Comment by cubefox
11 hours ago
> It may be counterintuitive at first, but why wouldn't be possible?
For the same reason it wasn't possible at the time for a third-party to make N64 cartridges themselves to avoid Nintendo's fees. But I assume these lockout chips are replicated or circumvented by now.
Related to this, every ROM needs a "boot loader" that has to be signed and is verified by the lockout chip.
Nintendo's boot code is under copyright and thus cannot be used. So the boot code distributed with Libdragon is signed by finding a hash collision with a brute force tool running on the GPU[1]. Fun stuff!
[1] https://github.com/DragonMinded/libdragon/tree/trunk/boot#bu...
The “development” version of that is even crazier: it's a very tiny signed bootloader that does nothing but copies the “real” bootloader into memory, then trampolines into it, such that even developing your own IPL3 doesn't require having to re-brute-force the signature for every build.
And on top of that, libdragon's IPL3 doesn't just blindly copy the first megabyte of ROM code into RDRAM like the official Nintendo one does, but actually expects the ROM data after it to be a full-blown ELF executable, which it parses out and copies pieces of to the specified places.
Pretty slick stuff.
They might be able to get around it with an affirmative defense in court, but they obviously don't want to, lest they lose.
But it's legal to use the Sony and Nintendo trademarks in a similar way. The court ruled that since they are checked by the console, there was no way not to use them, and Nintendo lost their protection by doing so.
Fairly recently the chip was studied in detail and replicated. But like most systems of that era, I believe it was circumvented fairly quickly by pirates. The easiest way would be to piggyback a licensed cartridge - unlike the NES, it has to be one with the same region and bootloader as there are several lockout chip variants, but that basic technique still works.
I never saw a piggyback cartridge at the time though, or one that was obviously unlicensed. Of course, this could have more to do with Nintendo's legal pressure than with technological possibility.
The main pirating route at the time (a device (oh which there were several) that sat under the N64 and had either an Iomega Zip drive or a CD drive for holding ROMs), had a port for inserting a real cartridge to use its lockout chip.
2 replies →
I think a lot of the early flashcarts were piggybacks. I was never into that scene though.