
Reverse engineering a Nintendo Switch cartridge - Ecco
https://www.texplained-store.com/en/Blog/8_how-it-is-made-zelda-botw-cartridge.html
======
dudus
Another interesting fact about switch game cards is that they taste horribly.
You can see several videos online of people tasting them. Theory was that it
was coated in something to avoid kids from swallowing the small cards. But I'm
not sure this was confirmed by Nintendo.

~~~
kristofferR
It was confirmed by Nintendo:

“To avoid the possibility of accidental ingestion, keep the game card away
from young children. A bittering agent (Denatonium Benzoate) has also been
applied to the game card. This bittering agent is non-toxic.”

[https://kotaku.com/nintendo-switch-cartridges-taste-so-
bad-1...](https://kotaku.com/nintendo-switch-cartridges-taste-so-
bad-1792869498)

~~~
userbinator
It's good that news travels fast today, or else people who didn't wash their
hands after handling carts could be in for a surprise when they ate. That's
the same chemical used in air dusters to stop them being inhaled deliberately.

------
chamakits
This is extremely cool. I always find these kinds of breakdowns interesting,
because they always find something absolutely unique to the device.

Does anyone know, for this kind of "unique card device" use case, do companies
usually have an in-house team in charge of developing it, or do they hire a
third party, or does a third party approach them with the offer of a device
like this?

If a third party, is it a small shop, or some established company? How is the
company known and how does it build that relationship with Nintendo?

~~~
userbinator
Nintendo has long used Macronix as its storage device supplier:

[http://wccftech.com/nintendo-nx-macronix-memory-
slots/](http://wccftech.com/nintendo-nx-macronix-memory-slots/)

~~~
0xcde4c3db
Fun fact: Macronix used to make chips to defeat the NES lockout system for
unlicensed cartridges [1]. I don't know if they made the ROMs or cartridges as
well, but it seems plausible. I think their partnership with Nintendo started
during the N64 era, with Toshiba and Sharp making most of their ROMs before
that.

[1]
[https://www.google.com/patents/US5004232](https://www.google.com/patents/US5004232)

~~~
derefr
Similarly, Argonaut Games, the company that worked with Nintendo to produce
StarFox and the SNES SuperFX chip. Their first interaction with Nintendo was
when "Argonaut submitted a proof-of-concept method of defeating the Game Boy's
copyright protection mechanism."

Another fun fact: Argonaut later evolved the very same SuperFX chip into the
[https://en.wikipedia.org/wiki/ARC_(processor)](https://en.wikipedia.org/wiki/ARC_\(processor\)),
which is used in, among [many] other things, Intel's infamous Management
Engine. You very likely have an Argonaut core in your computer.

------
duskwuff
Surely the first step should have been to attach a logic analyzer to the
cartridge in circuit? For all we know, it might be using a well-known protocol
like SDIO...

~~~
userbinator
It does look extremely similar to an SD card in construction, with a large
flash die and a smaller controller:
[https://www.bunniestudios.com/blog/?page_id=1022](https://www.bunniestudios.com/blog/?page_id=1022)

The part number on the IC, after some contrast enhancements, appears to be
MX28K128GL0 --- not a publicly documented Macronix part number, but may be
related to the 28F128, a common 16MB (128Mb) NOR flash.

~~~
consp
Considering the download size of the games, a 16GB (128Gbit) chip is more
likely

------
eriknstr
You're pretty determined when you decide to dissolve the packaging of an IC :)

~~~
Cyph0n
Decapping an IC is simpler than it looks. Heck, anyone with access to a
university cleanroom can (with practice) easily reverse a commercial IC.
Understanding how it works is a different matter entirely though -- that's
where microscopy and circuits knowledge come in. Analog circuits are
significantly more complex as you need to characterize (measure resistance,
capacitance, etc.) individual components to be able to accurately model their
behavior.

~~~
Cieplak
Curious what your thoughts are on this:

[https://reverseengineering.stackexchange.com/questions/5878/...](https://reverseengineering.stackexchange.com/questions/5878/reverse-
engineering-modern-intel-cpus)

~~~
Cyph0n
A modern Intel CPU is a different beast entirely. Even relatively simple ICs
become exceedingly difficult to reverse at lower process nodes, so I agree
with the answer. My comment was more geared towards simpler ICs at a fairly
accessible process node (65 nm and older). Also, my use of the word "reverse"
in no way includes the process of figuring out what each part of the circuit
does in detail.

Nonetheless, at least in my field of research, the assumption is that there
exist nation states with "unlimited" resources that can in fact reverse
complex ICs. In reality, I doubt even the US DoD has that level of resources
available, so I like to think of the assumption as an analogue to the oracle
model in cryptography.

~~~
userbinator
_In reality, I doubt even the US DoD has that level of resources available, so
I like to think of the assumption as an analogue to the oracle model in
cryptography._

Actually I would look East, to China and Russia, for the latest technologies
in IC reverse-engineering. I don't think nation-state levels of resources are
necessary even to RE something like an Intel CPU. To actually understand how
it all works is a different matter, but if you're talking about just deriving
a transistor-level or gate-level schematic, or turning that into HDL, from my
understanding it's actually quite affordable now. You can already recover code
from most microcontrollers with <$10K USD (and I personally know others who
have used those services before); I'd estimate getting a schematic to cost
maybe 10x that.

~~~
richardwhiuk
Modern intel CPUs are very different beasts from your average microcontroller.

------
profmonocle
It's interesting that almost half of the plastic enclosure is empty. Could
this be to allow for higher-capacity cartridges without having to use higher-
density storage?

~~~
mbel
I think that they might have picked the size due to ergonomics. It's hard and
incovienent to use very small obejcts and Nintendo seems to target players of
all ages.

~~~
badlucklottery
I suspect this is true. If they made it microSD-sized, it'd be very difficult
to change games on the go and would easily get lost in the bottom of a
backpack.

You see this on the PS Vita as well: the memory cards, which are meant to be
changed rarely if ever, are roughly the size of a microSD card while the game
cartridges are probably double the width and height even though the storage
capacity of the carts tend to be much less (2-4GB) than the memory cards (8-64
GB).

------
Texplained
Hi everyone and thanks for talking about our article.

For those who wants to go further: Zelda’s Chip ID is out!
[https://www.texplained-store.com/en/10-chip-id](https://www.texplained-
store.com/en/10-chip-id)

------
gatesphere
Interestingly enough, different games seem to have different internals. Here's
a more traditional PCB design found inside a 1-2-Switch cart:
[http://imgur.com/a/FndZC](http://imgur.com/a/FndZC)

------
MaanuAir
Funny: I felt this was so interesting that I could not imagine the wizardry
was taking place anywhere close to my area (FR).

It appears they are located on my daily commute.

Could not have known without HN, cool!

(EDIT: typo)

