| whichboot.gb | |
|---|---|
 | |
| General | |
| Author | nitro2k01 |
| Type | Test Roms |
| Version | 1.1 |
| License | MIT License |
| System | CGB, DMG |
| Last Updated | 2022/09/17 |
| Links | |
| Download | |
| Website | |
| Source | |
Whichboot.gb is a research tool designed to identify Gameboy consoles and emulators by analyzing software execution on the machine or emulator. Similar in concept to Matt Currie's which.gb, it utilizes different detection mechanisms to pinpoint various aspects of the running system.
While which.gb aims to detect the System-on-Chip (SoC) revision by triggering hardware quirks, whichboot.gb focuses on identifying the executed boot ROM. This is achieved through methods like examining CPU register values, analyzing boot process timing using DIV and LY registers, and inspecting the logo data stored in VRAM.
The initial intent of whichboot.gb was to non-intrusively detect any previously undumped boot ROMs present in Gameboy clones. It also proved valuable for gaining insights into emulator design and workings. It is able to detect many older emulators based on its detection methods.
User guide
Detection mechanisms
- Heuristic match:
- A simplified algorithm mimicking game behavior for identifying platforms like GBC or GBA. Detects SGB through multiplayer joypad reading and GBC+SGB mode in certain emulators.
- Entry Point 0:
- Indicates starting execution at $0000, e.g., GBA with boot ROM skip or specific emulator settings.
- CPU Registers
- Compares startup CPU registers to a reference list for precise matching based on boot ROM or emulator behavior.
- Timing Match:
- Measures time since last reset using DIV register. Overflows every 15.625 ms, offering a time fingerprint despite limitations. Detects hidden DIV bits changes, adding a fine timer value.
- Logo Match:
- Detects presence of logo or alternate graphical data in VRAM. Checks logo in tile RAM ($8010-$819F) and ® symbol in BG MAP ($9904-$9910, $9924-$992F).
- Logo:
- Checks tile RAM ($8010-$819F) for logo presence.
- No logo: Logo area filled with null bytes.
- Nintendo: Standard Nintendo logo in tile RAM.
- Maxstation: Maxstation clone replaces logo with "Loading..." graphic.
- Unknown: Unknown graphic in tile RAM (possibly undumped boot ROM).
- Map:
- Checks BG MAP for logo and ® symbol in specific areas.
- No (GBC/emu/clone): Empty logo area in BG map.
- Yes (with ®): Expected value on most DMGs, GB Pockets, and SGB.
- Yes (no ®): Expected value for early DMG0 boot ROM revision.
- R: Checks for ® symbol presence in tile RAM ($8190-$819F).
- Missing/Yes/Unknown/Null:
- Checks VRAM contents.
- Missing: Area filled with null bytes.
- Yes: ® symbol in tile $19.
- Unknown: Undetermined graphical data in tile $19.
- Null: All unchecked VRAM bytes are $00 (except warm reboots or wild boot ROM behavior).
Screenshots
Changelog
v1.1 2022/09/17
- Added support for using
$0000as an entry point. Intended for use with entering GBA-GBC mode with boot ROM skip. - Added specific detection for a bunch more emulators from the GB Emulator Shootout.
v1.0 2022/09/11
- Initial released of whichboot.gb.
Credits
Thanks to:
- beware for making BGB, which was useful in debugging this, and every other, Gameboy project I make.
- bbbbbr for dumping the boot ROM of the MaxStation GB clone, which prompted the last minute addition of the logo match check.