Rare Arcade Game Teardown And Mods

[Video Game Esoterica] loves a 1990s video game called Operation Tiger. Apparently, there are only a few of these known to exist in 2023, and he managed to find one of them. Well, it is really just a module so he has to figure out how to give it enough input and output to be actually playable. You can see several videos of his work with the Taito game below.

The board has a lot of ICs and a Power PC to handle the 3D graphics. The graphics seem clunky today, but they were impressive for the time. According to the video, the CPU board was only used for this game. The ROM that holds the software is separate with a mix of mask-programmed memory and EPROMs.

The machine is meant to live in an arcade box. So wiring things like coin selectors, video, speakers, and controllers is a non-trivial exercise. The wiring paid off, though, as the board started up but with no buttons, it wasn’t able to start in the first video. The controls go through a 60-pin connector and he tackles that project in part two.

The next step is to actually update the game software, which is hard but possible. Of course, you can run many of these old games with MAME or, if you prefer, use it to score that primo engineering workstation you used to covet.

Continue reading “Rare Arcade Game Teardown And Mods”

RGB Graphics On A DEC Rainbow With Reverse-Engineered Monitor

One of the delights of the boring pre-VGA era is that you get to express your creativity when it comes to making a random color CRT work with an equally exciting dual CPU computer like the DEC Rainbow 100. This is the situation that the folk over at Usagi Electric found themselves in with a recent project. The Rainbow 100 is an interesting computer in that it can boot not only DOS with its 8088 processor, but also CP/M on the Z80 processor. Although generally used in monochrome mode, it supports a color graphic card to output RGB signals via its male DB15 connector.

DEC Rainbow 100 to Princeton Ultrasync adapter. With strain-relief zip tie.
DEC Rainbow 100 to Princeton Ultrasync adapter. With strain-relief zip tie.

Unfortunately, the target monitor – a Princeton Ultrasync – featured a female DB25 connector that obviously wasn’t going to connect directly, thus requiring a spot of reverse engineering. Making this very easy, the PCB containing the input connector had the traces clearly marked with the intended signal, which just left the mapping of the two connectors. One complication here was with the Rainbow 100 outputting an RGB signal with sync-on-green, whereas the monitor expected a separate synchronization signal.

Fortunately, most analog monitors aren’t particularly fussy so long as they get the expected signal somewhere in the input, which just left the final issue, of the Rainbow 100 outputting the monochrome signal on a special monochrome pin. This allowed everything to work as it should, and leaving those of us who joined the computing era in the 90s appreciative of standard VGA cables, other than for those weird Sun and Apple systems with their proprietary connectors.

Continue reading “RGB Graphics On A DEC Rainbow With Reverse-Engineered Monitor”

An Unexpected Appearance Of An Iconic Motorola Chip

Big Clive's reverse-engineered schematic of the USB charger containing the MC34063 IC.
Big Clive’s reverse-engineered schematic of the USB charger containing the MC34063 IC.

Generally when you crack open a cheap car-to-USB charger unit that came with some widget, you do not expect to find anything amazing inside. That’s why it was such a surprise to [Big Clive] when said car USB charger revealed a blast from the past in the form of an MC34063. This is a switching regulator that supports buck, boost and inverting topologies, but perhaps it most notable feature is that it was first produced by Motorola in the early 1980s.

This particular IC is marked as having been produced by ON Semiconductor which means that it’s technically still manufactured by Motorola – with ON Semiconductor being the Phoenix division that was spun off in 1999 – but it’s somewhat remarkable that this particular chip isn’t only produced by ON Semi today, but also by Texas Instruments. Much like the venerable NE555 timer IC and Intel’s 8051 MCU architecture, it would seem that certain chips and designs are simply made to become commodities in the future.

This appears to be the case for the MC34063 as well, which may lack some niceties of more modern ICs, such as built-in thermal protection, and it switches at only up to 100 kHz, but it can be bought for peanuts, has a wide input voltage range of 3 to 40 V, can switch up to 1.5 A and supports multiple common topologies. Often a 100 kHz switching regulator is all you need, in which case it’s handy to have a stack of such commodity chips lying around, plus the MC34063 comes in PDIP packaging as well, which is a boon for prototyping.

Continue reading “An Unexpected Appearance Of An Iconic Motorola Chip”

Decompiling Sonic Runners

Usually, when you hear about games being decompiled and rebuilt, the games are often decades-old relics, loving and saved from the ravages of time. [MattKC] recently set out to decompile the 2015 game Sonic Runners.

The game was a 2D endless runner released on mobile platforms. Despite getting praise for the gameplay, it received mixed reviews for the pop-up ads and pay-to-play elements. A little over a year later, the game was discontinued. However, the game required a constant online connection, so once the servers were offline, it rendered the over five million downloads unplayable.

A team of developers worked to reverse engineer the server, and with a little bit of binary hacking, the client could be patched to connect to a community-hosted server instead. However, as phones with notched displays came out and suggestions for improvements stacked up, the community realized a new client would bring immense benefits. Compared to many decompilation projects, Sonic Runners was pretty easy as it uses Unity, which means most of the code is in C#. Unfortunately, the build of Unity used by the game is from 2012, meaning many of the tools designed for much later versions of Unity were inoperable.

However, one native code library called UnmanagedProcess was designed to confuse reverse engineering efforts. The library handled AES encryption and communication with the server. Luckily, the library was a later addition, and earlier versions of its functions still lingered in the C# code. Since an open source server already existed, it was trivial to validate the changes. Additionally, all the shaders were in OpenGL Shading Language (GLSL), which meant rewriting them in High-Level Shading Language (HLSL) and checking that they matched the original GLSL when building for Android.

Now the client has new game modes, no ads, and a proper offline mode. The community continues adding new features and refining the game, which is very satisfying. If you’re curious about reverse engineering, [Matthew Alt] can help you get started.

Continue reading “Decompiling Sonic Runners

Heartbeat packets of LKV373

Audio, Not Video Over The LKV373 HDMI Extender

[eta] found herself in a flat with several LKV373 HDMI extenders. Find the corresponding transmitter, plug it into your device, and you’ve got a connection to the TV/sound system, no fussing with wires behind the TV. However, [eta] wanted to get rid of the need to plug in a laptop and start sending packets directly to play music. As her flatmate [dan] had already reverse-engineered the receiver, she tested her prototype against their virtualized receiver, de-ip-hmdi.

The actual sending of images was surprisingly straightforward — just a JPEG sliced into 1024 bytes chunks and sent over. However, early testing showed nothing on the receiver. The end of a frame needed marking by setting the most-significant bit of the chunk number to one. Now de-ip-hdmi showed the image, but the actual hardware would not. With something missing, [eta] returned to Wireshark to scan packets. Noticing some strange packets on port 2067, she analyzed the pattern to reveal it sent another packet just before a new frame and included the frame number. With this tweak, it was still not enough. Ultimately, heartbeat packets sent every second synchronize things, but compared to the noise of the video packets, they were easy to miss. Now [eta] had some functioning video streaming rust code.

In theory, audio for the LKV373 followed the same thought process as video. Two channels of 32-bit big Endian integers at 44,100 hz chunked into 992-byte sections and sent as a packet formed the audio stream. With only 992 bytes, two streams, and 4 bytes per sample, each packet only held 2.812 milliseconds of sound. The first tests resulted in no audio output or distorted crunchy sound. Of course, this was every audio engineer’s worst nightmare: jitter. With a spin loop and an efficient ring buffer, the audio packets were soon slinging across the network reliably.

The code is available on a hosted version of GitLab. It’s a beautiful journey through reverse engineering some obscure but relatively cheap hardware. Along the way, there is nicely annotated Rust code, which makes it all the better.

Closing In On A PC Enabled PSVR2

When the PlayStation VR2 headset was released, people wondered whether it would be possible to get the headset to work as a PC VR headset. That would mean being able to plug it into a PC and have it work as a VR headset, instead of it only working on a PS5 as Sony intended.

Enthusiasts were initially skeptical and at times despondent about the prospects, but developer [iVRy]’s efforts recently had a breakthrough. A PC-compatible VR2 is looking more likely to happen.

So far [iVRy] is claiming they have 6 DOF SLAM (Simultaneous Localisation and Mapping), Prox sensor, and stereo camera data.

Most of the juicy bits are paywalled behind [iVRy]’s Patreon.  We’re hoping the jailbreak process will eventually be open-sourced.

The PS VR2 headset is quite unlike a PC VR headset in a number of ways, and it has not been historically easy to work with Sony’s products from a reverse-engineering perspective, whether it’s an attempt to improve the user experience of an annoying headset, or an attempt to understand the not-even-remotely-sanely-designed protocols behind the Sony Memory Stick. Getting the PS VR2 headset to work in a way it wasn’t intended was expected to be an uphill battle.

It’s not a finished job, but judging by the progress regularly shared on [iVRy]’s Twitter account, it might only be a matter of time.