text:
Tag Archives: Nintendo
RomUniverse's Request to Dismiss Nintendo Piracy Lawsuit Fails
2020-01-16 Ernesto
Post Syndicated from Ernesto original https://torrentfreak.com/romuniverses-request-to-dismiss-nintendo-piracy-lawsuit-fails200116/
Last year, Nintendo filed a lawsuit against the game download portal RomUniverse.
The website, which also allows users to download movies and books, was accused of massive copyright infringement, including that relating to many Nintendo titles.
"The Website contains and offers to the public an immense library of unauthorized copies of video games, primarily Nintendo video games designed for nearly every video game system Nintendo has ever produced," the complaint read.
The game company argued that the site's users downloaded hundreds of thousands of copyrighted works. RomUniverse profited from these infringements by offering premium accounts that allow users to download as many games as they want, Nintendo further alleged.
Despite these harsh allegations the site's operator, California resident Matthew Storman, wasn't giving up. He decided to defend himself in court and responded to Nintendo's claims last October through a detailed motion to dismiss.
Storman didn't deny that he is involved in the operation of RomUniverse. However, he sees himself as a Service Provider, who is not part of the 'forum' itself. On the contrary, the admin argued that he's protected by the DMCA's safe harbor provisions.
Nintendo disregarded this defense as improper, untimely, and wholly inadequate. In a detailed response, the game company requested the court to deny Storman's motion to dismiss the case.
After considering the arguments from both sides, US District Court Judge Consuelo B. Marshall has sided with Nintendo. In a ruling released yesterday, she denies the various arguments presented by Storman.
RomUniverse's operator wanted the case dismissed based on failure to state a claim, lack of jurisdiction, improper venue, insufficient service of process, and failure to join a party. None of these arguments convinced the court.
Storman, for example, argued that Nintendo is not the owner of previously purchased games because consumers have the right to sell, destroy, or give them away. The Judge didn't address this in detail but concluded that Nintendo's copyright registrations are sufficient at this stage.
Many of the defenses were linked to Storman's notion that he is shielded by the DMCA's safe harbor protections. Nintendo previously said that a motion to dismiss isn't the proper stage to invoke this defense and the court agrees.
'The Court cannot determine whether the DMCA's safe harbor provisions apply to Defendant at this stage because there is no evidence before the Court regarding whether Defendant is a service provider who satisfies the statutory requirements for protection pursuant to the DMCA's safe harbors," Judge Marshall writes.
Even if Storman has the right to safe harbor under the DMCA, that wouldn't make the trademark infringement and unfair competition claims go away.
"Even assuming the DMCA's safe harbor provisions apply to Defendant, those safe harbors would not protect Defendant from liability as to Plaintiff's trademark infringement and unfair competition claims," Judge Marshall adds.
All in all, the court denied RomUniverse's motion to dismiss. Judge Marshall further requests the site's operator to file a formal response to the complaint, which is due in two weeks. Whether Storman will continue this fight on his own or will retain an attorney is unknown.
A copy of US District Court Judge Consuelo B. Marshall's order is available here (pdf).
afeatnewsNintendoromuniverse
Nintendo Wins Injunction Against Switch Mod & Pirate Game Seller
Post Syndicated from Andy original https://torrentfreak.com/nintendo-wins-injunction-against-switch-mod-pirate-game-seller-200102/
In January 2018, hacking group Team-Xecuter announced a Nintendo Switch hack that presented the opportunity for people to run pirated games on the console.
This type of exploit is nothing new for hardware manufacturers like Nintendo but given its aggressive stance towards its intellectual property rights, the company wasn't likely to sit back and watch the development and distribution that followed.
Indeed, during December 2018, Nintendo took legal action against a California resident alleged to have sold Nintendo Switch mod devices produced by Team-Xecuter, memory cards containing pirated copies of Nintendo titles, plus a modified version of the NES Classic accompanied by 800 pirated games.
The main defendant in the case, initially identified as 'Mikel Euskaldunak' by Nintendo, was later named as Sergio Mojarro Moreno. In September 2019 there were signs that the parties had agreed to settle the case and on December 30, 2019, that agreement was detailed by a California court.
Stating that Nintendo is a world-famous video gaming brand whose status is underpinned by substantial investment in intellectual property, the consent judgment and injunction begins with the main defendant (Does 1-10 were dismissed) agreeing that Nintendo's copyrights and trademarks are "valid and enforceable in all respects" while acknowledging that the company's technical protection measures are "valid".
The judgment then goes on to restrain the defendant and anyone acting in concert with him from circumventing, offering services, and/or offering technologies, devices or components that circumvent Nintendo's technical protection measures.
Moreno is also restrained from selling, renting, offering or distributing unauthorized copies of Nintendo's copyrighted works, infringing its trademarks, or using the Internet "or any digital network" to provide services to the public that enable copyright infringement of Nintendo's works.
The consent judgment requires the defendant to refrain from several types of additional conduct such as challenging the validity or enforceability of any Nintendo intellectual property right or technological protection method "in any forum in the future", hacking, modifying or circumventing Nintendo's technical measures, or reverse engineering any computer program or software developed by Nintendo or its affiliates.
The defendant is further required to provide written certification to Nintendo that no circumvention software or devices, including but not limited to SX Pro or Trinket M0 chips, and/or illegal copies of games were in his or his agents' possession at the date of the stipulated judgment and injunction or, if they were, have been destroyed.
Entering judgment in favor of Nintendo on each and every claim for relief in its amended complaint, the court ordered the parties to bear their own costs and attorneys' fees while standing by to enforce the terms of the order in the event of any further dispute.
Obtained by TorrentFreak, the stipulated judgment and permanent injunction can be viewed here (pdf)
afeatBreaking NewsNintendoNintendo SwitchTeam-Xecuter
Nintendo Counters RomUniverse Operator's Defense in Piracy Case
Post Syndicated from Ernesto original https://torrentfreak.com/nintendo-counters-romuniverse-operators-defense-in-piracy-case-191226/
In September, Nintendo filed a lawsuit against the game download portal RomUniverse.
The website, which also allows users to download movies and books, stands accused of massive copyright infringement, including that relating to many Nintendo titles.
"The Website is among the most visited and notorious online hubs for pirated Nintendo video games. Through the Website, Defendants reproduce, distribute, monetize, and offer for download thousands of unauthorized copies of Nintendo's video games," the Japanese gaming giant wrote.
RomUniverse profited from these copyright infringements by offering premium accounts that allow users to download as many games as they want, Nintendo further alleged.
The site's operator, California resident Matthew Storman, is not backing down, however. He decided to defend himself in court and responded to Nintendo's claims last October through a detailed motion to dismiss.
Storman didn't deny that he is involved in the operation of RomUniverse. However, he sees himself as a Service Provider, who is not part of the 'forum' itself. On the contrary, the admin argues that he's protected by the DMCA's safe harbor provisions.
In addition, RomUniverse's operator said that Nintendo is not the owner of the files and therefore has no standing in this case. Citing the First Sale Doctrine, Storman argued that those who buy games have the right to sell, destroy, or give them away.
"The First Sale Doctrine permits non-copyright or trademark owner to dispose of their copies as they see fit. The Plaintiff does not own copies on websites," Storman wrote.
Late last week Nintendo responded to the motion to dismiss, describing is as wholly inadequate. Storman's arguments "completely miss the mark" and his "smattering of passing references to other legal arguments are similarly unavailing," the company counters.
Nintendo points out that Storman's affirmative defenses are not supposed to be pled in a motion to dismiss. Looking beyond this procedural issue, the game company notes that they would not work either.
Starting with the first sale doctrine defense, Nintendo points out that this doesn't apply to mass copyright infringement. It only allows an owner of a lawful copy to dispose of an individual copy of a work.
"Mr. Storman is doing much more than simply distributing any copy of Nintendo's copyrighted video games he many have," Nintendo writes.
"Instead, he is reproducing the video games, creating derivative works, and distributing hundreds of thousands of those derivative works. The first sale doctrine does not permit such blatant infringement."
The DMCA safe harbor defense doesn't work for Storman either, Nintendo notes. While RomUniverse's operator didn't specify which of the four safe harbors he relies on, it appears to be the one related to storage providers.
This safe harbor doesn't apply, Nintendo says, as Storman himself uploads, organizes, and catalogs infringing content. That alone is enough to lose safe harbor protections. In addition, the operator also receives a direct financial benefit that can be linked to the infringing material.
In the motion to dismiss, Storman highlighted that Nintendo sent him DMCA notices, which should confirm that he indeed has safe harbor protection. However, the game company counters that these notices are irrelevant. A service operator itself has to make sure that it ticks all the boxes when it comes to safe harbor eligibility.
All in all, it appears that by defending himself, Storman's motion to dismiss is not as strong as he might have hoped. The matter is now in the hands of the court which, at the time of writing, has yet to rule on the matter.
Meanwhile, RomUniverse remains up and running and Storman continues to request financial support for his legal battle.
A copy of Nintendo's response to Storman's motion to dismiss the complaint is available here (pdf).
Nintendo Wipes 'Piracy Enabling' URLs from Google with Anti-Circumvention Notices
Post Syndicated from Ernesto original https://torrentfreak.com/nintendo-wipes-piracy-enabling-urls-from-google-with-anti-circumvention-notices-191123/
As one of the most iconic gaming manufacturers in the world, Nintendo has been fighting piracy for many years.
The company has an in-house anti-piracy division that signals the latest threats to steer enforcement actions in the right direction.
This has resulted in high-profile lawsuits against ROM sites as well as site blocking efforts. For example, earlier this year the company obtained an injunction from the UK High Court which ordered local ISPs to block sites that enable Nintendo Switch piracy.
This included the homes of the infamous Team-Xecutor, as well as sites that sell R4i flashcard adaptors which allow Switch owners to load custom firmware.
The problem for Nintendo is that this blockade is limited to the UK. However, in recent months the company has used another strategy to limit the availability of these sites worldwide, with minimal effort. Instead of going to court, it went to Google.
The gaming company has sent hundreds of takedown notices to the search engine, targeting thousands of URLs. These requests are not standard copyright takedowns. Instead, Nintendo flags the sites for violating the DMCA's anti-circumvention provision.
This includes many pages from Team-Xecuter's site, which offers software to jailbreak the Switch console and bypass other protection measures.
"Nintendo's technological protection measures ('TPMs') ensure that only official copies of its game software can be played on Nintendo's video game systems," Nintendo writes.
"The circumvention devices, products or components offered at the reported links bypass Nintendo's TPMs so that users can play unauthorized copies of Nintendo's game files that are offered unlawfully via the Internet," the notice adds.
Some of the URLs
Nintendo notes that some of the URLs offer circumvention devices and tools directly, but it also highlights pages that "promote and direct" visitors to resellers of the circumvention components.
While Team-Xecuter is one of the main targets, Nintendo is also going after legitimate stores that offer R4i and R4S dongles. This includes Newegg, a well-known electronics retailer based in California.
At the time of writing, Newegg no longer lists any R4i dongles on its .com site but the Canadian version still has some, including the one below. Nintendo also asked Google to remove this page, but for now, it's still listed in the search results.
The same isn't true for many other pages. Most well-ranked Team-Xecuter URLs, including the homepage, have been removed from Google. The same is true for other sites such as usachipss.com, mod-switch.com, mlgames.net, and funnyplaying.com.
Whether the site operators agree with the takedowns or not, they are generally irreversible. Google says that unlike regular DMCA copyright takedowns, there is no counternotice process. The DMCA doesn't prescribe a takedown and counter-notification scheme for DRM circumvention.
While Google has voluntarily chosen to take the URLs offline, it is not required to offer a counter-notice option. This puts targeted sites at a severe disadvantage.
This means that for rightsholders this takedown route can be quite effective. Just a few weeks ago we showed that the RIAA uses the same grounds to remove the URLs of YouTube download platforms, and even scammers have previously used the anti-circumvention route as well.
afeatnewsNintendoNintendo SwitchTeam-Xecuter
RomUniverse Admin Asks Court to Dismiss Nintendo's Piracy Lawsuit
Post Syndicated from Ernesto original https://torrentfreak.com/romuniverse-admin-asks-court-to-dismiss-nintendos-piracy-lawsuit-191026/
Last month, Nintendo filed a lawsuit against the game download portal RomUniverse.
According to the game company, "hundreds of thousands of copies" have been illegally downloaded through RomUniverse. The site, meanwhile, profits from this by offering premium memberships that allow users to download as many games as they want.
This week, the operator of RomUniverse, California resident Matthew Storman, responded to Nintendo's claims. Instead of hiring an attorney, he is defending himself in court, starting with a detailed motion to dismiss the complaint.
Storman doesn't deny that he is involved in the operation of RomUniverse. However, he sees himself as a Service Provider, who is not part of the 'forum' itself. On the contrary, the admin argues that he's protected by the DMCA's safe harbor provisions.
"Since DMCA protects SP from any liability, and only limits Plaintiff to only injunctive relief, the Plaintiff complaints are without basis and potentially an abuse of process," the motion to dismiss reads.
The motion doesn't clearly name who is responsible for the files that are uploaded to the site, but it suggests that they are copies of games from people who obtained them legally.
Taking matters a step further, RomUniverse's operator argues that Nintendo is not the owner of the files and therefore has no standing in this case. Citing the First Sale Doctrine, Storman argues that those who buy games have the right to sell, destroy, or give them away.
"The First Sale Doctrine permits non-copyright or trademark owner to dispose of their copies as they see fit. The Plaintiff does not own copies on websites," the motion reads.
As mentioned before, Storman further argues that he is protected by the DMCA's safe harbor. In the motion, he explains that takedown requests that were sent on behalf of Nintendo were honored in the past.
Some of the takedown notices that were sent suggested that this was enough to prevent any legal action. This includes the following passage from a Nintendo DMCA notice.
"Therefore I request you to take immediate action to remove or disable access to unauthorised copies of the Nintendo Game listed at the URLs below and in order to prevent further legal actions against your company."
According to Storman, this is an implied contract suggesting that any potentially infringing copies that were removed will not result in further legal action.
Based on these and many other arguments, the RomUniverse operator (/service provider) asks the US District Court for the Central District of California to dismiss the complaint.
While Storman makes several interesting arguments, the question is whether any of these will hold up in court. On top of that, waging a legal battle against a billion-dollar gaming empire is already a challenge with a good lawyer. Doing so without any legal representation will be even harder.
Nintendo will likely file its response during the coming weeks, and after that, it will be up to the court to make a decision. In the meantime, RomUniverse remains online.
A copy of the memorandum in support of the motion to dismiss, filed pro se by Matthew Storman, is available here (pdf).
Nintendo Takes Down Facebook-Tooled Donkey Kong Remake
Post Syndicated from Andy original https://torrentfreak.com/nintendo-takes-down-facebook-tooled-donkey-kong-remake-190930/
If one took a broad overview of the entire history of video gaming, few would dare to argue Nintendo's legend status over the past several decades.
The Japanese company's games, both old and new, are renowned for their brilliance and enduring characters. Arguably the most iconic is Mario, who first made his appearance as the hero in the timeless 1981 release Donkey Kong.
Even today, dangerously close to 40 years on, countless players still enjoy this and other classics on emulators and similar tools but Nintendo's tolerance is becoming increasingly fragile. Over the past couple of years, as players toil in the shadows to defeat Kong, Nintendo has become a litigation machine throwing takedown notices and even lawsuits (1,2,3) at sites and alleged infringers.
The company's latest effort came on Friday when it sent a copyright complaint to development platform Github. The target was a remake of Donkey Kong built with React Native, the open-source mobile application framework created by Facebook.
Created by developer 'bberak', this React Native version of Donkey Kong isn't an emulation, it was created from the ground up for iOS and Android and documented in a detailed post on Hackernoon in April 2018.
The jumps and gameplay quirks reveal this is no emu
Perhaps a little unusually, given the risks associated with stepping on Nintendo's toes lately, the original repo — which was now been taken down — basically acknowledges that parts of the project may infringe copyright. The game's code may have been created independently but the visual and audio assets are undoubtedly Nintendo's. And the repo happily pointed to the company behind the project too.
"Copyright Notice: All content, artwork, sounds, characters and graphics are the property of Nintendo of America Inc, its affiliates and/or subsidiaries," the repo read.
"Get in Touch: We are Neap — a development and design team in Sydney. We love building stuff and meeting new people, so get in touch with us at https://neap.co."
The Neap website reveals that 'bberak' is Boris Berak, co-founder and Technical Director of the Australia-based company. TF contacted them for comment but at the time of publication, we hadn't received a response.
In hindsight, it was probably a mistake to use Donkey Kong as a technical demo since Nintendo has already shown an aversion to such projects in the past. Back in June 2017, the company targeted a Donkey Kong remake for Roku, also hosted on Github. Interestingly, the complaint filed Friday appears to have an artifact from that two-year-old notice.
Stating the content being targeted most recently, Nintendo states: "Nintendo's Donkey Kong video game, covered by U.S. Copyright Reg. No. PA0000115040 (supplemented by PA0000547470). The reported repository contains a recreation of Nintendo's Donkey Kong video game for Roku, which was created and published without Nintendo's authorization."
The text is an exact match with that in the earlier complaint, even going as far as referencing Roku, which appears to be an error. Nevertheless, those details are irrelevant to the claim and won't be good grounds for a counter-notice.
As Nintendo's notice points out, at least another 30 developers forked this Donkey Kong variant on Github, so all those repositories have been taken down too. They could probably be restored if Berak removed all the original Donkey Kong references, graphics, and sound, but that seems unlikely.
afeatBreaking Newsdonkey kongGithubNintendo
RomUniverse Aims to Crowdfund Legal 'Piracy' Battle With Nintendo
Post Syndicated from Ernesto original https://torrentfreak.com/romuniverse-aims-to-crowdfund-legal-piracy-battle-with-nintendo-190923/
Two weeks ago, Nintendo filed a lawsuit against the game download portal RomUniverse.
In the complaint filed at a federal court in California, Nintendo further stated that the site, which reportedly has 375,000 members, offers downloads for nearly every video game system it has ever produced.
The alleged operator of RomUniverse is California resident Matthew Storman. He was served shortly after the action was filed but has yet to file a response to the allegations. Going up against a major company such as Nintendo is no easy feat and to foot the legal bills, Storman is now asking the public for help.
The operator has added a donation option to the RomUniverse homepage and also launched a crowdfunding campaign on GoFundMe, setting a goal of $100,000 to assist with the defense.
"RomUniverse.com was founded in 2009 under the notion that users like you should have easy access to the content that you purchased and the ability to relive those childhood moments. It is because of this, that I am asking for your help," Storman writes.
A representative of RomUniverse previously informed TorrentFreak that the site responds to takedown notices, but that it didn't receive any from Nintendo recently. While it's not hard to see that pirated games are indeed shared on the site, Storman is determined to put up a fight.
"Now I know what you're thinking, this one person is going to take on one of the largest console/gaming manufacturers in the world? And the short answer is YES," he notes.
"I believe that I have a solid defense, and considering that other romsites have folded and settled, this has never been done before," Storman adds.
The RomUniverse operator likely refers to the now-defunct ROM sites LoveROMS.com and LoveRETRO.co. These were sued by Nintendo last year and the owners, a married couple, agreed to resolve the matter in exchange for a $12 million consent judgment.
The 'admin' of the official discord channel shared the link to the GoFundMe campaign with us, so the crowdfunding campaign is indeed linked to the ROM site. We subsequently requested more information on the forthcoming defense but, at the time of publication, we have yet to hear back.
On the GoFundMe page, Storman notes that he's not "greedy" or a scammer. He merely wants to defend his rights and those of others in this "unknown" landscape. In the meantime, the site remains online.
While some people may have donated to the site directly, thus far, the crowdfunding campaign on GoFundMe hasn't gained any traction. After two days, the donation counter is still at $0.
Nintendo Sues RomUniverse for Mass Copyright Infringement
Post Syndicated from Ernesto original https://torrentfreak.com/nintendo-sues-romuniverse-for-mass-copyright-infringement/
Last year Nintendo made headlines worldwide when it filed a lawsuit against the popular ROM sites LoveROMS.com and LoveRETRO.co.
The legal action effectively shut the sites down with many other platorms voluntarily following suit.
Not all game pirate sites were shaken up by the legal action though. RomUniverse, a site that's been around for a decade, saw its visitor numbers rise and announced that it would continue to offer Nintendo ROMs.
Fast forward a year and Nintendo is now taking RomUniverse to court. In a complaint filed at a federal court in California, the Japanese gaming giant accuses the site's alleged operator, Matthew Storman, of "brazen" and "mass-scale" copyright and trademark infringement.
"The Website is among the most visited and notorious online hubs for pirated Nintendo video games. Through the Website, Defendants reproduce, distribute, monetize, and offer for download thousands of unauthorized copies of Nintendo's video games," the complaint reads.
Nintendo states that the site, which has 375,000 members, offers downloads for nearly every video game system it has ever produced.
The complaint specifically notes that "hundreds of thousands of copies" have been illegally downloaded through RomUniverse, including nearly 300,000 copies of pirated Nintendo Switch games and more than 500,000 copies of pirated Nintendo 3DS games.
Users of the site can download one file per week for free. Those who want more have to sign up for a paid membership. After an "upgrade" of $30, members are allowed to download as many files as they want. This includes games, but also ebooks and the latest Hollywood movies.
As said before, RomUniverse wasn't impressed by the legal threats Nintendo issued against other sites last year. This didn't go unnoticed to the game publisher, which specifically mentions the operator's defiance in its complaint.
"In 2018, around the time that Nintendo successfully enforced its intellectual property rights against other infringing ROM websites, defendant Storman bragged that his Website would continue to offer Nintendo ROMs," Nintendo writes.
Through the lawsuit, which also lists a count of unfair competition, Nintendo hopes to shut RomUniverse down. The company also requests statutory damages of $150,000 per infringing Nintendo game and up to $2,000,000 for each trademark infringement.
This means that, with dozens of copyrighted titles and trademarks on the record, theoretical damages are well over $100 million.
Finally, Nintendo further asks for a permanent injunction ordering the site and its operator(s) to stop their infringing activities while handing over their domain names to the game publisher.
Update: RomAdmin from RomUniverse informed us that he hasn't received anything from Nintendo, no recent takedown notices either. The site does respond to takedown notices.
"We've always immediately taken down questionable material, per their take down notices," RomAdmin told TorrentFreak.
A copy of Nintendo's complaint against Matthew Storman and any "John Doe" accomplices, is available here (pdf).
Nintendo Wins Blocking Injunction Against Four Piracy-Enabling Sites
Post Syndicated from Andy original https://torrentfreak.com/nintendo-wins-blocking-injunction-against-four-piracy-enabling-sites-190911/
Every manufacturer of mass-market video gaming consoles has faced the possibility of piracy on their platforms.
The tools to prevent piracy usually come as a two-man team of hardware and software trickery (technological protection measures) but these are often defeated, later if not sooner.
Nintendo, in particular, has been struggling with piracy on its Switch console, facilitated by circumvention tools (particularly SX Pro and SX OS) promoted and made available to users via various websites.
In an effort to tame the threat, Nintendo went to the High Court of England and Wales, requesting an injunction that would prevent subscribers of several major ISPs from gaining access to the sites in question.
As is common in such cases, the ISPs themselves – Sky, BT, EE, TalkTalk, and Virgin Media – were the named defendants in the case. Nintendo (NCL) asked the Court to compel them to block team-xecutor.com, sx-xecutor.com (both operated by Team Xecutor) plus sxflashcart.com and xecuteros.com (previously stargate3ds.org).
Most ISP blocking in the UK is the result of copyright infringement proceedings but Nintendo's opening drive against the above sites is that they use the company's trademarks without permission.
Justice Arnold said that in his opinion it is "beyond dispute" that the sites use Nintendo's marks in order to promote circumvention devices. He also agreed that the devices were made available to the public on the basis they would be used to provide access to infringing content, since they all mention piracy in promotional material.
"The injunction sought is necessary to prevent, or at least reduce, substantial damage to NCL. It appears that substantial sales of the circumvention devices have been made in the UK, that substantial quantities of pirated games have been downloaded in the UK and installed on Switches using the circumvention devices and that NCL has sustained significant losses as a result," Justice Arnold writes.
"No alternative measures are realistically available to NCL since NCL has been unable to identity the operators of the Target Websites, who may well be abroad."
The Judge further notes that cease and desist notices sent by Nintendo's lawyers were ignored by the target sites while hosting providers, "to the extent they could be identified", also took no action.
While noting that blocking can be easily circumvented, the Judge said that blocking can be effective in reducing traffic to the sites in question, acts as a deterrent, won't be detrimental to the ISPs' business, and is therefore a proportionate response to infringement.
The order handed down by Justice Arnold on Tuesday can be obtained here
afeatnewsNintendoNintendo Switch
Adding the Pi to Picasso with wireless digital graffiti
2019-01-09 Alex Bate
Post Syndicated from Alex Bate original https://www.raspberrypi.org/blog/wiimote-graffiti-raspberry-pi/
It looks like the Nintendo Wii Remote (Wiimote) has become a staple in many maker toolkits! Case in point: with the help of a Raspberry Pi and the cwiid Python library, David Pride turned the popular piece of tech into a giant digital graffiti spraycan.
Using the Wiimote with a Raspberry Pi
While it's no longer being updated and supported, the cwiid library is still a handy resource for creators who want to integrate the Wiimote with their Raspberry Pi.
Over the years, makers have used the Wiimote to control robots, musical instruments, and skateboards; the accessibility of the library plus the low cost and availability of the remote make using this tool a piece of cake…or pie, in this instance.
Digital graffiti
Using aWiimote, a Wii Sensor Bar, and a large display, David Pride hacked his way to digital artistry wonderment and enabled attendees of the Open University Knowledge Makers event to try their hand at wireless drawing. It's kinda awesome.
OK, it's all kinds of awesome. We really like it.
Digital graffiti ingredients
To construct David's digital graffiti setup, you'll need:
A Raspberry Pi
A Nintendo Wii Remote and a Wii Sensor Bar
A power supply and DC/DC power converter
A large display, e.g. a TV or projector screen
A 30mm × 30mm mirror and this 3D-printed holder
David provides the step-by-step instructions for setting up the Wiimote and Raspberry Pi on his website, including a link to the GitHub repository with the complete project code. The gist of the build process is as follows:
After installing the cwiid library on the Raspberry Pi, David connected the Pi to the Wiimote via Bluetooth. And after some digging into the onboard libraries of the remote itself, he was able to access the infrared technology that lets the remote talk to the Sensor Bar.
The 3D-printed holder with which David augmented the Wiimote lets the user hold the remote upright like a spray can, while the integrated mirror reflects the IR rays so the Sensor Bar can detect them.
The Sensor Bar perceives the movement of the Wiimote, and this data is used to turn the user's physical actions into works of art on screen. Neat!
If you've used the Nintendo Wiimote for your Raspberry Pi projects, let us know. And, speaking of the Wii, has anyone hacked their Balance Board with a Pi?
On a completely unrelated note…
How cool is this?!
The post Adding the Pi to Picasso with wireless digital graffiti appeared first on Raspberry Pi.
artDavid PrideNintendoraspberry pi 3wiimoteYour Projects
Stream to Twitch with the push of a button
Post Syndicated from Alex Bate original https://www.raspberrypi.org/blog/tinkernut-twitch-streaming/
Stream your video gaming exploits to the internet at the touch of a button with the Twitch-O-Matic. Everyone else is doing it, so you should too.
Twitch-O-Matic: Raspberry Pi Twitch Streaming Device – Weekend Hacker #1804
Some gaming consoles make it easy to stream to Twitch, some gaming consoles don't (come on, Nintendo). So for those that don't, I've made this beta version of the "Twitch-O-Matic". No it doesn't chop onions or fold your laundry, but what it DOES do is stream anything with HDMI output to your Twitch channel with the simple push of a button!
eSports and online game streaming
Interest in eSports has skyrocketed over the last few years, with viewership numbers in the hundreds of millions, sponsorship deals increasing in value and prestige, and tournament prize funds reaching millions of dollars. So it's no wonder that more and more gamers are starting to stream live to online platforms in order to boost their fanbase and try to cash in on this growing industry.
Streaming to Twitch
Launched in 2011, Twitch.tv is an online live-streaming platform with a primary focus on video gaming. Users can create accounts to contribute their comments and content to the site, as well as watching live-streamed gaming competitions and broadcasts. With a staggering fifteen million daily users, Twitch is accessible via smartphone and gaming console apps, smart TVs, computers, and tablets. But if you want to stream to Twitch, you may find yourself using third-party software in order to do so. And with more buttons to click and more wires to plug in for older, app-less consoles, streaming can get confusing.
Enter Tinkernut.
Side note: we Tinkernut
We've featured Tinkernut a few times on the Raspberry Pi blog – his tutorials are clear, his projects are interesting and useful, and his live-streamed comment videos for every build are a nice touch to sharing homebrew builds on the internet.
So, yes, we love him. [This is true. Alex never shuts up about him. – Ed.] And since he has over 500K subscribers on YouTube, we're obviously not the only ones. We wave our Tinkernut flags with pride.
Twitch-O-Matic
With a Raspberry Pi Zero W, an HDMI to CSI adapter, and a case to fit it all in, Tinkernut's Twitch-O-Matic allows easy connection to the Twitch streaming service. You'll also need a button – the bigger, the better in our opinion, though Tinkernut has opted for the Adafruit 16mm Illuminated Pushbutton for his build, and not the 100mm Massive Arcade Button that, sadly, we still haven't found a reason to use yet.
"I'm sorry, Dave…"
For added frills and pizzazz, Tinketnut has also incorporated Adafruit's White LED Backlight Module into the case, though you don't have to do so unless you're feeling super fancy.
The Raspberry Pi Zero W is connected to the HDMI to CSI adapter via the camera connector, in the same way you'd attach the camera ribbon. Tinkernut uses a standard Raspbian image on an 8GB SD card, with SSH enabled for remote access from his laptop. He uses the simple command Raspivid to test the HDMI connection by recording ten seconds of video footage from his console.
One lead is all you need
Once you have the Pi receiving video from your console, you can connect to Twitch using your Twitch stream key, which you can find by logging in to your account at Twitch.tv. Tinkernut's tutorial gives you all the commands you need to stream from your Pi.
The frills
To up the aesthetic impact of your project, adding buttons and backlights is fairly straightforward.
Pretty LED frills
To run the stream command, Tinketnut uses a button: press once to start the stream, press again to stop. Pressing the button also turns on the LED backlight, so it's obvious when streaming is in progress.
For the full code and 3D-printable case STL file, head to Tinketnut's hackster.io project page. And if you're already using a Raspberry Pi for Twitch streaming, share your build setup with us. Cheers!
The post Stream to Twitch with the push of a button appeared first on Raspberry Pi.
183DADAdafruitaesAIAllalsappappsaptarcadearinartATIbetaBETTbleblogCCADcamcameracarCASCaseclicodecompetitionComputeComputersconsoleDailydavdeaecedetexploitexploitsfanfirformfruitFungamegamingGREHacksterhackster.ioHATICEIDEindustryinternetIPirslaptoplaunchLEDlightlightsloggingMakemillionMPANABnbaNCRNECNESNintendoonionOnlineOpinionOUsPApartyPetphonePi ZeroPi Zero WPINprojectProjectspsRraspberryraspberry piRaspberry Pi ZeroRaspberry Pi Zero/Zero WraspbianratraterecordremoteRemote accessrestRTIS.SAMscrSESsetupskysoftwaresportssshStarstreamingstsTAGtedtestTheTICtimeTinkernuttortouchTutorialTutorialstvUIunUSUsefulUSTRvideovideoswarwatchwinYour ProjectsyoutubeYouTuberszeroZero W
SoFi, the underwater robotic fish
Post Syndicated from Alex Bate original https://www.raspberrypi.org/blog/robotic-fish/
With the Greenland shark finally caught on video for the very first time, scientists and engineers are discussing the limitations of current marine monitoring technology. One significant advance comes from the CSAIL team at Massachusetts Institute of Technology (MIT): SoFi, the robotic fish.
A Robotic Fish Swims in the Ocean
More info: http://bit.ly/SoFiRobot Paper: http://robert.katzschmann.eu/wp-content/uploads/2018/03/katzschmann2018exploration.pdf
The untethered SoFi robot
Last week, the Computer Science and Artificial Intelligence Laboratory (CSAIL) team at MIT unveiled SoFi, "a soft robotic fish that can independently swim alongside real fish in the ocean."
Directed by a Super Nintendo controller and acoustic signals, SoFi can dive untethered to a maximum of 18 feet for a total of 40 minutes. A Raspberry Pi receives input from the controller and amplifies the ultrasound signals for SoFi via a HiFiBerry. The controller, Raspberry Pi, and HiFiBerry are sealed within a waterproof, cast-moulded silicone membrane filled with non-conductive mineral oil, allowing for underwater equalisation.
The ultrasound signals, received by a modem within SoFi's head, control everything from direction, tail oscillation, pitch, and depth to the onboard camera.
As explained on MIT's news blog, "to make the robot swim, the motor pumps water into two balloon-like chambers in the fish's tail that operate like a set of pistons in an engine. As one chamber expands, it bends and flexes to one side; when the actuators push water to the other channel, that one bends and flexes in the other direction."
Ocean exploration
While we've seen many autonomous underwater vehicles (AUVs) using onboard Raspberry Pis, SoFi's ability to roam untethered with a wireless waterproof controller is an exciting achievement.
"To our knowledge, this is the first robotic fish that can swim untethered in three dimensions for extended periods of time. We are excited about the possibility of being able to use a system like this to get closer to marine life than humans can get on their own." – CSAIL PhD candidate Robert Katzschmann
As the MIT news post notes, SoFi's simple, lightweight setup of a single camera, a motor, and a smartphone lithium polymer battery set it apart it from existing bulky AUVs that require large motors or support from boats.
For more in-depth information on SoFi and the onboard tech that controls it, find the CSAIL team's paper here.
The post SoFi, the underwater robotic fish appeared first on Raspberry Pi.
2018ADadsAIAllalsapparinartartificial intelligenceATIATSautonomousbit.lybleblogboatsbulkCcamcameraCASciciaComputecomputer sciencecontrolcontrollerdimensionecedEdgeeteufirfishformGREHAThttpIDEintelintelligenceIPirsKATLEDlightlimitMakeminermitMonitormonitoringmotorsMoUnewsNintendooperaOSSOtherOUsPAphonepspthRraspberryraspberry piraspberry pi 3ratraterobotroboticsRTIS.sciencesetupsignalstssupportteateamtechTechnologytedTheTICtimetorUIunUSveilvideowaterwinWirelessYour Projects
MagPi 64: get started with electronics
2017-11-30 Rob Zwetsloot
Post Syndicated from Rob Zwetsloot original https://www.raspberrypi.org/blog/magpi-64/
Hey folks, Rob here again! You get a double dose of me this month, as today marks the release of The MagPi 64. In this issue we give you a complete electronics starter guide to help you learn how to make circuits that connect to your Raspberry Pi!
MAGPI SIXTY-FOOUUUR!
Wires, wires everywhere!
In the electronics feature, we'll teach you how to identify different components in circuit diagrams, we'll explain what they do, and we'll give you some basic wiring instructions so you can take your first steps. The feature also includes step-by-step tutorials on how to make a digital radio and a range-finder, meaning you can test out your new electronics skills immediately!
Christmas tutorials
Electronics are cool, but what else is in this issue? Well, we have exciting news about the next Google AIY Projects Vision kit, which forgoes audio for images, allowing you to build a smart camera with your Raspberry Pi.
We've also included guides on how to create your own text-based adventure game and a kaleidoscope camera. And, just in time for the festive season, there's a tutorial for making a 3D-printed Pi-powered Christmas tree star. All this in The MagPi 64, along with project showcases, reviews, and much more!
Kaleido Cam
Using a normal web cam or the Raspberry Pi camera produce real time live kaleidoscope effects with the Raspberry Pi. This video shows the normal mode, along with an auto pre-rotate, and a horizontal and vertical flip.
Get The MagPi 64
Issue 64 is available today from WHSmith, Tesco, Sainsbury's, and Asda. If you live in the US, head over to your local Barnes & Noble or Micro Center in the next few days. You can also get the new issue online from our store, or digitally via our Android and iOS apps. And don't forget, there's always the free PDF as well.
Subscribe for free goodies
Want to support the Raspberry Pi Foundation and the magazine, and get some cool free stuff? If you take out a twelve-month print subscription to The MagPi, you'll get a Pi Zero W, Pi Zero case, and adapter cables absolutely free! This offer does not currently have an end date.
We hope you enjoy this issue!
Nintendo Sixty-FOOOOOOOOOOUR
Brandon gets an n64 for christmas 1998 and gets way too excited inquiries about usage / questions / comments? [email protected] © n64kids.com
The post MagPi 64: get started with electronics appeared first on Raspberry Pi.
3D4Kabout usADADIAIAIY ProjectsAllAndroidappaptartASDATIaudioBASICbleCcamcameraCASCasecasesChristmasciDigitaldosecedeffeffectsElectronicsetfirgameGitgmailGogoogleguideGuidesHATIDEiosIPIRCirsississuekidskitmagazineMagPimailMakemakingmediaMicro CentermitNECNESnewsNintendoOnlineORGpi cameraPi ZeroPi Zero WpowerprojectProjectspsRradioraspberryraspberry piRaspberry Pi FoundationReleaseROIRTIS.scrStarsupportteateachtedtestTheThe MagPiThe MagPi MagazineTICTodaytorTutorialTutorialsUIunUSvideowebwinzeroZero W
Potential impact of the Intel ME vulnerability
2017-11-28 Matthew Garrett
Post Syndicated from Matthew Garrett original https://mjg59.dreamwidth.org/49611.html
(Note: this is my personal opinion based on public knowledge around this issue. I have no knowledge of any non-public details of these vulnerabilities, and this should not be interpreted as the position or opinion of my employer)
Intel's Management Engine (ME) is a small coprocessor built into the majority of Intel CPUs[0]. Older versions were based on the ARC architecture[1] running an embedded realtime operating system, but from version 11 onwards they've been small x86 cores running Minix. The precise capabilities of the ME have not been publicly disclosed, but it is at minimum capable of interacting with the network[2], display[3], USB, input devices and system flash. In other words, software running on the ME is capable of doing a lot, without requiring any OS permission in the process.
Back in May, Intel announced a vulnerability in the Advanced Management Technology (AMT) that runs on the ME. AMT offers functionality like providing a remote console to the system (so IT support can connect to your system and interact with it as if they were physically present), remote disk support (so IT support can reinstall your machine over the network) and various other bits of system management. The vulnerability meant that it was possible to log into systems with enabled AMT with an empty authentication token, making it possible to log in without knowing the configured password.
This vulnerability was less serious than it could have been for a couple of reasons – the first is that "consumer"[4] systems don't ship with AMT, and the second is that AMT is almost always disabled (Shodan found only a few thousand systems on the public internet with AMT enabled, out of many millions of laptops). I wrote more about it here at the time.
How does this compare to the newly announced vulnerabilities? Good question. Two of the announced vulnerabilities are in AMT. The previous AMT vulnerability allowed you to bypass authentication, but restricted you to doing what AMT was designed to let you do. While AMT gives an authenticated user a great deal of power, it's also designed with some degree of privacy protection in mind – for instance, when the remote console is enabled, an animated warning border is drawn on the user's screen to alert them.
This vulnerability is different in that it allows an authenticated attacker to execute arbitrary code within the AMT process. This means that the attacker shouldn't have any capabilities that AMT doesn't, but it's unclear where various aspects of the privacy protection are implemented – for instance, if the warning border is implemented in AMT rather than in hardware, an attacker could duplicate that functionality without drawing the warning. If the USB storage emulation for remote booting is implemented as a generic USB passthrough, the attacker could pretend to be an arbitrary USB device and potentially exploit the operating system through bugs in USB device drivers. Unfortunately we don't currently know.
Note that this exploit still requires two things – first, AMT has to be enabled, and second, the attacker has to be able to log into AMT. If the attacker has physical access to your system and you don't have a BIOS password set, they will be able to enable it – however, if AMT isn't enabled and the attacker isn't physically present, you're probably safe. But if AMT is enabled and you haven't patched the previous vulnerability, the attacker will be able to access AMT over the network without a password and then proceed with the exploit. This is bad, so you should probably (1) ensure that you've updated your BIOS and (2) ensure that AMT is disabled unless you have a really good reason to use it.
The AMT vulnerability applies to a wide range of versions, everything from version 6 (which shipped around 2008) and later. The other vulnerability that Intel describe is restricted to version 11 of the ME, which only applies to much more recent systems. This vulnerability allows an attacker to execute arbitrary code on the ME, which means they can do literally anything the ME is able to do. This probably also means that they are able to interfere with any other code running on the ME. While AMT has been the most frequently discussed part of this, various other Intel technologies are tied to ME functionality.
Intel's Platform Trust Technology (PTT) is a software implementation of a Trusted Platform Module (TPM) that runs on the ME. TPMs are intended to protect access to secrets and encryption keys and record the state of the system as it boots, making it possible to determine whether a system has had part of its boot process modified and denying access to the secrets as a result. The most common usage of TPMs is to protect disk encryption keys – Microsoft Bitlocker defaults to storing its encryption key in the TPM, automatically unlocking the drive if the boot process is unmodified. In addition, TPMs support something called Remote Attestation (I wrote about that here), which allows the TPM to provide a signed copy of information about what the system booted to a remote site. This can be used for various purposes, such as not allowing a compute node to join a cloud unless it's booted the correct version of the OS and is running the latest firmware version. Remote Attestation depends on the TPM having a unique cryptographic identity that is tied to the TPM and inaccessible to the OS.
PTT allows manufacturers to simply license some additional code from Intel and run it on the ME rather than having to pay for an additional chip on the system motherboard. This seems great, but if an attacker is able to run code on the ME then they potentially have the ability to tamper with PTT, which means they can obtain access to disk encryption secrets and circumvent Bitlocker. It also means that they can tamper with Remote Attestation, "attesting" that the system booted a set of software that it didn't or copying the keys to another system and allowing that to impersonate the first. This is, uh, bad.
Intel also recently announced Intel Online Connect, a mechanism for providing the functionality of security keys directly in the operating system. Components of this are run on the ME in order to avoid scenarios where a compromised OS could be used to steal the identity secrets – if the ME is compromised, this may make it possible for an attacker to obtain those secrets and duplicate the keys.
It's also not entirely clear how much of Intel's Secure Guard Extensions (SGX) functionality depends on the ME. The ME does appear to be required for SGX Remote Attestation (which allows an application using SGX to prove to a remote site that it's the SGX app rather than something pretending to be it), and again if those secrets can be extracted from a compromised ME it may be possible to compromise some of the security assumptions around SGX. Again, it's not clear how serious this is because it's not publicly documented.
Various other things also run on the ME, including stuff like video DRM (ensuring that high resolution video streams can't be intercepted by the OS). It may be possible to obtain encryption keys from a compromised ME that allow things like Netflix streams to be decoded and dumped. From a user privacy or security perspective, these things seem less serious.
The big problem at the moment is that we have no idea what the actual process of compromise is. Intel state that it requires local access, but don't describe what kind. Local access in this case could simply require the ability to send commands to the ME (possible on any system that has the ME drivers installed), could require direct hardware access to the exposed ME (which would require either kernel access or the ability to install a custom driver) or even the ability to modify system flash (possible only if the attacker has physical access and enough time and skill to take the system apart and modify the flash contents with an SPI programmer). The other thing we don't know is whether it's possible for an attacker to modify the system such that the ME is persistently compromised or whether it needs to be re-compromised every time the ME reboots. Note that even the latter is more serious than you might think – the ME may only be rebooted if the system loses power completely, so even a "temporary" compromise could affect a system for a long period of time.
It's also almost impossible to determine if a system is compromised. If the ME is compromised then it's probably possible for it to roll back any firmware updates but still report that it's been updated, giving admins a false sense of security. The only way to determine for sure would be to dump the system flash and compare it to a known good image. This is impractical to do at scale.
So, overall, given what we know right now it's hard to say how serious this is in terms of real world impact. It's unlikely that this is the kind of vulnerability that would be used to attack individual end users – anyone able to compromise a system like this could just backdoor your browser instead with much less effort, and that already gives them your banking details. The people who have the most to worry about here are potential targets of skilled attackers, which means activists, dissidents and companies with interesting personal or business data. It's hard to make strong recommendations about what to do here without more insight into what the vulnerability actually is, and we may not know that until this presentation next month.
Summary: Worst case here is terrible, but unlikely to be relevant to the vast majority of users.
[0] Earlier versions of the ME were built into the motherboard chipset, but as portions of that were incorporated onto the CPU package the ME followed
[1] A descendent of the SuperFX chip used in Super Nintendo cartridges such as Starfox, because why not
[2] Without any OS involvement for wired ethernet and for wireless networks in the system firmware, but requires OS support for wireless access once the OS drivers have loaded
[3] Assuming you're using integrated Intel graphics
[4] "Consumer" is a bit of a misnomer here – "enterprise" laptops like Thinkpads ship with AMT, but are often bought by consumers.
ADadsadvogatoAIAllappaptArchitectureartAspectATIauthauthenticationbackdoorbankingBECBitsbleBTbugBugsBusinessCcapcarCASCaseciCIScloudcodeComputeconsoleCorecryptoCuritydatadeadesigndetDISAdisplaydocumentDRMecECRedEdgeeffembeddedemulationencryptionEnterpriseetexploitfactfedorafirfirmware updatesflashformfoxFunGoGREhardwareHATICEIDEIdentityinstallintelinternetiosIPiqIRCirsISPississueISTEkernelkeyslaptopliesMacMakemakingmanaMICROSmicrosoftmillionMPANCRNECNESNetflixNetworkNintendonseOnlineoperaOpinionOSSOtherOUsPApeoplepersonalPHIPINPlayPositionpowerPPLPresentPrivacyproblempsRratraterawRDSrealtimerecordremotereportrestROVRTIrunningRustS.ScalescrsecretssecuritysoftwareSSESSIDStarstoragestssupporttargetteatechTechnologytedtesttestingThethingsTICTokentortrustUIunupdatedUSusbvideovulnerabilitieswarwinWirelessWorkx86
Community Profile: Matthew Timmons-Brown
Post Syndicated from Alex Bate original https://www.raspberrypi.org/blog/community-profile-matthew-timmons-brown/
This column is from The MagPi issue 57. You can download a PDF of the full issue for free, or subscribe to receive the print edition in your mailbox or the digital edition on your tablet. All proceeds from the print and digital editions help the Raspberry Pi Foundation achieve its charitable goals.
"I first set up my YouTube channel because I noticed a massive lack of video tutorials for the Raspberry Pi," explains Matthew Timmons-Brown, known to many as The Raspberry Pi Guy. At 18 years old, the Cambridge-based student has more than 60 000 subscribers to his channel, making his account the most successful Raspberry Pi–specific YouTube account to date.
Matt gives a talk at the Raspberry Pi 5th Birthday weekend event
The Raspberry Pi Guy
If you've attended a Raspberry Pi event, there's a good chance you've already met Matt. And if not, you'll have no doubt come across one or more of his tutorials and builds online. On more than one occasion, his work has featured on the Raspberry Pi blog, with his yearly Raspberry Pi roundup videos being a staple of the birthday celebrations.
With his website, Matt aimed to collect together "the many strands of The Raspberry Pi Guy" into one, neat, cohesive resource — and it works. From newcomers to the credit card-sized computer to hardened Pi veterans, The Raspberry Pi Guy offers aid and inspiration for many. Looking for a review of the Raspberry Pi Zero W? He's filmed one. Looking for a step-by-step guide to building a Pi-powered Amazon Alexa? No problem, there's one of those too.
Make your Raspberry Pi artificially intelligent! – Amazon Alexa Personal Assistant Tutorial
Artificial Intelligence. A hefty topic that has dominated the field since computers were first conceived. What if I told you that you could put an artificial intelligence service on your own $30 computer?! That's right! In this tutorial I will show you how to create your own artificially intelligent personal assistant, using Amazon's Alexa voice recognition and information service!
Raspberry Pi electric skateboard
Last summer, Matt introduced the world to his Raspberry Pi-controlled electric skateboard, soon finding himself plastered over local press as well as the BBC and tech sites like Adafruit and geek.com. And there's no question as to why the build was so popular. With YouTubers such as Casey Neistat increasing the demand for electric skateboards on a near-daily basis, the call for a cheaper, home-brew version has quickly grown.
DIY 30KM/H ELECTRIC SKATEBOARD – RASPBERRY PI/WIIMOTE POWERED
Over the summer, I made my own electric skateboard using a £4 Raspberry Pi Zero. Controlled with a Nintendo Wiimote, capable of going 30km/h, and with a range of over 10km, this project has been pretty darn fun. In this video, you see me racing around Cambridge and I explain the ins and outs of this project.
Using a Raspberry Pi Zero, a Nintendo Wii Remote, and a little help from members of the Cambridge Makespace community, Matt built a board capable of reaching 30km/h, with a battery range of 10km per charge. Alongside Neistat, Matt attributes the project inspiration to Australian student Tim Maier, whose build we previously covered in The MagPi.
Despite the success and the fun of the electric skateboard (including convincing Raspberry Pi Trading CEO Eben Upton to have a go for local television news coverage), the project Matt is most proud of is his wireless LiDAR system for theoretical use on the Mars rovers.
Using a tablet app to define the angles, Matt's A Level coursework LiDAR build scans the surrounding area, returning the results to the touchscreen, where they can be manipulated by the user. With his passion for the cosmos and the International Space Station, it's no wonder that this is Matt's proudest build.
Built for his A Level Computer Science coursework, the build demonstrates Matt's passion for space and physics. Used as a means of surveying terrain, LiDAR uses laser light to measure distance, allowing users to create 3D-scanned, high-resolution maps of a specific area. It is a perfect technology for exploring unknown worlds.
Matt was invited to St James's Palace and the Houses of Parliament as part of the Raspberry Pi community celebrations in 2016
In a recent interview at Hills Road Sixth Form College, where he is studying mathematics, further mathematics, physics, and computer science, Matt revealed where his love of electronics and computer science started. "I originally became interested in computer science in 2012, when I read a tiny magazine article about a computer that I would be able to buy with pocket money. This was a pretty exciting thing for a 12-year-old! Your own computer… for less than £30?!" He went on to explain how it became his mission to learn all he could on the subject and how, months later, his YouTube channel came to life, cementing him firmly into the Raspberry Pi community
The post Community Profile: Matthew Timmons-Brown appeared first on Raspberry Pi.
20163DACEADAdafruitADIAIALAAlexaAllamazonappartartificial intelligenceATIaustraliaBBCBECbirthdaybleblogBTCcamCambridgecapcarCASCaseciciacolumncommunityCommunity ProfileComputecomputer scienceComputerscredit cardDailyDemoDigitaldowndownloadEbeneben uptonebsecedElectronicseteventfilmfinefirformfruitFunGitGoguideHATIAMICEIDEintelintelligenceinterviewIPirsississueKATlightmagazineMagPimailMakemakingmapmarsmathNCRnewsNintendoOnlineOSSOUsPApersonalphysicsPi ZeroPi Zero WPIRpowerproblemprojectpsRracingraspberryraspberry piRaspberry Pi FoundationRaspberry Pi GuyRaspberry Pi ZeroratrateRDSremoteResourcerestROVroverRTIS.sciencescrskateboardspaceStarsurveytalktechTechnologytedtelevisionThe MagPiThe Raspberry Pi GuyTICtortouchTutorialTutorialsuberUIunUnityUnKnOwNUSUSTRvideovideosvoice recognitionwebwebsitewiimotewinWirelessWorkyoutubeYouTuberszeroZero W
PlayerUnknown's Battlegrounds on a Game Boy?!
Post Syndicated from Alex Bate original https://www.raspberrypi.org/blog/playerunknowns-battlegrounds-game-boy/
My evenings spent watching the Polygon Awful Squad play PlayerUnknown's Battlegrounds for hours on end have made me mildly obsessed with this record-breaking Steam game.
So when Michael Darby's latest PUBG-inspired Game Boy build appeared in my notifications last week, I squealed with excitement and quickly sent the link to my team…while drinking a cocktail by a pool in Turkey ☀
PUBG ON A GAMEBOY
https://314reactor.com/ https://www.hackster.io/314reactor https://twitter.com/the_mikey_d
For those unfamiliar with the game: PlayerUnknown's Battlegrounds, or PUBG for short, is a Battle-Royale-style multiplayer online video game in which individuals or teams fight to the death on an island map. As players collect weapons, ammo, and transport, their 'safe zone' shrinks, forcing a final face-off until only one character remains.
The game has been an astounding success on Steam, the digital distribution platform which brings PUBG to the masses. It records daily player counts of over a million!
Yeah, I'd say one or two people seem to enjoy it!
PUBG on a Game Boy?!
As it's a fairly complex game, let's get this out of the way right now: no, Michael is not running the entire game on a Nintendo Game Boy. That would be magic silly impossible. Instead, he's streaming the game from his home PC to a Raspberry Pi Zero W fitted within the hacked handheld console.
Michael removed the excess plastic inside an old Game Boy Color shell to make space for a Zero W, LiPo battery, and TFT screen. He then soldered the necessary buttons to GPIO pins, and wrote a Python script to control them.
The maker battleground
The full script can be found here, along with a more detailed tutorial for the build.
In order to stream PUBG to the Zero W, Michael uses the open-source NVIDIA steaming service Moonlight. He set his PC's screen resolution to 800×600 and its frame rate to 30, so that streaming the game to the TFT screen works perfectly, albeit with no sound.
The end result is a rather impressive build that has confused YouTube commenters since he uploaded footage for it last week. The video has more than 60000 views to date, so it appears we're not the only ones impressed with Michael's make.
314reactor
If you're a regular reader of our blog, you may recognise Michael's name from his recent Nerf blaster mod. And fans of Raspberry Pi may also have seen his Pi-powered Windows 98 wristwatch earlier in the year. He blogs at 314reactor, where you can read more about his digital making projects.
Now it's your turn. Have you used a Raspberry Pi to create a gaming system? I'm not just talking arcades and RetroPie here. We want to see everything, from Pi-powered board games to tech on the football field.
Share your builds in the comments below and while you're at it, what game would you like to stream to a handheld device?
The post PlayerUnknown's Battlegrounds on a Game Boy?! appeared first on Raspberry Pi.
ADAIAllapparcadeATIbleblogCCADciconsoleDailydeadeathdetDigitaldigital makingecedetfanfirfootballformgamegamesgamingGitGoGPIOhackedHacksterhackster.ioHAThttphttpsICEInsideIPiplayerIPOirslightMakemakermakingmapmillionmoonmovmoveNECNESNintendonotificationsOnlineOSSPApcpeoplePi ZeroPi Zero WpiePINpinsPIRPlayPlexpowerprojectProjectspspythonRraspberryraspberry piRaspberry Pi ZeroratrateRDSReactrecordretroretropierunningS.spaceSSEstreamingTAGtalkteateamtechtedtestTICtorTutorialtwitterUIunUncategorizedUnKnOwNuploadedUSvideovideo gamewatchweaponswinwindowsWorkwwwyoutubezeroZero W
State of MAC address randomization
2017-09-05 Robert Graham
Post Syndicated from Robert Graham original http://blog.erratasec.com/2017/09/state-of-mac-address-randomization.html
tldr: I went to DragonCon, a conference of 85,000 people, so sniff WiFi packets and test how many phones now uses MAC address randomization. Almost all iPhones nowadays do, but it seems only a third of Android phones do.
Ten years ago at BlackHat, we presented the "data seepage" problem, how the broadcasts from your devices allow you to be tracked. Among the things we highlighted was how WiFi probes looking to connect to access-points expose the unique hardware address burned into the phone, the MAC address. This hardware address is unique to your phone, shared by no other device in the world. Evildoers, such as the NSA or GRU, could install passive listening devices in airports and train-stations around the world in order to track your movements. This could be done with $25 devices sprinkled around a few thousand places — within the budget of not only a police state, but also the average hacker.
In 2014, with the release of iOS 8, Apple addressed this problem by randomizing the MAC address. Every time you restart your phone, it picks a new, random, hardware address for connecting to WiFi. This causes a few problems: every time you restart your iOS devices, your home network sees a completely new device, which can fill up your router's connection table. Since that table usually has at least 100 entries, this shouldn't be a problem for your home, but corporations and other owners of big networks saw their connection tables suddenly get big with iOS 8.
In 2015, Google added the feature to Android as well. However, even though most Android phones today support this feature in theory, it's usually not enabled.
Recently, I went to DragonCon in order to test out how well this works. DragonCon is a huge sci-fi/fantasy conference in Atlanta in August, second to San Diego's ComicCon in popularity. It's spread across several neighboring hotels in the downtown area. A lot of the traffic funnels through the Marriot Marquis hotel, which has a large open area where, from above, you can see thousands of people at a time.
And, with a laptop, see their broadcast packets.
So I went up on a higher floor and setup my laptop in order to capture "probe" broadcasts coming from phones, in order to record the hardware MAC addresses. I've done this in years past, before address randomization, in order to record the popularity of iPhones. The first three bytes of an old-style, non-randomized address, identifies the manufacturer. This time, I should see a lot fewer manufacturer IDs, and mostly just random addresses instead.
I recorded 9,095 unique probes over a couple hours. I'm not sure exactly how long — my laptop would go to sleep occasionally because of lack of activity on the keyboard. I should probably setup a Raspberry Pi somewhere next year to get a more consistent result.
A quick summary of the results are:
The 9,000 devices were split almost evenly between Apple and Android. Almost all of the Apple devices randomized their addresses. About a third of the Android devices randomized. (This assumes Android only randomizes the final 3 bytes of the address, and that Apple randomizes all 6 bytes — my assumption may be wrong).
A table of the major results are below. A little explanation:
The first item in the table is the number of phones that randomized the full 6 bytes of the MAC address. I'm guessing these are either mostly or all Apple iOS devices. They are nearly half of the total, or 4498 out of 9095 unique probes.
The second number is those that randomized the final 3 bytes of the MAC address, but left the first three bytes identifying themselves as Android devices. I'm guessing this represents all the Android devices that randomize. My guesses may be wrong, maybe some Androids randomize the full 6 bytes, which would get them counted in the first number.
The following numbers are phones from major Android manufacturers like Motorola, LG, HTC, Huawei, OnePlus, ZTE. Remember: the first 3 bytes of an un-randomized address identifies who made it. There are roughly 2500 of these devices.
There is a count for 309 Apple devices. These are either older iOS devices pre iOS 8, or which have turned off the feature (some corporations demand this), or which are actually MacBooks instead of phones.
The vendor of the access-points that Marriot uses is "Ruckus". There have a lot of access-points in the hotel.
The "TCT mobile" entry is actually BlackBerry. Apparently, BlackBerry stopped making phones and instead just licenses the software/brand to other hardware makers. If you buy a BlackBerry from the phone store, it's likely going to be a TCT phone instead.
I'm assuming the "Amazon" devices are Kindle ebooks.
Lastly, I'd like to point out the two records for "Ford". I was capturing while walking out of the building, I think I got a few cars driving by.
(random) 4498
(Android) 1562
Murata 505
HTC-phone 226
Ruckus 60
OnePlus Tec 40
TCT mobile 20
Amazon Tech 19
-hp- 8
BLU Product 8
Kyocera 8
AsusTek 6
Yulong Comp 6
Lite-On 4
Sony Mobile 4
Z-COM, INC. 4
ARRIS Group 2
AzureWave 2
Barnes&Nobl 2
Ford Motor 2
Foxconn 2
Google, Inc 2
Motorola (W 2
Sonos, Inc. 2
SparkLAN Co 2
Wi2Wi, Inc 2
Xiaomi Comm 2
Alps Electr 1
Askey 1
Chi Mei Com 1
Clover Netw 1
CNet Techno 1
eSSys Co.,L 1
InPro Comm 1
JJPlus Corp 1
Raspberry P 1
Roku, Inc. 1
Sonim Techn 1
Texas Instr 1
TP-LINK TEC 1
Vizio, Inc 1
2014201590ADAIairportAllamazonAndroidappAppleaptartATIAzureBECBlackberryblebookbooksCcarcarsCAScicomicconferencedatadowndressEASTebookeBooksecedetfactfanfirfoxFunGogoogleGoProgothardwareHAThbohotelshpICEinstallinteliosIOTIPiPhoneiqirsISTElaptoplightMacMakemakermakersmakingMICROSmicrosoftmobilemovmoveNECNESNetworkNintendoNPRNSAnseOSSOtherOUspeoplephonephonespolicePPLPresentproblempsRraspberryraspberry piratRDSrecordReleaserestROIrokurouterS.SAMsetupSNIsoftwaresonySparkSSEStarstssupportteatechtedtestthingsTodaytorUIunUSwarwifiwinWork
Netflix develops Morse code search option
Post Syndicated from Alex Bate original https://www.raspberrypi.org/blog/netflix-morse-code/
What happens when Netflix gives its staff two days to hack the platform and create innovative (and often unnecessary) variations on the streaming service?
This. This is what happens.
Hack Day Summer 2017 Teleflix
Uploaded by NetflixOpenSource on 2017-08-28.
Netflix Hack Day
Twice a year, the wonderful team at Netflix is given two days to go nuts and create fun, random builds, taking inspiration from Netflix and its content. So far they've debuted a downgraded version of the streaming platform played on an original Nintendo Entertainment System (NES), turned hit show Narcos into a video game, and utilised VR technology into many more builds that, while they'll never be made public, have no doubt led to some lightbulb moments for the creative teams involved.
DarNES – Netflix Hack Day – Winter 2015
In a world… where devices proliferate… darNES digs back in time to provide Netflix access to the original Nintendo Entertainment System.
Kevin Spacey? More like 'Kevin Spacebar', am I right? Aha…ha…haaaa…I'll get my coat.
Teleflix
The Teleflix build from this summer's Hack Day is obviously the best one yet, as it uses a Raspberry Pi. By writing code that decodes the dots and dashes from an original 1920s telegraph (provided by AT&T, and lovingly restored by the team using ketchup!) into keystrokes, they're able to search for their favourite shows via Morse code.
Morse code, for the unaware, is a method for transmitting letters and numbers via a standardised series of beeps, clicks, or flashes. Stuck in a sticky situation? Three dots followed by three dashes and a further three dots gives you 'SOS'. Sorted. So long as there's someone there to see or hear it, who also understands Morse Code.
Morse code was a method of transmiting textual information as a series of on-off tones that could be directly understood by a skilled listener. Mooo-Theme: http://soundcloud.com/mooojvm/mooo-theme
So if you'd like to watch, for example, The Unbreakable Kimmy Schmidt, you simply send: – …. . / ..- -. -… .-. . .- -.- .- -… .-.. . / -.- .. — — -.– / … -.-. …. — .. -.. – and you're set. Easy!
To reach Netflix, the team used a Playstation 4. However, if you want to skip a tech step, you could stream Netflix directly to your Raspberry Pi by following this relatively new tutorial. Nobody at Pi Towers has tried it out yet, but if you have we'd be interested to see how you got on in the comments below.
And if you'd like to play around a little more with the Raspberry Pi and Morse code, you can pick up your own Morse code key, or build one using conductive components such as buttons or bananas, and try it out for yourself.
Alex's Netflix-themed Morse code quiz
Just for fun, here are the titles of some of my favourite shows to watch on Netflix, translated into Morse code. Using the key below, why not take a break and challenge your mind to translate them back into English. Reward yourself +10 imaginary House Points for each correct answer.
-.. — -.-. – — .-. / .– …. —
…. .- -. -. .. -… .- .-..
– …. . / — .-
… . -. … . —..
.— . … … .. -.-. .- / .— — -. . …
–. .. .-.. — — .-. . / –. .. .-. .-.. …
–. .-.. — .–
The post Netflix develops Morse code search option appeared first on Raspberry Pi.
20152017ADAIAllappARIAATIbleBTCChallengeclicloudcodecreativedownecedEnglishetfirflashformFungameGogotHAThttpICEIPirsISTEkeyslightMaker BuildsmitNECNESNetflixNintendoopensourceOUsPIRPlayPlaystationpsRraspberryraspberry piratraterestROVS.SearchsoundcloudspaceStaffstreamingstroketeateamtechTechnologytedTICtorTutorialUIunuploadedUSvideovideo gameVRwarwatchwinwriting
Datamining Pokémon
2017-08-03 Eevee
Post Syndicated from Eevee original https://eev.ee/blog/2017/08/02/datamining-pokemon/
A kind anonymous patron offers this prompt, which I totally fucked up getting done in July:
Something to do with programming languages? Alternatively, interesting game mechanics!
It's been a while since I've written a thing about programming languages, eh? But I feel like I've run low on interesting things to say about them. And I just did that level design article, which already touched on some interesting game mechanics… oh dear.
Okay, how about this. It's something I've been neck-deep in for quite some time, and most of the knowledge is squirrelled away in obscure wikis and ancient forum threads: getting data out of Pokémon games. I think that preserves the spirit of your two options, since it's sort of nestled in a dark corner between how programming languages work and how game mechanics are implemented.
A few disclaimers
In the grand scheme of things, I don't know all that much about this. I know more than people who've never looked into it at all, which I suppose is most people — but there are also people who basically do this stuff full-time, and that experience is crucial since so much of this work comes down to noticing patterns. While it sure helped to have a technical background, I wouldn't have gotten anywhere at all if I weren't acquainted with a few people who actually know what they're doing. Most of what I've done is take their work and run with it.
Also, I am not a lawyer and cannot comment on any legal questions here. Is it okay to download ROMs of games you own? Is it okay to dump ROMs yourself if you have the hardware? Does this count as reverse engineering, and do the DMCA protections apply? I have no idea. But that said, it's not exactly hard to find ROM hacking communities, and there's no way Nintendo isn't aware of them (or of the fact that every single Pokémon fansite gets their info from ROMs), so I suspect Nintendo simply doesn't care unless something risks going mainstream — and thus putting a tangible dent in the market for their own franchise.
Still, I don't want to direct an angry legal laser at anyone, so I'm going to be a bit selective about what resources I link to and what I merely allude to the existence of.
Some basics
This is, necessarily, a pretty technical topic. It starts out in binary data and spirals down into microscopic details that even most programmers don't need to care about. Sometimes people approach me to ask how they can help with this work, and all I can do is imagine the entire contents of this post and shrug helplessly.
Still, as usual, I'll do my best to make this accessible without also making it a 500-page introduction to all of computing. Here is some helpful background stuff that would be clumsy to cram into the rest of the post.
Computers deal in bytes. Pop culture likes to depict computers as working in binary (individual bits or "binary digits"), which is technically true down on the level of the circuitry, but virtually none of the actual logic in a computer cares about individual bits. In fact, computers can't access individual bits directly; they can only fetch bytes, then extract bits from those bytes as a separate step.
A byte is made of eight bits, which gives it 2⁸ or 256 possible values. It's helpful to see what a byte is, but writing them in decimal is a bit clumsy, and writing them in binary is impossible to read. A clever compromise is to write them in hexadecimal, base sixteen, where the digits run from 0 to 9 and then A to F. Because sixteen is 2⁴, one hex digit is exactly four binary digits, and so a byte can conveniently be written as exactly two hex digits.
(A running theme across all of this is that many of the choices are arbitrary; in different times or places, other choices may have been made. Most likely, other choices were made, and they're still in use somewhere. Virtually the only reliable constant is that any computer you will ever encounter will have bytes made out of eight bits. But even that wasn't always the case.)
The Unix program xxd will print out bytes in a somewhat readable way. Here's its output for a short chunk of English text.
00000000: 5468 6520 7175 6963 6b20 6272 6f77 6e20  The quick brown
00000010: 666f 7820 6a75 6d70 7320 6f76 6572 2074  fox jumps over t
00000020: 6865 206c 617a 7920 646f 6727 7320 6261  he lazy dog's ba
00000030: 636b 2e0a                                ck..
Each line shows sixteen bytes. The left column shows the position (or "offset") in the data, in hex. (It starts at zero, because programmers like to start counting at zero; it makes various things easier.) The middle column shows the bytes themselves, written as two hex digits each, with just enough space that you can tell where the boundaries between bytes are. The right column shows the bytes interpreted as ASCII text, with any non-characters replaced with a ..
(ASCII is a character encoding, a way to represent text as bytes — which are only numbers — by listing a set of characters in some order and then assigning numbers to them. Text crops up in a lot of formats, and this makes it easy to spot at a glance. Alas, ASCII is only one of many schemes, and it only really works for English text, but it's the most common character encoding by far and has some overlap with the runners-up as well.)
Since everything is made out of bytes, there are an awful lot of schemes for how to express various kinds of information as bytes. As a result, a byte is meaningless on its own; it only has meaning when something else interprets it. It might be a plain number ranging from 0 to 255; it might be a plain number ranging from −128 to 127; it might be part of a bigger number that spans multiple bytes; it might be several small numbers crammed into one byte; it might be part of a color value; it might be a letter.
A meaningful arrangement for a whole sequence of bytes is loosely referred to as a format. If it's intended for an entire file, it's a file format. A file containing only bytes that are intended as text is called a plain text file (or format); this is in contrast to a binary file, which is basically anything else.
Some file formats are very common and well-understood, like PNG or MP3. Some are very common but were invented behind closed doors, like Photoshop's PSD, so they've had to be reverse engineered for other software to be able to read and write them. And a great many file formats are obscure and ad hoc, invented only for use by one piece of software. Programmers invent file formats all the time.
Reverse engineering a format is largely a matter of identifying common patterns and finding data that's expected to be present somewhere. Of course, in cases like Photoshop's PSD, the most productive approach is to make small changes to a file in Photoshop and then see what changed in the resulting PSD. That's not always an option — say, if you're working with a game for a handheld that won't let you easily run modified games.
Okay, hopefully that's enough of that and you can pick up the rest along the way!
Before Diamond and Pearl, all of veekun's data was just copied from other sources. Like, when I was in high school, I would spend lunch in the computer lab meticulously copy/pasting the Gold and Silver Pokédex text from another website into mine. Hey, I started the thing when I was 12.
But then… something happened. I can't remember what it was, which makes this a much less compelling story. I assume veekun got popular enough that a couple other Pokénerds found out about it and started hanging around. Then when Diamond and Pearl came out, they started digging into the games, and I thought that was super interesting, so I did it too.
This is what led veekun into being much more about ripped data, though its track record has been… bumpy.
The Nintendo DS header and filesystem
Everything in a computer is, on some level, a sequence of bytes. Game consoles and handhelds, being computers, also deal in bytes. A game cartridge is just a custom disk, and a ROM is a file containing all the bytes on that disk. (It's a specific case of a disk image, like an ISO is for CDs and DVDs. You can take a disk image of a hard drive or a floppy disk or anything else, too; they're all just bytes.)
But what are those bytes? That's the fundamental and pervasive question. In the case of a Nintendo DS cartridge, the first thing I learned was that they're arranged in a filesystem. Most disks have a filesystem — it's like a table of contents for the disk, explaining how the one single block of bytes is divided into named files.
That is fantastically useful, and I didn't even have to figure out how it works, because other people already had. Let's have a look at it, because seeing binary formats is the best way to get an idea of how they might be designed. Here's the beginning of the English version of Pokémon Diamond.
00000000: 504f 4b45 4d4f 4e20 4400 0000 4144 4145  POKEMON D...ADAE
00000010: 3031 0000 0900 0000 0000 0000 0000 0500  01..............
00000020: 0040 0000 0008 0002 0000 0002 2477 1000  .@..........$w..
00000030: 00d0 3000 0000 3802 0000 3802 1c93 0200  ..0...8...8.....
00000040: 0064 3300 7f15 0000 007a 3300 200b 0000  .d3......z3. ...
00000050: 00b8 1000 e00a 0000 0000 0000 0000 0000  ................
00000060: 5766 4100 f808 1808 0086 3300 3159 7e0d  WfA.......3.1Y~.
00000070: 740a 0002 5801 3802 0000 0000 0000 0000  t...X.8.........
00000080: c05e a503 0040 0000 684b 0000 0000 0000  .^...@..hK......
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000c0: 24ff ae51 699a a221 3d84 820a 84e4 09ad  $..Qi..!=.......
000000d0: 1124 8b98 c081 7f21 a352 be19 9309 ce20  .$.....!.R.....
000000e0: 1046 4a4a f827 31ec 58c7 e833 82e3 cebf  .FJJ.'1.X..3....
000000f0: 85f4 df94 ce4b 09c1 9456 8ac0 1372 a7fc  .....K...V...r..
How do we make sense of this? Let us consult the little tool I started writing for this, porigon-z. It's abandoned and unfinished and not terribly well-written; I would just link to the documentation I consulted when writing this, but it's conspicuously 404ing now, so this'll have to do. I described the format using an old version of the Construct binary format parsing library, and it looks like this:
nds_image_struct = Struct('nds_image',
String('title', 12),
String('id', 4),
ULInt16('publisher_code'),
ULInt8('unit_code'),
ULInt8('device_code'),
ULInt8('card_size'),
String('card_info', 10),
ULInt8('flags'),
A String is text of a fixed length, either truncated or padded with NULs (character zero) to fit. The clumsy ULInt16 means an Unsigned, Little-endian, 16-bit (two byte) integer.
(What does little-endian mean? I'm glad you asked! When a number spans multiple bytes, there's a choice to be made: what order do those bytes go in? The way we write numbers is big-endian, where the biggest part appears first; but most computers are little-endian, putting the smallest part first. That means a number like 0x1234 is actually stored in two bytes as 34 12.)
Alas, this is a terrible example, since most of this is goofy internal stuff we don't actually care about. The interesting bit is the "file table". A little ways down my description of the format is this block of ULInt32s, which start at position 0x40 in the file.
file_table_offset   00 64 33 00 = 0x00336400
file_table_length   7f 15 00 00 = 0x0000157f (5503)
fat_offset          00 7a 33 00 = 0x00337a00
fat_length          20 0b 00 00 = 0x00000b20 (2848)
Excellent. Now we know that if we start at 0x00336400 and read 5503 bytes, we'll have the entire filename table.
003363f0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00336400: 2802 0000 5700 4500 cd02 0000 5700 00f0  (...W.E.....W...
00336410: f502 0000 5700 01f0 fd02 0000 5700 02f0  ....W.......W...
00336420: 0b03 0000 5800 01f0 3203 0000 5a00 01f0  ....X...2...Z...
00336430: 3e03 0000 5a00 05f0 7b03 0000 5d00 00f0  >...Z...{...]...
00336440: cf03 0000 6300 00f0 f403 0000 6300 08f0  ....c.......c...
00336450: 0b04 0000 6500 08f0 5804 0000 6a00 08f0  ....e...X...j...
00336610: 0f15 0000 5d01 41f0 4315 0000 6101 41f0  ....].A.C...a.A.
00336620: 6a15 0000 6301 41f0 8b61 7070 6c69 6361  j...c.A..applica
00336630: 7469 6f6e 01f0 8361 7263 07f0 8662 6174  tion...arc...bat
00336640: 746c 6508 f087 636f 6e74 6573 740d f084  tle...contest...
00336650: 6461 7461 10f0 8464 656d 6f13 f083 6477  data...demo...dw
00336660: 631d f089 6669 656c 6464 6174 611e f087  c...fielddata...
00336670: 6772 6170 6869 632c f088 6974 656d 746f  graphic,..itemto
I included one previous line for context; starting right after a whole bunch of ffs or 00s is a pretty good sign, since those are likely to be junk used to fill space. So we're probably in the right place, or at least a right place. Also we're definitely in the right place since I already know porigon-z works, but, you know.
The beginning part of this is a bunch of numbers that start out relatively low and gradually get bigger. That's a pretty good indication of an offset table — a list of "where this thing starts" and "how long it is", just like the offset/length pairs that pointed us here in the first place. The only difference here is that we have a whole bunch of them. And porigon-z confirms that this is a list of:
ULInt32('offset'),
ULInt16('top_file_id'),
ULInt16('parent_directory_id'),
My code does a bit more than this, but I don't want this post to be about the intricacies of an old version of Construct. The short version is that each entry is eight bytes long and corresponds to a directory; this list actually describes the directory tree. Decoding the first few produces:
offset 00000228, top file id 0057, parent id 0045
offset 000002cd, top file id 0057, parent id f000
offset 000002f5, top file id 0057, parent id f001
offset 000002fd, top file id 0057, parent id f002
Again, we encounter some mild weirdness. The parent ids seem to count upwards, except for the first one, and where did that f come from? It turns out that for the first record only — which is the root directory and therefore has no parent — the parent id is actually the total number of records to read. So there are 0x0045 or 69 records here. As for the f, well, I have no idea! I just discard it entirely when linking directories together.
So let's fully decode entry 3 (the fourth one, since we started at zero). It has offset 0x000002fd, which is relative to where the table starts, so we need to add that to 0x00336400 to get 0x003366fd. We don't have a length, but starting from there we see:
003366f0:                                 0c 6362               .cb
00336700: 5f64 6174 612e 6e61 7263 000f 7769 6669  _data.narc..wifi
00336710: 5f65 6172 7468 2e6e 6172 6315 7769 6669  _earth.narc.wifi
00336720: 5f65 6172 7468 5f70 6c61 6365 2e6e 6172  _earth_place.nar
I called the structure here a filename_list_struct. Also, as I read this code, I really wish I'd made it more sensible; sorry, I guess I'll clean it up when I get around to re-ripping gen 4. The Construct code is a bit goofy, but the idea is:
Read a byte. If it's zero, stop here. Otherwise, the top bit is a flag indicating whether this entry is a directory; the rest is a length.
The next length bytes are the filename.
Iff this is a directory, the next two bytes are the directory id.
(Ah yes, bits and flags. A flag is something that can only be true or false, so it really only needs one bit to store. So programmers like to cram flags into the same byte as other stuff to save space. Computers can't examine individual bits directly, but it's easy to manipulate them from code with a little math. Of course, using 1 bit for a flag means only 7 are left for the length, so it's limited to 127 instead of 255.)
Let's try this. The first byte is 0c. I can tell you right away that the top bit is zero; if the top bit is one, then the first hex digit will be 8 or greater. So this is just a file, and it's 0c or 12 bytes long. The next twelve bytes are cb_data.narc, so that's the filename. Repeat from the beginning: the next byte is 00, which is zero, so we're done. This directory only contains a single file, cb_data.narc.
But wait, what is this directory? We know its id is 3; its name would appear somewhere in the filename list for its parent directory, 2, along with an extra two bytes indicating it matches to directory 3. To get the name for directory 2, we'd consult directory 1; and directory 1's parent is directory 0. Directory 0 is the root, which is just / and has no name, so at that point we're done. Of course, if we read all these filename lists in order rather than skipping straight to the third one, then we'd have already seen all these names and wouldn't have to look them up.
One final question: where's the data? All we have are filenames. It turns out the data is in a totally separate table at fat_offset — "FAT" is short for "file allocation table". That's a vastly simpler list of pairs of start offset and end offset, giving the positions of the individual files, and nothing else.
All we have to do is match up the filenames to those offset pairs. This is where the "top file id" comes in: it's the id of the first file in the directory, and the others count up from there. This directory's top file id is 0x57, so cb_data.narc has file id 0x57. (If there were a next file, it would have id 0x58, and so on.) Its data is given by the 0x57th (87th) pair of offsets.
Phew! We haven't even gotten anywhere yet. But this is important for figuring out where anything even is. And you don't have to do it by hand, since I wrote a program to do it. Run:
python2 -m porigonz pokemon-diamond.nds list
To get output like this:
/application/custom_ball/data
87 0x03810200 0x0381ef8c     60812 [  295] /application/custom_ball/data/cb_data.narc
/application/wifi_earth
88 0x037b2400 0x037d7674    152180 [    8] /application/wifi_earth/wifi_earth.narc
89 0x037d7800 0x037d84c8      3272 [   19] /application/wifi_earth/wifi_earth_place.narc
Hey, it's our friend cb_data.narc, with its full path! On the left is its file id, 87. Next are its start and end offsets, followed by its filesize.
You may notice that before the filenames start, you'll get a list of unnamed files. These are entries in the FAT that have no corresponding filename. I learned only recently that they're code — overlays, in fact, though I don't know what that means yet.
Now we can start looking at data and figuring it out. Finally.
NARCs and basic Pokémon data
This was fantastic. All the game data, nearly arranged into files, and even named sensibly for us. A goldmine. It didn't used to be so easy, as we will see later.
Other people had already noticed the file /poketool/personal/personal.narc contains much of the base data about Pokémon. You'll notice it has a "501" in brackets next to it, indicating that it's actually a NARC file — a "Nitro archive", though I'm not sure what "Nitro" refers to. This is a generic uncompressed container that just holds some number of sub-files — in this case, 501. The subfiles can have names, but the ones in this game generally don't, so the only way to refer to them is by number.
You may also notice that evo.narc and wotbl.narc, in the same directory, are also NARCs with 501 records. It's a pretty safe bet that they all have one record per Pokémon. That's a little odd, since Pokémon Diamond only has 493 Pokémon, but we'll figure that out later.
NARC is, as far as I can tell, an invention of Nintendo. I think it's in other DS games, though I haven't investigated any others very much, so I can't say how common it is. It's a very simple format, and it uses basically the same structure as the entire DS filesystem: a list of start/end offsets and a list of filenames. It doesn't have the same directory nesting, so it's much simpler, and also the filenames are usually missing, so it's simpler still. But you don't have to care, because you can examine the contents of a file with:
python2 -m porigonz pokemon-diamond.nds cat -f hex /poketool/personal/personal.narc
This will print every record as an unbroken string of hex, one record per line. (I admit this is not the smartest format; it's hard to see where byte boundaries are. Again, hopefully I'll fix this up a bit when I rerip gen 4.) Here are the first six Pokémon records.
2d31312d41410c032d400001000000001f144603010741000003000020073584081e10022024669202000000
3c3e3f3c50500c032d8d0005000000001f144603010741000003000020073584081e10022024669202000000
5052535064640c032dd00006000000001f144603010741000003000030473586081e1002282466920a000000
27342b413c320a0a2d414000000000001f144603010e420000000000230651cce41e821201a4469202000000
3a403a5050410a0a2d8e4001000000001f144603010e420000000000230651cce41e821201a4469202000000
That first one is pretty conspicuous, what with its being all zeroes. It's probably some a dummy entry, for whatever reason. That does make things a little simpler, though! Numbering from zero has caused some confusion in the past: Bulbasaur (National Dex number 1) would be record 0, and I've had all kinds of goofy bugs from forgetting to subtract or add 1 all over the place. With a dummy record at 0, that means Bulbasaur is 1, and everything is numbered as expected.
So, what is any of this? The heart of figuring out data formats is looking for stuff you know. That might mean looking for data you know should be there, or it might mean identifying common schemes for storing data.
A good start, then, would be to look at what I already know about Bulbasaur. Base stats are a pretty fundamental property, and Bulbasaur's are 45, 49, 49, 65, 65, and 45. In hex, that's 2d 31 31 41 41 2d. Hey, that's the beginning of the first line! It's just slightly out of order; Speed comes before the special stats.
You can also pick out some differences by comparing rows. About 60% of the way along the line, I see 03 for Bulbasaur, Ivysaur, and Venusaur, but then 00 for Charmander and Charmeleon. That's different between families, which seems like a huge hint; does that continue to hold true? (As it turns out, no! It fails for Butterfree — because it indicates the Pokémon's color, used in the Pokédex search. Most families are similar colors.)
Sometimes a byte will seem to only take one of a few small values, which usually means it's an enum (one of a list of numbered options), like the colors are. A byte that only ranges from 1 to 17 (or perhaps 0 to 16) is almost certainly type, for example, since there are 17 types.
Noticing common patterns — very tiny formats, I suppose — is also very helpful (and saves you from wild goose chases). For example, Pokémon can appear in the wild holding held items, and there are more than 256 items, so referring to an item requires two bytes. But there are only slightly more than 256 items in this game, so the second byte is always 00 or 01. If you remember that some fields must span multiple bytes, that's an incredible hint that you're looking at small 16-bit numbers; if you forget, you might thing the 01 is a separate field that only stores a single flag… and drive yourself mad trying to find a pattern to it.
The games have a number of TMs which can teach particular moves, and each Pokémon can learn a unique set of TMs. These are stored as a longer block of bytes, where each individual bit is either 1 or 0 to indicate compatibility. Those are a bit harder to identify with certainty, since (a) the set of TMs changes in every game so you can't just check what the expected value is, and (b) bitflags can produce virtually any number with no discernible pattern.
Thankfully, there's a pretty big giveaway for TMs in particular. Here are Caterpie, Metapod, and Butterfree:
2d1e232d14140606ff350100000000007f0f4600030313000003000000000000000000000000000000000000
3214371e1919060678482000000000007f0f460003033d000003000000000000000000000000000000000000
3c2d3246505006022da000060000de007f0f460003030e000008000020463fb480be14222830560301000000
Butterfree can learn TMs. Caterpie and Metapod are almost unique in that they can't learn any. Guess where the TMs are! Even better, Caterpie is only #9, so this shows up very early on.
And, well, that's the basic process. It's mostly about cheating, about leveraging every possible trick you can come up with to find patterns and landmarks. I even wrote a script for this (and several other files) that dumped out a huge HTML table with the names of the (known) Pokémon on the left and byte positions as columns. When I figured something out, or at least had a suspicion, I labelled the column and changed that byte to print as something more readable (e.g., printing the names of types instead of just their numbers).
Of course, if you have a flash cartridge or emulator (both of which were hard to come by at the time), you can always invoke the nuclear option: change the data and see what changes in the game.
Still, easy, right? How hard could this be.
Sprites: In which it gets hard
What we really really wanted were the sprites. This was a new generation with new Pokémon, after all, and sprites were the primary way we got to see them. Unlike nearly everything else, this hadn't already been figured out by other people by the time I showed up.
Finding them was easy enough — there's a file named /poketool/pokegra/pokegra.narc, which is conspicuously large. It's a NARC containing 2964 records. A little factoring reveals that 2964 is 494 × 6 — aha! There are 493 Pokémon, plus one dummy.
python2 -m porigonz pokemon-diamond.nds extract /poketool/pokegra/pokegra.narc
This will extract the contents of pokegra.narc to a directory called pokemon-diamond.nds:data, which I guess might be invalid on Windows or something, so use -d to give another directory name if you need to. Anyway, in there you'll find a directory called pokegra.narc, inside of which are 2964 numbered binary files.
Some brief inspection reveals that they definitely come in groups of six: the filesizes consistently repeat 6.5K, 6.5K, 6.5K, 6.5K, 72, 72. Sometimes a couple of the files are empty, but the pattern is otherwise very distinct. Four sprites per Pokémon, then?
Let's have a look at the first file! Since it's a dummy sprite, it should be blank or perhaps a question mark, right? Oh boy I'm so excited.
00000000: 5247 434e fffe 0001 3019 0000 1000 0100  RGCN....0.......
00000010: 5241 4843 2019 0000 0a00 1400 0300 0000  RAHC ...........
00000030: de54 59cf e00a 2374 927c 5db5 7476 87c1  .TY...#t.|].tv..
00000040: 06d1 2183 c890 ab40 3a06 a53c dced 8f55  ..!....@:..<...U
00000050: 2e90 e9a5 b0e1 3324 e2a2 ed42 4480 9790  ......3$...BD...
00000060: 5632 b157 989d bb3e 8af2 35e8 accd 9f92  V2.W...>..5.....
00000070: 7e57 79b8 8064 43b0 3295 7d4c 1476 a77b  ~Wy..dC.2.}L.v.{
Hm. Okay, so, this is a problem. No matter what the actual contents are, this is a sprite, and virtually all Pokémon sprites have a big ol' blob of completely empty space in the upper-left corner. Every corner, in fact. Except for a handful of truly massive species, the corners should be empty. So no matter what scheme this is using or what order the pixels are in, I should be seeing a whole lot of zeroes somewhere. And I'm not.
Compression? Seems very unlikely, since every file is either 0, 72, or 6448 bytes, without exception.
Well, let's see what we've got here. RGCN and RAHC are almost certainly magic numbers, so this is one file format nested inside another. (A lot of file formats start with a short fixed string identifying them, a so-called "magic number". Every GIF starts with the text GIF89a, for example. A NARC file starts with CRAN — presumably it's "backwards" because it's being read as an actual little-endian number.) I assume the real data begins at 0x30.
Without that leading 0x30 (48) bytes, the file is 6400 bytes large, which is a mighty conspicuous square number! Pokémon sprites have always been square, so this could mean they're 80×80, one byte per pixel. (Hm, but Pokémon sprites don't need anywhere near 256 colors?)
I see a 30 in the first line, which is probably the address of the data. I also see a 10, which is probably the (16-bit?) length of that initial header, or the address of the second header. What about in the second header? Well, uh, hm. I see a lot of what seem to be small 16-bit or 32-bit numbers: 0x000a is 10, 0x0014 is 20, 0x0003 is 3; 0x0018 is 24. A quick check reveals that 0x1900 is 6400 (the size of the data), and so 0x1920 is the size of the data plus this second header.
This hasn't really told me anything I don't already know. It seems very conspicuous that there's no 0x50, which is 80, my assumed size of the sprite.
Well, hm, let's look at the second file. It's in the block for the same "Pokémon", so maybe it'll provide some clues.
Ah. No. It starts out completely identical. In fact, md5sum reveals that all four of these first sprites are identical. Might make sense for a dummy Pokémon. Does that pattern hold for the next Pokémon, which I assume is Bulbasaur? Not quite! Files 6 and 7 are identical, and 8 and 9 are identical, but they're distinct from each other.
What's the point of them then? Further inspection reveals that most Pokémon have paired sprites like this, but Pikachu does not — suggesting (correctly) that the sprites are male versus female, so Pokémon that don't have gender differences naturally have identical pairs of sprites.
Okay, then, let's look at Pikachu's first sprite, 150. The key is often in the differences, remember. If the dummy sprite is either blank or a question mark, then it should still have a lot of corner pixels in common with the relatively small Pikachu.
00000030: b6bd 6f4c 6c6e 3d16 b226 db0b 0818 c934  ..oLln=..&.....4
00000040: eeb7 876c e41f 9542 6a6d 73da 0022 a1cb  ...l...Bjms.."..
00000050: 2683 9f01 5cfa ed9b 2275 0bce f8c4 79bf  &...\..."u....y.
00000060: 5eff b76b d4dd 4582 da1d a346 f0e0 5170  ^..k..E....F..Qp
00000070: 960c cf0a 4caa 9d55 9247 3ba4 e855 293e  ....L..U.G;..U)>
00000080: ce8a e73e c43f f575 4ad2 d346 e003 0189  ...>.?.uJ..F....
00000090: 065a ff67 3c7e 4d43 029e 6b8e d8ca d9b0  .Z.g<~MC..k.....
000000a0: 3e5a 17e6 b445 a51d ba8a 03db d08a b115  >Z...E..........
Well. Nope. How does that compare to Pikachu's second sprite, 151 — which ought to be extremely similar, seeing as the only gender difference is a notch in the tail?
00000030: 2957 ce67 e76f c494 f5fe 4adf d367 e008  )W.g.o....J..g..
00000040: 0182 0697 ff78 3c33 4dac 020b 6b8f d82f  .....x<3M...k../
00000050: d989 3ef7 17d7 b45a a566 ba57 03bc d04f  ..>....Z.f.W...O
00000060: b1ce 7668 2fea 2ceb fd8d 72a5 9b4d c848  ..vh/.,...r..M.H
00000070: 89b0 aeca 4712 a4c4 5582 2ad4 33a4 c0fa  ....G...U.*.3...
00000080: 618f e6fd 5faf 1cc7 ada3 e2c3 cb1f b845  a..._..........E
00000090: 39cb 1ee2 7721 94d2 0552 9a54 6320 b009  9...w!...R.Tc ..
000000a0: 11c4 5657 8fc8 0cc7 5ded 5266 fb05 a826  ..VW....].Rf...&
Oh, my god. Nothing is similar at all.
Make a histogram? Every possible value appears with roughly the same frequency. Now that is interesting, and suggests some form of encryption — most likely one big "mask" xor'd with the whole sprite. But how to find the mask?
(It doesn't matter exactly what xor is, here. It only has two relevant properties. One is that it's self-reversing, making it handy for encryption like this — (data xor mask) xor mask produces the original data. The other is that anything xor'd with zero is left unchanged, so if I think the original data was zero — as it ought to be for the blank pixels in the corners of a sprite — then the encrypted data is just the mask! So I know at least the beginning parts of the mask for most sprites; I just have to figure out how to use a little bit of that to reconstitute the whole thing.)
I stared at this for days. I printed out copies of sprite hex and stared at them more on breaks at work. I threw everything I knew, which admittedly wasn't a lot, at this ridiculous problem.
And slowly, some patterns started to emerge. Consider the first digit of the last column in the above hex dump: it goes e, d, d, c, c, b, b, a. In fact, if you look at the entire byte, they go e0, d8, d0, c8, etc. That's just subtracting 08 on each row.
Are there other cases like this? Kinda! In the third column, the second digit alternates between 7 and f; closer inspection reveals that byte's increasing by 18 every row. Oh, the sixth column too. Hang on — in every column, the second digit alternates between two values. That seems true for every other file we've seen so far, too.
This is extremely promising! Let's try this. Take the first two rows, which are bytes 0–15 and bytes 16–31. Subtract the second row from the first row bytewise, making a sort of "delta row". For the second Pikachu, that produces:
d82b 3830 1809 789f 58ae b82c 9828 f827
As expected, the second digit in each column is an 8. Now just start with the first row and keep adding the delta to it to produce enough rows to cover the whole file, and xor that with the file itself. Results:
00000020: 0024 0030 0056 0088 003c 0060 000b 0019  .$.0.V...<.`....
00000030: 0016 009f 0060 009a 0085 00c6 0092 0035  .....`.........5
00000040: 00b3 00ed 0081 00d4 0034 005b 00a3 005e  .........4.[...^
00000050: 00a1 00aa 0033 0068 00c7 0078 0030 008e  .....3.h...x.0..
00000060: 0092 0065 0084 009c 0040 00b3 0077 00fb  ...e.....@...w..
00000070: 0040 00e0 0066 002a 002d 0075 007a 003f  .@...f.*.-.u.z.?
00000080: 0076 00da 00b3 0008 00bb 00e6 0097 003c  .v.............<
Promising! We got a bunch of zeroes, as expected, though everything else is still fairly garbled. It might help if we, say, printed this out to a file.
By now it had become clear that the small files were palettes of sixteen colors stored as RGB555 — that is, each color is packed into two bytes, with five bits each for the red, green, and blue channels. Sixteen colors means two pixels can be crammed into a single byte, so the sprites are actually 160×80, not 80×80. Combining this knowledge with the above partially-decrypted output, we get:
Kinda!
Meanwhile another fansite found our code and put up a full set of these ugly-ass corrupt sprites, so that was nice.
It took me a while to notice another pattern, which emerges if you break the sprite into blocks that are 512 bytes wide (rather than only 16). You get this:
2957 ce67 e76f c494 f5fe 4adf d367 e008 ...
29e2 ce3e e742 c4d3 f5d9 4a46 d30a e057 ...
296d ce15 e715 c412 f5b4 4aad d3ad e0a6 ...
29f8 ceec e7e8 c451 e561 a450 9763 e7f5 ...
This time, the byte in the first column is always identical all the way down. Well, kind of. This is encrypted data, remember, and I only know what the mask is because the beginning of the data is usually blank. The exceptions are when the mask is hitting actual colored pixels, at which point it becomes garbage.
But even better, look at the second byte in each column. Now they're all separated by a constant, all the way down! That means I can repeat the same logic as before, except with two "rows" that are 512 bytes long, and as long as the first 1024 bytes of the original data are all zeroes, I'll get a perfect sprite out!
And indeed, I did! Mostly. Legendary Pokémon and a handful of others tend to be quite large, so they didn't start with as many zeroes as I needed for this scheme to work. But it mostly worked, and that was pretty goddamn cool.
magical, a long-time co-conspirator, managed to scrounge up my final "working" code from that era (which then helped me find my own local copy of all my D/P research stuff, which I oughta put up somewhere). It's total nonsense, but it came pretty close to working.
Hm? What? You want to know the real answer? Yeah, I bet you do.
Okay, here you go. So the games have a random number generator, for… generating random numbers. This being fairly simple hardware with fairly simple (non-crypto) requirements, the random number generator is also fairly simple. It's an LCG, a linear congruential generator, which is a really bizarre name for a very simple idea:
ax + b
The generator is defined by the numbers a and b. (You have to pick them carefully, or you'll get numbers that don't look particularly random.) You pick a starting number (a seed) and call that x. When you want a random number, you compute ax + b. You then take a modulus, which really means "chop off the higher digits because you only have so much space to store the answer". That's your new x, which you'll plug in to get the next random number, and so on.
In the case of the gen 4 Pokémon games, a = 0x4e6d and b = 0x6073.
What does any of this have to do with the encryption? Well! The entire sprite is interpreted as a bunch of 16-bit integers. The last one is used as the seed and plugged into the RNG, and then it keeps spitting out a sequence of numbers. Reverse them, since you're starting at the end, and that's the mask.
The seed technically overlaps with the last four pixels, but it happens to work since no Pokémon sprites touched the bottom-right corner in Diamond and Pearl. In Platinum a couple very large sprites broke that rule, so they ended up switching this around and starting from the beginning. Same idea, though.
Of course, porigon-z knows how to handle this… though it's currently hardcoded to use the Platinum approach. Funny story: the algorithm was originally thought to go from the beginning, not the end, and it used an LCG with different constants. Turns out someone had just accidentally (?) discovered the reverse of the Pokémon LCG, which would produce exactly the same sequence, backwards. Super cool.
Why did that thing with subtracting the two rows kinda-sorta work, then? Well! It's because… when you… and… uh… wow, I still have no goddamn idea. That makes no sense at all. I'd sure love for someone to explain that to me. I'm sure I could explain it if I sat down and thought about it for a while, but I suspect it's something subtle and I'm not that interested.
I'd also like to know: why were the sprites encrypted in the first place? What possible point is there? They must have known we cracked the encryption, but then they used it again for Platinum, and Heart Gold and Soul Silver. Maybe it was only intended to be enough to delay us, during the gap between the Japanese and worldwide releases…? Hm.
Incidentially, the entire game text is also encrypted in much the same way. Without the encryption, it's just UTF-16 — a common character encoding that uses two bytes for every character. I have no idea why.
The dark days
So Nintendo DS cartridge have a little filesystem on them, making them act kinda like any other disk. Nice.
Game Boy cartridges… don't. A Game Boy cartridge is essentially just a single file, a program. You pop the cartridge in, and the Game Boy runs that program.
Where is the data, then? Baked into the program — referred to as hard-coded. Just, somewhere, mixed in alongside all the program code. There's no nice index of where it is; rather, somewhere there's some code that happens to say "look at the byte at 0x006f9d10 in this program and treat it as data".
I wasn't involved in data dumping in these days; I was copying stuff straight out of the wildly inaccurate Prima strategy guide. (Again, you know, I was 12.) It's hard to say exactly how people fished out the data, though I can take a few guesses.
A few guesses
To our advantage is the fact that Game Boy cartridges are much smaller than DS cartridges, so there's much less to sift through. Pokémon Red and Blue are on 1 MB cartridges, and even those are half empty (unused NULs); the original Japanese Red and Green barely fit into 512 KB, and Red and Blue ended up just slightly bigger.
To our disadvantage is that these are the very first games, so we don't have any pre-existing knowledge to look for. We don't know any Pokémon's base stats; we may not even know that "base stats" are a thing yet. Also, it's not immediately obvious, but the Pokémon aren't even stored in order. Oh, and Mew is completely separate; it really was a last-minute addition.
What do we know? Well, by playing the game, we can see what moves a Pokémon learns and when. There don't seem to be all that many moves, so it's reasonable to assume that a move would be represented with a single byte. Levels are capped at 100, so that's probably also a single byte. Most likely, the level-up moves are stored as either level move level move... or move level move level....
Great! All we need to do is put together a string of known moves both ways and find them.
Except, ah, hm. We don't actually know how the moves are numbered. But we still know the levels, so maybe we can get somewhere. Let's take Bulbasaur, which we know learns Leech Seed at level 7, Vine Whip at level 13, and Poison Powder at level 20. (Or, I guess, that should be LEECH SEED, VINE WHIP, and POISONPOWDER.) No matter whether the levels or moves come first, this will result in a string like:
07 ?? 0D ?? 14
So we can do my favorite thing and slap together a regex for that. (A regex is a very compact way to search text — or bytes — for a particular pattern. A lone . means any single character, so the regex below is a straightforward translation of the pattern above.)
>>> for match in re.finditer(rb'\x07.\x0d.\x14', rom):
...     print(f"{match.start():08x} {match.group().hex()}")
0003b848 07490d1614
Exactly one match! Let's have a look at that position in the file.
0003b840: 7700 0000 0110 0900 0749 0d16 144d 1b4b  w........I...M.K
0003b850: 224a 294f 304c 0000 0749 0d16 164d 1e4b  "J)O0L...I...M.K
0003b860: 2b4a 374f 414c 0000 0730 0d23 1228 1637  +J7OAL...0.#.(.7
0003b870: 1b84 2370 2b67 3238 0000 0001 219e 0013  ..#p+g28....!...
This seems pretty promising! It looks like the same set of moves is repeated 16 bytes later, but with different (slightly higher) levels after a certain point, which matches how evolved Pokémon behave. So this looks to be at least Bulbasaur and Ivysaur, though I'm not quite sure what happened to Venusaur.
By repeating this process with some other Pokémon, we can start to fill in a mapping of moves to their ids. Eventually we'll realize that a Pokémon's starting moves don't seem to appear within this structure, and so we'll go searching for those for a Pokémon that starts with moves we know the ids for. That will lead us to the basic Pokémon data along with base stats, because starting moves happen to be stored there in these early games.
The text isn't encrypted, but also isn't ASCII, but it's possible to find it in much the same way by treating it as a cryptogram (or a substitution cipher). I assume that there's some consistent scheme, such that the letter "A" is always represented with the same byte. So I pick some text that I know has a few repeated letters, like BULBASAUR, and I recognize that it could be substituted in some way to read as 123145426. I can turn that into a regex!
>>> for match in re.finditer(rb'(.)(.)(.)\1(.)(.)\4\2(.)', rom, flags=re.DOTALL):
Unfortunately, this produces a zillion matches, most of them solid strings of NUL bytes. The problem is that nothing in the regex requires that the different groups are, well, different. You could write extra code to filter those cases out, or if you're masochistic enough, you could express it directly within the regex using (?!...) negative lookahead assertions:
>>> for match in re.finditer(rb'(.)(?!\1)(.)(?!\1)(?!\2)(.)\1(?!\1)(?!\2)(?!\3)(.)(?!\1)(?!\2)(?!\3)(?!\4)(.)\4\2(?!\1)(?!\2)(?!\3)(?!\4)(?!\5)(.)', rom, flags=re.DOTALL):
0000820c 4305ff43441b440522
0001c80e 81948b818092809491
00054a94 0a4d350a556d554d43
0007a55a 33466f33fff0ff4670
0007c20c 4305e843440444050b
0008e7b2 7fa8b37fa0a6a0a8ad
00094e75 81948b818092809491
000a0bcd a77fb3a7a4b1a47fb6
That's much more reasonable. (The set of matches, I mean, not the regex.) It wouldn't be hard to write a script with a bunch of known strings in it, generate appropriate regexes for each, eliminate inconsistent matches, and eventually generate a full alphabet. (Or you could assume that "B" immediately follows "A" and in general the letters are clustered together, which would lead you to correctly suspect that the strings at 0x0001c80e and 0x00094e75 are the ones you want.)
Even better, once you have an alphabet, you can use it to translate entire ROM — plenty of it will be garbage, but you'll find quite a lot of blocks of human-readable text! And now you have all the names of everything and also the entire game script.
Modern day and a brief tour of gbz80 assembly
But like I said, I wasn't involved in any of that. Until recently! I've been working on an experiment for veekun where I re-dump all the games to a new YAML-based format. Long story short: the current database is a pain to work with, and some old data has been lost entirely. Also, most of the data was extracted bits at a time with short hacky scripts that we then threw away, and I'd like to have more permanent code that can dump everything at once. It'll be nice to have an audit trail, too — multiple times in the past, we've discovered that some old thing was dumped imperfectly or copied from an unreliable source.
So I started re-dumping Red and Blue, from scratch. I've made modest progress, though it's taken a backseat to Sun and Moon lately.
It's helped immensely that there's an open source disassembly of Red and Blue floating around. What on earth is a disassembly? I'm so glad you asked!
Game Boy games were written in assembly code, which is just about as simple and painful as you can get. It's human-readable, kinda, but it's built from the basic set of instructions that a particular CPU family understands. It can't directly express concepts like "if this, do that, otherwise do something else" or "repeat this code five times". Instead, it's a single long sequence of basic operations like "compare two numbers" and "jump ahead four instructions". (Very few programmers work with assembly nowadays, but for various reasons, no other programming languages would work on the Game Boy at the time.)
To give you a more concrete idea of what this is like to work with: the Game Boy's CPU doesn't have an instruction for multiplying, so you have to do it yourself by adding repeatedly. I thought that would make a good example, but it turns out that Pokémon's multiply code is sixty lines long. Division is even longer! Here's something a bit simpler, which fills a span of memory:
FillMemory::
; Fill bc bytes at hl with a.
push de
ld d, a
.loop
ld a, d
ld [hli], a
dec bc
ld a, b
or c
jr nz, .loop
pop de
CPUs tend to have a small number of registers, which can hold values while the CPU works on them — even as fast as RAM is, it's considered much slower than registers. The downside is, well, you only have a few registers. The Game Boy CPU (a modified Z80) has eight registers that can each hold one byte: a through f, plus h and l.. They can be used together in pairs to store 16-bit values, giving the four combinations af, bc, de, and hl.
(If you need more than 16 bits, well, that's your problem! 16 bits is the most the CPU understands; it can't even access memory addresses beyond that range, so you're limited to 64K. "But wait", you ask, "how can a Game Boy cartridge be 512K or 1M?" Very painfully, that's how.)
Now we can understand the comment in the above code. Starting at the memory address given by the 16-bit number in hl, it will copy the value in a into each byte, for a total of bc bytes. Translated into English, the above means something like this:
Save copies of d and e, so I can mess with them without losing any important data that was in them. (This code doesn't use e, but there's no push d instruction.)
Copy a, the fill value, into d.
Copy d, the fill value, into a.
Copy a, the fill value, into the memory at address hl. Then increase hl (the actual registers, not the memory) by 1.
Decrease bc, the number of bytes to fill, by 1.
Copy b, part of the number of bytes to fill, into a.
OR a with c, the other part of the number of bytes to fill, and leave the result in a. The result will be zero only if bc itself is zero, in which case the "zero" flag will be set.
If the zero flag is not set (i.e., if bc isn't zero, meaning we're not done yet), jump back to the instruction marked by .loop, which is step 3.
Restore d and e to their previous values.
Return to whatever code jumped here in the first place.
Even this relatively simple example has to resort to a weird trick — ORing b and c together — just to check if bc, a value the CPU understands, is zero or not.
CPUs don't execute assembly code directly. It has to be assembled into machine code, which is (surprise!) a sequence of bytes corresponding to CPU instructions. When the above code is compiled, it produces these bytes, which you can verify for yourself appear in Pokémon Red and Blue in exactly one place:
d5 57 7a 22 0b 78 b1 20 f9 d1 c9
I stress that this is way beyond anything virtually any programmer actually needs to know. Even the few programmers working with assembly, as far as I know, don't usually care about the actual bytes that are spat out. I've actually had trouble tracking down lists of opcodes before — almost no one is trying to read machine code. We are out in the weeds a bit here.
To finally answer your hypothetical question: disassembly is the process of converting this machine code back into assembly. Most of it can be done automatically, but it takes extra human effort to make the result sensible. Let's consult the Game Boy CPU's (rather terse) opcode reference and see if we can make sense of this, pretending we don't know what the original code was.
Find d5 in the table — it's in row Dx, column x5. That's push de. The first number in the box is 1, meaning the instruction is only one byte long, so the next instruction is the very next byte. That's 57, which is ld d, a. Keep on going. Eventually we hit 20, which is jr nz, r8 and two bytes long — the notes at the bottom explain that r8 is 8-bit signed data. That means the next byte is part of this instruction; it's f9, but it's signed, so really that's -7. We end up with:
ld (hl+), a
jr nz, $-07
This looks an awful lot like what we started with, but there are a couple notable exceptions. First, the FillMemory:: line is completely missing. That's just another kind of label, and the only way to know that the first line should be labelled at all is to find some other place in the code that tries to jump here. Given just these bytes, we can't even tell if this is a complete snippet. Once we find that out, there's still no way to recover the name FillMemory; even that is just a fan name and not the name from the original code. Someone came up with that name by reading this assembly code, understanding what it's intended to do, and giving it a name.
Second, the .loop label is missing. The jr line forgot about the label and ended up with a number, which is how many bytes to jump backwards or forwards. (You can imagine how a label is much easier to work with than a number of bytes, especially when some instructions are one byte long and some are two!) An automated disassembler would be smart enough to notice this and would put a label in the right place. A really good disassembler might even recognize that this code is a simple loop that executes some number of times, and name that label .loop; otherwise, or for more complicated kinds of jumps, it would have a meaningless name that a human would have to improve.
And there's a whole project where people have done the work of restoring names like this and splitting code up sensibly! The whole thing even assembles into a byte-for-byte identical copy of the original games. It's really quite impressive, and it's made tinkering with the original games vastly more accessible. You still have to write assembly, of course, but it's better than editing machine code. Imagine trying to add a new instruction in the middle of the loop above; you'd screw up the jr's byte count, and every single later address in the ROM.
But more relevant to this post, a disassembly makes it easy to figure out where data is, since I don't have to go hunting for it! When the code is assembled, it can generate a .sym file, which lists every single "global" label and the position it ended up in the final ROM. Many of those labels are for functions, like FillMemory is, but some of them are for blocks of data.
Snagging data
I set out to write some code to dump data from Game Boy games. Red/Green, Red/Blue, and Yellow were all fairly similar, so I wanted to use as much of the same code as possible for all of those games (and their various translations).
A very early pain point was, well, the existence of all those translations. Because there's no filesystem, the only obvious way to locate data is to either search for it (which requires knowing it ahead of time, a catch-22 for a script that's meant to extract it) or to bake in the addresses. The games contain quite a lot of data I want, and they exist in quite a few distinct versions, so that would make for a lot of addresses.
Also, with a disassembly readily available, it was now (relatively) easy for people to modify the games as they saw fit, in much the same way as it's easy to modify most aspects of modern games by changing the data files. But if I simply had a list of addresses for each known release, then my code wouldn't know what to do with modified games. It's not a huge deal — obviously I don't intend to put fan modifications into veekun — but it seemed silly to write all this extraction code and then only have it work on a small handful of specific files.
I decided to at least try to find data automatically. How can I do that, when the positions of the data only existed buried within machine code somewhere?
Obviously, I just need to find that machine code. See, that whole previous section was actually relevant!
I set out to do that. Remember the goofy regex from earlier, which searched for particular patterns of bytes? I did something like that, except with machine code. And by machine code, I mean assembly. And by assembly, I mean— okay just look at this.
ld a, [#wd11e]
dec a
ld hl, #TechnicalMachines
ld b, $0
ld c, a
add hl, bc
ld a, [hl]
ld [#wd11e], a
I wrote my own little assembler that can convert Game Boy assembly into Game Boy machine code. The difference is that when it sees something like #foo, it assumes that's a value I don't know yet and sticks in a regex capturing group instead. It's smart enough to know whether the value has to be one or two bytes, based on the instruction. It also knows that if the same placeholder appears twice, it must have the same value both times. I can also pass in a placeholder value, if I only know it at runtime.
I have half a dozen or so chunks like this. Every time I wanted to find something new, I went looking for code that referenced it and copied the smallest unique chunk I could (to reduce the risk that the code itself is different between games, or in a fan hack). I did run into a few goofy difficulties, such as code that changed completely in Yellow, but I ended up with something that seems to be pretty robust and knows as little as possible about the games.
I even auto-detect the language… by examining the name of the TOWN MAP, the first item that has a unique name in every official language.
This is probably ridiculous overkill, but it was a blast to get working. It also leaves the door open for some… shenanigans I've wanted to do for a while.
But enough about the Game Boy. Let's get back to the future.
The 3DS, and what I'm doing now
Recent games have been slightly more complicated, though the complexity is largely in someone else's court. The 3DS uses encryption — real, serious encryption, not baby stuff you can work around by comparing rows of bytes.
When X and Y came out, the encryption still hadn't been broken, so all of veekun's initial data was acquired by… making a Google Docs spreadsheet and asking for volunteers to fill it in. It wasn't great, but it was better than nothing.
This was late 2013, and I suppose it's around when veekun's gentle decline into stagnation began. When X and Y were finally ripped, I was… what was I doing? I guess I was busy at work? For whatever reason, I had barely any involvement in it. Then Omega Ruby and Alpha Sapphire came out, and now everyone was busy, and it took forever just to get stuff like movesets dumped.
Now I'm working on Sun and Moon again. It's not especially hard — much of the basic structure has been preserved since Diamond and Pearl, and a lot of the Omega Ruby and Alpha Sapphire code I wrote works exactly the same with Sun and Moon — but there are a lot of edge cases.
Some changes in X/Y and beyond
The most obvious wrinkle is that the filenames are gone. This has actually been the case since Heart Gold and Soul Silver — all the files now simply have names like /a/0/0/0 and count upwards from there. I don't know the reason for the change, but I assume the original filenames weren't intended to be left in the game in the first place. The files move around in every new pair of games, too, requiring bunches of people to go through the files by hand and note down what each of them appears to be.
Newer games use GARC instead of NARC. I don't know what the G stands for now. (Gooder? Gen 6?) It's basically the same idea, except that now a single GARC archive has two levels of nesting — that is, a GARC contains some number of sub-archives, and each of those in turn contains some number of subfiles. Usually there's only one subfile per subarchive, but I've seen zanier schemes once or twice.
Also, just in case that's not enough levels of containers for you, there are also a number of other single-level containers embedded inside GARCs. They're all very basic and nearly identical: just a list of start and end offsets.
Oh, and some of the data is compressed now. (Maybe that was the case before X/Y? I don't remember.) Compression is fun. Any given data might be compressed with one of two flavors of LZSS, and it seems completely arbitrary what's compressed and what's not. There's no indication of what's compressed or what's not, either; the only "header" that compressed data has is that the first byte is either 0x10 or 0x11, which isn't particularly helpful since plenty of valid data also begins with one of those bytes.
But there was one much bigger practical problem with X and Y, one I'd been dreading for a while. X and Y, you see, use models — which means they don't have any sprites for us to rip at all. And that kind of sucks.
The community's solution has been for a few people (who have screen-capture hardware) to take screenshots and cut them out. It works, but it's not great. The thing I've wanted for a very long time is rips of the actual models.
(Later games went back to including "sprites" that are just static screenshots of the models. Maybe out of kindness to us? Okay, yeah, doubtful. Oh, and those sprites are in the incredibly obtuse ETC1 format, which I had never heard of and needed help to identify, and which I will let you just read about yourself.)
Extracting models
The Pokémon models are an absolute massive chunk of the game data. All the data combined is 3GB; the Pokémon models are a hair under half of that, despite being compressed.
At least this makes them easy to find, since they're all packed into a single GARC file.
That file contains, I don't know, a zillion other files. And many of those files are generic containers, containing more files. And none of these files are named. Of course. It's easy enough to notice that there are nine files per Pokémon, since the sizes follow a rough pattern like the sprites did in Diamond and Pearl. (You'd think that they'd use GARC's two levels of nesting to group the per-Pokémon files together, but apparently not.)
At this point, I had zero experience with 3D — in fact, working on this was my introduction to 3D and Blender — so I didn't get very far on my own. I basically had to wait a few years for other people to figure it out, look at their source code, replicate it myself, and then figure out some of the bits they missed. The one thing I did get myself was texture animations, which are generally used to make Pokémon change expressions — last I saw, no one had gotten those ripped, but I managed it. Hooray. I'm sure someone else has done the same by now.
Anyway, I bring up models because of two very weird things that I never would've guessed in a million years.
One was the mesh data itself. A mesh is just the description of a 3D model's shape — its vertices (points), the edges between vertices, and the faces that fill in the space between the edges.
And, well, those are the three parts to a basic mesh. A few very simple model formats are even just those things written out: a list of vertices (defined by three numbers each, x y z), a list of edges (defined by the two vertices they connect), and a list of faces (defined by their edges).
It should be easy to find models by looking for long lists of triplets of numbers — vertex coordinates. Well, not quite. Pokémon models are stored as compiled shaders.
A shader is a simple kind of program that runs directly on a video card, since video cards tend to be a more appropriate place for doing a bunch of graphics-related math. On a desktop or phone or whatever, you'd usually write a shader as text, then compile it when your program/game runs. In fact, you have to do this, since the compilation is different for each kind of video card.
But Pokémon games only have to worry about one video card: the graphics chip in the 3DS. And there's absolutely no reason to waste time compiling shaders while the game is running, when they could just do it ahead of time and put the compiled shader in the game directly. (Incidentally, the Dolphin emulator recently wrote about how GameCube games do much the same thing.)
So they did that. Thankfully, the compiled shader is much simpler than machine code, and the parts I care about are just the parts that load in the mesh data — which mostly looks like opcodes for "here's some data", followed by some data. It would probably be possible to figure out without knowing anything about the particular graphics chip, but if you didn't know it was supposed to be a shader, you'd be mighty confused by all the mesh data surrounded by weird extra junk that doesn't look at all like mesh data.
The other was skeletal animation. The basic idea is that you want to make a high-resolution model move around, but it would be a huge pain in the ass to describe the movement of every single vertex. Instead, you make an invisible "skeleton" — a branching tree of bones. The bones tend to follow major parts of the body, so they do look like very simple skeletons, with spines and arms and whatnot (though of course skeletons aren't limited only to living creatures). Every vertex attaches to one or more of those bones — a rough first pass of this can be done automatically — and then by animating the much simpler skeleton, vertices will all move to match the bones they're attached to.
The skeleton itself isn't too surprising. It's a tree, whatever; we've seen one of those already, with the DS directory structure. The skeletons and models are in a neutral pose by default: T for bipeds, simply standing on all fours for quadrupeds, etc. All of this is pretty straightforward.
But then there are the animations themselves.
An animation has some number of keyframes which specify a position, rotation, and size for each bone. Animating the skeleton involves smoothly moving each bone from one keyframe's position to the next.
Position, rotation, and size each exist in three dimensions, so there are nine possible values for each keyframe. You might expect a set of nine values, then, times the number of keyframes, times the number of bones.
But no! These animations are stored the other way: each of those nine values is animated separately per bone. Also, each of those nine values can have a different number of keyframes, even for the same bone. Also, each of those nine values is optional, and if it's not animated then its keyframes are simply missing, and there's a set of bitflags indicating which values are present.
Okay, well, you might at least expect that a single value's keyframes are given by a list of numbers, right?
Not quite! Such a set of keyframes has an initial "scale" and "offset", given as single-precision floating point numbers (which are fairly accurate). Each keyframe then gives a "value" as an integer, which is actually the numerator of a fraction whose denominator is 65,535. So the actual value of each keyframe is:
offset + scale * value / 65535
Maybe this is a more common scheme than I suspect. Animation does take up an awful lot of space, and this isn't an entirely unreasonable way to squish it down. The fraction thing is just incredibly goofy at first blush. I have no idea how anyone figured out what was going on there. (It's used for texture animation, too.)
Anyway, thanks mostly to other people's hard work, I managed to write a script that can dump models and then play them with a pretty decent in-browser model viewer. I never got around to finishing it, which is a shame, because it took so much effort and it's so close to being really good. (My local copy has texture animation mostly working; the online version doesn't yet.)
Hopefully I will someday, because I think this is pretty dang cool, and there's a lot of interesting stuff that could be done with it. (For example, one request: applying one Pokémon's animations to another Pokémon's model. Hm.)
The one thing that really haunts me about it is the outline effect. It's not actually the effect from the games; I had to approximate it, and there are a few obvious ways it falls flat. I would love to exactly emulate what the games do, but I just don't know what that is. But maybe… maybe there's a chance I can find the compiled shader and figure it out. Maybe. Somehow.
Some annoying edge cases
Let's finish up with some small bumps in the road that are still fresh in my mind.
TMs are still in the Pokémon data, as is compatibility with move tutors. Alas, the lists of what the TMs and tutor moves are are embedded in the code, just like in the Game Boy days. You don't really need to know the TM order, since they have a numbering exposed to the player in-game, and TM compatibility is in that same order… but move tutors have no natural ordering, so you have to either match them up by hand or somehow find the list in the binary.
I had a similar problem with incense items, which each affect the breeding outcome for a specific Pokémon. In Ruby and Sapphire, the incense effects were hardcoded. I don't mean they were a data structure baked into the code; I mean they were actually "if the baby is this species and one parent is holding this incense, do this; otherwise," etc. I spent a good few hours hunting for something similar in later games, to no avail — I'd searched for every permutation of machine code I could think of and come up with nothing. I was about to give up when someone pointed out to me that incense is now a data structure; it's just in the one format I'd forgotten to try searching for. Alas.
Moves have a bunch of metadata, like "status effect inflicted" or "min/max number of turns to last". Trouble is, I'm pretty sure that same information is duplicated within the code for each individual move — most moves get their own code, and there's no single "generic move" function. Which raises the question… what is this metadata actually used for? Is it useful to expose on veekun? Is it guaranteed to be correct? I already know that some of it is a little misleading; for example, Tri Attack is listed as inflicting some mystery one-off status effect, because the format doesn't allow expressing what it actually does (inflict one of burn, freezing, or paralysis at random).
Items have a similar problem: they get a bunch of their own data, but it's not entirely clear what most of it is used for. It's not even straightforward to identify how the game decides which items go in which pocket.
Moves also have flags, and it took some effort to figure out what each of them meant. Sun and Moon added a new flag, and I agonized over it for a while before I was fed the answer: it's an obscure detail relating to move animations. No idea how anyone figured that out.
In Omega Ruby and Alpha Sapphire, there are two lists of item names. They're exactly identical, with one exception: in Korean, the items "PP Up" and "PP Max" have their names written with English letters "PP" in one list but with Hangul in the other list. Why? No idea.
Evolution types are numbered. Method 4 is a regular level up; method 5 is a trade; method 21 is levelling up while knowing a specific move, which is given as a parameter. Cool. But there are two oddities. Karrablast and Shelmet only evolve when traded with each other, but the data doesn't indicate this in any way; they both get the same unique evolution method, but there's no parameter to indicate what they need to be traded with, as you might expect. Also, Shedinja isn't listed as an evolution at all, since it's produced as a side effect of Nincada's evolution (which is listed as a normal level-up). To my considerable chagrin, that means neither of these cases can be ripped 100% automatically.
Pokémon are listed in a different order, depending on context. Sometimes they're identified by species, e.g. Deoxys. Sometimes they're identified by form, e.g. Attack Forme Deoxys. Sometimes they're identified by species and also a separate per-species form number. Sometimes the numbering includes aesthetic-only forms, like Unown, that only affect visuals. But sprites and models both seem to have their own completely separate numberings, which are (of course) baked into the binary.
Incidentally, it turns out that all of the Totem Pokémon in Sun and Moon count as distinct forms! They're just not obtainable. Do I expose them on veekun, then? I guess so?
Encounters are particularly thorny. The data is simple enough: for each map, there's a list of Pokémon that can be encountered by various methods (e.g. walking in grass, fishing, surfing). But each of those Pokémon appears at a different rate, and those rates are somewhere in the code, not in the data. And there are some weird cases like swarms, which have special rules. And there are unique encounters that aren't listed in this data at all, and which veekun has thus never had. And how do you even figure out where a map is anyway, when a named place can span multiple maps, and the encounters are only very slightly different in each map?
Anyway, that's why veekun is taking so long. Also because I've spent several days not working on veekun so I could write this post, which could be much longer but has gone on more than long enough already. I hope some of this was interesting!
Oh, and all my recent code is on the pokedex GitHub. The model extraction stuff isn't up yet, but it will be… eventually? Next time I work on it, maybe?
20133663D3m4K512546848-bit90ADADIadsaesAIALAAllALPHAanonymousappaptarinARMartASAAspectAssertionsATIATSbabyBASICBECBETTbinary formatBitsbleBTbugBugsCC5CADcamcarCASCasecasesccicdCERNcheatingChoiceciciaCIScliclustercodecodingcolumncommunitycompressionComputersconsoleContainerscontextcourtcryptoculturedatadatabasedataminingdeaDemodesigndesktopdetdimensiondirectoriesDMCAdocumentDocumentationdowndressEASTebsecECRedEdgeeffembeddedencodingencryptionEngineeringEnglisheNomeseteteueventexpressfactfailfamiliesfamilyfanfishflashformforumfoxFungamegamesGeneralgifGitGithubGogooglegotGREgroupsguideHABhackinghairhard drivehardwareHAThiveHoChtmlIAMICEincreaseInsideIPiqIRCirsissISTEjapankoreaLAPSLawLibrarylieslightlimitlinkinglocationLocksLTEMacMakemakingmanamapmappingmathmediaMegametadataMICROSmillionmitmoonMoUmovmovemp3MPANCRNECNESNintendonseOnlineopen sourceoperaORGOSSOtherOUspatreonpcpeoplepersonalPHIphonepiePINPIRpixelPlaypokemonPositionPPLPresentproblemprogrammingprojectProximapspythonRratrateRDSreconrecordReleaseresearchResourceresourcesrestReverse EngineeringRimerisksROVrpiRTIrubyrunningS.SAMScaleschoolscratchSearchshedSNIsoftwaresource codespacespotSSESSLStarstatusstsTAGteateachtechTechnicaltedtestthingstortouchtrackingtvUIunUnityUSveekunvideovolunteerwarwdwebwebsitewifiwinwindowsWorkWOWwritingzero
Awesome Raspberry Pi cases to 3D print at home
Post Syndicated from Alex Bate original https://www.raspberrypi.org/blog/3d-printed-raspberry-pi-cases/
Unless you're planning to fit your Raspberry Pi inside a build, you may find yourself in need of a case to protect it from dust, damage and/or the occasional pet attack. Here are some of our favourite 3D-printed cases, for which files are available online so you can recreate them at home.
TARDIS Raspberry PI 3 case – 3D Printing Time lapse
Every Tuesday we'll 3D print designs from the community and showcase slicer settings, use cases and of course, Time-lapses! This week: TARDIS Raspberry PI 3 case By: https://www.thingiverse.com/Jason3030 https://www.thingiverse.com/thing:2430122/ BCN3D Sigma Blue PLA 3hrs 20min X:73 Y:73 Z:165mm .4mm layer / .6mm nozzle 0% Infill / 4mm retract 230C / 0C 114G 60mm/s —————————————– Shop for parts for your own DIY projects http://adafru.it/3dprinting Download Autodesk Fusion 360 – 1 Year Free License (renew it after that for more free use!)
Since I am an avid Whovian, it's not surprising that this case made its way onto the list. Its outside is aesthetically pleasing to the aspiring Time Lord, and it snugly fits your treasured Pi.
Pop this case on your desk and chuckle with glee every time someone asks what's inside it:
Person: What's that?
You: My Raspberry Pi.
Person: What's a Raspberry Pi?
You: It's a computer!
Person: There's a whole computer in that tiny case?
You: Yes…it's BIGGER ON THE INSIDE!
I'll get my coat.
Pi crust
Yes, we all wish we'd thought of it first. What better case for a Raspberry Pi than a pie crust?
While the case is designed to fit the Raspberry Pi Model B, you will be able to upgrade the build to accommodate newer models with a few tweaks.
Just make sure that if you do, you credit Marco Valenzuela, its original baker.
Since many people use the Raspberry Pi to run RetroPie, there is a growing trend of 3D-printed console-style Pi cases.
So why not pop your Raspberry Pi into a case made to look like your favourite vintage console, such as the Nintendo NES or N64?
You could also use an adapter to fit a Raspberry Pi Zero within an actual Atari cartridge, or go modern and print a PlayStation 4 case!
Maybe you're looking to use your Raspberry Pi as a component of a larger project, such as a home automation system, learning suite, or makerspace. In that case you may need to attach it to a wall, under a desk, or behind a monitor.
Coo! Coo!
The Pidgeon, shown above, allows you to turn your Zero W into a surveillance camera, while the piPad lets you keep a breadboard attached for easy access to your Pi's GPIO pins.
Functional cases with added brackets are great for incorporating your Pi on the sly. The VESA mount case will allow you to attach your Pi to any VESA-compatible monitor, and the Fallout 4 Terminal is just really cool.
You might want your case to just look cute, especially if it's going to sit in full view on your desk or shelf.
The tired cube above is the only one of our featured 3D prints for which you have to buy the files ($1.30), but its adorable face begged to be shared anyway.
If you'd rather save your money for another day, you may want to check out this adorable monster from Adafruit. Be aware that this case will also need some altering to fit newer versions of the Pi.
Finally, there are great options for you if you don't have access to a 3D printer, or if you would like to help the Raspberry Pi Foundation's mission. You can buy one of the official Raspberry Pi cases for the Raspberry Pi 3 and Raspberry Pi Zero (and Zero W)!
As with all official Raspberry Pi accessories (and with the Pi itself), your money goes toward helping the Foundation to put the power of digital making into the hands of people all over the world.
You could also print a replica of the official Astro Pi cases, in which two Pis are currently orbiting the earth on the International Space Station.
Design your own Raspberry Pi case!
If you've built a case for your Raspberry Pi, be it with a 3D printer, laser-cutter, or your bare hands, make sure to share it with us in the comments below, or via our social media channels.
And if you'd like to give 3D printing a go, there are plenty of free online learning resources, and sites that offer tutorials and software to get you started, such as TinkerCAD, Instructables, and Adafruit.
The post Awesome Raspberry Pi cases to 3D print at home appeared first on Raspberry Pi.
3603D3D printingADAdafruitaesAIAllappaptartastro piATIautomationBETTbleCCADcamcameracarCASCasecasesciciacommunityconsoledesignDigitaldigital makingdowndpecECRedesaetfruitFunGitGoGPIOGREHAThome automationhttphttpsICEInsideinstructablesIPiPadirsissLAPSLTEMakemakerMaker BuildsmakersmakingmediaMoUMPANESNintendonseOnlineOtherpeoplePi 3Pi ZeroPi Zero WpiePINpinsPIPAPIRPlayPlaystationpowerprojectProjectspsRraspberryraspberry piraspberry pi 3Raspberry Pi FoundationRaspberry Pi ZeroratResourceresourcesretroretropieRustS.socialSocial MediasoftwarespaceStarsurveillanceTAGtedtorTutorialTutorialsUIunUnityUpgradeUSveilwarwinwwwzeroZero W