A security engineer has adapted one of the most well-known password recovery utilities, Hashcat, for the Game Boy Advance. The project, dubbed GBA-Hashcat, utilizes the 21-year-old Nintendo handheld's 16.78 MHz ARM7TDMI chip to perform SHA256 hashes.
Project developer Mark El-Khoury humorously noted on LinkedIn that the Game Boy Advance can achieve approximately 727 SHA256 hashes per second. This performance is roughly thirty million times slower than a modern cracking rig, which can complete the same task in about a second using GPU acceleration. El-Khoury jokingly described the endeavor on GitHub as both "The greatest password cracking of all time" and his "dumbest app of all time."
The GBA-Hashcat implementation is built using the Butano engine, allowing development in C++. However, unlike the full Hashcat, which supports numerous attack methods and over 300 hash algorithms, GBA-Hashcat is limited to checking a single, hardcoded wordlist against a fixed SHA256 target hash. The process involves generating the SHA256 hash of each word in the list and comparing it to the target hash to identify a match, which would then reveal the plaintext password.
This unusual porting effort is part of a recent trend of developers repurposing older gaming hardware for unexpected functionalities. In April, a modder created a Game Boy Color smartwatch, and another developer built an E-Ink Game Boy emulator with a playable refresh rate. These projects highlight the continued engagement with and creativity surrounding vintage gaming consoles.