Major Famicom Disk System security breach

Major Famicom Disk System security breach
by digilogistist on 2012-05-05 (#93396)

Hi,

As many have said before, by 1987 semiconductor ROM sizes were as large as 128KB, and that was the equivelant to both sides of an FDS disk image. This has been the suggested reason as to why the FDS was dropped from Nintendo's product line, despite having its own awesome extra sound channel generator hardware, that I think beats the 2A03's DMC shortcomings by a considerable measure.

However, there is probably more to this story. As usual, Nintendo tries to go to a lot of trouble to protect their systems from 3rd party developers (as can be witnessed with the CIC/10NES program present on the NES and carts). The FDS also came with a number of physical, electrical, and software lock-out schemes that tried to keep hackers out (i.e., Hacker International).

When an FDS disk boots, the ROM BIOS looks for the name table file "KYODAKU", which just contains a copyright notice that the BIOS verifies and scrolls up on the screen, before the actual FDS game is booted up. No KYODAKU file = BIOS returns an error message.

Despite Nintendo's efforts to put the lock and key on FDS development, they seemingly allowed for the game's NMI handler to be enabled by default during the disk boot process. So, all the game has to do to get NMI control (before the BIOS checks KYODAKU after the disk is read), is contain just a one-byte file at the end of the disk, that writes one single byte to $2000 to enable NMI's (plus waste some extra time with dummy disk reading to wait for the PPU's first VINT), and consequently circumvent the ROM BIOS's test for KYODAKU!

You would think that this very minor issue could have been something easily fixable by Nintendo with a revision of their ROM BIOS, but when you consider the fact that Nintendo actually expected developers to call their BIOS disk routines @ hard-coded addresses in ROM, it's no wonder why they couldn't make changes to it. Personally, they should've taken advantage of the BRK #xx opcode to make any 1 of 256 BIOS system calls possible, but nevertheless, I'm sure one of the FDS ROM BIOS developers must have lost their shirt over this little back door.

by whicker on 2012-05-06 (#93397)

Good story.

Are the FDS disks compatible with some other source of floppy disks? Or was it more about recycling old games by writing new data on existing disks?

Because hardware scarcity or uniqueness is another thing Nintendo is good at. I'm sure they used "not sold in stores" mini DVD's for the gamecube to try and at least delay the inevitable.

They do this too with their port connectors. I mean, they could have used the atari style 9-pin connectors on the NES or SNES. But they saw the potential accessory market.

by Dwedit on 2012-05-06 (#93398)

This was before Sega vs Accolade, which ruled that required a small amount of trademarked code (such as the word "SEGA") necessary to get past a BIOS did not count as trademark infringement.

Also, I guess this is how the Super Pig games showed their splash screen.

by AWJ on 2012-05-06 (#93403)

Dwedit wrote:
This was before Sega vs Accolade, which ruled that required a small amount of trademarked code (such as the word "SEGA") necessary to get past a BIOS did not count as trademark infringement.

More importantly, it was in a different country with a very different intellectual property regime from the US. I know almost nothing about Japanese laws but my impression is that unlicensed console games were always considered much shadier there, and you would never see them in "reputable" stores like Tengen and Wisdom Tree games in North America.

by Bregalad on 2012-05-06 (#93407)

This is not really a major security brench - the major problem about rewriting disks, which is complex and hard.

This security brench only makes it possible - once you can rewrite a disk - to boot without showing Nintendo's kyodaku screen.

However, you could still create unlicenced FDS games and show Nintendo's kyodaku's screen without taking advantage of this security brench.

by Jeroen on 2012-05-07 (#93486)

I'd argue its stil a "major" security breach. Just for a different purpose than what would typically be considerd usefull. Obviously Nintendo put that file there as a way to control who can get licensing (as mentioned this was before SEGA vs thingie) This method bypasses that and gets around it.

Back in the day this could've been pretty major.

by 80sFREAK on 2012-05-09 (#93550)

Bregalad wrote:
the major problem about rewriting disks, which is complex and hard.
LOL Wut?! Japan have huge market of vending machines and FDS kiosks were part of it at the time.

Why FDS was abandoned - 16-bit machines took over the market. "LOOK!!! NEW!!! MUST HAVE!!!"

by LocalH on 2012-05-09 (#93579)

They're referring to unsanctioned disk duplication, not authorized Disk Writer kiosks.

by Jeroen on 2012-05-09 (#93580)

On top of that the FDS didn't last all that long. And died off way before the 16 bit systems. (You could stil get disks from nintendo til about 2003 though, but I'm talking about mainstream popularity from a dev perspective here)
Reason for this is that the cost of rom and ic's went down alot in following years and it became more reasonable to make a cartridge with bigger rom.

by Gilbert on 2012-05-09 (#93593)

Also, the ability in saving games when battery backed RAM could be added to cartridges. The FDS had lost its advantages by then. Also, you didn't need to swap disks and wait impatiently for the loadings with games on cartridges.

I don't think being able to bypass the license message screen is any large security breach either as it's just for the licensing and not copy protection. Besides the advantages of cartridges over disks mentioned above, the main problem was pirating. Even consumers could copy the disks easily themselves provided they have the appropriate software. Nintendo did try to counter this by making revisions to the unit, such as limiting the size of data it could write in one go, but still, most units were just modded to circumvent this (I'm not sure but I've heard that the last revision could not be (easily) modded). The irony was that not only FDS games were pirated, but the drives were used alongside game copiers such as Game Doctors and Game Converters in pirating cartridge games (that's why the FDS was extremely popular here, possibly even more popular than in Japan).

Another problem was, Nintendo tried to profit from selling the bulk disks, but people quickly realised that they could convert Quickdisks for use with the FDS and later bulk disks were even manufactured cheaply in factories (and the NINTENDO indent on the disks was just a joke as protect measures). Since the FDS didn't generate much profit (FDS games were meant to be sold at prices much lower than carts and some developers were not willing to develop FDS games; the pirating of the games just didn't help) there is no wonder Nintendo eventually gave up on it.

by tepples on 2012-05-10 (#93610)

Gilbert wrote:
I don't think being able to bypass the license message screen is any large security breach either as it's just for the licensing and not copy protection.

It was another tool Nintendo could use to sue pirates or unauthorized developers of original software.

by MottZilla on 2012-05-10 (#93654)

Besides ROM memory falling in price dramatically and battery backed RAM on carts, another key problem with the FDS was Nintendo's strict licensing. If I recall, Nintendo got a partial copyright for any FDS games released. The profit margins may have been lower, etc. From a business perspective for developers it was a bad deal.

So it was both business and the aging FDS versus the better cheaper technology for carts. The FDS could have been upgraded with a new RAZM adapter, but that wouldn't have solved the piracy or loading issues. Later NES games were very commonly 128K, 256K, and 512K. FDS disks hold around 128K using both sides and I think it takes over a minute to scan the whole disk. So it would take considerable time before getting to play later games if you went that route.

And ROM was probably cheaper than a large initial investment in DRAM for a disk type system for later games.

by kyuusaku on 2012-05-10 (#93655)

MottZilla wrote:
I think it takes over a minute to scan the whole disk.

It takes around 8 seconds for each pass. If games didn't often make multiple passes during loading it might have been bearable.

by MottZilla on 2012-05-10 (#93656)

You mean if file loading was optimized enough so that it would only take one pass?, which i suppose if you were basically loading DRAM with a cartridge image from FDS disk it wouldn't have been so bad. So 16 seconds plus disk flipping time to load up a 1 meg game like Mega Man or Ghosts and Goblins and still less than a minute for a 2 Meg game like Double Dragon, that actually doesn't sound that bad. But piracy is still an issue for magnetic disks.

I guess that isn't surprising that disk loading times were not really optimized.

by kyuusaku on 2012-05-11 (#93661)

Right, it seems like most games make a pass for each file they access since they can't buffer the whole side in memory. When they make you wait through two passes, flip, wait through a pass, flip back and wait through a final pass it's very aggravating. Games which load between scenery changes become infuriating when either dying or getting bumped off screen by an enemy triggers two sets of loading to get back to where you want to be (I think Dracula II is an offender). Also if you get a disk error you still have to wait for the pass to complete and sometimes wait through a second pass where the read is reattempted. Great games, miserable loading.

by Bregalad on 2012-05-11 (#93662)

Loading from disc takes about 7 seconds, no matter how many data you load.
The disk drive lacks any kind of tracking motor which enable fast acess to any location on the disc.
The BIOS either copy data to/from drive, or ignores the data.

by tepples on 2012-05-11 (#93668)

Unless you're loading compressed data to be decompressed to VRAM and then you're loading data to be put in the same place in regular RAM. Then you need two passes.

by Bregalad on 2012-05-11 (#93674)

Yeah, Castlevania II does exactly this.

It could still have been possible to do it in a single pass by highhacking the BIOS load function and writing their own.