What's the point of suicide batteries?

[Bill Brasky]

If I paid thousands of dollars for an arcade machine, I would be extremely pissed if it had a self-destruct mechanism built in when a battery dies. Why did Capcom (others?) do this? Did they want their games to only have a shelf life of 5 years or something? I realize it was probably to deter piracy or bootlegs but they'll end up dying even if used normally.

[sebastius]

If I paid thousands of dollars for an arcade machine, I would be extremely pissed if it had a self-destruct mechanism built in when a battery dies. Why did Capcom (others?) do this? Did they want their games to only have a shelf life of 5 years or something? I realize it was probably to deter piracy or bootlegs but they'll end up dying even if used normally.

1017341[/snapback]

The point is basically, you can't pull the chip from the board without killing the contents on it. The encryption tables are stored inside the customized processor in a bit of ram. To rip it's contents the pirates would need to either 'open it up' and read the table manually via a electron microscope or something, or analyze it by running a special program (trojan) on it. For both options one would need the chip without the rest of the board, hence the suicide battery circuit.

 

It probably seemed like a good idea then (probably worked for a little while), and yes, arcade games have a 'life expectancy' of about a year, because you need a new game every now and then, the system was already written off and also wear and tear ofcourse.

[Dav]

If I paid thousands of dollars for an arcade machine, I would be extremely pissed if it had a self-destruct mechanism built in when a battery dies. Why did Capcom (others?) do this? Did they want their games to only have a shelf life of 5 years or something? I realize it was probably to deter piracy or bootlegs but they'll end up dying even if used normally.

1017341[/snapback]

 

Back then they had no idea anyone would be interested in a 5 year old game. During the height of the video game era a game was only good for 3 months and then it was more profitable to put something else in.

[Artlover]

Is this also the case if it's left plugged in and turned on? Rather, more specificly what I'm leading to is, can't you just hot-swap the battery before it fails.

[Dav]

Is this also the case if it's left plugged in and turned on? Rather, more specificly what I'm leading to is, can't you just hot-swap the battery before it fails.

1017659[/snapback]

 

 

Yes, but some have the battery and essential components encased in epoxy.

[ttontis]

I have successfully replaced 2 and killed one. The two sites below helped out if you are looking to give it a try. Also Jammaboards.com offers a suicide battery replacement service. ( I have not used them for any type of service just the website for information.)

 

http://www.jammaboards.com/guides/CPS2_Sui...idebattery'

 

http://www.leopardcats.com/decrypt/decryption.htm

 

Ted

[Dav]

I have successfully replaced 2 and killed one. The two sites below helped out if you are looking to give it a try. Also Jammaboards.com offers a suicide battery replacement service. ( I have not used them for any type of service just the website for information.)

 

http://www.jammaboards.com/guides/CPS2_Sui...idebattery'

 

http://www.leopardcats.com/decrypt/decryption.htm

 

Ted

1018123[/snapback]

 

I've offered to create replacement parts for the sega batteries on the leopardcats page, but as of yet there's not been enough interest to justify it. I need the originals for the NEC series processors though and as of yet we've not been able to find some of them. Hopefully they'll be found before they all die, although it's entirely possible that they are all gone for certain boards. The fact that we've been looking for working examples of certain boards for over 5 years w/o any luck doesn't bode well.

[supercat]

The fact that we've been looking for working examples of certain boards for over 5 years w/o any luck doesn't bode well.

1018146[/snapback]

 

How complex were the encryptions on those things? Any possibility of reverse-engineering them?

[Dav]

The fact that we've been looking for working examples of certain boards for over 5 years w/o any luck doesn't bode well.

1018146[/snapback]

 

How complex were the encryptions on those things? Any possibility of reverse-engineering them?

1018155[/snapback]

 

Sega had a wide range. The first encypted z80's were had as few as 6 different encryptions that were controlled by the address bits. The "encryption" was a simple bitswap of the data bits with a XOR on top. And not even all 8, usually just 3. The only complicating factor was the fact that data and opcodes use different encryptions thereby preventing decrypted roms from easily being made. These were easily beaten looking for known text, IE "CREDITS" "GAME OVER" etc. I'm pretty good at reading z80 binary too, so I can find patterns in code as well as in text. They gradually increased until they had 64 different encryptions on games like gardia. That one had me stumped, I was able to get the first half decrypted but the second half had a lot of sound data I think. I wrote a program to compare the roms to the other sega roms assuming they reused some code. Turns out they did, which helped me get as far as I did. Nicola was able to finish it though Iirc by finding patterns in the encryption tables itself. After that they moved to the epoxy potted NEC cpu. Iirc it has 256 different encryptions. Iirc the encryptions are no longer just a simple product of the address bits, it's a look up table. There's enough complexity you could probably make a decryption algorythym to turn a rom into about any game you wanted. I can defeat that by a device I built that emulates a circuit board and observes how the z80 reacts to different commands, but I have to have the cpu. It's been a couple of years since I looked at that stuff, but I seem to remember someone saying that they must have 2k of ram embedded in it for the lookup table.

 

The fd1089 is the same system but extended for the 68000 cpu. I believe that made it a little easier. The FD1094 is much worse. The NEC device had 2 states opcodes and data. This device has multiple states, that are called on command. I don't know a lot about them, but Charles Macdonald found a way to break them. But he also has to have the cpu. You could put multiple state roms back into one rom but you could never be 100% sure you've done it correctly, and you'd have to patch the rom checks etc. Doing it in hardware with a cpld and a prom would be a much better solution imo. And for system 22 which uses floppy disks it's the only solution, since no one as of yet has been able to copy a floppy much less modify the data.

 

 

The main games I'm worried about are system E, which used the NEC for the main cpu. Most of the other systems used the NEC for the sound cpu only and later versions of the boards came out with decrypted roms so it's not a big deal to fix those.