Reverse engineering a Nintendo Switch cartridge | Hacker News Reader

Reverse engineering a Nintendo Switch cartridge

texplained-store.com

163 pointsEcco29 comments

Another interesting fact about switch game cards is that they taste horribly. You can see several videos online of people tasting them. Theory was that it was coated in something to avoid kids from swallowing the small cards. But I'm not sure this was confirmed by Nintendo.

It was confirmed by Nintendo:

“To avoid the possibility of accidental ingestion, keep the game card away from young children. A bittering agent (Denatonium Benzoate) has also been applied to the game card. This bittering agent is non-toxic.”

https://kotaku.com/nintendo-switch-cartridges-taste-so-bad-1...

It's good that news travels fast today, or else people who didn't wash their hands after handling carts could be in for a surprise when they ate. That's the same chemical used in air dusters to stop them being inhaled deliberately.

This is extremely cool. I always find these kinds of breakdowns interesting, because they always find something absolutely unique to the device.

Does anyone know, for this kind of "unique card device" use case, do companies usually have an in-house team in charge of developing it, or do they hire a third party, or does a third party approach them with the offer of a device like this?

If a third party, is it a small shop, or some established company? How is the company known and how does it build that relationship with Nintendo?

Nintendo has long used Macronix as its storage device supplier:

http://wccftech.com/nintendo-nx-macronix-memory-slots/

Fun fact: Macronix used to make chips to defeat the NES lockout system for unlicensed cartridges [1]. I don't know if they made the ROMs or cartridges as well, but it seems plausible. I think their partnership with Nintendo started during the N64 era, with Toshiba and Sharp making most of their ROMs before that.

[1] https://www.google.com/patents/US5004232

Similarly, Argonaut Games, the company that worked with Nintendo to produce StarFox and the SNES SuperFX chip. Their first interaction with Nintendo was when "Argonaut submitted a proof-of-concept method of defeating the Game Boy's copyright protection mechanism."

Another fun fact: Argonaut later evolved the very same SuperFX chip into the https://en.wikipedia.org/wiki/ARC_(processor), which is used in, among [many] other things, Intel's infamous Management Engine. You very likely have an Argonaut core in your computer.

Back in the 80s Hudson developed the HuCard format based on their earlier Bee card format. They approached NEC with it and together they created the PC Engine (know as the TurboGrafx 16 in the US).

http://www.videogameden.com/article.htm?hu

I still have mine!

Surely the first step should have been to attach a logic analyzer to the cartridge in circuit? For all we know, it might be using a well-known protocol like SDIO...

It does look extremely similar to an SD card in construction, with a large flash die and a smaller controller: https://www.bunniestudios.com/blog/?page_id=1022

The part number on the IC, after some contrast enhancements, appears to be MX28K128GL0 --- not a publicly documented Macronix part number, but may be related to the 28F128, a common 16MB (128Mb) NOR flash.

Considering the download size of the games, a 16GB (128Gbit) chip is more likely

You're pretty determined when you decide to dissolve the packaging of an IC :)

Decapping an IC is simpler than it looks. Heck, anyone with access to a university cleanroom can (with practice) easily reverse a commercial IC. Understanding how it works is a different matter entirely though -- that's where microscopy and circuits knowledge come in. Analog circuits are significantly more complex as you need to characterize (measure resistance, capacitance, etc.) individual components to be able to accurately model their behavior.

Curious what your thoughts are on this:

https://reverseengineering.stackexchange.com/questions/5878/...

A modern Intel CPU is a different beast entirely. Even relatively simple ICs become exceedingly difficult to reverse at lower process nodes, so I agree with the answer. My comment was more geared towards simpler ICs at a fairly accessible process node (65 nm and older). Also, my use of the word "reverse" in no way includes the process of figuring out what each part of the circuit does in detail.

Nonetheless, at least in my field of research, the assumption is that there exist nation states with "unlimited" resources that can in fact reverse complex ICs. In reality, I doubt even the US DoD has that level of resources available, so I like to think of the assumption as an analogue to the oracle model in cryptography.

In reality, I doubt even the US DoD has that level of resources available, so I like to think of the assumption as an analogue to the oracle model in cryptography.

Actually I would look East, to China and Russia, for the latest technologies in IC reverse-engineering. I don't think nation-state levels of resources are necessary even to RE something like an Intel CPU. To actually understand how it all works is a different matter, but if you're talking about just deriving a transistor-level or gate-level schematic, or turning that into HDL, from my understanding it's actually quite affordable now. You can already recover code from most microcontrollers with <$10K USD (and I personally know others who have used those services before); I'd estimate getting a schematic to cost maybe 10x that.

Modern intel CPUs are very different beasts from your average microcontroller.

I think we can assume that if the potential gain is large enough, the US or other high tech economies (China/Japan/Korea/Russia/Singapore/France/Italy/etc) are definitely capable and willing to expend significant sums.

For example, the fragments of recent NorK missiles. If they had any computer or radar fragments left, they would be analysed, even if it cost $100M.

Also, military cryptographic processors, especially for strategic or space comms.

You might find this interesting:

https://www.sciencenews.org/article/what-donkey-kong-can-tel...

It was a post on HN a few months back

After decapping an IC, an experienced eye can usually identify patterns and make educated guesses at what each module in a circuit does, at least at a very high level. This can be helpful in and of itself, without diving into an exact understanding of how everything in the chip works.

you are determined when you unleash a technician with a FIB on the exposed chip.

And you can go to a lab and get this done for a few $100. It was exciting seeing the technician "fly" a electron microscope or something over the die and reach the exact spot we asked for and make modifications.

It's interesting that almost half of the plastic enclosure is empty. Could this be to allow for higher-capacity cartridges without having to use higher-density storage?

I think that they might have picked the size due to ergonomics. It's hard and incovienent to use very small obejcts and Nintendo seems to target players of all ages.

I suspect this is true. If they made it microSD-sized, it'd be very difficult to change games on the go and would easily get lost in the bottom of a backpack.

You see this on the PS Vita as well: the memory cards, which are meant to be changed rarely if ever, are roughly the size of a microSD card while the game cartridges are probably double the width and height even though the storage capacity of the carts tend to be much less (2-4GB) than the memory cards (8-64 GB).

Hi everyone and thanks for talking about our article.

For those who wants to go further: Zelda’s Chip ID is out! https://www.texplained-store.com/en/10-chip-id

Interestingly enough, different games seem to have different internals. Here's a more traditional PCB design found inside a 1-2-Switch cart: http://imgur.com/a/FndZC

Funny: I felt this was so interesting that I could not imagine the wizardry was taking place anywhere close to my area (FR).

It appears they are located on my daily commute.

Could not have known without HN, cool!

(EDIT: typo)

Reply on news.ycombinator.com