It is currently Mon Oct 23, 2017 3:48 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 16 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Sat Apr 25, 2015 7:53 am 
Offline

Joined: Tue Feb 03, 2015 2:14 am
Posts: 6
I have noticed that several Game Boy games contain a 32-byte footer at the end of one or more 16KB banks. For example, in "Kirby's Pinball Land (USA, Europe)" and "Kirby no Pinball (Japan)":
Code:
07fe0: .. C6 01 .. 05 00 .. C1 80 .. C3 F3 .. 8A E8 .. 08 98 .. 11 10 .. 62 00
0ffe0: .. 0F 01 .. 8D 00 .. C5 13 .. 86 C0 .. 90 AD .. 23 81 .. 98 F3 .. 20 00
23fe0: .. 6E BF .. 7F DF .. FF BE .. F7 CF .. 07 DB .. 2C ED .. FF F8 .. BB 00
2bfe0: .. 66 F7 .. 5F DF .. 7F F7 .. AD DE .. EB 3D .. F3 23 .. 7F 7D .. 3F 00
2ffe0: .. 08 40 .. 40 A4 .. 15 49 .. 15 36 .. 50 8F .. 6B 0C .. F0 4D .. 10 00
3ffe0: .. 98 85 .. 21 09 .. 41 33 .. 83 48 .. F8 51 .. 33 22 .. 90 74 .. 14 00
(.. represents a pair of "blank" bytes - either $00 $00 or $ff $ff)


Very similar footers exist in "Kirby's Dream Land", and footers in the same format exist in other games, including:

  • Adventures of Star Saver, The (USA, Europe)
  • Alien vs Predator - The Last of His Clan (USA)
  • Bonk's Adventure (USA)
  • Desert Strike - Return to the Gulf (USA)
  • Jetsons, The - Robot Panic (USA, Europe)
  • Jurassic Park (USA)
  • Mysterium (USA)
  • Pac-Attack (USA)
  • Snow Bros. Jr. (USA)
  • Spud's Adventure (USA)
  • Top Gun - Guts & Glory (USA, Europe)

Another thing these games have in common is that they all seem to use the same pattern to fill blank space - 32 bytes of $00 alternating with 32 bytes of $ff. In some cases this filler contains a significant number of flipped bits.


Does anyone know whether these 32-byte footers have any meaning? The values do not seem to be dependent on the contents of the 16KB bank - note that the two releases of "Kirby's Pinball Land" contain exactly the same footers, even for banks which differ.

Have bank footers similar to these been seen anywhere else? What might be their purpose?


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 1:37 pm 
Offline

Joined: Thu Aug 12, 2010 3:43 am
Posts: 1589
That looks to me like it could be code, but I may be wrong.


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 1:57 pm 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 3192
Location: Mountain View, CA, USA
CRC32 checksum of the preceding data?


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 4:14 pm 
Offline

Joined: Thu Aug 12, 2010 3:43 am
Posts: 1589
32 bytes to store a 32-bit value? =P


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 4:45 pm 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 3192
Location: Mountain View, CA, USA
Yes, assuming the CRCs represent smaller regions than whatever a "bank" is. Think outside the box for a moment, mate. :P

But I guess they can't be CRCs, unless they are but are being managed/added incorrectly. I say that because:

Quote:
... The values do not seem to be dependent on the contents of the 16KB bank - note that the two releases of "Kirby's Pinball Land" contain exactly the same footers, even for banks which differ. ...

The guy is asking something that only the inventors would necessarily know anyway -- it reminds me of the "what do these fields in an FDS header mean!??!?!?! it's driving me crazy!!!" thread.

Has anyone set up a debugger breakpoint for any reads from those regions (at the end of every bank) to see if they're being used in real-time? If not, why not?


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 4:49 pm 
Offline

Joined: Sun Mar 19, 2006 9:44 pm
Posts: 916
Location: Japan
Hey, without such curiosity, the Enigma code would never have been cracked. ;-)

_________________
http://www.chrismcovell.com


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 5:02 pm 
Offline
User avatar

Joined: Mon Sep 15, 2014 4:35 pm
Posts: 3074
Location: Nacogdoches, Texas
The enigma code?


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 5:06 pm 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 3192
Location: Mountain View, CA, USA
Stay focused.


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 5:17 pm 
Offline
User avatar

Joined: Mon Sep 15, 2014 4:35 pm
Posts: 3074
Location: Nacogdoches, Texas
Sorry...


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 7:51 pm 
Offline

Joined: Sun Jan 26, 2014 9:31 am
Posts: 256
Could be code, perhaps part of a library or some other commonly used codebase. One way to verify this, use a debugger and set breakpoints for that memory region. I'd chose a game with fewer banks to watch and see if any of them execute in the footers. Understanding what it does requires disassembling it though.

Actually, quicker way to see if it's code is to just set a breakpoint at $38. If the ".." in the footers happen to be $FF, that will jump to $38 in memory (it's the RST 38 instruction). You could use a trace function in a debugger to see if it ever returns to one of the footers.


Top
 Profile  
 
PostPosted: Sat Apr 25, 2015 11:36 pm 
Offline
User avatar

Joined: Sat Jul 12, 2014 3:04 pm
Posts: 936
koitsu wrote:
The guy is asking something that only the inventors would necessarily know anyway -- it reminds me of the "what do these fields in an FDS header mean!??!?!?! it's driving me crazy!!!" thread.

To be fair, a fair chunk of those got found out.

Other possible candidates, debugging-unseen:
  • PRG-build (time/number)stamp
  • A "fingerprint" to...
    • make sure nobody bungled and de-aligned the programming from banks with a stray byte
    • make sure the banks got are in the correct order
    • check that programming was functioning correctly (no setting nor clearing of unwarranted bits/bytes)
  • Some constants/flags used by the game that affect difficulty/margins/timings, possibly encoded, placed in a way that they'd be easy to alter for a different end experience

Observation:The last byte of each, too, is $00. Is this true in some/most/all of these mystery footers?


Top
 Profile  
 
PostPosted: Sun Apr 26, 2015 3:48 am 
Offline

Joined: Tue Feb 03, 2015 2:14 am
Posts: 6
koitsu wrote:
Has anyone set up a debugger breakpoint for any reads from those regions (at the end of every bank) to see if they're being used in real-time?

Yes. At least for the Kirby games, the footers are not accessed at run-time.


As mentioned, the footer at $07fe0 in both versions of "Kirby's Pinball Land" is also present, unchanged, in one version of "Kirby's Dream Land". Very similar footers exist in other versions of the latter game.

Interestingly, the exact data from "Kirby's Pinball Land" is also present in one version of "Shanghai", but the other two versions of "Shanghai" contain no footers at all. The only version of "Shanghai" which contains a footer is also the only one to use the alternating $00 $ff pattern to fill blank space.

Thus, I think it is likely that the footers come from the blank space (into which they are embedded) rather than from the useful data. Perhaps the build tools used for the games output a format such as Intel HEX, which can contain "holes". The footers may then have been inserted by the tool/method used to convert the output into a plain binary, filling in the blank space.

Whatever method was used to fill the blank space, it seems to have been imperfect - the pattern of $00 $ff contains several "wrong" bits. Perhaps another imperfection led to the presence of the footers.


I have also found similar footers in a few NES games, including "Empereur, L' (USA)", "Mega Man 6 (USA)"/"Rockman 6 (Japan)" and "Romance of the Three Kingdoms II (USA)". Again these use the alternating format for unused data - perhaps the same HEX => binary method was used for these games as well?


Top
 Profile  
 
PostPosted: Sun Apr 26, 2015 9:38 am 
Offline

Joined: Thu Aug 12, 2010 3:43 am
Posts: 1589
RetroSpark wrote:
Thus, I think it is likely that the footers come from the blank space (into which they are embedded) rather than from the useful data. Perhaps the build tools used for the games output a format such as Intel HEX, which can contain "holes". The footers may then have been inserted by the tool/method used to convert the output into a plain binary, filling in the blank space.

This is easy to check: in which dates did those games get released? Because it's possible they were overwriting the same memory chip. Alternatively, it could be a leftover from a development tool (it wasn't uncommon for data that remained in RAM in the development PC to end up in unused areas of the ROM).


Top
 Profile  
 
PostPosted: Sun Apr 26, 2015 3:57 pm 
Offline

Joined: Sun Mar 19, 2006 9:44 pm
Posts: 916
Location: Japan
It's also entirely possible that these are used by Nintendo cartridge checkers to verify bank information.

Seen here: Image

And the similar-looking Gameboy variant is here: http://www.assemblergames.com/forums/sh ... CheKer-DEV

_________________
http://www.chrismcovell.com


Top
 Profile  
 
PostPosted: Sun Apr 26, 2015 4:09 pm 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 19122
Location: NE Indiana, USA (NTSC)
ccovell wrote:
And the similar-looking Gameboy variant is here: http://www.assemblergames.com/forums/sh ... CheKer-DEV

The image links in this post require registration. Is assemblergames.com a site on which most of us reading this ought to have already registered? And does assemblergames.com delete lurker accounts?


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 16 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group