Technical blog by Joonas Javanainen
Game Boy Advance boards have a 10 nF capacitor C62 between the d-pad up input and ground, but other d-pad buttons have no capacitor. This raises the question: why is it needed for one input but not for the others? Schematic screenshot from OpenTendo Game Boy Advance , which is a recreation of the original board Theory: DC/DC conversion noise I think the capacitor is needed, because the d-pad…
Thanks to the "great" effort of Elon Musk, Twitter is in flames and I've suddenly realized all my data there is potentially at risk. During the last 8 years, I've occasionally tweeted about my Game Boy research and projects, so here's an archive of my Game Boy tweets with some extra commentary. Quick links to each year: 2015: Research begins 2016: First custom hardware to support…
Flash cartridges (= "carts") are commonly used to run Game Boy ROMs, such as homebrew games or dumped officially released games, on real hardware. Different kinds of flash carts with various features and performance characteristics have been available for a long time, but flash carts have in general the reputation of consuming a lot of power, greatly reducing the battery life of a Game Boy system,…
Biverting a greyscale Game Boy screen is a very popular mod, because it's widely considered to increase the screen contrast. The principle of biverting is fairly simple: we invert the LCD pixels once digitally, and then again optically. As a result, the pixels have the originally intended colors just like without biverting (black is black, light grey is light grey, etc...). This mod might…
This time I've decapped a Microchip PIC16LC72A , an 8-bit PIC microcontroller chip. The chip is in SOIC-28 package and is the LC variant which supports lower VDD voltage than the normal C variant. Based on the package marking information described in the datasheet, the chip is from year 2000 week 50. Here's the raw die after decapping (click for max resolution photo. Warning: it's…
This time I've decapped an STMicro L78M05CV , a fixed 5.0V linear regulator chip. Disclaimer: there's a small possibility I've mixed two chips and the raw die photo is actually L7805CV instead... This version of the chip is in the TO-220 package, which requires more heat than usual during thermal decapping, or the raw die might not detach cleanly from the packaging. I actually…
I've decided to start decapping random chips I've harvested from various boards to practice both the decapping procedure and imaging/stitching of microscope photos. Today's specimen is a Samsung S4L8K1X01 chip, which I think came from a mobile phone (Samsung S3 mini perhaps??). There's no public data sheet available, but based on some searches it seems to be some kind of…
This time I've decapped a Texas Instruments OPA1632 , a fully-differential operational amplifier chip. This specimen is an OPA1632D, which is the SOIC-8 -packaged version of the chip. Here's the raw die after decapping (click for max resolution photo): This photo was captured using my "Frankenscope", and is licensed under Creative Commons Attribution 4.0 International. There's one…
This time I wanted to post some photos of old PCBs I've designed in the last couple of years. All these boards are related to my Game Boy research activities, which started back in 2014. I was building a Game Boy emulator ( Mooneye GB ) and found existing documentation about the system lacking in detail, so I started doing my own research. In order to find information about the system, I…
I gave a presentation about Game Boy reverse engineering at Disobey 2018, a security/hacking-oriented conference held in Helsinki. It was a really nice chance to show off some of my tools and research results, and at least from my point of view the presentation went really well! Here's a YouTube video of the presentation: Unfortunately, even with a lot of preparation, some errors managed…
I own an SFC (Super Famicom, "Japanese SNES") that I use for running hardware tests on Super Game Boy and Super Game Boy 2 systems. My SFC has been modded with a SuperCIC mod so I can also use a PAL Super Game Boy with it. Unfortunately I got the SFC a fairly long time ago when I didn't have that much experience with electronics and console hardware, so I was very sloppy and ended up damaging…
I've made some progress in my research, but don't have any mindblowing findings to share yet. CPU versions I've finally acquired all of the Game Boy CPU versions. CPU CGB A was the trickiest one, and the serial number of the unit doesn't make much sense when compared to data from my other units. So, unfortunately the data doesn't make it possible to predict which units…
Game Boy test ROMs are crucial tools for verifying the collective understanding of the Game Boy hardware. Test ROMs can be executed on real Game Boys to check that they test the right things, and they can also be executed on emulators to check whether the emulator implements certain behaviour correctly. Unfortunately writing good test ROMs is surprisingly difficult, and a badly written test or…
It's been a while since the last time I wrote anything about Game Boys. Unlike what it might seem, I haven't stopped doing research or working on my emulator. It's the complete opposite: I've been very busy setting up better tooling for hardware testing, which will hopefully lead us to the "end-game" of Game Boy research where most questions are answered. I've decided to…
Last year I took PCB photos of all Game Boy games I own, but I never managed to categorize or publish the photos I'm not going to analyze all of these in detail, so I'm just going to leave the photos and basic information here for those who are interested in such things. The titles are based on the current No-Intro Game Boy and Game Boy Color databases, and there might be slight…
I've decided that it's time to do a proper release of Mooneye GB after more than one year of development. Mooneye GB is a Game Boy emulator project I started last year, and it has been my main hobby project since then. The first public commit in the repository is from Dec 18, 2014, but the project has actually a longer history. The initial commit for my private Mooneye GB repository was…
I'm happy to announce that I've succeeded in dumping the Super Game Boy 2 boot ROM. I take my hat off to Costis Sideris, who managed to dump the original Super Game Boy boot ROM , and documented the procedure with enough details for other people to follow his footsteps. I basically just replicated the same steps on the SGB2 with slightly different tools. The entire process took all my…
In my previous blog post I analyzed a Gameboy cartridge with a DMG-BEAN-01 circuit board. This time we'll take a look at three DMG-BEAN-02 games. I didn't trace the connections, because the DMG-BEAN-02 board seems to be identical to DMG-BEAN-01. I'm sure there's some kind of slight change to justify the version number, but I wasn't able to find any practical difference.…
In this blog post we'll take a look at a slightly more advanced cartridge than we saw in the previous post. This time the cartridge ROM does not fit in the address space $0000 - $7FFF, so an MBC (memory bank controller) chip is used to map different parts of the physical ROM into the address space. There are multiple MBC chip types, but we'll start with the simplest one: MBC1. The game…
In my previous blog post, I described the reasons why MBC chips are included in Gameboy game cartridges. Before we start looking at such cartridges, it's a good idea to first look at a game that doesn't use an MBC. We start our Gameboy cartridge analysis journey by first looking at a very popular game with very simple hardware: Tetris. The cartridge I own has the code DMG-TR-SCN-1 . The…
When I started developing Mooneye GB , I did the initial work in small gradual steps. I started by emulating things that the Gameboy bootrom uses, so I could see the Nintendo logo animation. After that, I only focused on games which have only a simple 32K ROM (e.g. Tetris). I could've continued with Tetris for a long time, for example by perfecting the GPU emulation or adding sound support,…
Recently my main hobby project has been Mooneye GB , a Gameboy emulator written in Rust. There's quite a lot of Rust Gameboy emulators, but Mooneye GB is unique: my main focus is accuracy based on rigorous hardware testing. If we move our focus away from Rust, the king of all Gameboy emulators is Gambatte, which is based on similar principles but the documentation is not that good. While…
I was recently looking for a simple Windows utility to turn off the screen, and I wanted it to be open source so I could compile it myself and be sure it doesn't do anything malicious. There are plenty of options available, but in the end I decided to implement it myself to learn a bit about Rust on Windows. Rust is a systems programming language focusing on safety while retaining low-level…
I blogged last year about compiling Cyanogenmod for YW9300, but you might guess from the lack of updates that I never succeeded. The YW9300 had a lot of operating system problems, and I eventually lost interest in the device. The online shop w2comp.com even stopped selling the devices due to the problems, but it looks like they are back in stock now. The manufacturer might have fixed the problems,…
I've spent a huge chunk of my free time this week on learning Android internals by tinkering with an Android device called YW9300. It's a reasonably cheap device with a powerful SoC (system-on-a-chip) called Exynos 4412 (officially "Exynos 4 Quad"). This is the same chip that exists in every Galaxy S III phone, and is also used in some other Samsung and 3rd party products. My goal was to…
Introduction Using phantom types is a very simple technique that can be used to increase the compile-time safety of code. There are a lot of potential use cases with different levels of complexity, but even a very lightweight usage of phantom types can significantly increase the compile-time safety. A phantom type is simply a parameterized type with an unused type parameter. For example: public…
Introduction Jawwa ZK Gritter is an open source library that can be used to add Growl-like notifications to ZK apps. The library provides a simple-to-use server-side Java API that can be used to control notifications in the application. Installation instructions are available in the reference manual. A sample app that demonstrates all the customization options is available at Github:…
Introduction In part 1 I showed how server push and threads can be used to execute background tasks in a ZK application. However, the simple example had a major flaw that makes it a bad approach for real-world applications: it starts a new thread for each background task. JDK5 introduced the ExecutorService class, which abstracts away the threading details, and gives us a nice interface which can…
This is not a "pitfall" per se, but an implementation detail worth knowing. Let's say I have a inner class with a field. Such a field is visible to the enclosing class, but which one of the following ways is the fastest way to access it? Note! I'm only looking here at the generated bytecode, and not considering any JIT optimizations, so this "performance analysis" is very naïve public…
Use cases Asynchronous UI updates are very useful, because they typically improve the responsiveness, usability and the general feel of user interfaces. I'll be focusing here on the ZK framework, but generally the same principles apply for desktop UIs too (Swing, SWT). Long-running processing Sometimes you might have a database query, or an external web service call that takes a long time.…
Many people, including Stephen Colebourne , have complained about some of the methods in the Scala collections API. A common example is the ++ operator: // There are many variants but this is what Stephen Colebourne used as an example def ++ [ B >: A , That ] ( that : TraversableOnce [ B ])( implicit bf : CanBuildFrom [ List [ A ], B , That ]) : That Here's an example of its use:…
Spring objects are recognized based on their names It doesn't matter whether you use XML or Java config, a Spring scope is roughly like a Map<String, Object> structure. This means that you cannot have two objects with the same name . Why is this a bad thing? If you have a large application with lots of @Configuration classes or XML files, it's very easy to accidentally use the same name…
I've finally managed to convert sbt-jrebel-plugin to SBT 0.9+. Check out the short release notes at implicit.ly . I guess it's time to start converting SBT 0.7 projects to 0.11...
As I mentioned in my previous post, ZK has a tendency to "just work". The overall technical quality is impressive and on par with most Java web frameworks, but I believe there are some parts of ZK that are less impressive. Stuck on Java 1.4 ZK is built with Java 1.4, which greatly limits the flexibility of their API and internal code quality Negative effects on ZK internal code ThreadLocals not…
I've been asked several times to present some of my opinions about ZK . So, based of my experience of 4 years as a ZK user, here's some thoughts: Overall developer experience, the community and documentation "It just works" Most of the stuff that ZK offers works very well, and the functionality is usually very intuitive to use if you have developed any desktop Java applications before.…
Overview of the challenge The biggest challenge in SBTEI is the most fundamental one: project metadata. SBT is very customizable, so many things that are needed for Eclipse integration are customizable: Source folders (src/main/scala, src/test/scala) Managed libraries (lib_managed/ / .jar) Unmanaged libraries (lib/*.jar) Project-to-project dependencies…
Scala is generally not backwards compatible, so matching Scala versions pose a challenge. SBTEI depends on Scala IDE, which in turn depends on a specific version of Scala that is bundled with the plugin. On the other hand, SBT projects themselves define their own Scala version(s). Having matching Scala versions is very important in order to prevent potential compilation/runtime problems. Java…
Comparing SBTEI and SbtEclipsify In addition to SBT plugins for Eclipse, there's also an Eclipse plugin for SBT called SbtEclipsify . It uses a completely different approach and generates Eclipse project files, so it's similar to the eclipse:eclipse task in Maven. When comparing SBTEI and SbtEclipsify, it's useful to look at some comparisons (2023 edit: removed dead link) between…
As an Eclipse user I've always been trouble by the lackluster support of SBT in Eclipse. In order to combat this problem, I forked sbt-eclipse-plugin (2023 edit: removed dead link) and added more features and improved the code. That project later became stale and now I'm concentrating my effort on SBT Eclipse Integration ; also known as SBTEI or SEI. SBTEI has been stalled for a while as…
jQuery + ZK = A perfect match? So, you're a ZK 5.0 user and you've heard it uses jQuery instead of Prototype like ZK 3 did. You must be thinking: "Yay! I can easily integrate all my favourite jQuery plugins easily". Well, sorry if I'm ruining all the fun but there are a few things you need to know first. ZK is a RIA framework, so pages created with it have a slightly different life…
If you've used JPA, does this look familiar? < persistence > < persistence-unit > < class >my.entities.package.Entity</ class > < class >my.entities.package.Another</ class > < class >my.entities.package.More</ class > < class >my.entities.package.EvenMore</ class > < class >my.entities.package.AndMore</ class > < class >my.entities.package.AndEvenMore</ class >…
There's a very annoying IE6 incompatibility in ZK. < window title = "I hate IE6" border = "normal" > < popup id = "popup" > < label value = "Fail" /> </ popup > < label value = "Click me" popup = "popup" /> </ window > When you click the label "Fail", you'll get a popup that is sized by its contents.... .... except in IE6 where the popup always has 100% width. This…
I was at first sceptical about JRebel , but after using it for a while, I must say that it's awesome! It's compatible with SBT, so you can get a good boost to your productivity when you combine JRebel with the incremental compilation of Scala code in SBT. However, when using JRebel, you don't want Jetty to redeploy the webapp automatically. You could just disable Jetty manually but…