DIY Mario Kart Arcade GP 1/2 Camera Solution - Working!

[winteriscoming]

Edit: DIY Directions posted here.

Edit: I've figured out how the camera works and have a replacement proof of concept running on an Rpi. Read on for more details.

Original post:
Who's got info on the camera used in Mario Kart Arcade GP1/2?

I see from the manual that it plugs into the Namco JVS I/O board (FCA PCB). That means the picture data is potentially being sent over JVS. That means if the communication protocol can be deciphered, I could potentially work any easy to interface camera into my MEGA JVS solution, and you could have a cheap camera for Mario Kart.

I see that it plugs into the I/O board with 3 wires, but there's also apparently a LAN element, which could make this too complicated. What I'm not sure of is if the camera is simply driven by the I/O board and maybe images come in over LAN, or what... Odd, though, because why couldn't a LAN camera be interfaced with 100% over LAN without involving the JVS I/O?

My hope is that the camera is somehow sending data over those three wires to the I/O and then the images are sent over JVS.

 

[winteriscoming]

@freddiefiasco

One thing I'd be curious to know since you have the FCA PCB, if you enable the camera in Mario Kart, does it give any kind of error?

I would assume since it's a NAMCO I/O that they'd be using some extended custom JVS commands and ACKs, and probably the camera functionality is a part of that.

 

[freddiefiasco]

@freddiefiasco

One thing I'd be curious to know since you have the FCA PCB, if you enable the camera in Mario Kart, does it give any kind of error?

I would assume since it's a NAMCO I/O that they'd be using some extended custom JVS commands and ACKs, and probably the camera functionality is a part of that.

When I have the camera setting is set to ON, the error is different from WMMT type errors where you can't get passed the initialization screen. All you get is a message that says "Camera cannot be used at this time" and it lets you continue on to play the game.

During gameplay, you get a bubble above each vehicle with the players picture. The LAN portion of the camera is used to display other players on your screen. When I last played MK2, the camera shows live data during gameplay so the camera is active at all times showing facial reactions of each opponent. This leads me to believe that the LAN connection is used to send active data to each Linked machine.

During the intro/demo screen, pre-rendered images of people are shown in the bubbles to simulate this type of network play.

I might swing by Round1 this weekend so I can contribute some images of what I am talking about.

 

[winteriscoming]

I'm guessing the LAN aspect is going to throw a wrench into my plans. I'd be curious to find out if the 3 pins on the I/O where the camera plugs in are inputs or outputs. If they're outputs, then we know that at some level the camera is just being driven by JVS and there's not much I'd be able to do with my MEGA JVS project. If they're inputs, and picture data is fed over JVS, then that's a different story and something might be possible. Maybe it's a mix?

The bad thing is I don't think there's enough documentation on the FCA PCB like there is on the Sega I/O's, where we can access a documented pinout and know for sure what each pin is.

I don't get why the camera needs direct LAN access. Couldn't each connected Triforce just send its picture data out over the LAN connection? And if it's a LAN camera, why couldn't the entire thing just be driven by LAN? Why involve the I/O? The stuff these companies incorporate into arcade cabinets baffles me sometimes!

 

[freddiefiasco]

I'm guessing the LAN aspect is going to throw a wrench into my plans. I'd be curious to find out if the 3 pins on the I/O where the camera plugs in are inputs or outputs. If they're outputs, then we know that at some level the camera is just being driven by JVS and there's not much I'd be able to do with my MEGA JVS project. If they're inputs, and picture data is fed over JVS, then that's a different story and something might be possible. Maybe it's a mix?

The bad thing is I don't think there's enough documentation on the FCA PCB like there is on the Sega I/O's, where we can access a documented pinout and know for sure what each pin is.

I don't get why the camera needs direct LAN access. Couldn't each connected Triforce just send its picture data out over the LAN connection? And if it's a LAN camera, why couldn't the entire thing just be driven by LAN? Why involve the I/O? The stuff these companies incorporate into arcade cabinets baffles me sometimes!

Definitely. Since it's dedicated hardware for just ONE game, they don't care.

I am heavily speculating the camera LAN access. I could be completely wrong.

Even with the manual, I agree that the information is not as concise as it should be even for a repair manual. It specifically states Input and no Output, that's about it.

 

[winteriscoming]

I've got some new theories on the camera, but no way at the moment to confirm.

I've been working on a wiring adapter for the Namco FCA I/O to Sega Type 1, and I have come to the conclusion that the 3 camera inputs are going to outputs on the I/O (i.e. the incoming line gets grounded when the output on the I/O is activated). That means the camera PCB likely has 3 inputs that it senses. The I/O would not be receiving any data into it from these lines, and therefore the camera is mostly interfaced with over LAN, at least with regards to images.

I suspect that these outputs are used as a means of initializing and setting the IP of the camera. It's also possible that some commands are given to the camera via these lines.

As part of another project I was messing with the pre-assigned IPs that the Triforce takes on when booting Mario Kart. In the stock rom file, the IPs for the 4 potential motherboards are:
192.168.29.150
192.168.29.151
192.168.29.152

192.168.29.153


Right next to these IPs in the rom file, I see the following:

192.168.29.104

192.168.29.105

192.168.29.106

192.168.29.107


I didn't know what these were at the time I originally found them, but now I'm thinking they are the expected IPs of the cameras associated with each motherboard.


I haven't had any luck with an android app that presents itself as an IP camera, but I'm curious to learn if the I/O portion of the camera interface is used exclusively for initialization and setup and is relatively unused otherwise. If so, it's possible that a correctly configured IP camera could just work with this game. If you know the IP address that the camera needs for a given motherboard, you could just set it up appropriately and not rely on the game to do so.


Knowing that these are outputs on the I/O, I should be able to do some analysis on the output commands over JVS and see if that tells me anything.

I found an "as-is" camera PCB for this game online and went ahead and ordered it. We'll see if I can do anything with it. I have had no luck finding a source for purchasing a known working PCB.

 

[freddiefiasco]

That means the camera PCB likely has 3 inputs that it senses. The I/O would not be receiving any data into it from these lines, and therefore the camera is mostly interfaced with over LAN, at least with regards to images.

Hopefully this confirms some of your suspicions. On startup, the camera establishes an IP for the camera for each seat. From what I observed, if the cab is linked to others, the stage where PCB1, PCB2, etc are initialized, the camera IPs are established after this point. Each camera IP seems to be assigned a specific range based on the linked units. I might have someone that would be willing to lend a working camera.

 

[obcd]

You could try a good old hub and a pc in the same subnet. Wireshark might be able to show you the network traffic between the triforce and a camera unit.
For the function of the io lines, your guess is as good as mine.
I doubt the JVS interface would have sufficient bandwith to stream real time video.

We used axis ip camera's in the past. If I remember well, you just had to access them with a browser and they started to show you their video stream in your browser. I doubt it will that easy with the MK camera's.

The reason I say hub is because switches try to be intelligent. If they know traffic from device A needs to be sent to device B, they will only output that traffic on the switch port device B is connected 2. This keeps the bandwith on the other switch ports available for other traffic. Old hub's simply send the data out on all ports and don't care on which one device B is connected. So, your pc connected to another port will receive the traffic as well.

 

[winteriscoming]

Discovery dump:

I received my broken camera board and cannot seem to get it to work with the game, but I have been able to use it for some research and made some interesting discoveries.

I believe my theory about the IPs for the games and cameras is correct. Using Wireshark, I was able to see that the game, when set per whatever player is chosen in settings and its subsequent ip address, pings the camera at the ip I expected. This activity happens during the Checking Camera portion at boot.

The connections to the JVS I/O board are simply acting as DIP switches to set the IP, at least the last numbers of it. There are even some unpopulated DIP switches on the camera board that link to each of these I/O connections, so a physical DIP could be installed to manually configure the camera.

With no DIPs set, the camera defaults to a .100 address. I confirmed that I have my wires connected to the I/O correctly, because the the address of the camera changes accordingly when the game boots or goes into test mode.

The camera board broadcasts its IP address when it boots, and reboots when DIP settings are changed, broadcasting its IP again.

The camera board uses an EPSON S1S65010 processor, which seems to be a dedicated IP camera chip. It has a web server and the camera can be accessed from its IP with a web browser. The interface is relatively robust and has a lot of options for settings. The interface appears to be in Japanese and Chrome translated the pages ok for me. The options to change any configuration settings requires a username and password which I discovered were root/administrator. So I can get into the camera and change settings, such as the IP address, and such.

What's odd to me is that my camera board was defaulting to 192.168.1.100, which doesn't seem to be the range Mario Kart expects. I edited the configuration to be 192.168.29.100 and the settings stuck. Now it defaults to this on initial boot.

However, no matter what I do, I cannot getting an image to show up from camera in the web browswer, and Mario Kart doesn't seem to get an image either. I don't see any evidence that Mario Kart is actually linking to this camera board and acknowledging that it's attached and/or that there's some specific error.

I don't see any troubleshooting/diagnostic tools in the web UI, so I have no idea what's wrong with my board other than the assumption that it's something wrong with the camera or image processor.

The camera is on a little module board that can be detached, but I wasn't able to discover a replacement by Googling the various IDs printed on it.

Since I purchased what I already expected was likely a broken camera, I'm not sure I've got much else I can do with it at this point.

 

[freddiefiasco]

The camera board uses an EPSON S1S65010 processor, which seems to be a dedicated IP camera chip. It has a web server and the camera can be accessed from its IP with a web browser. The interface is relatively robust and has a lot of options for settings. The interface appears to be in Japanese and Chrome translated the pages ok for me. The options to change any configuration settings requires a username and password which I discovered were root/administrator. So I can get into the camera and change settings, such as the IP address, and such.

The S1S65010 board looks to accept a JPEG Camera Module.
If the camera you have is broken but the board itself is functioning properly, I wonder if you can just use a standard camera that communicates with the external pins on the board to establish I/O.

See page 36 Sections 7.1, 7.2, 7.3:
https://global.epson.com/products_and_drivers/semicon/pdf/id000275.pdf

Also just curious:
Is the Camera's web server using port 80? or some other port number to display a signal?
(Actually, ignore this, I overlooked where you said you can change these on the web page)

 

[winteriscoming]

Is the Camera's web server using port 80? or some other port number to display a signal?
(Actually, ignore this, I overlooked where you said you can change these on the web page)

I'm actually not sure about the port. I don't see where I can set it, but I can enter 192.168.29.100:80 and the main landing page opens in my browser just the same as entering the address without the port.

I'm really not that familiar with IP cameras in general, but the web interface for this board seems to host a page where you're supposed to be able to view the image stream, and it requires java. All of my browsers started freaking out about it, and when I finally messed around forever updating java on my laptop, java still didn't like this page. I had to add an exception in java and even then the best I can get to happen is that IE will show "loading" on the page, but my other browsers show just a white screen.

The web address ends up being 192.168.29.100/imgview.htm and this is a pretty simple page with this source:

<html lang="ja">
	<!-- Copyright (C) 2003-2004 JAPAN MINI COMPUTER SYSTEMS CO.,LTD. -->
	<head><title>“®‰æ•\Ž¦</title></head>
	<body>
		<applet code="imageView.class" width=640 height=516>
			<param name=interval value="0">
			<param name=image value="img.jpg">
			<param name=speed_pos_x value="10">
			<param name=speed_pos_y value="+10">
		</applet>
	</body>
</html>

The imageView.class file ends up being pretty hard to read and I can't figure much out from it.

I don't know at this point how the game is interfacing with the camera board to get an image, and I can't be sure that it's any kind of modern standard.

I will probably have to wait until I get my hands on a known working board before I can determine if a working board does, in fact, generate an image over the web interface.

If the camera you have is broken but the board itself is functioning properly, I wonder if you can just use a standard camera that communicates with the external pins on the board to establish I/O.

See page 36 Sections 7.1, 7.2, 7.3:
global.epson.com/products_and_…/semicon/pdf/id000275.pdf

It may be possible, but I'm not sure I will ultimately pursue trying to fix this board. It feels like that will take me off course of my ultimate goal of putting an alternative together.

 

[winteriscoming]

My hope is that the game is somehow polling for images over http and that the process can be easily mimicked with a RPi server or something similar. If an RPi can be used, it seems like it would open up possibilities of using cheap webcams and not having to mess that much with the hardware side of things.

 

[freddiefiasco]

I think that issue you're seeing with IE as opposed to the other browsers is due to the IP camera trying to load a RAW image.
Similar to RTSP vs MJPEG, they require an additional driver for the browser to load tie image. Of course those times, the vendor supplies the driver on their site. I wonder if that class file is looking for an ActiveX plugin or similar.

My hope is that the game is somehow polling for images over http and that the process can be easily mimicked with a RPi server or something similar. If an RPi can be used, it seems like it would open up possibilities of using cheap webcams and not having to mess that much with the hardware side of things.

I'm hoping this too. On the RPi, you can plug in a generic USB camera and view the stream using motion.

 

[obcd]

Rpi USB used to be a disaster for camera's and usb 2 audio adapters.
You better use the rpi camera module for such purposes.
Maybe things have improved with the rpi3.

Would you be able to capture the http requests the board is sending to the camera to obtain a picture?

192.168.29.100/imgview.htm is something you would expect from the game board as well.

 

[Solkan]

I'm really not that familiar with IP cameras in general, but the web interface for this board seems to host a page where you're supposed to be able to view the image stream, and it requires java. All of my browsers started freaking out about it, and when I finally messed around forever updating java on my laptop, java still didn't like this page. I had to add an exception in java and even then the best I can get to happen is that IE will show "loading" on the page, but my other browsers show just a white screen.

<html lang="ja">
	<!-- Copyright (C) 2003-2004 JAPAN MINI COMPUTER SYSTEMS CO.,LTD. -->
	<head><title>“®‰æ•\Ž¦</title></head>
	<body>
		<applet code="imageView.class" width=640 height=516>
			<param name=interval value="0">
			<param name=image value="img.jpg">
			<param name=speed_pos_x value="10">
			<param name=speed_pos_y value="+10">
		</applet>
	</body>
</html>

The imageView.class file ends up being pretty hard to read and I can't figure much out from it.

I don't know at this point how the game is interfacing with the camera board to get an image, and I can't be sure that it's any kind of modern standard.

I will probably have to wait until I get my hands on a known working board before I can determine if a working board does, in fact, generate an image over the web interface.

You may need an older version of Java.

What is the Exception thrown by the Applet ?
Maybe we can decompile the imageView.class

 

[winteriscoming]

You may need an older version of Java.

I will see what I can do to test this. I have an old XP laptop from around the time this camera board was developed. I can use it and it looks like Oracle has legacy JAVA installers available.

What is the Exception thrown by the Applet ?

I'm not seeing an exception other than a generic security error that I can override. Then it just results in a white screen.

Maybe we can decompile the imageView.class

I'm able to view the file in my web browser by using 192.168.29.100/imageView.class. I have attached the file. A lot of it seems viewable in ASCII, but there are a lot of characters that don't display properly and I'm not sure if they're just Japanese characters that aren't rendering properly in my text editor or if they're something else.

 

[winteriscoming]

Well, the laptop couldn't handle it. Its resources maxed out as soon as the page loaded, so I'll try on the more capable XP box I use for my CNC machine.

 

[winteriscoming]

The seemingly best behavior is with Netscape 6.0 on my XP box. I can it to where the applet looks like it's at least attempting to load and can get a log from JRE that indicates an error with a VolatileImage.class file... I'm trying upgraded versions of Java to see if it helps.

I'm trying for browser and java versions from circa 2004.

I'm not sure what version of Firefox I was on, but when it loaded the page it wanted to have a plug-in installed, but refused to connect to any plug-in download server (I assume since it's out of date) and gave no information about what it wanted.

IE is behaving the same as on my XP laptop where it immediately blows up system resources with no apparent log of activity.

The frustrating thing with working with legacy browsers and plug-ins is that you run into a lot of incompatible combinations.

 

[winteriscoming]

Actually, I didn't realize loggging had to be turned on in the latest version of JRE.

On my Win7 laptop with IE11 and JRE version 1.8.0, I can get this log. The browser still just has a white page, with no apparent activity.

Java Plug-in 11.171.2.11 x86
Using JRE version 1.8.0_171-b11 Java HotSpot(TM) Client VM
User home directory = C:\Users\Jim
----------------------------------------------------
c:   clear console window
f:   finalize objects on finalization queue
g:   garbage collect
h:   display this help message
l:   dump classloader list
m:   print memory usage
o:   trigger logging
q:   hide console
r:   reload policy configuration
s:   dump system and deployment properties
t:   dump thread list
v:   dump thread stack
x:   clear classloader cache
0-5: set trace level to <n>
----------------------------------------------------
basic: Added progress listener: sun.plugin.util.ProgressMonitorAdapter@da7516
security: Expected Main URL: http://192.168.29.100/imageView.class
network: Cache entry not found [url: http://192.168.29.100/imageView.class, version: null]
security: SSV validation:
    running: 1.8.0_171
    requested: null
    range: null
    javaVersionParam: null
    Rule Set version: null
network: Created version ID: 1.8.0.171
network: Created version ID: 1.8.0.171
security: continue with running version
security: JUT Record:
    plugin2
    http://192.168.29.100/imgview.htm: launchjnlp= image=img.jpg code=imageView.class codebase=http://192.168.29.100/ width=640 speed_pos_y=+10 interval=0 speed_pos_x=10 height=516  app_model=eJx9UsFOGzEQnZAACY2gCuqlFRJC5cLBJjlQEKcIcUDaSgho72Zjska7trFnw4YDUn+iEgf+oP/BnW/olT9AasebJSAO8WG1nnkz894b/3mCee/gS2wy5nPNBtKmZsycvGB9a7+bgUxhcmpzsBRBM6bQufASYTm6FCPBtUT+4yTaj+DDQPrYKYvKaITOJJ0KPeSn6JQeEqQjC5TaE+BEepO7WHqETxNkjirlfefEOFIeCdy+FG4Ku4JbqNP81MQiDAj3WgStTCh9kApfAuaoyMs4dwrHgTvCVkTKOCnjE2WclPEXZV9P32Bp4DwqTGXVqIFjSw02ZjY4IwwVLoykHhhXVhaW/GwHRYysYWTN781vO5+f/7o6LB5BMxE+OaDiI2hY45AkiBwTE2i8TL5QrywS47H6b1pn0MQmre51olKN/Fcd2kp3r8e6O7ust8e629sINR4wLaRWiNaW9FZLesFwNjW8+PW4dvcg7utQI2pe3cjChr1fN8K3KP1tvw8szhjc5iobjpS8ZglmAfxxygFhRWViKH+GbBy2ZxFa09Ctg/UZD7J0vXqV0CEqDpZLQeGtsUOdZ2+T1Hmhf3wcHZ7Z/0jk6zo=
network: Cache entry not found [url: http://192.168.29.100/imageView.class, version: null]
network: Connecting http://192.168.29.100/imageView.class with proxy=DIRECT
network: Connecting http://192.168.29.100:80/ with proxy=DIRECT
cache: http://192.168.29.100/imageView.class is not cacheable.
basic: Applet loaded.
basic: Applet resized and added to parent container
basic: PERF: AppletExecutionRunnable - applet.init() BEGIN ; jvmLaunch dt 444443 us, pluginInit dt 252937681 us, TotalTime: 253382124 us
network: Cache entry not found [url: http://192.168.29.100/img.jpg, version: null]
network: Connecting http://192.168.29.100/img.jpg with proxy=DIRECT
network: Connecting http://192.168.29.100:80/ with proxy=DIRECT
cache: http://192.168.29.100/img.jpg is not cacheable.
basic: Loaded image: http://192.168.29.100/img.jpg
basic: Applet initialized
basic: Starting applet
basic: completed perf rollup
basic: Applet made visible
basic: Applet started
basic: Told clients applet is started
network: Connecting http://192.168.29.100/img.jpg with proxy=DIRECT
network: Connecting http://192.168.29.100:80/ with proxy=DIRECT
security: Grant liveconnect connect perm for http://192.168.29.100/imgview.htm : java.security.Permissions@1a8467d (
 ("java.net.URLPermission" "http://192.168.29.100:80/-" "*:*")
 ("java.net.URLPermission" "http://192.168.29.100:80" "*:*")
 ("java.net.SocketPermission" "localhost:0" "listen,resolve")
 ("java.util.PropertyPermission" "java.specification.version" "read")
 ("java.util.PropertyPermission" "path.separator" "read")
 ("java.util.PropertyPermission" "java.vm.vendor" "read")
 ("java.util.PropertyPermission" "os.version" "read")
 ("java.util.PropertyPermission" "browser.version" "read")
 ("java.util.PropertyPermission" "java.vendor.url" "read")
 ("java.util.PropertyPermission" "browser" "read")
 ("java.util.PropertyPermission" "browser.vendor" "read")
 ("java.util.PropertyPermission" "os.name" "read")
 ("java.util.PropertyPermission" "java.vm.specification.version" "read")
 ("java.util.PropertyPermission" "java.vm.name" "read")
 ("java.util.PropertyPermission" "javaws.*" "read,write")
 ("java.util.PropertyPermission" "javaplugin.vm.options" "read")
 ("java.util.PropertyPermission" "mrj.version" "read")
 ("java.util.PropertyPermission" "java.version" "read")
 ("java.util.PropertyPermission" "jnlp.*" "read,write")
 ("java.util.PropertyPermission" "javaplugin.version" "read")
 ("java.util.PropertyPermission" "os.arch" "read")
 ("java.util.PropertyPermission" "java.specification.vendor" "read")
 ("java.util.PropertyPermission" "java.vm.specification.name" "read")
 ("java.util.PropertyPermission" "file.separator" "read")
 ("java.util.PropertyPermission" "line.separator" "read")
 ("java.util.PropertyPermission" "java.vendor" "read")
 ("java.util.PropertyPermission" "java.specification.name" "read")
 ("java.util.PropertyPermission" "java.vm.specification.vendor" "read")
 ("java.util.PropertyPermission" "java.vm.version" "read")
 ("java.util.PropertyPermission" "javapi.*" "read,write")
 ("java.util.PropertyPermission" "java.class.version" "read")
 ("java.util.PropertyPermission" "http.agent" "read")
 ("com.sun.deploy.security.SecureCookiePermission" "origin.http://192.168.29.100:80")
 ("java.lang.RuntimePermission" "accessClassInPackage.sun.audio")
 ("java.lang.RuntimePermission" "stopThread")
)

I'm not sure what to make of it. I don't see an obvious error there.

 

[winteriscoming]

There is also what I think is a higher quality streamer available at http://192.168.29.100/hsview.htm.

This one keeps repeating this in the log file:
network: Connecting http://192.168.29.100/img.jpg with proxy=DIRECT
network: Connecting http://192.168.29.100:80/ with proxy=DIRECT
ERROR: com.sun.image.codec.jpeg.ImageFormatException: Not a JPEG file: starts with 0xff 0xd9


It could be that since the camera is broken, it's not generating a usable jpeg for this stream and maybe this would be working otherwise.

Edit: I can also load 192.168.29.100/img.jpg in my browser, but it's just blank. Perhaps this is the URL for a single still generated at the time the page is loaded?

I'm not sure there's much else to do with the broken board. @jlazaris has offered to let me borrow a working board, so I may hold off until I get that.