Revolution Arcade
| Revolution Arcade | |
 | |
| General | |
|---|---|
| Producer(s) | Nintendo |
| Release Date | 2008 |
| Region(s) | All |
| Ports | All excluding GameCube ports and composite video output 1x VGA output |
| Optical Drive | No |
| Usecases | Arcade machines |
| System Menu Version(s) | RVA Menus |
| Lifespan | 2008-? |
The Revolution Arcade (RVA) is an arcade version of the standard Wii. It's only known to have been used for Capcom games, even though it seems to have been prepared for SEGA and Namco as well, as per certificate references in its system menu. Its console type is referred to as OS_CONSOLE_RVA_PROD1, and it is referenced by a string describing an "RVA.txt" file in the Wii System Menu's title data directory.
The unit itself does not feature an option for composite video output, rather, it supports VGA output or JVS. It supports output at either 4:3 or 16:9. The unit also uses the standard power supply input seen on retail models.
It features an RVA Setting Menu, which is available by holding the SEL button as the system turns on. It contains a calendar, options to set the screen into either 4:3 or 16:9, and a license. There is also a game-specific test menu, which can be accessed by pressing the SEL button once the board is powered up. It is a menu to test functionalities so it typically contains a display test, an input/output test, system configuration options, clearing and saving data, and JVS status.
Within the System Configuration menu, there is an option to input an eight-digit password, which controls elements of a given game.
Unsigned Code Execution
The system menu will attempt to perform a system update if it detects a file on the mounted SD card that follows this specific format: A:/sysupdate/RVASysMenu.*.wad, where 'A' represents the drive letter of the mounted SD card. During the update process, the system menu scans for all files that match this format, and the names of these files are saved for later use. However, the buffer that houses these filenames has a fixed size, making it possible to overflow it by creating an excessive number of files that match the specified format.
To achieve unsigned code execution, one can create 85 ordered files that conform to the specified format. The characters at positions 137, 138, 139, and 140 in the 85th file will overwrite a pointer that references an array of function pointers associated with SD card functionality. By modifying this pointer to point to a region of user-controlled memory, it becomes possible to execute unsigned code on the system.
Dip Switch
| Dip Switch | Setting |
|---|---|
| DIP 1 | ON = 15K OFF = 31K |
| DIP 2 | TBC |
| DIP 3 | TBC |
| DIP 4 | TBC |
| DIP 5 | TBC |
| DIP 6 | TBC |
The manuals of the device does not indicate whether or not switches 2-6 are used.
Manual
Contains information on both the game and the unit.
- TvC_Manual_Page_1-9.pdf
- TvC_Manual_Page_10-18.pdf
- TvC_Manual_Page_19-27.pdf
- TvC_Manual_Page_28-36.pdf
Board
-
The top of the board. -
The bottom of the board.
| |||||||||||