Turns out, the GBA crash sound is just the console playing its entire address space as sound data. If we have a clear recording, we can convert it back to actual bytes, thus dumping the RAM and ROM.
Used source code is available at: sites.google.com/site/thezzaz...
File name: gbacrashsound_dumper.zip
Note - this is hardly a ready-to-use solution, and requires a lot of tuning, depending on the source data format.
You "cheated" but I wonder: is it possible to get the correct offset given enough recordings? Or is the playback speed not a constant rate?
It is constant rate - but due to imprecisions and the desynchronization between the console's and the recording's sample rates, each byte might take a slightly different number of samples every once in a while (say 9 instead of 10). Usually this is not a problem, since it's possible to find boundaries between different bytes by seeing the changes in audio level. Even if there's a streak of several identical bytes, it's still possible to get correct answers quite reliably just by rounding (if there's a segment of 48 identical samples, it's fine to reason that it corresponds to 5 identical bytes). However, if the streak is thousands of bytes long, the errors add up to the point where simple rounding cannot give a correct result, and it becomes close to impossible to know how many errors occurred. The only real solution would be to increase the sample rate to make the errors even less significant - but we quickly get to the point where we pretty much need a data-logging oscilloscope, and I wanted to stick to simple hardware.
@@TheZZAZZGlitchassuming there are slight differences on each generated rom, why dont you make the program repeat several times to enhance accuracy? make 5-6 roms and keep the closest one
@@pablo5425 That's... kind of what he did? Repeat the process a few times to iron out the errors?
@@TheZZAZZGlitch thanks for your answer, this was something i was wondering as well. the fact that a byte can be represented with a varying number of samples helps this make a lot more sense.
Can you use the "average" samples per 100k bytes during periods of activity, to produce a high-precision estimate of the byte rate to bridge long gaps of silence, or does the playback and recording rate drift enough to break that? Also how did you avoid least significant bit errors?
Hearing the in-game musicians tune their instruments by crashing the game is unbelievable but also really cool
i crashed my gba and at 1 hour and 17 minutes i started hearing all the sfx and its hilarious
When it's 6 A.M in a animatronic restaurant 1:11
I'm wondering what the hell the sound at 1:02 was from. Don't think I have ever heard it in-game and it doesn't really sound like it even belongs in a Pokémon game.
@@K9V1I'm guessing that they may have had a library of sounds they were working with and not all of them were used.
@@sarougeau That would actually make a great deal of sense. Very interesting sound bit nevertheless!
This whole thing feels like watching someone reproduce an almost perfect replica of the food they ate via throwing up violently. Incredible work ZZaZZ.
I get it but ew
Lol 😆
Hahahahahahahaha
I was just about to mention it.
throwing up violently 45 times
While this is already a very impressive feat, I'm even more impressed by the fact that the Chinese bootleg cart had been designed with actual efforts in order to make the game function as good as it possibly could without the RTC battery or the dedicated SRAM chip. I wonder why they bothered to replace the battery message, at this point they could have made the code to just bypass that screen entirely just to make it look genuine from the get go.
Thats exactly what I was wondering too. Why change the message, and not just nuke the check?
My guess is that the bootleggers were under deadline pressure - nuking the check would have taken longer to implement and debug than simply changing the message to something innocuous.
I don't really understand why anyone would have gone to all that extra trouble to make a replica cart to begin with?
@@LupisLight So they can mass-produce it and sell the carts for cheaper than the price of a real cart, of course.
Keep in mind that there's a decompilation of Emerald out there so technically they may actually have more control. The question is whether or not this repro supports the link cable and the GBA-GC cable, plus GBA-to-DS migration of Pokemon.
I'm old enough to remember time when radio stations sometimes played video games. You could record it and played it on Commodore 64.
Or write a program and save it on a cassette using a tape recorder peripheral. Thanks, Texas Instruments, for letting me save TI Basic that way and use it to play music otherwise!
I was thinking of the ZX Spectrum.
what???????????/
@@gabrielv.4358The C64 and other computers of the time had analog input/output, along with built-in software to save data as audio and vice-versa. Given that most computers of the time used cassettes, this was required to make full use out of them.
you aren't though
I grew up with a chinese bootleg of each gen 3 game, and that "The save file will be loaded." message was always so confusing to me, since I didn't realise they were fake at the time. Other quirks of the bootlegs were that if booted up in a DS rather than a GBA, the save file would be wiped, and for Emerald specifically beating the elite 4 would also wipe the save file. I know bootlegs can differ from each slightly, so I'd love to what weird changes they made to the ROM for those very annoying problems to happen.
If I think of the correct bootlegs, then they patched the games to store the savefile within the same internal area where the rom is. Yes, they *write* to the *read only memory* , which is illegal.(And this is legit, patches to replicate these roms actually exist publically. Probably useful for physical repros of Gen1/2 games too because those guys normally require battery and die when it does) Idk if they also did other modifications, but nonsense like this is probably why the slightest variance in functionality from the DS makes the game cr*p itself and panicwipe the savedata. As for the elite 4-wipe in emerald, they probably just screwed up the savewrite there considering getting into the hall of fame alters specific values in your savefile that otherwise aren't touched. Either that or the way it resets the game does something to the game that this specific bootleg does not like.
It because there's actually extra space in the savefile for the hall of fame data, and writing the first hall of fame to your savefile is usually when the flag gets checked that you beaten the game and can trade pokemon outside of the regional dex. However, most bootlegs don't bother taking this into account and what ends up happening is your save will get overwritten with the hall of fame information and corrupts the save. The gen 3 games also holds two copies of your save (128k), but the bootlegs only holds one copy (64k)
Same for me, but with a bootleg version of Sapphire and Leafgreen. Sometimes, with the latter, the save file would be wiped for no reason when booting up, so in order to play through the game, I had to keep the power on my GBA. Those bootleg versions don‘t work if you use Pal Park in the Gen 4 games. Luckily, the Pokémon can be traded to a legit copy, in my case, Emerald, and get them to the most recent games.
thats actually what i did years later when i finally got legit copies. managed to transfer up a few things to gen 4, but most of the bootlegs had already wiped themselves by then anyway (or the cartridge wouldnt read at all)@@DennisTheZZZ
I had a bootleg leafgreen that worked in my DS but if I played a DS Pokemon game with it plugged in the save corrupted. Apparently that's a common issue with fakes
Note: the magic KZhead algorithm seems to be recommending this video to people without context - if you're curious about why crashing GBA games play their entire memory as sound in the first place, check out my previous video from 6:00 onward - kzhead.info/sun/qreQfs-oqJyqhJE/bejne.html
fact
listen to some master boot record and report back to me (this comment used to say something different)
Yea
Crazy thing is, I got this video recommended a few minutes later after I watched the interesting things 4 video. Your a mad man is all I can say.
A link got posted on twitter a few hours ago as well
ZZAZZ is the only guy who wants to dump a ROM by destroying his ears. Mad props to him.
This is an incredible engineering feat so congratulations. It's like loading a game off of casettes back in the Commodore days. I can't wait for the day pirate radio stations start broadcasting this type of data lol.
The data is just a little too fragile to be sent in audio form over radio. Distortions from static will probably corrupt too much of the ROM to boot it, let alone play it. But if you're interested in the general concept of smuggling information by sending it in a nonstandard format, search up "illegal numbers" on Wikipedia, you might find it a fun read.
Some pirates on shortwave kinda do, in various digital modes, mostly sstv pictures.
I've been looking to get my radio ham licence, but given that it isn't music I think I could get away with sending this sort of data over the radio, so long as I also send my callsign every now and then. It'd be fun to try, just stick a Spectrum into the radio and see how wrong it gets the data.
jet set radio:
Oh, my... Being able to "read" by EAR an entire game's code is... amazing, and incredibly poetic. It's such a fun idea, too. Are you gonna drop the full EP now or what? xD
It's not a new idea though. That was how games and software were recorded on cassette tapes back in the day.
@BrunodeSouzaLino Type `load ""` and hit play, go and make a cuppa, come back 5 or 10 minutes later and find it errored out and you have to adjust the azimuth of your tape player again. Given how finicky the GBA software is here about timing, its a wonder tape loading even worked at all with the wow and flutter. I suppose the answer is a lot of error correction, but it was never perfect even with that.
You can also just import the ROM into Audacity as Signed 8-Bit Audio and a sample rate of somewhere around 10kHz to 16kHz
The scuffed-ass DS is a sign of true love.
This is interesting stuff, didn't know the corrupted noises are actually ROM data loaded into RAM. Makes for a good project if you don't have a dumper on hand.
replacing the famous error screen with "the save file will be loaded." is such a flex
The real hardware method could actually be a game changer for unlicensed game preservation. Many unlicensed games have their own unique protection to stop them from being dumped and this could get around it entirely. Also yes i'd love to see a video on the bootleg ROM differences
This reminds me of that Retro Game Mechanics Explained video where he tries to reverse engineer the code of Yar’s Revenge by looking at the neutral zone’s pixels
This ended up producing an actual game at the end though. Due to the way the Neutral Zone was made, I remember that making a ROM from that became extremely difficult after a certain point.
@@Hijiri_MIRACHION Yeah, the values used for the zone was only part of the game's memory, with 1/8 bits missing and iirc only half the entries, so essentially only half the game was to be found there, and even then that was incomplete and required a lot of guesswork to make sense of. It's a bit unfortunate, because it was really interesting
I was thinking the same exact thing
I'm pretty sure the guy who coded that thing into Yar's Revenge said "It's pretty ironic that the code for drawing the neutral zone *is* the graphics of the neutral zone" lol
@@Mizu2023he has a pinned comment in that same video
The very notion of this is so overwhelmingly absurd... I wanna see more stuff like this.
I'm more shocked that the chinese clone has a modified rom than I am surprised about you dumping the rom with audio.
Why is that so interesting
@@MasDouc These things are made for a quick buck, so to see the bootleggers put in all that effort is interesting.
This channel is reaching reaching a very professional level, I honestly cannot express how much I appreciate the existing of it, keep going ZZAZZ, and thanks for giving me the passion of glitching (lol)
fyi he works at microsoft iirc so hes pretty professional
@@kab43proof?
it's in one of his april fools videos i think, he talks about being busy cause of the job iirc@@serraramayfield9230
so... this is the evolution method of GBA Crash Sound? ...and it evolves into a whole game? Amazing.
That's so interesting :O The crash noises playing all the SFX then eventually the ROM??? It makes me so curious about why those crash noises even happen, that's so cool
If you haven't seen it, he goes over /why/ the noise happens in his previous video (Interesting observations #4). It's apparently different for every game, too, the same video has a sample of Mystery Dungeon crash sound in the section about its glitch dungeons. Super cool stuff.
In modern computing, there's no difference between software and data. The different sounds you hear are data being interpreted as audio and playing as such.
the audio chip plays samples from a pointer to a memory location that gets incremented automatically. To loop the sample you just set the pointer back to the beginning, but if the game crashes, the pointer will keep incrementing, playing every byte of memory as if it was sample data.
1:33 is just the life of a programmer. Also - Kitchen floor, table and ancient laptop reveal! And a cursed bit of soldering we shall not talk about ever again!
when the car ears flew in I died
Awesome video! The long string of similar bytes is a very real problem in EE in general. For example, the USB protocol requires a state change (called "bit stuffing") every 6 bits if one hasn't happened to prevent the loss of timing like you experienced. Regarding the 0x00s at the end, it may be the cartridge, or it might be the sound card. Realtek especially, but other ones as well, often have DC blocking, so after a while of the same non-zero data, the actual output/recording goes back to 0. Finally, the crosstalk you noticed may have actually been caused by the cable you used, a shorter cable, or better shielded one may yield better stereo results.
Absolutely incredible! I always fantasized as a kid that the horrific screeches of pulling a cartridge held some secret information... I guess that was kinda true! Curious, do you own a GBxCart to do a "proper" dump with to compare against? I'd be extremely curious to learn more about the tricks that get implemented in cheap clone carts, and would happily send you one if you think it'd help your efforts!
I DO own one, and working in a game store I tend to use it to flash over those carts for various purposes, I usually dump them beforehand just for safe keeping.
Kid me assumed, through child moon logic, that the screech must have been Jirachi's cry. Since I knew about Jirachi but had never seen one in-game, and didn't know what it sounded like. So I wasn't *technically* wrong either :'D
Had similar thoughts after once getting weird text to pop up in SF2 CE on Genesis after accidentally bumping the console while playing. Never happened again though. Kinda wish I had a GBA game crash while I was away (on the DS due to batteries) and to come back while it was playing the instruments.
the one dislike was from you soldering white to red
Waaaaait a minute, is that the Uplink OST I hear during those coding segments? Brings back memories. A really interesting idea. I'm surprised it's even possible, let alone that you managed to achieve 100% accuracy by repeating the recording. That bootleg cartridge is really interesting too.
I'm only in the comments to say the same think. God damn I loved Uplink.
As someone who has watched none of the video yet, this is a ZZAZZ classic.
as someone who has watched all of the video, this is a ZZAZZ classic
This is indeed a certified ZZAZZ classic.
@@kittrzfr
0:35 BANGER
You're not black
Holy moly, it's Camellia 👋 (Please do not add that to your latest tracks, our ears will bleed)
camellia don't listen to -w- it would be so funny if you put the gba crash sound in a song
Hello 2025 leak
gba crash remix
incredibly cool, and what an interesting replica cart!! i've played around with various bootleg pokemon cartridges before (though none of quite that quality) and from what i've seen, the whole "the save file will be loaded" message seems pretty universal (the one i've seen most often was simply "the game can be played." without the rest of the "however, clock-based events will no longer occur", also removing any mention of an actual battery). also shoutout to the cursed adapter + cat ears, gotta be one of my favourite genders
Incredible video detailing how it works and the processes you did, honestly really cool to hear all the different individual sounds
reminds me of when we had to dump an fds disk by using a program that output all of the disk's data over audio. pretty neat to see the changes the bootleg made, too. surprised they didn't just hack out the dry battery textbox rather than change the text, tho
Probably because they were too rushed to test if that'd break anything, and didn't want to risk yoloing it.
such a cool idea, the quality of the videos have never been this good. Actually inspired me to try glitchhunting myself.
One of the better videos I've seen in your channel, intresting topic, "slice-of-life" scenes, and cool topic in general. I hope to see more like that. :)
tch, i recognize that frequency, now I've i have your SRAM and own ALL your pokemon!!! >:)
For anyone else trying to read the single frame text/comments in the vid... pause and comma/period keys are a godsend (single frame back/forward).
Meanwhile on mobile: guess they just don't want people to read it /shrug
@@renakunisaki RIP :( sorry
it may not be "music" to most, but it IS art!
"So, how do you dump your rom files?" "It's complicated..."
The Uplink hacker music really set the tone for the reverse engineering segments
Long time fan, I am 100% here for this new direction of videos, I'm loving it.
This is amazing! When you hinted this last video, iI was sad because I really wanted to see it straight away. I'm glad you did it, and I'm so suprised how accurate you can get the rom!
Ooooh that music at 1:22 sparked some memories. Good pick.
yessssss I was waiting for this :D also hearing all the instrument samples back-to-back is so cool omfg
also, fun fact: those horrible squawking sounds after the Bard's "A E I O U" voice samples are actually compressed audio data for all the Pokémon cries! that's why they still sound slightly more like actual audio than the other glitchy screeching sounds
You made it into the latest HW news from gamers nexus
This reminds me a lot of how 1980s computer games were sometimes sold on cassette tapes with the game code literally being the "music" on the tape
This is wild! i didn't know if it would be possible,but you managed to do it! When i saw the thumbnail, i was like "No way, he actually tried it!"
A video about self-modifying code would be a real treat. Thank you for your work!
Amazing work ZZAZZ, I am just in awe at how clever this all is
great video and i love the new way you're taking things (not that i had anything against your previous videos)!
some of those sample sounds in the ROM are groovy. i’m guessing the voiced ones (like the “a, i, u, e, o” one) are generic samples that probably show up in other GBA ROMs, just interesting hearing them alongside ones that you do hear in-game
No there's an NPC in the game named "the bard" that uses them. He's in the mauville Pokemon center but only on certain save files.
@@iacon0425 I spent a few hours getting a save file with him because I've never had him before. The samples sound a lot different in game, are they processed somehow? I want to know more about the bard because I had never seen him before today lol
@@Zichqec He appears based on your trainer id, if it ends in 0 or 1 he will appear.
@@Tyranitar66501 Yeah I found that out, and reset over and over until I got one. And then I found out you can't mix records until you get to mauville anyways, so I had to spend a few hours making my way there. I was hoping to cheat the system by mixing records before then with a save that was already at mauville lol
Okay, that's really cool hearing all of the ROM's MIDI samples played back-to-back like that. You can literally _hear_ the structure of the data in some places. It's also really nostalgic hearing samples from my favorite Pokemon generation getting absolutely _blasted_ like that. I can even place certain sound effects. Man, do I need to boot up my copy of the Emerald decomp again? Yes, PLEASE do another video about the engineering of that Chinese ROM. I can't imagine it's a small feat, especially on GBA hardware.
i’m so glad youtube algorithm brought me back to your channel. used to watch you like almost 10 years ago or less on my old account 🖤
The fact this boots at all is just astounding, wow, great work!
fascinated by this just nearly barely complete rom. i like how you have to crash the game 7 (or 45) times and sit there for hours upon hours recording all of this just to have the worlds most inefficient dumping method. thats hilarious. and really interesting too is this the first time there was actual real life camera footage on the channel? would be very interested to see the hacky bootleg cartridge tech stuff too
Technically, no, it's not the first time. When ZZAZZ wants to show footage from 3DS VC, he simply puts his 3DS in front of a camera, presumably because there aren't a lot of options for 3DS capture cards.
ZZAZZ also had a video demoing some Game Boy Camera emulation they worked on, by using a webcam for what the emulated camera sees.
this was really neat!! i would definitely love to see a video where you dig into chinese bootlegs of gen 3 a little more, too!
This is absolutely insane and Im so glad you actually did it
We are eating so, so well with these recent uploads. What a treat!
3:05 looks like if the copyrights were scribbled out with a marker, could be an aesthetic for a pirate ROM or something
Fascinating! I think it would also be interesting to look at virtual console roms and see how they differ from the originals.
omg this is SO COOL, and i guess proves that no one else has ever been brave enough to listen to the gba crash noises for 2 hours? absolute banger of a video, thank you
This was amazing, especially the bit at the end about the code used to make the bootleg work.
It may not be music to my ears, but it is a video game edit:that adapter at 5:13 is super cool 😄 edit:thanks for the info on how that bootleg cart saves, I’m glad to understand that obscure engineering! Great work great video!
You were actually super close to the correct samplerate! All Gen 3 games run the engine at 13379Hz (most if not all of the samples are also sampled at that rate)
Banger video as always. Love this channel.
Well, this is just mind blowing. While there are GBA ROM dumpers available, this video proves that it's possible to dump the ROM of the game from the audio output of the GBA itself, given that you have sufficient patience and right equipment to do that.
This video better blow up in the algorithm because it's awesome
I finally found your channel! The game corner music brings back memories
I loved this so much. Sigbovik level work! I need more creators in my life like you and suckerpinch.
This is SO COOL. Please make videos about the chinese cart! I got scammed a long while back when I was young and naive (I have legit carts now) and it is so fascinating to me to see those carts be picked apart. Mine had a text box like "The save has been loaded. The game can be played." or something. It was a bit different from yours! And now that I've grown up, I've become very interested in programming, so even more reason I'd like to see what kind of stuff is going on under the hood there. This video is excellent, thank you so much for making it.
This might be one of the wackiest things I've ever seen pulled off
Definitely would love to see a deeper dive into this weird code! Also great vid! I still can't believe what makes this process unreliable is the blocks of silence rather than the rest of the data lol.
Wow, you really went above and beyond for this video! That weird replica rom code definitely looks interesting, interesting that rewriting the game is cheaper for bootleggers than use extra chips for the save.
The self-rewriting Pokémon bootleg cartridges are a pretty commonly known thing in the GBA homebrew community because they're an inexpensive way to get rewritable cartridges. Would love to see a video detailing a code
listening to those instrument samples I've just noticed that RSE uses the same soundfont as Mother 3
okay that was really damn cool. First video I've seen from your channel, you have earned a subscribe button click.
THE KING IS ALIVE
this is such a cool concept tho
I remember crashing my emerald rom by accident and left it on. I remember hearing the instruments play out and got so scared i turned it off
This was very enjoyable and an unexpected recommendation Nice work!
I'm glad I'm not the only one putting way too much time into random projects for my own entertainment and curiousity, alongside a possibility of some small utility
Always wondered about that "save file will be loaded" message, i have a bootleg emerald that does the same Mine also had this really annyoing issue of muting one of the audio channels after saving which was fun
Knowing the soundfont is actually just tuned in the ROM makes Mother 3’s mechanic of timing combos to the beat make a lot more sense
Every song in a game using the Sappy/M4A engine has a BPM attached to it. MOTHER 3 does stuff to check whether you've pressed A to the beat, the ROM does not "tune" the soundfont.
you are somehow one of the few channel that manage to keep my attention
I saw this on Twitter and have been waiting for the full video. Big lit!
I had no idea there were samples of human voice in the GBA games
So that's what the GBA crash sound does. It apparently becomes a full game with enough mixing and shuffling around. Now I wonder how long the extended Pokeball sequence when you have zero Pokémon in these games is, and if they actually get healed at the end, and any other effects it may have...
I like how all the instruments and sound effects play when it crashes. This would be a great method of creating soundfonts for gba games that don’t use the sappy sound engine
Absolutely fascinating. Please make more content like this
5:00 Was that a cat ear headband?
👀
Unrelated to the topic, but for those wondering what the song in 6:22 is, it's the goldenrod city game corner theme. I really liked hearing it and wanted to hear it in a different video. Sadly it's not credited in the description... but thank Arceus for song finder apps!
Damn, I am impressed that you managed to get usable data from that audio recording! Very nice anyway, thank you!
0:44 Oh wow, this makes ripping GBA samples incredibly easy... Really cool discovery for someone like me who's fascinated by the sound limitations of the GBA and how to mimic it, especially considering the lack of info around it.
the rom being filled with $FF instead of $00 is likely due to the exact memory chips used and the way they were flashed, some chips, before flashing, are filled with $FF, and some with $00, though of course they can be overwritten to be one or the other. the rom was likely dumped and then the extra $00 bytes truncated (possibly due to not knowing what address to stop reading at, depending on how early the replica was made) then flashed onto a chip that had come off the assembly line filled with $FF and not overwritten with $00 bytes. this is further reinforced by the fact that they obviously used a very different type of chip (source: i have encountered both in my experience working with the memory of microprocessors and other chips)
I would be very interested in seeing a video that covers more of the details on what's different between an official ROM and the chinese bootleg. I hear that a few strange behaviors occur on those chinese ROMS such as some wiping the save data when played on a DS. I wonder just how many weird things can happen with the chinese version
This is probably the coolest video you've made yet.
As someone who's been jumpscared by the GBA crash sound dozens of times and it continues to jumpscare me even when I expect a crash, this is so cool. Possibly the coolest video I've seen, and normally I just skip over text-only-videos.
My biggest question from all of this is where those *voices* are used. The one at 1:02 put in with all the instruments, and the "Ah Ee Oo Ei Ou Nn" sounds you showed in the emulator vs bootleg cart comparison. Like, those are the Japanese vowel sounds (plus ん, the only consonant capable of standing on its own), but why are they here? Where were these used...?
The ‘Ah Ee Oo Ei Ou Nn’ instruments are used for the guy in one of the Pokémon Centers who can “sing” a phrase you give him! I have absolutely zero clue about the voices at 1:02 though
I wonder if the GBA has that sample recording due to something... I wonder if the GBA uses MIDI or supports it? Many keyboards, music softwares, or any MIDI-related music thing tool, mostly no matter what brand, have a choir instrument, and sometimes a female voice and a male voice. I'm still unsure what this is, though, too. (or maybe it could be WAV samples!)
A I E O UM **fnaf doorbell sound**
This is unbelievably technically impressive im so glad youtube recomended this to me
I knew that it was playing some sort of data in memory, but I never left it running to play ALL of the memory because I thought it was just looping. Very impressive.
1:11 6am
1:22 uplink music :)