Sega Dreamcast: how its security works and how it was hacked.


I like beer.

You may also like...

88 Responses

  1. wololo says:

    Nice article :) Was there a homebrew scene on the Dreamcast, or was it all about piracy?

    • Acid_Snake says:

      yes, there was a decent number of homwbrews, specially emulators (the amount of emus for the dc is comparable to that of the psp). If it weren’t for it’s short life spam, I’d say the dreamcast could have easily been the console with most homebrews

    • mlc says:

      Here’s a youtube video of some of the various homebrew apps (mainly emulators) for the Dreamcast… I believe at least some of these existed back when the Dreamcast was still being sold, although I would assume some are significantly newer than that.

      I’m not certain, but I could really swear that I had a couple of these emulators when I was still using my “hacked” Dreamcast. (though I played my Dreamcast extensively long after it’s “generation”, so I could easily be mistaken due to that)

      Also, I was going to ask Acid_Snake for a list of Mil-CD’s that were actually released for the Dreamcast (and presumably don’t work on newer models), but while researching it found that there were only 8:

      <blockquote cite="As far as I know there's only 8 official Mil-Cd. (There could actaully be more, but I couldn't found more)

      Checkicco – Checkicco no MIL-CD
      D no Shokutaku 2 – Original Sound Track+MIL
      dps – Heart Break Diary
      Hang The DJ
      Himitsu – Original Sound Track
      Kita he – Pure Songs and Pictures
      Snappers – 09 Chairs
      Space Channel 5

      Backups of some of these Mil-Cd seems to need some modifications
      (hacks) to boot on NTSC or PAL console (Beside Region Flags).

      FG " credits to -=FamilyGuy=- from the assemblergames forum.

      (found this info at

    • 30W says:

      There was a prety big homebrew scene and there still is!
      Loads of emulators were released for it.

      My dreamcast is still ready to fire up and it can play snes, megadrive, and a lota more.. a pc port of doom was actually released for it!

      It can play the backups as discibed above as well, but i still have the original game discs.

    • Huntyz says:

      Very nice I cant wait for the next one.

      Loved the DC days:)

  2. awesome post! :) thanks for sharing 😀

  3. Proto-Tyrant says:

    I find the dreamcast great, i have to of them.
    Is a nice news of the old dreamcast, the dreamcast have good games ^^ shenmue is one of a lot.
    I love the dreamcast :3

    mfg proto

  4. theking says:

    everytime i hear about dreamcast all i can think of is SHENMUE!!!!!, i wish there was a dreamcast emulator on the ps3 or the xbox360 :) – (one wish that may never come true)

    • warfaren says:

      There IS one for the 360, called nulldc-360
      It’s still under development but if you compile it from source you can try it out. I have, been playing some Soul Calibur on it, amongst a few other games that work.

    • Hellinferno says:

      Shennmue,Illbleed,Skies of arcadia,The house of the dead 2,Cannon spike.I wish someone work on that emulator because the one that’s on the internet doesnt work well at all,im just want to play skies of arcadia and illbleed again.

      • warfaren says:

        I haven’t tested any of those games myself but like I said it’s still under development, binaries are not even released yet.

        The original PC version of the emu however is much older and binaries have been available for a long time. If the games you listed work on the PC version, they will probably get fixed for the 360 version eventually. Again the source for the 360 is available on Github so any programmer can contribute to the project!

  5. n1ckzero says:

    Oww, memories *-* , My dreamcast doesn’t work, I miss it

  6. HappyJoe says:

    This was a really good article! Thank you!

  7. consoleandgadget says:

    Nice read…

  8. Dovlek says:

    Good article keep them coming

  9. gunblade says:

    i weardly like the system mainly cuz there controllers had that lil memory cards that also had that like digimon thing with like controll buttons.. what ever was the use or the ports for the sythem i remebr the thing had a phone modem that u could take out but i remeber that there was sumkind of port like the ps1 system had on the under nither of it like the add on thing for the game cube that lets u play gameboy advance games……

  10. Sunny-Tech-UK says:

    This is a very nice article,very interesting. Thank You. :)

  11. CJW says:

    Loved the DC…..those of us who used it heavily will remember that the first series of hacks you had to use a boot disc to defeat the security, then swap and boot your backup. Shenmue, Skies of Arcadia, JetGrind, Crazy Taxi, Grandia 2, 2K sports, the gun games, fishing games and racing games…..heck it was a great system despite its short life. It was not so much killed off by piracy as it was the PS2. Everyone had a psx and wanted to wait for PS2 so held off on buying it. Oh yeah don’t forget Phantasy Star online that used a modem and was the first real online craze on a console. It made incredible strides for the gaming world. For those that missed it you can get them for like $25 used in the US and .iso files are out there to be had and burned. Use good media like verbatim CDs and you will have no trouble. There were a *** load of games released in the EU market that never came to america including a lot of arcade games and compilations. Also Shenmue 2 was never released in the US but was in EU. It had japanese voice audio but english subtitles and for those that loved the first one it is worth getting a system just to play and continue the story. They put it out on X360 but redid the voice in english and the localization sucked….much better to play it on DC. I wish Sega would pull the Shenmue series back out of the closet and give us 3 on the new sytems. Playing sleeping Dogs right now on PS3 and that has got to be some sort of a spiritual sucessor!

    • Acid_Snake says:

      Yes, the first hack (Utopia boot disc) tricked the system into thinking it was a Mil-CD, after that it was discovered that you can insert that Mil-CD boot code into actual games, it’s called a selfboot game. I miss my dreamcast, it has a broken laser T_T

      • jlo138 says:

        The laser is fairly easy to replace. Especially since the DC uses regular screws. I believe there are only two types of screw in it and the other type is just a little bit longer. Those hold the controller ports in place. I think it’s either 3 or 4 of them. But seriously, even I’m not tech savvy but its pretty easy I’d say.

    • zoraktorok says:

      I forgot.. how many games were suppose to be in that series? I remember it being huge, something like 8….

  12. Mo G says:

    Any way to get a dreamcast emulator for the vita? That would be amazing to play these games because I never had a dreamcast.

  13. stOneskull says:

    i miss my dreamcast. got me reminiscing..

  14. jrazorman says:

    loved it thank you

  15. zorrodood says:

    this is all so fascinating for me, because the first console i had was the n64. i wasn’t even aware the all the other consoles before and i was so young back then, that i never would have thought about hacking and stuff. as boring as normal history is to me, video game history is fascinating.

  16. Leires says:

    Interesting as heck. Thanks for this.

  17. middey says:

    Wow great article. I like this kind of articles and I hope you write more about the old console hacking. I never had a dreamcast :(

  18. Devil says:

    How about vita? S this related to ps vita hacking system?

  19. YcO96Ps says:

    Yeah good and interesting article!
    thanks and keep’em coming! 😀

  20. ndh777 says:

    I actually enjoyed reading this! Please, write more of these!!

  21. Bosanova X says:

    Nice article, The Dreamcast gave me the love for Homebrew with the NES emulator.

    It enabled me to play Megaman 5 + 6 as we never got those titles in the UK.

    Beats of Rage was pretty sweet as well.

    I love the Dreamcast for the 2d capcom fighters and Sega arcade classics like house of the dead 2.

    Great memories

  22. mrSoczi says:

    I like this kind of lecture. Keep it up.

  23. slipk487 says:

    sold mine a few months before had had found out about burning games when i was younger, miss that console.

  24. Jd8531 says:

    I wish Sega would get back in the console business. Dreamcast 2 would be incredible.

  25. Zonic says:

    I’m happy that my Dreamcast still works. Now if you’ll excuse me I’m gonna go play some Q-Bert.

  26. me says:

    How about the Gamecube? Nintendo placed the IPL in an serial ROM but the data was encrypted. At boot the data was fetched and decrypted inside the Flipper ASIC. They used a linear feedback shift register to implement the decryption which required one bit to be shifted in and out at a time but they forgot to clear the LFSR after reading the completed byte so the decrypted data was shifted out on to bus! So the serial output line could be sniffed to get the IPL and reverse the algorithm so modchips could be used to replace to IPL ROM.

    • Acid_Snake says:

      Interesting, I’ll dig up some more about this, specially about G-O-Ds
      (their hacking method was the same as for the dreamcast)

      • me says:

        and that’s not even the biggest security failure by Nintendo. That honor goes to the geniuses who used strcmp instead of memcmp to verify the RSA signatures in the Wii. As for Microsoft, the use of TEA for the 1st boot loader hash in the second XBOX revision was really dumb.

    • CJW says:

      There was a soft hack for the GC as well. You had to use an action replay boot. The problem was with the GC laser, it was hard to get it to read any burned discs with consistency. I actually got a custom top for it that would let you use 5inch CDs and then I was able to find a brand media that worked pretty well……still a pain.

  27. dimy93 says:

    Cool article :)

  28. kill3r says:

    Great article.
    A small gift :
    Feel free to use this photo. I can provide a photo without my pseudo.

  29. tonyuk73 says:

    Happy days. The best console ever made.:-)

  30. Axel says:

    FYI: It’s possible to run games from a SD Card and you can connect the Dreamcast with a HDMI cable to your TV for a great picture quality.
    Most gamedata can be changed to allow better picture quality.
    Note: You need some additional software and hardware to do all this.

  31. ICYHEART says:

    I wiash the WII U playable download dreamcast Games. When it is happening I will lose all my Money.

  32. coffincolors says:

    Great read wololo, I’m guessing the memory issue is why my burned shenmue backup always crashes after the first cutscene

    • coffincolors says:

      Nope nvm, just poor quality cds. Coolest thing about burning dc games has gotta be the ability to add your own soundtracks

  33. Yes says:

    Would love to see DC games on the Vita… =)

  34. Stranno says:

    ReviveDC and DCRes FTW.

  35. zoraktorok says:

    Still have my dreamcast ( well, another one I bought a couple years ago) … Intresting tidbit for those still messing with it… DID YOU KNOW: Alot of games used wmv files for the audio… by replacing those you could create your own soundtrack for most games… I like them, but it was nice to have something other than offspring for crazy taxi… I also used DC to play divX files which were prety new at the time with few dvd players that supported it. I really cant beleive the system didn’t do better than it did…. I personally liked it more than the ps2…

  36. Aye Guy says:

    All i ask is that someone create a dreamcast emulator for the psp/vita

  37. CJW says:

    What there was only like 4 games worthing owning on the Jaguar……..No way PSP has enough power to emulate DC. The Vita could do it but if we would get a hacked Vita then a working DC emu wouldn’t mean so much. Sadly DC just wasn’t popular enough to get coders to work on emulators for it. If vita ever gets hacked then a good N64 or PS2 emulator would be the bomb!

  38. CJW says:

    Actually he was talking about he larger size games and one of the other soluttions was the worked out a compression scheme for some games. Not sure how it worked but I know some of the later dupes did use some sort of real time compression

  39. sam says:

    didnt the dreamcast play psx games also ? with a special disc?

  40. Mars says:

    Fun read Acid, can’t wait for more hacking history.

  41. Pirate Cat says:

    Dreamcast <3.

    At Zorak: NullDC does a decent job (occasional graphical weirdness aside).

  42. thevoiceover says:

    Like many here, I still have my DC (actually 3 of them) and bb adapters, vmus, and tons of games that I own legit! This was a great machine (even got FreeBSD running on it) SH4! I can say though that all the original hacks came from some guys with a special scsi burner that had gd-r firmware on it. Anyone remember the 90minute cd-r discs? They were able to rip and create a “boot” disc. these guys were called wither utopia or echelon (can’t remember.) it wasn’t until phase 2/3 that they figured out how to burn a “bootable” disc.

    Regardless, this system (developed by M$ w/ Sega) should have done better and I think Sega should have NEVER got out of the HW world.

  43. Reshiram says:

    Here’s what. I get about the Dreamcast:
    1. Its the only 3d game that was better than the ps2 because of Rainbow Six.
    2. Its the only System that can play audio from most games (CD player) if you guys didn’t know that. And now y’all saying it can be hacked? That is amazing

  44. Reshiram says:

    Sorry I mean better than ps1 lol

  45. shapeshifter0100 says:

    Great article Acid_Snake!! Must say I have been a playstation person for a long time with psps and ps2 fats…but looks like the other console scenes were more interesting than psp and ps2 scenes.hope to read more such interesting articles in the future too!!

  46. Tonakai says:

    This was an incredibly interesting post, Acid.

  47. Beak says:

    Great article. Enjoyed learning some about the Dreamcast.

  48. m_101 says:

    The GD-ROM were also burned in a reverse way and the GD-ROM Reader of the Dreamcast would also read in a reverse way.

    Standard CD-ROM Reader read CDs clockwise. Same for burner.

    Since the Dreamcast would read the GD-ROM anti-clockwise, tricks had to be used to properly burn ISO and such using standard CD Burner.

  49. 9rockky says:

    Dreamcast is the only console from Sega that’s not suck…

  50. atreyu187 says:

    The DC never used PSO to dump games. ypu are confused with the Gamecube and the PSO exploit. We used a coders cable fashioned out of a system link cable and teraterm to dump disc back then. It took about 24 hours per disc. Nw days we use the BBA and httpd-ack to dump a disc in under 30 minutes. And it has been proven time and again that using a PC to dump doesn’t give accurate results and why no one uses it as it isn’t a true 1:1 dump.

  51. zorlon says:

    I only came here due to one of my images being used, I honestly don’t care about that I was just curious (the nice label shot with the blue Mil-CD text that I put there myself) and the red marking out the important part of the label

    I do however find it odd that you state that v2 is not Mil-CD compatible after all the place you got the image from actually states that the v2 is a 50:50 version as it was part way through the production of the v2 consoles that Sega removed Mil-CD compat from there consoles, so the best way is via the date on the US models, PAL models do not have a date and I have never seen a v2 PAL console

  52. zorlon says:

    Oh and Mil-CD’s did get used officially only in Japan though

    I have a bunch of those myself, they are just video CD’s in effect but used SFD to encode the video, the sound for those are produced via CD-DA (Digital Audio Tracks)

    These are much higher quality to actual Video CD’s

    The menu for those is very basic, much the same as the CD player that is built into the Dreamcast, no Fast Forward or rewind, just skip forward/backward

    There are 3 extra’s on the menu, “Menu” “Info” “Internet”

    Menu = Video Track Menu it just has some very basic info on each video included

    Info = Track/Time/Status (e.g. PLAY STOP PAUSE)

    Internet = the usual web browser

    A few Official Mil-CD’s have extra audio tracks to what is used when the disc is booted and the video played

    These extra tracks can be played by the music player of the Dreamcast or in any other CD music player

  53. zorlon says:

    Also original Mil-CD’s had protection built into them, though this obviously did not stop us finding out how they created the Mil-CD format anyway.

    there is a PICTURES, folder (no it does not have any pics in it) that contains JACKET01.00J JACKET01.00N JACKET01.00S JACKET01.00T asides from the first file the rest of these files can not be extracted from the disc correctly, as I don’t know the exact method but I know the method Sony used for these PSX CD’s that has the same effect I will use that as an example.

    PSX CD’s use a header that is part of the disc rather than a direct part of the file (Sony used that for XA files and containers) these headers are targeted on those files but is only created when the disc is created not when the files are created, so although these header are directly linked to the files they are not part of the files and will cause an error on extracting, though the data can still be ripped you can’t then re-use that data on the target console.

  54. zorlon says:

    We have method of reading GD-Rom discs direct on PC

    3 variations of doing that (look at the redump wiki for info on that, myself I wouldn’t bother there, that and most GD’s are dumped now)

    Via Dreamcast we have a few options

    PSO not required or used as stated that is a GC method

    Network streamed the data direct from a GD to a Netwrok connection BBA or LAN modem required (You can possibly use the phone modem as well, using modded drivers ect ect on the PC side)

    DC coders cable (another direct connection to PC via a serial port, the Dreamcast end is just the serial port that was used for link up)

    SD Card (used via the serial port)

    There are possibly other methods as well asides from those

  55. zorlon says:

    Overburning is not going to destroy anything and you can’t get 1GB of data to even fit a 99min CD-R it is not possible, you can only get an extra few bytes to copy over using overburn I don’t even think you can get a full MB out of overburning, but I don’t remember the exact amount of data, your burner will only go so far before letting you know it can’t burn any more and give up then fail to close the disc, because there there is no room to burn the close info

  56. zorlon says:

    P.S. even if you have GD-R’s and a burner the Dreamcast can not boot these, you require a GD-R boot disc

    I will stop now I could possibly go on, most the info seems fine but there are some things that are either totally wrong or are miss leading

  57. Lance says:

    Excellent read, cheers !

  58. Chicky Ficky says:

    I burned my Roms using Alchol 120% or something similar. My Shenmue 2 worked fine, I just went to Youtube and followed directions, back in ’09 though. Nice article and thanks for the comments. Very informational.

  1. July 18, 2015

    […] like video playback. Immediately after a recover of a Dreamcast, hackers found that they could completely bypass a need for GD-ROMs and force a console to play unchanging CDs as if they were Mil-CDs. This meant that any Dreamcast […]

Leave a Reply

Your email address will not be published. Required fields are marked *

Most comments are automatically approved, but in some cases, it might take up to 24h for your comments to show up on the site, if they need manual moderation. Thanks for your understanding