--- title: How to Extract the Game Boy Boot ROM From a Chip Photo description: Embedded systems reverse engineer Travis Goodspeed demonstrates how to extract the Game Boy's boot ROM directly from a microscope photograph of its CPU chip,... canonical: https://daily.dev/posts/how-to-extract-the-game-boy-boot-rom-from-a-chip-photo-rpn4vk9hz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Extract the Game Boy Boot ROM From a Chip Photo | daily.dev og:description: Embedded systems reverse engineer Travis Goodspeed demonstrates how to extract the Game Boy's boot ROM directly from a microscope photograph of its CPU chip,... og:url: https://daily.dev/posts/how-to-extract-the-game-boy-boot-rom-from-a-chip-photo-rpn4vk9hz og:image: https://api.daily.dev/og/posts/RPn4Vk9Hz.png og:image:alt: How to Extract the Game Boy Boot ROM From a Chip Photo og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Extract the Game Boy Boot ROM From a Chip Photo **[David Bombal](https://daily.dev/sources/davidbombal)** · 41 min read · 0 upvotes · 0 comments ## Summary Embedded systems reverse engineer Travis Goodspeed demonstrates how to extract the Game Boy's boot ROM directly from a microscope photograph of its CPU chip, using his open-source Mask ROM Tool to identify bit patterns from via connections, determine bit ordering, and decode the binary into working machine code. The conversation covers his book Microcontroller Exploits, the trademark-based copy protection Nintendo used instead of stronger cryptography, the history of the Tengen/Atari Tetris lawsuit involving reverse-engineered Nintendo chips, and other chip-hacking techniques like nail polish UV masking and acid decapsulation covered in the book. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can you extract the Game Boy boot ROM from a photo of the CPU chip? You photograph the mask ROM under a microscope, mark rows and columns of bit lines with a tool like Mask ROM Tool, set a bit threshold to distinguish working transistors (ones) from broken ones (zeros), then solve for the correct bit ordering using known instruction patterns like the stack pointer reset opcode 0x31 to identify the right decoding, and finally export the bytes as a ROM binary. _Developers curious about hardware reverse engineering can track deep technical demos like this on daily.dev._ ### Why did Nintendo use a trademarked logo check instead of stronger copy protection on the Game Boy? Nintendo saved money by relying on trademark law rather than the advanced copy protection mechanisms other consoles of that era used. The Game Boy's boot ROM checks that a cartridge displays the exact Nintendo logo before booting; showing a fake logo would trigger a trademark violation and legal liability rather than a technical block, making the protection legal rather than cryptographic. _Anyone weighing legal versus technical protection strategies can find these console security case studies on daily.dev._ ### What is Mask ROM Tool and what chips can it be used to reverse engineer? Mask ROM Tool is an open-source program written in Qt6 and C++, available for Mac, Windows, and Linux, built for reverse engineering read-only memory from chip photographs. It works on via ROMs and diffusion ROMs but not RAM, EPROM, or flash, and it has been used on chips as large as a million bits, including the NSA's 1990s Clipper chip. _Engineers evaluating reverse-engineering tooling can follow releases like this open-source project on daily.dev._ ## Similar posts on daily.dev - [I turned the Lego Game Boy into a working Game Boy part. 1](https://daily.dev/posts/i-turned-the-lego-game-boy-into-a-working-game-boy-part-1-7ndqtwqzz) · Lobsters · 0 upvotes · 0 comments - [GBC Boot Animation 88×31 Web Button](https://daily.dev/posts/gbc-boot-animation-88-31-web-button-7mbamiw6z) · Hacker News · 0 upvotes · 0 comments - [Dumping Nintendo e‑Reader Card “ROMs”](https://daily.dev/posts/dumping-nintendo-e-reader-card-roms--mjfo5rmsr) · Planet Python · 0 upvotes · 0 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#hardware](https://daily.dev/tags/hardware), [#embedded](https://daily.dev/tags/embedded), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/how-to-extract-the-game-boy-boot-rom-from-a-chip-photo-rpn4vk9hz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Extract the Game Boy Boot ROM From a Chip Photo","url":"https://daily.dev/posts/how-to-extract-the-game-boy-boot-rom-from-a-chip-photo-rpn4vk9hz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-extract-the-game-boy-boot-rom-from-a-chip-photo-rpn4vk9hz"},"datePublished":"2026-09-01T14:03:51.305Z","dateModified":"2026-09-01T14:04:14.597Z","description":"Embedded systems reverse engineer Travis Goodspeed demonstrates how to extract the Game Boy's boot ROM directly from a microscope photograph of its CPU chip,...","image":"https://i.ytimg.com/vi/z1nRvJi9d5U/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/z1nRvJi9d5U/sddefault.jpg","isAccessibleForFree":true,"articleSection":"David Bombal","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"David Bombal","logo":"https://media.daily.dev/image/upload/s--Dz6oUxSb--/f_auto/v1710503980/logos/davidbombal","url":"https://daily.dev/sources/davidbombal"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-extract-the-game-boy-boot-rom-from-a-chip-photo-rpn4vk9hz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source,hardware,embedded,reverse-engineering","timeRequired":"PT41M","video":{"@type":"VideoObject","name":"How to Extract the Game Boy Boot ROM From a Chip Photo","description":"Embedded systems reverse engineer Travis Goodspeed demonstrates how to extract the Game Boy's boot ROM directly from a microscope photograph of its CPU chip,...","thumbnailUrl":"https://i.ytimg.com/vi/z1nRvJi9d5U/sddefault.jpg","uploadDate":"2026-09-01T14:03:51.305Z","duration":"PT41M","url":"https://api.daily.dev/r/RPn4Vk9Hz","embedUrl":"https://www.youtube.com/embed/z1nRvJi9d5U"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"David Bombal","item":"https://daily.dev/sources/davidbombal"},{"@type":"ListItem","position":3,"name":"How to Extract the Game Boy Boot ROM From a Chip Photo"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-extract-the-game-boy-boot-rom-from-a-chip-photo-rpn4vk9hz#faq","mainEntity":[{"@type":"Question","name":"How can you extract the Game Boy boot ROM from a photo of the CPU chip?","acceptedAnswer":{"@type":"Answer","text":"You photograph the mask ROM under a microscope, mark rows and columns of bit lines with a tool like Mask ROM Tool, set a bit threshold to distinguish working transistors (ones) from broken ones (zeros), then solve for the correct bit ordering using known instruction patterns like the stack pointer reset opcode 0x31 to identify the right decoding, and finally export the bytes as a ROM binary. Developers curious about hardware reverse engineering can track deep technical demos like this on daily.dev."}},{"@type":"Question","name":"Why did Nintendo use a trademarked logo check instead of stronger copy protection on the Game Boy?","acceptedAnswer":{"@type":"Answer","text":"Nintendo saved money by relying on trademark law rather than the advanced copy protection mechanisms other consoles of that era used. The Game Boy's boot ROM checks that a cartridge displays the exact Nintendo logo before booting; showing a fake logo would trigger a trademark violation and legal liability rather than a technical block, making the protection legal rather than cryptographic. Anyone weighing legal versus technical protection strategies can find these console security case studies on daily.dev."}},{"@type":"Question","name":"What is Mask ROM Tool and what chips can it be used to reverse engineer?","acceptedAnswer":{"@type":"Answer","text":"Mask ROM Tool is an open-source program written in Qt6 and C++, available for Mac, Windows, and Linux, built for reverse engineering read-only memory from chip photographs. It works on via ROMs and diffusion ROMs but not RAM, EPROM, or flash, and it has been used on chips as large as a million bits, including the NSA's 1990s Clipper chip. Engineers evaluating reverse-engineering tooling can follow releases like this open-source project on daily.dev."}}]} ```