what format is the cf cards in?

Moderators: please move/split threads into here
OldFoo

Post by OldFoo »

zitoun wrote:
zitoun wrote:
android wrote:


See my little video of WMMT booting from CF card.



http://www.youtube.com/watch?v=qoMGc4etYV8



I have a patched firmware for Chihiro, that is not public and never will be.


Actualy Oon Chihiro / Triforce you can run every game on a NON SEGA cf too , but the problem is after 6 min runnin' the game gives us an error and than you can do nothing. SO do your video again coz I'd like to see if your custom firmware works after 6min :)



I'm not sayin you're a liar I mean a 1min video doesn't prove anything for me :smt012



Let us know :smt006


Hehe,



I'm not going to make a video of 10 minutes



I don't care if you believe or not.



Buit i'm goint to share a few tips.





The Media Board firmware on the Chihiro is encripted, but can be decrypted thanks to the info publicated by Felix at Debugmo.de for Trifroce one year ago:



http://debugmo.de/2010/12/the-last-piece/





This is part of the ASIC firmware decripted..... loaded into the media board on runtime.



0x0000476C 02 52 mov 2, r10

0x0000476E 63 57 29 00 st.w r10, 0x34+var_C[sp]

0x00004772 20 66 AE 00 movea 0xAE, r0, r12

0x00004776 43 67 20 00 st.b r12, 0x34+var_14[sp]

0x0000477A 20 6E 25 00 movea 0x25, r0, r13

0x0000477E 43 6F 21 00 st.b r13, 0x34+var_13[sp]

0x00004782 20 76 33 00 movea 0x33, r0, r14

0x00004786 43 77 22 00 st.b r14, 0x34+var_12[sp]

0x0000478A 20 7E 89 00 movea 0x89, r0, r15

0x0000478E 43 7F 23 00 st.b r15, 0x34+var_11[sp]

0x00004792 20 86 22 00 movea 0x22, r0, r16

0x00004796 43 87 24 00 st.b r16, 0x34+var_10[sp]

0x0000479A 20 8E 7E 00 movea 0x7E, r0, r17



..................................................



The Chihiro is searching for 0xAE,0X25,0x33,0x89,0x22,0X7E,0xC4,0xFF



For validadte the card as genuine.



To patch the firmware is trivial is a work of 5 minutes.



But The firmware.asic has a header of 16 bytes and has a 8 bytes checksum.



This header is always: CA xx 6D xx C9 xx 0A xx 42 xx 0C xx 4A xx 82 xx



The other XX bytes contains the checkusm.



Nobody except me and Sega knows how to calculate this checksum.
OldFoo

Post by OldFoo »

Locking topic to prevent further off-topic discussion..
Post Reply