Naomi CF boot: Difference between revisions
From pcbotaku
Jump to navigationJump to search
No edit summary |
mNo edit summary |
||
| Line 15: | Line 15: | ||
---- | ---- | ||
The following is copy/pasted | The following is copy/pasted with minor modifications from an unknown source. | ||
#Read ATA IDENTIFY DEVICE data. | #Read ATA IDENTIFY DEVICE data. | ||
| Line 22: | Line 22: | ||
#Go to that sector, and xor this data (byte by byte) with the data in encrypted sector 0x277. | #Go to that sector, and xor this data (byte by byte) with the data in encrypted sector 0x277. | ||
#Use the same two bytes of the serial number as above as a word, but this time add 0x19. | #Use the same two bytes of the serial number as above as a word, but this time add 0x19. | ||
#Go to that sector, compute a sum of | #Go to that sector, compute a sum of 32-bit dwords, accumulating in a 32-bit dword. | ||
#This value must match the 32-bit dword stored at offset 0x38 in sector 0x1D7. | #This value (byteswapped) must match the 32-bit dword stored at offset 0x38 in sector 0x1D7. | ||
#The 8-byte manufacturer ID must match a specific value. [Hagiwara Sys-Com cards only.] | #The 8-byte manufacturer ID must match a specific value. [Hagiwara Sys-Com cards only.] | ||
Revision as of 14:25, 24 April 2011
The NAOMI (including Chihiro and Triforce) Compact Flash solution is a 'drop in' replacement for the GD-ROM system. The setup includes:
- Compact Flash reader unit (Sega Japan made, with common SCSI style interface connector and 5 pin GD-ROM power header)
- Firmware update GD-ROM (specific to system for included game only)
- Security PIC
- Compact Flash card with encrypted game image (manufactured by Hagiwara Sys-Com)
The solution appears to be exclusive the UK.
For the Naomi, a version of the firmware that bypasses the check for Hagiwara Sys-Com cards exists. This version is "hacked", as the upgrade says 4.02, but the serial port output still reports the version to be gcxb-2.0.0 v4.01/v4.00 on start up.
The following is copy/pasted with minor modifications from an unknown source.
- Read ATA IDENTIFY DEVICE data.
- Read 2 bytes of the CF serial number (offset +0x24 in the identify structure). [This means games are locked to a specific card, i.e. copying data from one official Sega card to another official Sega card most likely won't work, unless by extreme coincidence the 2 bytes read have identical values.]
- Use these 2 bytes as a word, and add 0x20 to the value. This resulting value will give the location of the xor "key" data sector.
- Go to that sector, and xor this data (byte by byte) with the data in encrypted sector 0x277.
- Use the same two bytes of the serial number as above as a word, but this time add 0x19.
- Go to that sector, compute a sum of 32-bit dwords, accumulating in a 32-bit dword.
- This value (byteswapped) must match the 32-bit dword stored at offset 0x38 in sector 0x1D7.
- The 8-byte manufacturer ID must match a specific value. [Hagiwara Sys-Com cards only.]
