8-Bit Wonderland. Executing custom Code on the Nintendo Game Boy. Belial

Size: px

Start display at page:

Download "8-Bit Wonderland. Executing custom Code on the Nintendo Game Boy. Belial"

Brent May
5 years ago
Views:

1 8-Bit Wonderland Executing custom Code on the Nintendo Game Boy Belial

2 Table of contents 1 Fade In 2 Hardware 3 Software 4 Injection 5 Fade Out Belial 8-Bit Wonderland 2 / 36

3 Kickstart Belial 8-Bit Wonderland 3 / 36

4 Motivation Game Boy is well documented but the documentation is spread on the internet Simple architecture and good starting point to learn hardware development Cheap general purpose 8-bit device Fun :-) Belial 8-Bit Wonderland 4 / 36

5 Technical Details Presented in 1989 for the first time CPU: 8-bit (similar to the Z80 processor) 16KB physical RAM Games come on special cartridges containing a ROM and using 5 Volt 160x144 LCD-Display 4-Channel Sound Chip Serial Port Belial 8-Bit Wonderland 5 / 36

6 Memory Layout 0xFFFF 0xE000 0x8000 I/O Ports, Registers,... Internal Main RAM External RAM Internal Video RAM Upper ROM Region (Bank Switching) Lower ROM Region 0x0000 Belial 8-Bit Wonderland 6 / 36

7 Memory Layout 0xFFFF 0xE000 0x8000 I/O Ports, Registers,... Internal Main RAM External RAM Internal Video RAM Upper ROM Region (Bank Switching) Lower ROM Region 0x0000 Belial 8-Bit Wonderland 6 / 36

8 Memory Layout 0xFFFF 0xE000 0x8000 I/O Ports, Registers,... Internal Main RAM External RAM Internal Video RAM Upper ROM Region (Bank Switching) Lower ROM Region 0x0000 Belial 8-Bit Wonderland 6 / 36

9 Bus Introduction Arbiter Slave 1 Slave 2 Master 1 Master 2 Databus Adressbus Belial 8-Bit Wonderland 7 / 36

10 Game Boy Bus Cartridge (Slave) Data 8 16 Adress CS RD WR Game Boy (Master) Belial 8-Bit Wonderland 8 / 36

11 Game Boy Bus Cartridge (Slave) Data 8 16 Adress CS RD WR Game Boy (Master) Belial 8-Bit Wonderland 8 / 36

12 Bank Switching Game Boy maps only 32KB ROM into its memory Game Boy has only 16KB RAM Game Boymaps maps only 8KB external RAM into its memory Problem: What if we need more ROM and RAM? Solution: Bank Switching Belial 8-Bit Wonderland 9 / 36

13 Example: Bank Switching with 4 Banks 0xFFFF Game Boy Memory ROM on Cartridge Bank 3 0xFFFF Bank 2 0xC000 0x8000 Upper ROM Region (Bank Switching) Bank 1 0x8000 0x4000 0x0000 Lower ROM Region Bank 0 0x0000 Belial 8-Bit Wonderland 10 / 36

14 Complex Cartridge complex cartridge RAM with several Banks ROM with several Banks Battery Memory and Bank Switch Controller Game Boy Belial 8-Bit Wonderland 11 / 36

15 Simple Cartridge simple cartridge ROM with 2 Banks Game Boy Belial 8-Bit Wonderland 12 / 36

16 27C256 Belial 8-Bit Wonderland 13 / 36

17 27C256 Pin Layout Pin Name Description 01 OE Inverted Output Enable 07 VCC +5V Power Supply 08 VPP Needed for programming the EPROM 21 VSS Ground 27 CE Inverted Chip Enable 2-6, 9-17, 28 Address Bus 18-20, Data Bus Belial 8-Bit Wonderland 14 / 36

18 27C256 Pin Layout Pin Name Description 01 OE Inverted Output Enable 07 VCC +5V Power Supply 08 VPP Needed for programming the EPROM 21 VSS Ground 27 CE Inverted Chip Enable 2-6, 9-17, 28 Address Bus 18-20, Data Bus Belial 8-Bit Wonderland 14 / 36

19 27C256 Pin Layout Pin Name Description 01 OE Inverted Output Enable 07 VCC +5V Power Supply 08 VPP Needed for programming the EPROM 21 VSS Ground 27 CE Inverted Chip Enable 2-6, 9-17, 28 Address Bus 18-20, Data Bus Belial 8-Bit Wonderland 14 / 36

20 27C256 Pin Layout Pin Name Description 01 OE Inverted Output Enable 07 VCC +5V Power Supply 08 VPP Needed for programming the EPROM 21 VSS Ground 27 CE Inverted Chip Enable 2-6, 9-17, 28 Address Bus 18-20, Data Bus Belial 8-Bit Wonderland 14 / 36

21 27C256 Pin Layout Pin Name Description 01 OE Inverted Output Enable 07 VCC +5V Power Supply 08 VPP Needed for programming the EPROM 21 VSS Ground 27 CE Inverted Chip Enable 2-6, 9-17, 28 Address Bus 18-20, Data Bus Belial 8-Bit Wonderland 14 / 36

22 First Homebrew Cartridge Prototype Belial 8-Bit Wonderland 15 / 36

23 Second Homebrew Cartridge Prototype Belial 8-Bit Wonderland 16 / 36

24 ROM Header Layout 0x150 0x14D 0x134 0x104 0x100 Complement Byte Cartrige Type Informations Nintendo Logo Entry Point 0x060 0x000 Interrupt Entry Points Reset Entry Points Belial 8-Bit Wonderland 17 / 36

25 Interrupts V-Blank LCDC Status Timer Overflow Serial Transfer Completion High-to-Low of P10-P13 Belial 8-Bit Wonderland 18 / 36

26 Boot Sequence 1 Start internal boot ROM 2 Load Nintendo logo from cartridge and display it 3 Load Nintendo logo again and compare it with internal copy and execution if unequal 4 Add all bytes in cartridge between 0x134 to 0x14d. The sum is increased by 25. Stop execution if unequal to 0. 5 Start the game. Belial 8-Bit Wonderland 19 / 36

27 Vsync Display Content VSYNC Scanlines Pixel Belial 8-Bit Wonderland 20 / 36

28 8x8 Tile Line 1 Line 2 Line 3 Line 4 Line 5 Line 6 Line 7 Line 8 Belial 8-Bit Wonderland 21 / 36

29 Single Line of a Tile 0x00: x01: Belial 8-Bit Wonderland 22 / 36

30 Tiles in Memory Tile Data Table: Contains the tiles (16 byte per tile). Different tables for backgrounds and sprites. Background Tile Map: Tile numbers which refer to the TDT. Background Tile Map is displayed as background. Object Attribute Table: Is organized in so called blocks. Each blocks has a size of 4 bytes and consists of a tile number (refers to the sprite TDT), X and Y coordinate on screen and one byte for its attributes. Belial 8-Bit Wonderland 23 / 36

31 GBDK Open Source Project Ansi C-Compiler, Linker and Assembler APIs to access every hardware component Creates valid header with checksum, nintendo logo, etc. Belial 8-Bit Wonderland 24 / 36

32 Coding Guidelines Initialized global variables are located on the ROM. Uninitialized global variables are located in RAM and writable. Use 8-bit unsigned variables whenever possible. Avoid multiplication, division, modulo and floating point variables. Belial 8-Bit Wonderland 25 / 36

33 Case Study: Pong Clone 1 Disable display and interrupts. 2 Load sprites from ROM into VRAM TDT. 3 Enable display and interrupts. 4 Sleep until vertical synchronisation phase. 5 Game Logic 6 Update sprite positions on the display. 7 Goto 4. Belial 8-Bit Wonderland 26 / 36

34 Case Study: Pong Clone Demonstration Belial 8-Bit Wonderland 27 / 36

35 Introduction Modify an existing ROM Hide information in the ROM (Steganography) Information is displayed when key combination is hit Idea 1: Hook Interrupt Service Routines Idea 2: Modify ROM entry point Belial 8-Bit Wonderland 28 / 36

36 Injection Workflow 1 Consists of two parts: Injector and Payload 2 Allocate empty space in a ROM file 3 Patch org instructions in Payload asm source code 4 Ask user for secret message and copy it into the Payload source code 5 Assemble the Payload with TASM 6 Patch the ROM file and copy the Payload into it Belial 8-Bit Wonderland 29 / 36

37 Fix source code before injection.org $7B0F ld sp,$fff4 ; Create the Stack ld a,% ; No IRQs at all ldh ($ff),a... Belial 8-Bit Wonderland 30 / 36

38 First Attempt: Hooking Interrupts Before After Injected Code Gamepad Interrupt Game Game 0x150 0x150 Rest of Header Rest of Header 0x100 0x100 0x060 0x000 Gamepad Interrupt Reset Interrupts 0x060 0x000 Hooked Interrupt Reset Interrupts Belial 8-Bit Wonderland 31 / 36

39 Second Attempt: Entry Point Modification Before After Injected Code Old Entry Point Game Game 0x150 0x100 Rest of Header Entry Point 0x150 0x100 Rest of Header New Entry Point 0x060 0x000 Reset Interrupts 0x060 0x000 Reset Interrupts Belial 8-Bit Wonderland 32 / 36

40 Code Injection: Demonstration Demonstration Belial 8-Bit Wonderland 33 / 36

41 Conclusion Technical details about the Game Boy Modify an existing cartridge to execute home brew code Create our own home brew cartridge Developed with C a Pong clone which runs on the Game Boy Inserted code into an existing ROM Belial 8-Bit Wonderland 34 / 36

42 Further Work Sound Maybe Demo stuff Encryption Complexer cartridges Belial 8-Bit Wonderland 35 / 36

43 Questions Mail: Paper with all references and detailed description Beamer Slides All example programs (Pong, Injection,...) Homebrew cartridge Eagle layout Belial 8-Bit Wonderland 36 / 36

Dante Gonzales and Ian Doten

Dante Gonzales and Ian Doten Overview History Game Boy and Game Boy Color Specs CPU architectures Intel 8080 Zilog Z80 Sharp LR35902 Sharp LR35902 in depth Changes from the Z80 to the LR35902 Memory Cartridge