IGS Toolkits

IGS Toolkits for E2000

Thanks for Batteryshark's impressive PM1 hacking project.

• https://github.com/batteryshark/igstools
• Reversing an ASIC-Assisted Arcade Game

Usage

IGS SHFS v1/v2

Based on Squashfs 2.2

cd squashfs-tools\squashfs-tools
make all

sudo ./igs-toolkits/squashfs-tools/squashfs-tools/unsquashfs

IGS ROFS v1

cd cramfs-tools
make all

Unpack

sudo ./igs-toolkits/cramfs-tools/cramfsck -v -x./out ./test.img

Repack

sudo ./igs-toolkits/cramfs-tools/mkcramfs ./out test.img

IGS ROFS v2 (Percussion Master 3 only)

cd cramfs-tools
make pm3

Unpack

sudo ./cramfsck -v -x./out ./pm3/part2.bin

Fix GECA

cat ./GECA_header ./part2/etc/rc.d/rc0.d > ./GECA

Fix Game

(base) ➜  sd2 python ../igs-toolkits/recover_game.py -h 
usage: recover_game.py [-h] [-p {pm2008,sd2}] [-e ELFHEADER] [-d DATADIR] [-o OUTPUT]

Recover game from IGS E2000 platform

options:
  -h, --help            show this help message and exit
  -p {pm2008,sd2}, --game {pm2008,sd2}
                        game config to use
  -e ELFHEADER, --elfheader ELFHEADER
                        head file to read
  -d DATADIR, --datadir DATADIR
                        game parts dir to read
  -o OUTPUT, --output OUTPUT
                        game file to write
                        
(base) ➜ python ../igs-toolkits/recover_game.py -p sd2 -e ./head.bin -d ./p2/lib -o ./sd2_game
libc1.so size: 0x00067000, write 0x00043000 bytes to game file, write block 268 skip block_num: 141
libc4.so size: 0x00067000, write 0x00044400 bytes to game file, write block 273 skip block_num: 132
libc3.so size: 0x00067000, write 0x00045800 bytes to game file, write block 278 skip block_num: 123
libc2.so size: 0x00067000, write 0x00046C00 bytes to game file, write block 283 skip block_num: 114
libc8.so size: 0x00067000, write 0x00048000 bytes to game file, write block 288 skip block_num: 105
libc7.so size: 0x00067000, write 0x00049400 bytes to game file, write block 293 skip block_num: 96
libc5.so size: 0x00067000, write 0x0004A800 bytes to game file, write block 298 skip block_num: 87
libc6.so size: 0x00067000, write 0x0004BC00 bytes to game file, write block 303 skip block_num: 78
libc9.so size: 0x001D0294, write 0x001B6294 bytes to game file, write block 1752 skip block_num: 69

Fix agetty

Location: /etc/inittab

1:4:respawn:/sbin/agetty ttyS1 115200 vt102

SSH Services

Generate keys

ssh-keygen -q -t rsa -f ssh_host_key
ssh-keygen -q -t rsa -f ssh_host_rsa_key

sshd_config

HostKey /home/ssh_host_key
HostKey /home/ssh_host_rsa_key
SyslogFacility AUTHPRIV
LogLevel INFO
PermitRootLogin yes
AuthorizedKeysFile	.ssh/authorized_keys
PermitEmptyPasswords yes
X11Forwarding yes
Subsystem	sftp	/home/sftp-server

Fix SSH enviroment

mkdir /var/empty
echo "sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin" >> /etc/passwd

SSH Daemon

/home/sshd -f /home/sshd_config -h /home/ssh_host_rsa_key -p 22 -E /PM2008v2/pm2_data/sshd.log

TSG ROM Loader

Directory: tsgrom_loader

python ./tsgrom_loader.py -f ./test/mainl.rom

Show file information.

TSGROM Header:
  Header: TSGROM01
  Version: 00.0000.0004
  Length: 0
  Data Zones: 2180
  Data Type Counts:
       SOUND: 1
    ACTBLOCK: 485
    ACTINDEX: 1
    ACT_DATA: 90
    ACT_POOL: 485
    ACT_STEP: 753
    BASEDATA: 1
    BMP_OPSS: 30
    MTV_INAC: 1
    PALETTE1: 1
    TGA_OPSS: 332
Found 362 image data zones

Extract resources to target path.

python ./tsgrom_loader.py -f ./test/mainl.rom -o ./test/mainl

References

Arcade documentation.

• https://github.com/shizmob/arcade-docs

Open Source Projects

• https://github.com/plougher/squashfs-tools
• https://github.com/npitre/cramfs-tools