Naomi CF boot

The NAOMI (including Chihiro and Triforce) Compact Flash solution is a 'drop in' replacement for the GD-ROM system. The setup includes:

• Compact Flash reader unit (Sega Japan made, with common SCSI style interface connector and 5 pin GD-ROM power header)
• Firmware update GD-ROM (specific to system for included game only)
• Security PIC
• Compact Flash card with encrypted game image (manufactured by Hagiwara Sys-Com)

The solution appears to be exclusive the UK.

For the Naomi, a version of the firmware that bypasses the check for Hagiwara Sys-Com cards exists. This version is "hacked", as the upgrade says 4.02, but the serial port output still reports the version to be gcxb-2.0.0 v4.01/v4.00 on start up.

Step 1 - get the magic key

All ATA devices have a 512 byte structure that contains among other things, a 20 byte serial number represented in ASCII. The 3rd and 4th to the last ASCII characters, in hex, is used as the seed in this protection scheme/maze (offset 0x24 and 0x25 in the 512 byte block). This is to prevent CF cards from simply being copied. You can use out-of-the-box utilities in Linux to get this data, but the CF card has to be attached to an actual IDE bus - USB card readers don't support this. In the example below, this seed key is 0x3037 (or ASCII "07").

Get part of serial number with smartctl

smartctl -r ataioctl,2 -i /dev/sda

smartctl 5.40 2010-03-16 r3077 [x86_64-unknown-linux-gnu] (local build)
Copyright (C) 2002-10 by Bruce Allen, http://smartmontools.sourceforge.net


REPORT-IOCTL: Device=/dev/sda Command=IDENTIFY DEVICE
 Input:   FR=...., SC=0x01, LL=...., LM=...., LH=...., DEV=...., CMD=0xec IN
REPORT-IOCTL: Device=/dev/sda Command=IDENTIFY DEVICE returned 0

===== [IDENTIFY DEVICE] DATA START (BASE-16) =====
000-015: 5a 04 ef 03 00 00 10 00 00 00 00 02 3f 00 0f 00 |Z...........?...|
016-031: 10 7d 00 00 31 30 36 31 30 46 39 30 32 43 41 30 |.}..10610F902CA0|
032-047: 30 30 30 30 37 30 36 36 01 00 01 00 04 00 55 59 |00007066......UY|
048-063: 4e 41 30 31 36 32 31 35 4d 32 20 42 4b 43 20 53 |NA016215M2 BKC S|
064-079: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |                |
080-095: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 01 00 |              ..|
096-111: 00 00 00 0f 00 00 00 02 00 00 07 00 ef 03 10 00 |................|
112-127: 3f 00 10 7d 0f 00 00 01 10 7d 0f 00 00 00 01 00 |?..}.....}......|
128-143: 03 00 e0 01 e0 01 78 00 78 00 00 00 00 00 00 00 |......x.x.......|
144-159: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
160-175: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
176-191: 1f 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
192-207: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
208-223: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
224-239: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
240-255: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
256-271: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
272-287: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
288-303: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
304-319: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
320-335: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
336-351: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
352-367: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
368-383: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
384-399: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
400-415: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
416-431: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
432-447: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
448-463: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
464-479: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
480-495: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
496-511: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
===== [IDENTIFY DEVICE] DATA END (512 Bytes) =====

=== START OF INFORMATION SECTION ===
Device Model:     512MB CKS
Serial Number:    0116F009C20A00000766
Firmware Version: YUAN1026
User Capacity:    519,708,672 bytes
Device is:        Not in smartctl database [for details use: -P showall]
ATA Version is:   [No Information Found]
ATA Standard is:  [No Information Found]
Local Time is:    Sun Apr 24 22:28:55 2011 CEST
SMART support is: Ambiguous - ATA IDENTIFY DEVICE words 82-83 don't show if SMART supported.
A mandatory SMART command failed: exiting. To continue, add one or more '-T permissive' options.

Get part of the serial number with hdparm

hdparm --Istdout /dev/sda

/dev/sda:
045a 03ef 0000 0010 0000 0200 003f 000f
7d10 0000 3031 3136 4630 3039 4332 3041
3030 3030 3037 3636 0001 0001 0004 5955
414e 3130 3236 3531 324d 4220 434b 5320
2020 2020 2020 2020 2020 2020 2020 2020
2020 2020 2020 2020 2020 2020 2020 0001
0000 0f00 0000 0200 0000 0007 03ef 0010
003f 7d10 000f 0100 7d10 000f 0000 0001
0003 01e0 01e0 0078 0078 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
041f 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000

---

The following started out as something copy/pasted (see document history), and expanded with detail as investigation ensued.

1. Read ATA IDENTIFY DEVICE data.
2. Read 2 bytes of the CF serial number (offset +0x24 in the identify structure). [This means games are locked to a specific card, i.e. copying data from one official Sega card to another official Sega card most likely won't work, unless by extreme coincidence the 2 bytes read have identical values.]
3. Use these 2 bytes as a word, and add 0x20 to the value. This resulting value will give the location of the xor "key" data sector.
4. Go to that sector, and xor this data (byte by byte) with the data in encrypted sector 0x277.
5. Use the same two bytes of the serial number as above as a word, but this time add 0x19.
6. Go to that sector, compute a sum of 32-bit dwords, accumulating in a 32-bit dword.
7. This value (byteswapped) must match the 32-bit dword stored at offset 0x38 in sector 0x1D7.
8. The 8-byte manufacturer ID must match a specific value. [Hagiwara Sys-Com cards only.]