| Home | Forums | What's new | Resources | |
| Saturn CD Block ROM dumped again. |
| Waterfuell - Aug 10, 2020 |
| < Prev | 1 | 2 | 3 |
 |
Hecato | Aug 29, 2020 | ||||
You can see it on this picture. | ||||||
 |
Waterfuell | Aug 29, 2020 | ||||
I was refering that in schematic Ive post must take into account the comm line dosnt appears. The schematic you has post is good too for get an idea how CDB is intercomected. | ||||||
|
Waterfuell | Aug 29, 2020 | ||||
My research is based on CDB105 and unfinished, so i cant help, the only that i can say about port C is that pin PC6 is config as analog input AN6 in pin 94 | ||||||
 |
gambit | Dec 17, 2020 | ||
| Are you still working on this? Any progress? I'm interested in making my own ODE because hardly anybody can afford the prices they charge and we can control microcontrollers with python now so I thought I would give it a shot. I've ordered a few Saturn's to use for testing and will probably start getting my hands dirty with the project at the start of the new year. Essentially my goal is to get a cheap ODE on the market for everybody. | ||||
|
Waterfuell | Dec 18, 2020 | ||||
The project is halt, looks like ROM has been reverse engineered other times before, and people say there is no more to extract. The theorical feature that should be interesting to find is the way to load SH1 encrypted code from an autorized cd, but RE all the ROM requires lot of job for something that doesnt arouse much interest. At this moment Im also working on a open source ODE, ive talked about it whith other users in discord, not so deep, bu you can take a look if interested. | ||||||
|
gambit | Dec 20, 2020 | ||||
I saw that it had been reversed before but I thought the information was still not fully publicly available. Sent you a message on discord. | ||||||
 |
slinga | Apr 29, 2021 | ||
|
@Waterfuell... , I've started looking at the SH-1 ROM (cdb105.bin) and the YGR ROM (ygr022.bin). Using Yabause 0.9.15 I am able to set breakpoints within the SH-1. Do you know if it's possible to debug the YGR as well? Edit: Actually it looksl ike ygr022.bin is just a variant of the cdb105.bin. | ||||
|
Waterfuell | Apr 30, 2021 | ||||
As I comented to you in discord ygr is just lsi + sh1 join togeter in a single chip. LSI is just hardware, imagine it like an non programable cpld or fpga, just logic, for glue all together. I couldnt debug in yabause, in linux didnt work for me, I did a prety simple and slow sh1 emulator in python. | ||||||
 |
fafling | Apr 30, 2021 | ||
|
CDB105 and CDB106 are the markings on SH1 when it's separated from OCU (marked YGR019A or YGR019B), as the service manual... labels this component. OCU is an external bus controller for the SH1, it plays a bit the same role as does SCU (minus the DSP) for the SH2s. As @Waterfuell... said on Discord, it contains the CD block registers described in System Library User's Manual.... YGR022 is an integration of OCU and SH1. As such, it contains the 64 KB ROM of SH1. It first appears on revision VA6 of the Saturn motherboard. There are pictures of the different motherboards on the 2nd half of this page : [Sega] Saturn – Différencier les versions... | ||||
|
slinga | Apr 30, 2021 | ||||
I can verify SH-1 debugging in Linux with Yabause 0.9.15 works. I can set code breakpoints within the SH-1 ROM and it hits. Memory breakpoints do not appear to work however. | ||||||
|
Waterfuell | May 1, 2021 | ||||
Where are you get?? Prebuilt, or compiled yourself?? | ||||||
|
slinga | May 1, 2021 | ||
| Compiled. I think form here: Yabause » Download... | ||||
 |
rorirub | May 2, 2021 | ||
| Do we have a way of dumping the CDB yet? I was hoping the Satiator could do it, but I didn't pay attention as to what apps are available for it. | ||||
|
Waterfuell | May 2, 2021 | ||||
There is no easy way for dump ROM, at least that I knew. But ROMs has been leaked, if you are interested. | ||||||
|
rorirub | May 3, 2021 | ||
| I know it's out, but not all versions are dumped. CDB104 wasn't dumped last time I checked and it behaves differently in some instances. There are also older versions on devkits, at least one which does not have the copy protection implemented. Would be nice to get those dumped. I was always hoping the Satiator could do that due to the way it hooks up to the SH1. | ||||
|
Waterfuell | May 3, 2021 | ||||
Unless someone find the way to load sh1 from cd or mpeg port and share the code, we only can hope jhdl someday add ROM dumping support to satiator. | ||||||
 |
srg320 | May 23, 2021 | ||
|
I partially disassembled CDB105 for the purpose of development and debugging the Saturn FPGA core. Maybe it will be useful to someone. | ||||
|
slinga | May 23, 2021 | ||||
Thank you for sharing. I've been working my way through CDB105 as well and your notes will save me a ton of time. | ||||||
 |
supersat | Dec 1, 2022 | ||||
Have you looked at the strings in the CDB ROMs? There's only a few, and a couple stand out: "Hitachi" and "PublicKeyCipher." Given its proximity to a bunch of bit shifting and XOR instructions, I would not be surprised if this was used in the process to decrypt and load SH1 code from the VCD port. I have yet to do much more reverse-engineering beyond that, but I've seen no mention of these strings online whatsoeve... | ||||||
| < Prev | 1 | 2 | 3 |