Navigation

herpetic.adventures · Joined: 24 Nov 2007 Posts: 5

Long story short, about 10 years ago I was poking around the Player1 website looking for info on when Robotron 64 was coming out. Just for the hell of it, I clicked the "Press Info" link. Which turned out to be an anonymous FTP. Woo.

Poked around a bit, and amongst directories of PSX assets, I found "robo64.zip" and "tommy64.zip". Curious as hell, I downloaded them as fast as my blazing 21.6k would afford me. AAAAAND, I wind up with 2 password encrypted files both with .ROM extensions inside. Man.

I briefly entertained the concept of running a brute password cracker on them, but after running it for 5 minutes on my blazing Win95 P200 MMX with 64mb of RAM, I realised it was highly doubtful it would find the pwd before I reached the legal age of drinking...

Fast forward to Thanksgiving 2007. I was poking thru my drawers, attempting to consolidate random half spindles of CD-R's, and I come across "N64 & GB BS - 09/26/02". Curious what I had accumulated and needed to burn off 5 years prior, I popped it in and found amongst random Japanese games those 2 password protected zip files that mocked me in my youth.

But thanks to computers being twice as fast as they were 10 years ago (gahaf) I grabbed a cracker program and set it to work on tommy64. Fear the might of an Athlon 64 3400+ with 2 gigs of RAM, demon encryption! (God I need to upgrade...)

While letting it do its' thing, I poked around ye olden intarwebs to see what the exactly this thing could be. Back in the day I figured it was a press demo of one of the Rugrats games or something, which was one of the main reasons I didn't see a reason to devote the next 5-7 years of CPU processes to finding the key to check. Not to mention I didn't have a copier or devkit or whathaveyou back then, and I don't recall any of the N64 emus popping up til late 1998...

But I digress. It seems Player1 was working on something called Tommy Thunder, which got canned and switched to PlayStation, which also seems to have been canned. And that's about the extent of the info I can find. A few 'cancelled games' lists, and an IGN interview with Factor 5 (Rogue Squadron guys) where it's mentioned in passing. Wish I could find some pics or something.

Anyhow, after a few hours, brute force earned results in the form of the zip's 7 chr password. I copied it from the app, saved it to a text file, pasted it to about 5 different people on IRC/skype/etc, unzipped the rom, REZIPPED it sans password, and fired up Project 64.

"ERROR Unknown Cic Chip"
?
"ERROR Unhandled CicChip(-1) in first DMA"
????

After all these years, the goddamn thing is corrupt and won't run?? THIS IS AN OUTRAGE I'M CALLING MY CONGRoh wait there it goes.

http://s233.photobucket.com/albums/ee272/herpeticadventures/Tommy%20Thunder/

Sorry there's not too many shots - I can't find where my USB Xbox dongle adaptor thingus is, and trying to use a kbd for N64 stuff is horrible.

So it seems to be just a one level tech demo or alpha build or something. There's collision and a gun, but I couldn't line up with those bug things once I finally found the gun heh. Animation is a bit glitchy too when you hit collision. No splash screen or menu system or anything - level renders and you drop in at that ship crash site thing.

I'd like to give this thing a spin on real hardware - I saw a few months back there was a site, HK or Taiwan I believe, where someone was manufacturing SD/CF/etc flash carts for Genesis/NES/N64 etc, but I can't find the URL again for the life of me. Any ideas?

Tanks...

ClamIAm · Posted: Sun Nov 25, 2007 12:57 am Post subject:

Hooray for Moore's Law! Also, I can't say I'm hanging on the edge of my seat for it, but have you tried cracking the other (presumably Robotron) file?

neomerge · Joined: 12 Feb 2006 Posts: 351 Location: Woodstock GA!

Great find! Good to see that you kept the file intact over the years and finally successfully opened the passworded file.

herpetic.adventures · Joined: 24 Nov 2007 Posts: 5

Skrybe · Staff Joined: 28 Aug 2003 Posts: 1610

Haha, nice! It's always fun poking around websites for stuff like that. Let us know what you find in the other file!

TheRedEye · Posted: Sun Nov 25, 2007 3:43 am Post subject:

Aw, no download? I just installed Project64 hoping to try this out.

neomerge · Joined: 12 Feb 2006 Posts: 351 Location: Woodstock GA!

Did you by any chance try the password for the first one on the second? And just out of curiosity what was the password for the first one?

ProgrammingAce · Joined: 26 May 2006 Posts: 580

Dollars to doughnuts, if you have the password on one file you can reasonably guess the structure of the other.

IE, if one's a dictionary word, then the other probably is too. On the plus side, zip files only recently started using AES encryption. You should be able to crack a password fairly quickly with the right tools. If you want some help, let me know.

herpetic.adventures · Joined: 24 Nov 2007 Posts: 5

Sorry got a little distracted...

Original one was 0x7e1d3 - lucked out because it started with a 0 I guess. Robo64 was up to 9S????? before I turned it off yesterday. Tried a dictionary attack this afternoon on a whim and nothing.

If someone with a better machine and decryption skills wants to take a crack at it, drop me a line @gmail.com (same username) and I'll email it along

ProgrammingAce · Joined: 26 May 2006 Posts: 580

Who writes their passwords in hex?

That password is a little weird, it's hex notation. Converting it straight from hex to ascii is dubious, it's missing a character.

Converting hex to dec, gives you 516563. Which looks more promising, but that's "3A?" in ASCII... Ok, so ENIGMA i'm not...

I'll generate a dictionary for hex values and see if that does us any good.

BMF54123 · Posted: Tue Nov 27, 2007 6:55 am Post subject:

Perhaps it's a ROM address? A debug mode enabler, maybe? Very Happy

*crosses fingers*

S.F · Joined: 02 Aug 2007 Posts: 18

kap · Posted: Tue Nov 27, 2007 8:14 pm Post subject:

I just sprung for a 2.66 core 2 duo with a couple gigs of ram, if we need a return to password cracking. It's running lunix, and I have no experience with password cracking, but it shouldn't be too difficult, right?

..right?

rbudrick · not rubrdick Joined: 09 Oct 2006 Posts: 549

ProgrammingAce · Joined: 26 May 2006 Posts: 580

http://kotaku.com/gaming/sony/hackers-find-the-playstation-3-to-be-totally-hackarific-327133.php

nesworld · Joined: 14 Oct 2007 Posts: 22 Location: Denmark

Doesn't seem to be running on the real hardware because of the missing CIC chip info... just took it for a spin on my V64jr.

I decided to mess about a little and added bootcode to the binary, damn it looks crappy on real hardware...

Well here's the rom for those who doesn't have it...

http://temp.64scener.com/tommy64.rar

Gilgamesh · Joined: 28 Mar 2006 Posts: 4 Location: France

Hello,

Inside rom :

3DSMAX_ASCIIEXPORT 200
*COMMENT "AsciiExport Version 2.00 - Wed Sep 17 14:20:33 1997"

3DSMAX_ASCIIEXPORT 200
*COMMENT "AsciiExport Version 2.00 - Fri Sep 26 10:41:02 1997"

KR155E · Joined: 14 Oct 2004 Posts: 8 Location: Germany

herpetic.adventures · Joined: 24 Nov 2007 Posts: 5

heh sorry been distracted with life in general...

Got a new quad core machine, ran the cracker on the robo64 one - 2 days later it tells me the password is "i9KKs9s". So I give it a shot. And every ZIP program I have tried gives an error. (WinRAR opens the first 18 bytes in a text editor for some reason) So I dunno. Need to find another cracker I guess...

kap · Posted: Wed Feb 20, 2008 2:40 pm Post subject:

Try the command line unrar program. winrar sucks, and you probably don't want to use an unzipping program.

edit: I'd like to help trying to get at the file, if you'll supply me with a copy.

Navigation

Lost Levels Forums