Gameboy Color Boot ROM Dumped After 10 Years
An anonymous reader writes "Costis was able to dump the elusive boot ROM from the Gameboy Color by using various voltage and clock glitching tricks. The boot ROM is what initializes the Gameboy hardware, displays the 'GAMEBOY' logo and animation, and makes the trademarked 'cling!' sound effect. Even decapping the CPU had failed previously, but now the boot image and specifics on how it was dumped (along with many photos) are available for download."
...win 7.
because otherwise this is a puny attempt at resurrecting obsolete tech.
Smile, don't click...
I really love reading about the lengths enthusiasts go to when trying to do this kind of thing. For some reason I had assumed that this had been done already since there is already emulation for gameboy color, right? Can someone explain the significance of this development?
So I took a stroll through the binary and here is what it does in a nutshell.
- Catch the wake interrupt
- Resent the CPU
- Power on the LED
- Power on the LCD
- Power on the audio codec
- Copy the Nintendo graphic to VRAM
- Play the Clang WAV
- Initialize the buttons
- Copy game binary to memory
- Jump to game image
I have just one question - Why?
Here's my summary of how he did it, since the linked blog posting is quite long:
When the Game Boy Color powers up, a small internal boot ROM is enabled inside the CPU. This displays the logo, verifies that the game ROM is "genuine", then starts executing it. Just before it starts executing user code, it disables the boot ROM by writing to an I/O register. Once disabled, there is no way to re-enable it, thus user code can't easily read the ROM.
Costis found that if he stopped the CPU clock for a few seconds, then restarted it, many of the CPU registers (including the program counter) would take on random values. So he placed NOP instructions in all external memory, along with a small dump routine, then stopped and restarted the clock just before the boot ROM wrote to the I/O location to disable itself. This caused the program counter to take on a value outside the boot ROM, and execute all the NOPs until it hit his small dump routine.
This reminds me of the epiphanic moment during the garage scene in Primer:
"I did not remove any of the bypass caps on the mainboard for the 3.3V rail and it seems like a few seconds are actually required for the internal logic to discharge appreciably (anything less and the system continues running just fine afterward.)"
Why a few seconds, why not an exact time?
Why can't you just take the rom chip out of the gameboy, put it in a socket on a computer and just read the rom 1 byte at a time?
I am just a software guy, with no real lowlevel knowledge of hardware, but I would think you could just take the chip out*, solder the legs from the rom chip, on any kind of socket that take a rom chip, and then just read it from there. But I guess there is a reason you can't just do that. So what reason is that?
*Might take som magic, but when thinking about how the *&#*$ surface mounted chips serial/io chip were changed on the Amiga 500, it can't be that impossible.
Isn't it because the CPU and ROM are together in an ASIC package and the ROM can't be accessed directly externally through the pins? I could be wrong. If the ROM is a seperate chip then I've no idea why you couldn't do this.
Great, been waiting for that for ages. So now we might finally get those original GBC colors for GB games in emulators (and especially the coloring for Metroid 2!). For reference, if anyone is interested, here's the story how the original GB ROM got dumped by decapping the chip holding it and reading out the values with a Microscope: http://www.cherryroms.com/forums/copier-and-hardware-forum/manually-extracting-rom.html?page=2 (two thirds down the pge, the post by nevikisti from Wed, 05/18/2005 - 10:26). Thread itself deals with how they tried to dump the SNES DSP1 chip, but ultimately failed to do so. Currently there's some effort underway by the creator of bsnes to do the same thing: http://byuu.org/
Does this mean that we will be able to colorize Non-Super Gameboy Game Boy Games?
When a Gameboy Color starts up with a Super Gameboy boy game is put into a Super Game Boy, it uses the Super Gameboy Palette with the border that would normally be used on a TV omitted.
Examples of this:
Pokemon Red/Blue/Yellow
Donkey Kong
Alot of people thought that Pokemon games were Gameboy Color games, and some are, like Pokemon Crystal, but alot of the games are actually Super Gameboy Games.
Classic Gameboy games such as Tetris, Super Mario Land, and Metroid II had no colorization, so the Gameboy color and Super Gameboy would color them based on an alogorithm. No emulators exist that can colorize a non-Super Gameboy game. They are displayed in Gray Scale.
My question is, will the dumping of this Bios lead to a better understanding of how Non-Super Gameboy Games are colorized on the Game Boy Color?
Or Super Mario Bros ... wasted ...
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
"Copyright 2009. Costis Sideris."
So copyright law is good enough for you, but not for Nintendo?
This is a perfect example of useless, wasted effort.
I agree, you should have posted on Digg instead.
I care.
There are many great games for gameboy color, I had a gbc and about 10 games, but I haven't been able to play them for a while becuase I lost my GBC. I want to re-play them again some day.
Sure, this rom isn't needed for re-playing them, but its also a bit of preserved history. Thats one of the main reasons for dumping roms, its not all about piracy, its preserving a bit of history for future generations.
Posted by a Debian GNU/Linux user
GBC Boot ROM dumped? After 10 years?
It's more likely than you think.
I think he will suddenly have a lot of spare cash to spend on beer and hookers...
Son.. You're old enough now to become a.. Pokemon master!
We spent year reverse engineering the technology, but now you can become a Pokemon master thanks to advances in modern pirate technology.
Change is certain; progress is not obligatory.
GBC Boot ROM dumped? After 10 years?
It's more likely than you think.
Can you play Centipede on it? :-)
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
I'm just wondering when he's going to receive his DMCA takedown notice.
Oolite: Elite-like game. For Mac, Linux and Windows
This is also an interesting development because Costis achieved the same goal as the decapping of the original GameBoy CPU, but with vastly cheaper equipment (< $100) and probably in less time (< 1 week).
Glitching is a neat technology; it's most famously used by "card unloopers" for smartcard hacking, and is also used by modern Wii modchips. Travis Goodspeed gave a neat presentation at DefCon 2009 about glitching, and has released some open-source hardware which will eventually support glitching target microcontrollers. Given the right software, that board alone would probably have been enough to perform this hack.
get a GBA (or SP but not micro). the GBA played all previous GB, GBC and GBA games.
Somebody scream: DMCA!
What!? CHILD is evolving!!! CHILD evolved into...PERMAVIRGIN!
Ding dong doooong! Da da da da da dee da!
"When information is power, privacy is freedom" - Jah-Wren Ryel
..that nobody from the original company leaked the information in the interim. What kind of scary NDA do they have?
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
oh Fuck me! I just chocked on my cigarette!
hahahahaha, thanks for the laugh!