Last edited March 22nd, 2004.

This document is an analysis of the NetMD check-in procedure over USB. It was taken from a MZ-N505 MD unit.

log of a successful check-in
log of a failed check-in
Find the original logs here

Sub-command 0x80.

00 18 00 08 00 46 f0 03 01 03 80 ff
09 18 00 08 00 46 f0 03 01 03 80 00
Start secure session???

Sub-command 0x11.

00 18 00 08 00 46 f0 03 01 03 11 ff
09 18 00 08 00 46 f0 03 01 03 11 00 01 00 00 08
2d cd 00 00
Get player id???

Sub-command 0x12.

00 18 00 08 00 46 f0 03 01 03 12 ff 00 38 00 00
00 38 00 00 00 01 00 00 00 09 00 01 00 01 00 00
00 00 01 ca be 07 2c 4d a7 ae f3 6c 8d 73 fa 60
2b d1 0f f4 7d 45 9c 72 da 81 85 16 9d 73 49 00
ff 6c 6a b9 61 6b 03 04 f9 ce
09 18 00 08 00 46 f0 03 01 03 12 01 00 38 00 00
00 38
Submit 40-byte sequence (EKB).

Sub-command 0x23.

00 18 00 08 00 46 f0 03 01 03 23 ff 10 01 00 00
09 18 00 08 00 46 f0 03 01 03 23 00 10 01 00 00
b8 7f fa de 34 16 47 62
GetHashId for track 1. Presumably the PC checks the hash id with its database. If the hash id does not match, the following sub-commands are not executed and the PC skips directly to the 0x81 sub-command.

Sub-command 0x20.

00 18 00 08 00 46 f0 03 01 03 20 ff 01 00 00 ad
50 2b 5c 69 77 02 85
09 18 00 08 00 46 f0 03 01 03 20 00 01 00 00 3a
a5 88 f9 6f 12 6a 0e
Exchange keys???

Sub-command 0x40.

00 18 00 08 00 46 f0 03 01 03 40 ff 00 10 01 00
00
09 18 00 08 00 46 f0 03 01 03 40 00 00 10 01 00
00 6c 29 02 3a 8e a5 b9 45
Get something related to track 1

Sub-command 0x40.

00 18 00 08 00 46 f0 03 01 03 40 ff 01 10 01 ff
fe
(6.5 seconds delay)
09 18 00 08 00 46 f0 03 01 03 40 00 01 10 01 ff
fe 02 41 c5 5d 96 fb 85 e8
Get something related to track '-1'. Not sure what happens during the delay.

Sub-command 0x21.

00 18 00 08 00 46 f0 03 01 03 21 ff 01 00 00
09 18 00 08 00 46 f0 03 01 03 21 00 01 00 00
Thrash keys???

Sub-command 0x81.

00 18 00 08 00 46 f0 03 01 03 81 ff
09 18 00 08 00 46 f0 03 01 03 81 00
End secure session???