We have an open-source project called RetroArch. It has a development interface called libretro that allows for the easy creation of emulators and games that can plug straight into this program called RetroArch. This development interface is open to others so that they can run these pluggable emulator and game cores also in their own programs or devices. You can find this project on Github. (github.com/libretro). We also have a website – http://www.libretro.com. We started this project in late 2010 and we have been steadily increasing in popularity. We are on over 15 different hardware platforms right now that you can run RetroArch on, including Android (which this Retron5 device is based on).
These open-source programs are covered under certain licenses. Several of the emulators are covered under non-commercial licenses, which means they cannot be sold or profited from.
We have discovered that Retron5 is in violation of the licenses of several projects:
Genesis Plus GX
1. It uses the open-source emulator ‘Genesis Plus GX’ by author Eke-Eke for its Sega Genesis/Mega Drive module (https://github.com/ekeeke/Genesis-Plus-GX). This core has been licensed under a non-commercial license. It can therefore not be sold as, or part of, a commercial product.
Proof is in the accompanied screenshots at the bottom of this post. None of the authors were contacted about their code’s use in the Retron5 hardware.
More evidence: (1, 2, 3, 4, 5, 6)
SNES9x Next
2. It uses the open-source emulator ‘SNES9x Next’, which is itself a derivative of SNES9x (https://github.com/libretro/snes9x-next). I (Squarepusher) personally made this version of SNES9x. It has a few differences compared to normal SNES9x. It has SuperFX overclocking code and it has certain game speed hacks that make games run faster on slower hardware. This comes at the expense of some graphics inaccuracies though.
We could tell it was the SNES9x Next core because the exact same strings for variables to do with the speed hacks and the SuperFX overclock code popped up in their SNES core.
SNES9x is licensed under a non-commercial license. Like Genesis Plus GX, it can therefore not be a part of a commercial product.
What also bears pointing out is that SNES9x Next has never been released in any other version than the libretro version. Libretro is the development interface of RetroArch if you remember. We will return to this later on.
Proof is in the accompanied screenshots (see below). None of the authors were contacted.
More evidence (1, 2, 3, 4, 5, 6).
FCEUmm
3. It uses the open-source emulator ‘FCEUmm’ for its NES module, which is itself a derivative of FCE Ultra. FCEUmm is licensed under the GPLv2. Technically they would have been allowed to sell this IF they had made sure their frontend was compatible with GPLv2. Unfortunately, this turns out not to be the case as we’ll find later on – since they are using GPLv3 code inside their frontend as well which is technically incompatible with this license.
Proof of it being FCEUmm is in the accompanied screenshots (see below).
More evidence (1, 2, 3, 4, 5, 6)
VBA Next
4. It uses the open-source emulator ‘VBA Next’ for its GBA module. VBA Next is a derivative of another emulator called VBA-M. I (Squarepusher) made this version specifically and I could recognize it was this version because of the fact that I have built-in a game database into this emulator. The game ID strings that are used to identify the ROMs appeared in Retron’s GBA module as well. As for the rest of the code, it is undoubtedly VBA. The screenshots showing the code flow of operation will illustrate this clearest.
VBA Next is licensed under the GPLv2. None of the authors were contacted. Proof is in the accompanied screenshots (see below).
More evidence (1, 2, 3, 4, 5, 6)
RetroArch
5. We found obvious bits of RetroArch’s sourcecode inside their frontend. Now the reason we could identify these snippets is because it is inlined Assembly code that is hard to obfuscate. The relevant parts are the ARM NEON-optimized sinc resampler code and the audio integer to float conversion routines. If you want photographic evidence, I refer you to the second link I posted below.
All of the other C code of RetroArch seems to have been obfuscated so it will take us some more time to identify these parts. What is evidently clear though is that they are already in violation of the GPL license that we covered this RetroArch code under. GPL version 3 specifically forbids TIVO-ization. Let me explain later what TIVO-ization is. It basically means that you use opensource software to make a locked-down hardware device that doesn’t allow you the freedoms that the GPL generally provides to users and developers alike.
Since they have used our libretro cores evidently and since the only way to actually use these cores is through a libretro frontend implementation, and since actual RetroArch code has already been identified in their frontend, this raises serious questions as to how much of their frontend constitutes ‘original work’ and how much of it is just RetroArch. Either way, they are in the wrong for several reasons here:
– They should have also made these publicly available for every user to download since that is part of the rules and stipulations of using GPL code.
– They made a locked-down crippled hardware device based on open-source software. You void your warranty if you attempt to modify the copyleft-licensed software on this product and furthermore it doesn’t even allow you to do this. It is not possible to run the original, non-crippled RetroArch frontend on this device, only the crippled one provided by HyperKin. It also uses encryption as a means to obfuscate and hide the originating source of this software. This is TIVO-ization and the GPL version 3 was specifically made to prevent this.
What is TIVO-ization?
http://en.wikipedia.org/wiki/Tivoization
Tivoization /ˈtiːvoʊɨˌzeɪʃən/ is the creation of a system that incorporates software under the terms of a copyleft software license (like the GPL), but uses hardware restrictions to prevent users from running modified versions of the software on that hardware. Richard Stallman coined the term in reference to TiVo’s use of GNU GPL licensed software on the TiVo brand digital video recorders (DVR), which actively blocks users from running modified software on its hardware by design.[1][2] Stallman believes this practice denies users some of the freedom that the GNU General Public License (GNU GPL) was designed to protect.[3]
The GPL version 3 was specifically made because GPL version 2 did not provide enough safeguards against abuse like in the case of the TIVo digital video recorders. They would take from open source, not credit anybody and not give anything back either – and even create a closed platform around it where they would set themselves up as owners of the software (and in effect the hardware).
GPLv3 forbids you from building a gated community around open-source software like this and giving nothing back in return. The fact that they have used RetroArch’s GPL version 3-licensed audio resampler code in a product that is running a locked-down, encryption-crippled version of Android is already bad enough. That they don’t even provide to users the ability to run content on this device without any restrictions is another serious concern.
Anyway, as it stands right now in its current state the product is using parts of our software illegally. There were also some other things found that were legally questionable like a Microsoft-licensed Verdana font which is covered by a End-User License Agreement, so there are multiple license violations here at play.
More evidence of RetroArch appropriation (1, 2, 3, 4, 5, 6, 7).
Multiple license violations, multiple conflicting licenses, bad faith
The problems with this are many-fold, but for us it comes down to mixing non-commercial cores on this device with more permissively licensed cores, the infringement of the emulator authors’ rights, the lack of credit paid where credit is due, the lack of freedom in the hardware device (which restricts the user in what he/she can do and makes him/her reliant on Hyperkin to serve as the gateway keeper since he/she can’t uncripple this version of Android on their device without voiding their warranty and they can’t run the uncrippled RetroArch frontend on it either), and the multiple conflicting licenses. Also, the fact that changes / patches to the sourcecode have not been provided to customers of this device. These should have been made available on a public place free of charge.
Open-source is not a matter of doing with it as you please. The license is there for a reason and it needs to be followed, and it dictates how you should go about your business when deciding to make a commercial product out of such software. GPL is known as a ‘viral license’ which means that the community behind this uses the viral nature of the GPL as an effective strategy to ensure more and more software gets licensed under the GPL, since every bit of GPL code that gets incorporated into another project needs to be made GPL or GPL-compatible as well otherwise it’s a violation of the license. As it stands right now, the software for the Retron5 is very likely illegal to distribute.
Links:
1. http://imgur.com/a/T6W4e – This image gallery shows comparisons of the infringing derivative Retron code vs. the originals
2. https://www.anonimg.com/img/5d807718b069e5dae8a4e4320fdda1ab.png – This shows the RetroArch audio resampling and audio conversion routines in the Retron frontend
3. http://i.imgur.com/81bnckH.png – Another image of the audio resampling code. Originally from this tweet: https://twitter.com/FioraAeterna/status/512790355591196673
4. Regarding the MS Verdana font: http://www.microsoft.com/typography/fonts/font.aspx?FMID=1817 – “Verdana is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries.”
(EDIT: A section here about the ARM Mali drivers was removed since it appears to not be related to these issues)
(EDIT2 [9/20/2014]: Updated with more pics of evidence)
Matías Ferrero
September 20, 2014 — 3:32 am
Holy crap. I hope they are punished and also that RetroArch gets any type of compensation.
AndresSM
September 20, 2014 — 4:29 am
It’s not about any kind of compensation. Not even the credit. It’s about doing what is right… None of these guys are looking for profit or financial compensation whatsoever.
Sadly every scene seems to be filled with people looking to make a buck (or fame), the emu scene doing kickstarters, indies doing kickstarters, everyone is doing a freaking kickstarter. Everyone wants funding, financing, etc. ie: money.
Quite sad actually…
Anonymoose
September 20, 2014 — 7:50 pm
Could you at least C&D them so they can’t make any more shekels off of it?
undeadbobop
September 30, 2014 — 11:39 pm
Too bad the person who made this article claims to be a contributor to one of the projects with a GPLv3 licenses and super imposes additional restrictions attempting to say you need permission from the author to create a modification or distribution. That is actually a violation of GPLv3 under section 10, and by attempting to force people to ask for permission to make a distribution, and modification it creates a gated community. Most of this article is filled with ignorance of the licences which both allow commercial use.
The only thing they need to do is actually provide the source code here in this use.
AndresSM
October 1, 2014 — 12:04 am
Read both posts and then licenses again. Then come back. Otherwise you have a D- for effort
undeadbobop
October 1, 2014 — 4:12 pm
Read both licensees again then read what you are responding to or you get a D- for effort kid. Better yet section 10 of GPLv3.
AndresSM
October 1, 2014 — 4:51 pm
You can’t even come with your own original witty responses…
Where are they imposing restrictions? Cite please?
I’m gonna help you with your homework since it seems to be to difficult for you or you are confused:
First of all they have released SOME sources but not the frontend code. Regarding the frontend code, it’s licensed under GPLv3 which means they have to release it. BUT, they can’t even use it in their platform (locked-up platform)
“Protecting Your Right to Tinker
Tivoization is a dangerous attempt to curtail users’ freedom: the
right to modify your software will become meaningless if none of your
computers let you do it. GPLv3 stops tivoization by requiring the
distributor to provide you with whatever information or data is
necessary to install modified software on the device. This may be as
simple as a set of instructions, or it may include special data such
as cryptographic keys or information about how to bypass an integrity
check in the hardware. It will depend on how the hardware was
designed—but no matter what information you need, you must be
able to get it.
This requirement is limited in scope. Distributors are still allowed to
use cryptographic keys for any purpose, and they’ll only be required to
disclose a key if you need it to modify GPLed software on the device they
gave you. The GNU Project itself uses GnuPG to prove the integrity of all
the software on its FTP site, and measures like that are beneficial to
users. GPLv3 does not stop people from using cryptography; we wouldn’t
want it to. It only stops people from taking away the rights that the
license provides you—whether through patent law, technology, or any
other means.”
This is from http://www.gnu.org/licenses/quick-guide-gplv3.html
From the license itself:
“Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users’ freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.”
The Retroarch frontend code found in the Hyperkin app was under GPLv3, that is a violation and there are no know workarounds. Not even releasing the source code will get around this.
Now regarding the cores.
SNES9X and GenesisPlus-GX are under non-commercial licenses (not-gpl).
From the SNES9X license (included in the package they released when they were caught with their pants down):
“Snes9x is freeware for PERSONAL USE only. Commercial users should
seek permission of the copyright holders first. Commercial use includes,
but is not limited to, charging money for Snes9x or software derived from
Snes9x, including Snes9x or derivatives in commercial game bundles, and/or
using Snes9x as a promotion for your commercial product.”
From GenPlusGX:
“Redistributions may not be sold, nor may they be used in a commercial product or activity”
So yeah… yo don’t even get a D-
undeadbobop
October 2, 2014 — 1:39 am
“Where are they imposing restrictions? Cite please?”
Read the article kid. You get a F. The author is imposing that GPL’s MUST BE NON-comercial, and super imposing that they must ask permission to redistrobute a modified GPL software.
The hard ware does not prevent you from altering the software, and the Richard Stallmen didn’t not say they have to make it easy for you to do so, they don’t have to implement a system to enable you to do so just not disable along with that the software licences is independent than hardware use.
It is exactly like saying I can’t sell GPLv3 software because computers have bios that you can’t replace. Literally you are quoting the reasons not the licencees. The licencees doesn’t actually limit or restrict hardware usage.
Also libretro would be in violation not hyperkin, since libretro is made for devices that lock down software(android devices).
AndresSM
October 2, 2014 — 2:50 am
You’re an idiot. NOT ALL THE CORES ARE GPL
And it’s a locked down system that needs rooting to let you tinker with it. You’re still failing
undeadbobop
October 2, 2014 — 2:15 pm
It is clear you don’t actually read what you reply to. I never said all the cores are GPL. Actually by including them they apply additional restrictions. This is on RetroArch’s case of a violation, not hyperkins.
Android is a locked down oS that needs rooting to let you tinker with it. Thus your statement is literally self destructive. Also ROOTING IS TINKERING you dingus.
RetroArch by your own made up interpretation of the licencees violates your interpretation.
AndresSM
October 2, 2014 — 2:32 pm
You are wrong on so many levels… First was the BIOS now this. But well I’m bored of your dumb trolling already… So whatevs
Barney the Dinosaur
November 20, 2016 — 7:10 pm
Go back to your computer you virgin nerd loser!
AndresSM
October 2, 2014 — 3:05 pm
Retroarch doesn’t need the non-gpl cores to operate. Users are able to add or remove cores in any way they see fit.
The retron doesn’t work with the cores at all.
AndresSM
October 2, 2014 — 4:02 pm
By the way, there wan’t any citation, there is nothing saying that textually, you’re just interpreting separete stuff i a way it suits your dumb argument.
Vague Rant
September 20, 2014 — 4:37 pm
Obligatory IANAL.
My understanding of US laws surrounding fonts is that the letterforms themselves are not copyright-able. Creators can use a couple of methods to “protect” their fonts like trademarking a font’s name (e.g. “Verdana” above), which is easily circumvented by calling the font by a different name, patenting the letterforms (no idea whether this was done by Microsoft for Verdana) and then there’s a bit of kinda-edge-case stuff around the actual digital implementation of a font (e.g. a TrueType font file) where some of it can be claimed to be a form of software and thus copyrighted.
In most cases (barring patents, essentially), you–or in this case, Hyperkin–can probably get away with cloning a font as long as you’re not using its trademark name or literally ripping off the digital file (e.g. by instead creating your own digital reimplementation of the typeface’s letterforms or even easier, just pre-baking the font into images). Of course, whether Hyperkin actually did this is another question, and seems fairly unlikely given their wholesale ripping off of emulator cores. Still, it’s remotely plausible that they’re clean with regard to the use of “a font that happens to look exactly like Verdana but isn’t called that and differs under the hood”.
None of this is meant as a defense of Hyperkin’s practices here, just clearing up a way that they may have (but probably didn’t) skirt the legal issues in one particular instance.
ed jon
September 20, 2014 — 4:50 pm
I wish I could understand the images but i know zip about code. 🙁 I have a Retron 5 and i’d be willing to help for any files you may need if i can extract in any way that you would need the console for. I can root and and am an advanced android user kind of. I’m just not a dev. This is disappointing because even though I never thought they made there own emulators I would have hoped they went about getting the software the right way and I really like the console but i don’t like crap like this.
47iscool .
September 21, 2014 — 12:29 am
Pathetic. Too lazy to write their own emulator they go and steal others’ work for a profit.
Kind of reminds me of Mystic using ScummVM in their games.
See here: https://en.wikipedia.org/wiki/ScummVM#Mistic.27s_GPL_violations
Jesse James
September 21, 2014 — 10:55 pm
If not already done, I think Retroarch developers and other copyright owners should contact http://gpl-violations.org/ to expose the misuse of GPL code in Hyperkin’s Retron.
Non-commercial licenses (like MAME one) are probably harder to defend since each author is pretty much on his own.
47iscool .
September 22, 2014 — 12:42 am
Agreed.
newisle
September 26, 2014 — 12:41 pm
Agreed, and the sooner the better!
undeadbobop
September 30, 2014 — 11:45 pm
http://www.gnu.org/copyleft/gpl.html
Read it.
In this usage it is actually legal as long as they provide the source code….
Literally that is the only violation here, they do not need anyone’s permission and they can use it commercially in this implementation.
The author of this article claims to be a contributor but is attempting to impose a additional restriction of claiming you need permission. You don’t, and actually imposing additional restrictions is a violation.
undeadbobop
September 30, 2014 — 11:42 pm
Its funny you say that…. Nintendo does the same….
Billy Bob
September 21, 2014 — 7:42 pm
RetroArch: zero US dollars.
Retron: 175 US dollars.
Complaining
about people violating the license of your software while using pirated
copies of IDA and BinDiff to prove it: priceless.
Squarepusher
September 21, 2014 — 8:31 pm
That’s an allegation/assumption that you would have to prove before it can even enter the realm of reality. Good luck with that son.
Billy Bob
September 21, 2014 — 8:37 pm
Please upload an IDB for libcore-gba.so.
Squarepusher
September 21, 2014 — 8:46 pm
It’s from somebody who wishes to remain anonymous.
But hey, we can do the same thing with objdump if you prefer if that makes you happy. Gives you one less thing to shift the blame with, huh? You should be ashamed of yourself.
Billy Bob
September 21, 2014 — 8:53 pm
I don’t argue the validity of the claim that Retron stole your code. Quite the opposite, the evidence is unquestionable.
Billy Bob
September 21, 2014 — 8:58 pm
Oops, hit submit early. Meant to also say: apologies, then, if the hypocrisy is not yours, but the creator of the dump has something to answer for.
Squarepusher
September 21, 2014 — 9:03 pm
There were several people (unconnected to us) who alerted us to these findings and produced the evidence, and they did so anonymously. Hence why you see BinDiff in some pics and IDA used in another.
Regarding that one screenshot with VBA Next, we will reproduce the same evidence with objdump, Hopper or some other freeware alternative just to get this resolved. Until then we’ll pull the pic.
Nicholas Perry
September 22, 2014 — 10:57 pm
I think it would be wise to also save screenshots and a local copy of their update pages for the system. In case they argue they aren’t distributing commercially since it’s not included with the unit. BUT you HAVE to have purchased a unit in order to generate an UpdateRequest.DAT in order to make the system functional at all.
http://retron5.in/node/2
hikaricore
September 23, 2014 — 6:52 pm
It appears Hyperkin has released some source code: http://retron5.in/node/9
Doesn’t resolve everything, but it’s a start.
Squarepusher
September 23, 2014 — 11:08 pm
It doesn’t have the frontend code (shown above where the RetroArch code was found in).
That is licensed under GPL version 3, so that means that the entire frontend is therefore covered under that license. Therefore, they need to give the entire sourcecode to the frontend.
Also, GPLv3 forbids TIVOization. So, nothing less than complete de-TIVOization will do. Only then will we back down and be satisfied.
jfudge
September 26, 2014 — 6:30 am
http://retron5.in/node/9
Have you looked through this package?
Andrew Vrba
September 27, 2014 — 8:53 pm
So what can be done about this? Aside from spreading the word, I mean.
undeadbobop
September 30, 2014 — 11:27 pm
GPLv2, and v3 allows commercial use….You do not need to ask permission for any GPL’s….
You attempting to super impose this restriction this as a contributor actually is a violation…
The only thing they need to do is provide a means of aquireing the source code.
Also it isn’t open source software… it is free software… GPLv3 was not made to super impose restrictions like you are now. It was to limit restrictions and prevent others from locking down it.
AndresSM
September 30, 2014 — 11:30 pm
You are late to the party and misinformed.
Read about tivo-ization in GPL v3 and read the genplusgx and snes9x licenses
undeadbobop
October 1, 2014 — 3:57 pm
No you are misinformed. Read the damn GPL licencees and stop playing dumb. Kid;. There is no restriction on sharing, modifying, and redistrobution. They do not need the orginal authors permission, they can be commercial and non-commercial.
dimensio
October 1, 2014 — 5:57 pm
The issue is not the use of GPL-licensed code without permission. The issue is the use of GPL-licensed code without credit and source release (as is required by the license) and on a device where the GPLv3-ed compiled code cannot be altered by the end-user.
If the sources released by Hyperkin are identical to the sources used in compiling the binaries on the Retron 5, then the first issue is resolved. The second issue, however, is not resolved so long as user modification of the onboard software voids the system warranty.
A third issue is the use of open-source software whose open-source license forbids commercial use, as is the case with Snes9x and Genesis Plus GX. This issue cannot be resolved without some agreement from the copyright holders of the affected software.
undeadbobop
October 2, 2014 — 1:56 am
Its funny because it is easy to modify the onboard software. But so far every whiteknight has jumped on me saying you can’t do it when you can…
I’m not even talking about the clear violations, that isn’t where the misinformation is at. It is in the GPL licenceesed software. There is so many whiteknights of this article though. So far you are the only one that has responded to me in a non-stupid way.
The spread of misinformation of the topic matter is the issue I have here. Litterally everything in this article about GPL is way way way off.
The licencees still have the credits in it along with the code. You do not need to give credit….
AndresSM
October 2, 2014 — 2:56 am
Repeat with me:
Not all the cores bundled are GPL
Not all the cores bundled are GPL
Not all the cores bundled are GPL
Adam Higerd
April 1, 2016 — 2:56 am
I think you’re trying to drill the wrong point in. Just saying that the cores aren’t GPL doesn’t actually address the issue — in fact, on the surface such a statement actually makes it worse because it APPEARS to be the case that you’re willfully and knowingly combining software with incompatible licenses (even GPLv2 and GPLv3 are incompatible with each other, never mind the “noncommercial use” clauses).
The thing that actually makes RetroArch itself not in violation is the fact that it doesn’t actually LINK to the cores except at runtime.
The cores are, in a sense, application software running on top of the RetroArch platform, using the libretro API, both of which bear a BSD-like license. This is the same reason you can use open-source plugins in closed-source software — the host software has no dependencies on the plugin at all. You can take a core out and RetroArch still works.
If someone were to somehow make a static build of RetroArch with the cores compiled in, THEN there would be a problem. But as it stands, the only time the parts with differing licenses are linked together is at runtime, and you can’t really distribute that.
Denilson Sá
January 6, 2015 — 4:52 pm
How about this one? http://www.tecmundo.com.br/video-game-e-jogos/70903-conheca-infanto-console-brasileiro-obra-pirataria-6-mil-jogos.htm
A “console” that is essentially a Raspberry Pie running RetroPie, which in turn uses RetroArch/libretro.
Luis Anton Imperial
June 18, 2016 — 4:13 am
Although I have no idea what the evidence mean, I believe this. Because what were Hyperkin gonna use, I thought.