Does Capcom of Japan still revive dead CPS3 security carts?

[HyperBolt]

I came across this while searching for a Third Strike board to buy:

http://www.capcom-unity.com/tech_suppor ... rike_Board"

The post is pretty old, but I just mainly want confirmation that Capcom of Japan will still revive them.
Anyone send a cart to get revived recently?

Let's say I got a dead cart I want revived, who do you go to?
I heard only arcade operators can send in carts to be repaired. So who do you contact to get in touch with an arcade operator?
And any idea how much Capcom of Japan charges?


Sorry about all the questions, it's just that I might buy a Japanese 3s board.
I don't want to spend a lot of money on a Japanese board if it doesn't have the advantage of being revived.

[Ramza]

Capcom Japan repairs them for 5000 Yen, but only if you live in Japan. So if don't know anybody from Japan, your only chance is to send it in by one of the local arcade shops. I recently got my dead 3S cart repaired by Capcom Japan through Fujita.

You might also want to take a look at this thread: http://forum.arcadeotaku.com/viewtopic. ... 2&start=30

[HyperBolt]

Oh yeah I forgot to ask...

Do they still repair even if you've changed the battery before?
Just got myself a board and I have no idea when the battery was last changed.
So I want to get it changed soon.

[richy13]

Oh yeah I forgot to ask...

Do they still repair even if you've changed the battery before?
Just got myself a board and I have no idea when the battery was last changed.
So I want to get it changed soon.

capcom japan will not change a battery if its still living,your cart must be japanese and have a origianl capcom fitted battery.capcom asia will repair any cart but say if you have a japanese version cart it will be flashed with the asian/english version.which is a bit crap if ya a ryu and ken player as they take the japanese voices for fireball/dragon punches out etc...

[idc]

capcom asia will repair any cart but say if you have a japanese version cart it will be flashed with the asian/english version.which is a bit crap if ya a ryu and ken player as they take the japanese voices for fireball/dragon punches out etc...

..but having a working Asian-flashed 3rd Strike is better than having any version that is dead.

I have a Euro 3rd Strike which I bought off j69 a while ago. It's a great game, but my ****hole will be twitching severely when the time comes to try and replace the battery without killing the damn thing.

http://www.capcom-unity.com/tech_suppor ... rike_Board

Interesting thread. I've been in contact with a couple of guys at Capcom Japan in the past, regarding a few other dead CPS3 carts I have. They admitted to me that they will only repair Japanese carts and return them to Japanese addresses, despite my pleading. I did also ask about there being a possiblility that they might release information required to reprogram the carts into the public domain in the future. They didn't give me a point-blank "no", but their response suggested that they are not currently willing to consider this.

I was also in contact with the MAME team when they first emulated CPS3 successfully to see what they could discover. Although the decryption keys are now known, it's not currently possible to revive the carts. Decryption is done inside an SH2 CPU within the cart.

I believe these are the keys:

Code: Select all

static DRIVER_INIT( jojo )    { cps3_key1 = 0x02203ee3; cps3_key2 = 0x01301972; cps3_altEncryption = 0; DRIVER_INIT_CALL(cps3); }
static DRIVER_INIT( jojoba )  { cps3_key1 = 0x23323ee3; cps3_key2 = 0x03021972; cps3_altEncryption = 0; DRIVER_INIT_CALL(cps3); }
static DRIVER_INIT( sfiii )   { cps3_key1 = 0xb5fe053e; cps3_key2 = 0xfc03925a; cps3_altEncryption = 0; DRIVER_INIT_CALL(cps3); }
static DRIVER_INIT( sfiii2 )  { cps3_key1 = 0x00000000; cps3_key2 = 0x00000000; cps3_altEncryption = 1; DRIVER_INIT_CALL(cps3); }
static DRIVER_INIT( sfiii3 )  { cps3_key1 = 0xa55432b4; cps3_key2 = 0x0c129981; cps3_altEncryption = 0; DRIVER_INIT_CALL(cps3); }

I've never been one to form unruly protests or useless petitions, but maybe if a few of us request it, they'll be more willing to listen. I'd be interested to hear what anyone else thinks.

[Artemio]

Those are the keys indeed idc. U must say that although I have some technical knowledge, I am nowhere near the capacity of figuring this out myself. However I was looking into this issue because I imagined that maybe the CPS-3 hardware is capable of resurrecting carts if some files are present in a CD, with certain contents. This is pure speculation on my part of course.

What I did was decrypt the BIOS of some dumped carts using the MAME source code, and then proceeded to realign all the bytes in the BIOS to make the strings in the cart readable. I did this because of some information I found that they had found a hidden menu in CPS-3 carts. These are my findings (which of course the MAME team knows already)

Third Strike:

Code: Select all

Apr 09 1999
17:01:36
(#)kernel 1.00e 1998/06/30 
(#)kernel: nothing task control block.
kernel: stack overflow in task.
RAM Over
[ PUSH 1P START TO MENU     ]
  ERROR: 11
  ERROR: 1X
  ERROR: 2X
  ERROR: 3X
  ERROR: 4X
  ERROR: 5X
  ERROR: 60
  http://www.capcom.co.jp/
                CO.,LTD. 1996,97,98
  http://www.capcom.com/
  http://www.capcomasia.com.hk/
 THIS SECURITY CASSETTE IS NOT PRODUCT VERSION
 THIS SECURITY CASSETTE IS NOT PRODUCT VERSION
 SCSI DEVICE IS NOT CONNECTED
    PUSH SHOT1 TO RETURN    
   .BMP
SHO.MCR
 RE.BIN
   READING BITMAP FILE...
  EXECUTING
  FILE NOT FOUND
 SIMM NOT FOUND
 ABORT    
 DONE     
 READING DISK...
               
READING DIRECTORIES...
DRIVE NOT READY                                       
    <DIR> 
   %y-%m-%d %H:%M
 ANALIZE MACRO ...
%d
end
..ERASING         ...
READING            
WRITING
SECURITY CASSETTE UTILITY MENU  Ver 2.00
 1. FLASH MEMORY
 2. DISK & FILES
 3. GAME BOOT
 4. EXIT
SELECT = 1P UP or DOWN
START  = 1P SHOT1
2 . D I S K   &   F I L E S
 VOLUME LABEL:
 PATH:
 ENTRIES
 EXIT = 1P START & SHOT1
 1. DISK DUMP
 2. EJECT MEDIUM
 3. DEVICE INFORMATION
1. EXECUTE AS MACRO
2. WRITE TO FLASH MEMORY
3. CHECKSUM
4. FILE DUMP
5. LOAD AS MS-BITMAP
1. ONBOARD
2. SIMM1
3. SIMM2
4. SIMM3
5. SIMM4
6. SIMM5
7. SIMM6
8. SIMM7
START OFFSET = 00000000
E X E C U T E   M A C R O
 FILENAME     SIMM   OFFSET   RESULT
  CANCEL = 1P START
 D I S K   D U M P
  BLOCK = XXXXXXXX  BLOCK SIZE = XXXXXXXX
 OFFSET    +0   +2   +4   +6  01234567
 DEVELOPER'S SECURITY CASSETTE UTILITY Ver 2.00a
 PROPERTIES             
   GAME: UNKNOWN
     CODE:
 STATUS:
1P START = NEXT MODE
BOARD
SIMM1  
SIMM2  
SIMM3  
SIMM4  
SIMM5  
SIMM6  
SIMM7  
???        
FUJITSU    
Intel/SHARP
HITACHI    
MXIC       
???    
ERASED 
WRITTEN
Now reading the CD-ROM. Please wait...
 ERROR: Unable to rewrite. Please try again.
If problem persists please contact Capcom
or your distributor.
There is not enough memory installed on the PCB.
Turn off power,
and install more memory before restarting.
The CD-ROM Drive is not properly connected.
Please turn the power off
and correct it properly.
Please keep in mind that loading
a new CD-ROM will erase the prior memory
and it will take about    minutes
to rewrite the new game.
Approximately    Min.    Sec.
before completing the procedure.
Now rewriting. Please wait...
 NOTE:
Please do not turn the power off at this time.
Rewrite the game
Cancel
You have inserted
You have inserted an invalid CD-ROM.
a CD-ROM of the updated version of the game.
Press 1P Start button to eject the CD-ROM.
Now loading the game.        
Please insert a valid CD-ROM.
CD-ROM cannot be found.
Now reading data.            
a new CD-ROM.
  Now ejecting the CD-ROM. Please wait...
Now erasing the prior memory.
32M
ERASING... 
RESTORE... 
WRITING... 
CHECKSUM...
           
READING... 
     sec. 

1 . F L A S H   M E M O R Y
 . OPERATION = 
BOARD :
SIMM1   :
SIMM2   :
SIMM3   :
SIMM4   :
SIMM5   :
SIMM6   :
SIMM7   :
 BANK XX   +0   +2   +4   +6   +8   0123456789
 EXIT = 1P START & SHOT1
ERASE ALL                
OVERERASE RESTORE        
WRITE TEST               
QUICK CHECKSUM           
QUICK CHECKSUM 32M ONLY  
QUICK CHECKSUM     (OLD) 
QUICK CHECKSUM 32M (OLD) 
CHECKSUM                 
CHECKSUM 32M ONLY        
PROGRAM SIMM COPY    1->2
DMA SOURCE SIMM COPY 3->4

FUJITSU          
  Intel/SHARP      
  HITACHI          
0123456789abcdef0123456789ABCDEF
CD001
@(#)screen library 0.17a 1998/07/03
cgram: loked
cspr: permission denied.
cspr: invalid cell.
@(#)switch library 0.02a 1998/09/18
0123456789abcdefghijklmnopqrstuvwxyz

Of special interest in that BIOS are the SHO.MCR and RE.BIN file names that the BIOS references. Of course it is unknown how to access this SECURITY CASSETTE UTILITY MENU Ver 2.00, if it is even accessible though our carts though. Not to mention the DEVELOPER'S SECURITY CASSETTE UTILITY Ver 2.00a. It seems it can load BMPS and list the directory structure and files with dates form the CD, but there is not much more.

However, I did the same process with other carts.. and they don't have those menus at all. For instance, the first game being Red Earth only has:

Code: Select all

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
|%b %D %H:%M:%S %Y|%b %D %Y|&H:%M:%S
:Jan:January:Feb:Feburuary:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
%a %c
2:UTC:UTC:0
Day Mon dd hh:mm:ss yyyy
 RAM Over
 RESET ERROR
 RESET OK !!
FORCE REWRITE ALL            
FORCE REWRITE DMA SOURCE ONLY
  WAIT A MOMENT...
64M
32M
128M
PC RESET ERROR. TRY AGAIN
NOW READING...
SCSI HARDWARE ERROR
MEDIUM OR DRIVE NOT READY
REWRITE(1P SHOT1) OR REBOOT(1P SHOT2) ?
REWRITING... (HALT = 1P START)
       0%
 NOT FOUND
ERASING
       
             
	WRITING
VERIFY 
HALTED
     100%
COMPLETE
                                           
BINREAD.MCR
REWRITE MACRO-FILE ORDER
C P - S Y S T E M 
@CAPCOM CO., LTD. 1996 ALL RIGHTS RESERVED.
WELCOME TO CP-SYSTEM
 PCB SETUP
NORMAL REWRITE
ONBOARD D
SIMM1   P
SIMM2   P
SIMM3   D
SIMM4   D
SIMM5   D
SIMM6   D
SIMM7   D
SCSI DEVICE
PROGRAM ID
MEDIUM  ID
UNKNOWN          
FUJITSU          
4Intel/SHARP      
HITACHI          
MXIC             
HDD      
TAPE     
PRINTER  
PROCESSOR
WORM     
CD-ROM   
SCANNER  
MO       
CHANGER  
COMM     
NOT USE   
NEED 128MB
 NEED  32MB

   S Y S T E M   D E B U G G E R
MODE = REGISTERS & DISASSEMBLE
   R0   00000000  R1   00000000  R2   00000000
   R3   00000000  R4   00000000  R5   00000000
   R6   00000000  R7   00000000  R8   00000000
   R9   00000000  R10  00000000  R11  00000000
   R12  00000000  R13  00000000  R14  00000000
   SP   00000000  SR   00000000  GBR  00000000
   MACH 00000000  MACL 00000000  PR   00000000
TC PC   00000000
 Address  Code Nemonic                        
REBOOT = 1P START & 2P START
   MODE = SYSTEM INFORMATION
 BOOT ID:
COUNTRY:
  VERSION:
  ONBOARD:
  SIMM1  :
  SIMM2  :
  SIMM3  :
  SIMM4  :
  SIMM5  :
  SIMM6  :
  SIMM7  :
  GAME ID:
CLRT                    
   NOP                     
   RTS                     
   SETT                    
   DIV0U                   
   SLEEP                   
   CLRMAC                  
   RTE                     
   LDS.L   @m+,MACH        
   LDC.L   @m+,SR          
   LDS     m,MACH          
   LDC     m,SR            
   LDS.L   @m+,MACL        
   LDC.L   @m+,GBR         
   LDS     m,MACL          
   LDC     m,GBR           
   LDS.L   @m+,PR          
   LDC.L   @m+,VBR         
   LDS     m,PR            
   LDC     m,VBR           
   STC     SR,n            
   BSRF    n               
   STS     MACH,n          
   STC     GBR,n           
   STS     MACL,n          
   STC     VBR,n           
   BRAF    n               
   MOVT    n               
   STS     PR,n            
   CMP/PL  n               
   CMP/PZ  n               
   DT      n               
   TAS.B   @n              
   ROTL    n               
   ROTR    n               
   ROTCL   n               
   ROTCR   n               
   SHAL    n               
   SHAR    n               
   SHLL    n               
   SHLR    n               
   SHLL2   n               
   SHLR2   n               
   SHLL8   n               
   SHLR8   n               
   SHLL16  n               
   SHLR16  n               
   JMP     @n              
   JSR     @n              
   STC.L   SR,@-n          
   STC.L   GBR,@-n         
   STC.L   VBR,@-n         
   STS.L   MACH,@-n        
   STS.L   MACL,@-n        
   STS.L   PR,@-n          
   MOV.B   m,@(R0,n)       
   MOV.W   m,@(R0,n)       
   MOV.L   m,@(R0,n)       
   MUL.L   m,Rn            
   MOV.B   @(R0,m),n       
   MOV.W   @(R0,m),n       
   MOV.L   @(R0,m),n       
   MAC.L   @m+,@n+         
   MOV.B   m,@n            
   MOV.W   m,@n            
   MOV.L   m,@n            
   MOV.B   m,@-n           
   MOV.W   m,@-n           
   MOV.L   m,@-n           
   DIV0S   m,n             
   TST     m,n             
   AND     m,n             
   XOR     m,n             
   OR      m,n             
   CMP/STR m,n             
   XTRCT   m,n             
   MULU.W  m,n             
   MULS.W  m,n             
   CMP/EQ  m,n             
   CMP/HS  m,n             
   CMP/GE  m,n             
   DIV1    m,n             
DMULU.L m,n             
CMP/HI  m,n             
SUB     m,n             
SUBC    m,n             
SUBV    m,n             
ADD     m,n             
Q	wDMULS.L m,n             
ADDC    m,n             
|ADDV    m,n             
MAC.W   @m+,@n+         
MOV.B   @m,n            
)d MOV.W   @m,n            
iMOV.L   @m,n            
MOV     m,n             
XN^MOV.B   @m+,n           
MOV.W   @m+,n           
MOV.L   @m+,n           
*NOT     m,n             
SWAP.B  m,n             
SWAP.W  m,n             
lNEGC    m,n             
NEG     m,n             
EXTU.B  m,n             
AEXTU.W  m,n             
EXTS.B  m,n             
EXTS.W  m,n             
MOV.B   @(d,m),R0       
MOV.W   @(d,m),R0       
MOV.B   R0,@(d,n)      
MOV.W   R0,@(d,n)      
BT      d               
BF      d               
>L.BT/S    d               
UROBF/S    d               
NICMOV.B   R0,@(d,GBR)     
uMOV.W   R0,@(d,GBR)     
HARMOV.L   R0,@(d,GBR)     
CITMOV.B   @(d,GBR),R0     
TESMOV.W   @(d,GBR),R0     
   MOV.L   @(d,GBR),R0     
MOVA    @(d,PC),R0      
CMP/EQ  #i,R0           
TRAPA   #i              
TST     #i,R0           
AND     #i,R0           
XOR     #i,R0           
HECOR      #i,R0           
NG.TST.B   #i,@(R0,GBR)    
AND.B   #i,@(R0,GBR)    
 Y XOR.B   #i,@(R0,GBR)    
TIOOR.B    #i,@(R0,GBR)    
   MOV.L   m,@(d,n)        
MOV.L   @(d,m),n        
IMMBRA     d               
XX BSR     d               
  0MOV.W   @(d,PC),n       
RT MOV.L   @(d,PC),n       
 STADD     #i,n            
   MOV     #i,n            
   R0
HR10
CXXXXXXXX
   JAPAN   
_ASIA    
IMMEURO    
1->USA     
OURHISPANIC
OPYBRAZIL  
   OCEANIA 
   NORMAL VERSION        
7CHARACTER CHEK VERSION
APUBLICITY VERSION     
 LOCATION TEST VERSION 
0SHOW VERSION          
ERASING... 
RESTORE... 
WRITING... 
CHECKSUM...
           
READING... 
     sec. 
ANG        
0F L A S H   M E M O R Y   U T I L I T Y
RODOPERATION = 
ONBOARD :
SSIMM1   :
TSIMM2   :
 SIMM3   :
BSIMM4   :
2SIMM5   :
eSIMM6   :
eSIMM7   :
BANK XX   +0   +2   +4   +6   +8   0123456789
 EXIT = 1P START & SHOT1, REBOOT = 1P & 2P START
ERASE ALL                
icOVERERASE RESTORE        
viWRITE TEST               
viQUICK CHECKSUM           
geQUICK CHECKSUM 32M ONLY  
ioCHECKSUM                 
CHECKSUM 32M ONLY        
taPROGRAM SIMM COPY    1->2
hiDMA SOURCE SIMM COPY 3->4
                 
U FUJITSU          
ITIntel/SHARP      
1,HITACHI          
STMXIC             
S C S I   D E V I C E   U T I L I T Y
SCSI ID         = 1
DEVICE TYPE     =
REMOVABLE       =
ISO VERSION     =
ECMA VERSION    =
`ANSI VERSION    =
VENDER ID       =
PRODUCT ID      =
PRODUCT VERSION =
EXIT = 1P START & SHOT1, REBOOT = 1P & 2P START
Direct Access Device    
NsSequential Access Device
Printer Device          
o{Processor Device        
Write-Once Device (WORM)
CD-ROM Device           
Scanner Device          
Optical Device          
1-kMedia Changer Device    
Comminucation Device    
TFilesystem install failed
.Please reset this system
HF I L E   U T I L I T Y
VEXIT = 1P START & SHOT1, REBOOT = 1P & 2P START
HDD      
TTAPE     
ZPRINTER  
PROCESSOR
WORM     
CD-ROM   
SCANNER  
MO       
CHANGER  
COMM      

Again another MCR file: BINREAD.MCR, these might be the MACROs referred in the text. It also has a debugger in there. That specific cart also has asm code as strings (!?)

No idea if that track would lead to something. I was looking to something more obvious. The files referenced gave me some hope at first, but in case those were used we would need to know the syntax used and how to access this menu (which don't point to using the files at all). I also tried disassembling the SH2 code in these, but I believe that someone with good knowledge is needed for that task and it might lead nowhere.

Anyway, I decided to share this info.

Street Fighter III: New Generation:

Code: Select all

Dnothing task control block
stack overflow in task
Jan 29 1997
09:43:55
RAM Over
H@NOW READING...
DFILE NOT FOUND
 INVALID FILE SIZE
. 90
E       0%
AP     VERBOSE     
99   REWRITE ALL   
VEREWRITE CHARACTER
TDFLASH WRITE ERROR
REFLASH VERIFY ERROR
bCHECKSUM ERROR
bID ERROR
567     100%
2@CAPCOM CO., LTD. 1996
@CAPCOM MEXICO S.A. DE C.V. 1996 RIGHTS RESERVED.
es@CAPCOM U.S.A., INC. 1996 ALL RIGHTS RESERVED.
t@CAPCOM CO., LTD. 1996 ALL RIGHTS RESERVED.
0123456789abcdef0123456789abcdef0123456789abcdef
0123456789abcdef0123456789abcdef0123456789abcdef
ntrInserte el CD-ROM y presione
lael boton PLAYER1 y SHOT1.
a Se ha insertado un nuevo CD-ROM.
l Desea que se reescriba el juego?
 eADVERTENCIA: Cargar un nuevo CD-ROM
elaborrara toda la memoria anterior y tardara
entre 15 y 20 minutos para cargar la
gomemoria nueva.
Si va a reescribir el juego,
 dpresione el boton PLAYER1 y SHOT1.
O presione el boton PLAYER1 y SHOT2
recpara cancelar.
 Cargando...
el Por favor no apague el switch de corriente.
El cargado del juego ha fallado.
stPor fovor haga contacto con su distribuitor
CD-de Capcom.
oLa unidad de CD-ROM
TEMno esta conectada correctamente.
-RPor favor apague el switch de corriente
GLOy vuelava a empezar.
M fNo hay suficiente memoria
 instalada en la tableta.
CaInserte por favor el CD-ROM correspondiente
al CP-SYSTEM
 y presione
Favor inserir o CD-ROM e apertar
pR     
o botao JOGADOR1 GLOPE1.
5 aUm novo CD-ROM foi inserido.
 rVoce deseja redigitar o jogo?
tNOTA: Carregando um novo CD-ROM
 o       
       
OPEapagara a memoria anterior.
do.                           
  Para carregar um novo levara de 15 a 20 minutos.
lhSe voce deseja redigitar o jogo,
coaperte o botao JOGADOR1 GLOPE1.
ocaOu aperte o botao JOGADOR1 GLOPE2 para cancelar.
 na Carregando...
            
                
 Por favor nao desligue o botao de energia.
Falha no processo de carga.
Favor contactar seu distribuidor Capcom local.
l                   
     
O drive do CD-ROM nao esta
conectada corretamente.
ROM                    
OFavor desligar o botao "liga-desliga"
te iniciar novamente.
o r 
    
me?Nao ha memoria suficiente instalada na placa.
 Favor inserir o CD-ROM CP-SYSTEM
 e apertar
0 mPlease insert CD-ROM
e.and push PLAYER1 SHOT1 button.
gA New CD-ROM has been inserted.
Do you wish to rewrite the game?
R1NOTE: Loading a new CD-ROM will erase
d     the prior memory and will take
 lo     15~20 min. to load the new one.
omIf you wish to rewrite the game,
-Rpush PLAYER1 SHOT1 button.
If you wish to cancel,
push PLAYER1 SHOT2 button.
yNow Loading...
Please do not turn the power off.
PCUnable of load.
Please contact your local Capcom office
resor distributor.
The CD-ROM Drive is not properly connected.
UROPlease turn the power off
Cand properly correctly.
Not enough memory is installed on the PCB.
Invalid CD-ROM.
XX.Insert the CP-SYSTEM
 CD-ROM
and press PLAYER1 SHOT1 button.
DEVELOP 
JAPAN   
;ASIA    
+EURO    
USA     
HISPANIC
BRAZIL  
OCEANIA 
KOREA 
GALS.BMP
TIT2.BMP
`TIT20.BMP
TIT10.BMP
XXX.BMP
TOMO.BMP

[idc]

Artemio, although I've not investigated to the extent that you have, I am aware of the existence of the Security Cart Menus and indeed, it's not currently known how to access them from within the game, if it is even possible.

I do know that the SH2 used for decryption is used solely for that purpose, and I believe that once the decryption routine has finished, the SH2 is effectively turned off and control is handed over to the main SH2.

I know one of the MAME guys (Guru I think) has tried desoldering this custom SH2, replacing it with a standard SH2 and feeding it pre-decrypted CD-ROM data, without success. If we are ever able to revive CPS3 carts, it won't be in the way we can with CPS2. It appears that rather than forcing the game to run with decrypted data from a CD-R, we will have to actually reprogram the security routines in the carts.

I'm not sure if anyone is still working on it, or if they've given up...

[Artemio]

Yes I am aware of that, that's why I looked into the BIOS for clues.

What got my attention as I mentioned earlier is the reference to MACRO files and the BIN files that the BIOS can look into from the CD SCSI drive. I know it is a very long shot, but maybe there is something on the BIOS that allows to read the keys from a file on the CD, or allows to boot some encrypted or unencrypted code from a file on the CD that allows rewriting those keys. That is what I was trying to refer above, sorry if I wasn't clear about it.

But the BIOS does have the capability of reading directory structures, at least 3rd strike does. As far as I know, no one is working on this. I have a dead cart a friend gave me, and might look into this a bit more. But I don't have the time or experience for this kind of thing. Anyway, I posted all of this just in case someone that has the ability is interested.

[idc]

I'll see if I can catch up with ElSemi or Xorloser to see if they're interested in having a bash at it.

[Artemio]

what a coincidence. I took that picture at my home, the dead cart I have is one of those. Testing each of those carts on my system is what prompted me to investigate the above. I took a few more pics of that lot.

[Artemio]

No, they are not mine. I just happen to know the owner, and at the time he didn't have a CPS-3 at hand so he asked me to help him test them.

You should get a New Generation, that's how I started and I loved the game.

[Artemio]

It is not that difficult to perform the battery swap. All that is needed is patience and follow the steps carefully. I just performed it on 5 carts and all of them worked perfectly fine.

[HyperBolt]

Does the cart really have to have the original battery in order for Capcom of Japan to do the repair?
I don't understand why that would matter. The battery is dead either way and it has to be replaced anyway.
I have no idea if mine is still on the original battery, so I hope it's not true...


Somebody please find a way to revive the carts!

[skforty]

Talking about the cassette security menu, in the early days of cps3 emulation, the menu WAS accessed. Seen here.



http://mamedev.emulab.it/haze/2007/06/page/3/"

I'm not sure why more work hasnt been done to access this menu. it was clearly accessed at least in jojo through emulation. How?

[Artemio]

Yes, that was the reson I started to look for the whole text I posted on the cart.

It was probably accessed because of a wrong pointer. Only way to find out is to dissassemble and understand the whole code in the cart since it has been decrypted already.

[skforty]

According to the comments, it was accessed through the debugger, maybe wrong pointer like you said, cuz they were loading the bios wrong right? but yeah. hmmm. Apparently another poster on anohter forum states there was a 6 pin connector on his CPS3 board. Likely this was used imo to access the menu. You can see the files on the CD that get copied to the simms, and you know 10,20 are the slot 1 and 2 which are system/program data right? They are the same for every region of the game. Meaning, if you use the Asian cart or the japanese cart, the same files from the CD get copied to the appropriate simms. Its the region in the bios of the cart that is how is decided what version to execute. If you could edit the system data in 10,20, then burn a CD with the modified 10,20, then do an install, you could potentially force it to launch another region with the asian cart... All we really care about is third strike, maybe it makes sense to edit the system data to get the asian cart to work for us...Or maybe im wrong about how the game gets executed...

[Artemio]

Indeed, but you'd need to be sure the cart doesn' check for anything particular.

Another thing I noticed when I dumped the text is that some other files are looked for on the cd. I theorized that maybe there was a way to reflash the sram keys from cd... but you'd need to know the format and it is just my wild imagination based solely on the fact that they are listed on some firmware lines.

I don't know about those pins, can't recall any. But there's a protected region by plastic ghat varies a lot on each revision of the board I have. Around 5.

[skforty]

-on phone excuse typos and run on sentences-

Yeah I've never seen the 6pin connector myself. I contacted the poster the other day his post was over 2 years old. I wanted to make sure he wasn't confused about the kick harness. He said he only had 1 mobo with it on it. I've held about 10 different ones and never seen it, so until I do, I'll consider it a rumour. I bet you're right about the keys and cd. Files 93/93 on the cd don't copy over when installing on 3s, I did a cursory look at the and didn't find anything interesting yet.

Regarding the covered chip; According to the cps3 driver that is an EEPROM covered by the plastic with no security and it's unknown why it's covered.


"209   93C46 - National Semiconductor NM93C46A 128bytes x8 Serial EEPROM (SOIC8)
210   Note this IC is covered by a plastic housing on the PCB. The chip is just a normal
211   (unsecured) EEPROM so why it was covered is not known."

[Artemio]

Also on phone for the last 2 posts and this one, sorry about my typos as well.

On a couple of the board I have, there's nothing under the plastic cover but the placeholder for a battery. That led me to think that maybe a battery there activated something. Of course I was wrong. I need to check all my boards and report back with pictures of each, I'll try and do that asap so we can at least leave info here with solid evidence and not just what I remember.

Glad to find someone else interested.

Let's document all differences between board revisions and whatever else we find. I have a wiki we could use later on.

[sneek]

I have a cps3 mobo with the connector your talking about... ive had a lot of them come through but this was the only revision that had it.

I'll have to see if I can dig it up again. I was interested in this about 2 yrs ago but its been a while since ive looked back into it.