Attacking the Weak

13 February, 2017

ShouTime dumped the incredibly rare game Omega (Nihon System). It’s a ball-and-paddle game running on similar hardware to Sega’s Gigas. These games use an NEC MC-8123 CPU module containing a Z80 core, decryption circuitry, and an 8 KiB encryption key in battery-backed RAM. When fetching a byte from ROM or RAM, the CPU chooses a byte from the encryption key based on twelve of the address bits and whether it’s an M1 (opcode fetch) cycle or not. This byte from the encryption key controls what permutation (if any) is applied to the byte the CPU fetches. This encryption scheme could have been brutal, requiring extensive analysis of a working CPU module to crack, if it weren’t for a fatal flaw: Sega used a simple linear congruential generator algorithm to create 8 KiB keys from 24-bit seeds. That means there are less than seventeen million encryption keys to test. Seventeen million might sound like a lot, but it’s far less than the total possible number of keys, and definitely small enough to apply a known plaintext attack in a reasonable amount of time.

So how do we go about attacking it? First we have to make an assumption about what the game program is going to be doing. Given that the hardware looks pretty similar to Gigas and Free Kick, I guessed that one of the first things the program would do is write a zero somewhere to disable the non-maskable interrupt generator disable maskable interrupts. So I wrote a program to find candidate seeds (no, I won’t show you the source code for this program – it’s embarrassingly ugly and hacky, not something I could ever be proud of):

  • Start with first possible 24-bit seed value
  • Generate 8 KiB key using algorithm known to be used by Sega
  • Decrypt first few bytes of program ROM using this key
  • If it looks like Z80 code to store zero somewhere and disable interrupts, log the seed
  • Repeat for next possible seed value until we run out of values to try

This ran in just a few minutes on an i7 notebook, and narrowed down the millions of possible seed values to just five candidates: 36DF3D, 6F45E0, 7909D0, 861226, and BE78C9 (in hexadecimal notation). Now I could have tried these in order, but it looked like Sega had made another misstep: besides using a predictable algorithm to generate the key, they also used a predictable seed value to feed this algorithm. The candidate seeds value 861226 looks like a date in year-month-day format. It turns out this seed generates the correct key to decrypt the game program, so I guess we know what someone at Sega was doing the day after Christmas in 1986.

Brian Troha hooked up the peripheral emulation, and the game will be playable in MAME 0.183 (due for release on 22 February). Colours aren’t quite right as we don’t have dumps of the palette PROMs yet, but we expect to resolve this in a future release. Thanks to ShouTime and everyone else involved in preserving this very rare piece of arcade history.

Posted in MAME, Technology | 1 comment »

My PAL with the LASERs

15 December, 2015

Back in the distant past, MAME started cataloguing programmable logic devices (PLDs) in addition to ROMs. This was met with considerable hostility from certain segments of the community, as it was seen as forcing them to obtain files they saw as unnecessary for emulation in order to run their precious games. However PLDs are programmable devices, and it’s important to preserve them. So far though, the PLD dumps have mainly been used by PCB owners looking to repair their games. The haven’t been used by MAME for emulation. However, PLDs are key to the operation of many arcade games, performing functions like address decoding and video mixing.

One such arcade board is Zaccaria’s Laser Battle, also released under license by Midway as Lazarian. This board uses complex video circuitry that was poorly understood. It includes:

  • TTL logic for generating two symmetrical area effects, or one area effect and one point effect
  • TTL logic for for generating an 8-colour background tilemap
  • Three Signetics S2636 Programmable Video Interfaces (PVIs), drawing four 4×4 monochrome sprites each
  • TTL logic for generating a single 32×32 4-colour sprite
  • A Signetics 82S101 16×48×8 Programmable Logic Array (PLA) for mixing the video layers and mapping colours

On top of this, they decided it was a good idea to use some clever logic to divide the master clock by four when feeding the Signetics S2621 Universal Sync Generator (USG) that generates video timings, but to divide it by three to generate the pixel clock feeding the rest of the video hardware. This lets them get one third more horizontal resolution than the Signetics chips are designed to work with. They need additional logic to line up the pixel clock with the end of horizontal blanking, because the number of pixels in a line isn’t divisible by three, and some more logic for delaying the start of the visible portion of each frame and cutting it off early because they wanted less vertical resolution than the Signetics chips are designed for. It uses an GRBGRBGR colour scheme where the most significant bits are are in the middle of the byte and the missing least significant blue bit effectively always, so it can’t produce black, only a dark blue Was this design effort worth it? I guess they must’ve made some money off the Midway license at least.

Anyway, this game has never worked properly in MAME. It’s always been missing the area and point effects, the colours have always been completely wrong, and the mixing between layers hasn’t properly either. And that’s done inside the PLA. The PLA has 48 internal logic variables, each of which can be programmed to recognise an arbitrary combination of levels on the 16 input line. Each of the internal variables can drive any combination of the eight output lines. The outputs can be configured to be inverting or non-inverting.

In theory this sounds like a job for a ROM, so why use a PLA instead? Well a ROM with 16 input bits and eight output bits would need 64kB of space. Such a ROM would likely have been prohibitively expensive when this game was produced. I mean, its program ROMs are only 2kB each, so there’s no way they’d be sourcing a ROM 32 times that size just for video mixing. The PLA maps the same number of inputs to the same number of outputs with just 1,928 bit of storage, or a little less than one of the program ROMs. It can’t produce absolutely any arbitrary input to output mapping, but it’s more than enough for this application. In fact, it turns out they didn’t even need to use all the space in the PLA.

Read the rest of the post if you want to know more about the process of decoding the PLA bitstream and examining its contents.

Read the rest of this entry »

Posted in Development, MAME, Technology | No comments »

Yet another reason to hate Google’s tentacles

5 September, 2015

It’s not secret I don’t like the way the web is succumbing to JavaScript bloat and sucking in scripts from third-party sites. But I now have another reason to hate it. A few sites are blocked from China, including most Google properties such as Google search, Google APIs and YouTube (and also Tagged, incidentally). If a site that isn’t blocked from China tries to load scripts from Google APIs, for example the minified jQuery script, I have to wait for the blocked request to time out before the page will display at all, and functionality may be broken if the page actually depends on jQuery for content display or navigation. Is it really that hard to host your own scripts? Do you really need to give Google even more data on our browsing habits? One good thing about China’s policies it they make it harder for fucking Google to track us over here.

Posted in Internet, Technology | 1 comment »

Make a real argument

22 September, 2014

The newspapers just love publishing stories about prostitution, because they know it sells. Amanda Goff aka Samantha X has been giving them plenty of fuel. Of course these stories all have comments left open, and it’s only a matter of time before a certain argument comes up in one form or another. Here’s an example of it, as found in a comment on a Fairfax newspaper site:

My argument against prostitution isn’t based on religion, conservative values or prudishness, but is more to do with the fact that, in essence, prostitutes are being bribed to have sex with someone they don’t actually want to have sex with. One wants sex and the other doesn’t. Some may protest that they do want the sex, but what if no money was involved? That’s right. The sex wouldn’t happen.

This “argument” is absolutely absurd. Do the people making it really not see the glaring flaw? How about we do a simple substitution:

My argument against garbage collection isn’t based on religion, conservative values or prudishness, but is more to do with the fact that, in essence, garbage collectors are being bribed to collect garbage they don’t actually want to collect. One wants garbage collected and the other doesn’t. Some may protest that they do want to collect garbage, but what if no money was involved? That’s right. The garbage wouldn’t be collected.

You can apply it to most occupations. If no money was involved, the roads wouldn’t be maintained, the supermarket shelves wouldn’t be stacked, the garbage wouldn’t be collected, nothing would be manufactured, and society as we know it wouldn’t exist. I’m not trying to make a case for or against prostitution, I’m just completely sick of seeing this absolutely stupid argument smugly parroted over and over again.

Posted in Politics | 1 comment »

Faking it

11 January, 2014

Melbourne on new year’s day is a weird place. All sorts of shops, restaurants and bars are were closed. The entire Royal Arcade was closed for some reason. It’s like Melbourne still wants to believe it’s a quiet country town. Despite the crappy weather, there was plenty of foot traffic in the CBD, so a lot of the places that had the sense to stay open seemed to be doing pretty well. Fortunately the prices are high enough at Passionflower that it wasn’t overcrowded, and we could easily get a table to enjoy some very overpriced, sugar-laden dessert. The Melbourne one (Bourke St) has friendlier staff, better service and gets the nicer presentation of the food than the one at Capitol Square in Sydney — the staff there act like customers are an unwanted nuisance.

Anyway, with my parents in town, my wife and I decided to take advantage of the possibility of free babysitting and go out for dinner. There were limited options, but most of the restaurants in the Crown complex at Southbank were open, so we ended up at Nobu. It’s immediately obvious that the floor staff don’t really speak Japanese. It makes no sense to (poorly) attempt to say “irasshaimase” as you show someone to their table; you should have said that as they approached the door, or the moment they walked in. (Something like “kochira e” works when showing a person to their table.) All the staff were doing this with everyone, which kept my wife giggling. I guess they could claim to provide free entertainment. You might get even more entertainment if you get a seat in the upper bar/lounge area with a view of the riverbank. For example we saw some really weird cougar thing going on. There was this woman of east Asian appearance with a far younger guy who looked like he was part European, part Asian. She had the bag, camera and everything, and was acting like she knew she was in charge. The also seemed to have a bit of trouble walking straight. All in all, they gave off a pretty weird vibe. I really hope it was a cougar thing, because if he was a family member, they were acting downright creepy.

Read the rest of this entry »

Posted in Uncategorized | No comments »

Welcome to the madhouse

7 May, 2013

I’m having serious doubts about my ability to survive the rest of the month in Hong Kong. The infamous heat and humidity haven’t caused me problems – that doesn’t seem much worse than Sydney in summer. It doesn’t seem to rain too heavily for too long at a time, so that aspect isn’t really any worse than Melbourne. I read online that Sheung Wan smells like fish, but in reality there are just a few shops selling dried fish – not very smelly, and not the whole suburb by any means. When I arrived on a Saturday, Sheung Wan was blanketed in the smog that sometimes blows across from the mainland. People say it can be hard to tell the difference between mist and pollution, but I know the smell of coal furnace exhaust and this was it. I really wasn’t looking forward to breathing this every day. It would just about rule out any chance of getting exercise by walking to our from work, as it would mean that what’s supposed to be good for my heart would just end up being bad for my lungs. Fortunately that cleared up when a storm blew in on the following Monday afternoon and it hasn’t come back yet (fingers crossed); unfortunately it proved to be the least of my issues.

Read the rest of this entry »

Posted in Uncategorized | No comments »

Taste of a Tiger?

18 October, 2012

There’s this awesome laksa place on Hunter Street in the city, or at least everyone tells me it’s awesome, so I really want to try it. So I walked to Hunter Street last Sunday, keen to try get my Malaysian fix, but when I got there at half past one the place was closed and showed no signs of having been open at all that day. I looked carefully around the door and didn’t see opening hours posted anywhere. At least I got my walk in the sun, I now know they’re not open on Sundays, and I didn’t get a half-arsed weekend effort that isn’t representative of their weekday performance as happens at some eateries. I’ll try again on a Saturday, but failing that, it might have to wait for a day off. Is “laksa craving” as a valid medical condition for a sick leave form?

So having failed to get my laksa fix, I decided to finally have lunch at Tiger Bakers. Just walking in, the place felt far too hipster for me. The guy behind the bar was wearing a singlet, with his facial hair trimmed to look like five days’ growth, and his hair that says “I put a lot of effort into trying to look like I just rolled out of bed”. Oh yes, and it’s a bar – it’s so edgy, serving primarily as a coffee shop and restaurant, but in the form of a bar. The atmosphere is a bit of a let-down, too: if you sit well inside, it’s a bit stuffy and oppressive, but if you sit somewhere with fresh air and sunlight, you’ve got people smoking at that legally-just-outside counter messing with your ability to smell the food and coffee.

I got the barbecue lamb sandwich, and it tried pretty hard with crusty “Turkish-style” bread, lots of fancy salad leaves, tender spiced lamb, hummus and tzatziki. Although the hummus taste a bit flat, the everything else in the sandwich was done pretty well. The thing that ruined it was the chips they served with it. They were over-seasoned with that strong, artificial-tasting, MSG-loaded stuff. It conflicted terribly with the wholesome flavours of the sandwich, and it was the flavour that stuck with me after I left. All in all it was a disappointment, especially considering the good things I’ve heard about the place.

Posted in Uncategorized | No comments »

For the Music

26 March, 2012

I had an inadvertent busking experience. I was playing my recorders at the park while the kids enjoyed the playground. It seemed like good use of the time, as it meant fresh air for everyone, exercise for the children, and music practice for me. As we were leaving, some young ladies came up and gave me a few coins as a token of their appreciation for the music. I tried to give the money back, but there was no convincing them. I’d like to think I inspired them to keep up their own music practice or gave them a hint of what’s possible with some effort, but I’ll never know.

After seeing this, my goddaughter begged, “Teach me to play, so I can get money too!” I told her I only teach people if they’re in it for the right reasons (for the music, or the lulz as the case may be). I scared her mum off by telling her the price of a decent solo recorder — over £270 for one of mine. If I tried busking half seriously, I could probably get decent return on the price of the instruments, but it wouldn’t come close to covering the countless hours of spent building and maintaining playing skill.

(I also discovered that one must consider wind direction when playing outdoors. If you try to play a low note while facing into the wind, it behaves as though the bell is stopped. This is clearly not desirable. No-one teaches you important details like that.)

Posted in Uncategorized | No comments »


24 January, 2012

So I got this message today:

Hi Vas,
We work closely with company and placed man and woman with you recently. I’d like to add you to my professional network on LinkedIn.
– name

I’m like

So you run job ads?
That don’t impress-a-me much —
So you sold us grunts,
But can you find us stars?
Now don’t get me wrong,
Yeah, I think you’re alright
But that won’t make me cash in the economic blight.
That don’t impress-a-me much…

Posted in Uncategorized | 1 comment »


27 December, 2011

My wife has banned me from hiring or buying Ford or Holden cars. Since Hertz gets busy around Christmas, they were booked out of Mercedes, Lexus and even the more interesting Toyotas. From what was left, I decided to hire a Ford G6E (it’s the replacement for the Fairlane, kind of like a luxury Falcon variant). To be honest, I was hoping it would be bad all along — not undriveably bad, but bad enough to complain about for a while. It definitely didn’t disappoint in that regard. It’s like a bogan’s attempt at producing a premium product. It misses the bar so badly it’s not even funny.

Read the rest of this entry »

Posted in Uncategorized | 1 comment »