NAOMI security PIC: Difference between revisions

From pcbotaku
Jump to navigationJump to search
← Older edit
No edit summary
No edit summary
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
[[category:Hardware]]
[[category:Hardware]]
[[category:Naomi]]
[[category:Naomi]]
[[PIC16F628A]] is pin compatible with original security pic's.


Settings when programming must include:
==PIC Settings==
[[PIC16F628A]] is pin and binary compatible with original security pic's, PIC16C621A/PIC16C622A .
 
*HS Osc for oscillator setting
*HS Osc for oscillator setting
FIG:3FA2H    Oscillator Type:HS    WDT:Disable Block Protect:Disable /PWRTE :Enable
*VDD=3.3V
*VDD=3.3V
*clkin pin 16 is fed from PCB 4.0MHz
*clkin pin 16 is fed 4.0MHz from PCB


==Tranfering data==
==Tranfering data==
Line 97: Line 94:
  e7a7667f 666b84d3 "  f fk  "  6b61696a 796f213f "kaijyo!?" 59.315ms
  e7a7667f 666b84d3 "  f fk  "  6b61696a 796f213f "kaijyo!?" 59.315ms
  98b83c96 4c4ea39d "  < LN  "  3a701f71 1f4c00'''01''' ":p q L  " 63.435ms
  98b83c96 4c4ea39d "  < LN  "  3a701f71 1f4c00'''01''' ":p q L  " 63.435ms
==Disassembly of a security PIC==
[http://pastebin.com/Wn33TXMk Taken from MAME]


==References==
==References==
http://debugmo.de/2008/05/pah-security/
http://debugmo.de/2008/05/pah-security/
http://www.ultimate-console.fr/=-Sega-naomi-1-/-2-=/=-G%C3%A9n%C3%A9rale-=/=-La-S%C3%A9curit%C3%A9-des-GDRoms-Naomi-=.html - great writeup in French


http://mamedev.org/source/src/mame/drivers/naomi.c.html
http://mamedev.org/source/src/mame/drivers/naomi.c.html


http://guru.mameworld.info/naomi/index.html
http://guru.mameworld.info/naomi/index.html

Latest revision as of 19:45, 14 September 2011


PIC Settings[edit]

PIC16F628A is pin and binary compatible with original security pic's, PIC16C621A/PIC16C622A .

  • HS Osc for oscillator setting
  • VDD=3.3V
  • clkin pin 16 is fed 4.0MHz from PCB

Tranfering data[edit]

used pins:

  • RB0 = bitA
  • RB1 = bitB
  • RB2 = bitC
  • RB3 = clock

A byte is transferred in 3 clock cycles like this: 

CYCLE 3               CYCLE2           CYBLE1
PARITY|BITB|BITA | BITC|BITB|BITA| BITC|BITB|BITA

Logic analyzer dump[edit]

The following is the output from a program I wrote to decode the traffic between the PIC and the Naomi. The encryption algorithm is pretty well documented in the mame source.

Error creating thumbnail: Unable to save thumbnail to destination

boot sequence, normal GD-ROM: 

7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 4.028ms
7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 6.745ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 10.773ms
bc7b59a4 b391c276 " {Y    v"   2177590e 391e3b69 "!wY 9 ;i" 11.299ms
f662284d 3c586acf " b(M<Xj "   3044494d 4d494430 "0DIMMID0" 15.021ms
e46e56af 80b3dd64 " nV    d"   22581b2f 312c315f ""X /1,1_" 15.532ms
a1c4869a 9a516ad4 "     Qj "   3144494d 4d494431 "1DIMMID1" 19.298ms
af6e833c 1eaedd6a " n <   j"   233a442f 312c315f "#:D/1,1_" 19.811ms
a0c4869a 9a51e7ce "     Q  "   3244494d 4d494432 "2DIMMID2" 23.537ms
cf775091 6176c5cc " wP av  "   43317374 72646630 "C1strdf0" 24.045ms
a5c680ae 3d58dc62 "    =X b"   35424359 2e42494e "5BCY.BIN" 27.937ms
d6775091 6176c5cd " wP av  "   44317374 72646631 "D1strdf1" 28.447ms
a4883f65 4f9aa39c "  ?eO   "   36000000 00000000 "6       " 32.384ms
d1bd82ae 904be759 "     K Y"   414b4559 434f4445 "AKEYCODE" 32.895ms
9fb9ce7a 49fc9a17 "   zI   "   334ff16d 1a9e0bfb "3O m    " 36.693ms
d09d628e 706bc779 "  b pk y"   426b6579 636f6465 "Bkeycode" 37.203ms
a63b3f65 4f9aa39c " ;?eO   "   34cd0000 00000000 "4       " 41.048ms
e7a7667f 666b84d3 "  f fk  "   6b61696a 796f213f "kaijyo!?" 41.558ms
98b83c96 4c9aa39c "  < L   "   3a701f71 1f000000 ":p q    " 45.679ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 60070.309ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 60074.289ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 120102.305ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 120106.289ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 180199.688ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 180203.656ms

Boot sequence, WCCF - a game loaded via network, only difference is 1 bit in the answer to kaijyo: 

7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 4.029ms
7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 4.615ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 8.643ms
bc7b59a4 b391c276 " {Y    v"   2177590e 391e3b69 "!wY 9 ;i" 9.162ms
f662284d 3c586acf " b(M<Xj "   3044494d 4d494430 "0DIMMID0" 12.884ms
e46e56af 80b3dd64 " nV    d"   22581b2f 312c315f ""X /1,1_" 13.394ms
a1c4869a 9a516ad4 "     Qj "   3144494d 4d494431 "1DIMMID1" 17.161ms
af6e833c 1eaedd6a " n <   j"   233a442f 312c315f "#:D/1,1_" 17.668ms
a0c4869a 9a51e7ce "     Q  "   3244494d 4d494432 "2DIMMID2" 21.393ms
d1bd82ae 904be759 "     K Y"   414b4559 434f4445 "AKEYCODE" 21.900ms
9f0a0a02 d209a75f "       _"   339ecde5 85910443 "3      C" 25.699ms
d09d628e 706bc779 "  b pk y"   426b6579 636f6465 "Bkeycode" 26.207ms
a6cb3f65 4f9aa39c "  ?eO   "   345d0000 00000000 "4]      " 30.050ms
e7a7667f 666b84d3 "  f fk  "   6b61696a 796f213f "kaijyo!?" 34.923ms
98b83c96 4c9aa39d "  < L   "   3a701f71 1f000001 ":p q    " 39.043ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 60055.508ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 60059.488ms

"netboot pic", with "network" answer to kaijyo! and a key of all zeroes: 

7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 4.029ms
7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 29.037ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 33.067ms
bc7b59a4 b391c276 " {Y    v"   2177590e 391e3b69 "!wY 9 ;i" 33.581ms
f662284d 3c586acf " b(M<Xj "   3044494d 4d494430 "0DIMMID0" 37.303ms
e46e56af 80b3dd64 " nV    d"   22581b2f 312c315f ""X /1,1_" 37.810ms
a1c4869a 9a516ad4 "     Qj "   3144494d 4d494431 "1DIMMID1" 41.576ms
af6e833c 1eaedd6a " n <   j"   233a442f 312c315f "#:D/1,1_" 42.078ms
a0c4869a 9a51e7ce "     Q  "   3244494d 4d494432 "2DIMMID2" 45.803ms
d1bd82ae 904be759 "     K Y"   414b4559 434f4445 "AKEYCODE" 46.304ms
9f883f65 4f9aa39c "  ?eO   "   33000000 00000000 "3       " 50.103ms
d09d628e 706bc779 "  b pk y"   426b6579 636f6465 "Bkeycode" 50.605ms
a6883f65 4f9aa39c "  ?eO   "   34000000 00000000 "4       " 54.449ms
e7a7667f 666b84d3 "  f fk  "   6b61696a 796f213f "kaijyo!?" 59.315ms
98b83c96 4c4ea39d "  < LN  "   3a701f71 1f4c0001 ":p q L  " 63.435ms

Disassembly of a security PIC[edit]

Taken from MAME

References[edit]

http://debugmo.de/2008/05/pah-security/

http://www.ultimate-console.fr/=-Sega-naomi-1-/-2-=/=-G%C3%A9n%C3%A9rale-=/=-La-S%C3%A9curit%C3%A9-des-GDRoms-Naomi-=.html - great writeup in French

http://mamedev.org/source/src/mame/drivers/naomi.c.html

http://guru.mameworld.info/naomi/index.html

Retrieved from "https://wiki.pcbotaku.com/wiki/index.php?title=NAOMI_security_PIC&oldid=156"