Hacking Some questions about the new copy protection.

[Xandu]

Nintendo has recently copy protected some of it's major games, SMG for example. I have a Cyclowiz chip, but unfortunately without an update switch, so I'm stuck on v2 (v1 I'm not sure). So I got some questions:

1.Is this copy protection on all region discs? (PAL, JAP and NTSC)?
2.Will the original SMG disc work?
3.Can I somehow bypass the copy protection without updating the chip?

Thanks in advance.

 

[paul1991]

yes no no

 

[kedest]

I believe an original disc should work.
The protection cannot detect the modchip itself, but it can only detect if the disc is a copy.

 

[Hooya]

Here is how Bell, creator of YAOSM describes how the new protection scheme works, and how he fixed it in his modchip code. This also makes sense of why an original SMG disk works fine even when a modchip was present:

A normal Wii game has 0x230420 sectors (2048 bytes each) ranging from 0x000000 to 0x23041F while for example an DVD-R has 0x231280 sectors and a DVD+R has 0x230540 sectors. SMG tries to read a sector above the 0x23041F limit, I don't remeber the exact sector but I think it is 0x230500. This read operation will fail on original Wii discs but succeed on a DVD-R/DVD+R.

If that test is passed then it will send an A4 command to the DVD controller. I'm not entirely sure what the A4 command does but I think it has to do with the original encryption of DVD-movies and that command succeeds on DVD-R/DVD+R and most likely on real DVD movies aswell but on Wii original games it fails.

So what I do is that I hardcode the sector limit to 0x23041F and in the drive code it changes the mediaflag if an A4 command is comming on the DI-buffer(the DI-buffer is where commands from the WII/GC arrives to the DVD controller) so that the A4 command will fail and on every other DI-command the mediaflag is restored.

This was a lot harder to fix on yaosm than on the commerical modchips because commercial uses drivecode while yaosm patches the memory of the DVD controller over the serialbus and the serialbus is far to slow to be able to catch the A4 command.

http://psx-scene.com/forums/444411-post2.html

 

[paul1991]

Oh. Im sorry. I thought that the disc excuting unsigned code that read beyond the normal limit of DVDs. I was close.

 

[arctic_flame]

Fixed in OpenWii ages ago ( http://openwii.org/forums/viewtopic.php?t=574 )

CODE

in backendJackd.c
replace
maxSectors=(maxSectorsRaw[2]) |
(maxSectorsRaw[1]

 

[manias]

arctic flame that's hardly of use to him