Hacking Nintys new copyright protection (BCA)

[xdeadxpoolx]

I Just wanted to pass this along for the discussion, maybe not everyone is totally aware of it. OneUp released a .nfo today with this info in it.

> Wii.ISO.Releases.Will.Need.BCA.Data.ReadNFO.Wii-OneUp.nfo

> NOTICE

ÂÂ> Wii (ISO)

ÂÂ > 2009-12-02

ÂÂ> .nfo release

> http://www.eurasia.nu/modules.php?name=News&file=article&sid=2488

> We would like to bring to your attention the new Anti Piracy Protection 
ÂÂNintendo have started using called BCA (Burst Cutting Area) checking
ÂÂ
--------------------------------------------------------------------------------
modrobert (eurasia): "As you might know by now the protection used in NSMB 
(New Super Mario Bros) for Wii is a BCA check (Burst Cutting Area). Actually 
the drive command 'ReadDiscBca' is old but this is first time it has been used 
in a game to check the disc. In order to avoid cracking each game with this 
protection the BCA data should be collected from the original game disc and 
stored somewhere so it can be handled by either modchips or softmods in a 
proper way. 

For those who wish to load backup games from disc regardless if they have 
modchip or softmodded Wii it might be a good idea to store BCA within the ISO. 
Overburning DVD-R seems to be asking for trouble as some burner firmware can't 
handle it, same goes for certain media. Other backup solutions might benefit 
from doing the check in a separate external file perhaps.

In any case the BCA data is required from the original disc when ripped and 
I think the best way would be to create some kind of standard to deal with it. 
Maybe in the form of a PPF3 patch (with undo data) as I don't think it would be
a good idea to mess with the game dumps directly."
----------------
Note from OneUp: 
----------------
We at OneUp believe the ISO should still be left untouched/unpatched for release 
but due to the fact that BCA checks are now being used, we also believe that it 
is the responsible thing for Wii ISO groups to include this 64 bytes of
BCA data in the form of a separate text accompanying the ISO file

We have included the application uLoader that is capable of displaying
an ORIGINAL Wii games BCA data, once installed follow steps below

1 - Insert ORIGINAL Wii DISC
2 - Click on 'DVD Button'
3 - Click on 'Show BCA Data' Button
4 - Write down your BCA data for release

ÂÂÂÂÂÂÂÂ ...::: Example for New Super Mario Bros. Wii :::...

ÂÂ0000000000000000 0000000000000000 0000000000000000 0000000000000000
ÂÂ0000000000000000 0000000000000000 0000000100000000 0000000000000000

James.Camerons.Avatar.The.Game.PAL.Wii-GLoBAL has BCA data protection but no BCA
data is available.

 

[geoflcl]

God, Nintendo, haven't you realized that these aren't fixes, but only inconveniences?

 

[Satangel]

Thanks for posting the NFO, now we have a name for this inconvenience.

 

[synce]

Well they're basically just trying to make modding too much of a hassle for people to consider... I put it off for the longest while for that reason, but in the end I just wanted to play Fatal Frame 4 already

By the way does this even affect those of us with a softmod and something like GX loader? I could play the new Mario day one without issues

 

[electrico]

Now that everything is clear i hope modchip teams build an update for their customers.And that's the reason that wiikey fusion delayed, i think.

 

[xdeadxpoolx]

Now that everything is clear i hope modchip teams build an update for their customers.And that's the reason that wiikey fusion delayed, i think.

agreed, isnt this the exact reason that the chips started getting there flash memory?

Edit: Had to throw this in from wasabi page


19th of February 2008

Welcome to our brand new website! After months of hard work we're proud to present what we belive is by far the best Wii modchip out there.

Wasabi is not your typical Wii drivechip. Apart from all the usual features you'd expect from any good chip (including a working built-in GC audiofix), it sets new standards on many points:

* It's the first chip that works on all drives, from DMS to latest D2C drives (including GC2-D1A).
* It's the first D2C compatible chip that is upgradable from DVD.
* It's the easiest chip to install on D2C: only 9 wires, only 3 of them connected to a pin/via.
* It's the easiest chip to install on DMS and D2B as well: No need to use a dremel or super-glue with "cut-pin" drives, and there's no pin/via to solder even with the latest D2B boards.
* It's the first D2C compatible chip that is as clean as DMS/D2B drivechips: full control over the drive's firmware, no physical patching on the lines while the games are running. That means perfect stability, more control, and no stress on the drive's components.
* Best of all, it's the first chip to include a decent amount of flash memory (128KB) for firmware and data storage.


modchip comparison chart


Did you know that current ISO dumpers are currently missing a few KB of data stored in the barcode (BCA) and lead-in area ? This "extra" data could be read by the console and used to detect chips. SMG and SSBB are the first games to call one of the related drive commands, without interpreting the data yet. We take that as a warning. Thanks to on-board memory, the "extra" data of your whole game collection could be stored on the chip itself if that becomes necessary. The flash memory is also used to store the drivecode and could store patches and Wii/GC binaries in the future.

The first batch of wasabi will be shipped to retailers on the second week of March. Have a look at our product page for more info!

 

[Cyan]

Actual homebrew dumper don't read BCA, so only release group can extract these data for the moment.
I think if backup loaders and modchips start using bca data files, homebrew dumpers and USBloader internal dumpers will add it, right ?


@xdeadxpoolx : Nice catch about Wasabi ! let's see if they make use of it now.

 

[ringorinfret]

pretty interesting read...wasabi team saw it coming!!

 

[Lazycus]

Everyone saw it coming. Why Nintendo chose to wait until now to implement it is the question.

 

[TheNewbPleaser]

God, Nintendo, haven't you realized that these aren't fixes, but only inconveniences?

yep ur right ur only making more work for the hackers jajajaja

 

[techboy]

When will N learn that now that piracy has started, stopping it is almost impossible? Adding the anti-piracy after the fact isn't going to help. D3-2 was a step forward, but it's only time before the modchips show up.
If they want to stop most chips, they'd need to make D3-2 units with the whole circuit board potted in epoxy.

The BCA protection took what, a day or two to crack on NSMBW? If we're cracking AP protection in days, and it takes weeks or months for new protection to show up, N is fighting a losing war.

 

[damysteryman]

I agree.

Software-wise, I think they cannot stop us.

Hardware-wise, I think that a chip is posible, but I don't know why nobody has made a Drivechip for D3-2 drives. Surely there's some way to hack the big D1A chip on the drive motherboard.

As for the BCA data, I hope that the user could write the BCA data to the end of their game's ISO, then have a homebrew loader read it and implement it, in order to load the BCA-protected discs. I've seen a program released by the faltmii guys which writes the BCA data to the end of an ISO, now we need a way to implement it, that way we don't have to patch and fakesign every future game.

I wonder if anybody could code an app which could read and dump the BCA data while dumping a disc. Maybe somebody could convince wanin to update his cIOS DVD Dumper...

I'm downloading uLoader right now, and I'm going to dump the BCA data for every legitimate game I come across. I'll start with my Legit games, then I'll probably borrow some from friends, then I'm going to upload the bca data I've collected to the internet for all to use.

"Now where'd I put my Wii Sports disc? Wait, I know."

 

[hiver]

so with this info now
can an iso with the bca protection be resolved to run the backup dvd .iso of nsmb on a hardmodded wiikey v1 ?

 

[gene0915]

pretty interesting read...wasabi team saw it coming!!

Before anyone goes and starts sucking Wasabi's dick, remember that this is one of the many mod chip makers who til this day, have not released a firmware update for any of THEIR chips (TTBOMK) that deals with the protection in NSMB. Good thing people PAID for a product with such wonderful support. I think after the SMG stuff, mod chip makers coasted for a while and saw USB loaders taking off and pretty much gave up. Can't blame 'em, who wants to buy a modchip when a Wii can be fully software hacked and made to play games from a USB drive?

I'm not just giving Wasabi shit, out of all the Wii mod chips floating around out there, which ones were quick with a firmware update for NSMB? I think 1 was but I forget their name?!

 

[hiver]

I guess what I'm asking since I can make my own 1:1 backup

in future if no update or with an update from wiikey team

will I ever be able to use my wiikey v1 with 1.9s/x update at 4.1u ntsc

and play a backup of nsmb if its patched in some way sorta like a program ?

so like some one can make a crack or patch for an .iso of all the new wii games removing the bca or whatever

enabling me to play my backups once again from a disc with NO homebrew ?? on my wiikeyv1 ?

i just got a modchip to play my backups and now it seems pointless

 

[ringorinfret]

I agree.

Software-wise, I think they cannot stop us.

Hardware-wise, I think that a chip is posible, but I don't know why nobody has made a Drivechip for D3-2 drives. Surely there's some way to hack the big D1A chip on the drive motherboard.

As for the BCA data, I hope that the user could write the BCA data to the end of their game's ISO, then have a homebrew loader read it and implement it, in order to load the BCA-protected discs. I've seen a program released by the faltmii guys which writes the BCA data to the end of an ISO, now we need a way to implement it, that way we don't have to patch and fakesign every future game.

I wonder if anybody could code an app which could read and dump the BCA data while dumping a disc. Maybe somebody could convince wanin to update his cIOS DVD Dumper...

I'm downloading uLoader right now, and I'm going to dump the BCA data for every legitimate game I come across. I'll start with my Legit games, then I'll probably borrow some from friends, then I'm going to upload the bca data I've collected to the internet for all to use.

"Now where'd I put my Wii Sports disc? Wait, I know."

i think it is pointless to upload BCA for games that dont use it...so far only NSMB and Avatar are protected this way if I am not mistaken... every other game dont need any BCA

 

[VashTS]

Maybe CSI Deadly Intent as well? That game was overlooked cause no one cares about including me, I just like to see things get fixed and learn why

 

[damysteryman]

@ringorinfret
True. I wasn't thinking about that when I made that post... (lol)

So, I'll dump the BCA for every recent and future game I come across.

@VashTS
I don't have a copy of that game, so I can't help you there...

 

[LightyKD]

@ringorinfret
True. I wasn't thinking about that when I made that post... (lol)

So, I'll dump the BCA for every recent and future game I come across.

@VashTS
I don't have a copy of that game, so I can't help you there...

to da_letter_a

its a bit off topic but I couldnt help to ask. Will we be seeing a version of cIOSCORP that will use cIOS rev 15. Im asking because NSMB the patched version shows on the disc channel but loads to a restart b/c cIOSCORP 3.5 uses cIOS rev 14. I don't want to sound like a nag or a pester, I'm just curious.

 

[damysteryman]

Nope. rev15 causes 001 error for pretty much everything I throw at it.

Which patch are you using? the old one, when the game was first released? If so, that's why. That old patch doesn't work with softmods. Use the newer nsmbxy ppf patch by vki. You'll find the link to the patch in my sig.