Nintendo Game Boy Advance Reverse Engineering
Welcome to our page dedicated to Game Boy Advance reverse engineering! The Game Boy Advance was a popular handheld gaming console that was released in 2001, and has since become a favorite of gamers around the world.
If you’re interested in learning more about the technical aspects of this console and how it works, you’ve come to the right place. On this page, we’ve compiled a list of links to other pages that cover various topics related to Game Boy Advance reverse engineering.
Whether you’re interested in understanding the hardware architecture of the console, analyzing game code, or exploring the many mods and hacks that have been created by enthusiasts over the years, you’ll find a wealth of resources and information on the pages we’ve linked to.
So grab your Game Boy Advance, and get ready to dive into the exciting world of Game Boy Advance reverse engineering!
Hardware Architecture
Copetti.org has an excellent page on the hardware Architecture of the Game Boy Advance, it is also a great introduction to the system:
GBA AGS-CPU-11 Hardware Schematics
The GameBoy Advance uses a 32-bit RISC CPU (ARM7TDMI) running at 16.78 MHz known as the AGS-CPU-11, for really low level detail for how this CPU works at a hardware level check out the Schematics:
gb-schematics/AGS-CPU-11.pdf at master · Gekkio/gb-schematics · GitHub
Development Kits (Hardware)
Software Development Kits (SDK)
Official SDK
Music Library (M4A)
SDK Demos
Homebrew porting case studies
abe’s projects documents an attempt to port Super Auto Pets to the Game Boy Advance. The project is a modern example of adapting a game to the handheld’s constraints.
Emulation
Much to the annoyance of Nintendo, Game Boy Advance emulators were released before the console was even launched! Developers managed to get their hands on early development kits and managed to build and release the first known GBA emulator known as GBAEmu in September 2000 1! It was able to play the official SDK Demo’s such as Yoshi’s Island 2.
Nowadays GBA emulators have such high compatibility that pretty much all commercial games work without much trouble even on low end hardware.
Reverse Engineering
Reverse Engineering a Gameboy Advance Game: Klonoa
Bruno Macabeus has an excellent write up about reverse engineering the GBA game Klonoa: Empire of Dreams. The comprehensive guide covers the GBA architecture and ARM assembly, detailing the process of locating level data to build a custom level editor.
Reverse Engineering a GBA Game: Pokémon Mystery Dungeon
Star Cube Labs has an excellent write up about reverse engineering the Game Boy Advance title Pokémon Mystery Dungeon: Red Rescue Team. It covers the fundamentals of the ARM and Thumb instruction sets, setting up a Ghidra workflow for static analysis, and using emulator debugging features to trace game logic and memory values.
Figuring out an E-Reader Function
Matt Greer’s Blog has an excellent write up about reverse engineering the Nintendo e-Reader’s internal compression routines. It covers locating the DecompressVPKorNonVPK function within the ERAPI table, analyzing the ARM assembly to decipher parameter requirements, and utilizing the built-in VPK0 decompression to optimize storage for homebrew projects.
Distinguishing ARM, Thumb and Literal Pools
The GBA’s ARM7TDMI executes ARM and Thumb code.
Selecting the wrong instruction state can turn valid code into a misleading listing.
At a bx instruction, inspect the destination register: bit zero selects Thumb when set and ARM when clear 3.
Arm’s branch and call guide distinguishes these ARMv4T transitions from mechanisms introduced in later architectures 4.
Do not apply an ARMv5 blx recipe to the GBA.
A literal pool is data embedded near code for PC-relative loads.
For example, a Thumb instruction ldr r0, [pc, #16] at 0x08000102 loads the word at 0x08000114: add four to the instruction address, align that PC value down to four bytes, then add the displayed byte offset 3.
Mark the target as data and inspect its users before extending a function through it.
The word may be an address or constant, not another instruction.
Narrowing and Sign-Extension Clues
The decomp.wtf ARM guide highlights shifts and extending loads as useful type evidence 5. In this illustrative Thumb sequence, the low byte is retained and sign-extended:
lsl r0,r0,#24
asr r0,r0,#24
Replacing the arithmetic right shift with a logical right shift would zero-extend the byte instead. A signed-byte cast is one candidate explanation, but masks, packed values and intermediate conversions can produce similar effects. Check the value’s producers and consumers before changing every related field to a byte type.
Calls to arithmetic support routines are another clue; see runtime helpers before assuming an unfamiliar call is game-specific logic.
All Posts Tagged with GBA
Official Development Kit Hardware The Game Boy Advance official development kits were incredibly similar to the original Game Boy and Game Boy Color devkits.
In fact they reused the same dev kits and added support for the GBA.
Early Prototype...
...
Introduction This page covers release 3.0 of the english software development kit, but the other versions are very similar to this.
It is unclear if this was the last release of the development kit.
In the documentation Nintendo calls this...
...
Version 3.0 of the Game Boy Advance Software Development Kit (SDK) was leaked on to the internet for everyone to enjoy.
There are some very interesting findings in this SDK, but this post will cover something particularly interesting, the demo...
...
Introduction What is the M4A Library?
The M4A library otherwise known as Make SoundCodes for AGB (MKS4AGB) is used to play sound on the Game Boy Advance.
Where can I get the M4A Library?
Version 3.0 of the Game Boy...
...
Blib sample (/blib_sample) This folder contains File Name Extension Description DacsTest .c, .o Data .c, .o EepromTest .c, .o FlashTest .c, .o Main .c, .h, .o Makedepend N/A Lists dependencies to tell Make when to... ...
Introduction In the Game Boy Advance SDK Version 3.0 the source code for a variety of tools are available to learn from and modify.
These tools all have a command line interface (CLI) and are targeted for the Windows Operating...
...
The Nintendo Gigaleak preserves the AGB boot ROM material in two useful forms.
Inside other/agb_bootrom it survives as a real Subversion repository, and separately the leak also includes agb_bootrom_trunk.zip, an extracted working tree that makes the source much easier to...
...
Awesome list of Obscure Handheld Game Development and Reverse Engineering information ...
The netcard folder from the Gigaleak contains the documentation, SDKs, and design specifications for an officially scoped but ultimately cancelled online gaming peripheral for the Game Boy Advance.
{% capture netcard_body %} The folder preserves gba.tar (a 2.3 GB toolkit...
...
Nintendo has has many data leaks in the past, but none as huge as the original Oman Archive of the late 90s or the Gigaleaks of 2020.
This post is a reference point to help people catch up on any...
...
The Paladin leak occurred on the 30th of September 2020 and included about 2.4GB of content related to the Nintendo IRIS and Pokemon spinoffs.
This was the third Nintendo leak in September 2020 with the First being the Emerald leak...
...
Magazine Interviews
The magazine index collects developer interviews tagged for this system across all indexed magazines.
| Magazine | Issue | Pages | Developer | Platforms | Description |
|---|---|---|---|---|---|
| Retro Gamer | 37 | pp. 84-87 | Ste Ruddy | Commodore 64, NES, SNES, Game Boy Advance | Ste Ruddy discusses his game programming career. |
| Retro Gamer | 73 | p. 31 | Mark Betteridge | ZX Spectrum, Game Boy Advance | Interview in the Sabreman history feature about Rare’s character. |
| Retro Gamer | 142 | pp. 50-57 | Julian Gollop | ZX Spectrum, Amstrad CPC, Game Boy Advance | Gollop discusses the design and evolution of Rebelstar. |
| Retro Gamer | 156 | pp. 70-77 | David Leitch | Game Boy Advance | The former Hotgen developer discusses working on Game Boy Advance titles and hardware. |
| Retro Gamer | 161 | pp. 22-29 | Ken Sugimori | Game Boy, Game Boy Advance | The Game Freak artist discusses the creation and continuing design of Pokémon. |
| Retro Gamer | 176 | pp. 88-91 | Shu Takumi | Game Boy Advance, Nintendo DS | Takumi explains the design and development of Phoenix Wright: Ace Attorney. |
| Retro Gamer | 204 | pp. 72-75 | Gary Penn | Sky Gamestar, Game Boy Advance | Penn discusses Denki’s work on Sky interactive games and other platforms. |
| Retro Gamer | 210 | pp. 78-79 | John McMurray | Game Boy Advance | McMurray discusses his unfinished follow-up Uridium Advance. |
| Retro Gamer | 215 | pp. 88-91 | Trevor Attwood | Game Boy Advance | Attwood explains how Rare revived Sabre Wulf for the Game Boy Advance. |
| Retro Gamer | 230 | pp. 74-77 | Jonathan Russell | Game Boy Advance | Russell discusses the crossover games Crash Bandicoot: Fusion and Spyro Fusion. |
| Retro Gamer | 231 | pp. 52-59 | Rick Clucas, Steve Clark and Ryan Kaufman | Arcade, Atari ST, Amiga, Game Boy Advance, PSP | Developers revisit the original After Burner and its home and portable adaptations. |
| Retro Gamer | 237 | pp. 70-75 | Andrew Ayre and Mike Mika | Macintosh, PlayStation, Game Boy Advance | Digital Eclipse leaders discuss emulation, ports and the studio’s history. |
References
-
Retro Gamer Issue 01 page 62 ↩
-
Arm - ARM7TDMI Technical Reference Manual, DDI 0029G, programmer’s model and instruction summaries. ↩ ↩2