I always get a kick out of seeing that my favorite YouTube channels watch each other lol

Stacksmashing, mvg, and live overflow. The gang is all here

Thanks for crediting Stack Smashing in your recent video on the GB's bootloader, MVG - another cool hardware channel to add to my subs! :)

I was wondering why youtube would recommand me this channel but it is because of you !


I actually wondered back then, why they didn't develop that bootup logo with variations or animation from the game or "presented by Pepsi cola" etc

You can technically animate the screen by not clearing VRAM and instead doing something else with the screen the moment the BIOS gives control. Several demos do this. However, this was most likely prohibited by Nintendo's cert requirements; they probably wouldn't want someone doing this with their trademarks.


This is wonderful.  Thank you for posting it.  <br>I'm really stunned with how far FPGA boards have progressed.  I hope you release the GB cartridge soon!  My son has been fascinated since I showed him how we can use my oscilloscope to sniff the datalines of the SNES controller bus in real time.  This led into a discussion of different pin types and how we could sniff other types and how you might glitch them.  This is perfect because I can setup a bread board to branch off from my Super Game boy.

This is wonderful.  Thank you for posting it.
I'm really stunned with how far FPGA boards have progressed.  I hope you release the GB cartridge soon!  My son has been fascinated since I showed him how we can use my oscilloscope to sniff the datalines of the SNES controller bus in real time.  This led into a discussion of different pin types and how we could sniff other types and how you might glitch them.  This is perfect because I can setup a bread board to branch off from my Super Game boy.


Gotta love it when you can't wait for a PCB to arrive, so you just go and make one... And then design the PCB anyway, and release it for others! Nice!


That was a clever way of copy protection! Really interesting video, well done!


I would happily watch a few ads to help encourage you to make more videos of this type. Your skills are insane 👍


You presented this very well and kept it simple, tidy and interesting. Great job :)


every video i watch just blows my mind. its like decades of thinking 'what if', what if i got into this stuff and was good at it, what would it look like...? your videos are like painting the experience to my imagionation. Very satisfying. To see all this stuff is just incredible. I notice all the places I would have probably got stuck (so many times) and it just blows my mind. not to mentioned the quality of your editing. you are epic bro


You are just amazing... You make it so much easier to understand how games and their consoles work together. Ive always had an interest in programming and hacking and with your knowledge and great explanations I'm able to move forward with my own projects.. Thanks and awsome videos.


Incredible, never knew they already made this technique inside the gameboy


Remarkably simple. This is an excellent entry point for anyone looking to get into hardware hacking. Great video! 👍


i dreamt about doing things like this since when i was a kid. this fueld my interest and carrer significantly. thanks, gameboy.


This is very awesome, would love to see something similar for the game boy advance


Wow, that's really easy to extract a cartridge rom. Thought it would be more difficult than just a parallel read after seeing the Snes protection.


I am looking forward to more beginner Ghidra tutorials from you on your channel, they are very helpful!


They could've multiplexed the first 8 Address lines to behave as Data Lines sometimes, you'd only need an 8-bit latch to hold the address before a data read or write. That's how the old 8086 CPU worked, still a pretty cool workaround to having 8 extra pins.

You can multiplex all of them. Few different approaches exist here. They can also may write through section of map which controls address window.

I think the GBA did something like that. If I remember speaking to an engineer doing it at the time, he said the bus can auto-increment addresses too so you're not clocking in a new address every fetch.


I always wondered why the logo was blank if you didn't insert a cartridge.


Quickly becoming one of my favorite youtube channels. This guy is going places!


Clever license protection, for its time.

Sega sued Accolade for that exact thing and lost the Cort case. If the system requires the logo to be displayed. Then there is no copyright infringement

accolade vs sega "Accolade's acts of reverse engineering Sega Genesis software to learn about its security systems and subsequent publishing of unlicensed Sega Genesis games are protected under the fair use doctrine of copyright law. Sega is held responsible for using its security system to place its trademark on Accolade's games."

Does absolutely nothing to stop 'copying' though haha

@KuraIthys I recognise your name. I think I had a conversation or argument or something with you a couple of years ago maybe on a GameHut video relating to the Mega Drive and/or the Amiga?

@InsaneFirebat It's grown up Baby Metroid!

It sounds clever.
But Sega tried more or less the same thing, it got to court, and was ruled unenforceable.
The legal judgement was something to the effect that because you HAD to include this trademarked logo to get any software running, you had no choice in the matter, and thus couldn't be prosecuted for it...

These kind of things seem pretty clever, but they rarely seem to work in the company's favour in court, because courts seem to favour allowing people to write their own software for a given hardware platform over protecting the platform owner...

@InsaneFirebat yeah yeah I know. But still It's not cool if theres more than 1 with that pic.

It's from the Super NES game, Super Metroid. It IS the Super Metroid. So I don't own it either :)

aw man you profilepic is freakin cool<br>almost want to steal but that would be uncool

aw man you profilepic is freakin cool
almost want to steal but that would be uncool


That was very informative and a good presentation. Well done!


This guy has some serious engineer skills... I'm amazed!!!


This is genius!<br>It's basically a devkit for the gameboy created from scratch?

This is genius!
It's basically a devkit for the gameboy created from scratch?


Sehr interessantes und informatives Video! Super cool wie solche Technik früher funktioniert hat


Good channel, with great content. Keep up the great work.


Nice work. You could simplify the FPGA code slightly by just replacing the logo address range during the first read, and otherwise just always return the original ROM data. After all, the ROM already contains the correct logo.


That is pretty in-depth and awesome information. Great video!


Just a note: you accidentally put reg [7:0] rom[0:32768] instead of reg [7:0] rom[0:32767], which could result in using an extra block ram


A project I may work on once I finish my senior design, would be to make a similar cartridge but build an FPGA onto it... may be a fun way to mess around with verilog and some game boy stuff.


Collaboration between two wonderful engineering channels, amazing. Shove a CodeBullet or CodeParade in there too!


amazing job! thanks for sharing your findings <3


Very nice video. Thanks for that. May I ask which tool you use to make those animations? like when the numbers fit in the logo or the flowchart drawing?

Thank you! I’m using Keynote for the animations!


Analyzing the video, I came up with another idea that would have been possible with technology of the day.
Since you mentioned the presence of a 1mhz clock signal, you could power a very small microcontroller that could just count cycles  and since the  boot process always takes the same amount of time , swap the hacked logo bank and the original one based on said counter.
 And it could be a very small additional ROM just mapped to the address.


Is think Nintendo's approach to lock the nintendo was actually pretty smart.<br>They still kept the private flashing of cards possible, but could prohibit the commercial use of it

Is think Nintendo's approach to lock the nintendo was actually pretty smart.
They still kept the private flashing of cards possible, but could prohibit the commercial use of it


I’ll be completely honest. I have no idea what any of this really means, but I’m just fascinated by the technical jargon and seeing how things work, and you actually have a pretty chill voice, too, so I’ve subscribed. ^_^


Some days ago I bought the gamboy cartrdige breakout port and I want to build something similar to this. I am a newbie with this kind of projects and I have a doubt about the forwarder: do you synchronize in some shape or form the FPGA clock and GB one?

Thanks for these amazing videos!


Could you make a video on how you made such a cardridge, seems interesting :)


Is this something that would have been feasible with 1990s hardware?  I would imagine that it would be a lot harder to set a conditional on first read/second read of the logo at the time.  Any ideas on how that might have been accomplished?


That is really interesting. I always enjoy learning new things about old tech!


The breakout PCB looks useful, looking forward to the gerbers being released :)

With coronavirus floating around, you really want more things to be released into the public?


So the cartridge "protection" works just like in the Mega Drive? Interesting video by the way!


Very clever hybrid technical/juridical protection. The only mistake programmers made, defeated all - they shouldn't read the logo twice.


@ModernVintageGamer has a LOT of great videos on things. Watching his channel is undoubtedly why I was recommended yours (and subbed)


Nintendo loves trademark violations so much that they implemented a protection based around that. Epic.


I'm really into all this stuff. If I wanted to learn about this kind of hacking to do as a hobby what kind of information should I study or read?


oh I remember my first gameboy... best day in my life as a kid. Played tetris all day long. Interesting to see how the protection works


I have actually been working on a similar project A GameBoy cart with an fpga on it, and wanted to use the same level shifters, good to know that they are a little problematic.<br>What exactly is the problem though with them? do you have any details?

I have actually been working on a similar project A GameBoy cart with an fpga on it, and wanted to use the same level shifters, good to know that they are a little problematic.
What exactly is the problem though with them? do you have any details?

he mentioned their autosense capability.
Based on datasheets for such devices I'm assuming these are bidirectional level shifters that can automatically decide which direction the shifter is operating in (eg which side is 'in' and which is 'out') and possibly also what the voltages are on either side.

If the auto sensing system messes that up, I can see that causing a bunch of issues...


LOve the video. Amazing work and well explained. Maybe you can help. I got an idea of getting own quick code into GBC but don’t want to use expensive flash cart. I’m rather to build own small GBC cart store one game, maybe saves so with a battery. But can not find any source that could help build it. Maybe you know anything? Thx


you rarely see this kind of work.<br>stacksmashing / liveOverflow  = Creativity

you rarely see this kind of work.
stacksmashing / liveOverflow  = Creativity


Just imagining a low cost wifi module that let kids develop their own games and upload them wireless 🙃<br>I wonder if the gameboy could provide enough power to connect an esp with it :)

Just imagining a low cost wifi module that let kids develop their own games and upload them wireless 🙃
I wonder if the gameboy could provide enough power to connect an esp with it :)


Really cool!  what are the potential of this making board?


I love their thought process<br>force unauthorised 3rd parties to use their logo so they can sue them

I love their thought process
force unauthorised 3rd parties to use their logo so they can sue them


Name dropping MVG? Instant subscribe. This was interesting too. I sort of knew this but didn't realize how simple it was.


Very interesting video.

Since he still stores the nintendo logo in memory, would it still be considered illegal? Even though the logo isn't showed.

Data ownership is legally gray. Suppose you copyright the word “foo”. Does that reasonably mean you own the byte representation? What if I use the bytes to make a colored t shirt, is that infringing?

Nah trademark law works differently lol it has to be shown to count as a violation xD

@z01010000b Well in the video he did say something to effect of "so it is legal".

No. At least not in the US. Companies like Nintendo hoped for that to be the case but Sega lost a very similar case against Accolade back in 1992. <br>I quote Wikipedia: "...Sega is held responsible for using its security system to place its trademark on Accolade's games." In other words, even showing the actual Nintendo logo in this very particular case wouldn't be illegal. It's just that having your own logo is so much cooler.

No. At least not in the US. Companies like Nintendo hoped for that to be the case but Sega lost a very similar case against Accolade back in 1992.
I quote Wikipedia: "...Sega is held responsible for using its security system to place its trademark on Accolade's games." In other words, even showing the actual Nintendo logo in this very particular case wouldn't be illegal. It's just that having your own logo is so much cooler.


Whenever I receive a notification that you have uploaded a new video, I immediately stop whatever I was doing and sit to watch your video. What an awesome work. Keep up the good work! ✌❤


Nintendo lawyers from the 90's enters chat. This is really fascinating haha, great vid!!

Sega sued Accolade for that exact thing and lost the Cort case. If the system requires the logo to be displayed. Then there is no copyright infringement

accolade vs sega "Accolade's acts of reverse engineering Sega Genesis software to learn about its security systems and subsequent publishing of unlicensed Sega Genesis games are protected under the fair use doctrine of copyright law. Sega is held responsible for using its security system to place its trademark on Accolade's games."


Love the vid awesome work. Just binge watching all your vids


This is really cool, but what is the practical use of this? Do you plan to get into GameBoy homebrew game development? It would be really cool if so.


This is awesome! How did you learn all this stuff?


This is impressive but couldn't you just have two ROM chips, an SN74S08, and an SR latch that feeds into a transistor that flips the chip select between the ROMs each time you try and read 0x0133? So you'd start with a hacked ROM, read the logo in up to 0x0133, route the relevant address lines through the SN74S08, trigger the SR latch which would then switch the transistor and changes the CS line over to the genuine ROM? It sees like a lot less hassle than building a full FPGA setup?


I realized that the logo was copy protection when I noticed that if the logo didn't look correct (for maybe a dusty cartridge) the game wouldn't load.


This was inspiring. This was fascinating.


IIRC, wasn't this how Argonaut (the guys who eventually made StarFox) got hired by Nintendo? By demonstrating their development skills by bypassing the Gameboy's protection in a similar way with their logo right in front of them?


This is like using a chainsaw to cut tomatoes, love it


Why don't you use synchronizers on control signals in your Verilog code? Don't you have metastability issues when crossing clock domains?


Scott Shawcroft of Adafruit has managed to put CircuitPython on a SAMD51, which is apparently fast enough to emulate a Game Boy cartridge. There's a fantastic video from Hackaday Supercon about it: https://www.youtube.com/watch?v=ycTFYb-9nhI


Hmm ... would it be possible to make a YM3812 cart that uses the audio pin to play Adlib music? It'd be neat to play FM synthesis tracker music on the gameboy.


Came here from the MVG video on the GB bootloader, this is awesome. I look forward to watching your other videos! :D


This is just the kinda stuff I love to watch.<br>A question though, is all the tooling for that particular FPGA board you have closed source? I've seen that stuff like PlatformIO has FPGA boards listed, but I don't know to what extent it operates with them.

This is just the kinda stuff I love to watch.
A question though, is all the tooling for that particular FPGA board you have closed source? I've seen that stuff like PlatformIO has FPGA boards listed, but I don't know to what extent it operates with them.


Interestingly, a similar hack was demonstrated by Argonaut Games to Nintendo. Normally this would've ended up in a lawsuit, but Ninty was reportedly impressed by it that Argonaut became one of their partners, eventually culminating in <i>Star Fox</i> for the SNES.

Interestingly, a similar hack was demonstrated by Argonaut Games to Nintendo. Normally this would've ended up in a lawsuit, but Ninty was reportedly impressed by it that Argonaut became one of their partners, eventually culminating in _Star Fox_ for the SNES.


Hello, I have a nanoloop one cartridge (a homebrew for the GB) that boots fine in a first generation GB and a GB Pocket (after displayin a "Hello" instead of the Nintendo logo), so I guess that the technique you explain here was used in that cartridge. But the same cartridge will not boot in a super game boy (although it does show the "Hello"). Would that be because the SGB has an extra protection feature? It really intrigues me, but I have no idea why it does that. If you could share any theory it would be really appreciated. Thanks.


Even though I wouldn’t take the time to do this, I love watching.


Oh that's why my Gameboy Micro wouldn't display the Nintendo logo without a cartridge! Real interesting stuff! (Does that mean my hack cart has a trademark violation in it??)


This was also leveraged by Sony on the PSOne, not the original Playstation that had the wobble track copy protection but the later version, the small one.<br>The original one displayed whatever logo the disc had, the PSOne checked against a ROM stored logo and if they didn't match, the console didn't boot the game.

This was also leveraged by Sony on the PSOne, not the original Playstation that had the wobble track copy protection but the later version, the small one.
The original one displayed whatever logo the disc had, the PSOne checked against a ROM stored logo and if they didn't match, the console didn't boot the game.


I'm not sure if you knew about this already but did you know that the Sachen 4-in-1 cartridges has their own logo and bypasses the bootstrap check?


You might want to have a look at the SACHEN cartridges. They were released in the 90s and showed their logo while booting. And they somehow worked just fine.

Some time many years ago, I read through an annotated, decompiled copy of the GB boot ROM, and IIRC it didn't compare the cartridge and onboard logos bit-for-bit. Instead, it calculated a line-by-line hash/checksum for each horizontal line of the logos, and compared those.

I had one of these Sachen cartridges, and I remember thinking that the "Sachen" logo looked really weird; it was barely readable. I believe that this was done in order to return the same hash/checksum values as the proper "Nintendo" logo, despite displying a different image.

They probably switched ROM banks when the logo was read or after some set duration.

That sounds interesting, will try to get my hands on one! I also have a cartridge that displays its own logo, using the same method as shown in the video (though not with an FPGA)


Amazing, can I ask you how to write a cartridge with a new game ?


I have a Mega Memory cartridge (onto which you can backup game saves) and unless used on a Game Boy Advance, it says "Megamem" instead of Nintendo but it still runs fine! There's also a Smartcom personal organizer cartridge that says Smartcom instead of Nintendo but still boots fine (although I've heard it's not compatible with the Game Boy Advance) and Rocket Games' unlicensed Game Boy Color games say ROCKET instead of Nintendo but again they still run fine!


another great source for more info on the Gameboy is "The Ultimate Gameboy Talk"
https://www.youtube.com/watch?v=HyzD8pNlpwI
also about the code, wouldn't it just be easier to have the always block check the RD line for changes instead of the CLK? it would make it only run when it actually Reads instead of constantly checking. or just completely get rid of the always block and use a ternary operator with the RD input.
then again, using an FPGA to emulate ROM is a bit overkill anyways


hm.. couldn't this be done with just a comparator and a flip-flop? the comparator triggers upon accessing the last logo byte and trips off the flip flop to switch an otherwise unused rom address line. this would waste half of the rom, but seems much less overkill than an fpga. this way it would have even been possible back in the day.


For the level shifting, it may be a better idea to use IMO level shifting chips with external direction control like SN74LVC16T245 for the address and signal lines. Those chips needs control signals, but thise can be derived from the CS, RD and WR pins using some 74LVC1Gxx logic. This means for the target board it can be directly connected without the need of level shifters, and since those SN74LVCxxT245 chips contains line redrivers, you can even run longer wires with little ill effects. Also you can include an op amp like LMV321 to buffer the audio line, basically also a redriver.


This is so cool, do you think this works with the GBC as well?


Every single concept of this video is pure gold... Yes, even the comments.


It's a rather shrewd form of DRM that relies more on their lawyers filing trademark lawsuits and less on active protection. An even lower-tech method would be the "NINTENDO" trademark stamped on Famicom Disk System floppies which was required for the FDS to boot. Bootleggers were too chicken to stamp that exact wordmark so they came up with ways to dodge it until they realised that only a few indentations was all it took to defeat it.


You can use an ice40 fpga or one of those chinese $5 fpgas for the cartridge. It's also possible to load the binaries of a game to the internal block ram of the fpga. Or if you're feeling adventurous, add a microsd card slot in which you can read from the fpga.

Yea the problem is getting an ICE40 board with enough IOs and enough RAM - I wanted to try it on one of my ECP5 boards though


Did you ever finalize and release the breakout cartridge?


Such an amazing video! Instant subscribe.


Nice work there! I was watching this with pleasure, thanx for that!


Mistakes Were Made - How the Gameboy copy protection was defeated

"Mistakes were made." - Well, not for the time when it was invented. FPGAs were prohibitively expensive at the time, so were ASICs.

it's trademark protection, like Sega TMSS


Nice video ! But is it really "copy protection" ? I don't understand how it can prevent copies of games.

@kilrahvp Too late, everything sold. I didn't know that cola with urine is so popular!?! rotfl

@Jedzia Dex If you sold anything with the coca cola name or logo on it they can definitely sue you, their trademark is registered. To use a registered trademark you need the permission of the trademark holder.

@stacksmashing I think some of them just did that to be cool. When this was designed, it worked legally, but the law was soon changed to allow the use of trademarks and copyrighted data if they were required to make the product work.

Not a lawyer, this is what most sourced said - it seemed successful in that the third party cartridges that exist (i.e. SACHEN) indeed do not display the Nintendo logo. Also remember that trademark laws vary a lot between countries, so I think it’s hard to give a definitive statement on this

@stacksmashing Actually, it doesn't even do that in the legal sense.
It would be a strange world in which we are no longer allowed to pronounce names or show symbols. Reminds me of Voldem.... Well, You-Know-Who;)
A second page with a disclaimer, that the Nintendo(R) Logo is needed to run the game is enough to "circumvent" this bodge legally.

It's like a recipe for a drink from Coca Cola plus your own urine. Coca Cola may not like that, but there is nothing they can do about it.
disclaimer: <Coca Cola is a trademark of  the Coca-Cola Company> ... you get it.
Cheers, i am very proud of the last example*g*

@stacksmashing Actually, it doesn't even do that in the legal sense.
It would be a strange world in which we are no longer allowed to pronounce names or show symbols. Reminds me of Voldem.... Well, You-Know-Who;)
A second page with a disclaimer, that the Nintendo(R) Logo is needed to run the game is enough to "circumvent" this bodge legally.

It's like a recipe for a drink from Coca Cola plus your own urine. Coca Cola may not like that, but there is nothing they can do about it.
disclaimer: <Coca Cola is a trademark of  the Coca-Cola Company> ... you get it.
Cheers, i am very proud of the last example**g**

True, it doesn’t prevent copies, it prevents others from publishing game cartridges for it :)


i wonder if it could be done without a fpga
by using a second ROM that contains the logo and when the GB is turned on, the modded ROM starts until a few ms later and switches to the original ROM before the second logo read happens.
or (if the ROM is only filled halfway, basically having addr bit 16 allways 0) putting the logo at 0x8104 and flipping bit 16  x msec after turning on/first read.


I already asked you about this but since now you team with the big boy aka LiveOverflow do you think you can reverse engeneering Bosch E-bike motors ?


Could this be used to play videos on it as well as games I wonder?


Thank you very much.

I am so interested in this topic, yet not by myself.
Is there a way to meet up with people to endeavor on topics like this?


A lawsuit in the early 90's removed the legal underpinnings for this sort of usage of trademarks as a form of copy protection. lookup Sega vs. Accolade for more info. Accolade published unlicensed games that used Sega's copy-protection code including the part that displayed the Sega logo. A court eventually ruled that the code usage was fair use and Sega's act of requiring display of a trademark for a game work was an "improper use" of trademark because it served to limit competition which is the function of patents and not trademarks.


it will be perfect for gameboy's re-shells that has "game girl" on it.


Well done, awesome dude.<br>Keep hacking.


How do you get the ROM onto the FPGA? Do you preload it somehow? Or is it being read from and SD card reader or something?


2:15
Sega sued Accolade for that exact thing and lost the Cort case. If the system requires the logo to be displayed. Then there is no copyright infringement

accolade vs sega "Accolade's acts of reverse engineering Sega Genesis software to learn about its security systems and subsequent publishing of unlicensed Sega Genesis games are protected under the fair use doctrine of copyright law. Sega is held responsible for using its security system to place its trademark on Accolade's games."


W T F this content is so freaking amazing


Do you think this would be possible using the new Raspberry Pi 4?


you're a genius for finding that out and a hero for making that public.<br>In my eyes at least, in the eyes of the law, that may differ ;).

you're a genius for finding that out and a hero for making that public.
In my eyes at least, in the eyes of the law, that may differ ;).

@stacksmashing Thanks for the video anyway as it is very well explained.

Ah this is well known in the community, this is not something I found - there also used to be cartridges at the time that used a similar trick!<br>But glad you like the video!

Ah this is well known in the community, this is not something I found - there also used to be cartridges at the time that used a similar trick!
But glad you like the video!


Ah, a Game Boy Logo Expert, now I have someone who I can ask this question:
When I saw this trailer /watch?v=UzuOw50zmbU
at second 5 I felt something like a childhood flashback. I don't know if my mind is making this up but I think back in the days our Game Boy would sometimes show this weird logo that you can see in this trailer. Then I blew on the pins and restarted the System and then it usually worked. What is that? Have you, or anyone else, seen that on the Game Boy before? Is it a typical bug that they are referencing in the trailer? I feel like I have seen it before, but I'm not 100% sure, I was like 4 years old when I played with the Game Boy. Maybe this happens when specific pins are blocked?


Nice Hackers reference with "Hack the planet" on the PCB at the end


Good video. BTW, the word infamous is not 'in-famous', it has the stress on the word in, so it is 'IN-fa-mous'.


Nintendo had better lawyers than engineers.


Dear Stacksmashing, In the past had a game from a company called "Sachen", no Nintendo logo appeared instead the logo "Sachen" and it still worked on the official gameboy


That awkward pause at the end to reach the advertisable video length ;)

@stacksmashing just talk a little bit slower. spoken info will be much more clear and you will pass the 10min mark with no effort.

The minimum for mid-roll was reduced to 8 minutes some time in 2020. :-) I like it, too. Creators and viewers have less filler to deal with.

There isn't a minimum length for ads but 10+ minute videos are allowed to have unlimited midroll ads

@Sasszem

Knock! Knock!

Who's there?

😈 NINTENDO 😈

@Sasszem

*Knock! Knock!*

Who's there?

😈 *NINTENDO* 😈

No use, Nintendo will claim it / disable ads...

Youtube is weird, Why put a minimum advisable length, it only encourages long and cringy videos while real gems like these are left behind.


I have to say, this is one of the weirdest protection methods that I have seen, I mean the logo is right there, any programmer with some hex knowledge could take it, I think that even I could do it and the fact that the logo is copyrighted would not stop some people, especially on the other side of the globe, If I know it, I used to own a pirate pokemon crystal cartridge, I remember that I even dissasebled it because the battery was dead, that and playing with the missing number fried it, yes, missigno in fact can break your game.

That's because it's not a technical protection so much as a legal one.

Their goal wasn't to make it difficult on a technical level to 'break' their protection.
Their goal was that if you broke their protection they could sue you for trademark infringement.
Thus the difficulty this presents is legal, not technical.

Still,

It was proven in court that this method isn't seen as legally valid, so it's a moot point.


It only took 31 years, but it has finally been done.

well, some bootleg cartridges did this back then


If someone wanted to implement this in the simplest hardware, wouldn't a rom chip that's twice the size (or two rom chips, one big and one tiny one.<br>The first time address 133 has been selected, a flipflop is activated, etither flipping an address line, or toggling chip select pins.That way, you wouldn't need an expensive FPGA.

If someone wanted to implement this in the simplest hardware, wouldn't a rom chip that's twice the size (or two rom chips, one big and one tiny one.
The first time address 133 has been selected, a flipflop is activated, etither flipping an address line, or toggling chip select pins.That way, you wouldn't need an expensive FPGA.


I'm now wondering if there's a low tech way of doing this with discrete components, so a company at the time could cheaply and legally publish an unapproved game.

My thought: I conjecture that the Gameboy will always do the reads after the same set number of cartridge clock cycles, since there is no user input before then. Have a smaller, separate ROM store the unofficial logo and put the official one on the main ROM. A counter chip can count clock cycles, and switch the ROM chip over via chip enable signals right after the hacked logo is read.

Doh, much more robust design that also uses a comparator and a counter:<br>Just have the comparator compare the address bus to the (constant) address of the beginning of the logo, and use the output to clock a counter. Once the counter counts to two, flip the enable pins of the rom chips.

Doh, much more robust design that also uses a comparator and a counter:
Just have the comparator compare the address bus to the (constant) address of the beginning of the logo, and use the output to clock a counter. Once the counter counts to two, flip the enable pins of the rom chips.

If there's interest I might design a PCB for this so people can sell hardware homebrew game carts for cheap on Etsy or whatever and get sued a little less hard by the Nintendo lawyer army.


Has enough parts “just lying around” to build a Cray computer.


3:05 did anyone notice the "hacked" and "nintendo" logo spells out "Hacked Nintendo"?


Wow. Nintendo really took advantage of suing..


should've replace "Hacked" text into "Hello World"


Since you still need the original Nintendo logo data in the ROM, isn't that enough for Nintendo to sue?<br>The logo image is still a logo image even if it isn't displayed.

Since you still need the original Nintendo logo data in the ROM, isn't that enough for Nintendo to sue?
The logo image is still a logo image even if it isn't displayed.


you should TOTALLY collab with the 8-bit guy, or TDNC (This Does Not Compute)!


Everyone: LiveOverflow... boot rom.. CIC... data lines...<br>Me: Is that dust on the Gameboy or on my screen? 🤔

Everyone: LiveOverflow... boot rom.. CIC... data lines...
Me: Is that dust on the Gameboy or on my screen? 🤔


Hmm would this be possoble to do in the time the Gameboy was released (the technology that was avalable then)


it seems its purpose is not protection but just checking if pins are connected well.


Forcing pirates to use your logo so you can get them for copyright.  It's brilliant.


this whole thing where the gameboy will lockup if it's not the nintendo logo sorta seems like a pc that locks up if u try to upgrade it but if u bypass that the company sues


Even If I don´t understand too much about this. It´s quite satisfaying to watch this videos.


You are an inspiration, I'm a small tech youtuber doing some videos on the pi, IT career tops etc.. love your content man.


I want 1 video every day, I enjoy this more than all animes


ok, now make among us on gameboy using the online multiplayer thing you made in the other video so people with gameboys can play the game with any device


Nice Hackers reference on the breakout cart ;)


question: if i load a rom hack i made [with gb studio] onto a flash cart, will the nintendo logo show or will it show my name and lock?


Has an FPGA, voltage regulators and presumably a ton of other parts/boards - let's hack something that doesn't even have a backlight. 😂 You could probably just make a better gameboy. Upgrade to an OLED display, maybe some better audio, slim the device, convert it to 3.3v, and make it run any cartridge that will fit in the slot. You could probably pull it off with a RPi Pico. If so, you can run the Pico at 1.8v. You could make batteries last forever.


Imagine playing on this unportable version and having all clunky wires instead of just using an emulator.... BeCauSe aEsThEtIcS OlD tEcH bAcK tO lIfE


One still has to store data for the Nintendo logo in order for the ROM to pass the second read check. Wouldn't that be enough for Nintendo to sue someone with this even if said logo isn't displayed?

@David Jacques It's Nintendo. The universes master of legal prosecution. They'll find a way.

If it's not displayed, all it is are numerical values compared to other numerical values by the CPU. It has the be interpreted as an image to be the logo. If you shot a movie, and it just so happened that, if you open the file in a text editor, you see "Nintendo" in the otherwise meaningless sequence of characters, could they sue you for trademark violation, even though it never showed if you played the movie as intended?


Can you make a video recreating this without any information as if you were the first one figuring out how to make a ROM cartridge. But only with tools available before the game boy came out


If the Nintendo logo still needs to be in the cart the second time (check time) for the gb to boot, how isn't still a copyright infringement? Even if you don't display it, it is still there

My understanding is that this is about trademark, not copyright. A trademark is used to show which company made a product, whereas a copyright protects the creator of a work of art (such as a game) from having to compete with copies. I'm not a lawyer, but it seems to me that if a trademark isn't displayed anywhere, there's no infringement because there's no chance of misleading a consumer.


An FPGA is obviously the easiest way to do it now, but with the technology of the eighties that wouldn't have been possible.
Maybe you could check how many clock cycles or milliseconds it takes before it reads the logo the second time so it knows when to switch using either a timer or counter circuit.
The switch could simply force the A9 pin high when reading the first time and after a certain amount of time it lets it function normally.
This would cause it to unknowingly read from 0x0304 to 0x0333 the first time (where the hacked logo could be stored), and then read from 0x0104 to 0x0133 (normal logo).

You'd be surprised. FPGA's of some description have been around a long time.

The C64 uses a PLA for bus arbitration. (Programmable Logic Array)
The Sinclair Spectrum implements a fair few secondary functions using a similar device as well.

They're nowhere near the level of complexity of an FPGA, but they're the same general idea.

And in the 90's you certainly could get an FPGA - they weren't cheap.
But if you were say, implementing a Developer cartridge for the Nintendo 64...
You'd use an FPGA for some of the interface logic. (see, pictures of the interface units Rare built themselves for various projects - you can clearly see the FPGA used in some of them.)

By the mid-90's you could absolutely use an FPGA, but you likely wouldn't want to given the cost of one.
(remember the gameboy is a 90's device more so than an 80's one)

And if the complexity of what you are implementing is low enough, you could've done it with an early 80's style PLA.

Probably not the simplest or cheapest option for the time though...


It's not a big deal...gb source code was in the net since 2000


How is the TOCTOU-attack a bug rather than an oversight/dodgy implementation?


That is very smart trademark protection, as long as you are changing, modifying or even storing their logo on your own device you are falling foul of trademark protection, you cant use fair use either.


This video has been up for almost a year and still no legal action from Nintendo?!

Sega v Accolade rendered this kind of trademark-induced security ineffective in the US.


Can u make an indept video of how to convert LCD signals to HDMI/VGA with FPGA I need to capture footage from old Nokia feature phones like Nokia 1100, Nokia engage etc etc


Cartridge was said 39 times during this video


Does anyone know if this applies to game boy colors?


Bro You are genius. You know that right.


Hack The Planet! Hackers is such a great movie!


Did you end up releasing the breakout board?


Finally I can play that cracked version of tetris on my Gameboy, thanks!


Is there a way to do this with a Gameboy advance and not having to use a big thing of tech ?


I'm jealous of your knowledge, what is your academic background?


The video is exactly 10 minutes long
The video was uploaded 10 months ago
And I’m watching this at 10 : 00PM


Bruh... You can supply the expected functionality with a cheap eeprom but you went straight for fpga, lmao.

I guess it'll make the hack easier, though it would have been more fun to just use an eeprom, a counter, and a latch.

Alternatively you could spend the $5 to get an ATxmega128 and have a nice, neat little single-chip solution that can do anything you want to the poor DMG.


This is how you get Mew to appear under the truck!


Verilog looks better than VHDL, I've never liked VHDL but that's what I know

I pefer Verilog too. But from academical point of view VHDL is better. It has a well defined handling of data-types.


where can i see the game and watch video?

curious to see the innards..

thanks


An interessting and cool example of the use of the audio pin on a cartridge is nanoloop mono:
http://www.nanoloop.de/mono/index.html

"On the original Game Boy models, one pin of the cartridge connector functions as audio input, connected to the built-in amplifier. This unique feature allows to generate sound on the cart and play it through the headphone output on a completely analog signal path.

In the nanoloop mono cart, the analog components (op-amps, comparators, logic cells etc) of a PIC microcontroller are connected and configured in such a way that they form a hybrid soundchip with 3 analog filters and a true random noise generstor, using only a few passive external components."

Yea I also own a regular nanoloop cartridge and it also shows a custom logo :)

Btw, nanoloop mono also has a custom logo shown when booting


Brilliant I have a challenge I know some brilliant mind like you Will solve it I need help with a Korean nintendo wii Locked on error 003 after update there is way to fix it but it's a painful and I can't find a modchip if there any way through software please and a lot of thanks to you for your time and work

Check out Letterbomb which is a softmod for wii... You can write to the NAND memory for homebrew and flash roms...


Li Cheng Industries-published Game Boy games has the Nintendo logo modified to read "Niutoude".

That doesn't use this exploit - AFAIK CGB just doesnt check the bottom half of the logo


glad to hear you bypass the nintendo logo !! ...


Any idea why the Gameboy reads the logo twice? Why not read it once, display it on the screen and then compare the data to the stored reference data?

Does seem a bit weird.
My guess is it's accidental.
Someone just didn't think about it when they programmed the bootloader.

That, or it's a technical issue - in the first pass the logo has to be loaded into video memory so that it can be displayed.
The second pass the CPU has to compare it with a value stored in an internal ROM...


I swear I've seen a couple cartridges released that were able to boot with a custom logo, without packaging an FPGA into them

You could do this with a standard ROM chip and some custom bankswitching logic. For example, you could have a custom bankswitch IC that starts with HOME in bank 1, then switches it back to bank 0 after the BIOS reads the logo. Put your fake logo in bank 1 and the Nintendo logo in bank 0, and you get a custom logo, at least on DMG. CGB wont accept this afaik, but it also doesnt check half the bytes at all, so you dont even need a custom mapper on CGB if your logo is some half-Nintendo, half-custom monstrosity.


Read all the comments and no mention of the "Mega Memory Card" for GB - that displayed a "MegaMem" logo on boot.


This video is 1990's nintendo's worst nightmare


I thought it read the logo directly from screen like a framebuffer


Why is the ROM only 32kb? Shouldn't 16 address pins make addressing possible for 64kb?


Verilog is ugly. Sorry to say. It's almost like the last 25 years hasn't happened 😂

Great video though! Thank you!


Anyone press start/select when the Nintendo logo appears it makes it disappear and the game doesn’t boot


Can u Reverse a sprx ps3 plugin for a game?


as soon as you brought out those level shifters, i knew you were going to have problems with them lol. those ICs are garbage

Non bidirectional level shifters. We struggled with those at work and switched to SN74LVCXT245


Omg my childhood answer to why it it was black Nintendo logo had been answered!! I never knew why😱😱😱


a bit late, but i love the hack the planet reference


Cant nintendo still sue you for having the nintendo logo on the chip at all?

@Tuxfanturnip Based on a similar lawsuit in the past...
The fact that this form if infringement is REQUIRED to be able to get software to run on such a system actually works against it legally...

Basically, because if you want to get a gameboy game to run at all you HAVE to include this logo, that fact alone counts against this method in a court.
(that's what the ruling against Sega said, anyway... - Sega used a very similar method for the Mega Drive)

It's technically a copyright/trademark violation, but since it's forced upon you for technical reasons, it can't be enforced.
Something to that extent.

I think they might be able to claim copyright of the image as data, but the trademark is only violated if it's displayed to the user? Not at all an expert, just my guess

Not a lawyer, so absolutely no clue if this was enforceable in the first place :)


0:40 this for NES and Nintendo64
Not for Nintendo gameboy


Isn't this just the Sega TMSS, which courts shot down?


Would it be possible to hack 'gbc ONLY games' to work on gb?

@stacksmashing the ZAZZ glitch tried this in 'bringing arbitrary code execution to other games' lol he tried to load Pokémon crystal on a GB. The graphics where super messed up and the game crashed upon going beyond the title screen 🤣


wow really so in other words I would have to pay for there logo just to run it on the handheld? Thats like be having to pay Microsoft everytime I wanted to run a custom program that I made on C++ for windows ><


2:09 At least in the United States of America, Nintendo would probably have lost such a lawsuit. U.S. courts don't let a trademark holder assert a trademark as an ersatz patent. Kellogg v. Nabisco; Sega v. Accolade.

I was going to mention this as well, although it's interesting that Sega continued using their Trademark Security System on the Saturn and Dreamcast well past the 1992 ruling against them. Presumably they hoped it would be enforceable in other jurisdictions.

Pretty sure this was designed before that ruling.


Finanzielle Freiheit dank Kryptowährungen


Man this is so facinating, I wonder how hard it is for simple people to understand this.


Can an expansion pack be created from a PC's RAM?

@Vili Muratovic Probably.
but why would you? Functional equivalents to the expansion pack (or even actual expansion packs) can be gotten off ebay for about $9.
I guarantee you that trying to build your own will cost you way more than that...

@kilrahvp I have the game zelda majora's Mask for Nintendo 64 but unfortunately I don't have the expansion pack, is there any way to create an Expansion pack from other components?

Nope, PC RAM is dynamic so needs a complex controller to deal with it. Could be implemented in an FPGA, but then you don't need the RAM anymore


Bro big fan of yours from Lamatol village, golbazar-06 municipality, siraha district, sagarmatha zone, province no 2, nepal 🇳🇵


The volume of this video is so low, I can barely hear it!


Argonaut Software has a less elegant but more indigenous solution- they’d have a capacitor and resistor that when the GB was powered up, the capacitor would be empty at the time and send the GB the Argonaut text. But when the second read is done, the capacitor would have charged and somehow trigger the ROM to return the Nintendo logo.

https://www.eurogamer.net/articles/2013-07-04-born-slippy-the-making-of-star-fox

They didn’t get into the specifics tho, but I’d think that the capacitor would meddle with the address bits to shift the memory access.

This would work for memory map. Double the ROM, and the cap is page select. (Delay via RC time constant, which works since this is very static.) Giving two pages with the same address space. The controller still believes it is working within a single page.

They could also build a write through section of address space were they can change the page select.


stack overflow is taken will it be stack flowsmash?


Why not use an Arduino Mega or something? It runs on 5 V. And you can just read two 8 bit ports into an uint16_t or to get the address, read it from an array or whatever and output it onto an 8 bit port. And then if you want check if the logo was already read once. The program would be dead simple.

@stacksmashing Really? How fast does it have to be? Triggering a pin change ISR, reading two bytes from two registers and and outputting a corresponding byte from memory to another register plus some checks for the logo. That's a pretty simply task. If you program efficiently, I think 100 clock cycles could be realistic. So at 16 MHz, when the read pin is pulled low it would take about 6.25 microseconds to output the data. Obviously you can't use Arduino (the library) cause it's slow as fuck.
I'm sure you could get it faster if you wanna take the time to write the code in assembly. But assembly is kinda annoying to work with compared to C. So I guess that would be a reason not to use ATmega. I just thought an ATmega would be nice cause it would be quite easy to solder directly onto the cartridge PCB and it's cheaper than an FPGA.
Anyway, so how quickly do the data pins need to be set after the read pin is pulled low?


Not sure if we should call the cops for hax or pat your back for a solid use of the Arty A7...


Haha, didn't expect to see FPGA for a simple GB cart hack. Kinda overkill isn't it?


Can we do this thing on Arduino UNO and it also work on 5v?

Unfortunately the Arduino Uno doesn't have enough IOs, also it's pretty slow at 16MHz, making it very hard to get the timing right (if possible at all) and also it doesn't have enough memory to store the full ROM


What cart was sacrificed, by the way? :)

A Tetris cartridge - I’d be lying if I claimed it didn’t hurt, but I have 5 or so of them...


youtube out here guessing my interests again<br>knows I already watch, and like, liveoverflow and am interested in electronics

youtube out here guessing my interests again
knows I already watch, and like, liveoverflow and am interested in electronics


You guys have a lot of spare time in your life


as soon as he switched on the game boy at 7:41 I got an ad


I dont know what a game boy is. Anyway nice video


Why did you hack the ████████ ████ ███ cartrige protection?


if you hack your Game Boy, then The Startup Screen will say "Hacked" instead of Nintendo

R62A 6 Train Offical, ThatRobloxTransitFoamer


Am I the only one hearing he say "cockroach" instead of "cartridge"?


Product from 1985 has copyright laws,, all proper,  all legal,  safe product.  <br>Product from 2019 china,  no copy right law,  copied technology,  illegal,  pirates,  may explode in your pocket.

Product from 1985 has copyright laws,, all proper,  all legal,  safe product.
Product from 2019 china,  no copy right law,  copied technology,  illegal,  pirates,  may explode in your pocket.


I just hope the sacrificial cartridge was one of those awful sports games


You're from Germany aren't you<br>Btw great video

You're from Germany aren't you
Btw great video


Can you continue to reversing Wannacry, please?


3:06   yooo this guy hacked nintendo  it says
stacksmashing

hacked
nintendo


sorry to bother but can someone tell me how and what to study to understand all this.


wait wha if you made it so that the audio pn plays rickroll upon first check lololol


just a normie passerby that got this vid through recommendations


Tetris with all long straight pieces muahahah muahahahahaha


oh sweet! <br>Finally I can have a custom version of Tetris that says "PENIS" when I boot it up!

oh sweet!
Finally I can have a custom version of Tetris that says "PENIS" when I boot it up!


So much filler to stretch it to 10 mins...


Technically, (all that matters in a court room) (also psa, not that it reallly matters anymore) no matter what, Nintendo has the upper hand, even if you do this, you still have the word “Nintendo” and are using it to misrepresent one self and the cartridge


dann kannst du mir bestimmt helfe. ich arbeite seit knapp 1.5 Jahren mit nem Kumpel von der Uni an nem eigenen Gameboy. wir wollte  die möglichkeit schaffen für jeden privaten eine konsole zu bieten für die man umsonst spiele machen kann. also ohne license und so. wir haben aber einige probleme mit dem vram und rom. hast du discord oder so?


Everytime i hear him say cartridge to me it sounds like he says cockroach


There's a large difference between bisexual and beesexual ;)


what i should learn to be able to do what you just did?


as i mean i cant see the words in the GB


Macked? Wow... mack-daddy of the GB over here


Hi sir you please helping. Arduino program

@stacksmashing

Can you teach me the program?
(This Arduino program)


I don't understand why they would bother, in the real world Nintendo would have sued anyway knowing that the rom still contained the Nintendo(R) logo in it and would have found it during disclosure in any court case.


Sprichst du deutsch ? Dein Englisch hört sich wie meins an ^^

stacksmashing / Ghidra Ninja  haha nicht böse gemeint, trotzdem geiles Video 👍🏼😄

Akzent? Welcher Akzent?  😂 Ja, komme aus Deutschland!


Couldn't you have just used an Arduino instead of an FPGA (that way you wouldn't need level shifters)?

@Jonathan Wick More info please, im interested in that but not for gaming purposes.

@stacksmashing Thanks for replying. I used an external RAM chip with the ATmega but i get your point ;)

@Jonathan Wick The problem is not only speed, but also that the ATmega328 doesn't have enough flash to store code + game - and for the more complex carts you don't have enough RAM to implement i.e. a ROM cartridge. I also looked at using an STM32 (which some people also did in the past), but in the end the FPGA makes life so much easier - and makes it much easier to explain :)

@VoidField101x As i said i've done it with a nearly identical device and you are right the most annoying thing about it was the timing but after i looked at the ATmega328 datasheet<br>i figured out what registers must be set to what values to get the timing right and it worked like a charm.

@VoidField101x As i said i've done it with a nearly identical device and you are right the most annoying thing about it was the timing but after i looked at the ATmega328 datasheet
i figured out what registers must be set to what values to get the timing right and it worked like a charm.

Well I don't think that it would be very flexible. Sure a Arduino / AVR is flexible, but with about 16 MHz and the GameBoy with about 4 Mhz you don't have that much time to handle everything. While instructions on the Gameboy will take more than 4 clockcycles (so the speed is more about 1Mhz), the Arduino still has to finish outputting data in about 16 cycles (while staying in sync with the data bus). And that ignores the weird timing issues / requirements some Processors have, like a data hold and setup times.

To be fair, I didn't do much research about the specific timings of all cpu instructions (neither for the Gameboy nor for AVR Processors) or the timing requirements for the Gameboy data bus. But it can get very annoying and complicated to debug timing issues.
But it might be worth trying.

@Michał Bojarski Thanks for your reply. I have done something similar with an Arduino Mega and yes the code was much more complicated than the FPGA code in the video but the hardware setup was  much cleaner.

with mcu it a bit more complicated as you have to check how fast rom puts its data out. ROMs are fast, MCU like arduino would need first to read address line, analyze it, read flash and put it on gpio. It all takes processor clocks


Dude why you sound like you record your voice secretly and afraid of something


BI is pronounced like BYE. BI-directional, not BEE-directional

Thanks, will try to say it correctly next time - in my language it’s pronounced bee directional :)