Hey!
In the past few weeks quite some progress has been made in bringng homebrew onto the
Nintendo Game & Watch:
We now have a working, basic NES emulator running on the game & watch, a basic Game
Boy emulator, a basic DOOM as you saw in the last video, and also a base
project for others to start developing new things for the game & watch.
Now in this video, I want to walk you through the process of getting your device ready for
homebrew development: I want to show
you how you can use our scripts to backup and restore the original firmware of the device,
and how to install homebrew software on the game & watch.
I should note that all of this is not yet ready for daily use or anything: Things like
save-games, standby, and so on are not yet implemented, but we
hope that with these instructions, we can motivate others to join
the fun and help improve the software, so that eventually we have something that is
easy to install and not just for developers.
Now who do I mean by we? All the tools you'll see were built together with Konrad Beckmann,
an awesome hardware hacker from sweden, go follow him on twitter for
a lot of super interesting stuff!
Lets start with what you will need: Besides the actual game and watch unit, and also a
tri wing screwdriver, you will need an SWD programmer. Now you can
get these very cheap st-link clones, though they have a couple of
disadvantages: On the ones I tried, the reset line is not functions with STM32s, and also
they do not adjust the digital signal levels to the target voltage.
A great alternative is to get an STM32Nucleo development board, such as the one used in
my bare-metal reverse-engineering video. That board has
an ST-Link debug probe on board that you can separate from the dev-board,
and it works nicely with the game & watch. Alternatively you can also get a dedicated
debug probe, such as an original st-link or a j-link.
The scripts we built work both with stlink compatible probes as well as with the jlink.
Finally, you need a way to hook up the debug adapter to your Game & Watch: You can use
testclips, you can solder on wires or for example, like i did on this unit here,
solder on a regular 2.54mm pin-header.
The exact pinouts are linked in the description of this video. Also, as I know the question
will come: The USB port does not have its data pins connected
to the processor, and so it will not be possible to homebrew the
device without opening it up - though a couple of people are already working on USB mods.
Lets start with backing up the original firmware of the game & watch, and unlocking the processor:
To do this we have published a dedicated repository, the scripts in which make it relatively simple
to backup & restore your device. Currently they run only on Linux
& Mac OS, however if you are interested in porting the scripts
over to Windows, a pull-request is more than welcome!
So lets start: I've hooked my game and watch to a debug probe, and i've also powered it
up via USB. Also note that I have disconnected the battery.
Next, lets clone the game-and-watch-backup repository, cd into it, and lets run the first
script. This script simple does a sanity check on whether all required
tools are avaiable.
Next, lets run the second script: This script will first download a part of the tightly
coupled instruction RAM which will be required to dump the internal
flash later. Then it will load a tiny SPI flash dumper
program into RAM. That program will copy the entire contents of the SPI flash into
RAM, and then we save it to the computer. It also verifies the integrity of both dumps
to ensure that they are correct.
The next script encrypts a tiny payload and writes it into the SPI flash. As this will
modify SPI flash contents the script asks for additional confirmation. Then it
flashes the payload using our flashloader, which is a SPI flasher that runs
directly from RAM on the device.
After a couple of seconds we have to follow a short procedure: Power off the device by
removing USB power, plug it back in, keep the power button pressed and hit
return. This will execute the payload, and the script
will then load a copy of the internal flash into RAM, from where we can
dump it.
Now we have a full backup of both the internal firmware device, as well as the SPI flash
contents.
This means we able to unlock the read protection of the processor now: This will cause a mass
erase of the internal flash, and so it's the most destructive part
of the process. But as we have a backup, nothing should go wrong.
After we've unlocked the device and power cycled it, we are now able to restore the
original firmware using the fifth script - and after a short wait we are back
in business: Our Game & Watch is running the original firmware again,
but with an unlock processor!
Now we are able to flash homebrew, and we will be able to go back to the original firmwrae
at any time!
Now in the last video you already saw the basic DOOM I've ported over, in this video,
we will load a work in progress NES emulator onto the device: Konrad started
porting the nofrendo based NES emulator from the retro-go project over
to the Game & Watch, and after a couple of days we got it working quite nicely: It's
running at 60FPS, sound is working, and it's definitely already
fun to play! Savegames are not working yet, standby needs to be
implemented, but it's great to see all this heading into the right direction.
To allow you to try it out, I've also published a pre-build version of the NES emulator, including
the open-source PwnAdventureZ NES ROM! You can install it
by running the install_pwnadventure script.
We've also started porting a Game Boy emulator and some other things,
so I think we'll see quite some fun stuff in the future!
Now if you are interested in porting or maybe even writing an original game for the Game
& Watch, we are also today publishing our Hello World project:
A simple, STM32CubeMX based base project that shows you how to
write to the screen, how to read the buttons, how to play audio, and so on. So if you are
interested in developing for the Game and Watch, this is a great place
to get started!
I hope you enjoyed this video, and if you're interested in this kind of stuff, feel free
to subscribe. In a future video we will take a more technical
look at how we are actually dumping the internal flash, and what goes
into bringing homebrew to a new device. We also take a look at a couple of possible hardware
mods, for example we will replace the relatively small 1Megabyte
SPI flash, with a 16 Megabyte one!
Thanks, and I hope to see you on this channel again soon!