It may be counterintuitive at first, but why wouldn't be possible? It's one of the perks of "offline" hardware without subscriptions or DRM. You build a piece of hardware (cartridge) that attaches to another one (console) and it works. As long as the console works, there shouldn't be a problem.
> It may be counterintuitive at first, but why wouldn't be possible?
For the same reason it wasn't possible at the time for a third-party to make N64 cartridges themselves to avoid Nintendo's fees. But I assume these lockout chips are replicated or circumvented by now.
Fairly recently the chip was studied in detail and replicated. But like most systems of that era, I believe it was circumvented fairly quickly by pirates. The easiest way would be to piggyback a licensed cartridge - unlike the NES, it has to be one with the same region and bootloader as there are several lockout chip variants, but that basic technique still works.
I never saw a piggyback cartridge at the time though, or one that was obviously unlicensed. Of course, this could have more to do with Nintendo's legal pressure than with technological possibility.
The main pirating route at the time (a device (oh which there were several) that sat under the N64 and had either an Iomega Zip drive or a CD drive for holding ROMs), had a port for inserting a real cartridge to use its lockout chip.
Related to this, every ROM needs a "boot loader" that has to be signed and is verified by the lockout chip.
Nintendo's boot code is under copyright and thus cannot be used. So the boot code distributed with Libdragon is signed by finding a hash collision with a brute force tool running on the GPU[1]. Fun stuff!
The “development” version of that is even crazier: it's a very tiny signed bootloader that does nothing but copies the “real” bootloader into memory, then trampolines into it, such that even developing your own IPL3 doesn't require having to re-brute-force the signature for every build.
And on top of that, libdragon's IPL3 doesn't just blindly copy the first megabyte of ROM code into RDRAM like the official Nintendo one does, but actually expects the ROM data after it to be a full-blown ELF executable, which it parses out and copies pieces of to the specified places.
FlavioMacedo · · focus · HN ↗
101008 · · focus · HN ↗
cubefox · · focus · HN ↗
For the same reason it wasn't possible at the time for a third-party to make N64 cartridges themselves to avoid Nintendo's fees. But I assume these lockout chips are replicated or circumvented by now.
inigyou · · focus · HN ↗
cubefox · · focus · HN ↗
inigyou · · focus · HN ↗
monocasa · · focus · HN ↗
cubefox · · focus · HN ↗
phoboslab · · focus · HN ↗
Nintendo's boot code is under copyright and thus cannot be used. So the boot code distributed with Libdragon is signed by finding a hash collision with a brute force tool running on the GPU[1]. Fun stuff!
[1] <a href="https://github.com/DragonMinded/libdragon/tree/trunk/boot#building-ipl3-production-version" rel="nofollow">https://github.com/DragonMinded/libdragon/tree/trunk/boot#bu...
yellowapple · · focus · HN ↗
And on top of that, libdragon's IPL3 doesn't just blindly copy the first megabyte of ROM code into RDRAM like the official Nintendo one does, but actually expects the ROM data after it to be a full-blown ELF executable, which it parses out and copies pieces of to the specified places.
Pretty slick stuff.