Breaking Eggs And Making Omelettes

Topics On Multimedia Technology and Reverse Engineering


Archives:

V.Flash Format Experiments

December 27th, 2006 by Multimedia Mike

While babysitting the tedious resurrection processes of a number of Gentoo machines on life support, I took some time to put my money where my hypotheses were regarding the recently unearthed V.Disc multimedia formats. I lost. But you might be interested to see what I came up with anyway.

Read the rest of this entry »

Posted in Game Hacking, Reverse Engineering, VTech V.Flash | 11 Comments »

V.Disc Analysis

December 24th, 2006 by Multimedia Mike

I finally got around to prying open that V.Flash V.Disc cartridge. All it required was a screwdriver acting as a chisel, a hammer, and a blood sacrifice (technical veterans will recognize that last item as a mainstay of computer repair methodology). I have to give VTech proper credit for the strength of the cartridges. Sega could have learned something from VTech when they manufactured their flimsy, oversized Sega CD and Sega Saturn jewel cases. Anyway, it is confirmed: The V.Disc is a simple CD-ROM.


V.Flash V-Disc, separated from cartridge

The particular title I have, The Amazing Spider-Man: Countdown To Doom, contains around 313 MB of data. The largest directories on the disc are labeled kw01/, kw02/, and kw03/. They contain combinations of files bearing the extensions .mjp, .ptx, and .snd. I strongly suspect that these are Motion JPEG, raw picture, and pure audio files, respectively. Various other directories on the disc also contain .mjp files with ‘cutscene’ in the filenames.

The .mjp files begin with a MIAV signature and draw influence from the AVI format in that media chunks are denoted variously by ’00dc’, ’01wb’, and ’02wb’ FourCCs. The chunk format is FourCC – chunk number within stream – chunk length – payload. The 00dc chunks contain what resemble JPEG chunks. But something seems off about them. My first clue is a FourCC ‘FJFI’. Then it comes into focus– it’s byteswapped JPEG data (the usual signature here is ‘JFIF’). In fact, the first chunk begins with the bytes 0xD8 0xFF 0xE0 0xFF– byteswapped from the standard marker bytes 0xFF 0xD8 0xFF 0xE0. The 01wb and 02wb streams, I would guess, represent 2 separate audio tracks. Perhaps this disc can be played in 2 different languages? Or perhaps there is a director’s commentary track? I think I like my first hypothesis better. I didn’t see anything on the box or cartridge to indicate that the game has more than one language. But it could be that the same media is marketed in a different region with different printed materials. If that were true, it would indicate that the game could query the region of the V.Flash to know which language it should present to the player.

I am not sure what format the audio data takes. It could be low-volume, 16-bit, little endian PCM (mono or stereo), it could be 8-bit stereo PCM that’s dominant only on one channel, or it could be some other unusual encoding. The .snd files might provide a little more insight. The .snd files turn out to be straight-up WAV files.

The .ptx files are all 262188 bytes, which is (44 + 218) bytes, so I suspect that these files have a 44-byte header followed by 218 bytes of raw image data. The first byte in the file is 0x2C = 44, so that’s a good validation sign. I’m trying to decide what the dimensions and color resolution could possibly be. The square root of 218 = 29 = 512. A 512×512 image would not make sense for a television screen. But that would assume 8-bit palettized data anyway. However, if the data was 15- or 16-bit RGB, then the image might be 512×256 which is plausible. The header encodes the number 480, which is a common image height, but does not divide evenly into 218. Plus, there is no sane parameter encoded in the area around 480 to indicate height, so I have to assume that 480 is a coincidence. Hey, Robert and Reynaldo: is that RGB recovery utility ready yet?

For program code, the disc contains a file called 0system/boot.bin. I think Ian Farquhar called it when he speculated that the V.Flash uses an ARM processor. Running ‘strings’ on this binary reveals “MORE v4.0 SDK ARM9T version”. The binary format itself I am unfamiliar with, but it is a chunked FourCC format that contains such FourCCs as ‘BOOT’, ‘REL\0′, and ‘DBG\0′. A clue regarding the toolchain, however: “GNU AS 2.13″. The string “OggSRIFFdV” also shows up.

Update: Here are some samples of the .mjp and .ptx files (the .snd files are just straight PCM WAV files).

Posted in Game Hacking, Reverse Engineering, VTech V.Flash | 16 Comments »

V.Disc

December 7th, 2006 by Multimedia Mike

So I went out and got one of those V.Discs that operate with the VTech V.Flash console: The Amazing Spider-Man: Countdown To Doom. This is what it looks like, front and back (click for larger pictures):


VTech Spider-Man V.Disc (front)

VTech Spider-Man V.Disc (back)

The door in the back is spring-loaded; I taped it open for the photo shoot. Now I just need a good way to get the cartridge open, hopefully by employing a method somewhat more sophisticated than my first impulse– bang with rock. I’m not really worried about getting the disc back into the cartridge. But it would be nice to ensure that the optical disc is not damaged during the process. Even if I get a cheap V.Flash console somewhere down the line, it stands to reason that the disc can be placed in the audio CD tray and played. Though there could be some mechanism to prevent that– perhaps the cartridge design trips some switch in the console authorizing the disc as an actual bootable game. The game’s instruction manual warns of the legal ramifications of copying and claims that backup or archival copies are legally prohibited. So, the manual tacitly acknowledges that copying is somehow possible.

Studying the remainder of the manual as well as the box copy, I see no other companies involved other than VTech (and the myriad license holders of the properties advertised). So I imagine that VTech develops all the software in-house.

As an aside, when it comes to children’s toys, I have really been out of it for the last, oh, 17 years or so. When wandering down the toy aisle containing the VTech products, I was stunned by the volume of tech-y kids toys. I guess it’s a good business model– sell some kind of cheap base system and then sell lots of media. And I don’t know what I was thinking in my previous post when I expressed amazement at VTech’s licensee lineup for the V.Flash– these companies will whore their properties to just about anyone, as my trip to the toy aisle revealed (e.g., Disney for every no-name gizmo system). But as long as a system uses optical media and probably displays FMV, you know I’ll be interested.

Obligatory MultimediaWiki page: It’s not much more impressive than the current English Wikipedia page.

Posted in Game Hacking, VTech V.Flash | 1 Comment »

V.Flash

December 6th, 2006 by Multimedia Mike

I briefly spied a television commercial for a product called the V.Flash by VTech. The sound was off, but I got the impression that it was some kind of new game console for young children. And it appeared to have pretty decent graphical capabilities which is somewhat unexpected in this market.


VTech's V.Flash

Based on Google searches thus far, there doesn’t seem to be a big underground/hacking/homebrew scene developing around this new console yet. So it’s difficult to find hard technical data about it. Whatever the guts are made of, it must be possible to sell them at US$100 per unit and presumably make a profit. The 3D graphics aren’t especially revolutionary, but who can tell the difference in this day and age? In fact, based on screenshots and web videos I have seen thus far, the graphic quality strikes me as reminiscent of the PlayStation-N64 days. Further, the unit only supports composite A/V output.

Here is the PDF manual for the V.Flash console. As you can see from the above marketing photo, the system uses optical media in a cartridge, which is affectionately termed a V.DiscTM. The manual describes that the console comes with a tray onto which a user can mount an audio CD (and apparently a photo CD). This implies that the unit has the optical hardware to read CDs. I think it’s reasonable that it does not also read DVDs or else they would probably be able to advertise DVD playback capability. Plus, DVD playback ability would markedly increase costs via parts and technology licensing costs.

Naturally, I’m interested to see if the CDs have any FMV. The games are apparently widespread wherever fine toys are sold. They are around US$30 each and the company has managed to publish an impressive line-up of licensed titles featuring such properties as Spider-Man, Spongebob Squarepants, and Disney Princesses. It seems reasonable that one of these discs could be separated from its cartridge relatively easily and read in a normal PC’s optical drive.

What’s the wager that the unit contains, at its heart, an x86_32-type CPU? Then again, the V.Flash comes from a company that is hardly a startup and appears to have years of experience making small, game-related devices.

Posted in Game Hacking, VTech V.Flash | 8 Comments »