Getting Started on a VWF?

[justin3009]

I'm looking to start learning more on adding VWF's to games, most notably right now would be Mega Man X3.

I know the font is refreshed non-stop throughout the game but it never gets overwritten by anything else.  I remember reading that the font area could be used as the VWF storage for taking a whole sentence and setting it up?  If I remember correctly.

How exactly would I get started on this though?  I've found in the game where the letters get written to and that's about it so far, minus where the dialogue loads and how they choose font colors and whom speaks, the basic stuff.  I've seen a couple of guides on here but I get so lost in how it's explained that it throws me through a loop.

I guess, what exactly DOES a VWF do besides the usual understanding of adding specific spacing between each letter?

[KingMike]

On SNES, you're pretty much creating "squishy tiles" at runtime.
You read the font data, squeeze the letters together across several tiles, then transfer the condensed tiles to VRAM, and also updating the tilemap accordingly.

[Nightcrawler]

Letters are written to the screen two ways on the SNES. The first is static reference via the tilemap. The full font is loaded once into VRAM. From then on, when the game wants to print text, it alters the screen's tilemap entries to reference those tiles. The second is dynamically drawing them. No font is loaded. It pulls letters when needed from the ROM (or RAM) and creates a tile, or set of tiles, and uploads to VRAM. The tilemap is then changed to reference those new tiles. For every letter, processing is needed to create and load in VRAM a new tile or tiles, rather than simply updated a tilemap.

The differences between them are speed, VRAM usage, and processing. The first is very quick, requires virtually no processing, and uses little VRAM. However, you're confined to having your letters exactly an even tile width (8x8 8x16, 16x16).  Also, the larger the font, the more VRAM you need to take up. It may become less practical if you have a large font like a Japanese game with thousands of Kanji. The second is much more flexible. You can have letters of any size. However, processing is greater and code complexity is greater. VRAM usage is usually greater because new tiles are needed each time a letter is made. Many copies of the letter 'a' will exist in VRAM each time it is used unlike the former method where it is there only one time.

You will need to use the dynamic method in order to do a VWF. So, if your game uses the static reference via tilemap method, you'll need to do a a larger modification to both convert it to dynamic and then be VWF per character. If your game is already dynamic, but uses a fixed width font, you'll need to modify it to simply use variable width, which is much less work as the game was already drawing tiles dynamically.

It really helps if you understand how the screen is put together with backgrounds, tilemaps, and VRAM. Then the concept becomes much easier to grasp. I suggest using VSNES as a good visual learning tool and documentation by Anomie to understand the details of any hardware registers that come up during your investigations.

Here is a little overview of the mechanics of what a VWF routine actually does:
http://transcorp.parodius.com/forum/YaBB.pl?num=1124688575/1#1

It may sound somewhat difficult, but it's not. Break it into baby steps and learn one thing at a time.

Extra Note: What you've heard about using the font are being used for VWF storage applies to converting the static tile map reference to dynamic. You will then be able to use the space that used to be for the font as it is no longer needed. Instead, it will store your new tiles dynamically created by your VWF.

[justin3009]

I was hoping the game would have fixed-width but it doesn't so that makes things much more complicated than what I was hoping.  Though this is a good time to start learning how to do it from the basics.

The dynamic option is the best bet on this, which I believe you stated as well.  The font's 8x8 so I think that makes it a little easier, though there's more than enough room I believe for 8x16 or 16x16.  Though I'd probably just stick with 8x16 at the most if I ever had to go that far.  But yea, ranting aside there 8x8 is the main choice right now.

I also remember reading that little tidbit of yours on the forum Night.  It makes things more clear than before, but as you said I'll be taking baby steps.  This is rather confusing for me at first site but I understand it a bit more.  I'll be attempting to start on it or at least use VSNES like you said and get a better visual look.  (Did you mean BSNES or is it literally VSNES?)

[Dragoon ZERO]

vSNES

[justin3009]

Looking at BSNES and the most obvious piece of info is that the dialogue was on Layer Background 3, though that's pretty easily seen if you remove layers in any emulator.

Should there be something specifically that I look get a better look?

[RedComet]

The only two pieces of information you really need to get started is where the tilemap is in VRAM and where the tiles associated with that tilemap are stored in VRAM. VSNES can tell you both. From there you just set break points and work your way backwards until you've found the text routine.

[justin3009]

Oh woops, I meant to say VSNES.  But ohh okay I see where you're going with that!  That makes a lot more sense   I'll take a whack at that right now while I have the time.

[RedComet]

Keep in mind bsnes is the only emulator that will let you set breakpoints on VRAM addresses.

[justin3009]

Oh good thing you just noted that too.  I was about to get a head start on this.

I'll keep that in mind and try to work with it.  BSNES is rather interesting to work with so I'll be getting a nice learning experience from that as well.

Edit: How exactly do breakpoints work with BSNES?  Better yet, is there a guide for BSNES debugging anywhere?

[RedComet]

Debugging is debugging regardless of the emulator. Make sure you have the debugger build then open the debugger window and set a breakpoint from the menu.

[justin3009]

Edit:  I had this listed in one of my files and it seems these two addresses are always written to whenever a letter is shown on screen.

Code Select Expand

$00/E672 89 80       BIT #$80                A:0145 X:0001 Y:000B D:0000 DB:06 S:01FF P:envMXdIzC HC:0788 VC:078 FC:20 I:00
$00/E674 F0 03       BEQ $03    [$E679]      A:0145 X:0001 Y:000B D:0000 DB:06 S:01FF P:envMXdIZC HC:0812 VC:078 FC:20 I:00
$00/E679 A6 A5       LDX $A5    [$00:00A5]   A:0145 X:0001 Y:000B D:0000 DB:06 S:01FF P:envMXdIZC HC:0842 VC:078 FC:20 I:00
$00/E67B 9D 04 06    STA $0604,x[$06:0604]   A:0145 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIZC HC:0874 VC:078 FC:20 I:00
$00/E67E A5 6E       LDA $6E    [$00:006E]   A:0145 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIZC HC:0920 VC:078 FC:20 I:00
$00/E680 9D 05 06    STA $0605,x[$06:0605]   A:0108 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzC HC:0952 VC:078 FC:20 I:00
$00/E683 A9 80       LDA #$80                A:0108 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzC HC:0998 VC:078 FC:20 I:00 - Text color
$00/E685 9D 00 06    STA $0600,x[$06:0600]   A:0180 X:0000 Y:000B D:0000 DB:06 S:01FF P:eNvMXdIzC HC:1022 VC:078 FC:20 I:00
$00/E688 C2 21       REP #$21                A:0180 X:0000 Y:000B D:0000 DB:06 S:01FF P:eNvMXdIzC HC:1068 VC:078 FC:20 I:00
$00/E68A A5 6A       LDA $6A    [$00:006A]   A:0180 X:0000 Y:000B D:0000 DB:06 S:01FF P:eNvmXdIzc HC:1098 VC:078 FC:20 I:00
$00/E68C 65 6C       ADC $6C    [$00:006C]   A:0886 X:0000 Y:000B D:0000 DB:06 S:01FF P:envmXdIzc HC:1172 VC:078 FC:20 I:00
$00/E68E 18          CLC                     A:0888 X:0000 Y:000B D:0000 DB:06 S:01FF P:envmXdIzc HC:1212 VC:078 FC:20 I:00
$00/E68F 69 20 00    ADC #$0020              A:0888 X:0000 Y:000B D:0000 DB:06 S:01FF P:envmXdIzc HC:1234 VC:078 FC:20 I:00
$00/E692 29 FF 07    AND #$07FF              A:08A8 X:0000 Y:000B D:0000 DB:06 S:01FF P:envmXdIzc HC:1266 VC:078 FC:20 I:00
$00/E695 09 00 08    ORA #$0800              A:00A8 X:0000 Y:000B D:0000 DB:06 S:01FF P:envmXdIzc HC:1298 VC:078 FC:20 I:00
$00/E698 9D 01 06    STA $0601,x[$06:0601]   A:08A8 X:0000 Y:000B D:0000 DB:06 S:01FF P:envmXdIzc HC:1330 VC:078 FC:20 I:00
$00/E69B E6 6C       INC $6C    [$00:006C]   A:08A8 X:0000 Y:000B D:0000 DB:06 S:01FF P:envmXdIzc HC:0020 VC:079 FC:20 I:00
$00/E69D E2 20       SEP #$20                A:08A8 X:0000 Y:000B D:0000 DB:06 S:01FF P:envmXdIzc HC:0082 VC:079 FC:20 I:00
$00/E69F A9 02       LDA #$02                A:08A8 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzc HC:0112 VC:079 FC:20 I:00
$00/E6A1 9D 03 06    STA $0603,x[$06:0603]   A:0802 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzc HC:0136 VC:079 FC:20 I:00
$00/E6A4 8A          TXA                     A:0802 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzc HC:0182 VC:079 FC:20 I:00
$00/E6A5 18          CLC                     A:0800 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIZc HC:0204 VC:079 FC:20 I:00
$00/E6A6 69 06       ADC #$06                A:0800 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIZc HC:0226 VC:079 FC:20 I:00
$00/E6A8 85 A5       STA $A5    [$00:00A5]   A:0806 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzc HC:0250 VC:079 FC:20 I:00
$00/E6AA AD 49 1F    LDA $1F49  [$06:1F49]   A:0806 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzc HC:0282 VC:079 FC:20 I:00
$00/E6AD F0 38       BEQ $38    [$E6E7]      A:0800 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIZc HC:0322 VC:079 FC:20 I:00
$00/E6E7 AD 4A 1F    LDA $1F4A  [$06:1F4A]   A:0800 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIZc HC:0352 VC:079 FC:20 I:00
$00/E6EA 30 08       BMI $08    [$E6F4]      A:0801 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzc HC:0392 VC:079 FC:20 I:00
$00/E6EC CE 4A 1F    DEC $1F4A  [$06:1F4A]   A:0801 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzc HC:0416 VC:079 FC:20 I:00
$00/E6EF F0 03       BEQ $03    [$E6F4]      A:0801 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIZc HC:0470 VC:079 FC:20 I:00
$00/E6F4 A6 6F       LDX $6F    [$00:006F]   A:0801 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIZc HC:0500 VC:079 FC:20 I:00 - Text speed
$00/E6F6 F0 2D       BEQ $2D    [$E725]      A:0801 X:0004 Y:000B D:0000 DB:06 S:01FF P:envMXdIzc HC:0532 VC:079 FC:20 I:00
$00/E6F8 E0 01       CPX #$01                A:0801 X:0004 Y:000B D:0000 DB:06 S:01FF P:envMXdIzc HC:0596 VC:079 FC:20 I:00
$00/E6FA F0 1C       BEQ $1C    [$E718]      A:0801 X:0004 Y:000B D:0000 DB:06 S:01FF P:envMXdIzC HC:0620 VC:079 FC:20 I:00
$00/E6FC AD B3 1F    LDA $1FB3  [$06:1FB3]   A:0801 X:0004 Y:000B D:0000 DB:06 S:01FF P:envMXdIzC HC:0644 VC:079 FC:20 I:00
$00/E6FF D0 17       BNE $17    [$E718]      A:0800 X:0004 Y:000B D:0000 DB:06 S:01FF P:envMXdIZC HC:0684 VC:079 FC:20 I:00
$00/E701 5A          PHY                     A:0800 X:0004 Y:000B D:0000 DB:06 S:01FF P:envMXdIZC HC:0708 VC:079 FC:20 I:00
$00/E702 AD 49 1F    LDA $1F49  [$06:1F49]   A:0800 X:0004 Y:000B D:0000 DB:06 S:01FE P:envMXdIZC HC:0738 VC:079 FC:20 I:00
$00/E705 F0 0B       BEQ $0B    [$E712]      A:0800 X:0004 Y:000B D:0000 DB:06 S:01FE P:envMXdIZC HC:0778 VC:079 FC:20 I:00
$00/E712 A9 1E       LDA #$1E                A:0800 X:0004 Y:000B D:0000 DB:06 S:01FE P:envMXdIZC HC:0808 VC:079 FC:20 I:00 - SFX to use each time a letter is written
$00/E714 20 79 85    JSR $8579  [$00:8579]   A:081E X:0004 Y:000B D:0000 DB:06 S:01FE P:envMXdIzC HC:0832 VC:079 FC:20 I:00

Out of those, these couple areas are important.  These are written too whenever a letter appears on screen.

$00/E67B 9D 04 06    STA $0604,x[$06:0604]   A:0145 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIZC HC:0874 VC:078 FC:20 I:00
$00/E680 9D 05 06    STA $0605,x[$06:0605]   A:0108 X:0000 Y:000B D:0000 DB:06 S:01FF P:envMXdIzC HC:0952 VC:078 FC:20 I:00

Those values are either in the CX4 chip or VRAM since they cannot be accessed by normal means.  Relates back to the 'ole life bar glitch.

[Mauron]

According to Anomie's C4 Chip Doc, $6000-$6bff(?) (Sorry, it cleared the text when I checked the spelling of Anomie) is generic ram on the chip.

[justin3009]

Ick.. you're right.  Back to the drawing board again.  I'll try vSNES again.  How exactly do you know you've found the right area though?  Especially with BSNES.  I've put a breakpoint for VRAM and it just says "Breakpoint x hit (x)".  Not really sure what that's supposed to do for me ._.

Edit: Looking at vSNES again.  2109 seems to effect layer 3 which is where the font is on.  It says it's 7 bits and a value of 09.  I'm guessing that's the info I needed, but I'm not sure what to do with it now.

Edit 2: Set a breakpoint in SNES9X for the heck of it and it led me to.

$7E/212D A5 CE       LDA $CE    [$00:00CE]   A:00E1 X:0000 Y:6000 P:eNvMxdIzc - Removing this will destroy Layer 3 completely.
$7E/212F 8D 09 21    STA $2109  [$06:2109]   A:000A X:0000 Y:6000 P:envMxdIzc

[Nightcrawler]

Start with what you know and work backwards and expand your knowledge. VSNES will show you where the background layer tile tilemap data is in VRAM. This is an effective address. The actual address that would be written to $2116 is half of that because it's word addressed (instead of byte). You can verify yourself in the VRAM viewer that the data is there. You can even edit it if you want and see the results occur instantly in VSNES. (Remember that VSNES is limited in it's abilities to display HDMA (scanline) effects.) If you look at the tilemap there, you'll also know what actual byte values to be looking for to confirm you've found the right code later.

Now, you know the place of interest in VRAM. Now you need to start looking for how data gets there. Most of the time it's going to be a DMA transfer to the area or manual write to $2118/$2119. Remember VRAM address is set in $2116 for either method, so that should clue you in to relevant code. You can use breakpoints, you can list active DMA transfers in Geiger's debugger real time, or you can use a tracelog and look for DMA routines. Whatever works for you to start finding some relevant code that writes to the area of VRAM you found earlier. You'll find it either comes from somewhere in RAM or ROM. If it's RAM, you continue on and find out how the data got to where it is in RAM. Continue farther back if you need. You'll eventually end up at the relevant code.

I think you're on the right track:
In your case where you've mentioned the whole font is in VRAM, you'll most likely find a copy of the tilemap in RAM (or C4 RAM ) that gets sent to VRAM each frame. That's how most games do a static tilemap based font routine.

From the code you posted, it looks like you've probably found the right code. There is probably a copy of the tilemap in that $06:0600 region. Verify by seeing if the tilemap in VSNES has tile data with the bytes you see being written there. Or, edit them in a debugger that allows you to access that RAM (I think we had that discussion in another topic. I forget what the end result was.)

Once you've confirmed you've found the tilemap data and text routine and understand how it works, you can start making a sensible plan on modification.

These are the most difficult mechanics to pick up in ROM hacking. Nobody can really teach you how to be good at reverse engineering. You will improve with experience and time. Also, the more knowledge you gain about the platform you're working with, the easier it will be.

[justin3009]

I'm slowly speaking with someone to help assist some of the areas that I'm getting lost at, but here's some more information I think.

Code Select Expand

    These appear once the letters do
        DMA[0]: CPU->PPU Mode:1 0x000604->0x2118 Bytes:34 (inc) V:232 VRAM: 0984 (1,0) word
        DMA[0]: CPU->PPU Mode:1 0x00063C->0x2118 Bytes:2 (inc) V:233 VRAM: 0984 (1,0) word
        DMA[0]: CPU->PPU Mode:1 0x000642->0x2118 Bytes:34 (inc) V:234 VRAM: 09C4 (1,0) word
        DMA[0]: CPU->PPU Mode:1 0x00067A->0x2118 Bytes:2 (inc) V:235 VRAM: 09C4 (1,0) word
        DMA[0]: CPU->PPU Mode:1 0x000680->0x2118 Bytes:28 (inc) V:235 VRAM: 0A04 (1,0) word
        DMA[0]: CPU->PPU Mode:1 0x0006AC->0x2118 Bytes:28 (inc) V:236 VRAM: 0A44 (1,0) word
   
   
    $00/E67B 9D 04 06    STA $0604,x[$06:0604]   A:012E X:0000 Y:0016 P:envMXdIZC
    DMA[0]: CPU->PPU Mode:1 0x000604->0x2118 Bytes:2 (inc) V:235 VRAM: 0BB4 (1,0) word
    $7E/22BC 8D 0B 42    STA $420B  [$06:420B]   A:0001 X:0004 Y:0000 P:envMXdIzc

0984 in VRAM in Geiger's literally shows nothing, but going to 604 and it's partially the letters in the tilemap.  I knocked a chunk of it out and a mass horde of the letters went missing.  So I'm guessing around 300-900 is where the tilemap is.

[RedComet]

Try checking at $1308. Like NC said, it's word addressed. Anytime you see a VRAM address in Geiger's DMA log double it to get the address to look at in the hex editor.

[justin3009]

Oh duh, right.  Completely bypassed that.  The screen I've been looking at is the Capcom Copyright screen right when the game starts.  Ends up being 1308 IS where it's all being stored correctly.  I thought maybe this wasn't the right area to check but that area loads the font as well so it's generally okay.  So yep, 1308 is the right spot.

Would my next step to trace it backwards?  If so, how do you work backwards from VRAM?  I've never done it with that but I've done it multitudes of times with regular code.

[RedComet]

Oh duh, right.  Completely bypassed that.  The screen I've been looking at is the Capcom Copyright screen right when the game starts.  Ends up being 1308 IS where it's all being stored correctly.  I thought maybe this wasn't the right area to check but that area loads the font as well so it's generally okay.  So yep, 1308 is the right spot.

Would my next step to trace it backwards?  If so, how do you work backwards from VRAM?  I've never done it with that but I've done it multitudes of times with regular code.

You can set a breakpoint on VRAM with bsnes and go from there.

What I like to do is open up VRAM in the hex editor (I typically use Geiger's SNES9x simply because it supports savestates and switch to bsnes when Geiger's debugger falls short), jump to the address where the data is ($1308 in your case) and run the game until the data appears so I have some idea when the data is written to VRAM. Then I reset the game (or load a savestate to a point before the data is put in VRAM) and turn on DMA logging while the data is loaded and hope for a bite.

If I find the data is being sent to VRAM via DMA, I either use the source address as my next point of interest (usually RAM) or make a trace and try to catch the write to $420b that starts the DMA transfer. Then you just keep working backwards.

[justin3009]

DMA[0]: CPU->PPU Mode:1 0x7E2622->0x2118 Bytes:1000 (fixed) V:232 VRAM: 5000 (1,0) word
DMA[0]: CPU->PPU Mode:1 0x7E2622->0x2118 Bytes:1000 (fixed) V:257 VRAM: 5800 (1,0) word
DMA[0]: CPU->PPU Mode:1 0x7E2622->0x2118 Bytes:1000 (fixed) V:020 VRAM: 0800 (1,0) word

This is what comes up in SNES9X whenever it gets hit so that's probably where I should work backwards from in RAM is my guess.

In BSNES when I set a Write Breakpoint to 1308 with VRAM, it just says this.

Breakpoint 0 hit (1).
Breakpoint 0 hit (2).
Breakpoint 0 hit (3).

I'm not entirely sure how BSNES helped in that cause ._.

Edit: Maybe that isn't right on SNES9X's case.  All that leads me to is nothing at all, so not really sure what's up there.

Edit 2:
Saw this at the top of the log buuuut

Code Select Expand

..ffcf nop                    A:00 X:00 Y:00 SP:01ef YA:0000 nvpbhizc
008106 beq $8103     [008103] A:0100 X:00ff Y:0001 S:02ff D:0000 DB:06 nvMXdIZc V:241 H:  18
008103 lda $09ce     [0609ce] A:0100 X:00ff Y:0001 S:02ff D:0000 DB:06 nvMXdIZc V:241 H:  40
..ffd2 nop                    A:00 X:00 Y:00 SP:01ef YA:0000 nvpbhizc
001ff3 jml $7e2000   [7e2000] A:0100 X:00ff Y:0001 S:02fb D:0000 DB:06 nvMXdIZc V:225 H: 104


7e22ba lda #$01               A:0006 X:0004 Y:0000 S:02ee D:0000 DB:06 nvMXdIzc V:232 H:1126
7e22bc sta $420b     [06420b] A:0001 X:0004 Y:0000 S:02ee D:0000 DB:06 nvMXdIzc V:232 H:1142

NOPing these out will remove all traces of the font in game, but layer 3 will still okay.  I believe this is what I was needing to find?