Forums

There are some games that have the characters movement too slow such as Ashura/Secret Commando/RamboII for the SMS and Sonic Labyrinth, Tails Adventures for the GG. It is really annoying in Ashura (I can't beat the first stage) then for Sonic and Tails games, because everyone is used to play with them faster than in those games.

It's certainly possible given the skills and a bit of time.

Find the player positions in a memory viewer and then use breakpoints to try to find the code altering the position. Code could be adding a constant to the position directly or adding a velocity vector in which case you want to find how you can alter the velocity values.

It's probably that each game has an upper limit where collision or rendering would start breaking.

Thanks @Bock, I'm trying with Rambo II the first sprite tile (Rambo character) is vram $0040 (as Emullicious) then I don't know how to advance. I actually managed to move a character in my homebrew thanks to sverx's tutorial for homebrew in c and managed to use float point numbers to move the character succesfully.

The homebrew I made use a static background with no scrolling at all, that's all I know (no idea how the scrolling works), at this stage I don't know how to use Meka maybe this emulator has another features than Emullicious and viceversa. So if anyone could give some hints, that would be great.

By the way, are the player position a number between 0-256 horizontal and 0-192 vertical?? just a beginner here.

Is there a cheat search function?
You could use to find the player x, y RAM values by walking in one direction and do a cheat search every few stops (with x increasing as the player walks right, and y increasing as the player walks down, presumably).

From there you could use RAM values to find code related to movement.

I found a cheat finder option in MEKA but don't know how to use it, there is a code finder option in Kega Fusion it seems very limited and there is an ram search option for Emullicious.

First, does anyone know how to add action replay codes to Emullcious and MEKA (to activate infinite lives) ?? because I'm being interrupted by the soldiers beating me. Next I'm going to figure out what I made in my homebrew in the asm file there may be features shared between the game and my homebrew as a lesson to learn.

You can either use the Memory Tracer or RAM Search.

The following description is for Rambo - First Blood Part 2.

With the Memory Tracer you do the following:
Load the game and open the Memory Tracer from the Tools menu. In the Memory Tracer window check the Enabled checkbox. Now start the game and open the Sprite Viewer. In the Sprite Viewer point to the sprite of your character. For source hpos it tells you "ROM $1BEF (see ROM $3D9)". This means that the value for the x position of the sprite might come from ROM at the address $1BEF. But you know that the position of your character can change so the value you're interested in can't origin from ROM. In parentheses it tells you "see ROM $3D9". This points to the instruction that loads the value from the given source before it gets written to VRAM. Open the Debugger from the Tools menu, press CTRL+G and enter "3d9". The debugger will take you to the address $3D9 which is the address of the instruction that loads the value from the given source. You will find the following instructions there:

   ld a, (de)
   add a, (iy+8)
   ld (hl), a

The first one is the one pointed to by the Memory Tracer that loads the value from $1BEF in ROM. The last one writes the value somewhere to RAM (It later gets loaded from there and written to VRAM). The one in the middle is the one of interest for us. It adds a value to the value previously loaded from ROM. There's a good chance that this is the actual X coordinate of your character. Now double-click the line in the middle. A red dot will appear next to the line. This indicates that emulation will get suspended when this instruction is about to get executed. Now resume the emulation by clicking the Resume menu item from the Run menu of the debugger. The game will suspend quickly and in the debugger you will see a comment saying "; Line Breakpoint hit" next to the line you've just double-clicked before. After this comment there's another comment saying "iy+8 = _RAM_C408_". This means the X coordinate of your character is most likely stored in RAM at c408.

With RAM Search you do the following:
Load the game and start it. When your character appears open the Debugger from the Tools menu. The emulation will get suspended. Now open RAM Search from the debugger's Windows menu. In there select the greater or equal button and check the Search automatically checkbox. Now Resume the emulation from the debugger's Run menu and walk to the right for a while. Now press the pause button so you won't get killed. Uncheck the Search automatically checkbox and select the smaller than button. Now unpause the game and walk to the left and pause the game again using the pause button. Then click on Search in the RAM Search window. The number of addresses should have decreased a lot now. The X coordinate of your character should be among the remaining addresses. You can now unpause the game again, walk to the left again a bit, pause the game then press the Search button again. The number of addresses might decrease again.
If there's no address left you can either Undo the last search or just reset and start over.
In the end you should have 5 addresses left c360, c362, c364, c366 and c408. One of these is the X coordinate of your character.

After you've found out that the X coordinate of your character is stored in c408 you need to find out where this value gets changed. In order to do that you need to create a watchpoint on this address. Open the Breakpoints window from the Windows menu of the debugger. In the table click the cell that says "Add Breakpoint" and enter c408. This creates a watchpoint on the address c408. As we are only interested in writes to this address you can now uncheck the Read checkbox. After you've created this watchpoint resume the emulation until it suspends again. You will notice that it won't suspend as long as you don't walk. This is because the address is not being written to as long as you don't walk. So now walk to the left or to the right and emulation should get suspended immediately. The debugger points to the following code now:

_LABEL_A23_:
   ld d, (iy+16)
   ld e, (iy+17)
_LABEL_A29_:
   ld h, (iy+8)
   ld l, (iy+9)
   add hl, de
   ld (iy+8), h
   ld (iy+9), l
   ret

The arrow in the left ruler that indicates the current instruction now points to the instruction

ld (iy+8), h

This is where the write to c408 takes place. The instruction writes the value of register h into c408. In the line directly above this line we can see that hl is calculated as hl + de. Looking at the other preceding instructions we can see that h is loaded from (iy+8). We know that iy+8 points to the X coordinate of the character so the new X coordinate is calculate from the old X coordinate and iy+16/17. So iy+16/17 must be the velocity on the X axis. Next to these instructions we can see iy+16 = _RAM_C410_ and iy+17 = _RAM_C411_. Now we are interested in where these addresses get written to so we add a watchpoint with address "c410..c411" on write. Now resume the emulation again and walk a bit until the emulation suspends again. Open the Memory Tracer and in the RAM tab look for c410. It says "C410 <- ROM $146E (see ROM $146D)" if you walked left or "C410 <- ROM $14A0 (see ROM $149F)" if you walked right. So the value of c410 comes from ROM at $149f and $146e. In the debugger press CTRL+G and enter 149f. Right-click the $00 in the selected line and choose "Select in Memory Editor" from the menu that just popped up. No change the 00 in the Memory Editor to 01 or whatever you want to try. For walking left you change the FF at 146e to FE or whatever you want to try.

Now you can remove your breakpoints and enjoy more speed on the X axis.

In other games it might be simpler to achieve.

Thank you very much @Calindro you reaaally rock!!! The game is really enjoyable and feel happy to be the first ones to play it like this now. I tried to find the ram c408 in RAM Search but I couldn't and got lost but I'm going to do my best to figure out what you've done, maybe I checked other options and messed the results.

size =1
type=unsigned
X old value

Since this is a romhack maybe is not possible to make a ram hack and obtain a pro action replay code after all, I think the best would be make the same for diagonal (horizontal speed only) and to keep the vertical speed, I'm going to give a try to this game and another ones, thanks again.

EDIT:
Here it is a patch, the credit goes to Calindro :)

Rambo - First Blood Part 2 (UE) [!].ips (20 B)

Author	Message
FeRcHuLeS Joined: 22 Mar 2015 Posts: 228	Increase the movement speed by ram hacking, possible?? Posted: Thu Jan 26, 2017 3:59 pm
FeRcHuLeS Joined: 22 Mar 2015 Posts: 228	There are some games that have the characters movement too slow such as Ashura/Secret Commando/RamboII for the SMS and Sonic Labyrinth, Tails Adventures for the GG. It is really annoying in Ashura (I can't beat the first stage) then for Sonic and Tails games, because everyone is used to play with them faster than in those games.

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Thu Jan 26, 2017 4:46 pm
	It's certainly possible given the skills and a bit of time. Find the player positions in a memory viewer and then use breakpoints to try to find the code altering the position. Code could be adding a constant to the position directly or adding a velocity vector in which case you want to find how you can alter the velocity values. It's probably that each game has an upper limit where collision or rendering would start breaking.

FeRcHuLeS Joined: 22 Mar 2015 Posts: 228	Posted: Thu Jan 26, 2017 7:01 pm
FeRcHuLeS Joined: 22 Mar 2015 Posts: 228	Thanks @Bock, I'm trying with Rambo II the first sprite tile (Rambo character) is vram $0040 (as Emullicious) then I don't know how to advance. I actually managed to move a character in my homebrew thanks to sverx's tutorial for homebrew in c and managed to use float point numbers to move the character succesfully. The homebrew I made use a static background with no scrolling at all, that's all I know (no idea how the scrolling works), at this stage I don't know how to use Meka maybe this emulator has another features than Emullicious and viceversa. So if anyone could give some hints, that would be great. By the way, are the player position a number between 0-256 horizontal and 0-192 vertical?? just a beginner here.

KingMike Joined: 14 Oct 2008 Posts: 513	Posted: Thu Jan 26, 2017 7:53 pm
KingMike Joined: 14 Oct 2008 Posts: 513	Is there a cheat search function? You could use to find the player x, y RAM values by walking in one direction and do a cheat search every few stops (with x increasing as the player walks right, and y increasing as the player walks down, presumably). From there you could use RAM values to find code related to movement.

FeRcHuLeS Joined: 22 Mar 2015 Posts: 228	Posted: Thu Jan 26, 2017 11:07 pm
FeRcHuLeS Joined: 22 Mar 2015 Posts: 228	I found a cheat finder option in MEKA but don't know how to use it, there is a code finder option in Kega Fusion it seems very limited and there is an ram search option for Emullicious. First, does anyone know how to add action replay codes to Emullcious and MEKA (to activate infinite lives) ?? because I'm being interrupted by the soldiers beating me. Next I'm going to figure out what I made in my homebrew in the asm file there may be features shared between the game and my homebrew as a lesson to learn.

Calindro Joined: 14 Apr 2013 Posts: 624	Posted: Thu Jan 26, 2017 11:38 pm
Calindro Joined: 14 Apr 2013 Posts: 624	You can either use the Memory Tracer or RAM Search. The following description is for Rambo - First Blood Part 2. With the Memory Tracer you do the following: Load the game and open the Memory Tracer from the Tools menu. In the Memory Tracer window check the Enabled checkbox. Now start the game and open the Sprite Viewer. In the Sprite Viewer point to the sprite of your character. For source hpos it tells you "ROM $1BEF (see ROM $3D9)". This means that the value for the x position of the sprite might come from ROM at the address $1BEF. But you know that the position of your character can change so the value you're interested in can't origin from ROM. In parentheses it tells you "see ROM $3D9". This points to the instruction that loads the value from the given source before it gets written to VRAM. Open the Debugger from the Tools menu, press CTRL+G and enter "3d9". The debugger will take you to the address $3D9 which is the address of the instruction that loads the value from the given source. You will find the following instructions there: ld a, (de) add a, (iy+8) ld (hl), a The first one is the one pointed to by the Memory Tracer that loads the value from $1BEF in ROM. The last one writes the value somewhere to RAM (It later gets loaded from there and written to VRAM). The one in the middle is the one of interest for us. It adds a value to the value previously loaded from ROM. There's a good chance that this is the actual X coordinate of your character. Now double-click the line in the middle. A red dot will appear next to the line. This indicates that emulation will get suspended when this instruction is about to get executed. Now resume the emulation by clicking the Resume menu item from the Run menu of the debugger. The game will suspend quickly and in the debugger you will see a comment saying "; Line Breakpoint hit" next to the line you've just double-clicked before. After this comment there's another comment saying "iy+8 = _RAM_C408_". This means the X coordinate of your character is most likely stored in RAM at c408. With RAM Search you do the following: Load the game and start it. When your character appears open the Debugger from the Tools menu. The emulation will get suspended. Now open RAM Search from the debugger's Windows menu. In there select the greater or equal button and check the Search automatically checkbox. Now Resume the emulation from the debugger's Run menu and walk to the right for a while. Now press the pause button so you won't get killed. Uncheck the Search automatically checkbox and select the smaller than button. Now unpause the game and walk to the left and pause the game again using the pause button. Then click on Search in the RAM Search window. The number of addresses should have decreased a lot now. The X coordinate of your character should be among the remaining addresses. You can now unpause the game again, walk to the left again a bit, pause the game then press the Search button again. The number of addresses might decrease again. If there's no address left you can either Undo the last search or just reset and start over. In the end you should have 5 addresses left c360, c362, c364, c366 and c408. One of these is the X coordinate of your character. After you've found out that the X coordinate of your character is stored in c408 you need to find out where this value gets changed. In order to do that you need to create a watchpoint on this address. Open the Breakpoints window from the Windows menu of the debugger. In the table click the cell that says "Add Breakpoint" and enter c408. This creates a watchpoint on the address c408. As we are only interested in writes to this address you can now uncheck the Read checkbox. After you've created this watchpoint resume the emulation until it suspends again. You will notice that it won't suspend as long as you don't walk. This is because the address is not being written to as long as you don't walk. So now walk to the left or to the right and emulation should get suspended immediately. The debugger points to the following code now: _LABEL_A23_: ld d, (iy+16) ld e, (iy+17) _LABEL_A29_: ld h, (iy+8) ld l, (iy+9) add hl, de ld (iy+8), h ld (iy+9), l ret The arrow in the left ruler that indicates the current instruction now points to the instruction ld (iy+8), h This is where the write to c408 takes place. The instruction writes the value of register h into c408. In the line directly above this line we can see that hl is calculated as hl + de. Looking at the other preceding instructions we can see that h is loaded from (iy+8). We know that iy+8 points to the X coordinate of the character so the new X coordinate is calculate from the old X coordinate and iy+16/17. So iy+16/17 must be the velocity on the X axis. Next to these instructions we can see iy+16 = _RAM_C410_ and iy+17 = _RAM_C411_. Now we are interested in where these addresses get written to so we add a watchpoint with address "c410..c411" on write. Now resume the emulation again and walk a bit until the emulation suspends again. Open the Memory Tracer and in the RAM tab look for c410. It says "C410 <- ROM $146E (see ROM $146D)" if you walked left or "C410 <- ROM $14A0 (see ROM $149F)" if you walked right. So the value of c410 comes from ROM at $149f and $146e. In the debugger press CTRL+G and enter 149f. Right-click the $00 in the selected line and choose "Select in Memory Editor" from the menu that just popped up. No change the 00 in the Memory Editor to 01 or whatever you want to try. For walking left you change the FF at 146e to FE or whatever you want to try. Now you can remove your breakpoints and enjoy more speed on the X axis. In other games it might be simpler to achieve.

FeRcHuLeS Joined: 22 Mar 2015 Posts: 228	Posted: Fri Jan 27, 2017 1:36 am
FeRcHuLeS Joined: 22 Mar 2015 Posts: 228	Thank you very much @Calindro you reaaally rock!!! The game is really enjoyable and feel happy to be the first ones to play it like this now. I tried to find the ram c408 in RAM Search but I couldn't and got lost but I'm going to do my best to figure out what you've done, maybe I checked other options and messed the results. size =1 type=unsigned X old value Since this is a romhack maybe is not possible to make a ram hack and obtain a pro action replay code after all, I think the best would be make the same for diagonal (horizontal speed only) and to keep the vertical speed, I'm going to give a try to this game and another ones, thanks again. EDIT: Here it is a patch, the credit goes to Calindro :) Rambo - First Blood Part 2 (UE) [!].ips (20 B)

Forums

View topic - Increase the movement speed by ram hacking, possible??