search

alex-free / aprip

PSX Anti-Piracy Protection Bypass Generator
https://alex-free.github.io/aprip
BSD 3-Clause "New" or "Revised" License
26 stars 0 forks source link

beatmania - Append Club Mix SLPM-86692 (NTSC-J) protection not detected #1

Open mdmdj opened 6 months ago

mdmdj commented 6 months ago

Hi alex-free, thanks for the amazing tool!

I found a game with protection not detected in the bin image by aprip. beatmania - Append Club Mix SLPM-86692 (NTSC-J)

This is one of the Konami music games that usually requires disc swapping, but I modified the bin to be 'noswap' by booting APPEND.EXE directly from SYSTEM.CNF which works for some other games in the series.

With this modification I was able to generate game shark codes from the dump with aprip.

Got APv2 Fake PAL BIOS bypass (By Alex Free & MottZilla) starting at offset: 0x001BFC18
D01BFC26 1062
801BFC26 1800
Got APv2 Fake VC0 Bypass starting at offset: 0x001C1080
D01C10B0 001E
801C10B0 0000

For now, I'm not sure if applying the modification will change the offsets.

I wanted to share this information with you incase it could help you to add detection for this game in aprip.

Here is the RAM dump: beatmania club mix protection dump.zip

Here is an xdelta patch to apply the no swap modification: beatmania club mix noswap patch.zip It should work with the redump image.

When I was looking around for a patch or other information about the protection in this game, I found this thread where they attempting to detect all games with protection and this game was not detected in that case also. http://forum.redump.org/post/52530/#p52530 Maybe it has some unusual obfuscation?

Hope this helps. Thanks again for your great tools!

alex-free commented 6 months ago

Hi alex-free, thanks for the amazing tool!

I found a game with protection not detected in the bin image by aprip. beatmania - Append Club Mix SLPM-86692 (NTSC-J)

This is one of the Konami music games that usually requires disc swapping, but I modified the bin to be 'noswap' by booting APPEND.EXE directly from SYSTEM.CNF which works for some other games in the series.

With this modification I was able to generate game shark codes from the dump with aprip.

Got APv2 Fake PAL BIOS bypass (By Alex Free & MottZilla) starting at offset: 0x001BFC18
D01BFC26 1062
801BFC26 1800
Got APv2 Fake VC0 Bypass starting at offset: 0x001C1080
D01C10B0 001E
801C10B0 0000

For now, I'm not sure if applying the modification will change the offsets.

I wanted to share this information with you incase it could help you to add detection for this game in aprip.

Here is the RAM dump: beatmania club mix protection dump.zip

Here is an xdelta patch to apply the no swap modification: beatmania club mix noswap patch.zip It should work with the redump image.

When I was looking around for a patch or other information about the protection in this game, I found this thread where they attempting to detect all games with protection and this game was not detected in that case also. http://forum.redump.org/post/52530/#p52530 Maybe it has some unusual obfuscation?

Hope this helps. Thanks again for your great tools!

This is very interesting, because I can 'swap the EXE' used when detecting this SYSTEM.CNF/boot exe combination from Tonyhax International on booting this game (and then enable these codes in the built-in anti-piracy bypass system for this specific game).

For USA consoles these codes could be turned on for a game that can boot this via the disc swap feature, and when it is eventually booted via the disc change it would work to bypass the anti-piracy. The problem is the disc swap feature doesn't work like normal for Japanese consoles. It still can work if you do a swap trick during the disc swap feature, but that is dangerous and can damage the drive. For Japanese consoles I want to implement a software workaround for such games, which this method does indeed provide in a way.

You mention there are other games in the series this exe swap applies to, do you know which ones work the same way?

If I recall correctly this series uses obsfucation (compressed or encrypted the code) so it is only visiable/patchable with gameshark codes (as the code is decompressed/decrypted at run time and still vulnerable to aprip bypasses) which you proved with your ram dump gameshark code generation.

Thanks

mdmdj commented 5 months ago

Hi alex-free, sorry for the late reply.

Here is some more context that I hope will be helpful if you're interesting in adding support for these games.

I have been trying to hack together images of these games that will direct boot (no swap) and disable the region/mod detection.

I have been using a mixture of xps patches I found on https://www.consolecopyworld.com/psx/psx_patches.shtml , applied in a Windows XP VM and I manually tried hex editing some bins to modify the SYSTEM.CNF.

The games seems to fall into 3 main categories: Key Disc Games that boot normally, and are used to swap/disc change with the APPEND discs. These are Beat Mania (Japan) (Disc 1) (Arcade) Beatmania 6thMix + Core Remix (Japan) Beat Mania - The Sound of Tokyo (Japan) Beatmania Best Hits (Japan)

APPEND Disc - Original Style Beat Mania (Japan) (Disc 2) (Append) aka Yebisu Mix Beat Mania Append 3rdMix (Japan)

APPEND Disc - APPEND.EXE Style Beat Mania Append GottaMix (Japan) Beat Mania Append GottaMix 2 - Going Global (Japan) Beatmania Append 4thMix - The Beat Goes On (Japan) Beatmania Append 5thMix - Time to Get Down (Japan) Beatmania Append Club Mix (Japan)

Beat Mania (Japan) (Disc 1) (Arcade) does not seem to have protection

Beat Mania (Japan) (Disc 2) (Append) aka Yebisu Mix did not seem to ever have anyone make a noswap patch for it. Does not seem to have protection

Beat Mania Append 3rdMix (Japan) - I was able to use a patch to make a noswap version. To save you the trouble of getting xps patcher to run, here is a delta patch vs the Redump bin. Though please note that patch also contained a modified boot logo, so there are some unnecessary diffs. Beat Mania Append 3rdMix (Japan) noswap modlogo.zip Does not seem to have protection.

Beat Mania Append GottaMix (Japan) - I was able to use an XPS patch to remove the protection and modified SYSTEM.CNF to boot APPEND.EXE directly Beat Mania Append GottaMix (Japan) modfix noswap.zip

Beatmania Append 4thMix - The Beat Goes On (Japan) - I was able to use an XPS patch to remove some protection but the game wouldn't seem to start APPEND.EXE directly. Maybe due to another code path for protection.

Beatmania Append 4thMix - The Beat Goes On (Japan) modfix.zip

For Beatmania Append 5thMix - Time to Get Down (Japan) and Beat Mania Append GottaMix 2 - Going Global (Japan) I was able to source images that already had protection removed and noswap modification applied. They are in ccd format so I'm not sure how to give a valid patch.

For Beatmania Append Club Mix (Japan) I haven't found a way to remove the protection and the game won't directly start when modified to start APPEND.EXE even in an emulator setup in a way that shouldn't trigger protection(?)

alex-free commented 5 months ago

Hi alex-free, sorry for the late reply.

Here is some more context that I hope will be helpful if you're interesting in adding support for these games.

I have been trying to hack together images of these games that will direct boot (no swap) and disable the region/mod detection.

I have been using a mixture of xps patches I found on https://www.consolecopyworld.com/psx/psx_patches.shtml , applied in a Windows XP VM and I manually tried hex editing some bins to modify the SYSTEM.CNF.

The games seems to fall into 3 main categories:

Key Disc

Games that boot normally, and are used to swap/disc change with the APPEND discs.

These are

Beat Mania (Japan) (Disc 1) (Arcade)

Beatmania 6thMix + Core Remix (Japan)

Beat Mania - The Sound of Tokyo (Japan)

Beatmania Best Hits (Japan)

APPEND Disc - Original Style

Beat Mania (Japan) (Disc 2) (Append) aka Yebisu Mix

Beat Mania Append 3rdMix (Japan)

APPEND Disc - APPEND.EXE Style

Beat Mania Append GottaMix (Japan)

Beat Mania Append GottaMix 2 - Going Global (Japan)

Beatmania Append 4thMix - The Beat Goes On (Japan)

Beatmania Append 5thMix - Time to Get Down (Japan)

Beatmania Append Club Mix (Japan)

Beat Mania (Japan) (Disc 1) (Arcade) does not seem to have protection

Beat Mania (Japan) (Disc 2) (Append) aka Yebisu Mix did not seem to ever have anyone make a noswap patch for it. Does not seem to have protection

Beat Mania Append 3rdMix (Japan) - I was able to use a patch to make a noswap version. To save you the trouble of getting xps patcher to run, here is a delta patch vs the Redump bin.

Though please note that patch also contained a modified boot logo, so there are some unnecessary diffs.

Beat Mania Append 3rdMix (Japan) noswap modlogo.zip

Does not seem to have protection.

Beat Mania Append GottaMix (Japan) - I was able to use an XPS patch to remove the protection and modified SYSTEM.CNF to boot APPEND.EXE directly

Beat Mania Append GottaMix (Japan) modfix noswap.zip

Beatmania Append 4thMix - The Beat Goes On (Japan) - I was able to use an XPS patch to remove some protection but the game wouldn't seem to start APPEND.EXE directly. Maybe due to another code path for protection.

Beatmania Append 4thMix - The Beat Goes On (Japan) modfix.zip

For Beatmania Append 5thMix - Time to Get Down (Japan) and Beat Mania Append GottaMix 2 - Going Global (Japan) I was able to source images that already had protection removed and noswap modification applied. They are in ccd format so I'm not sure how to give a valid patch.

For Beatmania Append Club Mix (Japan) I haven't found a way to remove the protection and the game won't directly start when modified to start APPEND.EXE even in an emulator setup in a way that shouldn't trigger protection(?)

That's awesome. I can implement the exe change in software with Tonyhax international. I can have it detect the boot file for the patchable games you have found to make them no swap without any patching to the actual disc image before burning them being required. This means real import discs will also work directly, I hope this makes sense!

I could also make Aprip detect the same thing and do a patch without adding any boot logos and what not, but the Tonyhax international support is much cooler IMO.

alex-free commented 3 months ago

Hi alex-free, sorry for the late reply.

Here is some more context that I hope will be helpful if you're interesting in adding support for these games.

I have been trying to hack together images of these games that will direct boot (no swap) and disable the region/mod detection.

I have been using a mixture of xps patches I found on https://www.consolecopyworld.com/psx/psx_patches.shtml , applied in a Windows XP VM and I manually tried hex editing some bins to modify the SYSTEM.CNF.

The games seems to fall into 3 main categories: Key Disc Games that boot normally, and are used to swap/disc change with the APPEND discs. These are Beat Mania (Japan) (Disc 1) (Arcade) Beatmania 6thMix + Core Remix (Japan) Beat Mania - The Sound of Tokyo (Japan) Beatmania Best Hits (Japan)

APPEND Disc - Original Style Beat Mania (Japan) (Disc 2) (Append) aka Yebisu Mix Beat Mania Append 3rdMix (Japan)

APPEND Disc - APPEND.EXE Style Beat Mania Append GottaMix (Japan) Beat Mania Append GottaMix 2 - Going Global (Japan) Beatmania Append 4thMix - The Beat Goes On (Japan) Beatmania Append 5thMix - Time to Get Down (Japan) Beatmania Append Club Mix (Japan)

Beat Mania (Japan) (Disc 1) (Arcade) does not seem to have protection

Beat Mania (Japan) (Disc 2) (Append) aka Yebisu Mix did not seem to ever have anyone make a noswap patch for it. Does not seem to have protection

Beat Mania Append 3rdMix (Japan) - I was able to use a patch to make a noswap version. To save you the trouble of getting xps patcher to run, here is a delta patch vs the Redump bin. Though please note that patch also contained a modified boot logo, so there are some unnecessary diffs. Beat Mania Append 3rdMix (Japan) noswap modlogo.zip Does not seem to have protection.

Beat Mania Append GottaMix (Japan) - I was able to use an XPS patch to remove the protection and modified SYSTEM.CNF to boot APPEND.EXE directly Beat Mania Append GottaMix (Japan) modfix noswap.zip

Beatmania Append 4thMix - The Beat Goes On (Japan) - I was able to use an XPS patch to remove some protection but the game wouldn't seem to start APPEND.EXE directly. Maybe due to another code path for protection.

Beatmania Append 4thMix - The Beat Goes On (Japan) modfix.zip

For Beatmania Append 5thMix - Time to Get Down (Japan) and Beat Mania Append GottaMix 2 - Going Global (Japan) I was able to source images that already had protection removed and noswap modification applied. They are in ccd format so I'm not sure how to give a valid patch.

For Beatmania Append Club Mix (Japan) I haven't found a way to remove the protection and the game won't directly start when modified to start APPEND.EXE even in an emulator setup in a way that shouldn't trigger protection(?)

Interesting, Beat Mania Append GottaMix (Japan) indeed works by just changing the exe file for no swap. I implemented some new functions in my yet to be released aprip update which can do it automatically. Which other games work for changing the exe in SYSTEM.CNF?

My assumption is the other games which don't work for no swap like this are doing more checks like you say, but maybe that can be fixed trivially as well soon.

alex-free commented 3 months ago

Known games that work by changing bootfile to cdrom:\APPEND.EXE;1

alex-free commented 3 months ago

https://github.com/alex-free/aprip?tab=readme-ov-file#append-no-swap-bypass

alex-free commented 2 months ago

Found code for club mix: https://gamehacking.org/game/93333

Few more: http://www.gameotaku.20m.com/enablecodes.htm

Successfully implemented no swap + codes for Gottamix that defeats both AP check and Key disc check when booting an original disc or unpatched CD-R burn via tonyhax international v1.4.7: https://alex-free.github.io/tonyhax-international . No swap bypass also implemented for 3rd mix but AP is not fixed yet in my beta build of tonyhax international.

@mdmdj

alex-free commented 1 month ago

So BeatMania 3rd mix doesn't have any mod-chip related protection (only EDC) so it also already works directly booted with Tonyhax International, no key disc required. Tonyhax International 'is' the key disc.