News: 11 March 2016 - Forum Rules
Current Moderators - DarkSol, KingMike, MathOnNapkins, Azkadellia, Danke

### Author Topic: Sega 68K Branch on not equal question  (Read 2189 times)

#### seraphim423

• Jr. Member
• Posts: 22
##### Sega 68K Branch on not equal question
« on: June 08, 2019, 06:13:41 pm »
I have a question to anyone with some 68k language knowledge.

This requires some set up for explanation so bear with me.

This has to do with Shadow run on Sega.

In the game there are 12 weapons.  Each weapon is assigned a number between 1 and 12 that the game uses to track it.  This tells the game what type of gun it is (pistol, smg, or shotgun), tells it how to reduce its ammo (3 per trigger pull for burst weapons), and determines if the gun fires in a burst fire or not.

1-7 correspond to pistols
8-10 correspond to smgs
11-12 correspond to shotguns

The way the game works is it runs a compare bit and then branches into two different directions based on rather the gun is an pistol/shotgun or SMG. SMGs are assigned numbers 8,9, and 10.  So the code looks like this.

cmbip #8,%a0@(87)
beqw 0x0000002a
cmbip #9,%a0@(87)
beqw 0x0000002a
cmbip #10,%a0@(87)
bneq 0x00000127

and the way I understand what is going on it compares the bit to 8,9, and 10 and sends the game to one of two locations to determine how the weapon fires.

I have been able to make guns past a certain points in the string fire on burst by replacing "branch if equal" with "branch if greater than". This has given me some flexibility redesigning the weapons but is also restrictive.  I've been able to design a machine pistol by making it branch if greater than 6 but this also has the effect of making the shotguns fully automatic.

So with this said I have a couple of questions.

What kind of command did the Sega use to identify what items correspond to the bit number?  Some details of the weapons (Name, inventory picture, ammo count, damage, armor piercing ability, etc) are all defined in specific addresses in the ROM.  Each item has about two full ROM addresses dedicated to it.  So somewhere in the code it has to say "these two ROM addresses correspond to gun 1, these two to gun 2, etc.

Second question would be how to I read the branch command?  Where is it telling the game to go look for additional directions above?  I do not understand what 0x0000002a or 0x00000127 means.

I know you cannot just insert directions into the ROM because it would throw the address off.  But a good portion of the ROM is not used in the addresses that the SEGA developer manual says is dedicated to game info. I was hoping to change the branch location to an unused part of the rom and then I could insert a few more iterations of compare bit to x and branch if equal and then bring it all back around. Would this possibly be a solution?

I apologize if my questions don't make sense, I can try to clarify if needed.

Thanks in advance for any help.

#### Malias

• Sr. Member
• Posts: 301
##### Re: Sega 68K Branch on not equal question
« Reply #1 on: June 10, 2019, 12:58:43 pm »
What kind of command did the Sega use to identify what items correspond to the bit number?  Some details of the weapons (Name, inventory picture, ammo count, damage, armor piercing ability, etc) are all defined in specific addresses in the ROM.  Each item has about two full ROM addresses dedicated to it.  So somewhere in the code it has to say "these two ROM addresses correspond to gun 1, these two to gun 2, etc.

First off, I'm assuming you mean byte, not bit.  Have you tried searching the ROM for the content of RAM at that address?  It could be that the data's being directly read from ROM.  The surest way to find out where the weapon data is coming from and how it's put into memory is to either get a code trace or to set a write breakpoint on the memory address being read in you emulator of choice.  In this case, that would be whatever address is at A0 + 0x87 (I'm assuming the offset is in hex).

Quote
Second question would be how to I read the branch command?  Where is it telling the game to go look for additional directions above?  I do not understand what 0x0000002a or 0x00000127 means.

I would recommend reading up on the instruction set of the 68k so you can better understand the instructions.  This site is a pretty convenient reference: http://68k.hax.com.  For the instruction in question, see this page

Quote
I know you cannot just insert directions into the ROM because it would throw the address off.  But a good portion of the ROM is not used in the addresses that the SEGA developer manual says is dedicated to game info. I was hoping to change the branch location to an unused part of the rom and then I could insert a few more iterations of compare bit to x and branch if equal and then bring it all back around. Would this possibly be a solution?

Unfortunately with branches, you're limited where you can jump to and I can almost guarantee the code you'll want to run will be out of range of a branch.  You might have to move this branch block to your code and change it to use jumps instead. The quick and dirty way to change code flow is to overwrite some of the code with a jump to the code you want to execute, move the code you overwrote to the beginning of your code block, run your code, then jump back into the code to resume normal execution.
The great achievement is to lose one's reason for no reason, and to let my lady know that if I can do this without cause, what should I do if there were cause?
~Don Quixote~

#### RyanfaeScotland

• Sr. Member
• Posts: 366
##### Re: Sega 68K Branch on not equal question
« Reply #2 on: June 25, 2019, 04:17:25 pm »
...The quick and dirty way to change code flow is to overwrite some of the code with a jump to the code you want to execute, move the code you overwrote to the beginning of your code block, run your code, then jump back into the code to resume normal execution.

Thanks Malias, I've been wondering about that myself and now that you explain it it seems fairly obvious. Overwriting existing code had occurred to me but I'd never thought of putting the code I overwrite into the new location. Sneaky!

What are you using to generate the code Seraphim423? Because none of the code you have posted there is actually valid 68k, it's close, but it isn't right. If it was from your own memory then I can forgive it but if it is copy and pasted from somewhere then something isn't right.

Identifying items was likely done through constants. For example I could write:

Code: [Select]
`SMG_1 EQU \$08`
and then change the first line of code you posted to

Code: [Select]
`cmbip #SMG_1,%a0@(87)`
and it would still work. However this information is lost when disassembling the finished ROM as the assembler substitutes out all the nice constant names for the number they represent.

Although the link Malias has gave is certainly a good reference, I prefer http://mrjester.hapisan.com/04_MC68/ for its nice wordy descriptions and examples of how many of the 68k instructions work. I'd start there if you are still new to some of them.

#### seraphim423

• Jr. Member
• Posts: 22
##### Re: Sega 68K Branch on not equal question
« Reply #3 on: June 28, 2019, 06:16:11 pm »
Malias that was unbelievably helpful, thank you.  I had not thought of that, but that seems like such an easy fix.

In regards to RyanfaeScotland I used an online disassembler that probably is not perfect.  I've downloaded IDA 68K free as a disasembler but haven't had time to sit down with it and get it configured to run correctly.  I liked the web one because it was pretty easy to just drop code in and look at it and mess around till you had what you wanted it, but if its not giving me good code back then I probably need to look for something else.

Malias' solution of using a jump command to move to an empty area and insert a couple more compare bit to commands to get the desired results seems like a pretty workable solution.  Now I just need life to slow down enough to get the time to try it.

And I apologize for the delays since you guys took time out of your days to help me with a problem.  Work has kinda picked up so life is some what hectic.

#### RyanfaeScotland

• Sr. Member
• Posts: 366
##### Re: Sega 68K Branch on not equal question
« Reply #4 on: June 30, 2019, 03:47:07 am »
Real Life (tm) happens to us all, no need to apologise.

Exodus and Gens KMod are good emulator for looking at the code, they let you set breakpoints, step through one line at a time and so on. Worth checking out when you find a little time.