Sega Saturn CD - Cracked after 20 years

so we're looking at a seegar Saturn and when released back in 1994 this was arguably the king of gaming consoles two CPUs video acceleration nothing could touch it and because it was made by Sega it also licensed a whole load of arcade titles using very similar technology and they looked amazing now the games came on CDs which were amazing for the day but now we have a little bit of a problem because these drives are now 20 years old and while the machines will often keep working the drives are dying left right and center so we got to do something about this fast-forward 20 years and we're living a bit of a retro revolution at the moment and this is thanks to technology like this this is a flash cartridge and basically you can program this with any ROM you want the spin off of this is that there's an incredible homebrew scene that's now popped up and while the brains behind technology like this come from all around the world I want to introduce you to dr. abrasive because for the Sega Saturn he's conjured up one of the most insane flash projects I have ever seen welcome to my mad scientist lab or to my very messy desk so this is a project I started I think around 2013 basically I heard about the chiptune capabilities of the Sega Saturn with its crazy multi-channel sound chip and I thought she would be be nice to have one of those around so I happened to be in Japan and wandered to a super potato and bought myself a Sega Saturn and managed to jam it into my suitcase and lug at home and then when I got at home I went okay now I want to write some software for this thing what do I do and I found out that there was still pretty much the original 19 technology for this device so you had to go and get a mod ship which people don't make anymore funnily enough you had to install the mod ship and then you could burn CDs I was like could probably do better so I spent a little while researching to see if there was some way to work around the copy protection unfortunately the outcome of my research was that no it actually works quite well it detects a little wobble in the outer ring of the CD when it's trying to read the protection data and that's not something you can do with a CD bin and when you buy a CDR it's already got a spiral pressed in it so no wobble for us so I basically started doing some digging about the hardware architecture at the Saturn and I was a little bit surprised actually to find out just how over engineered it is so it has I don't even know how many different CPUs it's got two main CPUs it's got a CPU just for sound and in addition it has a CPU that just controls the CD subsystem so there it turns out is a whole operating system running inside this chip that no one ever has been able to access so you can send it commands it will send you data but no one knows how it works there have been a couple of efforts over the years to decap the chip so to open up the package and read out the ROM using a microscope unfortunately it turns out it uses the technology called implant ROM where you can't actually see it under the microscope you have to do this complicated staining process and so no one had ever dumped it that way successfully so I sort of came along at this point and stared at it a bit and scratched my head and found all the different schematics for the senton you can find on the internet and and sort of puzzled about how it worked and eventually I came up with a couple of schemes I thought I'd try so I went and got my hands on one of the CD Drive CPUs the city blocks CPU from a very friendly chap in Hungary who I don't think realized quite what I was going to do with it he sent me the CD module from a Saturn and I unn soldered the CPU from it I made myself a circuit board and solder on the other board and basically tricked it into reading out all of its ROM content to me and then in a very very lengthy reverse engineering process I basically went through and puzzled out how its internal operating system worked so it's got 64 kilobytes of ROM and it's packed it's completely packed with instructions there's a lot of stuff going on there and there's a lot of spaghetti code there's a lot of weird sort of obviously hacky bits of code there's bits that have been written by hand and several times I've actually been really surprised by how much you can see of its development history just by kind of looking at the code which is which is really cool so I sort of as I started to find my way through there and building up a map of where everything was then of course I gravitated towards the protection area and finding you know how how could we possibly run cds on here the first thing I was looking for which I was really hoping to find was that they put in some kind of a back door which would let you basically open up the system in some way with the burnt CD with a dev kit kind of sort of feel to it exactly and I know there are discs that they made for use by developers which would put it into a mode where it would accept burn discs so it would temporarily disable a copy protection but those discs still had that wobble burned on the outside which is how they ran in the first place so I was hoping that there'd be some more secret mechanism that would do the same thing and unfortunately I didn't find one but you know this is sort of peaked my interest by this point you know I've gone pretty far in so I figured I'd better find a way out so continuing my little reverse engineering journey my attention next turn to the video CD port on the back of the Saturn so that was an interface they provided to support playing video cities which at the time still look like they would be a thing especially in Japan so there's an add-on card which you could buy which plugs in the back of the Saturn then it contains an MPEG video decoder chip an imp agario decoder chip a bunch of RAM a bunch of ROM and basically so that would augment the functionality through the CD block CPU and when I dug far enough on this I found that there was actually in the ROM most of it contained a program for the Saturn to run just like a CD it would boot up show I mean you do user interface kind of things but there was also a little thing of random looking code that was kind of hidden not very well hidden of course you can't really hide a piece of random looking code on the front of a ROM but it was not obvious from the normal interfaces and as I was looking in the inside of the CD block code I realized that this was actually encryption it was an encrypted chunk of data I go why is this encrypted this must be important and possibly interesting and as I continue to dig I found that it was actually a piece of code that would be loaded into the city block CPU so the city block is like this walled little fortress you can send in commands you can get CD data but because it manages the copy protection it doesn't let you run code on there it tries to keep itself completely sealed off so finding that there might be a way to run code on there meant maybe I could find a way around the copy protection maybe I could make a mod chip that would plug in this slot so instead of having to pull your whole console apart and put in this kind of really janky piece of circuitry that tacks into the CD drive cable maybe I could just make a neat thing where you pop open the port on the back shutter singing in and off you go which would be great and then as I did some further digging I found there are some some reasons that that might be a little bit difficult and did more digging and more dignity and more digging and eventually I somehow came to the conclusion that what I should really do at this point is ditch the CD drive all together and essentially insert tentacles through the video CD slot straight into the CD be brain of the system so at that point I embarked on developing a card that would plug into this slot so no soldering they're taking out screws no anything that would have at the time I envisioned up with an SD card this thing would have an SD card you plug it in and it would basically replace the CD drive so instead of putting a CD and you'd put an SD card with an ISO on for example and essentially that's what I've ended up doing over the time the design has changed a little bit I realized it would make a lot more sense to support USB because of course you can get much bigger USB drives if you want to support storing more than one image on there and essentially it's something I've worked on on and off in my spare time over several years it's been my longest-running project by far this is now at the point where not only can it boot and run games I've finished just recently in fact putting in audio supports so it can play audio tracks which many games of course use for background music in that era and I also took the opportunity to add some features there I thought would be nice to have that you can have with this technology so I for the time being possess the only satin in the world that's capable of writing files to a USB stick so there's actually for developers in homebrew and anyone else who might want to be enthusiastic about this there's the ability to actually read and write files directly on the on the USB stick that's attached to the device so managing your safe games and I'm hoping to go back to the original plan back to chip music and in that case you'll be able to load sample store your songs on your USB because we're also going to do it exactly so a question to do with the the cd-rom reading and the way the sectors are set up on the disk let's just say your drive had packed it up like a died in your Sega seven which is happening with a lot of them absolutely um so you could you take your games for instance put them in your PC rip them and then use this player to play them yeah you absolutely can so the unlike some other consoles the satin discs are not protected from reading at all you can read the entire thing no problems I know there are a lot of machines like mine for example where the CD drive is actually dying of old age I mean I have to admit I never imagined that solid-state lasers would die of old age I thought they were pretty bulletproof but it's it seems to be an incredibly common problem and it's actually something I wrestled with when I was starting to do my research and how the drive protection worked because it wouldn't read the real disks after time which was infuriating and those mechanisms are getting harder to find and harder to replace of course as they get older and older and of course all the replacements if you get them secondhand can have the same problem so really there's those two things on we achieve one is the sort of archival side of things I would like people to be able to trust that these systems are going to keep running you know with fully replaceable solid-state systems of course now hopefully that can happen forever and the other aspect is that I would like to enable people who would for example like to exploit more of the power of their systems I think previously with homebrew being predominantly through burning CDs it's a bit of a high threshold for people to get into and mod chips are hard to find you know if you make these things more accessible you open up that consulta more people and the architecture I think can be quite powerful if you can handle it correctly and I'd be really excited if if this can open up more possibilities for people either musically or wider demo programming or who knows what else absolutely and for the music aficionados out there we're talking it's this is from memory 32 operators of FM that can be chained in any way you want and terminated and pulled out of the chain at any point so I have to say it has it has been about a year since I myself looked at the documents that ESI John is it yeah so from memory I mean it does have 32 channels you can load arbitrary samples and chain them in arbitrary ways to modulate each other there's a super complicated way of doing inserts and and mixing and turning there's a lot of configuration registers and it also includes a programmable DSP which you can mix in two different channels so that means if you wanted to get really crazy you could actually program your own DSP FX which I haven't seen anyone doing and I love to Wow so can you do delay lines and things you have like IDM is stuff you've got a little bit of memory there and there are DMA facilities as well so there's a 68k that exists just to service the sound chip oh that's a lot it yeah so there's a lot of beef there there's a number of other features that aren't aren't very obvious about it so the SES B has native MIDI for example so if you have the right adapter you can connect to the communication port at the back of the console and then 2 media at the other end and that's basically there's there's no electronics in the store it wires it straight through I mean there might be an opto isolator but there's there's nothing to it you can do both any time so it's got a native MIDI interface it actually has digital i/o interfaces as well so there's essentially I squared s buses that run up to the cartridge port at the back of the console so you could build a cartridge that has for example SPF in and out and then hook them up to an audio workstation if you want to do your sample prep that way for example Wow another it's just super clean audio output as well absolutely because is the audio internally filtered it is a bit rubbish I think like it's it's it's a bit noisy and the design is you know it's that's not winning any prizes I think but it's quite straightforward great well this is excited let's have a look at it so this is this is my development system so this is a regular old Japanese seeker Saturn but I've basically taken out all the parts that either I don't need or that posed a threat to me so over here the power supply is disappeared because 240 or 110 volts hanging around when you're poking at five volt systems is a recipe for sticking your elbow in pain I don't recommend that the CD drive has disappeared as well so that normally sits bang in the middle of everything like so on a big metal plate which you will also see is missing so funnily enough I don't need the CD drive since I'm developing a replacement so that gets to go out of the way and out of the picture within the console itself I think the most exciting thing everyone will agree is this board over here in the corner so this corner is where the video CD card would normally slot into a console so in most consoles this slot is permanently empty in this case it has my prototype board you can tell it's a prototype because it's incredibly ugly and has all sorts of crap hanging off it fitting out the back is the USB port there's a debug port for the CPU so that's how it's programmed and controlled when it's running and there's also a programming port for the CPL V so there's a programmable logic device on the backside of the board so we want to take a quick look at the other side of the board there's not much to the electronics not compared to the original board that was in there anyway so down here we have a CPL D so that basically lets me implement a bunch of digital glue logic to connect the bus that used to hold the MPEG material to my own microcontroller over here so this is an arm microcontroller it's actually reasonably powerful it runs at 72 megahertz which does make it the fastest piece of gear in this particular machine but it has the properties not only that it's conveniently small but it has enough power to do all the heavy lifting to convince the Saturn that there is in fact CD data streaming in from this USB port conveniently located over here apart from a voltage regulator over in this corner there's nothing else to it this is a bit of input protection or IO protection as well well there is no IO protection there is all that's that's not true so these resistors here are just series termination for some of the high-speed lines essentially they were put in as design insurance so this is the first revision of the board this is the one where I came up with the idea and thought I know I'll build it like this and then you can see from the presence of these little colored wires on the surface that in fact the way I thought have worked is not always the way it actually worked luckily you know after a bit of experience with these things you get quite good at patching up your mistakes and of course somewhere down the track I will actually make a new revision of this circuit board and erase all evidence that I ever made any mistakes of any kind at any time affectionately known as bodge wires exactly so there's a good collection on this board but any off see the much worse layout than that that's actually quite nice layout do you have any problems with timing and the way you had to change let lengths of your bus or anything like that or is this little enough clock speed that it does I had a couple of termination issues early on so I seem to recall it's probably why this little Bob's resistor is there and I think oh that's a bodge cap actually and there's a bob cap somewhere on this side as well here we go but apart from the termination issues there's no that there haven't been any signal integrity issues whatsoever which has been lovely so when you fire it up take us through it alrighty so the way this is set up at the moment it takes over the console at the point where it boots into the CD player so as it's part way through booting into the CD player it takes over fades it out and then brings you to a menu the menu exposes basically all the files on the USB Drive so in this case this is just my testing drive that's really not a lot on here at the moment the most important thing to do is hit the green button which will load whatever you're pointing out into the virtual drive and start the boot sequence roxeanne how many times have you heard his song more than I would like to up their amazing painfully capturing but geez it works straightaway like this it's about the same load time and it's real time I see it absolutely it follows the timing of the original quite faithfully that's brilliant so I have had a feature request to essentially put it into kind of a turbo speed mode and just throw data at it as fast as it can handle which is an interesting idea for homebrew software or for testing or for that kind of thing but I'm also quite wary of what might happen with that sort of thing the operating system inside the CD block actually runs several different tasks simultaneously and it's obviously been quite carefully tuned so that they can all run and keep everything going on at the same time with quite limited resources so if you were to try and run it faster you increase the risk that everything is going to collapse and it's just going to stop any of these old systems because they were never designed to be faster or slower overclock do I have different components put in them so the components were very much on edge they were all just time exactly and one thing would feed something you know just as another expected and something so all the processes were very matched as far as I understand absolutely so that's something that's proving an obstacle to emulation so one thing I've been doing with this is that all the reverse engineering I've done an understanding how it works and pulling it apart I've shared that with emulation authors and I've actually been working with a couple to try and help them implement emulating the CD block using the dumped rom inside their emulator so this has been difficult to emulator authors in the past because without being able to see the original code they can't specify how it works they basically have to try and work out what it's supposed to do based on the publicly available documentation which is almost nothing they've done a great job based on what they have but by actually being able to look under the hood and see how the thing works in the first place that means they'll actually be able to get cycle accurate emulation one of the biggest challenges there is actually because it's timing sensitive it's trying to stream you know data coming off a CD there's no buffer in between it has to pick the data up as it comes and then also get that to the rest of the system so this is exposing areas where the emulators had never had to deal with this particular piece of detail before and that's actually quite challenging there's some sort of fundamental reaction that has to go on here for it to support those particular things accurately and it's some of that to do with like over sampling the way it does its instructions and things so we can do stuff with a sort of sub instruction level and have timings and things or it is it's similar to that but kind of the other way so emulators for the sake of efficiency even when there are two CPUs in hardware that would normally run off the same clock instead of running them both one for one for one they'll actually run them in blocks I'll run this CPU for 100 instructions this CPU for 100 instruction this GPU for 50 and all the different parts of the system run sort of in sync but slightly they're not actually being run at the same time so you can add poor States as long as the output you're getting at the end of a set of instructions is that right that's the idea so that's that's one of the big sort of challenges than approximations in emulating multi-threaded systems like this so there's all these things that are happening in parallel and you could emulate each one cycle by cycle destroy your time efficiency because you you know your CPU cache won't hold everything so it's a compromise and it does diminish accuracy and it's really about choosing how you make those compromises so to try and implement this particular bit of emulation it means going back and changing some of the compromises that were made previously what's this going to do for the seiga-san scene that's out there so there's a few things one of the things in the most immediate term is that the information I've gleaned from the reverse engineering efforts is actually now feeding into emulation so it will improve the fidelity of basically all the CD operations which have been a black box until now so that's a nice thing that's that's already happening in the longer term you know I want to turn this into a piece of hardware that people will be able to get their hands on so one of the problems with mod chips at the moment is people don't make them anymore so I there are some open source mode ship plans now but still the you know it's quite a high barrier to entry and if you bought a seat satin yeah and you don't have a soldering iron and things like that I mean it's a big thing to add a mud ship and risk your hands absolutely so so the mod ship is a barrier to homebrew and a barrier to using it at all is the fact that these consoles the CD drives are slowly dying and you know it was especially in the West was never that popular a console in that generation and so finding spare parts is actually difficult so ultimately I'd like to help not only homebrew become more accessible and also more powerful with the USB interface but I'd like to see it with a place in archiving I think it would be really nice to know that essentially everything will remain accessible even when you're absolutely right you know completely gives it up that you'll still be able to use your console all of its features as it was intended and what's been the most awesome thing you discovered about satin or maybe the scene and everything around it so far I don't know actually that's a really good question I'm I'm certainly pleased to find that the scene is you know full of people who are really interested and excited and just passionate about what they do some of these patterns are very specific some people go and you know collect every ROM dump chip they can find and you know it's it's a kind of similar role to being a librarian I guess you just have that passion for information and for collecting it and you know manicuring it getting good information together which is really fascinating to see I think it's really really lovely that people do these things in their spare time I couldn't have done this project without standing on the backs of others so one of the biggest things when I dumped this ROM so I couldn't have dumped the ROM without schematics that people had published so there are reverse engineered schematics there are leaked schematics but there's just these little fragments of information that people are brought together and that was the gateway into dumping the ROM in the first place then when I dumped the ROM I had this huge blob of binary there was all his code and I didn't know where anything was and just to be able to find my way and then map my way around I had this map of what all the different CD bot commands were that you could ask it to do and that was documented by emulator authors and published in a wiki so one of the big emulators yabbos like don't know how you pronounce it but there you go on their wiki publish all the different CD commands that they know of and what they think they do and that basically was the first thing I looked for when I got this wrong I went okay somewhere in here is a big table that dispatches all of these commands and it was like a rosetta stone you go these commands effect this stuff and oh look the code they run is all over here this other group of commands does these other things and so it showed me around the ROM and showed me where everything was so without that it would have been ten times a hundred times harder I don't think I would have gotten there eventually would you love to release some kind of just card that people can purchase yeah so I think at this point I've you know this has been on hiatus for a while I was finishing my PhD getting some stuff sorted and now I've basically decided it's crunch time I really want to get this to the point where people can actually have it in their hands they can plug it in they can do so really there's now it's just a question of what form that's going to take what features it's going to have so I want to keep it simple and it will be firmware upgradeable there will be the opportunity to add some more stuff to it later but I want something that's simple and reliable that's how I like my things to work I I'm just going to assume everyone feels the same less features more good still to decide is how it's going to look so maybe it will just be a bare card and you have to figure out how to put it in there and keep it in there also to decide maybe some accessory kits would be neat one thing I personally would quite like to do is to build a kit where you can take a 2.5 inch hard drive and actually build it inside the console so take out the CD drive put in your hard drive and just have it as a complete replacement so you know with a few few little bits of wire and do a bit of soldering that will definitely possible it's just a question of how people can exercise you you you

Channel: debuglive

Views: 4,257,489

Rating: 4.8917713 out of 5

Keywords: sega saturn, hack, dr abrasive, flashcart, vcd, user port

Id: jOyfZex7B3E

Length: 27min 8sec (1628 seconds)

Published: Sun Jul 10 2016

Reddit Comments

[u/MattBoySlim]

WOW. Not only is the topic of this video ridiculously fascinating, but it's amazingly well produced! I really enjoy seeing how digging into the guts of a console and making new modifications dovetails with emulation efforts when it comes to preserving the history of our favorite pastime. My old PS1/PS2/Dreamcast optical drives are starting to fail, as are many others, so it's great to know that people are working on solutions to keep those generations alive in various ways.

[u/Vespera]

Does anyone know what software is he using? I really like the way the table relationships are displayed.

---

EDIT: Found it. The software is called "IDA" and the official website describes it as:

IDA is a Windows, Linux or Mac OS X hosted multi-processor disassembler and debugger that offers so many features it is hard to describe them all.

[u/FlukeHawkins]

That guy is nuts. I don't understand how people do this kind of indepth waveform reverse engineering.

[u/Jademalo]

What an absolutely fantastic video, I don't think I've been that engrossed in a 30 minute video in years.

There's only one thing I didn't quite understand - Why is getting audio streaming from his device different to getting game data streaming working? He mentions it here

Surely if you're streaming the data from the ISO then that would include the audio data?

[u/iToxBox]

I uses Pseudo Saturn Kai Gamer's Cartridge to play backups and save/import games save data to SD card. But this is impressive.

http://ppcenter.webou.net/pskai/

[u/[deleted]]

This has been a really interesting documentary (hell the production was better than most documentaries) i would love to see this kind of in-depth video on hacks/emulators/mods etc.

Also i really really hope the price will be kept low, i don't agree with the "i will buy it at the highest price first!" toxic buyer mentality, most if not 90% of the flashcarts/hacks never reach most of the retrogamers because of the steep price.

[u/z3rocool]

So where can I follow this guy? Couldn't seem to find a blog or anything to add to my rss reader to keep up with updates.

[u/AlxEllis]

This was super fascinating, thanks for linking this!

Saturn emulation has always been a bit of a pain :(

[u/Throwaway_43520]

Fascinating video and Dr. Abrasive's skills are intimidating.

That said several things:

1. The Saturn was not even close to being the "king of gaming consoles" unless we consider the week and a half it was out before the PlayStation.

2. We all remember SEGA carts announcing "SAAAAY-GAAA" when they were fired up. Was the recording different in their part of the world? I say that because regional differences in pronunciation and vocabulary are perfectly reasonable - but you'd think they'd be able to say the name of the company right!

3. The arcade titles "looked amazing"? Really? Correct me if I'm wrong but I thought the 3D capabilities of the system were essentially a late addition and the reason those ran so terribly.

Weird niggles aside it was an amazing video and I really admire people who put in this much effort into putting right some little part of the world. Solve those problems, yo.