RHDN Forum Archive - Looking for Simon's Quest data

Code:

Name: Castlevania II: Simon's Quest
Document title: Data log, notes and hacking guide
Author: TFG (palacios_barreda@yahoo.com.mx)

Disclaimer
----------

I won't bother organizing this document into a nifty tidy format. It contains all my
hacking-related findings, looking forward to code a full fledged editor. Any questions,
comments, whatever... drop me a line.

Have fun,
TFG.

Day/Night system & Game clock
-----------------------------

Minutes: 0-59
Hours: 0-23
Days: 0-99

00 06 18 24
|------------------------------------|
* *
Day/night toggles occur at 6hr & 18hr

Toogle marks (hr): 06, 18

$82 - Switch ($00=day, $01=night)
$83 - Days, decimal.
$84 - Seconds, hex.
$85 - Minutes, decimal.
$86 - Hours, decimal.
$87 - Counter ($30, $20, $10, $F0, $10, $20, $30)

Adjust the clock to a real rate
-------------------------------

ROM 1D795 -> Adjust minute length

In-game Menu
------------

Original
################
# #
# T- DD:HH:MM #
# E-0000 L- 00 #
# H-0000 #
#--------------#
# L. WHIP #
#--------------#
# #
# #
#--------------#
# #
# #
# #
# #
################

Hearts
------

$48 - 4 digit decimal counter

Text
----

Description | Offset (iNES)
------------------------------
Text block #1 | $CC84
Text block #2 | $1C965
Title screen #1 | $10169
Title screen #2 | $10368
Title screen #3 | $139FD
Password screen #1 | $137C4

Refer to CV2.TBL for details.

RAM Map
-------
$000 -
$001 -
$004 - Controller #1 full status
$005 - Controller #2 full status
$013 - Whip damage
$022 - X Screen pointer during PPU write ops
$093 - Used in number-to-gfx operations
$0FC - Scrolling
$0FD - Scrolling
$0FE - PPU $2001
$0FF - PPU $2002
$100 - MMC1, Register #1
$101 - MMC1, Register #2
$102 - MMC1, Register #3
$197 - Laurel effect != 0
$200 - Sprite data for DMA transfers
$4CX - Enemies's HP
$34X - Enemies' X location
$700 - On screen data (BG)

Bosses
------

Grim reaper
-----------

ROM 5CE1 -> Max health
RAM 04C8 -> Current health

$C081:20 83 C1 JSR $C183 ; Mapper setup? ROM swapping.
$C084:20 C5 AB JSR $ABC5 ; Sprites (Attributes)
$C087:20 A7 C1 JSR $C1A7 ; Sprites (X,Y)
$C08A:20 8A C8 JSR $C88A ; BG

$AC1E:A9 F4 LDA #$F4
$AC20:9D 00 02 STA $0200,X @ $025C = #$F4
$AC23:8A TXA
$AC24:18 CLC
$AC25:69 C4 ADC #$C4
$AC27:C5 16 CMP $16 = #$4C ; $16 holds the beginning of GR's data block
$AC29:90 F9 BCC $AC24
$AC2B:AA TAX
$AC2C:88 DEY
$AC2D:10 EF BPL $AC1E
$AC2F:60 RTS

NMI
---

$C046:48 PHA
$C047:8A TXA
$C048:48 PHA
$C049:98 TYA
$C04A:48 PHA ; Push registers into stack
$C04B:AD 02 20 LDA $2002 ; Clear the VBlank bit to prevent recursive calls
$C04E:A9 00 LDA #$00 ; Clear out SPR-RAM address (useless shit!)
$C050:8D 03 20 STA $2003 ;
$C053:A0 02 LDY #$02 ;
$C055:8C 14 40 STY $4014 ; Do a DMA transfer to SPR-RAM from $200
$C058:A4 1A LDY $1A ;
$C05A:D0 3B BNE $C097 ;
$C05C:E6 1A INC $1A ;
$C05E:20 D8 C0 JSR $C0D8 ; Clear out PPU settings
$C061:20 69 CB JSR $CB69 ; PPU initial setup
$C064:A5 FE LDA $FE ; PPU $2001
$C066:A6 21 LDX $21 ; ???
$C068:F0 06 BEQ $C070 ;
$C06A:C6 21 DEC $21 ;
$C06C:F0 02 BEQ $C070 ;
$C06E:A9 00 LDA #$00 ;
$C070:8D 01 20 STA $2001 ;
$C073:20 40 C1 JSR $C140 ; MMC1 setup
$C076:20 B8 C0 JSR $C0B8 ; PPU setup for Name table #1 writing (BG, Level data)
$C079:20 FB C0 JSR $C0FB ; Load screen's track [music]
$C07C:20 53 C4 JSR $C453 ; Process input [controllers]
$C07F:A9 00 LDA #$00 ;
$C081:20 83 C1 JSR $C183 ; Bankswapping bullshit
$C084:20 C5 AB JSR $ABC5 ; Update enemies
$C087:20 A7 C1 JSR $C1A7 ; More enemy stuff
$C08A:20 8A C8 JSR $C88A ; BG related, updates the X pointer for scroling operations ($22)
$C08D:A9 00 LDA #$00 ;
$C08F:85 1A STA $1A ;
$C091:68 PLA ;
$C092:A8 TAY ;
$C093:68 PLA ;
$C094:AA TAX ;
$C095:68 PLA ; Restore registers
$C096:40 RTI ; Return to normal code execution
$C097:20 FB C0 JSR $C0FB
$C09A:4C 91 C0 JMP $C091

Input processing @ $C453
------------------------

$C453:A2 00 LDX #$00 ;
$C455:20 8A C4 JSR $C48A ; Read & store controller input in RAM

$C48A:A0 01 LDY #$01 ;
$C48C:8C 16 40 STY $4016 ;
$C48F:88 DEY ;
$C490:8C 16 40 STY $4016 ; Strobe the pad before reading
$C493:A0 08 LDY #$08 ;
$C495:AD 16 40 LDA $4016 ; Read controller #1
$C498:85 04 STA $04 ;
$C49A:4A LSR ;
$C49B:05 04 ORA $04 ;
$C49D:4A LSR ;
$C49E:36 00 ROL $00,X ; Save data, bit by bit.
$C4A0:AD 17 40 LDA $4017 ; Read controller #2
$C4A3:85 05 STA $05 ;
$C4A5:4A LSR ;
$C4A6:05 05 ORA $05 ;
$C4A8:4A LSR ;
$C4A9:36 01 ROL $01,X ; Save data, bit by bit.
$C4AB:88 DEY ;
$C4AC:D0 E7 BNE $C495 ;
$C4AE:60 RTS ;

$C458:A2 02 LDX #$02 ; Read the controllers again
$C45A:20 8A C4 JSR $C48A ; to do a fail-safe check against buggy reads.
$C45D:A5 00 LDA $00 ;
$C45F:C5 02 CMP $02 ;
$C461:D0 1C BNE $C47F ;
$C463:A5 01 LDA $01 ;
$C465:C5 03 CMP $03 ; Compare the 2 reads, if they're different
$C467:D0 16 BNE $C47F ; branch out of the routine. Zeroing both controllers.
$C469:A2 00 LDX #$00 ;
$C46B:20 6F C4 JSR $C46F ;
$C46E:E8 INX ;
$C46F:B5 00 LDA $00,X ;
$C471:A8 TAY ;
$C472:55 F1 EOR $F1,X ;
$C474:35 00 AND $00,X ;
$C476:95 F5 STA $F5,X ;
$C478:95 F3 STA $F3,X ;
$C47A:94 F7 STY $F7,X ;
$C47C:94 F1 STY $F1,X ;
$C47E:60 RTS ;

$C47F:A9 00 LDA #$00 ; Clear out controller and
$C481:85 F5 STA $F5 ; return to NMI.
$C483:85 F3 STA $F3 ;
$C485:85 F6 STA $F6 ;
$C487:85 F4 STA $F4 ;
$C489:60 RTS ;

Notes
-----

608Dh Enemies?

Code:

Game: Castlevania II: Simon's Quest
Document title: Level data and related routines
Author: TFG (palacios_barreda@yahoo.com.mx)

Simon's location
----------------

Palette data pointer table
--------------------------

Stored in Bank 7 @ $C895

The game reads the pointer using a previsouly stored index in the X register:

$C83D:BD 95 C8 LDA $C895,X
$C840:85 00 STA $0000
$C842:BD 96 C8 LDA $C896,X
$C845:85 01 STA $0001

$C7D8:B9 C5 F7 LDA $F7C5,Y @ $F7ED = #$E9
$C7DB:85 00 STA $0000 = #$72
$C7DD:B9 C6 F7 LDA $F7C6,Y @ $F7EE = #$FB
$C7E0:85 01 STA $0001 = #$80
$C7E2:A5 50 LDA $0050 = #$0A
$C7E4:0A ASL
$C7E5:0A ASL
$C7E6:A8 TAY
$C7E7:A5 82 LDA DayNight_Toggle = #$00
$C7E9:F0 02 BEQ $C7ED
$C7EB:C8 INY
$C7EC:C8 INY
$C7ED:B1 00 LDA ($00),Y @ $809A = #$B6
$C7EF:85 08 STA $0008 = #$60
$C7F1:C8 INY
$C7F2:B1 00 LDA ($00),Y @ $809A = #$B6
$C7F4:85 09 STA $0009 = #$B1
$C7F6:A5 51 LDA $0051 = #$00
$C7F8:29 7F AND #$7F
$C7FA:0A ASL
$C7FB:A8 TAY
$C7FC:60 RTS

Code:

@@@@@
Music

1EB1: Beginning of Game Start song.

BX is kick bass, AX is snare drum.

Tempo > Instrument > ? > ? > ? > ?

Note, Tempo,Octave and repeats are the same as CV1.

FE is repeat. Next values is how many times.

FEFF followed by a two byte pointer is "Repeat Forever", End of Track.

@@@
AsM

1D7A4: 20 CA D7 = JSR to Day/Night Counter Check

1D7A4: EAEA60 = Never turn night.

1D7A8: Counter value for change. Value x 4 seconds (00 is simply 4 second Day/Night)

1D7F8: Holy Water routine?

E26 - 1219: Town Song

41A2: EAEA makespeople vanish.

-$4010 = RAM

C903/$88F3: Jump Height Routine (Lower is higher)

$90: Currently Selected Sub Weapon

$91:Body Parts + Orbs, etc

$4A: Sub Weapons?

$4F: Currently Selected Part/Orb

$F1: Current Input

$80 = Health

$434: Whip Type

1FEF0: Free Space

DD10: Free Space (In Range of Jump routine: $9D00)

@@@@@@@@@@@@@@@@@@@@@@@
Checking For Orb

$85FE:A5 4F LDA $004F = #$01
$8600:C9 06 CMP #$06
$8602:F0 07 BEQ $860B
$8604:BD C6 03 LDA $03C6,X @ $03CC = #$20
$8607:09 20 ORA #$20
$8609:D0 05 BNE $8610
$860B:BD C6 03 LDA $03C6,X @ $03CC = #$20
$860E:29 DF AND #$DF
$8610:9D C6 03 STA $03C6,X @ $03CC = #$20
$8613:4C BB 85 JMP $85BB

@@@@@@@@@@@
Holy Water?

$D7E8:A5 90 LDA $90 = #$04
$D7EA:9D B4 03 STA $03B4,X @ $03B7 = #$00
$D7ED:A9 00 LDA #$00
$D7EF:9D C2 04 STA $04C2,X @ $04C5 = #$00
$D7F2:9D C6 03 STA $03C6,X @ $03C9 = #$00
$D7F5:A9 82 LDA #$82
$D7F7:9D D8 03 STA $03D8,X @ $03DB = #$00
$D7FA:AD 20 04 LDA $0420 = #$01
$D7FD:9D 20 04 STA $0420,X @ $0423 = #$00
$D800:AD 48 03 LDA $0348 = #$AE
$D803:9D 48 03 STA $0348,X @ $034B = #$00
$D806:AD 24 03 LDA $0324 = #$BD
$D809:9D 24 03 STA $0324,X @ $0327 = #$00
$D80C:60 RTS

@@@@@@@@@@@
Checking for Eye
$8354:BD 44 04 LDA $0444,X @ $044A = #$00
$8357:D0 10 BNE $8369
$8359:BD C6 03 LDA $03C6,X @ $03CC = #$00
$835C:29 F7 AND #$F7
$835E:A4 4F LDY $004F = #$03
$8360:C0 03 CPY #$03
$8362:F0 02 BEQ $8366
$8364:09 08 ORA #$08
$8366:9D C6 03 STA $03C6,X @ $03CC = #$00
$8369:4C 2A DD JMP $DD2A

@@@@@@@@@@@@@@
Damage Writing

$D354:85 08 STA $0008 = #$08
$D356:A5 80 LDA $0080 = #$30
$D358:38 SEC
$D359:E5 08 SBC $0008 = #$08
$D35B:B0 02 BCS $D35F
$D35D:A9 00 LDA #$00
$D35F:85 80 STA $0080 = #$30
$D361:60 RTS

$$$$$$$
$HACKS$
$$$$$$$

###################
Make Item High Jump

Hook: C904 - 20009DEA

Routine: DD1D - A000 A54F C905 F003 A9FC60 A9FA60
| |
Item Binding New Jump Height

B Action

20 2F D8: Subweapon Routine
4C 55 DB: Whip Routine

00:81E4:A2 00 LDX #$00
00:81E6:4C 2A DD JMP $DD2A <-- True Whip?

Subweapon Routine
A5 90: Load Subweapon ID
20 BB C5: Go to main Routine.

Whip Routine:

00:8943:4C 55 DB JMP $DB55 <--- Now that we've determined Up+B hasn't been pressed, Whip It!

DD20: Free space

00:DB55:A9 0A LDA #$0A <--- Huh.
00:DB57:AC 34 04 LDY $0434 = #$02 <--- Check Whip Type
00:DB5A:C0 02 CPY #$02 <--- See if it's the Chain Whip
00:DB5C:90 0B BCC $DB69 <---- If it's not, branch.
00:DB5E:C0 04 CPY #$04 <--- See if it's the flame whip.
00:DB60:D0 05 BNE $DB67 <---- Branch if it's not.
00:DB62:A9 0F LDA #$0F <--- Huh.
00:DB64:4C 69 DB JMP $DB69 <---- Flame Whip Routine?
00:DB67:A9 0E LDA #$0E
00:DB69:20 18 C1 JSR $C118 <--- Leather/Thorn/Chain/Morningstar?
00:DB6C:A9 80 LDA #$80
00:DB6E:8D EA 03 STA $03EA = #$80
00:DB71:A9 FF LDA #$FF
00:DB73:8D B5 03 STA $03B5 = #$00
00:DB76:60 RTS

20E8D7 <---Knife?

Checking Types
00:D8D6:A5 90 LDA $0090 = #$02
00:D8D8:C9 03 CMP #$03
00:D8DA:D0 04 BNE $D8E0
00:D8DC:A9 02 LDA #$02
00:D8DE:D0 02 BNE $D8E2
00:D8E0:A9 01 LDA #$01
00:D8E2:20 56 D8 JSR $D856 <-- Knife?
00:D8E5:20 E8 D7 JSR $D7E8
00:D8E8:A0 00 LDY #$00
00:D8EA:A5 90 LDA $0090 = #$02
00:D8EC:C9 02 CMP #$02
00:D8EE:D0 02 BNE $D8F2
00:D8F0:A0 40 LDY #$40
00:D8F2:A9 02 LDA #$02
00:D8F4:20 4F E0 JSR $E04F
00:D8F7:20 8A DF JSR $DF8A
00:D8FA:A5 90 LDA $0090 = #$02
00:D8FC:C9 01 CMP #$01
00:D8FE:D0 05 BNE $D905
00:D900:A9 20 LDA #$20
00:D902:9D 9E 04 STA $049E,X @ $04A1 = #$00
00:D905:A5 90 LDA $0090 = #$02
00:D907:C9 03 CMP #$03
00:D909:D0 05 BNE $D910
00:D90B:A9 13 LDA #$13
00:D90D:4C 12 D9 JMP $D912
00:D910:A9 11 LDA #$11
00:D912:20 18 C1 JSR $C118
00:D915:A9 32 LDA #$32
00:D917:4C 2A D8 JMP $D82A
00:D91A:A5 4C LDA $004C = #$00
00:D91C:D0 03 BNE $D921

Code:

$0013#WhipDamage#
$0048#dHearts#Decimal
$0049#cHearts#Decimal
$0082#DayNight_Toggle#
$0083#Clock_days#Decimal
$001A#NMI_Flag#If set, NMI exits right away.
$0022#VRAM_BW_Index#
$0084#Clock_seconds#Hexadecimal
$0085#Clock_minutes#Decimal
$0086#Clock_hours#Decimal
$00FC#PPU_Vt_Scrolling#
$00FD#PPU_Hz_Scrolling#
$00FF#PPU_CtrlReg1_Mirror#
$0100#MMC1_Conf0_Mirror#
$0101#MMC1_Conf1_Mirror#
$0102#MMC1_Conf2_Mirror#
$0103#MMC1_Bank3_Mirror#
$0197#LaurelActive#Non-zero activates laurel
$0200/FF#SPR-RAM_Mirror#Used in DMA transfers
$0324#YCoord_Simon#
$032A#YCoord_Screen#
$0348#XCoord_Simon#
$034E#XCoord_Screen#
$0700/FF#VRAM_Bulk_Writes#
$2000#PPU_ControlRegister1#
$2001#PPU_ControlRegister2#
$2002#PPU_StatusRegister#
$2003#SPR_AddressRegister#
$2004#SPR_InputOutput#
$2005#PPU_Scrolling#
$2006#PPU_Address#
$2007#PPU_InputOutput#
$4014#PPU_SpriteDMA#
$4016#Joypad1#
$4017#Joypad2#
$8000#MMC1_Conf0#
$BFFF#MMC1_Conf1#
$C000#MMC1_Conf2#
$FFFF#MMC1_Bank#
$C895/01#BGPalettes_PtrTbl#
$C82E#LoadPalette_Init#Initializes VRAM Bulk write buffer. Parameters: A = palette index
$C046#NMI#Non-maskable interrupt
$C0D8#ResetPPU#
$C183#MMC1_LoadBank#Parameters: A = bank #
$C140#MMC1_Setup#
$C0B8#VRAM_Setup_NameTable0#
$C7FD#LoadAreaPalettes#Series of calls that load several palettes, corresponding to a new area.
$C88C#Write_to_VRAM_BW#Parameters: A = value
$C839#LoadPalette_NoInit#Parameters: A = palette index
$C453#ReadControllers#
$CB69#VRAM_BulkWrite#Writes data to VRAM using the following format:
\\[PPU-Reg1 Settings] [VRAM Address] [DATA] [#FF]
\\[#FF] [#00] indicates end of stream.
\\The data is read from $700-$7FF