Yes, I Froze an SNES for Science
Where
Game Hacking Village
DEF CON 34
Duration
40 min
Explains how component aging and temperature shift the Super Nintendo's audio clock, and why that complicates deterministic tool-assisted speedrun playback on real hardware.
Summary
The talk opens with a primer on tool-assisted speedruns, where recorded button presses are replayed on a real console. That only works if the console behaves deterministically. The Super Nintendo has two independent timing sources, a CPU crystal and a ceramic oscillator for the audio chip, and their drift can knock the handshake between processors out of step by a single frame. That changes the random number generator state, so enemies may act differently.
The speaker then describes a crowdsourced measurement effort. About 158 valid submissions, each backed by screenshots from a flash-cart tool, measured the audio sample rate against its nominal 32 kHz. The average landed near 32,076 Hz, with wide spread between individual consoles. A freezer experiment showed the rate climbing as a console warmed from below freezing to room temperature, and a tone test followed the same curve. Console-to-console variation turned out to matter more than temperature, which undercut the hotplate trick players had used to speed up runs.
The takeaway is that temperature tricks are not worth the risk for casual play, but unit-specific variance could affect tightly tuned tournament games. Efforts to derive the audio clock from the CPU clock and to tune an emulator to measured values did not give consistent playback, because reset ordering across chips was the real obstacle. The speaker suggested the same clock interplay could make a good source of randomness.
Materials
Related talks
Main Stage·18 min
Stacksmashing
Reverse-engineers a Sea-Doo jetski's diagnostic protocol and one-wire key interface to build an open-source, programmable replacement key.
Radio Frequency Village·23 min
Shows how the classic game Doom was ported to run entirely on a bladeRF software-defined radio's FPGA, with no host computer and video sent over RF.
Creator Stage·21 min
Craig Heffner
Breaks down practical software and hardware techniques for decrypting obfuscated and encrypted IoT firmware without requiring advanced cryptography math.

