NAOMI security PIC

PIC18F628A is pin compatible with original security pic's, compatible settings include ExtRC/CLKOUT

• VDD=3.3V
• clkin pin 16 is fed from PCB 4.0MHz

Tranfering data

used pins:

• RB0 = bitA
• RB1 = bitB
• RB2 = bitC
• RB3 = clock

A Bytes is transferred in 3 clock cycles like this:

CYCLE 3               CYCLE2           CYBLE1
PARITY|BITB|BITA | BITC|BITB|BITA| BITC|BITB|BITA

Logic analyzer dump

The following is the output from a program I wrote to decode the traffic between the PIC and the Naomi. The encryption algorithm is pretty well documented in the mame source.

Error creating thumbnail: Unable to save thumbnail to destination

boot sequence, normal GD-ROM:

7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 4.028ms
7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 6.745ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 10.773ms
bc7b59a4 b391c276 " {Y    v"   2177590e 391e3b69 "!wY 9 ;i" 11.299ms
f662284d 3c586acf " b(M<Xj "   3044494d 4d494430 "0DIMMID0" 15.021ms
e46e56af 80b3dd64 " nV    d"   22581b2f 312c315f ""X /1,1_" 15.532ms
a1c4869a 9a516ad4 "     Qj "   3144494d 4d494431 "1DIMMID1" 19.298ms
af6e833c 1eaedd6a " n <   j"   233a442f 312c315f "#:D/1,1_" 19.811ms
a0c4869a 9a51e7ce "     Q  "   3244494d 4d494432 "2DIMMID2" 23.537ms
cf775091 6176c5cc " wP av  "   43317374 72646630 "C1strdf0" 24.045ms
a5c680ae 3d58dc62 "    =X b"   35424359 2e42494e "5BCY.BIN" 27.937ms
d6775091 6176c5cd " wP av  "   44317374 72646631 "D1strdf1" 28.447ms
a4883f65 4f9aa39c "  ?eO   "   36000000 00000000 "6       " 32.384ms
d1bd82ae 904be759 "     K Y"   414b4559 434f4445 "AKEYCODE" 32.895ms
9fb9ce7a 49fc9a17 "   zI   "   334ff16d 1a9e0bfb "3O m    " 36.693ms
d09d628e 706bc779 "  b pk y"   426b6579 636f6465 "Bkeycode" 37.203ms
a63b3f65 4f9aa39c " ;?eO   "   34cd0000 00000000 "4       " 41.048ms
e7a7667f 666b84d3 "  f fk  "   6b61696a 796f213f "kaijyo!?" 41.558ms
98b83c96 4c9aa39c "  < L   "   3a701f71 1f000000 ":p q    " 45.679ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 60070.309ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 60074.289ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 120102.305ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 120106.289ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 180199.688ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 180203.656ms

Boot sequence, WCCF, only difference is 1 bit in the answer to kaijyo:

7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 0.000ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 4.029ms
7b7f8587 55696491 "{   Uid "   62736563 5f766572 "bsec_ver" 4.615ms
c55c6558 acabb9ce " \eX    "   38564552 30303031 "8VER0001" 8.643ms
bc7b59a4 b391c276 " {Y    v"   2177590e 391e3b69 "!wY 9 ;i" 9.162ms
f662284d 3c586acf " b(M<Xj "   3044494d 4d494430 "0DIMMID0" 12.884ms
e46e56af 80b3dd64 " nV    d"   22581b2f 312c315f ""X /1,1_" 13.394ms
a1c4869a 9a516ad4 "     Qj "   3144494d 4d494431 "1DIMMID1" 17.161ms
af6e833c 1eaedd6a " n <   j"   233a442f 312c315f "#:D/1,1_" 17.668ms
a0c4869a 9a51e7ce "     Q  "   3244494d 4d494432 "2DIMMID2" 21.393ms
d1bd82ae 904be759 "     K Y"   414b4559 434f4445 "AKEYCODE" 21.900ms
9f0a0a02 d209a75f "       _"   339ecde5 85910443 "3      C" 25.699ms
d09d628e 706bc779 "  b pk y"   426b6579 636f6465 "Bkeycode" 26.207ms
a6cb3f65 4f9aa39c "  ?eO   "   345d0000 00000000 "4]      " 30.050ms
e7a7667f 666b84d3 "  f fk  "   6b61696a 796f213f "kaijyo!?" 34.923ms
98b83c96 4c9aa39d "  < L   "   3a701f71 1f000001 ":p q    " 39.043ms
f1b46298 636abc7f "  b cj  "   61746573 74706963 "atestpic" 60055.508ms
a3d482b8 833bde67 "     ; g"   37544553 545f4f4b "7TEST_OK" 60059.488ms

References

http://debugmo.de/2008/05/pah-security/

http://mamedev.org/source/src/mame/drivers/naomi.c.html