4 ms·

Is this similar to what CAPCOM did with their arcade system with that weird battery thing? If it powered off you had to send it back to CAPCOM to get it re-prog

Is this similar to what CAPCOM did with their arcade system with that weird battery thing? If it powered off you had to send it back to CAPCOM to get it re-programmed. It was a DRM method used to combat piracy in the early arcade days.

dfxm12 1y ago
I don't see how it is, but maybe you're referring to something else. I think you're talking about the CPS, or more famously the CPS2, which had a battery power its anti-piracy measures. You only had to send it in if the battery dipped below a certain voltage, after which it would destroy the security key (in memory), so the ROMs would remain encrypted. You could turn off the machine just fine. Arcade machines were regularly powered off. This coupled with the fact that the CPS2 batteries especially are prone to leak over critical components dubbed them the suicide batteries. These security measures have since been defeated in a few ways, all while removing the troublesome battery. You can replaced the encrypted ROMs on your board with Phoenix ROMs, which are decypted. You can solder on a PCB called the Infinikey, which loads the decryption key with power from the board and not the battery. Maybe there are others, too. I think the HNG64 just had obscure/undumped/not understood hardware.
- mrandish 1y ago
  The many-year effort to finally break the CPS2 hardware protection is a fascinating story. It was huge not only for the preservation of some well-known, historically significant games but it also allowed a lot of dead vintage arcade boards to be resurrected for new generations to enjoy.
- commandersaki 1y ago
  I would love to see a write up of the CPS2 cryptography and how it was cracked; my understanding it was some custom Feistel cipher.
mschuster91 1y ago
That shit is something you still find in the gambling world. Many of the modern one-armed bandits have HSMs with a loooot of protections, including batteries with drill through protections and god knows what else, although it's less used for anti-piracy but more to prevent tax fraud.
- gosub100 1y ago
  It's to prevent cheating! If the roms weren't cryptographically signed, people would "homebrew" their own "mods" lol.
kstenerud 1y ago
Yes, it was a 2-part scheme: They had a proprietary decryptor chip that sat between the program roms and the CPU. The decryptor used a table held in a small SRAM that was powered by a battery. When the SRAM lost power (battery died, or someone was trying to reverse engineer the board), the decryption key would be lost. We broke it because someone noticed that the FC1 pin was tied to the drcyptor chip. In retrospect this made sense because only the program roms were encrypted, not the gfx roms (FC1 and FC0 pins were 01 for data access and 10 for program access [1]). Whenever the 68000 was requesting an instruction, it would set FC0 low and FC1 high, and when requesting data it would be opposite - this is how the decryptor knew when to decrypt. But there was an achilles heel! If you use PC-relative addressing, this ALSO causes FC0 low and FC1 high (because PC-relative is assumed to be accessing more program code). So all you had to do was fetch each address using PC-relative MOVEs, and it would happily give you the decrypted instruction words. But then there was a secondary protection scheme: The decryptor chip would mysteriously shut down after a short while! WTF! It wasn't until Capcom released their home console based off the original CPS board, along with backports of games like Street Fighter Zero, that the penny dropped. These backports were full of mysterious reads of weird addresses that made no sense. It turns out that these weird addresses were what the decryptor chip was waiting for on the address bus. If no such address appeared within a timeout period, the chip would stop decrypting until you reset. But the guys backporting CPS2 games didn't take the instructions doing these accesses out - even though the original CPS board didn't need it (probably it would have been a lot of work), so that secret leaked out. After that, it was a simple matter of writing a program that read via PC-relative addresses, sent those weird accesses from time to time to keep the watchdog happy, and then output to a dumper via IO pins. [1] Section 3.8: PROCESSOR FUNCTION CODES (FC0, FC1, FC2) https://www.nxp.com/docs/en/reference-manual/MC68000UM.pdf https://www.nxp.com/docs/en/reference-manual/MC68000UM.pdf
- sixothree 1y ago
  Great explanation. The address bus reminds me of port knocking.
- pansa2 1y ago
  > The decryptor used a table held in a small SRAM that was powered by a battery. IIRC Sega’s System 16 did something similar. Was that board’s encryption cracked in the same way? Was this style of anti-piracy measure widely used at the time, or was it only on a few 68000-based systems?

dfxm12 1y ago

I don't see how it is, but maybe you're referring to something else. I think you're talking about the CPS, or more famously the CPS2, which had a battery power its anti-piracy measures. You only had to send it in if the battery dipped below a certain voltage, after which it would destroy the security key (in memory), so the ROMs would remain encrypted. You could turn off the machine just fine. Arcade machines were regularly powered off. This coupled with the fact that the CPS2 batteries especially are prone to leak over critical components dubbed them the suicide batteries. These security measures have since been defeated in a few ways, all while removing the troublesome battery. You can replaced the encrypted ROMs on your board with Phoenix ROMs, which are decypted. You can solder on a PCB called the Infinikey, which loads the decryption key with power from the board and not the battery. Maybe there are others, too. I think the HNG64 just had obscure/undumped/not understood hardware.

mrandish 1y ago
The many-year effort to finally break the CPS2 hardware protection is a fascinating story. It was huge not only for the preservation of some well-known, historically significant games but it also allowed a lot of dead vintage arcade boards to be resurrected for new generations to enjoy.
commandersaki 1y ago
I would love to see a write up of the CPS2 cryptography and how it was cracked; my understanding it was some custom Feistel cipher.

mschuster91 1y ago

That shit is something you still find in the gambling world. Many of the modern one-armed bandits have HSMs with a loooot of protections, including batteries with drill through protections and god knows what else, although it's less used for anti-piracy but more to prevent tax fraud.

gosub100 1y ago
It's to prevent cheating! If the roms weren't cryptographically signed, people would "homebrew" their own "mods" lol.

kstenerud 1y ago

Yes, it was a 2-part scheme: They had a proprietary decryptor chip that sat between the program roms and the CPU. The decryptor used a table held in a small SRAM that was powered by a battery. When the SRAM lost power (battery died, or someone was trying to reverse engineer the board), the decryption key would be lost. We broke it because someone noticed that the FC1 pin was tied to the drcyptor chip. In retrospect this made sense because only the program roms were encrypted, not the gfx roms (FC1 and FC0 pins were 01 for data access and 10 for program access [1]). Whenever the 68000 was requesting an instruction, it would set FC0 low and FC1 high, and when requesting data it would be opposite - this is how the decryptor knew when to decrypt. But there was an achilles heel! If you use PC-relative addressing, this ALSO causes FC0 low and FC1 high (because PC-relative is assumed to be accessing more program code). So all you had to do was fetch each address using PC-relative MOVEs, and it would happily give you the decrypted instruction words. But then there was a secondary protection scheme: The decryptor chip would mysteriously shut down after a short while! WTF! It wasn't until Capcom released their home console based off the original CPS board, along with backports of games like Street Fighter Zero, that the penny dropped. These backports were full of mysterious reads of weird addresses that made no sense. It turns out that these weird addresses were what the decryptor chip was waiting for on the address bus. If no such address appeared within a timeout period, the chip would stop decrypting until you reset. But the guys backporting CPS2 games didn't take the instructions doing these accesses out - even though the original CPS board didn't need it (probably it would have been a lot of work), so that secret leaked out. After that, it was a simple matter of writing a program that read via PC-relative addresses, sent those weird accesses from time to time to keep the watchdog happy, and then output to a dumper via IO pins. [1] Section 3.8: PROCESSOR FUNCTION CODES (FC0, FC1, FC2) https://www.nxp.com/docs/en/reference-manual/MC68000UM.pdf https://www.nxp.com/docs/en/reference-manual/MC68000UM.pdf

sixothree 1y ago
Great explanation. The address bus reminds me of port knocking.
pansa2 1y ago
> The decryptor used a table held in a small SRAM that was powered by a battery. IIRC Sega’s System 16 did something similar. Was that board’s encryption cracked in the same way? Was this style of anti-piracy measure widely used at the time, or was it only on a few 68000-based systems?