So recently my channel passed 100’000 subscribers - incredible, and I can’t thank you all
enough, you all have been awesome and i had a ton of fun creating content for this channel!
Now when you pass 100’000 subscribers, YouTube eventually sends you what’s called a silver
play button, a nice plaque that you can hang on your wall or sneakily put into the background
of your zoom meetings to flex on your colleagues.
But being a hardware hacker, I had a different plans: After checking whether the play button
is conductive, I wanted to use the play button to hack something.
And given this channels history, what better device to hack than the original Nintendo
Game Boy. And so today, we are going to dump the BootROM of the original Game Boy using
a silver play button! Let me show you how it works!
The setup is simple: I’ve got an old, taken apart Game Boy here, and I also put a custom
ROM that I wrote onto a flash card. And if we turn on the gameboy, we can see that it
says “Failed to dump bootrom”.
However, if we boot the Game Boy, and we use the play button and touch a certain contact
on the PCB with it, we see some glitching on the screen and suddenly some text on the
display.. Lets zoom in on this: What’s that? Instead of “Failed to dump bootrom”, the
bootrom is now getting hexdumped onto the display! The play button somehow triggered
something that let the cartridge dump the bootROM.. Lets look at what exactly is happening
here!
As you might remember from my video where we looked at the game boy cartridge protection,
the game boy bootrom loads the logo from the cartridge, scrolls it down the screen and
then verifies it.
To understand how this attack works, we have to look at what happens to the memory during
the boot of the device: Normally, the first 16 kilobytes of memory
are mapped directly to the cartridge bank 0. Any memory access to this address range
will read data from the cartridge ROM. During boot however, the first 256 bytes of
memory are mapped to a mask ROM that is in the game boy cpu. And this ROM contains a
bit of code and a bit of data, and it first loads the logo from the cartridge, then it
scrolls it down the screen, then it verifies the logo data, and then finally, as literally
the last instruction, it unmaps the bootrom from memory. Afterwards, execution will continue
on the cartridge, and if the cartridge now accesses address 0, it will read cartridge
memory, and in my case say “failed to dump bootrom”, cause it’s already unmapped.
Now if we manage to find a way to skip the unmap bootrom instruction the bootrom would
stay in memory, and the code on the cartridge would be able to read and display the bootrom!
One of the techniques that you can use to cause an instruction skip is called “fault
injection”, you might remember it from the video where I hacked the airtags: we drop
power for a very short amount of time at a very precise location, and that skipped an
instruction in the bootrom of the chip.
Now with the play button, we are doing something very similar, even though it’s much simpler
and much less precise: If we hook an oscilloscope up to the contact, we can see that there’s
a 4 mhz sinewave signal on it. And guess what: The Game Boy CPU is running at 4MHz - even
though it takes multiple cycles to actually execute an instruction. So this is the main
clock signal that controls how fast the game boy is executing! And if we modify this signal,
for example by connecting the play button to it, or, much easier, by scratching it with
a grounded jumper wire, we are corrupting that clock signal!
And just like with voltage glitching, corrupting that clock signal can cause the CPU to skip
instructions. This is called clock glitching, and we will look at some more complex examples
of this in the future.
Now by hand we can’t really control well how many instructions we are skipping, and
often the game boy will just crash or reset. However, we can make it more likely to work:
If we use the regular GBDK settings, our code will be at the beginning of the cartridge.
So the bootrom will execute, and then run directly into our dumping code.
If we try to glitch this, chances are high that we will jump to somewhere in the middle
or even behind our dumping code.
If we move our dumping code to the end of the cartridge memory, and then fill the whole
space in between with NOPs - instructions that do nothing, we can jump to anywhere in
the NOP area, and then just slide into our dumping code. And that is exactly what my
cartridge does, you can find it - and its code - linked in the description.
Now I did not come up with this approach - in fact it’s quite well known in the game boy
hacking community. I first saw it in Gekkio’s awesome talk at disobey 2018, but apparently
the jumper wire approach was discovered by BennVenn in 2014, and even before that, in
2008, costis glitched the super game boy to get its bootrom using an FPGA.
Before that, Neviksti used a decapped game boy cpu and a microscope to literally read
out the bits from the mask ROM.
Now thanks again for all the support, and I hope you liked this somewhat different approach
to a 100000 subscriber special!
I hope to you see on this channel again soon! Thanks!