Page 5 of 6

Posted: Tue May 06, 2008 4:07 pm
by AamirM
TmEE co.(TM) wrote:I don't understand this ROM destruction thing....

Beggar Prince has some extra HW in cart, and it depends on it... same for my game.
Also, I will release a demo of my game, and when the cartridge is not in production anymore, some more emulator friendly version of the final version... I'm not a total monster, eventually things will be free...
Glad to know that.

Posted: Tue May 06, 2008 5:13 pm
by Sik
tomaitheous wrote:
Sik wrote: It would be enabled by just writing something with the 68k. A copier is never capable of doing this, so making it dump-proof. You would need to modify your copier to be able to dump the ROM.
Or worse - it could destroy the rom. Megaman X3 had this problem iirc.
You need to do something really wrong to destroy the cartridge that way, just feed the extra HW the data it wants and you're done. The worst that can happen is a bad dump honestly (or the deletion of the data in SRAM) :/

EDIT: updated 2gen BIOS :P
http://srb2town.sepwich.com/junk/2genbios.bin

Initially you won't find anything weird, but use it to load the BIOS itself or an invalid ROM (one that the normal BIOS wouldn't load). You'll find a menu :D However only the "check hardware" function works >_> Also it has very few functionality. I'll update it all later, OK? :P

Posted: Wed May 07, 2008 12:57 am
by tomaitheous
Sik wrote: You need to do something really wrong to destroy the cartridge that way, just feed the extra HW the data it wants and you're done. The worst that can happen is a bad dump honestly (or the deletion of the data in SRAM) :/
No, the cartridge had a copy protection mechanism. If you tried to read from the cart, it would self destruct the data rendering the cartridge useless. A number of cartridges were destroyed until they(forget his name) finally figured out the mechanism.

Posted: Wed May 07, 2008 1:04 am
by Sik
Do you know how many companies (specially Nintendo) would have liked to have such a system back then (and would like to be able to do something similar on discs now)...

Posted: Wed May 07, 2008 1:18 am
by TmEE co.(TM)
but why the cart doesn't die if MD wanted to read it ?

Posted: Wed May 07, 2008 2:54 am
by Sik
Because the killing device would get enabled only by accessing a specific part of the ROM, not it all. Reading the start up code wouldn't kill the ROM. Then the 68k sends something that disables the kill until power off, and the MD can read it. Quite simple. A copier simply can't do that unless it's modified to enable that ROM section.

Posted: Wed May 07, 2008 3:21 am
by HardWareMan
My copier are always allows do write. And it can do read/write SRAM (any types) and even do write to port !TIME. So, if I will know that the protection exist, I just trace start of ROM and do all of protection required. ;) It's can be more simple, if I use M68K emulator for that. ;) Slowly and surely.

Posted: Wed May 07, 2008 3:26 am
by tomaitheous
TmEE co.(TM) wrote:but why the cart doesn't die if MD wanted to read it ?
Well, this is X3 for SFC. The security chip would detect longer than normal (whatever that is) linear reads from the cart pins. If detected then it would fry itself. The trick was to read smaller chunks, then read from random addresses, then go back to reading another small chunk - rinse and repeat.

Posted: Wed May 07, 2008 3:28 am
by Sik
How it turns out pirate games are the hardest to pirate? >_> Most pirate games have some kind of problem (difficulties whiles dumping, problems with emulators, custom hardware, etc.).

EDIT: you know that with all this we're just giving more stuff for Tiido to make the ultimate protection system, right? :/ Well, I guess I'll just have to wait until the time for the free release :P

Posted: Wed May 07, 2008 10:53 am
by TmEE co.(TM)
I'm not gonna bother ROM killer... I've found its difficult to kill ROMs unless you give them 12V directly... I read one ROM while I had my dumper/writers 82C55 chip in Write mode (I was still writing the software), the ROM got really hot (and 82C55 too I think), but it gave out so much juice that when I read the 82C55, I got what ROM output !!!!

I'm not gonna bother with more than the EEPROM mapper, I have to keep the costs down you know :)

And for cart fryers, these cart do have to work on real HW, and for MD stuff, you could use Mask of Destiny's solution... a bit slow, but effective...

Posted: Wed May 07, 2008 4:26 pm
by tails92
A cart fryer for an homebrew game? What are you thinking about?
In my opinion the user is fully entitled to a backup of his cartridge.
And no offence, but what you want to do is just evil and you're going to ruin your reputation, that way.

Posted: Wed May 07, 2008 4:35 pm
by TmEE co.(TM)
you can make a backup if you want, but it will not work in any emu or flashcart... and I don't want it to work until the cart is not sold anymore.

Posted: Wed May 07, 2008 5:18 pm
by Sik
tails92 wrote:A cart fryer for an homebrew game? What are you thinking about?
He never said he was going to use it, the discussion started with the fact Megaman X3 had it :/ Seriously, I'm quite sure a lot of companies would want to be able to do the same on discs right now... Which proves that pirates are way better at doing protection systems XD

EDIT: typo >_>

Posted: Wed May 07, 2008 10:07 pm
by Shiru
TmEE, just interesting, which exact goals (or main one) with plans for selling real carts you have? Make some money, or support people's interest for real hardware, or something else?

Posted: Wed May 07, 2008 11:37 pm
by Sik
2gen BIOS version 2008.07.05:
http://srb2town.sepwich.com/junk/2genbios.bin
(same link again :P)

Now you can format the SRAM (you'll even be warned if you try to reformat it). It also has sound :P I guess that putting a background would make it look way better...

Also I would want info about what you would want to add to the header that the old one doesn't have, which was the main point of this topic :/