Lets Repo a CAT702 Security Chip

[twistedsymphony]

The Sony ZN arcade boards used by Capcom, Taito, Tecmo, Raizing, Acclaim, Atari, etc. all use a security chip called a CAT702

info on what that does here: https://github.com/mamedev/mame/blob/master/src/mame/machine/cat702.cpp

Guru also has a nice chart that shows which chips have been dumped and which games they belong to: http://members.iinet.net.au/~lantra9jp1_nbn/gurudumps/ZNx/index.html

Essentially there is a uniquely programmed version of this chip for each game, and a uniquely programmed version of this chip for each mobo variant. Realistically this chip is the only thing preventing easy ROM board conversions on the ZN hardware, and arguably the biggest hurdle towards a multi.

Functionally it takes in some data via clock and data in pins similar to the PS1 controller ports. performs a "transform" calculation and then outputs the results on a data out pin. the transform algorithm doesn't change but there is a small bit of data programmed on the chip used in the calculation that makes it unique (per game/mobo).

I actually contacted the manufacturer of the CAT702 at one point, or rather the company that bought them out, and got nowhere. The front line support at least has no record of the chip ever existing so either it's protected by some kind of NDA or the info was simply/lost forgotten in the buy out.

I've heard it suggested that a PAL/GAL could be used but I'd not found one that seemed to map very well to the CAT702 pinout, and I'm not at all familiar enough programming those especially with serial to make that work.

One other lead is a Bootleg Bloody Roar 2 ROM board I've seen. Last time one of these came up on eBay I lost the auction and the pictures were too blurry to make out what they were using for the protection chip.

However @ArcSys101 recently posted one up for sale: FS Gals Panic S SU/S2 , Bloody Roar 2


and he was kind enough to provide me with this picture:






That's an ATMEL AT89C2051-24PC (data sheet: https://ww1.microchip.com/downloads/en/DeviceDoc/doc0368.pdf)


Now it's possible that the ROMs here are patched to remove security and this chip is doing something else BUT looking at the potential to use this as a replacement CAT702 looks good.

According to the MAME driver the CAT702 works at either 300kHz or 2MHz, the 2051 can operate at 24MHz which should be plenty to process the incoming data.

The Pinout is very amicable as well:
pin - cat702 - 2051
1 - N/C - RST/VPP
2 - +5V - P3.0 (RXD)
3 - +5V - P3.1 (TXD)
4 - +5V - XTAL2
5 - SEL - XTAL1
6 - SEL - P3.2 (INT0)
7 - CLK - P3.3 (INT1)
8 - DIN - P3.4 (TO)
9 - +5V - P3.5 (T1)
10- GND - GND

11- GND - P3.7
12- N/C - P1.0 (AIN0)
13- +5V - P1.1 (AIN1)
14- DOUT- P1.2
15- +5V - P1.3
16- N/C - P1.4
17- +5V - P1.5
18- +5V - P1.6
19- +5V - P1.7
20- +5V - VCC

the 2051 appears to have it's own internal clock which is good, and the necessary pins to make it work (bolded) appear to map really well.
the only pins that might cause a problem are the external XTAL pins 4 and 5, but I think worst case we'd simply have to cut these pins on the 2051.

A PLC might still be better for an eventual multi, but I like the idea of a drop in-solution for conversions or repair that doesn't require patching ROMs. Also I think we could probably program every known code on these chips and have it selectable via jumpers/dips much like the infini-key.


I'm not super well-versed in programming ATMEL chips, I can muddle my way through, I do plan on poking around with this myself but I'd appreciate any comments or ideas people have on this. Is this a viable option or nah?

If any of you out there know your way around an ATMEL and have a ZN board at your disposal I'd encourage you to take a stab at this yourself.

-----
tagging for attention some people that I know might be interested in this:
@CoolFox Removing the Cat702 security on a Primal Rage 2 board set


@Hammy, @undamned Capcom ZN Conversion/Multi Interest Thread

 

[nem]

You're forgetting this thread of yours:

BOUNTY for Taito G-Net CF Conversions.

 

[twistedsymphony]

Indeed, remember that thread but couldn't find it and forgot how much effort was made there. Realistically the G-Net conversion and a CAT702 replacement are completely different projects;

 

[nem]

It kind of skewed off later in the thread. Skim through it.

 

[Hammy]

As SMF said in the other thread, the chip is most likely playing back a 'recording' of what a real chip does.

If you patch the game and bios you don't need to remake the chip.

 

[twistedsymphony]

useful CAT702 bits from the other thread:

The security chip is a sort of number tumbler based on the bits coming in and going out, I think it is too complex to just use a PLD. I had considered just skipping making a chip and emulating the serial communication as it's pretty simplistic bit math but haven't had time to give it a try. However if you're aware of a method that already exists to make the chip I'm all ears.

I had heard someone mention that they could replace them with a PLD but after looking at the MAME driver for the protection chip I came to the same conclusion you did. Would definitely be interested in a simple chip solution.

The bootleggers use this chip:
https://www.mouser.co.uk/datasheet/2/268/doc1001-1180642.pdf

Probably the easiest way is to buy a bootleg ZN rom board (bloody roar 2 for example) or converted rom board and employ what they did. Solutions exist out there, it's just not a cut and paste solution though.

Yes it's a shame that nobody snapped up that bootleg... Plenty more fish in the sea.

I have a Bloody Roar 2 bootleg here. Unfortunately, it's not a very good one as it locks up during the intro. If you start the game before it, you can play it up to some point. I don't think you can finish it though.


Anyway, can I do something meaningful with it? Is it of some use to someone here?

Sounds like it's not a good crack if there's lock ups, but it's still worth checking out
It needs to be dumped, and possibly the security chip traced out.
Anyone with desoldering skills and the AT89c4051 in the device list will do.
Providing the bios is not required to dump the rest will be a fairly simple job

The bootleggers use this chip:


mouser.co.uk/datasheet/2/268/doc1001-1180642.pdf

do they use that on the main board as well? it doesn't look like it'd be pin compatible.

Now that's a good question, a picture of the bottom board of this bootleg will have all the answers.Is the bios modified, and is the security chip original...


Obviously the bootleg top board has been re-designed. a small adapter will be required for the replacement on an origianl.

Sounds like it's not a good crack if there's lock ups, but it's still worth checking out
It needs to be dumped, and possibly the security chip traced out.
Anyone with desoldering skills and the AT89c4051 in the device list will do.
Providing the bios is not required to dump the rest will be a fairly simple job

Here's pics of the board:

The AT89c4051 is socketed and I have it in my programmer's device list, however, reading it I just get 4 KB of FF.

This one is slightly different to the one i've seen, maybe yours is an older version:
http://www.happy-manor.com/itm/459260/71605/Arcade-PC-Board/KONAMI/Bloody-Roar-II-PC-K106


Bad news about the surface mounted rom, your one has some of the program in the SMT MX chip instead of 2x 160's.


The 27c160 in the socket should be dumped anyway, maybe Coolfox or someone will be up for dumping the tricky one (i have no adapters).


Looks like the atmel has a security bit, that's a bummer.


Good news is that it's spoofing the security using only 2 wires?!?
And the atmel looks like it's controlling the OKI. and not the protection?
Maybe it's simpler than copying the chip anyway.


With a hack that simple it's more than likely a code patch with the bare minimum connected in place of the chips for the board to function.


Has the mainboard surface mounted bios been changed?

The protection in the ZN platform is a serial bus so it's not surprising that only 2 pins are necessary.

Yep and it's in use directly by the atmel quad and that's a shame..


So traced out the cat 702 on a pcb.


pin
1 - n/c?
2 - 5v
3 - 5v
4 - 5v
5 - tied with 6 / b21 on connector
6 - tied with 5 / b21 on connector
7 - a20 on connector
8 - a21 on connector
9 - 5v
10 - gnd
11 - gnd
12 - n/c?
13 - 5v
14 - b19 on connector
15 - 5v
16 - n/c?
17 - 5v
18 - 5v
19 - 5v
20 - 5v


that makes the signals b21, a21, a20 and b19


seems right as 5+7 are connected to the base board on that bootleg.


I have studied the picture a little better and it looks like the 2 feeds are going into the atmel quad.
It also looks like the edge connector signals are going directly into there too.


What is the chip code on the atmel? More than likely secured up anyway like the first one.

Well the other chip is the CPLD, so it seems the bootleggers found it easier to do a CPLD instead of writing a program for the micro controller.

Good news and bad news with the CPLD, I need to speak to a few people about it... maybe it's not so bad to read out

The motherboard must of came / got sold with a game, whatever original software worked on there should give an idea.

Is all the program data dumped for this bootleg then? one of the dumped roms looks like for the OKI.

Do you have the g-net conversions booting in mame yet?

Only two of the bloody roar 2 roms are dumped. One of the ROMs is for the OKI & the other is for the CAT702 replacement.
The CPLD appears to just grab a byte from the ROM and bit shift it out. Only a small part of the game boot is encrypted and so a replay attack is practical. The beasorizer bootleg that is already in MAME has a similar ROM, oddly they used a 16 bit EPROM and the upper and lower bytes of each word are identical.

The file seems to include the responses from the CAT702 on the motherboard and the one on the gameboard.

However after 0x50 bytes, this dump and the one from beastorizer diverge from what MAME normally returns and the game crashes. This might be an emulation issue that eventually fixes itself (the bios retries accesses if it gets data it doesn't like, so it might not be working properly anyway) or it might be that the CPLD does something more complex than just shifting each byte out from the start of the ROM to the end.

I can't currently see how either game would boot on anything other than a raizing motherboard with ET01 CAT702 and -54 BIOS. It's possible they found some way of exploiting the bios & I'm missing some crucial part of making it work.

Which does raise the question what game they were using as the donor, as we don't have any other games dumped for this motherboard at all. It's possible that raizing knocked out the bootlegs themselves, to avoid paying Sony some licence fee. If Sony supplies the CAT702 programmed, then it's an easy way of enforcing some form of per game license fee. All they had to do was order a few hundred motherboards as spares.

A few years later the raizing motherboard was used by someone else for Bust A Move 2, while raizing themselves switched to releasing games on Tecmo motherboards (MG01 CAT702, -61 BIOS). I'm not sure of why they would switch round like that, the CAT702 devices normally follow a naming pattern based on the publisher.

A logic analyser dump of the serial stream from the bootleg as it starts up would help figure out what is going on, I'm out of ideas & I don't want to get bogged down. So I've put a note in the source & I'm going to move on. You or anyone else is more than welcome to take a look, I might be missing something obvious.

I don't see any point in trying to duplicate it for making other bootlegs, now we know how the CAT702 works then adding an extra ROM is more complex. In fact it's the mask roms that is the biggest hurdle.

I've thought about supporting the g-net conversions in MAME, however someone on DU is friends with arcademodbios and so it's currently on hold. I don't tend to speculate on things I might do in the future, to avoid over committing myself.

do you have any info on how to make a repo protection chip? I've heard that before but I haven't been able to find any info other than the mame driver.

You could cross your fingers for luck and buy some
https://octopart.com/cat702-catalyst+semiconductor-13008420

You'll need to figure out how to program them, which might need decapping.

I asked http://arcadehacker.blogspot.com/ already, but he's busy.

Raizing would of had access to the real original sound chips, it's gotta be a bootleg due to the lower quality OKI being used.I guess the 2 wires going to the bottom board feed the game with the ET01 data, but as you say it does not explain the bios lock...

The output from both of the cat702 chips are wired together, but when they aren't active the outputs float. If they just captured the data on the output pin, then they would get the output from both cat702. My guess is the outputs get AND'd so as long as the bootleg is outputting what the motherboard cat702 outputs, then it's fine. If the cat702 replacement is always active then you might be able to remove the cat702 from the motherboard and still boot.
No idea what the two wires are for. Where do they go to on the game board?

 

[twistedsymphony]

As SMF said in the other thread, the chip is most likely playing back a 'recording' of what a real chip does.

If you patch the game and bios you don't need to remake the chip.

Indeed, but we have the algorithm in MAME, there shouldn't be a reason we can't make a legit replacement without patching the bios/game

 

[CoolFox]

I mean I have a patched out version of my game, but it would be nice to have a more original solution.

 

[Hammy]

Round 2 : Fight!!

 

[CoolFox]

oh is that for the bios?

 

[Hammy]

Indeed, you'd be quite amazed how far things have moved in the last couple of days

Turns out only the address bus is available on the back connector. The data bus goes into the processor via 5v > 3.3v level shifters
<rom chip 5v , processor 3.3v>.

 

[CoolFox]

Nice!

 

[Hammy]

It will be, nice if everything falls in place...

After this there's more...
Hopefully the program memory upgrade works so we can make the highest - spec config motherboard that works on everything (like yours hehe)

 

[Hammy]

Gallop racer 2 on an MVS! LOL Just kidding but sorta...
The wooden table was affecting the signals for some reason. it will be better with a little board...

 

[Hammy]

Ok, some more progress with this....

So far....
Capcom ZN1 , Taito FX , Video systems games can be cracked / patched to run with the above technique.

HOWEVER not truly cracked the bios yet.... Also there's multiple versions of the security program that get better over time.
Tecmo has an extra copy of the security program.

	decodesce	decode.c	rsec	Extra
Tecmo TPS	decodesce.c,v 1.3 1995/08/29	decode.c,v 1.7 1997/05/07	ramsec.c,v 1.2 1996/06/19	decodetecmo2.c,v 1.2
Capcom 2	decodecapcon.c,v 1.2 1995/08/20	decode.c,v 1.7 1997/05/07	ramsec.c,v 1.2 1996/06/19	COPY OF decodecapcon.c,v 1.2
Video Sys	decodebp.c,v 1.2 1996/06/19	decode.c,v 1.4 1995/10/06	ramsec.c,v 1.2 1996/06/19
Atlus	decodeatlus.c,v 1.1 1996/03/12	decode.c,v 1.4 1995/10/06	ramsec.c,v 1.1 1995/10/06
Acclaim	decodeacraim.c,v 1.2 1995/08/20	decode.c,v 1.4 1995/10/06	ramsec.c,v 1.1 1995/10/06
Atari	decodetw.c,v 1.2 1995/08/20	decode.c,v 1.4 1995/10/06	ramsec.c,v 1.1 1995/10/06
Capcom 1	decodecapcon.c,v 1.2 1995/08/20	decode.c,v 1.3 1995/08/29	x
Taito FX	decodetaito.c,v 1.2 1995/08/20	decode.c,v 1.3 1995/08/29	x
Dev bios # 1 (5820)	decodesce.c,v 1.1 1995/08/18	decode.c,v 1.1 1995/08/18	x
Raizing	decodeatlus.c,v 1.1 1996/03/12	decode.c,v 1.5 1997/01/10	ramsec.c,v 1.2 1996/06/19
Dev bios # 2 (PR.2)	decodesce.c,v 1.3 1995/08/29	decode.c,v 1.4 1995/10/06	ramsec.c,v 1.1 1995/10/06

 

[brizzo]

You gotta love and appreciate when the library names get compiled into the binary

 

[Hammy]

Makes things easier, the data used by the sec program is next to the strings

Gives a timeframe of when the game companies commissioned the motherboards.

Also shows that there's a newer version of primal rage 2 (9 days or more) out there...
Undumped / lost that would of originally been coupled with coolfox' development system....

 

[Hammy]

#1 tecmo motherboard keychip in top board for a laugh
#2 capcom genuine chip for the game
#3 another game keychip

 

[Darksoft]

Congratulations!!!

 

[bagheera369]

Brilliant work.....sincerely.