Space Invaders: A Super Nintendo Game Hidden in a Game Boy Cartridge!

The hidden Super Nintendo game you didn't even know you had!

• Keith Ott
• Video Games
• July 28, 2023
• 8 Minutes

I’ve recently been building up my physical Game Boy library, and I was surprised to learn that the Game Boy game Space Invaders includes a full Super Nintendo game hidden inside that can be unlocked with the Super Game Boy! But how does this work?!

The Super Game Boy

First, some background. The Super Game Boy was an add-on for the Super Nintendo that allowed you to play Game Boy games on your TV with a Super Nintendo controller. (Yes, the Switch is not a new concept; Nintendo first did this almost 30 years ago!) Oh, and this was no emulation; the Super Game Boy contained real Game Boy hardware.

The problem is Game Boy games are still limited to four colors. The Super Game Boy allowed you to set your own color palettes and even custom borders, but they’re still just Game Boy games. However, once the Super Game Boy was released, more and more games started shipping with Super Game Boy enhancements. The games would function normally on a Game Boy, but when played on a Super Game Boy these games would feature custom color palettes and custom borders. Some games even went the extra distance and used features of the Super Nintendo, such as allowing a second player to play on a second controller (like Killer Instinct) and using the Super Nintendo sound chips. However, the coolest was Space Invaders.

Space Invaders on a Super Game Boy

When Space Invaders was played on a Super Nintendo, it gave players the option of playing the normal Game Boy game (with Super Game Boy enhancements) and a separate “Arcade” mode that loaded an entire Super Nintendo game. This wasn’t a Game Boy game with colors, or some hidden Easter Egg in the Super Game Boy. No, this is a real Super Nintendo game hidden inside the Game Boy cartridge!

Once Space Invaders is started on a Super Game Boy, the player is prompted to select the Game Boy or Arcade version:

When the player selects the Arcade version, it displays a brief loading screen:

And then, the game launches! The intro has some Mode 7 effects, there’s no border, and far more colors then a Super Game Boy enhanced title displays. This is the real deal!

… but how? I always assumed the Super Game Boy ran Game Boy games in a complete sandbox, and custom palettes and borders were just read by the Super Game Boy. Turns out this isn’t the case. Super Game Boy enhanced Game Boy games know they’re on a Super Game Boy, and the Super Game Boy provides mechanisms for Game Boy games to take full control of the Super Nintendo hardware.

How A Super Nintendo Game is Hidden in the Space Invaders Game Boy Cartridge

Thanks to the gbdev.io website, we can see how an entire Super Nintendo game is hidden in the Space Invaders Game Boy cartridge. First, games need to set a header specifying they’re Super Game Boy enhanced. If they don’t set this, none of the Super Game Boy commands will do anything:

Cartridge Header

SGB games are required to have a cartridge header with Nintendo logo and proper checksum just as normal Game Boy games. Also, two special entries must be set in order to unlock SGB functions:

• SGB flag: Must be set to $03 for SGB games
• Old licensee code: Must be set to $33 for SGB games When these entries aren’t set, the game will still work just like all “monochrome” Game Boy games, but it cannot access any of the special SGB functions.

(Source)

Then, Space Invaders loads data directly into the Super Nintendo RAM with the DATA_TRN commands (what I presume is happening during the “loading” screen):

SGB Command $10 — DATA_TRN
Used to transfer binary code or data directly into SNES RAM.
 Byte  Content
 0     Command*8+Length    (fixed length=1)
 1     SNES Destination Address, low
 2     SNES Destination Address, high
 3     SNES Destination Address, bank number
 4-F   Not used (zero)

The data is sent by VRAM-Transfer (4 KBytes).
 000-FFF  Data

(Source)

Finally, a JUMP command is issued to have the Super Nintendo CPU start executing commands at a custom memory address

SGB Command $12 — JUMP
Used to set the SNES program counter and NMI (vblank interrupt) handler to specific addresses.
 Byte  Content
 0     Command*8+Length    (fixed length=1)
 1     SNES Program Counter, low
 2     SNES Program Counter, high
 3     SNES Program Counter, bank number
 4     SNES NMI Handler, low
 5     SNES NMI Handler, high
 6     SNES NMI Handler, bank number
 7-F   Not used, zero

(Source)

The gbdev.io site even calls out this is how Space Invaders works: “The game Space Invaders uses this function when selecting ‘Arcade mode’ to execute Super Nintendo program code which has been previously transferred from the Super Game Boy to the Super Nintendo.”

If I load the same into the SameBoy emulator, force it to Super Game Boy mode, and attempt to run the arcade mode, we can see the following errors in the debugger. 12 is the JUMP command and 10 is the DATA_TRN command, and it would make sense these would fail (SameBoy is a Game Boy emulator, not a Game Boy / Super Nintendo emulator!)

I spent some time trying to figure out Ghida (a decompiler) to locate exactly where this is happening, but I’ll admit I eventually gave up. I don’t yet know enough about decompilation and Z80 assembly to really understand what’s going on. But hey, even with that, it’s clear this is how Space Invaders has an entire Super Nintendo game hidden within it. Cool stuff!

Modern Software Architecture

Relating this to modern software development, I find this approach really jarring. In today’s always online, interconnected world, the goal is to isolate software as much as possible for security purposes. It would be a security nightmare if a program running in AWS EC2 could take control of the server of if a website’s JavaScript could break out of a web browser’s sandbox. However, in this case, not only did Nintendo not mind if Game Boy games broke out of the Super Game Boy sandbox, they built in mechanisms to enable this.

You could say this is just because it’s a game console, but Sony removed “Other OS” from the PlayStation 3 years ago and Microsoft requires users to reboot into a separated “Dev Mode” to run unsigned Xbox code. It’s because breaking out of the isolated sandboxes of modern software architectures presents a huge problem. (In the case of modern consoles, unsigned code means enabling software piracy.)

Sure we gain a lot by networking all our devices and adding more features to them, but are we pausing to realize we’re also losing something in the process?

… or am I just turning into Cranky Kong? :)

Back to Blog Posts

---

---

You may also like: