I finally got my Sports Pack upgrade and tried a few things...
First and foremost, dumping the legit USB stick with 'dd' and rewriting the image to another stick of the same size (256MB) doesn't exactly work. When the copied stick is inserted to the Arcade Legend's machine, it recognizes the stick as a valid game upgrade pack, but then immediately fails before it starts copying any of the licensed roms over. I'm guessing the dudes at Joshua Technology Inc. were smart and did something clever, like checking the USB stick's vendor ID/name. If they don't match, it fails. Perhaps if you can find USB sticks from the same vendor, it will work. More on that later.
Secondly, I dumped the stick before marrying it to my machine. After I installed the roms from the legit stick, I created another dump. So I have two images: a virgin and a married. It becomes married the second you insert the stick--before it copies anything.
The only difference between the virgin and the married image is a 64-bit value starting at 0x295:
virgin: 75 8C 63 5C 23 04 57 7F
married: 1F F5 2B 0A C3 0C 67 93
I can write the virgin image back to the legit stick and it's all cool again. Meaning it can be reused in another machine.
More notes on the Sports Upgrade pack -- courtesy of my good friend:
- the USB flash drive starts with a 'standard' x86 boot sector:
x86 boot sector; partition 4: ID=0x4
starthead 0, startsector 0, 0 sectors, code offset 0x36
- with one partition (#4) containing a WIN98 boot loader, starting at 0x4000:
x86 boot sector, Microsoft Windows 98 Bootloader IO.SYS+MSDOS.SYS
code offset 0x3c, OEM-ID "MSWIN4.1", sectors/cluster 8, root entries 512
Media descriptor 0xf8, sectors/FAT 248, heads 16, hidden sectors 32
sectors 506847 (volumes > 32 MB) , serial number 0xc2f8e4f2
unlabeled, FAT (16 bit)
- despite this being a 'standard' WIN98 partition, the filesystem is not FAT16
as indicated in the partition header. when partition #4 is mounted, you see
248MB but it's all 'empty'. the data within (the SAFF files - see below),
are hidden some how.
- there seems to be 28 unique blocks (or files) found at 32-bit aligned
addresses. seems to have a 128-bit header, beginning with ASCII "SAFF"
and ending with ASCII "JEXE3.86". between these strings is a 32-bit
value, probably the length or two 16-bit values...
(presumably these are the roms)
Code:
2002000: 5341 4646 4898 0500 4a45 5845 332e 3836 SAFFH...JEXE3.86
24c4000: 5341 4646 b96b 0500 4a45 5845 332e 3836 SAFF.k..JEXE3.86
2bc5800: 5341 4646 117e 0a00 4a45 5845 332e 3836 SAFF.~..JEXE3.86
37bd400: 5341 4646 9538 0400 4a45 5845 332e 3836 SAFF.8..JEXE3.86
39bc600: 5341 4646 d0b1 0400 4a45 5845 332e 3836 SAFF....JEXE3.86
4002000: 5341 4646 c197 0500 4a45 5845 332e 3836 SAFF....JEXE3.86
44a7600: 5341 4646 f693 0400 4a45 5845 332e 3836 SAFF....JEXE3.86
465f600: 5341 4646 9872 0500 4a45 5845 332e 3836 SAFF.r..JEXE3.86
4993a00: 5341 4646 139f 0400 4a45 5845 332e 3836 SAFF....JEXE3.86
4d94000: 5341 4646 039a 0500 4a45 5845 332e 3836 SAFF....JEXE3.86
5310a00: 5341 4646 10ac 0400 4a45 5845 332e 3836 SAFF....JEXE3.86
5ae2600: 5341 4646 68b2 0a00 4a45 5845 332e 3836 SAFFh...JEXE3.86
6002000: 5341 4646 fe6c 0500 4a45 5845 332e 3836 SAFF.l..JEXE3.86
638cc00: 5341 4646 3498 0500 4a45 5845 332e 3836 SAFF4...JEXE3.86
696a000: 5341 4646 2b9a 0500 4a45 5845 332e 3836 SAFF+...JEXE3.86
6cc5a00: 5341 4646 c45e 0a00 4a45 5845 332e 3836 SAFF.^..JEXE3.86
73c1a00: 5341 4646 ebaf 0400 4a45 5845 332e 3836 SAFF....JEXE3.86
782fa00: 5341 4646 016e 0500 4a45 5845 332e 3836 SAFF.n..JEXE3.86
7d58000: 5341 4646 946f 0500 4a45 5845 332e 3836 SAFF.o..JEXE3.86
a121a00: 5341 4646 417c 0a00 4a45 5845 332e 3836 SAFFA|..JEXE3.86
ad91000: 5341 4646 1b74 0400 4a45 5845 332e 3836 SAFF.t..JEXE3.86
b193e00: 5341 4646 749a 0500 4a45 5845 332e 3836 SAFFt...JEXE3.86
b890c00: 5341 4646 a84e 0600 4a45 5845 332e 3836 SAFF.N..JEXE3.86
bceae00: 5341 4646 32f1 0400 4a45 5845 332e 3836 SAFF2...JEXE3.86
c4bb800: 5341 4646 6a27 0600 4a45 5845 332e 3836 SAFFj'..JEXE3.86
cc3f600: 5341 4646 707c 0a00 4a45 5845 332e 3836 SAFFp|..JEXE3.86
d437000: 5341 4646 8963 0a00 4a45 5845 332e 3836 SAFF.c..JEXE3.86
dac4c00: 5341 4646 786d 0a00 4a45 5845 332e 3836 SAFFxm..JEXE3.86
- the header seems to be much larger than originally assumed (128-bit).
comparing two SAFF entries, there seems to be 64 bytes of header.
the range 0x10-0x13 is common, 0x14-0x2f differ between records.
the 3rd row, 0x30-0x3f is also common... 0x40-EOF compressed and/or
encrypted data.
Code:
0000000: 5341 4646 4898 0500 4a45 5845 332e 3836 SAFFH...JEXE3.86
0000010: dc1f b832 b0df ba1b 91ad 6dbd 54c4 b9e9 ...2......m.T...
0000020: ab53 603e 108d b768 ad94 4be7 7969 f90e .S`>...h..K.yi..
0000030: e1d5 06f1 e290 723e b5c7 54b5 5298 3be1 ......r>..T.R.;.
0000000: 5341 4646 b96b 0500 4a45 5845 332e 3836 SAFF.k..JEXE3.86
0000010: dc1f b832 b0df ba1b 7d72 f97c 602c 8025 ...2....}r.|`,.%
0000020: 14f5 c26c cca0 a93c 424f 5dec 663f a5e0 ...l.....T.R.;.
- common to all records, before actual data begins:
Code:
0000030: e1d5 06f1 e290 723e b5c7 54b5 5298 3be1 ......r>..T.R.;.
I'm still poking around and figuring new things out. I'll provide an update whenever I have the time, or discover something worthwhile. I'm not even sure what my actual goal is or will be--just having some fun right now.