The Guru is proudly supported by....
Send Comments

SEGA 317-xxxx Security Parts List and FD10xx cracking ;-)


A Sega FD1094 encrypted 68000 module

A Sega FD1149

A System 16 PCB with Hitachi FD1094'. Click the pic for a better view
Here's how the cracking works in very simple terms....

The basic method involves using a Sega System 24 PCB to extract data from the FD1094.
The System 24 board is used because it has 2 CPU's whereby the standard 68000 can be used to communicate with the FD1094. The FD1094 has a pinout that is compatible with a standard 68000, so any FD1094 can be plugged into the System 24 board, including those that run on System16/18/24 and X/Y Board hardware. Breaking the FD1094 encryption involves running small pieces of hand-written code on the FD1094 and the results collected from shared RAM by a custom program running on System 24's normal 68000 and sent to the PC via a small custom USB adapter board. The amount of data collected is exactly 128 Megabytes. The method, software and adapter board is the brainchild of Charles MacDonald.

Another custom program by Dr. Nicola Salmoria analyses the downloaded 128M of tables and data then creates a key file which is used to decrypt the data. The battery-backed RAM inside the FD1094 is 8K. The key file is also 8K. There is a great degree of confidence that the derived key file is exactly the same as what is inside the 8K battery-backed RAM. It's not possible to directly read it to verify that conclusion, but the resulting decryption of the encrypted code is probably proof enough that it's correct.

Due to the state-changing nature of the FD1094, it was initially thought that it would not be possible to decrypt the code then just plug in EPROMs containing unencrypted code into the PCB. However, with decrypted code and modifications to make it work,
this is exactly what has happened. If you search with google you can find large archives of Sega decrypted ROMs for almost all of the System 16/18/24/32 games.

Now that the FD1094 encryption is broken, we need access to all the FD1094's (and other security CPU's) to dump out relevant info to assist with decrypting each game. For the moment we only need the FD1094's. Hopefully the other security parts will be looked at in due course :-)
Some of this info is a bit sketchy and sparsely documented so if you can help with missing info or corrections, let me know. We need all the FD1094's to complete the decryption of all FD1094-encrypted games. If you can help out by buying/loaning some of them to us, speak up!
Update: This list is mostly complete now. The number of undumped FD1094's still alive is probably zero so basically what is done is what you get.

This page deals with only Sega part numbers 317-xxxx. Note anything listed extra (i.e not FD1094's) are listed for reference.
Also note that some of these numbers may be incorrect, or missing or actually not FD1094s (might be 8751's/Z80's or other protection chips instead)
We'll know more once the wanted list gets shorter :-)

Additionally, Dave Widel has dumped some tables from a NEC MC-8123B and Nicola has made progress decrypting the first one. So we will require all NEC MC-8123B's also as well as the 1 remaining custom Z80 (to be sent to Dave Widel)
Update: Nicola has cracked all of the custom Z80's and MC-8123 CPUs so we don't need them now.
Who?
A = Aaron
C = Charles
G = Guru
J = Junoman
T = Thierry
E = Gerald
D = DWidel
X = Team Japump
Wanted
Got It!
Dumped!
Undumpable (for now?) :(

Note: The '# of Dumps' column refers to the number of good matching dumps taken from _different_ CPU's with the same Sega part number. Due to the volatile nature of the info held in these CPU's, it's important that we dump them from at least 2 different CPU's for verification.

Who? Game Name Part Number Type # Of Dumps
?317-0001?
?317-0002?
?317-0003?
Calorie Kun317-0004Custom Z80Cracked
Space Position317-0005Custom Z80Cracked
Gardia317-0006Custom Z80Cracked
Gardia317-0007Custom Z80Cracked
?317-0008?
?317-0009?
Quartet 1 and 2317-00108751
Dump Matsumoto317-0011A8751
?317-0012?
CEJ Enduro Racer317-0013AFD1089B1
DakkoChan Jansoh317-0014MC-8123BCracked
Body Slam317-00158751
Fantasy Zone317-0016FD1089?
?317-0017?
T Action Fighter317-0018FD1089A1
?317-0019?
?317-0020?
Alex Kidd317-0021FD1089A
CJ Dunk Shot317-0022FD1089A1
?317-0023FD1089A
T Time Scanner317-0024FD1089B
?317-0025?
?317-0026?
SDI317-0027FD1089B
C SDI317-0028FD1089A
Block Gal317-0029MC-8123BCracked
Perfect Billiards317-0030MC-8123BCracked
?317-0031?
?317-0032?
C Alien Syndrome317-0033FD1089A1
TC Super Hang On317-0034FD1089B1
?317-0035?
?317-0036?
J Alien Syndrome317-0037FD1089B
X Super Hang-On (Japan)317-0038FD1094
Super Hang-On317-0039FD1089?
Bullet ?317-0040FD1094
Bullet317-0041FD1094
Opa Opa317-0042MC-8123BCracked
Wonder Boy Monster Land317-0043MC-8123BCracked
Super Hang On317-0044FD1089?
Super League317-0045FD1094
Heavyweight Champ317-0046FD1094
Heavyweight Champ ?317-0047FD1094
Wonderboy 2317-0048FD1094
CJ Shinobi (System 16B)317-0049FD10941 (C-bad)
CTJ Shinobi (System 16A)317-0050FD10941 (J-bad)
Sonic Boom ?317-0051FD1094 ?
Sonic Boom ?317-0052FD1094 ?
CE Sonic Boom317-0053FD10942
D Shinobi (System 16A)317-0054MC-8123BCracked
Thunder Blade ?317-0055FD1094 ?
CEJ Thunder Blade317-0056FD10942
Fantasy Zone 2317-0057MC-8123BCracked
?317-0058-01FD1094
J Scramble Spirits317-0058-02CFD10941
G Gain Ground317-0058-03DFD10941
X Crack Down (Japan)317-0058-04BFD10941
Crack Down (World)317-0058-04CFD10941
J Crack Down317-0058-04DFD10941
X Super Masters Golf317-0058-05BFD10941
J Super Masters Golf317-0058-05CFD10941
J Super Masters Golf317-0058-05DFD10941
GX Rough Racer317-0058-06BFD10942
?317-0058-07FD1094
GE Quiz Syukudai317-0058-08BFD10941
J Dynamic Country Club317-0058-09DFD10941
Ace Attacker (16B)317-0059FD1094
Ace Attacker (Japan, 16A)317-0060FD10941
Ace Attacker317-0061FD1094
?317-0062?
?317-0063?
Ufo Senshi Yohko Chan317-0064MC-8123BCracked
Altered Beast317-0065FD1094
D Altered Beast317-0066MC-8123B1
Altered Beast ?317-0067FD1094
J Altered Beast (Japan)317-0068FD10941
E Altered Beast317-0069FD1094
X Passing Shot (4P, Japan)317-0070FD10941
Passing Shot (S16A 4P, Japan)317-0071FD10941
Passing Shot (4P, Export) ?317-0072FD1094
?317-0073?
E Passing Shot317-0074FD10941
?317-0075?
Altered Beast317-00768751
Altered Beast317-00778751
Altered Beast317-00788751
Excite League317-0079FD1094
E Passing Shot (2P, Export?)317-0080FD10941
?317-0081?
?317-0082?
Last Survivor (Japan)317-0083FD1094
CT W/Boy3 Monster Lair (Japan)317-0084FD10942
C W/Boy3 Monster Lair (Japan)317-0085FD10941
W/Boy3 Monster Lair ?317-0086FD1094 ?
X W/Boy3 Monster Lair (Japan)317-0087FD10941
W/Boy3 Monster Lair (US) ?317-0088FD1094 ?
CE W/Boy3 Monster Lair (Export)317-0089FD10942
E Wrestle War (Japan)317-0090FD10941
CJ Tetris (Japan, S16B)317-0091FD10942
CET Tetris (Japan, S16B)317-0092FD10942
CE Tetris (Japan, S16A)317-0093FD10941
T Tetris (Japan, S16A)317-0093AFD10941
Dynamite Dux (Japan) ?317-0094FD1094 ?
Dynamite Dux (US) ? 317-00958751
C Dynamite Dux (Export?)317-0096FD10941
?317-0097?
W/Boy3 Monster Lair317-00988751
Tough Turf317-00998751
Tough Turf317-01008751
Wrestle War (US) ?317-0101FD1094 ?
J Wrestle War (Export)317-0102FD10941
Wrestle War317-01038751
Tough Turf317-01048751
Turbo Out Run ?317-0105FD1094
Turbo Out Run317-0106FD1094
Turbo Out Run317-0107FD1094
?317-0108?
Turbo Outrun (Original White Cockpit)317-0109FD1094
TEJ Golden Axe (Export)317-0110FD10942
?317-0111?
Golden Axe317-01128751
?317-0113?
Bay Route ?317-0114FD1094 ?
J Bay Route (Japan)317-0115FD10941
TE Bay Route (Export)317-0116FD10941
Turbo Out Run ?317-0117FD1094 ?
C Turbo Out Run (upgrade)317-0118FD10941
Turbo Out Run ?317-0119FD1094 ?
C Golden Axe (Export)317-0120FD10942
Golden Axe (Japan)317-0121FD10941
CJ Golden Axe (US)317-0122FD10941
Golden Axe317-0123A8751
C Super Monaco GP (Japan)317-0124AFD10941
CE Super Monaco GP (US)317-0125AFD10942
E Super Monaco GP (Export)317-0126FD10941
E Super Monaco GP (Export)317-0126AFD10942
CJ Flash Point (Japan)317-0127AFD10942
E E-Swat (Japan)317-0128FD10941
CTEJE-Swat (US)317-0129FD10942
CE E-Swat (Export)317-0130FD10942
?317-0131?
?317-0132?
?317-0133?
C Line of Fire (Japan)317-0134FD10941
Line of Fire (US)317-0135FD1094
E Line of Fire (Export)317-0136FD10941
?317-0137?
?317-0138?
TJ Bloxeed (Japan)317-0139FD10941
Bloxeed317-0140EPM5032
?317-0141?
MVP (Japan)317-0142FD10941
CEJ MVP (US)317-0143FD10941
E Racing Hero (Export)317-0144FD10941
Racing Hero (US) 317-0145FD1094
C Alien Storm (2P, Japan)317-0146FD10941
E Alien Storm (3P, US)317-0147FD10941
T Alien Storm (3P, Export)317-0148FD10941
Columns317-0149.27EPM5032
?317-0150?
?317-0151?
?317-0152?
T Pontoon317-0153FD1094
Alien Storm (2 player, Export)317-0154FD1094
?317-0155?
Bonanza Bros317-0156EPM5032
JE Moon Walker (Japan)317-0157FD10942
CT Moon Walker (US)317-0158FD10941
JE Moon Walker (Export)317-0159FD10941
Columns II317-0160EPM5032
GP Rider (Japan)317-0161FD1094
C GP Rider (US)317-0162FD10941
C GP Rider (Export)317-0163FD10941
Laser Ghost (Japan) ?317-0164FD1094
C Laser Ghost (US)317-0165FD10941
C Laser Ghost (Export)317-0166FD10941
Aurail (Japan)317-0167FD1089A
Aurail317-0168FD1089B
E AB Cop (Export & Japan)317-0169BFD10941
AB Cop ?317-0170FD1094
AB Cop ?317-0171FD1094
Thunder Force AC317-0172EPM5032
Borench317-0173?
?317-0174?
C Clutch Hitter (Japan)317-0175FD10941
CTJ Clutch Hitter (US)317-0176FD10942
Dynamic Country Club (ROM version)317-0177EPM5032
Ribbit317-0178EPM5032
T Cotton (Japan)317-0179AFD10941
T Cotton (US) 317-0180FD10941
JE Cotton (Export)317-0181AFD10941
X D.D. Crew (2P, Japan)317-0182FD10941
D.D. Crew (2P, US)317-0183FD1094
T D.D. Crew (2P, Export)317-0184FD10941
D.D. Crew (4P, Japan)317-0185FD1094
CTJ D.D. Crew (4P, US)317-0186FD10942
D.D. Crew (4P, Export)317-0187FD1094
D.D. Crew (3P, Japan)317-0188FD1094
D.D. Crew (3P, US)317-0189FD1094
D.D. Crew (3P, Export)317-0190FD1094
Quiz Rouka Ni Tattenasai317-0191EPM5032
?317-0192?
Twin Squash317-0193EPM5032
Desert Breaker (Japan)317-0194FD1094
Desert Breaker (US) ?317-0195FD1094
E Desert Breaker (Export)317-0196FD10941
T Where's Wally (Japan)317-0197AFD10941
X Where's Wally (Japan)317-0197BFD10941
?317-0198?
?317-0199?
Tokoro San no MahMahjan317-0200EPM5032
?317-0201?
?317-0202?
Puyo Puyo317-0203.27EPM5032
Dark Edge317-0204FD1149
Quiz Mekuromeku Story317-0205EPM5032
?317-0206?
?317-0207?
?317-0208?
?317-0209?
F1 Super Lap317-0210FD1149
Tanto-R317-0211EPM5032
Burning Rival317-0212FD1149
Segasonic The Hedgehog317-0213FD1149
?317-0214?
Dragon Ball Z317-0215FD1149
?317-0216?
Dragon Ball Z317-0217FD1149
Poto Poto (System C2)317-0218EPM5032
Stack Columns317-0219.27EPM5032
Tokoro San no MahMahjan 2317-0220EPM5032
?317-0221?
J League317-0222FD1149
Stack Columns (World)317-0223EPM5032
C Ichidant-R317-0224EPM50321
?317-0225?
Quiz Ghost Hunter317-0226EPM5032
?317-0227?
CA Puyo Puyo II317-0228EPM50322
Dead Or Alive (Model 2 protection PCB)317-0229
Dynamite Cop (Model 2 protection PCB)317-0236-COM
  Dirt Devils (Model 3) 317-0238-COM    
  Daytona USA 2 317-0239-COM    
  STW (Star Wars Trilogy?) 317-0241-COM    
LA Machine Guns (Model 3)317-0242-COM
Ocean Hunter (Model 3)317-0244-COM
  Virtua Striker 2 '99 (Model 3) 317-0245-COM    
Dynamite Baseball Naomi (NAOMI ROM)317-0246-JPN
Zombie Revenge (NAOMI ROM)317-0249-COM
  APC? (Airline Pilots?) 317-0251-COM    
Giant Gram Zen-nihon Pro Wrestle 2 (NAOMI ROM)317-0253-JPN
Ferrari F355 DX (NAOMI ROM) 317-0254-COM
Toy Fighter (NAOMI ROM) 317-0257-COM
Virtua Striker 2 Ver. 2000 (NAOMI ROM) 317-0258-COM
  Super Major League '99 317-0259-COM    
Derby Owners Club (NAOMI ROM)317-0262-JPN
 Virtua Tennis 2?317-0263-COM  
 Jambo Safari?317-0264-COM  
 Emergency Call Ambulance (Model 3)317-0265-COM  
Out Trigger (NAOMI ROM)317-0266-COM
Ferrari F355 DX (on multi-motherboard)317-0267-COM
Dynamite Baseball '99 (NAOMI ROM)317-0269-JPN
Samba de Amigo (NAOMI ROM)317-0270-COM
  Virtua NBA 2000 (NAOMI ROM) 317-0271-COM    
  PFSB PTR? 317-0273-COM    
Star Wars Racer Arcade (Hikaru)317-0277-COM
  PFSB MRF? 317-0281-COM    
  Nascar Racing (Hikaru) 317-0283-COM    
  PFSB WR1? 317-0285-COM    
Slash Out (NAOMI ROM)317-0286-COM
Cosmic Smash (NAOMI ROM)317-0289-COM
Alien Front Online?317-0293-COM
Air Trix (Hikaru)317-0294-COM
Samba de Amigo Ver. 2000 (NAOMI ROM)317-0295-COM
Giant Gram 2000 (NAOMI ROM)317-0296-COMActel A54SX32
Planet Harriers (Hikaru)317-0297-COM
Confidential Mission317-0298-COM
Sports Jam (NAOMI GDROM)317-0300-COM>PIC16C621A
  Wild Riders (ROM cart) 317-0301-COM    
Slash Out (NAOMI GDROM)317-0302-COMPIC16C621A
Spikers Battle (NAOMI GDROM)317-0303-COMPIC16C621A
Virtua Striker 3 (NAOMI GDROM)317-0304-COMPIC16C621A
  Wave Runners GP? 317-0306-COM    
Monkey Ball (NAOMI GDROM) 317-0307-COMPIC16C621A
Virtua Golf / Dynamic Golf (NAOMI GDROM) 317-0308-COMPIC16C621A
Super Major League (NAOMI GDROM) 317-0309-COMPIC16C621A
Virtua Tennis / Power Smash (NAOMI GDROM)317-0312-COMPIC16C621A
Club Kart European Session 317-0313-COM
Virtua Fighter 4 (NAOMI GDROM) 317-0317-COMPIC16C621A
Virtua Tennis 2 / Power Smash 2 (NAOMI GDROM)317-0318-COMPIC16C621A
  Virtua Tennis 2 (NAOMI ROM) 317-0320-COM Actel A54SX32  
Shakka to Tambourine 2001 Power Up! (NAOMI GDROM)317-0321-COMPIC16C621A
  Virtua Fighter 4 317-0324-COM    
Virtua Athletics (NAOMI GDROM)317-0330-COMPIC16C621A
Initial D Arcade Stage (NAOMI GDROM)317-0331-JPNPIC16C621A
Lupin : The Typing (NAOMI GDROM)317-0332-JPNPIC16C621A
The Maze Of Kings (NAOMI GDROM)317-0333-COMPIC16C621A
Virtua Fighter 4 Evolution (NAOMI 2 GDROM)317-0334-COMPIC16C621A
Virtua Striker 2002 (Triforce GDROM)317-0337-JPNPIC16C621A
Virtua Fighter 4 Evolution (NAOMI GDROM)317-0338-JPNPIC16C621A
Initial D Arcade Stage (Export) (NAOMI GDROM)317-0343-COMPIC16C621A
Initial D Arcade Stage Ver. 2 (Japan) (NAOMI GDROM)317-0345-JPNPIC16C621A
Initial D Arcade Stage Ver. 2 (Export) (NAOMI GDROM)317-0357-COMPIC16C621A
Gekitou Pro Yakyuu (Triforce GDROM)317-0371-JPNPIC16C621A
Puyo Puyo Fever (NAOMI GDROM)317-0375-COMPIC16C621A
Virtua Fighter 4 Final Tuned (NAOMI GDROM)317-0387-COMPIC16C621A
Ninja Kid II317-5???MC-8123?Cracked
Gigas317-5002MC-8123
Ganbare ChinsanOoshoubu317-5012MC-8123ACracked
XSukeban Jansi Ryuko317-5021FD1089B1
TRyu Kyu317-5023FD10941
Zero Gunner (Model 2B)317-5038-COM
  Tecmo World Cup '98 (STV) 317-5039-COM    
Astra Superstars (STV)317-5040-COM
New Japan Pro Wrestling Toukon Retsuden 4 (NAOMI ROM)317-5040-COM
World Kicks (NAOMI ROM)317-5040-COM
  Radient Silvergun (STV) 317-5041-COM    
Steep Slope Sliders (STV)317-5042-COM
  Elandoree (STV) 317-5043-COM    
Pilot Kids (Model 2 protection PCB)317-5044-COM
Daytona 2 USA Power Edition (Model 3 protection PCB)317-5045-COM
Power Stone (NAOMI ROM)317-5046-COM
Idol Janshi Suchie-Pai 3 (NAOMI ROM)317-5047-JPN
Dead Or Alive 2 (NAOMI ROM)317-5048-COM
  Final Fight Revenge (STV) 317-5049-COM    
Shangri-La (NAOMI ROM)317-5050-COM
Spawn (NAOMI ROM)317-5051-COM
Power Stone 2 (NAOMI ROM)317-5054-COM
Capcom vs SNK : Millenium Fight 2000 (NAOMI ROM)317-5059-COM
Gunspike (NAOMI ROM)317-5060-COM
Guilty Gear X (NAOMI ROM)317-5063-COM
Giga Wing 2 (NAOMI ROM)317-5064-COM
Moero! Justice Gakuen (NAOMI ROM)317-5065-COM
Death Crimson OX (NAOMI ROM)317-5066-COM
Mobile Suit Gundam : Federation VS Zeon (NAOMI GDROM)317-5069-COMPIC16C621A
Heavy Metal Geo Matrix (NAOMI ROM)317-5071-COM
Street Fighter Zero 3 Upper (NAOMI GDROM)317-5072-COMPIC16C621A
Capcom VS SNK Millenium Fight 2000 Pro (NAOMI GDROM)317-5076-JPNPIC16C621A
Capcom VS. SNK 2 Millionaire Fighting 2001 (NAOMI GDROM)317-5078-COMPIC16C621A
Mobile Suit Gundam : Federation VS Zeon DX (NAOMI GDROM)317-5079-COMPIC16C621A
Ikaruga (NAOMI GDROM)317-5081-JPNPIC16C621A
Guilty Gear XX (NAOMI GDROM)317-5082-COMPIC16C621A
Musapie no Choco Marker (NAOMI GDROM)317-5085-JPNPIC16C621A
Quiz Keitai Q-mode (NAOMI GDROM)317-5090-JPNPIC16C621A
Azumanga Daioh Puzzle Bobble (NAOMI GDROM)317-5091-JPNPIC16C621A
Guilty Gear XX #Reload (NAOMI GDROM)317-5092-JPNPIC16C621A
Tetris Kiwamemichi (NAOMI GDROM)317-5093-JPNPIC16C621A
Shikigami no Shiro II (NAOMI GDROM)317-5095-JPNPIC16C621A
Usagi Yasei no Topai - Yamashiro Mahjongg Compilation (NAOMI GDROM)317-5096-JPNPIC16C621A
Border Down (NAOMI GDROM)317-5097-JPNPIC16C621A
Psyvariar 2 - The Will To Fabricate (NAOMI GDROM)317-5100-JPNPIC16C621A
Chaos Field (NAOMI GDROM)317-5102-COMPIC16C621A
Trizeal (NAOMI GDROM)317-5103-JPNPIC16C621A
Melty Blood Act Cadenza (NAOMI GDROM)317-5104-JPNPIC16C621A
Senko no Ronde (NAOMI GDROM)317-5107-COMPIC16C621A
Senko no Ronde New (NAOMI GDROM)317-5107-JPNPIC16C621A
Super Shanghai 2005 (NAOMI GDROM)317-5108-JPNPIC16C621A
Radilgy (NAOMI GDROM)317-5110-JPNPIC16C621A
Guilty Gear XX Slash (NAOMI GDROM)317-5111-JPNPIC16C621A
Under Defeat (NAOMI GDROM)317-5117-JPNPIC16C621A
Trigger Heart Exelica (NAOMI GDROM)317-5121-JPNPIC16C621A
Jingy Storm (NAOMI GDROM)317-5122-JPNPIC16C621A
         
         
         

Updates will follow as I find out more......

If you want to see more games here, please consider donating.

The Guru's ROM Dump News