Reprograming Kabuki
Last week's journey under the microscope gave us a better understanding of all the Kabuki internals. In this week's final post we will learn all of its reprograming secrets.
Kabuki is no longer a secret, thank you for watching and I hope you enjoyed this journey as much as I did. See you again in 2015!
Nice work!
ReplyDeleteWell done, I was impressed with your decapping and deprocessing of the die, I know how hard this is to do. Given that this is a fairly clever keyloading method, I wonder if Capcom reused it, or something similar for the CPS2 encrypted cpu. I know that the decryption is radically different (took quite a while to break by very clever mame contributors), however since no one has worked out how the key loading works, I wonder if it is worth another look at the die shots of the cps2 encrypted 68k... Cheers, Pete
ReplyDeleteOn another subject, can you make available your "Kabuki-reprogramming" pdf, since this would be a great reference text for other reverse engineers.
ReplyDeleteCheers, Pete
Niiiiice.
ReplyDeleteI also do think there is a logical explanation why the secret key is what it is. It might be useful to add a link to the decapped die image as it might help finding the origin of the secret key, I think...
For me it seems trivial that the 20 bits are 4 x 5 bits which cover the japanese characters in JIS/Shift JIS (with 0xA0 offset). It then gives out ｶｾｲ･ (KA SE I [comma]). The problem is kasei can mean anything. The word itself has at least ten meanings (I'd choose metamorphosis), and a quick search brings for example a company which makes everything (Asahi Kasei), a period (see kasei kabuki), a university and so on. It can even be a twisted "engrish" acronym for KAbuki SEcret Initialization.
ReplyDeleteTake your pick.
Wow your posts are amazing! You've mentioned that you're not a hw engineer. How did you learn about identifying components on the decap image and things like this?
ReplyDeleteHi Norbert, thanks for watching. There's several blogs/sites that discuss RE, some of them have great amounts of information. eg: http://siliconpr0n.org/
DeleteIs it possible to have these last two parts in a text format similar to the first 3?
ReplyDeleteI greatly enjoyed the first 3, but prefer to read than watch.
Unlike but I will consider your comments when preparing future posts.
Delete