Classic NES Series Anti-Emulation Measures

https://mgba.io/2014/12/28/classic-nes/

by kibwen • 9 years ago

209 75 9 years ago

kibwen• 9 years ago

I find it very interesting to read about these sort of tactics, given that not only does their design require a high degree of expertise with console hardware (which Nintendo's developers obviously have), but also a high degree of familiarity with emulators themselves in order to understand the techniques that are likely to defeat the common optimizations and shortcuts that emulators make in order to make up for the discrepancy in speed.

eric_the_read• 9 years ago

From the "Dolphin Progress Report" article (https://news.ycombinator.com/item?id=13544514): there were two Disney games that wrote garbage data to a region of memory where important data was stored, but not enough to cause the CPU to flush the cache, and then invalidated the cache, causing the writes to never actually happen on real hardware, but on Dolphin (which didn't actually implement a CPU cache in its emulation layer), it caused the writes to actually happen.

jedimastert• 9 years ago

That's super clever

LoonyBalloony• 9 years ago

All this effort to claim possession over something. Imagine if all the effort regarding possession and wealth were used to make something actually useful. What a waste.

AceJohnny2• 9 years ago

That is awesome. I'll have to remember that one.

AdmiralAsshat• 9 years ago

Article is from 2014. Suggest adding info to submission title.

jpfau4• 9 years ago

Indeed, I even posted it back then: https://news.ycombinator.com/item?id=8808754

webreac• 9 years ago

I wonder if these tricks to defeat emulators have the opposite effects. They give truly interesting chalenges that can motivate talentuous developpers.

brokenmachine2• 9 years ago

talentuous

I like the word, but I think you mean "talented". :)

derefr3• 9 years ago

Yep. See, for example, 4am's cracks of the Apple II software collection (https://archive.org/details/apple_ii_library_4am), done half for the sake of preserving old games, but also half for the sake of discovering (and documenting!) the many kinds of anti-piracy measures that went into them.

ClassyJacket2• 9 years ago

Yeah, ironically, they could lead to the emulator developers more accurately emulating the original hardware. Then other games may actually emulate better!

It's not be practical to actually make one, but theoretically, there's nothing you could do to stop your game being on a 100% accurate emulator. And some good emulators are amazingly close.

gp2000• 9 years ago

It is difficult to take a binary program and establish intent. I'd rather call these "interesting and unusual programming tricks" than "anti-emulation measures" until more evidence is presented.

Mirrored memory is a side effect of unconnected lines on the address bus thus making the content of those bits irrelevant. Code can take advantage of this to run faster or put tag values into addresses.

On a GBA, VRAM is faster than ordinary RAM. Programs can do well to use it for tight inner loops.

Using STM (store multiple) to DMA registers? Again, go faster.

Save type masquerading might be code that helps when running on a development kit, but I admit that I can't think of what use it might have.

Self-modifying code that depends on the pre-fetch queue might be the best place to look for intent. Might be easy to tell if the program is doing it for some larger purpose or simply to fail subtly or overtly if it sees unrealistic processor behavior.

Any why would a program do extra work writing to an audio FIFO than need be?

crooked-v• 9 years ago

Particularly given the "NES Classics" line, I would expect weird stuff to happen because these cartridges are effectively themselves emulations of games from different hardware.

tiraniddo• 9 years ago

I'd take a guess that the save tricks might be more anti piracy. After all the gba had flash carts, perhaps these carts contained sram and eeprom so checking for it was to block it. No idea about the pipeline stuff though, perhaps checking vram was working correctly?

david-given• 9 years ago

Yeah, putting tight loops into fast RAM for extra speed is a very old trick --- I've done it myself. Likewise multiple stores.

Using a non-standard copy of the address --- well, it's an emulator, on a slow system; the ARM requires 32-bit constants to be read from a constant pool. If it can use certain addresses that are cheaper to construct, somehow, that'd be a performance boost. Can't tell without knowing which addresses, though.

My first thought on the save type masquerading and the pre-fetch queue testing is that it's testing for particular hardware. e.g. if it's running on a cart with SRAM, do the SRAM thing, otherwise do the flash thing. Likewise, testing the pipeline size might be trying to figure out what processor there is. That doesn't explain why it just crashes rather than following some other code path --- if the code to do the SRAM thing was there, and the emulator tells the game that there's SRAM, then the emulator should see the game doing the SRAM thing.

It might be something as trivially stupid as that the game contains the code to check for development hardware, but that the run-time support for the development hardware isn't present and instead the game is just crashing. There may not be anything malicious here.

If I wanted some sort of antipiracy or antiemulation feature, I wouldn't put a big obvious crash up front. Instead I'd introduce some sort of random failure elsewhere in the game, so it superficially looks like it's working, but isn't any fun to play...

jpfau4• 9 years ago

Instead I'd introduce some sort of random failure elsewhere in the game, so it superficially looks like it's working, but isn't any fun to play...

This isn't mentioned in the article, since one of the anti-piracy/-emulation techniques I didn't discover at the time of writing it (due to my dump being an overdump) is that many of the games do this. They screw up input so it either boots but you can't play it at all, or input is unplayably slow. It detects it by having an interesting memory mirroring quirk in the cartridges that no other GBA carts have.

Cpoll2• 9 years ago

Instead I'd introduce some sort of random failure elsewhere in the game, so it superficially looks like it's working, but isn't any fun to play...

Doesn't that defeat the purpose? If people don't realize that they're being punished for pirating, you're just collecting bad review scores and not pushing anyone to buy a legitimate copy.

jpfau4• 9 years ago

What does this have to do with speed?

On a GBA, VRAM is faster than ordinary RAM. Programs can do well to use it for tight inner loops.

Almost all programs use IWRAM for this. It's one of the things it's for. It's as fast if not faster than VRAM (depends on if the VRAM is being accessed by the PPU at the time).

Using STM (store multiple) to DMA registers? Again, go faster.

In retrospect, yeah this might actually be the case.

Save type masquerading might be code that helps when running on a development kit, but I admit that I can't think of what use it might have.

There are a handful of GBA games that lie about save type as anti-piracy and refuse to save or even boot if it finds the wrong one. It's also really the only anti-piracy technique that any other GBA games actually use, since it's quite effective against flash carts.

MaulingMonkey• 9 years ago

What does this have to do with speed?

You generally need to mask potentially-tagged pointers before dereferencing them. (Ab)using virtual memory or unconnected lines lets you skip the mask, eliminating the cost in any code that's otherwise unconcerned about the tags. This in turn may let you save a byte or register here and there (and thus save memory bandwith / potentially spill fewer registers, maybe saving some performance).

GCs may abuse pointer tagging for keeping track of what they scaned. Ruby's VALUE type is pointer sized, and will point to Ruby objects such as strings and symbols - but it can also directly represent e.g. a 31-bit integer value ('Fixnum') on 32-bit systems without needing to be dereferenced, and without needing to consume a separate type field.

userbinator2• 9 years ago

Indeed, in the PC world taking advantage of the prefetch queue as a sort of "loop buffer" was relatively common in demos, where a loop would patch instructions to execute in the next iteration, squeezing out a few extra cycles. Here's a detailed application of this trick:

http://www.reenigne.org/blog/8088-pc-speaker-mod-player-how-...

...as seen in this awesome demo:

https://trixter.oldskool.org/2015/04/07/8088-mph-we-break-al...

saganus• 9 years ago

That demo is insane. Is there some kind of archive that is keeping track of them?

It would be sad if they were to be lost in time.

patmcguire2• 9 years ago

Why bother? If these are ports of NES games, couldn't they just emulate the NES versions?

patmcguire2• 9 years ago

Welp, I commited the sin of posting before reading. That was the last paragraph of the article.

jonawesomegreen• 9 years ago

Part of me wonders if this is just some experienced game dev working on a boring porting project that decided to have a little fun and see how he could cause issues with emulation, not some large sanctioned measure to defeat emulation software. Might explain why this effort went into such a seemingly unlikely game.

rhinoceraptor• 9 years ago

If I were a game dev, I would want my work to be preserved past the life of the specific hardware it was written for. It's sad that so much culture is lost due to proprietary hardware and software.

brokenmachine2• 9 years ago

True.

I recently "bought" Titanfall 2, on DVD. I put "bought" in quotes because I wonder how much I actually own it, if at all.

It wouldn't run at all without first connecting to the internet and downloading multiple gigabytes of updates.

I wonder what would happen in the future when EA decides to shut up shop or change their DRM platform. Will I ever be able to play it again?

This is why I often feel like pirates "own" the content more than legitimate buyers.

Macha• 9 years ago

But your work here is a port. You don't have any creative input to make you feel attached to it, and it's already going to be preserved in its original (NES) form.

TheGrumpyBrit• 9 years ago

The fact that it's a port makes me approach it from the other side.

Since the original code was designed to run on NES, I wonder if these were hacks to work around issues with NES code running on GBA rather than a deliberate consideration to stop people from porting your port.

bondjsbond2• 9 years ago

Does Legend of Zelda: Minish Cap have something similar? I played that game on a raspberry pi but it always freezes and dies when I enter a certain room in the final boss castle... Not sure if just a bad port or a security feature... I would love to finish it, but don't feel like replaying the rest of the game just for the ending...

voltagex_• 9 years ago

Which emulator?

bondjsbond2• 9 years ago

I want to say it was running Retro Pie? Edit: I don't have it with me, but I think it was the mGBA emulator, sorry.

qwertyuiop92410• 9 years ago

I've been reading about the gameboy's architecture and internals (in the hopes of making a game with it), and it's pretty amazing how much specialized hardware there was in earlier generations of consoles, especially compared to the more general modern consoles. And yes, new consoles have GPUs, but those are everywhere.

Your computer has a GPU. It probably doesn't and didn't have scrolling registers or hardware sprites (unless, like the C64, it had a gaming focus).

iflowfor8hours• 9 years ago

There is an excellent video from 33c3 about Gameboy internals and all the wonderful tricks that can be utilized when writing software for it. https://media.ccc.de/v/33c3-8029-the_ultimate_game_boy_talk

qwertyuiop92410• 9 years ago

C3 never ceases to surprise me. Thanks!

derefr3• 9 years ago

One could at least describe the "text mode" of VGA/CGA/EGA video hardware as actually being the same kind of "tile mode" you find in consoles. And in slightly more modern video cards (the kind you'd find in a Windows 95/98 machine), the mouse cursor was usually a hardware sprite. (Even today, mouse cursors seem to frequently escape OS gamma correction for some reason...)

rahimnathwani• 9 years ago

My first computer was an Acorn Electron, and that had hardware scrolling, too.

I don't think it had hardware sprites, but game programmers of that era often used compiled sprites to improve performance.

kalleboo• 9 years ago

And even without a dedicated scrolling register, John Carmack famously managed to get the IBM PC to do scrolling by manipulating the screen buffer address (and emulating sprites by manually redrawing those parts) https://en.wikipedia.org/wiki/Adaptive_tile_refresh

derefr3• 9 years ago

I’m not really sure why Nintendo went all out with these games, considering that these are just ports of NES games.

I've always suspected that Nintendo cares a lot less about PC emulation, than it does about mostly-chip-compatible knock-off hardware.

Think of those consoles you see at Walmart that claim to come with "100 games built in!" Those frequently contain chip-compatible designs of Nintendo's old hardware, and a library of ROMhacks of NES games (or the ROM from a single one of those 100-in-1 NES carts.) They're not emulating Nintendo ROMs; they're just running them, directly.

The manufacturers of these consoles never bothered to clone newer ones after the NES, because all the demand for these knock-offs seems to be some weird combination of nostalgia and clueless-parent value-purchasing (e.g. "oh hey, it has Super Mario Bros on the box! That game was great. My kids would like that!")

But the GBA is just as easy to clone the internals of as the NES is (ARM7 cores are just as easy to find—and cheap—as 6502s), and has a far larger library of games (~17000!) So if these companies could transition to a GBA chip-compatible design and still ship these NES ports, they'd increase value immensely, while still being able to put NES nostalgia on the box.

And so, for these ROMs that might have been just the thing to spark this switch-over, Nintendo went to some extra effort.

It would have been funny, had any of these knock-off manufacturers already finalized a hardware design based on tests with other GBA ROMs and started up their logistics pipeline to assemble consoles, had they flashed one of the NES Classics ROMs onto their new-off-the-line console, and realized that it was far more stringent than other games were about faithfulness to the GBA's architecture. It might be enough to kill a whole company.

---

Of course, none of this ever materialized, because for some reason, the knock-off manufacturers are still just making consoles that are chip-compatible with NES games, rather than speccing out builds based on what chips have become equally cheap since then. Who knows why.

einr• 9 years ago

Of course, none of this ever materialized, because for some reason, the knock-off manufacturers are still just making consoles that are chip-compatible with NES games, rather than speccing out builds based on what chips have become equally cheap since then. Who knows why.

Actually, there are now quite a few Chinese GBA clones on the market, and my understanding is that they do not use emulation but are hardware-compatible reimplementations of the GBA hardware.

Some examples:

http://www.k1gba.com/

http://exeq.ru/produkcija/pristavki/detskie/gamebox.html

http://obscurehandhelds.com/2010/08/the-nintendo-game-boy-ad...

qwertyuiop92410• 9 years ago

If I could find a good one, I just might buy it, too. My AGS-101 isn't exactly an ideal system. But then, a GBASP might be cheaper...

Fej• 9 years ago

If I remember correctly, Nintendo also implemented tough DRM like this for the GBC Video series. Same light gray cartridges, I think.

(GBA Video was a short-lived series of video content available on GBA carts. I remember having a cart with an episode of The Fairly Odd-Parents on it. The video quality was terrible. Nothing worth protecting.)

Classic NES Series Anti-Emulation Measures

Related Stories