InfiniKey-CPS2

[nobody]

Could you program a PIC with a null key?
https://github.com/ajefr/CPS2_Modchip

Or have you tried installing a new battery and injecting the null key once?

There's no hex file for a PIC with null keys.

It does work if I install a battery and inject null keys with the Arduino, but the point was getting rid of said battery.

 

[skate323k137]

There's no hex file for a PIC with null keys.

It does work if I install a battery and inject null keys with the Arduino, but the point was getting rid of said battery.

I see. If it were me and I didn't feel like chasing the ghost in the machine I would either battery it, or try to see if someone can compile the hex with a null key... surely that would be easy if the source code is available.

 

[nobody]

try to see if someone can compile the hex with a null key... surely that would be easy if the source code is available.

I'm not that knowledgeable but I try to improve myself every day.
I guess I could compare two hex files using an editor and spot where the keys are stored in the file (hopefully they're no compression or weird data manipulation going on).
That's a good challenge, I like it.

 

[nobody]

Here is my progress.

First I compared two hex files selected randomly (19xx and avsph) :

Only 4 lines are different (2 to 5).

Now the question is, how to make the link with the keys?

{ 0x07,0x00,0x02,0x40,0x00,0x0A,0x04,0xC2,0xA4,0x02,0x02,0x20,0x04,0x3C,0x2F,0xEB,0xE0,0x63,0x81,0xC0}; //19xx
{ 0x0F,0x00,0x02,0x40,0x00,0x08,0x04,0xC0,0xB1,0x20,0x79,0xAB,0xE9,0xC6,0xCF,0x09,0x42,0x5B,0x52,0x38}; //avsph

[EDIT]
I think I got it:

19xx

:10000000FB2B00308A000408840A8207003407347E
:1000100000340234403400340A340434C234A4348A
:1000200002340234203404343C342F34EB34E034D2
:1000300063348134C03461346A3465345F34663487

avsph

:10000000FB2B00308A000408840A820700340F3476
:10001000003402344034003408340434C034B13481
:1000200020347934AB34E934C634CF340934423423
:100030005B345234383461346A3465345F34663446

So now I need to:
- replace those 20 values by 0xFF
- understand how is calculated the checksum for each line (it's probably well documented somewhere in the datasheet or on the web)

 

[nobody]

Well it didn't take long to understand the checksum calculation:

:10000000FB2B00308A000408840A820700340F3476
= 100 - (10 + 00 + 00 + 00 + FB + 2B + 00 + 30 + 8A + 00 + 04 + 08 + 84 + 0A + 82 + 07 + 00 + 34 + 0F + 34) => discarding MSB
= 100 - 8A
= 76

Now I'm going to handcraft a new file with null (0xFF) keys.

 

[nobody]

Here's what I got for lines 2 to 5:

:10000000FB2B00308A000408840A82070034FF3486
:10001000FF34FF34FF34FF34FF34FF34FF34FF3448
:10002000FF34FF34FF34FF34FF34FF34FF34FF3438
:10003000FF34FF34FF3461346A3465345F3466342E

Which gives the following hex file:

:020000040000FA
:10000000FB2B00308A000408840A82070034FF3486
:10001000FF34FF34FF34FF34FF34FF34FF34FF3448
:10002000FF34FF34FF34FF34FF34FF34FF34FF3438
:10003000FF34FF34FF3461346A3465345F3466342E
:02004000723418
:1006B0000234831605111F1185109F108312051136
:1006C00085108512051408008316851205111F1167
:1006D00085109F1005101F1041308312A100EE30CD
:1006E000A000A00B712BA10B712B000059238312CA
:1006F000051505100B30A1006230A000A00B7E2B69
:10070000A10B7E2B000003308312A1009730A000C4
:10071000A00B882BA10B882B8D2B03308312A100FB
:100720009730A000A00B922BA10B922B972B03309C
:100730008312A1009730A000A00B9C2BA10B9C2B37
:10074000A12B8312A201A3012208013E84000120F3
:10075000A0000130A1002308073C013EB12B03108B
:10076000A10DFF3E031DAF2B210820050319BB2B54
:1007700083128516BD2B8312851285140330A100C8
:100780009730A000A00BC22BA10BC22BC72B83124A
:1007900085100330A1009730A000A00BCD2BA10B3A
:1007A000CD2BD22B01308312A0002008A3070830E4
:1007B0002302031CA42B0130A0002008A207143040
:1007C0002202031CA32B051105140330A10097304E
:1007D000A000A00BE92BA10BE92BEE2B83128510B7
:1007E0004130A100EE30A000A00BF42BA10BF42BA4
:0E07F00000005923FA2B5823A4008301642B28
:02400E00D431AB
:00000001FF

Going to test it in about minutes.

 

[nobody]

It works people!

A big thank to Eduardo Cruz and @aje_fr for their work.

Now if a new game/revision/set of keys is discovered we can easily handcraft a new hex file using the method above without knowing anything about writing code for PIC devices.

On a side note, if installing a PIC with NULL keys you won't have to worry about discharging the capacitors from time to time anymore.
I know I know, why using a phoenix version when you can restore keys for the OG code? There are a least two reasons to me:
- phoenix versions let you choose the region
- some hacks/conversions use null keys

 

[skate323k137]

Well done bud!

 

[JoeAwesome]

I'm trying to repair a CPS2 grey board set I've received, but I'll keep it on topic as much as I can. If an Infinikey was soldered on and taken off a ST board, what would it do if the board had Avalaunch chips already (no battery)? I think this may a root cause of the board not working at all (purple screen).

 

[nem]

No Infinikey and no battery with a decrypted program rom set should result in a working board. Have you tried shorting EXC5? Maybe it's still holding the keys in memory.

 

[JoeAwesome]

No Infinikey and no battery with a decrypted program rom set should result in a working board. Have you tried shorting EXC5? Maybe it's still holding the keys in memory.

I -think- I did with a screwdriver across all three points for a minute, and that didn’t help, but there’s a little dodgy soldering I may need to touch up from the uninstall. I also wasn’t using clips or have gone through the tester chip yet (next steps), but I was thinking the same about holding keys in memory. Just making sure I wasn’t missing anything key related.

 

[YesAffinity]

I -think- I did with a screwdriver across all three points for a minute, and that didn’t help, but there’s a little dodgy soldering I may need to touch up from the uninstall. I also wasn’t using clips or have gone through the tester chip yet (next steps), but I was thinking the same about holding keys in memory. Just making sure I wasn’t missing anything key related.

I've always used exc1 to short and clear any stored corrupted key information. It may be the same as shorting exc5 but thought it worth mentioning.

 

[JoeAwesome]

I tried shorting both, but I’m still getting a pink screen. At this point, I need to find a known working setup to test, but thanks for the suggestions.

 

[skate323k137]

Suicide tester rom time?

 

[JoeAwesome]

Suicide tester rom time?

Tried it. Still pink, bro. Raised voltages to just above 5v; used clips; tried with an uncased B board; reseated the C board. Nothing changed. Checked continuity on a couple unbent pins and where work was done installing/unstalling the infinikey, and everything beeped well. Unfortunately, I don’t know anyone with a gray set, locally, but it’s my best idea at this point to rule out one or both boards.

 

[Dubiyus]

I can make you a special one. 19XX EUR dump did not exist when original CPS2 Infinikeys were produced. Next production run will include it and a few more keys for other revisions not previously dumped.
-ud

What's the status of the Infinikeys? Sent a msg a while ago looking for a 10 pack but never heard anything back. Still looking for that 10 pack!

 

[Max7153]

Hey everyone,

I'm attempting to install an infinikey on a Capcom Sports Club (Euro) pcb. I have installed infinikeys successfully on the other cps2 boards in my collection. However, I am unclear where to begin on this one as it is unique with 2 tiers. Any help would be greatly appreciated.

 

[Kidkaos]

What's the status of the Infinikeys? Sent a msg a while looking for a 10 pack but never heard anything back. Still looking for that 10 pack!

Same, I need a 10 pack myself.

 

[xodaraP]

Hey everyone,

I'm attempting to install an infinikey on a Capcom Sports Club (Euro) pcb. I have installed infinikeys successfully on the other cps2 boards in my collection. However, I am unclear where to begin on this one as it is unique with 2 tiers. Any help would be greatly appreciated.

The add on board is additional ROMs for CSC - you get a smaller one on SSF2X

Pop the top board off and install Infinikey on B board as per normal

 

[ack]

Same, I need a 10 pack myself.

I'm in need of some too (Kabuki).

It looks like his "last seen" on the forum was Dec 3, 2021. Hopefully everthing is ok with him.