Cracking The Sega Saturn After 20 Years

When it was released 20 years ago, the Sega Saturn was by far the most powerful video game console available. It was a revolutionary device, had incredible (for the time) graphics, and a huge library of IP Sega could draw from. The Saturn was quickly overshadowed by the Sony Playstation, and soon these devices found themselves unused, unloved, and fetching high prices on the collectors market.

After finding a Sega Saturn on a trip to Japan, [jhl] decided he would like to write some code for this machine. Unlike earlier consoles, where Flash cartridges are readily available, or later consoles, where writing directly to the on-board storage is easy, bringing up a development environment for the Saturn isn’t easy. The best method is installing a mod chip and working off of burned CDs. Instead of writing a game or two for the Saturn, [jhl] got distracted for a few years and developed an optical drive emulator.

cracking-the-sega-saturn-thumbAccording to [jhl], the design of the Sega Saturn is tremendously complicated. There’s an entire chip dedicated to controlling the CD drive, and after some serious reverse engineering work, [jhl] had it pretty much figured out. The question then was how to load data onto the Saturn. For that. [jhl] turned to the internal expansion port on the Saturn. This internal expansion port was designed to accept an MPEG decoder card for playing video CDs on the Saturn, but the connector presents the entire bus. By attaching a Game Boy Flash cartridge, [jhl] was able to dump the ROM on the CD controller.

With a little bit of work, a fast ARM microcontroller, and a CPLD for all the logic glue, [jhl] was built an adapter to push CD data to the Saturn through this internal expansion port. Not only is this a boon for homebrew Saturn development, but this build also completely replaces the CD drive in the Saturn – a common failure point in this 20-year-old machine.

The formal release for this ultimate Saturn crack isn’t out yet, but it’s coming shortly, allowing anyone who still has a Saturn to enjoy all those very blocky games and develop their own games. You can check out a short, amateur documentary made on [jhl]’s efforts below.

41 thoughts on “Cracking The Sega Saturn After 20 Years

  1. Actually, the “crack” part of jhl’s work *has* been released – in the form of PseudoSaturn, which gets flashed onto an Action Replay cart and allows you to play backups. There’s efforts underway to move this to the internal slot, but it’ll be the same concept in that it will “only” unlock the drive.

    The ODE doesn’t count as a crack, imho, since it doesn’t circumvent the copy protection in the CD block, but replaces it altogether. In my book that makes it even more impressive.

    1. if my memory serves me right, the “copy protection” is actual a very simple encoded data that stored outsides of the normal region that a normal CDROM would read. It shouldn’t be too hard to fake that data when the controller request to read the special blocks.

          1. Be fair though, he qualified his post as a possibly incorrect memory. Documenting in a web searchable way even an incorrect recollection, with appropriate qualification, is better than letting that one possibly vital game changing lead slip away down the memory hole. Easy enough to rule the idea out as incorrect than to never have had access to it at all, and if it had been correct may have wasted many hours chasing down dead ends or even never come up with the solution. Also tacky to zap him after he came back and repudiated his own post after reviewing the linked content.

          2. To be fair, that was the theory for decades, and was supported by Sega’s patents. It wasn’t until a couple of years ago that it was shown to be wrong, and the old info is still found on tons of sites.

        1. Actually you weren’t totally off. The copy protection wobble is at a constant offset, so what the existing modchips do is monitor the commands to the optical pickup, and once a seek past a certain point occurs they start overriding the actual data with a prerecorded “wobbling sequence”. Thing is, there’s multiple drive variations, and finding the matching chip can be a piece of work, especially decades later…

    1. And the #1 reason Saturn remained expensive machine though its end while the competing Playstation could be made and sold cheaper over time. All those chips weren’t designed to work together and Sega couldn’t combine them into fewer, cheaper chips. It is also a major pain in the butt to code for, many developer often started for Playstation, then ported them to Saturn without taking advantage of advanced graphic capabilities.

      1. i remember that the early saturn games had better graphics than the early playstation games. but it seemed that later on developers of the saturn just gave up and just started under utilizing the hardware, while playstation devs got much better at utilizing its hardware.

        of course the saturn was the last console that i owned. i hawked it to go see metallica when i was 16. i do not regret that decision. went full in to pc gaming at that point. my voodoo card pewned the crap out of that saturn anyway. i saw one at a garage sale some years ago and i regret not grabbing it, if only to sell it on ebay.

      2. Sega did whatever it took to get the first presentation spot at E3 the year of Saturn’s debut. Their presentation was filled with all the technical goodness of Saturn, then finished off with the price.

        Sony wisely got the second spot to intro the Playstation then led off by simply stating a price $100 lower than Saturn. I suspect that was their strategy, no matter that price Sega pinned on Saturn, Playstation was to be $100 less.

        Sega should’ve told Sony, “Oh, please, you go first! We’ll overshadow your chump console with our technical sophistication.”.

        But Sega then went and fornicated the canine by NOT having a complete Saturn development ready *long before* the debut of the console, so there was an embarrassingly long wait for the game library to grow. Their next gaffe was not requiring games to use the full power of the console, so most game ended up using only half its resources.

        For their next console, Sega finally learned from all their errors with Saturn and other consoles. They had a full dev kit in play long before the intro of Dreamcast. They had games lined up. They weren’t getting surprised on price by the competition. All systems go for a successful launch and then… “Oh hai! Let us commit digital seppuku! WE QUIT! No more consoles for Sega after Dreamcast!”. “Of course Dreamcast is a success! We’ve *shipped” all these many thousands of units.” Nevermind they’re *sitting on store shelves* while Playstation 2’s and X-Boxen are actually *selling* – both because they told the gaming public they just didn’t care any more and because the PS2 and XBox could play DVD while Gamecube was Nintendo and Nintendo could’ve sold anything, even if it had dog poop baked into the case – because *Nintendo*. Seriously, Nintendo used to be the Apple of the game console world. Fans would buy *anything* they made, no matter how crappy.

        Sega, sunk by so many idiot decisions that are so easy to see in hindsight that it’s difficult to see how they could not *see* the failures as they made them.

      3. Sega (or rather their chip partners) did manage to combine chips in late models. The 68k and sound chip were combined, the SH1 and CD block ASIC were combined, and in the (AFAIK) final revision, the two SH2s were combined. The final board (VA15) is a very tidy design, but there were not a lot of them made.

        What would be interesting to know is if Sega were planning on this strategy from the start. Sony probably were – they were manufacturing the chips themselves, and would have had a clear roadmap from the outset.

    2. incredible^^^^^^retarded
      just like SEGA CD and X32, or Atari Jaguar.
      Hey, lets throw two or more CPUs on same bus and let software developers figure out how to extract any performance out of this mess ….

  2. Hey, that’s cTrix in that video. Met him at Evoke in Köln a few years ago, great guy.

    RE: the hack itself, that’s mighty impressive. Makes me wonder if any modern machines have similar exploits lurking undetected. The bit about emulator accuracy is interesting, since it turns out very few systems are actually emulated correctly enough for development. The NES is a particularly tragic example

        1. http://forums.nesdev.com/viewtopic.php?t=7902 That is just the CPU, but we have exact emulations of separate components. The mappers are nearly fully documented and implemented, too. Check out the Flash carts EverDrive and PowerPak. The firmwares support nearly every single mapper chip out there. I’m beginning to think that no level of emulation, including simulating all the individual atoms would be enough for you. XD

          As far as real-time exact emulation including the video signals (analog output), good luck with that, unless you happen to own a FPGA “co-processor” card. Oh, and even though it’s digital, you can make a FPGA output analog signals (with external DAC for example).

        2. Higan (formerly known as bsnes) is a down-the-the-metal emulator for SNES and others. It requires hilariously more system resources, but it can accurately play Star Fox, Star Ocean, and all the other games with wacky special chips. It’s a hell of a piece of work, even if it’s a bit quirky.

        3. You pretty much HAVE to emulate NES at the bare metal level. It’s not like other systems where you can just emulate the BIOS calls or something. There’s several emulators (Nintendulator for example) that emulate every register, tick for tick.

          That’s not even including a few fpga implementations that have been made heh. (One of which actually outputs composite video identical to how a real nes would.)

  3. Might be nice if it were possible to attach an IDE or SATA CD-ROM drive externally to replace the one in the machine when it dies if it’s not possible to just dump the CD images with a regular computer. That way, it’s easier for people to make use of their games that are still on CD.

  4. Congratulations on achieving this amazing break through, this is really going to open up the Saturn to the gaming community, especially in the area of independent games!

  5. I love these old_gadget_hacks, but having been a niche hanger on to Linux handhelds especially the Sharp Zaurus SL-5500 and Nokia N900 I have seen these communities built around amazing hardware slowly cool to ghost towns(not quite yet at maemo.org).
    There is just a melancholy feeling holding and even using a device every day where you know all of the cool apps have been developed, the neat accessories have been sold(except maybe something to print shows up on thingiverse) and while there might be a few bright moments where someone in the community writes a new app or adopts and upgrades something, in the end there will be the few die-hards and some come-n-go noobs on the forum while the hardware decays, the APIs the software rely upon are removed, and the gadget becomes obsolete.
    It is as if you had seen the best timeline, one where you could continue to get better and better versions of your favorite but business and consumers turned around and chose closed bootloader Windows and Android instead, hackable but not designed to be.
    Sometimes I forget how special it is that for most computers you can just install your flavor of Linux and even if you have to confront blob closed drivers you can still do almost everything vs consoles and phones.

  6. There already is Saturn hardware CD emulator https://gdemu.wordpress.com/installation/phoebe-installation/

    Same project for original Playstation http://ps-io.com/features/ https://www.youtube.com/watch?v=GbWW1VzeRgI . Started in ~2010
    Playstation also had a trapdoor Parallel I/O port exposing raw address/data bus, it was meant for network interface, debugging(PSY-Q) and stuff(ActionReplay/GameShark). Great thing about that port is you can hang your own ROM there and console will execute it while booting, no code signing/drm crap.

    Afair at the beginning PSIO patched original firmware replacing all CD routines with its own, but later in the project it was discovered a lot of games talked straight to the hardware ignoring SONY requirements for using BIOS routines. This is why current version comes with small board you need to solder inside to reroute chip select signals from the CD controller chip – PSIO emulates that chip completely. You still get data faster than CD due to no seek times. https://www.youtube.com/watch?v=Wc3rOb7Evxc

    Original work from 1999 http://web.archive.org/web/19990220052039/http://www.geociti

    Gamecube has IDE-EXI, same thing http://www.gc-forever.com/wiki/index.php?title=Ide-exi

    1. For those wondering what the difference is, Phoebe replaces the laser pickup assembly and leaves the controller alone, while jhl’s device goes one level deeper and replaces everything. I guess both are fine to fix a failing drive since in most cases it’s gonna be the mechanical parts or the laser.

    2. Pinchy/Crazynation made a working Saturn CD emulator in 2006, but I don’t know how far he got in terms of compatibility before abandoning it. His approach was the same as the Phoebe, replacing the actual CD drive.

  7. Is [jhl] the guy who refused to release the dump of the CD controller’s ROM as some sort of “fuck you” to those of us working on Saturn emulators? Because if so, fuck that guy.

    1. “I, myself, am not going to release these ROMs. This isn’t the first project where I’ve dumped a commercial object for some other purpose and been asked to share (see: shairport, for one), and after much thought I conclude – now, as then – that it’s not the right thing for me to do in any project. There are legal and professional risks which I’m just not comfortable taking. That’s not negotiable.”

      His quote from a forum. I tried posting the forum link but it had problems.

      1. What a crock of shit. He manufactures a CD-ROM replacement which 99% of the time is used for piracy, but releasing the ROM is just too much? Yeah, fuck that guy and is weak-ass justification.

  8. You had me at “By attaching a Game Boy Flash cartridge…”

    Using a Nintendo accessory to hack a Sega console takes this from lete hax into the realm of black magic.

  9. I remember working on an old HP’s BIOS to try to override its wireless card black list, and felt particularly proud of myself having contributed something meaningful to that thread, but this is light years ahead of what I did there. I would love to learn how to do something like this so that I could contribute to things like this again in the future. Dr. Abrasive is a god.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s