SEGA 317-xxxx Security Parts List and FD10xx cracking ;-) A Sega FD1094 encrypted 68000 module A Sega FD1149 A System 24 PCB hooked up for 'dumping'. Click the pic for a better view. Thanks to Junoman for the pic :-) Here's how the cracking works in very simple terms.... The basic method involves using a Sega System 24 PCB to extract data from the FD1094. The System 24 board is used because it has 2 CPU's whereby the standard 68000 can be used to communicate with the FD1094. The FD1094 has a pinout that is compatible with a standard 68000, so any FD1094 can be plugged into the System 24 board, including those that run on System16/18/24 and X/Y Board hardware. Breaking the FD1094 encryption involves running small pieces of hand-written code on the FD1094 and the results collected from shared RAM by a custom program running on System 24's normal 68000 and sent to the PC via a small custom USB adapter board. The amount of data collected is exactly 128 Megabytes. The method, software and adapter board is the brainchild of Charles MacDonald. Another custom program by Dr. Nicola Salmoria analyses the downloaded 128M of tables and data then creates a key file which is used to decrypt the data. The battery-backed RAM inside the FD1094 is 8K. The key file is also 8K. There is a great degree of confidence that the derived key file is exactly the same as what is inside the 8K battery-backed RAM. It's not possible to directly read it to verify that conclusion, but the resulting decryption of the encrypted code is probably proof enough that it's correct. Due to the state-changing nature of the FD1094, it's not possible to decrypt the code and just plug in EPROMs containing unencrypted code into the PCB. However, we are hoping that eventually a method will be discovered to re-program the FD1094's so that dead PCB's can be revived. Since the FD1094 is a mass-produced item, it must be externally programmable somehow.... Now that the FD1094 encryption is broken, we need access to all the FD1094's (and other security CPU's) to dump out relevant info to assist with decrypting each game. For the moment we only need the FD1094's. Hopefully the other security parts will be looked at in due course :-) Some of this info is a bit sketchy and sparsely documented so if you can help with missing info or corrections, let me know. We need all the FD1094's to complete the decryption of all FD1094-encrypted games. If you can help out by buying/loaning some of them to us, speak up! This page deals with only Sega part numbers 317-xxxx. Note anything listed extra (i.e not FD1094's) are listed for reference. Also note that some of these numbers may be incorrect, or missing or actually not FD1094s (might be 8751's/Z80's or other protection chips instead) We'll know more once the wanted list gets shorter :-) Additionally, Dave Widel has dumped some tables from a NEC MC-8123B and Nicola has made progress decrypting the first one. So we will require all NEC MC-8123B's also as well as the 1 remaining custom Z80 (to be sent to Dave Widel) Update: Nicola has cracked all of the custom Z80's and MC-8123 CPUs so we don't need them now.

Note: The '# of Dumps' column refers to the number of good matching dumps taken from _different_ CPU's with the same Sega part number. Due to the volatile nature of the info held in these CPU's, it's important that we dump them from at least 2 different CPU's for verification.