GameBoy hardware hacking: Part 1

In the case of GameBoy and GameBoy Color systems the console itself holds just a really minimal program on the board, the so-called boot ROM (256 bytes long). It does the initialization of the components and the cartridge, also it reads the header part of the program stored on the cartridge and checks if that is valid. (Fun fact: the scrolling Nintendo logo is read from the cartridge and it is really a test to see if the cartridge can be accessed correctly. The logo is then compared to the one stored in the boot ROM to see if it was read correctly, if not that indicates some pins are not working and the CPU halts. This is when you need to blow the cartridge.).

All the other program code (i.e. the game itself and all the instructions to make it work) is located on the GameBoy Cartridge alongside with the textures, sounds and all the rest.

So the cartridge is basically the part of the system, the CPU reads it directly when it needs the next instruction and executes the code from there without copying it to its own memory.

The cartridges usually consist of the following components:

  • ROM: Read Only Memory
    Stores the program code and all the resources needed for the game. It is programmed once and then never written again.
  • MBC: Memory Bank Controller (optional)
    The Memory Bank Controller switches banks of the addressable memory space (32 kilobyte in total). The lower 16 kilobytes are always the first 16 kilobytes of the ROM while the upper 16 kilobytes are switchable between several blocks (i.e. part of the ROM or the RAM). There are several MBCs out there with their own purposes. This is a really long story, I’ll write more about this later.
  • RAM: Random Access Memory (optional)
    This is a readable and writable storage, when a game has high-score list, saved game state, etc. it holds them information in the RAM. This is a standard SRAM so this is volatile – it needs constant power to keep the data alive this is why cartridges with RAM need batteries as well.
  • Battery: (optional)
    The battery provides power for the RAM to keep the stored data alive.
  • Connector:
    Last but not least, all the cartridges have a 32 pin connector that provides a connection between the console and the components of the cartridge.

The interface between the console and the cartridge consists of 32 pins (direction is written from console perspective, out: from console to cartridge, in: from cartridge to console):

  • pin 1 [out]: VCC (+5 V)
    This is the supply pin for the cartridge and its components (i.e. the ROM, RAM, MBC).
  • pin 2 [n/c]: not connected or CPU clock
    I have not seen this pin connected so far but some documents claims this is a direct output of the CPU clock. I ran a logic analyzer on this pin, it showed a high-low pattern alternating at 1.04 MHz (0.46 µs high followed by 0.50 µs low).
  • pin 3 [out]: !write
    This is a signal line that is low when a write request is made to RAM. Otherwise this is high.
  • pin 4 [out]: !read
    This is a signal line that is low when a read reqeust is made to ROM, MBC or RAM. Otherwise this is high.
  • pin 5 [out]: !RAM select
    This line is low when the RAM or the MBC is being accessed. Both of them supports reads and writes. Otherwise this is high.
  • pin 6..21 [out]: address selection bit 0..15
    These bits sets the address that is being written or read in the RAM, ROM, or in the MBC registers.
  • pin 22-29 [out/in]: data in/out bit 0..7
    When the console wants to read from the ROM, RAM or MBC these pins are inputs, their values being set by the remote component. When the console wants to write data these are outputs, set to the data by the console.
  • pin 30 [out]: !reset
    When the console reboots it sets this pin high after about 4-5 ms. This delay is probably introduced to give the clock a few cycles to stabilize.
  • pin 31 [n/c]: not connected or analog audio input
    I have not seen this pin connected so far but some documents claims this is an analog audio input. (I think I’ve read something about a direct sound channel on the GameBoy CPU, but that might be a different story.)
  • pin 32 [out]: GND
    The ground connection for the cartridge and all the components.

In the following posts I will write about the different cartridge and MBC types, and also will post schematics and circuits to build a few different homebrew GameBoy cartridges. Stay tuned.