Classic NES Series Anti-Emulation Measures
mgba.io
mgba.io
That so many useful innovations are lost & forgotten, because there was no incentive to market & distribute the innovation.
It is lost on many, that the usefulness of an idea does not guarantee it's popularity. It is very, very hard to get visibility & traction for even the most useful of inventions.
Protections on ownership & wealth create the incentives to invest in creating new innovations, but also to productise, distribute and market those innovations.
It is only a small fraction of products that can exist without the proper incentives to build out the whole chain from idea to r&d, productisation, to distribution & marketing.
Mirrored memory is a side effect of unconnected lines on the address bus thus making the content of those bits irrelevant. Code can take advantage of this to run faster or put tag values into addresses.
On a GBA, VRAM is faster than ordinary RAM. Programs can do well to use it for tight inner loops.
Using STM (store multiple) to DMA registers? Again, go faster.
Save type masquerading might be code that helps when running on a development kit, but I admit that I can't think of what use it might have.
Self-modifying code that depends on the pre-fetch queue might be the best place to look for intent. Might be easy to tell if the program is doing it for some larger purpose or simply to fail subtly or overtly if it sees unrealistic processor behavior.
Any why would a program do extra work writing to an audio FIFO than need be?
Using a non-standard copy of the address --- well, it's an emulator, on a slow system; the ARM requires 32-bit constants to be read from a constant pool. If it can use certain addresses that are cheaper to construct, somehow, that'd be a performance boost. Can't tell without knowing which addresses, though.
My first thought on the save type masquerading and the pre-fetch queue testing is that it's testing for particular hardware. e.g. if it's running on a cart with SRAM, do the SRAM thing, otherwise do the flash thing. Likewise, testing the pipeline size might be trying to figure out what processor there is. That doesn't explain why it just crashes rather than following some other code path --- if the code to do the SRAM thing was there, and the emulator tells the game that there's SRAM, then the emulator should see the game doing the SRAM thing.
It might be something as trivially stupid as that the game contains the code to check for development hardware, but that the run-time support for the development hardware isn't present and instead the game is just crashing. There may not be anything malicious here.
If I wanted some sort of antipiracy or antiemulation feature, I wouldn't put a big obvious crash up front. Instead I'd introduce some sort of random failure elsewhere in the game, so it superficially looks like it's working, but isn't any fun to play...
This isn't mentioned in the article, since one of the anti-piracy/-emulation techniques I didn't discover at the time of writing it (due to my dump being an overdump) is that many of the games do this. They screw up input so it either boots but you can't play it at all, or input is unplayably slow. It detects it by having an interesting memory mirroring quirk in the cartridges that no other GBA carts have.
[1] http://mikejmoffitt.com/articles/0047-puyopuy2.html [2] https://tcrf.net/Puyo_Puyo_Tsuu_(Arcade)
Doesn't that defeat the purpose? If people don't realize that they're being punished for pirating, you're just collecting bad review scores and not pushing anyone to buy a legitimate copy.
Another game, Game Developer Tycoon, would run as normal, but as you got further and further along, in-game pirates would pirate all the games you made and your profits would keep on dropping. People came to the developer forums to ask for ways to keep people from pirating their games, because they couldn't make any money because of all of the pirate. The irony was lost on some.
For every person who goes out of their way to complain on the forums, there's probably five that just caution their friends not to buy the game.
I also recall (obviously difficult to verify) accounts from people who claimed that the Arkham Asylum (I recalled it was City...?) bug happened to them with legitimate copies. From a development perspective, an "Easter egg" of that sort requires a LOT of QA effort.
What does this have to do with speed?
On a GBA, VRAM is faster than ordinary RAM. Programs can do well to use it for tight inner loops.
Almost all programs use IWRAM for this. It's one of the things it's for. It's as fast if not faster than VRAM (depends on if the VRAM is being accessed by the PPU at the time).
Using STM (store multiple) to DMA registers? Again, go faster.
In retrospect, yeah this might actually be the case.
Save type masquerading might be code that helps when running on a development kit, but I admit that I can't think of what use it might have.
There are a handful of GBA games that lie about save type as anti-piracy and refuse to save or even boot if it finds the wrong one. It's also really the only anti-piracy technique that any other GBA games actually use, since it's quite effective against flash carts.
You generally need to mask potentially-tagged pointers before dereferencing them. (Ab)using virtual memory or unconnected lines lets you skip the mask, eliminating the cost in any code that's otherwise unconcerned about the tags. This in turn may let you save a byte or register here and there (and thus save memory bandwith / potentially spill fewer registers, maybe saving some performance).
GCs may abuse pointer tagging for keeping track of what they scaned. Ruby's VALUE type is pointer sized, and will point to Ruby objects such as strings and symbols - but it can also directly represent e.g. a 31-bit integer value ('Fixnum') on 32-bit systems without needing to be dereferenced, and without needing to consume a separate type field.
Indeed, in the PC world taking advantage of the prefetch queue as a sort of "loop buffer" was relatively common in demos, where a loop would patch instructions to execute in the next iteration, squeezing out a few extra cycles. Here's a detailed application of this trick:
http://www.reenigne.org/blog/8088-pc-speaker-mod-player-how-...
...as seen in this awesome demo:
https://trixter.oldskool.org/2015/04/07/8088-mph-we-break-al...
It would be sad if they were to be lost in time.
In particular, http://www.pouet.net/prod.php?which=65371
I've always suspected that Nintendo cares a lot less about PC emulation, than it does about mostly-chip-compatible knock-off hardware.
Think of those consoles you see at Walmart that claim to come with "100 games built in!" Those frequently contain chip-compatible designs of Nintendo's old hardware, and a library of ROMhacks of NES games (or the ROM from a single one of those 100-in-1 NES carts.) They're not emulating Nintendo ROMs; they're just running them, directly.
The manufacturers of these consoles never bothered to clone newer ones after the NES, because all the demand for these knock-offs seems to be some weird combination of nostalgia and clueless-parent value-purchasing (e.g. "oh hey, it has Super Mario Bros on the box! That game was great. My kids would like that!")
But the GBA is just as easy to clone the internals of as the NES is (ARM7 cores are just as easy to find—and cheap—as 6502s), and has a far larger library of games (~17000!) So if these companies could transition to a GBA chip-compatible design and still ship these NES ports, they'd increase value immensely, while still being able to put NES nostalgia on the box.
And so, for these ROMs that might have been just the thing to spark this switch-over, Nintendo went to some extra effort.
It would have been funny, had any of these knock-off manufacturers already finalized a hardware design based on tests with other GBA ROMs and started up their logistics pipeline to assemble consoles, had they flashed one of the NES Classics ROMs onto their new-off-the-line console, and realized that it was far more stringent than other games were about faithfulness to the GBA's architecture. It might be enough to kill a whole company.
---
Of course, none of this ever materialized, because for some reason, the knock-off manufacturers are still just making consoles that are chip-compatible with NES games, rather than speccing out builds based on what chips have become equally cheap since then. Who knows why.
Actually, there are now quite a few Chinese GBA clones on the market, and my understanding is that they do not use emulation but are hardware-compatible reimplementations of the GBA hardware.
Some examples:
http://exeq.ru/produkcija/pristavki/detskie/gamebox.html
http://obscurehandhelds.com/2010/08/the-nintendo-game-boy-ad...
I recently "bought" Titanfall 2, on DVD. I put "bought" in quotes because I wonder how much I actually own it, if at all.
It wouldn't run at all without first connecting to the internet and downloading multiple gigabytes of updates.
I wonder what would happen in the future when EA decides to shut up shop or change their DRM platform. Will I ever be able to play it again?
This is why I often feel like pirates "own" the content more than legitimate buyers.
Will that be true of FTL, Bastion, Shadow of Mordor, Limbo, or Assassin's Creed?
I get the point, though. I've got dozens and dozens of games from the 90s and 2000s, and the earlier ones are much less likely to have a reliance on some external authentication server, or something.
For really old games, I usually just buy the disks outright.
Since the original code was designed to run on NES, I wonder if these were hacks to work around issues with NES code running on GBA rather than a deliberate consideration to stop people from porting your port.
Your computer has a GPU. It probably doesn't and didn't have scrolling registers or hardware sprites (unless, like the C64, it had a gaming focus).
I don't think it had hardware sprites, but game programmers of that era often used compiled sprites to improve performance.
For GBA emulation, RetroPie has the choices of "gpSP" (either through libretro or independently), "vba-next", and "mgba".
edit: Sorry, jpfau, saw yours after refreshing.
I like the word, but I think you mean "talented". :)
It's not be practical to actually make one, but theoretically, there's nothing you could do to stop your game being on a 100% accurate emulator. And some good emulators are amazingly close.
(GBA Video was a short-lived series of video content available on GBA carts. I remember having a cart with an episode of The Fairly Odd-Parents on it. The video quality was terrible. Nothing worth protecting.)