It is currently Sun Mar 26, 2017 11:39 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 16 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Sat Dec 24, 2016 4:51 am 
Offline

Joined: Sat Dec 24, 2016 3:50 am
Posts: 8
I'm really newbie to this whole scene, and to be honest I just want to play Dragon Buster on a platform without support for its mapper (95). But I don't mind having to learn a bunch of stuff to do that, just needing some guidance.
Or would it be less work to just try and patch the emulator?


Top
 Profile  
 
PostPosted: Sat Dec 24, 2016 5:26 am 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 3192
Location: Mountain View, CA, USA
What is "the emulator"?


Top
 Profile  
 
PostPosted: Sat Dec 24, 2016 5:46 am 
Offline

Joined: Sat Dec 24, 2016 3:50 am
Posts: 8
That'd be any for the 3DS, where I'm trying to play it. Tried a couple, but they didn't seem to work for this game, or don't have working download links, or they deleted their github page.


Top
 Profile  
 
PostPosted: Sat Dec 24, 2016 10:56 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 5419
Location: Seattle
Mapper 95 requires one-screen mirroring, which the MMC3 (mapper 4) doesn't support.

There are other mapper hacks that could be made to work (e.g. m118, m158, m207), but support for them in emulators isn't tremendously more likely than m95. (That list is in descending likelihood of being supported)


Top
 Profile  
 
PostPosted: Sat Dec 24, 2016 2:21 pm 
Offline

Joined: Sat Dec 24, 2016 3:50 am
Posts: 8
lidnariq wrote:
There are other mapper hacks that could be made to work (e.g. m118, m158, m207), but support for them in emulators isn't tremendously more likely than m95.

Well actually, m118 seems to be supported by one! How would I go on doing that?


Top
 Profile  
 
PostPosted: Sat Dec 24, 2016 2:45 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 5419
Location: Seattle
Well, what I'd do is:
Load the game in a debugging emulator (FCEUX for windows, Nintendulator, Mesen)
Set a breakpoint on writes to $8000-$9FFF
Discover that the game seems to always keep a shadow copy of the CHR banking registers in RAM
Disable old breakpoint, set a new breakpoint on writes to that shadow copy
Discover that the game seems to keep 6-byte arrays in ROM corresponding to the desired PPU memory layout
Change the corresponding tables in ROM, change the mapper # in the header, and see if it works correctly


Top
 Profile  
 
PostPosted: Sat Dec 24, 2016 7:06 pm 
Offline

Joined: Sat Dec 24, 2016 3:50 am
Posts: 8
lidnariq wrote:
Well, what I'd do is:
Load the game in a debugging emulator (FCEUX for windows, Nintendulator, Mesen)
Set a breakpoint on writes to $8000-$9FFF
Discover that the game seems to always keep a shadow copy of the CHR banking registers in RAM
Disable old breakpoint, set a new breakpoint on writes to that shadow copy
Discover that the game seems to keep 6-byte arrays in ROM corresponding to the desired PPU memory layout
Change the corresponding tables in ROM, change the mapper # in the header, and see if it works correctly

I probably should've been more clear, I only know the basic idea of mappers and some MIPS assembly I've seen in college. I was hoping I could figure some things out with the debugger (using FCEUX), but I'm not sure of how to identify most of those things.
What I've got is that the game copies these registers from the cartridge, so I gotta find this copy, get this PPU memory layout from those arrays, and use these values to edit the ROM.
So... I don't know how to find this shadow copy. Or identify CHR banking registers. Or 6-byte arrays. Or those tables in the ROM. :?
You've helped a lot, I just don't know what I'm looking for looks like.


Top
 Profile  
 
PostPosted: Sat Dec 24, 2016 7:24 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 5419
Location: Seattle
So ... uh, Debug / Debugger ... pops up this window
and in the upper right corner you can add a new breakpoint by clicking on the "add" button

Start off with the documentation at nesdevwiki:iNES Mapper 095 which points you at nesdevwiki: iNES Mapper 206 ... ok, so you need to set a breakpoint on writes to $8000-9FFF because that's where the N108 listens.

The N108 and MMC3 are kinda inconvenient to debug because you need to know both what value it wrote to $8000 before any write to $8001. But fortunately this game always puts them immediately adjacent when you look in the disassembly listing.

There's a writeup here about reverse-engineering the compression format used by a random puzzle game; it involves a lot of the same background skills.

Let me know if you want more guidance.


Top
 Profile  
 
PostPosted: Sat Dec 24, 2016 8:17 pm 
Offline

Joined: Sat Dec 24, 2016 3:50 am
Posts: 8
Actually i had figured out how to set those breakpoints haha... It's just the "now what?".
What am I looking for on those breakpoints that points me to the shadow copy?


Top
 Profile  
 
PostPosted: Sat Dec 24, 2016 9:32 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 5419
Location: Seattle
At some point you'll find the following code:
Code:
  ldx #5
loop:
  stx $8000
  lda $383,x
  and #$1f
  sta $8001
  dex
  bpl loop
  rts


If you reason your way through it, you'll see that it copies the five bytes from [$383+x] to the N108 register #x

It also specifically masks off the upper three bits of each write, which when you combine it with the write-up about how mapper 95 works, means that it's always forcing the nametables to "1-screen A".

And there's another loop that looks similar, but doesn't mask off the upper three bits.

So this is where I did the same thing to find how the values got in to RAM at $383 through $388


Top
 Profile  
 
PostPosted: Sun Dec 25, 2016 11:29 am 
Offline

Joined: Sat Dec 24, 2016 3:50 am
Posts: 8
Alright, I've found an array that it copies from just as the game boots ($85A2-$85A7), another when you start the game ($C4CD-$C4D2), and another when you enter a level ($C4C7-C4CC). I see that the first is in that first interval and that the others are adjacent. Does those values at $85A2-$85A7 (14 16 00 01 02 03) have anything to do with the pinout? Probably just grasping at straws now...


Top
 Profile  
 
PostPosted: Sun Dec 25, 2016 11:43 am 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 17984
Location: NE Indiana, USA (NTSC)
For Namco 108 and MMC3, the values are offsets from the beginning of CHR ROM in units of 1024 ($400) bytes. The first two cover 2 KiB regions at $0000-$07FF and $0800-$0FFF; the others cover 1 KiB regions at $1000-$13FF, ..., $1C00-$1FFF. (MMC3 can invert the sense of bit 12 such that the banks instead start at $1000, $1800, $0000, $0400, $0800, and $0C00.) So 14 16 00 01 02 03 means switch CHR ROM $05000-$05FFF into PPU $0000 and $00000-$00FFF into PPU $1000.

Is a value greater than $1F ever written to $8001? If not, then you could probably just take the existing ROM and run it on TLSROM (mapper 118). If so, you'll need to map values $20-$3F to $80-$9F, and it'll run on TLSROM.


Top
 Profile  
 
PostPosted: Sun Dec 25, 2016 11:49 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 5419
Location: Seattle
So, those six values are the values that are written to the N108's first six banking registers. (While "real" computers' MMUs have 4 KiB or 2 MiB banks and only one address space, the NES MMCs have two address spaces and often a random mix of different sizes of banks)

N108 and MMC3 both use the same PPU banking scheme, allowing control of two 2 KiB windows and four 1 KiB windows. (The MMC3 refines this by allowing the user to swap which comes first)

So if the game ultimately writes $0→[$8000] then $14→[$8001], that means "set the 2 KiB CHR bank at $0000-$07FF to bank #$14 and, in the case of mapper 95, set the nametable in the top half (the $20s bit) to 0"

In contrast, the same write to mapper 118 would mean "set the nametable in the top half (the $80s bit) to 0".

Does this make sense so far?


Top
 Profile  
 
PostPosted: Sun Dec 25, 2016 12:56 pm 
Offline

Joined: Sat Dec 24, 2016 3:50 am
Posts: 8
lidnariq wrote:
Does this make sense so far?

I got how it works now, I only don't visualize these $20s and $80s banks. Top half of what? That could probably answer my next question.

tepples wrote:
Is a value greater than $1F ever written to $8001? [...] If so, you'll need to map values $20-$3F to $80-$9F, and it'll run on TLSROM.

Yes... And I really tried searching before asking, but how do I map these values?


Top
 Profile  
 
PostPosted: Sun Dec 25, 2016 1:28 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 5419
Location: Seattle
Before I go too far off ... do you understand what a nametable is? What mirroring is? We have some articles on the wiki which hopefully will help, if not: nesdevwiki:Mirroring and nesdevwiki:PPU nametables.

From an EE point of view:
Mapper 95 connects what would have been CHR A15 instead to "CIRAM" (= nametable) A10. The N108 (& MMC3) drives values from its first six registers depending on the instantaneous state of PPU A10, A11, & A12 (but not A13 — that's why this works!)
So when the PPU is fetching from $0000-$07FF or $2000-$27FF (because it's not connected to A13), it drives the CHR ROM (and also CIRAM A10) according to the contents of register 0.
Similarly, when it's fetching from $0800-$0FFF or $2800-$2FFF, it drives the CHR ROM (and CIRAM A10) according to the contents of register 1.

This means that there are four possible ways that the NES's two nametables can be combined:
[R0] & $20 = 0 and [R1] & $20 = 0 → CIRAM A10 is always 0, regardless of PPU A10, A11
[R0] & $20 = $20 and [R1] & $20 = $20 → CIRAM A10 is always 1, regardless
[R0] & $20 = 0 and [R1] & $20 = $20 → effectively, CIRAM A10 is connected to PPU A11
[R0] & $20 = $20 and [R1] & $20 = 0 → effectively, CIRAM A10 is connected to NOT PPU A11

Mapper 118 is the exact same idea.... it's just that they used the pin that's usually connected to CHR A17 instead to CIRAM A10. So the bit becomes $80 (because the eight bits in the register normally correspond to CHR A17..A10).


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 16 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group