i did not create this guide and i suspect its incomplete.
this infomation should be out and to that end i release what info i have.
Monday, November 14, 2011
to actually create CF images is a complicated process, it isn't a case of just copying a file.
-- From Android -- Grin
About the Protection mecanism of the compact flash......
The thinks are always on the same place, on the card, and all is based on 2 bytes that you read from the ATA Identify command, and 8 bytes Manufacturer card.
Is important EVER, start with a card fresly formatted with FAT16, because in this way, the sector adress of the mecanism, always correspond to the same adresses inside the game file.
Do you need to read the 20 digits Serial number, returned by the Ata Identify command.
This serial number, is different from card to card, but the first 10 bytes are ever the same in all the 4 Sega cards I have, so I supossed it will be ever the same.
At adress 0x24 of the readed 256 bytes structur there is an ASCII value of "00" that minds the value is 0x3030, this is the same for all the Sega CF cards that I have and is the value used as offset for calculate the position of the protection elements inside the card.
For put a new game,
1)You need to format the card with FAT.
2) open GAME.BIN (binary file of the game, desencrypted) and make a CRC32 of it.
3) Get the result and make a XOR 0xFFFFFFFF
4) open a header file, ABC.bin and store the result of the CRC32 calculation at adress 0x08-0x0B, the order of the CRC32 is first low byte and last high byte.
2) copy to the CF card the ABC.bin (File containing the header for the game)
If all is ok, the ABC.bin, will start at sector 520 of the CF card and GAME.bin will start at sector 536 of the CF card, this is very important because if not, the adresses of the game that we need to patch, will change
So you need to go to sector 0x3030 +0x20-> 0x3050-> Sector 12368, that corresponds to the GAME.bin adress of ((12368-536)*512= 0x5C7000 (this is ever the same, if your game starts at secor 536 of the CF card), copy this 256 bytes to a File
The go to sector 0x277-> Sector 631-> that corresponds to the Game.bin adress of (631-536)*512 =0x0BE00-0x0BFFF, copy this 256 bytes to a second file.
Make a XOR of the two 512 files using a program like XORIT.
Then you overwrite the data at 0xBE00-0xBFFF of the game with the data result of the XORIT program and save to Game.bin
Copy the GAME.bin to the card.
This is the first part of the protection mechanism, now the game will be loaded successfully on the Naomi, Trifrorce or Chihiro, but after 5 minutes the Naomi will reset with error 26 mediaboard malfunction.
Now the second part of the protection mechanism, consist of make a Checksum of one sector of the Game.bin and store this checksum in the CF, but outside the game.bin and abc.bin (header file), this will link the game to the CF card, and by this way is imposible to copy only the game files to another card, as this will trigger the 2 protection mechanism.
So for acomplish this part, is necesarry to go to sector 0x3030+0x19=0x3049 --> 12361 game.bin adress of (12361-536)*512=0x5C6200-0x5c63FF.
You need to get this sector and make a 32 bytes checksum, by addding the data as 32 bytes DWORD, with a result of 32 Bytes DWORD.
Is important that the data is get 4 bytes at a time as this ---> B1*256*256*256+B2*256*256+B3*256+B4 and this is stored in a 32Bytes DWORD and added to the next 4 bytes.
The result of the sum of the 512 bytes in 4 bytes packets, will be stored in the card sector 0x1D7-->sector 471 offest 0x38 with is located at the second copy of the fat.
For store this value, you need to open the card with winhex and then go to the sector 471 and at offeset 471 store the 4 bytes checksum, first low byte and last highest byte.
About the Protection mecanism of the compact flash......
The thinks are always on the same place, on the card, and all is based on 2 bytes that you read from the ATA Identify command, and 8 bytes Manufacturer card.
Is important EVER, start with a card fresly formatted with FAT16, because in this way, the sector adress of the mecanism, always correspond to the same adresses inside the game file.
Do you need to read the 20 digits Serial number, returned by the Ata Identify command.
This serial number, is different from card to card, but the first 10 bytes are ever the same in all the 4 Sega cards I have, so I supossed it will be ever the same.
At adress 0x24 of the readed 256 bytes structur there is an ASCII value of "00" that minds the value is 0x3030, this is the same for all the Sega CF cards that I have and is the value used as offset for calculate the position of the protection elements inside the card.
For put a new game,
1)You need to format the card with FAT.
2) open GAME.BIN (binary file of the game, desencrypted) and make a CRC32 of it.
3) Get the result and make a XOR 0xFFFFFFFF
4) open a header file, ABC.bin and store the result of the CRC32 calculation at adress 0x08-0x0B, the order of the CRC32 is first low byte and last high byte.
2) copy to the CF card the ABC.bin (File containing the header for the game)
If all is ok, the ABC.bin, will start at sector 520 of the CF card and GAME.bin will start at sector 536 of the CF card, this is very important because if not, the adresses of the game that we need to patch, will change
So you need to go to sector 0x3030 +0x20-> 0x3050-> Sector 12368, that corresponds to the GAME.bin adress of ((12368-536)*512= 0x5C7000 (this is ever the same, if your game starts at secor 536 of the CF card), copy this 256 bytes to a File
The go to sector 0x277-> Sector 631-> that corresponds to the Game.bin adress of (631-536)*512 =0x0BE00-0x0BFFF, copy this 256 bytes to a second file.
Make a XOR of the two 512 files using a program like XORIT.
Then you overwrite the data at 0xBE00-0xBFFF of the game with the data result of the XORIT program and save to Game.bin
Copy the GAME.bin to the card.
This is the first part of the protection mechanism, now the game will be loaded successfully on the Naomi, Trifrorce or Chihiro, but after 5 minutes the Naomi will reset with error 26 mediaboard malfunction.
Now the second part of the protection mechanism, consist of make a Checksum of one sector of the Game.bin and store this checksum in the CF, but outside the game.bin and abc.bin (header file), this will link the game to the CF card, and by this way is imposible to copy only the game files to another card, as this will trigger the 2 protection mechanism.
So for acomplish this part, is necesarry to go to sector 0x3030+0x19=0x3049 --> 12361 game.bin adress of (12361-536)*512=0x5C6200-0x5c63FF.
You need to get this sector and make a 32 bytes checksum, by addding the data as 32 bytes DWORD, with a result of 32 Bytes DWORD.
Is important that the data is get 4 bytes at a time as this ---> B1*256*256*256+B2*256*256+B3*256+B4 and this is stored in a 32Bytes DWORD and added to the next 4 bytes.
The result of the sum of the 512 bytes in 4 bytes packets, will be stored in the card sector 0x1D7-->sector 471 offest 0x38 with is located at the second copy of the fat.
For store this value, you need to open the card with winhex and then go to the sector 471 and at offeset 471 store the 4 bytes checksum, first low byte and last highest byte.
Monday, December 13, 2010
Tuesday, February 16, 2010
Friday, October 9, 2009
Thursday, March 19, 2009
Saturday, October 4, 2008
when companies get too full of themself.
some time ago i was given a usb harware encryption key. since it been a while since i used it i wanted to get the free software and drivers that should be with it.
the key had the download info attached. (see pic)
when i headed to the page the i got a 404.
after some digging around. it seems the company said email them for a password to download. so i did and what follows is what happened
> Juan,
> I'll be happy to send you the download password. First, can you tell me
> when you purchased your A-Key, which model it ism and who you purchased it
> from?
> Thanks, David
they started gilling me for info they did not need nor was i should not have gave.
so i sent
"your company sent me it!!!
it said nothing about a password begging session on the keychain
all it said was "to use your authenex a-key go to www.authenex.com/demopack"
this website page was removed some weird reason. so can i get this password
since somehow a password begging session seems to be company policy.
so to sound gruff but all this doesnt endear good ideas about future
purchases.
"
so they responded
"Juan,
Nobody is asking you to beg for the password. I simply asked you to supply
some basic information. When did we send you the key? Can you please
provide the ESN (serial number) from the back of the key.
We discontinued sales of ASafe and HDLock over a year ago and that is why I
asked when you got the key and where you got it from. I didn't see your
name on any Purchase order from the last 2.5 years - maybe you received the
key from your company or a distributor. If you did purchase the key
legitimately and you are an Authenex customer, then there should be no
problem answering the questions I asked in the same time it took you to send
the last email. And you would have the download by now.
David
Authenex Support
"
now doesnt this sound like they are demanding too much for a compnay that gave away these for free?
being tied of the bullshit i gave in.
"i was sent it by your company.
esn is 123123-231312
what else should i provide? to get the removed download from your site?
"
for security i should never have gave the seed key number. but i wanted to use this and this stupid company demanded nothing less.
so after the begging session finally worked
"
Go to http://support.authenex.com, login and click the "downloads" link.
Find your A-Safe V2.01 dwonload. Your password is s3cur1tY. Let me know if
you have any problem.
Authenex Support
"
download it if you need it
the key had the download info attached. (see pic)
when i headed to the page the i got a 404.
after some digging around. it seems the company said email them for a password to download. so i did and what follows is what happened
> Juan,
> I'll be happy to send you the download password. First, can you tell me
> when you purchased your A-Key, which model it ism and who you purchased it
> from?
> Thanks, David
they started gilling me for info they did not need nor was i should not have gave.
so i sent
"your company sent me it!!!
it said nothing about a password begging session on the keychain
all it said was "to use your authenex a-key go to www.authenex.com/demopack"
this website page was removed some weird reason. so can i get this password
since somehow a password begging session seems to be company policy.
so to sound gruff but all this doesnt endear good ideas about future
purchases.
"
so they responded
"Juan,
Nobody is asking you to beg for the password. I simply asked you to supply
some basic information. When did we send you the key? Can you please
provide the ESN (serial number) from the back of the key.
We discontinued sales of ASafe and HDLock over a year ago and that is why I
asked when you got the key and where you got it from. I didn't see your
name on any Purchase order from the last 2.5 years - maybe you received the
key from your company or a distributor. If you did purchase the key
legitimately and you are an Authenex customer, then there should be no
problem answering the questions I asked in the same time it took you to send
the last email. And you would have the download by now.
David
Authenex Support
"
now doesnt this sound like they are demanding too much for a compnay that gave away these for free?
being tied of the bullshit i gave in.
"i was sent it by your company.
esn is 123123-231312
what else should i provide? to get the removed download from your site?
"
for security i should never have gave the seed key number. but i wanted to use this and this stupid company demanded nothing less.
so after the begging session finally worked
"
Go to http://support.authenex.com, login and click the "downloads" link.
Find your A-Safe V2.01 dwonload. Your password is s3cur1tY. Let me know if
you have any problem.
Authenex Support
"
download it if you need it
Subscribe to:
Posts (Atom)