Comments on: Trojan Update http://www.raidenii.net/2010/05/trojan-update/ YOUR MISSIONS! Thu, 05 Jan 2012 00:18:29 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: trap15 http://www.raidenii.net/2010/05/trojan-update/comment-page-1/#comment-114 trap15 Tue, 21 Dec 2010 21:43:01 +0000 http://blea.ch/~r2proj/?p=15#comment-114 The first one is what we've been doing :3 The first one is what we’ve been doing :3

]]> By: dlfrsilver http://www.raidenii.net/2010/05/trojan-update/comment-page-1/#comment-113 dlfrsilver Tue, 21 Dec 2010 18:29:42 +0000 http://blea.ch/~r2proj/?p=15#comment-113 Then 2 solutions applies. Using modified rom code to check the board registers in step by step, and compare with the samey on mame. The other would be to disassemble the whole code eprom, and seperate the bytecode parts in the game code. trojaning anyway would be the thing to do. ;) Then 2 solutions applies. Using modified rom code to check the board registers in step by step, and compare with the samey on mame.

The other would be to disassemble the whole code eprom, and seperate the bytecode parts in the game code.

trojaning anyway would be the thing to do. ;)

]]> By: trap15 http://www.raidenii.net/2010/05/trojan-update/comment-page-1/#comment-111 trap15 Mon, 20 Dec 2010 21:47:52 +0000 http://blea.ch/~r2proj/?p=15#comment-111 We've taken an analysis of the bytecode (we know some of the opcodes due to the HLE and some guessing), and it seems completely alien. The SEI1000 is likely a custom chip built from Toshiba logic blocks, but we are fairly sure that the "CPU" is completely custom, as it does not match any CPU we've ever seen before. Decapping them is only partly useful; if they're logic blocks, a decap will not help very much, but a full layer-by-layer stripping will work (though that costs FAR more money). We’ve taken an analysis of the bytecode (we know some of the opcodes due to the HLE and some guessing), and it seems completely alien. The SEI1000 is likely a custom chip built from Toshiba logic blocks, but we are fairly sure that the “CPU” is completely custom, as it does not match any CPU we’ve ever seen before.
Decapping them is only partly useful; if they’re logic blocks, a decap will not help very much, but a full layer-by-layer stripping will work (though that costs FAR more money).

]]> By: dlfrsilver http://www.raidenii.net/2010/05/trojan-update/comment-page-1/#comment-110 dlfrsilver Mon, 20 Dec 2010 15:24:48 +0000 http://blea.ch/~r2proj/?p=15#comment-110 mmhhhh okkkk :D ! Because i own Zero Team, and Legionnaire. Those 2 fellas use the dreaded protection. On legionnaire, the SEICOP protection is used for the sprites control and priorities, from what i've seen between my original board and the mame emulation. On zero team, it should be nastier.... I guess decapping the chips will be useful. Because at first we don't know what kind of MCU, CPU or whatever is lying under the SEIXXXX part numbers. Look at the C-chip on taito boards, who will have known that it was a second z80 with 8kb ram + 8 kb rom ? Legionnaire would be maybe a good start to begin with, because the game displays the graphics, only the game logic is lacking. don't you think ? mmhhhh okkkk :D ! Because i own Zero Team, and Legionnaire. Those 2 fellas use the dreaded protection.

On legionnaire, the SEICOP protection is used for the sprites control and priorities, from what i’ve seen between my original board and the mame emulation.

On zero team, it should be nastier….

I guess decapping the chips will be useful. Because at first we don’t know what kind of MCU, CPU or whatever is lying under the SEIXXXX part numbers.
Look at the C-chip on taito boards, who will have known that it was a second z80 with 8kb ram + 8 kb rom ?

Legionnaire would be maybe a good start to begin with, because the game displays the graphics, only the game logic is lacking.

don’t you think ?

]]> By: trap15 http://www.raidenii.net/2010/05/trojan-update/comment-page-1/#comment-107 trap15 Mon, 20 Dec 2010 00:49:15 +0000 http://blea.ch/~r2proj/?p=15#comment-107 Well, for the most part, we've uncovered that the protection runs bytecode, and the games using it upload a table of commands (made up of bytecode) to the protection. Whenever the game sends a specific trigger, it executes the bytecode in the command that was triggered. The difficult part is understanding the construction of the bytecode; it's essentially reverse engineering an entire CPU with no documentation :P Hopefully you can understand why there has been little progress lately on this protection. It's one hell of a scheme! Well, for the most part, we’ve uncovered that the protection runs bytecode, and the games using it upload a table of commands (made up of bytecode) to the protection. Whenever the game sends a specific trigger, it executes the bytecode in the command that was triggered. The difficult part is understanding the construction of the bytecode; it’s essentially reverse engineering an entire CPU with no documentation :P
Hopefully you can understand why there has been little progress lately on this protection. It’s one hell of a scheme!

]]> By: dlfrsilver http://www.raidenii.net/2010/05/trojan-update/comment-page-1/#comment-106 dlfrsilver Mon, 20 Dec 2010 00:24:10 +0000 http://blea.ch/~r2proj/?p=15#comment-106 Hi there, can you hint about what the protection is doing overall ? Hi there,

can you hint about what the protection is doing overall ?

]]>