# game and watch got hacked one day before release



## loler55 (Nov 12, 2020)

https://twitter.com/ghidraninja


----------



## eyeliner (Nov 12, 2020)

Well, you can probably use it to emulate any two button console, like gameboy/nes/sms/gg?


----------



## luigirockz (Nov 12, 2020)

Well that was fast


----------



## MikaDubbz (Nov 12, 2020)

How much storage does it have? I'd just wanna add all the missing NES Mario Bros games and mario spinoffs, so Super Mario Bros 2/USA, Super Mario Bros 3, Mario Bros., Dr. Mario, Wario's Woods, Yoshi, NES Open Tournament Golf, Donkey Kong, Donkey Kong Jr., Donkey Kong 3, Wrecking Crew, and fuck it maybe even Mario is Missing and Mario's Time Machine too, just for the sake of being complete (and yes I'm aware Mario pops up in games like Punch Out, but I'm focusing only on games where Mario characters are playable).


----------



## EPgrouch (Nov 12, 2020)

this doesn't surprise me. just shows how weak nintendos security is.


----------



## MikaDubbz (Nov 12, 2020)

EPgrouch said:


> this doesn't surprise me. just shows how weak nintendos security is.


Did anyone really expect a little limited edition novelty to have high security to begin with?


----------



## Lostbhoy (Nov 12, 2020)

I want Mario 64 on it


----------



## EPgrouch (Nov 12, 2020)

MikaDubbz said:


> Did anyone really expect a little limited edition novelty to have high security to begin with?


good point.


----------



## Mnecraft368 (Nov 12, 2020)

Epic, now I can finally justify the £45 I wasted spent on this!


----------



## hippy dave (Nov 12, 2020)

Exciting. What he's done so far tho is through connecting to internal chips/contacts, I hope there turns out to be a nice USB-accessible hack at some point.
Anyway like I said elsewhere when this gadget was announced, the most important thing to get running on it isn't more NES games, but the simulations of all the original Game & Watch games.


----------



## Seriel (Nov 12, 2020)

MikaDubbz said:


> How much storage does it have? I'd just wanna add all the missing NES Mario Bros games and mario spinoffs, so Super Mario Bros 2/USA, Super Mario Bros 3, Mario Bros., Dr. Mario, Wario's Woods, Yoshi, NES Open Tournament Golf, Donkey Kong, Donkey Kong Jr., Donkey Kong 3, Wrecking Crew, and fuck it maybe even Mario is Missing and Mario's Time Machine too, just for the sake of being complete (and yes I'm aware Mario pops up in games like Punch Out, but I'm focusing only on games where Mario characters are playable).


128kb:
Interesting, an STM32H7B0VBT6 is the main processor! Cortex-M7, 128 KBytes Flash, 1024 KBytes of RAM. Also some unpopulated headers close by that expose SWD (the Arm Cortex-M debug interface)! pic.twitter.com/f5cdSlmin6— stacksmashing (@ghidraninja) November 12, 2020


----------



## MikaDubbz (Nov 12, 2020)

Seriel said:


> 128kb:


Well shit, Super Mario 2 alone, as well as Super Mario 3 alone are too big for device.


----------



## Lostbhoy (Nov 12, 2020)

Need a usb hdd attachment!


----------



## Mnecraft368 (Nov 12, 2020)

MikaDubbz said:


> Well shit, Super Mario 2 alone, as well as Super Mario 3 alone are too big for device.


It actually has 8MB.
Next to it is a Macronix 25U8035 8Mb flash - definitely a candidate to be dumped! pic.twitter.com/23gegjHMjn— stacksmashing (@ghidraninja) November 12, 2020


----------



## bobmcjr (Nov 12, 2020)

MikaDubbz said:


> Well shit, Super Mario 2 alone, as well as Super Mario 3 alone are too big for device.



Most of the data is likely pulled in from the external flash memory next to it.


----------



## MikaDubbz (Nov 12, 2020)

Mnecraft368 said:


> It actually has 8MB.
> https:/twitter.com/ghidraninja/status/1326857188158136320



Then that changes things, I'll be generous and say everything there takes up 1MB (SMB1 is 41kb, Lost Levels is 73kb, can't imagine the clock and Ball take up another 900kb, but I'll assume that regardless and see how close to those 7 extra mbs I can get with the games I suggested:

Mario Bros: 41kb
Super Mario 2/USA: 257kb
Super Mario 3: 385kb
Dr. Mario: 257kb
Donkey Kong Original Edition (version with all 4 levels): 65kb
Donkey Kong Junior: 25kb
Donkey Kong 3: 41kb
NES Open Tournament Golf: 257kb
Wrecking Crew: 41kb
Wario's Woods: 513kb
Yoshi: 257kb
Yoshi's Cookie: 193kb
Mario is Missing: 257kb
Mario's Time Machine: 257kb

That adds up to 2846kb, leaving still over 4mb of space for other games (or what I'd do is add all the best NES Mario hacks from there like Super Mario 3Mix or Mario Adventure).  So that's pretty cool, in theory this could be like a complete NES collection of all Mario-related offerings, or I bet you could load all the NES Classic games on it and have a portable NES classic.


----------



## osirisjem (Nov 12, 2020)

MikaDubbz said:


> Donkey Kong Junior: 25kb


Yes please !


----------



## putamierda (Nov 13, 2020)

@Mnecraft368 Actually it says on the twitter post it has 8Mb of storage, that means 1 megabyte, so much less space to add games, unless the person posting messed up with the lower case "b"


----------



## zfreeman (Nov 13, 2020)

putamierda said:


> @Mnecraft368 Actually it says on the twitter post it has 8Mb of storage, that means 1 megabyte, so much less space to add games, unless the person posting messed up with the lower case "b"


You're right.

https://datasheetspdf.com/mobile-pdf/706345/MacronixInternational/MX25U8035/1


----------



## gamesquest1 (Nov 13, 2020)

I'm liking that they are using a joy-con battery to power it, as for storage, I guess it wouldn't be too difficult to just swap out the SPI chip for a slightly bigger one (granted your still pretty limited with it being an spi chip) but as long as the system is capable accepting a larger chip (I wouldn't imagine they didn't bother putting any hardware checks or anything in place) I would imagine you could make up a little 20 in 1 game system for novelties sake, but I guess the limited storage makes the system less appealing to people looking for a little emulation system, hopefully people figure out how to interface with it via usb and can reprogram it whenever they want to swap out games, would make it at least a little bit more useful, but overall its going to be limited to a novelty item rather than a fairly useful little device like the snes/nes mini consoles ended up being useful as a emulator box


----------



## loler55 (Nov 13, 2020)

gamesquest1 said:


> I'm liking that they are using a joy-con battery to power it, as for storage, I guess it wouldn't be too difficult to just swap out the SPI chip for a slightly bigger one (granted your still pretty limited with it being an spi chip) but as long as the system is capable accepting a larger chip (I wouldn't imagine they didn't bother putting any hardware checks or anything in place) I would imagine you could make up a little 20 in 1 game system for novelties sake, but I guess the limited storage makes the system less appealing to people looking for a little emulation system, hopefully people figure out how to interface with it via usb and can reprogram it whenever they want to swap out games, would make it at least a little bit more useful, but overall its going to be limited to a novelty item rather than a fairly useful little device like the snes/nes mini consoles ended up being useful as a emulator box


https://gizmodo.com/nintendos-new-game-watch-hacked-a-day-before-its-offi-1845664049
based on stacksmashing’s explorations it doesn’t appear as if the USB-C port on the new Game & Watch is connected to the CPU or anything other than power wires. It seems it’s for charging the internal battery only, which means that anyone wanting to swap out the pre-loaded ROM files, or completely replace the firmware, is going to need to open up their device and use custom hardware to re-flash it.

but he sayed on twitter only this:

Didn’t solder a thing - but also didn’t use USB  couple of test clips were enough. Need to check whether USB actually goes to the CPU, didn’t look like it does



can be a bad news i dont now if this site has more infos about


----------



## NoNAND (Nov 13, 2020)

Lostbhoy said:


> I want Mario 64 on it


And i want Mario odyssey on it.


----------



## gamesquest1 (Nov 13, 2020)

loler55 said:


> https://gizmodo.com/nintendos-new-game-watch-hacked-a-day-before-its-offi-1845664049
> based on stacksmashing’s explorations it doesn’t appear as if the USB-C port on the new Game & Watch is connected to the CPU or anything other than power wires. It seems it’s for charging the internal battery only, which means that anyone wanting to swap out the pre-loaded ROM files, or completely replace the firmware, is going to need to open up their device and use custom hardware to re-flash it.
> 
> but he sayed on twitter only this:
> ...


yeah I guess there isn't much need for the game and watch to have a usable USB port, at least with the snes/nes mini they had the reasoning that there was more that could go wrong so they needed a quick recovery mode to recover faulty consoles if the settings or saves or something somehow got corrupted and somehow bricked the console, there isn't really any saving on smb1 to go wrong, I guess that seals its fate as a novelty/collectors item

wouldn't surprise me to see a couple of people refresh the console just for the sake of it, but its not going to be more than just enthusiasts doing it just to prove they can......could see people gutting them and trying to stick a pi-zero in the case or something with a full gb/gbc/nes romset


----------



## Mnecraft368 (Nov 14, 2020)

The process of the hack + some tools have been released.

https://github.com/ghidraninja/game-and-watch-hacking


----------



## gamesquest1 (Nov 15, 2020)

Mnecraft368 said:


> The process of the hack + some tools have been released.
> 
> https://github.com/ghidraninja/game-and-watch-hacking



interesting, so its similar to how we used to have to create xor pads for the 3DS to downgrade the firmware, the sad part is this only works for known data, so unless the entire un-encrypted flash chip is loaded up into ram at some point you would only be able to decrypt and re-encrypt the known areas, I guess the sprites and stuff for the clock would be possible if they figure out what format they're stored in and the roms should be fairly trivial, unfortunately the on the fly patching would probably mean flashing games that aren't SMB is out of the question

then again, if they are using their other systems emulators as a base for the game and watch emulator, you would probably find a nice simple ini file loaded up in the ram dump thats used for applying patches and with a bit of XOR'ing you could find the location its stored at in the encrypted flash image and patch out the patches entirely by simply dummying out the ini file


----------



## peteruk (Nov 22, 2020)

Looks like the fella has DOOM running on it now, exciting for those of us into these things


----------



## K3N1 (Nov 27, 2020)

can it run crysis


----------



## Deleted User (Dec 20, 2020)

Game and Watch got completely reverse engineerd.
People are also looking into a mod that integrates an ESP32 WiFi module, which could lead to things like wireless transfer of ROMs.  Work has even begun on a full PCB replacement that includes an FPGA that can run a NES core.


----------



## nani17 (Dec 21, 2020)

I must pick one of these up soon.


----------

