How Sega bet against Reverse Engineering...and lost | MVG

[Music] console manufacturers like sony nintendo and microsoft all understand the importance of a good security system in their hardware but unfortunately for them almost all of their systems have been compromised by hackers and with the imminent release of next generation the same questions are asked but these days thanks to modern cryptography hacking consoles is much harder but it's not impossible it's almost inevitable that some exploit or loophole will be found to allow unauthorized access into a game console when we think about console modding the earliest system you probably would consider is the sony playstation 1. the amount of 6y mod chip devices that were installed in ps1s easily go into the millions and it was a common place for many people to own a chip ps1 because it was convenient and easy to use and if you had access to a cd burner it was even better piracy was a massive thing on the playstation and with cd burns becoming more affordable over time the practice then moved over to every other console that used optical media but the reality is the practice of hacking or reverse engineering has been around in computing in the 70s and game consoles like the atari vcs from the early 80s and we've covered some of this history before with the early anti-piracy and reverse engineering with nintendo and their infamous 10 nes lockout ship later known as the cic chip which mitigated the flow of unauthorized third party bootlegs and hacked games for years but this would not be the last time a video game company would attempt to reverse engineer a game console many people in many different areas of video games have utilized reverse engineering tools in the past and in some instances it's actually game development companies themselves in the 90s the console wars were in full swing with the 16-bit era it was sega versus nintendo in a battle of world domination both the sega genesis and the super nes were cartridge based but interestingly enough while the super nes contained an updated variant of the 10 nes lockout ship known as the cic the sega genesis had nothing at all well except for two things region lockout and licensing region lockout simply means that a different region game to the console you own would not boot licensing simply means if you developed a game and you wanted it published by sega there would be a cost associated in doing so usually around 15 dollars per cartridge licensing with sega also meant giving away some of your freedoms as well and as you can imagine this cost could quickly skyrocket nba jam on the genesis sold around 2 million copies so midway would have had to pay sega at least 15 million in licensing fees alone but not everyone was happy with the licensing arrangement that sega had put in place one year after the genesis had released in north america one company electronic arts wanted to bring its catalogue of games to the genesis but they were very concerned about the cost of licensing their games with sega and set out to do something about it themselves it's important to mention that electronic arts had a very successful market in the home computer space particularly on the amiga and atari st with games such as populous pga tour golf the immortal marble madness and others electronic arts were skill developers that knew the 68 000 architecture very well which is the exact same processor that ran on the sega genesis and looked to bring their portfolio over but they quickly hit a snag you see they didn't want to pay the outrageous licensing costs that sega was quoting so to work around this once ea's president tripp hawkins learned that there was no security lockout on the genesis he gave the green light to his development team to build games for it but how would they at the time ea did not have any sega genesis development kits on hand sega was struggling to keep up with demand and ea unfortunately had missed out very hard to imagine if we consider who ea is today but at the time this did not deter them they were able to acquire an official development kit from an unknown source and formed two separate groups the first group was to examine the hardware and reverse engineer it while the second was in charge of documenting the findings writing manuals and building in-house development tools this was an entirely clean room project in other words no software libraries or documentation were ever used from the development kit itself this approach was done to mitigate any potential legal issues after some time ea's engineers had completely reverse engineered the hardware documented what it had found and had built its own in-house development kit and tools now it was possible to build games for the genesis which did not require any involvement from sega the first two ports developed by ea were populous and buddha khan with the leverage of a custom development kit trip hawkins went to sega and asked them for a fair licensing deal rather than the 8 to 10 price that they were charging per cartridge sega was initially furious they wanted to sue ea for what they thought was illegally reverse engineering the hardware but hawkins didn't back down he threatened to release their games without a license anyway in the end they made the right choice of allowing ea free to release as many games as they wanted and did not require sega's approval to do so ea would also control manufacturing of their game cartridges which can be identified by the distinct yellow tab slightly thicker game case and artwork and theming in exchange for a significantly reduced licensing cost although sega and ea's partnership was very successful it left sega in a tight spot the system had no anti-piracy or lockout measures in place and sega had grown concerned about piracy with bootleg cartridges appearing in the taiwanese markets so once ea and sega had come to a license agreement and electronic arts was able to publish their own games on the sega genesis sega realized that they needed to come up with a plan for this to not happen again in 1991 sega made a small but important revision to the console that would lock out any unauthorized third party access known as the trademark security system or tmss it was a small block of code that was added to genesis boot roms with header code that would be added to every licensed game cartridge this approach was very similar to nintendo's 10 nes but perhaps not as sophisticated tmss works something like this when a game cartridge is inserted and the console turned on tmss checks the rom at hex location 100 for the word sega if located the code will then be instructed to display the string produced by or under licence from sega enterprises limited but there's also a second part of this check the rom must contain this instruction if we convert the hex value the string sega is sent to hexadecimal address a1 4000 this is an area of i o memory that will enable the vdp or video display processor if both of these checks are satisfied then the tmss validation or anti-piracy check has been successful and the game can boot as normal now you're probably thinking this doesn't seem like a very secure anti-piracy check it could be easily patched bypassed or replicated the thing is it didn't need to be both the tmss and header code were copyrighted by sega and because a trademark was generated every time the console was activated this means that a publisher that tried to produce an unlicensed game that activated the tmss was in violation of copyright law and trademark law another company that had developed games on the amiga known as accolade had approached sega for a licensing contract but like ea they found the deal too restrictive so they set out to reverse engineer the hardware but they took a different approach to ea instead they used retail hardware and three games accolade engineers reverse engineered the games and looked for similarities between them all while documenting their findings armed with this information they built custom in-house development tools that would facilitate making their own games but what they didn't know during this time sega was rolling out tmss on their newer hardware revisions and when they found out that their game ishido weight of the stone would not boot thanks to tmss they quickly reverse engineered the check and added the required code to activate tmss in subsequent game releases sega took accolade to court in late 1991 for trademark infringement and copyright violation but accolade would counter sue arguing fair use initially sega would win on all accounts and the judge ordered accolade to cease production of games in development and pull its games from shelves within 10 days but accolade would appeal the decision and the 9th circle court of appeals ruled in accolades favor and deemed the reverse engineering effort valid the court of appeals stated that no proprietary sega code was ever used and because accolade purchased retail hardware for the reverse engineering effort no copyright laws were broken but the biggest blow to sega was since there was no way to boot any genesis game without triggering tmss accolade did not violate any trademark laws at all they had no other choice in the end sega vs accolade was a landmark court case that led console manufacturers and game publishers know that reverse engineering of software and hardware would be perfectly acceptable as long as the hardware or software had been legitimately obtained and no original or proprietary code was present in the final product and this is one of the reasons why clean room emulation is perfectly legal and why reverse engineering is an acceptable practice even the nsa has made their open source reverse engineering tool gidra available to the public reverse engineering as long as it's above board can be utilized for many different use cases and we've seen the nsa actually release their own reverse engineering tool that they used in-house known as gedra and you know the main driver i guess for the nsa would be to identify security exploits but reverse engineering tools like ida pro and gydra can be used in many different use cases everything from you know rom hacking security exploits but also just to peek around and take a look at code and see how things have been done we talk about a game like final fantasy 8 for example that most likely use some form of reverse engineering tools to get that game back up and running on modern systems and i think it's definitely something that we'll see more of as time goes by especially with lost and old source code that just no longer exists or is not in a complete state but guys let me know what you thought about this video in the comments below i think it's an interesting topic to go back and revisit we're essentially talking about the birth of legal and clean room reverse engineering in the courts and i think it's definitely something that i find very interesting and i hope you guys did as well let me know what you thought about this video in the comments below guys and if you liked it you know what to do leave me a thumbs up and as always don't forget to like and subscribe and i'll catch you guys in the next video bye for now [Music] you

Channel: Modern Vintage Gamer

Views: 458,508

Keywords: sega, genesis, megadrive, 16bit, reverse engineering, ghidra, mvg, modern vintage gamer, sega genesis, 68000, trip hawkins, ea, electronic arts, accolade, commodore amiga, blast processing, hacking, reversing, devkit, development kit, modding

Id: -aLfKnJAe0Y

Length: 12min 8sec (728 seconds)

Published: Mon Jul 13 2020

Reddit Comments

[u/makemeking706]

I always wonder if court cases like the one described here or others like the Betamax case would turn out the way they did if they were decided in this day and age.

[u/[deleted]]

Great video, I had no idea of the Accolade case. From what I read about FFVII and FFVIII's redoing of the PC port (which would later be ported everywhere) however, it was using a modified verison of a fanmade OpenGL driver instead. I can't really say what effort Square put into that.

[u/dnkmn]

Cant someone help me identify the first dell monitor that is hooked up to the PS1?

[u/Raykusen]

This guy is pretty good at getting info and joining them together in a simple yet attractive way.