Schrijver
| Help with hacking msx roms
|
manuel msx guru Berichten: 3378 | Geplaatst: 28 Februari 2007, 23:27   |
Quote:
|
I think that you are used to use breakpoints that stop emulation when certain address changes. Unfortunately this kind of breakpoints are not available in BlueMSX or OpenMSX (not sure though).
|
It is available in openMSX. Try this in the console:
debug set_watchpoint write_mem 0x9000
This will put openMSX in to 'debug break' mode when the CPU writes to address 0x9000.
Is that what you mean?
|
|
Whipon msx friend Berichten: 14 | Geplaatst: 01 Maart 2007, 02:56   |
Yes Manuel, thats I mean!!!!!.
Thank you very much for the replies. I'll start to hack right now!.
I just want to say that I know what is a RAM address and what is a ROM address.
Quote:
|
"Whipon, the answer to your question is: you cannot directly translate RAM addresses from the file you have to adresses in ROM."
|
Quote:
|
Once again, those are RAM addresses not ROM adresses. If you can poke the addresses every second or so you should be fine.
|
The only thing I didn't know is how to use the debugger to use these RAM adresses to obtain ROM adresses by the debugger.
Thank you very much to everyone!. n_________n
Whipon. |
|
Whipon msx friend Berichten: 14 | Geplaatst: 01 Maart 2007, 04:14   |
Well, I tried to make the OpenMSX debugger to work, but I can't see the output of it nowhere. I searched the OpenMSX installation folder and nothing, followed the instructions in the manuals in sourceforge and no luck.
I heard that is not a graphic debugger, but a least I need the output of it.
I typed in the console as Manuel said:
debug set_watchpoint write_mem 0xc131
C131 is the health ram address for Metal Gear.
The emulation stops, but I cant find the debug output nowhere!.
Can someone help me with this one. OpenMSX seems to be a bit complicated, and i couldn't make the debug to work with the manuals in the official site.
Thanks again for the help
Whipon.
|
|
Vampier msx addict Berichten: 493 | Geplaatst: 01 Maart 2007, 06:39   |
If you are having difficulties please join #openmsx on irc.freenode.net, please note that most people are in the -1 timezone (Holland/Belgium) I'm in the US eastcoast timezone but I can't help you since I never used the debugger  |
|
manuel msx guru Berichten: 3378 | Geplaatst: 01 Maart 2007, 11:36   |
Getting on IRC is useful.
But, first of all: this debug command was actually meant to be used by external programs only. You can use it from the console as I described, but you need additional commands to see what's going on.
There is a still unreleased GUI debugger around. When you get on IRC, we could give you a binary.
Anyway, so when you're in debug break, you can use other commands on the console to see what's going on.
Check the debug command in the file doc/commands.txt which got installed. Commands like 'disasm' are useful as well 
What exactly do you want to see?
|
|
Whipon msx friend Berichten: 14 | Geplaatst: 01 Maart 2007, 18:16   |
Well, I want to see the asm code where the emulation stops.
For example
If I enter in the console
debug set_watchpoint write_mem 0xc131
Then I resume playing and get hurt intentionally.
The emulation will freeze because of the watchpoint.
So I need to see where the breakpoint caused the emulation to stop, for example:
92A0: DEC C131 (1F)
I'll try the irc to get the debugger binary. But if I can see this info by commands in the console I'll apreciatte if you can tell me how.
C U n_______n
|
|
manuel msx guru Berichten: 3378 | Geplaatst: 01 Maart 2007, 19:03   |
as I said: use 'disasm'
So, after the watchpoint is triggered type:
disasm.
This shows code from 0x9033
9033 jr z,#903a (check if yer out of life now)
9035 djnz #9032
etc.
But the watchpoint is triggered AFTER the write, so check on the previous PC: by typing: disasm 0x9025 (or so) and there you see it:
902B ld hl,#c131
902E ld a,(hl)
902F and a
9030 jr z, #903a (check if you're out of life)
9032 dec (hl) (this causes the watchpoint trigger)
Well, that's nice, isn't it?  Now you have to find this code back in the ROM...
|
|
Whipon msx friend Berichten: 14 | Geplaatst: 02 Maart 2007, 02:46   |
Thank you!!!
I think thats all I need. I'll experiment with it all the night!.
ñ___ñ
|
|
manuel msx guru Berichten: 3378 | Geplaatst: 02 Maart 2007, 11:36   |
OK, let me know how that goes.
|
|
Whipon msx friend Berichten: 14 | Geplaatst: 03 Maart 2007, 03:18   |
Well, I managed to get these cheats:
Vampire killer,
Infinite Lives,
4231 01 ----> disasm data
231 01 => 00 ----> ROM address. The data after the "=>" is the replacing value.
Contra
Infinite Health,
AF18 ld (#e2c9),a 32 C9 E2
6F1A E2 => 01
Invincibility,
BAE0 dec DD 35 FE
7AE0 DD => C9
Metal Gear,
Infinite Health,
9032 dec (hl) 35
5032 35 => 00
I wanted to make a code for Metal Gear, to start with all the weapons (setting a breakpoint before the game starts with the gun ram address), but i couldn't do it. Anyway I tried to do the same in the NES version with no luck. I managed to do it in the NES with a little trick: If you press select, then enter the weapon inventory, the game reads the address where weapon are stored. So I changed that read by puting a LDA FF then a STA. with this I managed to get all the weapons for the start (with no ammo). But then again I couldn't do the same in the msx version. Then I tried to make an infinite ammo code, but to do this, I need to have all the weapons, so I need the cheats to get all the weapons, but I can't figure out how to load the tcl file with openmsx. And I could't find any help in the web for it (maybe I used wrong keywords).
Do you know how to enable the ram cheats?.
I want to thank you for the info you gave me. I love to cheat games, and I enjoy very much hacking them. Are you spanish or latinoamerican?. I answer this because of your username "Manuel".
C U
 |
|
manuel msx guru Berichten: 3378 | Geplaatst: 03 Maart 2007, 11:37   |
I'm Dutch.
Please try the new openMSX 0.6.2 beta I posted about in another thread. It has a very easy to use cheat system, but it should be used from the console. Type there: help trainer, for some help. Then type: trainer Metal[TAB], which will expand to: trainer Metal\ Gear
When you then press enter, you see which cheats are available in the Metal Gear trainer. You can active them by typing e.g.: trainer Metal\ Gear 1 2 3 4
This will activate (toggle) the first 4 cheats (as the list will tell you which is printed after the command: the crosses mean an active cheat). You can also use the descriptions instead of the numbers: trainer Metal\ Gear "enemy 1 gone" "enemy 2 gone"
Should be doable, I think? Using TAB to complete your commands proves to be very useful here  |
|
Whipon msx friend Berichten: 14 | Geplaatst: 03 Maart 2007, 16:41   |
Yes, I think is very easy to do that way. 
I'll post the new cheats here.
Thanks.  |
|
Whipon msx friend Berichten: 14 | Geplaatst: 06 Maart 2007, 03:47   |
I just want to share the codes I found for Metal Gear, the game who introduced me in the amazing msx world:
Metal Gear:
Infinite Health,
9032 dec (hl) 35
5032 35 => 00
Infinite Ammo for all weapons,
4617 ld (hl),a 77
617 77 => 00
Invincible after hit,
6FD5 dec (hl) 35
2FD5 35 => 00
Thanks Manuel!. BTW: where I must post these codes?. Maybe them could help to cheat in a real msx?. Or at least them could help anyone who plays these games in emulators without cheat support.
C U!.
|
|
|
|
|