MIL－CD一共出过7部。以下有关于这种格式的介绍，老外称这种格式是SEGA致命的错误，BLEAMCAST等自制软件就是利用了这个后门。
A History of Media and Booting on the Sega Dreamcast
The Sega Dreamcast has two known booting sequences--one for GD-ROMs and one for MIL-CDs.
MIL-CDs
MIL-CDs are special CD-ROMs with Dreamcast-bootable data. MIL-CDs are just multi-session CD-ROMs with a data track containing a bootsector on the last session. No one knows for sure why Sega allowed the MIL-CD format to exist. The only official Sega products that used the MIL-CD format were seven Japanese music CDs that had extra stuff on them when inserted in a Dreamcast. All unofficial products, like the Code Breaker, Gameshark, bleemcast!, VCD Player, etc. used the MIL-CD format. The MIL-CD format was the backdoor for software piracy and mainstream homebrew development on the Dreamcast. The inclusion of the MIL-CD format was a crucial mistake for Sega, as it it can be argued that piracy ultimately killed the Dreamcast, and the Dreamcast's failure killed off Sega as a hardware developer.
GD-ROMs
GD-ROMs (gigabyte-disc read only memory) are Sega's proprietary disc format, developed by Yamaha and based off of the CD-ROM standard. While a CD-ROM is an entire disc of a single density, a GD-ROM is split into three parts: low density, security ring, and high density. The low density part has two tracks in its session: a data track with some information about the game, and sometimes wallpapers and bonuses, and an audio track that warns the user that the disc is a Dreamcast disc. The low density tracks are able to be read in any CD-ROM drive. The security ring is a special divider that is used for authentication purposes. Before the Dreamcast will boot the disc, it checks for the security ring. This is to prevent pirate manufacturers from creating their own copies of Dreamcast GD-ROMs. Finally, the high density section of the GD-ROM holds about a gigabyte of data, allowing games to hold more data and making games not fit on a CD-R. In this session there can be a single data track or a mixture of audio tracks and data tracks.
GD-Rs
GD-Rs (gigabyte-disc recordable) are very similar to GD-ROMs, the most major difference being the lack of a security ring. Because of this, they will not boot without a special disc or a trick. The Sega "System Disc 2" GD-ROM is used to boot GD-R discs. If one does not own a System Disc 2, they can perform a swap trick, swapping a GD-ROM with a GD-R right after the security check has completed. GD-Rs can be recorded with a SEGA GD-Writer.
Booting GD-ROMs
As the Dreamcast is powered on with a GD-ROM inserted, it checks for the security ring and authenticates the disc. Once the disc is authenticated, it seeks to sector 45000 on the disc, and reads the first 16 sectors (32KB) it finds there, which is the Dreamcast bootsector, or IP.BIN. The IP.BIN contains information fields about the game (manufacturer, description, executable file, allowed regions, # of discs, etc.) and three executable areas for booting the game. The Dreamcast checks the name of the executable file (usually 1ST_READ.BIN or 0WINCEOS.BIN, but sometimes others) and loads this file into memory. The Dreamcast then executes the IP.BIN code, which causes the display of the Sega copyright screen and some system initialization. Then the Dreamcast passes off its control over to the executable file and the game begins.
Booting MIL-CDs
As the Dreamcast is powered on with a MIL-CD inserted, it checks the disc for multisession data. It then reads the first 16 sectors (32KB) of the last track of the MIL-CD, which is the Dreamcast bootsector, or IP.BIN. The IP.BIN contains information fields about the game (manufacturer, description, executable file, allowed regions, # of discs, etc.) and three executable areas for booting the game. The Dreamcast checks the name of the executable file and loads this file into memory. Unlike the GD-ROM booting method, when booting a MIL-CD, the Dreamcast does not directly load the executable file into memory, but it instead performs a descrambling function on the file. This means that the executable file must be in a scrambled format on the disc in order to be loaded into memory properly. The Dreamcast then turns off the GD-ROM drive, meaning that the disc can no longer be read. The Dreamcast then executes the IP.BIN code, which causes the display of the Sega copyright screen and some system initialization. Then the Dreamcast passes off its control over to the executable file and the game begins. In order to access the disc in the drive after it has been locked, the software must perform a "GD-ROM reset" hardware function. This function is performed automatically at startup of programs compiled with common development libraries such as KallistiOS.
Taking advantage of the MIL-CD "backdoor"
The pirate group Utopia discovered from work done by homebrew and commercial coders that it is possible to boot software from CD-ROMs (by creating MIL-CDs). Utopia created rips of GD-ROM discs, but these were not bootable because the GD-ROM drive was locked before binary execution, causing the games to crash immediately. Since Utopia was pirating programs, not creating their own, they couldn't just make their copies perform the "GD-ROM reset" trick. Utopia instead created the Utopia boot CD, which unlocked the GD-ROM drive and started the game from a disc that wouldn't boot on its own. They released this disc and some games. They soon disappeared from the Dreamcast scene, being arrested by German police, who could quite easily find them since they included their own faces in an image on the Utopia boot CD.
Creating self-booting pirate Dreamcast MIL-CDs
Many pirate games requiring the boot CD were released on the internet after the arrests of Utopia. However, pirate groups later learned how they could create self-booting discs that did not need the boot CD. They created multisession MIL-CDs and added two functions to the bootsector on their discs to solve the problems of the different booting sequence for MIL-CDs. The first function is a scrambling function--the Dreamcast loads the binary from the disc and descrambles it, creating invalid data, but the IP.BIN rescrambles the data, leaving correct executable data in memory. The second function is the "GD-ROM reset" function, which unlocks the GD-ROM drive, making it able to read from the disc after the game has booted. While previous games were for burning with CDRWIN, self-booting games, like the Utopia boot CD, were for burning in DiscJuggler, because CDRWIN does not support multisession files.
Differences between pirate games and the real thing
While pirate games and originals often provide an identical experience, this isn't always the case. A GD-ROM holds more data than a CD-R does, so data sometimes needs to be removed from the game in order to burn it. Sometimes groups can apply a few tricks to eliminate redundant data and still provide the same experience, but most oversized discs require sacrifices in order to be released. Groups will often lower the quality of audio and video files on the disc in order to squeeze them onto a CD-R. Some discs have no downsamplable material, and must be spread across multiple discs with certain spots within the game where the player must save the game and start from another disc. Sometimes groups have been innovative and wrote their own decompressor to compress files onto a CD-R, but this creates lag and increased load times. Besides the amount of data on a disc, pirate games are cracked for copy protection and obviously use the MIL-CD format or the bootCD format, both of which differ from the GD-ROM. Some rare, late-model US Dreamcasts and some special edition Japanese Dreamcasts are crippled and have the code for booting MIL-CDs removed from their BIOS, meaning that there is no way to play backups or unofficial software on the system without some sort of hardware modification (or an as-of-yet undiscovered additional backdoor). No PAL Dreamcasts are crippled in this manner. It commonly believed that changing the track type of the first session of a MIL-CD (from the typical audio/data to data/data) will allow it to be played on these crippled Dreamcasts, but this is a myth--the code for booting MIL-CDs is completely not present in the hardware.
GD-ROM images, large capacity CD-Rs, and emulation
Within recent times, GD-ROM images have become more widespread. These images are byte-for-byte what one would find on a GD-ROM. Dumpcast endorses the TOSEC standard, in which files must be dumped using the httpd-ack software and verified with other dumpers, and filenames must match the TOSEC Naming Convention. These images can be useful in many ways. Although the CD-R standard holds 700MB or 80min of information, there are other CD-Rs that are being manufactured that can hold 90min or even 99min of information. There are CD burners that can also burn more data on a standard CD-R than usual (one of these is called GigaRec). It is possible to use a GD-ROM image to create a game CD-R with no downsampled content or at least with less downsampled content than a game's pirate 80min-CD release. In addition, the nullDC emulator for Windows supports loading GD-ROM images and has good compatibility, which means one can play the game in its entirety on a PC. These files are the best method to preserve Dreamcast games for the future. It would surely be disappointing to play a ROM of Super Mario World only to find out that the music has been taken out; it would be equally disappointing to learn that about a Dreamcast game as the Dreamcast gets older and the amount of people emulating it increases. GD-ROM images are distributed as several files: a BIN or ISO file for each data track, a RAW file for each audio track, and a GDI file for track layout information.
Written by darcagn on July 5, 2007
