Most blog posts and things people upload to the internet don't include all the headache it took for them to get there. It's unrealistic. Imagine all the insight we could gain from reading about the failures and what not to do.

This post is about a project I started during COVID that I had no idea what to do, and about how I eventually accomplished my goal, with a lot of help from other netizens!

I've always been into arcade games even though I didn't go to an arcade like my dad did, growing up. Maybe it was once at Chuck E Cheese if those machines even count, or the random Galaga at some pizza restaurant. Many arcade cabinet are the inspiration of modern games and game mechanics we see in games today. I'd say some of the most interesting and influential games have come out of Japan, not just for arcade machines, but also for gaming in general like the mega corps Playstation and Nintendo.

Another thing to note, I'm writing this blog post solely for the reason that when I started this project, I had little to no guidance in the beginning. I'm hoping this will give people the initial step in the direction of discovering a new interesting thing to research! Arcade machine hacking and game preservation is a very unique, underground community worth diving into! I learned so many things starting this project, and I hope you, reader, can also gain some helpful insight! I'll also admit, the arcade game community is a bit gatekeepy. Some reasons involve people not wanting to get caught with DMCA, and others just people not wanting to share (probably for the reason that it'll get traced back to them).

Motivation

Just browsing my site, you can probably see I have both an interest in Japan. This then blossomed into a few ddg searches of a particular arcade game. After watching some game play on YouTube, I thought, wouldn't it be crazy if I was able to play this?

I was right, it was crazy — I was crazy! What's even crazier is it ended up becoming a reality.

When I started this project, I never traveled to Japan before simply because its way to expensive as a broke college COVID-era student. I then discovered that about a year ago (as of searching about the game on forums), the game had been officially out of service. Out of service means the machines aren't connecting to an official unified network and the game play is significantly reduced. This also implies the game arcade cabinet itself will likely get decomissioned. I think this also makes the contract void and they machines are to be decommissioned. I realized then that I may never be able to play the game, without a significant amount of work.

I was right, it was a significant amount of work for sure. About two years in the making.

Frantically, I fell down the rabbit hole of discovering a site called Buyee. Buyee is an international shipping proxy for things being sold on Yahoo Auctions Japan and other Japanese related sites. (Essentially Ebay in Japan) If I wasn't able to go to Japan and play this game, I told myself, I can make this game playable even if it takes me a few years, even if I didn't get it working, I knew someone on the internet would eventually. Given the amount of time I had on my hands, I unwisely ordered the majority of the parts needed to recreate the machine.

Ordering Hardware

When doing this for your target arcade machine, this usually includes the following:

Required:

• Arcade PC
  • most arcades are physically PCs running some type of OS, you can look your game up on buyee, and may find the machine being sold. Make sure the hard drive is included! Many arcades have interoperable drives for re-purposing a machine for a different game when one goes out of service. Sometimes you will need to source the drive separately if its rare.
• IO board + (sometimes needed, card reader)
  • this is the bare minimum because the software on the arcade will be looking for this hardware, and will likely not work properly without it (unless you tweak the game with binary patching using Ghidra for example)

Optional:

• Button Input (for the IO board)
  • this is usually the controls the game needs, for this arcade it was a 11 button Plexiglas looking thing (todo image)
• IO Harness
  • this connects the button input to the IO board (I tried DIY-ing this, do not recommend it, there are a ton of connections just for 12 buttons)

Failed Start

Once you acquire the hardware, or better yet, you have an entire complete machine to do the research on, the first step is powering it on and seeing what happens!

At start up, take note of anything that hints at what this system is running. BIOS versions, hardware checks, OS logos etc. For this system (which I will try to keep as unnamed as possible for legal reasons) it was running Windows 8.1 Embedded. Yeah, I also had no idea what that even was or knew that it even exsisted. I had to do a little bit of research. Embedded Windows versions do not include the desktop ui. They're usually configured to run a specific application on start up. For this cab, it spawned some cmd script before launching the actual game.

Then the game showed an error. No music, no nothing. Just an error, in all Japanese.

(TODO insert image of error)

I was honestly really stumped. I had no idea what the next step was. In hindsight, I didn't realize this, but the error was saying the coin door was open. Make sure to translate the error and try to understand it!

Asking for help

Doing random ddg searches I eventually stumbled upon this fourm called Arcade Projects. Lots of useful information and helpful people here.

Since the game would not boot, the next step was figuring out how to get the contents of the drive onto my PC for more research. Thankfully, there was someone that gave me the steps to do this. It was actually quite simple!

All machines of current popular arcade games are encryted with disk-level encryption. Things like ATA disk encryption, Windows Bitlocker, and BIOS encryption are just a few things you might see when trying to learn the interworkings of an arcade system.

Ranging from USB dongles to odd looking PCI cards that plug into the power pins of the motherboard, the way arcades handle if they should turn on and function or not can be unique from machine to machine. If your lucky, it's as simple as plugging the PCI card and shorting the power pins yourself, or if you're unlucky, you'll have to make sure your testing environment is as similar to a functioning machine as possible to reduce the possibility of boot errors from missing sensors or decryption keys.

Since we had all the hardware needed to actually boot the system, we were all set. To dump the hard drive, we need to get it to decrypt first. The bios decrypts it on boot automatically. So knowing this, before it boots into the OS, we can get it to decrypt. Then we can plug it into a SATA to USB reader and dump that way. One problem though, the BIOS dects that its not in the OS and reboots automatically. To mitigate this, we simply power it externally.

To sum it up:

• power the drive externally
• get the BIOS to put the drive into a decrypted state
• hot swap the SATA cable with a system that can dump the contents

Lost

At this point I didn't really know what to do. The game would not boot or play. The contents of the hard drive were so forgien to me, I didn't know what to do either. So I switched gears and looked at the IO board. I ended up buying the manuals for the arcade, and reading through them I discovered the IO board had a voltage requirement of 24V. (todo check)

Background

Before this project I got really into building custom USB keyboards for RSI prevention. I plan to write a blog post about this, but for now, all you need to know is I'm currently writing this post with a Corne Keyboard, and I've made multiple dactyl keyboards (not the manuform). They're awesome!

IO Board Investigation

Since I got it to power up with my bench power supply, the board lit up with lots of red LEDS indicating things I didn't know. The micro USB port also started to function. This means the IO board is powered separately. The micro USB port did not receive power, it only exposed its 2 data lines to the computer it was plugged into. Plugging in the USB, the first thing to check is to see what the OS saw. Using the Linux tool lsusb is a great way to do this. Running this command watch -n 1 lsusb I would plug in the device, then unplug it. Doing that a few times would easily show me which one it was in the list.

Using that, I could use the vendor descriptor (the unique code of the USB device) and select it using lsusb to view more info.

All it really ended up telling me was that it was a specially USB 2.0 bulk device. I didn't really understand this either.

Doing some more research and prompting chatgpt, there were some other files I could observe when plugging this into Linux. (TODO confirm this) - it exposed some /sys/device/0 and cating it revealed that when I 'pressed buttons' (aka shorting pins on the IO harness header) it would change. This number iirc... (this could be wrong) todo come back

I then decided to write a Rust application that would take the USB device and try to display all the data its sending to the computer. Doing this was actually not that hard at all. I took a USB HID example, and just changed the IDs to explicitly read the data coming from the IO board. Then pressing buttons, I was able to get this data and determine which byte corresponded to which button. It was awesome!

Using this information, I was able to pass it off to some people who worked on tools that let you play arcade games on your PC. This process also intrigued me, but I had no idea what or how they did it. When I asked how or if they'd give me the code, they said no, its too dangerous to leak. Very gatekeepy interestingly.

That was annoying but at least the game could play on PC. It still didn't have internet or network functionality though.

Thats when I started looking at attempting to fix that. The game sent multiple network requests and DNS requests to confirm it could reach the server that no longer existed. This sucked because we basically had to recreate something blind. We had no network data to go off of except what it wants.

It was honestly the hardest part because I just couldn't understand it or figure it out.

So I did some research. I looked into other similar projects where someone would create a private server for a game and what the codebases looked like. Looking into the games for this same not to be named machine, I found someone working on essentially the same thing, only for a different arcade game. The cool thing about these arcades is that they usually share very similar networking protocols. That means if someone started on one arcade, we could probably use that to get a small head start on another one to get it fully functional.

So I pestered that guy, he was from China! He ended up being the most helpful person in this project. He tried to walk me through what to look for and how to attempt this, but he just ended up taking the game files and figuring it out himself.

I'll try and paraphrase this the best I can. But the following is not my work, I just wanted to understand how it worked.

So, the binaries (exe file) of this game in particular had some interesting data. A public key and a private key, both embedded into the binary. Most modern games have a heavy amount of encryptino involved because of cheaters and hackers alike. So they usually use HTTPS along with some type of AES encapsulation. This makes it basically impossible to see what is happening over the wire unless you have physical access to the machine.

Using a decompiler, you can find this by searching for PUBLIC or just long strings. This then needs to be combined with the network traffic. You need to figure out the type of encryption used or the keys are just as useful as the encrypted random network traffic you're looking at. Using a proxy or wireshark can help in this process. Pasting in the data with cyberchef may eventually lead you to discovering this.

Interestingly, the network traffic was actually being encrypted with the public key, so the private key was what decrypted it. Technically backwards, but it still works, if no one in transit has either one.

(still currently writing this, theres a lot more I want to talk about)