Monday, 20 March 2017

A Journey Into Capcom's CPS2 Silicon - Part 1

capcom cps2

Capcom's Play System 2, also known as CPS2, was a new arcade platform introduced in 1993 and the company call on bootlegging. Featuring similar but improved specs to its predecesor CPS1, the system introduced a new security architecture that gave Capcom for the first time a piracy-free platform. A fact that remained true for its entire commercial lifespan and that later on it even prevented projects like Mame from gaining proper emulation of the system for years.

Whereas CPS1 philosophy on protection had to do mainly with providing a mechanism to control game pcb conversions, CPS2 instead brought back the focus to cpu code encryption just like its old ancestor Kabuki and Capcom's first go on security. Using a similar approach to Kabuki, CPS2 employs battery backed ram hidden away from user access, once this battery runs out the information needed to run the game is lost with it rendering the game unusable for life.


Enclosed in a plastic shell, CPS2 retains CPS1's characteristic 2-layer pcb assembly style consisting on a base board known as A board, and a game board known as B board. Some later games added additional boards featuring expanded memory and cross-game communication capabilities. The two most important differences of this new generation system are: 1) the A board no longer features the system main cpu, this is now moved to the top B board, and 2) the amount of custom chips has grown considerably as seen in the images below.

CPS2 A base board outside of its plastic shell

CPS2 B top board removed from its plastic shell

A later cost down revision of CPS2 shrank the pcb stack to just one pcb enclosed in a metal black case. Most roms also replaced by a single flash memory module, a technology introduced first in Capcom's CPS3 system in 1996.

"All-in-one" CPS2 cost down revision removed from its case


Encryption meets conservation

First attempts to take control of the platform started circa 1999 by the CPS-2 Shock team, with early emulation following soon in the year 2001 right at the end of its commercial lifecycle. The platform saw one last commemorative game title release from Capcom in December of 2003: Hyper Street Fighter II: The Anniversary Edition, so technically speaking emulation did happen during its commercial life.

A bug found in Capcom's security implementation allowed unencrypted memory dumping on the fly, this discovery enabled the CPS-2 Shock team to retrieve clear program code dumps that led to the production of non-encrypted game rom sets for emulation and dead board "phoenixing", a term used by the arcade community referring to game boards altered to run unencrypted game code.

Thanks to these efforts emulation became possible and countless CPS2 dead boards were converted to run unencrypted versions of games thus saved from hitting the bin.

Capcom's encryption mystery remained a secret for six more years until in 2007 a team composed by Charles McDonald, Andreas Naive and Nicola Salmoria (Mame founder) managed to crack the algorithm via custom hardware and mathematical analysis. Their work revealed CPS2 used two four-round feistel ciphers with a 64 bit key and at this point original code emulation became possible.

From there on the picture for CPS2 hardware owners remained pretty much the same: run out of battery and lose your original game forever, phoenixing your board was the only way out of the situation, but at least it was an option.


Capcom's Customfest

CPS2's use of customs was extensive featuring as many as 11 custom made QFP chips, all of them stamped with Capcom logos. For years the maker, exact nature and purpose of many of  these chips has also been a mystery, something especially true for the ones located on the top B board as many of the A board customs are just a continuation of the ones found in CPS1.

Capcom QFP 160 pin custom chip dated Week 47 1993 

The level of custom integration in CPS2 even touched its main cpu, previously featured in CPS1 as a single Motorola 68000 chip, the arrival of CPS2 saw the 68000 cpu fading away somewhere inside one of the new custom chips, nobody exactly knew which. Another interesting thing about the customs found on the top B board is the fact that they all receive battery power while the board is at rest, an obvious exercise to hide away its security implementation and possible targets.


The widow maker

Present in CPS2 systems since B board revision 5 (93646B-5), this little JST NH 6 pin type connector became over time an item of interest and research by the curious. Its purpose unknown but contained a nasty surprise for whoever was brave enough to mess with it: it killed your board.

CPS2 CN9 connector

This connector brought many questions without answer and one clear result: messing with CN9 suicided your board exactly as running out of battery would do. Why Capcom would include such feature? How was it related to the system encryption? Was it of any real use? or could it just be a distraction?

Over the next series of articles we will explore the inner workings of Capcom's CPS2 security implementation, these findings and discoveries are part of the efforts that led to successful reverse engineering of the system security programming methods late last year: Capcom CPS2 Security Programming Guide.

Stay tuned for more.

Tuesday, 13 September 2016

Capcom CPS2 Security Programming Guide

Dear all, after a few months of testing we are extremely happy to release the new clean desuicide / security programing method for Capcom's CPS2 hardware.



This guide is the result of almost two years of work by an small group of arcade enthusiasts to unravel the secrets of the security implementation found in one of the largest and most popular arcade platform systems. Thanks for this work it is now possible to fully preserve any CPS2 systems as original hardware.

Over the coming weeks additional details about the CPS2 hardware internals will be released providing unseen insights into how Capcom implemented security.

Thanks to everyone who has helped test and validate this release throughout the summer, special thanks to Bill DeLeo, Jeremy Walski, Leonard Oliveira and rtw.


Capcom CPS2 Security Programming Guide

This document will guide you through the basics of preparing your setup and testing the new clean desuicide method on any of the known CPS2 board revisions. You can find a pdf copy of this guide and code on the following link: https://github.com/ArcadeHacker/ArcadeHacker_CPS2



What's needed
Arduino programmer hardware












  • Power supply capable of 5 volts @ 1.5 amps or more, eg: arcade or ATX PC power supply.




  • Soldering iron and solder


CPS2 motherboard tools and supplies








Software






Assembling and preparing your Arduino programmer
  1. Solder the 7 pin strip to the top right most socket of the LCD Keypad Shield


  1. Assemble the Arduino Uno and LCD Keypad Shield together


  1. Download and install software for your OS from https://www.arduino.cc/en/Main/Software
  2. Connect your arduino to your PC via USB
  3. Open the ArcadeHacker_CPS2.ino file in the Arduino environment.
  4. Compile and Upload the sketch to the Arduino, next boot sequence should display what's shown below. If you can't see anything you may want to double check the screen contrast setting.




  1. Locate digital pins 2, 3, 11, 12 (top right) and GND (top left icsp connector) on your LCD Keypad Shield. Label them if possible.




  1. Connect the dupont cables to the pinout as shown above. Label them if possible.




Assembling the CPS2 target power cable
Attach two female dupont ends to the female molex power plug.





Identifying your CPS2 B board type
There are several revisions of PCB. These are the relevant ones:


93646B-3:
93646B-3-FRONT.jpg

93646B-4:
19xx_pcb_1.jpg


93646B-5:



93646B-6 and 93646B-7:
93646B-6-FRONT.jpg



97691A-3 and 97691A-4 (Black case, single board):



Pinout for board revisions 93646B-3 and 93646B-4
CN2 interface pins:


DATA Arduino #2 → CN2 A32
SETUP1 Arduino #3 → CN2 A30
CLOCK Arduino #11 → CN2 A31
SETUP2 Arduino #12 → CN2 A29


CN7 power pins:


+5V Power supply → CN7 A25
GND Power supply & Arduino GND → CN7 A23
GND Power supply & Arduino GND → CN7 B23



Pinout for board revisions 93646B-5
CN9 interface pins:


DATA Arduino #2 → CN9 #2
SETUP1 Arduino #3 → CN9 #3
CLOCK Arduino #11 → CN9 #4
SETUP2 Arduino #12 → CN9 #5


CN7 power pins:


+5V Power supply → CN7 A25
GND Power supply & Arduino GND → CN7 A23
GND Power supply & Arduino GND → CN7 B23



Pinout for board revision 93646B-6, 93646B-7 and 97691A-3
CN9 pins:

+5V ---------------- → CN9 #1
DATA Arduino # 2 → CN9 #2
SETUP1 Arduino # 3 → CN9 #3
CLOCK Arduino # 11 → CN9 #4
SETUP2 Arduino # 12 → CN9 #5
GND Arduino GND → CN9 #6




Preparing your CPS2 B board
  1. Open the CPS2 B Board plastic case using the Torx Security T20 screwdriver head (the photo below does not apply to revision 97961A-3 "all in one black")



  1. Identify your PCB revision and check the battery voltage




  1. If needed replace the battery with a fresh spare, fit a battery holder when possible





Desuiciding revisions 93646B-3 and 93646B-4
  1. Connect your hooking cables to the corresponding outputs of the arduino programmer (2, 3, 11, 12 & GND)




  1. Connect all pins to CN2 following the order described below.
                                                                                                                                                                
DATA Arduino # 2 → CN2 A32
SETUP1 Arduino # 3 → CN2 A30
CLOCK Arduino # 11 → CN2 A31
SETUP2 Arduino # 12 → CN2 A29


GROUND Arduino # GND → CN2 C32




  1. Connect power cables to CN7 A23 & B23 (GND) and A25 (+5)


cps2img.png


  1. Connect the molex connector to the power supply (power supply off!)



  1. Make sure the CPS2 A board and B board are disconnected from each other




  1. Turn on the power supply connected to your CPS2 B board, then power up your Arduino programmer (plug the USB cable to a USB power source, eg: your computer)




  1. Follow the on-screen instructions and program the game configuration you wish to upload. Use the up/down/right/left buttons to advance through the game options.
  2. Once programmed, disconnect power to the Arduino programmer followed by switching off the main power supply to your CPS2 B board
  3. Disconnect all arduino and power supply wires connected to the PCB
  4. Assemble the CPS2 A and B boards together and test for results. If unsuccessful take your time to review your setup before attempting a new keyload.


Desuiciding revisions 93646B-5, 93646B-6, 93646B-7, 97691A-3, 97691A-4
  1. Connect the ic clips to the corresponding outputs of the arduino programmer (2, 3, 11, 12 & GND)




  1. Connect all grabbers to CN9 following this order. You can also use a JST NH 6pin connector, pins are part number SHF-001T-0.8BS or SHF-002T-0.8BS depending on your wire gauge.


DATA Arduino # 2 → CN9 #2
SETUP1 Arduino # 3 → CN9 #3
CLOCK Arduino # 11 → CN9 #4
SETUP2 Arduino # 12 → CN9 #5
GND Arduino GND → CN9 #6


capcom.png


  1. [Revisions 93646B-6, 93646B-7, 97691A-3 only] Attach the power cable as shown below. GND connects to the existing arduino grabber.




  1. [Revision 93646B-5 only] Connect power cables to CN7 A23, B23 (GND) and A25 (+5)




  1. Connect the molex connector to the power supply (power supply off!)




  1. Make sure the CPS2 A board and B board are disconnected from each other





  1. Turn on the power supply connected to your CPS2 B board, then power up your Arduino programmer (plug the USB cable to a USB power source, eg: your computer)





  1. Follow the on-screen instructions and program the game configuration you wish to upload. Use the up/down/right/left buttons to advance through the game options.
  2. Once programmed, disconnect power to the Arduino programmer followed by switching off the main power supply
  3. Disconnect all arduino and power supply wires connected to the PCB
  4. Assemble the CPS2 A and B boards together and test for results. If unsuccessful take your time to review your setup before attempting a new keyload.


Hands-on video tutorial by Artemio

https://www.youtube.com/watch?v=ulIi9B74HMs