At first glance, the adoption of the proprietary GD-ROM format was a strong deterrent to the production of unauthorised copies and their use on non-Dreamcast hardware. Games are also region-locked, meaning that the console refuses to run a game intended for a different geographical region.
Thus, attention turns towards MIL-CDs: as they rely on the standard CD medium, they become a potential (and affordable) attack vector for executing third-party code on the console. To mitigate this, Sega included another layer of protection: it required MIL-CD executables (1ST_READ.BIN) to be obfuscated using a simple block permutation algorithm . The BIOS then applies the inverse algorithm to reconstruct the executable in memory. Overall, this system didn't make use of a secret key, and only Sega knew the implementation of this algorithm, meaning its defence relied entirely on obscurity.
Additionally, after the BIOS descrambles the executable in memory, it locks the disc drive, requiring the MIL-CD application to manually reinitialise the drive . This is an extra layer meant to prevent a somehow-pirated GD-ROM game from executing immediately afterwards.
The painful defeat
As you may already know, security is only as strong as the weakest link. GD-ROMs were very secure by design, but MIL-CDs were not (hence Sega adding layers on top). Unfortunately for the company, relying on the secrecy of the MIL-CD algorithm proved to be a fatal flaw that compromised the entire security model.
At the start of 2000, independent distributors such as Datel and Bleem! released unauthorised Dreamcast software that booted as MIL-CDs . While they didn't reveal how this was achieved, the same year saw major breakthroughs:
- Homebrew developer Marcus Comstedt reverse-engineered and documented the algorithm that scrambled MIL-CD executables .
- Undocumented methods were employed to extract the contents of GD-ROMs, presumably using development hardware and/or modified readers.
- The hacking group Utopia replicated the logic behind Datel's Action Replay to construct a CD bootstrapper that unlocked the drive before executing a MIL-CD program .
The combination of these discoveries soon led to an influx of unauthorised software (e.g. independent games, cheat loaders, movie players, emulators, etc.) disguised as MIL-CDs to bypass Sega's protection. Alongside this, a surge in third-party development tools (e.g. libronin and libdream/KallistiOS) allowed homebrew development to thrive.
On the other side of the coin, piracy groups were now able to extract the contents of GD-ROMs and repackage them as bootable MIL-CDs. These also took advantage of IP.BIN's space for initialisation code to embed a 1ST_READ.BIN unscrabler routine and a disc reader unlocker , allowing games to boot without modifying their executables. Overall, this caused an unstoppable wave of 'game rips' to be released on the net.
Game piracy was not without further challenges, nonetheless. Although GD-ROMs can store around a gigabyte of data, CD-ROMs can fit only around 700 MB. So, how could 'rippers' shrink larger games to fit on a CD? Well, by recompressing music and graphics assets until they fit. Some games were even split across multiple discs. After all, game data is no longer stored as a single blob (unlike on an old cartridge), but is instead organised hierarchically into files and directories.
Two years after the Dreamcast's release, Sega began shipping consoles with a revised BIOS that patched the previous tricks by removing support for MIL-CD altogether . However, the change came too late to undo the damage.
A lesson for the future
I find it educational to point out that the Dreamcast's security missteps had already been predicted by 19th-century cryptographers such as Auguste Kerckhoffs, who stipulated that, for a cryptographic system to survive, one cannot rely on keeping the algorithm secret. Instead, an additional factor (i.e. a secret key) must be added. This explains why later competitors adopted key-based cryptographic systems instead.