Hacking All-New NEOGEO game.bin.z (first-gen) Generator & iNJECTOR for Wii VC :D

[SaulFabre]

Hello to all the community of GBAtemp, and welcome back to saulfabreg Wii VC!

I am saulfabreg (@SaulFabre), and today I'm showing to all of you my biggest work in a new tool for take the files from your NeoGeo romset (MAME/NeoRAGEx) and make / create / generate a correct game.bin.z file of first-generation which uses a strange variant of ZLIB compression, and also be able to inject them in new Neo-Geo Wii Virtual Console WADs which use this type of compression (in WADs from 2009 to 2011 such KOF95, KOF97, Samurai Shodown III, Samurai Shodown IV, etc.). This took me several days for develop, test and finish it and get it as working, so hope you enjoy my work.

Remember, this is a public BETA version, so If I find some bugs or you of them tell me about any bug, I will update it as soon as I have enough time.

Special thanks goes to Sr Corsario @sr_corsario (for the NG injection on new Wii VC WADs info and also for some code based in his old tool, and also for testing the tool), syring (for the UnxUtils split.exe splitting tool), Dirk Paehl (for the SimplyZip ZLIB compression tool), @stev418 from @0RANGECHiCKEN (for the game.bin.z compression info), @G0dLiKe (for the interest in game.bin.z compression found on KOF97), kikex-box and the SpekSNK community (for the NeoGeo to NeoGeo CD Graphics Converter), @waninkoko (for the NeoGeo Byte Swapper), the uCON64 team (for the uCON64 tool), @icefireicefire (for the u8it tool from WADder), Superken7 (for FreeTheWads tool), @torito21, BFGR and @suloku (for their WAD tools), and @Zorg1996 and @mrt84 (for the big Wii VC injection support to me and testing of the tool) for the help, investigations and also for pushing me to make this tool.

Well, the most interesting features are:

• Posibility to make correct game.bin.z Neo Geo VC files from any NeoGeo romset (MAME/NeoRAGEx) of ANY SIZE for inject them in new Neo-Geo VC WADs of first generation of game.bin.z compression, but with the limit of about 58,3 MB (61.210.688 bytes) / 59,3 MB (62.259.264 bytes), becuase of the emulator or system memory (64 MB of RAM) limitations, probably.
• Checks automatically what is the biggest .app file (where usually is the game.bin.z stored).
• Inject the resulting game.bin.z automatically in your NeoGeo VC WAD (only supports official NG VC WADs which were released in 2009/2010/2011).
• Auto-detection of size of each group of files (P, M, V, S, C) for make the header-generation easier
• Compatibility with Windows Vista/7/8/8.1/10 and x64 bits Windows OS

Said that, I'm going to explain you how to use the tool when you open it and the wizard screen in CMD (command line) appears. I written all in Notepad, maked a batch (*.bat) file for run it in CMD and then converted to executable with F2KO BAT to EXE Converter software. Coming soon I'm writing the tutorial of how to use the program. I will be updating this as soon as I have time.

First of all, download the latest version of the 7z file and uncompress its contents on a folder.

Link: >> https://gbatemp.net/download/neogeo...or-for-new-ng-wii-vc-wads-beta-version.37129/ <<

You MUST add the files common-key.bin and libWiSharp.dll on the same folder where the executable NGWii_gamebinz_iNJ.exe is stored. If you don't, the program will not be able to pack or unpack WADs.

Additional comments about NeoGeo VC on Wii:

NEO GEO:
The NEOGEO Wii VC emulator is universal, as their romsets. This means that if your console is European (PAL), the emulator will switch to PAL mode, if your console's region is USA (NTSC-U), it will switch to NTSC-U, and if your console's region is Japan (NTSC-J), it will switch to NTSC-J (I think).
The bad thing about this is that the emulator will never be in PAL60 mode (only will run in PAL50), at least since we find a way to do so.
The "good thing" is that the emulator in Europe (PAL) mode optimizes the NeoGeo games so the speed is almost the same as the original in 60 Hz mode. So, the only bad thing will be the black borders... if your TV is not a 16:9 one xD

A NeoGeo game / romset is programmed with the following groups of files: (thanks to @sr_corsario for this info!!! )

• S files: Text / Letters
• C files: Sprites / Graphics / Objects
• V files: Sound samples
• P files: M68K program (game code)
• M files: Z80 program (sound driver code)

With the new compression on game.bin used since year 2010 until 2011 for NeoGeo VC games, called game.bin.z, uses a strange type (variant) of ZLIB compression, which @stev418 from @0RANGECHiCKEN could discover with what tools can be (un)compressed, with tools Xpert v2.0 or SimplyZip. This was most noticeable on official WAD of The King of Fighters '95 (KOF95), and later used on more NeoGeo VC WADs until 2011, including The King of Fighters '97 (KOF97) (thanks to @G0dLiKe for purchasing and dumping this game for this purpose).

Special thanks again to @sr_corsario for checking what is the new structure of these game.bin.z files: Header + S + C + V + BIOS + P + M

The official NeoGeo VC WADs which uses this type of game.bin.z with ZLIB compression, compatibles with this injector, are the following:

• Metal Slug 2
• KOF95 (The King of Fighters '95)
• KOF97 (The King of Fighters '97)
• Samurai Shodown III
• Samurai Shodown IV: Amakusa's Revenge
• Ironclad
• Street Slam
• Fatal Fury Special
• Fatal Fury 3: Road to the Final Victory
  
• Fighter's History Dynamite / Karnov's Revenge
• Magical Drop 2 / Magical Drop II
• Magical Drop 3 / Magical Drop III
• Spin Master

In year 2012 until year 2013, Nintendo used a more complicated and fast compression in their game.bin.z on the newer NeoGeo VC WADs, a strange type of CRUSH variant (type) of compression, called CR00 (CRUSH00 / CRUSH01 / CRUSH001), which is still unrecognizable and less documented for un/compress these game.bin.z files with CR00 compression, sadly And programmers aren't interested in it
They're also encrypted with an AES key, different in all games of all regions (this means, each game in each region have different AES encryption keys), making this still impossible to decompress it.

Unfortunately, these WADs aren't supported by this injector

Some of the official NeoGeo VC WADs which uses this type of game.bin.z with CR00 compression, NOT compatibles with this injector, are the following: (incomplete list)

• Shock Troopers
• Shock Troopers: 2nd Squad
• Metal Slug 3
• Metal Slug 4
• Metal Slug X
• Sengoku
• Sengoku 2
• Sengoku 3
• KOF96 (The King of Fighters '96)
• KOF98 (The King of Fighters '98)
• KOF99 (The King of Fighters '99)
• 2020 Super Baseball
• NAM-1975
• Last Blade
• Last Blade 2
• Real Bout Fatal Fury
• Real Bout Fatal Fury 2
• Real Bout Fatal Fury Special
• World Heroes 2
• World Heroes 2 Jet

That's all for now, I know it's not pretty clear, and the program is still a little buggy, but if you use it the way I said, you probably will not have a lot of problems. Any bug reports and questions are appreciated, and I will try to solve them when I have the time

 

[SaulFabre]

Tool updated to v1.4.0 on May 11, 2021
Go check it out and UPDATE it!

 

[niuus]

Just wanted to clarify as i will probably try some Neo Geo injections soon, the difference between this tool and this tool, is that the first one generates this special file from the game's ROMs (game.bin.z) and the second one uses and injects said file to finally create the Neo Geo WAD? But doesn't the second tool do that job already?

Awesome tools and great work, from what i've been reading.

 

[SaulFabre]

Just wanted to clarify as i will probably try some Neo Geo injections soon, the difference between this tool and this tool, is that the first one generates this special file from the game's ROMs (game.bin.z) and the second one uses and injects said file to finally create the Neo Geo WAD? But doesn't the second tool do that job already?

Awesome tools and great work, from what i've been reading.

Yeah. my first tool is only for make game.bin.z from Neo Geo romsets, and the second tool is both make the game.bin.z from your Neo Geo game and then inject it into the desired WAD.

Greetings

 

[niuus]

Yeah. my first tool is only for make game.bin.z from Neo Geo romsets, and the second tool is both make the game.bin.z from your Neo Geo game and then inject it into the desired WAD.

Greetings

Oh, cool. So i guess it doesn't matter if i just use the second one. Thanks for the info!

 

[JanErikGunnar]

In year 2012 until year 2013, Nintendo used a more complicated and fast compression in their game.bin.z on the newer NeoGeo VC WADs, a strange type of CRUSH variant (type) of compression, called CR00 (CRUSH00 / CRUSH01 / CRUSH001), which is still unrecognizable and less documented for un/compress these game.bin.z files with CR00 compression, sadly And programmers aren't interested in it
They're also encrypted with an AES key, different in all games of all regions (this means, each game in each region have different AES encryption keys), making this still impossible to decompress it.

Not true anymore!
My fork of vcromclaim is able to automatically build the AES key, decrypt, and extract most of the "crushed" games, it SHOULD be possible for you to reverse all the algorithms.
The biggest problem is the generation of the AES key which is absolutely ridiculous, but now you have a working implementation. Fortunately AES is symmetric so you can use the same algorithm to get the key to use for encryption when injecting a game as well.
The only "dynamic" input of the AES key is the content of banner.bin and the first 20 bytes of the CR00 file (those 20 bytes are not part of the game data, they are probably just input for the AES key). The AES key also use some values from inside the other app files, but they are the same for each game.

 

[SaulFabre]

Not true anymore!
My fork of vcromclaim is able to automatically build the AES key, decrypt, and extract most of the "crushed" games, it SHOULD be possible for you to reverse all the algorithms.
The biggest problem is the generation of the AES key which is absolutely ridiculous, but now you have a working implementation. Fortunately AES is symmetric so you can use the same algorithm to get the key to use for encryption when injecting a game as well.
The only "dynamic" input of the AES key is the content of banner.bin and the first 20 bytes of the CR00 file (those 20 bytes are not part of the game data, they are probably just input for the AES key). The AES key also use some values from inside the other app files, but they are the same for each game.

Hey @JanErikGunnar, thanks a ton for this info and other info about later second-gen NeoGeo VC game.bin.z compression!

One noob question...
With that info, is it possible to make a tool on C#/C/C++ or similar (not Python) which can automatically uncompress these game.bin.z files, and also for calculate the required values for the new modified files (CRC, hash, size, AES key, etc, etc, etc...) before finally compressing the new game.bin.z in the new format?

One of my goals is having support for game.bin.z on a VC injector tool. Yeah, we're talking about FriishProduce (developed by @CatmanFan), which is made in C#.

In short: is it possible to adapt your methods for (un)compressing these game.bin.z files in a injector tool?

Thanks a ton for this

 

[JanErikGunnar]

It MIGHT be.
The troubles I think you might have is:
- Knowing which encodings/file formats to use. vcromclaims just does things like "this file has an ACM header, that means we need to decode it with the ACM algorithms". Going in the other direction, you would have to determine if the file needs to be ACM encoded or not. (ACM just being an example, there are plenty of different stuff used for different games.) So you would have to do some more research in what file formats/encodings are used/expected by each software. In worst case, some emulators MAY be very customized to the ROMs they are bundled with.
- Additional checks. I would not be surprised if the emulators does additional checks, maybe using checksums, to ensure games haven't been tampered with. Of course if you can identify these checks it should be easy to patch those things as well.
- Original encryption. Some later NG games have encrypted ROMs in the original hardware, and the MAME romsets also have these encrypted ROMs. The Wii versions are decrypted, so when injecting, you would have to decrypt them. (MAME has C++ code that does this!)

Of course, everything that can be done in Python can be done in C#/C/C++. By reversing and/or porting things from vcromclaim you should be well on your way.

Disclaimer: I'm doing this for preservation only, I wont be touching anything illegal