illegal opcodes on 6502 nes version

Discuss emulation of the Nintendo Entertainment System and Famicom.

Moderator: Moderators

User avatar
Dwedit
Posts: 4410
Joined: Fri Nov 19, 2004 7:35 pm
Contact:

Post by Dwedit » Fri Dec 10, 2010 7:17 pm

I was considering using the unofficial opcodes, but Martin Korth's NO$NES page gives stern warnings against using them.
Here come the fortune cookies! Here come the fortune cookies! They're wearing paper hats!

User avatar
MottZilla
Posts: 2835
Joined: Wed Dec 06, 2006 8:18 pm

Post by MottZilla » Fri Dec 10, 2010 8:35 pm

tokumaru wrote:What I really want to know is, after you guys finish this arguably pointless discussion, how do you plan on making this new name official, considering that the presence of the 6502 is much wider than its use on the NES. We can't even change stuff that only pertains to the NES (iNES header, for example)!
QFT. The only thing to keep in mind is the actual NES behaves a certain way on these instructions and that unless you have good reason to use them, don't use them in your own projects. But if writing a NES emulator, you need to keep in mind some software might use/abuse them. However in my experience with emulation, no game I encountered ever executed an undocumented opcode unless the emulator had a bug/crash like incorrect bankswitching and jumping to code that wasn't there.

puzzud
Posts: 8
Joined: Tue Jul 05, 2011 8:19 pm
Location: United States
Contact:

Re: illegal opcodes on 6502 nes version

Post by puzzud » Mon Sep 10, 2012 8:09 am

I know this thread has been inactive for some time, but I figure it was worth mentioning. I'm in the process of trying to hack the Duck Hunt VS ROM to work from a PowerPak. After having disassembled the PRG ROM, not too long after the RESET vector, the code path encounters illegal opcodes. It's pretty obvious and it is not misinterpreted interrupt code. The disassembler I'm using does not yet support illegal opcodes, so it doesn't attempt to make sense of code after the illegals either.

I thought it very odd that I would see Nintendo using illegal opcodes. From reading this thread, it seems like it's really odd. I can provide more detail about where and what opcodes I'm seeing. I think some are double nops, but I was going to put those sections of bytes through an illegal opcode enabled disassembler before I made any serious attempts to figure out what's going on.

lidnariq
Posts: 10256
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: illegal opcodes on 6502 nes version

Post by lidnariq » Mon Sep 10, 2012 11:51 am

puzzud wrote:[in Duck Hunt VS] not too long after the RESET vector, the code path encounters illegal opcode
Byte offsets? I just disassembled $8000-$80C2 and didn't see any. (image CRC32: 45B180F7)

puzzud
Posts: 8
Joined: Tue Jul 05, 2011 8:19 pm
Location: United States
Contact:

Re: illegal opcodes on 6502 nes version

Post by puzzud » Mon Sep 10, 2012 3:37 pm

Follow the code down from $8000 (RESET) to $805f, where there are a handful of subroutine jumps. One of those calls goes to $80b6:

Code: Select all

P_80B6            ;       [80B6]
    lda       Z_24
    beq       A_80BD

    jmp       J_8101  ;       [8101]

A_80BD            ;       [80BD]
    lda       Z_25
    jsr       P_85B3  ;       [85B3]
    tax
    !byte      $82  ; illegal opcode

E_80C4            ;       [80C4]
!byte          $D4  ; .
E_80C5            ;       [80C5]
!byte          $9C  ; .

E_80C6            ;       [80C6]
    ora       Z_9D
    !byte      $1C  ; illegal opcode
E_80C9            ;       [80C9]
    sta       A_A9A3,X
    cmp       A_6D87,Y
    txa
    !byte      $AF  ; illegal opcode

E_80D1            ;       [80D1]
!byte          $89, $16, $AC, $4E, $AC, $6D, $AC  ; ...N.m.
!byte          $EF, $AC, $A3, $A9, $FC, $80, $62  ; ......b
!byte          $A0, $D9, $87, $D9, $87, $C2, $84  ; .......
!byte          $34, $88, $55, $B2, $81, $B2, $B6  ; 4.U....
!byte          $B2, $CE, $B7, $17, $BA, $E6, $B7  ; .......
!byte          $48, $83, $22, $81, $1F, $82, $27  ; H."...'
!byte          $9A, $A9, $0A, $85, $25, $60 ; ....%`

J_8101            ;       [8101]
    lda       Z_26
    jsr       P_85B3  ;       [85B3]
    !byte      $92  ; illegal opcode
E_8107            ;       [8107]
    sty       A_8CC8
    !byte      $13  ; illegal opcode
E_810B            ;       [810B]
    sta       A_8E1D
    lsr       Z_8E
    !byte      $5A  ; illegal opcode

S_8111
@lidnariq, am I am looking at this code incorrectly? The CRC32 for the image I'm using is e2554e0a. I got the image form a large comprehensive NES ROM torrent, the file name is "Duck Hunt (VS).nes". The torrent includes just one other copy of Duck Hunt VS entitled "Duck Hunt (VS) [b1].nes". Its CRC32 is 8862afd7 but I notice there seems to be graphical corruption with the dog.

hcs
Posts: 31
Joined: Mon Nov 27, 2006 11:34 pm
Location: NYC
Contact:

Re: illegal opcodes on 6502 nes version

Post by hcs » Mon Sep 10, 2012 3:54 pm

Is that 85B3 by any chance the handler for the funky embedded switch that I've heard about? I don't have the ROM on hand, but it may be expecting to be followed by a table, the next few bytes are (according my reassembly):

AA 82
D4 9C
05 9D
1C 9D

Which look like plausible jump targets. For reference: viewtopic.php?f=10&t=8956

lidnariq
Posts: 10256
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: illegal opcodes on 6502 nes version

Post by lidnariq » Mon Sep 10, 2012 4:07 pm

Yeah, $85B3 looks like:

Code: Select all

__85b3:     STX $27            ; $85b3: 86 27     
            STY $28            ; $85b5: 84 28     
            ASL                ; $85b7: 0a        
            TAY                ; $85b8: a8        
            INY                ; $85b9: c8        
            PLA                ; $85ba: 68        
            STA $14            ; $85bb: 85 14     
            PLA                ; $85bd: 68        
            STA $15            ; $85be: 85 15     
            LDA ($14),y        ; $85c0: b1 14     
            TAX                ; $85c2: aa        
            INY                ; $85c3: c8        
            LDA ($14),y        ; $85c4: b1 14     
            STA $15            ; $85c6: 85 15     
            STX $14            ; $85c8: 86 14     
            LDX $27            ; $85ca: a6 27     
            LDY $28            ; $85cc: a4 28     
            JMP ($0014)        ; $85ce: 6c 14 00
which takes the address it was called from, uses A to index into a table after it, and jumps to that.

puzzud
Posts: 8
Joined: Tue Jul 05, 2011 8:19 pm
Location: United States
Contact:

Re: illegal opcodes on 6502 nes version

Post by puzzud » Mon Sep 10, 2012 4:14 pm

Ahhh. This sounds familiar. I was getting ready to start comparing the code to the disassembled Metroid source code to look for any similarities. I seem to recall they used this funky jump method in Metroid, as well.

@hcs, just confirmed those vectors are all valid code. So much for fully automated disassembly. At least I can start identifying these locations are data vs code.

Now I feel silly :oops:. Thanks for both of your help.

Post Reply