Emulating Handheld History

March 19, 2018 by Brian Benchoff 32 Comments

There’s a certain class of hardware only millennials will cherish. Those cheap ‘LCD Video Games’ from Tiger Electronics were sold in the toy aisle of your old department store. There was an MC Hammer video game. There was a Stargate video game. There was a Back To The Future video game. All of these used the same plastic enclosure, all of them had Up, Down, Left, Right, and two extra buttons, and all of them used a custom liquid crystal display. All of them were just slightly disappointing.

Now, there’s an effort to digitize and preserve these video games on archive.org, along with every other variety of ancient handheld and battery powered video game from ages past.

Double Dragon. You remember this, don’t you?

This is an effort from volunteers of the MAME team, who are now in the process of bringing these ‘LCD Video Games’ to the Internet Archive. Unlike other games which are just bits and bytes along with a few other relatively easily-digitized manuals and Peril Sensitive Sunglasses, preserving these games requires a complete teardown of the device. These are custom LCDs, after all. [Sean Riddle] and [hap] have been busy tearing apart these LCDs, vectorizing the segments (the game The Shadow is seen above), and preserving the art behind the LCD. It’s an immense amount of work, but the process has been refined somewhat over the years.

Some of these games, and some other earlier games featuring VFD and LED displays, are now hosted on the Internet Archive for anyone to play in a browser. The Handheld History collection joins the rest of the emulated games on the archive, with the hope they’ll be preserved for years to come.

DIY Diner Booth With Cocktail Table Arcade

September 16, 2017 by Adam Fabio 3 Comments

[Glennzo] has a house with some odd interior design choices. The most glaring one is a living room/den complete with a green Jacuzzi hot tub straight out of the 1980s. The tub really didn’t fit with [Glennzo’s] plan to use the space as a bar and game room, so out came the Sawzall and demo hammer. The tub was in its own little alcove, possibly a converted closet. [Glennzo’s] turned the space into a restaurant style booth complete with a cocktail arcade table.

The fiberglass tub was relatively easy to cut up and remove. This left the wood framed tile tub surround. The surround was extended to become a booth seat. A bit of creative woodworking, some vinyl cushions, and the booth itself was ready. But what good is a booth without a table?

The cocktail table arcade machine is powered by a mini-tower running MAME. The monitor is an old 21″ LCD. The frame of the table is plywood and pine lumber, finished with stain and polyurethane. The illuminated buttons and interface came from an arcade control kit, which made wiring a snap. The table is topped off with a custom 3/8″ thick piece of glass.

The final product looks great and fits the room perfectly. Now [Glennzo] just needs a BarBot to finish off the perfect hacker and gamer paradise!

Toy Dash Turned Gaming Interface

August 30, 2017 by John Baichtal 15 Comments

We see a lot of MAME cabinets and other gaming emulator projects here on Hackaday, but it’s not often that we see one the form factor of which so elegantly matches the ROM. [circuitbeard] converted a Tomy Turnin Turbo toy dashboard into a mini arcade machine playing Outrun.

There are many fascinating details in [circuitbeard]’s writeup. His philsophy is to “keep it looking stock” so he went to great lengths to add functionality to various elements of the toy without changing its appearance. The gear shifter was turned into a 3-way momentary switch with high and low speeds at top and bottom, with rubber bands pulling the switch back the center (neutral) when he lets go of it. The original toy’s steering wheel mounts to a slide potentiometer. The dash has a working ignition switch that uses a PowerBlock to manage the safe startup and shutdown of the Pi. The dash also lights up the way you’d expect, and even displays accurate MPG and rev info.

For more MAME goodness here on Hackaday, see this broken tablet turned into a mini MAME cabinet or the portable MAME system of the future

Continue reading “Toy Dash Turned Gaming Interface” →

Completely Owning The Dreamcast Add-on You Never Had

July 17, 2017 by Elliot Williams 30 Comments

If you’ve got a SEGA Dreamcast kicking around in a closet somewhere, and you still have the underutilized add-on Visual Memory Unit (VMU), you’re in for a treat today. If not, but you enjoy incredibly detailed hacks into the depths of slightly aged silicon, you’ll be even more excited. Because [Dmitry Grinberg] has a VMU hack that will awe you with its completeness. With all the bits in place, the hacking tally is a new MAME emulator, an IDA plugin, a never-before ROM dump, and an emulator for an ARM chip that doesn’t exist, running Flappy Bird. All in a month’s work!

The VMU was a Dreamcast add-on that primarily stored game data in its flash memory, but it also had a small LCD display, a D-pad, and inter-VMU communications functions. It also had room for a standalone game which could interact with the main Dreamcast games in limited ways. [Dmitry] wanted to see what else he could do with it. Basically everything.

We can’t do this hack justice in a short write-up, but the outline is that he starts out with the datasheet for the VMU’s CPU, and goes looking for interesting instructions. Then he started reverse engineering the ROM that comes with the SDK, which was only trivially obfuscated. Along the way, he wrote his own IDA plugin for the chip. Discovery of two ROP gadgets allowed him to dump the ROM to flash, where it could be easily read out. Those of you in the VMU community will appreciate the first-ever ROM dump.

On to doing something useful with the device! [Dmitry]’s definition of useful is to have it emulate a modern CPU so that it’s a lot easier to program for. Of course, nobody writes an emulator for modern hardware directly on obsolete hardware — you emulate the obsolete hardware on your laptop to get a debug environment first. So [Dmitry] ported the emulator for the VMU’s CPU that he found in MAME from C++ to C (for reasons that we understand) and customized it for the VMU’s hardware.

Within the emulated VMU, [Dmitry] then wrote the ARM Cortex emulator that it would soon run. But what ARM Cortex to emulate? The Cortex-M0 would have been good enough, but it lacked some instructions that [Dmitry] liked, so he ended up writing an emulator of the not-available-in-silicon Cortex-M23, which had the features he wanted. Load up the Cortex emulator in the VMU, and you can write games for it in C. [Dmitry] provides two demos, naturally: a Mandlebrot set grapher, and Flappy Bird.

Amazed? Yeah, we were as well. But then this is the same guy emulated an ARM chip on the AVR architecture, just to run Linux on an ATMega1284p.

Revealing Capcom’s Custom Silicon Security

April 3, 2017 by Mike Szczys 52 Comments

Ask any security professional and they’ll tell you, when an attacker has hardware access it’s game over. You would think this easily applies to arcade games too — the very nature of placing the hardware in the wild means you’ve let all your secrets out. Capcom is the exception to this scenario. They developed their arcade boards to die with their secrets through a “suicide” system. All these decades later we’re beginning to get a clear look at the custom silicon that went into Capcom’s coin-op security.

Alas, this is a “part 1” article and like petulant children, we want all of our presents right now! But have patience, [Eduardo Cruz] over at ArcadeHacker is the storyteller you want to listen to on this topic. He is part of the team that figured out how to “de-suicide” the CP2 protections on old arcade games. We learned of that process last September when the guide was put out. [Eduardo] is now going through all the amazing things they learned while figuring out that process.

These machines — which had numerous titles like Super Street Fighter II and Marvel vs. Capcom — used battery-backed ram to store an encryption key. If someone tampered with the system the key would be lost and the code stored within undecipherable thanks to “two four-round Feistel ciphers with a 64-bit key”. The other scenario is that battery’s shelf life simply expires and the code is also lost. This was the real motivation behind the desuicide project.

An overview of the hardware shows that Capcom employed at least 11 types of custom silicon. As the board revisions became more eloquent, the number of chips dropped, but they continued to employ the trick of supplying each with battery power, hiding the actual location of the encryption key, and even the 68000 processor core itself. There is a 6-pin header that also suicides the boards; this has been a head-scratcher for those doing the reverse engineering. We assume it’s for an optional case-switch, a digital way to ensure you void the warranty for looking under the hood.

Thanks for walking us through this hardware [Eduardo], we can’t wait for the next installment in the series!

IPad Tossed Out For RetroPie Arcade Cabinet Redux

March 2, 2017 by Donald Papp 11 Comments

The naming and remixing in this project can get a little confusing to those unfamiliar with the different elements involved, but what [John Gerrard] has done is take a stylish mini arcade cabinet intended as a fancy peripheral for an iPad and turned it into an iPad-free retro arcade gaming cabinet. He also designed his own power controller for graceful startup and shutdown.

The project started with a peripheral called the iCade (originally conceived as a fake product for April Fool’s) and [John] observed it had good remix potential for use as a mini retro gaming cabinet. It was a good starting point: inexpensively purchased off eBay with suitable arcade-style joystick and buttons, a nice layout, and plenty of hacking potential. With a small variety of hardware from familiar sources like eBay and Aliexpress, [John] rounded up most of what he needed.

Continue reading “IPad Tossed Out For RetroPie Arcade Cabinet Redux” →

Extracting Sounds With Acid And UV

December 27, 2016 by Brian Benchoff 46 Comments

Toaplan was a Japanese video game developer in the 80s and early 90s, most famous for Zero Wing, the source of the ancient ‘All Your Base’ meme. Memeology has come a long way since the Something Awful forums and a pre-Google Internet, but MAME hasn’t. Despite the completionist nature of MAME aficionados, there are still four Toaplan games with no sound in the current version of MAME.

The sound files for these games is something of a holy grail for connoisseurs of old arcade games, and efforts to extract these sounds have been fruitless for three decades. Now, finally, these sounds have been released with the help of sulfuric acid and microscopes.

The sounds for Fire Shark, Vimana, Teki Paki, and Ghox were stored on their respective arcade boards inside the ROM for a microcontroller, separate from the actual game ROM. Since the fuse bits of this microcontroller were set, the only way to extract the data was decapsulation. This messy and precise work was done by CAPS0ff, who melted away the epoxy coating of the chip, revealing the microcontroller core.

Even without a microscope, the quarry of this hunt was plainly visible, but there was still no way to read out the data. The built-in read prevention bit was set, and the only way to clear that was to un-set a fuse. This was done by masking everything on the chip except the suspected fuse, putting it under UV, and checking if the fuse switched itself to an unburnt state.

The data extraction worked, and now the MAME project has the sound data for games that would have otherwise been forgotten to time. A great success, even if the games are generic top-down shooters.