Phoenixing CPS3 carts

Is there a way to Phoenix a CPS3 cart? If so, does anyone know who I can send CPS3 carts to to get them phoenixed?

As far as I know,
not yet.


Some people are starting to buy them up and hoard them for when the time is finally upon us.

I thought so, too, but according to wikipedia, the codes have been decrypted:

http://en.wikipedia.org/wiki/CPS3

Thus, I thought that maybe someone on here might know if and how they can be phoenixed.

No one knows yet, but I have 3 of them waiting for it ( all 3 US TS's ).

im willing to do it when i get details how

werejag said:

im willing to do it when i get details how

Click to expand...

You'll more than likely need to replace the custom capcom SH2 processor with an unlocked hitachi SH2. Doing so will require LOTS of SMD soldering.

None of this is going to be done until someone cracks the program code to run on the CPS3 hardware (modified or not).

Currently mame is able to read past the encryption. That doesn't really help in regards to pheonixing carts, as the platform is encrypted hitachi SH2.

Sorry to break the bad news, however I don't see this happening for a LONG time, if at all.

billd420 said:

You'll more than likely need to replace the custom capcom SH2 processor with an unlocked hitachi SH2. Doing so will require LOTS of SMD soldering.

None of this is going to be done until someone cracks the program code to run on the CPS3 hardware (modified or not).

Currently mame is able to read past the encryption. That doesn't really help in regards to pheonixing carts, as the platform is encrypted hitachi SH2.

Sorry to break the bad news, however I don't see this happening for a LONG time, if at all.

Click to expand...

How is MAME able to "read past" the encryption and work? It looks like the code is stored for MAME unencrypted and hacked up drivers make it work... I wonder if that code & driver set could be redone to work on the CPS III system if the SH2 processors were replaced with standard ones.

If the pinouts are the same and if it's just a matter of swapping chips, I can do that.

The MAME notes also say this:

Even though the code in the flashROM is encrypted, the cart can run it even if it is dead/suicided because it has been discovered that the BIOS contains a hidden security menu allowing the cart to be loaded with the security data. This proves the cart runs the BIOS even if it is dead. The special security menu is not normally available but is likely accessed with a special key/button combination which is unknown ATM.

Click to expand...

I find that very interesting! I'm wondering why more time hasn't been dedicated to finding that combination, finding the key in the BIOS, or to hacking that BIOS to just have it autoload the code onto the chip.

RJ

EDIT* Sorry, you might as well just excuse what I already typed. I just got ahead to reading the actual MAME faq, which blows my mind. I guess the bios is modified to run on the emulator, but it does make you wonder if it could be modified to run on actual hardware? (If it wasn't encrypted. Eh? So the cpu is a special type that is encyrypted to read encrypted data, with the sram that stores the security data in the processor itself? I'm wondering if it's possible to find out what's written on the static ram in the processor, and potentially switch it out with dynamic ram. Thus eliminating the need for the battery.

OLD* Hmmm, I was thinking that because the rom's were already decrypted, they only needed the bios w/ hacked drivers to work in MAME. Hence, Mame doesn't need to worry about the encryption code on the security cart. As for the special bios screen, it's probably not as simple as a key/button combination. Only Capcom really knows how to get to it, but I'm thinking that's it's there when the security code is setup in the first place. (For Instance, wasn't someguy on ebay phoenixing US SF3rd Strikes into Chinese ones a while back?) But the fact that there is one makes you wonder why they couldn't hack it to auto load the security features. I don't see why you would have to swap processor's if it was just an issue with the bios. My question though are the bios' out for the emulators the same as in the hardware or are they modified to work in the emulators?

channelmaniac said:

How is MAME able to "read past" the encryption and work? It looks like the code is stored for MAME unencrypted and hacked up drivers make it work... I wonder if that code & driver set could be redone to work on the CPS III system if the SH2 processors were replaced with standard ones.

If the pinouts are the same and if it's just a matter of swapping chips, I can do that.

The MAME notes also say this:



I find that very interesting! I'm wondering why more time hasn't been dedicated to finding that combination, finding the key in the BIOS, or to hacking that BIOS to just have it autoload the code onto the chip.

RJ

Click to expand...

From first glance (mind you, I'm a hardware geek & not a programmer) it appears they are using a standard SH2 emulator and hacked up code as they don't know how to emulate the encryption processor in the CPS3 system.

Once they figure that part out they can then rewrite things to work without the stupid key.

Ruell said:

As for the special bios screen, it's probably not as simple as a key/button combination. Only Capcom really knows how to get to it, but I'm thinking that's it's there when the security code is setup in the first place.

Click to expand...

I'm 99% sure you can access the security menus with by communicating with the JTag connector found on one of the CPS3 motherboard revisions.

As for the guy pheonixing dead carts, he was simply sending them to Capcom HK as they dont' give a shit what region the original is. I dont' care what Tony Chan says (NeweraVideogames), he's a lying POS and absolutely does not have the capability to reflash the games himself.

@Raymond- Guru (mame dumper) toyed around with putting a regular SH2 in the cartridge instead of the capcom issued one with no luck. As far as I know there is volatile ram within the custom SH2 that holds the encryption key, backed by battery. In theory, a combination of cracked bios, regular SH2 and decrypted CD-data should work. Its gonna require a TON of modifications to the code, but I think it can be done. Who's the resident SH2 guru? Not me, thats for sure.

-Bill

From what I see the encryption is known and used in MAME. Aparently there is also code in the cart to reprogram the keys, the problem is (from what Ive heard) the SH2 in CPS3 is not able to run decrypted code. That said however people said the same thing about the custom CPS2 processor and look how wrong they were with that.

I may take a look at CPS3 if I ever get enough time to.

I'm curious as to if it really is a custom SH2 CPU or if it's a stock one. They make some with built in flash or OTP ROM and SRAM in the core in a 144 pin package just like used on the security carts.

Now if someone could dump the internal ROMs...

Here's the best part:

If that info is true, with a little engineering, you should be able to make an All-in-One decrypter cart.. I.E. run everything from one cart if I read that right.

VanillaThunder said:

Here's the best part:

If that info is true, with a little engineering, you should be able to make an All-in-One decrypter cart.. I.E. run everything from one cart if I read that right.

Click to expand...

In theory, yes. If the program code loaded into the simms was patched to accept one generic key, than one single cart could be able to run all the games.

-Bill

channelmaniac said:

I'm curious as to if it really is a custom SH2 CPU or if it's a stock one. They make some with built in flash or OTP ROM and SRAM in the core in a 144 pin package just like used on the security carts.

Now if someone could dump the internal ROMs...

Click to expand...

PM me if you want a suicided cart to tinker with.

I have one to play with but I have no software/programming skills. I can do the soldering and other hardware work though.

Razoola said:

From what I see the encryption is known and used in MAME. Aparently there is also code in the cart to reprogram the keys, the problem is (from what Ive heard) the SH2 in CPS3 is not able to run decrypted code. That said however people said the same thing about the custom CPS2 processor and look how wrong they were with that.

I may take a look at CPS3 if I ever get enough time to.

Click to expand...

OMG, please do! If anyone can get suicided CPSIII games to work it would be you!

Any more word on this. I'm actually getting together with a few of my friends from school. A couple of them know a little programming, maybe they could understand some of Andreas notes.

Fuck...FUCK... :/

FUCK, FUCKEDY, FUUUUCK!

My 3s just died on me a few minutes ago.
Was playing for a few mins, switched off, back on again, black screen of death.
I changed bat in 08/2004, that isnt even four fucking years.
Fuck you capcom.
How to contact cap hk on this issue?
Anyone did that sucessfully?
Whats the price on that one?

Razoola, i'll kiss your bum if you look into this.

I love reading threads in which I have no clue what you guys are talking about.
I only get the Dead CPS3 part. And the foul language.

I can honestly say a suicide-free 3rd Strike would pretty much be the best thing ever...give me that and I couldn't give 2 shits about Street Fighter 4.

If someone needs a suicided CPS3 cart to play with, just let me know.

channelmaniac said:

I'm curious as to if it really is a custom SH2 CPU or if it's a stock one. They make some with built in flash or OTP ROM and SRAM in the core in a 144 pin package just like used on the security carts.

Now if someone could dump the internal ROMs...

Click to expand...

I do know that the CPS3 shares the same kind of possessor as the Sega Saturn. People guess it was Capcom wanting to use the Saturn as a ground for good CPS3 ports but we all know how that ended up (Capcom has good relations with Sega so this suports the idea as well).

I just don't know if its the same EXACT one or some custom version like you suggested.

EVIL NICK said:

If someone needs a suicided CPS3 cart to play with, just let me know.

Click to expand...

I'll take a dead TS, if you can spare one.

DJ Long Cat said:

I do know that the CPS3 shares the same kind of possessor as the Sega Saturn. People guess it was Capcom wanting to use the Saturn as a ground for good CPS3 ports but we all know how that ended up (Capcom has good relations with Sega so this suports the idea as well).

I just don't know if its the same EXACT one or some custom version like you suggested.

Click to expand...

CPS3 has dual SH2 processors, not just 1 like the saturn. The saturn would have never been able to handle the amount of sprites on screen at the same time.

Heck, the dreamcast had to remove frames of animation for the CPS3 ports that it saw.