don't click here

Analysis of a Mega Drive "emulator" GBA bootleg

Discussion in 'Technical Discussion' started by RibShark, May 29, 2024.

  1. RibShark

    RibShark

    Member
    113
    37
    28
    I already posted this on my twitter, but figured people here would find this interesting.

    Seven years ago, a video of a bootleg GBA cart with an apparent Mega Drive emulator appeared on YouTube. Given that there has never been any other emulator like this released, I was pretty intrigued and spent a good amount of time trying to find a similar cart for myself so I take a look at it. Well, after years, I finally found someone who had one and had them send it to me; and it turned out to be far more interesting than I anticipated.

    The first thing I did was attempt to dump the cart via actual hardware with a link cable. This was partially successful: the resulting ROM booted on emulator and showed a splash screen, but then crashed upon trying to boot the game:
    [​IMG]

    I had already expected the cart to have some sort of mapper that would prevent a simple ROM dump from working though, so I went to take a look at the code with a disassembler. What I found was that the main ROM (internally named GASA_MENU), after showing the splash, actually copied a secondary, multi-boot (link cable boot) ROM (internally named GASA_ENG) into the memory of the GBA and then jumped to that ROM. The trouble was, on analysing this second ROM, it seemed to only have around 0x8000 bytes of code; this is far less than would be needed to implement a full blown Mega Drive emulator. Furthermore, the code seemed to loop infinitely and never return execution back to the cart. This means that there was no way it could, for instance, be loading a new bank onto the cart to jump back to the code there. At this point I was stumped, I had no idea how this could be working, and I figured there must be something I was missing in the code.

    While I was analysing the code, I had the game on in the background when I accidentally jostled the cart a little bit. Suddenly the screen and audio were completely filled with static. I reinserted the cart, and the game immediately started working again. This took me by surprise, as usually if the data lines of the cart are disconnected at all the game should completely crash, but instead it seemed to be working as if nothing had happened! So I tried it again, deliberately this time, and found that not only did the game not crash, it actually continued running the entire time the cart was partially disconnected!


    At this point I finally realised what was going on. The GBA was indeed just running a small amount of code from RAM in a loop. That code though, was interfacing with the cartridge to receive audio and video from a Mega Drive on a chip in the cart. When the cart was disconnected, the audio+video was just reading off an open bus instead, which caused the static to appear. Meanwhile the game itself continued to run on the cartridge hardware. It turns out this wasn't a software emulator at all, but a hardware clone packed into a tiny chip. I have never seen such a tiny chip for this before, but it is the only reasonable explanation. I'm honestly incredibly impressed that they could pull this off. Unfortunately this means it isn't really possible to experiment with the "emulator" as I had hoped. Still incredible to see though, especially on such a barebones PCB and I hope that maybe it might be possible to flash other ROMs on there.

    Below are some pics of the PCB in question. Has anyone here ever come across a clone chip so small before? I'm very curious how they were able to pull this off.
    [​IMG] [​IMG]
     
  2. Chimes

    Chimes

    The One SSG-EG Maniac Member
    754
    543
    93
    This is so eldritch, I've never seen a cartridge for another system use a GOAC before. I wonder if there's more cartridges like this in other systems... nay, in other clones, too...
     
  3. Cooljerk

    Cooljerk

    Professional Electromancer Oldbie
    4,608
    284
    63
    Obvious example would be the SNES carts that can play Sega Genesis games via SOAC:

    img_1819.jpg
     
  4. Jeffery Mewtamer

    Jeffery Mewtamer

    Blind Bookworm Member
    1,934
    118
    43
    From the title, I knew there had to be something weird going on with this cart... After all, I recall Genesis emulation being damn near the limit of what the GamePark 32 could do and it had an ARM processor roughly ten times as fast as the GBA's at a time when clock speed was the biggest determining factor in how processors compared.

    Still, even if built for the specific game and lacking any megadrive capabilities the game doesn't use, it's mind blowing that someone fit an entire Genesis clone into a GBA cart... makes me wonder how many retro clone systems one could theoretically fit into the volume of a Raspberry Pi while also having room for an SD card to load roms from and USB prts for gamepads... granted, it would be simpler just to run all the software emulators one wnnts on the Pi, but still, makes one wonder about the limits of miniaturizing old hardware.
     
  5. Clownacy

    Clownacy

    Tech Member
    1,076
    638
    93
    Is there really anything mind-blowing about this? I've seen some random internet person shove an ARM SoC into a Gameboy cartridge in order to run Doom on it. Tiny little <5v SoC mounted on a board and supplied with power can do all kinds of things - it's nothing new.
     
  6. Jeffery Mewtamer

    Jeffery Mewtamer

    Blind Bookworm Member
    1,934
    118
    43
    Admittedly, I have no good reference for how big(or I guess small) a typical SoC is and my point of reference for very small single board computer is a Raspberry Pi 0, and that's quite a bit larger than a GBA cart(and possibly more total area than a GB/C cart, though without looking up the dimensions and doing the math, it's hard to say if the Pi0 being longer than a GB cart makes up for it being narrower.

    And now that I think about it, I do recall once listening to a YouTube video where someone mounted a Pi 0 inside a custom NES cart or something like that, it just never occurred to me that stripping down to just a SoC could let one do the same with a tiny handheld cart...
     
  7. shilz

    shilz

    Member
    1,092
    288
    63
    getting my daily allowance of vitamin kk
    This is like a whole rabbit hole of cartridges that make consoles to do things they're normally not able to, almost all unrelated to each other and made at drastically different times for different reasons.

    And when you think about it stuff like the NES SuperFX chip, 32x, various portable TV tuners and most cheat devices, Sonic & Knuckles, and Flash carts are a part of that.
    Your Genesis, SNES, Game Boy and DS accept SD cards? You can watch TV on your Game Boy? That's crazy!

    I even remember hearing somewhere that some GBA or DS flash card had some hardware specifically made for playing game boy or NES games even if the hardware normally didn't do it.

    And these days, similarly to the raspberry pi example, DIY is so crazy that yeah, you can get GTA 5 running on a game boy via streaming.



    Or you can turn your GBA (or DS by extension) into a wireless USB game controller.



    Even knowing stuff like that exists and how relatively "unspecial" it is, It's still really cool an anomaly like this hybrid Genesis GBA cartridge exists.

    Edit: now that I think about it, I remembered a GBA version of Somari that may or may not have been a similar case, or even an inspiration of sorts. I can't remember how existent NES Emulation is on the GBA.
     
    Last edited: Jun 4, 2024
  8. Jeffery Mewtamer

    Jeffery Mewtamer

    Blind Bookworm Member
    1,934
    118
    43
    Admittedly, I don't have any hands-on experience with flash carts, and most of my experience with special cartridges, add-ons, cheat devices, etc. aside from SNES SuperFX games have involved in elegant bulk(Pokemon pinball was bigger than a normal GBC cart and weirdly shaped to account for the rumble and it's extra battery, Yoshi's topsy turvy was halfway between GBA and GBC carts in size to account for the tilt sensors, the N64 GameShark a friend had pulled a S&K lock-on two full-sized carts stacked, the GameShark SP I had for my GBASP added more bulk than the GBA Wireless adaptor or a GB/C cart did, the Super Gameboy was twice the height of a normal SNES cart, the Gamecube's Gameboy Player wa actually quite elegant with how it added just enough height to make the gamecube an actual cube, but still was bigger than an actual GBA and 25% the volume of the Gamecube)... and admittedly, it's a bit of a logical leap to go from "trick the system's data loading hardware into loading data from storage media with far more capacity than the system was intended to ever load from to Fit and entire other system into the data storage medium and reduce the host to essentially be just a display and controller.

    Now, can something similar be done with disc based systems... presumably,, the port the Gamecube uses for the GB Player could be used to interface any other clone system, but is there a way to say, make a PSOne act as IO for a Vita clone SOC? Admittedly, this is mostly a curiosity since it would probably be simpler to just build a clone system that could interface directly with a television and USB gamepads, but hey, we're well into terroritory of "awesome, but impractical".
     
  9. Cooljerk

    Cooljerk

    Professional Electromancer Oldbie
    4,608
    284
    63
    The original PS1 had a parallel port that was fast enough to run emulators from. I had one back in the day, it was a cart adapter that would go into the parallel port. Later models removed it, and the only other external input port would be the serial port, which would not be fast enough to read from a cartridge in real time.

    The dreamcast's modem port, known as the G2 bus, is actually conformant to the PCI standard, except the Dreamcast lacks a PCI Controller. The modem gets around this by putting the PCI Controller on the board that connects to the G2 bus. You can definitely make that port read outside media, there are projects that add a hard drive to the dreamcast through this bus this very way.

    PS2 and Xbox and onward have USB inputs, which would be fine for reading a cartridge.
     
    • Informative Informative x 1
    • List