NAOMI security PIC: Difference between revisions

From pcbotaku
Jump to navigationJump to search
Newer edit →
Created page with "boot sequence, normal GD-ROM: 7b7f8587 55696491 "{ Uid " 62736563 5f766572 "bsec_ver" 0.000ms c55c6558 acabb9ce " \eX " 38564552 30303031 "8VER0001" 4.028ms 7b7f8587 ..."
 
No edit summary
Line 1: Line 1:
PIC18f628A is pin compatible with original security pic's, compatible settings include ExtRC/CLKOUT
*VDD=3.3V
*clkin pin 16 is fed from PCB 4.0MHz
Using
used pins:
*RB0 = bitA
*RB1 = bitB
*RB2 = bitC
*RB3 = clock
Bytes are transfered in 3 clock cycles, and ends up like this:
#BITA CYCLE0
#BITB CYCLE0
#BITC CYCLE0
#BITA CYCLE1
#BITB CYCLE1
#BITC CYCLE1
#BITA CYCLE2
#BITB CYCLE3
#PARITY
==Logic analyzer dump==
The following is the output from a program I wrote to decode the traffic between the PIC and the Naomi.  The encryption algorithm is pretty well documented in the mame source.
[[image:LA-securitypic.png]]
boot sequence, normal GD-ROM:
boot sequence, normal GD-ROM:
  7b7f8587 55696491 "{  Uid "  62736563 5f766572 "bsec_ver" 0.000ms
  7b7f8587 55696491 "{  Uid "  62736563 5f766572 "bsec_ver" 0.000ms
Line 27: Line 58:
  a3d482b8 833bde67 "    ; g"  37544553 545f4f4b "7TEST_OK" 180203.656ms
  a3d482b8 833bde67 "    ; g"  37544553 545f4f4b "7TEST_OK" 180203.656ms


Boot sequence, WCCF
Boot sequence, WCCF, only difference is 1 bit in the answer to kaijyo:


  7b7f8587 55696491 "{  Uid "  62736563 5f766572 "bsec_ver" 0.000ms
  7b7f8587 55696491 "{  Uid "  62736563 5f766572 "bsec_ver" 0.000ms
Line 47: Line 78:
  f1b46298 636abc7f "  b cj  "  61746573 74706963 "atestpic" 60055.508ms
  f1b46298 636abc7f "  b cj  "  61746573 74706963 "atestpic" 60055.508ms
  a3d482b8 833bde67 "    ; g"  37544553 545f4f4b "7TEST_OK" 60059.488ms
  a3d482b8 833bde67 "    ; g"  37544553 545f4f4b "7TEST_OK" 60059.488ms
==References==
http://debugmo.de/2008/05/pah-security/
http://mamedev.org/source/src/mame/drivers/naomi.c.html

Revision as of 23:03, 28 March 2011

PIC18f628A is pin compatible with original security pic's, compatible settings include ExtRC/CLKOUT

  • VDD=3.3V
  • clkin pin 16 is fed from PCB 4.0MHz

Using

used pins:

  • RB0 = bitA
  • RB1 = bitB
  • RB2 = bitC
  • RB3 = clock

Bytes are transfered in 3 clock cycles, and ends up like this:

  1. BITA CYCLE0
  2. BITB CYCLE0
  3. BITC CYCLE0
  4. BITA CYCLE1
  5. BITB CYCLE1
  6. BITC CYCLE1
  7. BITA CYCLE2
  8. BITB CYCLE3
  9. PARITY


Logic analyzer dump

The following is the output from a program I wrote to decode the traffic between the PIC and the Naomi. The encryption algorithm is pretty well documented in the mame source.

Error creating thumbnail: Unable to save thumbnail to destination

boot sequence, normal GD-ROM: 

7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 4.028ms
7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 6.745ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 10.773ms
bc7b59a4 b391c276 " {Y    v"   2177590e 391e3b69 "!wY 9 ;i" 11.299ms
f662284d 3c586acf " b(M<Xj "   3044494d 4d494430 "0DIMMID0" 15.021ms
e46e56af 80b3dd64 " nV    d"   22581b2f 312c315f ""X /1,1_" 15.532ms
a1c4869a 9a516ad4 "     Qj "   3144494d 4d494431 "1DIMMID1" 19.298ms
af6e833c 1eaedd6a " n <   j"   233a442f 312c315f "#:D/1,1_" 19.811ms
a0c4869a 9a51e7ce "     Q  "   3244494d 4d494432 "2DIMMID2" 23.537ms
cf775091 6176c5cc " wP av  "   43317374 72646630 "C1strdf0" 24.045ms
a5c680ae 3d58dc62 "    =X b"   35424359 2e42494e "5BCY.BIN" 27.937ms
d6775091 6176c5cd " wP av  "   44317374 72646631 "D1strdf1" 28.447ms
a4883f65 4f9aa39c "  ?eO   "   36000000 00000000 "6       " 32.384ms
d1bd82ae 904be759 "     K Y"   414b4559 434f4445 "AKEYCODE" 32.895ms
9fb9ce7a 49fc9a17 "   zI   "   334ff16d 1a9e0bfb "3O m    " 36.693ms
d09d628e 706bc779 "  b pk y"   426b6579 636f6465 "Bkeycode" 37.203ms
a63b3f65 4f9aa39c " ;?eO   "   34cd0000 00000000 "4       " 41.048ms
e7a7667f 666b84d3 "  f fk  "   6b61696a 796f213f "kaijyo!?" 41.558ms
98b83c96 4c9aa39c "  < L   "   3a701f71 1f000000 ":p q    " 45.679ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 60070.309ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 60074.289ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 120102.305ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 120106.289ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 180199.688ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 180203.656ms

Boot sequence, WCCF, only difference is 1 bit in the answer to kaijyo: 

7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 4.029ms
7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 4.615ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 8.643ms
bc7b59a4 b391c276 " {Y    v"   2177590e 391e3b69 "!wY 9 ;i" 9.162ms
f662284d 3c586acf " b(M<Xj "   3044494d 4d494430 "0DIMMID0" 12.884ms
e46e56af 80b3dd64 " nV    d"   22581b2f 312c315f ""X /1,1_" 13.394ms
a1c4869a 9a516ad4 "     Qj "   3144494d 4d494431 "1DIMMID1" 17.161ms
af6e833c 1eaedd6a " n <   j"   233a442f 312c315f "#:D/1,1_" 17.668ms
a0c4869a 9a51e7ce "     Q  "   3244494d 4d494432 "2DIMMID2" 21.393ms
d1bd82ae 904be759 "     K Y"   414b4559 434f4445 "AKEYCODE" 21.900ms
9f0a0a02 d209a75f "       _"   339ecde5 85910443 "3      C" 25.699ms
d09d628e 706bc779 "  b pk y"   426b6579 636f6465 "Bkeycode" 26.207ms
a6cb3f65 4f9aa39c "  ?eO   "   345d0000 00000000 "4]      " 30.050ms
e7a7667f 666b84d3 "  f fk  "   6b61696a 796f213f "kaijyo!?" 34.923ms
98b83c96 4c9aa39d "  < L   "   3a701f71 1f000001 ":p q    " 39.043ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 60055.508ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 60059.488ms

References

http://debugmo.de/2008/05/pah-security/ http://mamedev.org/source/src/mame/drivers/naomi.c.html

Retrieved from "https://wiki.pcbotaku.com/wiki/index.php?title=NAOMI_security_PIC&oldid=53"