Mike Tyson's Punch-Out Disassembly

Discuss technical or other issues relating to programming the Nintendo Entertainment System, Famicom, or compatible systems.

Moderator: Moderators

DirtyMcDingus
Posts: 38
Joined: Sat Jul 25, 2020 5:31 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by DirtyMcDingus » Sun Aug 23, 2020 4:02 pm

Another thing, The code right now is not very detailed as I have been jumping around figuring things out. I plan on going through a couple of Glass Joe's states and then I'm going to back fill a lot of details. Also, Once the opponent state machine is all figured out, I'll go back and finish detailing and formatting the audio engine. I don't like things half done and love seeing completed and nicely formatted dis-assemblies!

nispio
Posts: 13
Joined: Thu Aug 20, 2020 11:19 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by nispio » Sun Aug 23, 2020 6:54 pm

DirtyMcDingus wrote:
Sun Aug 23, 2020 3:59 pm
As of yet, I have not found the RNG for the game. It's not as obvious as it is on some other games.
The speedrunning community has figured out how the RNG works so that they can manipulate outcomes. Random numbers are read from $0018, which is updated once per frame as a combination of the byte values at $0019 and $001E. Those addresses are the cumulative input, and the frame count, respectively.

The following document describes a RNG manipulation strategy dubbed "Hippo Manippo." The first few pages describe how the RNG works, and the rest of the document goes on to explain the specifics of the "Hippo Manippo" strategy:

https://docs.google.com/document/d/1haV ... 7n-5I/edit

DirtyMcDingus
Posts: 38
Joined: Sat Jul 25, 2020 5:31 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by DirtyMcDingus » Thu Aug 27, 2020 1:15 am

nispio,
Oh nice! Thanks for the info! I'll integrate it into the disassembly.

nispio
Posts: 13
Joined: Thu Aug 20, 2020 11:19 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by nispio » Sun Aug 30, 2020 12:58 pm

I have been looking at some of the disassembly for the things I am interested in. Primarily, how random events are handled. There are a few things that I have noticed, and I am wondering if you can confirm any of them or elaborate on them.

Addresses E0-EF seem to be really popular for temporary variables, especially pointers.

There seems to be a number of data tables on page 5 of RAM. In the code I have been exploring I am noticing lots of table lookups into addresses in the neighborhood of $05D0. I am wondering if some of the opponent data tables are copied into RAM at the beginning of the fight. I would love to have a formula that I could convert an address like $05E0 into an offset into the opponent data, but it might be more nuanced than that.

It looks like there are quite a few places where a value is read, and if the value is not zero (or in some cases 0xFF) then it is used as an offset into a table, but if the value is zero, then a random offset is generated using some combination of bits from $0018

DirtyMcDingus
Posts: 38
Joined: Sat Jul 25, 2020 5:31 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by DirtyMcDingus » Sun Aug 30, 2020 2:30 pm

nispio,
Yes, there is a whole segment of opponent data that is Loaded into $05A0 through $05FF. Look in PRG_Bank0 at address $9316. I have figured out what a big portion of that data is. Each opponent has a set of data copied into this memory segment.

DirtyMcDingus
Posts: 38
Joined: Sat Jul 25, 2020 5:31 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by DirtyMcDingus » Sun Aug 30, 2020 4:41 pm

Well, I went through and completed the commenting of Glass Joe's right hook data. Not too interesting but I pulled apart a lot of the code to understand it. It's a good start on understanding the code that controls the opponent states. I reverse engineered about 2/3 of the subroutines that control the opponent's behavior. Interestingly, I have not seen any code that manipulates the crowd in the background. It must be there since there is the guy in the front row who nods his head at certain times when Piston Honda is vulnerable. There is a subroutine that writes memory zero page addresses when updating opponent states. It may be that subroutine...or maybe not. Also, I have located the opponent's individual states like punching, blocking, getting hit and dodging, but I still have not found the larger state machine that controls the flow from state to state.

DirtyMcDingus
Posts: 38
Joined: Sat Jul 25, 2020 5:31 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by DirtyMcDingus » Sun Aug 30, 2020 4:54 pm

I'm going to change things up a bit and go back and finish off the audio engine. I'm losing my focus by looking through only one section of the game. The audio is always the most fascinating part to me. Maybe because I know nothing about music. It should not take long to go through as I have already pulled it apart quite thoroughly. Maybe the opponents state data is about to give up some secrets. I'll let someone else look at it for a bit...

FrankWDoom
Posts: 240
Joined: Mon Jan 23, 2012 11:27 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by FrankWDoom » Sun Aug 30, 2020 6:43 pm

DirtyMcDingus wrote:
Sun Aug 30, 2020 4:41 pm
Well, I went through and completed the commenting of Glass Joe's right hook data. Not too interesting but I pulled apart a lot of the code to understand it. It's a good start on understanding the code that controls the opponent states. I reverse engineered about 2/3 of the subroutines that control the opponent's behavior. Interestingly, I have not seen any code that manipulates the crowd in the background. It must be there since there is the guy in the front row who nods his head at certain times when Piston Honda is vulnerable. There is a subroutine that writes memory zero page addresses when updating opponent states. It may be that subroutine...or maybe not. Also, I have located the opponent's individual states like punching, blocking, getting hit and dodging, but I still have not found the larger state machine that controls the flow from state to state.
there's a camera flash cue in the crowd when bald bull is charging. i don't know if that would be considered part of the crowd animation or it's own thing though

User avatar
Alp
Posts: 223
Joined: Mon Oct 06, 2014 12:37 am

Re: Mike Tyson's Punch-Out Disassembly

Post by Alp » Wed Sep 02, 2020 4:40 pm

Oh hey! This is pretty cool.

I would've reverse-engineered Punch Out myself, because of a project I'm currently working on, but after doing it for Hydlide (which was a HUGE mess), I lost the will to disassemble any more NES games. :lol:

So, I resorted to using a stopwatch to roughly time things in Punch Out, like Nintendo themselves did when they ported Donkey Kong to the NES.
(My game is a turn-based pseudo 3D Dungeon Master clone, with action-based Punch Out styled combat)

nispio
Posts: 13
Joined: Thu Aug 20, 2020 11:19 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by nispio » Fri Sep 04, 2020 2:22 pm

I spent a bunch of time working on understanding the disassembly this week. I learned to use the various debug tools available in FCEUX, and I must say that I am really impressed. There are some really great features that make reverse engineering much more convenient.

One thing that I couldn't quite figure out is how FCEUX comes up with the numberings for program banks. So far, I think that I have it worked out as follows:

PRG_Bank007: NL3
PRG_Bank008: NL4
PRG_Bank009: NL4
PRG_Bank00A: NL5
PRG_Bank00B: NL5
PRG_Bank00C: NL6
PRG_BankDEF: NL6/NL7

The problem here is that the overlapping NameList numbers make for ambiguities. Now 05:$8000 refers to two different memory locations in banks A and B. Am I missing something?

DirtyMcDingus
Posts: 38
Joined: Sat Jul 25, 2020 5:31 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by DirtyMcDingus » Fri Sep 04, 2020 3:17 pm

nispio,
I think FCEUX Assumes the PRG banks are 16KB in size. As far as I know, the MMC2 (used only in Punchout) is the only memory controller that bank switches in 8KB chunks. That's why they overlap...at least that's what I assume.

nispio
Posts: 13
Joined: Thu Aug 20, 2020 11:19 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by nispio » Fri Sep 04, 2020 3:49 pm

I made quite a bit of progress this week looking at a few different areas. I have committed a big pile of my work in progress here:

https://github.com/nispio/mike-tysons-p ... e/prgbanks

Right now, I am working on cleaning all of it up, since my process has been pretty helter-skelter so far. After I clean things up, I will submit a pull request, if you are interested. I tried to infer a "style guide" of sorts from the existing work, and I tried to stick to it as much as possible. I will give a high level overview of some of the things I learned in subsequent posts on this thread.

DirtyMcDingus
Posts: 38
Joined: Sat Jul 25, 2020 5:31 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by DirtyMcDingus » Fri Sep 04, 2020 4:32 pm

Heck yeah! Submit a pull request when you get you stuff ready! This is awesome to have some help.

nispio
Posts: 13
Joined: Thu Aug 20, 2020 11:19 pm

Re: Mike Tyson's Punch-Out Disassembly

Post by nispio » Fri Sep 04, 2020 5:10 pm

I learned about switching between the different PRG banks. The switch is accomplished by writing the desired bank number to `$AFFF`. Doing so will map that bank to the range `$8000-$9FFF`. The bank labeled 'PRG_BankDEF' is always mapped to `$A000-$FFFF` All bank swapping is handled through a single subroutine call at `$AA4A`. There is one other place where `$AFFF` is written, but it comes immediately after a call to the subroutine for bank swapping, so as far as I can tell, it is essentially a NOP.

The subroutine that wraps bank switching always writes out the bank number to `$0D`. This is very convenient because it means that you can always refer to that byte to know which of the switchable PRG banks is currently mapped into the address space. There are a set of subroutines that map a specific bank and also write that bank number to `$0E`. This allows for doing temporary bank swaps and then swapping back to the previous bank. For lack of better terminology, I call this type of operation a push and pop, even though there is no real stack involved.

lidnariq
Posts: 9659
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Mike Tyson's Punch-Out Disassembly

Post by lidnariq » Fri Sep 04, 2020 5:14 pm

I'd recommend quickly browsing our documentation of how the MMC2 works: https://wiki.nesdev.com/w/index.php/MMC2

Post Reply