Secrets of the Nintendo CIC Chip - Early Cartridge Anti-Piracy | MVG

To combat unlicensed games and win back confidence of retailers in North America and Europe, the NES and all licensed games came with a lockout chip known as the 10NES or CIC. In this episode we take a look at this chip , the clone chip that was developed by Atari and how it took 20 years for the homebrew community to reverse engineer the chip and the challenges they faced.
► Consider supporting me - / modernvintagegamer
Links and Credits:
► Reverse Engineering the Nintendo 64 CIC RECon 2015 (Credits : Mike Ryan, John McMaster, FPGA_Nugga) - • Reversing the Nintendo...
► Tengen Rabbit Chip Pic - Gaming Historian - • Tengen: Atari Games vs...
► Ninja Gaiden Gameplay - xRavenXP - • Video
► Reverse Engineering the CIC - forums.nesdev.com/viewtopic.ph...
► 10NES Original Patent - patents.google.com/patent/US4...
► What happened with SNES CIC reverse engineering? - forums.nesdev.com/viewtopic.ph...
► The weird and wonderful CIC - hackmii.com/2010/01/the-weird...
► Breaking Integrated Circuit Device Security through Test Mode Silicon Reverse Engineering - analysis.seclab.tuwien.ac.at/p...
Social Media Links :
► Check me out on Facebook : / modernvintagegamer
► BandCamp : modernvintagegamer.bandcamp.com/
► The Real MVP Podcast : player.fm/series/the-real-mvp
► Follow me on Twitter : / modernvintageg
#Nintendo #10NES #AntiPiracy

[@toddbot7545]

Yeah but have you seen our genius methods where we force you to login to play 25 year old easily pirated games?

[@NOCTURNAL351]

Intriguing

[@ModernVintageGamer]

Oh hi Todd

[@toddbot7545]

@@NOCTURNAL351 You should have used it reggie

[@toddbot7545]

@@FancyGeeks *16 times the detail

[@miganhawkins8390]

Lmao!!

[@Lord_Nightmare]

Ok, having been somewhat involved in the process with reverse engineering the CIC, there's a bunch of parts of this video which need clarification: in 2006, before the Nesdev scene knew what processor the CIC used, the Atari/Tengen rabbit chip was reverse engineered. The instruction set of the rabbit chip is DIFFERENT (and slightly more efficient!) than the instruction set of what we later found out was a Sharp SM590 microcontroller that the NES and SNES CIC chips used. This meant that the code it ran is actually not the same as the original NES code, and lends to the idea explained by people who worked at atari, that the copy of the 10NES cic code listing they got from the copyright registrar's office was not actually used during the reverse-engineering, but was done afterward by a legal intern without permission. The real SM590 code for the NTSC and one of the PAL NES regions, and for the NTSC SNES cic was extracted via decapping around 2007. Once we knew the keys for the NTSC and PAL-1 region on the NES, the keys for the other two regions, PAL-2 and Korea, were brute-forced using traces of the 16 data streams. The reason two CICs had to be decapped is the timing of the NTSC CIC code is older and different from the timing of the two PAL and Korea CICs, the latter 3 likely use the same code with a different key on each. The SNES D411 CIC was decapped, and brute force analysis of streams from the SNES PAL CIC showed that the NTSC D411/F411 CIC and PAL D413/F413 CIC keys only differ by 1 bit. The N64 CIC is an entirely different can of worms, and much more complicated. There, the N64 has a system management controller in it called the PIF (which has INSIDE THE CHIP a special version of its 'lock' CIC, containing multiple keys, corresponding to different key chips it can use) uses the values returned by the key chips to decrypt one of the earlier boot-sectors for each game upon power-up. The PIF also contains a small bit of boot code that runs on the MIPS processor in the N64, and sets up the RDRAM and then queries the PIF to see what the CIC returned. Reverse engineering the N64 CIC had a major advantage: a clever member of the n64 community discovered that if you apply a higher-than-normal voltage to one of the SM5K3 pins, it will spit out its internal ROM contents in an undocumented debug mode. This made finally completely reverse engineering the N64 CIC (which has 4 or 5 variants per region, to prevent people swapping ROMs and piggybacking carts between games easily) finally possible. Another interesting thing is the very final version of the cart CIC used on the n64, used on perfect dark 2 and banjo tooie (and one other game?), actually has another layer of encryption implemented by the CIC 'in between' the blocks of bits in the stream of random data that it normally constantly sends back and forth with the PIF, which allows the console cartridge software to send a 'command' to the CIC and get a response back, which was used for additional DRM with those games specifically.

[@hualni]

Nintendo: "We will only allow the best games to be made" Then proceeds to allow LJN to make games.

[@kerokerocola99]

LJN was a way for Acclaim to publish more games, similar to Konami with Ultra Games. Most LJN/Acclaim games were made by different devs and companies, so it was a gamble on what would an LJN game be. Hell, Rareware made the Roger Rabbit game they published.

[@RadikAlice]

@@kerokerocola99 I actually didn't know LJN was a shell company like Ultra Games, neat

[@FacchiniBRTV]

Thanks to LJN we have AVGN haha

[@hualni]

@@FacchiniBRTV Laughin' Jokin' Numbnuts

[@kenrickeason]

James, is that you?

[@TheGunmanChannel]

I had to snip that pin after accidentally buying an NTSC copy of the original Final Fantasy for my PAL NES.

[@krypton7900]

yeah and than watch in horror as it tries to render an ntsc game in pal mode

[@roobeeeee]

@@krypton7900 Sounds like nightmare fuel.

[@samljer]

Copy protection existed earlier too i was shocked like space invaders 1978 tries to overwrite itself in ROM. copied chips take the write and the game doesnt play.

[@MrMario2011]

Crazy it took that long, I never looked too much into the chips but I didn't know the same type of setup was used up to the N64!

[@krypton7900]

huh I didn't know you watch his videos Mario

[@salamnishellhole2160]

Yello, mario.

[@TheTribes44]

from the most difficult DRM to crack to being defeated by a paperclip lol

[@bluephreakr]

And before then, tweezers!

[@animepussy8356]

It's a real shame (for Nintendo ;) because it was Nvidia's vulnerable bootrom code that allowed hackers full access. The Switch OS itself is actually extremely secure.

[@AdamSmithNES]

All you need to bypass the lockout chip on an original NES is a screwdriver and something to snip one contact from the board.

[@TrolleyMC]

@@bluephreakr long live team twiizers, now known as fail0verflow.

[@MrBlazinerday]

Adam Smith that works for most games but not for all and if done wrong can burn out the system

[@ianf123]

Note that the claim that Atari required the 10NES code to create the Rabbit chip is disputed. That was Nintendo's claim and was repeated, without any apparent diligence to verify it, by David Sheff in "Game Over". I have heard quite different versions of this from the folks who were working at Atari at the time. I don't think any of us are in a position to judge, but I'd call Nintendo's claims at best poorly substantiated. A relevant point is that amateurs have subsequently decapped the CIC, and didn't experience a lot of trouble optically recovering the ROM contents and reverse engineering the algorithm. I was actually told, by someone involved, that the biggest challenge they faced was identifying the Sharp SM590 because the die, as is common for CPUs like this to prevent reverse engineering, contained no indication at to the manufacturer.

[@daniflores5119]

Great recap! Thank you for listing the homebrew comm so many people worked hard to do this. Thank you for shining some light on this. Spent years myself trying to reverse engineer but gave up.

[@kaitlyn__L]

I knew a lot of this about the NES CIC... had no idea about the SNES and N64 having one! You always include interesting history that I've not come across before, even when I feel I'm familiar with the subject from the title.

[@kennylauderdale_en]

This was a fantastic video. I don't have anything insightful to say, just that I like what I see.

[@SilhSe]

Hi Kenny 👋 I know your channel and its has lots of value and great insights nice to see you here ! 🤗

[@Osai1234]

that’s the usual and this is what i like to hear

[@ForExampleJon]

That's how I feel around here. I'm just driving up engagement.

[@pyrozmbies9363]

it's always a good day when mvg uploads

[@NextLevelCode]

Nice makeup Kim. I see you have been watching the KZbin beauty channels. 😉

[@userPrehistoricman]

I heard you met The Real Donald!

[@kneehighspy]

Kim’s favorite game? Atari’s Missile Command

[@jakeg7190]

Except when his facts are wrong...

[@JRP2234]

Personally my favourite game is the blinking screen. I don't know but when ever I play nes I always get blinking screen so I just sit back and enjoy it and then cry in the shower.

[@holymegadave]

But you can see the screen blinking i want a switch but my poverty keeps me away from buying it.

[@mason0190]

blinking screen usually just means dirty contacts, pop open the nes and clean the pins the cartridge connects to with some ISO and a cotton swab and see if it helps

[@buddyguy4723]

have you tried shaking it like a baby?

[@tuffasgong]

Is the crying in the shower from the NES game not playing or from the shame you feel for treating your body like an amuesment park while you shower?

[@JesusJavier-MyAccount]

*@tuffasgong* Cursed comment,

[@saishowaguu2]

Love these videos. Like a trip down memory lane. Very informative. Thanks. Keep it up!

[@reclaimer429fishing]

Who ever was playing Ninja Gaiden was a Savage!!

[@wompastompa3692]

MVG played that while editing the rest of the vid, he's just that beastly.

[@holymegadave]

@@wompastompa3692 haha i love when people engrose other people for being cool members of this society

[@argedismun2]

Probably tool assisted gameplay

[@Whelkman]

@@argedismun2 It is a TAS, specifically the old version from 2006: watch?v=xMxjodJY0xs

[@fensoxx]

Dude I just paused the video because I had to lay down props for that. That player is an ace.

[@dialga2]

I just found this channel and I'm amazed at how something that satisfies my extremely specific interests of hardware and gaming can exist in such a high quality format!!! This is amazing technical information, presented in a very clean and catchy way. I'm going to binge watch all of these technical breakdown videos.

[@NeoReibert]

As always a really good video! And as a computer and electrical engineering student especially interesting. Hopefully, you make a lot more videos of this kind. There are definitely people interested in this.

[@Colin_Ames]

Very interesting. I really like these videos about the cracking of security measures. I am impressed with the tenacity and ingenuity of the community involved.

[@LetsPlayKeldeo]

Could you make a Video on how DS games where cracked ? / the different ways how DS game makers try to sabotage there games

[@kaitlyn__L]

Makes me think of Chrono Trigger (DS). That was the first ROM I personally had to patch

[@kgonepostl]

@@ZippletTech Didn't he already make a video of that?

[@CanaldoZenny]

I know how the Gen 5 Pokemon games AP features work: the original games had a IR sensor built in the carts. When the game starts, it checks the IR sensor after 5 minutes. If its there, its legit. If it doesn't detect, the program assumes its pirate copy and starts the AP measure. The program disables EXP gain in all battles, and later starts crashing and freezing randomly. This was later patched by hackers with patched ROMs and emulators and Flashcard kernels that could run the clean ROMs without these problems. Still, there are emulators and some flashcards that need the patched ROMs (HGSS too) to work. Since many of those patches are old, many have been lost on the Internet. Its much easier to find clean ROM nowdays. The guys at GBATemp made a thread for recivering any old patch for DS games because TWLMenu++ needs AP patched ROMs.

[@CrazyBananas56]

@@CanaldoZenny that must be why I can't play Pokemon on my bootleg flash cart lol

[@DeadSpecimen]

Yesss

[@aemerox5773]

3:30 Now I know why many modders would prefer to cut out PIN 4 on the 10NES lockout chip.

[@MrBloom2037]

MVG I still remember when my dad was talking about your Xbox snes emulator & n64 emulator in 2003-4

[@Osai1234]

1:19 hi MVG you are the greatest retro man alive thank you for all your amazingly interesting history and variety of consoles to match every video of what you’re talking about, just wanted to take a moment to appreciate that in whole

[@xenonrider3049]

Great episode. It's always fascinating to see what type of DRM the game consoles and arcade machines used and how they were reverse engineered.

[@RastaJediX]

I love these types of videos. Some of my favorite MVG content right here.

[@pleasedontwatchthese9593]

Fantastic video on this. You make the best videos on this

[@farhanyousaf5616]

The description has tons of great links, as MVG says, its really interesting stuff!

[@RetroRecollections]

Another fantastic look at retrogaming from a technical angle. I love this channel! 👍

[@chrisdelaney926]

Fantastic video. Your Explainationon the chip was really easy to understand.

[@ars7374]

Really interesting video! I thought of The Gaming Historian’s Tengen video while watching this.

[@fawzanfawzi9993]

Do you know anything about the supposed "anti-piracy" mechanism found in Pokemon Black and White when you can't gain any EXP?

[@toddbot7545]

I think it's an infrared thing

[@flintloxgaming]

Todd Howard You expect me to take your word for it?

[@LemonGingerHoney]

This is an interesting topic.

[@fawzanfawzi9993]

@Kyle Applin thanks dude. This is all I need.

[@krypton7900]

PERFECT LOW LEVEL RUN TRICK

[@stevejennings3960]

What another fantastic video once again!!! Massive kudos here to you

[@therealfox]

Thanks for makeing so tech deep videos, i really like that. Hope to see more videos soon. Thanks for teaching us.

[@cheater00]

Another classic. Thanks bro! Really appreciate it! Instant thumbs up from me!

[@memphisraines5699]

Take my sub and thumbs up for delivering great pieces of history and documentaries, Mr. MVG.

[@hegyak]

I didn't know the SNES and N64 used the CIC chip. Crazy stuff.

[@videogameobsession]

The unlicensed NES game publisher American Video Entertainment used to mail out kits back in 1990 which included alligator clips and instructions on how to bridge and bypass the NES10 chip. This came in handy when I wanted to get SuperVision multi-game carts working on the NES. Thanks AVE! :)

[@TheEpicFace007]

That's awesome ! I can't wait to see your video on vm protect.

[@wildzero7777]

Great content as always!

[@lerxsty]

love your videos man, great info on topics that no one else really covers. Do I want to hear some kids top 10 switch games? nah couldnt care less thanks for actually making some interesting gaming content.

[@m1s3ry97]

Less than a minute to say "Thank you for being persistent with your great uploads!"

[@Code-ff4fn]

Yet again another awesome drm video i love this series... Where did you get that snk shirt ?

[@WickedGamerCollector]

I did see some video's about this subject only find your video's really fun to watch... MVG Haves Upload.. grab myself some thee ... relax.... and enjoy the show !! I love these video's MVG Keep them coming !!

[@LesKingBNE]

Mate, your videos are interesting and accurate. Love it.

[@MT-fl1eb]

Amazing content and presented well thanks!

[@MrDomBoileau]

Man, I love your channel so much dude.

[@newolku]

Awesome video as always

[@metalmusic1401]

Excellent video mate I've always liked your stuff it's very enjoyable to watch and I'm still stoked that you are Australian! The same as me keep up the great work!

[@kenrickeason]

Damn..... This is neat! I knew about the lock out chip but the deep in details on how it works are the best.. If I had a programing company I would hire you with an offer you will love..

[@leandrormor]

thank you so much for the time and research!!!

[@LambdaCalculus379]

Thanks for another excellent, informative video!

[@andrewut7ya511]

Im not a coder myself but i looove these videos. The history of my favorite systems is so interesting. Thanks for makong these videos

[@michaelc5019]

Thank God for our tech junkies that spend their time cracking these systems and thank you MVG for being apart of that community that I know we all take for granted

[@wing0zero]

Yeah too many people take this community as a form of stone!! 😉

[@madmodder123]

FYI it is "taken for granted" not granite lol

[@michaelc5019]

The Mad Modder / your right. Spell check on my iPhone corrected. SwiftKey App so I can have a black keyboard

[@beeaaran9949]

I don't want to live in a world where there's no MVG Mondays!!, Keep up the magnificent work!!

[@Joxxum]

I love these kinds of videos about console/arcade security

[@TemoanaD]

I love your vidéo MVG ! very informative, thank you.

[@root42]

Very interesting. I wouldn’t mind if you made longer bonus videos that go even further into the details. This was still pretty highlevel. A bit of a walkthrough of the CIC firmware would be nice.

[@gehirnstaub8234]

hell yeah! such a good start in the week!

[@RobertNES816]

This is some very cool stuff. Who would've thought so much went into those CIC chips!

[@malsuk]

always excellent videos

[@JoeBetro]

Amazing. Thank you! 🌟

[@yandyyay]

great video, thanks for you hard work and research.

[@MKFan528]

A new MVG video is perfect to watch while eating breakfast on a Monday morning.

[@SPRITEVIDS101]

The story of tengen battling nintendo’s Strict policy is one of the most fascinating stories in gaming, it just goes to show that even though they were the new kids Nintendo were willing to be really strict in the US market despite the recent video game crash, there was also a lot of involvement from Namco as at the time they recently purchased the video game division of Atari

[@JGRICH61]

Interesting content didnt expect this from you

[@UpcycleElectronics]

This is one of your more interesting hardware uploads IMO. From a production hardware perspective, it's interesting that they designed the chip to run identical code on both the base and cartridges. Anyone care to share how they would personally implement better security with a set of similar production hardware constraints, (4-bit μC, identical master/slave, etc)? -Jake

[@johnfrancisdoe1563]

Upcycle Electronics A slightly larger internal ROM for more patterns, maybe some code to disguise the pattern. Oh and an 8 pin chip to save production cost. Maybe feed some of the actual game ROM lines through the chip and require that game data to contain a certain pattern. Auth failure would feed the CPU unplayable garbage.

[@SCB666]

Fanatically detailed video.

[@penrar]

Loved this. You got any old Amiga games with their unique copy protections? I adored that stuff myself and sure it’d make for a good vid! Thanks as always MVP MVG!

[@RisingRevengeance]

Most DRM just increase piracy nowadays, but back in the day it worked a bit "better".

[@pmangano]

And they make the game crappier to the consumer because of constant background checks *COUGH* denuvo *COUGH*

[@tadpolegaming4510]

@@pmangano 🦀🦀🦀🦀 DENUVO IS GONE 🦀🦀🦀🦀

[@pmangano]

@@tadpolegaming4510 What do you mean by gone?

[@Sharpless2]

@@pmangano its the crab rave meme. Hence the crabs in the comment...

[@CancunMimosa]

That’s a fairly false statement. I don’t think I’ve ever read where DRM was proven to increase piracy within a market. Please reference the industry study your comment is referencing.

[@ner0p]

Great video, as always.

[@lwvmobile]

I think they also used the CIC chip because the Famicom had rampant piracy issues since it didn't have any lock out chips. To be fair though, I think Nintendo were more worried about squeezing every dime they could out of publishers this way more than they were about piracy. Publishers can to sign agreements to have a certain exclusivity to Nintendo, purchase their own cartridges and chips from Nintendo, artificial chip shortages (still employed by Nintendo today) and only publish so many games in a year. The fees could come quite staggering, pushing some companies to only make Sega games at the time.

[@HeadsetHistorian]

Your eyebrows look powerful in this video. I absolutely love your content, thanks for your hard work!

[@Diablokiller999]

Seeing your OSSC in the background all the time, maybe you can make a video about how to find the perfect parameters for each console (backporch, etc.)?

[@ModernVintageGamer]

i wish i knew lol, i need to dial mine in better

[@MarkMarkMark]

I love your videos. I was watching one where you showed us how to mod the lights on gamecube ports. Do you have another channel dedicated just to following mod steps? I think that would be rad

[@aaronperron]

Modern Nostalgia Gamer. The soundtracks to these vids remind me of sick 80's movies like Tron or something

[@davidenwah3413]

this was an A plus video man. subbed

[@starlitalpha7]

Listen, on one hand it's good that everdrive doesn't have to sacrifice 64 games for their cart anymore... But think for a moment, what else are we going to do with those copies of superman 64?

[@krypton7900]

do what protonjon did?

[@MsJ423]

one the best KZbin Channels Keep up the good work.

[@asphyxiaVR]

Love your work~

[@madfinntech]

Excellent video!

[@aurathedraak7909]

Omfg yes it's about time you explain this

[@Fulthrotle73]

Love the Nes back in the day. It was my first console. Still love it today.

[@VOTJofficial]

LOVE this content!

[@Heitzsche]

A brand new MVG video and a chocolate bar all to myself. Can an evening get any better!

[@kevtris]

the rabbit chip was totally different from the 10NES chip. It was a purpose-built sort of CPU, vs. the 10NES' general purpose microcontroller. Tengen ended up using all the "extra" pins for debug outputs that let a decent amount of state to be read out during operation and this helped to reverse engineer it. I made custom hardware to perform this data dumping as the chip communicated with a lock chip. Interestingly there's a relatively easy way to dump the 10NES' code using the factory test mode but no one figured this out until very recently. Also interesting is ROB's microcontroller is the exact same microcontroller with different code.

[@bkrich]

Awesome video 👍🏼

[@osgrov]

Fascinating story, thanks mate.

[@Stu2be2]

Love all your vids

[@DanielLopez-up6os]

Heck yes finally a good explanation on it.

[@illingr]

wow a lot of research was done on this!

[@nicedreams7192]

While i don't understand half if not most of how any of this is done, this is still by far one of my favorite series on KZbin. You do a good job at making it followable/understandable to the average shmuck like me.

[@DTM1337]

Nice, really interesting info

[@NappyWayz]

That explains a lot when my console was resetting. Mostly due to dirty carts.

[@chivajg88]

always enjoy that intro!

[@TioMegamanX]

When I was a kid I had serious issues with my NES which kept resetting or glitching out with most games, it always seemed to only accept a few "brands" or publishers which I never understood, this still puzzles me to this day because I thought it just had a faulty 72pin connector but the DRM check behavior described here reminds me of those days, pirated games maybe? not unless the video rental I went to had games which gave me those problems... unless they also got pirated games too.

[@RicardoSaenzLeivaMUSICA]

Wow, you make my breakfast interesting :) with these uploads. Thx for sharing your knowledge, cheers from Chile 👍😉👍.

[@nobodynevermind]

Dude I love your music selection for your videos. Do you post your soundtrack anywhere?

[@diarykeeper]

20 years.. Dang. Someone did an amazing job. Nintendo thanks this guy way too much. Hope he got rewarded accordingly.

[@carlosbragatto]

Awesome stuff

[@nobuyukinyuu]

I tried looking into this some years ago only to find many posts in the relevant nesdev thread nuked. I always wondered if kev wiped the record of his efforts for legal reasons, a new project, new information, or what... But it kinda sucks that some of that process could've been lost to history! Thanks for the informative video.

[@alxqrz]

Never new anti piracy videos could be entertainment until this channel. Thanks.