Showing posts with label cps3 encryption phoenix suicided. Show all posts
Showing posts with label cps3 encryption phoenix suicided. Show all posts

Tuesday, August 9, 2011

CRCs are history

I start debugging and getting into the program. I don't know the rest of debuggers out there, but at least in my case, debugging is like programming, in the sense that it takes some time to get into the program and be really productive, so you can't just work in sessions of half an hour.

A couple of days later (overnight which is when I usually can work more than 20 minutes without interrumptions)  I have found all the CRC checks.

There are a couple of interesting things in the CRC checks.
First is that there are several CRC checks and they go in blocks. Files 30 and 31 have a common CRC so I just need to modify the 31 and the test will go OK for files 30 and 31. The same goes for 40 and 41, 50 and 51 as well as 60 and 61(4 checks in total in the longest game)

Secondi is that files 10 and 20 have an independent CRC so I should change the CRC both in files 10 and 20.
Another interesting thing is that there are only 6 types of cartridges. If the key is the same, the CRC check is the same. The BIOS may change, but the keys and the CRC are the same independently of country and revision.

After that I have modified my c program and now I just enter the input version and the output cartridge and I get all files re-encrypted and with the right CRC. The ISO modifying process is still manual though.

I have done several tests like Warzard/Red Earth running on SFIII New Gen Cartridge or JOJO Bizarre adventure running in SFIII-3 cartridge. I have done many more tests in MAME which work OK but only those two in the real thing.

I have ordered several memories to enlarge my SFIII Newgen board and I'll convert all 6 games for this cartridge which is one of the earliest. This will eventually proof that games can independently of the cartridge model.

In the meanwhile, I'm creating an unencrypted BIOS that will skip all the CRC and CD Checks so that will accept any CD and any CRC Check. If I manage to get this BIOS without encryption(I don't mean with the keys to 0's but just unencrypted) running on a recompiled version of MAME we will be very close to a phoenix cartridge. I'm about to order a socket for the 29F400 so I can reprogramm it many times without the hassle of soldering. If someone has some tips about how to make many tests on a 29f400 eprom please advice.

Expect more news sometime soon.