Pandora’s Box 6 – Deep Dive, Part 3

Okay, when we last left off, we found what looked to be our emulator frontend, /usr/emu/emulotar. It appeared to be the program that the Pandora’s Box 6 wanted to keep running at all costs and it looked like some scripting set up the use of the Linux framebuffer for the QT graphical toolkit for embedded Linux. Let’s try to verify our assumptions by taking a look at emulotar with a hexeditor.

Personally, I am using HxD, a freeware hexeditor for Windows that should work fine for most cases, including this one.

Do We Know What We Think We Know?

Let’s start off by verifying a few of our previous assumptions. We’re going to rip open /usr/emu/emulotar and take a look at what we might find inside. When looking at a file with HxD, we will see the hexidecimal representation of the file on the left and a translation to ASCII on the right. This helps us visually look for strings of text within the file easily. So, let’s open ‘er up.

Lots of ELFs around this time of year.

The very first thing we see when opening up the file is “.ELF”. This is a tell-tale sign that we’re looking at an .ELF file, which is an executable built for ARM processors. This is exactly what we’re expecting to see as the Pandora’s Box is built on the ARM architecture.

I know what you’re probably thinking right now.

“Jay, that’s… not very interesting.”

And you’d be right. However, there actually IS a lot in this file that IS actually interesting. Starting at offset 0x00005C40, we have what appears to be a block of strings. These appear to be commands that the emulator frontend is running which will give us some insight into what’s going on.

A small sample of what we can find here.

Instead of just giving you screenshots, I’m going to list what I find here and explain what they mean/do and take a guess at how things are working. Here are my little notes on what I think I’m looking at and I’ll take a final guess as to what is going on afterwards. This is a little information-dense, so feel free to skip this.

  • /dev/spidev1.0 – I believe this is a device file for the SPI bus and it’s likely that controls are accessed by reading GPIO pins through the SPI bus. I would have expected a /dev/spidev0.0 rather than a 1.0, but who knows…
  • /dev/mem – The normal device file that all the RAM is mapped to, normal in Linux land.
  • /dev/fb0 – The framebuffer device. Also to be expected in Linux.
  • echo volume – A command that would write “volume” to the screen. Odd.
  • %d – Usually used as a token for another variable. Impossible to tell what this is here for alone. The 00’s show that this isn’t just a part of the next line as they would be spaces (20) instead but they aren’t.
  • 1 > /tmp/mfile & – This appears to be a fragment of a command. The intent appears to be to write the contents or output of a file into /tmp/mfile. The “&” here tells Linux to do this in the background. It appears that the file being copied to /tmp/mfile is a video file, likely the Pandora’s Box 6 intro video that you see on bootup.
  • /bin/vp -slave -input file=/tmp/mfile -quiet -volume – This appears to be our video player application. A quick look at vp using our hexeditor shows that it appears to be a version of mplayer, the popular Linux video player. So it looks like vp is mplayer in disguise and is told to play the file found at /tmp/mfile.
  • /bin/vp -slave -input file=/tmp/mfile -quiet -zoom -x 384 -y 226 -volume – Exactly the same as above except we can see that it appears to be playing at a small resolution. This is likely the command used when the Pandora’s Box 6 is used through a JAMMA connection to a low resolution arcade machine.
  • /tmp/libboot.so & – This tells Linux to run the file as an executable in the background. This is slightly odd as usually any file that ends in .so is a shared object, similar to Windows DLLs… but in Linux, you can name anything whatever you want so it’s not a hard and fast rule. This appears to be common on the pirate versions of the Pandora’s Box at least.
  • rb – Unsure. Too small to speculate. See wb below.
  • /dev/mmcblk0 – This is the device file for the first SD card that Linux finds. This would be where the Pandora’s Box would find the SD card it uses to boot from.
  • app1, app2, app3, app4, app5, app6, app7, app8 – I believe that – much like the previous boot1, boot2 files we found previously – this is potentially the emulator application set up for different languages/resolutions.
  • wb – When seeing wb and rb somewhat close together, it is possible that this is a flag for opening files as writable (wb) or read-only (rb). Until we can dig into everything ourselves, this is just a guess.
  • /tmp/app – Later on, it appears that this is the path to the main emulator executable used by the Pandora’s Box 6. I believe it is a combination of MAME, FBA and PCSX Reloaded in a single executable but this is currently unknown.
  • We now have what looks like 4 different sets of mplayer executables copied to /tmp/vdt as well as 4 different sets of .so files:
  • cp /bin/mplayer /tmp/vdt – Copies /bin/mplayer to /tmp/vdt. Also has the following files listed: /tmp/libboot.so, libbootc.so, /tmp/liblogo.so, liblogoc.so. libbootf.so, liblogof.so, libboote.so, liblogoe.so. Very likely that the files that end in c are Chinese, those ending in e are English. Very possible that these are the logos shown on the screen during boot up before the video is played and when a game is launched.
  • But we also have cp /bin/mplayer1 /tmp/vdt with the following files: libbootc1.so, liblogoc1.so, libbootf1.so, liblogof1.so, libboote1.so, liblogoe1.so
  • Same cp and files mentioned for numbers 2 and 3 as well. Very likely meant for different resolutions. On closer inspection, the mplayer3 version does not appear to have any files ending in f as the others do. Perhaps this is the one for the JAMMA version?
  • Much like the repeating blocks of files and commands for 4 different versions of mplayer, we have something similar with libcfg.so files, but also the Pandora’s Box 6 allows players to change the background of the menus by copying a file on the Udisk. If the number scheme holds up, it appears that we’ve figured out what the numbers mean. No number = 1280×720, 1 = 1024×768, 2 = 640×480, 3 = 384×224.
To give you a better idea, I’ve separated them by line, cropped to fit here.
You get the idea.
  • tar -xf /tmp/libcfg.so -C /tmp – This extracts the files from within /tmp/libcfg.so directly into /tmp. Most likely what happens here is that the version of libcfg.so taken from above is copied to /tmp/libcfg.so before being decompressed. So I think this is going to be a set of configuration files for MAME that is setup for the different resolutions.
  • rm /tmp/libcfg.so – Delete the /tmp/libcfg.so file after decompression.
  • cp /tmp/config/xmame/nvram/* /tmp/ – Almost 100% certain that these are premade NVRAM files for different games with preselected settings. Likely something like this also with save states for the PlayStation games allowing them to skip all the intros and loading at the start. So this means that they have an archive of NVRAM files dumped into /tmp. This is where we would need to put in a fixed joust.nv so that Joust would be playable.
  • We appear to have a list of filetypes that this emulator frontend supports showing – bin, cue, img, mdf, pbp, toc and cbn for the PlayStation emulator and zip for MAME/FBA.
  • /tmp/imagesc.so – Unknown, perhaps Chinese only due to this being the only version of the file mentioned? Haven’t found references to this elsewhere yet.
  • /tmp/mfile, mkfifo /tmp/mfile – It looks like the /tmp/mfile that is used for playing a video through mplayer is a named pipe. Basically, the video file is piped through /tmp/mfile for mplayer to play it. It’s okay to not know what that means, just think /tmp/mfile = start up video and you’re good.
  • mkdir /tmp/udisk, mount -a, mdev -s, /dev/sda1, mount -t vfat /dev/sda /tmp/udisk – It looks like we have the emulator frontend setting up the mounting of the udisk, which we expected to find in /etc/fstab but didn’t. What is very interesting about this here is that it doesn’t look like the udisk is mounted as read only, so it’s very possible that maybe we can output some logs or something out to the udisk for analysing.
  • killall -9 vp – Forcably kill the video player when everything’s mounted and ready?
  • rm /tmp/libboot.so – Delete /tmp/libboot.so when done with it.
  • 4 calls of mplayer0 playing /tmp/liblogo.so in all four resolutions the PB6 supports… except that the horizontal resolution is 2 pixels wider for… whatever reason. So 1280×722 instead of 1280×720, for instance. Odd that they only use mplayer0 for this and not mplayer1/2/3 as we see elsewhere.
  • /tmp/udisk/roms_fba, /tmp/udisk/roms_mame, /tmp/udisk/roms_playstation – These are the three different folders that users can drop their ROMs into to get added to the PB6 and their mount points.
  • killall -9 mplayer0 – Kill the video player when we’re done loading up user roms?
  • rm /tmp/liblogo.so – Delete the logo when we’re done?
  • /tmp – Seems to be where most of the work is being done here, the temporary RAM disk.
  • chmod 777 app – Set the permissions to allow read/write and execute on app. I believe this app program is our actual emulator.
  • /app -qws 54 54 20, /app -qws 54 52 20, /app -qws 52 54 20, /app -qws 52 52 20, /app -qws 54 54 30, /app -qws 54 52 30 – Pretty sure that this runs our emulator at different resolutions. Likely that qws has to do with the QT toolkit.
  • rm app – Delete the emulator when we’re done? Why?
  • /app tankfrce, /app btime, /app 54, /app 52 – I believe this is how the emulator to run for each ROM is selected as it mirrors something I remember seeing in a pirate Pandora’s Box. As far as I remember, while tankfrce (Tank Force) and btime (Burger Time) are legit MAME roms, I believe the emulator looks specifically for these games being called to know to switch to either the FBA or MAME emulators. It’s… an odd way of doing things, that’s for sure.
  • Just a few more device file names, and some error text after that, nothing special.
  • /dev/dsp – Likely the device file for audio output.

That’s about all the interesting text we’ve got here, so let’s take a look at everything we’ve got so far and take a guess at how this whole thing is functioning.

It’s getting late though and I’m tired. So I’ll write up a full guess into how the Pandora’s Box 6 boots up and runs, how it does things and when. I’ll also mention a few potential attack vectors for breaking into the box.

Pandora’s Box 6 – Deep Dive, Part 2

Now that we have a general idea of what we’re looking at on the Pandora’s Box 6 file systems, it’s time to start poking around. As this is a Linux-based single board computer, some Linux knowledge is useful. I’ll do my best to explain things as I see them so that those of you who are less technically inclined can follow along and understand a bit about how the box functions.

Start Me Up

Since the Pandora’s Box 6 is built to basically be a simple appliance that turns on and does one thing, we should start our journey into it by taking a look at how it would go through starting up. Generally speaking, a bootloader would be the first thing that would run and would then load up a Linux kernel and mount a file system. Once that is done, control is normally handed off to the Linux kernel and it finishes the boot up process by mounting the other file systems needed, running various daemons (or services in the Windows world) on start up before finally handing control over to the user. Well, in our case, we have a bit of a problem here as there is no obvious Linux kernel anywhere on either the EXT3 or FAT16 file systems.

Educated guess time: I think the various boot1 through boot9 files in the FAT16 file systems are encrypted/compressed archives that likely contain either the Linux kernel itself and additional files needed or it is somehow loaded up from elsewhere. The one thing that we can easily throw out is that the Linux kernel being loaded is from the UDisk as you are very capable of booting up the Pandora’s Box 6 without it and getting a completely empty game list. (This may be something to remember in the future as it might mean that all ROMs are read from the file system and not just those in the three folders meant for users to add games to. Perhaps something we can exploit here?)

Let’s continue onward with the Linux bootup process. Linux has what it calls runlevels. Basically these runlevels are numbered from 0 to 6 and represent different states. Most Linux boxes will set runlevel to 5 which represents network up and running, graphical interface running, everything ready for users. Runlevel 6 is usually the reboot state and Runlevel 0 is when the system is halted and can be safely shutdown. There are scripts that can be run automatically when certain runlevels are hit, so let’s take a look and see if we’ve got something like that happening here.

A Simplified Look at Our EXT3 File System

Just before we start poking around, let’s take a quick tour of our EXT3 file system so you can get an idea of what you’re looking at.

This is a fairly typical file system for most embedded Linux systems here.

Starting from the top, here’s what we’ve got:

  • /bin – Binaries that are common for the system and available for most to use.
  • /dev – Files representing all the machine’s devices are stored here. (Linux treats all devices as if they were virtual files which allows for some interesting ways of doing things.)
  • /etc – Configuration files used by the system, some applications and daemons (services).
  • /home – This is where your own user files are stored, much like My Documents on Windows but more tightly controlled and secured.
  • /lib – Where you will normally find Linux kernel modules and libraries (much like Windows DLLs).
  • /lost+found – A directory where Linux will attempt to place any files it recovers upon checking the system at startup.
  • /proc – A virtual filesystem that contains information about the running system, no actual files exist here.
  • /sbin – Binaries that are needed for running the Linux system and maintaining it.
  • /sys – Similar to /proc, it is a virtual filesystem containing information about the running system.
  • /tmp – A temporary filesystem that is created in RAM and can be used by processes for temporarily storing data. Disappears when system reboots.
  • /usr – Contains binaries meant for users to run and use as well as libraries and additional files needed by those binaries.
  • We will ignore the linuxrc symlink (or shortcut) for the moment.

We’re going to take a quick look at the /etc directory to see what we can find there. Typically, it is where you would find scripts that would run when runlevel hits 5 as well as other information such as filesystems to mount on boot.

As spartan as you’ll almost ever find an /etc directory.

Poking Around Some More

So what do we have here?

  • /etc/init.d/ – A directory that normally holds scripts to run on startup.
  • /etc/fstab – A file used by Linux for mounting filesystems.
  • /etc/hostname – A filename that tells Linux what hostname the machine should use.
  • /etc/profile – A default profile for all users on the machine.

Okay, so taking a look at profile shows absolutely nothing of interest, just something for setting the default terminal prompt, which we cannot see anyways. The hostname file just tells the machine to set the hostname to “hhh”, nothing too exciting here.

Now fstab is very interesting for us as it is where you would normally find filesystems getting mounted. We would expect to find our udisk listed here among the filesystems and…

…we don’t.

Instead, what we see here are the various virtual filesystems that are needed soon after booting. /proc and /sys are created during boot up and /tmp and /dev are created soon after. Well, that would normally be the case except none of the file systems are marked “auto”, so they need to be mounted manually, likely from a script. The use of tmpfs means “this filesystem exists only in RAM”, essentially. Alrighty, so a swing and a miss. Let’s move on to the init.d directory, where we find a file called rcS that I have good feelings about. Let’s open it up, shall we?

And here’s where we start seeing something.

This small shell script is run on bootup. It tells the machine to set the hostname using the “hhh” value found in /etc/hostname. It then sets the default directories that Linux will use as its PATH variable, searching the directories listed for any executables the user will attempt to type into the console. Nothing unusual about either command here at all. But what do we have here? A command attempting to run /usr/myinit which definitely isn’t something you would find on a normal Linux box. Let’s check that out.

Finally, a little meat to chew on.

Okay, so the first two lines here set up the PATH for Linux to look for executables and the PATH to load libraries (like Windows DLLs) from. Both of these are 100% standard for Linux, so nothing odd there. But the next line… that’s… that’s something new to me. A quick Google search for QWS_DISPLAY shows that it is a variable used by QT for Embedded Linux, which is a graphical toolkit. So it is more than likely that our emulator frontend uses the QT toolkit for all its graphics.

Google is endlessly helpful when it comes to things like this.

After reading that and looking at the line in our /usr/myinit file, we can see now that it is setting a variable to tell a QT application to use the Linux framebuffer device for writing graphics to the screen using the /dev/fb0 device.

Remember when I mentioned how it was odd that /etc/fstab showed filesystems but none of them were flagged as “auto” and therefore wouldn’t be automatically mounted at boot time? Well, the reason for that appears to be that they would rather have this script do it instead. The use of “mount -a” tells Linux to mount all the filesystems listed in /etc/fstab right now, so it is at this point that those virutal file systems are mounted and active. “mdev -s” is responsible for creating all the virtual files for each of your devices in /dev. This is where, for example, the /dev/fb0 framebuffer device will be created.

Finally, we see a while loop that will loop infinitely running what looks like our frontend executable. This is exactly the kind of thing you do when you want a program to always be running because if it terminates at any point, this loop will start it back up again automatically. This is a great stopping point for now.

Summary

So, let’s take a look at what we now know about our Pandora’s Box 6 so far.

  • The udisk is formatted FAT16 and contains all of our default games and directories for adding more games.
  • The boot SD card is split into two partitions, a FAT partition that contains what looks like different archives depending on what settings you use and an EXT3 file system that houses the rest of the system.
  • The emulators used by the Pandora’s Box are MAME 0.106, Final Burn Alpha
    0.2.97.36 and an unknown PlayStation emulator (likely PCSX ReARMed, but haven’t found evidence yet).
  • The emulator frontend appears to load games up on-the-fly.
  • The emulator frontend appears to use the QT graphical toolkit for embedded Linux devices.
  • The boot sequence once we are past loading the Linux Kernel is /etc/init.d/rcS -> /usr/myinit -> /usr/emu/emulotar
  • We learned a bit about how the Linux filesystem looks and what the structure means.
  • We learned that sometimes, looking up stuff on Google can bring us some knowledge that we would have needed otherwise.
  • The Linux kernel isn’t on the UDisk as the PB6 can be booted up without it attached just fine.

In the next blog post, we will continue to pull on the thread to see what falls out as we examine the emulator frontend application itself and see what else we can find to help us.

Hope that you’ve learned something from this post. If you have questions, feel free to ask in the comments below.

Oddities – Pandora’s Box For Sale at Best Buy?

When you get interested in Chinese bootleg gaming machines, you come to expect the unexpected. You never know when you’ll discover a new idea that the bootleggers have come up with while looking around. But this… this is a bit unique.

I spend some time occasionally looking for more information on the various Pandora’s Box hardware out there and the various clones and seeing if I find any that are local that I might be interested in picking up. To be perfectly honest, I kind of am interested in collecting them at this point because I find them somewhat facinating with all the strange variants out there. It was during one of these random searches online that I found something a bit out of the ordinary.

Adequate Purchase?

Best Buy’s site online isn’t just a listing of what they have in stores or online as you might expect. Anyone that’s attempted to search for something they are interested in have probably noticed that there are also various retailers selling their goods through the “Best Buy Marketplace”, as it is titled. These marketplace 3rd party seller search results appear being just as legitimate as those from Best Buy itself with the only real difference being that “pick up in-store” isn’t an option and the seller is listed.

I was looking through the Best Buy Canada site to see if they were starting to sell the various Arcade1Up 3/4ths size arcade machines when I typed “arcade” into the search box and found this:

…Oh boy.

So, just kind of the generic Pandora’s Box 4S bootleg as you might expect and have probably seen a million times before. Nothing really unique about it at all aside from normally being overpriced. I have to admit that I do enjoy the color scheme a little bit as I’m very partial to blue. I’ve seen this one on other sites and it is made in plastic which is… less than desirable when most of these are made in wood or metal. I highly doubt that Best Buy realizes the illegality of selling this on their site but I’m not about to blow the whistle about it.

It looks like the seller is rather new and likely started up in November 2017. It doesn’t look like it’s going too well as we can see the following:

Not exactly a confidence builder, hmm?

While there are no reviews for the Pandora’s Box being sold here itself, let’s take a look at the seller’s reviews. 23 reviews, I’m sure there’s bound to be some information about why they only have a 3.3 star average. I’m going to cherry-pick a few of the more interesting reviews below.

Most of the reviews seem to complain about headphones.
Yes, there are some good reviews here, too.
Of course, there’s always the obligatory “I don’t understand this star rating system” person. Sorry, Lynn, but you’ve failed us all.

Conclusion

Unfortunately, the seller doesn’t give us enough information to say exactly what Pandora’s Box clone is inside the box as they just give us “800 Classical Games” and that doesn’t match up to any PB or clone that I know of directly.

It’s overpriced, especially at its original $300 price tag, you won’t know exactly what you are getting beforehand and it’s housed in a plastic casing. I would not recommend buying this through Best Buy unless you had money to burn and the novelty of buying it through them tickles your fancy… for whatever reason. There are far better options that you should be able to find on Facebook Marketplace, Kijiji, Craigslist, AliExpress or… well, just about anywhere. Don’t bother.

Update

Here’s someone’s review of what looks like a unit with the same box as the one being sold above on Best Buy’s Marketplace. Of course, because these are Pandora’s Boxes, the hardware on the inside is very likely entirely different than what is being sold above as even the number of games differs greatly. But for those of you interested in a better look at the box itself, here you go:

Pandora’s Box 9 – Feature Comparison against PB5 and PB6

So, the Pandora’s Box 9 clone is getting more widely sold and as such, there is more information about it than we had when we previously discovered it a few months ago. For those of you wondering if you should take the plunge on a Pandora’s Box 9, I’ve recreated a table of information that is found on some Chinese AliExpress pages and adding more detail and a better translation.

Feature Set3A Official Pandora’s Box 53A Official Pandora’s Box 6Clone Pandora’s Box 9
Game Quantity960 games1300 games + 3000 custom added1500 games
3D Game SupportNoYESNo
Game CustomizationNoCan add your own gamesNo
Screen Resolution1280×7201280×720
1024×768
640×480
1280×720
1024×768
640×480
Game Pause FuntionYES, during free playYES, during coin or free playYES, during free play
Game Sorting FunctionNoYESNo
Autofire FunctionNoYES, for games classified as shooting games.No

Hopefully, this will help anyone looking to decide on which Pandora’s Box to pick up.

Pandora’s Box 6 – (Unverified) Workaround for PlayStation Crashes

We’ve previously noted here on the blog that there were several PlayStation games that didn’t function properly and would crash when run through the Pandora’s Box 6. At the time, I didn’t think too much of it but I kept a log of where crashes seemed to be occuring. It looks like someone else – whose name I’ve forgotten – has figured out the issue as well as a workaround.

Rumble in the Jungle

Looking at the list of games that crashed consistently (linked above), someone appears to have noticed a pattern. It seems like the crashes are apparently caused by games using the controller rumble support. When we look at the list, we see a crash caused by the first jump in Tony Hawk’s Pro Skater 2, a crash caused by hitting the first jump in Hydro Thunder… these are both instances where you would expect a rumble in the controller to happen. But because the Pandora’s Box does not support controller rumble whatsoever, it appears to just crash the emulator entirely when a rumble is triggered.

So it looks like the real solution is to enter the game’s settings/options screens and disabling rumble support. Once rumble has been disabled, games no longer crash according to some people in the community. Unfortunately, disabling rumble usually doesn’t get saved so players will have to remember to kill rumble each time they play.

I’m going to be going back to the games in my compatibility list to see if disabling rumble gets them to stop crashing. Once I’ve verified that this fix is legitimate, I’ll go back to my compatibility pages and update the list with my findings.

Pandora’s Box 9 – Diving Into The Game List

I contacted a seller for the Pandora’s Box 9 clone and requested the game list. We’re going to take a look through it and compare it to the Pandora’s Box 5 and 6 official boxes. We’ll then see if there are any conclusions to draw from the comparison afterwards.

The Game Lists

Here are the 3 PDF game lists for you to download and take a look at for yourself. Let me know if I missed anything interesting or got something wrong.

We Have To Go Deeper…

Probably the first thing we should do is compare the Pandora’s Box 9’s game list against the version it appears to be imitating the most, the Pandora’s Box 6. Here’s a partial comparison (first 700 or so games) of the games from my quick look through.

Games Newly Added To Pandora’s Box 9 
  • Star River Guard
  • Super Marvel Heroes
  • Sprint 2
  • American Wrestling Federation
  • Runark
  • Mat Mania
  • Ohgon No Siro
  • Success Joe
  • Warriors Armored
  • Super Muscle Bomber: International Blowout
  • Muscle Bomber Duo: Ultimate Team Battle
  • Punch-Out!!
  • Tough Turf
  • Main Event
  • Super Mouse
  • Syusse Oozumou
  • Jungle Hunt
  • Mole Attack
  • Zwackery
  • Big KinKong 3 (likely Donkey Kong 3?)
  • Kangaroo
  • Intrepid
  • Spelunker
  • Hcastlee
  • Driving Force
  • Fast Freddie
  • Fly-Boy
  • Logger
  • The Amazing Adventures of Mr. F. Lea
  • Kung-Fu Taikun
  • Dream Shopper
  • Mariner
  • Marine Boy
  • Cook Race
  • Liberator
  • Taxi Driver
  • Strength & Skill
  • Karnov
  • Time Limit
  • Space Chaser
  • Mouser
  • Lasso
  • Discs of Tron
  • Megadon
  • Marvin’s Maze
  • Pitfall II
  • Monte Carlo
  • Xybots
  • Legend of Makai
  • Victory Road
  • Normandy Landing
  • D-Day
  • Pandora’s Palace
  • City Connection
  • Kero Kero Keroppi No Issyoni Asobou
  • Crash
  • Targ
  • Skull & Crossbones
  • Wonder Boy 4TH Warrior
  • Kamikaze Cabbie
  • Mister Viking
  • Sega Ninja
  • Crystal Castles (likely joystick hack)
  • Guzzler
  • Talbot
  • Freeze
  • Sindbad Mystery
  • Naughty Ghost
  • Springer
  • Jack Rabbit
  • Hunchback
  • Gold Bug
  • Rastan
  • Nastar
  • Magic Worm
  • Jungler88
  • Mr. Goemon
  • Leprechaun
  • Youjyuden
  • Hero
  • Megatack
  • City Bomber
  • Combat Hawk
  • Navarone
  • Cutie Q
  • Catacomb
  • Streets of Rage II
  • Pac-Land
  • Scorpion
  • Saint Dragon
  • Turtle Ship
  • Dragon Buster
  • Golden Axe II
  • Super Locomotive
  • The Pit
  • Combat Patriots
  • Captain America (likely Captain America and the Avengers)
  • Urban Elite
  • Demon
  • Future Spy
  • Pure Green Corps
  • Gaoshan warriors
  • Side Track
  • Trio
  • Hunter

Games From Pandora’s Box 6 Missing On Pandora’s Box 9
  • Kaiser Knuckle
  • Survival Arts
  • Dragon Master
  • Time Killers
  • Blazing Tornado
  • Schmeiser Robo
  • Top Ranking Stars
  • Shogun Warriors
  • Knuckle Bash 2
  • Alligator Hunt
  • Ultra Toukon Densetsu
  • Dyna Gear
  • Action Hollywood
  • Blood Storm
  • Night Slashers
  • zunzunkyou No Yabou
  • Sonic The Hedgehog 1
  • Sonic The Hedgehog 2
  • Judge Dread
  • Elevator Action Returns
  • Arabian Magic
  • Light Bringer
  • Dark Seal2
  • G.I. Joe
  • Steel Force
  • D-Con
  • SD Gundam Psycho Salamander
  • Ikari III – The Rescue
  • Kero Kero
  • Teenage Mutant Hero Turtles (Teenage Mutant Ninja Turtles)
  • Commando
  • Devastators
  • Blasto
  • Ironclad
  • Sexy Parodius
  • Super Spacefortress Macross II
  • Gokujyou Paroudius
  • 4-D Warriors
  • Bio-Hazard Battle
  • Hyper Duel
  • Darius Gaiden-Silver Hawk
  • Koutetsu Yousai Strahl
  • Spectrum 2000
  • Cobra-Command
  • Ufo Robo Danger
  • Cosmic Cop
  • G-Loc Air Battle
  • Xexex
  • Vasara2
  • Vasara
  • Change Air Blade
  • Ultra X Weapons
  • Twin Cobra II
  • Cyvern
  • Sengeki Striker
  • Gekirindan
  • Gunlock
  • Lightning Fighters
  • U.N. Defense Force: Earth Joker
  • R-Shark
  • Silver Millennium
  • Varia Metal
  • Final Star Force
  • Gun & Frontier
  • Super Space Invaders ’91
  • Star Fighter
  • Lethal Thunder
  • The Last Day
  • Twin Hawk
  • Sand Scorpion
  • Ashura Blaster

While looking at the list of gamelist files, I made a little diiscovery: Almost every single one of the games that were in the Pandora’s Box 6 but somehow didn’t make it onto the Pandora’s Box 9 are almost entirely games that were newly added to Pandora’s Box 5. If you open up the Pandora’s Box 5 game list, you’ll see the games that were newly added from the 4S+ are marked in Green and they are almost all the same as those missing on the Pandora’s Box 9.

Another set of games that are missing from the Pandora’s Box 6 are the “3D Games” that are included. These games are all actually PlayStation 1 versions likely running under PCSX ReARMed. I believe they boot directly into the character selection screen, likely with the use of loading a save state along with the game when launching. And those games are…

3D Games From Pandora’s Box 6 Missing on Pandora’s Box 9
  • Tekken
  • Tekken 2
  • Tekken 3
  • Street Fighter EX Plus
  • Street Fighter EX2 Plus
  • Mortal Kombat
  • Mortal Kombat 2
  • Mortal Kombat 3 Trilogy
  • Mortal Kombat 4

Conclusion

It looks like this Pandora’s Box 9 is actually a Pandora’s Box 4S+ with additional games added to it and using the hardware cloning of the Pandora’s Box 6, as it seems like all the games that were added to Pandora’s Box 5 were missing. It’s hard to say what’s really going on without having the box here with me yet, but I would hope that the hardware inside is at least a decent quad core processor matching the Pandora’s Box 5. We’ll have to see when the first videos pop up on YouTube to be sure, I guess.