Register | Login
Views: 19364387
 Main | Memberlist | Active users | ACS | Commons | Calendar | Online users
Ranks | FAQ | Color Chart | Photo album | IRC Chat 		11-02-05 12:59 PM
1 user currently in Rom Hacking: hukka | 2 guests
Acmlm's Board - I2 Archive - Rom Hacking - Complete F-Zero tracks images (at last!) | |
Pages: 1 2Add to favorites | "RSS" Feed | Next newer thread | Next older thread
User Post
VL-Tone

Red Cheep-cheep
Level: 23

Posts: 49/200
EXP: 64158
For next: 3565

Since: 06-06-04
From: In the Moon!

Since last post: 5 days
Last activity: 2 hours
Posted on 06-18-05 01:54 PM Link | Quote
Originally posted by neviksti
Hello, I was curious about the F-Zero data and people suggested I look here.

I am by no means a rom hacker, more of a rom programmer I guess. So my main methods for trying to understand a rom are to look at the code. This is usually slow and inefficent, but eventually leads to a fairly complete understanding of what the game is doing during xyz.

In short, I'd like to help... but be patient as my methods are slower.

I figured out how the game keeps track of its state and goes through menus etc. So I tracked down this...

Here is the "grand prix mode" track loading routine:
...

Hopefully this will quicken the search for others reading the code.

I would love to see a fully functional track editor, so if you tell me what is most needed, I can try to focus my efforts on that. In the mean time, I'll continue reading through the code.


Hey welcome here neviksti, great work on the main track loading routine! sorry for the time it took to reply (and sorry to bump the thread). There is nothing wrong about doing ROM hacking by looking at the code "Au contraire" as they say... You'll see that the best ROM hackers here mostly work like that (I'm not one of them), and I wouldn't say my methods are necessarily faster. Though the main reason my hacks/editors don't progress is mostly because I simply don't program/hack much these days, not because I'm slow at it.

I just found a key element that is missing and this is where your help will be needed... I guess it was obvious but I somehow forget to check for that.

Forget about the ZST states adresses, the (W)RAM adresses are much more logical.

Look at these adresses, they are the offsets for each row. To find the offset in the master row data
IN RAM is simply by adding 7F000 to the 16 -bits adress, on the picture the first row data offset is 42767F (reverse byte order). Just read 32 bytes from this address and you get 16 2 bytes offsets. Add $64580 to the offset to get the ROM address (with 512 bytes header) of the 4 bytes data describing a macro-tile (2x2 tiles).

The master row data actually starts at 7F4000 in RAM and not every part of the 7F RAM bank is used for row data. I made a table on the older thread describing what ranges are used.

So the key element I found is a single mention of 00407F in the ROM close to F03F7F which seems to point to a 16 bytes row data "header" in RAM. This is likely part of the row data decompression code. So you mission neviksti, if you accept it, will be to reverse-engineer the row data decompression routine It's not like I couldn't do it myself , and I'm willing to help, but you seem more used to deal with SNES code than me.

So just look at $2536 in the ROM (or search for 00407F) and try to figure out how the routine writes to this address in RAM. But before anything, what we need to know is where this compressed data is read from in ROM, looking at this code around $2536, you should be able to find out.

Once we can compare the compressed to the uncompressed data it can be much easier to figure the inner mechanism.

Note that if you change the 00407F or F03F7F to something else, you'll see that the header and row data are shifted accordingly om RAM. Somehow, the game will read the data at the correct relative address, but the row data can get corrupted by other data written in RAM if you offset it.

Heian-794 Great graphical hacks!! I love Kyoto, I want to move there someday (ok maybe not). A F-Zero track editor should include a graphic editor, though cars are really tough to edit unless you use CGI models like FZ2 and the GBA F-Zero, but for me the hand drawn cars are part of the original F-Zero experience. Still, it could be fun to integrate CGI 3d models
neviksti

Goomba
Level: 8

Posts: 8/25
EXP: 1510
For next: 677

Since: 06-09-05

Since last post: 36 days
Last activity: 30 days
Posted on 06-18-05 07:01 PM Link | Quote
Well, it looks like it gets the row data after at least two "unpackings".

- somehow the rows for the "track panels" as you called them (32x32 tiles, or 16 rows) are put into ram
- then the rom data holding all the track panels are unpacked (using the above ram table) into just row data in ram

I have not found that first part yet (or more accurately, I may have found it, but have not made sense of it yet ... it jumps all over).

Here is the routine for the second part:
Notice there is no compression ... so this step is easy.

80/A30D:	C230    	REP #$30
80/A30F:	ADF50C  	LDA $0CF5	; ?? track #
80/A312:	29FF00  	AND #$00FF
80/A315:	0A      	ASL A
80/A316:	AA      	TAX 		; X = 2 * track #
80/A317:	A9000C  	LDA #$0C00
80/A31A:	8521    	STA $21		; rom source bank: $0C
80/A31C:	BF80E80C	LDA $0CE880,X
80/A320:	8520    	STA $20		; rom source offset: $0CE880,X
80/A322:	A9007F  	LDA #$7F00
80/A325:	850A    	STA $0A		; ram source bank: $7F
80/A327:	A00000  	LDY #$0000
80/A32A:	BB      	TYX 		; clear x,y
;"unpack row data" loop
80/A32B:	B720    	LDA [$20],Y	;get word for rom
80/A32D:	F01A    	BEQ $A349	;  $0000 means done unpacking
80/A32F:	8509    	STA $09		;otherwise rom word = ram source offset
80/A331:	5A      	PHY 
80/A332:	A00000  	LDY #$0000
80/A335:	B709    	LDA [$09],Y	;get word from ram
80/A337:	9F00407F	STA $7F4000,X	;move to $7F4000 table
80/A33B:	E8      	INX 
80/A33C:	E8      	INX 
80/A33D:	C8      	INY 
80/A33E:	C8      	INY 
80/A33F:	C02000  	CPY #$0020
80/A342:	D0F1    	BNE $A335	;get 16 of these
80/A344:	7A      	PLY 
80/A345:	C8      	INY 
80/A346:	C8      	INY 
80/A347:	80E2    	BRA $A32B
80/A349:	E210    	SEP #$10
80/A34B:	A20E    	LDX #$0E
80/A34D:	BD7BA3  	LDA $A37B,X	; copy data directly, $10 bytes
80/A350:	9FF03F7F	STA $7F3FF0,X	;	$00A37B -> $7F3FF0
80/A354:	CA      	DEX 
80/A355:	CA      	DEX 
80/A356:	10F5    	BPL $A34D
80/A358:	A212    	LDX #$12
80/A35A:	BD67A3  	LDA $A367,X	; copy data directly, $14 bytes
80/A35D:	9DC00E  	STA $0EC0,X	;	$00A367 -> $7E0EC0
80/A360:	CA      	DEX 
80/A361:	CA      	DEX 
80/A362:	10F6    	BPL $A35A
80/A364:	E220    	SEP #$20
80/A366:	60      	RTS
Pages: 1 2Add to favorites | "RSS" Feed | Next newer thread | Next older thread
Acmlm's Board - I2 Archive - Rom Hacking - Complete F-Zero tracks images (at last!) | |


ABII


AcmlmBoard vl.ol (11-01-05)
© 2000-2005 Acmlm, Emuz, et al



Page rendered in 0.017 seconds.