Sega Saturn CD – Cracked after 20 years (2016) [video](youtube.com)
youtube.com
Sega Saturn CD – Cracked after 20 years (2016) [video]
https://www.youtube.com/watch?v=jOyfZex7B3E
39 comments
It was also possible to copy games using a cd burner and boot them without any mod chip.
During the boot process the Saturn would check the drive for an authentic disc. Once the check passed, the drive paused and prepared to boot the game.
At this point of pause you could swap the authentic disc to a completely different pirated game (one burned onto a normal CD-R that would fail the first boot check).. Timing the swap correctly, the Saturn would play the pirated game.
During the boot process the Saturn would check the drive for an authentic disc. Once the check passed, the drive paused and prepared to boot the game.
At this point of pause you could swap the authentic disc to a completely different pirated game (one burned onto a normal CD-R that would fail the first boot check).. Timing the swap correctly, the Saturn would play the pirated game.
Right, the Saturn just like early versions of the PS1 had an opening for the famous "swap trick". I never used it myself other than on the PS1.
IIRC you could do something similar with Action Replay, you would load into the Action Replay UI, swap out the disc and then boot into a pirated game
If you had the action replay cart, you could just leave it in and it would bypass the check altogether. I played burnt discs aplenty on my Saturn.
Simply not true. I own several Saturns and action replays since the 90's.
The Pseudo Saturn Action reply hack to circumvent disc checks was only within recent years released.
The Pseudo Saturn Action reply hack to circumvent disc checks was only within recent years released.
Weird. I definitely had a bog-standard Action Replay and most certainly played burnt discs. Perhaps my console was hardmodded, without my knowledge.
(Also, someone had downvoted you, which I disagree with completely. If I'm wrong, I'm wrong. So, here's an upvote to balance it out.)
(Also, someone had downvoted you, which I disagree with completely. If I'm wrong, I'm wrong. So, here's an upvote to balance it out.)
ps2 slim also had the disc swap trick
Ha yes I remember this. There was a physical mod that allowed the disk door to be opened without the ps1 noticing so you could switch disks after the verification
Purchasing Verbatim purple bottom CDR blanks to copy original PSX games was my introduction to piracy. I was quite young. Those first gen Playstations with the port in the back were amazing easy to mod with the action replay or just the swap trick.
I also jumped on the XBMC and Xecutor modchip for the original Xbox when that came out. Another mind blowing time in computer gaming.
I also jumped on the XBMC and Xecutor modchip for the original Xbox when that came out. Another mind blowing time in computer gaming.
There are also ways of bypassing the protection using the memory cartridge port. Cartridges with Pseudo Saturn Kai pre-installed are readily available these days.
What prevents current generation consoles from loading a game that was copied exactly from the original disc to another Blu-ray?
Do you have a Blu-ray mastering and pressing operation? In that case, not that much.
Do you just have a Blu-Ray optical burner? Burned discs are typically simple to distinguish from pressed discs, so you can't make an exact copy.
Some early CD systems were made before CD-Rs were common (or maybe even contemplated) and didn't have mechanisms to check media type, but modern consoles know about these things.
Do you just have a Blu-Ray optical burner? Burned discs are typically simple to distinguish from pressed discs, so you can't make an exact copy.
Some early CD systems were made before CD-Rs were common (or maybe even contemplated) and didn't have mechanisms to check media type, but modern consoles know about these things.
Simply the fact that it's actually very hard to make an exact copy of the disc. You can make an exact copy of the files, but there are layers underneath the file level that are harder to duplicate correctly, and the copy protection uses idiosyncrasies in that to work out if the media is original.
Why can't you also make a copy at the block level?
So think of a block on a CD as some amount of data (like 512 bytes), and some amount of error correction bytes. When the CD is copied those blocks aren't copied exactly, but the data is read, corrected and the block is written with the corrected data and error correction data. Most formats don't record bad blocks, nor do consumer writes write invalid blocks.
One of the original methods used as copy protection used a special industrial writer write a invalid block, data was ok but the error correction would say it's something different, and check because the consumer hardware wouldn't read or write these blocks.
One of the original methods used as copy protection used a special industrial writer write a invalid block, data was ok but the error correction would say it's something different, and check because the consumer hardware wouldn't read or write these blocks.
Yes, that's one of the ways. The block size on a CD is 2kB plus error correction, by the way.
BR is one part key exchange, one part manufacturing, one part firmware lockouts using that key. So if you mod a drive you probably could get raw data from the disc. The problem is getting that back out to a disc correctly that another unmoded player would like it. There are projects out there that are reading data right off the read head. But they are more focused on laserdisc items.
Part of the copy protection includes physical features of the disc that must be pressed into it when it's produced, meaning a BluRay writer has no way of replicating it.
My understanding is that the PS1 copy protection encoded the first pits and peaks in a way that a normal CD drive’s error correction logic would tolerate, but in such a way that the special firmware on the PS1 could detect the profile of the “errors” and ensure they matched expectations.
Consumer CD Burners didn’t have firmware (or maybe even the physical capability) to reproduce these “errors”.
Imagine a vinyl record where the start of the track has a groove that isn’t perfectly tracing the perimeter, but is actually a low amplitude sine wave of a certain frequency, waving in to the center and out to the perimeter. Any record player could trace the groove correctly, despite the fact that there is a low amplitude sine wave, and you’d hear the audio correctly (error correction). But a special record player could even detect the sine wave and reject records that don’t have it. I’m hand-waving away the fact that you’d get a little bit of wow and flutter from the sine wave, but you get the idea.
Consumer CD Burners didn’t have firmware (or maybe even the physical capability) to reproduce these “errors”.
Imagine a vinyl record where the start of the track has a groove that isn’t perfectly tracing the perimeter, but is actually a low amplitude sine wave of a certain frequency, waving in to the center and out to the perimeter. Any record player could trace the groove correctly, despite the fact that there is a low amplitude sine wave, and you’d hear the audio correctly (error correction). But a special record player could even detect the sine wave and reject records that don’t have it. I’m hand-waving away the fact that you’d get a little bit of wow and flutter from the sine wave, but you get the idea.
https://en.wikipedia.org/wiki/Wobble_frequency
Afaik Wobble is pre molded in polycarbonate layer and cant be altered by CD Writer no matter the firmware.
https://en.wikipedia.org/wiki/Absolute_Time_in_Pregroove
Afaik Wobble is pre molded in polycarbonate layer and cant be altered by CD Writer no matter the firmware.
https://en.wikipedia.org/wiki/Absolute_Time_in_Pregroove
Excellent analogy. You could, if you had a full CD pressing & mastering plant, copy those discs with "wobble groove" and all. But it's a clever clever side channel. https://archive.ph/LuPaY#:~:text=they%20track%20the%20%27-,w...
Awesome, I learned a lot in this thread. Thank you (plural) for the answers and your time to reply to my question!
This is usually what they add, though the Nintendo Gamecube used a DVD-similar format at a different size to make it harder to copy. They also ran at CAV (constant angular velocity) instead of constant linear velocity (CLV) which lead to the rumor that they "spin backwards".
Protection is at the physical level. I mean, it was for the CDs, but you can easily imagine stuff that you can press onto the disc that your burner can't do.
https://youtu.be/XUwSOfQ1D3c?t=481
https://youtu.be/XUwSOfQ1D3c?t=481
> Why can't you also make a copy at the block level?
I don't know about CDs / BluRays but similar to what user jaywalk answered: back in the floppy disks days some copy-protection relied on physical differences created on purpose on the original game. It could be something as "simple" as damaging a track on purpose, by punching a hole in it. Then the game would try to read the data, any data, from that track. And the read command had to fail. A dumb block level copy wouldn't work: it could of course not physically punch a hole in a floppy disk.
So pirate groups would crack the game and ship a version of the game without the copy protection and these could be copied at will.
I don't know about CDs / BluRays but similar to what user jaywalk answered: back in the floppy disks days some copy-protection relied on physical differences created on purpose on the original game. It could be something as "simple" as damaging a track on purpose, by punching a hole in it. Then the game would try to read the data, any data, from that track. And the read command had to fail. A dumb block level copy wouldn't work: it could of course not physically punch a hole in a floppy disk.
So pirate groups would crack the game and ship a version of the game without the copy protection and these could be copied at will.
A simpler explanation than some of the below: imagine a damaged CD (or floppy) where one of the “blocks” returned inconsistent data.
Plain English explanation of the above code would be read a sector multiple times, make sure it is never always just even or just odd, but instead varies.
Usually perfection in digital media is what you strive for, but strategically introducing imperfections has a long history in authenticating “genuine” products.
for x = 1 to 10:
total += (read $DAMAGED_BLOCK) mod 2
assert total > 2 and total < 8
Plain English explanation of the above code would be read a sector multiple times, make sure it is never always just even or just odd, but instead varies.
Usually perfection in digital media is what you strive for, but strategically introducing imperfections has a long history in authenticating “genuine” products.
Reminds me of the BleemCast CD's - with the right one you could play PS1 games on a dreamcast! And it nicely upscaled the resolution and everything. Such an odd product
Even though emulators were a thing and we had seen copying devices for the most obscure consoles come out of China bleem was something else. Such a mad idea and they actually made a business case out of it.
Saturn has several options for playing backups:
Pseudo Saturn Kai: a firmware for the pro action replay cartridge that will boot non-official discs. Affordable and no modding required.
Phantom mod chip: like a classic playstation mod chip, but it plugs into the ribbon cable between the optical drive and the main system board. It needs one wire other than the ribbon cable, to provide 5V power.
Satiator: As shown in this youtube video, plugs into the VCD port on the back of the system and runs backups with no modding required.
Optical drive emulators: TerraOnion MODE, Fenrir, Rhea & Phoebe, these all replace the CD drive in the stock console.
Pseudo Saturn Kai: a firmware for the pro action replay cartridge that will boot non-official discs. Affordable and no modding required.
Phantom mod chip: like a classic playstation mod chip, but it plugs into the ribbon cable between the optical drive and the main system board. It needs one wire other than the ribbon cable, to provide 5V power.
Satiator: As shown in this youtube video, plugs into the VCD port on the back of the system and runs backups with no modding required.
Optical drive emulators: TerraOnion MODE, Fenrir, Rhea & Phoebe, these all replace the CD drive in the stock console.
Great overview, one correction:
Satiator doesn't play backup discs. It plays your games directly from an SD card.
Satiator doesn't play backup discs. It plays your games directly from an SD card.
I've always been interested in electronics and programming, and I've always struggled to write excellent code. This guy, on the other hand, makes it look easy.
Ive seen this video pop up again and again over the last 5 years.
I have 1 question: when/where can I buy one!
This has got to have been one of the weirdest game systems ever. Even the games were weird. Innovative and the graphics were mind blowing for its day but.....Knights? What an odd but unique game.
Disappointing that he didn’t elaborate on how the rom was dumped.
Also please check out the discussion on mil-cds here https://news.ycombinator.com/item?id=18655524
Edit: found the scrambler algo for milcd if anybody is curious https://mc.pp.se/dc/files/scramble.c (google was useless thank heavens for kagi)
Also please check out the discussion on mil-cds here https://news.ycombinator.com/item?id=18655524
Edit: found the scrambler algo for milcd if anybody is curious https://mc.pp.se/dc/files/scramble.c (google was useless thank heavens for kagi)
I brought Saturn CD to a 1995 New Years party as a teenager and was so cool that day.
I only ever had Virtua Fighter though and that was the last gaming console or game I ever bought.
I just remember it being a massive waste of money for me. $399 in 1995 dollars, about $690 adjusted for inflation with a CPI calculator.
The effort in this video is about deconstructing the CD drive's protocol and link-layer, to allow for disc emulation with flash memory storage.