exxos's Atari, Amiga & retro forum

We welcome retro users & hardware gurus alike! Come and join the party :)
https://www.exxosforum.co.uk/forum/

Cartridge keys and emulation

https://www.exxosforum.co.uk/forum/viewtopic.php?t=2781

Page 5 of 11

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 07:09
by czietz
troed wrote: 18 May 2020 22:43 Just a hickup, but irritating. It does give me some incentive to in addition to emulator support also try to produce either a working GAL16V8 replacement or, if the equations cannot be reversed from the data, some MCU based hw clone.
Having already successfully reverse-engineered the equations of a PAL, I have quite detailed ideas how I would proceed. With enough effort it should be possible to reconstruct the equations. Too bad that these dongles are very expensive on eBay; too expensive to do this as a fun project. (I have no need for Steinberg software.)

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 08:07
by troed
czietz wrote: 19 May 2020 07:09 Having already successfully reverse-engineered the equations of a PAL, I have quite detailed ideas how I would proceed. With enough effort it should be possible to reconstruct the equations. Too bad that these dongles are very expensive on eBay; too expensive to do this as a fun project. (I have no need for Steinberg software.)
Yeah I'm doing it purely for the challenge. Helping out with archiving for posterity is a bonus.

I'll shell out the money if needed.

/Troed

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 08:19
by JezC
beel1 wrote: 18 May 2020 22:55 Try running Avalon with the dongle first :D
Ok, will dig out the dongle & try it in the Mega ST4 it came with - I think the s/w is still on the Megafile so I will run the s/w with no dongle & then with the dongle & if that is OK, then try it with that program.

We can try to sort out Avalon first & then revisit the Synthworks dongles at a later date.

I've wanted to get the equivalent editor for the Roland D series (incl. MT32 etc.) but can't afford that.

I got the C-Lab one back in the late 80s...and that is now in the public domain :shrug: :sigh:

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 08:44
by Tomswork
I have a question about the cartridge key. Does the software have a s/n or does it access hardware thru a midi port. There were not many ways to validate a dongle in the old days. Some of the old dongle looked for something unique like a code from a startup phrase in a booklet or stored the phrase once entered on th floppy or hd to check with the key.

Tom

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 09:29
by troed
Tomswork wrote: 19 May 2020 08:44 I have a question about the cartridge key. Does the software have a s/n or does it access hardware thru a midi port. There were not many ways to validate a dongle in the old days. Some of the old dongle looked for something unique like a code from a startup phrase in a booklet or stored the phrase once entered on th floppy or hd to check with the key.
An ST cartridge is a memory space. The dongles generate numbers when an address is read, and the chip inside the dongle is supposed to generate a string of values hard to predict. The values are then used in the execution of the program on the ST, so if the values are wrong the execution will fail.

It's very different from simple phrases or serial numbers.

/Troed

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 10:01
by troed
There might also be different hardware dongles, even though they're all Steinberg. From this thread we know that Synthworks and Avalon use the same method, only different variables and equations. From a thread on Atari-Forum (down, so reading cached) I saw Frank saying the Cubase Score one is different:
Inside the Steinberg Dongle is a "Intel P5C060" cmos PLD Chip. (Cubase Score 3.x key)
I found a random photo showing a Steinberg dongle for "Twenty Four" with visible chip marking, GAL16V8: https://www.nightfallcrew.com/wp-conten ... G_9830.jpg The PCB is the same as for Avalon/Synthworks.

... and here's a tweet showing that a Cubase dongle at least has a different PCB. Looks like it's a single bit in, single bit out:

Chip visible for the Cubase dongle here, validating Frank's comment of chip type. A quick read through the data sheet made me think it doesn't have hidden registers either, but I didn't read in that much detail. Since all unused pins are tied to GND/VCC they simply don't use outputs as inputs if so.



/Troed

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 10:55
by beel1
I profiled the startup of several legal versions I found (mostly here: http://atari.music.free.fr/main.php?Cubase also here: https://atarimusic.exxosforum.co.uk/foru ... f=23&t=807 ), there are at leat 2 different dongle read routines:
  • Routine "A" (black dongle) we are working on:
    Synthworks Wavestation 1.14
    Avalon 2.1
    Cubase 2.01
  • Routine "B" (red dongle):
    Cubase 3.10
    Cubase Score 2.0r6

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 11:20
by JezC
I know that the red dongle for Cubase 3 (and the same one works with Cubase Score and even Cubase Audio Falcon I think???) is different from the Cubase 2 dongle.

I have a few Cubase 3 dongles & also a full Cubase Audio Falcon box & two Pro 24 dongles (I think) - I don't have one for Cubase 2 though.

Is there interest in reverse engineering some of the other dongles as well in the future? If so I can try to help out with all but the black Cubase 2.0 dongle...

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 11:44
by czietz
troed wrote: 19 May 2020 08:07 Yeah I'm doing it purely for the challenge. Helping out with archiving for posterity is a bonus.
I'll shell out the money if needed.
Ok, since I cannot actually do it (for lack of a dongle [1]), here is what I would do. Maybe it can help you.

1. Capture the access pattern to the dongle (input pins, clock, /OE) on the Atari using a logic analyzer.
2. Recreate this pattern in a microcontroller and place µC and PAL on a breadboard. Force /OE low so that one can observe the registers for every clock cycle.
3. Put the data in vectors: [input pins, current register state] => [register state after clock] and run these vectors through Espresso or a similar minimizer.
4. In the best case, this will already yield a (sensible) solution.
5. If for some reason the approach above fails, I would revisit my theory that this is mainly an LFSR:
a. clock the PAL with constant input
b. see how the period of the data is
c. try to figure out the LFSR
d. set the input pins and try to figure out how they are combined

[1] For a fun challenge like this, I'd maybe spend 10 €; but the dongles are being sold for 50 € or so.

Re: Steinberg Avalon cartridge

Posted: 19 May 2020 13:13
by beel1
JezC wrote: 19 May 2020 11:20 I know that the red dongle for Cubase 3 (and the same one works with Cubase Score and even Cubase Audio Falcon I think???) is different from the Cubase 2 dongle.

I have a few Cubase 3 dongles & also a full Cubase Audio Falcon box & two Pro 24 dongles (I think) - I don't have one for Cubase 2 though.

Is there interest in reverse engineering some of the other dongles as well in the future? If so I can try to help out with all but the black Cubase 2.0 dongle...
Yes all dongles are interesting, red dongles will need more work and should be more challenging
This is what I get when running Cubase Score:

Code: Select all

FB0000 W ---
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000834
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
FB0000 W 00000200
...
Here is Cubase 3.10:

Code: Select all

FB0000 W ---
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 00000E88
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 0000058C
FB0000 W 00000634
FB0000 W 0000058C
FB0000 W 0000058C
Thus dongle reset pattern is unknown yet, and there are far more cycles between reads (0x28 for black dongle and 0x200 or 0x58C for red one) so I guess intermediate results may not be discarded.
All times are UTC+01:00
Page 5 of 11

Powered by phpBB® Forum Software © phpBB Limited