Wheel Of Fortune Gets Infinite Puzzles On NES

December 2, 2018 by Lewin Day 20 Comments

Wheel of Fortune is a television game show, born in the distant year of 1975. Like many popular television properties of the era, it spawned a series of videogames on various platforms. Like many a hacker, [Chris] had been loading up the retro NES title on his Raspberry Pi when he realized that, due to the limitations of the cartridge format, he was playing the same puzzles over and over again. There was nothing for it, but to load a hex editor and get to work.

[Chris’s] initial investigation involved loading up the ROM in a hex editor and simply searching for ASCII strings of common puzzles in the game. Initial results were positive, turning up several scraps of plaintext. Eventually, it became apparent that the puzzles were stored in ASCII, but with certain most-significant-bits changed in order to mark the line breaks and ends of puzzles. [Chris] termed the format wheelscii, and developed an encoder that could turn new puzzles into the same format.

After some preliminary experimentation involving corrupting the puzzles and testing various edge cases, [Chris] decided to implement a complete fix. Puzzles were sourced from the Wheel of Fortune Puzzle Compendium, which should have plenty of fresh content for all but the most addicted viewers. A script was then created that would stuff 1000 fresh puzzles into the ROM at load time to minimize the chances of seeing duplicate puzzles.

ROM hacks are always fun, and this is a particularly good example of how simple tools can be used to make entertaining modifications to 30-year-old software. For another take, check out this hack that lets the Mario Bros. play together.

Metroid, Zelda, And Castelvania Auto-Mapped With NES Emulation & Heuristics

August 30, 2018 by Lewin Day 11 Comments

The NES was one of the flagship consoles of the glorious era that was the 1980s. Many of the most popular games on the platform involved some sort of adventure through scrolling screens — Metroid, Super Mario, and Zelda all used this common technique. For many games, keeping track of the map was a huge chore and meant mapping by hand on graph paper or using the screenshots published in Nintendo Power magazine. These day’s there’s a better way. [Daniel] set out to automatically map these huge two-dimensional worlds, developing software he calls WideNES to do it.

WideNES is an add-on to [Daniel]’s own NES emulator, ANESE. As part of the emulator, WideNES can easily read the various registers of the NES’s Picture Processing Unit, or PPU. The registers of the PPU are used to control the display of the background and sprite layers of NES graphics, and by monitoring these, it is possible to detect and map out the display of levels in various NES games.

It’s an interesting piece of software that relies on a thorough understanding of the NES display hardware, as well as the implementation of some neat tricks to deal with edge cases such as vertical scrolling in The Legend of Zelda or room changes in games like Castlevania — the use of perceptual hashing is particularly genius. There’s source and more available on the project page, including a GitHub link, if you’re interested in getting down to brass tacks.

We’re impressed by the manner in which WideNES is able to so neatly map out these games of yesteryear, and can’t wait to see where the project goes next. [Daniel] notes that it should be possible to integrate into more popular emulators without too much trouble. If that’s not enough, check out this reverse-emulation Nintendo hack.

[Thanks to Michael for the tip!]

Find Your Level – Extracting NES Game Data Using Python

August 1, 2018 by Sven Gregori 8 Comments

Just this summer, the Nintendo Entertainment System had its 35th release anniversary, and even after years of discontinuation, it is still going strong in the hacker community. Exhibit A: [Matthew Earl]. For one of his upcoming projects, [Matthew] needed to get his hands on the background images of the NES classic Super Mario Bros. Instead of just getting some ready-rendered images and stitching them together, he decided to take care of the rendering himself, once he extracts the raw game data.

Since there is no official source code available for Super Mario Bros, [Matthew] used a disassembled version to get started looking for the image data. To avoid reading through thousands of lines of assembly code, and to also see what actually happens during execution, he wrapped the game’s ROM data into py65emu, a Python library emulating the 6502, the CPU that drives the NES. By adding a simple wrapper around the emulator’s memory handler that tracks reads on uninitialized data, [Matthew] managed to find out which parameters he needs to feed to the parser routine in order to get the image tile data. After an excursion into the Picture Processing Unit (PPU) and its memory arrangements, [Matthew] had everything he needed to create the Python script that will render the game background straight from its ROM data.

Even if extracting NES game data is not your thing, the emulator concept [Matthew] uses might be still worth a read. On the other hand, if you want to dig deeper into the NES, you should definitely have a look at emulating an SNES game on a NES, presented on the NES itself.

A Lightgun For LCDs – Thanks To Maths!

June 28, 2018 by Lewin Day 47 Comments

Light guns were a fun way to learn to shoot things on consoles, enjoying their heyday in the 80s and 90s. The original designs largely relied on the unique characteristics of CRT televisions and the timing involved in the drawing of their frames. Unfortunately, due to a variety of reasons (dependent on the exact techniques used), they typically do not work at all with modern LCD & plasma screens.

The light gun contains a camera, and reportedly works by using the distortion of the rectangular image of the screen to calculate the position of the light gun itself.

Recently, there has emerged a new project called the Sinden Lightgun. In the How It Works video, it seems to use a fairly standard 30fps camera inside the gun to image the television screen being used by the game. The display is then rendered in 4:3, letterboxed on a 16:9 aspect ratio display, within a rectangular bezel. The image from the camera is then processed, and the distortion of the game image is used to calculate the position of the gun and the direction of its aim. Processing is handled by the host computer running MAME and the requisite coordinates are fed back in to the game code.

The basic concept seems sound, though as always, there’s a healthy amount of skepticism around the project. We’d love to hear your take, on whether the concept is plausible, and whether the lag figures stated are cromulent. We’re always excited to see new developments in the lightgun space! Video after the break.

Our own [Will Sweatman] penned an excellent piece on a variety of ways one could resurrect the venerable game of Duck Hunt, too.
Continue reading “A Lightgun For LCDs – Thanks To Maths!” →

Reverse-Emulating NES: Nintendception!

May 31, 2018 by Elliot Williams 32 Comments

This is a stellar hack, folks. [Tom7] pulled off both full-motion video and running a Super Nintendo game on a regular old Nintendo with one very cute trick. And he gives his presentation of how he did it on the Nintendo itself — Nintendo Power(point)! The “whats” and the “hows” are explained over the course of two videos, also embedded below.

In the first, he shows it all off and gives you the overview. It’s as simple as this: Nintendo systems store 8×8 pixel blocks of graphics for games on their ROM cartridges, and the running program pulls these up and displays them. If you’re not constrained to have these blocks stored in ROM, say if you replaced the cartridge with a Raspberry Pi, you could send your own graphics to be displayed.

He demos a video of a familiar red-haired English soul-pop singer by doing just that — every time through the display loop, the “constant” image block is recalculated by the Raspberry Pi to make a video. And then he ups the ante, emulating an SNES on the Pi, playing a game that could never have been played on an NES in emulation, and sending the graphics block by block back to the Nintendo. Sweet!

The second video talks about how he pulled this off in detail. We especially liked his approach to an epic hack: spend at least a day trying to prove that it’s impossible, and when you’ve eliminated all of the serious show-stoppers, you know that there’s a good chance that it’ll work. Then, get to work. We also learned that there were capacitors that looked identical to resistors used in mid-80s Japan.

These are long videos, and the first one ends with some wild speculation about how a similar human-brain augmentation could take a similar approach, replacing our “memories” with computed data on the fly. (Wait, what?!? But a cool idea, nonetheless.) There’s also another theme running through the first video about humor, but frankly we didn’t get the joke. Or maybe we just don’t know what’s funny. Comments?

None of that matters. A SNES game was played in an NES by pushing modified graphics from a “ROM” cartridge in real-time. And that’s awesome!

If you want more Nintendo-in-Nintendo goodness, check out this NES ROM that’s also a zip file that contains its own source code. If you compile the source, you get the zip file, which if you unzip gives you the source to compile. Right?

Continue reading “Reverse-Emulating NES: Nintendception!” →

This NES ROM Is A ZIP Of Its Source

February 6, 2018 by Eric Evenchick 12 Comments

Polyglots, in computing terms, are files have multiple valid meanings. We’ve seen some amazing examples of polyglot files in releases of The International Journal of PoC||GTFO. One example: a PDF that is also a ZIP, HTML file, and BPG image.

[Vi Grey] was inspired by PoC||GTFO’s release of a PDF/ZIP/NES ROM hybrid file for issue 0x14. Using a different method, [Vi] created a file which is both an NES ROM and ZIP, where the full contents of the ZIP are stored in the NES ROM.

When PoC||GTFO created their NES ROM polyglot, they stuck most the information outside the bounds of the NES ROM. While the file is valid, you’d lose the ZIP archive if it was burnt to a cartridge.

[Vi]’s polyglot is different. Rip it from a real NES cartridge and you get a ZIP file. Unzip it, and you get the source. Compile that source, and you get a valid ZIP file containing the source. Burn that to a cartridge and… hopefully you grok the recursion at this point.

The source and scripts to mangle the polyglot together are up on Github.

Reverse Engineering A Pirate Nintendo Arcade Board

January 12, 2018 by Lewin Day 23 Comments

The Nintendo VS. System was a coin-op arcade system based on the Nintendo Entertainment System (NES) hardware. By being so closely related to the home console, it made it easy to port games back and forth between the two. Being an arcade system, there was significant financial incentive to pirate the boards and games, and many years later such a pirate board landed on the desk of [kevtris], who decided to reverse engineer it for our viewing pleasure.

The board in question runs Super Mario Brothers, and rather than using actual Nintendo hardware it instead relies on a standard MOS 6502 to recreate all the functions of the of the original CPU. A Z80 is pressed into service to emulate the original audio hardware, too. With much of the functionality recreated in TTL logic chips, the board is power hungry, drawing a ridiculous 3 amps when powered up. We wonder as to the fire safety of such machines all crammed into a hot, sweaty arcade of yesteryear.

[kevtris] does a great job of reverse engineering the system, even providing a full PDF schematic for the bootleg board. An old SEGA controller is hand-wired into the board to provide both game controls and act as a coin switch to allow the game to be played.

We’d love to hear the story of how these machines actually came to be, and the design process involved, but for now that may remain one for the ages. Arcade piracy was something the big companies fought against for years, with varying success – and we’ve seen arcade DRM hacked before.

[Thanks to Jero32 for the tip!]

Continue reading “Reverse Engineering A Pirate Nintendo Arcade Board” →