Revealing Capcom’s Custom Silicon Security

April 3, 2017 by Mike Szczys 52 Comments

Ask any security professional and they’ll tell you, when an attacker has hardware access it’s game over. You would think this easily applies to arcade games too — the very nature of placing the hardware in the wild means you’ve let all your secrets out. Capcom is the exception to this scenario. They developed their arcade boards to die with their secrets through a “suicide” system. All these decades later we’re beginning to get a clear look at the custom silicon that went into Capcom’s coin-op security.

Alas, this is a “part 1” article and like petulant children, we want all of our presents right now! But have patience, [Eduardo Cruz] over at ArcadeHacker is the storyteller you want to listen to on this topic. He is part of the team that figured out how to “de-suicide” the CP2 protections on old arcade games. We learned of that process last September when the guide was put out. [Eduardo] is now going through all the amazing things they learned while figuring out that process.

These machines — which had numerous titles like Super Street Fighter II and Marvel vs. Capcom — used battery-backed ram to store an encryption key. If someone tampered with the system the key would be lost and the code stored within undecipherable thanks to “two four-round Feistel ciphers with a 64-bit key”. The other scenario is that battery’s shelf life simply expires and the code is also lost. This was the real motivation behind the desuicide project.

An overview of the hardware shows that Capcom employed at least 11 types of custom silicon. As the board revisions became more eloquent, the number of chips dropped, but they continued to employ the trick of supplying each with battery power, hiding the actual location of the encryption key, and even the 68000 processor core itself. There is a 6-pin header that also suicides the boards; this has been a head-scratcher for those doing the reverse engineering. We assume it’s for an optional case-switch, a digital way to ensure you void the warranty for looking under the hood.

Thanks for walking us through this hardware [Eduardo], we can’t wait for the next installment in the series!

IPad Tossed Out For RetroPie Arcade Cabinet Redux

March 2, 2017 by Donald Papp 11 Comments

The naming and remixing in this project can get a little confusing to those unfamiliar with the different elements involved, but what [John Gerrard] has done is take a stylish mini arcade cabinet intended as a fancy peripheral for an iPad and turned it into an iPad-free retro arcade gaming cabinet. He also designed his own power controller for graceful startup and shutdown.

The project started with a peripheral called the iCade (originally conceived as a fake product for April Fool’s) and [John] observed it had good remix potential for use as a mini retro gaming cabinet. It was a good starting point: inexpensively purchased off eBay with suitable arcade-style joystick and buttons, a nice layout, and plenty of hacking potential. With a small variety of hardware from familiar sources like eBay and Aliexpress, [John] rounded up most of what he needed.

Continue reading “IPad Tossed Out For RetroPie Arcade Cabinet Redux” →

Extracting Sounds With Acid And UV

December 27, 2016 by Brian Benchoff 46 Comments

Toaplan was a Japanese video game developer in the 80s and early 90s, most famous for Zero Wing, the source of the ancient ‘All Your Base’ meme. Memeology has come a long way since the Something Awful forums and a pre-Google Internet, but MAME hasn’t. Despite the completionist nature of MAME aficionados, there are still four Toaplan games with no sound in the current version of MAME.

The sound files for these games is something of a holy grail for connoisseurs of old arcade games, and efforts to extract these sounds have been fruitless for three decades. Now, finally, these sounds have been released with the help of sulfuric acid and microscopes.

The sounds for Fire Shark, Vimana, Teki Paki, and Ghox were stored on their respective arcade boards inside the ROM for a microcontroller, separate from the actual game ROM. Since the fuse bits of this microcontroller were set, the only way to extract the data was decapsulation. This messy and precise work was done by CAPS0ff, who melted away the epoxy coating of the chip, revealing the microcontroller core.

Even without a microscope, the quarry of this hunt was plainly visible, but there was still no way to read out the data. The built-in read prevention bit was set, and the only way to clear that was to un-set a fuse. This was done by masking everything on the chip except the suspected fuse, putting it under UV, and checking if the fuse switched itself to an unburnt state.

The data extraction worked, and now the MAME project has the sound data for games that would have otherwise been forgotten to time. A great success, even if the games are generic top-down shooters.

Hackaday Links: September 18, 2016

September 18, 2016 by Brian Benchoff 25 Comments

No Star Trek until May, 2017, at which time you’ll have to pay $5/month to watch it with ads. In the meantime, this is phenomenal and was shut down by Paramount and CBS last year ostensibly because Star Trek: Discovery will be based around the same events.

Tempest in a teacup. That’s how you cleverly introduce the world’s smallest MAME cabinet. This project on Adafruit features a Pi Zero, a 96×64 pixel color OLED display, a few buttons, a tiny joystick, and a frame made out of protoboard. It’s tiny — the height of this cabinet just under two wavelengths of the radiation corresponding to the transition between the two hyperfine levels of the ground state of the cesium 133 atom. Being based on the Pi Zero, it’s a capable arcade cabinet, although we would struggle to find a continuous rotation pot small enough to play Tempest the way it should be played. Check out the video.

[Graham] sent an interesting observation in on the tip line. It’s an election year in the US, and that can mean only one thing. It’s coroplast season. Coroplast is that strange material used for political signage, famous for its light weight, being waterproof, and reasonably strong, depending on how you bend it. There is a severe lack of coroplast builds, but if you have some be sure to send them in.

The ESP32, the followup to the hugely popular ESP8266 , is shipping. [Elliot] got his hands on one and found it to be a very promising chip, but the ESP3212 modules I bought from Seeed haven’t arrived yet. That hasn’t stopped [Ptwdd] from making a breakout board for the ESP3212, though. We don’t know if it works, but it’s just a breakout board, anyway.

The usual arguments for drones involve remote sensing, inspection, and generally flying around for a very long time. Quadcopters don’t do this, but fixed wings can. Over on DIYDrones, [moglos] just flew 425km on a single charge. The airframe is a 3 meter Vigilant C1 V tail, using the stock 300kV motor. The battery is a bunch of Panasonic 18650 cells arranged in 6S 9P configuration for 30600mAh. The all-up weight is 5.7kg. This is significant, and we’re seeing the first glimmer of useful tasks like pipeline monitoring, search and rescue, and mapping being done with drones. It is, however, less than half the range a C172 can fly, but batteries are always getting better. Gas goes further because it gets lighter as you fly.

Bartop Arcade RetroPie Powered Laser Cut

March 18, 2016 by Gerrit Coetzee 8 Comments

[hhtat] wanted to build an arcade cabinet since his days in high-school. Only recently have the tech planets aligned. Looking into the night sky he saw a laser cutter, the Raspberry Pi, and lowering prices on key components and thought, “this is the year.”

Much like an arcade cabinet we posted earlier, this one sits on a counter top. With full controls and a nice screen, it provides a lot of the experience without the additional explaining to the SO why the living space should house a giant decaled MDF box.

The frame was designed in SketchUp and vectors were made in Inkscape. The frame was lasercut out of MDF and Acrylic. Decals were printed and applied. The resulting case, build from tab and slot construction, is attractive.

The internals are simple. A Raspberry Pi with a fast SD card acts as the brain. Rather than make it difficult on himself, [hhat] bought a pre-made controls kit from eBay. Apparently there is a small market for this stuff. He also purchased an IPS screen with built in controller. The IPS panel gives the arcade cabinet a desireable wide viewing angle.

The final product looks like a lot of fun and we can see it turning at least one person into an unintentional loner at any house party.

Broken Android Tablet Mini-MAME Cabinet

March 6, 2016 by Elliot Williams 14 Comments

Everyone’s got an unused or even quasi-broken tablet lying around these days. [sairuk] has three kids, and somehow ended up with three broken tablets in short order. We’re not saying that correlation implies causality…

The digitizers were shattered, and since they were relatively cheap tablets to begin with, [sairuk] started thinking what could be done with a tablet that doesn’t have touch sensing anymore. He tried making an e-book reader for his kids, but somehow the idea of a MAME “cablet” (get it?) won out in the end. We’re not surprised: simple woodworking, gaming, and electronic hacking. What’s not to love?

This writeup goes into a lot more detail, so check that out too. He and his sons built up cardboard prototypes first (we love cardboard!) and then transferred their plans over to wood for the final “rough cut”. A PS1 controller reads out the joystick and buttons, and a PS1 -> USB adapter plus a USB-OTG cable connects that to the tablet. They also removed the batteries and built in a permanent power supply. Everything is simple and cheap, but the results are still impressive. Although they claim their build isn’t finished to the utmost, it looks pretty darn good to us.

We’re all frackers, so it’s satisfying to see a “junk” tablet put to good use. We’re wondering what [sairuk] is going to do with his other two tablets — we’ve got a suggestion for what he should do if he had twenty kids.

Continue reading “Broken Android Tablet Mini-MAME Cabinet” →

Saving Old Voices By Dumping ROMs

January 20, 2016 by Elliot Williams 41 Comments

Some people collect stamps. Others collect porcelain miniatures. [David Viens] collects voice synthesizers and their ROMs. In this video, he just got his hands on the ultra-rare Electronic Voice Alert (EVA) from early 1980s Chrysler automobiles (video embedded below the break).

Back in the 1980s, speech synthesis was in its golden years following the development of TI’s linear-predictive coding speech chips. These are the bits of silicon that gave voice to the Speak and Spell, numerous video game machines, and the TI 99/4A computer’s speech module. And, apparently, some models of Chrysler cars.

We tracked [David]’s website down. He posted a brief entry describing his emulation and ROM-dumping setup. He says he used it for testing out his (software) TMS5200 speech-synthesizer emulation.

The board appears to have a socket for a TMS-series voice synthesizer chip and another slot for the ROM. It looks like an FTDI 2232 USB-serial converter is being used in bit-bang mode with some custom code driving everything, and presumably sniffing data in the middle. We’d love to see a bunch more detail.

The best part of the video, aside from the ROM-dumping goodness, comes at the end when [David] tosses the ROM’s contents into his own chipspeech emulator and starts playing “your engine oil pressure is critical” up and down the keyboard. Fantastic.

Continue reading “Saving Old Voices By Dumping ROMs” →