SEGA 317-xxxx Security Parts List and FD10xx cracking ;-) A Sega FD1094 encrypted 68000 module A Sega FD1149 A System 16 PCB with Hitachi FD1094'. Click the pic for a better view Here's how the cracking works in very simple terms.... The basic method involves using a Sega System 24 PCB to extract data from the FD1094. The System 24 board is used because it has 2 CPU's whereby the standard 68000 can be used to communicate with the FD1094. The FD1094 has a pinout that is compatible with a standard 68000, so any FD1094 can be plugged into the System 24 board, including those that run on System16/18/24 and X/Y Board hardware. Breaking the FD1094 encryption involves re-programming the System 24 boot ROMs with a custom trojan program and running small pieces of hand-written code that talks to the FD1094 and the results collected from shared RAM by a custom program running on System 24's normal 68000. The data is sent to the PC via a small custom USB adapter board that connects to the auxillary controls expansion connector on the Systm 24 board. The amount of data collected is exactly 128 Megabytes. The method, software and adapter board was developed by Charles MacDonald. Another custom program by Dr. Nicola Salmoria analyses the downloaded 128M of tables and data then creates a key file which is used to decrypt the data. The battery-backed RAM inside the FD1094 is 8K. The key file is also 8K. There is a great degree of confidence that the derived key file is exactly the same as what is inside the 8K battery-backed RAM. It's not possible to directly read it to verify that conclusion, but the resulting decryption of the encrypted code is probably proof enough that it's correct. Due to the state-changing nature of the FD1094, it was initially thought that it would not be possible to decrypt the code then just plug in EPROMs containing unencrypted code into the PCB. However, with decrypted code and modifications to make it work, this is exactly what has happened. If you search with google you can find large archives of Sega decrypted ROMs for almost all of the System 16/18/24/32 games. Now that the FD1094 encryption is broken, we need access to all the FD1094's (and other security CPU's) to dump out relevant info to assist with decrypting each game. For the moment we only need the FD1094's. Hopefully the other security parts will be looked at in due course :-) Some of this info is a bit sketchy and sparsely documented so if you can help with missing info or corrections, let me know. We need all the FD1094's to complete the decryption of all FD1094-encrypted games. If you can help out by buying/loaning some of them to us, speak up! Update: This list is mostly complete now. The number of undumped FD1094's still alive is probably zero so basically what is done is what you get. This page deals with only Sega part numbers 317-xxxx. Note anything listed extra (i.e not FD1094's) are listed for reference. Also note that some of these numbers may be incorrect, or missing or actually not FD1094s (might be 8751's/Z80's or other protection chips instead) We'll know more once the wanted list gets shorter :-) Additionally, Dave Widel has dumped some tables from a NEC MC-8123B and Nicola has made progress decrypting the first one. So we will require all NEC MC-8123B's also as well as the 1 remaining custom Z80 (to be sent to Dave Widel) Update: Nicola has cracked all of the custom Z80's and MC-8123 CPUs so we don't need them now. Update 2019: The encryption is well understood now and any game encrypted with a FD10xx can be brute-force decrypted, so dumping any of the remaining FD10xx security modules is no longer required. The information in MAME has been used to create decrypted ROMs that will work using a standard 68000. Additionally, using information from MAME the original FD1089/FD1094 security modules can now be re-programmed with the decryption key using an Arduino. Google 'sega security programming guide' and you'll find all the info you need. This page remains here purely for historical purposes :-)

Note: The '# of Dumps' column refers to the number of good matching dumps taken from _different_ CPU's with the same Sega part number. Due to the volatile nature of the info held in these CPU's, it's important that we dump them from at least 2 different CPU's for verification.