Exploiting Game Boy Camera's SRAM storage to run minigames via cart swap (w/shoddy "Snek Fly" game)
(Note this hasn't been tested on a real Game Boy Color yet.)
Save files coming shortly. ^^
Concept:
Perform the cart swap glitch to run a modified version of Game Boy Camera's start up routines. In this case, I jumped straight after the OAM DMA routine and added my own. https://mirawww.glitchcity.wiki/wiki/...
The vulnerability chosen was a menu mode DA16. Invalid value 09 runs arbitrary code execution in Echo RAM F0C9. You can have this region not be changed in the setup, then add your own bootstrap code to open and run the SRAM (for purposes not just limited to minigames but perhaps swap back DLC as well).
To make your own minigames, you'll want to learn GB Programming. Example https://mirawww.glitchcity.wiki/wiki/...
And tools such as RGBDS and how to use BGB emulator. https://tcrf.net/Help:Contents/Findin...
Inspiration:
I originally intended a basic Snake game. I'm a crap programmer though that can't make anything better than a bootleg, and has a bit of a messy code structure, so the idea for the Game Boy Camera minigame to add changed to a silly excuse for a "Snake" that can Fly/go anywhere it wants (and I didn't know how to render in the limited palette), and just has to get to an egg. ^^ The moving "IN" (originally was meant to be part of "win").
There are actually a number of unused content and bugs in the Snek Fly game. Here's one: The collision is unacceptable and has to be exact with the flying IN letters (however, in the 'release', I don't even know if it works at all).
The Game Boy Camera has a lot of SRAM banks. Here is a breakdown of SRAM storage which include photo data. However, it isn't the entirety of the data; and data might also be reserved for border data, etc.
2:a000 #1
2:b000 #1
3:a000 #2
3:b000 #2
4:a000 #3
4:b000 #3
5:a000 #4
5:b000 #4
6:a000 #5
6:b000 #5
7:a000 #6
7:b000 #6
8:a000 #7
8:b000 #7
9:a000 #8
9:b000 #8
a:a000 #9
a:b000 #9
b:a000 #a
b:b000 #a
c:a000 #b
c:b000 #b
d:a000 #c
d:b000 #c
e:a000 #d
e:b000 #d
f:a000 #e
f:b000 #e
1:a000 #f
1:b000 #f
This also means theoretically Game Boy Camera dotcodes are a thing, though for this video I decided to use a more distributed portion of SRAM bank 2. In the future I'll test if you can double cart swap using dotcodes for DLC, since one idea might be to use a selection of photo dotcodes to add MissingNo. back sprites for arbitrary sprite glitch Pokémon back into the game.
Coincidentally, imablissey made a video about how to add DLC to Pokémon Ruby with custom e-Reader cards, so check them out. ^^ • I made DLC for Pokémon Ruby & Sapphire