Hacking the Game Boy cartridge protection 

amazing work and great video !

I actually wondered back then, why they didn't develop that bootup logo with variations or animation from the game or "presented by Pepsi cola" etc

That awkward pause at the end to reach the advertisable video length ;)

This is wonderful. Thank you for posting it. I'm really stunned with how far FPGA boards have progressed. I hope you release the GB cartridge soon! My son has been fascinated since I showed him how we can use my oscilloscope to sniff the datalines of the SNES controller bus in real time. This led into a discussion of different pin types and how we could sniff other types and how you might glitch them. This is perfect because I can setup a bread board to branch off from my Super Game boy.

I always wondered why the logo was blank if you didn't insert a cartridge.

Gotta love it when you can't wait for a PCB to arrive, so you just go and make one... And then design the PCB anyway, and release it for others! Nice!

it will be perfect for gameboy's re-shells that has "game girl" on it.

Clever license protection, for its time.

Name dropping MVG? Instant subscribe. This was interesting too. I sort of knew this but didn't realize how simple it was.

They could've multiplexed the first 8 Address lines to behave as Data Lines sometimes, you'd only need an 8-bit latch to hold the address before a data read or write. That's how the old 8086 CPU worked, still a pretty cool workaround to having 8 extra pins.

Whenever I receive a notification that you have uploaded a new video, I immediately stop whatever I was doing and sit to watch your video. What an awesome work. Keep up the good work! ✌❤

Nintendo lawyers from the 90's enters chat. This is really fascinating haha, great vid!!

I am looking forward to more beginner Ghidra tutorials from you on your channel, they are very helpful!

Quickly becoming one of my favorite youtube channels. This guy is going places!

You are just amazing... You make it so much easier to understand how games and their consoles work together. Ive always had an interest in programming and hacking and with your knowledge and great explanations I'm able to move forward with my own projects.. Thanks and awsome videos.

every video i watch just blows my mind. its like decades of thinking 'what if', what if i got into this stuff and was good at it, what would it look like...? your videos are like painting the experience to my imagionation. Very satisfying. To see all this stuff is just incredible. I notice all the places I would have probably got stuck (so many times) and it just blows my mind. not to mentioned the quality of your editing. you are epic bro

Mistakes Were Made - How the Gameboy copy protection was defeated

This guy has some serious engineer skills... I'm amazed!!!

I’ll be completely honest. I have no idea what any of this really means, but I’m just fascinated by the technical jargon and seeing how things work, and you actually have a pretty chill voice, too, so I’ve subscribed. ^_^

Came here from the MVG video on the GB bootloader, this is awesome. I look forward to watching your other videos! :D

Incredible, never knew they already made this technique inside the gameboy

That was a clever way of copy protection! Really interesting video, well done!

Remarkably simple. This is an excellent entry point for anyone looking to get into hardware hacking. Great video! 👍

i dreamt about doing things like this since when i was a kid. this fueld my interest and carrer significantly. thanks, gameboy.

That is pretty in-depth and awesome information. Great video!

Sehr interessantes und informatives Video! Super cool wie solche Technik früher funktioniert hat

This is very awesome, would love to see something similar for the game boy advance

That was very informative and a good presentation. Well done!

Nice work there! I was watching this with pleasure, thanx for that!

Love the vid awesome work. Just binge watching all your vids

Nice Hackers reference with "Hack the planet" on the PCB at the end

That is really interesting. I always enjoy learning new things about old tech!

Wow, that's really easy to extract a cartridge rom. Thought it would be more difficult than just a parallel read after seeing the Snes protection.

I would happily watch a few ads to help encourage you to make more videos of this type. Your skills are insane 👍

You are an inspiration, I'm a small tech youtuber doing some videos on the pi, IT career tops etc.. love your content man.

I want 1 video every day, I enjoy this more than all animes

Even though I wouldn’t take the time to do this, I love watching.

Imagine bringing one of these back to the 1990s

Great content man. Keep it up! 👍🏻

amazing job! thanks for sharing your findings

Excellent content as usual!

should've replace "Hacked" text into "Hello World"

For the level shifting, it may be a better idea to use IMO level shifting chips with external direction control like SN74LVC16T245 for the address and signal lines. Those chips needs control signals, but thise can be derived from the CS, RD and WR pins using some 74LVC1Gxx logic. This means for the target board it can be directly connected without the need of level shifters, and since those SN74LVCxxT245 chips contains line redrivers, you can even run longer wires with little ill effects. Also you can include an op amp like LMV321 to buffer the audio line, basically also a redriver.

Li Cheng Industries-published Game Boy games has the Nintendo logo modified to read "Niutoude".

It's a little harder for the user and more expensive, but it's possible to load one game's Nintendo logo by inserting its cartridge, turning on the console, and swapping it with the hack game. This also makes it possible to boot into worn down games to see what actually happens there. I tested it myself by inserting 007 Nightfire, turning on my DS, and swapping it with MKSC. I know it's GBA but all 3 consoles in the Game Boy family have the same boot screen function, but the graphic and sound effect are different for each model (minus the GBA's backwards compatibility).

Even If I don´t understand too much about this. It´s quite satisfaying to watch this videos.

The breakout PCB looks useful, looking forward to the gerbers being released :)

This was inspiring. This was fascinating.

This is the kind of content I crave.

Good channel, with great content. Keep up the great work.

as always great video, thank you sir

Some days ago I bought the gamboy cartrdige breakout port and I want to build something similar to this. I am a newbie with this kind of projects and I have a doubt about the forwarder: do you synchronize in some shape or form the FPGA clock and GB one? Thanks for these amazing videos!

This is really cool, but what is the practical use of this? Do you plan to get into GameBoy homebrew game development? It would be really cool if so.

Such an amazing video! Instant subscribe.

Analyzing the video, I came up with another idea that would have been possible with technology of the day. Since you mentioned the presence of a 1mhz clock signal, you could power a very small microcontroller that could just count cycles and since the boot process always takes the same amount of time , swap the hacked logo bank and the original one based on said counter. And it could be a very small additional ROM just mapped to the address.

A lawsuit in the early 90's removed the legal underpinnings for this sort of usage of trademarks as a form of copy protection. lookup Sega vs. Accolade for more info. Accolade published unlicensed games that used Sega's copy-protection code including the part that displayed the Sega logo. A court eventually ruled that the code usage was fair use and Sega's act of requiring display of a trademark for a game work was an "improper use" of trademark because it served to limit competition which is the function of patents and not trademarks.

This video is amazing! Good job!

This was also leveraged by Sony on the PSOne, not the original Playstation that had the wobble track copy protection but the later version, the small one. The original one displayed whatever logo the disc had, the PSOne checked against a ROM stored logo and if they didn't match, the console didn't boot the game.

Interestingly, a similar hack was demonstrated by Argonaut Games to Nintendo. Normally this would've ended up in a lawsuit, but Ninty was reportedly impressed by it that Argonaut became one of their partners, eventually culminating in _Star Fox_ for the SNES.

Fantastic & inspiring video!

glad to hear you bypass the nintendo logo !! ...

Reminds me of how the AIM protocol used to request a CRC of a random range of bytes from the official AOL client, making it very difficult for a third party client to use the protocol without bundling or referencing the copyrighted client exe.

this knowlegde is awesome! congratulations and thank you for the video! ;-)

I have a Mega Memory cartridge (onto which you can backup game saves) and unless used on a Game Boy Advance, it says "Megamem" instead of Nintendo but it still runs fine! There's also a Smartcom personal organizer cartridge that says Smartcom instead of Nintendo but still boots fine (although I've heard it's not compatible with the Game Boy Advance) and Rocket Games' unlicensed Game Boy Color games say ROCKET instead of Nintendo but again they still run fine!

i wonder if it could be done without a fpga by using a second ROM that contains the logo and when the GB is turned on, the modded ROM starts until a few ms later and switches to the original ROM before the second logo read happens. or (if the ROM is only filled halfway, basically having addr bit 16 allways 0) putting the logo at 0x8104 and flipping bit 16 x msec after turning on/first read.

Nice work. You could simplify the FPGA code slightly by just replacing the logo address range during the first read, and otherwise just always return the original ROM data. After all, the ROM already contains the correct logo.

Your Channel is just awesome!

Super cool video, thank you!

There was a game back in the day that did this, but I don't remember which. You can definitely achieve this effect with discrete logic though.

A project I may work on once I finish my senior design, would be to make a similar cartridge but build an FPGA onto it... may be a fun way to mess around with verilog and some game boy stuff.

Every single concept of this video is pure gold... Yes, even the comments.

Very interesting video. Since he still stores the nintendo logo in memory, would it still be considered illegal? Even though the logo isn't showed.

You might want to have a look at the SACHEN cartridges. They were released in the 90s and showed their logo while booting. And they somehow worked just fine.

You can use an ice40 fpga or one of those chinese $5 fpgas for the cartridge. It's also possible to load the binaries of a game to the internal block ram of the fpga. Or if you're feeling adventurous, add a microsd card slot in which you can read from the fpga.

Love these videos!

Collaboration between two wonderful engineering channels, amazing. Shove a CodeBullet or CodeParade in there too!

Dude you have earned my subscription

That is the coolest thing I've ever seen!

Read all the comments and no mention of the "Mega Memory Card" for GB - that displayed a "MegaMem" logo on boot.

Very nice video. Thanks for that. May I ask which tool you use to make those animations? like when the numbers fit in the logo or the flowchart drawing?

Hmm ... would it be possible to make a YM3812 cart that uses the audio pin to play Adlib music? It'd be neat to play FM synthesis tracker music on the gameboy.

Thank you very much. I am so interested in this topic, yet not by myself. Is there a way to meet up with people to endeavor on topics like this?

I already asked you about this but since now you team with the big boy aka LiveOverflow do you think you can reverse engeneering Bosch E-bike motors ?

This is impressive but couldn't you just have two ROM chips, an SN74S08, and an SR latch that feeds into a transistor that flips the chip select between the ROMs each time you try and read 0x0133? So you'd start with a hacked ROM, read the logo in up to 0x0133, route the relevant address lines through the SN74S08, trigger the SR latch which would then switch the transistor and changes the CS line over to the genuine ROM? It sees like a lot less hassle than building a full FPGA setup?

This was an amazing video!

Nice Hackers reference on the breakout cart ;)

I'm really into all this stuff. If I wanted to learn about this kind of hacking to do as a hobby what kind of information should I study or read?

I'm jealous of your knowledge, what is your academic background?

This is just the kinda stuff I love to watch. A question though, is all the tooling for that particular FPGA board you have closed source? I've seen that stuff like PlatformIO has FPGA boards listed, but I don't know to what extent it operates with them.

Is this something that would have been feasible with 1990s hardware? I would imagine that it would be a lot harder to set a conditional on first read/second read of the logo at the time. Any ideas on how that might have been accomplished?

So the cartridge "protection" works just like in the Mega Drive? Interesting video by the way!

So much effort in this video.

It only took 31 years, but it has finally been done.

Hack The Planet! Hackers is such a great movie!

Excellent work. You are genius.

I have actually been working on a similar project A GameBoy cart with an fpga on it, and wanted to use the same level shifters, good to know that they are a little problematic. What exactly is the problem though with them? do you have any details?

making a mechanism to be able to sue people more easily instead of actual copy protection is one of the most nintendo things nintendo has ever done

You presented this very well and kept it simple, tidy and interesting. Great job :)

You guys have a lot of spare time in your life