Wednesday, December 27, 2023

Japan-Exclusive Rockman Cellphone Games Dumped, Playable Now!


Today, we're thrilled to announce the successful acquisition and release of EIGHT Rockman cellphone games previously available only in Japan. Among the lot are Rockman EXE: Phantom of Network and Rockman EXE: Legend of Networka full chapter from Rockman DASH: Great Adventure on 5 Islands, and a handful of lesser-known from Rockman GP to a unique Rockman 1 port featuring a fully-playable Roll. Best of all, you can play them -- ALL of them -- today.

Read on for the details!


Hey, Mega Man fans! This is RockmanCosmo, leader of SciLab Secrets – the team working to preserve lost Rockman games developed for Japanese feature phones. I am thrilled to announce that we have preserved eight games: the entirety of Rockman EXE: Phantom of Network and Rockman EXE: Legend of Network, the fifth island of Rockman DASH: Great Adventure on 5 Islands, Rockman Pinball, Rockman GP, Rockman Panic Fire, Rockman Bug Sweeper, and a trial version of Rockman 1 with the ability to play as Roll.



How and Where to Play The Games


The lone DoCoMo Java (DoJa) emulator available is embedded within DoCoMo's official DoJa 5.1 SDK. Collaborating with LNRC, I created a portable version of this emulator housing the Rockman games. You can download it here (mirror). Extract the file to a folder with no spaces or special charactersFollow the steps in the readme closely; all resources are included.

Please note that the SDK's emulator isn't flawless—it encounters performance glitches with 3D games and audio stuttering when there's several objects on screen. In 5 Islands, this audio issue can be resolved by accessing the options menu through the maps menu to reset the audio. Meanwhile, team member XerTheSquirrel is developing SquirrelJME, an inclusive Java Micro Edition emulator to support DoJa apps. Once completed, these games will operate on a more stable framework.





The Ripping and Dumping Process


These games originated from a Panasonic P-06C. This is a different phone than the Sharp SH-10C, a phone in our possession that also had the full EXE games. These games were stored within its internal memory. The phone underwent a non-destructive hacking method known as the debug cable technique. Essentially, this involved altering the pins of a standard FOMA to microUSB cable and employing custom-made Linux scripts, prompting DoCoMo phones to boot into a testing mode. From there, the internal memory's content could be dumped.

User Xyz devised these Linux scripts for his ktdumper tool, which received an update in November, extending support to the P-06C phone. On November 24th, GoodTofuFriday utilized the modified cable and ktdumper to extract the contents of our P-06C's internal storage. However, the task was far from complete. Analyzing the P-06C's FSR filesystem presented a unique challenge. It wasn't until December 25th that Xyz successfully accessed and read the phone's filesystem, thereby granting us initial access to its collection of games for the very first time.

MemoryHunter and Leonierx discovered leftover game files, including the fifth chapter of 5 Islands, Rockman Panic Fire, and Rockman Bug Sweeper, amidst the phone's deleted data. Surprisingly, despite efforts to move 5 Islands entirely to an SD card, some data remained on the phone. Games like Rockman GP and 5 Islands had startup checks for online subscriptions, blocking playability. However, Leonierx successfully edited these files, enabling the games to be played—an enormous breakthrough in preserving "keitai" games.

UPDATE: Initially, we believed that the EXE games were not complete. The P-06C’s owner told us that she did not purchase the full EXE games at the time they were available. What's more, the save file for Phantom of Network left off at the very end of chapter 2, asking if the player wants to “upgrade” to chapter 3. Legend of Network had a completely new save file. However, as fans started playing through each game, they kept loading new chapters! In addition, technically-minded users discovered full game scripts and sprites of the final bosses. Suddenly, we realized our copies of the EXE games were full games that were paywalled. On the original phone, users had to pay to unlock the next chapter. But with the game files running on an emulator, this subscription check is absent, allowing for the complete gaming experience without restrictions! Our team only discovered this after extensively testing the game files on an emulator—something we couldn't have known beforehand.


Gameplay Footage and Details



Rockman GP is a racing game. There is a time limit mode where the game keeps track of your times between each checkpoint. VS mode lets you race two other racers; placing in first unlocks the next racetrack (there are three total). You can choose between three different characters, each with their own special abilities. Roll can boost her speed, Rockman can throw bombs, and Forte can become invincible. Each ability is laid on the racetrack for the player to pick up and use.

Rockman Pinball features both a classic pinball mode and a battle mode where players engage with three Robot Masters on the top screen by hitting them with the pinball to progress through three stages. A fun fact: I accidentally left my mic on during gameplay, showcasing the game's occasional frustration.

Rockman Bug Sweeper is a Rockman 1-themed minesweeper, while Rockman Panic Fire is a quirky puzzle game that tasks players with guiding Rockman to an exit while evading Fire Man and his fire trails. Fire Man moves in the opposite direction, demanding strategic planning from players.

This trial of Rockman 1 was preloaded on all P-06C devices. Normally network-locked, Leonierx was able to bypass it through modifying the game’s files. Through further hacking, he discovered that the full game can be unlocked, revealing it to be a 20th anniversary promotion of sorts. This game also had a mode where the player could play as Roll! However, the version in our archive is only the trial version; Leonierx wishes to wait until the full game is archived properly.


As previously mentioned, you'll find the complete versions of Phantom of Network and Legend of Network together! There are eight chapters total. Phantom of Network’s save file commences at the conclusion of the second chapter, offering an option on the title screen to either progress to chapter 3 or restart from chapter 1. These games closely resemble their GBA counterparts, though lacking an overworld and isometric cyberworld. They boast original stories and NetNavis. User D3str0y3d255 has ripped sprites and backgrounds from both games, set to be uploaded shortly.


This archive contains the fifth chapter of 5 Islands, which is the entirety of the final island. Given how this is the final island, the file’s save data has a lot of items and upgrades. It controls a little clumsily, but you are able to remap the controls on the game’s title screen to whatever is most comfortable for you. The other four islands were moved to the phone’s microSD card, which we have in our possession.

There's Still More Work to Be Done!


As mentioned earlier, the remaining content of 5 Islands remains encrypted on its microSD card, along with other discoveries like Rockman Tennis and Rockman Diver. Progress has been significant in decrypting these games, a process requiring an s-box, a device key, and a bind ID to crack the CPRM encryption. The universal s-box was found two years ago, while GoodTofuFriday employed a bruteforce method using a program by usernameak and XerTheSquirrel to derive a device key in October. Now, the team is focused on bruteforcing a device unique key from Rockman Tennis's files to obtain the elusive bind ID. Real-time progress tracking is available here and here, aiming for a breakthrough before January 7th.

Meanwhile, the SH-10C phone containing the full EXE games faces compatibility challenges with the debug cable method. Kraze previously attempted to desolder a test SH-10C's NAND chip but encountered technical issues. GoodTofuFriday plans to undertake a similar approach soon, aiming to dump the firmware and explore non-destructive dumping methods like browser or Flash exploits. The team is actively researching such exploits for future progress. Even though we have fully preserved both EXE games, finding an exploit for the SH-10C will benefit many other games stuck on DoCoMo Sharp phones.




Conclusion and Credits


I want to give a huge thanks to the entire SciLab Secrets team. There are over a dozen members, so here’s a list of the ones who would like to be publicly listed. Thanks to D3str0y3d255 for ripping sprites and backgrounds from the EXE games. I would also like to thank users MemoryHunter and Leonierx for their indispensable help with circumventing the games’ online subscription checks and getting them to work on the DoJa SDK’s emulator. Have fun exploring these lost games, and I hope to give you some more good news in 2024! If you have any questions about the games or our progress, do not hesitate to reach out to me via Twitter or the resources linked on my website.

42 comments:

  1. Congratulations to everyone involved! Thank you very much for this herculean effort. Not sure what else to say, there are no words to thank you enough, congrats again!

    ReplyDelete
  2. Wow congrats you guys. Shoutout to rockmancosmo!

    ReplyDelete
  3. I do wonder where the music data is in these files, normally its as easy as extract JAR get midi, but not for any of these recent uploads

    ReplyDelete
    Replies
    1. The phones run a custom format called i-melody, with .mld extension. That's different from your conventional MIDI. PSMplayer is able to play it. For ripping, you can use mtex found on github afaik.

      Delete
    2. I want to do the same thing, but I don't know the URL. translate with google

      Delete
    3. I want to do the same thing, but I don't know the URL. translate with google

      Delete
  4. RIP Rockman The Puzzle Battle

    ReplyDelete
  5. Speaking of video game preservation. Brandon G (rabidrodent) was able to preserve the Rockman DASH 3 Devroom site including a lot of Japanese Devroom entries to boot. Check it out:
    https://drive.google.com/file/d/1hDzkEK8WvqaYl9_ptCTWua2AEF6LeFBG/view?usp=drive_link

    ReplyDelete
  6. Let’s a fucking gooo!

    ReplyDelete
  7. No Rockman: The Puzzle Battle? I was really looking forward to that one.

    ReplyDelete
  8. You guys are awesome! Any hope these will be playable on like regular java phones one day?

    ReplyDelete
  9. I want to treat every member of this project to a very nice dinner.

    ReplyDelete
  10. Amazing! I appreciate all their preservation efforts!

    ReplyDelete
  11. This is just incredible. Now I can finally enjoy Rockman GP. Major thanks to RockmanCosmo and SciLab Secrets for pulling all of this off.

    ReplyDelete
  12. YEAAHHHH LET'S FUCKING GOO!!! Thank you to everyone who worked on this and continuing to work!!!

    ReplyDelete
  13. Did anyone run into an issue where the status bar (battery icon, etc.) is rendered, but the game itself is not rendered at all?

    ReplyDelete
  14. The mad lads did it! you guys rock!

    ReplyDelete
  15. Amazing work! There is a bug in the batch scripts: trying to run Rockman 1 for example from a path with spaces in the folder name fails, need to move it into a subfolder with no spaces in the folder name. This can be fixed by quoting the initial path variable if I recall correctly.

    ReplyDelete
    Replies
    1. Thank you bringing this up! I'll update the readme to make note of it.

      Delete
    2. Hoping For You Guys To Dump Rockman The Puzzle Battle

      Delete
  16. I was able to get PoN and LoN mld on Twitter.
    Open the file with a hen editor and try changing "sorc..."(73 6f 72 63 00 01 01 => 73 6f 72 63 00 01 00).
    PsmPlayer's Conversion(red circle button) works.

    ReplyDelete
    Replies
    1. thanks so much, ive been trying to figure out what the issue was!

      Delete
  17. Muchas gracias, siempre soñé con jugar estas rarezas que solo quedaron en Japón.

    ReplyDelete
  18. Hoping some day someone gets Rockman Tennis, it looks neat

    ReplyDelete
  19. Amazing! I am currently looking for the cell phone version of Rockman X made by Com2Us in Korea. This is harder to find because it was only released as a cell phone in Korea. I've also heard that this version has a few more dialog scripts than the original SNES version. I hope to get this one someday.

    ReplyDelete
  20. This ones going into the history books,

    ReplyDelete
  21. This is unreal! This is just like winning the lottery, only without the taxes! I mean, this is like falling out of an airplane without a parachute, and hitting a gaggle of geese in mid-air who break your fall. Wait until my buddies over at Happy Gardener's Monthly hear about this. I'm going to be famous! Maybe even get my picture in the next issue. -Gardener from Mario RPG (https://gifyu.com/image/Sjj1h)

    That first part matches how I felt after seeing this news! Thank you.

    ReplyDelete
  22. Great work on this preservation project. I have a question for those who are interested in playing this on real hardware. Would the DoJa SDK be required or would this possibly run on phones released around the same time. I'd be interested in this running on a Motorola Razer v3 if it could.

    ReplyDelete
  23. First we finally got Medal Operation, now PoN and LoN
    This is just like a childhood dream coming true; could only drool on PoN and LoN data as a kid

    ReplyDelete
  24. Anyone got this working in Linux and/or SteamDeck?

    ReplyDelete
  25. 好像還蠻不錯的,我可以用Gpdwm 7840u掌機碰一下!

    ReplyDelete
  26. Awesome work everyone

    ReplyDelete
  27. Congrats too all involved in such amazing efforts to preserve these old games.

    ReplyDelete
  28. If you play PoN, don't try to complete PA's library.
    ドリームブレード(LifeBlade) requires バンブーブレード(BambooBlade) code D, but due to a mistake by Capcom, it can only be obtained from Chip Trader's output.

    ReplyDelete
    Replies
    1. Hello, so it can be obtained only from the Chip Trader? Or is it impossible? I was planning on 100% the game as well.

      Delete
  29. hey does anyone know about a bootleg rockman x2 i remember seeing it at bootleg shop in brazil

    ReplyDelete
    Replies
    1. There's a bootleg X3 for Megadrive(known as Genesis in America). I've never heard of a bootleg X2 and I'm big into bootlegs. Tell me more if you know anything.

      Delete
  30. As my comment on the video, I MUST say this again.
    You are a hero for bringing this game back to existence, I was shocked that this game would only work in I-mode for japanese phones, being able to emulate and find the original files is awesome!

    This team made my day and dream from childhood.

    ReplyDelete
  31. So now that this unprecedented field of technology has begun is it possible to extract other cellphone games? Like final fantasy 7: before crisis for example?

    ReplyDelete

Keep it friendly. Disparaging, belittling and derogatory comments are not permitted.