Reversing the Nintendo 64 CIC

Video in TIB AV-Portal: Reversing the Nintendo 64 CIC

Formal Metadata

Reversing the Nintendo 64 CIC
Reversing a 20 year old copy protection chip
Title of Series
Part Number
Number of Parts
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
This presentation covers our successful efforts to reverse engineer and clone the Nintendo 64's copy protection chip: the N64 CIC. We describe the processes and techniques we used to finally conquer this chip, nearly 20 years after its introduction. Nintendo's NES, Super NES, and Nintendo 64 used a series of copy protection chips known as CICs. As the consoles grew more sophisticated, so did the chips. While the NES and Super NES CICs have been cracked and cloned, up until recently the Nintendo 64's has remained an elusive target. Our team approached this chip by exposing the die (decapping) and optically imaging it, including its mask ROM. Through visual inspection we determined the CPU core and instruction set, and we were able to extract the program code from the mask ROM. We wrote an emulator on PC and ultimately cloned the chip on a PIC microcontroller.
Nintendo Co. Ltd. Group action Forcing (mathematics) Multiplication sign Projective plane Content (media) Video game Game theory Einsteckmodul Absolute value Reverse engineering
Nintendo Co. Ltd. Arithmetic mean Game controller Video game Mass Quicksort Game theory Family Computing platform Physical system
Nintendo Co. Ltd. Arithmetic mean Set (mathematics) Game theory Einsteckmodul Mereology Boiling point Physical system
Nintendo Co. Ltd. Greatest element Digital electronics Divisor Multiplication sign Physical law Source code Machine code Mereology Revision control Process (computing) Different (Kate Ryan album) Personal digital assistant Gastropod shell Negative number Cloning Right angle Game theory Office suite Physical system Reverse engineering
Nintendo Co. Ltd. Game controller Block diagram Moment (mathematics) Interrupt <Informatik> Bit Iteration Game theory Quicksort Einsteckmodul Rectangle Physical system
Nintendo Co. Ltd. Optical disc drive Greatest element Information Copyright infringement Meeting/Interview Game theory Quicksort Mereology Number
Nintendo Co. Ltd. Ocean current Meeting/Interview Software developer Computer hardware Flash memory Projective plane Quicksort Product (business)
Nintendo Co. Ltd. Point (geometry) Dialect Shift operator Copyright infringement Sheaf (mathematics) 1 (number) Set (mathematics) Streaming media Machine code Logikanalysator Process (computing) Meeting/Interview Personal digital assistant Computer hardware Figurate number Whiteboard Quicksort Game theory
Laptop Slide rule Addition Building Information Multiplication sign Execution unit Water vapor Bit Mereology Number Process (computing) Spherical cap Meeting/Interview Right angle Software testing Quicksort
Laptop Point (geometry) State of matter Multiplication sign Device driver Neuroinformatik Medical imaging Meeting/Interview Physical system Graphics tablet Standard deviation Scaling (geometry) Arm Information Mathematical analysis Serial communication Sound effect Bit Machine code Microprocessor Process (computing) Right angle Pattern language Quicksort Object (grammar) Pressure
Point (geometry) Computer program Greatest element Game controller Multiplication sign Materialization (paranormal) ACID Mereology Tracing (software) Graph coloring Product (business) Number Vortex Medical imaging Mathematics Term (mathematics) Core dump Data structure Firmware Dot product Standard deviation Information Concentric Projective plane Mathematical analysis Bit Equivalence relation Tablet computer Residual (numerical analysis) Type theory Exact sequence Process (computing) Exterior algebra Ring (mathematics) Optics Buffer solution output Right angle Summierbarkeit Quicksort Procedural programming Figurate number Resultant
Addition Scaling (geometry) Multiplication sign Mereology Bookmark (World Wide Web) Frame problem Product (business) Residual (numerical analysis) Process (computing) Causality Analogy Iteration Circle Right angle Quicksort Game theory Bounded variation
Slide rule Service (economics) Token ring Multiplication sign Real number Connectivity (graph theory) ACID Meeting/Interview Liquid Tunis Covering space Area Concentric Block (periodic table) Gradient Projective plane Bit Perturbation theory Cartesian coordinate system Category of being Process (computing) Angle Auditory masking Right angle Quicksort Resultant
Point (geometry) Pairwise comparison Program code Mapping Cellular automaton Sampling (statistics) Microcontroller Bit Maxima and minima Machine code Parameter (computer programming) Mass Entire function Medical imaging Type theory Process (computing) Befehlsprozessor Personal digital assistant Core dump Authorization Right angle Quicksort Computer architecture Spacetime
Block matrix Information Bit Microprocessor Medical imaging Process (computing) Befehlsprozessor Term (mathematics) Calculation Energy level Right angle Game theory Recursion Disassembler Computer architecture
Point (geometry) Group action Simulation Functional (mathematics) Link (knot theory) Multiplication sign Projective plane Debugger Heat transfer Machine code Emulator Positional notation Semiconductor memory Logic Phase transition Reverse engineering
Point (geometry) Identifiability Run time (program lifecycle phase) Sequel Structural load Bit Machine code Power (physics) Process (computing) Meeting/Interview Lecture/Conference Semiconductor memory Logic Radio-frequency identification Energy level Booting Freezing
Point (geometry) Run time (program lifecycle phase) State of matter Multiplication sign Zoom lens Source code Similarity (geometry) Open set Mass Mereology 2 (number) 6 (number) Power (physics) Emulator Semiconductor memory Different (Kate Ryan album) Bus (computing) Einsteckmodul Theory of everything Information security Physical system Nintendo Co. Ltd. Algorithm Dependent and independent variables Scaling (geometry) Copyright infringement Validity (statistics) Inheritance (object-oriented programming) Content (media) Bit Machine code Line (geometry) Data stream Process (computing) Personal digital assistant Radio-frequency identification Blog Interpreter (computing) Video game Quicksort Game theory Resultant Asynchronous Transfer Mode Disassembler
Functional (mathematics) Algorithm State of matter Device driver Machine code Opcode Latent heat Process (computing) Lecture/Conference Different (Kate Ryan album) Personal digital assistant Semiconductor memory Quicksort Data conversion Codierung <Programmierung> Reverse engineering
Algorithm Randomization Digital electronics Key (cryptography) Multiplication sign Structural load Weight Content (media) Bit Frequency Meeting/Interview Radio-frequency identification Booting
Personal identification number Game controller Personal digital assistant Order (biology) Expert system Total S.A.
Dependent and independent variables Algorithm Game controller Scaling (geometry) Run time (program lifecycle phase) Computer file Cellular automaton Electronic mailing list Machine code Variable (mathematics) Complete metric space Neuroinformatik Word Videoconferencing Encryption Game theory Booting Reverse engineering
Point (geometry) Digital electronics Open source State of matter Microcontroller Mereology Rule of inference Power (physics) Revision control Medical imaging Spherical cap Cloning Flag Software testing Information security Computer architecture Area Nintendo Co. Ltd. Demo (music) Forcing (mathematics) Consistency Bit Machine code Mikroarchitektur Befehlsprozessor Computer animation Personal digital assistant Logic Factory (trading post) Asynchronous Transfer Mode Reverse engineering
Medical imaging Word Validity (statistics) Program slicing Whiteboard Mass Machine code
Nintendo Co. Ltd. Flash memory Bit Field (computer science) Scattering Medical imaging Personal digital assistant Logic Software testing Game theory Data conversion Firmware Resultant Asynchronous Transfer Mode
Personal identification number Functional (mathematics) Weight Cellular automaton Device driver Set (mathematics) Library catalog Machine code Number output Pattern language Right angle Rhombus
Nintendo Co. Ltd. Scaling (geometry) Internetworking Projective plane Plastikkarte Software testing Bit Game theory Sega Enterprises Ltd.
NP-hard Point (geometry) Polynomial Game controller Open source Multiplication sign Moment (mathematics) Microcontroller Machine code Regular graph Data management Process (computing) Befehlsprozessor Order (biology) Linearization Video game Cloning Right angle Game theory Booting Asynchronous Transfer Mode Physical system
the only a group where the group but if you think if you issue here in the i hi everybody my name is Mike Ryan and I were talking to you today about reverse engineering intended 64 sick but about
this and I really like the way video games but when Marshall & and have a lot of interest in Nintendo 64 specifically for a long time so it's been really great that these 2 people that we make it happen understood that agreements is used to her this is the young the signal a critical the hi my name is John McMaster I run so confronted org and and general harder enthusiast and like working with computer chips right so before you get to into the technical content of what we're talking about their only give you guys a little brief history of the video game industry and the motivation that the forces that led to the creation of the set so back in the early 19 eighties Atari was a very popular video game company but the release some very excellent and I'm sure a lot of you have heard of and Nintendo's original Donkey Kong i and everything was going really well for them until around 1980 years so when the market became flooded with just the absolute garbage games I'm sure a lot of people here familiar with the story of the tea there's a whole bunch of cartridges ended up in a landfill somewhere in Mexico a lot of us that this is an apocryphal story so there was an art project last year that 1 out and examine some of those and it turns out that yes indeed the landfill was absolutely loaded with trash games and this did
not work out well for Atari or for the home video game market you can see it takes a major died starting around 1983 and then in 1986 not the very bottom of the market was everybody had thought the video game industry was dead meanwhile Nintendo was having
massive success in Japan with the family come and they wanted to bring it to the United States but Hiroshi emotive president of Nintendo believe that a car you failed because they allow to anybody and everybody to publish games for the platform they didn't do any quality control whatsoever so he believes that there had to be some sort of a technical mitigation for this the technical means of preventing people from making unauthorized gains for the system
it really all boils down to this so when you went out to the market if you're a kid in the eighties and you buy a Nintendo game and had this sealine you're reasonably sure that you're getting a pretty good game so the technical means by which the Nintendo accomplish this was the same the now what the SEC is is part of a
system to basically enforced licensing from Drupa directly from Nintendo so what happens is and it's like you have a set chip and the consul and 1 in the game and then they talk to each other when you start the game so they're always talking about this constantly so that if anything happens uh just resets itself and anyone who has an NES knows they are very very very flaky this is 1 of the reasons because of the bad cartridge connector easily when making contact and for the Super Nintendo it was pretty much the same story but they just have the same shit the shrunken download problem so all but there's no much
difference there now there were a pirate gains for the NES and there's a couple ways that they did this was pretty interesting I think the the top picture the picture on the top there is part is the game circuit board and there is a like ketchup instead there is a boost regulator which is just a circuit that generates very large negative spike voltage and it goes and then it instead of talking to the chip it just punch in the mouth mn shifted up with no so it's definitely not kosher it'd work but sometimes summertimes it just kills the consul Nintendo actually release a consul revision that had some in my resistors that that that that prevented this and some of the factors actually sent out manuals that said how to open up your consul in clip that pain on the sick but enable that that's how that's where these companies were to make games for the system right because the licensing costs were very a prohibitive it could make money but he did have to work very hard for it and on the bottom is a actual clone made by tangent and which is actually a target they just made a shell company so that the kids legally get away with stuff like this so this
is actually pretty interesting story and some of people is a might be familiar with it so at the time of Nintendo Ahtisaari sorry Atari was attempting to reverse engineer this chip using invasive chip methods so they tried to get inside the guy package and remove the die and then figure out how that shit works in the meantime what somebody inside r decided to go to the Copyright Office and file a bogus copyright claim to get the source code to Nintendo's original 10 NES chip and then they produce of perfectly functional clone using this this is pretty illegal and Nintendo's see them for that and the target of halving of him a whole bunch of money however the interesting outcome of this lawsuit was that 1 of the District Court judges noted that the reverse engineering process assuming Atari had not stolen the code actually qualifies as a fair use so we've got a pretty rock-solid cases we're doing is fair use under copyright law but but at the right
so it's just skipping to Nintendo 64 now all older stuff now they basically took the same system that work for them on the older stuff and the tweaked a little bit modernize it just slightly just enough work to be different and so here's a block diagram of the and 64 and I going to talk about how it is a game graphics and stuff like that what's inside the yellow rectangle is the protection system uh same deal these 2 chips are talking to each other from the moment you turn the game on until you turn it off always talking to each other but instead of being 2 symmetrical things of you know executing a lot step the path is just the role it into a chip that handles all the system bring up and pulling the controllers in interrupts the research and all that sort of thing but
so here's an actual game cartridge this is a legitimate 1 so the chapel the left is the like active looks exactly the same they're made by Sharp it's just the more modern iteration I suppose and now I should
say unlike the older Nintendo stuff instead of having very widespread pirate chips this but a pirate game is actually very very very rare but if you actually have 1 of these in your willing to donate in the name science we actually like this you put inside those there there is a very small number of pirate gains made in Hong Kong have this chip and we have very little information about the history of the pirated 6 so again with those of Yemeni leads on these
continuing not talk about dubious legality this is how you would hiring games basically it has a bunch of RAM inside this is on the bottom of the top part in 64 if you're familiar with it it reads the games of CD drives and then it did not have any sort of way to emulate or copy the lock active so we had to do was In the Carter sort the top you insert a real game and it would get just a lockout chip so it fooled and running a now here are
the couple flash cottages that let you run home brew and do some sort of development and modern of with modern technology and in really that's what this is all about this sick made sense perhaps 10 years ago 20 years ago a Nintendo actually was making considerable money off his consuls but nowadays we wanna be able to do homebrew development and actually use them for interesting purposes and the sickest is getting in the way of what we consider a very reasonable use of the hardware so but not only ourselves but earlier projects also started looking into cloning the earlier chips right and if
you were to take the lid off 1 of these are older production chips but we have the swap around this is actually the older in India since rainiest like a the had this is basically showing you the existing efforts to clone them which they have accomplished and we haven't accomplished that for our current development tools for the Nintendo 64 which is what we're going to do an aside but of this talk is about I'm not sure if
we actually explain and again we have an and good job presenting serious and so unlike the older Nintendo's where they have 1 market chip or you know like section 7 years and Nintendo go over smarter and throughout the lifespan of the consul they would periodically introduce new ships just to stay ahead of the pirates by a few months so that have you know figure the new secrets out so the 6 variants per regions and then there's a in which is America's Japan and some other things and then the rest world basically so it made things that made it much harder and more difficult to pirate but there were some special cases like
this is a arcade boards to jam of war that plugs into an arcade cabinet has Nintendo chip set and they just have the game plugs into some sort custom connector just a different you know the special case of the light that and that this this even the arcade hardware at the same exact locker shift it's labeled as a 51 0 1 but it's actually running identical code the 61 0 1 and usage each of so at this point we know what the chair does we don't know how it does it if you were to look at what the chip does physically lo logic analyser something you would see a need stream of zeros and ones and is completely random uh you can log it for days and days it will never repeat you don't know how it works so what we did is we switch to the we started to get to know John McMaster here er while and his work with design and bird this give a talk but they do is they but use very dangerous chemicals and they just get right in there under the chip and then see exactly what's going on so I'm internal
over to him is and explain exactly the Mad Science used to look inside their so well while these guys were cowering behind the laptops in their cuticles I was out in the trenches getting my hands dirty so let's talk a little bit about what that evolves in what we got out of it so Andrew is apparently can get bored to death by the slide that were to beat the dead horse a little that just 1 slide but so the 1st part of this process of for actually getting to the dying extracting information is to actually open up the chip and expose it by removing the epoxy this basically blocking access to the chip unfortunately at the time I was having trouble getting us in the chemicals I want to use so the very 1st step for me which is shown on the left is actually I distilled the United and that I want to use to cap the chip so once I got that that we move over to the right but not normally the way that I would do this is maybe with a heat gun and small test to just a cap 1 one-chip as we'll see later though this process had some issues were had come play around with a little bit so I've actually decapping abundant ships at the same time unfortunately this reaction is very exothermic that is you know put off like he and actually can explode if you I don't wanna carefully so offer here I put in a water bath and that kind of makes it keeps under control and make I don't have to get a new i or something but the other big problem due to the notices this kind a red gas of building up in there and this red gas is actually rather unpleasant to breathe faster yes 2nd notable part of the set up which is kind in the background there is an addition to that feed it through was called a scrubber unit that actually makes it so very little of this very red unpleasant gas gets released in this process once that done that once that
completes you get something that looks like this I think this is some Xilinx FPGA of sorts but you know the same sort of idea get this kind of tangled mess of bond wires and so again the bond wires being the of gold wires that connect from the plastic packages used to seeing on circuit boards down to the actual sort and I I this makes it difficult to clean it makes it very unstable microscope stages and leads to a number of other problems so we really need a way to rid the suckers off you know just get the bare die so the 1st way that had to do
this which is well what people do is agitate tweezers and you are very careful under a microscope up all these guys off 1 by 1 and that's right it initially in you know works OK but if you want you a bunch of these it really doesn't scale well it's just kind of soul crushing process I may be soothing for some people but you also cannot your risk scratching the dying of your tweezers with us slips I you can mean Abdallah jading maybe crack the dying half if you're really sloppy and you know just 1 avoid that of possible additionally you know this yanking process pretty brutal you actually take chunks out of the I sometimes but not necessarily a problem but it looks kind of ugly so after a look around a little bit of a so there were few other methods that people use for stuff like this 1 of them is actually take Mercury and you use that to dissolve the gold on and I just like you know the gold miners would you would do that Mercury even by my standards I cited that don't really 1 deal that fun have to I looked into it and the hot sorta seems to work just as well not exactly the greatest chemical either but a little bit better than Mercury so if you look on the left you can see a ball bond on a chip and on the right after applying some sort this but what is done is is basically just as all the Goldwater we have the bond pad which is a little bit of a distorted from the ball bonding process which is a newcomer high pressure and chemical process but otherwise we have basically a perfectly functional a bond pattern it's very clean of the way it turns out so
once once we get to this point we've got a bear die and we start extracting information from it so I looked in the market for getting a full computer controlled microscope and unfortunately it's you know very expensive so it instead was kind a hobbled something together from a bunch of pieces are collected basically across the US and so the microscope body itself came from Craigslist at the motor controllers came from the school downstairs the laptop came from Mr. + shop at in was Canada's on everything's gonna hobbled together and somehow it kind managed to make a working system that basically the way that it works is that there's a lamp house which shines light onto the die the objectives you know actually do the magnification and then the motors and go through an ARM processor that I wrote some very crude but effective C code that goes over to weighted use the serial interface to the laptop on the lower left corner but that runs in Python as well as a camera driver I wrote for the microscope camera and uh that's able to you know take pictures from the use the camera and then send commands to the ARM processor to issue us step commands that to the state 1 that at time and I that's how I produced the images that are later used for analysis OK so
at this point we were able to get some top top-middle images of the chip you know the highest of layers but unfortunately for this project that should not that was not enough we're looking for the wrong which will talk about a little bit more later you know the actual firmware in this device but we couldn't see it know we could see some metal traces in a little bit below have we had a little bit deeper you know to get the information that were looking for so basically this process is called the layering and essentially what you're doing is removing the silicon dioxide in metal there on upper layers silicon oxide silicon dioxide is essentially the supporting material that hold everything together and the 1st thing to do is to use a hydrofluoric acid but which you can get through a number of kind of home rust clear products don't try this at home by the way and and I use that to dissolve it unfortunately this had a few big problems are the 1st is that it's somewhat uneven which all talk about later causes some are real problems and the 2nd is that it leaves this aluminum fluoride residue and that's going to deposits and gunk on a diet that's Oregon's cause the later problems but after a little bit of researching looking through some filler announces books by the general recommendation is to use so-called buffered oxide etch and the idea is the you add the ammonium fluoride uh which is you know a buffer that is you know it keeps the ph more constant and therefore you know as the acid kind is depleted and some parts of the chip the buffer welcome to replenish it to the original concentration in keeping a lot more even across the chip even as some parts start at a little bit quicker to begin with and the 2nd part is that I use the vortex a which is basically a glorified mixer and a kind of shake surrounding doesn't seizures and also use a heat gun I that's temperature control not exactly your standard Home Depot 1 and that way everything is very and temperature-controlled it's kind sloshing around which keeps everything well next in so far that seems to give pretty good results it are right so now we run into a little bit of a roadblock on so if you look at the top and what we have is a we call AI nor input and or active program brought that's off the Motorola 68 k as the a microcode it's very plainly visible basically you can season squiggles and essentially no squiggle means 1 and o squiggle mean 0 that's great because you know after some time there we can you see your Jia manually type that whatever and recover that into the microcode but on the bottom there we see the sort equivalent structure after this SES Egypt and we don't really see anything it's kind of a blank slate there's a little bit dots here in their best basically just you know just another garbage on die so at this point will that stuff you know uh well what can we do so then it turns out if you look a little bit more through some failure analysis books I you find upon something called dash echinus mother alternatives but this seems to be no standard and is basically gets you from the image on the left under the microscope to the image on the right and microscope and on the right now we have very clear concise bits that that aren't too bad to image so without a mind let's go through this process because although they made it sound pretty easy in the books it turns out this is fairly involved actually get good results so 1st below the background so basically what we're doing is the semiconductor chips have positive and negative doping which is you know actually makes these transistors work the at small purity is like a boron or phosphorus I to silicon very small quantities now we terms that we can do is we use hydrofluoric acid just like we did for layering to destroy the silicon dioxide we also can use an oxidizer such as Niger gas to actually I turn the silicon substrate into a silicon-dioxide if if we use both of those at the same time we get a competing reactions were some chemistry is creating silicon dioxide is some the chemistry is taking away and it turns out that if you have thin layers of an optical transparent materials such as silicon dioxide gradually get thin-film interference just like soapy bubbles you you see the ring Brewer colors were talking about you know seems effective and so if we do this we actually can create crests and values such as the US an image that some going and interatomic have but I think that is the core to and I see us and there is a little bit lower in some are a little bit higher
at so in a course that also shows up an optical microscope as well as a sum but so once again I basic procedure is I you know maybe 10 or 15 minutes of etching it actually rather quick and fill analysis books recommended you put a strong light on it I like the lights the blinding me from the audience members and that unfortunately I haven't really seen much but changes when I put a strong light but that's what people recommend but unfortunately I ran into quite a few snags which were in goes through and the last unfortunate point the you'll find is because you really are etching away the and if you don't get it right the 1st time you basically lose the data this is definitely going to have a you know kind of figure out ways to doing so the 1st issue run into is that there's
process variation and what that means is that are some chips are actually making a smaller over time you know you're about to that you know 65 nanometer or 22 nanometres ships right you know this kind of shrinking over time know were doing at a much larger scale but it's basically the same idea but the other part is that this chip manufacturers will actually very yeah chemistry used as so for example this new we generally will call the silicon dioxide wells not really that simple you sometimes is thermally grown sometimes it's spin on glass in all these sort of variations of essentially what you're trying to get at is the same as sort of chemistry and that all the facts you know the way that this is chip is gone etch and give your final product that's so fortunately for this chip that these all sports games which basically nobody loves that you know the favorite sports Guyana for 1 year but you know after 10 years you know no really remembers then in the dirt cheap on ebay so I was able to get a big pile of these to play with and that was great because it danger item just have 1 try together right now we can go rounds and iterate so the next issue the running
is that things need to be very high purity and I think this is 1 of the issues I ran into using the early you know hardware store chemicals was that they had you different additives in there that were causing interference on the picture to the right for example um talk talk about interference but those little circles on the left and right I believe those are from tweezers that grabbed the die and the deposit a very small amount of residue onto the died and that was enough to completely the reaction on the die in cause a lot of problems so part of process was finding ways you know to deal very high purity basically you know washing and I wanted to picking it up I just keeping it you know hands on it nothing like that constant contamination another issue I found was I was using the same features for doing the decapping as for the hydrofluoric acid etching and the problem is that nitric acid will react with copper very readily which is you present as the lead frame analog ships and at what this does is it creates copper nitrate which then interacts with the hydrofluoric acid to cause a lot of side reactions will copper plate to die and basically stopped this reaction altogether I so use dedicated glassware wearing you know things started working what better the
another issue I ran into is that you know kind of the back alley ship service and exactly having a some sort of a high-tech act in a temperature humidity control facility said I'm doing is you know in that basically the grant right and so why temperature swings you know cold in winter hot in summer but the main component of this stash next year is a seat acid you know basically concentrated there and 1 of the very interesting properties about this liquid is that or solid rather here is that it it melts at room temperature so depending on how you look at it it's either a solid or a liquid and this becomes a real problem because if it's not a hot day this'll actually precipitate cover your diet and actually interfere with a reaction so the way that I get around this is actually to easy he can just like I was using for and maybe decapping summer delayering work just run it at a slightly elevated controlled temperature so that regardless of whether I run this in summer or winter you know I get kind people process running at about the same temperature and the below you can see an example of that you know what this looks like I when you do it to call the temperature of so even with all this unfortunately I stole ran into a lot of problems where I would take the exact same process it seemed and I would actually I get very different results and sometimes I would get the mask run out and sometimes I wouldn't and and and also after a little bit more research but what I found was that if I lacked the died at an angle which is basically precision polishing but what this will do is it will add a I you know kind of a gradient we can see that the different heights of the transistors essentially to see you know what is the optimal height that we should be operating at to get the best data retention and which showed was you actually want the lower layers of the transistor which is at the right not to get to be the best data readout and on the left area that I I just turned completely black you know there was no time when an axis show the data they just went immediately black in no no real data could be recovered so kind of an ongoing project is staring ways to kind of tune that you how far can dig down in style reliably to make sure that I get the best data every time
and also I get a lot of questions about safety as a I have tokens slide about this acid hydrofluoric acid is in fact you know not exactly the nicest chemical block that so for this project I actually did purchase a of full has masters of which is good because I was able to work with the concentrated hydrofluoric acid release with them you know reasonable safety fortunately I don't have to work with every long you basically take that makes some weaker solutions and most the time you just deal with those so with that I think I'm
going hand aloft emotional but so at this point we have is 8 that map of the masker on which contains the program code for the microcontroller now I mentioned the pith and before they're the 2 chips they're talking to each other so here's what they actually look like but you take a lot of 6 on the left this is on the right there actually share the same CPU core it is called the sm-5 core CPU made by sharp but we do know that at 1st we just we just subjugate so we gave the shots to this guidance Aguirre who has seen a lot of the sharp ships before and he's a very he's actually shot by itself Hjartarson like it you know a lot of stuff up here not working for sharp anyway it was immediately and able to identify that uh architecture and cells it's an of 5 so it's probably custom there's all sorts of stuff hanging off of it that you can't immediately know what it's doing it but there you go so that was our starting point so what is so we have this done in the lower left but surround image that is actually what the code that executes so using uh John masters dashes process we could figure out what it looked like and then get an image
DOE once we had the image which is a big thing on the right that's the entire mass ground is 8 kilobits 1 kilobyte data not exactly the cutest thing does need to be so what I did was instead of trying to go ahead and use open cv to you know is this is Europa is in 1 scan through the entire thing the quality was not that good this is actually a process we started uh is spanned like what is it like several months a year year and a half from when started doing Odessa's when you during the tweak it so these early images are what it basically worked off of it and I decided I would just do everything by hand now I think this is a pretty good case the previous argument for this manual entry when you just have to do something once like it only took me to a write this tool and I subplot so that the made tools sharp I have in the case of not invented here so but I don't even look at all of the use of out there there is a tool if if you have this same sort of problem there's a to author called wrong but which is great tool let you figure out the alignment of the grid and then you know sample on a different points so if he have cleaner imagery especially something check out and what is set on Mr. not invented here said use but they're probably work for you so is my tool it took me half an hour once 0 this to adjust but in all the bits that was used set the grid is space seen it Max off all the stuff that you need to know they'll actually check to make sure the type and everything 2 0 here's just a comparison
of the old processor versus the most recent process John's know best work is on the right to know that's something that you could probably automatically image and it would be fine is a block diagonal the
CPU at a 4 bit CPU it has 1 K around it has 32 nobles not by nobles of RAM to a 16 bytes of RAM and has 4 stack levels don't no recursion but not that you have room to do anything anyway but once we had the architecture someone identified but like a friend Igor indicated to us he said these were actually used in a lot of calculators and stuff like no handheld games from the nineties term we were able OK about 5 or 6 sheets that had this information and the problem was that there was a lot of ambiguity uh but I still minister disassembler OK but this
to give you an example here's a few of instructions it's really hard to figure out what you're looking at here are the men monarchs are the same but it has like 3 different uh actions that uh causes 2 0 and I'm not going to simply anyway so it
it was this middle column at the top is register transfer notation so you can see what's going on and on the right see a branching instructions but I can see what's going
on so once we have this this disassembly I work for a long time and then that's when might actually came in on this project it
so starting from Marshall's this disassembly we were able to get some idea of what the chip it and how it works but this was pretty opaque code I'm not terribly good at reverse engineering this by giving a talk here and and I'm a much more of a devoted guy so I wrote as 5 emulator based on the data and we're actually able to run a simulation of this chip up pretty effectively and it says that diesel emulators got a built-in debugger code memory breakpoints and memory during the but right now I'm working on a new functionality something that's very important the for uh so this is actually open source and have a link to it at the end of the talk so having the the disassembly from Marshall and the emulator we were able to get an almost complete picture of how the chip actually operates so this point were able to understand the major phases of execution and be able interpret some of those logic captures we got off a wire so to give an overview
about it should actually works the 2nd the Council turns on the 6th sense the following data to the pit earth is the hello and a reason ID that identify whether it's a power India chip it sends the valuable the seed and a checksum now the PIF looks at this data and decides whether likes what it sees at any point in this process the PIF can decide that it's not going to allow the Council of boot and just call the Council of freeze and the sequel to sit there waiting forever if the effective does like what it sees it sends the 6 2 levels of data to kind pre-seed memory and then both chips and to the main runtime end this is actually what it looks
like a logic ISA you can see the food the check and the RAM load all happen in the 1st 2nd and a half or so after the Council starts and then into this main runtime this mean runtime ever stops so to drill down a little bit into the boot here you can see the hello in the region ID followed by the sea of the season code it will go back to that a little bit this is how you actually interpret the
data so there are that the pith and the sick are connected by 2 lines on the cartridge bias other top line is a clock blind is driven by the pith and the bottom line is an open drain line that is driven alternately by the paper or the sick and it's uh there's no explicit bus arbitration it's all implicit the running pretty similar code so they know they will step on each other's toes and you can see here that the they encoded seed in this particular example is D 3 9 3 D a lot about what that means in the 2nd of of little zoom in on the checksum here but you can see that it's a bit longer than the seed and finally at the very end a you see the tunable sent from the 5th to the 6th among part so the tunable sent from the 5th to the 6th so this is the 1st time that the payoff actually talks to seconds in any meaningful amount data so after it that it sends those tunable so the sick they
enter the main run time of the the APIs tells the sick but go into memory compare mode and into memory compared so at this point we start to see similarities with the earlier 6 ships remember that the earlier sectors that have very much intelligence of an intended in the Super NES but they had that they were to ships operated in lockstep and if either chip I thought that there was a problem of the data stream that both reset each other in on this chip on the 5th and the 6th but given the sick both run the same algorithm on on the same memory of but they don't do it in lockstep instead they run the algorithm and then they dump the contents of memory and compare each other so 1st the pit since its 1st bit of memory then the 6th since its 1st bit of memory and on each step 1st the sick validates that the papers and the correct it and then the pith melodies that the SEC has the correct that so so it's easier to make yeah OK so and a in this case I I'm because like the on but sorry technical difficulties the so by doing this Nintendo not only made sure that the cartridge in the system was legitimate they also made protected against people from trying a pirate that pit instead of trying to power the 6 so you can have a higher council this is a pretty interesting technique and you can also see here that there is a small delay of highlighted in red when the 6 sends as 0 the 1st bit there is the pitch sending a 0 and you can see both the clock in the data line are driven low and high at the same time however the 1 6 and the bed it waits until the data clock goes high before releasing the line so if you're looking at some unknown ship in the future and source of behavior like this you might be able to deduce from this that it's 2 chips talking at different times and finally the very end of this the PIF tells the sick to go back into the memory compared mode so it runs this for ever until we turn off the Council the party never stops there is no delay and if there's ever a single problem the consul lots of now I said that the given the state run the same algorithm on the same code on this is what that algorithm looks like don't try to get your eyes cross trying understand it it's just garbage and the point here is that it's essentially security through obscurity there's no way you could possibly did use this algorithm realistically without decapping the chip and and extracting the contents of the mass from so it's security through obscurity but it was effective for about 20 years which is more than the useful life of the Council's sort of put this in the win column so we mentioned earlier the 3rd several variants of the sick of 1 of the particular the 61 0 5 had a special extra mode just to try to follow prior prior it's a little bit more of in this mode the game could actually query the sick center the challenge mistake would send a response and this is what the code looks like inside the 6 for doing that it's just another case of security through obscurity what's interesting to note about this is that our gentleman by the name of x scale actually was able to take a huge pile of data has become bloggers data and he was able to reverse-engineer the actual algorithm used to generate this without looking at the code so that was very very impressed so at this point the process we had the disassembler we have emulator we could get a pretty good interpretation of the data coming over lines we still could incompletely clone the chip we had a few more hang-ups I 1 example here is that the data show sheets were not the best sheets that they had some some some incompatibilities for example you can see in the top 1 that they are skipped if the l equals 0 and the 2nd 1 skip if result of B L equals at age so depending on how you implemented these instructions you would have very drastically different code paths and
now the other thing is we had this encoded seat this encoded check some so with these data sheets with there was an there was an opcode called DTA and depending on which state is you're looking at it did something different for example in 1 of the chips it would drive LCD drivers in another ship it would drive analog-digital converters so it seemed to be just sort of a general-purpose instruction used to do a chip specific functions function and in this case we had no idea what this chip specific function was however we could definitely tell looking at the code that it was related to this encoded seed in this encoded checksum is loading some data from somewhere and then that they'd ended up in memory then this encoding process happen and that data got sent over the wire interestingly enough we looked at this encoding
algorithm and I said hey it looks like you could probably run that in reverse
so we came up with the inverse algorithm for this and then based on that data
sent over load the wire we could actually decoded and get the contents of that secret data without actually having understand how this instruction worked so in the 1st example you'd see 1 chip 1 of boots and BD 3 9 3 D and when you decode it you get 3 f 3 f that's the seed for that particular ship the next example the seat is 7 8 7 8 interestingly enough when the system boots this encryption key the 1st 2 bytes there at 1st enables rather are always be 5 the checksums a little bit more interesting it's longer for 1 thing and it uses the 4 noble quote unquote key and this value actually varies depending on a delay from the pit Thursby random period of time that the pith weights before telling the sick OK CMU checksum and that is just based off of the RC circuit delay from a capacitor that offer this chip so finally with all of this we actually were able to completely clone at the chip so in
order to test this we had this guy over here who's an LT pro put together PCB and he was talking about the City Marshall year as you can see I am
a total PCB expert at all it does is it uh that's about 4 pins from the same footprint to be we use to pick my controller as fixed 16 of summer other uh so as you can see that ECB is very very compliant to everything uh this had if you use you know the RHS our lives 3 sorry you find you comply fraud cases so anyway so that was our basically a testbed for the 1st 1st you chips so i come and go ahead and then run a
video of this thing booting and apologize in advance variable is not the best my house for anything that except the composite in that didn't all was also mounted to a wall and the studio monitors the best I could come up with the cell us so the 1st thing that we do here is food banjo to e and as you can see the game actually successfully boots and this is 1 of those games the use of the 61 0 5 chip but it won't even get it or even boot if you haven't implemented the 61 0 5 child response algorithm correctly actually this game uh it encrypts all this game assets and he uses the response as the decryption key so at the crypt itself at runtime so uh the way they actually emulate this on a computer is to just capture all the responses as someone please through the entire game because the over several hundred responses that you have no actually interesting side note about that after X scale I was able to reverse engineer this algorithm he you generally regenerated but the list of all the challenges and responses and it turned out that this there is a semi fat finger 1 of the the responses in the file so so after up and to reboot so we just had a guy by name of are place through this game 100 % he just finished playing 100 % last nite and he did not run into any problems whatsoever so very confident that our is working on a person effectively the so after the game finishes up interesting dozens and so just for completeness we also went ahead and booted in another game another sick and this is using our our little adapter word that I can show you have to talk about this
just booting Star Fox and again I'm left this game running overnight and it never stops never never seen because the problems so we're we're pretty confident in America code the public schools embedded computer sorry guys if I had control cues again a quick PowerPoint living back user
firm for a couple weeks now commercial tell a joke the put me on the spot here well well of the joke stages and rule out of it I was in play but but
very it in and very so of those are our demo was no logo Nintendo 64 from the states here to show it but but in any case really really are in any case so so the features of our clone shippers is actually region free I discovered a technique for making it able to boot in either the power the Ntsc region of not releasing that code but I am releasing a bare-bones version of this code opensourc so others can begin a blink at the end of your check out my really possum it will take assembly go go nuts and and mineral look about architecture again but the thing about think it's pretty terrible but for this particular microarchitecture it has some nice features that made implementing this stuff pretty easier than it could have been otherwise remember we mention that this is a 4 bit microcontroller so when you got things like I like carried out it all depends on not carry an 8 bit it's carrying the 4th bit they can actually has a feature called decimal carry so if the force that carries a flag in the status register so we're able to actually implement the codon pretty straightforward manner of not having to think too hard about 4 it matters that we ran into an interesting problem with the pith so the the CPU clock for the sick is around 1 point 6 to 10 megahertz and the internal logic of the chip actually runs at half that speed so we wired up a picture the same clock and we thought career have twice as many instructions but to actually implement the same thing because we'll have that will be running at the full external clock speed all fun fact about a bit takes actually run it 1 for the external clock speed so we have half as many instructions that then work out but luckily mycogen makes of incompatible part till we originally specs and it has an internal for its PLL Cyrillic around them so I guess you win some you lose some of the with that our last but not least we differ we wanna mention some related work we spent about to be to have years working on this and in the meantime at least 1 other independent effort came about to reverse engineer the chip hours so of a German team led by 2 guys in markets but grew up wrote a paper called this of breaking this integrated circuit by security area but they found a factory test mode on this chip they are the date like we did the cap that ship and optically image Did they traced out some logic on a chip and found that there is actually a factory test mode and so they found that they were actually able to perform arbitrary code execution on this chip and uh so using using their technique we could actually start to understand what some of these an unknown instructions did and and and runs some column chip so once again our PCB pro over here as a
board it's a very nice word of the I made last year so it's not that out of the more and so of this this board has a footprint
for us sick on here and also has the ability to burn texts in slices it places and so this was a pleasant and FPGA board there and we were able of clocks encoded into it and run arbitrary code and using this technique we were able to extract the mass from using a code and validate that our image that we have obtained optically was bit-for-bit identical to the the image and it turns out it was so it was really great to find out that our technique was very effective so what are the other things are
working on that's also related to Nintendo 64 is ht my converter that you know of skills a signal so I needed a way to build up the the firmware for that in the field so I thought OK you just make yourself a custom game you put in Nintendo to boost in every flashes everything so this was this is 1 of the biggest use cases that I can see right off for this uh clone chip is the just put on their it costs like 70 cents and then you can make light in scatter these things and not have to worry about getting them back so you're not depending on you know scavenging stuff from older games the so we'll talk a little bit about the
future work but we also John D. captain image the pair of the more advanced chip that lives on the Nintendo 64 and so we we traced out John results logical that and found the same to test things that markets the markers had identified so we strongly suspect that the internal test mode is present on this ship that we did extract the die image of the ROM image optically but problem we try to interpret it we ran into some weird problems so I think for future work we're going to try to identify the bus that that actually you plot the data in and out so this is something you did
Marshall right at that the diamonds that John made and by 1 around the periphery the
chip or the inputs and outputs are and I tried to catalog would nets were driving more opinions and it turns out some
pins really driven or drove 1 that was and that is basically a signal so around this the outside the periphery the chip is depend number the function of the chip and this blue number the blue number is the number of nets that that uh I driver has so if you look at the top right corner you'll see being 0 6 6 6 3 6 3 6 4 uh the those are a lot higher than was my lesson thinking that these uh depends have often functionality just like the sick and we use it for arbitrary code execution of this is future work we you know we just discovered this like a week ago so but we're really hoping we could run our code on this ship this has its own 1 K Ramos well but it's actually fully utilized unlike the set is basically have in the cell so now we have some interesting ideas about how we might find those patterns of you want was after the talk about that be happy to know that's pretty much only for you today
give us some things markers the markers very graciously helped us out and Sega who's crazy smart as likely as well helped a lot of this project I think nobody knows more about the Nintendo 64 bits and he does I indicated out in Australia help a lot with the PAL testing are being a juror who were running through games and making sure that they continue running so that will releases the the public there will be solid as a rock and shout outs to some friends on the internet and 64 dead and she lacked scale the this rest in peace Andrew thanks for this for everything and that will open it up to any questions and these are contacts and
if it
that you is it it but for the wasn't talking guys but hey you can't see me progress you question so the 4 members in the 80 s sick had this path that you could lift what that means it is grounded that would disable the stake in the consul so any game you gives you could just run on it did you notice anything with the and 64 city by looking through the coder like figuring out something else that is the easy way to bypass this whole thing if you could you know modify the Council will like this and the PIF is what again worry about and was inside the Council and does all the system bring up and it does handle the research and analyzed for the MIPS CPU and it pulls the controllers and lots of so basically the A. Campbell it away and replace it with your own but you have to listen copper code the bootloader added the put that new new 1 and then most likely all this now is not a practical approach but if we get the pitch code maybe there's a hidden mode where the 2nd time they just stop bugging me in and let run forever on this is the technical difficulties you to of a really they're they're almost solving a problem this by hiding it inside of more so the the hiding inside a much more complex so here and questions so or the take a moment to say really enjoy video games the they so when you guys approach to that searching for the hidden sex you guys had a bunch of cottages you can just by pickpockets sense each but how did you approach that searching the chip in the consul really have like a couple of them in order to get a sacrifice like 2006 cost the so where so at that point I already told the process for the US 61 a 2 and a process on the was very similar so I was able to just say OK look these chips are made on the same process it's going to require the same recipe as so really wasn't that big a deal to get the process working with once of working on this we have more questions in front so and the it yeah so here Alexi anything of here by also so the modern never drives the how does that work and you measure the stuff with the again so all so the clone of the sick is open source so if you want to use that you can of the currently as far as I know the the using the the same same technique at 64 . users which is a cop an actual chip inside the Council of our original and management of 6 so that the at what the right had uh they were questions but will more of it is the most questions of ever got from a talk to so yeah yeah this is a little less than a quarter of and the old CSC have like an unusual for the polynomial instruction counter curious there any hard work works of and 64 yes if similar but of size is being fought a microcontroller was created on the regular linear counter of nothing all out of the ordinary yeah because I've seen the reversing efforts for the previous yesterday I was always curious how they had you know manually reverse that polynomial instruction counter and going through the code and that was at the heart of a sensor is is 1 of those those people use like are you crazy smart just just take this and do you think it right that's it you teeth