Gameboy Color Boot ROM

top_view_full

It’s only been a week since the Super Gameboy’s boot ROM was dumped by [Costis] and he’s already at it again. This time he’s managed to grab the Gameboy Color’s boot ROM. He found the newer Gameboy Color’s hardware is able to cope with a clock speed up to 100MHz, so the original clock increase trick he used on the Super Gameboy wouldn’t work again.

Instead he discovered a quick disconnection of clock and power before 0xFF50 would make the Gameboy jump to a random area within the ROM. Then it was only a matter of entropy, luck, and some special NOP instructions until eventually he had the boot ROM. Keep up the good work [Costis].

Super Game Boy Boot ROM Dumped

gameboy_boot_rom_dump_hardware

[Costis] managed to dump a copy of the boot ROM for the Nintendo Super Game Boy. This small piece of code (256 bytes) writes a graphic to the display at boot time as it loads the ROM on the game cartridge. He was able to dump the code by finding the exact point at which the device locks down the boot ROM. Just as that point approached he overclocked the device causing it operate so fast it couldn’t write the lockout bits into the register. Once past that single point of security, he executes a code that writes the boot rom out to a different address that he is able to read from. He’s got a copy of the dump along with the explanation up for your enjoyment.

[Thanks Anthony]