Running unlicensed code on the original Nintendo Gameboy.

Nowadays we take it as a given that you can't play unlicensed or home-brew games on your gaming console.

That doesn't mean some smart people didn't find a way around it. Who remembers GeoHot and his discovery of the master key for the PS3?

But public/private key infrastructures weren't readily available back in the day of the original Nintendo Gameboy. The hardware wasn't powerful enough to use a strong protection scheme.

Still Nintendo didn't want to lose any licensing fees and designed a way to keep unlicensed games from running. It all hinged on enforcing the use of they're logo and suing anyone who used the logo without a proper license.

So if you want to write your own game or code that runs on an original gameboy you need to know how this mechanism works. 

So lets dive right in, starting with the legality of it all.

Legality

Nintendo used a similar scheme as Sega used on the Mega Drive. Since it isn't in itself illegal to create a game for an existing gaming console, how did they (try to) ensure that developers where forced to pay licensing fees?

Simple, they required the use of the company logo to make the system run. If the logo isn't contained in the rom cartridge then the system will halt. That logo by itself is protected by copyright law. So if you didn't pay the licensing fee they could sue you for copyright infringement.

Later on I'll mention some games that bypassed this in a very creative way. Whats important for now is that Sega sued Accolade somewhere in the early 90's for copyright infringement because of this.

In the end Sega lost the court case, and it's verdict set a precedent that:

"Copyrights do not extend to non-expressive content in software that is required by another system to be present in order for that system to run the software."

The gameboy uses a scheme that falls within the definition of this ruling. Still, Nintendo could try to sue you, but I haven't found a single case where this happened.

Bootrom

Nintendo calls this the 'monitor program'. I'm going to focus mainly on the bootrom in the original

Gameboy (DMG).

When you turn on your Gameboy, with or without a cartridge present, this piece of code is run. It's build into the processor. It first loads the logo from the cartridge (if present) into video memory and displays the scrolling logo we all know and love.

This is also why if you turn it on without a cartridge present, it'll scroll a black box.

After that it'll compare the logo on the cartridge to see if it's the same one contained in the bootrom. If the logo doesn't match, it'll lockup your Gameboy refusing to play the cartridge.

The bootrom does other things like validating the header checksum, refusing to run if it doesn't match. The super gameboy's bootrom doesn't care about the header checksum.

If all goes well the bootrom will disable itself until the gameboy is powered off. It does this by writing a $01 to address $FF50. The next instruction is at address $100, which is on the cartridge itself.

This way it's impossible to dump the bootrom using code on the cartridge. But through glitching and other hacks these bootroms have been dumped, decompiled and analysed. Which is good news for us.

Header

I won't go into to much detail about the header. You can find very detailed information about it through the links I provided in an older post.

What you do need to know is that the header contains everything you need about the cartridge. The rom size, number of banks and options like ram, battery, rumble pack or camera. It also contains the logo, checksum and region-code.

It's 80 bytes long starting at $100 and ending at $14F. The first four bytes contain opcodes, usually a jump to $150. Those four bytes are followed by 48 bytes containing the nintendo logo.  The header checksum at $14D.

Every cartridge has this header information and it's of immeasurable help when writing an emulator for the Gameboy. Checking if a file is really a ROM, knowing what kind of cartridge to emulate and more.

Logo

The 48 bytes that make up the nintendo logo are:

CE ED 66 66 CC 0D 00 0B 03 73 00 83 00 0C 00 0D
00 08 11 1F 88 89 00 0E DC CC 6E E6 DD DD D9 99
BB BB 67 63 6E 0E EC CC DD DC 99 9F BB B9 33 3E

They are stored in the address range $104..$133 on the cartridge and the gameboy will not run if it's not there. I still have to find out how the bootrom converts this into the image we all see. As soon as I do i'll update this section with more info.

Logo hacks

Every real collector will have probably shaken they're heads by now after I repeatedly said the nintendo logo and only the nintendo logo can be at that location.

They've probably played a game that shows a different logo when they turn it on. And those are quite nice workarounds. It also nicely bypasses displaying the nintendo logo and, in hindsight, copyright worries. So how could I end this blog without explaining that?

It's still true tho, at addresses $104..$133 you have to have the bytes that are normally converted to show the nintendo logo. But as you remember the bootrom first copies that area to video memory before checking if it is actually the logo. So using timing or some switching when address $133 has been read they map the nintendo logo they stored somewhere else to the area where the bootrom expects it. Simple and brilliant at the same time.

NeoFuji has an amazing collection of these custom logo's.

Emulators

Emulators generally don't support these kind of tricks. For me it's actually a design goal to support these cartridges. It's a small end goal, but still... imho it enhances the experience.

Actually, an emulator doesn't even have to care about any of this. It can simply start execution at address $100 and (although you won't see a scrolling logo) it'll run the cartridge just fine.

I'm still torn when it comes to the bootrom. I want a fast and efficient emulator, but I still want an authentic feel when you load your cartridge. So for the DMG a scrolling logo is mandatory.

But I want to just put it in the public domain with no copyright issues like with using the original bootrom or maybe even the nintendo logo itself.

I could just fake it but I (for the authentic feel) still want to support custom logo's.
.
Things you'll need to make choices about when writing your own. Again, there's no better way then just start writing code.

Worst case scenario: You write more code.