Enabling telnet on a WNR2000 Router (OpenWRT install)

Enabling telnet on a
WNR2000v4 Router
(OpenWRT install)


   During late 2018 due to reasons, I temporarily moved back home into my parents' basement to look for better game development employment elsewhere while working at a few temp jobs. Previously I was living with my great roommates in an apartment, and fortunately my room was close enough to run a 20ft or so long Ethernet cable from the ISP's router to my room for Internet. Earlier in 2018, back at home, my father "upgraded" the shady Comcast router with a shadier, newer one, and gave me the old router, a Netgear WNR2000v4 router. At the apartment, I used this router as an overglorified network switch for the devices in my room, for giving Internet access to my laptop, a legacy PC, or any older video game consoles or devices that required wired Internet. I also prefer a wired Ethernet connection over WiFi when I can, since it can be more secure and have less overhead (faster and more reliable) than dealing with wireless Internet. Unfortunately, since this was a 2-router network setup, the network was somewhat complex (outer ISP router being on a 192.168.x.x subnet, with my inner router being on a 10.0.x.x subnet). This 2-router network prevented things such as connecting the PS2 versions of Star Wars Battlefront 1 & 2 to SWBFSpy (which requires getting an IP whitelisted by the server's admin for usage).

   Unfortunately, when I moved back home into my room, I didn't have the privilege of having wired Ethernet available, due to the ISP's router being on the other end of the house from my room and my "roommates" not going to like having a 50+ ft. length of Ethernet cable running across the houses to the ISP's router. This obviously wasn't a problem to give Internet access for devices that can use WiFi, but definitely one for devices that only have a wired connection (such as those older video game consoles). Most modern day routers have a web-based GUI for configuring the router (by connecting to the default router gateway in a web browser and logging in as the admin); the WNR2000v4 was no exception. Unfortunately, the default gateway's GUI (called "Genie" by Netgear) for this particular router model does not have a wireless bridging feature, just basic router functionality (via Ethernet or WiFi) for an Internet connection and network switch functionality between wired devices. Getting a wireless bridge function working would allow me to connect devices via wired Ethernet to my room's router and then forward the network data wirelessly (via WiFi) to the main router on the other side of the house. This would allow wired Internet connections from my room to connect to the Internet, and would additionally make the network appear as a single-router network from my router's perspective (with a single subnet; not having to use 2 subnets like at the apartment). Rather than wasting precious money on a dedicated wireless bridge to solve my problem, I was resourceful and used my brain instead, looking into hacking my spare Netgear WNR2000v4 router to install OpenWRT.

Telnet enable attempt/Installing OpenWRT

   For those whom are unaware, OpenWRT is a lightweight Linux distribution meant for embedded devices (especially routers). Installing OpenWRT as a replacement firmware on a router removes any restrictions with the stock firmware, and allows full control of the hardware, as well as beefed up security. Basically it can turn any router into a fully configurable business one (with telnet, VLan setting up, etc), just like the Cisco ones my classmates and I learned about in my networking class at college. Most importantly, OpenWRT has a few packages that can be installed to enable wireless bridging functionality on this router. This would solve my problem of connecting my wired devices to the ISP router on the other end of the house without using a double-router setup with 2 subnets and a very long Ethernet cable.

   Unfortunately, the stock firmware on the WNR2000v4 has its telnet feature locked. To summarize the basic process of installing OpenWRT on router devices, you need to telnet into the router (using software such as PuTTY) and flash the device with the new firmware. This file is sent to the router via a TFTP server on a computer, and the flashing is done through a Linux console on the router by running some Linux commands. Most Netgear routers have the telnet locked for security reasons, and in order to unlock the telnet, a special packet usually must be sent either over UDP or TCP (depending on the particular router model). Usually a special program is used to send the magic packet and unlock the telnet. More details about unlocking the telnet on Netgear routers can be found on this OpenWRT article, and full details about installing OpenWRT on the WNR2000v4 router (including an UDP telnet enable python script) can be found on this other OpenWRT article under "How to Install OpenWRT on the Netgear WNR2000v4 through u-boot-env modification on Linux" section.

  Also unfortunately, neither the UDPtelnetenable.py script worked within a Linux virtual machine, nor did any of the telnet enable programs for Windows in the other article were able to unlock the telnet on my router. Perhaps my particular router unit was a newer hardware revision that blocked telnet enabling altogehter, or some other weird networking issues were preventing the packet from being sent/received and properly unlocking the telnet. Fortunately, while doing a Google search about my problems, I came across a security vulnerability (CVE-2016-10174) for the similar WNR2000v5 router, which, when exploited, can allow an attacker to bruteforce the admin password, enable telnet, and then gain a Linux root console access. These privilege escalations through the exploit are a pretty serious security vulnerability, and you really should replace this router with a more secure one if you wish to use its stock firmware (or do the smart thing and replace the firmware with the much more secure OpenWRT like I'm doing). A person online also wrote up details about the security vulnerability and a PoC hack here. Most importantly, a formal exploit was published and included with the Metasploit framework for white hat hackers. This security vulnerability is confirmed to exist and to work on the v5 router, but only has static analysis to show possible existence on the v4 and v3 routers. Using this exploit to enable telnet and gain the Linux root console access, I could properly install OpenWRT fully without relying upon the broken telnet enable programs that weren't working for me. Since I know the admin password to my own router, I could bypass the password bruteforcing, and just use the exploit to enable telnet/gain Linux root console access, speeding up the exploit process.

Enabling Telnet the hard way
via the security exploit

    Since none of the UDP telnet enable programs were able to properly send the magic packet and enable telnet, I decided to enable telnet the hard way, by bruteforcing telnet enable and gain a root Linux console through the exploit. I did this through installing and using Pentestbox with Metasploit. Fortunately Metasploit has a penetration module to run the exploit on the WNR2000 series of routers; instructions and details on the module usage here. I also had to upgrade my router to firmware, which is required for installing OpenWRT (see the main OpenWRT install article for this router for the stock firmware link). If I remember correctly, basically I logged into my router's gateway interface (Genie) via the admin password (in order to get the timestamp from the router for the exploit), and then immediately ran the Metasploit module on the page that confirmed access was granted, and was able to get temporary telnet enable and a root Linux console access on the router after the exploit successfully ran. Then I ran all of the normal OpenWRT installation steps for the WNR2000v4 router (setup the TFTP server, send the OpenWRT firmware, run the Linux consoles commands to flash the firmware, etc).

  After all of this was done, I got OpenWRT installed on my spare WNR2000v4 router, and proceeded to setup wireless bridging to solve my original networking problem. So now this router has wireless bridging functionality, and a much more secure firmware (OpenWRT) without nasty, inexcusable security vulnerabilities like CVE-2016-10147. This installation also proves that the vulnerability exists and that the exploit does indeed work for not only the WNR2000v5 router, but also for the v4 router. (Meaning you really should replace this router if you have one or install the much more secure OpenWRT firmware on this model.) Hopefully anybody who runs across the same issue I had with being unable to unlock telnet for an OpenWRT install on a WNR2000 v3-v5 router with the special magic packet programs will find this article useful, and use the security vulnerability method to bruteforce telnet enable/root Linux console access as a last resort.


Socket the Hedgeduck Progress: FZ & TCZ

Socket the Hedgeduck Progress: FZ & TCZ

  After nearly a 2 year hiatus (due to professional gamedev work), development on the Socket the Hedgeduck mod for Sonic 1 has resumed! Recently, Future Zone Acts 2 and 3 have been finished, as well as the entirety of the final zone, Time Castle Zone. A planned v0.4a demo will be released later this year and submitted to the 2019 Sonic Hacking Contest, after more polishing, bugfixes, and improvements will be made to the game.

    Future Zone acts 2 and 3 were previously empty, due to figuring out a way to implement the reverse-gravity gimmick used in the original game for act 2. After a few failed attempts at porting S3K's reverse-gravity gimmick to Sonic 1 (which would have been a high cost, low benefit feature to implement, due to only one level requiring it), I used some out-of-box thinking to implement the feature. Instead of vertically flipping Sonic's gravity and physics, why not vertically flip the entire level around Sonic ๐Ÿ˜ฎ?

    Behind the scenes, in code, instead of implementing S3K's reverse-gravity gimmick, hitting an activated gravflip bridge instead transports Sonic between FZ2 and FZ4 levels, very similarly to the inter-level warp doors in Olein Cavern Zone 2 (OCZ2) or the boss doors in act 3 of each zone. (I call the types of warp doors that transport Sonic to a different location within the same level "inter-level warp doors".) FZ2 is the normal version of the level, while FZ4 is a copy of FZ2 that is vertically flipped (has vertically flipped level chunks and y positions of  objects mirrored about the level's middle y midpoint). The only difference in the warping functionality for the gravflip bridges is Sonic's new warp position. Sonic's new x position is kept the same, while his y position is calculated to be a new one mirrored about the levels y midpoint. This creates the illusion of gravity flipping. Similarly to the Bonus Fence Zone (BZF) levels, where pressing A button while in Debug Mode will send Sonic to the background layer for collision, pressing A button while in Debug Mode will send Sonic between FZ2 and FZ4 levels to implement the "gravity flip".

   Act 3 for each Zone is a unique remix I create using the existing chunks from the other 2 acts, since the original Socket game only has 2 level per zone (excluding High Speed Zone (HSZ) levels). Due to the fact that the Sonic engine (and Socket engine) use large 256x256 px chunks instead of Sonic 2 and later's more flexible 128x128 px chunks, these levels are usually remixed sections of the 2 previous acts, with a few unique chunks I design sprinkled in between to connect sections for smooth level graphics and layout flow. Unfortunately, gravity flipping act 3 would have consumed more than the zone limit of $FF Big ROM Chunks, so the reverse-gravity feature was only designed for act 2. All act 3 levels (except TCZ3) have a boss warp door leading to a boss area.

 FZ3 is an extremely difficult remix of acts 1 and 2, with a ton of traps, surprises, and difficult obstacles, and might actually be the hardest level in the hack. The final section of the level consists of a Labyrinth Zone (LZ)-styled wind tunnel, inside a few huge glass tube chunks. Sonic must float upwards and downwards to avoid painful torpedoes (the same ones as used in Antiquity Zone (AZ)), horizontally moving spiked blocks, collect rings, and cling onto Satebรด BS-X Satellaview satellites. (These satellites have the same behavior as LZ wind tunnel poles). The level ends with hitting the boss warp door, which leads to the boss area and a to-be-implemented boss.




  The entirety of Time Castle Zone, the final zone in the game, recently also has been finished. This zone was sitting at approximately 95% complete during the hiatus, and was just waiting on fully implementing 2 new custom objects (the hamster belts and clock platforms). This zone features some custom objects such as:

  • Beam bridges
    • Hit a button on the object, which unfurls a temporary solid bridge
  • Hamster belts
    • Operates like Metropolis Zone (MTZ) nuts in Sonic 2, but horizontally
    • Moving on the object will lock Sonic's position onto the belt
    • Moving Sonic left will move the hamster belt and Sonic right, and Sonic right move belt and Sonic left
    • Hamsterbelt will stop moving when it hits a wall either to the left or right
    • Makes squeaking noises as the object's art updates frames
  • Clown faces
    • Painful objects that rotate clockwise, counterclockwise, or upside down in either rotational direction
  • Clock platform
    • Platforms that rotate clockwise on clock faces in the level
    • 2 variants
      • Platform with a shorter radius that moves slower (hour hand)
      • Platform with a longer radius that moves faster (minute hand)
  •  Crusher blocks
    • Purple blocks that oscillate up and down, attempting to crush Sonic in various areas of the level
  • Collapsible platform
    •  Standard Sonic 1 collapsible platform, just updated graphics for zone
  • Runaway Saws
    • Standard Sonic 1 saws and pizza cutters object from Scrap Brain Zone.
    • Only runaway version used, with updated graphics
    • Same objects as used in FZ
 TCZ1 is a rather basic (but difficult) level, introducing the player to this zone's gimmicks. TCZ2 is a difficult labyrinth, and is the only level in the original Socket game to feature two bonus stage doors. TCZ3 is a remixed version of TCZ1 and TCZ2, with bottomless pits and a more difficult level layout. Currently TCZ has an odd memory leak bug somewhere where having too many clown faces and chained spikeballs on screen will cause the game to start corrupting object SSTs, not loading new objects, crash the game, or begin running arbitrary code. This bug happens often in TCZ2, and the bug will be investigated and fixed before the upcoming demo release. In the game mod's extended playlist, each act in TCZ features a song for both the bad ending (not having all 7 chaos emeralds) and the good ending (having all 7 emeralds). Some of these songs are currently WIP, while others are completed.

    TCZ goes over Sonic's original Scrap Brain Zone (SBZ) level slot. The original Sonic 1 game has a SBZ3 level which is actually a Labyrinth Zone (LZ) act 4 level. The real SBZ3 level is Final Zone, and is actually just SBZ2 but starting at a further level position and having the boss implemented. I found this setup to be BS, and undid it completely. (I call this the "Anti-SBZ3 BS feature".) TCZ3 is a real level in this mod. TCZ doesn't have a boss; the next and final zone (a 1-act Time Lord Zone (TLZ)) does feature the final boss, the evil Time Dominator! Time Lord Zone is technically SBZ4 in this mod. It uses some extra chunks from SBZ3 and a new palette for the level. This is a far more acceptable setup for the final zone than the SBZ3/LZ4 BS in the original game ๐Ÿ˜€.

  TLZ is currently just a level layout, with no final boss yet implemented. Like with TCZ, this level has both a good and bad ending song. I have plans down the road possibly to implement some cutscene screens in the game, replace the emeralds with Sonic CD Time Stones, and to explain a backstory as to why Sonic is in Socket's universe and as to why he is fighting the Time Dominator. In the bad ending, you just fight the Time Dominator; in the good ending, you fight both the Time Dominator and a brand new boss.

     Other changes behind the scenes include refactoring the mod's original warp system to fix screen tearing and BG deformation issues. Inter-level warp doors no longer clear object RAM. This means you can no longer use warp doors and continuously farm up on rings by having them respawn. Sonic is the only object destroyed, and then reloaded with a new warp position set (classical quantum teleportation lol).

  With both FZ and TCZ complete, all of the levels for the hack have been implemented ๐Ÿ˜€! All that is left to complete this hack is to fix bugs, polish the game, and to implement the remaining bosses.

   Stay tuned for more development on Socket the Hedgeduck this year!


Thwimp v1.1 Update!

Thwimp v1.1 Update!

 Thwimp, the modification utility which allows one to view, to rip, and to encode Nintendo THP video files from/for Mario Kart Wii, has been updated to v1.1 today!

   This new update fixes a few bugs from the initial release (proper framerate not being applied to newly encoded THP video files, and improper ripping of the control BMP frames from battle_cup_select.thp), as well as refactors the THP Viewer/Ripping section! When cropping THP videos for ripping, users can now click radio buttons to select a subvideo cell to crop to. The section now includes a start/end frame field, for selecting a time period at which to clip the video to. A numeric up/down control has been added to select from which multiplicity time period for ripping subvideo frames from. Furthermore, the user's manual (on the Github page) has been updated with images, better spelling/grammar, and updates. Most importantly, an article for the application has been added to the Mario Kart Wiiki!

 You can view the changes with the THP Viewer/Ripper in this update video.

  I had been holding off on writing a MKWiiki article for the application until this v1.1 update was released. This application was quite challenging to write, due to the idiosyncrocies involved with the command line params for FFMPEG. I'm quite pleased with how this application turned out. Hopefully MKWii modders will find it quite useful for creating new THP videos for their menu-based THP files!

  You can download the application either from the Wiiki article, the Thwimp webpage, or get the source code from the Github page.



Hover Pack Release!

Hover Pack Release!

   After about 3 or so months of work during leisure time, Hover Pack has been released for Mario Kart Wii! During the past month, all tracks have been finished, and polished with some bugfixes and some visual enhancements have been added. Furthermore, the pack has been enhanced with custom graphics (making the game more Windows 95/Hover themed), new THP videos, many custom songs, and even a custom Hover Item Pack! This pack replaces all of the items used in the game with some new ones.

   The pack, item pack, and individual courses can be download from the project page (which link to MKWiiki articles where the downloads reside). A future update will be made to address some issues in the new content later.


Thwimp utility released / Hover Pack project announcement

Thwimp utility released / Hover Pack project announcement

   Lately, I have been looking into modding Mario Kart Wii on the Nintendo Wii, with My Stuff files in Riivolution. Specifically, I have been working on designing a pack of custom battle courses, ported from the mazes in Microsoft Hover! (1995), called "Hover Pack", with an additional track being a port of Arena Rumble from Monster Truck Madness 2. Currently, maze 1, maze 2, and maze 3, and the Easter Egg Credits Maze have been ported, and are all done other than adjusting enemy route widths. The pack (when released), will include a new title screen, sound effects from Hover, music from Hover, some custom music, new THP videos for the tracks (created with Thwimp), the new battle courses themselves, and "Flag Grabbers" mode (modified Coin Runners mode with Microsoft Hover flags to capture). You can view the current progress at this YouTube playlist.

    While creating Hover Pack, I created new THP video files. These video files are used in the menus, title video, and ending sequence. Unfortunately, most of these THP files are actually an array of subvideos inside (with a multplicity of subvideo per frame), are all of equal frame length, and are quite complex to create manually. Some actually include padding (THP videos' dimensions must align to the nearest 16px boundary), and sometimes this padding including what I call a "control signal". This signal is usually a white rectangle in the padding, which moves to an integer position at each multiplicity, in order to tell the game which row to highlight in a menu during THP playback.

   With all of these problems with manually creating THP video files, I have create and released Thwimp utility!

    Thwimp is a Windows utility which allows users easily to view, to rip, and to encode Nintendo THP video files for Mario Kart Wii. Written in Visual Basic (from Visual Studio 2010 IDE), the Thwimp application calls some FOSS and other command line tools (not included) "from arms length" via the Command Prompt to perform its tasks. For encoding new THP files, Thwimp can intelligently handle audio, subvideo array, multiplicity, and padding/control information when encoding THP files to replace ones in-game. It does this by accepting appropriately named, input mp4 video files for each subvideo cell in the array, and for each multiplicity. It will also accept a WAV audio file, and BMP image frames for each multiplicity padding/control signal as needed. After reading the input files, Thwimp will intelligently process and splice all of the files together appropriately in order to create a high-quality, properly formatted THP video replacement file!

    Today, I have updated the EagleSoft Ltd webpage with a new Nintendo Wii section, a Thwimp page (where you can learn more about the utility and download it), and Mario Kart Wii Tracks page (to host all of my incoming new tracks) .

  I hope people find Thwimp useful for THP editing!


Coffee Crisis Release (PC, XBox One)

Coffee Crisis Release (PC, XBox One)!

   Many people might have been wondering why EagleSoft Ltd hasn't been as active lately since about 2017. The real reason has mostly been life, and starting a new job as full-time Indie video game developer at Mega Cat Studios! Mega Cat Studios is a local Pittsburgh company, that creates Indie video games for modern and retro platforms (such as for Sega Genesis, NES, SNES, and others).

  From 2017 to mid-2018, I was developing for the company the port of Coffee Crisis to next-gen platforms (PC on Steam, and Xbox One) as lead developer, while collaborating with our other teammates. Coffee Crisis is a retro, 2D side-scrolling fighter game, similar to Streets of Rage. The Smurglian alien race has come to Earth and they’re not leaving until they steal our four most prized commodities: metal music, the best coffee, cat videos, and all the WiFi. Challenge them through unique and innovative levels inspired by real-life areas in Pittsburgh, PA. Join Black Forge Coffeehouse baristas Nick and Ashley, two galaxy gladiators called to arms to stop this madness and remove the Smurglian threat from Earth. The Smurglians can have the cat videos… but if you don’t help our heroes fend off against the alien-assimilated elderly, bros, cowgirls, and country western singers, who knows what could happen!

  The game features 1P and 2P local Co-op, 2 different players (Nick and Ashley), weapons, many fighting moves, powerups, and much more! These ports not only contained the content of the original game, but new enemy types, tons of visual-eye candy, Finish Them Zone modifiers, new bosses, new levels, and tons of improvements over the original game. After a year of many development twists, turns, technical difficulties, and collaborative teamwork, the development team and I at Mega Cat Studios have finally released Coffee Crisis, both for PC on Steam for more recently for XBox One!

  You can learn more about the game at Mega Cat Studio's Coffee Crisis webpage. The PC version (including a demo) can be purchased/tried at the Steam store page, the soundtrack at the Steam DLC page, and the Xbox One version at the Microsoft Store. The original game for the almighty Sega Genesis can be purchased at Mega Cat's storepage (NTSC version, PAL version), or users can try out a demo in a Sega Genesis emulator. Having a personal Coffee Crisis? Try some Coffee Crisis coffee!

   Stay tuned for official news on progress for other Mega Cat Studio games at their website! The EagleSoft Ltd portfolio webpage (and softography pages) have been updated with info on the release. Both will be updated with other projects I work on at Mega Cat Studios, as games get completed, as much as NDA will allow me to.

-MrTamkis (aka "Eagle")

The Quest for RGB

The Quest for RGB

        During a Saturday in early May 2018 this summer, I was over in the Squirrel Hill area of Pittsburgh in order to stop by to the nearest Get Go for cheaper gasoline for the car. While in that area, I noticed an estate sale going on. Considering estate, garage, yard, and flea market sales have the potential to sell awesome vintage stuff (such as retro video games and vintage technology) for cheap, I decided to stop by and check it out. I'm glad I did stop by; I found treasure that day!

   The estate sale seemed to belong to an older, classy Italian who recently passed away, who had some high-end, retro, AV equipment. The item that caught my eye the most was an old Sony CRT monitor, with a listed sales price of an incredibly affordable $20. Although I've never seen this particular model of CRT before and didn't know exactly what it was at first, it did look quite high-end, and I did notice a "Digital RGB" indicator and a "Sony Trinitron" logo on the front. Apparently this model of CRT could support RGB input, which is the highest quality video that retro video game consoles can output! Although I already had an older CRT which is starting to go bad, I decided to take the risk and purchase it. Also purchased with the lot was a VK-2D Multi-Input Cable for the CRT, and a generic 3.5mm to Component jack cable. This was the 2nd and final day of the Estate sale, so everything was being sold for half-off. (I didn't realize this until after the purchase; otherwise, I would have also purchased the remote and TV tuner that was compatible with the CRT).
   The CRT was huge, and weighed about 120 pounds, so a helper at the estate sale and I had to do a two-person lift to haul this treasure into the car. Back at the apartment, I did some research online for what I found. The find was a Sony Profeel KX-2501A Component CRT, which is a high-end CRT manufactured during the 1980s by Sony. It uses a high-end Sony Trinitron monitor, a proprietary Sony technology which reduces the amount of color bleed between pixels. It is known as a "component TV", not because it has component AV inputs (YPbPr), but because it requires external hardware ("components") to fully utilize it. For example, the CRT doesn't include built-in speakers; it has speaker jacks to hook up to 8-16ฮฉ stereo speaker equipment. Furthermore, it is best to use the compatible VTX-1000R TV Tuner with it, which allows hooking up multiple RCA and other inputs to the monitor (such as analog TV on RF), as well as hooking all equipment via a single, optional VK-2D 8-pin DIN Multi Input cable. The CRT also is compatible with the retrotacular Remote Commander RM-205 remote.

The Sony KX-2501a
(hooked up to a Sega Saturn via RGB)

   According to the Vintage Knob, the Sony "Profeel" line of CRTs was Sony's marketing term for their consumer and semi-pro product line of CRTs, with the product line positioned slightly below their fully professional product lines. Their professional product lines were their PVM (Professional Video Monitor) and BVM (Broadcast Video Monitors) monitors. These 3 product lines are highly sought out by retro video gaming and video enthusiasts due to their quality. They utilize Sony Trinitron monitors, high quality monitors which are sharp, bright, and clear. You can learn more about why Sony Trinitron monitors were (and still are) the king of CRT technologies in this informative YouTube video.

    Not only do these monitors contain high quality Trinitron monitors, but most of them have inputs for digital RGB. digital RGB is the best quality AV you can get out of most retro video game consoles. Compared to other inferior AV input types (such as RF, Composite, or S-Video), RGB separates the red, green, blue, and sync information on video into separate signals. The other video input types mentioned combine all or some of the color information into individual signals, instead of separating each piece of information into separate signals. This combining of signals causes much signal interference and loss of color quality and information. RGB, on the other hand, separates each piece of color information into their own wire/signal, preventing any interference, and ensuring perfect color accuracy and quality. This is why digital RGB is such a big deal for video enthusiasts. You can learn more about what digital RGB is and why it is so spectacularly awesome for retro video games at this webpage and at the retrorgb.com website.

Comparison between
lowest quality RF
and high-quality RGB video
(Source: RetroRGB website)

Unfortunately, there was a VTX-1000R TV tuner and the remote for the CRT for sale at the estate sale, but I didn't realize I should have picked it up at the time. I later picked up both for relatively cheap on eBay (but not as cheap as at the estate sale). Dumb mistake!

The KX-2501A monitor in action,
with VTX-1000R TV tuner and Remote Commander

Getting RGB into this monitor

    As previously mentioned, Digital RGB is the best quality AV input for most retro video game consoles. RGB can be input to most high-end CRTs either thru SCART or thru BNC (RGBHV) connections. SCART is a European standard, and uses a 21-pin connector which carries RGB signals. Few if any monitors in North America use SCART inputs; however, many higher end CRTs have BNC connections for RGB (RGBHV or RGBs), which are more common than SCART inputs. SCART contains both audio and video on one cable, while BNC connections use 4-5 BNC connections for video, with audio via left/right RCA connections.

  The Sony Profeel KX-2501A does support RGB input; however; it neither uses SCART or BNC inputs for RGB, and instead, uses a proprietary IDC34 jack, which looks the same as a 34-pin floppy drive jack (see input panel on above picture). This change in input interface was a big problem with getting RGB input on the CRT. After doing some research online, I discovered this blog post from WaveBeam on how to rewire the pins on a SCART jack into such an IDC34 port for transmitting an RGB signal, as well as a proof-of-concept by another person who got RGB working via BNC+RCA connection. Later I discovered a Ben Heck article on creating an AV switcher circuit using Bus Switcher ICs.
Enter Sony Super Multi (X) RGB Kits

  With the information researched in those links, I have designed the ultimate conversion interface kit for getting RGB input into IDC34 monitors such as mine. The R&D of the products are in late stage development (about 90% complete), and the kits should be ready to be sold to the public at around early October, after pricing, packaging, and an online store are setup.

    The Sony Super Multi RGB product line of kits will contain two kits: The Sony Super Multi RGB, and the Sony Super Multi X RGB. The former kit is the basic kit, while the latter is the premium kit. Both kits will allow one to interface both SCART and BNC (RGBHV/RGBs+RCA stereo audio) RGB AV into their IDC34 port on their monitor, as well as to use either a standard (twisted) IDC34 floppy cable or a nonstandard one. The main difference between the 2 kits is that the former is a passive circuit and does not prohibit the usage of both SCART and BNC inputs active at the same (attempting to use both will mux both signals to the CRT), while the latter is an active, powered, digital circuit that only allows one input type active at the same time. The latter uses an AV Input source switch to select which input to use, power supply, and a few SMT Bus Switcher ICs to fix the design flaw of the standard kit; however, it costs more and is harder to assemble, due to the few SMT components and more complex design. Both kits will come with color instruction manuals for how to use and assemble the kits. The parts used for the AV inputs will be high-quality, non-oriental parts, in order to ensure a pure AV signal. Both kits will be open-sourced, fabricated at OSHPark, and were designed with Autodesk Eagle. Pre-assembled kits will be tested for QA assurance before shipping.



   Stay tuned for more news about the development of the Sony Super Multi kits, and an eventual release date for the first batch of kits. The source material for the kits and the manuals will be released when the design is finalized and ready to ship. The EagleSoft Ltd website has been updated with a new "Electronics" tab, including a WIP page for the SSM Kits.

DreamPi NOOBS-compatible image updated (v1.1/v1.7)

DreamPi NOOBS-compatible
image updated! (v1.1/v1.7)

  Earlier this year, I released a DreamPi NOOBS-compatible image for Raspberry Pi for the Sega Dreamcast. A DreamPi is a standardized set of software (a customized Linux distro) and a set of hardware created by a fellow named "Kazade" which will create a simplified DC-PC server, for getting a Dreamcast back online to connect to the internet for browsing and online gaming, via resurrected, private game servers. The stock DreamPi image is one which must be written to the entire SD card, and doesn't easily allow a multi-boot setup with other OSes on other SD card partitions. This DreamPi NOOBS-compatible image is compatible with NOOBS or (by extension, the recommended, superior) PINN. NOOBS is a simple bootloader, which allows one to install NOOBS-compatible distro images in such a way as to allow a simple multi-boot configuration, while PINN (derived from NOOBS) is a enhanced version of NOOBS, which fixes some design flaws and adds new useful, convenient features. PINN is recommended over NOOBS.

  The DreamPi NOOBS compatible image works with NOOBS/PINN, and allows one to install DreamPi distro with others in a multi-boot configuration. Recently, the stock DreamPi image was upgraded to v1.7. You can read the Dreamcast Live blog post and forum thread from the previous link for information about the ChangeLog, but to summarize the changes:

  • Updated Firmware
    • Image rebuilt against newer minimal Raspbian distro.
    • Now supports Pi Zero W and Pi 3 B+ models of Raspberry Pi
    • Smaller image size
  • 2K Games support
    • Supports resurrected servers for the supported 2K series of sports games (NBA 2k1/2, NFL 2k1 etc; see up-to-date games list)
  • Wi-Fi Config Utility 
  • Bugfixes
   I have updated the DreamPi NOOBS-compatible image against the updated DreamPi v1.7 stock image. The DreamPi NOOBS guide has been updated to detail how to upgrade your DreamPi partition from an older version to a newer version via the latest NOOBS image, and clarifies a few items. The upgrade requires the latest version of PINN, which has now introduced a "replace" OS function, as well as dual-firmware support to handle Raspberry Pi models 3B+ and newer and also older models. This OS replacement feature will upgrade DreamPi with the newer image, without deleting or modifying other partitions within your multi-boot setup on PINN.

Do note that this image may need the speed bugfix applied to make it boot consistently.

You can download the latest DreamPi NOOBS compatible image and read the guide at this EagleSoft page.

Have fun playing with the new support for the 2k series of sports games, and having DreamPi multi-boot with other OSes on NOOBS/PINN!


Birthday Bash 2018/Recent pickups

Birthday Bash/
Recent Pickups
(Not a dead hobo yet)

   I and EagleSoft Ltd are not dead! I just have been really busy with my day job as a developer lately. I somehow recently lived long enough to turn 26 years old during April! As usual, I picked up a few video game related items this month in celebration, some homebrew development related, others just video games. Unfortunately, turning 26, I fell off my parents' health insurance. What did I pickup this year?

   Around April, I found a few good games at a thrift store for dirt cheap, and some other great finds at the annual Pittsburgh Retro Gaming Convention (2018)! At the thrift store, I found a boxed copy of the Starter Pack for Skylanders Superchargers Racing for Wii, with Bowser, his airplane, the portal, and the game, as well as a copy of Megaman Network Transmission for Gamecube, and a longbox copy of Twisted Metal for PS1. A future blog post will give a short game review of Skylanders Superchargers Racing for Wii, as well as a quick review video in a future episode of Nerdology.

 PRGC/Gamemaster's Realms Pickups:

At the 2018 Pittsburgh Retro Gaming Convention (PRGC) and a recent trip to the local game shop (The GameMaster's Realm), I found some great pickups! 

  • PS2
    • Hw
      • 8MB Memory Card
    • Applications 
      • HDLoader
      • Network Adapter Startup Disc
      • DVD Player v2.10 
    • Games
      • Star Wars Battlefront 1
      • Star Wars Battlefront 2
  • Gamecube
    • BMX XXX (at GMR)
      • Homebrew Game Save exploit!
    • Gamecube SD Gecko (eBay)
  • Sega Saturn
    • Games
      • Virtua Fighter 2
      • Virtua Cop 
        PS2 Pickups/FHDB Setup

   Last year, somebody gave me a working Fat PS2. It was fully working, but the CD tray was jammed. I was able to easily fix that by lubricating the drive belt. I also had future plans to acquire a HDD Network Adapter, and to install a HDD with Free Hard Drive Boot (FHDB) and Playstation Broadband Navigator (PSBBN) on it. This adapter would also enable me to play various games online again, via private servers or self-dumped, patched backup discs.

    That same someone also gave me an OEM HDD Network Adapter (with Ethernet and Dialup jacks) on it, so I had been trying to setup my PS2 Fat up with networking and HDD capabilities. Initially, the blank Memory card I acquired at PRGC'18 would be used as the Free McBoot (FMCB) memory card, with HDLoader being the software to use to get over the chicken-and-egg problem of having to write the appropriate files to the memory card on a non-modified console for the FMCB installation, and being the software to use to utilize the HDD. However, the HDLoader disc was badly chipped on a section of disc near the inner ring. Although I tried getting the CD buffed at the Gamemaster's Realm (whose owner has such a professional CD buffing machine), it still wasn't enough to fix the issue, so I ended up returning the disc back to the seller on the 2nd day of the convention. It was a shame too, because HDLoader is a somewhat rare but useful homebrew utility disc, and I found this copy for a steal of only $3.

    A few weeks later I picked up a compatible 40GB IDE HDD for dirt cheap ($10) on eBay, and ended up just writing a modified PSBBN disk image to it ("PSBBN custom install 2013 by AKuHAK" from somewhere online), for a Free Hard Drive Boot (FHDB) installation. More info about what a PS2 FHDB installation can do in a future blog post/Nerdology video.

Formatting the old drive
on the Windows ME DosBox

 Powering up the HDD
in the Windows ME DosBox desktop,
LLF formatting the drive,
and writing the PSBBN Custom image
to the drive from Windows 7 dev machine

End result
(HDD support in OSDSYS, PSBBN, PS2 Linux)

  Also picked up were a Network Startup Disc and a DVD Player v2.10 disc. The former allows setting up a Network Adapter for usage with an internet connection, while the latter installs an updated version of the PS2's DVD Player application onto a memory card. Using the former, I was able to determine that my HDD Network Adapter does indeed work with respect to connecting to the internet, as well as setup the PS2 with an internet connection. The FHDB installation also showed the HDD interface to be working too. The latter pickup is mostly a curio item, which updates the PS2's DVD Player version. (My PS2 had its DVD Player software on v1.x, this updated it to v2.10). Most PS2 online games back in the day were hosted via GameSpy; however, when the website folded, so did all of the servers. Believe it or not, in 2018, it is still possible to play some games online, via reverse-engineered, dedicated servers.

   As far as games, I found copies of Star Wars Battlefront 1 & 2 for PS2 (the original games, not the terrible next-generation ones ruined by EA Games). A SWBF community member by the name of Phobos has recently put the finishing touches this summer on launching SWBFSpy, an OpenSpy replacement for the SWBF Master Servers. This will allow online multiplayer for these games once again, after applying patches to them, as well as gameplay stats and a plethora of other features, which haven't been around since the GameSpy servers ended. I'm quite excited for the release, and to play some SWBF online once again very soon!

GameCube Homebrew Exploit

    To quickly followup from Repairaganza last year, someone gave me a used Wii. It was fully functional, but the DVD Drive mechanism was jammed. It was determined that a copy of Mario Kart Wii was jammed in the drive. After prying the DVD out, the drive still wouldn't suck or eject discs. Although I attempted lubricating and adjusting the DVD drive's gear system after disassembly of the console, I was unable to repair the drive; the mechanism was just too fragile to fix up. During early 2018, I transplanted the working DVD Drive from my brother's dead Wii. This DVD Drive was an early D2A chip drive, and works perfectly in my Wii! As a bonus, it's an early enough disc drive revision that it can watch DVD movies through MPlayer for Wii (not that I want to reduce the lifespan of the ODD's laser by watching DVD movies).

  One item I was looking for the GameCube at the convention was a copy of any GCN game from the short list of exploitable GameCube games. Games from this list can utilize a hacked saved file, which will exploit the game into running unsigned code from another device (run boot.dol converted to a save file on the same GCN memory card, Mini DVD-R, SD Gecko, etc). An SD Gecko is a GCN Memory card which allows plugging in an SD Card. Such devices are widely use in the GCN homebrew scene for running games, apps, and other things on real hardware, but compatibility is better on smaller SD Cards (not SDHC cards). In order to setup the exploit, the user needs to copy the hacked saved file onto a GCN memory card through a hacked Wii, using a utility such as GCMM on the Wii. Unfortunately, I was unable to find any of those games (there was a copy of 007 Agent Under Fire, but it was case only; no game). I was hoping to get Swiss running on an SD Gecko, so I'd be able to run and play Gamecube hombrew on real hardware. Specifically, I was planning on running the Gameboy Inteface (GBI) homebrew app using the softmod. GBI is a GB(C)/Advanced emulator that utilizes the Gameboy Player hardware to play real cartridges, and has much superior emulation than that with the official Nintendo GBP Bootdisc. This would allow me to play old Gameboy games on the big screen, as well as allow for future streaming of retro games for Nerdology in glorious high quality.

   Fortunately, I found a very cheap copy ($3) of BMX XXX at Gamemaster's Realm. (No, I'm not interested in playing this mature game lol. Just using BMX XXX as an XXXPloit game). After ordering a cheap SD Gecko and recently acquiring an official Wii SD Card (1GB, so less than SDHC capacities). I was able to get Swiss and GBI running on my 'Cube through the Exploit ๐Ÿ˜Ž. I still have been having too many troubles with running homebrew that access external files, for whatever reason. Further details about this softmod in a future blog post/Nerdology video.

Running Swiss and GBI
through the BMX XXXPloit
via SDGecko
Sega Saturn finds
   Some better finds at the convention were copies of Virtua Fighter 2 and Virtua Cop for the Sega Saturn. The latter came in a longbox (CIB minus manual), while the latter was a loose copy. The longbox game is the first for my Sega Saturn collection; I've only recently gotten around to collecting and playing on the Sega Saturn, after I repaired one last year.
Other EagleSoft Ltd News.

   EagleSoft Ltd has been relatively inactive the last 1.5 years, due to real life. Recently, this blog has been updated to use an HTTPS connection, in order to encrypt traffic for its own safety on the public web. Furthermore, the 100 blog post here at EagleSoft Labs, is coming very soon! I have a few surprises, announcements, and important web/blog updates for the incoming


Ultra Air Hockey DX Source Code release!

Ultra Air Hockey DX
Source Code release!

 When Ultra Air Hockey DX v1.0 was released way back in February 2015 after completing Fundamentals of Software Engineering class in the Fall semester of 2014 at RMU, I had plans to eventually port the game to Android, and to then try to publish the game on Steam with achievements and online multiplayer. The Android port eventually surfaced in a v1.1 patch of the game in summer of 2015. However, due to many years passing since then and working on many other projects (including many now in an official video game development job with a company) and not having time for an online-multiplayer release, I am releasing the source code for the game today.

   In order to get the game on Steam, I would have to create original music (the music used in-game were module music from ModArchive.org, since the game was originally freeware), as well as figure out online multiplayer and Steam Achievements. This coupled with the fact that I would have to greatly refactor the game's code for online multiplayer and due to the fact the game was created with an ancient version of Unity (3.x or 4.x if I remember correctly), I am releasing the source code, as well as the game's documentation from Fundamentals of Software Engineering class. Everything is open sourced with a GPL License, and is free for people to use as per the license. Downloads available on the project page.



DreamPi NOOBS-compatible image release

DreamPi NOOBS-compatible
image release!

    Two years ago for my 24th birthday, I finally picked up a Sega Dreamcast, one of Sega's coolest and most innovative game consoles, which unfortunately was discontinued prematurely during its video game generation. It's still possible today to get a Sega Dreamcast online (even without a dial-up service available at a residency), to browse the web and send emails on DC-compatible web browsers, and even to play some online games again via resurrected private servers. The Sega Dreamcast comes supplied with a 56k dial-up modem; although a DSL Broadband adapter (the infamous "BBA") exists, it's quite rare and expensive (still so today). 

 Older attempts at getting my Dreamcast back online

    During that year, I tried getting my Dreamcast online by creating a Linux-based PC-DC server on my modern laptop. A PC-DC Server is a set of software that runs on a computer that converts a modern-day ethernet internet connection to something that dial-up based computers can use to connect to the internet. The software will answer to the dial-up calls from older computers, and convert the modern-day internet connection to a dial-up connection which the older device can use. My modern development machine just so happened to have a legacy v.92 Fax-modem port. Unfortunately, the modem model of my Dreamcast requires a voltage on the dial-up connection in order to function, so I soldered up a Line Voltage Inducer circuit. Although I tried running some Linux commands on a BunsenLabs Linux virtual machine to run a PC-DC server, I was only able to connect the Dreamcast to the internet for browsing; I was unable to get it to connect to private game servers. Often a connection attempt would be flaky, which was odd, and I suspected the LVI not to be soldered that well.

   Thinking the issue could be either hardware or setup related (especially with using a virtual machine), a year later I received from someone a very nice, used, older PC tower (a custom-built K8V SE Deluxe mo'bo in a ThermalIntake XTaser3 case). Always wanting a machine dedicated to playing old DOS and Windows 95-based titles, I installed Windows ME onto an HDD for the machine. Although ME does not have direct Real Mode DOS support out of the box (it's buried in the OS), it's possible to hack Real Mode DOS functionality back into the machine. More about this machine in an upcoming blog post or video. With the machine, I installed into it a v.92 US Robotics PCI card for dial-up connections, which would give a much more authentic dial-up connection for a PC-DC server. After installing the related software to setup a PC-DC server using the PCI dial-up modem (Windows 98 guide), I still was only able to browse the web, but not connect to games. At one point the modem card caused booting up of ME to not respond indefinitely, and, due to my usage of the particular Real Mode DOS hack I used ("Real Mode DOS Patch 3", which sacrificed emergency boot and Safe Mode functionality to use) and not having a working System Restore point (due to not having an update patch which fixes system restore failure issues past an odd Sept. 2001 date), I had to reformat the drive with a fresh Windows ME install. At this point I gave on trying to setup a PC-DC server via VM and dedicated DosBox for an online connection and decided to eventually purchase a DreamPi.

Physical Windows ME
DOSBox :)

DreamPi attempt

   A DreamPi is a standardized set of software (a customized Linux Distro) and a set of hardware created by a fellow named "Kazade" which will create a simplified DC-PC server. A DreamPi setup consists of a Raspberry Pi model 2/3 computer, a Linux-compatible USB Fax modem, an ethernet connection, and a Line Voltage Inducer. The software takes care of the dial-up connection with a very minimum, automated setup for the user, and will even allow the user to create an account for the DreamPi on the Dreamcast Now website. The Dreamcast now website will show the usernames of players currently online with DreamPis, and which online compatible game they are playing, allowing for easy hooking up with people for online matches. DreamPi by extension can also get other dial-up based computers back online, including the Sega Saturn, which can browse the restored NetLink zones for NetLink compatible games (Saturn guide). One problem with the DreamPi Linux distro is that it is a raw image file, meant to be written directly to the SD Card, making it quite unsuitable for allowing multi-booting of various OSes on the same SD Card.

 DreamPi Kit

DreamPi NOOBS-compatible image

    To fix this problem, I have released a NOOBS-compatible DreamPi image, based off DreamPi v1.6. NOOBS (New Out-Of Box Setup) is a bootloader for Raspberry Pi, that allows the installation of multiple OSes in such a way as to allow multi-boot. This DreamPi image works with NOOBS, and has a nifty slideshow upon installation explaining the features of DreamPi. By extension, this image is compatible with PINN. PINN (PINN Is Not NOOBS) is an enhanced version of NOOBS, which I recommend over using NOOBS. It has the following extra features over standards NOOBS:
  • Various ways to install OSes
  • Install from SD Card (offline)
  • Install from online server (with a wider variety of OSes)
  • External Media
    • USB Flash Drive
    • External SD Card via a USB SD Card reader
  • Install additional 512MB ext4 Data partitions, for general data usage
  • Download and archive to the SD Card the OSes from the online server, for offline installation
  • Easily reinstall OSes if something goes wrong (without having to redo a fresh NOOBS/PINN setup)
  • Various maintenance capabilities
    • OS maintenance utility
    • Recovery shell
    • SD card clone utility
    • Password restorer
    • File System Checker
  The image can be downloaded on its page in the Sega Dreamcast section of my website, along with info about it and how to use it. With my DreamPi, I was finally able to get my Dreamcast and Saturn back online for web browsing, and to get the Dreamcast back online for gaming! Couple with my NOOBS-compatible image, I was able to get a few other Linux distros working on the same SD card with a multi-boot setup.

Installing and using
DreamPi NOOBS compatible image

Installation slideshow

Some pictures of getting my
Dreamcast back online with DreamPi :)
 Getting my Sega Saturn
to browse the web with DreamPi
 Enjoy this DreamPi NOOBS compatible image for getting your Dreamcast/other dial-up computers back online, while enabling multiboot for other Linux distros!


Merry Christmas/Repairaganza

Merry Christmas 2017/Repairaganza!

   Hope everyone has a very Merry Christmas/New Year for 2017!

      Although I did not get as much done as I wanted with EagleSoft Ltd this year (I took the year off to focus on my professional video game development job), I plan to do a lot for the early next year. Since the job started in January 2017, I have gotten a year's worth of valuable, real-world professional experience in the video game industry. Both my rรฉsumรฉ and the portfolio sections of the EagleSoft Ltd website are quite outdated now, and will be updated early next year as much as NDA allows me to, especially for the professional projects.

    There are also a few older, cancelled projects from a few years ago that I'd like to upload and document on the site, and I'm going to try finishing Socket the Hedgeduck hack next year. Those two older projects were a Super Mario 64 and F-Zero X ROM hack. A lot of work was put into the Socket the Hedgeduck hack, and I would love to do what it takes to polish it up to completion as a personal project. This ROM hack really helped me understand how the Sega Genesis hardware works, and was one of the projects that helped me get my professional video game development job. Other plans are to begin either a YouTube channel or Twitch channel called Nerdology, where I will review old video games and technology ๐Ÿ˜€.

Repairaganza 2017

     On a different note, I recently received from someone a few old video game consoles and other video game memorabilia (including a custom arcade cabinet). Some of the consoles had some issues, and needed repair, while others were working and needed some cosmetic refurbishment. In a few previous posts, I repaired a Sega Game Gear and an awesome Sega Saturn, but recently received a few other consoles. I would like to use the rest of this post to detail the repairs in getting them fixed, for fun. These consoles will obviously be used when I begin reviewing video games for the Nerdology channel, coming next year!

  • Nintendo
    • Game Boy Color chassis
    • GameCube
    • Wii 
    • Custom piano SNES
    • Misc.
      • N64 Arcade Cabinet
  • Sony
    • Fat PS2
  • Microsoft
    •  XBox 360
      • Yerf-Dog
      • Refurbished unit
Game Boy Color chassis replacement

      One of the items received was a lime-green Game Boy Color Chassis. Although, back in the day, my parents gave me a lime-green Game Boy Color (which I still own), this unit cosmetically was trashed, especially for the screen. The screen got pretty badly scratched and scraped after loaning it out to a friend back in 4th grade, and the chassis edges got pretty badly dirtied by myself. (I owned it way back when I was younger, and, being younger, I did not take very good care of the handheld.) Now having a Tri-wing screwdriver and this older chassis, I figured it was finally time to restore its appearance, by transplanting the Game Boy Color motherboard to the new chassis.

     Transplanting was easy, after following some iFixit guides for the front and back covers. The old chassis was somewhat dirty, and needed cleaning. Opening it up also gave me the chance to apply rubbing alcohol to the button pads, which I really found to help in maintenance of buttons for gamepads and such. I managed to transplant the motherboard without breaking anything.

Nintendo GameCube refurbishment/repair

     Two other things I received were a working (albeit dirty) Nintendo GameCube, and a Nintendo Wii. The Nintendo GameCube was working, but sometimes the power button (which is spring loaded) would not depress all the way to actually turn the console on. This was easily fixed by removing the plastic button altogether; there's a hole there now where the button can be manually depressed with a long, pointed object (such as a screwdriver). It was quite dirty, and I had to open the GameCube up in order to vacuum up the dirt/dust near the fan, by following this iFixit guide.

    Unfortunately, I ended up damaging the GameCube in the process of cleaning up the fan, by accidentally breaking off a lever for the CD sensor switch when putting the top lid back on. Most CD-based game consoles have a CD sensor switch; this is used to determine if the CD lid is open (for top-loader based systems, such as the original PS1) or if the CD tray is slid out all the way (for front-loader based systems, such as the fat, original PS2). Most top-loader systems (such as the GameCube) have a piece of plastic on the lid, which depresses a switch somehow. This switch is usually a "normally-opened" (NO) type of switch. When this switch is closed, the console knows that the CD lid is closed/tray is in; when the switch is opened, the console knows that the CD lid is opened/tray is slid out. When the switch is opened, the CD motor spindle is idle; when it is closed, the machine begins spinning and reading the disc (since there should be one in there now). The Nintendo GameCube uses a DPDT (Double-Pole, Double-Throw) type of switch, using two lever switches. One of the levers got broken off.

       The circuit board for the Nintendo GameCube CD sensor switch is about the size of a US quarter, and easy to replace (being a modular PCB component). Rather than waste $6-$12 for the replacement part on eBay (which seems excessively expensive for how simple the CD sensor switch module is), I just soldered up an override switch on the CD sensor switch module with a spare SPST switch to get around the broken switch. I could technically use this sensor override switch to do a swap-trick if I really wanted to do so. (The swap-trick is a method where the user puts in an authentic disc into a game system, and quickly swaps out the authentic CD with a bootleg copy at the right time. This is done with an override switch, in order to fool the console that the CD lid is closed when it is actually opened physically, and vice-versa when needed. If the swap-trick is done correctly and quickly enough, the console will not know that the authentic CD was swapped, and will use the authentication data from the authentic disc to boot the bootleg disc. This is an especially useful technique to run bootlegs on security-based CD consoles, such as the Sega Saturn, Sony PS1, and the Sony PS2. However, it is a risky trick, and, if done incorrectly, the motor or console can be damaged.)

GameCube CD Sensor switch

Repaired GameCube ๐Ÿ˜Ž
     The main reason for picking up this GameCube (even though I also got a Wii, which is backwards compatible with GameCube discs), is the fact that, unlike the Wii, only the GameCube is compatible with the Game Boy Player add-on (which I have). It is an awesome add-on for the GameCube, which allows the user to play original Game Boy, Game Boy Color, and Game Boy Advanced games on a TV via the GameCube. In the future, I plan on either installing an XenoGC modchip (which allows the playing of mini DVD-R discs without the swap trick) or purchasing an SD Media Launcher bundle for playing homebrew on the console. The latter loader method contains a special GameCube software disc (with the proper BCA area, so that it is read as an authentic disc), which can launch homebrew from a special memory card which interfaces with an SD card, as well as boot mini DVD-R backups. One homebrew I would love try out is the Game Boy Interface, which is an advanced Game Boy Player boot disc, which fixes all of the issues for the original boot disc made by Nintendo for the add-on.

     I also received with this GameCube a turbo-enabled GameStop controller and a semi-rare GameCube Lodgenet controller. It was a special controller that worked with a special Lodgenet GameCube model. This GameCube model was used in Lodgenet hotels for a simple pay-to-play trial system, and came with this special controller for using the system menu. The special controller includes special buttons for the menu interface. The controller uses a 6P6C RJ11 connection (instead of the standard GameCube connector) with a super long telephone cord, and I plan to solder up an adapter after doing some original research in the near future.

Stock image of a semi-rare
GameCube Lodgenet controller

   Nintendo Wii repair/hacks

    The Nintendo Wii I received was fully working, other than the fact that the Wii disc drive mechanism was jammed. It also lacked covers for the GameCube ports and the Memory Card slots, which will be replaced later, and has the final firmware version for the model (4.3U). Unlike most other CD-based consoles (which either use a top-loader system or a front-loading tray), the Wii uses a disc slot. When you insert a disc, a simple conveyor system "eats" the disc and spits it out as necessary (similar in concept to VHS players of yore, or exactly like most automotive CD audio systems). Unfortunately, the previous owner somehow got a copy of Mario Kart Wii stuck in the system. After forcibly prying out the game out with tweezers, I disassembled the Wii (using the iFixit guide at https://www.ifixit.com/Guide/Nintendo+Wii+DVD+Drive+Replacement/5164), and determined that some gears for the conveyor system got out of alignment, making some nasty clicking noises. The gears were not catching, the conveyor system would not run, and the disc could not be either sucked in or spitted out. I tried watching and following this repair video, but the gear system was too finicky/sensitive to repair. I plan just to throw out the old drive and eventually purchasing a compatible, replacement drive on eBay.

     To prepare for that replacement day, I surfed over to the Wii Drive Chip DB website in order to determine what type of DVD drive I had in the Wii during disassembly. The Wii product line contained various different DVD drives during its lifetime; some were cost reduced and had physical changes made to it in order to make modchip installation more difficult. Earlier drives can play both GameCube and Wii games, while later drives can only play Wii games. When replacing a disk drive, it is a good idea to replace it with one containing the correct drive chip. After inspecting the drive, I determined that it is a full-sized DVD drive, with a D2B drive chip, with cut pins (harder to install modchip), and no CD clip.

Wii Disc Drive identification

    After determining the drive chip type, I soft-modded my Wii with the Homebrew Channel, via Letterbomb exploit ๐Ÿ˜Ž. I later installed some fun homebrew games and applications (to tide me over until I replace the dead disc drive), and modified the Weather Channel, News Channel, Wii Mail, and Everybody Votes channel to work again online via the RiiConnect24 project. (News Channel is throwing a FORE000006 error, so I have to reset the RTC clock). The coolest part about this Wii was that the previous owner did not remove his/her Wii Shop Channel account, and left 2250 Wii points for me ๐Ÿ˜€. Unfortunately, the Wii Shop Channel is closing in January 2019, so I am trying to get as many original WiiWare titles as possible and enjoy them while they last. After the disc drive is replaced, I am going to have a blast playing some games online again via the Wiimmfi project and its patches.

Wii hacked with HBC, RiiConnect24 

Although the previous Wii owners broke the disc drive,
they left me with 2,250 Wii Points ๐Ÿ˜€
Custom piano SNES

        From the same person as the other consoles, I received a custom-painted Piano SNES that nobody wanted. (Poor SNES!) The unit was not working at all; it would power up, but would never read cartridges. Somebody I knew took a closer look at the unit with an oscilloscope; turns out the CPU (a Ricoh 5A22) was reading garbage data when cartridges were inserted, and he determined that the CPU was dead. He was able to repair the unit by soldering in a working, replacement CPU. (I am quite glad he repaired it; I do not have the hardware or skills yet to do surface mount soldering, yikes!) It is a sexy console, and works well ๐Ÿ˜Ž.

Fat Sony PS2 repairs

    I also received from this same person an older, fat PS2, with a cool barbed wire skin on it. It is a SCPH-350001 model, with relatively low versions on the system components, and the much sought-after Expansion Bay. Supposedly, it had "Disc Read Errors," but I determined that it did not have such issues. I was able to get it to read PS1, PS2 (Single Layer DVD 4GB discs), audio, and DVD Video discs. I am assuming that the tester used a Dual Layer PS2 disc (such as those in the TimeSplitters series), which have been known to have issues with some models of fat PS2s without adjusting the laser potentiometers. I remember having to do that and place transparent tape on the inner CD rings (where the motor spindle attaches) to get TimeSplitters 1 to work on my older brother's PS2 back in the day.

    The fan was incredibly dirty, the unit had some minor scuffs, and the CD tray sometimes would not open (it would jam). I cleaned out the fan, washed off the scuffs as best as I could, and cleaned off/lubricated the tray drive belt via rubbing alcohol, which improved the disc tray sliding. Controller ports and Memory cards work on this unit too. (In fact, this was the first unit that booted up a particular, old, blue, 8MB, 1st-party PS2 memory card I had in over 8 years! I thought this particular memory card corrupted years ago to the point of being unreadable, yet it read it!)

      Eventually I plan to purchase a PS2 Network Adapter for the Expansion Bay, which can mount an IDE HDD, for loading homebrew via FHDB and similar utilities.

 Before cleaning the Fat PS2 up
 During cleanup
(Look how dirty the cotton swabs
got when cleaning the fan; yuck!)
After cleanup
(So much cleaner!)

Video of disc drive before/after lubrication

Microsoft Xbox 360 repairs

     In terms of consoles, lastly, I saved two XBox 360 Fat units from the person. Both had some minor scuffs and scratches which I would clean off, and very dirty fans which I cleaned out. Both did not work fully, and I was saving both because the other unit had the parts the other lacked, and because I planned to hack one of the consoles (with RJTAG) for homebrew and other features. One would be kept stock for XBox Live features, while the other would be hacked and stay permanently offline (hacked consoles are banned on XBox Live). One had a custom sticker on top ("Yerf-Dog"), while the other one had a refurbishment sticker on it.
    The former XBox 360 model was fully working, other than a jammed CD drive, while the latter had an out-of-order wireless module. The latter would not allow the connection of wireless XBox 360 controllers, and would not display the state of the power button (the console would boot however). Both have some of the latest firmware versions available (16k and 17k versions), meaning I would have to hack one later with a complicated R-JTag hardware hack. I was also allowed to keep a 60GB HDD, and both a Composite/S-Video AV cable, and an HD Component AV cable (with SD/HDTV toggle button). While repairing them, I identified the processor type and other specs from this guide, so I could determine which XBox 360 would be better to hack.
    I repaired the jammed DVD Drive in the Yerf-Dog model by following this guide and disassembling the DVD Drive. Inside was a belt drive, which I cleaned out and lubricated with rubbing alcohol. This made the drive slide smoother and open up properly. This unit was identified with the following:

Yerf-Dog model
  • CPU
    • 2009 Jasper CPU
  • Firmware
    • Version 17000 dash (Metro Dash)
  • DVD Drive
    • Model type: Liteon
    • MS Part no : X800474-009
    • MFR Date: July 2009
    • HW Ver: A0A2
    • FM Ver: 83850C
  • 256MB Internal Memory Unit

     For the other model (the refurbished one), I was able to fix the wireless module by properly connecting the module; it was loose. This XBox 360 was cleaner than the other was, and I identified it with the following specs:

Refurbished model:
  • CPU
    • 2007 Falcon CPU
  • Firmware
    • Version 16000 dash (Metro Dash)
  • DVD Drive
    • Model type: Liteon
    • MS Part no : X800474-009
    • MFR Date: July 2009
    • HW Ver: A0A2
    • FM Ver: 83850C
    • Epoxied drive chip!
  • No Internal Memory Unit

          After repairing both units, it was determined that the refurbished model would be the better one to hack. It has an older firmware, and a Falcon processor (better R-JTag results). My only concern is the epoxied drive chip on this model.

N64 Arcade Cabinet
     The last thing (and arguably the coolest thing) I received from the person was a custom N64 arcade cabinet, and two additional, replacement LCD monitors! It was formerly a botched portable N64 stuffed into this arcade cabinet, with the N64 begin a bare motherboard. (Hence the N64 joypad ports in the front, and Super Smash Bros. 64 artwork.) The N64 was a dead motherboard. The unit had a single power supply, which powered the N64 power brick, the mini LCD, and a HiFi system. This arcade cabinet has a miniature LCD monitor, which has two RCA Video input channels and a power jack pigtail (tied to the single power supply). The LCD monitor has aspect ratio options (4:3 and 16:9) brightness, color, and contrast settings. The HiFi system outputs audio to two large speakers in the top panel of the cabinet, and accepts audio input via a left/right RCA pair (red and white jacks). The HiFi system has knobs for volume, bass, and tone, and the knobs will light up and change color when powered.
    Since the N64 was dead, I removed the N64 and de-spliced the N64 power brick from the common power supply. Some of the wires running from the HiFi system to the speaker broke off, so I repaired them by soldering them back onto the speakers. I mounted the HiFi system to the side panel, and mounted the common power brick onto the other side panel. This allows both the HiFi system and power brick to be encompassed into the cabinet design, to make the whole thing portable. I replaced the old LCD monitor with a newer one, which has two RCA video inputs, as well as a VGA input port. Lastly, I pimped the unit up by tracing the cabinet borders with cool, red EL wire. Using a battery powered EL wire inverter, the whole cabinet lights up ๐Ÿ˜Ž.

Although I have both a full-sized CRT and a LCD monitor, I use this cabinet as both a decoration and as a portable screen. It has been useful for testing consoles after repairs (such as those in this post) to make sure everything still works, and as a portable game system.

Overall, I picked up and fixed a a lot of old consoles, accessories, and a cool custom arcade cabinet. Next year is going to be more active for EagleSoft Ltd, with an updated porfolio website and even a YouTube/Twitch streaming channel called Nerdology, where I'll review old video games/consoles ๐Ÿ˜€.

Copyright EagleSoft Ltd. Powered by Blogger.