11 changed files with 445 additions and 36 deletions
@ -0,0 +1,147 @@
|
||||
{% extends "sega.html" %} |
||||
{% block title %}mxkeychip{% endblock %} |
||||
{% block body %} |
||||
<h1>mxkeychip</h1> |
||||
|
||||
<p>mxkeychip is responsible for interfacing between the physical keychip, and anything that needs to talk to it (the |
||||
system services and the game). It does this by means of the <a |
||||
href="{{ROOT}}/sega/software/drivers/#mxparallel">mxparallel</a> driver. I have not yet documented the parallel |
||||
protocol.</p> |
||||
|
||||
<p>Owners wishing to start a system without a legitimate keychip need only replace this binary with a custom binary. <a |
||||
href="https://gitea.tendokyu.moe/Bottersnike/micetools/src/branch/master/src/micetools/micekeychip">micekeychip</a> |
||||
is an example of one such binary, making use of the official libpcp. (Contact me if you want a build.)</p> |
||||
|
||||
<h2>PCP Service</h2> |
||||
<p>mxkeychip runs a PCP service on port <code>40106</code> (data port <code>40107</code>).</p> |
||||
|
||||
<h3><code>keychip.version</code></h3> |
||||
<p>Return the keychip version, as two bytes. <code>0104</code> is the current keychip version, representing |
||||
<code>1.4</code>. An optional parameter <code>device</code> can be added to retrieve a specific version. The only |
||||
allowed value for this however is <code>n2</code>, and <code>0104</code> should be returned in both cases. |
||||
</p> |
||||
|
||||
<h3><code>keychip.ds.compute</code></h3> |
||||
<p>Perform a query-response challenge. The query is the command argument, and the page is passed as a parameter with |
||||
name <code>page</code>. TODO: Details of how to calculate responses!</p> |
||||
|
||||
<h3><code>keychip.ssd.proof</code></h3> |
||||
<p>Perform a query-response challenge. The query is the command argument, and the page is passed as a parameter with |
||||
name <code>page</code>. TODO: Details of how to calculate responses!</p> |
||||
|
||||
<h3><code>keychip.ssd.hostproof</code></h3> |
||||
<h3><code>keychip.status</code></h3> |
||||
<p>Get the current keychip status. Reponses should be either <code>init</code> to indicate mxkeychip is still performing |
||||
setup, <code>available</code> to indicate the keychip is ready to use, or <code>error</code> to indicate the keychip |
||||
is not present, or unusuable.</p> |
||||
|
||||
<h3><code>keychip.encrypt</code></h3> |
||||
<h3><code>keychip.decrypt</code></h3> |
||||
<h3><code>keychip.setiv</code></h3> |
||||
<h3><code>keychip.appboot.*</code></h3> |
||||
<p>Request one of a number of variables from the keychip regarding the authorised game configuration:</p> |
||||
|
||||
<table> |
||||
<tr> |
||||
<td><code>formattype</code></td> |
||||
<td>Data format. <code>mxsegaboot</code> will only support version <code>1</code>.</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>platformid</code></td> |
||||
<td>The hardware platform ID. <code>AAL</code> or <code>AAM</code>. <code>___</code> is sent if this is |
||||
unavailable.</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>gameid</code></td> |
||||
<td>The four-character game ID. <code>____</code> is sent if this is unavailable.</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>systemflag</code></td> |
||||
<td>A single byte containing a number of system flags. What exactly these bits do is unknown right now, but |
||||
<code>64<sub>h</sub></code> works fine. |
||||
</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>modeltype</code></td> |
||||
<td><code>02</code></td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>region</code></td> |
||||
<td>Region bitmask. 1 = Japan, 2 = USA, 4 = Export, 8 = China</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>networkaddr</code></td> |
||||
<td>The IP address for this machine</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>dvdflag</code></td> |
||||
<td><code>01</code></td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>seed</code></td> |
||||
<td>A seed value that will be used for.. something? Not sure yet. It's 16 bytes.</td> |
||||
</tr> |
||||
</table> |
||||
<h3><code>keychip.billing.*</code></h3> |
||||
<p>As with appboot, billing contains a number of values stored on the keychip, however some of these are also writiable. |
||||
</p> |
||||
|
||||
<table> |
||||
<tr> |
||||
<td><code>keyid</code></td> |
||||
<td>The keychip ID. For example, A72E-0123456. Read-only.</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>mainid</code></td> |
||||
<td>The hardware ID. For example, AASE-0123456. This value can be written. In this respect, it stores the |
||||
previous owner of the keychip, allowing systems to identify if they have been presented with a new keychip, |
||||
and allowing a curious owner (or curious sega) to identify who last used this keychip.</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>playcount</code></td> |
||||
<td>The number of plays that have been performed. This value can be incremented by providing <code>1</code>. |
||||
</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>playlimit</code></td> |
||||
<td>The number of plays that are allowed until the game must next check in with a billing server. This value can |
||||
be written, however a signature (128 bytes) must then be sent over a data transfer to validate that this |
||||
playlimit update was authorised by a legitimate billing server. As the private keys for the billing service |
||||
are not currently known, and likely never will be, this renders legitimate keychips useless after playcount |
||||
runs out!</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>nearful</code></td> |
||||
<td>Get the 'nearfull' value stored from the billing server. This is the number of plays remaining at which a |
||||
game is expected to pre-emptively check in with a billing server. This value is a 32-bit value, also |
||||
containing the accounting mode in the upper two bytes of the value. As with playlimit, this value can be |
||||
written, but requires a valid signature to be sent.</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>signaturepubkey</code></td> |
||||
<td>Retrieve the public key for the billing server signing service.</td> |
||||
</tr> |
||||
<tr> |
||||
<td><code>cacertification</code></td> |
||||
<td>Retrieve the authorative certiciate for the billing server. This certificate will be trusted implicitly, |
||||
regardless of the actual legitimacy of the certificate (including allowing self-signing).</td> |
||||
</tr> |
||||
</table> |
||||
<h3><code>keychip.tracedata.restore</code></h3> |
||||
<h3><code>keychip.tracedata.put</code></h3> |
||||
<h3><code>keychip.tracedata.get</code></h3> |
||||
<h3><code>keychip.tracedata.logicalerase</code></h3> |
||||
<h3><code>keychip.tracedata.sectorerase</code></h3> |
||||
<h3><code>keychip.eeprom</code></h3> |
||||
<h3><code>keychip.nvram0</code></h3> |
||||
<h3><code>keychip.nvram1</code></h3> |
||||
<h3><code>keychip.nvram2</code></h3> |
||||
<h3><code>keychip.nvram3</code></h3> |
||||
<h3><code>keychip.nvram4</code></h3> |
||||
<h3><code>keychip.nvram5</code></h3> |
||||
<h3><code>keychip.nvram6</code></h3> |
||||
<h3><code>keychip.nvram7</code></h3> |
||||
<h3><code>keychip.nvram8</code></h3> |
||||
<h3><code>keychip.nvram9</code></h3> |
||||
|
||||
{% endblock %} |
||||
@ -0,0 +1,51 @@
|
||||
{% extends "sega.html" %} |
||||
{% block title %}mxmaster{% endblock %} |
||||
{% block body %} |
||||
<h1>mxmaster</h1> |
||||
|
||||
<p>mxmaster is the program responsible for orchastrating the entire system.</p> |
||||
|
||||
<p>Before spawning any processes, it copies the following files from <code>s:\</code> into |
||||
<code>c:\System\Execute</code>:</p> |
||||
<ul> |
||||
<li><code>mxsegaboot.exe</code></li> |
||||
<li><code>mxauthdisc.exe</code></li> |
||||
<li><code>mxshellexecute.exe</code></li> |
||||
<li><code>ringmaster_pub.pem</code></li> |
||||
<li><code>develop_regset.txt</code></li> |
||||
<li><code>lockid.txt</code></li> |
||||
<li><code>d3dref9.dll</code></li> |
||||
<li><code>mxsegaboot_2052.dll</code></li> |
||||
</ul> |
||||
|
||||
<p>Following this, it begins to spawn system processes as required. The full diagram can be found on the <a |
||||
href="..">software page</a>.</p> |
||||
|
||||
<!-- <ul> |
||||
<li><code>s:\mxkeychip.exe</code></li> |
||||
<li><code>s:\mxnetwork.exe -p 40104</code></li> |
||||
<li><code>s:\mxstorage.exe</code></li> |
||||
<li><code>s:\mxinstaller.exe -cmdport 40102 -binport 40103</code> (sometimes with <code>-openmode any</code> appended)</li> |
||||
<li><code>s:\mxgcatcher.exe {appboot.platformid} {appboot.gameid} {appboot.networkaddr} {appboot.keyid}</code></li> |
||||
<li><code>s:\mxgfetcher.exe {appboot.platformid} {appboot.gameid} {appboot.networkaddr} {appboot.keyid}</code></li> |
||||
<li><code>s:\mxgdeliver.exe {appboot.platformid} {appboot.gameid} {appboot.networkaddr} {appboot.keyid}</code></li> |
||||
<li><code>C:\WINDOWS\system32\regini.exe S:\default_regset.txt</code></li> |
||||
<li><code>c:\System\Execute\mxsegaboot.exe</code></li> |
||||
<!-- TODO: Investigate amDongleSetAuthConfig->FUN_00412ae0 -- > |
||||
</ul> --> |
||||
|
||||
<h2>PCP Service</h2> |
||||
<p>mxmaster runs a PCP service on port <code>40100</code> (data port <code>40101</code>).</p> |
||||
|
||||
<h3><code>mxmaster.reconnect.usb.device</code></h3> |
||||
<h3><code>mxmaster.erase_log</code></h3> |
||||
<h3><code>mxmaster.output_log</code></h3> |
||||
<h3><code>mxmaster.logging_available</code></h3> |
||||
<h3><code>mxmaster.develop</code></h3> |
||||
<h3><code>mxmaster.foreground.getcount</code></h3> |
||||
<h3><code>mxmaster.foreground.fault</code></h3> |
||||
<h3><code>mxmaster.foreground.next</code></h3> |
||||
<h3><code>mxmaster.foreground.active</code></h3> |
||||
<h3><code>mxmaster.foreground.current</code></h3> |
||||
|
||||
{% endblock %} |
||||
@ -1,23 +0,0 @@
|
||||
{% extends "sega.html" %} |
||||
{% block title %}mxmaster{% endblock %} |
||||
{% block body %} |
||||
<h1>mxmaster</h1> |
||||
|
||||
<p>mxmaster is the program responsible for orchastrating the entire system.</p> |
||||
|
||||
<p>It first spawns the following list of programs:</p> |
||||
|
||||
<ul> |
||||
<li><code>s:\mxkeychip.exe</code></li> |
||||
<li><code>s:\mxnetwork.exe -p 40104</code></li> |
||||
<li><code>s:\mxstorage.exe</code></li> |
||||
<li><code>s:\mxinstaller.exe -cmdport 40102 -binport 40103</code> (sometimes with <code>-openmode any</code> appended)</li> |
||||
<li><code>s:\mxgcatcher.exe {appboot.platformid} {appboot.gameid} {appboot.networkaddr} {appboot.keyid}</code></li> |
||||
<li><code>s:\mxgfetcher.exe {appboot.platformid} {appboot.gameid} {appboot.networkaddr} {appboot.keyid}</code></li> |
||||
<li><code>s:\mxgdeliver.exe {appboot.platformid} {appboot.gameid} {appboot.networkaddr} {appboot.keyid}</code></li> |
||||
<li><code>C:\WINDOWS\system32\regini.exe S:\default_regset.txt</code></li> |
||||
<li><code>c:\System\Execute\mxsegaboot.exe</code></li> |
||||
<!-- TODO: Investigate amDongleSetAuthConfig->FUN_00412ae0 --> |
||||
</ul> |
||||
|
||||
{% endblock %} |
||||
@ -1,4 +0,0 @@
|
||||
{% extends "sega.html" %} |
||||
{% block title %}{% endblock %} |
||||
{% block body %} |
||||
{% endblock %} |
||||
Loading…
Reference in new issue