Search found 10 matches

Go to advanced search

by andreasnaive
Tue Dec 27, 2016 12:50 pm
Forum: Work In Progress (WIP)
Topic: SH4's FSRRA
Replies: 5
Views: 52028

Re: SH4's FSRRA

Sure. The FSRRA is far more precise, though. I still think this is the result of linear interpolation plus a single Newton step, but the coefficient in the Newton step must be modified so as to try to minimize the error. An unmodified Newton step wouldn't create errors with both signs as we see in t...
by andreasnaive
Wed Aug 03, 2016 9:34 pm
Forum: Work In Progress (WIP)
Topic: SH4's FSRRA
Replies: 5
Views: 52028

Re: SH4's FSRRA

I have done some tests today, and there are new significant conclusions. First, when trying to combine the two first subintervals to obtain a cubic approximant like I said in the end of the first post, things didn't matched well. The problem is that, when joining the two chunks like I said, a discon...
by andreasnaive
Wed Aug 03, 2016 1:38 am
Forum: Work In Progress (WIP)
Topic: SH4's FSRRA
Replies: 5
Views: 52028

SH4's FSRRA

About a year ago, MetalliC asked me to look at some dumps of the FSRRA (Floating Point Square Reciprocal Approximate) instruction used by the SH4A architecture. The emulation-related motivation for it being that the custom CPU used by the Dreamcast/Naomi systems implements some instructions from the...
by andreasnaive
Wed Jan 14, 2015 12:04 am
Forum: Work In Progress (WIP)
Topic: STV & Model3 encryptions
Replies: 5
Views: 59511

Re: STV & Model3 encryptions

Quick update: ANY solved the problems and dumped some data from a 315-5881 module from a Tecmo World Cup '98 board (STV) soldered on a Virtua NBA Naomi cart. The analysis of the data show that it first perfectly into the current implementation, being the key needed equal to 0x01200913. Besides, Guru...
by andreasnaive
Mon Jan 05, 2015 1:42 am
Forum: Work In Progress (WIP)
Topic: STV & Model3 encryptions
Replies: 5
Views: 59511

Re: STV & Model3 encryptions

Time for an update. After the last post, I spent several days developing some partial attacks and testing them on Astra Super Stars; most of that just consist on trying to get as big biases as possible involving a certain key bit by using the information on the topology of the network and on the lin...
by andreasnaive
Fri Dec 26, 2014 11:32 pm
Forum: Work In Progress (WIP)
Topic: STV & Model3 encryptions
Replies: 5
Views: 59511

Re: STV & Model3 encryptions

After seeing as the automatic extraction idea didn't really worked, I have switched to a per-game study of the sets. Thanks to Haze and CaH4e3, I now have some pairs both from STV sets (with the decrypted data coming from the Saturn sets) and from Model3 (for some chunks for which the plaintext is c...
by andreasnaive
Wed Dec 24, 2014 12:36 am
Forum: Work In Progress (WIP)
Topic: STV & Model3 encryptions
Replies: 5
Views: 59511

Re: STV & Model3 encryptions

In order to ease the study of the topology, I decided to take the time to create a full diagram of the second Feistel Network. It's clear from it that the implementation could be rewriten so that at most one key bit per sbox input be present. Beyond that, some relatively strong biases can be derived...
by andreasnaive
Sat Dec 20, 2014 11:37 am
Forum: Work In Progress (WIP)
Topic: STV & Model3 encryptions
Replies: 5
Views: 59511

Re: STV & Model3 encryptions

The first step in the scheduled plan is to study the linear characteristics of the S-Boxes. In some quick code I has limited the search against characteristics using at most a couple of input bits; of course, the fewer involved bits, the better, so not all of them are equally useful. If you take all...
by andreasnaive
Sat Dec 20, 2014 11:13 am
Forum: Work In Progress (WIP)
Topic: STV & Model3 encryptions
Replies: 5
Views: 59511

STV & Model3 encryptions

After ANY's confirmation that some Sega Titan Video encrypted games (decathlete and the like) and some Model3 ones were using the same protection chip ( 315-5881 ) as Naomi M2 boards, Haze tried to brute force into the thing by looking for a bunch of decrypted zeros on the full keyspace. CaH4e3 also...
by andreasnaive
Wed Dec 10, 2014 1:13 pm
Forum: Work In Progress (WIP)
Topic: CPS-2 & Naomi M2 sboxes
Replies: 0
Views: 46613

CPS-2 & Naomi M2 sboxes

Some time ago, after having reverse engineered Naomi-M2's crypto scheme, I ran a comparison between the s-boxes from CPS-2 and the ones from Naomi. You can see both sets here: https://github.com/mamedev/mame/blob/master/src/mame/machine/cps2crpt.c https://github.com/mamedev/mame/blob/master/src/mame...

Go to advanced search