Cracking The Sega Saturn After 20 Years

When it was released 20 years ago, the Sega Saturn was by far the most powerful video game console available. It was a revolutionary device, had incredible (for the time) graphics, and a huge library of IP Sega could draw from. The Saturn was quickly overshadowed by the Sony Playstation, and soon these devices found themselves unused, unloved, and fetching high prices on the collectors market.

After finding a Sega Saturn on a trip to Japan, [jhl] decided he would like to write some code for this machine. Unlike earlier consoles, where Flash cartridges are readily available, or later consoles, where writing directly to the on-board storage is easy, bringing up a development environment for the Saturn isn’t easy. The best method is installing a mod chip and working off of burned CDs. Instead of writing a game or two for the Saturn, [jhl] got distracted for a few years and developed an optical drive emulator.

cracking-the-sega-saturn-thumbAccording to [jhl], the design of the Sega Saturn is tremendously complicated. There’s an entire chip dedicated to controlling the CD drive, and after some serious reverse engineering work, [jhl] had it pretty much figured out. The question then was how to load data onto the Saturn. For that. [jhl] turned to the internal expansion port on the Saturn. This internal expansion port was designed to accept an MPEG decoder card for playing video CDs on the Saturn, but the connector presents the entire bus. By attaching a Game Boy Flash cartridge, [jhl] was able to dump the ROM on the CD controller.

With a little bit of work, a fast ARM microcontroller, and a CPLD for all the logic glue, [jhl] was built an adapter to push CD data to the Saturn through this internal expansion port. Not only is this a boon for homebrew Saturn development, but this build also completely replaces the CD drive in the Saturn – a common failure point in this 20-year-old machine.

The formal release for this ultimate Saturn crack isn’t out yet, but it’s coming shortly, allowing anyone who still has a Saturn to enjoy all those very blocky games and develop their own games. You can check out a short, amateur documentary made on [jhl]’s efforts below.

48 thoughts on “Cracking The Sega Saturn After 20 Years

  1. Actually, the “crack” part of jhl’s work *has* been released – in the form of PseudoSaturn, which gets flashed onto an Action Replay cart and allows you to play backups. There’s efforts underway to move this to the internal slot, but it’ll be the same concept in that it will “only” unlock the drive.

    The ODE doesn’t count as a crack, imho, since it doesn’t circumvent the copy protection in the CD block, but replaces it altogether. In my book that makes it even more impressive.

    1. if my memory serves me right, the “copy protection” is actual a very simple encoded data that stored outsides of the normal region that a normal CDROM would read. It shouldn’t be too hard to fake that data when the controller request to read the special blocks.

          1. Be fair though, he qualified his post as a possibly incorrect memory. Documenting in a web searchable way even an incorrect recollection, with appropriate qualification, is better than letting that one possibly vital game changing lead slip away down the memory hole. Easy enough to rule the idea out as incorrect than to never have had access to it at all, and if it had been correct may have wasted many hours chasing down dead ends or even never come up with the solution. Also tacky to zap him after he came back and repudiated his own post after reviewing the linked content.

          2. To be fair, that was the theory for decades, and was supported by Sega’s patents. It wasn’t until a couple of years ago that it was shown to be wrong, and the old info is still found on tons of sites.

        1. Actually you weren’t totally off. The copy protection wobble is at a constant offset, so what the existing modchips do is monitor the commands to the optical pickup, and once a seek past a certain point occurs they start overriding the actual data with a prerecorded “wobbling sequence”. Thing is, there’s multiple drive variations, and finding the matching chip can be a piece of work, especially decades later…

    1. And the #1 reason Saturn remained expensive machine though its end while the competing Playstation could be made and sold cheaper over time. All those chips weren’t designed to work together and Sega couldn’t combine them into fewer, cheaper chips. It is also a major pain in the butt to code for, many developer often started for Playstation, then ported them to Saturn without taking advantage of advanced graphic capabilities.

      1. i remember that the early saturn games had better graphics than the early playstation games. but it seemed that later on developers of the saturn just gave up and just started under utilizing the hardware, while playstation devs got much better at utilizing its hardware.

        of course the saturn was the last console that i owned. i hawked it to go see metallica when i was 16. i do not regret that decision. went full in to pc gaming at that point. my voodoo card pewned the crap out of that saturn anyway. i saw one at a garage sale some years ago and i regret not grabbing it, if only to sell it on ebay.

      2. Sega did whatever it took to get the first presentation spot at E3 the year of Saturn’s debut. Their presentation was filled with all the technical goodness of Saturn, then finished off with the price.

        Sony wisely got the second spot to intro the Playstation then led off by simply stating a price $100 lower than Saturn. I suspect that was their strategy, no matter that price Sega pinned on Saturn, Playstation was to be $100 less.

        Sega should’ve told Sony, “Oh, please, you go first! We’ll overshadow your chump console with our technical sophistication.”.

        But Sega then went and fornicated the canine by NOT having a complete Saturn development ready *long before* the debut of the console, so there was an embarrassingly long wait for the game library to grow. Their next gaffe was not requiring games to use the full power of the console, so most game ended up using only half its resources.

        For their next console, Sega finally learned from all their errors with Saturn and other consoles. They had a full dev kit in play long before the intro of Dreamcast. They had games lined up. They weren’t getting surprised on price by the competition. All systems go for a successful launch and then… “Oh hai! Let us commit digital seppuku! WE QUIT! No more consoles for Sega after Dreamcast!”. “Of course Dreamcast is a success! We’ve *shipped” all these many thousands of units.” Nevermind they’re *sitting on store shelves* while Playstation 2’s and X-Boxen are actually *selling* – both because they told the gaming public they just didn’t care any more and because the PS2 and XBox could play DVD while Gamecube was Nintendo and Nintendo could’ve sold anything, even if it had dog poop baked into the case – because *Nintendo*. Seriously, Nintendo used to be the Apple of the game console world. Fans would buy *anything* they made, no matter how crappy.

        Sega, sunk by so many idiot decisions that are so easy to see in hindsight that it’s difficult to see how they could not *see* the failures as they made them.

        1. AIUI the second SH-2, the main CPU(s) was hammered into place at the last minute. Right about when the world realised the “3D fad” was going to be around for a bit longer. The Saturn had a fantastic sprite chip, since that’s what they thought would be needed. But then they caught a look at the PSX and shit themselves. Fortunately a stretched, warped sprite is sort of like a polygon, a square in fact. So the sprite engine could bodge polygon rendering.

          But still underpowered, so they squoze a second CPU in there, except it could only execute code in some tiny set of circumstances, out of it’s 4K cache. It could only access RAM and the rest of the system when the other CPU didn’t want it. So you ended up with a multiprocessor system that really wasn’t designed for it. All that extra money for not much difference.

          Maybe it would’ve been sensible to go back to the drawing board, once they’d realised their mistake. Even if that meant sticking a better, faster CPU in, though there wasn’t much choice available. Perhaps they could’ve done what Nintendo did, and sat that dance out, bringing out a 64-bitter with much more power a couple of years later. The Nintendo 64 did well enough, Sega’s reputation was equal to Nintendo’s, people would have bought a later, more powerful Saturn.

          Then the Dreamcast was just a bit too early. Much better technology came out a little while later, and Sony and Microsoft released their offerings using that. Though even Sega or Nintendo didn’t have the sheer size or money that Microsoft and Sony had. And actually, now, Playstation is by far the biggest part of Sony’s business, they did very well out of it. Microsoft have their money-printing machine so they could afford to fail all day if they’d wanted to, wouldn’t have stopped them.

          1. For Dreamcast, SEGA didn’t have the money on hand to buy DVD drive mechanisms, or even the funds for the per unit license fee for DVD tech. But a 750 megabyte CD wouldn’t hold enough data for the kind of games SEGA wanted to have on the console, and as Sony found out with the PS/2, CDs were easy to copy and play on the PS1 with a simple mod chip. So they invented the Gigabyte Disc ROM, GD-ROM, able to be read with modified CD-ROM mechanisms. That also made the discs impossible to read on anything but the GD-ROM drive in a Dreamcast or Dreamcast development system.

            But then the backdoor was discovered. SEGA had hedged their bet on GD-ROM and left the console able to read standard CD-ROM in addition to Redbook Audio CD, in case the GD-ROM project failed. Combined with hacks that enabled ripping GD-ROMs out the Dreamcast’s serial port (that SEGA had unwisely made standard RS232 instead of something proprietary), games could have their audio, video, and textures compressed and/or non-vital stuff left out to squeeze games onto CD-R, playable on unmodified Dreamcasts. 700+ megabytes wasn’t too terrible to download at the time with v.90 dialup or 256K DSL.

            SEGA plugged the hole by removing the CD-ROM reading code from the last batches of the console, but that was closing the door on the burning barn after the horses had run away.

            Now there are several ways to replace the GD-ROM drive in a Dreamcast with a USB 2.0 port or IDE hard drive connection. It’s possible to have the entire 700+ game library available all at once.

          2. 750MB at 5KB/s (kilobytes, and using 50 rather than 56 because overheads and line quality, similarly dividing by 10 instead of 8). I’m being rough with the data rate but on my 56K I’d generally get between 40 and 48, maybe 50k once or twice. Divide it all down and that’s 43 hours, roughly. At constant download speed. Assuming your connection is resumable (I dunno, did Napster support other file types than music? I can’t remember).

            It’s not likely! I remember the 10MB exploding whale avi taking a few hours to come down (at 28.8k cos that’s all that was invented), and being extremely happy when it actually came down. And I was paying either 60p or a pound for each hour online, just on the phone bill! Internet on top!

            Where the hell you’d get domestic 256K I dunno. I suppose maybe a few years later. Since the Dreamcast itself came with a 56K modem.

            Was the Dreamcast’s modem a “software” one? IE did all it’s DSP calculations on the main CPU? Or did it have a separate chip for all that? Software modems (actually “so-called” “”software”” “””””modems”””””) were a terrible idea foisted upon us by Intel. Their idea was, by modem manufacturers skipping a quid or whatever on not putting a cheap CPU into the modem, the PC’s processor could do it instead! And much more expensively! Requiring that the most expensive part of your PC do the job of a commodity chip that’d cost maybe a quid! More expensive for the user than doing it the proper way round, but in those cases the money was going to somebody other than Intel, so fuck that eh?

            This was, presumably, due to disappointment in Microsoft’s progress at making their software slower and slower. It just wasn’t getting slower fast enough! So stick it all on the CPU, why not, then the chumps will be forced to buy ever more expensive ones. Saving money by skipping those last few megahertz was no longer an option!

            AKA Microsoft’s money printing machine giving Intel’s a hand. Why, I dunno. They both had more-or-less monopolies that supported each other. Although back then there was at least Cyrix in second place to Intel, beside AMD. Even though Cyrix made ugly, horrible, creaky antique chips with old technology pushed faster and hotter.

            Anyway sorry about my mild digression into “software” “modems” there. Next week I’ll tell you about the plot to just wire the VGA port to half-a-dozen of the CPU’s address pins, and do the graphics card all in software.

      3. Sega (or rather their chip partners) did manage to combine chips in late models. The 68k and sound chip were combined, the SH1 and CD block ASIC were combined, and in the (AFAIK) final revision, the two SH2s were combined. The final board (VA15) is a very tidy design, but there were not a lot of them made.

        What would be interesting to know is if Sega were planning on this strategy from the start. Sony probably were – they were manufacturing the chips themselves, and would have had a clear roadmap from the outset.

    2. incredible^^^^^^retarded
      just like SEGA CD and X32, or Atari Jaguar.
      Hey, lets throw two or more CPUs on same bus and let software developers figure out how to extract any performance out of this mess ….

  2. Hey, that’s cTrix in that video. Met him at Evoke in Köln a few years ago, great guy.

    RE: the hack itself, that’s mighty impressive. Makes me wonder if any modern machines have similar exploits lurking undetected. The bit about emulator accuracy is interesting, since it turns out very few systems are actually emulated correctly enough for development. The NES is a particularly tragic example

        1. http://forums.nesdev.com/viewtopic.php?t=7902 That is just the CPU, but we have exact emulations of separate components. The mappers are nearly fully documented and implemented, too. Check out the Flash carts EverDrive and PowerPak. The firmwares support nearly every single mapper chip out there. I’m beginning to think that no level of emulation, including simulating all the individual atoms would be enough for you. XD

          As far as real-time exact emulation including the video signals (analog output), good luck with that, unless you happen to own a FPGA “co-processor” card. Oh, and even though it’s digital, you can make a FPGA output analog signals (with external DAC for example).

        2. Higan (formerly known as bsnes) is a down-the-the-metal emulator for SNES and others. It requires hilariously more system resources, but it can accurately play Star Fox, Star Ocean, and all the other games with wacky special chips. It’s a hell of a piece of work, even if it’s a bit quirky.

        3. You pretty much HAVE to emulate NES at the bare metal level. It’s not like other systems where you can just emulate the BIOS calls or something. There’s several emulators (Nintendulator for example) that emulate every register, tick for tick.

          That’s not even including a few fpga implementations that have been made heh. (One of which actually outputs composite video identical to how a real nes would.)

          1. Every console emulator I ever heard of emulates all the registers, and usually cycle for cycle. They wouldn’t work otherwise.

            I think your idea of “bare metal” is a bit less bare and metallic than the others here. They’re talking like gate level, or transistor. Registers and stuff are really software level, a programmer’s business. So are clock cycles, mostly.

          2. Then there was that Quick BASIC (not QBASIC) NES emulator. At the time it was written it was way below full speed on the PCs available. The author speculated that it’d probably take at least a 1Ghz PC to run it at full speed. Sure enough, when 1+ Ghz PCs came along, the Quick BASIC NES emulator was able to run games at full speed.

          3. I’ve read the source of a Quick Basic NES emulator, I imagine it’s the same one, can’t remember the name. It’s technically BASIC but it looks like C (or perhaps Pascal). Very much in the way the logic is laid out, and raw hardware of the PC is accessed. It’s not the sort of BASIC you’d learn from teach-yourself books (and I read LOTS of that type as a kid) or magazines. A bit of search / replace and you’d have C source code from the BASIC in not too long.

  3. Might be nice if it were possible to attach an IDE or SATA CD-ROM drive externally to replace the one in the machine when it dies if it’s not possible to just dump the CD images with a regular computer. That way, it’s easier for people to make use of their games that are still on CD.

  4. Congratulations on achieving this amazing break through, this is really going to open up the Saturn to the gaming community, especially in the area of independent games!

  5. I love these old_gadget_hacks, but having been a niche hanger on to Linux handhelds especially the Sharp Zaurus SL-5500 and Nokia N900 I have seen these communities built around amazing hardware slowly cool to ghost towns(not quite yet at maemo.org).
    There is just a melancholy feeling holding and even using a device every day where you know all of the cool apps have been developed, the neat accessories have been sold(except maybe something to print shows up on thingiverse) and while there might be a few bright moments where someone in the community writes a new app or adopts and upgrades something, in the end there will be the few die-hards and some come-n-go noobs on the forum while the hardware decays, the APIs the software rely upon are removed, and the gadget becomes obsolete.
    It is as if you had seen the best timeline, one where you could continue to get better and better versions of your favorite but business and consumers turned around and chose closed bootloader Windows and Android instead, hackable but not designed to be.
    Sometimes I forget how special it is that for most computers you can just install your flavor of Linux and even if you have to confront blob closed drivers you can still do almost everything vs consoles and phones.

  6. There already is Saturn hardware CD emulator https://gdemu.wordpress.com/installation/phoebe-installation/

    Same project for original Playstation http://ps-io.com/features/ https://www.youtube.com/watch?v=GbWW1VzeRgI . Started in ~2010
    Playstation also had a trapdoor Parallel I/O port exposing raw address/data bus, it was meant for network interface, debugging(PSY-Q) and stuff(ActionReplay/GameShark). Great thing about that port is you can hang your own ROM there and console will execute it while booting, no code signing/drm crap.

    Afair at the beginning PSIO patched original firmware replacing all CD routines with its own, but later in the project it was discovered a lot of games talked straight to the hardware ignoring SONY requirements for using BIOS routines. This is why current version comes with small board you need to solder inside to reroute chip select signals from the CD controller chip – PSIO emulates that chip completely. You still get data faster than CD due to no seek times. https://www.youtube.com/watch?v=Wc3rOb7Evxc

    Original work from 1999 http://web.archive.org/web/19990220052039/http://www.geociti

    Gamecube has IDE-EXI, same thing http://www.gc-forever.com/wiki/index.php?title=Ide-exi

    1. For those wondering what the difference is, Phoebe replaces the laser pickup assembly and leaves the controller alone, while jhl’s device goes one level deeper and replaces everything. I guess both are fine to fix a failing drive since in most cases it’s gonna be the mechanical parts or the laser.

    2. Pinchy/Crazynation made a working Saturn CD emulator in 2006, but I don’t know how far he got in terms of compatibility before abandoning it. His approach was the same as the Phoebe, replacing the actual CD drive.

  7. Is [jhl] the guy who refused to release the dump of the CD controller’s ROM as some sort of “fuck you” to those of us working on Saturn emulators? Because if so, fuck that guy.

    1. “I, myself, am not going to release these ROMs. This isn’t the first project where I’ve dumped a commercial object for some other purpose and been asked to share (see: shairport, for one), and after much thought I conclude – now, as then – that it’s not the right thing for me to do in any project. There are legal and professional risks which I’m just not comfortable taking. That’s not negotiable.”

      His quote from a forum. I tried posting the forum link but it had problems.

      1. What a crock of shit. He manufactures a CD-ROM replacement which 99% of the time is used for piracy, but releasing the ROM is just too much? Yeah, fuck that guy and is weak-ass justification.

  8. You had me at “By attaching a Game Boy Flash cartridge…”

    Using a Nintendo accessory to hack a Sega console takes this from lete hax into the realm of black magic.

  9. I remember working on an old HP’s BIOS to try to override its wireless card black list, and felt particularly proud of myself having contributed something meaningful to that thread, but this is light years ahead of what I did there. I would love to learn how to do something like this so that I could contribute to things like this again in the future. Dr. Abrasive is a god.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.