Mirroring the rom worked for the NDS because there was very little verification. It didn't work for the 3DS until sky3ds cracked the cart protections and reimplemented. Issue here is that there is active protection in both the cart and the switch.
-
-
Replying to @hedgeberg @laith_iris_
Basically, without an OS exploit + a hardware-modified switch in addition to the cart itself, you're SoL.
1 reply 1 retweet 7 likes -
Replying to @hedgeberg
What about disc consoles? How do they know whether a disc is legit or not?
1 reply 3 retweets 2 likes -
Replying to @laith_iris_
This one is actually super neat. I don't know for all of them, but for the Wii, first off the disks actually spun backwards! You couldn't use regular pc DVDs without some smart hax. Second, the manufacturer intentionally burned specific sectors of the disk as bad.
3 replies 3 retweets 18 likes -
Replying to @hedgeberg @laith_iris_
GC/Wii uses a different scrambling algorithm than the DVD standard specification. It was a myth that they spun backwards, but its simpler than that (and this simplicity is enough to make the originals unreadable on a computer and the burnt ones unrecognized by the console)
1 reply 0 retweets 1 like -
Replying to @aaru_dps @laith_iris_
Yeah, I've since been educated as such. Again, Wii wasn't a platform I worked on past basic application of other people's haxx, I was like 14 iirc. Was just spouting something someone told me once. odds are they were talking about something else and I screwed up a-la telephone
1 reply 0 retweets 0 likes -
Replying to @hedgeberg @laith_iris_
It was several things: 1) sector format subtly changed, 2) scrambing seeds different, 3) some nonstandard media type in the lead-in, 4) a laser physically punches "scratches" into lead-in, 5) laser-cut BCA encodes PSNs of thusly damaged sectors, symmetrically encrypted.
1 reply 0 retweets 0 likes -
The theory is that angular positions of sectors aren't predictable, so you can't duplicate and then "re-make" the same scratches because they'd hit different sectors. Then Datel figured out you can just... turn off the mastering laser to simulate a scratch. Oops.
1 reply 0 retweets 0 likes -
This is how they made their unofficial GC/Wii discs, by copying the BCA area from a real game and then duplicating the broken sectors by shutting down the laser (breaking the low level bitstream) even though they're no longer in the same physical location.
1 reply 0 retweets 0 likes -
Incidentally, all of this is *theoretically* possible to do with a hardware+firmware-modified DVD+R burner. Media type is changeable, BCA can be written with LightScribe-type technology, you can mess with seeds and bitstream, ...
1 reply 0 retweets 0 likes
Also there were dumping tools that used specific PC readers. IIRC they did something like try to read a sector, wait for the error, then use some debug command to dump the raw sector data which could be corrected with the proper scrambling/offsets. Super slow but it worked.
-
-
Yeah, I wanted to take the RE work that
@scanlime did for coastermelt and use it to try and dump/author copy-protected optical disks, but I never got around to it since a _ton_ more RE would be needed.0 replies 0 retweets 1 likeThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.