Nicolas Correia: SF30th Hacking Edition

### Overview In this talk, Nicolas Correia, a reverse engineer at the French offensive security firm Synacktiv, details his reverse engineering of the closed-source Capcom arcade emulator known as 'mu'. Developed by Digital Eclipse and veteran developer Daniel Filner, the mu emulator powers the *Street Fighter 30th Anniversary Collection* (released on PC, PS4, and Switch) and certain dedicated hardware units like the Arcade1Up cabinet. Although the commercial release supports offline play for 12 games and online netplay for only four, Correia investigates how to reverse engineer and hook the emulator in memory to inject custom Capcom Play System (CPS-1, CPS-2, CPS-3) ROMs, enable netplay for unsupported games, modify arcade cabinet hardware, and add gameplay enhancements.

### Key Topics - **Asset Extraction and ROM Conversion**: Extracting uncompressed `.mbundle` files using tools originally developed by Luigi Auriemma (luigibotty) and building a Python tool to convert open-source MAME ROM sets into the proprietary format expected by mu. - **In-Memory Hooking & Architecture Differences**: Hijacking ROM loading functions using Vectored Exception Handling (VEH) hooks in memory, while resolving board-specific quirks such as CPS-1 hardware registers and CPS-2 opcode decryption. - **Embedded Hardware Hacking**: Accessing the root shell of an Arcade1Up cabinet via exposed UART serial pins, finding a root-writable startup script, and patching the ARM build of mu to run alternative arcade titles. - **Cheats and Gameplay Modifications**: Reversing the emulator's runtime cheat mechanisms to add infinite coins and custom training modes to unsupported titles. - **Online Netplay & Lobby Architecture**: Adapting Steam API matchmaking lobbies, synchronizing online save states across players, and hooking win/loss callbacks to support competitive tournament formats like 'First to X' (FT2).

### Technical Details Converting standard MAME ROMs to mu required system-specific adjustments. For CPS-1, main CPU words had to be 16-bit word-swapped, and graphics files were merged, reordered, and decoded by reimplementing MAME's `cps1_gfx_decode` algorithm in Python. In addition, getting CPS-1 titles to boot required patching internal CPS-B hardware registers and graphics mappers (such as scroll tile addresses in video RAM), which vary across games to prevent piracy. For CPS-2, CPU opcodes require decryption; Correia integrated the `rarena2`/`rash2` tool with dumped encryption keys into his conversion script.

To load games into the PC version, Correia avoided altering disk assets by applying Vectored Exception Handling (VEH) hooks to internal loader functions (such as `GetData`). A single byte modification triggers an exception, caught by a custom handler that substitutes the buffer size and ROM data directly in memory.

To expand online play via Steamworks API, the research addressed multiple constraints: 1. **Save States**: Online play avoids desynchronization by loading synchronized initial memory save states. Correia dumped states offline and redirected online state loading in memory. 2. **Lobby Matchmaking**: Steam API functions (`CreateLobby`, `SetLobbyData`, and `JoinLobby`) originally used hardcoded slot identifiers (0 or 1) for the four default online games. Correia patched the lobby filters and creation logic to pass arbitrary unique game IDs, ensuring players with identical custom ROMs could match. 3. **Event Callbacks & Tournament Rules**: The emulator uses callbacks tied to hardcoded CPU execution addresses to detect match finishes and return to the lobby. Using MAME's debugger to identify internal victory counter memory addresses, Correia hooked the winner callback to manage custom 'First to 2' (FT2) series before returning players to the matchmaking lobby.

### Takeaways Proprietary retro game collections using closed-source emulators often maintain flexible architectures capable of running wider hardware libraries than officially exposed. By combining static analysis (via IDA Pro RTTI structures and MAME source code), in-memory VEH hooking, and network lobby parameter redirection, researchers can extend closed commercial emulators to run arbitrary titles, build custom network features, and repurpose embedded arcade hardware.