OPOS & April's EMMs Explained

[CG121]

As I can't post on this forum yet, I'll put this here....

ok, it would appear 2 EMMs are to blame for the corruption to the primary key.

Looking at both EMMs, we can clearly see 2 bytes from key0 are altered by each EMM. The thing is, each EMM changes 2 different bytes.

The first EMM alters byte 3 and 8 in the primary key.
The second EMM alters byte 1 and 7 in the primary key...

The primary key is the 8 bytes that follow the 42 05 command in the EMM..
The secondary (unaffected key) is the 8 bytes that follow the 42 85 command...

Also notice, bytes 1 and 7 are valid in the first EMM and bytes 3 and 8 are valid in the second EMM...

So basically, a keyroll now consists of 2 EMMs. Each EMM ensures it doesn't writeout the others bytes..

Meaning, all you need do is ensure $AD = 1E & $B2 = 40 after the first EMM executes and $AB = ED & $B1 = 60 after the second EMM executes...

It's the calcs that use the register ($02) which cause the emu to fail as it can't fully emulate it...
(and they know this)

Either patch the opos emu to modify the register (both $02 and the previously used $07) or patch the ROM code..

Njoy

You don't have permission to view the code content. Log in or register now.

 

[CG121]

Following another keyroll today, the opos ironically now has the correct primary key (key0) and an incorrect secondary key (key1) which is now in use...

Any solution that uses a patch on the EMM will require BOTH types patched.
Modifying the register at $02 however would handle both.

Does anyone have BOTH EMMs from today's C&W carousel??

 

[CG121]

Don't bother....

Here they are

You don't have permission to view the code content. Log in or register now.

 

[DodgyTech]

hey cg121, how comes u havent got a better status on this form yet mate?

anyhoo, im trying to do funcard logging to see how the keys have changed.

im using opos at the mo, and have got to catch up to all the emm stuff and atty/opos hex creations.

you got any guides for me for opos? there is already a tutorial thread for atmega. in fact tut's for anything will be much appreciated mate.