HUNDRED SWORDS KEY VERSION [HDR-0127]

[majorpbx]

Did not find this one in the dats. It is the @barai version as noted by logo on the disk and case.

Title: HUNDRED SWORDS KEY VERSION
Media ID: 5E0F
Media Config: GD-ROM1/1
Regions: J
Peripheral String: 2799B11
Product Number: HDR-0127
Version: V1.000
Release Date: 20001228
Manufacturer ID: SEGA ENTERPRISES
Mould SID Code: IFPI 783C
Inner Ring Code: <HDR-0127-0634>HL113C
Mastering SID Code: IFPI L463
Barcode: 4-974365-501273

Hardware: Dreamcast USA HKT-3020 (1) with Broadband HIT-0400
Software: httpd-ack-20080711 on Windows 10 with Chrome, and custom PowerShell script

Code: Select all

5
1 0 4 2352 track01.bin 0
2 450 0 2352 track02.raw 0
3 45000 4 2352 track03.bin 0
4 181623 0 2352 track04.raw 0
5 208512 4 2352 track05.bin 0

disc.gdi size 149 crc 20f456b5 md5 434e0f140eb966e8d5e126151dbeb96e sha1 769fab7524418d6bd4f895e45023ad5ea77ea3d3
track01.bin size 705600 crc 3a6d79e2 md5 8ca56a68635f38f00b5d962cea46554b sha1 afb383616c3853f3ec77cbbfa8aa25bd9311efaf
track02.raw size 1735776 crc 89ac06fb md5 5a9f4156c37f503b735c4899017ea8c6 sha1 f56d9fe7e83a16d194693e79ac31608013aa84bd
track03.bin size 320984496 crc 10c36406 md5 54bc51bf6611819b55408ff85071d037 sha1 82256bf9ea6b2184f5eef7faef271af94bdec684
track04.raw size 62890128 crc 59c7429e md5 343c53e6faabeb34e04c97528850e87a sha1 bde250bc254d4c641f1ee20572ab99d92d1bb5fa
track05.bin size 801180576 crc 9b6e4865 md5 088a40d8ad350360e242fbb9bbe63748 sha1 9b989a442ffbcc6994447d79e2a80b9a36790ebd

[Maddog]

Matched my personal dump. I didn't actually have much hope that someone would submit a dump of this as it's relatively rare and of low interest to most people. Quite happy to see your dump!
All info identical to what is seen above.
It will appear in the next dats. Thank you majorpbx!

[majorpbx]

No problem, I like finding rare items like this as I had no idea they existed in the first place. Also, do you know if anyone anywhere has a save with the key file needed for this or the Eternal Arcadia game? I found in another post that you weren't sure what the difference was between these and the regular versions of the game. Just curious if the true differences are known.

[Maddog]

No, I have never seen the keys posted anywhere or anything else that would help unlock the game.
I had the vague idea that you needed to access a long-dead Sega server in order to actually unlock the game, but I have not looked into it much TBH and I don't know exactly how the actual procedure went...

[MetalliC]

do you know if anyone anywhere has a save with the key file needed for this or the Eternal Arcadia game?

I think I can look at that.
is it known at what point these games require "key files" ? it will be perfect to have game save files near that point.

[majorpbx]

I do not know at what point, but might be a good time to throw it in the DC and run through the game huh?

[majorpbx]

Actually, thinking about it a bit more. Would it be a good idea to start with what files have changed on the disc from the full version compared to the @barai version?

[MetalliC]

the plan is to run game in emulator with debugger, plus disassemble and analyze code in IDA, usual reverse engineering stuff. but I don't have enough time (and TBH no desire too) to play game dozen(s) of hours until the point where "key" is needed. so, it will be nice to have some input data, or at least clear information.

as for file comparison - game binary expected to be recompiled with some changes, so there will be almost impossible to spot real changes, because of thousands of changed pointers and code blocks moved here and where.

[MetalliC]

to my big surprise, Arcadia @barai turned out pretty amusing case.
this game looking for E.ARCADIAKEY file at VMU, if it was found it will be used as decryption key for USR.PUB file located at game disk. decrypted data in its turn becomes another decryption key, for ~150 FIELD/*.MLE files.
pretty nice security design (however, I would make unique keys married with serial number of the console )

[majorpbx]

Nice find, its funny as i noticed the Eternal Arcadia the differences were bigger 1st_read.bin, the addition of the USR.PUB file, and several changes to the FIELD\*.MLE files. Now if there is a decryption key does it exist anywhere?

[MetalliC]

I'm not greatest expert in encryption, but it looks like key file might be brute forced, but I'm not sure how complex math it is and how much compute power it takes.

[MetalliC]

update on this, but not optimistic one. finally I get to the point where game wants key, it is about 4-5 hours of gameplay, until upper Valua city rail train scene.
game looking for E.ARCADIAKEY at VMUs, quite small - 1024 bytes (2 blocks), its contents: VMS header + one icon followed by actual "key" data block @280h, looks like 128bytes in size.
that data block together with USR.PUB file passed to decryption routine, quite complex one.

decoded result expected to be: 0, 1, FFh-s (optional, will be skipped if found), 0,'S','E','G','A', console unique serial# 6bytes, MLE files decryption key 40 bytes, the rest is probably zeroes (not 100% sure, game does strncmp() with empty string, might be emulation issue and non-empty but some text on real dreamcast).

not simple at all, and also developers was smart enough to implement unique SN# check, so VMU key will work only with one specific Dreamcast unit.
so far I have no good ideas how it might be solved in more or less simple and not painful long way.
it might help if one day will be found one of original VMU keys, so it might be analyzed and provide data for "keygen" development.
otherwise we have too much unknowns here...