Oh. My. God. San Francisco Rush: Extreme Racing, and the eMaker:Huxley
No, I’m not building replacement parts for SF Rush with my eMaker:Huxley… They just both happen to be recent acquisitions. Sadly, I must admit that the SF Rush has been taking the majority of my time, despite my desire to actually finish building the Huxley. The SF Rush generates more at’a-boy points from the familial unit. In my 6yo son’s words, “The motors are cool, but the rest is just boring.. let’s race instead!”
But that’s another story. First, let me back up and say… Oh. My. God. I had nearly forgotten that I had this thing called a blog. I think my last blog post was made a year ago… honestly, I could check to know for sure, but that’s not really the point. So what brings me back, dusting off the old wp-admin interface? Shit, I already let that cat out of the bag… Yeah, new toys.
As I was thinking about it this evening, I thought, “I should blog the restoration of my SF Rush.. that would be cool. Oh, wait.. already done.” then I thought, “I should blog the building of the Huxley. Naw, if my son thinks actually building it is boring, I can’t imagine the dry eyes to be had from reading about building it. Besides… already done.”
In fact, that singular thought that brought me back to my blog. More hacking. I don’t think I saw my blog being used to this end, but it seems popular in that regard. Who am I to complain.
So, what I am I hacking this time? Well, the SF Rush of course. So, just to be clear, for any poor soul who is unfortunate enough not to understand what “SF Rush” is. It’s probably one of the best coin-operated “driving simulators” to ever hit you local FLYNN’S. My wife and I have a couple of games that we bought just after getting married, and had always wanted a Rush. We would play it at the movie theater endlessly.. well, at least until our movie was about to start. When I managed to score one on eBay for a whopping $1.25 + ~$300 in shipping and handling, it was too good to pass up. Anyway, I digress. Short answer: San Francisco Rush: Extreme Racing is a lime-green, full-sized, sit-down, arcade game in which you race against 7 other cars through the streets of San Francisco. That game was built by Atari and released in 1997, and offered “realistic” physics, and sported force-feedback in the steering wheel, along with a 4.1 sound-track and surround/quadro-phonic audio. The game also supported “linking” 7 additional cabinets together to allow you to race with your friends, or participate in a tournament. Good times.
Anyway, so, onto the hacking. There are a number of mods, such as replacing PROMs and hard-drives with CF cards, and upgraded firmwares, etc. But that was all to “run of the mill”.” In my cleaning of a cabinet that had 15 years of “17 year-old” all of it, I noticed the link cable that interconnects multiple game cabinets together was standard Cat-5. A slightly closer investigation revealed that the interconnect was standard Ethernet. Oh joy!
While the ultimate plan is to get at least one more of these machines, so we can race our friends in the basement before heading in to watch a flick in the theater room, I had the thought: “I wonder what the packets look like…” Within a moment, I’d installed WireShark on my laptop, plugged in the Cat-5, and was capturing packets.
It was pretty boring, but it confirmed that the data is in fact standard Ethernet 2. Nothing quite as elegant as IP, but it was better than Token-Ring, or some proprietary serial-based protocol that just happened to be pushed through Cat-5.
So, now what? For starters I was thinking that it might be fun to record Time Trials, and then allow you race yourself. Not unlike Ghosts, except that you actually can crash into yourself. I also thought it might be interesting to look into creating advanced AIs for the other cars. That’s getting a bit more involved, since it would require more detailed knowledge of the track layout, etc, but I could certainly start with one of my own races, and applying some genetic algorithms to “evolve” my own driving.
So, anyway, I’ll try and do my best to post progress and keep my motivation, given the Huxley sitting next to me on the table, unfinished. Of course, if you stumble across my page, and find this idea interesting and worth its merit, drop me a line, or comment– it might just be the motivation I need.
UPDATE:: Well, after plucking around till way-to-late last night, I’ve decided to change my direction with this little hack, in the short term… While I was starting to make some progress talking back to the machine, I quickly realised that I would be severely restricted in my reverse-engineering of the protocols, without having a second machine on hand.
What occurred to me though, was that I could write an app that would let me proxy the Ethernet II packets over the Internet to another, remote Rush game, thus allowing multiple people to race against each other, without being in the same room.
If by some chance, someone with another Rush: ER game comes across this, and is interested in helping out in testing, please, drop a comment.
Next update: After talking with others, hacking around, and doing a ton of investigation, here is what I’ve found so far: One area that had me puzzled in my Wiresharking was that various packets with the (seemingly) same ID/Type would have different lengths, and different values at similar offsets. While possible, it didn’t jive well, and I was getting really frustrated, until…
While digging around last night I actually found a field that seems to have a direct correlation to the packet length. With that, I’ve found the following structures:
All Packets: Basic “SF Rush” Header. Includes a packet Id, Timestamp, and a couple of [fixed?] fields.
All Broadcast Packets: Message Type (0x1815), Length, Game ID, Car/Console ID, handful of unknown fields.
— Various Sub-“Broadcast” messages: each has a corresponding state, 0x0-0x5, 0x9, and 0xA (identified so far).
— 0x00 : appears to be broadcast once at start of “attract mode”
— 0x01 : appears to be broadcast once at console startup
— 0x09 : ping at 3-second intervals when not racing (during “attract” and “game setup”)
— 0x02 : appears to be broadcast at start of “game setup”
— 0x05 : appears to be broadcast after selecting track
— 0x03 : appears to be broadcast after selecting car, drones/force-feeback options
— 0x04 : appears to be broadcast after selecting auto/manual
— 0x0A : appears to be broadcast prior to start of race
Still trying to pick out the various fields in the packet. Unfortunately, I didn’t get much time to try and correspond difference game setup options with the packets. I think I’m going to write up a “diff” function in my app, that will highlight packet data values that have changed, from previous packets.
I’m trying hard not to write a decoder for Wireshark. That seems overkills. But I’ve had to tell myself that more than once now…
I also followed up with some other machine collectors at the Arcade-Museum. Apparently a few people have used OpenVPN to connect remote machines over the Internet, with success. Of course, one of my concerns was simply finding enough people to actually coordinate and play with, and that was realized by those early attempts of others. It also appears that the majority of machine owners have upgraded their systems to SFR: The Rock. I seem to be in the minority with an actual SFR:Extreme Racing system. I may track down the chips and do the upgrade… More tracks! Woot!
New update: I just recently purchased a second RUSH. I have to make a run out to Lake Tahoe to pick it up, but it should make for some much easier wire-sharking!