Remote Code Execution On The N64

July 6, 2020 by Lewin Day 4 Comments

Some like to garden in their spare time, while others prefer to smoke cigars or fold complicated origami figurines. Security researcher ~~[grifter]~~ [CTurt] seems to enjoy cracking consoles instead, and had a go at exploiting the Nintendo 64 over an obscure modem interface.

The 1990s were a wild time, where games shipped in cartridges. This format opened up crazy possibilities to add additional hardware to the cartridge itself. Perhaps most famously, Nintendo packed in the SuperFX chip to enable 3D graphics on the Super Nintendo. Later on, the N64 game Morita Shogi 64 shipped with an entire telephone modem in the cartridge itself. The resulting exploit is therefore dubbed “shogihax”.

Armed with a dodgy GameShark and a decompiler, [CTurt] set to work. Through careful parsing of the code, they were able to find a suitable overflow bug in the game when using the modem. Unlike more pedestrian savegame hacks, this not only allowed for the execution of arbitrary code but also the modem interface means that it’s possible to continually stream more data to the console on an ad-hoc basis.

It’s a great hack that takes advantage of a relatively accessible cartridge, rather than relying on more obscure hardware such as the N64DD modem or other rarities. We’ve seen other N64 homebrew hacks before, too. Video after the break.

Thanks to [grifter] for the tip!

Continue reading “Remote Code Execution On The N64” →

Finding A Secret Message From A Gaming Legend

July 4, 2020 by Tom Nardi 6 Comments

Satoru Iwata is perhaps best remembered for leading Nintendo through the development of the DS and Wii, two wildly successful systems which undeniably helped bring gaming to a wider and more mainstream audience. But decades before becoming the company’s President in 2002, he got his start in the industry as a developer working on many early console and computer games. [Robin Harbron] recently decided to dig into one of the Iwata’s earliest projects, Star Battle for the VIC-20.

Finding the message was easy, if you knew were to look.

It’s been known for some time that Iwata, then just 22 years old, had hidden his name and a message in the game’s source code. But [Robin] wondered if there was more to the story. Looking at the text in memory, he noticed the lines were actually null-terminated. Realizing the message was likely intended to get printed on the screen at one point during the game’s development, he started hunting for a way to trigger the nearly 40 year old Easter Egg.

As it turns out, it’s hidden behind a single flag in the code. Just change it from 0 to 1, and the game will display Iwata’s long-hidden credit screen. That proved the message was originally intended to be visible to players, but it still didn’t explain how they were supposed to trigger it during normal game play.

That’s where things really get interesting. As [Robin] gives us a guided tour through Star Battle’s inner workings, he explains that Iwata originally intended the player to hit a special combination of keys to tick over the Easter Egg’s enable flag. All of the code is still there in the commercial release of the game, but it’s been disabled. As Iwata’s life was tragically cut short in 2015 due to complications from cancer, we’ll perhaps never know the reason he commented out the code in question before the game was released. But at least we can now finally see this hidden message from one of gaming’s true luminaries.

Last time we heard from [Robin], he’d uncovered a secret C64 program hidden on a vinyl record. With his track record so far, we can’t wait to see what he digs into next. Continue reading “Finding A Secret Message From A Gaming Legend” →

No, The Nintendo Leak Won’t Help Emulator Developers, And Here’s Why

May 21, 2020 by Erin Pinheiro 34 Comments

If you haven’t heard from other websites yet, earlier this year a leak of various Nintendo intellectual properties surfaced on the Internet. This included prototype software dating back to the Game Boy, as well as Verilog files for systems up to the Nintendo 64, GameCube and Wii. This leak seems to have originated from a breach in the BroadOn servers, a small hardware company Nintendo had contracted to make, among other things, the China-only iQue Player.

So, that’s the gist of it out of the way, but what does it all mean? What is the iQue Player? Surely now that a company’s goodies are out in the open, enthusiasts can make use of it and improve their projects, right? Well, no. A lot of things prevent that, and there’s more than enough precedent for it that, to the emulation scene, this was just another Tuesday.

Continue reading “No, The Nintendo Leak Won’t Help Emulator Developers, And Here’s Why” →

Teardown: Generation NEX

May 11, 2020 by Tom Nardi 13 Comments

Today if you wanted a little gadget to sit on your shelf and let you play classic games from the early console era, you’d likely reach for the Raspberry Pi. With slick emulator front-ends like RetroPie and DIY kits available on Amazon, you don’t even need to be a technical wizard or veteran penguin wrangler to set it up. If you can follow an online tutorial, you can easily cram the last few decades of gaming into a cheap and convenient package.

But things were a bit different back in 2005. There weren’t a lot of options for playing old games on the big screen, and what was out there tended to be less than ideal. You could hack an original Xbox or gut an old laptop to make an emulation box that could comfortably blend in with your DVD player, but that wasn’t exactly in everyone’s wheelhouse. Besides, what if you had the original cartridges and just wanted to play them on a slightly more modern system?

I’m willing to bet whoever wrote this owns a katana.

Enter Messiah, and their Generation NEX console. As you might have gathered from their ever-so-humble name, Messiah claimed their re-imagined version of the Nintendo Entertainment System would “Bring Gaming Back to Life” by playing the original cartridges with enhanced audio and visual clarity. It also featured integrated support for wireless controllers, which at the time was only just becoming the standard on contemporary consoles. According to the manufacturer, the Generation NEX used custom hardware based on the “NES algorithm” that offered nearly 100% game compatibility.

Unfortunately, the system was a complete bomb. Despite Messiah’s claims, the Generation NEX ended up being yet another “NES-on-a-chip” (NOAC) clone, and a pretty poor one at that. Reviewers at the time reported compatibility issues with many popular titles, despite the fact that they were listed as working on Messiah’s website. The touted audio and video improvements were nowhere to be found, and in fact many users claimed the original NES looked and sounded better in side-by-side comparisons.

It didn’t matter how slick the console looked or how convenient the wireless controllers were; if the games themselves didn’t play well, the system was doomed. Predictably the company folded not long after, leaving owners stuck with the over-priced and under-performing consoles. Realistically, most of them ended up in landfills. Today we’ll take a look inside a relatively rare survivor and see just what nostalgic gamers got for their money in 2005.

Continue reading “Teardown: Generation NEX” →

Trimmed PCB Makes The Ultimate Portable N64

March 27, 2020 by Tom Nardi 2 Comments

One of the most impressive innovations we’ve seen in the world of custom handhelds is the use of “trimmed” PCBs. These are motherboards of popular video game consoles such as the Nintendo Wii and Sega Dreamcast that have literally been cut down to a smaller size. As you can imagine, finding the precise shape that can be cut out before the system stops functioning requires extensive research and testing. But if you can pull it off, some truly incredible builds are possible.

Take for example this absolutely incredible clamshell N64 built by [GMan]. After cutting the motherboard down to palm-sized dimensions, he’s been able to create a handheld system that’s only a bit larger than the console’s original cartridges.

Incidentally those original cartridges are still supported, and fit into a slot in the rear of the system Game Boy style. It’s still a bit too chunky for tossing in your pocket, but we doubt you could build a portable N64 any smaller without resorting to emulation.

In the video after the break, [Gman] explains that the real breakthrough for trimmed N64s came when it was found that the system’s Peripheral Interface (PIF) chip could be successfully relocated. As this chip was on the outer edge of the PCB, being able to move it meant the board could get cut down smaller than ever before.

But there’s more than just a hacked N64 motherboard living inside the 3D printed enclosure. [Gman] also designed a custom PCB that’s handling USB-C power delivery, charging the handheld’s 4250 mAh battery, and providing digital audio over I2S. It’s a fantastically professional setup, and you’d be forgiven for thinking the board was part of the original console.

Considering how well designed and built this N64 SP is, it probably will come as no surprise to find this isn’t the first time [Gman] has put something like this together. He used many of the same tricks to build his equally impressive portable Dreamcast last year.

Continue reading “Trimmed PCB Makes The Ultimate Portable N64” →

There Really Was A Sewing Machine Controlled By A Game Boy

March 11, 2020 by Lewin Day 12 Comments

These days, high-quality displays and powerful microcontrollers are cheap and plentiful. That wasn’t the case a couple of decades ago, and so engineers sometimes had to get creative. The result of this is products like the Jaguar nu.yell sewing machine, as covered by [Kelsey Lewin].

The later nuotto model was capable of more advanced embroidery patterns. A Mario character cartridge was sold, while a later Kirby edition was scrapped before release.

The Japanese market product eschewed the typical mechanical controls of the era, to instead interface with a Nintendo Game Boy. The sewing machine would hook up to the handheld console via the Link Port, while the user ran a special cartridge containing the control software. This would allow the user to select different stitch types, or embroider letters. Very much a product of its time, the nu yell mimics the then-cutting edge industrial design of the first-generation Apple iMac. The technology was later licensed to Singer, who brought it to the US under the name IZEK. Sales were poor, and the later Jaguar nuotto didn’t get a similar rebranding stateside.

Back in the late 90s, the Game Boy was likely an attractive package to engineers. Packing a Z80 processor, buttons, and a screen, it could act as a simple human interface in lieu of designing one from the ground up. Aprilia even used them to diagnose motorbike ECUs, and we’ve seen Game Boy parts used in medical hardware from the era, too. Video after the break.

Continue reading “There Really Was A Sewing Machine Controlled By A Game Boy” →

Dad Makes Xbox And Nintendo Work Together To Bridge The Accessibility Gap

January 28, 2020 by Erin Pinheiro 11 Comments

In the last few years, console and controller manufacturers have been making great strides in accessibility engineering in order to improve the inclusiveness of people with different motor disabilities into the gaming world. One such example is the Xbox Adaptive Controller, which [Rory Steel] has used to build his daughter a fully customized controller to allow her to play Breath of the Wild on the Nintendo Switch.

His build plan is outlined in just a few Twitter videos, and sadly we don’t have a detailed walkthrough on how to build our own just yet, though he mentions plans on making such guide in the future. In the mean time, it’s not too hard to speculate on some specifics. The Adaptive Controller can use USB-C for communication, as the Switch also does with its Pro controller in wired mode. Interfacing the two is as simple as using an adapter to bridge the gap between the two vendors.

The joysticks are each wired into generic gamepads which act as the left and right sticks, each one being a separate USB input into the Adaptive Controller, while each one of the button inputs is broken out to 3.5mm jacks on its back, making them dead simple to wire to the sixteen arcade buttons surrounding the sticks. The layout might look unconventional to us, and [Rory] mentions this is simply a prototype that will be improved upon in the future after real-world testing. The size of his daughter’s smile tells us this is already a success in her eyes.

This is not the first time we’ve seen a build with the Xbox Adaptive Controller, and it’s nice to see just how well it enables parents to build their kids controllers they can use more easily, seeing as how before its introduction these kinds of controllers usually required the expertise for tearing expensive official controllers apart in ways the manufacturers never expected. We can only hope that going forward, this sort of accessibility becomes more the norm and less the exception.

[via Kotaku, thanks Itay for the tip!]