+  RHDN Forum Archive
|-+  Romhacking
| |-+  ROM Hacking Discussion
| | |-+  Demon's Blazon Bug/Feature
Pages: [1] 2 3
Author Topic: Demon's Blazon Bug/Feature  (Read 2 times)
DarknessSavior
Guest
« on: January 22, 2008, 01:37:34 pm »

The DB translation is almost done, the script itself is in the editing stages.

However, there is an expansion-related bug that is causing me grief. Once you get to the second boss (the Hippogryph) and bite him to start the battle, you're not able to open the inventory menu from that point on (making it so you cannot finish the game).

How do I know it's expansion related? I checked traces between the expanded and hacked version, and a plain expanded version. No differences. So I played the Japanese game with no hacks, then the Japanese expanded version. It only happens once you expand the game.

I asked around my ASM gurus first: RedComet, DaMarsMan and Gemini. DMM and Gemini said they had never heard of such a bug. RC was able to fix the first expansion-related bug (Arma was invincible, he somehow fixed that), but the second bug itself stumped him.

Quote from:  Trillian Log: Me/RC
RC: I looked at the rom, but there isn't much there
Me: So you're saying ditch the expansion and stuff?
Me: Do something like...DTE/Dictionary?
RC: the bank is copied into ram (well, $30xxxx, I think--which is typically sram) at start up

DMM also suggested to ditch the expansion and go with DTE. I do eventually need to do a DTE, but I'd rather not since I've already got everything figured out for the expansion/pointers/etc in this case. I'm hoping that one of you mad scientists of the 65816 can understand what is going on, or have encountered something like this before.

Any help would be greatly appreciated.

~DS
MathOnNapkins
Guest
« Reply #1 on: January 22, 2008, 01:47:06 pm »

an ips patch and savestate would help :/
RedComet
Guest
« Reply #2 on: January 22, 2008, 01:49:19 pm »

At start up an entire bank of ROM is loaded auto-magically into RAM. Later at certain points through out the game the data in ROM is compared to the same data in RAM. For some reason, when the ROM is expanded the ROM bank isn't copied into RAM at start up. That means when the aforementioned comparisons are performed they fail and cause the game to do all sorts of weirdness. I disabled one of these comparisons to fix the Arma invincibility bug that DS mentioned.

EDIT: MathOnNapkins, just expand the ROM to 2.5MB and check out the data in RAM at $300000 or so.
DarknessSavior
Guest
« Reply #3 on: January 22, 2008, 01:53:08 pm »

Quote from: MathOnNapkins on January 22, 2008, 01:47:06 pm
an ips patch and savestate would help :/

I haven't made an .ips yet. You don't really need one, anyway. Just download the Japanese ROM, and expand it to 3 MB (it starts out 2MB). That's what causes the inventory bug.

I can provide a savestate for the Hippogryph, though, if you really need it (it's in the intro, so it's not hard. I'll have to make a savestate in Geiger, though, if you want one, unless you feel like waiting until tomorrow.)

~DS
DaMarsMan
Guest
« Reply #4 on: January 22, 2008, 01:59:27 pm »

I don't understand why it's doing this. Can't we just keep the bank and everything the same and use 24bit addressing?
MathOnNapkins
Guest
« Reply #5 on: January 22, 2008, 02:06:26 pm »

d'oh... for some reason I thought you were talking about a later hippogryph. (There's two others, iirc)
DarknessSavior
Guest
« Reply #6 on: January 22, 2008, 02:08:06 pm »

Quote from: MathOnNapkins on January 22, 2008, 02:06:26 pm
d'oh... for some reason I thought you were talking about a later hippogryph. (There's two others, iirc)

S'alright. Yeah, there's two or three other Hippogryphs. I'm just referring to the first one ("the second boss...").

~DS
Nightcrawler
Guest
« Reply #7 on: January 22, 2008, 03:02:58 pm »

Define 'auto-magically'....
DaMarsMan
Guest
« Reply #8 on: January 22, 2008, 03:10:19 pm »

Hey Nightcrawler...Why would a rom be accessing the expanded space? The only thing I could think of is if he changed the DB right?
RedComet
Guest
« Reply #9 on: January 22, 2008, 03:13:14 pm »

Quote from: Nightcrawler on January 22, 2008, 03:02:58 pm
Define 'auto-magically'....

The bank is copied at reset on its own, i.e. there's no code moving the bank from point A to point B. It's like SRAM.
DaMarsMan
Guest
« Reply #10 on: January 22, 2008, 03:16:24 pm »

Well if a game is copying the first bank why would it copy the other instead? Does it overwrite the first one?
Nightcrawler
Guest
« Reply #11 on: January 22, 2008, 06:17:55 pm »

Quote from: RedComet on January 22, 2008, 03:13:14 pm
Quote from: Nightcrawler on January 22, 2008, 03:02:58 pm
Define 'auto-magically'....

The bank is copied at reset on its own, i.e. there's no code moving the bank from point A to point B. It's like SRAM.

So, you're trying to tell me a bank of code is copied to the 7E:XXXX or 7F:XXXX RAM range by itself at power on? I don't think that's possible. I suspect the 'RAM' you're seeing is being addressed with via a bank outside of 7E/7F which is probably not actually RAM. The game is probably simply checking mirrored ROM locations. That's my guess. I don't have the time to look at it right now though. There is just no way a ROM bank can be copied to RAM by itself.

You mentioned the $30 bank which further strengthens my suspicion. What's the exact address of the first piece of ROM code that is mysteriously in RAM? What's the exact address of 'RAM' you are reading this at?
RedComet
Guest
« Reply #12 on: January 22, 2008, 06:37:09 pm »

Code:
$BE/E3C1 E2 30       SEP #$30                A:F5E9 X:0000 Y:0000 D:1300 DB:81 S:0135 P:eNvmxdizcHC:1088 VC:252 00 FL:25
$BE/E3C3 AF C1 FF 80 LDA $80FFC1[$80:FFC1]   A:F5E9 X:0000 Y:0000 D:1300 DB:81 S:0135 P:eNvMXdizcHC:1106 VC:252 00 FL:25
$BE/E3C7 CF C1 FF 40 CMP $40FFC1[$40:FFC1]   A:F565 X:0000 Y:0000 D:1300 DB:81 S:0135 P:envMXdizcHC:1136 VC:252 00 FL:25
$BE/E3CB F0 06       BEQ $06    [$E3D3]      A:F565 X:0000 Y:0000 D:1300 DB:81 S:0135 P:envMXdizCHC:1168 VC:252 00 FL:25

If I check out the value at $40FFC1 in the Japanese ROM, it's $65. If I check that same address after I've expanded the ROM, it's $00, though $80FFC1 is still $65. Hope that clarifies the problem a bit better.
DaMarsMan
Guest
« Reply #13 on: January 22, 2008, 06:48:14 pm »

Ahh not so automatic now. I would do a trace of the beginning and just convert all the opcodes to the proper addressing.
Nightcrawler
Guest
« Reply #14 on: January 23, 2008, 11:03:45 am »

Quote from: RedComet on January 22, 2008, 06:37:09 pm
Code:
$BE/E3C1 E2 30       SEP #$30                A:F5E9 X:0000 Y:0000 D:1300 DB:81 S:0135 P:eNvmxdizcHC:1088 VC:252 00 FL:25
$BE/E3C3 AF C1 FF 80 LDA $80FFC1[$80:FFC1]   A:F5E9 X:0000 Y:0000 D:1300 DB:81 S:0135 P:eNvMXdizcHC:1106 VC:252 00 FL:25
$BE/E3C7 CF C1 FF 40 CMP $40FFC1[$40:FFC1]   A:F565 X:0000 Y:0000 D:1300 DB:81 S:0135 P:envMXdizcHC:1136 VC:252 00 FL:25
$BE/E3CB F0 06       BEQ $06    [$E3D3]      A:F565 X:0000 Y:0000 D:1300 DB:81 S:0135 P:envMXdizCHC:1168 VC:252 00 FL:25

If I check out the value at $40FFC1 in the Japanese ROM, it's $65. If I check that same address after I've expanded the ROM, it's $00, though $80FFC1 is still $65. Hope that clarifies the problem a bit better.

Nightcrawler shoots and scores!  Smiley

Exactly. That's because $40:FFC1 is mapped to ROM, not RAM. It's doing exactly what I suspected. It's checking mirrored locations. According to my understanding of the the LoROM mapping model for Mode20 ROMs, bank $40 will shadow $C0 or default to the A bus. In the original ROM, there's no ROM in the traditional sense to map there because it's too small. The cart doesn't respond, and it in turn just accesses the A bus which is the equivalent of 00:FFC1 OR $80:FFC1 (And other locations, but we won't get into that).

Now when you expand the ROM, you DO have enough ROM to map to bank $40/$C0 and the cart (theoretical new cart) would respond. NOW.. $40:FFC1 is actually the same as address $C0:FFC1. Anomie could probably explain it more elegantly, but you get the picture.

Understand what's happening here? The game code as is simply will not work with an expanded ROM. I'd guess this check was either put in as some sort of copier protection (I'd imagine some copiers probably wouldn't have the correct addressing either) or hack protection (but I doubt that was an issue back then).

You need to either hack those instructions or work within the confines of the original ROM. Alternatively, you can 'trick' it by sticking the '65' in the expanded spot $C0:FFC1. That's all there is to it. 
« Last Edit: January 23, 2008, 11:09:14 am by Nightcrawler »
Pages: [1] 2 3  


Powered by SMF 1.1.4 | SMF © 2006-2007, Simple Machines LLC