Breaking Eggs And Making Omelettes

Topics On Multimedia Technology and Reverse Engineering


Meta:

Shortcut To The Treasure

November 17th, 2007 by Multimedia Mike

Followup: Some Reddit readers tackled this challenge and conquered it. Read up on it here.


Treasure Master (NES) cartridge

Back in the glory days of the old 8-bit Nintendo Entertainment System, I used to read my Nintendo Power magazine issues religiously. One issue that stood out to me, and that I never forgot about, is one that briefly mentioned Treasure Master (volume 26, July 1991, Robin Hood: Prince of Thieves issue).

This will be the first NES game where you can actually win prizes by playing it to the finish! The Game Pak will be released in the fall, and everyone will have time to master it. When you finish the game, you’ll reach a point where you can enter a speical password. In February of 1992, American Softworks will reveal the password that will allow you to play a secret portion of the game. The first person to finish the secret level and call in will win a $25,000 bond. Many of those who finish later will still be eligible for prizes– the sooner you finish, the better the prize. As you can imagine, the code is top secret, and the password system has been proven uncrackable by MIT and the CIA. (emphasis added)

Nintendo Power -- Robin Hood cover       Treasure Master (NES) -- Nintendo Power
click for larger image

So the gimmick for this substandard, side-scrolling, run & jump game was that players would buy it, play it, and build up skill in a few months. Then, after everyone has had a chance to get really good at the game, the company would release a password that would unlock a secret stage. Play through this stage and you could win big prizes.


Treasure Master (NES) -- Title screen

Naturally, the part about the uncrackable code caught my attention. I didn’t even realize the CIA provided such a vetting service. Anyway, I didn’t hear anything else about the game again. Many years passed and I saw the game in a used video game shop. I figured it was time to revisit the uncrackable code issue since I know a little more about computers and codes now. And I also know better than to accept an uncrackable code claim at face value.

How uncrackable is the code? The introductory blurb from Nintendo Power raises some questions, many of which can be answered by the Treasure Master instruction manual. The full details of the contest are provided. Apparently, the password was to be announced on MTV on April 11, 1992, probably during a commercial. Players would enter the password, along with their game cartridge’s unique serial number, in order to unlock the special levels of the game. Upon completion of the levels, the game would return a special winning number that the player could give to the operator on the other end of a 1-900 phone number to try to win a prize.

To be fair, the official manual doesn’t mention the uncrackable code nonsense. The James Bond material highlighted in the Nintendo Power preview can probably be attributed to some Marketing/PR flunkie at American Softworks working more closely with the magazine than their own engineering department.

Also, Nintendo really wants you to know that they have nothing to do with the contest:


Treasure Master (NES) -- Disclaimers

Threat Model
Read the rest of this entry »

Posted in Game Hacking, Nintendo, Reverse Engineering | 4 Comments »

Wii Motion JPEG

November 13th, 2007 by Multimedia Mike

Did you know that the Nintendo Wii can play user videos? I didn’t, but the Wii can apparently play videos through a user’s SD card. I also didn’t know what format they have to be converted into in order to be played back — Motion JPEG.


Nintendo Wii

There is a Windows program based on — what else? — FFmpeg called Wii Video 9 that handily converts anything into the accepted multimedia format. From the Sony PlayStation 3 and PSP to the Apple iPod and now the Nintendo Wii, the trend is for consumer electronics devices to be able to play user videos. But they usually support more advanced formats like MPEG-4 and H.264. I’m guessing that part of the Wii’s comparably low price is directly attributable to lower multimedia technology licensing costs.

I don’t know why I find it so humorous to read the Wii Video 9 forum posts, such as “Why are the converted files so HUGE?” I think we all need to respect that the deeper aspects of multimedia technology are not second nature to the general populace. One day, this stuff may truly be transparent and ubiquitous. Until then, Monsieur Scandragon has a point when he rants, “It doesn’t matter how bad it is at playing compressed video.. 10 seconds at BAD quality should NEVER be 25MB!!”

I have been too lazy to try the program myself. I wonder if it’s normal MJPEG data, or if it is unescaped data like that seen in the THP format common on the Nintendo GameCube. I also wonder about the audio format. Presumably, if they were too cheap to license MPEG-4 or H.264 video codecs, they’re not going to license MP3 or AAC either. I am guessing either straight PCM or their own custom ADPCM format.

Posted in Nintendo | 5 Comments »

GameCube Multimedia Review

October 6th, 2006 by Multimedia Mike

Poking around on a number of Nintendo GameCube games, I have found a pretty consistent mix of FMV formats. In due time, these will need to be entered into the MultimediaWiki:

  • THP files seem to be the most prevalent
  • H4M files have the markings of a hierarchical vector quantizer (like the letters ‘HVQ’); HVQ is also used in Sorenson Video 1 and LucasArts video
  • Electronic Arts games have a VID format which has similar markings as a number of their other evolved game multimedia formats
  • One game has 11,500+ Ogg Vorbis files; some of them appear to correspond via base filename to files with the extension .cib; I tend to think that these are corresponding video files
  • Sofdec files, as commonly seen on Sega Dreamcast games
  • DSP files, often paired as L and R files for stereo effect
  • occasional BIK files

Plus, there are a number of other audio files, probably encoded with a custom ADPCM format common on GameCube games.

Posted in Game Hacking, Nintendo | 3 Comments »

Caimans Video Codec

October 5th, 2006 by Multimedia Mike

Going back through some old posts, I decided to follow up on a codec named Caiman’s Video Codec For Gameboy Advance (new MultimediaWiki page). The official site has a number of movie trailers and anime clips encoded with some custom video and audio codecs. The interesting thing is that the samples are encoded as .gba files which are apparently ROM images that are able to be played in an emulator such as VisualBoyAdvance. Therefore, there are no clean multimedia container files (e.g., AVI) for study.


Caiman's Video in VisualBoyAdvance

Unsurprisingly, very few technical details are available. The technology page brags about how tweakable the parameters are, but mentions nothing about coding algorithms. Still, it’s interesting that these A/V codecs were designed and optimized for the Gameboy Advance.

Related Post:

Posted in Nintendo | 1 Comment »

My Very Own Search Engine

October 4th, 2006 by Multimedia Mike

Back in 1998, I started a web project called the Internet NES Database to catalog information about games for the greatest video game console system of all time, the Nintendo Entertainment System. I reasoned that a web database needed to be searchable but I couldn’t find any literature on exactly how to create a search engine. So I sat down and thought about it and came up with a solution. I eventually refined the idea and later wrote this article about the design decisions I made but never got around to publishing it anywhere. I came across the article on my hard drive recently and figured I may as well publish it in case someone, somewhere might find it interesting.


8-bit NES

It’s weird to think that I was building an elaborate search mechanism to index approximately 760 items (the total number of games in the database), though I had hoped to expand the database into something MobyGames-like in due time. Keep in mind that at the outset, while the data was managed in a MySQL database, the data was exposed online through a series of static HTML pages; this was 1998 and it was a little difficult and expensive to get database hosting on the internet. Thus, I could not directly query a database, and I had limited CGI scripting facilities.

Introduction

I present the approach that I took in developing a simple search engine for the Internet NES Database as well as the thinking and reasoning behind the design decisions. It’s not highly sophisticated, but if you don’t know anything about search engine operation, this should give you a starting point.

When I started developing my video game database in early 1998 I knew that it would be much more usable if it featured a search engine. I had no idea how to write a search engine. Web searches on topics such as “search engine theory” turned up thousands of pages claiming to reveal the secrets of getting high ranks in popular search engines. I realized that I was on my own. So I sat down and thought really hard about how to write a search engine.

Read the rest of this entry »

Posted in Nintendo | 2 Comments »

Zelda Quests On

September 10th, 2006 by Multimedia Mike

I do hope to one day follow up on more ZeldaClassic hacking. Meanwhile, John Berry/Ulf Magnet is beginning with some of my research and putting together his own Python utilities to work with the game’s data files.

Related posts:

Posted in Nintendo, ZeldaClassic | No Comments »

GameCube CVS

August 30th, 2006 by Multimedia Mike

When I started mounting GameCube disc images with my gcfuse utility, perhaps the strangest thing I found (apart from 11,500+ Ogg Vorbis files on one title) was intact CVS directory structures on a number of discs. Of course, CVS directories don’t give away much interesting detail; it’s not like there’s leaked source code living inside. Perhaps the most interesting thing is comparing the CVSROOT strings to information found in the MobyGames database. So, Yasunari Soejima, Hiroki Sotoike, and Fumihisa Sato: I just wanted to helpfully point out that you neglected to delete the CVS directories before creating the final disc images for certain GameCube games.


Magnifying glass

Posted in Game Hacking, Nintendo | 1 Comment »

gcfuse, With Executable Support

August 26th, 2006 by Multimedia Mike

I upgraded my gcfuse utility tonight. The main change was to expose the primary game executable file when browsing a GameCube filesystem. The primary executable is stored as an implicit part of the filesystem, separate from the directory structure. Being able to easily read this file is a useful feature if, for example, someone wishes to get at these executables for the purpose of disassembly.

For example, when mounting the first disc image of one of my few GC games that I have actually completed, Metal Gear Solid:

$ ls -al mount/
total 1
dr-xr-xr-x 4 melanson users         0 Jul 15  2005 .
drwxr-xr-x 7 melanson users       760 Aug 26 21:48 ..
-r--r--r-- 1 melanson users        95 Jul 15  2005 .metadata
dr-xr-xr-x 4 melanson users         0 Jul 15  2005 audio
-r--r--r-- 1 melanson users 426387456 Jul 15  2005 demo.dat
-r--r--r-- 1 melanson users   1988128 Jul 15  2005 metal-gear-solid-the-twin-snakes-exe.dol
-r--r--r-- 1 melanson users      6496 Jul 15  2005 opening.bnr
dr-xr-xr-x 3 melanson users         0 Jul 15  2005 shared
-r--r--r-- 1 melanson users 198715392 Jul 15  2005 stage.dat

The executable file is metal-gear-solid-the-twin-snakes-exe.dol. The filename is a little long, which can happen since it is derived from the game title in the disc metadata, which can be nearly 1000 characters long. The GC executable format is known as DOL, probably short for Dolphin which was the codename of the GameCube during development.

I recognize that I’m likely the only person on the planet who cares about this utility but, hey, it’s my blog and what are blogs for if not to tell the world about the tedious minutiae of an individual’s life?

Related post:

Posted in Game Hacking, Nintendo, Open Source Multimedia | 2 Comments »

gcfuse

July 17th, 2006 by Multimedia Mike

I’m taking useless academic exercises to new heights. I wrote a utility called gcfuse that allows you to mount filesystems replicated, one way or another, from Nintendo GameCube DVDs.


Nintendo GameCube

What on earth for? I’ve heard tales of strange and wonderful FMV formats on those petite GameCube DVDs and I just had to know for myself. One game I’m playing right now is Metroid Prime, which has visuals that certainly appear to be pre-rendered multimedia files. Let’s find out:

$ gcfs metroidprime.gcm gcm/

$ ls gcm/
Audio         Metroid4.pak  NESemu.rel    SlideShow.PAK   metroid5.pak
AudioGrp.pak  Metroid6.pak  NESemuD.rel   TestAnim.Pak    opening.bnr
GGuiSys.pak   Metroid7.pak  NESemuP.rel   Tweaks.Pak
Metroid1.pak  Metroid8.pak  NoARAM.pak    Video
Metroid2.pak  MidiData.pak  SamGunFx.pak  client_pad.bin
Metroid3.pak  MiscData.pak  SamusGun.pak  default.dol

$ ls gcm/Video/
00_first_start.thp            08_GBA_fileselect.thp  attract9.thp
01_startloop.thp              AfterCredits.thp       creditBG.thp
[...]

Right away, a new multimedia format– THP. The GC-Linux project already has documentation about this MJPEG-like format. Samples, of course, are available for your inspection.

Posted in Game Hacking, Nintendo, Open Source Multimedia | 9 Comments »

More NES Password Madness

June 10th, 2006 by Multimedia Mike

I was perusing my old Nintendo Power issues today, as I am wont to do for no good reason, and I stumbled upon a forgotten bonus that the magazine shipped to its subscribers once upon a time– Top Secret Passwords:


Top Secret Password Guide cover
Click for a larger image, and to guess which game is covered by the level 8 password on the sticky note

Now I’m playing with power. They put a tremendous amount of work into that cover. Passports for not only the Principality of NES but also the Republic of SNES. I guess in the early 1990s, nothing said “top secret” quite like a portable phone. Luckily, the book features passwords for Solar Jetman, the present object of my password infatuation. I wonder if the official password validator accepts the secret password comprised of all ‘Q’s, or if that’s handled by a special case.

Not only is Solar Jetman covered in the book but when I opened the book a carefully folded piece of paper slid out. It contained a number of very neatly written passwords, including ones for every world in Solar Jetman! It doesn’t look like my handwriting, plus the paper includes passwords for games that I never would have been caught dead playing. What a mystery. It’s almost like someone meant for me to find these clues and take up the cause of researching these ancient Nintendo password systems.

The password book contains passwords for a number of games where the only information carried in the password is what level the player was on. For a number of such games, I did a quick string check through the respective ROM data for the passwords. It looks like no coders bothered to use straight string comparison techniques for password validation.

One can only guess what sort of international espionage thrillers influenced the book’s artists, but their conceptualization of incognito (and airplane markings) involved a lot of pink:


Codename: Pink
Click for larger image of Codename: Pink Gamer

Posted in Nintendo, Outlandish Brainstorms | 1 Comment »

« Previous Entries