Tutorial to unhide R18 files

[Megalexxx]

This tutorial is meant to help you "unhidding" files in R18 releases. Why ? Because it's quite frustrating not knowing what's on your CD, and you might need these files for selfboot purpose, for example.

I found all this by myself, and noone helped me. I'm a poor lonesome DC lover.
So all credits go to ME !


I'll work on R18's release of "Vermilion Desert".
This release is a quite hard piece of work : when you browse your burnt CD, nothing appears ! I think this is a good example for you, but you can do this with any other R18's release whith hidden files ("Panzer Front", ...).

Here we go.


First of all, you have to make an image of your CD. Use original release, or backup an already burnt CD.

Then, you'll have to find the name of one existing file on your CD. If you can see some files while browsing your CD with windows explorer, then note one name ("0GDTEX.PVR" for example). With "Vermilion Desert", nothing appears so you'll have to hexedit your image and look for "SEGAKATANA". You should find IP.BIN. Here, the 1st file read is written (81 bytes after "SEGAKATANA"). In "Vermilion Desert", you'll find "1ST_READ.BIN".

Now that you've got one name, do the following :
1) go at the very beginning of your image
2) look for the name of your file ("1ST_READ.BIN"). You should find it a first time. You've found a "fake TOC" : it's the Table Of Contents that windows explorer shows. It DOESN'T CONTAIN ALL THE FILES, so leave it here.
3) look for a 2nd "1ST_READ.BIN". You should find the real TOC. Here, you can find every files contained in your CD.

Now, the hard part :
4) you have to find "CD001" a bit before this TOC. Go there, and leave your cursor here
5) go down until you find loads of "0" AFTER the TOC (so after all the files names)
6) select a zone between "CD001" and one of these "0" bytes (any of these can do the job; try to select one of the first ones...)
7) choose "COPY"
8) go at the very beginning of your image
9) look again for the 1st "1ST_READ.BIN"
10) look again for "CD001" a bit before this fake TOC
11) place your cursor on this "CD001". Be sure you are EXACTLY were you were when you copied the real TOC.
12) choose "PASTE". It will replace the fake TOC by the REAL one.
13) save and exit

If you did all this right, you should be able to browse your image with any image tool, like "CDMage". But there's a little more thing to do to have a perfect image with no hidden files. R18 have hidden some files with another (much easier) method : ".associated" files.

13 bis) on your new TOC, look for hex value = "04 00 00 01 00 00 01". You should find this value before important files, such as "1ST_READ.BIN" and "IP.BIN".
14) change this value by "00 00 00 01 00 00 01"

15) save, exit and burn

Enjoy your fine release with no hidden files.
Thanx who ?

[jeffma68]

a question
every games have a ZZZZZZ folder
and there is a file called R18OUT.BIN in that folder
what's that file for?

[Megalexxx]

HEdit it, and you'll see.

To sign their release, they often create an almost empty directory containing some kind of dummy file and a text file. You can delete this "ZZZZZ" directory.

[Dreamcaster]

You are genious!

I have some R18's hidden discs (DX Life, Vermilion Desert, etc...)

I will try selfbooatable someday.

[Megalexxx]

Thanx.

These games are selfbootable.

[Slider One]

Hi Megalexxx, great tutorial

The thing is, though I read through it several times I'm still having a problem with a game. Namely Death Crimson 2. It seems that Eurasia released it, but it came actually from R18. Since it only has a Mode1-Track I suppose it's non-boot.
Well, I'm trying to selfboot it now.
I can browse and extract the files with CDmage 1.01.5 and Beta 5. Well I guess Eurasia already unhided the files then.
But when extracted there are still some files (00DEA.BIN , IP.BIN , and some others), that have the *.associated extension.
I'm a little confused now. Should I in this case still hexedit the CDI as you mentioned or simply rename the extracted files? If the first, then do I still have to find a faked TOC?

Never did something like this before...

[terminator]

i used isobuster or
daemon tools and then isobuster to open the image

then open options, file system settings

and unmark "ignore associated files"

then the files appear as macintosh files,
if my mind works so early in the morning.
now you can extract them like usual


maybe i have swapped a large movie with
smaller one, but that may not neccessary

[Slider One]

Yep, that's exactly what I did last night with Isobuster and the option you mentioned. But I was still a little uncertain, if it worked right because I couldn't playback one of the two big SFD-Files (the small ones can be played in Virtual Dub, without sound of course). I just wanted to have a look on what these Videos are to find something to downsample. The whole files take up 700 MB, so I see two ways:

Downsample an *.sfd, BUT I heard DC Movie-Maker won't work under Win XP...

Downsample the huge *.afs, BUT it seems impossible to find either AFSLNK, or AFSencd or AFS-Shrinker on the net.

On the other side I CAN burn 90 min. CD-R's.
The main problem are these Internet Bin-Files (Maigo, etc), which need to be hacked. I usually wozld use I-Netfixer for this. But this proggie gives them the LBA 0. So I'd have to use Bin2Boot on it, BUT Discjuggler won't overburn any CD with the 2nd session afer 80 min. So I'm screwed.

If I knew how to hack all those four Bin's to 17002 (tried that with Sonic and failed), then I could overburn it with CDRecord as I burn my 90 min CD-R's usually. You see my problem?

The only thing I found that could be of any help would be the 45000-Trick. I never used it so far (and I'm not sure if I got what it does). So I guess I'll try that one... though any help is still appreciated

[terminator]

using the 45000 trick would´nt solve your problem,
cause you have to patch all relevant files to 45000

by the way its the same procedure as making 11700,
except you use two large audio.raw´s

these files need a patch:

00DEA.BIN
2_DP.BIN
MAIGO.BIN
SG_DPLDR.BIN

so i think you should do the the echelon way
step by step.

NO BATCH!

repeat the binhack part for all files
and binhack 00DEA.bin (the bootbin)at last.
i don´t know why this is important, but browsing back in this
forum gives the answer.


i think i have used a selfbooting patch
or i have just patched the bootbin and it works. i-net never tried.

i use some kind of plugin to watch the sfd files with media player

[Slider One]

According to all those threads I've read and some sites, it's said that with the 45000-trick there's no need to hack any of the Bin files because the LBA 45000 is the usual one where the DC is looking for them, and that also where the 2nd session starts when you make the Iso that way. I was also confused why this shuld work without patching the *.bin files, but that's how I understood the thing (what else could be the advantage of that trick?). I'd really like to know a little more bout that trick, if anyone can tell.

Well, as for my problem. I found all nesseccary tools for downsampling the ASF, and that could be enough.

As for the Binhacking thing. I never got to know what Binhack changes in the IP.BIN while hacking the other BIN's. I mean, it just seems as if the IP.BIN is overwritten everytime you hack one of the other BIN's. Nevertheless, if nothing else works, I'll have to try it this way.

So far BIG THANX to you, terminator!!

[terminator]

if you rip a game from a gd-rom, the lba is at 45000
and all relevant files point to 45000

the advantage is that the last dreamcast consoles produced
are protected against booting a lba smaller than 45000
and therefore people owning such a console need to make
the backups beginning at 45000.

cause this is the original value, no protection is possible.
but takes about 80mb space on cd so many games can´t made
selfboot by this. (audio-audio-data)

if you don´t own such a protected dreamcast its just
a 80mb dummy for you and therefore not useless.

binhack deletes a logo for example, if inserted before.
i agree with you, ip.bin is overwritten every time and this
is absolutely useless. but thats the way binhack works.
you can avoid using binhack if you use a hexeditor.
maybe i find time to find a batch solution for patching this 2 bytes.
imho:
binhack does nothing than calculate the given lba from dez to hex
and put it in the right place in the bootbin. and inserts the bootbin filename
in the ip.bin but by doing this it deletes everything in the
"custom" parts of the ip.bin

if i´m wrong please correct me!

[Slider One]

First of all thanx for the info, terminator

I just read at so many places about that trick, that I thought it would be of kinda "common" use, and not "only" for people who have the hardware to rip on their own.

As for my problem, I fixed it worthwhile. It wasn't too diffucult to downsample the afs a bit. So I able to use Inet-Fixer and Bin2boot and made it work

[Megalexxx]

Terminator : everything you said is right.
Just one more thing : "45000 trick" is sometimes usefull since some games have several references to this LBA, so if you don't know where they are, you can't patch them, so you can't make your game selfboot with another LBA.

Slider One : ".associated" files have nothing to see with what I call "Fake TOC". It's just an easy way to hide files. To get these files, you can either rename them, or use another tool to extract them, or use my tutorial at step 13 bis)

[VoVak]

i have repack game Canvars (sb jap r-18)
corruption file voicem.afs i trying repair with program BadCopy. I did it i
get file 100% then i trying extract file form cd no look file
hiding. how i make unhide file. How i can make image if file
corruption.
sorry my awful language.

[VoVak]

other medot make cdi image then convert in iso with cdirip
and extract files from iso with Winrar
i trying this when make Selfboot for Nadesico.
i make iso from nb disk then extract with winrar.