Skip to content

Extracting OutRun Music From the Switch & 3DS

Jump to bottom
reassembler edited this page May 18, 2021 · 2 revisions

Background

Both the Nintendo Switch and 3DS versions of OutRun contain new music tracks that can be played in Cannonball. The developer, M2, respectably elected to compose the new music in Sega's Music Markup Language (MML) format. This format is fully compatible with the original arcade hardware, and therefore Cannonball. This is a lovely gesture, when it would have been far easier to simply stream the music from an audio file.

As a side note, if you're interested in the Sega MML format, you will appreciate my MML Reassembler Toolkit. This enables you to decompile the binary music (from either the arcade machine, 3DS or Switch) into notation format, edit the notation, and recompile again.

The 3DS version included the following two new tracks:

  • Camino A Mi Amor
  • Cruising Line

The Switch version also included these two tracks, but added:

  • Radiation (composed by Hiro himself)
  • Step On Beat (An enhanced version based on the OutRun Megadrive music)
  • Step On Beat (The Megadrive version, inaccessible from the game but possibly an Easter Egg?)

The Switch version also included some streaming audio that does not make use of the original hardware:

  • Midnight Highway
  • OutRun Megamix

Extracting Audio From Switch

Unfortunately, this is not an easy task. There's no way I can automate this legally as it requires you to provide your original Nintendo Switch decryption keys. Nor is this intended to be a full tutorial, as it's quite a complicated process, and I'd recommend reading further documentation for the tooling involved.

  • There are two versions of OutRun for the Switch. Let's call them v1.0 and v1.1.
  • There are two distribution formats. One is NSP format (from the Nintendo E-Store). The second is XCI format (a game card image).

1/ Both formats are encrypted. You will need a copy of your original Nintendo Switch security keys to decrypt the binary distribution file. I used hactool for this. This will decrypt the main NSO (Nintendo Switch Executable) and romfs (containing scripts and streaming music in M4A format).

2/ To extract the contents of romfs, I used nstool. You now have the M4A streaming music, which can be manually converted to a WAV in an audio editor and used in CannonBall if desired.

3/ The main executable is compressed exefs/main. I used nsnsotool to decompress it. This contains the binary music data, maybe the most exciting part.

Once the main executable is uncompressed the new music can be found at the following offsets:

Switch Version 1.0

  • 0x78030e Cruising Line
  • 0x78730e Camino A Mi Amor (Version 1)
  • 0x78e30e Step On Beat (Arcade Version)
  • 0x79530e Radiation
  • 0x79c30e Camino A Mi Amor (Version 2)
  • 0x7a330e Step On Beat (Megadrive Version)

Switch Version 1.1

  • 0x77f807 Cruising Line
  • 0x786807 Camino A Mi Amor (Version 1)
  • 0x78d807 Step On Beat (Arcade Version)
  • 0x794807 Radiation
  • 0x79b807 Camino A Mi Amor (Version 2)
  • 0x7a2807 Step On Beat (Megadrive Version)

Each piece of audio data starts with the byte sequence B9 84 if you want to sanity check you're at the right offset before extracting.

To help ensure you have extracted the data correctly, I've provided the CRC32 values of the files below. You can use these to verify your data is identical to mine:

  • Cruising Line: 24,369 bytes [CRC32: 70C83B74]
  • Camino A Mi Amor (Version 1): 22,488 bytes [CRC32: 0056B27D]
  • Step On Beat (Arcade Version): 14,480 bytes [CRC32: 93BBCDAC]
  • Radiation: 28,274 bytes [CRC32: 1BAB7DDA]
  • Camino A Mi Amor (Version 2): 22,488 bytes [CRC32: C07D2D50]
  • Step On Beat (Megadrive Version): 10,503 bytes [CRC32: 7DB6F98E]

Essentially you want to extract each track to a separate binary. Each binary should be no larger than 32K. The music data binaries you've created can be added to Cannonball via the config.xml file. Each file should have a ".bin" extension, to ensure Cannonball assumes it's in compiled MML format.

Extracting Audio From 3DS

You will need to extract and decrypt the exefs binary from the 3DS game. Once successfully decrypted, the music tracks can be found at the following offsets:

  • 0x37bd60 Cruising Line: 24,369 bytes [CRC32: 70C83B74]
  • 0x382d60 Camino A Mi Amor: 22,488 bytes [CRC32: 0056B27D]
Clone this wiki locally