tag:blogger.com,1999:blog-8885424693097849748.post6456214906335535241..comments2023-05-18T17:56:27.780+02:00Comments on Breaking CPS3: Do you know these versions??La pastilla roja de matrixhttp://www.blogger.com/profile/13971666923005470207noreply@blogger.comBlogger11125tag:blogger.com,1999:blog-8885424693097849748.post-71629569178189104422011-12-17T20:18:37.149+01:002011-12-17T20:18:37.149+01:00Another nice pic of the developer's menu, even...Another nice pic of the developer's menu, even better than windows :)<br /><br />http://tinypic.com/view.php?pic=dm5u6d&s=5La pastilla roja de matrixhttps://www.blogger.com/profile/13971666923005470207noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-20004505750543190872011-12-17T19:26:36.324+01:002011-12-17T19:26:36.324+01:00Agree!Agree!La pastilla roja de matrixhttps://www.blogger.com/profile/13971666923005470207noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-64023234710361647492011-12-17T19:15:56.407+01:002011-12-17T19:15:56.407+01:00To be honest, I doubt that it is possible to re-wr...To be honest, I doubt that it is possible to re-write the security data on to carts using normal CPS3 hardware. It's likely that specific servicing hardware is required for this task.<br /><br />This was certainly the case for CPS2 boards, for example:<br /><br />http://ctx.me/l<br />http://ctx.me/mIan Court (idc/Team Avalaunch)https://www.blogger.com/profile/02115593654109664020noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-23492455387806130112011-12-17T18:29:33.871+01:002011-12-17T18:29:33.871+01:00For the curios ones, this is how you go to the &qu...For the curios ones, this is how you go to the "special menu". Notice that the menu code is being run from the BIOS.<br /><br />http://tinypic.com/view.php?pic=29egfw9&s=5La pastilla roja de matrixhttps://www.blogger.com/profile/13971666923005470207noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-43433007888871039272011-12-17T18:03:39.390+01:002011-12-17T18:03:39.390+01:00Some more pics here....
http://tinypic.com/view.ph...Some more pics here....<br />http://tinypic.com/view.php?pic=14j12qt&s=5<br />http://tinypic.com/view.php?pic=116kyuw&s=5<br />http://tinypic.com/view.php?pic=9sfi3c&s=5La pastilla roja de matrixhttps://www.blogger.com/profile/13971666923005470207noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-88873058151941402572011-12-17T17:23:11.063+01:002011-12-17T17:23:11.063+01:00Ehem, ehem....do you mean this???
hhttp://tinypic...Ehem, ehem....do you mean this???<br /><br />hhttp://tinypic.com/view.php?pic=sy448y&s=5<br />http://tinypic.com/view.php?pic=fla6nt&s=5<br />http://tinypic.com/view.php?pic=2dtvgjq&s=5<br /><br />You can make many things from there, even copy content from one SIMM to another, but definitely, you can't bring back to life a cartridge, as the menu itself is in the cartridge and needs to be decrypted. <br /><br />The only way I see to solve this, is by checking if there is real traffic going on between SH2<-->BIOS and SH2<-->CPSIII Board.<br /><br />Me lazy, will eventually set the signal analyzer setup one day and bring will hopefully some light to this....La pastilla roja de matrixhttps://www.blogger.com/profile/13971666923005470207noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-84437029418190137352011-12-17T14:32:59.502+01:002011-12-17T14:32:59.502+01:00I'm not even certain that the secret menu is p...I'm not even certain that the secret menu is present in the carts for all games is it? I know 3rd Strike has it, but I'm not sure the others do. Please correct me if I'm mistaken.<br /><br />SECURITY CASSETTE UTILITY MENU Ver 2.00<br />1. FLASH MEMORY<br />2. DISK & FILES<br />3. GAME BOOT<br />4. EXIT<br />SELECT = 1P UP or DOWN<br />START = 1P SHOT1<br />2 . D I S K & F I L E S<br />VOLUME LABEL:<br />PATH:<br />ENTRIES<br />EXIT = 1P START & SHOT1<br />1. DISK DUMP<br />2. EJECT MEDIUM<br />3. DEVICE INFORMATION<br />1. EXECUTE AS MACRO<br />2. WRITE TO FLASH MEMORY<br />3. CHECKSUM<br />4. FILE DUMP<br />5. LOAD AS MS-BITMAP<br />1. ONBOARD<br />2. SIMM1<br />3. SIMM2<br />4. SIMM3<br />5. SIMM4<br />6. SIMM5<br />7. SIMM6<br />8. SIMM7<br />START OFFSET = 00000000<br />E X E C U T E M A C R O<br />FILENAME SIMM OFFSET RESULT<br /> CANCEL = 1P START<br />D I S K D U M P<br /> BLOCK = XXXXXXXX BLOCK SIZE = XXXXXXXX<br />OFFSET +0 +2 +4 +6 01234567<br />DEVELOPER'S SECURITY CASSETTE UTILITY Ver 2.00a<br />PROPERTIES <br /> GAME: UNKNOWN<br /> CODE:<br />STATUS:<br />1P START = NEXT MODE<br />BOARD<br />SIMM1 <br />SIMM2 <br />SIMM3 <br />SIMM4 <br />SIMM5 <br />SIMM6 <br />SIMM7 <br /> <br />FUJITSU <br />Intel/SHARP<br />HITACHI <br />MXIC <br /> <br />ERASED <br />WRITTENIan Court (idc/Team Avalaunch)https://www.blogger.com/profile/02115593654109664020noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-29698492662715098702011-12-17T09:54:07.725+01:002011-12-17T09:54:07.725+01:00@Guru, I was looking for that routine and I couln&...@Guru, I was looking for that routine and I couln't find it. I even discussed the issue with Elsemi. Can you please point to the person who found this menu? If this exists, I commit to find the combinations to get there!La pastilla roja de matrixhttps://www.blogger.com/profile/13971666923005470207noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-45370219172302768652011-12-17T05:10:16.749+01:002011-12-17T05:10:16.749+01:00Looks like you have not found the secret cart
re-...Looks like you have not found the secret cart <br />re-programming menu? That's probably a better <br />way to proceed rather than hacking the code <br />just re-program a dead cart with the security <br />data which will probably be in the flashrom in <br />the cart. <br /><br />While your method is impressive the main problem remains which is dead security carts. Finding a <br />way to solve the dead security cart issue should <br />be the main task.... and Capcom have provided it <br />with the secret menu. You just need to find a way <br />to unlock it.<br /><br />Mamedev found the secret menu by forcing a jump <br />in the BIOS code (IIRC) but the method to access <br />the menu on real hardware was not found.<br /><br /><br /><br />Guru<br />http://guru.mameworld.infoGuruhttps://www.blogger.com/profile/16002130690657503556noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-67059103425116263202011-12-17T04:59:06.861+01:002011-12-17T04:59:06.861+01:00This comment has been removed by the author.Guruhttps://www.blogger.com/profile/16002130690657503556noreply@blogger.comtag:blogger.com,1999:blog-8885424693097849748.post-20400217470982780772011-12-17T00:47:45.875+01:002011-12-17T00:47:45.875+01:00Woah, nice work! Extremely fast progress, I can ba...Woah, nice work! Extremely fast progress, I can barely keep up! ;)<br /><br />This will be excellent news for owners of Asia 3rd Strike carts, if the tool can recreate 3S -> 3S ISO but switch only the region. That way, the game can run as a region other than Asia, with full speech samples (no more "huh" instead of "hadouken").<br /><br />One of the next things on the list I guess will be fixed ROM checksums in the test menu. :)Ian Court (idc/Team Avalaunch)https://www.blogger.com/profile/02115593654109664020noreply@blogger.com