SMS Power!

MEKA :: RE: Cheatfinder - how to use it?

hang-on — Sun, 19 May 2013 18:56:16 GMT

Author: hang-on
Posted: Sun May 19, 2013 6:56 pm (GMT 0)

OK - there's also some blocks of ff's in the vicinity. I will play through the patched game soon and check that everything is okay. If I encounter faulty graphics etc., I will move my code to the ff's. Thanks for the tip!

Edit: Just finished the game and got the princess. Everything seemed to be working fine. The only weird thing is that the game kind of halts in the final screen. I could do nothing but reset/power off to move on from the final screen with text congratulating me. I don't know if this is also the case on the original, unpatched ROM. It works quite well - maybe even better than just the expected jump back to the intro screen.

Main :: RE: Game Gear Throws a wobbly!

sidney — Sun, 19 May 2013 18:09:42 GMT

Author: sidney
Posted: Sun May 19, 2013 6:09 pm (GMT 0)

That is another thing worth considering Maraakate. Yesterday it worked, then it didn't, cooled down and then it did! I opened it up, cleaned the contact, then put it back together minus the start button and used a pen tip to short/pause games and it seems to be ok like that. It paused on it's own a couple of times during Wonderboy but a quick tap with the pen and it was ok again.
So it is not perfect but it is at least useable which is an improvement. Given that some Game Gears have bad screens and no sound and this one has a great screen and sound I may just have to accept this machine's quirks. That said some of the contact solution suggested may sort it out totally.

Competitions :: RE: [Music competition 2013] Deep Duck Trouble - Ice Ice Duck by tibone

Johannes — Sun, 19 May 2013 10:24:23 GMT

Author: Johannes
Posted: Sun May 19, 2013 10:24 am (GMT 0)

I finally looked up the original song. I'd say it's a bit bland, but you turned it into something really cool with this cover. I think this is your best work yet (along with Snail Bite of course, which is still the most awesome thing ever!) and my favourite contribution this year.

MEKA :: RE: Cheatfinder - how to use it?

Maxim — Sat, 18 May 2013 23:06:12 GMT

Author: Maxim
Posted: Sat May 18, 2013 11:06 pm (GMT 0)

I'd avoid areas of 00 in the middle of a bank as they probably mean something - maybe some graphics you didn't see yet. I'd prefer to use ffs at the end of the bank (assuming that's what you find there).

MEKA :: RE: Cheatfinder - how to use it?

hang-on — Sat, 18 May 2013 22:10:45 GMT

Author: hang-on
Posted: Sat May 18, 2013 10:10 pm (GMT 0)

------
Advanced stuff (relative to my current skill level)

Preparing to bypass block initialization.

Remember to take paging into account! Got to find unused space nearby the original block init code.

I looked up the opcodes for the instructions I need:

CD yy xx : CALL address xx yy (remember paging and little endian)
C9 : RET

3E xx : LD A, xx

I use debugger to locate the block init routine. It is around $277C1

Copy 3 bytes from $277C1 (which are hex 32 42 C0 - load a into RAM C042). This will be overwritten with a call instruction in a moment.

Paste these bytes to location 27102. It looks unused 00's, but not intirely. So I could be screwing some important data up here. Must test. Add a RET after this LD instruction. We now have:

27102: 32 34 C0 C9, which is

LD (C034), A
RET

now go back to 277C1. Replace the LD instruction with a CALL to our custom function at 27102.

MEKA RMAP tells me that 2770C is B70C

How long from this address to custom routine? 2770C-27102 = 60A

calculate address of custom routine: b70c - 60a = b102

So I can now goto 277C1 and overwrite the LD instruction 32 34 C0 with a call to my custom function: CD 02 b1 (remember little endian)

I test it... OMG, it works! This is pushing my own limits!! I disassemble in MEKA, debug etc., and realize that the game still seems to work, the program flow integrates the new routine as intended, ... oh, I'll go have a beer now...

Next thing is to copy all the LD's from the block initialization into the new handler. Here I can tweak them according to my needs. Then go back and overwrite them with 00's at the old place.

... done.

It works!!!! I have successfully bypassed the block initialization. I let the program do as it would have done anyway - except that when it wants to write 00 to shoes (c044) and armour (c043) addresses - I throw in my own 3E 03 (LD A, 03h) just before. 03h is the value for golden armour and golden shoes. I set register A back to its original 00 (3E 00) before returning (C9) to the old block init routine, where the program now runs over a short sequence of 00's (NOP) before reaching the rest of the original routine.

Yeah - come on you not-so-scary skeletons. Taste my infinite lives, infinite hearts, golden armour and golden shoes :)

--- edit:

Oh - did not realize that you had already posted something, Maxim. Will look into your link and example. But first I will rest a little on my hex-hacking laurels :) For a guy that never made it past Visual Basic and Flash back in the 90's, opcodes and hex-editing is like... totally the Matrix. :) Thank you for all your support.

MEKA :: RE: Cheatfinder - how to use it?

Maxim — Sat, 18 May 2013 20:40:52 GMT

Author: Maxim
Posted: Sat May 18, 2013 8:40 pm (GMT 0)

I'd use an assembler to make the opcodes. Here's an example of patching a rom - for mapping, but it's very similar for your case.

http://www.smspower.org/maxim/Maps/AsterixAndTheGreatRescue

MEKA :: RE: Cheatfinder - how to use it?

hang-on — Sat, 18 May 2013 20:05:19 GMT

Author: hang-on
Posted: Sat May 18, 2013 8:05 pm (GMT 0)

nice tip with the rmap pc command. I did not know it. I will use it from now on when encountering paging!

Would you prefer to disassemble the game to alter the block initializations, Maxim? I was actually thinking about using Frhed to find an unused area with 00's and then hex code simple stuff directly into this (mostly load a value into A, then write to certain places in RAM), then overwrite some of the original initialization code to call this custom initialization. I looked in the z80 instruction manual and got a feeling that it might be within my reach - but of course I'm interested if there is a better/simpler way :)

Main :: Game gear emulator multiplayer online?

rey100 — Sat, 18 May 2013 11:57:15 GMT

Author: rey100
Subject: Game gear emulator multiplayer online?
Posted: Sat May 18, 2013 11:57 am (GMT 0)

There is some game gear emulator for play multiplayer online?

Thanks!! ;-)

Development :: RE: Disabling the I/O chip

omp — Sat, 18 May 2013 09:48:44 GMT

Author: omp
Posted: Sat May 18, 2013 9:48 am (GMT 0)

Yes it depends which revision of Master System you have. It didn't work in a SMS2 and I would assume it *may* not work in a VA3 SMS model 1 since it uses the same I/O IC.

Main :: RE: poster of 8bit games!!!!!

Calindro — Sat, 18 May 2013 08:37:49 GMT

Author: Calindro
Posted: Sat May 18, 2013 8:37 am (GMT 0)

Really nice work! I love how you arrange things that they even kinda interact with eachother! It reminds me of "Where's Waldo". This could be "Where's Teddy Boy"? :D