Game console hacking xbox, playstation, nintendo atari and gamepark 32
- 593 trang
- file .pdf
TLFeBOOK
Register for Free Membership to
[email protected]
Over the last few years, Syngress has published many best-selling and
critically acclaimed books, including Tom Shinder’s Configuring ISA
Server 2000, Brian Caswell and Jay Beale’s Snort 2.0 Intrusion
Detection, and Angela Orebaugh and Gilbert Ramirez’s Ethereal
Packet Sniffing. One of the reasons for the success of these books has
been our unique [email protected] program. Through this
site, we’ve been able to provide readers a real time extension to the
printed book.
As a registered owner of this book, you will qualify for free access to
our members-only [email protected] program. Once you have
registered, you will enjoy several benefits, including:
■ Four downloadable e-booklets on topics related to the book.
Each booklet is approximately 20-30 pages in Adobe PDF
format. They have been selected by our editors from other
best-selling Syngress books as providing topic coverage that
is directly related to the coverage in this book.
■ A comprehensive FAQ page that consolidates all of the key
points of this book into an easy to search web page, pro-
viding you with the concise, easy to access data you need to
perform your job.
■ A “From the Author” Forum that allows the authors of this
book to post timely updates links to related sites, or addi-
tional topic coverage that may have been requested by
readers.
Just visit us at www.syngress.com/solutions and follow the simple
registration process. You will need to have this book with you when
you register.
Thank you for giving us the opportunity to serve your needs. And be
sure to let us know if there is anything else we can do to make your
job easier.
TLFeBOOK
TLFeBOOK
GAME CONSOLE
HACKING
Have Fun While
Vo i d i n g Yo u r Wa r r a n t y
Joe Grand
Frank Thornton
Albert Yarusso
Special Foreword by
Ralph H. Baer
“The Father of Video Games”
TLFeBOOK
Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively
“Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work.
There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and
WITHOUT WARRANTY. You may have other legal rights, which vary from state to state.
In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or conse-
quential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of
liability for consequential or incidental damages, the above limitation may not apply to you.
You should always use reasonable care, including backup and other appropriate precautions, when working with computers,
networks, data, and files.
Syngress Media®, Syngress®, “Career Advancement Through Skill Enhancement®,” “Ask the Author UPDATE®,” and “Hack
Proofing®,” are registered trademarks of Syngress Publishing, Inc. “Syngress:The Definition of a Serious Security Library”™,
“Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Syngress Publishing,
Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies.
KEY SERIAL NUMBER
001 JKL32CVF79
002 P5FGJK9995
003 82H24555YY
004 38IIHGF543
005 CVPLQ6WQ23
006 VT5123HG66
007 H3WD3EHJNB
008 29WMKB8765
009 62SDJTHGGG
010 I5TBBB536T
PUBLISHED BY
Syngress Publishing, Inc.
800 Hingham Street
Rockland, MA 02370
Game Console Hacking: Xbox, Playstation, Nintendo, Atari, & Gamepark 32
Copyright © 2004 by Syngress Publishing, Inc. All rights reserved. Printed in the United States of America. Except as per-
mitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any
means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception
that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for pub-
lication.
Printed in the United States of America
1 2 3 4 5 6 7 8 9 0
ISBN: 1-931836-31-0
Publisher: Andrew Williams Page Layout and Art: Patricia Lupien
Acquisitions Editor: Christine Kloiber Copy Editor: Darlene Bordwell
Technical Editor: Joe Grand Indexer: J. Edmund Rush
Cover Designer: Michael Kavish
Distributed by O’Reilly Media, Inc. in the United States and Canada.
For information on rights and translations, contact Matt Pedersen, Director of Sales and Rights, at Syngress Publishing; email
[email protected] or fax to 781-681-3585.
TLFeBOOK
Acknowledgments
We would like to acknowledge the following people for their kindness and support in making this
book possible.
Syngress books are now distributed in the United States and Canada by O’Reilly Media, Inc.The
enthusiasm and work ethic at O’Reilly is incredible and we would like to thank everyone there for
their time and efforts to bring Syngress books to market:Tim O’Reilly, Laura Baldwin, Mark
Brokering, Mike Leonard, Donna Selenko, Bonnie Sheehan, Cindy Davis, Grant Kikkert, Opol
Matsutaro, Steve Hazelwood, Mark Wilson, Rick Brown, Leslie Becker, Jill Lothrop,Tim Hinton, Kyle
Hart, Sara Winge, C. J. Rayhill, Peter Pardo, Leslie Crandell, Valerie Dow, Regina Aggio, Pascal
Honscher, Preston Paull, Susan Thompson, Bruce Stewart, Laura Schmier, Sue Willing, Mark Jacobsen,
Betsy Waliszewski, Dawn Mann, Kathryn Barrett, John Chodacki, and Rob Bullington.
The incredibly hard working team at Elsevier Science, including Jonathan Bunkell, Ian Seager, Duncan
Enright, David Burton, Rosanna Ramacciotti, Robert Fairbrother, Miguel Sanchez, Klaus Beran,
Emma Wyatt, Rosie Moss, Chris Hossack, Mark Hunt, and Krista Leppiko, for making certain that our
vision remains worldwide in scope.
David Buckland, Marie Chieng, Lucy Chong, Leslie Lim, Audrey Gan, Pang Ai Hua, and Joseph Chan
of STP Distributors for the enthusiasm with which they receive our books.
Kwon Sung June at Acorn Publishing for his support.
David Scott, Tricia Wilden, Marilla Burgess, Annette Scott, Andrew Swaffer, Stephen O’Donoghue, Bec
Lowe, and Mark Langley of Woodslane for distributing our books throughout Australia, New Zealand,
Papua New Guinea, Fiji Tonga, Solomon Islands, and the Cook Islands.
Winston Lim of Global Publishing for his help and support with distribution of Syngress books in the
Philippines.
A special thank you to our attorney and friend Gene Landy, whose expertise in “all things intellectual
property” is impressive.
v
TLFeBOOK
TLFeBOOK
Technical Editor & Contributor
Joe Grand; Grand Idea Studio, Inc. Joe Grand is the President of Grand Idea Studio, a San Diego-
based product development and intellectual property licensing firm, where he specializes in the inven-
tion and design of consumer electronics, medical devices, video games, and toys. His latest creations
include the Stelladaptor Atari 2600 Controller-to-USB Interface and the Emic Text-to-Speech
Module.
A recognized figure in computer security, Joe has testified before the United States Senate
Governmental Affairs Committee and is a former member of the legendary hacker collective L0pht
Heavy Industries. Joe’s research on mobile devices and embedded security has been published in var-
ious periodicals, including Circuit Cellar and the Digital Investigation Journal. He is the author of many
security-related software tools, including pdd, the first forensic acquisition application for Palm devices.
Joe currently has a patent pending on a hardware-based computer memory imaging concept and appa-
ratus (U.S. Patent Serial No. 10/325,506).
Joe has presented his work at numerous academic, industry, and private forums, including the
United States Air Force Office of Special Investigations, the Naval Postgraduate School, the IBM
Thomas J. Watson Research Center, the Embedded Systems Conference, the Black Hat Briefings, and
DEFCON. He has appeared in documentaries and news for television, airplane in-flight programming,
and print media outlets. He has also authored Hardware Hacking: Have Fun While Voiding Your Warranty
(Syngress Publishing, ISBN: 1-932266-83-6), contributed to Stealing The Network: How to Own A
Continent (Syngress, ISBN: 1-931836-05-1), and is a frequent contributor to other texts. Joe holds a
Bachelor of Science degree in Computer Engineering from Boston University.
Joe is the author of Chapter 1 “Tools of the Warranty Voiding Trade,” Chapter 2 “Case Modifications:
Building an Atari 2600PC,” Chapter 5 “Nintendo GBA,” Chapter 6 “GP32,” Chapter 7
“NES,” and the Appendices.
vii
TLFeBOOK
Contributors
Frank (Thorn) Thornton runs his own technology-consulting firm, Blackthorn Systems,
which specializes in wireless networks. His specialties include wireless network architecture,
design, and implementation, as well as network troubleshooting and optimization. An interest
in amateur radio has also helped him bridge the gap between computers and wireless net-
works. Frank’s experience with computers goes back to the 1970’s when he started program-
ming mainframes. Over the last 30 years, he has used dozens of different operating systems and
programming languages. Having learned at a young age which end of the soldering iron was
hot, he has even been known to repair hardware on occasion. In addition to his computer and
wireless interests, Frank was a law enforcement officer for many years. As a detective and
forensics expert he has investigated approximately one hundred homicides and thousands of
other crime scenes. Combining both professional interests, he was a member of the workgroup
that established ANSI Standard ANSI/NIST-CSL 1-1993 Data Format for the Interchange of
Fingerprint Information. He has co-authored WarDriving: Drive, Detect, and Defend: A Guide to
Wireless Security (Syngress Publishing, ISBN: 1-93183-60-3), as well as contributed to IT Ethics
Handbook: Right and Wrong for IT Professionals (Syngress, ISBN: 1-931836-14-0). He resides in
Vermont with his wife.
Frank is the author of Chapter 3 “Xbox.”
Albert Yarusso is a principle of Austin Systems (www.austinsystems.com), an Austin,Texas-
based firm that specializes in web design programming and hosting services. Albert’s back-
ground consists of a wide range of projects as a software developer, with his most recent
experience focused in the game industry. Albert previously worked for Looking Glass
Technologies and more recently for Ion Storm Austin, where he helped create the highly
acclaimed PC game Deus Ex.
Albert co-founded AtariAge (www.atariage.com) in 2001, a comprehensive website
devoted to preserving the history of Atari’s rich legacy of video game consoles and computers,
which has become one of the busiest destinations on the web for classic gaming fans. In 2003,
Albert helped bring the first annual Austin Gaming Expo (www.austingamingexpo.com) to
Austin, an extremely successful event that drew over 2,000 visitors in its first year. Albert is also
a contributor to Hardware Hacking: Have Fun While Voiding Your Warranty (Syngress Publishing,
ISBN: 1-932266-83-6).
viii
TLFeBOOK
Albert is the author of Chapter 8 “Atari 2600,” Chapter 9 “Atari 5200 SuperSystem,” and
Chapter 10 “Atari 7800.”
Jonathan S. Harbour has been an avid hacker for many years, having started with early sys-
tems like the Commodore PET, Apple II, and Tandy 1000. He holds a degree in computer
information systems, enjoys writing code in C, C++, and several other languages, and has
experience with many platforms, including Windows, Linux, Pocket PC, and Game Boy
Advance. Jonathan has written several books on the subject of game programming, and may be
contacted via his Web site at www.jharbour.com.
Jonathan is a contributor to Chapter 5 “Nintendo GBA.”
Marcus R. Brown is a software engineer at Budcat Creations. His work includes writing
low-level drivers and system-level programming such as resource management, file loading,
and audio streaming. He is currently working on an unannounced title for the PlayStation 2
and Xbox. Marcus lives in Las Vegas, Nevada.
Marcus is the author of Chapter 4 “PlayStation 2.”
Christopher Dolberg is a full-time student, and an avid player of console and PC games.
When not gaming, he can be found modifying his hardware in an attempt to push it to the
very limits of its function. Occasionally he takes time off from both these activities to actually
attend classes. He resides in Vermont.
Chris is a contributor to Chapter 3 “Xbox.”
ix
TLFeBOOK
Foreword Contributor
Ralph H. Baer is an engineer and a hacker from way back, as well as a prolific inventor with
over 150 US and foreign patents to his credit. He is best known as the “Father of Video
Games.” For over fifty years he has had one leg in the commercial and defense electronics
development and production business; and the other leg in toy and game design. Many well-
known handheld electronic toys such as “Simon” came from his lab. His early video game
hardware already resides in such places as the Smithsonian and the Japanese National Science
Museum and replicas are on display all over the map.
His home has been Manchester, New Hampshire for the past 48 years. He moves around a lot.
Technical Reviewer
Job de Haas is Managing Director of ITSX BV, a Dutch company located in Amsterdam.
ITSX BV provides security testing services in the broadest sense. Job is involved in testing,
researching, and breaking security aspects of the latest technologies for corporate clients. In
assignments for telecommunication operators and mobile phone manufacturers, Job gained
experience with internal operations of modern phones.
Job holds a master’s degree in electrical engineering from Delft Technical University. He
previously held positions at the Dutch Aerospace Agency (NLR) as a robotics researcher and at
Digicash BV as a developer of cryptographic applications. He lives in Amsterdam,The
Netherlands.
x
TLFeBOOK
Contents
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxi
Introduction 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxvii
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxix
Part I Introduction to Hardware Hacking . . . . . . . . . . . . . . .1
Chapter 1 Tools of the Warranty-Voiding Trade . . . . . . . . . .3
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
The Essential Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Basic Hardware Hacking . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
Advanced Projects and Reverse Engineering . . . . . . . . . . . . . . .13
Where to Obtain the Tools . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Chapter 2 Case Modifications: Building an Atari 2600PC . .19
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
Choosing Your Features: Why the Atari 2600? . . . . . . . . . . . . . .21
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
Opening the Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
Cleaning the Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
Mocking Up the Design . . . . . . . . . . . . . . . . . . . . . . . . . .32
Configuring the BIOS . . . . . . . . . . . . . . . . . . . . . . . . .35
Installing Software . . . . . . . . . . . . . . . . . . . . . . . . . . . .36
Preparing the Control Panel . . . . . . . . . . . . . . . . . . . . . . .38
Preparing the USB/FireWire Backplane . . . . . . . . . . . . . . .45
Preparing the Cordless Keyboard/Mouse Receiver . . . . . . . .46
Preparing the Stelladaptor 2600 Controller-to-USB Interfaces 51
Preparing the Power Supply Connector . . . . . . . . . . . . . . .54
Preparing the Mini-ITX Motherboard . . . . . . . . . . . . . . . .56
Preparing the Housing . . . . . . . . . . . . . . . . . . . . . . . . . . .59
Putting It All Together . . . . . . . . . . . . . . . . . . . . . . . . . . .67
The CD-ROM Drive . . . . . . . . . . . . . . . . . . . . . . . . . .67
xi
TLFeBOOK
xii Contents
The Motherboard . . . . . . . . . . . . . . . . . . . . . . . . . . . .70
The Hard Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71
The PW70 Power Supply Module . . . . . . . . . . . . . . . . .72
The USB Components . . . . . . . . . . . . . . . . . . . . . . . . .73
The Control Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . .75
Closing It Up: Completing the Atari 2600PC Case
Modification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78
In Conclusion... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82
Resources and Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . .82
Case Modifications on the Web . . . . . . . . . . . . . . . . . . . . .82
Stuffing PCs into Videogame System Consoles . . . . . . . .83
Creating Your Own Portable Game System . . . . . . . . . . .83
Parts and Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83
Part II Modern Game Consoles . . . . . . . . . . . . . . . . . . . . . .85
Chapter 3 The Xbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88
Xbox Hardware and Specifications . . . . . . . . . . . . . . . . . . .89
Xbox Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90
Opening the Xbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .92
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .92
Controller Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95
Controller Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
Getting Inside Your Controller . . . . . . . . . . . . . . . . . . . . . . . .97
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .97
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .97
Illuminating the Controller Buttons with LEDs . . . . . . . . . .99
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . .99
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .99
Under the Hood: How the Hack Works . . . . . . . . . . . .103
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . .104
Optional Hack: Illuminating the Controller Logo . . . . . .104
Adding a Remote Reset Switch . . . . . . . . . . . . . . . . . . . .104
Adding a Remote Reset Switch to the Xbox Controller .104
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .104
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .105
TLFeBOOK
Contents xiii
Adding a Remote Reset Switch to the Xbox Controller
Memory Card or Xbox Live Communicator . . . . . . . .107
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .107
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .108
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . . . . .110
Adding an Xbox Live Communicator to a Wireless
Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .111
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Xbox Networking Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Establishing a Network Link Using Standard Networking .113
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .114
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . .115
Creating Your Own Crossover Cable . . . . . . . . . . . . . . . . . . .116
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .117
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . . . . .119
Extending the Network Status LEDs to the Front Panel . . . . . .120
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .120
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .120
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . . . . .122
Wireless Networking Hacks . . . . . . . . . . . . . . . . . . . . . . . . .123
Adding a Wireless Networking Adapter to the Xbox . . . . . .123
Adding a Removable Antenna to the Microsoft Xbox
Wireless Adapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . .125
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .126
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .126
Under the Hood: How the Hack Works . . . . . . . . . . . .131
Installing a Modchip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131
A Brief Introduction to Modchips . . . . . . . . . . . . . . . . . .131
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .135
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .135
Running Linux on an Unmodified Xbox . . . . . . . . . . . . . . .141
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .141
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .142
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .144
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .144
Xbox Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . .146
TLFeBOOK
xiv Contents
Chapter 4 PlayStation 2 . . . . . . . . . . . . . . . . . . . . . . . . .147
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148
Commercial Hardware Hacking: Modchips . . . . . . . . . . . . . . .148
Getting Inside the PS2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150
Mainboard Revisions . . . . . . . . . . . . . . . . . . . . . . . . . . .150
Identifying Your Mainboard . . . . . . . . . . . . . . . . . . . . .151
Opening the PS2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .152
Installing a Serial Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .156
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .157
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .158
Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .164
Under the Hood: How the Hack Works . . . . . . . . . . . . . .164
Booting Code from the Memory Card . . . . . . . . . . . . . . . . . .164
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .165
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Preparing TITLE.DB . . . . . . . . . . . . . . . . . . . . . . . . .165
Choosing BOOT.ELF . . . . . . . . . . . . . . . . . . . . . . . . .168
Saving TITLE.DB to the Memory Card . . . . . . . . . . . .168
Independence! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169
Under the Hood: How the Hack Works . . . . . . . . . . . . . .169
Other Hacks: Independent Hard Drives . . . . . . . . . . . . . . . . .171
PS2 Technical Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171
Understanding the Emotion Engine . . . . . . . . . . . . . . . . .172
The Serial I/O Port . . . . . . . . . . . . . . . . . . . . . . . . . .173
The I/O Processor . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175
The Sub-CPU Interface . . . . . . . . . . . . . . . . . . . . . . . . .176
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .176
PS2 Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . . .177
Part III Handheld Game Platforms . . . . . . . . . . . . . . . . . .179
Chapter 5 Nintendo Game Boy Advance . . . . . . . . . . . . .181
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182
Game Boy, 1989 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182
Game Boy Pocket, 1996 . . . . . . . . . . . . . . . . . . . . . . . . .183
Game Boy Color, 1998 . . . . . . . . . . . . . . . . . . . . . . . . . .183
Game Boy Advance, 2001 . . . . . . . . . . . . . . . . . . . . . . . .184
Game Boy Advance SP, 2003 . . . . . . . . . . . . . . . . . . . . . .185
TLFeBOOK
Contents xv
A Very Brief History of Nintendo . . . . . . . . . . . . . . . . . . . . .186
Opening the GBA Console . . . . . . . . . . . . . . . . . . . . . . . . . .187
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .187
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .188
Replacing the Display Lens . . . . . . . . . . . . . . . . . . . . . . . . . .193
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .194
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .194
Light Up Your LCD with the GBA Afterburner Mod . . . . . . . .198
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .198
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .200
Removing the LCD . . . . . . . . . . . . . . . . . . . . . . . . . .201
Preparing the GBA Housing . . . . . . . . . . . . . . . . . . . .203
Preparing the LCD . . . . . . . . . . . . . . . . . . . . . . . . . . .206
Preparing the Afterburner Module . . . . . . . . . . . . . . . .209
Installing the Afterburner Module . . . . . . . . . . . . . . . .211
Adding the Brightness Control (Optional) . . . . . . . . . . .214
Under the Hood: How the Hack Works . . . . . . . . . . . . . .216
Enhancing Your Afterburner with the GBA Stealth Dimmer Chip 217
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .218
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .219
Under the Hood: How the Hack Works . . . . . . . . . . . . . .225
Nintendo GBA Technical Specifications . . . . . . . . . . . . . . . . .226
The Central Processor . . . . . . . . . . . . . . . . . . . . . . . . . . .226
CPU Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .227
Memory Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . .228
Internal Working RAM . . . . . . . . . . . . . . . . . . . . . . .229
External Working RAM . . . . . . . . . . . . . . . . . . . . . . .230
Graphics Memory . . . . . . . . . . . . . . . . . . . . . . . . . . .230
Game ROM and Game Save Memory . . . . . . . . . . . . .231
The Graphics System . . . . . . . . . . . . . . . . . . . . . . . . . . .231
Tile-Based Modes (0–2) . . . . . . . . . . . . . . . . . . . . . . .232
Bitmap-Based Modes (3–5) . . . . . . . . . . . . . . . . . . . . .232
The Sound System . . . . . . . . . . . . . . . . . . . . . . . . . . . . .233
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .233
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .234
Nintendo GBA Resources on the Web . . . . . . . . . . . . . . . . . .238
TLFeBOOK
xvi Contents
Chapter 6 Gamepark 32 (GP32) . . . . . . . . . . . . . . . . . . . .241
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .242
Out of the Box: Configuring Your GP32 . . . . . . . . . . . . . . . .245
Opening the GP32 Console . . . . . . . . . . . . . . . . . . . . . . . . .251
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .251
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .251
Replacing the GP32 Screen Cover . . . . . . . . . . . . . . . . . . . . .257
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .258
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .258
Repairing Your Buttons . . . . . . . . . . . . . . . . . . . . . . . . . . . .262
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .262
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .263
Accelerating Your GP32 (CPU Core Voltage Increase) . . . . . . .264
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .265
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .265
Under the Hood: How the Hack Works . . . . . . . . . . . . . .268
Creating a DC Power Adapter . . . . . . . . . . . . . . . . . . . . . . . .269
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .269
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .273
Under the Hood: How the Hack Works . . . . . . . . . . . . . .275
Installing the Multifirmware Loader . . . . . . . . . . . . . . . . . . . .275
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .276
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .276
Backing Up Your Firmware . . . . . . . . . . . . . . . . . . . . .276
Reprogramming (Flashing) the New Firmware . . . . . . .278
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .280
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .284
GP32 Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . .286
Part IV Retro and Classic Systems . . . . . . . . . . . . . . . . . . .289
Chapter 7 Nintendo NES . . . . . . . . . . . . . . . . . . . . . . . . .291
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292
Opening the NES Console . . . . . . . . . . . . . . . . . . . . . . . . . .294
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .294
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
Replacing the 72-Pin Cartridge Connector . . . . . . . . . . . . . .299
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .300
TLFeBOOK
Contents xvii
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .301
Blue Power LED Modification . . . . . . . . . . . . . . . . . . . . . . .302
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .303
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .304
Under the Hood: How the Hack Works . . . . . . . . . . . . . .310
Disabling the NES “Lockout Chip” . . . . . . . . . . . . . . . . . . . .311
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .312
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .312
Optional: Adding a Switch . . . . . . . . . . . . . . . . . . . . . . . .315
Under the Hood: How the Hack Works . . . . . . . . . . . . . .315
Opening an NES Game Cartridge . . . . . . . . . . . . . . . . . . . . .316
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .316
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .318
Replacing the Battery in Certain Game Cartridges . . . . . . . . .319
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .320
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .321
Creating an EPROM Cartridge for Homebrew Game
Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .324
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .324
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .325
Under the Hood: How the Hack Works . . . . . . . . . . . . . .330
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .330
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .332
NES Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . .333
Chapter 8 Atari 2600 . . . . . . . . . . . . . . . . . . . . . . . . . . .335
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .336
Hacks in This Chapter . . . . . . . . . . . . . . . . . . . . . . . . . . .337
Atari 2600 Left-Handed Joystick Modification . . . . . . . . . . . . .337
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .338
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .338
Repair Your Atari 2600 Joysticks . . . . . . . . . . . . . . . . . . . . . .342
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .342
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .343
Revitalize Your Atari 2600 Paddles . . . . . . . . . . . . . . . . . . . . .349
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .350
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .350
Use an NES Control Pad with your 2600 . . . . . . . . . . . . . . . .356
TLFeBOOK
xviii Contents
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .357
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .358
Atari 2600 S-Video/Audio Mod . . . . . . . . . . . . . . . . . . . . . .364
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .364
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .366
Optional: Commodore 1702 Hack . . . . . . . . . . . . . . . . . .380
Optional: Do-It-Yourself 2600 A/V Mod . . . . . . . . . . . . .381
Technical Information . . . . . . . . . . . . . . . . . . . . . . . . . . .381
Atari 2600 Stereo Audio Output . . . . . . . . . . . . . . . . . . . . . .382
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .384
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .384
Under the Hood: How the Hack Works . . . . . . . . . . . . . .391
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .391
Atari 2600 Resources on the Web . . . . . . . . . . . . . . . . . . . . .396
Chapter 9 Atari 5200 . . . . . . . . . . . . . . . . . . . . . . . . . . .399
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .400
Opening the Atari 5200 . . . . . . . . . . . . . . . . . . . . . . . . . . . .401
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .401
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .401
Reassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .408
Atari 5200 Blue LED Modification . . . . . . . . . . . . . . . . . . . .408
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .409
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .410
Under the Hood: How the Hack Works . . . . . . . . . . . . . .413
Atari 5200 Two-Port BIOS Replacement . . . . . . . . . . . . . . . .413
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .414
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .414
Creating an Atari 5200 Paddle Controller . . . . . . . . . . . . . . . .419
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .421
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .421
Disassembling the Atari 2600 Paddle Controller . . . . . . .422
Building the 5200 Paddle Controller . . . . . . . . . . . . . .424
Adding a Weighted Dial . . . . . . . . . . . . . . . . . . . . . . .432
Under the Hood: How the Hack Works . . . . . . . . . . . . . .433
Freeing Yourself from the 5200 Four-Port Switchbox . . . . . . . .434
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .435
TLFeBOOK
Contents xix
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .436
Under the Hood: How the Hack Works . . . . . . . . . . . . . .445
Atari 5200 Video and Audio Upgrade Modification . . . . . . . . .446
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .447
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .449
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .467
Rebuilding Atari 5200 Controllers . . . . . . . . . . . . . . . . . .467
Atari 5200 Four-Port VCS Cartridge Adapter Fix . . . . . . . .470
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .470
Atari Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . .474
Chapter 10 Atari 7800 . . . . . . . . . . . . . . . . . . . . . . . . . . .477
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .478
Hacks in This Chapter . . . . . . . . . . . . . . . . . . . . . . . . . . .479
Blue LED Modification . . . . . . . . . . . . . . . . . . . . . . . . . . . .479
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .480
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .481
Under the Hood: How the Hack Works . . . . . . . . . . . . . .485
Game Compatibility Hack to Play Certain Atari 2600 Games . .486
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .487
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .487
Under the Hood: How the Hack Works . . . . . . . . . . . . . .489
Voltage Regulator Replacement . . . . . . . . . . . . . . . . . . . . . .490
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .490
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .491
Under the Hood: How the Hack Works . . . . . . . . . . . . . .494
Power Supply Plug Retrofit . . . . . . . . . . . . . . . . . . . . . . . . . .495
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .496
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .497
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .501
Atari 7800 Composite and S-Video Output . . . . . . . . . . . .501
Sega Genesis to Atari 7800 Controller Modification . . . . . .501
NES Control Pad to Atari 7800 Controller Modification . . .502
Atari 7800 DevOS Modification and Cable Creation . . . . .502
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .502
Atari 7800 Resources on the Web . . . . . . . . . . . . . . . . . . . . .506
TLFeBOOK
Register for Free Membership to
[email protected]
Over the last few years, Syngress has published many best-selling and
critically acclaimed books, including Tom Shinder’s Configuring ISA
Server 2000, Brian Caswell and Jay Beale’s Snort 2.0 Intrusion
Detection, and Angela Orebaugh and Gilbert Ramirez’s Ethereal
Packet Sniffing. One of the reasons for the success of these books has
been our unique [email protected] program. Through this
site, we’ve been able to provide readers a real time extension to the
printed book.
As a registered owner of this book, you will qualify for free access to
our members-only [email protected] program. Once you have
registered, you will enjoy several benefits, including:
■ Four downloadable e-booklets on topics related to the book.
Each booklet is approximately 20-30 pages in Adobe PDF
format. They have been selected by our editors from other
best-selling Syngress books as providing topic coverage that
is directly related to the coverage in this book.
■ A comprehensive FAQ page that consolidates all of the key
points of this book into an easy to search web page, pro-
viding you with the concise, easy to access data you need to
perform your job.
■ A “From the Author” Forum that allows the authors of this
book to post timely updates links to related sites, or addi-
tional topic coverage that may have been requested by
readers.
Just visit us at www.syngress.com/solutions and follow the simple
registration process. You will need to have this book with you when
you register.
Thank you for giving us the opportunity to serve your needs. And be
sure to let us know if there is anything else we can do to make your
job easier.
TLFeBOOK
TLFeBOOK
GAME CONSOLE
HACKING
Have Fun While
Vo i d i n g Yo u r Wa r r a n t y
Joe Grand
Frank Thornton
Albert Yarusso
Special Foreword by
Ralph H. Baer
“The Father of Video Games”
TLFeBOOK
Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively
“Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work.
There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and
WITHOUT WARRANTY. You may have other legal rights, which vary from state to state.
In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or conse-
quential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of
liability for consequential or incidental damages, the above limitation may not apply to you.
You should always use reasonable care, including backup and other appropriate precautions, when working with computers,
networks, data, and files.
Syngress Media®, Syngress®, “Career Advancement Through Skill Enhancement®,” “Ask the Author UPDATE®,” and “Hack
Proofing®,” are registered trademarks of Syngress Publishing, Inc. “Syngress:The Definition of a Serious Security Library”™,
“Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Syngress Publishing,
Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies.
KEY SERIAL NUMBER
001 JKL32CVF79
002 P5FGJK9995
003 82H24555YY
004 38IIHGF543
005 CVPLQ6WQ23
006 VT5123HG66
007 H3WD3EHJNB
008 29WMKB8765
009 62SDJTHGGG
010 I5TBBB536T
PUBLISHED BY
Syngress Publishing, Inc.
800 Hingham Street
Rockland, MA 02370
Game Console Hacking: Xbox, Playstation, Nintendo, Atari, & Gamepark 32
Copyright © 2004 by Syngress Publishing, Inc. All rights reserved. Printed in the United States of America. Except as per-
mitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any
means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception
that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for pub-
lication.
Printed in the United States of America
1 2 3 4 5 6 7 8 9 0
ISBN: 1-931836-31-0
Publisher: Andrew Williams Page Layout and Art: Patricia Lupien
Acquisitions Editor: Christine Kloiber Copy Editor: Darlene Bordwell
Technical Editor: Joe Grand Indexer: J. Edmund Rush
Cover Designer: Michael Kavish
Distributed by O’Reilly Media, Inc. in the United States and Canada.
For information on rights and translations, contact Matt Pedersen, Director of Sales and Rights, at Syngress Publishing; email
[email protected] or fax to 781-681-3585.
TLFeBOOK
Acknowledgments
We would like to acknowledge the following people for their kindness and support in making this
book possible.
Syngress books are now distributed in the United States and Canada by O’Reilly Media, Inc.The
enthusiasm and work ethic at O’Reilly is incredible and we would like to thank everyone there for
their time and efforts to bring Syngress books to market:Tim O’Reilly, Laura Baldwin, Mark
Brokering, Mike Leonard, Donna Selenko, Bonnie Sheehan, Cindy Davis, Grant Kikkert, Opol
Matsutaro, Steve Hazelwood, Mark Wilson, Rick Brown, Leslie Becker, Jill Lothrop,Tim Hinton, Kyle
Hart, Sara Winge, C. J. Rayhill, Peter Pardo, Leslie Crandell, Valerie Dow, Regina Aggio, Pascal
Honscher, Preston Paull, Susan Thompson, Bruce Stewart, Laura Schmier, Sue Willing, Mark Jacobsen,
Betsy Waliszewski, Dawn Mann, Kathryn Barrett, John Chodacki, and Rob Bullington.
The incredibly hard working team at Elsevier Science, including Jonathan Bunkell, Ian Seager, Duncan
Enright, David Burton, Rosanna Ramacciotti, Robert Fairbrother, Miguel Sanchez, Klaus Beran,
Emma Wyatt, Rosie Moss, Chris Hossack, Mark Hunt, and Krista Leppiko, for making certain that our
vision remains worldwide in scope.
David Buckland, Marie Chieng, Lucy Chong, Leslie Lim, Audrey Gan, Pang Ai Hua, and Joseph Chan
of STP Distributors for the enthusiasm with which they receive our books.
Kwon Sung June at Acorn Publishing for his support.
David Scott, Tricia Wilden, Marilla Burgess, Annette Scott, Andrew Swaffer, Stephen O’Donoghue, Bec
Lowe, and Mark Langley of Woodslane for distributing our books throughout Australia, New Zealand,
Papua New Guinea, Fiji Tonga, Solomon Islands, and the Cook Islands.
Winston Lim of Global Publishing for his help and support with distribution of Syngress books in the
Philippines.
A special thank you to our attorney and friend Gene Landy, whose expertise in “all things intellectual
property” is impressive.
v
TLFeBOOK
TLFeBOOK
Technical Editor & Contributor
Joe Grand; Grand Idea Studio, Inc. Joe Grand is the President of Grand Idea Studio, a San Diego-
based product development and intellectual property licensing firm, where he specializes in the inven-
tion and design of consumer electronics, medical devices, video games, and toys. His latest creations
include the Stelladaptor Atari 2600 Controller-to-USB Interface and the Emic Text-to-Speech
Module.
A recognized figure in computer security, Joe has testified before the United States Senate
Governmental Affairs Committee and is a former member of the legendary hacker collective L0pht
Heavy Industries. Joe’s research on mobile devices and embedded security has been published in var-
ious periodicals, including Circuit Cellar and the Digital Investigation Journal. He is the author of many
security-related software tools, including pdd, the first forensic acquisition application for Palm devices.
Joe currently has a patent pending on a hardware-based computer memory imaging concept and appa-
ratus (U.S. Patent Serial No. 10/325,506).
Joe has presented his work at numerous academic, industry, and private forums, including the
United States Air Force Office of Special Investigations, the Naval Postgraduate School, the IBM
Thomas J. Watson Research Center, the Embedded Systems Conference, the Black Hat Briefings, and
DEFCON. He has appeared in documentaries and news for television, airplane in-flight programming,
and print media outlets. He has also authored Hardware Hacking: Have Fun While Voiding Your Warranty
(Syngress Publishing, ISBN: 1-932266-83-6), contributed to Stealing The Network: How to Own A
Continent (Syngress, ISBN: 1-931836-05-1), and is a frequent contributor to other texts. Joe holds a
Bachelor of Science degree in Computer Engineering from Boston University.
Joe is the author of Chapter 1 “Tools of the Warranty Voiding Trade,” Chapter 2 “Case Modifications:
Building an Atari 2600PC,” Chapter 5 “Nintendo GBA,” Chapter 6 “GP32,” Chapter 7
“NES,” and the Appendices.
vii
TLFeBOOK
Contributors
Frank (Thorn) Thornton runs his own technology-consulting firm, Blackthorn Systems,
which specializes in wireless networks. His specialties include wireless network architecture,
design, and implementation, as well as network troubleshooting and optimization. An interest
in amateur radio has also helped him bridge the gap between computers and wireless net-
works. Frank’s experience with computers goes back to the 1970’s when he started program-
ming mainframes. Over the last 30 years, he has used dozens of different operating systems and
programming languages. Having learned at a young age which end of the soldering iron was
hot, he has even been known to repair hardware on occasion. In addition to his computer and
wireless interests, Frank was a law enforcement officer for many years. As a detective and
forensics expert he has investigated approximately one hundred homicides and thousands of
other crime scenes. Combining both professional interests, he was a member of the workgroup
that established ANSI Standard ANSI/NIST-CSL 1-1993 Data Format for the Interchange of
Fingerprint Information. He has co-authored WarDriving: Drive, Detect, and Defend: A Guide to
Wireless Security (Syngress Publishing, ISBN: 1-93183-60-3), as well as contributed to IT Ethics
Handbook: Right and Wrong for IT Professionals (Syngress, ISBN: 1-931836-14-0). He resides in
Vermont with his wife.
Frank is the author of Chapter 3 “Xbox.”
Albert Yarusso is a principle of Austin Systems (www.austinsystems.com), an Austin,Texas-
based firm that specializes in web design programming and hosting services. Albert’s back-
ground consists of a wide range of projects as a software developer, with his most recent
experience focused in the game industry. Albert previously worked for Looking Glass
Technologies and more recently for Ion Storm Austin, where he helped create the highly
acclaimed PC game Deus Ex.
Albert co-founded AtariAge (www.atariage.com) in 2001, a comprehensive website
devoted to preserving the history of Atari’s rich legacy of video game consoles and computers,
which has become one of the busiest destinations on the web for classic gaming fans. In 2003,
Albert helped bring the first annual Austin Gaming Expo (www.austingamingexpo.com) to
Austin, an extremely successful event that drew over 2,000 visitors in its first year. Albert is also
a contributor to Hardware Hacking: Have Fun While Voiding Your Warranty (Syngress Publishing,
ISBN: 1-932266-83-6).
viii
TLFeBOOK
Albert is the author of Chapter 8 “Atari 2600,” Chapter 9 “Atari 5200 SuperSystem,” and
Chapter 10 “Atari 7800.”
Jonathan S. Harbour has been an avid hacker for many years, having started with early sys-
tems like the Commodore PET, Apple II, and Tandy 1000. He holds a degree in computer
information systems, enjoys writing code in C, C++, and several other languages, and has
experience with many platforms, including Windows, Linux, Pocket PC, and Game Boy
Advance. Jonathan has written several books on the subject of game programming, and may be
contacted via his Web site at www.jharbour.com.
Jonathan is a contributor to Chapter 5 “Nintendo GBA.”
Marcus R. Brown is a software engineer at Budcat Creations. His work includes writing
low-level drivers and system-level programming such as resource management, file loading,
and audio streaming. He is currently working on an unannounced title for the PlayStation 2
and Xbox. Marcus lives in Las Vegas, Nevada.
Marcus is the author of Chapter 4 “PlayStation 2.”
Christopher Dolberg is a full-time student, and an avid player of console and PC games.
When not gaming, he can be found modifying his hardware in an attempt to push it to the
very limits of its function. Occasionally he takes time off from both these activities to actually
attend classes. He resides in Vermont.
Chris is a contributor to Chapter 3 “Xbox.”
ix
TLFeBOOK
Foreword Contributor
Ralph H. Baer is an engineer and a hacker from way back, as well as a prolific inventor with
over 150 US and foreign patents to his credit. He is best known as the “Father of Video
Games.” For over fifty years he has had one leg in the commercial and defense electronics
development and production business; and the other leg in toy and game design. Many well-
known handheld electronic toys such as “Simon” came from his lab. His early video game
hardware already resides in such places as the Smithsonian and the Japanese National Science
Museum and replicas are on display all over the map.
His home has been Manchester, New Hampshire for the past 48 years. He moves around a lot.
Technical Reviewer
Job de Haas is Managing Director of ITSX BV, a Dutch company located in Amsterdam.
ITSX BV provides security testing services in the broadest sense. Job is involved in testing,
researching, and breaking security aspects of the latest technologies for corporate clients. In
assignments for telecommunication operators and mobile phone manufacturers, Job gained
experience with internal operations of modern phones.
Job holds a master’s degree in electrical engineering from Delft Technical University. He
previously held positions at the Dutch Aerospace Agency (NLR) as a robotics researcher and at
Digicash BV as a developer of cryptographic applications. He lives in Amsterdam,The
Netherlands.
x
TLFeBOOK
Contents
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxi
Introduction 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxvii
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxix
Part I Introduction to Hardware Hacking . . . . . . . . . . . . . . .1
Chapter 1 Tools of the Warranty-Voiding Trade . . . . . . . . . .3
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
The Essential Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Basic Hardware Hacking . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
Advanced Projects and Reverse Engineering . . . . . . . . . . . . . . .13
Where to Obtain the Tools . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Chapter 2 Case Modifications: Building an Atari 2600PC . .19
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
Choosing Your Features: Why the Atari 2600? . . . . . . . . . . . . . .21
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
Opening the Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
Cleaning the Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
Mocking Up the Design . . . . . . . . . . . . . . . . . . . . . . . . . .32
Configuring the BIOS . . . . . . . . . . . . . . . . . . . . . . . . .35
Installing Software . . . . . . . . . . . . . . . . . . . . . . . . . . . .36
Preparing the Control Panel . . . . . . . . . . . . . . . . . . . . . . .38
Preparing the USB/FireWire Backplane . . . . . . . . . . . . . . .45
Preparing the Cordless Keyboard/Mouse Receiver . . . . . . . .46
Preparing the Stelladaptor 2600 Controller-to-USB Interfaces 51
Preparing the Power Supply Connector . . . . . . . . . . . . . . .54
Preparing the Mini-ITX Motherboard . . . . . . . . . . . . . . . .56
Preparing the Housing . . . . . . . . . . . . . . . . . . . . . . . . . . .59
Putting It All Together . . . . . . . . . . . . . . . . . . . . . . . . . . .67
The CD-ROM Drive . . . . . . . . . . . . . . . . . . . . . . . . . .67
xi
TLFeBOOK
xii Contents
The Motherboard . . . . . . . . . . . . . . . . . . . . . . . . . . . .70
The Hard Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71
The PW70 Power Supply Module . . . . . . . . . . . . . . . . .72
The USB Components . . . . . . . . . . . . . . . . . . . . . . . . .73
The Control Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . .75
Closing It Up: Completing the Atari 2600PC Case
Modification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78
In Conclusion... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82
Resources and Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . .82
Case Modifications on the Web . . . . . . . . . . . . . . . . . . . . .82
Stuffing PCs into Videogame System Consoles . . . . . . . .83
Creating Your Own Portable Game System . . . . . . . . . . .83
Parts and Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83
Part II Modern Game Consoles . . . . . . . . . . . . . . . . . . . . . .85
Chapter 3 The Xbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88
Xbox Hardware and Specifications . . . . . . . . . . . . . . . . . . .89
Xbox Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90
Opening the Xbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .92
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .92
Controller Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95
Controller Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
Getting Inside Your Controller . . . . . . . . . . . . . . . . . . . . . . . .97
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .97
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .97
Illuminating the Controller Buttons with LEDs . . . . . . . . . .99
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . .99
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .99
Under the Hood: How the Hack Works . . . . . . . . . . . .103
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . .104
Optional Hack: Illuminating the Controller Logo . . . . . .104
Adding a Remote Reset Switch . . . . . . . . . . . . . . . . . . . .104
Adding a Remote Reset Switch to the Xbox Controller .104
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .104
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .105
TLFeBOOK
Contents xiii
Adding a Remote Reset Switch to the Xbox Controller
Memory Card or Xbox Live Communicator . . . . . . . .107
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .107
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .108
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . . . . .110
Adding an Xbox Live Communicator to a Wireless
Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .111
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Xbox Networking Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Establishing a Network Link Using Standard Networking .113
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .114
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . .115
Creating Your Own Crossover Cable . . . . . . . . . . . . . . . . . . .116
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .117
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . . . . .119
Extending the Network Status LEDs to the Front Panel . . . . . .120
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .120
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .120
Testing and Troubleshooting . . . . . . . . . . . . . . . . . . . . . . .122
Wireless Networking Hacks . . . . . . . . . . . . . . . . . . . . . . . . .123
Adding a Wireless Networking Adapter to the Xbox . . . . . .123
Adding a Removable Antenna to the Microsoft Xbox
Wireless Adapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . .125
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .126
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .126
Under the Hood: How the Hack Works . . . . . . . . . . . .131
Installing a Modchip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131
A Brief Introduction to Modchips . . . . . . . . . . . . . . . . . .131
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .135
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .135
Running Linux on an Unmodified Xbox . . . . . . . . . . . . . . .141
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .141
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .142
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .144
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .144
Xbox Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . .146
TLFeBOOK
xiv Contents
Chapter 4 PlayStation 2 . . . . . . . . . . . . . . . . . . . . . . . . .147
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148
Commercial Hardware Hacking: Modchips . . . . . . . . . . . . . . .148
Getting Inside the PS2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150
Mainboard Revisions . . . . . . . . . . . . . . . . . . . . . . . . . . .150
Identifying Your Mainboard . . . . . . . . . . . . . . . . . . . . .151
Opening the PS2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .152
Installing a Serial Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .156
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .157
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .158
Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .164
Under the Hood: How the Hack Works . . . . . . . . . . . . . .164
Booting Code from the Memory Card . . . . . . . . . . . . . . . . . .164
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .165
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Preparing TITLE.DB . . . . . . . . . . . . . . . . . . . . . . . . .165
Choosing BOOT.ELF . . . . . . . . . . . . . . . . . . . . . . . . .168
Saving TITLE.DB to the Memory Card . . . . . . . . . . . .168
Independence! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169
Under the Hood: How the Hack Works . . . . . . . . . . . . . .169
Other Hacks: Independent Hard Drives . . . . . . . . . . . . . . . . .171
PS2 Technical Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171
Understanding the Emotion Engine . . . . . . . . . . . . . . . . .172
The Serial I/O Port . . . . . . . . . . . . . . . . . . . . . . . . . .173
The I/O Processor . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175
The Sub-CPU Interface . . . . . . . . . . . . . . . . . . . . . . . . .176
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .176
PS2 Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . . .177
Part III Handheld Game Platforms . . . . . . . . . . . . . . . . . .179
Chapter 5 Nintendo Game Boy Advance . . . . . . . . . . . . .181
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182
Game Boy, 1989 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182
Game Boy Pocket, 1996 . . . . . . . . . . . . . . . . . . . . . . . . .183
Game Boy Color, 1998 . . . . . . . . . . . . . . . . . . . . . . . . . .183
Game Boy Advance, 2001 . . . . . . . . . . . . . . . . . . . . . . . .184
Game Boy Advance SP, 2003 . . . . . . . . . . . . . . . . . . . . . .185
TLFeBOOK
Contents xv
A Very Brief History of Nintendo . . . . . . . . . . . . . . . . . . . . .186
Opening the GBA Console . . . . . . . . . . . . . . . . . . . . . . . . . .187
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .187
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .188
Replacing the Display Lens . . . . . . . . . . . . . . . . . . . . . . . . . .193
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .194
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .194
Light Up Your LCD with the GBA Afterburner Mod . . . . . . . .198
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .198
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .200
Removing the LCD . . . . . . . . . . . . . . . . . . . . . . . . . .201
Preparing the GBA Housing . . . . . . . . . . . . . . . . . . . .203
Preparing the LCD . . . . . . . . . . . . . . . . . . . . . . . . . . .206
Preparing the Afterburner Module . . . . . . . . . . . . . . . .209
Installing the Afterburner Module . . . . . . . . . . . . . . . .211
Adding the Brightness Control (Optional) . . . . . . . . . . .214
Under the Hood: How the Hack Works . . . . . . . . . . . . . .216
Enhancing Your Afterburner with the GBA Stealth Dimmer Chip 217
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .218
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .219
Under the Hood: How the Hack Works . . . . . . . . . . . . . .225
Nintendo GBA Technical Specifications . . . . . . . . . . . . . . . . .226
The Central Processor . . . . . . . . . . . . . . . . . . . . . . . . . . .226
CPU Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .227
Memory Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . .228
Internal Working RAM . . . . . . . . . . . . . . . . . . . . . . .229
External Working RAM . . . . . . . . . . . . . . . . . . . . . . .230
Graphics Memory . . . . . . . . . . . . . . . . . . . . . . . . . . .230
Game ROM and Game Save Memory . . . . . . . . . . . . .231
The Graphics System . . . . . . . . . . . . . . . . . . . . . . . . . . .231
Tile-Based Modes (0–2) . . . . . . . . . . . . . . . . . . . . . . .232
Bitmap-Based Modes (3–5) . . . . . . . . . . . . . . . . . . . . .232
The Sound System . . . . . . . . . . . . . . . . . . . . . . . . . . . . .233
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .233
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .234
Nintendo GBA Resources on the Web . . . . . . . . . . . . . . . . . .238
TLFeBOOK
xvi Contents
Chapter 6 Gamepark 32 (GP32) . . . . . . . . . . . . . . . . . . . .241
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .242
Out of the Box: Configuring Your GP32 . . . . . . . . . . . . . . . .245
Opening the GP32 Console . . . . . . . . . . . . . . . . . . . . . . . . .251
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .251
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .251
Replacing the GP32 Screen Cover . . . . . . . . . . . . . . . . . . . . .257
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .258
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .258
Repairing Your Buttons . . . . . . . . . . . . . . . . . . . . . . . . . . . .262
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .262
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .263
Accelerating Your GP32 (CPU Core Voltage Increase) . . . . . . .264
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .265
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .265
Under the Hood: How the Hack Works . . . . . . . . . . . . . .268
Creating a DC Power Adapter . . . . . . . . . . . . . . . . . . . . . . . .269
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .269
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .273
Under the Hood: How the Hack Works . . . . . . . . . . . . . .275
Installing the Multifirmware Loader . . . . . . . . . . . . . . . . . . . .275
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .276
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .276
Backing Up Your Firmware . . . . . . . . . . . . . . . . . . . . .276
Reprogramming (Flashing) the New Firmware . . . . . . .278
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .280
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .284
GP32 Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . .286
Part IV Retro and Classic Systems . . . . . . . . . . . . . . . . . . .289
Chapter 7 Nintendo NES . . . . . . . . . . . . . . . . . . . . . . . . .291
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292
Opening the NES Console . . . . . . . . . . . . . . . . . . . . . . . . . .294
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .294
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
Replacing the 72-Pin Cartridge Connector . . . . . . . . . . . . . .299
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .300
TLFeBOOK
Contents xvii
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .301
Blue Power LED Modification . . . . . . . . . . . . . . . . . . . . . . .302
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .303
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .304
Under the Hood: How the Hack Works . . . . . . . . . . . . . .310
Disabling the NES “Lockout Chip” . . . . . . . . . . . . . . . . . . . .311
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .312
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .312
Optional: Adding a Switch . . . . . . . . . . . . . . . . . . . . . . . .315
Under the Hood: How the Hack Works . . . . . . . . . . . . . .315
Opening an NES Game Cartridge . . . . . . . . . . . . . . . . . . . . .316
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .316
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .318
Replacing the Battery in Certain Game Cartridges . . . . . . . . .319
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .320
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .321
Creating an EPROM Cartridge for Homebrew Game
Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .324
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .324
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .325
Under the Hood: How the Hack Works . . . . . . . . . . . . . .330
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .330
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .332
NES Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . .333
Chapter 8 Atari 2600 . . . . . . . . . . . . . . . . . . . . . . . . . . .335
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .336
Hacks in This Chapter . . . . . . . . . . . . . . . . . . . . . . . . . . .337
Atari 2600 Left-Handed Joystick Modification . . . . . . . . . . . . .337
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .338
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .338
Repair Your Atari 2600 Joysticks . . . . . . . . . . . . . . . . . . . . . .342
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .342
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .343
Revitalize Your Atari 2600 Paddles . . . . . . . . . . . . . . . . . . . . .349
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .350
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .350
Use an NES Control Pad with your 2600 . . . . . . . . . . . . . . . .356
TLFeBOOK
xviii Contents
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .357
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .358
Atari 2600 S-Video/Audio Mod . . . . . . . . . . . . . . . . . . . . . .364
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .364
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .366
Optional: Commodore 1702 Hack . . . . . . . . . . . . . . . . . .380
Optional: Do-It-Yourself 2600 A/V Mod . . . . . . . . . . . . .381
Technical Information . . . . . . . . . . . . . . . . . . . . . . . . . . .381
Atari 2600 Stereo Audio Output . . . . . . . . . . . . . . . . . . . . . .382
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .384
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .384
Under the Hood: How the Hack Works . . . . . . . . . . . . . .391
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .391
Atari 2600 Resources on the Web . . . . . . . . . . . . . . . . . . . . .396
Chapter 9 Atari 5200 . . . . . . . . . . . . . . . . . . . . . . . . . . .399
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .400
Opening the Atari 5200 . . . . . . . . . . . . . . . . . . . . . . . . . . . .401
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .401
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .401
Reassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .408
Atari 5200 Blue LED Modification . . . . . . . . . . . . . . . . . . . .408
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .409
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .410
Under the Hood: How the Hack Works . . . . . . . . . . . . . .413
Atari 5200 Two-Port BIOS Replacement . . . . . . . . . . . . . . . .413
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .414
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .414
Creating an Atari 5200 Paddle Controller . . . . . . . . . . . . . . . .419
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .421
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .421
Disassembling the Atari 2600 Paddle Controller . . . . . . .422
Building the 5200 Paddle Controller . . . . . . . . . . . . . .424
Adding a Weighted Dial . . . . . . . . . . . . . . . . . . . . . . .432
Under the Hood: How the Hack Works . . . . . . . . . . . . . .433
Freeing Yourself from the 5200 Four-Port Switchbox . . . . . . . .434
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .435
TLFeBOOK
Contents xix
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .436
Under the Hood: How the Hack Works . . . . . . . . . . . . . .445
Atari 5200 Video and Audio Upgrade Modification . . . . . . . . .446
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .447
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .449
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .467
Rebuilding Atari 5200 Controllers . . . . . . . . . . . . . . . . . .467
Atari 5200 Four-Port VCS Cartridge Adapter Fix . . . . . . . .470
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .470
Atari Resources on the Web . . . . . . . . . . . . . . . . . . . . . . . . .474
Chapter 10 Atari 7800 . . . . . . . . . . . . . . . . . . . . . . . . . . .477
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .478
Hacks in This Chapter . . . . . . . . . . . . . . . . . . . . . . . . . . .479
Blue LED Modification . . . . . . . . . . . . . . . . . . . . . . . . . . . .479
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .480
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .481
Under the Hood: How the Hack Works . . . . . . . . . . . . . .485
Game Compatibility Hack to Play Certain Atari 2600 Games . .486
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .487
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .487
Under the Hood: How the Hack Works . . . . . . . . . . . . . .489
Voltage Regulator Replacement . . . . . . . . . . . . . . . . . . . . . .490
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .490
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .491
Under the Hood: How the Hack Works . . . . . . . . . . . . . .494
Power Supply Plug Retrofit . . . . . . . . . . . . . . . . . . . . . . . . . .495
Preparing for the Hack . . . . . . . . . . . . . . . . . . . . . . . . . .496
Performing the Hack . . . . . . . . . . . . . . . . . . . . . . . . . . . .497
Other Hacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .501
Atari 7800 Composite and S-Video Output . . . . . . . . . . . .501
Sega Genesis to Atari 7800 Controller Modification . . . . . .501
NES Control Pad to Atari 7800 Controller Modification . . .502
Atari 7800 DevOS Modification and Cable Creation . . . . .502
Homebrew Game Development . . . . . . . . . . . . . . . . . . . . . .502
Atari 7800 Resources on the Web . . . . . . . . . . . . . . . . . . . . .506
TLFeBOOK