Exhibit D

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 1 of 19 Pg ID 385
UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF MICHIGAN

SOUTHERN DIVISION

BIG GUY’S PINBALL, LLC

Case No. 2:14-CV-14185-VAR-RSW

Plaintiff, 

Honorable VICTORIA A. ROBERTS

v. U.S. District Judge, Presiding

JIMMY LIPHAM, Honorable R. STEVEN WHALEN

U.S. Magistrate Judge, Referral 

Defendant. 

_____________________________________________________________________________/ 

ROBERT A. FARR, PLLC WILLIAMS HUGHES, PLLC

Robert A. Farr (P61597) Eric C. Grimm (P58990) 

Attorney for Plaintiff Attorney for Defendant 

1050 Shiawassee Circle 120 West Apple Avenue, P.O. Box 599

Howell, Michigan 48843 Muskegon, Michigan 49443-0599

(248) 703-0662 (231) 728-1111 

rfarr@rfarrlaw.com ecgrimm@williamshugheslaw.com 

_____________________________________________________________________________/

AFFIDAVIT OF DONALD WEINGARDEN

STATE OF MICHIGAN )

) S.S.

OAKLAND COUNTY ) 

Don Weingarden, being first duly sworn, states under oath the following: 

1. I am an adult resident of Michigan and have personal knowledge of the following facts stated

under oath. I am competent to testify and, if called to do so, would testify as summarized herein. 

BACKGROUND FACTS

2. I am a co-creator of software titled Nucore, which was developed in collaboration with two

other co-creators: Charles Hess and Steven Ellenoff. 

3. Messrs. Hess, Ellenoff and I transferred all of our individual copyright interests in Nucore

1

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 2 of 19 Pg ID 386
to Big Guy’s Pinball, LLC (“BPG”). BGP is a Michigan-based limited liability company with three

members. Messrs. Hess, Ellenoff and I formed BGP on September 19, 2007 to distribute Nucore

for sale in the public marketplace. We are each equal 1/3-members of BGP. 

FACTS DESCRIBING NUCORE & BGP’s BUSINESS MODEL

4. Nucore is software which enables presently standardized and commonplace personal

computer hardware to emulate the functions of obsolete, no longer manufactured computer hardware

components originally utilized byWilliams Electronic Games, Inc. within its “Pinball 2000" pinball

machines (“WP2K”). WPB2K pinballmachines are hybrids:theycombine video graphics (projected

downward onto the partially-reflective glass cover of the play field) with traditional all-mechanical

play fields where the steel pinball interacts with bumpers, gates, ramps, flippers and other devices. 

Nucore and its related hardware restore and improve function to the original WP2K pinball machines

which otherwise become unusable and valueless when the obsolete components of the now 15-yearold machines inevitably fail. 

5. Nucore was first made available for sale to the public on March 17, 2009. It was marketed

and made available on optical compact disks (“CD’s”, which must be physically shipped to a

purchaser), or as a digital “ISO-file” for remote download via the internet from BGP’s website at

“www.bigguyspinball.com”. ISO-files are digital versions of the same software code files stored on

an optical CD. ISO-files enable software to be transferred electronically rather than requiring that

a CD containing the software be physically shipped to the end user. Downloaded ISO-files can then

be stored by the user on an optical CD, or can be stored and operated directly on the user’s computer

using widely available software which emulates the function of physical CD-drive hardware. 

6. BGP’swebsite (www.bigguyspinball.com) is registered in Michigan. Exhibit A. The Nucore

2

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 3 of 19 Pg ID 387
ISO-files are downloadable from BGP’s website. BGP also operates a tournament server located

in Michigan which allows Nucore/WPB2K players to store and record their pinball scores, and view

other Nucore/WPB2K players’ high scores, via their internet connections. 

7. The Nucore software itself can be downloaded as an ISO-file without charge, but is protected

against unauthorized use by hardware security keys (within the Nucore software code) which

searches for and detects the proper related hardware and stops Nucore from function if that hardware

is absent. Sales are handled in this way as BGP’s mechanism for protecting against software theft,

to discourage copyright infringement, and for ongoing technical support for legitimate purchasers

of Nucore and the related hardware. Those purchasers with authorized hardware compatible with

Nucore’s security keys may download Nucore as often as necessary- for instance, as a backup to any

computer crashes requiring Nucore to be reinstalled, and to be assured they are using the latest

upgrades to Nucore as those become available. 

FACTS RELATED TO THE INFRINGEMENT OF NUCORE

8. BGP’s website features an access log which records information about the remote users

accessing the server via the internet. The BGP access log records the date, time, and IP address of

the remote user. 

9. On July 6, 2013 at approximately 10:13 p.m., the BGP server activity log recorded a

download of the Nucore ISO-files by a remote user using the IP address “98.251.52.68" assigned to

him by his internet service provider. 

10. On August 1, 2013, a member (identified by the pseudonym “MasterGeek”) of the publicly

accessible internet pinball enthusiast forum “Pinside.com” posted the following message notifying

other members that - 

3

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 4 of 19 Pg ID 388
[w]e are pleased to announce a Nucore alternative - for free nonetheless. Pinbox [the

name given to the forgoing “Nucore alternative”] builds off of emulation technology

to provide an easy replacement option for Pinball 2000 hardware. *** Feel free to

head on over and check out our website and download and try the software for

yourself! [link provided to www.PlayPinBox.com]

Exhibit Bto this affidavit. The link to the web site www.PlayPinBox.com contained a downloadable

ISO-file with the “Pinbox” software. 

11. On August 2, 2013, I downloaded the Pinbox ISO-file from Playpinbox.com to

investigate. The directory structures and filenames were the same as Nucore except the main

executable "Nucore" was renamed to "Pinbox". When I performed a side by side comparison of the

binary files named Nucore and Pinbox, they were very few differences. 

When the differences were text, "Nucore"was changed to "Pinbox". Anytext relating to BGP

was changed to Pinbox gaming. When the differences were binary, the program was modified to

eliminate the hardware security key. The screen images with the Nucore logo were changed to say

Pinbox. In the Linux directory etc/rc4.d the Nucore startup file named "S99_exec_nucore" was left

behind without being renamed, further proving that Pinbox was reallyNucore in disguise. Finally,

the text for the credits screen was modified: all names were removed except for Mastergeek and

Steve Ellenoff (the removed credits left a large hole which could not be reduced so it was filled it

with blank spaces). 

In addition to the forgoing, I searched the Pinbox directories and located the “bash history”

file created there when the user downloaded and created this ISO-file. One of the user’s keystroke

commands, preserved in a portion of the ISO-file which became “Pinbox”, was:

“ wget http://www.bigguyspinball.com/ISO/nucore_install.iso ” 

12. Two characteristics of the Pinbox creator’s keyboard command are important, as is a third

4

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 5 of 19 Pg ID 389
undeniable fact - 

(a) First, the “wget” prefix of that command is a file transfer command which is not

routine during a normal visit to a web site like www.bigguyspinball.com through

normal searches and links. In a routine web site visit a “get” command

(automatically generated by the user’s web browsing software) works behind the

scenes (with existing authorizations established by the web site’s creators) to

download the portions of a web site intended to be publically visible such as images,

graphics, text, clickable links to other sites, and files (and portions thereof) intended

to be accessible and downloadable by the site’s operators. In contrast, “wget”

(specifically, the “w” portion of that command prefix) is a command which must be

manually typed by a user. It is purposefully utilized by a user who knows specifically

what he is looking for as a means to narrowly focus where that search command is

directed to look, and which specific ISO-file it is directed retrieve from that location. 

A “wget” command does not require the use of web browsing software. 

(b) Second, everything following the “wget” prefix of that command reflects the user’s

intentional targeting of the Nucore installation ISO-file. Everything that follows the

“wget” prefix exists in only one place: BGP’s server, located in Michigan. 

(c) Third this "wget" command was recorded in the bash history while the

nucore_install.iso was downloaded. The bash history eventually became part of the

Pinbox ISO files which were released “www.PlayPinBox.com”. The user who

entered this "wget" command failed to find and erase this record from the hidden

bash history created at the time he downloaded the Nucore ISO-files from BGP’s

5

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 6 of 19 Pg ID 390
s e r v e r . T h u s , t h e p r e s e n c e o f t h e " w g e t

http://www.bigguyspinball.com/ISO/nucore_install.iso " command within Pinbox is

the fingerprint proving that Pinbox is really Nucore. 

13. Having discovered within Pinbox the presence of the “wget” command associated with the

Nucore installation ISO-file, I then examined the BGP server activity log to see when “wget”

commands may have been recorded, and from where they originated. There were only five instances

of the “wget” command recorded by the BGP server activity log: 

(a) First - 98.251.52.68 - - [06/Jul/2013:22:13:00 -0400] "GET /nucore_install.iso

HTTP/1.1" 404 640 www.bigguyspinball.com "-" "Wget/1.13.4 (linuxgnu)" "-"

The first portion of the log entry quoted above (“98.251.52.68") is the downloading user’s internet

protocol (“IP”) address, assigned to him by his internet service provider. The second portion of that

log entry, appearing in brackets (“[06/Jul/2013:22:13:00 -0400]”), is the date and time stamp of the

downloading user’s visit to BGP’s site. The third portion of that log entry beginning with the GET

command (“GET /nucore_install.iso HTTP/1.1" 404 640 www.bigguyspinball.com ") is the routine

and expected record of a visitor’s presence on the BGP web site. However, the fourth portion of that

log entry beginning with the Wget command ("Wget/1.13.4 (linux-gnu)") (bold emphasis added)

is the manual search command, purposefully entered by the downloading user, searching for and

directing that a particular “1.13.4” file to be downloaded. More important is that there were no other

uses of the “wget” command recorded by the BGP server activity log between July 1, 2013 and

August 1, 2013 other than this one from IP 98.251.52.68, and the four others in that period

summarized below (also from IP 98.251.52.68). Also important is that this user, operating from IP

6

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 7 of 19 Pg ID 391
98.251.52.68, is actively targeting the same “Nucore_install.iso” directory which was recorded in

the bash file later released as Pinbox (paragraph 11, above). 

(b) Second - 98.251.52.68 – [06/Jul/2013:22:13:27 -0400] "GET 

/ISO/nucore_install.iso HTTP/1.1" 200 19744768

www.bigguyspinball.com "-" "Wget/1.13.4 (linux-gnu)" "-"

This is a repeat of the first instance of the “wget” command (bold emphasis added), but at

10:13:27p.m., a few minutes following the first instance in paragraph 13(a), above. Again, the

significance is threefold: (1) whom is performing this purposeful “wget” operation (i.e., the user of

IP 98.251.52.68), (2) what is being accessed (i.e., the same “Nucore_install.iso” directorywhich was

recorded in the bash file later released as Pinbox (paragraph 11, above)), and (3) when this “wget”

operation was logged (i.e., during the period immediately before release of Pinbox, and when no

other “wget” commands were logged by the BGP server access log). 

(c) Third - 168.28.22.142 - - [06/Jun/2013:09:20:55 -0400] "GET /roms

HTTP/1.1" 200 448 www.bigguyspinball.com "-" "Wget/1.13.4

(linux-gnu)" "-"

This is a repeat of the first and second instances of the “wget” command (bold emphasis added).

Again, the significance is threefold: (1) whom is performing the “wget” command (i.e., IP

168.28.22.142), and (2) when this “wget” operation was logged (i.e., the period when no other

“wget” commands were logged, and in the lead up to the release of Pinbox), as in the first two

instances (paragraphs 13(a) and (b), above). However, his particular instance of the “wget”

command is significant two additional ways which differ from the first two instances. 

First, the IP address from which the request was made is different: IP 168.28.22.142. This

IP is registered to Board of Regents of the University System of Georgia. See Exhibit C to this

affidavit. Mr. Lipham is employed by Georgia Gwinnett College, which is a “unit of the University

7

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 8 of 19 Pg ID 392
System of Georgia.” See id. It appears from this information that Mr. Lipham may have searched

for and downloaded portions of the files needed for his actions from a computer at his workplace.

Second, in this instance the perpetrator is purposefully targeting ROM’s from a specific

directory within Nucore. “ROM” is an acronym for “read-onlymemory”. In the context of gaming,

ROMs are the digitally-stored images and sound that users see and hear when playing a game. 

ROMs are what make the Williams Pinball 2000 game “Star Wars - Episode I” look and sound like

the movie “Star Wars - Episode I” - they are, quite literally, the “Star Wars - Episode I” movie and

music presented in a pinball medium. Those image and music ROMs were licensed by the creators

of the Star Wars films to Williams Electronic Games, Inc. for use in WPB2K pinball machines, who

in turn licensed those ROMs to Plaintiff BGP for use in Nucore. Those specific ROM files within

Nucore also contained sound library ROMs unique to Nucore, as well as additional files necessary

to the integration of WPB2K and Nucore. Use of the “wget” command demonstrates that this user

was specifically targeting the ROM files within the Nucore ISO-files, without which Pinbox would

not be “a Nucore alternative *** [or a viable] replacement option for [Williams] Pinball 2000

hardware” as it was boasted to be. Exhibit A. 

(d) Fourth - 98.251.52.68 - - [07/Jul/2013:19:24:43 -0400] "GET

/ISO/nucore_install.iso HTTP/1.1" 200 19744768

www.bigguyspinball.com "-" "Wget/1.14 (linux-gnu)" "-"

This instance of the “wget” command occurs on July 7, 2013 at 7:24:43p.m. Significantly, it again

originates from IP 98.251.52.68 as in all previous instances. Like the first two instances the user is

targeting the same “Nucore_install.iso” directory which was recorded in the bash file later released

within Pinbox (paragraph 11, above)), and this “wget” operation was logged during the period

immediatelybefore release of Pinbox, and when no other “wget” commands were logged bythe BGP

8

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 9 of 19 Pg ID 393
server access log. How this instance differs, and what it demonstrates at a minimum, is that this

particular user’s searches are persistent and narrowlytargeted leading right up to the time that Pinbox

was released. 

Nucore is based on an older version of an operating system called LINUX than is currently

available in its most recent iteration. LINUX is not always “backward compatible” with older

versions. The perpetrator originally used the “wget” command to manually search for a

Nucore_install.iso file which was compatible with an intermediate version of LINUX (i.e., 

"Wget/1.13.4 (linux-gnu)" in the first three instances of “wget”-based commands). When that

search failed to produce a functioning Pinbox the perpetrator returned the next day and used the

“wget” command to manually search for a Nucore_install.iso file which was compatible with a

newer version of LINUX (i.e., "Wget/1.14 (linux-gnu)" in this instance). The difference is version

“1.13.4" (intermediate) and “1.14" (newer). He has yet to discover he is going the wrong direction,

but this use of the “wget” command demonstrates that this same perpetrator is diligent and

methodical in his repeated attempts over several days breathe life into Pinbox as a functioning, albeit

disguised, analog to Nucore. 

(e) Fifth - 98.251.52.68 - - [07/Jul/2013:20:32:26 -0400] "GET

/ISO/nucore_install.iso HTTP/1.0" 200 19744768

www.bigguyspinball.com "-" "Wget/1.12 (linux-gnu)" "-"

This instance of the “wget” command occurs on July 7, 2013 at 8:32:26p.m., just an hour later than

the fourth instance (paragraph 13(d), above) where he is searching for an effective version of LINUX

to use with the Nucore_install.iso file downloaded from BGP’s web site. This instance has the same

significant points as the fourth. It demonstrates that, having spent the last hour failing to get Nucore

9

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 10 of 19 Pg ID 394
to operate as Pinbox with newer “1.14" version of LINUX, he returns to BGP’s site and uses the

“wget” command to manually search the Nucore_install.iso directory for a file which instead be

compatible with an older version of LINUX (i.e., "Wget/1.12 (linux-gnu)" in this instance). The

difference this time is version “1.14" (newer) vs. version “1.12" (even older than the intermediate

“1.13.4" initially tried). This was ultimately a move in the right direction, again demonstrating that

this same perpetrator remained diligent and methodical, returning to BGP’s Michigan-based server

several times over several days to find the solutions, from within Nucore, needed to make Pinbox

function. 

14. There is a sixth instance of a visit to BGP’s website by the user operating from IP

98.251.52.68. Although it does not involve the use of the “wget” command, it remains significant

for other elements linking Pinbox to Nucore. On July 5, 2013 at 6:23:56 p.m., BGP’s server activity

log recorded the following activity - 

Sixth - 98.251.52.68 - - [05/Jul/2013:18:23:56 -0400] "GET

/release/nts.tar.gzHTTP/1.1" 404 640www.bigguyspinball.com"-"

"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4)

AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116

Safari/537.36" "-"

The significance of this record begins with the fact that (a) it is from the same user (i.e., IP

98.251.52.68), on (b) the day before the same perpetrator began his campaign of “wget” commands

to hack the Nucore ISO-files. Uniquely significant to this record is the bolded text: the file

“nts.tar.gz”. The acronym “nts” stands for Network Tournament Server. The BGP server included

a service where Nucore users could compete against each other in real time. When the distributor

of Pinbox announced its availability as “a Nucore alternative - for free nonetheless”, he also noted

10

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 11 of 19 Pg ID 395

Affidavit Exhibit A

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 13 of 19 Pg ID 397
Domain Name: bigguyspinball.com

Registry Domain ID: 

Registrar WHOIS Server: whois.1and1.com

Registrar URL: http://1and1.com

Updated Date: 2014-10-31T09:07:09Z

Creation Date: 2008-03-14T00:17:18Z

Registrar Registration Expiration Date: 2016-03-14T00:17:18Z

Registrar: 1&1 Internet AG

Registrar IANA ID: 83

Registrar Abuse Contact Email: abuse@1and1.com

Registrar Abuse Contact Phone: +1.8774612631

Reseller: 

Domain Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited

Registry Registrant ID: 

Registrant Name: Chuck Hess

Registrant Organization: 

Registrant Street: [Redacted - Robert Farr, Attorney for Plaintiffs]

Registrant City: [Redacted - Robert Farr, Attorney for Plaintiffs]

Registrant State/Province: MI

Registrant Postal Code: [Redacted - Robert Farr, Attorney for Plaintiffs]

Registrant Country: US

Registrant Phone: [Redacted - Robert Farr, Attorney for Plaintiffs]

Registrant Phone Ext: 

Registrant Fax: 

Registrant Fax Ext:

Registrant Email: [Redacted - Robert Farr, Attorney for Plaintiffs]

Registry Admin ID: 

Admin Name: Chuck Hess

Admin Organization: 

Admin Street: [Redacted - Robert Farr, Attorney for Plaintiffs]

Admin City: [Redacted - Robert Farr, Attorney for Plaintiffs]

Admin State/Province: MI

Admin Postal Code: [Redacted - Robert Farr, Attorney for Plaintiffs]

Admin Country: US

Admin Phone: [Redacted - Robert Farr, Attorney for Plaintiffs]

Admin Phone Ext: 

Admin Fax: 

Admin Fax Ext: 

Admin Email: [Redacted - Robert Farr, Attorney for Plaintiffs]

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 14 of 19 Pg ID 398
Affidavit Exhibit B

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 15 of 19 Pg ID 399
h 

rnc. 

,Jfl:m 

maT 

linked by 1'1a"""' S'"'-'"/ 

... .... 

··········· ...... ,,, .. ......... . 

• £ J. 

3 ............................ ............. . . ················ ·········· .. .. . 

Pinhead 

161 , 500 0 

........ 

QC 

14 

Mato 

Pinball master 

3,263 , '7 5 0 0 

1111 Pe1th 

l 2 «; 6ii 

mum mite 

Pinball addict 

1 ,50H , 400 1 

M Belmont, CA 

• lJ «- 18 . 

PanzerFreak 

Pinball addict 

4 

9!!il Macomb, 

....... 

· •·•·· · 

We are pleased to announce a Nucore alternative - for free nonetheless. Pl

technology to provide an easy replacement option for Pinball 2000 hardwar

replacing the Pinball 2000 computer entirely with a computer running our o

open source and based on Llnux with a broad compatibility spectrum for m

Features Include: streamlined easy Installation, working tournament server

configuration of the system, jukebox with network sharing options to scan 

to play, enhanced graphics rendering pipeline, support for both ArcadeVGA 

MORE. 

Feel free to head over and check out our website and download and try the 

,;4:: 71ink removed-

;k" - MG .. ·, ··+·;· · ¥ "L· · .. ..... ... . ............ ..... . ......... ......

f Post edited by roiJin : Unk re;noved, p.fNJSe don't ltnk to cop vright 

:; AGO I il.l.t I 

cheers, will have a look 

J AGO I .I!:. I.! I 

Very cool! 

3 NOimiS AGO I !t ll I 

This Is awesome. Its things like this that really show just how great and su

is. 

:/ /pinside.conijpinball/forum/topic/nucore-altemative-announced-1 

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 16 of 19 Pg ID 40
Affidavit Exhibit C

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 17 of 19 Pg ID 401
IP Address Country Region City ISP

168.28.22.142 United States Georgia Lawrenceville Board Of Regents Of The University

System Of Georgia

1000 University Center Lane, Lawrenceville, GA 30043 | 678.407.5000

A bachelor degree-granting unit of the University System of Georgia.

Ethics and Compliance Reporting Hotline

© 2015 Georgia Gwinnett College

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 18 of 19 Pg ID 402
Directory 

I 

~ Georg:ia Gwi. nnett .. · · .. COLLEGE 

Meet Our Faculty and Staff 

Page 1 of 1 

ABCDEFGHIJ KLMNOPQRSTUVW 

X Y Z 

First Name 

Area 

[select] 

[select] 

Last Name 

i ..... .J 

Discipline 

v 

Mr. limmy Lipham 

Director of Software Development 

A-1 071 

jlipham@ggc.edu 

470.235.9466 (Cell) 

2:14-cv-14185-VAR-RSW Doc # 36-4 Filed 04/17/15 Pg 19 of 19 Pg ID 403