I'm glad that people like you make these things and hack these seemingly unhackable things. Without people like you, we wouldn't have all these things that we use today pretty regularly. Thank you!
@Unknow Yes, but I'm just some random dude on the internet who knows a little HTML and CSS. Although I will admit, the video editing is very good here. I can say for certain this content is a lot better than something I could put out right now.
@Rose this aint anything new communities come together all the time for this stuff. Think iphone jailbreak devs, or even gaming communites. The 3ds was blown wide open to the point you could download any game from Nintendo e-shop server and they could not stop you. still works to this day. The PS1 classic was was done pretty quickly along with the SNES/NES min's and even the Mini sega.
This must be the best console reverse-engineering talk ever! The game & watch turns out to be a great fit in terms of complexity for hardware hacking and homebrew!
There's a small mistake around 17:11 : When you have a ciphertext encrypted with AES-CBC and you flip n bits in one of the encrypted blocks, only the corresponding plaintext block + the bits at the same indices in the next plaintext block will be corrupt. The following blocks will decrypt normally. So if you set n bytes to zero (assuming they all belong to the same block), you'd get 16 + n corrupted bytes in the plaintext.
Loved the intro! I am not that technical, but I found this video to be very informative and well paced. Glad that you put this video together! Appreciate all the work on this even if it is more of a curiosity for me than anything else.
Amazing video thanks for sharing. I've been following your story since day-0 as well here, still waiting till the gadget becomes a little more available to get one. You surely piqued people's interest in this a lot (including myself), for an otherwise yet-another-meh-cash-grab device from Nintendo; hacking it, however, opens many interesting possibilities.
I wish I could give this video a thousand likes. Absolutely amazing mate! Great video! And what a community you have built around this little device. I can't wait to see more.
That was a great presentation and summary of a lot of time and hard work invested in the game and watch. Thanks for sharing it with us and opening everything ;)
Great talk and amazing work! I bought one of these for my son for Christmas and had to buy myself one after seeing this unfold. I'm very much looking forward to hacking this. I'll be happy with emulation but would love to have a go at writing a homebrew game for it. As for the USB ... you just need to shrink the MiniPRO down until it fits inside the case :D
Man your videos are great, your projects are great, YOU are great ! Seriously this is really entertaining but also really instructive, your explainations are clear and understandable by what I would assume to be everybody and that's really cool ! Good job man, you have a lot of talent !
it's surprising how many times this method works on so many different platforms. I used to have a job hacking keyless entry systems and we broken encryptions and did dumps in almost the same way.
All the dislikes are from the security team over at Nintendo. Nintendo: Great job team, its secure, they'll never hack this. stacksmashing: Hold my bowl of cereal.
Honestly, I feel like it's more that they wanted to crank out a fun portable device on the cheap. They weren't defeated; rather, people figured out a hundred other ways to have fun :)
Would love to see how people will preserve Super Mario Maker for the Wii U (yes, the Wii U) and Super Mario 35 (the eShop download)'s online functionality after March.
I can't wait until the RAM change is pretty much all you need to do to get it running emulators. Really the device just needs to emulate all NES and Game and Watch games and it's perfect.
How difficult would it be to fix the usb data lines so that they work ? (EG. soldering the data lines to the proper pins on the CPU, etc, and modifying the firmware to allow communication)
I was thinking that to use the USB plug for data purposes, the only thing needed was to wire the two data pins from the microcontroller to the USB connector, but I just read the datasheet for that microcontroller, and while it has USB 2.0 OTG capabilities, there's no pins for it in the 100-pin package version Nintendo used for the game and watch. What a pity.
I bought this hoping i'd be able to soft mod it. Whelp, so much for that! Its still gonna be cool pulling this from the inside pocket of my Mario Levi denim jacket :)
Great hack, and Nintendo were showed how incompetent they are and that they just should release the stuff with easy access or are showed off like here.
In the old days, lack of Hard and Software for doing such hacks made the systems a bit more secure. But nowadays, with all that brainpower, they couldn't stand any chances.
I still think, it would be possible to remove the decryption for easier access, but it's broken anyway. Now, all is left is to be able to run other games from a USB drive, so you would need a extension board you place there instead of the rom chip (or put a bigger chip in it). If that would work, you could put in NES game dumps and have a fully functional handheld console.
I would love to tinker with such stuff, but having time for it is an issue. I envy you to be able to do that on a daily basis 😀 Most in can do, is reverse engineer NC binary files and reimplement a generator for our company.
The Mario romhacking community is one of the oldest and the largest, with a ton of hacks on SMB1. So, my question is, is it possible to run these without loading an emulator? For example, could you load a Mario Romhack on top of Ball? I personally want to load "Super Mario Bros Special for NES", an NES conversion of Hudsonsoft's SMB Special.
Hey ich wollte auch einfach mal danke sagen! Ich kann leider nichts zur community beitragen außer die hacks nach Anleitung durchzuführen, aber ich bin so dankbar für Leute wie dich, die das möglich machen, UND erklären wie man zum Ergebnis kommt! Definitv der Wahnsinn und hat mein Interesse geweckt selbst mal bisschen zu hacken.
I wasn't planning on getting this, as it doesn't have all of those original Game & Watch games on it. But I will probably get one to have when there is a way for the regular person to be able to easily put on those MAME Game & Watch recreated games on it. Thanks.
Problem would be the savestates. If I understood him right, this is just a readable rom that can not save data because its loaded into ram and when you switch it off, it's gone.
Hi, I am trying to follow along and use this video as a guide to replicate how the encryption was broken. I am a little stuck at comparing the RAM vs ROM. I have downloaded the ram at memory addresses 0x20000000, 0x240000000 and 0x30000000, but where did you find the original (unencrypted) rom in memory? I have an original rom and I cannot find this anywhere when comparing against the ram snapshot. I have used your bitmap extraction program and I can see the frame buffer and get a nice picture of the video but I can't find the unencrypted rom. you seem to have one ram file as well instead of 3? did you just combine the 3 ram addresses into one file? but mine still seem a lot smaller in size even when combined when compared to yours. ( although I am using the Zelda version game and watch)
Surprised that, unless I missed it, you didn't cover why merely replacing the NES ROM wasn't viable. FTR, Nintendo dies an in place ROM patch to make some small alterations, and that patch would break most other ROMs.
I mentioned in another video that the ROM is patched - however patching out that patch is also trivial. However replacing the emu with your own gives you much more flexibility and you can iterate much faster without constant reverse engineering
Got my game and watch for christmas and yeah It Is limited as It Is but a nice size and I love playing mario with infinite lives and being able to turn it on and continue any time but gameboy on this thing would be amazing!!
@supdograinbarff could be. The problem was many times broken solder joints or broken lines from the cartridge plastic. They were fixable today, back then it was hard.
@stacksmashing - do you know if anyone has considered swapping the SPI flash for a Micro-SD card? The SPI protocol is the same as basic SD-card I/O. Fairly sure you could make a removable storage solution like this to store multiple games.
Couple of issues with that: - SDIO is 3.3V, so would need level shifters - A lot of microSD do not support that protocol anymore - The memory mapped mode does only work with SPI flash :)
@stacksmashing interesting, every<2GB card I've tried does support the protocol, at least using the PIC microcontroller anyway.
The level shifters shouldn't be an issue, most of the micro SD card interfaces from China have a 74lv14 IC and associated resistors to protect the card.
I have to admit that I'm not entirely sure how it could be implemented as removable storage, but certainly as bulk internal storage it could be an option.
@davegsm82 He didn't mean that the voltage levels of the G&W could damage the micro SD card, but rather they are too low to be properly registered by the micro SD card's input circuitry.
I had no idea you could get the encryption key if you know both ciphertext and part of the clear text. Does this only apply to AES-CTR? Do you think it would have been possible to hack this if Nintendo had used authenticated encryption?
I see. Does that mean that you could only replace the bytes that make up the ROMs (the cleartext that you know) in the flash? The streams differ in each block due to the counter, no? Did you later find the encryption key in the firmware dump? I also don't quite understand how this relates to iv reuse - did they not encrypt the entire flash in one go, but the ROMs independently, both times with the same key and iv and the counter reset to 0?
I think I have some serious reading to do on encryption.
@RWL2012 Are the things I concluced wrong? If so, why?
AES-CTR uses a different XOR stream for every block (128 bits) due to the counter being increased. And since he didn't have the encryption key, there should be no way for him to get the XOR streams for blocks outside of the plain texts he knows (the ROMs).
And IV reuse can only be a problem if you encrypt two different messages with the same IV. I don't see how that applies here - the Flash is one single thing to encrypt. Or did they actually have a filesystem on there and encrypt every file with the same Key & IV?
@Pesthuf All he needed was the plaintext he knew from RAM dumping - this allowed him to change the data in those areas and one was enough to get control of code execution. But sometimes there are further attacks where you can brute force specific areas, etc, so if you know something is running AES-CTR, you have abilities to flip individual bits if you know where you need to be trying to flip them. You can just flip a section until you get the right combination via some futher effect, though it might take many attempts.
@Spelter No, this wasn't a brute force attack, but were there no way to access the plain text from RAM dump, it could still be possible to execute a brute force attack on spi flash alteration (or more realistically emulating the SPI flash) assuming there is a way to automate the test cycle.
It's not possible to disable the decryption without altering the program to well, not use encryption. You have to get a copy of the program to easily alter it, unless...
You can try changing data in random places until you find where changes cause it to deviate from normal behavior/power consumption earliest. If you're lucky this is some boot code. If it is code, you can try to guess/alter the first changed instruction (it could be a branch instruction if it tends to do wildly different things when you alter the address field in it) - once you can work out part of the instruction bits you might be able to figure out some more bits of it through guessing subsets of changes and watching behavior. It's a messy game but once you get a couple instructions figured out the rest get easier because you can do some setup prior to the next instruction you're testing.
@stacksmashing I had something similar, yet quite different, when I wrote an open-source library and upload manager that works with the Philips MCI500H HiFi systems with internal HDD. They "encrypted" the album art (and just the art, not the actual music) for unknown reasons (the closest answer I got was that it was done for copyright reasons) with a repeated 4k random key that was XOR'd with the image data. I was able to write software that could read and write these files without the need of sharing or extracting the key by the end user, by including two image files, one original and one that the original firmware/software had derived from my input. XORing the two and clipping the result to the key size, at the start of the application, yielded the key without sharing it or parts of the original software.
You mentioned you were a trainer towards the beginning of the video. Could I get you to provide me with a little more information about this? Kind regards,
Why do you think Nintendo went with RDP protection level 1 instead of 2? They seem to have gone to more rep how this time to try and prevent hacks, so why not lock it down completely?
I'm not entirely sure if RDP level 2 completely disables the debug port or just additionally locks RAM, but if it disables the port, leaving it at level 1 might help them to either fix bugs in unsold stock by allowing its reflashing (very unlikely), or allows them to debug issues with the product in the field to mitigate them in a later batch (more likely). They were probably not very concerned with this device getting hacked, as it does not contain much IP that was not already shared everywhere on the internet. And also since there are no new games to buy for it, as well as no internet connection, it getting hacked would neither affect sales nor their infrastructure so wouldn't be any concern to them. Encrypting the flash was most likely just to make it not too easy to just dump the ROM, but not to affect the performance and requirements on the CPU too much.
@Benedikt I understand the idea of leaving themselves a way to debug. However, if they don't care about it being hacked, then it would make sense to me to not bother with RDP at all (leaving it at 0), so it would be easier to debig. It seems they thought putting it on 1 would deter hackers in some way. I suspect they just underestimated programmer abilities, like they did back on the Wii U, thinking indie games wouldn't sell.
so the device was hacked before it was even released. why does Nintendo even bother trying to secure these retro systems then? go out of their way to not connect the usb data pins just to annoy people because obviously it did nothing to prevent it being hacked. $50 for 2+1 games is frankly atrocious.
please, can i send you mine from spain and you do your magic? i would love to have there 1-nes punch out 2-NES bart simpson vs the mutants 3- NES super marios 1,2 and 3 and if possible also kungfu, double dragon, tetris...
@paparansen 32MB if you can source the chip, and then some more difficult soldering. I know a lot of people ask about SD card support. It’s not possible to get it memory mapped without a bunch of work and hardware modifications, however you could write a loader that loads a rom into ram but this also has limitations. We’ll see if anyone comes up with a good solution for this. Right now there is no simple way.
Hast du zwischen 3:40 und 4:10 gesagt DHL hat es zu dir geliefert? Das bedeutet du wohnst in Deutschland und bist höchstwahrscheinlich auch ein Deutscher oder? Nice Sache Dude
Eould it be possible to in stall this game list. Arcade mario bros., Game and watch gallery 3 or 4, legend of zelda, and finally Donky Kong 3. I Believe those games would be most accustomed and authentic to the unit build.
Ui, also wenn dir das nicht auffällt 🤣 Uns deutsche hören die Natives einfach am Dialekt, aber was solls, die mögen uns 🥰 (ausser bei unseren stacksmasher, der wird von einigen Firmen und Ingenieuren gehasst lol)
Perhaps it is because as already talked about in past CCC events is that all the games you want to play are already on PC and because of the dev mode you don't need to hack the console to run applications on the console. The only thing left untouched was a complete new operating system.
You didn't have a Nintendo did you? It didn't do that when it crashed at all.. This new era is strange. . Leave the old days alone.. It hurts my eyes and ears. Wiki is full of crap at times because manufacturers need to protect themselves against certain laws that have been made over time etc tax etc
I meant no harm by it, sorry you lost the bet hehe, if I didn't see it I don't think it would've been noticed, we get older we forget things right, not me. You and that particular friend must have some powerful mind bending conversations no doubt..
It just makes sense that a device with such a nice screen and powerful processor should be able to play more than a couple factory-installed games. 🤔
137 likesReplies (1)
yes it does!
3 likesI'm glad that people like you make these things and hack these seemingly unhackable things. Without people like you, we wouldn't have all these things that we use today pretty regularly. Thank you!
131 likesReplies (2)
Hacking is easy. Explaining and making a video is the hard part.
4 likes@Unknow Yes, but I'm just some random dude on the internet who knows a little HTML and CSS. Although I will admit, the video editing is very good here. I can say for certain this content is a lot better than something I could put out right now.
0 likesI can't believe how well the community has pulled together to extend this awesome device. Thanks for all your hard work!
59 likesReplies (3)
I can't believe how hands off Nintendo has been 🤣
1 like@Rose this aint anything new communities come together all the time for this stuff. Think iphone jailbreak devs, or even gaming communites. The 3ds was blown wide open to the point you could download any game from Nintendo e-shop server and they could not stop you. still works to this day. The PS1 classic was was done pretty quickly along with the SNES/NES min's and even the Mini sega.
0 likes@Larry what's your point Larry?
0 likesI'm impressed this project has come a long way. It's only a matter of time before hacked ones show up on Ebay.
16 likesThis must be the best console reverse-engineering talk ever! The game & watch turns out to be a great fit in terms of complexity for hardware hacking and homebrew!
16 likesReplies (1)
It's not a bad talk. But there are some really good ones that really break it down more. But no doubt he did a wonderful job.
0 likesI have followed your progress since day one on twitter and YouTube, Watched the live Rc3 with a great intro! Great talk, fun and informative!
23 likesGreat talk!
6 likesThere's a small mistake around 17:11 :
When you have a ciphertext encrypted with AES-CBC and you flip n bits in one of the encrypted blocks, only the corresponding plaintext block + the bits at the same indices in the next plaintext block will be corrupt. The following blocks will decrypt normally. So if you set n bytes to zero (assuming they all belong to the same block), you'd get 16 + n corrupted bytes in the plaintext.
I can't wait to see what else comes from this! My hope is to turn mine into a classic mario\nintendo\g&w item.
10 likesLoved the intro! I am not that technical, but I found this video to be very informative and well paced. Glad that you put this video together! Appreciate all the work on this even if it is more of a curiosity for me than anything else.
6 likesPeople like you survive the apocalypse. Good job.
20 likesHell yes I am so hyped on this. Working on moving into some hardware hacking, and who doesn't love pissing off Nintendo
9 likesDispite the fact that i have the technical knowledge of a potato i found this video very interesting and informative thank you!
27 likesIt has been said but, great intro! Thank you for all the hard work you’ve put in for this. No way I can duplicate the process to try this myself.
3 likesAmazing video thanks for sharing. I've been following your story since day-0 as well here, still waiting till the gadget becomes a little more available to get one. You surely piqued people's interest in this a lot (including myself), for an otherwise yet-another-meh-cash-grab device from Nintendo; hacking it, however, opens many interesting possibilities.
1 likeI wish I could give this video a thousand likes. Absolutely amazing mate! Great video! And what a community you have built around this little device. I can't wait to see more.
2 likesThat was a great presentation and summary of a lot of time and hard work invested in the game and watch. Thanks for sharing it with us and opening everything ;)
2 likesThank you for this very informative video. I've never looked into hardware hacking before, but you are a very good, easy-to-listen-to teacher.
1 likeGreat talk and amazing work! I bought one of these for my son for Christmas and had to buy myself one after seeing this unfold. I'm very much looking forward to hacking this. I'll be happy with emulation but would love to have a go at writing a homebrew game for it. As for the USB ... you just need to shrink the MiniPRO down until it fits inside the case :D
0 likesYou've inspired me to get a G&W of my own. Super excited to unlock it and use it for Nefarious Purposes, like super-low-quality DOOM
0 likesMan your videos are great, your projects are great, YOU are great ! Seriously this is really entertaining but also really instructive, your explainations are clear and understandable by what I would assume to be everybody and that's really cool ! Good job man, you have a lot of talent !
0 likesAwesome video! Very well explained and entertaining!
1 likeHands down the best CCC talk this year!
0 likesSo awesome - the content but the delivery/deck too! Thanks!
0 likesIt must kill someone to see their code ripped open and molested like this! Great work
0 likesit's surprising how many times this method works on so many different platforms. I used to have a job hacking keyless entry systems and we broken encryptions and did dumps in almost the same way.
0 likesAll the dislikes are from the security team over at Nintendo.
11 likesNintendo: Great job team, its secure, they'll never hack this.
stacksmashing: Hold my bowl of cereal.
Replies (2)
Honestly, I feel like it's more that they wanted to crank out a fun portable device on the cheap. They weren't defeated; rather, people figured out a hundred other ways to have fun :)
1 likeDoesnt seems that they put much effort into seucring it to be honest.
1 likeThis talk was awesome (I watched it during rC3).
6 likesgreat work! you teached me a lot!
0 likessuper helpful and informative video, thank youu <3
0 likesThis is insanely well written and understandable for beginners.
0 likesWould love to see how people will preserve Super Mario Maker for the Wii U (yes, the Wii U) and Super Mario 35 (the eShop download)'s online functionality after March.
0 likesgreat video be nice if we had videos on step by step and tools to use on how to flash and setup that would be ace for learners like myself
0 likesI can't wait until the RAM change is pretty much all you need to do to get it running emulators. Really the device just needs to emulate all NES and Game and Watch games and it's perfect.
0 likesI'm just going to take stab-in-the-dark, but....
0 likesHow difficult would it be to fix the usb data lines so that they work ?
(EG. soldering the data lines to the proper pins on the CPU, etc, and modifying the firmware to allow communication)
Plenty of Geek Points for you . Quite amazing what you are able to do "because you can" .
0 likesI was thinking that to use the USB plug for data purposes, the only thing needed was to wire the two data pins from the microcontroller to the USB connector, but I just read the datasheet for that microcontroller, and while it has USB 2.0 OTG capabilities, there's no pins for it in the 100-pin package version Nintendo used for the game and watch.
0 likesWhat a pity.
Just got my G&W! I look forward to snagging a debugger and start poking around.
0 likesThanks for the NOP Slide.... that's the best thing I've learned in months!
0 likesThanks for the great talk! Is there a way to wire usb data lines to MCU?
1 likeGreat work, great video, thanks!
0 likesI bought this hoping i'd be able to soft mod it. Whelp, so much for that! Its still gonna be cool pulling this from the inside pocket of my Mario Levi denim jacket :)
0 likesGreat hack, and Nintendo were showed how incompetent they are and that they just should release the stuff with easy access or are showed off like here.
0 likesIn the old days, lack of Hard and Software for doing such hacks made the systems a bit more secure. But nowadays, with all that brainpower, they couldn't stand any chances.
I still think, it would be possible to remove the decryption for easier access, but it's broken anyway. Now, all is left is to be able to run other games from a USB drive, so you would need a extension board you place there instead of the rom chip (or put a bigger chip in it). If that would work, you could put in NES game dumps and have a fully functional handheld console.
I would love to tinker with such stuff, but having time for it is an issue. I envy you to be able to do that on a daily basis 😀 Most in can do, is reverse engineer NC binary files and reimplement a generator for our company.
Somebody should make a program that makes this able to play all the old Game & watch games on this device 🙂
0 likesThe Mario romhacking community is one of the oldest and the largest, with a ton of hacks on SMB1. So, my question is, is it possible to run these without loading an emulator? For example, could you load a Mario Romhack on top of Ball? I personally want to load "Super Mario Bros Special for NES", an NES conversion of Hudsonsoft's SMB Special.
0 likeswonderful video with very detail information, thanks
1 likebest TED talk of 2020 in my opinion
16 likesReplies (2)
This isn't a ted talk?
0 likes@David yeah I know, it's just a little joke ;)
1 likeId love to see the developers reaction to your video. Im sure at some point there would be a '' DAMN IT ''. haha
1 likeHey ich wollte auch einfach mal danke sagen! Ich kann leider nichts zur community beitragen außer die hacks nach Anleitung durchzuführen, aber ich bin so dankbar für Leute wie dich, die das möglich machen, UND erklären wie man zum Ergebnis kommt! Definitv der Wahnsinn und hat mein Interesse geweckt selbst mal bisschen zu hacken.
0 likesAbsolutely fantastic!
0 likesI wasn't planning on getting this, as it doesn't have all of those original Game & Watch games on it. But I will probably get one to have when there is a way for the regular person to be able to easily put on those MAME Game & Watch recreated games on it. Thanks.
6 likesGreat presentation my man!
1 likeAwesome. I had love to get Zelda from NES into my game&watch😁👍
1 likeReplies (2)
How can i get Zelda?
0 likesProblem would be the savestates. If I understood him right, this is just a readable rom that can not save data because its loaded into ram and when you switch it off, it's gone.
0 likesAmazing video and explanation.
0 likesGreat talk. Thank you!
2 likesgreat job , great video.
1 likeThank you.
This Intro man! Love it!
0 likesAwesome talk, thanks.
0 likesHi, I am trying to follow along and use this video as a guide to replicate how the encryption was broken. I am a little stuck at comparing the RAM vs ROM. I have downloaded the ram at memory addresses 0x20000000, 0x240000000 and 0x30000000, but where did you find the original (unencrypted) rom in memory? I have an original rom and I cannot find this anywhere when comparing against the ram snapshot. I have used your bitmap extraction program and I can see the frame buffer and get a nice picture of the video but I can't find the unencrypted rom. you seem to have one ram file as well instead of 3? did you just combine the 3 ram addresses into one file? but mine still seem a lot smaller in size even when combined when compared to yours. ( although I am using the Zelda version game and watch)
0 likesSurprised that, unless I missed it, you didn't cover why merely replacing the NES ROM wasn't viable. FTR, Nintendo dies an in place ROM patch to make some small alterations, and that patch would break most other ROMs.
0 likesReplies (1)
I mentioned in another video that the ROM is patched - however patching out that patch is also trivial. However replacing the emu with your own gives you much more flexibility and you can iterate much faster without constant reverse engineering
0 likesGot my game and watch for christmas and yeah It Is limited as It Is but a nice size and I love playing mario with infinite lives and being able to turn it on and continue any time
4 likesbut gameboy on this thing would be amazing!!
great job.. too many ours spended in this project .. but work it out !
0 likesVery explanatory 👍
1 likeNice summary of your work, the GBSMB is now selling in Mexico, I think I have a nice idea for a gift to myself :D
0 likesThis just popped up in my reommended, and I gotta say... This is REALLY Cool!
1 likeI was trying to find the guide to upgrade the storage to 60MB and the discord but no luck.
2 likesLove the intro!
1 likeGreat summary! Thanks!
1 likelo digo en spanish porque es mas facil, es lo mejor que he visto acerca de hardware hacking sos mi idolo <3
0 likes0:18 that was epic 🤣
1 likeCan we have some links to the hardware required to hack it?
0 likesGood presentation ! Thanks
0 likesAmazing video!
1 likeThis channel is so underrated :(
0 likesSomething worth watching!
2 likesCan you use a usbasp or usb blaster for this?
0 likesI wasn't even born when the Nintendo 64 came out but I know the pain of having to blow out cartridges
0 likesReplies (4)
It was almost never necessary, so not much of a pain.
1 likeNintendo 64? Dude, that was Atari and NES from the 80s. With the N64, it was known how to clean it with a qtip 😉
0 likes@Spelter yeh, but my cousin's told me to blow it out which never worked. I ended up thinking that some of the games were just broken
0 likes@supdograinbarff could be. The problem was many times broken solder joints or broken lines from the cartridge plastic. They were fixable today, back then it was hard.
1 like@stacksmashing - do you know if anyone has considered swapping the SPI flash for a Micro-SD card? The SPI protocol is the same as basic SD-card I/O. Fairly sure you could make a removable storage solution like this to store multiple games.
0 likesReplies (3)
Couple of issues with that:
1 like- SDIO is 3.3V, so would need level shifters
- A lot of microSD do not support that protocol anymore
- The memory mapped mode does only work with SPI flash :)
@stacksmashing interesting, every<2GB card I've tried does support the protocol, at least using the PIC microcontroller anyway.
0 likesThe level shifters shouldn't be an issue, most of the micro SD card interfaces from China have a 74lv14 IC and associated resistors to protect the card.
I have to admit that I'm not entirely sure how it could be implemented as removable storage, but certainly as bulk internal storage it could be an option.
@davegsm82 He didn't mean that the voltage levels of the G&W could damage the micro SD card, but rather they are too low to be properly registered by the micro SD card's input circuitry.
1 likeI had no idea you could get the encryption key if you know both ciphertext and part of the clear text. Does this only apply to AES-CTR? Do you think it would have been possible to hack this if Nintendo had used authenticated encryption?
1 likeReplies (8)
You can't get the encryption key, you can only get the XOR-stream that was generated by AES-CTR - hence the need to have a unique nonce.
0 likesI see. Does that mean that you could only replace the bytes that make up the ROMs (the cleartext that you know) in the flash? The streams differ in each block due to the counter, no?
0 likesDid you later find the encryption key in the firmware dump?
I also don't quite understand how this relates to iv reuse - did they not encrypt the entire flash in one go, but the ROMs independently, both times with the same key and iv and the counter reset to 0?
I think I have some serious reading to do on encryption.
@Pesthuf yes you do :P
0 likes@RWL2012 Are the things I concluced wrong? If so, why?
0 likesAES-CTR uses a different XOR stream for every block (128 bits) due to the counter being increased. And since he didn't have the encryption key, there should be no way for him to get the XOR streams for blocks outside of the plain texts he knows (the ROMs).
And IV reuse can only be a problem if you encrypt two different messages with the same IV. I don't see how that applies here - the Flash is one single thing to encrypt. Or did they actually have a filesystem on there and encrypt every file with the same Key & IV?
@Pesthuf All he needed was the plaintext he knew from RAM dumping - this allowed him to change the data in those areas and one was enough to get control of code execution. But sometimes there are further attacks where you can brute force specific areas, etc, so if you know something is running AES-CTR, you have abilities to flip individual bits if you know where you need to be trying to flip them. You can just flip a section until you get the right combination via some futher effect, though it might take many attempts.
0 likes@Brad N So its more of an Brute Force Attack. Wouldn't it be possible to disable the AES decryption and store the ram dump onto the spi?
0 likes@Spelter No, this wasn't a brute force attack, but were there no way to access the plain text from RAM dump, it could still be possible to execute a brute force attack on spi flash alteration (or more realistically emulating the SPI flash) assuming there is a way to automate the test cycle.
0 likesIt's not possible to disable the decryption without altering the program to well, not use encryption. You have to get a copy of the program to easily alter it, unless...
You can try changing data in random places until you find where changes cause it to deviate from normal behavior/power consumption earliest. If you're lucky this is some boot code. If it is code, you can try to guess/alter the first changed instruction (it could be a branch instruction if it tends to do wildly different things when you alter the address field in it) - once you can work out part of the instruction bits you might be able to figure out some more bits of it through guessing subsets of changes and watching behavior. It's a messy game but once you get a couple instructions figured out the rest get easier because you can do some setup prior to the next instruction you're testing.
@stacksmashing I had something similar, yet quite different, when I wrote an open-source library and upload manager that works with the Philips MCI500H HiFi systems with internal HDD. They "encrypted" the album art (and just the art, not the actual music) for unknown reasons (the closest answer I got was that it was done for copyright reasons) with a repeated 4k random key that was XOR'd with the image data.
0 likesI was able to write software that could read and write these files without the need of sharing or extracting the key by the end user, by including two image files, one original and one that the original firmware/software had derived from my input. XORing the two and clipping the result to the key size, at the start of the application, yielded the key without sharing it or parts of the original software.
You mentioned you were a trainer towards the beginning of the video. Could I get you to provide me with a little more information about this? Kind regards,
0 likesWould it be possible to add a headphone jack to the Game & Watch?
0 likesPlot twist: Ninty's putting out these cheap retro consoles to evaluate the security flaws in their designs before using them in future devices.
1 likeHAHA intro was hilarious
25 likesWhy do you think Nintendo went with RDP protection level 1 instead of 2? They seem to have gone to more rep how this time to try and prevent hacks, so why not lock it down completely?
0 likesReplies (2)
I'm not entirely sure if RDP level 2 completely disables the debug port or just additionally locks RAM, but if it disables the port, leaving it at level 1 might help them to either fix bugs in unsold stock by allowing its reflashing (very unlikely), or allows them to debug issues with the product in the field to mitigate them in a later batch (more likely).
0 likesThey were probably not very concerned with this device getting hacked, as it does not contain much IP that was not already shared everywhere on the internet. And also since there are no new games to buy for it, as well as no internet connection, it getting hacked would neither affect sales nor their infrastructure so wouldn't be any concern to them.
Encrypting the flash was most likely just to make it not too easy to just dump the ROM, but not to affect the performance and requirements on the CPU too much.
@Benedikt I understand the idea of leaving themselves a way to debug. However, if they don't care about it being hacked, then it would make sense to me to not bother with RDP at all (leaving it at 0), so it would be easier to debig. It seems they thought putting it on 1 would deter hackers in some way. I suspect they just underestimated programmer abilities, like they did back on the Wii U, thinking indie games wouldn't sell.
0 likesThis is art
1 likeNice,
2 likesI'd like to see more about IoT'Devices, thks.
take your time man. make it a better system.
0 likesand no picture of your costume in the Q&A?
1 likethat was hilarious! xD
good job though, i enjoyed the talk.
i can just say,
1 likeyou are amazing
Sander Van Der Wel Game & Watch backplate needs a pull-out stand.
0 likes3:10 where he says that the SNES and NES classic use Linux
0 likesMe: WHAT THE
Great Work
0 likesBrevity is the soul of wit
0 likesYou are Awesome 👏
0 likesi wanna see someone mod sonic 1 onto the mario game and watch
0 likesReplies (1)
Already happened
0 likesmake this into a mp4 player for me lol. to put anime on .
0 likesCan you play mame games on this machine?
0 likesI thought that nintendo already given strike to video that promote nintendo hacking
1 likeso the device was hacked before it was even released. why does Nintendo even bother trying to secure these retro systems then? go out of their way to not connect the usb data pins just to annoy people because obviously it did nothing to prevent it being hacked. $50 for 2+1 games is frankly atrocious.
0 likesvery amazing
0 likesI wish I had a game and watch, I’d try hack it and put Pokémon yellow
0 likesCan I just send u mine and you reprogram it for me
0 likesLet me know you are awesome 💯
im waiting for the day we could play pokemon :/ like pokemon yellow or blue and also pokemon silver and gold
0 likesawesome
1 likeplease, can i send you mine from spain and you do your magic? i would love to have there 1-nes punch out 2-NES bart simpson vs the mutants 3- NES super marios 1,2 and 3 and if possible also kungfu, double dragon, tetris...
0 likesWhat are u doing? WHAT?
9 likesNever. EVER. Blow in the cartridge.
Replies (1)
It worked tho :P
0 likesYou can say the N word without consequences lol
1 likeWhy in the hell are those Nintendo screwdrivers not called... the TriForce, or Triforcer
0 likesReplies (2)
True!
0 likes@stacksmashing Still watching... Can it play Half-Life?
0 likesNice thumbnail, NOP slide
1 like👏👏👏👏👏
0 likeslol @ intro
0 likesWhere i can buy 16mb chip to replace 1mb any website?
0 likesReplies (1)
Digikey, Mouser & co
0 likesBut does it run DOOM properly?
0 likesWatch your back, stacksmashing. I hear Nintendo stalks people.
1 like0:17 NNNNNOOOOOOOOOOOOOOO!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1 likeWie viele deutsche ich einfach ohne es zu wissen abonniert hab, lol.
4 likesnintendo copyrighter is a synonym for homosexualist
0 likeswhat is the max flashupgrade size?
0 likesReplies (5)
16MB without significant effort. Desolder the old flash and solder a new one. Going larger is possible but requires more work.
1 like@kbeckmann how large & what kind of more work?
0 likes@paparansen 32MB if you can source the chip, and then some more difficult soldering. I know a lot of people ask about SD card support. It’s not possible to get it memory mapped without a bunch of work and hardware modifications, however you could write a loader that loads a rom into ram but this also has limitations. We’ll see if anyone comes up with a good solution for this. Right now there is no simple way.
1 likeAlso there is a 16MB flash that is compatible with the stock firmware which is interesting for some people.
1 like@kbeckmann ah ok, then we will wait and see... thank you :)
0 likeswhen u going to sell these hacked game and watch??you will make a lot of money selling these modded systems
0 likesNow this is definitely a ppggers moment
1 likeHast du zwischen 3:40 und 4:10 gesagt DHL hat es zu dir geliefert? Das bedeutet du wohnst in Deutschland und bist höchstwahrscheinlich auch ein Deutscher oder? Nice Sache Dude
0 likesEould it be possible to in stall this game list. Arcade mario bros., Game and watch gallery 3 or 4, legend of zelda, and finally Donky Kong 3. I Believe those games would be most accustomed and authentic to the unit build.
0 likesReplies (1)
And can't for get wrecking crew and Ice climer. But they are filling their spiritual ancestor when it comes to game n watch games.
0 likesvor diesem Video dachte ich, du wärest ein Amerikaner
0 likesReplies (3)
Trotz des sehr deutschen Dialekts? :)
2 likes@stacksmashing das ist mir irgendwie nie so richtig aufgefallen
0 likesUi, also wenn dir das nicht auffällt 🤣 Uns deutsche hören die Natives einfach am Dialekt, aber was solls, die mögen uns 🥰 (ausser bei unseren stacksmasher, der wird von einigen Firmen und Ingenieuren gehasst lol)
1 likeGuys plz tell me is this important? Is it a breakthrough or what guys tell me whats happpenin.... can this work on current gen?
0 likesReplies (1)
He hacked the new game&watch, it's pretty cool
0 likesNice, but a better challenge would be hack the XBox One... many years passed and defeated all hackers! ;)
0 likesReplies (1)
Perhaps it is because as already talked about in past CCC events is that all the games you want to play are already on PC and because of the dev mode you don't need to hack the console to run applications on the console. The only thing left untouched was a complete new operating system.
0 likesWhy did you blur the consoles screen?
0 likesReplies (1)
Because nintendo was mad.
1 likeI can't believe it took 2 minutes to get the video started. Please shorten your intros should be 30 seconds or less (like 10-15 is best)
0 likesReplies (1)
It’s just for the talk (and very related to the conference), otherwise I don’t do intros
0 likes1st
0 likesYou didn't have a Nintendo did you? It didn't do that when it crashed at all..
0 likesThis new era is strange. .
Leave the old days alone..
It hurts my eyes and ears.
Wiki is full of crap at times because manufacturers need to protect themselves against certain laws that have been made over time etc tax etc
Replies (2)
Lol, I had a bet with a friend that someone would say that!
1 likeIt's called having fun with something, and believe it or not it's OK to have fun :) And I did have & do have "a Nintendo" as you'd say.
I meant no harm by it, sorry you lost the bet hehe, if I didn't see it I don't think it would've been noticed, we get older we forget things right, not me.
0 likesYou and that particular friend must have some powerful mind bending conversations no doubt..
Pog
0 likes