Stupid question time

by **adidas** on Fri Sep 07, 2001 2:53 am

Forgive me for asking such a newbie question, but what exactly does an XOR table do?

The following (taken from CPS2Shock) is really all I know about the process:

<BLOCKQUOTE><font size="1" face="Verdana, Helvetica, sans-serif">quote:</font><HR>
Only the program ROM's contain the encrypted information, graphics, sound and sound samples are not encrypted.

In the encrypted ROM's only program code and data fetched using PC relative addressing is encrypted.

The Supervisor Stack Pointer and Program Counter vectors are encrypted, the rest of the 68000 vector table is not encrypted.

The memory address a encrypted value sits on plays a part in its decryption process.

The encryption works on word values, not bytes or long words.

The 68000 processor can execute normal non encrypted program opcodes if stored in the systems RAM or VRAM (not in ROM).

The encryption chip times out after 5 seconds unless it receives a code to keep it alive. This code changes from game to games.

Different language releases of the same CPS-2 game use a different encryption variable stored on the game board.

A new revision of a game uses the same encryption variable stored on the game board as its predecessor.
<HR></BLOCKQUOTE>

I've skimmed the full reports at CPS2shock, but they really don't give me any information that I can use beyond what is given in the summary.

by **Damian** on Fri Sep 07, 2001 4:20 am

Raz hasn't really fully divulged the "secrets" of this process, this was a decision he made a week or so after he first broke through. But I always assumed that the XORs allowed the program ROM data to bypass the encryption. That really is a complete guess I just pulled out of my head as no-one else answered [img]images/smiles/icon_biggrin.gif[/img].

by **Pdaimaoh** on Fri Sep 07, 2001 11:37 am

my guesses were that they return the values the decryption would've returned

or that it causes the code to believe the right data has been returned (dunno if it's actually getting demand values, or if it's just checking values)

by **Jewboy** on Fri Sep 07, 2001 7:07 pm

The XOR's are the answers to the question without having the formula to work it out.

by **RabidYak** on Fri Sep 07, 2001 11:08 pm

Like Pd said, its something to do with providing the unencryted values at each memory adress.

I think Raz pulls the XORs out of the boards by using his program to exploit an undocumented processor opcode or something to that effect.