The good old days, when Nintendo secured QA-approved NES cartridges with a custom 4-bit chip...
I was curious so I researched this and it's quite a fascinating story!
Some of the main points:
- In the late 80's Nintendo develops the 10NES lockout system and patents it:
The Nintendo 10NES (CIC) lockout system is covered by U.S. Patent 4,799,635, titled:
"System for Determining Authenticity of an External Memory Used in an Information Processing Apparatus."
https://patents.google.com/patent/US4799635- Two identical chips, one on the NES and one on the cartridge, run in lockstep producing the exact same sequence. If the sequences differ the NES chip resets the CPU.
- Tengen, a subsidiary of Atari, using subterfuge gets the source code for the 10NES from the US Copyright Office and this leads to the development of a functional substitute they call the "Rabbit". Nintendo sues and in 1992 wins an injunction against Tengen.
- The Action 52 cartridge used voltage fault injection to disable the 10NES chip. A charge pump was used to create -5V which was presented to the 10NES data lines. Nintendo later adds resistors and clamping diodes on those lines.
- Another approach to running unlicensed cartridges was to piggyback a genuine cartridge via a dongle which passed through the 10NES signals from the genuine cartridge. Yet another was to cutting the connection from the 10NES chip in the NES and the 6502's reset line. Later Nintendo games start to check for this modification.
- In 2006 the Rabbit chip is decapped and although the CPU itself isn't reverse engineered it is discovered that the Rabbit has a debug port which allows introspection of what each instruction is doing, and this leads to the full revelation of the 10NES algorithm.
There are tons of articles/videos on this saga. For those who like to read check out pages 6-9 here:
https://archive.nes.science/nintendoage-forums/static.nintendoagemedia.com/ezine/Issue_07-2008.pdf