WAD View 1.0

A viewer, extractor and editor for the FOTOPLAY.WAD archives in funworld
Photo Play / I.G.O. arcade cabinets.

Download WADView-1.0.zip, or clone the repo — it is the same five files.
Start it with run.cmd, or python wadview.py [a .WAD, or a HardDisk.img].

What it does

Opens an archive on its own, or reads one straight out of a cabinet's
HardDisk.img — every archive on the volume is listed and read in place, so
the 94 MB FINDIT/PICS opens without extracting anything. Shows PCX, DCX, GIF
and FLC (with a frame slider), plays WAV, hex-dumps the rest. Extracts the
selection, one archive, or every archive on the image, optionally writing a PNG
beside each picture.

No dongle is needed to read anything. Most stored files have their first 128
bytes enciphered with a Turbo Pascal LCG, and in the photo games every picture
has its own key that the dongle hands over at run time. Four bytes of known
plaintext pin that seed through a 12/12-bit meet-in-the-middle — about 20 ms per
file. Scored against the 1397 keys a real dongle serves for FIND IT: 1397 of
1397 exact.

Entries can be replaced, added and removed, then saved as a new .WAD or
written back into the disk image, growing or shrinking the archive's cluster
chain in place while nothing else on the volume moves. Rebuilding an archive you
have not edited reproduces the original file byte for byte.

Two things about the format that were not previously written down

• In the per-picture-keyed archives the trailing 768-byte VGA palette is
  enciphered too — same seed, keystream restarted, with the 0x0C marker in
  front of it left in the clear. This is easy to miss because the picture still
  decodes; it just comes out in garish false colour.
• funworld's PCX encoder writes bytesPerLine == width, odd values included,
  though the spec says that field must be even. A spec-strict reader rejects
  perfectly good pictures.

What it cannot do

The 2001-and-later photo archives seal the picture data itself with a block
cipher whose keyed round runs inside the dongle. WAD View detects those and says
so rather than drawing noise — on a 2001 image that is 37 of 424 archives, and
everything else in every game reads normally.

ppdongle.py implements that cipher and the DONGCAP capture workflow, and gets
4080 bytes of every 4096-byte buffer back exactly (checked against I.G.O. 4,
which ships the same archive in the clear). The last two blocks of each buffer do
not decode, and 16 bytes every 4 KB is enough to break a GIF or PCX decoder — so
a capture gives you the picture data, not yet a picture that renders. Dongle > What a dongle adds in the app says the same thing.

Requirements

Python 3.4 or newer with Tkinter — that floor is deliberate, because 3.4 is the
last CPython that installs on 32-bit Windows XP. Works on Linux too. Pillow
is optional and only used for drawing and PNG export; without it the entry list,
key recovery, extraction and editing all still work. Nothing else.

The GUI has been exercised on Windows through an automated harness (40 checks)
and the format library on both Windows and Linux (18 checks), against real
cabinet images of every generation. The GUI itself has not been run on Linux.

Credit

The container layout, the FAT reader, the LCG, the known-plaintext method, the
2001 picture cipher and the DONGCAP capture tools come from the
PeepeeBox Photo Play research.