TLFeBOOK solutions@syngress.com Over the last few years, Syngress has published many best-selling and critically acclaimed books, including Tom Shinder’s Configuring ISA Server 2000, Brian Caswell and Jay Beale’s Snort 2.0 Intrusion Detection, and Angela Orebaugh and Gilbert Ramirez’s Ethereal Packet Sniffing. One of the reasons for the success of these books has been our unique solutions@syngress.com program. Through this site, we’ve been able to provide readers a real time extension to the printed book. As a registered owner of this book, you will qualify for free access to our members-only solutions@syngress.com program. Once you have registered, you will enjoy several benefits, including: ■ Four downloadable e-booklets on topics related to the book. Each booklet is approximately 20-30 pages in Adobe PDF format. They have been selected by our editors from other best-selling Syngress books as providing topic coverage that is directly related to the coverage in this book. ■ A comprehensive FAQ page that consolidates all of the key points of this book into an easy to search web page, pro- viding you with the concise, easy to access data you need to perform your job. ■ A “From the Author” Forum that allows the authors of this book to post timely updates links to related sites, or addi- tional topic coverage that may have been requested by readers. Just visit us at www.syngress.com/solutions and follow the simple registration process. You will need to have this book with you when you register. Thank you for giving us the opportunity to serve your needs. And be sure to let us know if there is anything else we can do to make your job easier. Register for Free Membership to 304_Game_Hack_FM.qxd 9/27/04 3:25 PM Page i TLFeBOOK 304_Game_Hack_FM.qxd 9/27/04 3:25 PM Page ii TLFeBOOK Joe Grand Frank Thornton Albert Yarusso Special Foreword by Ralph H. Baer “The Father of Video Games” GAME CONSOLE HACKING Have Fun While Voiding Your Warranty 304_Game_Hack_FM.qxd 9/27/04 3:25 PM Page iii TLFeBOOK Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and WITHOUT WARRANTY. You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or conse- quential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®,“Career Advancement Through Skill Enhancement®,”“Ask the Author UPDATE®,” and “Hack Proofing®,” are registered trademarks of Syngress Publishing, Inc.“Syngress:The Definition of a Serious Security Library”™, “Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Syngress Publishing, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY SERIAL NUMBER 001 JKL32CVF79 002 P5FGJK9995 003 82H24555YY 004 38IIHGF543 005 CVPLQ6WQ23 006 VT5123HG66 007 H3WD3EHJNB 008 29WMKB8765 009 62SDJTHGGG 010 I5TBBB536T PUBLISHED BY Syngress Publishing, Inc. 800 Hingham Street Rockland, MA 02370 Game Console Hacking: Xbox, Playstation, Nintendo, Atari, & Gamepark 32 Copyright © 2004 by Syngress Publishing, Inc. All rights reserved. Printed in the United States of America. Except as per- mitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for pub- lication. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 ISBN: 1-931836-31-0 Publisher: Andrew Williams Page Layout and Art: Patricia Lupien Acquisitions Editor: Christine Kloiber Copy Editor: Darlene Bordwell Technical Editor: Joe Grand Indexer: J. Edmund Rush Cover Designer: Michael Kavish Distributed by O’Reilly Media, Inc. in the United States and Canada. For information on rights and translations, contact Matt Pedersen, Director of Sales and Rights, at Syngress Publishing; email matt@syngress.com or fax to 781-681-3585. 304_Game_Hack_FM.qxd 9/27/04 3:25 PM Page iv TLFeBOOK Acknowledgments v We would like to acknowledge the following people for their kindness and support in making this book possible. Syngress books are now distributed in the United States and Canada by O’Reilly Media, Inc.The enthusiasm and work ethic at O’Reilly is incredible and we would like to thank everyone there for their time and efforts to bring Syngress books to market:Tim O’Reilly, Laura Baldwin, Mark Brokering, Mike Leonard, Donna Selenko, Bonnie Sheehan, Cindy Davis, Grant Kikkert, Opol Matsutaro, Steve Hazelwood, Mark Wilson, Rick Brown, Leslie Becker, Jill Lothrop,Tim Hinton, Kyle Hart, Sara Winge, C. J. Rayhill, Peter Pardo, Leslie Crandell, Valerie Dow, Regina Aggio, Pascal Honscher, Preston Paull, Susan Thompson, Bruce Stewart, Laura Schmier, Sue Willing, Mark Jacobsen, Betsy Waliszewski, Dawn Mann, Kathryn Barrett, John Chodacki, and Rob Bullington. The incredibly hard working team at Elsevier Science, including Jonathan Bunkell, Ian Seager, Duncan Enright, David Burton, Rosanna Ramacciotti, Robert Fairbrother, Miguel Sanchez, Klaus Beran, Emma Wyatt, Rosie Moss, Chris Hossack, Mark Hunt, and Krista Leppiko, for making certain that our vision remains worldwide in scope. David Buckland, Marie Chieng, Lucy Chong, Leslie Lim, Audrey Gan, Pang Ai Hua, and Joseph Chan of STP Distributors for the enthusiasm with which they receive our books. Kwon Sung June at Acorn Publishing for his support. David Scott,Tricia Wilden, Marilla Burgess, Annette Scott, Andrew Swaffer, Stephen O’Donoghue, Bec Lowe, and Mark Langley of Woodslane for distributing our books throughout Australia, New Zealand, Papua New Guinea, Fiji Tonga, Solomon Islands, and the Cook Islands. Winston Lim of Global Publishing for his help and support with distribution of Syngress books in the Philippines. A special thank you to our attorney and friend Gene Landy, whose expertise in “all things intellectual property” is impressive. 304_Game_Hack_FM.qxd 9/27/04 3:25 PM Page v TLFeBOOK 304_Game_Hack_FM.qxd 9/27/04 3:25 PM Page vi TLFeBOOK vii Technical Editor & Contributor Joe Grand; Grand Idea Studio, Inc. Joe Grand is the President of Grand Idea Studio, a San Diego- based product development and intellectual property licensing firm, where he specializes in the inven- tion and design of consumer electronics, medical devices, video games, and toys. His latest creations include the Stelladaptor Atari 2600 Controller-to-USB Interface and the Emic Text-to-Speech Module. A recognized figure in computer security, Joe has testified before the United States Senate Governmental Affairs Committee and is a former member of the legendary hacker collective L0pht Heavy Industries. Joe’s research on mobile devices and embedded security has been published in var- ious periodicals, including Circuit Cellar and the Digital Investigation Journal. He is the author of many security-related software tools, including pdd, the first forensic acquisition application for Palm devices. Joe currently has a patent pending on a hardware-based computer memory imaging concept and appa- ratus (U.S. Patent Serial No. 10/325,506). Joe has presented his work at numerous academic, industry, and private forums, including the United States Air Force Office of Special Investigations, the Naval Postgraduate School, the IBM Thomas J. Watson Research Center, the Embedded Systems Conference, the Black Hat Briefings, and DEFCON. He has appeared in documentaries and news for television, airplane in-flight programming, and print media outlets. He has also authored Hardware Hacking: Have Fun While Voiding Your Warranty (Syngress Publishing, ISBN: 1-932266-83-6), contributed to Stealing The Network: How to Own A Continent (Syngress, ISBN: 1-931836-05-1), and is a frequent contributor to other texts. Joe holds a Bachelor of Science degree in Computer Engineering from Boston University. Joe is the author of Chapter 1 “Tools of the Warranty Voiding Trade,” Chapter 2 “Case Modifications: Building an Atari 2600PC,” Chapter 5 “Nintendo GBA,” Chapter 6 “GP32,” Chapter 7 “NES,” and the Appendices. 304_Game_Hack_FM.qxd 9/27/04 3:25 PM Page vii TLFeBOOK viii Frank (Thorn) Thornton runs his own technology-consulting firm, Blackthorn Systems, which specializes in wireless networks. His specialties include wireless network architecture, design, and implementation, as well as network troubleshooting and optimization. An interest in amateur radio has also helped him bridge the gap between computers and wireless net- works. Frank’s experience with computers goes back to the 1970’s when he started program- ming mainframes. Over the last 30 years, he has used dozens of different operating systems and programming languages. Having learned at a young age which end of the soldering iron was hot, he has even been known to repair hardware on occasion. In addition to his computer and wireless interests, Frank was a law enforcement officer for many years. As a detective and forensics expert he has investigated approximately one hundred homicides and thousands of other crime scenes. Combining both professional interests, he was a member of the workgroup that established ANSI Standard ANSI/NIST-CSL 1-1993 Data Format for the Interchange of Fingerprint Information. He has co-authored WarDriving: Drive, Detect, and Defend: A Guide to Wireless Security (Syngress Publishing, ISBN: 1-93183-60-3), as well as contributed to IT Ethics Handbook: Right and Wrong for IT Professionals (Syngress, ISBN: 1-931836-14-0). He resides in Vermont with his wife. Frank is the author of Chapter 3 “Xbox.” Albert Yarusso is a principle of Austin Systems (www.austinsystems.com), an Austin,Texas- based firm that specializes in web design programming and hosting services. Albert’s back- ground consists of a wide range of projects as a software developer, with his most recent experience focused in the game industry. Albert previously worked for Looking Glass Technologies and more recently for Ion Storm Austin, where he helped create the highly acclaimed PC game Deus Ex. Albert co-founded AtariAge (www.atariage.com) in 2001, a comprehensive website devoted to preserving the history of Atari’s rich legacy of video game consoles and computers, which has become one of the busiest destinations on the web for classic gaming fans. In 2003, Albert helped bring the first annual Austin Gaming Expo (www.austingamingexpo.com) to Austin, an extremely successful event that drew over 2,000 visitors in its first year.Albert is also a contributor to Hardware Hacking: Have Fun While Voiding Your Warranty (Syngress Publishing, ISBN: 1-932266-83-6). Contributors 304_Game_Hack_FM.qxd 9/27/04 3:25 PM Page viii TLFeBOOK ix Albert is the author of Chapter 8 “Atari 2600,” Chapter 9 “Atari 5200 SuperSystem,” and Chapter 10 “Atari 7800.” Jonathan S. Harbour has been an avid hacker for many years, having started with early sys- tems like the Commodore PET,Apple II, and Tandy 1000. He holds a degree in computer information systems, enjoys writing code in C, C++, and several other languages, and has experience with many platforms, including Windows, Linux, Pocket PC, and Game Boy Advance. Jonathan has written several books on the subject of game programming, and may be contacted via his Web site at www.jharbour.com. Jonathan is a contributor to Chapter 5 “Nintendo GBA.” Marcus R. Brown is a software engineer at Budcat Creations. His work includes writing low-level drivers and system-level programming such as resource management, file loading, and audio streaming. He is currently working on an unannounced title for the PlayStation 2 and Xbox. Marcus lives in Las Vegas, Nevada. Marcus is the author of Chapter 4 “PlayStation 2.” Christopher Dolberg is a full-time student, and an avid player of console and PC games. When not gaming, he can be found modifying his hardware in an attempt to push it to the very limits of its function. Occasionally he takes time off from both these activities to actually attend classes. He resides in Vermont. Chris is a contributor to Chapter 3 “Xbox.” 304_Game_Hack_FM.qxd 9/27/04 3:25 PM Page ix TLFeBOOK [...]... consoles, from the retro and arguably archaic Atari systems, to the teenaged Nintendo NES console, up through the modern consoles like Xbox and PlayStation 2 There’s something in here for every type of gamer, whether you like to get your hands dirty with modifying hardware or whether you’re an aspiring game developer Step-by-step hacks are presented with a slew of pictures to hold your hand along the way,... Contributor Ralph H Baer is an engineer and a hacker from way back, as well as a prolific inventor with over 150 US and foreign patents to his credit He is best known as the “Father of Video Games.” For over fifty years he has had one leg in the commercial and defense electronics development and production business; and the other leg in toy and game design Many wellknown handheld electronic toys such as “Simon”... 497 Other Hacks 501 Atari 7800 Composite and S-Video Output 501 Sega Genesis to Atari 7800 Controller Modification 501 NES Control Pad to Atari 7800 Controller Modification 502 Atari 7800 DevOS Modification and Cable Creation 502 Homebrew Game Development 502 Atari 7800 Resources on the Web 506 TLFeBOOK... distribution and marketing; and that was Magnavox.The first Magnavox Odyssey games showed up in stores in the fall of 1972, over five years after I had the original epiphany A couple of years and about 340,000 games later, Odyssey was replaced by a newer model using IC’s and the competition was busy cranking out their own versions.The industry had been launched.The fact that Atari s Pong arcade game hit... 231 Tile-Based Modes (0–2) 232 Bitmap-Based Modes (3–5) 232 The Sound System 233 Homebrew Game Development 233 Other Hacks 234 Nintendo GBA Resources on the Web 238 TLFeBOOK xvi Contents Chapter 6 Gamepark 32 (GP32) 241 Introduction ... the kill For gamers, by gamers There’s something to be said for pouring your heart and soul into a creative game design or hardware hack, and I hope this book will entice you to do so Inspiration and creativity can’t be taught or forced.The possibilities are endless The way we customize our things says a lot about who we are Who are you? —Joe Grand, author, hardware hacker, and gamer July 2004 www.syngress.com... Advance Introduction Game Boy, 1989 Game Boy Pocket, 1996 Game Boy Color, 1998 Game Boy Advance, 2001 Game Boy Advance SP, 2003 .181 182 182 183 183 184 185 TLFeBOOK Contents xv A Very Brief History of Nintendo 186 Opening the GBA Console 187... licenses and the same, overused 3D game engines.There are thriving development communities for all the systems we cover in this book.There are people who still yearn to develop games just so they can play those games Sharing code samples, socializing with fellow programmers, hacking videogame systems to allow them to run their custom software, designing games for the sheer thrill of the kill For gamers,... basic handball game to produce ball-slapping sounds and added a feature which caused the wall to gradually move closer to the players, speeding the game up progressively It was fun to play, also and drew the same amount of enthusiasm from the great marketeers at Magnavox You can take a horse to water but you can’t make it drink, I guess Fortunately the TV game engineers at Magnavox, now labeled video game. .. to play a car racing game or whatever Management’s reaction was predictable: “Forget it Finish the damn set.You’re behind schedule as it is.” The thought resurfaced in August of 1966 I wrote a 4-page disclosure document on September 1st that laid it all out: Chase games, sports games, quasiboard games…the lot! I had one of the engineers in my division at Sanders Associates sign and date each page.That . Publishing, Inc. 800 Hingham Street Rockland, MA 02370 Game Console Hacking: Xbox, Playstation, Nintendo, Atari, & Gamepark 32 Copyright © 2004 by Syngress. Contributor Joe Grand; Grand Idea Studio, Inc. Joe Grand is the President of Grand Idea Studio, a San Diego- based product development and intellectual