Corrupt Core

I was very satisfied with the SGB corrupter that I recently built for Vinesauce, and this time I set my sights a bit higher. After watching the stream, a few people had contacted me asking for schematics and directions on how to build their own. I was lazy and didn’t make schematics, but I decided that there might be enough demand to design a PCB that could be used to corrupt a variety of retro game systems. With this in mind, I started designing the Corrupt Core

Theory of Operation

The corrupt core is a single PCB being driven by an AVR ATMega328p running Arduino. It induces a corruption by forcing a data line on a retro game console to read logic low when the console expects it to read some other value. It’s not a very sophisticated corruption, but it’s simple and appears to work well. It accomplishes this with a bank of shift registers to expand the AVR’s IO that in turn connect to an array of darlington transistors. The transistors isolate the game console from the AVR and allow it to sink much more current.

There is also an LTC1799 precision resistor set oscillator integrated into the Corrupt Core. This allows the user to change the clock speed of the game console they’re corrupting and speed up or slow down their game. Simply running the game at a nonstandard clock speed sometimes induces its own corruptions. The LTC1799 is not controlled at all by the Arduino, and is instead configured by the user via some wire jumpers and a resistor.

Testing

The first system I’m going to corrupt with the Corrupt Core is the Super Nintendo.

This is the first revision of the SNES board. I’ve already started to attach some jumper wires to the lines I want to corrupt.

I found a schematic of the SNES online and decided I wanted to try and corrupt the following lines:

  • A0 of the PPU
  • D0 on the PPU
  • A0 of the VRAM
  • D0 on the VRAM
  • PAWR
  • A0 on the WRAM
  • D0 on the WRAM

To corrupt the lines, I just touched the jumper wire to ground. This is essentially what the Corrupt Core will be doing, albeit in a much more controlled manner.

This netted me some interesting results.

Sometimes this would just happen on my perfectly legit Mario All Stars cart

A0 and D0 of the PPU didn’t behave like I thought they would. I thought they would cause corruptions similar to the ones I saw on the A0 and D0 lines of the VRAM, but instead they caused actual gameplay and sound glitches, not just non-persistent video artifacts.

This was the first corruption I did, on A0 of the PPU. The glitch persisted and the audio disappeared. I’ll have to do more experimenting with these lines.

 

PAWR proved to be the most interesting. It caused amazing audio and visual glitches. I’d like to pulse this line very fast and see what that accomplishes.

Designing the Board

With a theory of operation in mind, I’ve designed this board based around an AVR ATMega328p with banks of darlington transistors being driven by shift registers. All the relevant Eagle files are up on GitHub.

The fully laid out board

The finished schematic

The Bare Board

GitHub page is here: https://github.com/granthaack/corruptcore

Populating and Testing the Board

Populating was a little difficult because of all the SMD components, but it’s not impossible.

The Populated Board

I encountered one mistake in this version of the board. I was a bit of a bonehead when I wired up the reset status LED, I connected the positive end of the LED directly to the reset line in series with a 150 ohm resistor and connected the negative end of the LED to ground. This pulled the reset line down to 2 volts, which kept the microcontroller permanently disabled. In order to enable the microcontroller, the reset line needs to be at 5v. I fixed this by controlling the reset LED with a transistor instead of just wiring it directly to the reset line. Once the reset status LED was disabled, the board worked perfectly.

The microcontroller can be programmed directly on the CorruptCore board by hooking up the TX, RX, and Reset lines of the Ardiuno programmer to the header on the CorruptCore board. Now it needs to be hooked up to the SNES and properly programmed.