+  RHDN Forum Archive
|-+  Romhacking
| |-+  ROM Hacking Discussion
| | |-+  Menu Compression.
Pages: 1 2 3 [4] 5 6 ... 10
Author Topic: Menu Compression.  (Read 5 times)
ded302
Guest
« Reply #45 on: June 14, 2007, 01:31:52 pm »

I hate to tell this but, I accidentally overwrote the log file that had that error in it.

Ill make another attempt at getting this to work after I get home from work tonight.  If it dont work, ill post up my trace log file.
« Last Edit: June 14, 2007, 02:13:47 pm by ded302 »
Nightcrawler
Guest
« Reply #46 on: June 14, 2007, 06:20:21 pm »

Quote from: ded302 on June 14, 2007, 11:58:57 am
I used my debugger to see what was going on with the code.  In the trace log file, the rom halted at the jump.  How do I get the address that goes in the jump instruction that points to that new code?

You tell it where you put your code. Wink You picked some free space, right? Where did you put your code? Take that address and put it in the jump statement. And yeah, if you've left the bank, you will have to swap banks.
ded302
Guest
« Reply #47 on: June 15, 2007, 12:00:24 am »

Ok, I put the code in free space marked by ff's and know that the code is in 2 different banks.  How do I swap banks?
RedComet
Guest
« Reply #48 on: June 15, 2007, 12:12:03 am »

Depends on the mapper.
ded302
Guest
« Reply #49 on: June 15, 2007, 12:42:03 am »

I found out that Steds mapper in an mmc1 and I'll go look for an mmc1 document that will tell me how to bankswap.
KingMike
Guest
« Reply #50 on: June 15, 2007, 11:38:15 am »

MMC1 is frustrating. I'll just give the program-ROM switching part, since that's what you're interested in.
MMC1 can use 16KB banks (most common) or 32KB (haven't seen it before).

To change a register for MMC1, you have to write a 5-bit value to any value within a certain address range (the last byte of the range seems to be most common). Also, you must write each bit seperately.
You'll probably use just the $E000-FFFF range (which swaps PRG banks).
To write the 5-bit value
LDA $value (actually, it seems you can only use a 4-bit value (00-0F), for a total of 16 banks. Bit 5 seems to be undefined)
STA $offset: LSR (repeat this sequence 4 times)
STA $offset
since this space-wasting code, the game likely has a function to do it in the last program ROM bank (since it's always located at CPU address $C000-FFFF). Search a trace log for writes to $FFFF (can't recall if that was the address used, but it's the most likely).
Remember that if you begin your code from the $8000 to $BFFF range, the bank will have swapped when you return. So you'll need to continue your code from the corresponding address in the new bank.
Make sense?
ded302
Guest
« Reply #51 on: June 15, 2007, 11:58:46 am »

I appreciate the help, and I will study your post until I get it.

I have another small question.  Does the bankswap code you gave me go before the jump to the hacked code in another bank?
« Last Edit: June 18, 2007, 12:31:16 pm by ded302 »
KingMike
Guest
« Reply #52 on: June 19, 2007, 11:07:52 am »

Maybe I should give an example.

EDITED: Because I made a minor mistake in the last step.

Say I'm at $1BFF0 in the ROM file (minus the header, it's $1BFE0). $1BFE0 (rom offset) mod $4000 (bank size)= $3FE0. I need to remember that.
I have this code, and it's at CPU address $BFE0: (because $8000 + the $3FE0 from above = $BFE0)
LDA #$bank_number
JSR $C474 (I just checked a trace log. This is where the game's original bankswap routine is, CPU address $C000-FFFF is locked to the last 16KB of program ROM, so this should be $1C484 if STED has 128KB PRG. The routine assumes that the accumulator holds the value to swap.).
So, anyway, now my code is 5 bytes long (2 byte LDA, 3 byte JSR).
But while I was running the routine in the $C000-FFFF region of the CPU, the contents of $8000-BFFF changed.
The game is going to run whatever code is now at CPU address $BFE5.
So I'm going to need to continue my code at ROM offset: (bank_number) * $4000 + $3FE0 (from the first step of this example) + 5 (because I used 5 bytes for LDA and JSR instructions) + $10 (the header)
« Last Edit: June 19, 2007, 09:49:23 pm by KingMike »
ded302
Guest
« Reply #53 on: June 19, 2007, 12:56:50 pm »

Thanks for the example, and I'm not going to ask any more questions on this topic.

Acutally I do have another question.  I tried modifying the games code in a hex editor to try and cut the prices in half.  This time the game does not freeze or reset.  The code to cut the prices in half is in the same bank as the original code. When I tried going to the new code with a jsr, all I get are 1's for the prices. When I used a jmp, I get big numbers as prices.  In both attempts, I used an rts and a jmp to return from the hacked code.  I traced the file and found out that the hacked code was not being executed.
« Last Edit: June 21, 2007, 11:32:19 am by ded302 »
Nightcrawler
Guest
« Reply #54 on: June 21, 2007, 01:02:31 pm »

So... what is happening at the point of execution where it should jump to your code? That's what the debugging process is. You make a change, if it doesn't work, see what is happening and figure out why it's not doing what you intend. So, the next step is to figure out what the game is doing and why it's not going to your code by looking at the trace log. You've given us no information to go on other than it doesn't crash the game, but your code isn't being executed. We can't do much of anything with that little to go on.
ded302
Guest
« Reply #55 on: June 21, 2007, 01:33:50 pm »

If you want to help me with this, what kind of info do you need?
Nightcrawler
Guest
« Reply #56 on: June 21, 2007, 03:27:37 pm »

A log of the few instructions where your code should be executed through your code's execution to the return from it if it gets that far. Perhaps you're still not grasping this.

The ROM code executes normally to the code spot you changed. WHAT is happening when it gets to that point? The trace log of those instructions will tell you exactly that. The first instruction is obviously going to be a jump or a jump to subroutine instruction. Then it should go to the new place in code your new code is waiting. It will execute that code, then it will return back to the normally executing game code.

It's pretty simple. A log of those few instructions will tell you everything that is happening. Analyzing that tells you what is wrong and why it's not doing what you expect it to do.

But you MUST look at code that's being executed. That's debugging on a fundamental level. See what the code is doing. Based on that, figure out why it is not doing what you expect it to do.
ded302
Guest
« Reply #57 on: June 22, 2007, 12:20:11 am »

Ok, I traced the file and figured out why Im getting bogus shop prices. 

In my hex editor I have the hacked code at location
18000 - Hex editor
03/8000 in tracer.exe disasm file

and the jump to that code is at location
1B13B - Hex editor.
03/B13B - in tracer.exe disasm file

They are in the same bank.

The jump at 1b13b is jumping to the code that is 10 hex units ahead of 18000.
KingMike
Guest
« Reply #58 on: June 22, 2007, 10:09:42 am »

You should use FCEUltra XD SP's trace logger.
Press F2 to pause the emulator just before buying something. (like when you have the cursor pointing to the item)
Open the trace logger.
I'd choose to log to a file. Enter a file name.
Begin the trace logger.
Press F2 to unpause the emulator, then press the "A" button to buy the item.
When your credits change or the game crashes, stop the trace logger.
Close the emulator and check your trace log.
ded302
Guest
« Reply #59 on: June 22, 2007, 10:39:04 am »

I got it.  Heres what I did. 
Disassembled the file using tracer 6502 disassembler.
Searced through output.dis to find free space in the same bank as the shop price loading code.
Searched for my free space in a hex editor.
I typed in the shop price loading code in the free space area.
In hex I subtraced 10 from the offset where the hacked shop price loading code began.
I replaced the jump to jump to the hacked code instead of the original code.
And now the prices are halved.
« Last Edit: June 22, 2007, 11:23:10 am by ded302 »
Pages: 1 2 3 [4] 5 6 ... 10  


Powered by SMF 1.1.4 | SMF © 2006-2007, Simple Machines LLC