https://wiki.hackmanhattan.com/api.php?action=feedcontributions&feedformat=atom&user=LNRC 2026-05-17T13:14:22Z User contributions MediaWiki 1.40.1 https://wiki.hackmanhattan.com/index.php?title=Meeting_2026-01-28&diff=9557 2026-01-29T00:33:28Z

<p>LNRC: /* Treasurer's Report */</p> <hr /> <div>Meetings are conducted according to [[MIBS_Rules]].<br /> <br /> ==Approve Minutes==<br /> <br /> ==Consensus Agenda==<br /> * Reimburse Robin $52.53 for 75 Soldering class PCBs (6-9 months worth of supply)<br /> * Spend up to $120 on bulbs, ballasts, and other necessary components such as connectors to repair the overhead lighting in the space<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * No report.<br /> ====Treasurer's Report====<br /> * We are breaking even<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> ====Directors-at-Large's Report====<br /> * No report.<br /> ===Member and Project Reports===<br /> <br /> == Old Business ==<br /> <br /> == New Business ==<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: member1, member2 | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 23:59 by MEMBER.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by MEMBER.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2025-11-26&diff=9539 2025-11-26T20:03:09Z

<p>LNRC: /* Treasurer's Report */</p> <hr /> <div>Meetings are conducted according to [[MIBS_Rules]].<br /> <br /> ==Approve Minutes==<br /> <br /> ==Consensus Agenda==<br /> * Approve purchase of a barely used (one or two prints) Prusa Mini + for $140 to have another small reliable printer available and cut down wait times/print backlog. (Peter found someone selling one for cheap and bought, will resell to Hack at same price.)<br /> <br /> * Approve up to $500 for purchase of a new sewing machine. Model tbd.<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * No report.<br /> ====Treasurer's Report====<br /> * Benevity is now set up!<br /> * Progress in moving from LESFCU to Amalgamated Bank: 10k transferred over, debit cards activated, online account activated.<br /> * Tasks remaining: sync Amalgamated Bank to Xero (accounting software), transfer rest of bills.<br /> * This month, member dues appear to be significantly lower, operating income was -$500.<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> ====Directors-at-Large's Report====<br /> * No report.<br /> ===Member and Project Reports===<br /> <br /> == Old Business ==<br /> <br /> == New Business ==<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: member1, member2 | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 23:59 by MEMBER.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by MEMBER.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2025-08-27&diff=9486 2025-08-27T22:10:36Z

<p>LNRC: /* Treasurer's Report */</p> <hr /> <div>Meetings are conducted according to [[MIBS_Rules]].<br /> <br /> ==Approve Minutes==<br /> <br /> ==Consensus Agenda==<br /> * Authorize spending up to $200 per year for business cards. Disbursement subject to Board approval.<br /> <br /> * Consensus Item 2<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * No report.<br /> ====Treasurer's Report====<br /> * Income was negative this month. Positive income from previous months came from deposits from cash box and Venmo, so this month's report may be a more accurate assessment of where we are at.<br /> * Increase in Digital Services comes from Bitwarden (password management software).<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> ====Directors-at-Large's Report====<br /> * No report.<br /> ===Member and Project Reports===<br /> <br /> == Old Business ==<br /> <br /> == New Business ==<br /> <br /> ===Sponsored Members Induction===<br /> Welcome, Sam!<br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: member1, member2 | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 23:59 by MEMBER.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by MEMBER.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2025-07-30&diff=9477 2025-07-30T23:23:17Z

<p>LNRC: </p> <hr /> <div>Meetings are conducted according to [[MIBS_Rules]].<br /> <br /> ==Approve Minutes==<br /> <br /> ==Consensus Agenda==<br /> * Allow start membership applications before the 3rd visit. All other aspects would remain unchanged<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * No report.<br /> ====Treasurer's Report====<br /> * June's income statement is in the green!<br /> * High donations comes from cumulative cash deposit ($639.00) and donation from [https://bidya.org/ Bidya] (thanks Lambda for coordinating this!)<br /> * Event cost comes from Lightburn Laser Expo<br /> ====Secretary's Report====<br /> * No report.<br /> ====Directors-at-Large's Report====<br /> * No report.<br /> ===Member and Project Reports===<br /> <br /> == Old Business ==<br /> <br /> == New Business ==<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: member1, member2 | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 23:59 by MEMBER.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by MEMBER.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2025-05-28&diff=9430 2025-05-28T01:01:50Z

<p>LNRC: Created page with &quot;Meetings are conducted according to MIBS_Rules. ==Approve Minutes== ==Consensus Agenda== * Consensus Item 1 * Consensus Item 2 ==Member Reports== === Board Reports=== ====President's Report==== * No report. ====Treasurer's Report==== * No report. ====Secretary's Report==== * No report. ====Directors-at-Large's Report==== * No report. ===Member and Project Reports=== == Old Business == == New Business == ===Sponsored Members Induction=== For each prospective mem...&quot;</p> <hr /> <div>Meetings are conducted according to [[MIBS_Rules]].<br /> <br /> ==Approve Minutes==<br /> <br /> ==Consensus Agenda==<br /> * Consensus Item 1<br /> * Consensus Item 2<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * No report.<br /> ====Treasurer's Report====<br /> * No report.<br /> ====Secretary's Report====<br /> * No report.<br /> ====Directors-at-Large's Report====<br /> * No report.<br /> ===Member and Project Reports===<br /> <br /> == Old Business ==<br /> <br /> == New Business ==<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: member1, member2 | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 23:59 by MEMBER.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by MEMBER.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2025-02-26&diff=9285 2025-02-27T00:30:30Z

<p>LNRC: /* Treasurer's Report */</p> <hr /> <div>==Consensus Agenda==<br /> <br /> == New Business ==<br /> <br /> ===Nominations===<br /> {| class=&quot;wikitable&quot;<br /> |+ Election Candidates (in order of nomination)<br /> |-<br /> ! Candidates !! Nominated By !! Accepted !! Notes<br /> |-<br /> | Chris || Ellen || Yes || <br /> |-<br /> | Ellen || Nick || Yes || <br /> |-<br /> | Robin || Nick || Yes || <br /> |-<br /> | Nick || Ellen || No || <br /> |-<br /> | Hannah || Ellen || Yes || <br /> |-<br /> | Drew || Hannah || Yes || <br /> |-<br /> | Clyde || Hannah || Yes || <br /> |-<br /> | Pidge || Jay || Yes || <br /> |-<br /> | Chaim || Nick || Yes || <br /> |-<br /> | Alex S. || Nick || Yes || <br /> |}<br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> ====Treasurer's Report====<br /> * The HVAC has been replaced!! $5,000 total<br /> * Electric bill for Feb 2025 was high (around $300), but about the same as that of Feb 2024<br /> * After HVAC replacement purchase, bank account is at $29,331.45<br /> * Monthly expenses = ~$3.8k a month (not including toiletries, etc.). Monthly member dues = $4,260.00 a month. We are in the green.<br /> * January had income of around $500, HVAC purchase will apply to February financial summary<br /> <br /> ====Secretary's Report====<br /> ====Directors-at-Large's Report====<br /> ===Member and Project Reports===<br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: Member1, ... | LateMember1, ...<br /> * Visitors: <br /> * Called to order at TIME by NAME<br /> * The meeting was adjourned at TIME by NAME<br /> * Minutes taken and submitted by NAME<br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2025-01-29&diff=9276 2025-01-29T20:42:05Z

<p>LNRC: Created page with &quot;Meetings are conducted according to MIBS_Rules. ==Approve Minutes== ==Consensus Agenda== * Consensus Item 1 * Consensus Item 2 ==Member Reports== === Board Reports=== ====President's Report==== * No report. ====Treasurer's Report==== * Accounting books have been reconciled, but we are still working on fixing automated systems * Class expenses are missing because they were not paid in December (sorry folks still catching up here). However, all teachers should be pa...&quot;</p> <hr /> <div>Meetings are conducted according to [[MIBS_Rules]].<br /> <br /> ==Approve Minutes==<br /> <br /> ==Consensus Agenda==<br /> * Consensus Item 1<br /> * Consensus Item 2<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * No report.<br /> ====Treasurer's Report====<br /> * Accounting books have been reconciled, but we are still working on fixing automated systems<br /> * Class expenses are missing because they were not paid in December (sorry folks still catching up here). However, all teachers should be paid by now. January class expenses may be larger than usual as a result.<br /> * Current amount in bank: $34,168.72<br /> ====Secretary's Report====<br /> * No report.<br /> ====Directors-at-Large's Report====<br /> * No report.<br /> ===Member and Project Reports===<br /> <br /> == Old Business ==<br /> <br /> == New Business ==<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: member1, member2 | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 23:59 by MEMBER.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by MEMBER.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2024-12-16&diff=9266 2024-12-16T23:58:56Z

<p>LNRC: /* Treasurer's Report */</p> <hr /> <div>==Consensus Agenda==<br /> * Consensus Item 1<br /> * Consensus Item 2<br /> <br /> == New Business ==<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * No report.<br /> ====Treasurer's Report====<br /> * Still properly organizing accounts after abrupt transition between treasurers. <br /> Number of Active Members: ~47<br /> * Operating Expenses: $3,938.87<br /> ** Rent: $3,267.95<br /> ** Utilities (Internet, Electricity, Waste Management): $466.69<br /> *** ConEd bill went up about $30 this month<br /> ** Other Expenses: $204.23<br /> *Total Income: $4,919.18<br /> ** Income from dues: $4,155.00<br /> ** Income from donations + sales: $858.86<br /> ** Income from class fees (new income category!): $23.24<br /> ** Payment processing fees: -$117.92<br /> * Net Income: $980.31<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> ====Directors-at-Large's Report====<br /> * No report.<br /> ===Member and Project Reports===<br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: member1, member2 | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 23:59 by MEMBER.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by MEMBER.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Individual_Pages&diff=9263 2024-12-16T23:52:09Z

<p>LNRC: </p> <hr /> <div>* [[User:Anna | Anna]]<br /> * [[User:beadsland|Beads Land-Trujillo]]<br /> * [[User:Chaim | Chaim Fraiman]]<br /> * [[User:k10 | k10]]<br /> * [[User:Citybadger|citybadger (Stephen Lynch)]]<br /> * [[User:Clyde | Clyde]]<br /> * [[User:LNRC | Ellen]]<br /> * [[User:Nick|Nick]] (WIP)<br /> * [[User:mc4bbs|MC4BBS (Chaz Antonelli)]]<br /> * [[User:Shenkin|Peter Shenkin]]<br /> * [[User:Pidge|Pidge (Peter M)]]<br /> * [[User:Cuebus|Robin]]<br /> * [[User:Sam|Rotabush (Sam Brown)]]<br /> * [[User: Shway|Shway]]<br /> * [[User:Justinej|Justine]]<br /> * [[User:Boostfox|Boost]]<br /> <br /> [[Former Members]]<br /> <br /> Hey current members! Make yourself a page and add it here!</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2024-11-27&diff=9255 2024-12-03T22:09:26Z

<p>LNRC: </p> <hr /> <div>==Consensus Agenda==<br /> * Ban on minors (under 18 yo) in the space unless accompanying their legal guardian.<br /> <br /> * Require verification of photo id (US state id, NYC id, or passport) upon membership initiation. Procedure is just email to board.<br /> <br /> == New Business ==<br /> * Ban on minors (under 18 yo) in the space unless accompanying their legal guardian.<br /> Tristan pulled this out of the consensus agenda<br /> Version B: Minors (Defined as under 18 years old) are not allowed in the space unless accompanying their legal guardian. Additionally, no minors are allowed at open house unless their accompanying guardian is a member.<br /> Motion passes 13-4<br /> <br /> * Require verification of photo id (US state id, NYC id, or passport) upon membership initiation. Procedure is just email to board.<br /> Shaina pulled this out of the consensus agenda<br /> This item will be postponed and further revised<br /> <br /> Vote to ban Luna <br /> Motion passes 18-0<br /> <br /> Vote to ban Johnny<br /> Motion Passes 19-0<br /> <br /> ===Sponsored Members Induction===<br /> <br /> Welcome Akash, Audrey, and Kent!<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> <br /> * December members meeting to be rescheduled due to falling on Christmas day, please vote in Discord poll about date<br /> * Will also hold election for open board slot then<br /> <br /> &lt;blockquote&gt;<br /> =====Official Statement from the Board of Hack Manhattan=====<br /> <br /> Dear Members,<br /> <br /> We are writing to inform you of a recent decision made by the board of Hack Manhattan. The person known as &quot;Luna Turing&quot;* was asked to resign from their position as Treasurer and as a board member of our organization. Following their resignation, we took action to terminate their membership and permanently ban them in order to protect our community.<br /> <br /> It has come to our attention that over the past year Luna has engaged in unacceptable and harmful behavior, including fabricating stories involving serious criminal activity to manipulate members for personal gain. They engaged in deliberate intimidation and concealed their true identity in furtherance of these deceptions. These needless actions have caused significant emotional distress to multiple members, including severe consequences for their professional and personal lives.<br /> <br /> We have received direct confirmation from multiple people affected, as well as an admission from Luna regarding their conduct. <br /> <br /> We want to make it clear that Luna is no longer affiliated with Hack Manhattan, and we strongly advise against extending any form of trust to them. If you have been impacted or have any concerns regarding their actions, particularly if you have been subjected to their lies and need help understanding what is true, we encourage you to reach out to us, either directly or at board@hackmanhattan.com. We are committed to supporting anyone affected and ensuring that our community is a safe and welcoming space.<br /> <br /> Thank you for your understanding and continued support as we navigate this difficult situation. We appreciate the resilience of our members and are working diligently to prevent any further harm.<br /> <br /> Sincerely,&lt;br/&gt;<br /> The Board of Hack Manhattan<br /> <br /> <br /> &lt;nowiki&gt;*&lt;/nowiki&gt; Luna Turing is neither their given name, nor their current chosen legal name<br /> &lt;/blockquote&gt;<br /> <br /> ====Treasurer's Report====<br /> * The HVAC is broken and the replacement is quoted at $8000. Plan is to proceed with professional replacement.<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> ====Directors-at-Large's Report====<br /> * No report.<br /> ===Member and Project Reports===<br /> * Ed will be setting up a non-permanent radio antenna in the window of the space<br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: Clyde, Ellen, Mihir, Peter, Jay, Tristan, Robin, Cat, Audrey, Xander, Shaina, Charlotte (Late)<br /> * Online Attendance: Suha, Ashley, Hannah, Nick, Chaim, Michelle, Chris, Justine<br /> * Proxy attendance for: Hannah is proxy for Marceline, Robin is proxy for Boost, Suha is proxy for James<br /> * Called to order at 7:42 by Peter.<br /> * The meeting was adjourned at 8:57 by Peter.<br /> * Minutes taken and submitted by Ellen.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=9077 2024-01-19T20:31:27Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> == Mobile Device Data Extraction Projects ==<br /> Some Japanese feature phones can have their data extracted using the [https://github.com/ktdumper/ktdumper ktdumper] scripts available on GitHub, along with a FOMA debug cable (a FOMA cable with pins 8, 9, and 10 bridged together). Information on creating a debug cable can be found [https://docs.google.com/document/d/1iELxocYKh-hDV6hk7SYsnb7AHU1j1JkgolC6kz61PA8/edit?usp=sharing here].<br /> <br /> To see models that are currently compatible with the script, check out the [https://github.com/ktdumper/ktdumper/blob/main/ktdumper/devices.py devices.py] file in the KTdumper project. There may be more models compatible that the ones listed, but these models are essentially guaranteed to work.<br /> <br /> === NEC, Panasonic, Casio ===<br /> ==== NEC ====<br /> NEC devices enter a testing mode when plugged into a PC using a debug cable. Currently known exploits for NEC devices work with phones that have NEC M2 and NEC M3 CPU chips (note this is not the same as the Apple M2). Some phones with OMAP chips are also preservable (OMAP 1610, OMAP 1621?), but later phone models still require more study (OMAP 3430).<br /> <br /> ==== Panasonic ====<br /> For Panasonic phones, the debug cable triggers Panasonic IPL mode. <br /> <br /> Some Panasonic phones have also had their firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer.<br /> <br /> We have extracted data with Panasonic phones that have the following CPUs:<br /> * OMAP 1610<br /> * OMAP 1611<br /> * OMAP 2420<br /> * UniPhier 3M<br /> * UniPhier 4MBB +<br /> <br /> Progress was halted on Panasonic phones for a while due to difficulty in deciphering the FTL (Flash Translation Layer), but this has now been solved.<br /> <br /> ====Casio====<br /> A small number of late Casio phones are compatible with current exploits, such as the 930CA. Extracting data from other models will require an entirely new strain of research.<br /> <br /> === Fujitsu, Mitsubishi, Sharp ===<br /> Fujitsu, Mitsubishi, and Sharp phones can all be booted into a special &quot;Maker Mode&quot; with additional permissions. We have figured out how to extract data from the JAVA folder in some of these phones, but have yet to take full advantage of this &quot;Maker Mode.&quot;<br /> <br /> Phones from these manufacturers generally use the SH-Mobile CPU chip.<br /> <br /> ====Fujitsu====<br /> Current exploits for Fujitsu phones have worked with some models and not others. Issues likely stem from the ktdumper script requesting the wrong folder path. It will be difficult to fix this code for more Fujitsu phone models until more firmware dumps are provided. This requires desoldering the CPU BGA chip and putting it into a compatible chip reader.<br /> <br /> These are the general ranges of models our current exploit works for, though many in-between models still need to be tested.<br /> <br /> * F902i - F906i<br /> * F884iES<br /> * F-04A - F-10A<br /> <br /> <br /> ====Mitsubishi====<br /> The situation with Mitsubishi phones is essentially the same as it is with Fujitsu phones. <br /> <br /> These are the general ranges of models our current exploit works for, though many in-between models still need to be tested.<br /> <br /> * D702i - D705i(myu)<br /> * D902i - D905i<br /> <br /> ==== Sharp ====<br /> We have successfully preserved one Sharp phone, the SH-03E, by reading its eMMC flash. This firmware has helped us derive the exploits to work with Fujitsu and Mitsubishi phones. Ironically, we have not been able to use these tools with Sharp phones yet. These phones can be booted into Maker Mode, but we still need to figure out what to do from there.<br /> <br /> ===== Sharp SH-10C =====<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below.<br /> *[https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> *[https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> === Others===<br /> ==== LG ====<br /> LG DoCoMo mobile phones had their firmware dumped at least 10 years ago, though most of these files have been lost. The firmware dumping process has not been replicated since, but should be possible to figure out with some research.<br /> <br /> The following phones have had their firmware preserved:<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/LG_L704i L704i] (Found Online)<br /> * L706ie (Found Online)<br /> * [https://lpcwiki.miraheze.org/wiki/LG_L-03A L-03A] (Found Online)<br /> <br /> ==== Motorola ====<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a '''RMCDA General Program''', '''M702iS/M702iG USB Drivers''', and '''P2K Commander'''.<br /> <br /> The following phones have had their firmware preserved:<br /> <br /> * M702iG<br /> * M702iS<br /> <br /> ==Brute Force Live Stream: Cracking the Cryptomeria Cipher==<br /> THIS SECTION IS UNDER CONSTRUCTION AND IS NOT UP TO DATE.<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 requires three things: s-box, device keys, and a game-specific bind ID. <br /> * The S-BOX was discovered a few years ago within the firmware of a Japanese Samsung Galaxy S2 (it was used to encrypt live television recordings<br /> * The <br /> <br /> Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> '''THE DEVICE KEY HAS BEEN FOUND THROUGH BRUTE FORCE.'''<br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> * [https://gitlab.com/usernameak/mkb_bruteforce Source code for MKB Bruteforce]<br /> <br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8909 2023-11-04T02:31:39Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the Cryptomeria Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> '''Update: THE DEVICE KEY HAS BEEN FOUND THROUGH BRUTE FORCE.''' But there is still much more to do!<br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> * [https://gitlab.com/usernameak/mkb_bruteforce Source code for MKB Bruteforce]<br /> <br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> === NEC ===<br /> NEC devices enter a testing mode when plugged into a PC using a debug cable (a FOMA cable with pins 8, 9, and 10 bridged together). This cable also works with Panasonic phones. Information on creating a debug cable can be found [https://docs.google.com/document/d/1iELxocYKh-hDV6hk7SYsnb7AHU1j1JkgolC6kz61PA8/edit?usp=sharing here].<br /> <br /> ==== Firmware Dumped Phone Models ====<br /> <br /> * N901iS<br /> <br /> === Panasonic ===<br /> For Panasonic phones, the debug cable triggers Panasonic IPL mode. This cable also works with NEC phones.<br /> <br /> Some Panasonic phones have also had their firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. <br /> <br /> ==== Firmware Dumped Phone Models ====<br /> <br /> * 301P (eMMC)<br /> * 401PM (eMMC)<br /> * P901iS (Debug Cable)<br /> * P-01F (eMMC)<br /> * P-01H (eMMC)<br /> Some phones have had their system data dumped but not their user data<br /> <br /> ==== System Only Firmware Dumps ====<br /> <br /> * P851i<br /> * P903i<br /> <br /> === LG ===<br /> LG DoCoMo mobile phones had their firmware dumped at least 10 years ago, though most of these files have been lost. The firmware dumping process has not been replicated since, but should be possible to figure out with some research.<br /> <br /> ==== Firmware Dumped Phone Models ====<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/LG_L704i L704i] (Found Online)<br /> * L706ie (Found Online)<br /> * [https://lpcwiki.miraheze.org/wiki/LG_L-03A L-03A] (Found Online)<br /> <br /> === Motorola ===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a '''RMCDA General Program''', '''M702iS/M702iG USB Drivers''', and '''P2K Commander'''.<br /> <br /> ==== Firmware Dumped Phone Models ====<br /> <br /> * M702iG<br /> * M702iS<br /> <br /> === Sharp ===<br /> Sharp mobile phones have not yet been dumped, but there have been specific efforts towards breaking open the Sharp SH-10C, detailed below.<br /> <br /> ==== Sharp SH-10C ====<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below.<br /> *[https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> *[https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2023-10-25&diff=8874 2023-10-26T00:07:11Z

<p>LNRC: /* Member and Project Reports */</p> <hr /> <div>==Consensus Agenda==<br /> None<br /> <br /> == New Business ==<br /> * New Members: Jordan, Bill<br /> * Front door RFIDs and physical keys are inside the safe<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * IMPORTANT REMINDERS ABOUT THE SPACE<br /> ** You must lock the building door (street door) if you're last out (no one else in the space when you leave. A board member can give you a key from the safe if you do not have one.<br /> ** '''No sleeping is allowed in the space.'''<br /> ** Do NOT go upstairs for any reason.<br /> <br /> ====Treasurer's Report====<br /> * Insurance payment of $475<br /> ** Insurance payments have risen<br /> * ConEd: $220.63<br /> ** About $40 higher that the same time last year<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> <br /> ====Directors-at-Large's Report====<br /> * No report.<br /> <br /> ===Member and Project Reports===<br /> * Shway: Shakespeare Night every Monday - Still going but only a few members so far. Please join!<br /> * Jordan: Proposal for lockpicking workshop - Rough idea for this first one is it will be between 12-16 people at $30-40 where people will get a SC1 lock and I'll provide tools to be borrowed to learn how to disassemble and re-pin the lock from the current key to the new key. Students will be able to take both keys and the lock home. <br /> ** 12 people X $30 = $360<br /> ** 16 people x $$30 = $480<br /> ** 12 people x $40 = $480<br /> ** 16 people x $40 = $640<br /> ** And we do half space half me.<br /> * Ellen: Update on [[Japanese Feature Phone Preservation]] - The device key brute force effort worked and the key was found! However, there is one more key to discover. Right now members of the project are analyzing firmware dumps of Panasonic phones to understand the encryption mechanism. Separately, Ellen is trying to get acquired Java games working in an emulator but needs help reading Java code to make them work. Please reach out in the Retro Gaming channel!<br /> * Tristan: Got some objects cut with CNC, now the objects need to be spray painted and dried<br /> * Erika: Windows are clean! Do we need curtains now?<br /> * Shway: Went to amateur radio meetup, one person from meetup came to visit<br /> * Tristan: We've made a larger 3D printout of Erika's head<br /> * Erika: Brought paintings this week<br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: Online: Jay, Nick, Clyde, Mihir, Tristan - In-Person: Erika, Shway, Peter | Thomas<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 7:37 by Peter.<br /> * The meeting was adjourned at 8:04 by Peter.<br /> * Minutes taken and submitted by Ellen.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2023-10-25&diff=8873 2023-10-26T00:06:30Z

<p>LNRC: </p> <hr /> <div>==Consensus Agenda==<br /> None<br /> <br /> == New Business ==<br /> * New Members: Jordan, Bill<br /> * Front door RFIDs and physical keys are inside the safe<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * IMPORTANT REMINDERS ABOUT THE SPACE<br /> ** You must lock the building door (street door) if you're last out (no one else in the space when you leave. A board member can give you a key from the safe if you do not have one.<br /> ** '''No sleeping is allowed in the space.'''<br /> ** Do NOT go upstairs for any reason.<br /> <br /> ====Treasurer's Report====<br /> * Insurance payment of $475<br /> ** Insurance payments have risen<br /> * ConEd: $220.63<br /> ** About $40 higher that the same time last year<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> <br /> ====Directors-at-Large's Report====<br /> * No report.<br /> <br /> ===Member and Project Reports===<br /> * Shway: Shakespeare Night every Monday - Still going but only a few members so far. Please join!<br /> * Jordan: Proposal for lockpicking workshop - Rough idea for this first one is it will be between 12-16 people at $30-40 where people will get a SC1 lock and I'll provide tools to be borrowed to learn how to disassemble and re-pin the lock from the current key to the new key. Students will be able to take both keys and the lock home. <br /> ** 12 people X $30 = $360<br /> ** 16 people x $$30 = $480<br /> ** 12 people x $40 = $480<br /> ** 16 people x $40 = $640<br /> ** And we do half space half me.<br /> * Ellen: Update on [[Japanese Feature Phone Preservation]] - The device key brute force effort worked and the key was found! However, there is one more key to discover. Right now members of the project are analyzing firmware dumps of Panasonic phones to understand the encryption mechanism. Separately, Ellen is working to get acquired Java games working in an emulator but needs help reading Java code to make them work. Please reach out in the Retro Gaming channel!<br /> * Tristan: Got some objects cut with CNC, now the objects need to be spray painted and dried<br /> * Erika: Windows are clean! Do we need curtains now?<br /> * Shway: Went to amateur radio meetup, one person from meetup came to visit<br /> * Tristan: We've made a larger 3D printout of Erika's head<br /> * Erika: Brought paintings this week<br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: Online: Jay, Nick, Clyde, Mihir, Tristan - In-Person: Erika, Shway, Peter | Thomas<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 7:37 by Peter.<br /> * The meeting was adjourned at 8:04 by Peter.<br /> * Minutes taken and submitted by Ellen.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2023-10-25&diff=8872 2023-10-26T00:05:10Z

<p>LNRC: </p> <hr /> <div>==Consensus Agenda==<br /> None<br /> <br /> == New Business ==<br /> * New Members: Jordan, Bill<br /> * Front door RFIDs and physical keys are inside the safe<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * IMPORTANT REMINDERS ABOUT THE SPACE<br /> ** You must lock the building door (street door) if you're last out (no one else in the space when you leave. A board member can give you a key from the safe if you do not have one.<br /> ** '''No sleeping is allowed in the space.'''<br /> ** Do NOT go upstairs for any reason.<br /> <br /> ====Treasurer's Report====<br /> * Insurance payment of $475<br /> ** Insurance payments have risen<br /> * ConEd: $220.63<br /> ** About $40 higher that the same time last year<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> <br /> ====Directors-at-Large's Report====<br /> * No report.<br /> <br /> ===Member and Project Reports===<br /> * Shway: Shakespeare Night every Monday - Still going but only a few members so far. Please join!<br /> * Jordan: Proposal for lockpicking workshop - Rough idea for this first one is it will be between 12-16 people at $30-40 where people will get a SC1 lock and I'll provide tools to be borrowed to learn how to disassemble and re-pin the lock from the current key to the new key. Students will be able to take both keys and the lock home. <br /> ** 12 people X $30 = $360<br /> ** 16 people x $$30 = $480<br /> ** 12 people x $40 = $480<br /> ** 16 people x $40 = $640<br /> ** And we do half space half me.<br /> * Ellen: Update on [[Japanese Feature Phone Preservation]] - The device key brute force effort worked and the key was found! However, there is one more key to discover and few leads. Ellen is also working to get acquired Java games working in an emulator but needs help reading Java code to make them work. Please reach out in the Retro Gaming channel!<br /> * Tristan: Got some objects cut with CNC, now the objects need to be spray painted and dried<br /> * Erika: Windows are clean! Do we need curtains now?<br /> * Shway: Went to amateur radio meetup, one person from meetup came to visit<br /> * Tristan: We've made a larger 3D printout of Erika's head<br /> * Erika: Brought paintings this week<br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: Online: Jay, Nick, Clyde, Mihir, Tristan - In-Person: Erika, Shway, Peter | Thomas<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 7:37 by Peter.<br /> * The meeting was adjourned at 8:04 by Peter.<br /> * Minutes taken and submitted by Ellen.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2023-10-25&diff=8871 2023-10-26T00:04:07Z

<p>LNRC: </p> <hr /> <div>==Consensus Agenda==<br /> None<br /> <br /> == New Business ==<br /> * New Members: Jordan, Bill<br /> * Front door RFIDs and physical keys are inside the safe<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * IMPORTANT REMINDERS ABOUT THE SPACE<br /> ** You must lock the building door (street door) if you're last out (no one else in the space when you leave. A board member can give you a key from the safe if you do not have one.<br /> ** '''No sleeping is allowed in the space.'''<br /> ** Do NOT go upstairs for any reason.<br /> <br /> ====Treasurer's Report====<br /> * Insurance payment of $475<br /> ** Insurance payments have risen<br /> * ConEd: $220.63<br /> ** About $40 higher that the same time last year<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> <br /> ====Directors-at-Large's Report====<br /> * No report.<br /> <br /> ===Member and Project Reports===<br /> * Shway: Shakespeare Night every Monday - Still going but only a few members so far. Please join!<br /> * Jordan: Proposal for lockpicking workshop - Rough idea for this first one is it will be between 12-16 people at $30-40 where people will get a SC1 lock and I'll provide tools to be borrowed to learn how to disassemble and re-pin the lock from the current key to the new key. Students will be able to take both keys and the lock home. <br /> ** 12 people X $30 = $360<br /> ** 16 people x $$30 = $480<br /> ** 12 people x $40 = $480<br /> ** 16 people x $40 = $640<br /> ** And we do half space half me.<br /> * Ellen: Update on [[Japanese Feature Phone Preservation]] - The device key brute force effort worked and the key was found! However, there is one more key to discover and few leads. Ellen is also working to get acquired Java games working in an emulator but needs help reading Java code to make them work. Please reach out in the Retro Gaming channel!<br /> * Tristan: Got some objects cut with CNC, now the objects need to be spray painted and dried<br /> * Erika: Windows are clean! Do we need curtains now?<br /> * Shway: Went to amateur radio meetup, one person from meetup came to visit<br /> * Tristan: We've made a larger 3D printout of Erika's head<br /> <br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: Online: Jay, Nick, Clyde, Mihir, Tristan - In-Person: Erika, Shway, Peter | Thomas<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 7:37 by Peter.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by Ellen.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2023-10-25&diff=8870 2023-10-26T00:01:15Z

<p>LNRC: </p> <hr /> <div>==Consensus Agenda==<br /> None<br /> <br /> == New Business ==<br /> * New Members: Jordan, Bill<br /> * Front door RFIDs and physical keys are inside the safe<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * IMPORTANT REMINDERS ABOUT THE SPACE<br /> ** You must lock the building door (street door) if you're last out (no one else in the space when you leave. A board member can give you a key from the safe if you do not have one.<br /> ** '''No sleeping is allowed in the space.'''<br /> ** Do NOT go upstairs for any reason.<br /> <br /> ====Treasurer's Report====<br /> * Insurance payment of $475<br /> ** Insurance payments have risen<br /> * ConEd: $220.63<br /> ** About $40 higher that the same time last year<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> <br /> ====Directors-at-Large's Report====<br /> * No report.<br /> <br /> ===Member and Project Reports===<br /> * Shway: Shakespeare Night every Monday - Still going but only a few members so far. Please join!<br /> * Jordan: Proposal for lockpicking workshop - Rough idea for this first one is it will be between 12-16 people at $30-40 where people will get a SC1 lock and I'll provide tools to be borrowed to learn how to disassemble and re-pin the lock from the current key to the new key. Students will be able to take both keys and the lock home. <br /> ** 12 people X $30 = $360<br /> ** 16 people x $$30 = $480<br /> ** 12 people x $40 = $480<br /> ** 16 people x $40 = $640<br /> ** And we do half space half me.<br /> * Ellen: Update on [[Japanese Feature Phone Preservation]] - The device key brute force effort worked and the key was found! However, there is one more key to discover and few leads. Ellen is also working to get acquired Java games working in an emulator but needs help reading Java code to make them work.<br /> * Tristan: Got some objects cut with CNC, now the objects need to be spray painted and dried<br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: Online: Jay, Nick, Clyde, Mihir, Tristan | In-Person: Erika, Shway, Peter | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 7:37 by Peter.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by Ellen.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2023-10-25&diff=8869 2023-10-25T23:48:07Z

<p>LNRC: </p> <hr /> <div>==Consensus Agenda==<br /> None<br /> <br /> == New Business ==<br /> * New Members: Sidepocket, Bill<br /> * Front door RFIDs and physical keys are inside the safe<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * IMPORTANT REMINDERS ABOUT THE SPACE<br /> ** You must lock the building door (street door) if you're last out (no one else in the space when you leave. A board member can give you a key from the safe if you do not have one.<br /> ** '''No sleeping is allowed in the space.'''<br /> ** Do NOT go upstairs for any reason.<br /> <br /> ====Treasurer's Report====<br /> * Insurance payment of $475<br /> ** Insurance payments have risen<br /> * ConEd: $220.63<br /> <br /> ====Secretary's Report====<br /> * No report.<br /> <br /> ====Directors-at-Large's Report====<br /> * No report.<br /> <br /> ===Member and Project Reports===<br /> <br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: Online: Jay, Nick, Clyde, Mihir, Tristan | In-Person: Erika, Shway, Peter | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 7:37 by Peter.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by Ellen.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Meeting_2023-10-25&diff=8868 2023-10-25T23:38:13Z

<p>LNRC: </p> <hr /> <div>==Consensus Agenda==<br /> * Consensus Item 1<br /> * Consensus Item 2<br /> <br /> == New Business ==<br /> <br /> ===Sponsored Members Induction===<br /> For each prospective member, please confirm no later than Thursday before the meeting:<br /> <br /> * Has the member visited 3 times at the regular Tuesday and Thursday open nights?<br /> * Has the member received the briefing? When, and who was the briefer?<br /> * Has the member's bio and photo been circulated on the members list? (not just Discord)<br /> <br /> ==Member Reports==<br /> === Board Reports===<br /> ====President's Report====<br /> * No report.<br /> ====Treasurer's Report====<br /> * Insurance payment of $475<br /> * ConEd: $220.63<br /> ====Secretary's Report====<br /> * No report.<br /> ====Directors-at-Large's Report====<br /> * No report.<br /> ===Member and Project Reports===<br /> <br /> ==Meeting Meta==<br /> * Members in Attendance: Online: Jay, Nick, Clyde, Mihir | In-Person: Erika, Shway, Peter | latemember1<br /> * Visitors: visitor1, visitor2<br /> * Called to order at 7:37 by Peter.<br /> * The meeting was adjourned at 23:59 by MEMBER.<br /> * Minutes taken and submitted by Ellen.<br /> <br /> [[Category:Meetings]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8867 2023-10-25T23:36:45Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the Cryptomeria Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> '''Update: THE DEVICE KEY HAS BEEN FOUND THROUGH BRUTE FORCE.''' But there is still much more to do!<br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> * [https://gitlab.com/usernameak/mkb_bruteforce Source code for MKB Bruteforce]<br /> <br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> [[File:RockmanPhantomofNetwork.png|thumb|Screenshot of ''Rockman.exe Phantom of Network'' ([https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html source])]]<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. This phone model does not allow applications to be transferred to an SD card.<br /> <br /> Right now, preservationists are focusing on this model of phone for a few reasons:<br /> * The schematics were leaked by the FFC ([https://fcc.report/FCC-ID/APYHRO00145 see here])<br /> * A member of the community possesses a phone with two Mega Man exclusive games: '''Rockman.exe: Phantom of Network''' and '''Rockman.exe: Legend of Network'''<br /> * Since this was one of the last Japanese feature phones to be released, it offers a wider variety of possibly exploitable tools such as a wifi-enabled Netfront web browser and [https://en.wikipedia.org/wiki/Adobe_Flash_Lite Adobe Flash Lite]<br /> <br /> For more information, we recommend reading the report below. <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using '''RMCDA General Program'''.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===Others===<br /> There are many individuals in the preservation community with their own unique phone models seeking unique device solutions, either through debugging software or direct eMMC file transfer. Feel free to ask in the [https://discord.com/invite/jh56s2v5PP Discord] Retro Gaming channel for more info!<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8846 2023-10-08T00:23:56Z

<p>LNRC: /* Brute Force Live Stream: Cracking the Cryptomeria Cipher */</p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the Cryptomeria Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> * [https://gitlab.com/usernameak/mkb_bruteforce Source code for MKB Bruteforce]<br /> <br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> [[File:RockmanPhantomofNetwork.png|thumb|Screenshot of ''Rockman.exe Phantom of Network'' ([https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html source])]]<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. This phone model does not allow applications to be transferred to an SD card.<br /> <br /> Right now, preservationists are focusing on this model of phone for a few reasons:<br /> * The schematics were leaked by the FFC ([https://fcc.report/FCC-ID/APYHRO00145 see here])<br /> * A member of the community possesses a phone with two Mega Man exclusive games: '''Rockman.exe: Phantom of Network''' and '''Rockman.exe: Legend of Network'''<br /> * Since this was one of the last Japanese feature phones to be released, it offers a wider variety of possibly exploitable tools such as a wifi-enabled Netfront web browser and [https://en.wikipedia.org/wiki/Adobe_Flash_Lite Adobe Flash Lite]<br /> <br /> For more information, we recommend reading the report below. <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using '''RMCDA General Program'''.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===Others===<br /> There are many individuals in the preservation community with their own unique phone models seeking unique device solutions, either through debugging software or direct eMMC file transfer. Feel free to ask in the [https://discord.com/invite/jh56s2v5PP Discord] Retro Gaming channel for more info!<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8845 2023-10-08T00:23:28Z

<p>LNRC: /* Brute Force Live Stream: Cracking the C2 Cipher */</p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the Cryptomeria Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 cipher with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> * [https://gitlab.com/usernameak/mkb_bruteforce Source code for MKB Bruteforce]<br /> <br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> [[File:RockmanPhantomofNetwork.png|thumb|Screenshot of ''Rockman.exe Phantom of Network'' ([https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html source])]]<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. This phone model does not allow applications to be transferred to an SD card.<br /> <br /> Right now, preservationists are focusing on this model of phone for a few reasons:<br /> * The schematics were leaked by the FFC ([https://fcc.report/FCC-ID/APYHRO00145 see here])<br /> * A member of the community possesses a phone with two Mega Man exclusive games: '''Rockman.exe: Phantom of Network''' and '''Rockman.exe: Legend of Network'''<br /> * Since this was one of the last Japanese feature phones to be released, it offers a wider variety of possibly exploitable tools such as a wifi-enabled Netfront web browser and [https://en.wikipedia.org/wiki/Adobe_Flash_Lite Adobe Flash Lite]<br /> <br /> For more information, we recommend reading the report below. <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using '''RMCDA General Program'''.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===Others===<br /> There are many individuals in the preservation community with their own unique phone models seeking unique device solutions, either through debugging software or direct eMMC file transfer. Feel free to ask in the [https://discord.com/invite/jh56s2v5PP Discord] Retro Gaming channel for more info!<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8844 2023-10-07T05:43:53Z

<p>LNRC: /* General Summary */</p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the C2 Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 cipher with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> * [https://gitlab.com/usernameak/mkb_bruteforce Source code for MKB Bruteforce]<br /> <br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> [[File:RockmanPhantomofNetwork.png|thumb|Screenshot of ''Rockman.exe Phantom of Network'' ([https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html source])]]<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. This phone model does not allow applications to be transferred to an SD card.<br /> <br /> Right now, preservationists are focusing on this model of phone for a few reasons:<br /> * The schematics were leaked by the FFC ([https://fcc.report/FCC-ID/APYHRO00145 see here])<br /> * A member of the community possesses a phone with two Mega Man exclusive games: '''Rockman.exe: Phantom of Network''' and '''Rockman.exe: Legend of Network'''<br /> * Since this was one of the last Japanese feature phones to be released, it offers a wider variety of possibly exploitable tools such as a wifi-enabled Netfront web browser and [https://en.wikipedia.org/wiki/Adobe_Flash_Lite Adobe Flash Lite]<br /> <br /> For more information, we recommend reading the report below. <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using '''RMCDA General Program'''.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===Others===<br /> There are many individuals in the preservation community with their own unique phone models seeking unique device solutions, either through debugging software or direct eMMC file transfer. Feel free to ask in the [https://discord.com/invite/jh56s2v5PP Discord] Retro Gaming channel for more info!<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8843 2023-10-07T05:19:17Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the C2 Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 cipher with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> [[File:RockmanPhantomofNetwork.png|thumb|Screenshot of ''Rockman.exe Phantom of Network'' ([https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html source])]]<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. This phone model does not allow applications to be transferred to an SD card.<br /> <br /> Right now, preservationists are focusing on this model of phone for a few reasons:<br /> * The schematics were leaked by the FFC ([https://fcc.report/FCC-ID/APYHRO00145 see here])<br /> * A member of the community possesses a phone with two Mega Man exclusive games: '''Rockman.exe: Phantom of Network''' and '''Rockman.exe: Legend of Network'''<br /> * Since this was one of the last Japanese feature phones to be released, it offers a wider variety of possibly exploitable tools such as a wifi-enabled Netfront web browser and [https://en.wikipedia.org/wiki/Adobe_Flash_Lite Adobe Flash Lite]<br /> <br /> For more information, we recommend reading the report below. <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using '''RMCDA General Program'''.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===Others===<br /> There are many individuals in the preservation community with their own unique phone models seeking unique device solutions, either through debugging software or direct eMMC file transfer. Feel free to ask in the [https://discord.com/invite/jh56s2v5PP Discord] Retro Gaming channel for more info!<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8842 2023-10-07T05:06:14Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the C2 Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 cipher with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> [[File:RockmanPhantomofNetwork.png|thumb|Screenshot of ''Rockman.exe Phantom of Network'' ([https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html source])]]<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. This phone model does not allow applications to be transferred to an SD card.<br /> <br /> Right now, preservationists are focusing on this model of phone for a few reasons:<br /> * The schematics were leaked by the FFC ([https://fcc.report/FCC-ID/APYHRO00145 see here])<br /> * A member of the community possesses a phone with two Mega Man exclusive games: '''Rockman.exe: Phantom of Network''' and '''Rockman.exe: Legend of Network'''<br /> * Since this was one of the last Japanese feature phones to be released, it offers a wider variety of possibly exploitable tools such as a wifi-enabled Netfront web browser and [https://en.wikipedia.org/wiki/Adobe_Flash_Lite Adobe Flash Lite]<br /> <br /> For more information, we recommend reading the report below. <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using '''RMCDA General Program'''.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===Others===<br /> There are many individuals in the preservation community with their own unique phone models seeking unique device solutions, either through debugging software or direct eMMC file transfer. Feel free to ask in the [https://discord.com/invite/jh56s2v5PP Discord] for more info!<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8841 2023-10-07T05:03:00Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the C2 Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 cipher with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> [[File:RockmanPhantomofNetwork.png|thumb|Screenshot of ''Rockman.exe Phantom of Network'' ([https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html source])]]<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. <br /> <br /> Right now, preservationists are focusing on this model of phone for a few reasons:<br /> * The schematics were leaked by the FFC ([https://fcc.report/FCC-ID/APYHRO00145 see here])<br /> * A member of the community possesses a phone with two Mega Man exclusive games: '''Rockman.exe: Phantom of Network''' and '''Rockman.exe: Legend of Network'''<br /> * Since this was one of the last Japanese feature phones to be released, it offers a wider variety of possibly exploitable tools such as a wifi-enabled Netfront web browser and [https://en.wikipedia.org/wiki/Adobe_Flash_Lite Adobe Flash Lite]<br /> <br /> For more information, we recommend reading the report below. <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using '''RMCDA General Program'''.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===Others===<br /> There are many individuals in the preservation community with their own unique phone models seeking unique device solutions, either through debugging software or direct eMMC file transfer. Feel free to ask in the [https://discord.com/invite/jh56s2v5PP Discord] for more info!<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8840 2023-10-07T05:00:59Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the C2 Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 cipher with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> [[File:RockmanPhantomofNetwork.png|thumb|Screenshot of ''Rockman.exe Phantom of Network'' ([https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html source])]]<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. <br /> <br /> Right now, preservationists are focusing on this model of phone for a few reasons:<br /> * The schematics were leaked by the FFC ([https://fcc.report/FCC-ID/APYHRO00145 see here])<br /> * A member of the community possesses a phone with two Mega Man exclusive games: '''Rockman.exe: Phantom of Network''' and '''Rockman.exe: Legend of Network'''<br /> * Since this was one of the last Japanese feature phones to be released, it offers a wider variety of possibly exploitable tools such as a wifi-enabled Netfront web browser and [https://en.wikipedia.org/wiki/Adobe_Flash_Lite Adobe Flash Lite]<br /> <br /> For more information, we recommend reading the report below. <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===Others===<br /> There are many individuals in the preservation community with their own unique phone models seeking unique device solutions. Feel free to ask in the [https://discord.com/invite/jh56s2v5PP Discord] for more info!<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) and [https://japanesefeaturephones.miraheze.org/wiki/I%CE%B1ppli_Publisher iαppli Publisher] Games ===<br /> Mobile Game Deployer/iαppli Publisher was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8839 2023-10-07T04:58:46Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, digital wallets, virtual characters to replace you on video calls, and more. The phones offered platform-exclusive games from many beloved franchises such as ''Final Fantasy, Pokemon, Kingdom Hearts, Professor Layton,'' and ''Megami Tensei.'' Mobile devices in Japan were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of [https://en.wikipedia.org/wiki/I-mode proprietary internet protocols], and more, these phones and their games have been extremely challenging to preserve.<br /> <br /> ==Brute Force Live Stream: Cracking the C2 Cipher==<br /> ===General Summary===<br /> [[File:RockmanDash5Islands.jpg|thumb|Rockman DASH: Great Adventure on 5 Islands! ([https://www.legends-station.com/?id=big-5-island-adventure image source])]]<br /> The microSD cards in Japanese feature phones hide copyright protected data using a [https://en.wikipedia.org/wiki/Cryptomeria_cipher Cryptomeria Cipher], also known as a C2. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 cipher with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains '''Rockman DASH: Great Adventure on Five Islands!''' <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> * [https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> ===Hardcore Summary===<br /> [[File: MKB.png|thumb|Chart of the 16 MKB types used in SD cards involved in this process. Games are encrypted with MKB 11: SD Binding]]<br /> <br /> An MKB on SD cards generally contains two records (except some mostly irrelevant header records): '''Calculate Media Key''' and '''Conditionally Calculate Media Key'''.<br /> <br /> # A row which corresponds to our device key is looked up in Calculate Media Key record.<br /> # We decrypt this row with our device key, and get another key.<br /> # In the Conditionally Calculate Media Key record, there's an encrypted block with a specific (constant) value which we attempt to decrypt with the key from the previous step.<br /> # If this value matches what we expected, we look up a row in the Conditionally Calculate Media Key record (same row number as in step 1) and decrypt it with the key we got in step 2, then decrypt it again with the device key - that's our key; else we are done and the key is what we got in step 2.<br /> <br /> We've made an assumption that the condition in step 4 is always true. Which isn't extremely unreasonable - values in the Conditionally Calculate Media Key record don't seem like what you would expect according to specification (if I've interpreted it correctly, invalid values would be identical to what is in the Calculate Media Key record; and they aren't). So as long as the assumption holds true, it'll eventually succeed.<br /> <br /> For more technical information, please look at the following official PDFs:<br /> * [{{SERVER}}{{localurl:File:Cprm-base110-20101215.pdf}} Content Protection for Recordable Media Specification: Introduction and Common Cryptographic Elements] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-com097-20101215.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - Common Part] (PDF)<br /> * [{{SERVER}}{{localurl:File:Cprm-sd-bind-part-092-2005-1212.pdf}} Content Protection for Recordable Media Specification: SD Memory Card Book - SD-Binding Part] (PDF)<br /> <br /> <br /> == Mobile Device Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> [[File:RockmanPhantomofNetwork.png|thumb|Screenshot of ''Rockman.exe Phantom of Network'' ([https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html source])]]<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. <br /> <br /> Right now, preservationists are focusing on this model of phone for a few reasons:<br /> * The schematics were leaked by the FFC ([https://fcc.report/FCC-ID/APYHRO00145 see here])<br /> * A member of the community possesses a phone with two Mega Man exclusive games: '''Rockman.exe: Phantom of Network''' and '''Rockman.exe: Legend of Network'''<br /> * Since this was one of the last Japanese feature phones to be released, it offers a wider variety of possibly exploitable tools such as a wifi-enabled Netfront web browser and [https://en.wikipedia.org/wiki/Adobe_Flash_Lite Adobe Flash Lite]<br /> <br /> For more information, we recommend reading the report below. <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===Others===<br /> There are many individuals in the preservation community with their own unique phone models seeking unique device solutions. Feel free to ask in the [https://discord.com/invite/jh56s2v5PP Discord] for more info!<br /> <br /> == Archive Re-release Restoration Projects ==<br /> This section will describe efforts to restore original DoJa game files.'''DoJa''' is a proprietary Java runtime developed by NTT Docomo to run specifically on feature phones. Games consist of two files: the .jam file (java manager file), which provides technical information to the phone about the application's install requirements, and the .jar file, which is the game itself. DoJa games use a scratchpad, which is saved as a .sp file.<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain DoJa files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> ==== Currently Accessible Appli Archives Games ====<br /> Any game not on this list lacks a publicly known license key in order to be decrypted. Visit the [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Japanese Feature Phones wiki] for the full list of games in this collection.<br /> {| class=&quot;wikitable&quot;<br /> !Appli Archive Game<br /> !Games Included<br /> !Release Date<br /> |-<br /> |'''アプリアーカイブス ジャレコ シティコネクション'''<br /> Appli Archives: Jaleco City Connection<br /> |<br /> * City Connection DX<br /> * City Connection: Rocket<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア デュオローグ'''<br /> Appli Archives: Nippon Ichi Software Duologue<br /> |<br /> * Duologue<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス ジャレコ モモコ1200%'''<br /> Appli Archives: Jaleco Momoko 1200%<br /> |<br /> * Momoko 1200% Prequel<br /> * Momoko 1200% Sequel<br /> |2014.12.24<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック1'''<br /> Appli Archives: Nippon Ichi Software Mini Game Pack 1<br /> |<br /> * Elingya Puzzle DX<br /> * Going Down the Hill<br /> * The Throwing Prinnies<br /> |2015.01.14<br /> |-<br /> |'''アプリアーカイブス ジャレコ アーガス＆フィールドコンバット'''<br /> Appli Archives: Jaleco Argus &amp; Field Combat<br /> |<br /> * Argus<br /> * Buta-san<br /> * Exerion DX<br /> * Field Combat DX<br /> |2015.01.28<br /> |-<br /> |'''アプリアーカイブス ジー・モード バーガータイム'''<br /> Appli Archives G-MODE Burger Time<br /> |<br /> * BurgerTime<br /> * Pucchin Puzzle<br /> * Snowboard Man<br /> |2015.03.11<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック2'''<br /> Appli Archives Nippon Ichi Software Mini Game Pack 2<br /> |<br /> * Disgaea: The Prinnies Strike Back<br /> * Nyanko Panel DX|Nyanko Panels DX<br /> * Nyanko Suberi DX|The Slipping Nyanko DX<br /> |2015.04.28<br /> |-<br /> |'''アプリアーカイブス チームライズ HumanFly'''<br /> Appli Archives Team Rise HumanFly<br /> |<br /> * HumanFly Kai<br /> * HumanFly 2<br /> * CIA Sniper Investigator DX<br /> |2015.05.27<br /> |}<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) Games ===<br /> Mobile Game Deployer was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> ===G-mode Archives===<br /> The [https://japanesefeaturephones.miraheze.org/wiki/G-mode_Archives G-mode Archives] are a collection of Japanese feature phone re-releases for Nintendo Switch and Windows (Steam) published by G-mode. These games were developed in Unity, and so far no DoJa files have been discovered inside of them.<br /> <br /> ==Emulating Network Protocol?==<br /> At this point, no one knows how to emulate the proprietary network protocols that were used by these mobile devices to download games. This means that ''no one'' has successfully added new applications or side-loaded applications to a Japanese feature phone. Even though a wifi enabled phone can access a website containing a game download, the wifi Full Browser does not offer the ability to download the game files. Only the proprietary browser (such as i-mode) has the capacity to download and install games.<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=File:RockmanPhantomofNetwork.png&diff=8838 2023-10-07T04:44:00Z

<p>LNRC: Rockman.exe Phantom of Network screenshot from https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html</p> <hr /> <div>== Summary ==<br /> Rockman.exe Phantom of Network screenshot from https://www.rockman-corner.com/2021/09/rockman-exe-phantom-of-networklegend-of.html</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=File:RockmanDash5Islands.jpg&diff=8837 2023-10-07T04:23:37Z

<p>LNRC: For Japanese Feature Phone Preservation a screenshot of Rockman Dash: Great Adventure on 5 Islands. Source: https://www.legends-station.com/?id=big-5-island-adventure</p> <hr /> <div>== Summary ==<br /> For [[Japanese Feature Phone Preservation]] a screenshot of Rockman Dash: Great Adventure on 5 Islands. <br /> <br /> Source: https://www.legends-station.com/?id=big-5-island-adventure</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=File:Cprm-base110-20101215.pdf&diff=8836 2023-10-07T04:15:51Z

<p>LNRC: Explanation of SD bind related to Japanese Feature Phone Preservation</p> <hr /> <div>== Summary ==<br /> Explanation of SD bind related to Japanese Feature Phone Preservation</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=File:Cprm-sd-com097-20101215.pdf&diff=8835 2023-10-07T04:15:43Z

<p>LNRC: Explanation of SD bind related to Japanese Feature Phone Preservation</p> <hr /> <div>== Summary ==<br /> Explanation of SD bind related to Japanese Feature Phone Preservation</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=File:Cprm-sd-bind-part-092-2005-1212.pdf&diff=8834 2023-10-07T04:15:06Z

<p>LNRC: Explanation of SD bind related to Japanese Feature Phone Preservation</p> <hr /> <div>== Summary ==<br /> Explanation of SD bind related to Japanese Feature Phone Preservation</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=File:MKB.png&diff=8833 2023-10-07T03:39:31Z

<p>LNRC: A chart showing the 26 CPRM MKBs that are used to encrypt data on an SD card, relevant to Japanese Feature Phones</p> <hr /> <div>== Summary ==<br /> A chart showing the 26 CPRM MKBs that are used to encrypt data on an SD card, relevant to [[Japanese Feature Phones]]</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8829 2023-10-04T02:12:21Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> ==Brute Force Live Stream: Cracking the C2 Cipher==<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 cipher with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains Rockman DASH: Great Adventure on Five Islands! <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> *[https://www.twitch.tv/goodtofufriday Cracking Rockman DASH: Great Adventure on Five Islands! Livestream]<br /> <br /> == Game-Specific Preservation Projects ==<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain [[DoJa]] files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> ==== Currently Accessible Appli Archives Games ====<br /> Any game not on this list lacks a publicly known license key in order to be decrypted.<br /> {| class=&quot;wikitable&quot;<br /> !Appli Archive Game<br /> !Games Included<br /> !Release Date<br /> |-<br /> |'''アプリアーカイブス ジャレコ シティコネクション'''<br /> Appli Archives: Jaleco City Connection<br /> |<br /> * City Connection DX<br /> * City Connection: Rocket<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア デュオローグ'''<br /> Appli Archives: Nippon Ichi Software Duologue<br /> |<br /> * Duologue<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス ジャレコ モモコ1200%'''<br /> Appli Archives: Jaleco Momoko 1200%<br /> |<br /> * Momoko 1200% Prequel<br /> * Momoko 1200% Sequel<br /> |2014.12.24<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック1'''<br /> Appli Archives: Nippon Ichi Software Mini Game Pack 1<br /> |<br /> * Elingya Puzzle DX<br /> * Going Down the Hill<br /> * The Throwing Prinnies<br /> |2015.01.14<br /> |-<br /> |'''アプリアーカイブス ジャレコ アーガス＆フィールドコンバット'''<br /> Appli Archives: Jaleco Argus &amp; Field Combat<br /> |<br /> * Argus<br /> * Buta-san<br /> * Exerion DX<br /> * Field Combat DX<br /> |2015.01.28<br /> |-<br /> |'''アプリアーカイブス ジー・モード バーガータイム'''<br /> Appli Archives G-MODE Burger Time<br /> |<br /> * BurgerTime<br /> * Pucchin Puzzle<br /> * Snowboard Man<br /> |2015.03.11<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック2'''<br /> Appli Archives Nippon Ichi Software Mini Game Pack 2<br /> |<br /> * Disgaea: The Prinnies Strike Back<br /> * Nyanko Panel DX|Nyanko Panels DX<br /> * Nyanko Suberi DX|The Slipping Nyanko DX<br /> |2015.04.28<br /> |-<br /> |'''アプリアーカイブス チームライズ HumanFly'''<br /> Appli Archives Team Rise HumanFly<br /> |<br /> * HumanFly Kai<br /> * HumanFly 2<br /> * CIA Sniper Investigator DX<br /> |2015.05.27<br /> |}<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) Games ===<br /> Mobile Game Deployer was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8828 2023-10-04T02:11:21Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday''''' '''''READ FIRST HEADER ON THIS PAGE FOR INFO ON LIVE STREAM'''''<br /> <br /> <br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> ==Brute Force Live Stream: Cracking the C2 Cipher==<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> The user GoodTofuFriday is currently brute-forcing the C2 cipher with his GPU to obtain one device key that can be applied to encrypted SD game dumps. Once we have that device key, we will test it on the card that this particular MKB (a key inside DRM) came from. That has a 100% chance of working because that's literally where the device key came from. <br /> <br /> With that in tow, we'll now get to the games: finding the game-specific bind ID using the device key and s-box (which has already been acquired). It depends on how long that will take, but the device key will make things exponentially easier than if we didn't have it. Next is to combine the three to decrypt the game files... and nobody knows what will happen next.<br /> <br /> One of the main goals of this brute force effort is to access a specific SD card that contains Rockman DASH: Great Adventure on Five Islands! <br /> <br /> * [https://www.youtube.com/watch?v=fVtgixfBdDc Video footage of Rockman DASH: Great Adventure on Five Islands!]<br /> <br /> == Game-Specific Preservation Projects ==<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain [[DoJa]] files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> ==== Currently Accessible Appli Archives Games ====<br /> Any game not on this list lacks a publicly known license key in order to be decrypted.<br /> {| class=&quot;wikitable&quot;<br /> !Appli Archive Game<br /> !Games Included<br /> !Release Date<br /> |-<br /> |'''アプリアーカイブス ジャレコ シティコネクション'''<br /> Appli Archives: Jaleco City Connection<br /> |<br /> * City Connection DX<br /> * City Connection: Rocket<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア デュオローグ'''<br /> Appli Archives: Nippon Ichi Software Duologue<br /> |<br /> * Duologue<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス ジャレコ モモコ1200%'''<br /> Appli Archives: Jaleco Momoko 1200%<br /> |<br /> * Momoko 1200% Prequel<br /> * Momoko 1200% Sequel<br /> |2014.12.24<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック1'''<br /> Appli Archives: Nippon Ichi Software Mini Game Pack 1<br /> |<br /> * Elingya Puzzle DX<br /> * Going Down the Hill<br /> * The Throwing Prinnies<br /> |2015.01.14<br /> |-<br /> |'''アプリアーカイブス ジャレコ アーガス＆フィールドコンバット'''<br /> Appli Archives: Jaleco Argus &amp; Field Combat<br /> |<br /> * Argus<br /> * Buta-san<br /> * Exerion DX<br /> * Field Combat DX<br /> |2015.01.28<br /> |-<br /> |'''アプリアーカイブス ジー・モード バーガータイム'''<br /> Appli Archives G-MODE Burger Time<br /> |<br /> * BurgerTime<br /> * Pucchin Puzzle<br /> * Snowboard Man<br /> |2015.03.11<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック2'''<br /> Appli Archives Nippon Ichi Software Mini Game Pack 2<br /> |<br /> * Disgaea: The Prinnies Strike Back<br /> * Nyanko Panel DX|Nyanko Panels DX<br /> * Nyanko Suberi DX|The Slipping Nyanko DX<br /> |2015.04.28<br /> |-<br /> |'''アプリアーカイブス チームライズ HumanFly'''<br /> Appli Archives Team Rise HumanFly<br /> |<br /> * HumanFly Kai<br /> * HumanFly 2<br /> * CIA Sniper Investigator DX<br /> |2015.05.27<br /> |}<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) Games ===<br /> Mobile Game Deployer was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8823 2023-10-03T03:00:33Z

<p>LNRC: /* Mobile Game Deployer (MGD) Games */</p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday'''''<br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> == Game-Specific Preservation Projects ==<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain [[DoJa]] files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> ==== Currently Accessible Appli Archives Games ====<br /> Any game not on this list lacks a publicly known license key in order to be decrypted.<br /> {| class=&quot;wikitable&quot;<br /> !Appli Archive Game<br /> !Games Included<br /> !Release Date<br /> |-<br /> |'''アプリアーカイブス ジャレコ シティコネクション'''<br /> Appli Archives: Jaleco City Connection<br /> |<br /> * City Connection DX<br /> * City Connection: Rocket<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア デュオローグ'''<br /> Appli Archives: Nippon Ichi Software Duologue<br /> |<br /> * Duologue<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス ジャレコ モモコ1200%'''<br /> Appli Archives: Jaleco Momoko 1200%<br /> |<br /> * Momoko 1200% Prequel<br /> * Momoko 1200% Sequel<br /> |2014.12.24<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック1'''<br /> Appli Archives: Nippon Ichi Software Mini Game Pack 1<br /> |<br /> * Elingya Puzzle DX<br /> * Going Down the Hill<br /> * The Throwing Prinnies<br /> |2015.01.14<br /> |-<br /> |'''アプリアーカイブス ジャレコ アーガス＆フィールドコンバット'''<br /> Appli Archives: Jaleco Argus &amp; Field Combat<br /> |<br /> * Argus<br /> * Buta-san<br /> * Exerion DX<br /> * Field Combat DX<br /> |2015.01.28<br /> |-<br /> |'''アプリアーカイブス ジー・モード バーガータイム'''<br /> Appli Archives G-MODE Burger Time<br /> |<br /> * BurgerTime<br /> * Pucchin Puzzle<br /> * Snowboard Man<br /> |2015.03.11<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック2'''<br /> Appli Archives Nippon Ichi Software Mini Game Pack 2<br /> |<br /> * Disgaea: The Prinnies Strike Back<br /> * Nyanko Panel DX|Nyanko Panels DX<br /> * Nyanko Suberi DX|The Slipping Nyanko DX<br /> |2015.04.28<br /> |-<br /> |'''アプリアーカイブス チームライズ HumanFly'''<br /> Appli Archives Team Rise HumanFly<br /> |<br /> * HumanFly Kai<br /> * HumanFly 2<br /> * CIA Sniper Investigator DX<br /> |2015.05.27<br /> |}<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) Games ===<br /> Mobile Game Deployer was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficultly in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===C2 Cipher Code Decryption on SD Cards===<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> Currently, one of the members on the Rockman preservation team is executing the brute forcing. Results are expected within about a month.<br /> <br /> It's important to note that we don't know what the decrypted data looks like. There's a chance that it's fragmented (bad) or Java game files (good).<br /> <br /> * [https://gitlab.com/usernameak/mkb_bruteforce MKB Bruteforce] repo on GitLab<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8822 2023-10-03T02:59:30Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday'''''<br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> == Game-Specific Preservation Projects ==<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Appli_Archives Appli Archives] for PlayStation Mobile ===<br /> The Appli Archives are a series of feature phone re-releases. The PlayStation Mobile games contain [[DoJa]] files for each game, likely from original source. Game files and assets are drawn from a localhost server that runs within the PlayStation Mobile application. Because of use of localhost, these games cannot run directly in the DoJa SDK. However, some files have been made to run by hosting files on a localhost server on PC.<br /> <br /> PlayStation Mobile game packages use [https://www.psdevwiki.com/vita/PSSE PSSE encryption], which requires a game's original license key in order to perform decryption. Because of this, many of the Appli Archive files have not been decrypted, and their DoJa games have remained inaccessible. <br /> <br /> ==== Currently Accessible Appli Archives Games ====<br /> Any game not on this list lacks a publicly known license key in order to be decrypted.<br /> {| class=&quot;wikitable&quot;<br /> !Appli Archive Game<br /> !Games Included<br /> !Release Date<br /> |-<br /> |'''アプリアーカイブス ジャレコ シティコネクション'''<br /> Appli Archives: Jaleco City Connection<br /> |<br /> * City Connection DX<br /> * City Connection: Rocket<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア デュオローグ'''<br /> Appli Archives: Nippon Ichi Software Duologue<br /> |<br /> * Duologue<br /> |2014.12.17<br /> |-<br /> |'''アプリアーカイブス ジャレコ モモコ1200%'''<br /> Appli Archives: Jaleco Momoko 1200%<br /> |<br /> * Momoko 1200% Prequel<br /> * Momoko 1200% Sequel<br /> |2014.12.24<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック1'''<br /> Appli Archives: Nippon Ichi Software Mini Game Pack 1<br /> |<br /> * Elingya Puzzle DX<br /> * Going Down the Hill<br /> * The Throwing Prinnies<br /> |2015.01.14<br /> |-<br /> |'''アプリアーカイブス ジャレコ アーガス＆フィールドコンバット'''<br /> Appli Archives: Jaleco Argus &amp; Field Combat<br /> |<br /> * Argus<br /> * Buta-san<br /> * Exerion DX<br /> * Field Combat DX<br /> |2015.01.28<br /> |-<br /> |'''アプリアーカイブス ジー・モード バーガータイム'''<br /> Appli Archives G-MODE Burger Time<br /> |<br /> * BurgerTime<br /> * Pucchin Puzzle<br /> * Snowboard Man<br /> |2015.03.11<br /> |-<br /> |'''アプリアーカイブス 日本一ソフトウェア ミニゲームパック2'''<br /> Appli Archives Nippon Ichi Software Mini Game Pack 2<br /> |<br /> * Disgaea: The Prinnies Strike Back<br /> * Nyanko Panel DX|Nyanko Panels DX<br /> * Nyanko Suberi DX|The Slipping Nyanko DX<br /> |2015.04.28<br /> |-<br /> |'''アプリアーカイブス チームライズ HumanFly'''<br /> Appli Archives Team Rise HumanFly<br /> |<br /> * HumanFly Kai<br /> * HumanFly 2<br /> * CIA Sniper Investigator DX<br /> |2015.05.27<br /> |}<br /> <br /> === [https://japanesefeaturephones.miraheze.org/wiki/Mobile_Game_Deployer Mobile Game Deployer] (MGD) Games ===<br /> Mobile Game Deployer was a software that could easily convert i-mode applis into Android, iOS, and Windows Phone programs. A number of prominent feature phone game publishers used this tool to bring their games to the smartphone generation.<br /> <br /> The game [https://japanesefeaturephones.miraheze.org/wiki/Flyhight_Cloudia Flyhight Cloudia] was successfully extracted from an Android APK in a fully playable version. <br /> <br /> So far, other games have not been converted due to the difficult in finding original application files for early smartphone games. Not only are these games approximately 10 years old, but they were often distributed in provider-specific mobile game portals, rather than common application stores such as Google Play and the App Store.<br /> <br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===C2 Cipher Code Decryption on SD Cards===<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> Currently, one of the members on the Rockman preservation team is executing the brute forcing. Results are expected within about a month.<br /> <br /> It's important to note that we don't know what the decrypted data looks like. There's a chance that it's fragmented (bad) or Java game files (good).<br /> <br /> * [https://gitlab.com/usernameak/mkb_bruteforce MKB Bruteforce] repo on GitLab<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8803 2023-09-26T20:23:20Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> '''''SD CARD BRUTE FORCE LIVE STREAM HERE: https://www.twitch.tv/goodtofufriday'''''<br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===C2 Cipher Code Decryption on SD Cards===<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> Currently, one of the members on the Rockman preservation team is executing the brute forcing. Results are expected within about a month.<br /> <br /> It's important to note that we don't know what the decrypted data looks like. There's a chance that it's fragmented (bad) or Java game files (good).<br /> <br /> * [https://gitlab.com/usernameak/mkb_bruteforce MKB Bruteforce] repo on GitLab<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=File:HM_Release.pdf&diff=8800 2023-09-26T16:36:02Z

<p>LNRC: </p> <hr /> <div>Hack Manhattan's Release of Liability Form (Liability Waiver). Signers agree to Assumption of Risk, Release of Liability, Covenant Not to Sue, and Third Party Indemnification. This form must be signed in order to permit access to heavy equipment such as the band saw, soldering station, wooden lathe, etc.</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=File:HM_Release.pdf&diff=8799 2023-09-26T16:35:26Z

<p>LNRC: </p> <hr /> <div>Hack Manhattan's Release of Liability Form (Waiver). Signers agree to Assumption of Risk, Release of Liability, Covenant Not to Sue, and Third Party Indemnification. This form must be signed in order to permit access to heavy equipment such as the band saw, soldering station, wooden lathe, etc.</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8793 2023-09-22T04:23:15Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===C2 Cipher Code Decryption on SD Cards===<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> Currently, one of the members on the Rockman preservation team is executing the brute forcing. Results are expected within about a month.<br /> <br /> It's important to note that we don't know what the decrypted data looks like. There's a chance that it's fragmented (bad) or Java game files (good).<br /> <br /> * [https://gitlab.com/usernameak/mkb_bruteforce MKB Bruteforce] repo on GitLab<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8786 2023-09-20T00:59:32Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===**TOP PRIORITY** C2 Cipher Code Decryption on SD Cards===<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> Right now, plans are underway to attempt a collective brute forcing of device keys by combining the power of multiple GPUs on a Java-based server. The mechanism for accomplishing this is currently under development.<br /> <br /> It's important to note that we don't know what the decrypted data looks like. There's a chance that it's fragmented (bad) or Java game files (good).<br /> <br /> * [https://gitlab.com/usernameak/mkb_bruteforce MKB Bruteforce] repo on GitLab<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=User:LNRC&diff=8782 2023-09-13T21:30:08Z

<p>LNRC: /* Unabandonware */</p> <hr /> <div>My name is Ellen. I like retro gaming and tech. Nice to meet you!<br /> <br /> ==My Projects==<br /> <br /> ===[https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phone Wiki]===<br /> Wiki dedicated to flip phone games from Japan during the 2000s.<br /> <br /> ===Unabandonware===<br /> The name I occasionally use when posting about retro games.<br /> * [https://unabandonware.com/ Unabandonware.com]<br /> * [https://archive.org/details/@unabandonware Unabandonware] on Archive.org<br /> * [https://www.thingiverse.com/unabandonware/designs Unabandonware] on Thingiverse</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=User:LNRC&diff=8781 2023-09-13T02:53:41Z

<p>LNRC: </p> <hr /> <div>My name is Ellen. I like retro gaming and tech. Nice to meet you!<br /> <br /> ==My Projects==<br /> <br /> ===[https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phone Wiki]===<br /> Wiki dedicated to flip phone games from Japan during the 2000s.<br /> <br /> ===Unabandonware===<br /> The name I occasionally use when posting about retro games.<br /> * [https://unabandonware.com/ Unabandonware.com]<br /> * [https://archive.org/details/@unabandonware Unabandonware] on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8778 2023-09-09T02:49:06Z

<p>LNRC: </p> <hr /> <div>[[File:JapaneseFeaturePhones.jpg |thumb]]<br /> <br /> Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===C2 Cipher Code Decryption on SD Cards===<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> Right now, plans are underway to attempt a collective brute forcing of device keys by combining the power of multiple GPUs on a Java-based server. The mechanism for accomplishing this is currently under development.<br /> <br /> It's important to note that we don't know what the decrypted data looks like. There's a chance that it's fragmented (bad) or Java game files (good).<br /> <br /> * [https://gitlab.com/usernameak/mkb_bruteforce MKB Bruteforce] repo on GitLab<br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=File:JapaneseFeaturePhones.jpg&diff=8777 2023-09-09T02:47:01Z

<p>LNRC: Image from https://hitsave.org/feature-phone-gaming/</p> <hr /> <div>== Summary ==<br /> Image from https://hitsave.org/feature-phone-gaming/</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8776 2023-09-09T02:45:51Z

<p>LNRC: /* C2 Cipher Code Decryption on SD Cards */</p> <hr /> <div>Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===C2 Cipher Code Decryption on SD Cards===<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> Right now, plans are underway to attempt a collective brute forcing of device keys by combining the power of multiple GPUs on a Java-based server. The mechanism for accomplishing this is currently under development.<br /> <br /> It's important to note that we don't know what the decrypted data looks like. There's a chance that it's fragmented (bad) or Java game files (good).<br /> <br /> * [https://gitlab.com/usernameak/mkb_bruteforce MKB Bruteforce] repo on GitLab<br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8775 2023-09-09T02:45:31Z

<p>LNRC: </p> <hr /> <div>Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===C2 Cipher Code Decryption on SD Cards===<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> Right now, plans are underway to attempt a collective brute forcing of device keys by combining the power of multiple GPUs on a Java-based server. The mechanism for accomplishing this is currently in development.<br /> <br /> It's important to note that we don't know what the decrypted data looks like. There's a chance that it's fragmented (bad) or Java game files (good).<br /> <br /> * [https://gitlab.com/usernameak/mkb_bruteforce MKB Bruteforce] repo on GitLab<br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Notable Japanese Feature Phone Games ==<br /> Some notable titles from recognizable game series include:<br /> <br /> * [https://japanesefeaturephones.miraheze.org/wiki/Before_Crisis_-Final_Fantasy_VII- Before Crisis -Final Fantasy VII-] and [https://japanesefeaturephones.miraheze.org/wiki/Dirge_of_Cerberus_Lost_Episode_-Final_Fantasy_VII- Dirge of Cerberus Lost Episode -Final Fantasy VII-]: Games in the Final Fantasy VII metaverse that greatly expand upon its lore<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Professor_Layton_and_the_Mansion_of_the_Deathly_Mirror Professor Layton and the Mansion of the Deathly Mirror]: A unique Professor Layton title released exclusively for Japanese mobile phones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Kingdom_Hearts_coded Kingdom Hearts coded]: A story that covers events proceeding the finale of Kingdom Hearts II<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Persona_Mobile_Online Persona Mobile Online]: An entire Persona online MMORPG for cellphones<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Ni_no_Kuni:_Hotroit_Stories Ni no Kuni: Hotroit Stories]: A prologue to the Ni no Kuni series that takes place before Ni no Kuni: Dominion of the Dark Djinn<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Pok%C3%A9mate Pokémate]: The first Pokémon mobile game<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Nakayoshi_Chao! Nakayoshi Chao!]: A Chao virtual pet game for phones<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC https://wiki.hackmanhattan.com/index.php?title=Japanese_Feature_Phone_Preservation&diff=8774 2023-09-09T02:39:51Z

<p>LNRC: /* Motorola M702iG and M702iS */</p> <hr /> <div>Japanese feature phones is a category of mobile devices that were released (almost) exclusively in Japan between approximately 1999-2015. These phones contained many features that took over a decade to reach the rest of the world: game streaming, live TV, NFC tags, and more. These phones were developed by a variety of companies, each with their own proprietary hardware and software. Because of the diversity of phone models, the restrictive copyright protections, a separate set of proprietary internet protocols, and more, these phones and their games have been extremely challenging to preserve. <br /> <br /> == Current Preservation and Data Extraction Projects ==<br /> <br /> ===Sharp SH-10C===<br /> The Sharp SH-10C is a DoCoMo phone released in 2011. Attempts have been made to read the NAND chip on this phone, in part because its schematics were made public by the [https://fcc.report/FCC-ID/APYHRO00145 FCC]. Currently, there are no chip programmers that support its NAND chip (Toshiba TY00D0021211KC) by default, and attempts at using a chip programmer have not reached past the bootloader. For more information, we recommend reading the report below. <br /> <br /> * [https://docs.google.com/document/d/1X3TN1QIvINPMDC6fmwo6vHCgAT377jOFM1zYkWZzdZY/edit?usp=sharing Report on Extraction of Data from DoCoMo Sharp SH-10C Mobile Phone] by Kraze<br /> * [https://lpcwiki.miraheze.org/wiki/Sharp_SH-10C Sharp SH-10C] on the Legacy Portable Computer Wiki<br /> <br /> ===Motorola M702iG and M702iS===<br /> The Motorola M702iG and M702iS are based upon the Motorola Razr that was released internationally. Due to the availability of information about these phones, their firmware has successfully been accessed through USB. It's possible to browse the entire file system on these phones using a RMCDA General Program.<br /> <br /> * M702iS/M702iG USB Drivers are required.<br /> * You will need RMCDA General Program. This will do something to the M702iS/G that open its file system up to P2K Commander. You will need information displayed on the screen to proceed to the next step.<br /> * P2K Commander will be able to access file system after using RCDMA General.<br /> * Java Games are located in KJAVA folder.<br /> <br /> ===Panasonic P-01F===<br /> The Panasonic P-01F successfully had its firmware extracted by unsoldering the eMMC and analyzing it with a chip programmer. This technique was also used for the '''Panasonic 301P''' and '''Panasonic 401PM'''.<br /> <br /> ===C2 Cipher Code Decryption on SD Cards===<br /> The microSD cards in Japanese feature phones hide copyright protected data using a C2 cryptomeria cipher. Cracking the C2 cipher requires three things: s-box, device keys, and a game-specific bind ID. Having the s-box and device keys allows us to find the bind ID. The s-box was discovered last year, but hackers are still searching for phone specific device keys. These device keys can be used across multiple game dumps, so it's not necessary to find each device's set of device keys for decryption to work. <br /> <br /> Right now, plans are underway to attempt a collective brute forcing of device keys by combining the power of multiple GPUs on a Java-based server. The mechanism for accomplishing this is currently in development.<br /> <br /> It's important to note that we don't know what the decrypted data looks like. There's a chance that it's fragmented (bad) or Java game files (good).<br /> <br /> * [https://gitlab.com/usernameak/mkb_bruteforce MKB Bruteforce] repo on GitLab<br /> <br /> ==Phones at Hack Manhattan==<br /> ===Panasonic P903iTV===<br /> The Panasonic P903iTV is a mobile phone developed by Panasonic and released in 2007. There is currently a disassembled version of this phone at Hack Manhattan undergoing repairs.<br /> <br /> * [https://lpcwiki.miraheze.org/wiki/Panasonic_P903iTV Panasonic P903iTV] on Legacy Portable Computer Wiki<br /> <br /> == Resources ==<br /> * [https://www.youtube.com/watch?v=tKH0x21rj1Y Japan's Game Preservation Crisis] by Did You Know Gaming<br /> * [https://hitsave.org/feature-phone-gaming/ Japanese Feature Phone Game Preservation: Uncovering a Forgotten Era of Gaming] on HitSave.org<br /> * [https://japanesefeaturephones.miraheze.org/wiki/Main_Page Japanese Feature Phones Wiki] (made by HM member Ellen!)<br /> * [https://docs.google.com/document/d/1fJdByYSfUPRFFAOixBX5BXx6sGkEc2uqX5verAgBhyc/edit?usp=sharing Feature Phone Preservation Resources] by Ellen<br /> * [https://archive.org/details/@dekafire Japanese Feature Phone PC Downloads] posted on Archive.org</div>

LNRC