September 2024
Intermediate to advanced
408 pages
7h 29m
English
Like its predecessor, Nintendo’s Game Boy Advance contains a mask ROM that executes at reset to boot a game cartridge after verifying that it contains a valid Nintendo logo for trademark protection. In the Game Boy, the ROM would unmap itself just before jumping into the game cartridge, but the Game Boy Advance keeps the ROM mapped into memory. We call this a BIOS because, like the BIOS ROM in an IBM PC, this ROM contains convenience functions that are called as interrupts.
Unlike many targets in this book, the attacker has the privilege of running arbitrary machine code on the device. This is possible with a simple EEPROM chip wired to the right pins of a game catridge, and it was very quickly ...
Read now
Unlock full access