How to Create a Zero Key (PIC) For Net Booting and CF on NAOMI Chihiro and Triforce
- Thread starter rtw
- Start date
In a glance:
1. Netboot zero pic: Allows netbooting and has the DES decryption key set to all zero's
2. Netboot non zero pic: Allows netbooting of only one specific game encrypted with the des key in the pic.
3. CF boot zero pic: Allows booting from compact flash / gdrom and has the DES decryption key set to all zero's
4. CF boot non zero pic: Allows booting from compact flash / gdrom of only one specific game encrypted with the des key in the pic.
4. Is the security pic that comes originally with a game. Original security pic's usually have a strange housing for easy insertion / extraction.
The original sega firmware for compact flash boot only works with a specific brand of compact flash cards. If such a firmware is used with another brand of compact flash card, the system will reboot after approx. a minute with an error 33 screen.
Some security pic's floating around do not work on a chihiro / triforce type 3. This is due to the pic's configuration settings. Probably an incorrect oscillator setting will cause a security pic to not work on a type 3.
On most programmers, the security settings are a separate setting, and the configuration word for it is not included in a firmware image.
As cherry on the cake, some programmers seem to byte swap a firmware image (swap even and uneven bytes)
The difference between a netboot pic image and compact flash image is one byte. It's the response to the AIJYOANSWER command that ends either with 1 or 0
***********************************************************************************************************************************
I just tested on a chihiro 3 and the zero pic with the AIJOANSWER ending with 1 seems to work for both netboot and compact flash.
**********************************************************************************************************************************
That's with the firmware update that allows to boot from any compact flash card.
I will now test if it still netboots with the compact flash card in place. This would basically mean that only the jumper needs to be changed to switch between netboot and cf boot. It would be great if someone could test this behavour on triforce 3.
1. Netboot zero pic: Allows netbooting and has the DES decryption key set to all zero's
2. Netboot non zero pic: Allows netbooting of only one specific game encrypted with the des key in the pic.
3. CF boot zero pic: Allows booting from compact flash / gdrom and has the DES decryption key set to all zero's
4. CF boot non zero pic: Allows booting from compact flash / gdrom of only one specific game encrypted with the des key in the pic.
4. Is the security pic that comes originally with a game. Original security pic's usually have a strange housing for easy insertion / extraction.
The original sega firmware for compact flash boot only works with a specific brand of compact flash cards. If such a firmware is used with another brand of compact flash card, the system will reboot after approx. a minute with an error 33 screen.
Some security pic's floating around do not work on a chihiro / triforce type 3. This is due to the pic's configuration settings. Probably an incorrect oscillator setting will cause a security pic to not work on a type 3.
On most programmers, the security settings are a separate setting, and the configuration word for it is not included in a firmware image.
As cherry on the cake, some programmers seem to byte swap a firmware image (swap even and uneven bytes)
The difference between a netboot pic image and compact flash image is one byte. It's the response to the AIJYOANSWER command that ends either with 1 or 0
***********************************************************************************************************************************
I just tested on a chihiro 3 and the zero pic with the AIJOANSWER ending with 1 seems to work for both netboot and compact flash.
**********************************************************************************************************************************
That's with the firmware update that allows to boot from any compact flash card.
I will now test if it still netboots with the compact flash card in place. This would basically mean that only the jumper needs to be changed to switch between netboot and cf boot. It would be great if someone could test this behavour on triforce 3.
Last edited:
Hackcell
Grand Master
Question... what programmer and SW are you using?Device: PIC16F628A
The archive contains 2 files:
ABC_BIN_0000000000000000.bin
Suitable for CF and standard GD-ROM, DES KEY = 0000000000000000, Loader name: ABC.BIN
ABC_BIN_0000000000000000_NET.bin
Suitable for Net-Booting, DES KEY = 0000000000000000
archive: View attachment naomi_pic.zip
The following programmer settings should be used.
Oscillator: HS
WDTE (watchdog) disabled.
PWRTE (power up timer) enabled.
Code Protect: All protected
MCLRE should be set to internal also called "disabled"
BOREN/BODEN (brown-out reset) disabled.
LVP (low-voltage programming) enabled.
CPD should be 0, meaning that data code protection is on
This should give a config word of: 0x1e82
Huge thanks to @zeruel85 for verifying these settings
Note:
Currently it is unclear which setting one should use with Triforce Type 3, this post will be updated when we know more.
Verified Compatibility:
CF and standard GD-ROM
NAOMI1, NAOMI2
Net-Boot
NAOMI1, NAOMI2, Chihiro
It shouldn't matter. The software comes with the programmer.
Just watch out for the common programmer booby traps:
Some programmers assume the file is little endian and swap all odd / even bytes.
Some programmers invert the configuration bits.
Any programmer capable of programming the PIC16F628A should work.
On chihiro 3, there is a security pic that works for both netboot and compact flash boot.
It wouldn't suprise me it works for both on naomi / triforce as well.
Just watch out for the common programmer booby traps:
Some programmers assume the file is little endian and swap all odd / even bytes.
Some programmers invert the configuration bits.
Any programmer capable of programming the PIC16F628A should work.
On chihiro 3, there is a security pic that works for both netboot and compact flash boot.
It wouldn't suprise me it works for both on naomi / triforce as well.
I just got a PM confirmation that the netboot version works for both netboot and compact flash on triforce 3 as well.
So the compact flash version is only needed for naomi / naomi 2.
Now we need someone who can fix that in the netdimm firmware as well.. This would hopefully end all the security pic issues.
So the compact flash version is only needed for naomi / naomi 2.
Now we need someone who can fix that in the netdimm firmware as well.. This would hopefully end all the security pic issues.
mathewbeall
Enlightened
I can confirm this as well..... same key works on both platforms (Triforce and Chihiro - Type 3), for both CF boot as well as NetBoot.
Anyone able to try the hex attached to my earlier post for netbooting on NAOMI? I've confirmed it works for CF loading.
[Here]
Might be worth testing on Chihiro and Triforce too. I don't have either of those systems to test, but this hex image should in theory allow dual netbooting and CF loading (with DIMM jumpers set as required) for all systems.
Thank you for the feedback gents, I have updated the first post.
So now we know that there is nothing special with the PIC on the Chihiro and the Triforce
hamster
Student
- Joined
- Jul 18, 2017
- Messages
- 87
- Reaction score
- 26
Hmm... I have a chihiro ( actually 4 of them ) that I cannot get this PIC to boot a zero key CF Card image and I can get an original security key to boot an encrypted non Sega Branded Card ( So i know the modified firmware works & hardware works) , but taking the same BIN file, decrypting it, it will net boot ok, and if i write it to a CF card, i get Error 26 .
Funny thing, if i net boot the game, turn it off, switch it back to "GD ROM" Mode, turn it on without a CF Card, I get Error 25 ( which is what i would expect ) , Turn it off, Put the CF Card in with the same netboot binary, Turn it on, it loads up just fine ( CRC check matches ) [ Yes, i have a good battery ]...turn it off, wait 10 minutes, turn it on, again, CRC passes, Game loads, but if i unplug the battery on a power cycle, bam error 26 again. its like it can't read the Game BIN on the CF Card? but only does it with the Zero Key. ( i confirmed that ABC.BIN is on the card along with the game BIN file )
need to test encrypting another game with the same Key I have and see if it boots.
Any thoughts?
Funny thing, if i net boot the game, turn it off, switch it back to "GD ROM" Mode, turn it on without a CF Card, I get Error 25 ( which is what i would expect ) , Turn it off, Put the CF Card in with the same netboot binary, Turn it on, it loads up just fine ( CRC check matches ) [ Yes, i have a good battery ]...turn it off, wait 10 minutes, turn it on, again, CRC passes, Game loads, but if i unplug the battery on a power cycle, bam error 26 again. its like it can't read the Game BIN on the CF Card? but only does it with the Zero Key. ( i confirmed that ABC.BIN is on the card along with the game BIN file )
need to test encrypting another game with the same Key I have and see if it boots.
Any thoughts?
hamster
Student
- Joined
- Jul 18, 2017
- Messages
- 87
- Reaction score
- 26
I used the glci and naomiCF i tried both.. ( note, If i used the GLCI app, and wrote an encrypted file to the CF card, the game boots it fine using the stock sega security key for that game ) -- didn't try NaomiCF as it only uses the ABC.BIN loader file. ( GLCI allows me to make it the correct name for the Sega Security Key )
I am using a GQ4 , however, I do know of the byteswap issue, so i was able to open the BIN file in HXD, save as Intel S16 which GQ then loads up fine ( first 4 bytes 0x0528 )
The security pic does net boot just fine.. which is why i am puzzled.
I am using a GQ4 , however, I do know of the byteswap issue, so i was able to open the BIN file in HXD, save as Intel S16 which GQ then loads up fine ( first 4 bytes 0x0528 )
The security pic does net boot just fine.. which is why i am puzzled.
Hi rtw, I saw everyone is interested in "NETboot" pic, maybe I am the only one want to make a "normal" Gd-rom PIC.
I am using TOP3000 programmer, load the file "ABC_BIN_0000000000000000.bin" and followed the setting, Naomi shows error 26 when i try to use this pic to load gd-rom. i realized i can't make the register as 0x3F82 in programmer.
Is there any hints for me please? I want to use this pic to load a "dimm update disc" to update my netdimm from 2.13 to 3.17, thanks a lot!
I am using TOP3000 programmer, load the file "ABC_BIN_0000000000000000.bin" and followed the setting, Naomi shows error 26 when i try to use this pic to load gd-rom. i realized i can't make the register as 0x3F82 in programmer.
Is there any hints for me please? I want to use this pic to load a "dimm update disc" to update my netdimm from 2.13 to 3.17, thanks a lot!
hamster
Student
- Joined
- Jul 18, 2017
- Messages
- 87
- Reaction score
- 26
@typanhk , do you have the actual update disc? you will need to change the key and file name in the pic in order to boot a geniune gd-rom.
if you know someone who has a network media board, you can swap it onto your 2.13 and netboot the firmware update to it to bring it to 4.02 if you have a zero key.
if you know someone who has a network media board, you can swap it onto your 2.13 and netboot the firmware update to it to bring it to 4.02 if you have a zero key.
@hamster, i haven't buy the update disc yet, i just try to burn the PIC for normal games like snk vs capcom2, in order to make sure i can burn the PIC correctly.
Thanks for your suggestion! I have another unit of 4.02 dimm and zero key with PIforce. I am going to follow your method and try tonight. "network media board"means the topper layer PCB inside the netdimm right?
Thanks for your suggestion! I have another unit of 4.02 dimm and zero key with PIforce. I am going to follow your method and try tonight. "network media board"means the topper layer PCB inside the netdimm right?
