Hacking the Nintendo Game and Watch
ฝัง
- เผยแพร่เมื่อ 13 พ.ย. 2020
- Why is this censored: Got copyright claims on it otherwise.
I got lucky and received my Game and Watch Super Mario Bros. one day early - and immediately started hacking it! In this video we will teardown the device, take a look inside, and find how we can put our own, customized ROM onto it!
Resources:
- Twitter: / ghidraninja
- Twitter thread: / 1326855097083686917
- Game and watch scripts:
github.com/ghidraninja/game-a...
- STM32H7B0 Reference manual: www.st.com/resource/en/refere...
Also many thanks to SciresM ( / sciresm ) on Twitter from telling me that ... basically exclusively uses AES-CTR! - วิทยาศาสตร์และเทคโนโลยี
Can't wait to play Doom on it.
Or Super Mario 64
@@matiytpopin14 nes emulator cant run it
With only 128KB of storage that is very doubtful.
This is Nintendo, I think Wolf 3d was the most violent game they had.
Most STM32 MCUs are perfectly capable of running Doom. You can even replace Mario with Doom on this one, should not be much of a problem. But you will never be able to put Mario back again.
The USB port being power only is disappointing. Funny though, because now Nintendo can’t even put out an update to correct their language blunder.
I... Don't think it even connects to the net
@@IVChan Exactly. So the logical solution would have been to do it ‘the old fashioned way’, eg. Hooking up to a PC via USB. But this is not possible, so all Nintendo could do is make a public apology.
Okey
Funnily enough Nintendo has once again helped scalpers and the second-hand market. I assume now those 1st gen G&Ws with the "language glitch" will be a hot commodity when they replace them with the fixed batch on store shelves, stock up now
@@applchu : Do you really think they will make a second batch? This is a limited edition item which will stop being sold in March, so there won't be a second batch.
Nintendo thought they were being crafty making the usb port power only.
Only to make a language error in the firmware that can't be updated because of that.
Probably because how easy it was to load ROMs to the NES Mini and SNES Mini ;). So this time it is a real treatment.
@@NavidErde I mean yeah, that' a typical Nintendo move, but why should they care? You can play those games without much effort on almost every Device with customizable OS.
Instead they should be happy that their community is so cool and wants to make Homebrew and stuff. But big companies don't get that. Because of Piracy, it's understandable but in the end the sufferes are the good people who pay for the games while the pirates hack it anyway even if it is a Playstation with a badass(not a fan tho) encryption.
@@NavidErde In the SNES version there was a message from the original developers. So they knew about the hacks but didn't (care?) do anything about it. Wish they didn't make the usb port power only, I don't have the tools for this.
It's the chip
Xbox: super powerful fridge
PlayStation: next gen internet router
Nintendo: 1985
If you're going with a theme wouldn't Sony be gynormous internet router?
@@ignignxkt ok
PS5 is designed using Chad Warden as a base
@@Kabodanki ok lol
Instead of ruining my comment I’m just gonnna say y tho
Me watching this whole video despite knowing none of these technical words:
“I like your funny words magic man!”
Same here
He sounds german too, it only makes it sound more dramatic.
Lol
I was going to say something similar lol
I came to say the very same shit
- The usb is only for charging.
+ Hold my ARM debug probe.
cpu suports usb dfu booting some time and someone will hack it to reflash via usb
@@vampirwrr it would still need hardware mods, since the usb data pins aren't physically connected to anything
Awesome breakdown of this all! 🙂
Love watching youtubers support each other.
Hi Mario!
I cant belive people keeps hacking almost every game console that releases
I modded a 1970 handheld football game to play PSP games I am your God nerds kneel before me
Legend. Loading NES and G&W roms on this would be great!
You guys work much faster than Rule 34 artists
You see comrad, when it not come out you still hack!
r1337: if it exist, it can (and will) be hacked
@@Valery0p5 time to hack my abacus
@@Valery0p5 🐐
What's rule 34 artist? 🐐 Hackers?
This is very cool, can't wait to see more videos about this little thing.
Please post more often, I'm sure this will be great!! (2min ago and I'm straight here)
Man, disappointing the data pins aren't hooked up on the usb port. I was really hoping this could turn into a neat easily homebrewable little handheld.
Meh.. the lack of buttons makes it not very practical to hack and put more NES games on it. No start and select buttons make it so most NES games won’t even be able to start. These Mario games were modified for this system to use A and B as start and select. Regular roms won’t work the same.
@@dewinter1411 the zelda one has a start and select and is hacked too already
@@dewinter1411the Mario one uses the top buttons for start and select. This is a perfect pocket emulator.
Very elaborate stuff! I would love to be able to run the GB G&W Gallery 1-4 games on this, just to keep the G&W theme going on and have a dedicated system to G&W games only!
yeah with a big "SUPER MARIO BROS." header on it
@@beesree39Sorry it wasn't written in an obvious way. I meant to say you keep the packed in games too as they are sold, but add only the G&W gallery games to also make it a dedicated G&W system. I personally wouldn't add any other type of game on here other than these!
@@Keiffer01 that's not what I said
I would personally add Game and Watch roms.
I think we must be patient.
Soon there will be a way to make this gizmo a super cool G&W all in one emulator.
stacks: *explains everything carefully*
me not understanding a goddamn thing but thinking its awesome:
lmao same
Count me in
Indeed, that is God-level stuff for someone like me lol
OH MY GOOOOOD
WOOOW
Yeh same i have no clue if what he is saying
I am so excited to hopefully get this. I heard about what you achieved and I’ve been looking out for this video for a while! Well done!
damn dude you're awesome for breaking this down for us. hope you're getting the credit you properly deserve
After studying EE and about 3 years of experience, it made me happy that I understood 99% of this video.
I got 0% idea of what's going on but still liked the video
@@mr.billybob4013 it's a good video nonetheless
Just wondering for amateurs how does one achieve this kind of understanding? I'm walking through a CS degree but the most relevant course seems to be comp arch. Connecting to debug ports, dumping falsh/ram, trying to figure out the encryption algorithm, all these sound very interesting to me. I can probably follow along with enough tools but how do I do all of these on my own?
@@Levelworm I'm dealing with STM32 MCUs at work, often also using external memory and implementing firmware update mechanisms. Doing this kind of work, I need to figure out how to make things more secure, so that nobody can actually get the code or extract an encryption key (e.g. when the bootloader itself is being updated) by sniffing any lines that connect MCU and the external flash. So I'm basically on the other side of what stacksmashing does. This made it easy to understand for me. It made me happy, because I remember times when I would watch videos like this and understood basically nothing.
You studied at E sports? Coool
I didnt understand a word but this is super interesting and make me apreciatte the work of console hackers, thanks man!
@The Deadpool Who Chuckles. brrt?
@@AmberCresent brrrt
I understood very very little in this video. However, it was very well made and informative, nonetheless! Great work, and excited for how this community is so smart! Can't wait to see other games on this cool little device!
Seriously nice work! I enjoyed the twitter adventure the other day. Thanks for all the progress you've made, I can't wait for mine to get here from osaka
This was insane! I've read a bit about microcontroller operation, as well as data encryption, but seeing those ideas and principles put to use in hacking this was fascinating! Very impressive.
I been WAITING for this! Great job!
Pah 2nd :)
Strange that they hotpatched the copyright date instead of just hacking the rom
Would be easier to maintain a ROM that’s the same across many of their devices and hot patch locally per device.
@@KaderRocks Not really, they never have to do any maintenance on any Game and Watch consoles. It's a situation where they simply have to change a few strings of text before recompiling the ROM, and then there would be no need to have an emulator stand-in for patching. It's cleaner to have everything run without bloat. It would be different if it were a more intensive type of patch, this is inconsequential.
@@ha1vorsen The idea with keeping a rom that is original is that you can use it across many devices and not have to worry about it acting differently. And if it does, you hot patch it on the devices versus constantly making change sto the original and then hoping your changes work with new devices later.
@@KaderRocks But that doesn't inherently make any sense. 100% of Game and Watch units are identical. Your point about "working on new devices" makes zero sense. Even if you were talking about other devices aside from the Game and Watch for some reason, an edited ROM will work on any device; it's original game data. The only way that you'd run into issues with a properly made edited ROM is if the emulator itself is shoddy. An edited ROM is _much_ less work than designing the infrastructure necessary to hotpatch a game. Nintendo made the game in the first place, they made a modified version of SMB just within the past few months for Super Mario 35. They did it with the GBA release of the game as well. They did it with many N64 games on Virtual Console, like Ocarina of Time and Mario Kart 64, either to patch critical bugs or remove dangerous effects (Starman's epliepsy-inducing effect from Mario Kart 64)
A single use modification to directly change a number from 1985 to 2020 for a single console is less work, less "hacky", and less strain on the hardware than emulator patches. Simply running game code is more efficient than running game code with external code on top of it. There is only one Game and Watch which runs this game, and it's not like they would ever use a Game and Watch specific ROM on the Switch console's VC instead of the original ROMs from the NES release. I'm really confused on the point you're making.
Kensen If you need to modify the string during development, it is much easier to change text in source code than to patch the ROM again. It is much better if the ROM is “clean”.
Even if you need to change the code behavior to fix bugs or add new functions, easier to do this in emulator than in the original code.
You answered the first question I had when I saw the announcement for this device! Thanks so much for your efforts, I look forward to seeing what comes next.
Well that took way less time than I expected. Also, a big thanks for showing the process of how you did it, your tools had me in awe for a moment (DevOpser here) awesome video :) !
because he hacked it before release. It actually has to be measured in the T minus - time scale. Like a rocker before launch.
My mind just melted. Great work!
Great work! Hopefully a more user friendly and accessible method will come along.
Very informative! I look forward to any progress that's made.
Wow fantastic breakdown. I didn't understand the technical aspects of this demonstration, but I can't wait to see what other cool stuff you can do. I hope to see more nes roms get added, that would be amazing as only 3 games added in this modern game & watch feels limited and kinda wish they added more.
very epic release, vouch for contribution. :sunglasses:
that was pretty quick from getting the game & watch to a video lmao nice
This is mind-blowing to watch. Thanks for the hard work. Subscribed!
Really like how you described in details how you got each step.
I want Zelda 2 in it!
Zeldas game & watch 35 year anniversary is next year.. Guaranteed they'll release it next Christmas.. And maybe some other titles in between now and then 🤞
@@horizonfan first of all, Zelda is really good actually and second, Metroid never got a Game & Watch console.
@@horizonfan by saying "zelda eww" you are also referring to breath of the wild, a link to the past, majora's mask, a link between worlds, twilight princess, wind waker, and link's awakening, which are all great games, the only good metroids are the first one, super metroid, that one 3ds remake, and the metroid prime games,
@@horizonfan ah I see you aren't a man of culture
@@horizonfan dude, it's one of the better ones, also i was only talking about the rly good ones that i thought of ON THE SPOT, and i guess you aren't a metroid fan because your idiot ass didn't even notice i didn't list all the best metroid games, the gba one is awesome, I just didn't put it on there to see if you would notice
Nintendo device: Exists.
Hacked before official launch.
Everyone but Nintendo: _liked that_
Side note, I've subscribed because I'm surprised I haven't yet. I love tear-downs like this, they're super informative and full of entertainment!
All this should be way over my head but it was so simply explained. Thanks for taking the time to do this
Do you think it'll ever become easy to flash your own ROMs onto the device? I couldn't justify picking it up for just Super Mario Bros, but if I could play Mario 3 that would be a different story 👀
I’d love to see SMB3, Legend of Zelda, and maybe even Pokémon on this little guy, can’t wait to see more!
If I could get these for Pokémon, even if they only had a game a piece, I’d be trilled
@I'm Self Aware imagine beating Nightmare on a Mario Game & Watch
Sales of this devices is good. If you wait abit, Nintendo might officially release it.
I want Tetris on it
@Marcus Mysteriously If it can run a NES emulator it might be able to run a Gameboy one too
Amazing work. Though I probably won’t do it myself I enjoy you discussing your approach to figuring how security worked
Wow! First vid of yours I've watched, and I'm Super Mario Impressed!
SEGA: we are going to publish a tiny handheld device which cannot host more than 4 games
Nintendo: hold my handheld expertise, n00b
Ah, but Sega made the smaller device. So who really won?
@@EpicEmberOriginal Nintendo since their handheld is actually playable!
Yet we only got 3 games unless you count Mode B of Ball. 5 if you count the harder version of Super Mario Bros.
If Sega made those handhelds the same size as the Mario Game & Watch, I'd probably actually buy them.
Ah, this is the "I'll post a video of this soon" video - nice one :)
are you going to hack the Zelda version when it comes out...?
Awesome stuff!!! Please keep us updated on what else can be loaded into it. It would be awesome to load any rom in there... maybe even via USB!
How do you think we'll be able to use USB if the data line is not connected?
@@OMA2k Connecting it to the flash directly? 🙂 Just kidding... anyway just wanted to say great work!!
The amount of knowledge and skill you have is really impressive!
Cool, hopefully you can fix their language bug 😆
Can't wait for mine to arrive, I've already prototyped a pcb with a microcontroller and a much larger flash to implement a sort of "bank switching" to hold more games, I just need the thing in my hands to finish writing the software and test it
Can you put some links to these items so others can buy them too?
@@BigHushAffiliate it's just a 64mbit flash and a 120mhz ucontroller that I already had around. I designed and made the pcb. Will only work (if at all) for mmc1 games
Great video! I love how you detail your explanations!
I'd love to get into this stuff some day. The DS Lite is my favorite console and I wish more hacks were done with it, regardless of how useless they'd be. Awesome video.
I really want to see people port other LCD games like Hippo Teeth, Coconut Joe and Wolf & Eggs.
I hope that we can put our own ROMS in someday! I definitely wanna mod in SMB2USA and SMB3 as well as some of the popular ROM Hacks for 1 & 3 like Extra Mario Bros. or Super Mario Bros. 3Mix!
Ain’t gonna happen
@@andrewober Woah, someone woke up on the wrong side of the bed this morning! It can and inevitably will run other NES roms in the future with modding, although I can't say the same for games from other platforms.
@@vertihippo1274 But the modding won't be easy. The USB has no data line. It's only power. That means for the majority of people it won't be as easy as the NES mini by plugging it to a computer and running a program.
@@chamoo232 Still possible though :)
You're a genius, truly amazing! And great video editing on top of that, thank you.
I am impressed
Holy shit! Didn't understand a word but boy oh boy, was this entertaining to watch! Damn, u r smart, pal! Good luck with those future hacking plans.
They probably are gonna put doom on there lol
I’ll be surprised if they haven’t done it already. I’ve beaten it on a microwave and on a potato. So this is the next step.
I'd honestly love to see id/Bethesda.. Microsoft? .. put out a dedicated OG Doom handheld like this with Doom, Doom II, Final Doom and maybe the master levels.
Not without modifying the hardware heavily. The files for Doom are far too large to fit into the amount of storage this device it has.
@@CosmicGaijin still hasnt/cant be ported the TI-84 Plus CE tho lmao
@@fatusopp4739 that just means they aren’t trying hard enough
So you can install a "52 in 1" ROM.
Need to protect against the hot patching first
Klasse Arbeit, wirklich sehr sehr spannend und anschaulich erklärt , ich lasse mal ein Abo hier deine bisherigen Videos haben mir auch sehr gefallen.
That was so informative! Thank you for your work and the awesome breakdown! I know you probably can't share the XOR key, but was it of any significance? Or just random bytes? Also, how long is it?
I like your funny words, talented man.
I wish I understood those words you said that are new to me, it's a pretty cool video.
this case is so awesome, i would put a Raspbery to run some game boy games!
Awesome video and nice job finding out it was XOR encryption
Very well done, and smart indeed ! Thanks for making this. Brings me back to my electronic classes too :)
Cant wait to see this run Doom 😁
Wow, nice work! I'm personally really curious about the hidden Mario drawing song, since it's originally from the DSiWare app Flipnote Studio. I've spent a bit of time reverse-engineering Flipnote in the past, so I'm wondering if they made the effort to include a full Flipnote parser or if it's been converted into some other format. Any ideas?
Gut gemacht. So ein schönes Stück Hardware. Es ist unglaublich, wie butterweich die Spiele auf der Hardware emuliert werden.
Would be a fun to put in some bigger Spi flashs :D
But awesome work dude!
Memory expansion and more nes roms would be freaking sweet!
How? Haha
@@superjerjer1 How? Replace the flash ROM with a bigger one.
@@blahdelablah but thats hardware modding, look at chinese handheld majority of them are software modding
@@superjerjer1 "Memory expansion" implied hardware modding, perhaps you just assumed it was software modding that was being discussed.
The dream would be if you could add a micro-sd reader and have the firmware rewritten to just parse the roms on the card and present them in a menu. Do you think that could be done theoretically?
Yes; mass-erase the STM32H7B0's 128KB of flash (in 8KB sectors), remove the 1MB NOR flash (SPI Bus), solder the microsd slot breakout to the now-vacant flash pads, burn a FAT driver into the internal 128KB that can parse the filesystem, locate the emulator code, map it into memory, and present a fileselector. Bonus points if the fileselector is actually 6502 code running under the emulator, commanding the emulator to traverse and list directories. But ARM menu code is also acceptable. 1.4MB of SRAM is extremely large in terms of MCUs; take a look on github for "/Jean-MarcHarvengt/MCUME", which can run with a teensy4's 1MB of ram and for some emulator cores, an optional SPI 8MB PSRAM from Espressif, usually found on ESP32s.
Great work and explained in such detail. Super!
This is some good work! I'm gonna enjoy playing Skyrim on that tiny screen in a few months.
question: is the screen the same as the 3ds? me and some gbatemp members speculated they did it to get rid of old stock
I seems very plausible tho
Nope, different resolution etc.
@@stacksmashing and what is the resolution of this display?
I'm curious what your background is - electrical engineering, computer science? How did you learn this stuff?
badassery, that is his backgroud
@@Macs nolifery
Try to see if you can swap the theme playing while time is displayed. Would be cool to see a Zelda or even a Mr. Game and Watch one instead! Either way great work man!
Great work! Somebody needs to port *all* the single screen Game & Watches onto this.
So exciting. It's a great device out of the box, so the potential to add roms will make this device such a great collector and PLAY item.
Adding roms will be difficult, because it has just enough storage to store the built in games
Honestly if you want to play ROMs just get a PS Vita
@@acex222 this is way more portable than a PS Vita.
@@souljastation5463 is it really killing you that you can't play NES roms on the bus on any existing device? Are you travelling somewhere you can take a game and watch but not a vita, where the time required to travel is necessary that you bring a toy with you? Come on dude, live in the real world
@@acex222 Seriously this.
I get the novelty of playing different games on this, but there are so many devices that can do just that very well nowadays that why even bother.
I play NES games on my gba with a flashcard and SNES games on my New 3ds.
You could pick up a cheap Chinese anbernic device that can play nearly everything up to ps1 fairly well and for fairly cheap. Or even cheaper use your phone with a bluetooth controller.
In a few years we're gonna see this get modded to essentially be an NES portable
Game Boy games too!
Years?? Wont take that long
Try weeks if not months
Wow that was really interesting! You made it look like Nintendo placed security measures equivalent of a "do not disturb" sign :p
Wow..
Liking this so far.
Can't wait to see what the capability of this device actually is and what can play on it..
PS.. I'm definitely subscribing to this channel..
Would there be enough memory for a game boy rom? I'm thinking of Game & Watch Gallery.
thats smart
Watch E3 2021 to see that happen. Oh and BOTW2 is coming in 2022
I think you should make a point to collect some dead and damaged ones. Then, you can gut it, and put a R-pi-0W inside but have the SNES branded case.
It's a really nice case
i never followed you before but only saw your Twitter Thread because MVG liked it ... and now i see your vid 3 days later in my recommended ... youtube algorhytm is scarry!
Wow! excellent break down. Thanks for sharing!
Can't wait to play Dragon Quest 3 on this.
You probably couldn't switch it off until you are done with the game until someone can implement saving.
@MHzBurglar Oh, didn't know that. Mine is still sealed.
I was wondering about how hackable the Game & Watch is!
That's some insane progress for two days!
After 2 minutes of video, I understand that I'll never do something like this, but you are awesome!!
I did not understand 99% of what you said but man that’s awesome! Hope to see you put other games on this baby.
Awesome video man! Unfortunately with 128kb it doesn't look like you'll be able to fit many roms on there aside from the earlier generation titles that range from 25-65kb. But most NES games after that are 129-513kb from looking at my rom list.
Solder on a new flash and support it with a CFW maybe?
Too bad that this doesn't run linux. Seems unlikely that there will ever be usb access to upload roms.
You underestimate the nintendo modding scene, those guys will make an entire custom pcb if they have to
Sir, you have become Legend!
Nice work 👍💪
I believe this encryption scheme is called XOR-based one time pad. That XOR stream you inferred was essentially the “one time pad”. The weakness in the implementation here is that there was no protection from using the one time pad multiple times because you could change the contents of the flash. Thanks for the super interesting video.
Can you rip those new Mario Illustrations from the bios?
Oh so that's why it can "quick resume" between the two SMB games, they're both in the memory at all times, clever
I love it! Solid hack, sir.
Awesome! Thanks so much for sharing.
My Brain tapped out 10 seconds into the video.
Same.
Nice video
Very good work. Thanks a ton for sharing!
Amazing work, well done! And thank you for sharing!
Well done. I said, 'give it a week to a month'; you did it before launch. #LMAO
Just say lmao
Don't use hashtags. Just say "Lmao"
@@liquiditya How about you give me five bucks on Steam instead?
@@AmyraCarter nah I’m good. Thanks for the idea tho. I’ll make sure to use it on someone else. Not you :)
One day in: C R A C K E D
I thought the actual thing was pretty crap. Getting two roms you can get online for $50. But this is amazing. I just found your channel and 😃
Great stuff man I've always wanted to learn more about things like this 😸