News: 11 March 2016 - Forum Rules
Current Moderators - DarkSol, KingMike, MathOnNapkins, Azkadellia, Danke

Author Topic: FCEUX PPU Viewer: Left Table  (Read 6744 times)

RaidouJFlo

  • Jr. Member
  • **
  • Posts: 67
    • View Profile
FCEUX PPU Viewer: Left Table
« on: March 10, 2016, 10:27:44 am »
Hi,

Long ago I made a thread about translating DDS2, but I said I'd quit, but I eventually picked it up again and did a crap load of work on it.  In hindsight, I've always used the right table as a reference for finding things, or table creation, but I've encountered a roadblock in what I've been doing!  I am only guessing the left table may be relevant to this issue, so can someone explain what the significance of that table is? 

I will use 2 examples.

For DDS2, text hacking has been as simple as just searching a string of bytes that correspond to what was being shown on the screen.  The menus (battle commands, etc) were in a vertical sequence, as opposed to horizontal, so that was a bit tricky to find, but the right side table was used for that too.

HOWEVER, I have encountered 2 things now in which I cannot find the text, by searching a conventional horizontal sequence or the alternative vertical sequence.

These 2 things I am talking about are when you are looking at a door in FPS mode which erects a small box with text.  The second thing is a small box with text again, but on the world map (I.E, going to Haneda will show Haneda in japanese on the top right).  I cannot show you the latter since my save file is at home but I can show you the first thing.

Poison Bar for example is what I cannot find in the ROM section.



I tried using the right table's upper tiles:

1B=P
1A=O
14=I
1E=S
19=N

or the curious left table's tiles (which quite frankly I have never used):

99=P
98=O
92=I
9C=S
97=N

Here are said tables:



I've had no luck finding POISON for example anywhere.  The reason I ask about the left table is because I took a look at the RAM section randomly and noticed POISON using the left tile IDs.  I can also change the hex in the RAM and it will reflect in-game.  That is about as far as I went.  Hex below:

So I know this game has the horizontal/vertical sequence.  How do you think POISON BAR is being displayed?  I hope this all made sense, I guess.  I don't feel like continuing this until I find out how to hack that text. 

The second thing I mentioned (HANEDA) also appears at that same address (starting at $0225).


AWJ

  • Full Member
  • ***
  • Posts: 105
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #1 on: March 10, 2016, 12:06:49 pm »
The section of RAM you've highlighted is definitely the sprite list (aka shadow OAM). It looks like that popup window is made out of sprites. Why don't you set a write breakpoint/watchpoint there (whatever they're called in FCEUX) and see how the program generates the list?

KingMike

  • Forum Moderator
  • Hero Member
  • *****
  • Posts: 6900
  • *sigh* A changed avatar. Big deal.
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #2 on: March 10, 2016, 12:16:53 pm »
Left and Right Table are because the NES supports two tilesets, one for sprite tiles and one for background tiles.
Games can select either one for either purpose (I think they can even use one tileset for both sprite and BG if they wanted to).
"My watch says 30 chickens" Google, 2018

RaidouJFlo

  • Jr. Member
  • **
  • Posts: 67
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #3 on: March 10, 2016, 01:27:57 pm »
The section of RAM you've highlighted is definitely the sprite list (aka shadow OAM). It looks like that popup window is made out of sprites. Why don't you set a write breakpoint/watchpoint there (whatever they're called in FCEUX) and see how the program generates the list?

Setting a write breakpoint at $0225 (where P is), I see this:

0F:F28B:9D 01 02  STA $0201,X

Just above that is a:

0F:F28A:68        PLA

Looking at the A register as well, it's at #$99 when that write breakpoint occurs.  X is also set to 24.  When I see the Hex Editor, $0225 is also set to #$99.

So if I'm understanding this correctly, the A register is somehow becoming #$99, and that byte is being stored at the address $0201 + 24?

Regarding PLA, does this mean it's pulling #$99 from the stack and assigning it to the A register?  Though I have no idea why #$99 is in the stack at that exact moment.

Evidently my ASM is weak, but I'm curious if I somewhat understand that correctly I guess?

I will still be glancing at this code, provided I understand what's going on.


There's also this line, which occurs in what I imagine is the loop handling this drawing code.  It's above the STA code above:

0F:F282:BE D3 F2  LDX $F2D3,Y @ $F2DD = #$28

Does this mean the address for these letters are relative to X, and that X is relative to $F2D3 + Y?

Though that doesn't matter, right?  Should I be focusing on how the stack is generating those A register values?  If the value is being pulled, then prior to all of this, the value must be getting pushed in, right?  Pushed in backwards maybe?

Here's a picture:



Left and Right Table are because the NES supports two tilesets, one for sprite tiles and one for background tiles.
Games can select either one for either purpose (I think they can even use one tileset for both sprite and BG if they wanted to).

Never really occurred to me, but what you're saying essentially is that NES games are made up of 2 layers only then, right?  Ah, and I see.  Left isn't always necessarily the foreground as it can be customized.  Cool to know.

RetroRain

  • Sr. Member
  • ****
  • Posts: 286
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #4 on: March 10, 2016, 01:46:08 pm »
RaidouJFlo, have you been able to solve your problem?  I've had to deal with a lot of PPU nonsense myself, so if you can't figure it out, I'll be able to take a look at it later tonight when I get home from work, or if I'm too tired, tomorrow.  What's the name of the game?  I'm not familiar with the abbreviation DDS2.

RaidouJFlo

  • Jr. Member
  • **
  • Posts: 67
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #5 on: March 10, 2016, 01:52:39 pm »
RaidouJFlo, have you been able to solve your problem?  I've had to deal with a lot of PPU nonsense myself, so if you can't figure it out, I'll be able to take a look at it later tonight when I get home from work, or if I'm too tired, tomorrow.  What's the name of the game?  I'm not familiar with the abbreviation DDS2.

Digital Devil Monogatari: Megami Tensei II.

All the examples I'm using are from an untouched Japanese rom since I'm posting from work, so my testing here can be mirrored on the default rom.

Have not been able to solve my problem yet actually, though I did notice something interesting.  Address $01F1 is changing into each letter individually, whenever I click "Run Line." from the debugger.  I assume how POISON is being written is through a loop, so the function of Run Line is just running all possible code until it reaches that same line again?  I thought it would have run the next line of code but "Step Into" seems to serve that function.

The table I'm using is:

99=P
98=O
92=I
9C=S
97=N

and to get to the poison bar, head south from the beginning of the game until your first right.  Head right 2 blocks and go north into the door.  Choose the second option with the old man, and the second option at the computer room.  You'll then be in the green room.  Look east then move until you hit a wall, then look north.  You will be infront of the Poison Bar and the text will come up.

Example pics:





I've been trying to add a conditional breakpoint to have A == #99 at $01F1 but it does not seem to be doing anything.  Admittedly again though I'm not sure I'm on the right path here.
« Last Edit: March 10, 2016, 02:04:58 pm by RaidouJFlo »

AWJ

  • Full Member
  • ***
  • Posts: 105
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #6 on: March 10, 2016, 01:54:49 pm »
Setting a write breakpoint at $0225 (where P is), I see this:

0F:F28B:9D 01 02  STA $0201,X

Just above that is a:

0F:F28A:68        PLA

Looking at the A register as well, it's at #$99 when that write breakpoint occurs.  X is also set to 24.  When I see the Hex Editor, $0225 is also set to #$99.

So if I'm understanding this correctly, the A register is somehow becoming #$99, and that byte is being stored at the address $0201 + 24?

Regarding PLA, does this mean it's pulling #$99 from the stack and assigning it to the A register?  Though I have no idea why #$99 is in the stack at that exact moment.

Evidently my ASM is weak, but I'm curious if I somewhat understand that correctly I guess?

Yes, you're going to have to find where the value of #$99 is getting pushed onto the stack.

Quote
There's also this line, which occurs in what I imagine is the loop handling this drawing code.  It's above the STA code above:

0F:F282:BE D3 F2  LDX $F2D3,Y @ $F2DD = #$28

Does this mean the address for these letters are relative to X, and that X is relative to $F2D3 + Y?

No, X is an offset to the destination address in this case. STA $xxxx,X means "take the base address xxxx, add the contents of X to it, and store A at that location". The table at $F2D3 won't help you find where the tile values are coming from (it's probably just a multiply-by-4 lookup table)

RetroRain

  • Sr. Member
  • ****
  • Posts: 286
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #7 on: March 10, 2016, 02:04:46 pm »
Now, the box that says POISON BAR, I'm assuming that that is what you are trying to change it to?  You said you are translating the game.  Does that mean that that text is really Japanese, and you are trying to find it so you can change it to POISON BAR?  I read your posts, but it wasn't clear to me.

Anyway, here is how sprites work:

Y value
Sprite Tile Number
Palette/Mirror Rotation Value
X value

Try highlighting 0x224 to 0x23B in that RAM window, and copy it.  Then go to View in the hex editor toolbox, and go to ROM File.

Then open up the search box, and paste those values you copied.  See if it weilds any results.  If it does, search again to see if that first search result was the only search result.  If it is, it is possible you may have found your data.

As I said above, sprites work in that format.

For instance:

At 0x225 in the RAM viewer, you have these four bytes:

38 99 00 68

That represents one sprite.

The 38 is the Y.
The 99 is the sprite tile ID number.
The 00 is both the palette and rotation value.
The 68 is the X.

So, if you find that string that you copied in the ROM file, try changing the second number of every four numbers to what you want.  That would change the sprite word for you.

This is just one method of going about finding the data.  If it doesn't work, you'll have to try another.

I have to go to work now, but if you still can't figure this out, I'll take a look at it later or tomorrow.

RaidouJFlo

  • Jr. Member
  • **
  • Posts: 67
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #8 on: March 10, 2016, 02:07:06 pm »
Now, the box that says POISON BAR, I'm assuming that that is what you are trying to change it to?  You said you are translating the game.  Does that mean that that text is really Japanese, and you are trying to find it so you can change it to POISON BAR?  I read your posts, but it wasn't clear to me.

Anyway, here is how sprites work:

Y value
Sprite Tile Number
Palette/Mirror Rotation Value
X value

Try highlighting 0x224 to 0x23B in that RAM window, and copy it.  Then go to View in the hex editor toolbox, and go to ROM File.

Then open up the search box, and paste those values you copied.  See if it weilds any results.  If it does, search again to see if that first search result was the only search result.  If it is, it is possible you may have found your data.

As I said above, sprites work in that format.

For instance:

At 0x225 in the RAM viewer, you have these four bytes:

38 99 00 68

That represents one sprite.

The 38 is the Y.
The 99 is the sprite tile ID number.
The 00 is both the palette and rotation value.
The 68 is the X.

So, if you find that string that you copied in the ROM file, try changing the second number of every four numbers to what you want.  That would change the sprite word for you.

This is just one method of going about finding the data.  If it doesn't work, you'll have to try another.

I have to go to work now, but if you still can't figure this out, I'll take a look at it later or tomorrow.



POISON BAR is the default text, but there are a few text boxes that come up as Japanese.  Changing Poison Bar should be enough practice to affect any kind of occurrence of this.  Anyway, I'll read everything you've said now and post an update.

EDIT:

That did not yield anything.  I even tried to simplify by search 38 99 00 68.  No luck, but interesting that you said that.

Yes, you're going to have to find where the value of #$99 is getting pushed onto the stack.

No, X is an offset to the destination address in this case. STA $xxxx,X means "take the base address xxxx, add the contents of X to it, and store A at that location". The table at $F2D3 won't help you find where the tile values are coming from (it's probably just a multiply-by-4 lookup table)

I guess that is what I meant by Store at address relative to X.  Sorry for possibly incorrect english lol.
« Last Edit: March 10, 2016, 02:17:53 pm by RaidouJFlo »

AWJ

  • Full Member
  • ***
  • Posts: 105
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #9 on: March 10, 2016, 02:17:31 pm »
Now, the box that says POISON BAR, I'm assuming that that is what you are trying to change it to?  You said you are translating the game.  Does that mean that that text is really Japanese, and you are trying to find it so you can change it to POISON BAR?  I read your posts, but it wasn't clear to me.

Anyway, here is how sprites work:

Y value
Sprite Tile Number
Palette/Mirror Rotation Value
X value

Try highlighting 0x224 to 0x23B in that RAM window, and copy it.  Then go to View in the hex editor toolbox, and go to ROM File.

Then open up the search box, and paste those values you copied.  See if it weilds any results.  If it does, search again to see if that first search result was the only search result.  If it is, it is possible you may have found your data.

As I said above, sprites work in that format.

For instance:

At 0x225 in the RAM viewer, you have these four bytes:

38 99 00 68

That represents one sprite.

The 38 is the Y.
The 99 is the sprite tile ID number.
The 00 is both the palette and rotation value.
The 68 is the X.

So, if you find that string that you copied in the ROM file, try changing the second number of every four numbers to what you want.  That would change the sprite word for you.

Did you even look at the disassembled code he posted? You can see where it's filling in the X and Y coordinates, copying them from elsewhere in RAM:

F28E: LDA $0064
F290: STA $0203,X ; x coordinate
F293: LDA $0065
F295: STA $0200,X ; y coordinate


He's obviously not going to find the sprite table as literal data in the ROM.

RaidouJFlo

  • Jr. Member
  • **
  • Posts: 67
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #10 on: March 10, 2016, 02:18:58 pm »
Did you even look at the disassembled code he posted? You can see where it's filling in the X and Y coordinates, copying them from elsewhere in RAM:

F28E: LDA $0064
F290: STA $0203,X ; x coordinate
F293: LDA $0065
F295: STA $0200,X ; y coordinate


He's obviously not going to find the sprite table as literal data in the ROM.

Now that I think about it, maybe I can search those opcodes instead of the raw bytes from the RAM.

EDIT:

Actually, maybe this would not help at all.  It's not like these subroutines are directly referencing the numbers.  I should really focus on that stack eh?

RetroRain

  • Sr. Member
  • ****
  • Posts: 286
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #11 on: March 11, 2016, 11:46:30 am »
I'll take a look at the ROM today and see if I can find what you are looking for.
« Last Edit: March 11, 2016, 12:19:51 pm by Rockman »

RaidouJFlo

  • Jr. Member
  • **
  • Posts: 67
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #12 on: March 11, 2016, 01:44:17 pm »
I'll take a look at the ROM today and see if I can find what you are looking for.

Great, thank you.  I'm still trying to decipher this myself as well.

RetroRain

  • Sr. Member
  • ****
  • Posts: 286
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #13 on: March 11, 2016, 05:42:12 pm »
Okay dude, here ya go!

The sprites you are looking for are located in:

Bank $0A

Address $91EB

Offset Range:

0x291FB - 0x29206

The Bytes at that Range:

99 00 98 00 92 00 9C 00 98 00 97 00

Just change those non-zero numbers to whatever sprite tile ID you want to test it.

This is what I made:



:P

I have never heard of this game before, and honestly playing it in Japanese is extremely difficult, since I haven't the slightest idea of what I'm doing.  But it does look like a very interesting game!  I like the music, the graphics, and the First-Person mode looks pretty cool.

I'm glad you are translating this.  I'd play it if you complete the translation. :)

Good luck to you! :)

----------------------------------------------------------------

Incase you are interested in how I found what I was looking for:

I used both the RAM Viewer of the hex editor, to look at both the stack ($100 - $1FF) and sprite ($200 - $2FF) addresses.

I found out that the sprite data was being pushed to $1F1 of the stack, and then pulled to be written to the sprite addresses.  I followed the code in the Debugger to find the LDA that preceded the PHA (Push Accumulator onto Stack).  I then went to that address, and found what I was looking for.

I shouldn't have told you to look for 4 sprite bytes, since from my past experience, most sprite data is stored as 2 bytes, the sprite tile ID number and the palette/rotation value.  However, those 4 bytes ARE the correct format for sprites, as I stated in my previous post above.  It's just that the X and Y values are handled elsewhere.  I'm very hands on, so I'm not able to really tell you much unless I actually take a look at it for myself.

Code: [Select]
0F:F25B:B1 11     LDA ($11),Y @ $91EC = #$00
0F:F25D:D0 05     BNE $F264

This is the block of code that I looked at to find what I was looking for.  I set a breakpoint of write to $225 (where the "P" is located), and when the debugger snapped, I had to find out how it was writing to that $225.  The value was being pulled from the stack (PLA), as it was said, but then you had to find out how it was getting on the stack to begin with.  It is done with a PHA, but in order to push it onto the stack, it had to be read from somewhere first.  That $91EB address is where it was being read from.

1. Load the Accumulator.
2. Push it on the stack
3. Pull it from the stack.
4. Write it to the Sprite address.

That is what happened here.

That LDA ($11), Y is an indirect way of reading an address.  I can explain indirect reading to you some other time.
« Last Edit: March 11, 2016, 05:48:12 pm by Rockman »

RaidouJFlo

  • Jr. Member
  • **
  • Posts: 67
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #14 on: March 11, 2016, 07:36:18 pm »
Okay dude, here ya go!

The sprites you are looking for are located in:

Bank $0A

Address $91EB

Offset Range:

0x291FB - 0x29206

The Bytes at that Range:

99 00 98 00 92 00 9C 00 98 00 97 00

Just change those non-zero numbers to whatever sprite tile ID you want to test it.

This is what I made:



:P

I have never heard of this game before, and honestly playing it in Japanese is extremely difficult, since I haven't the slightest idea of what I'm doing.  But it does look like a very interesting game!  I like the music, the graphics, and the First-Person mode looks pretty cool.

I'm glad you are translating this.  I'd play it if you complete the translation. :)

Good luck to you! :)

----------------------------------------------------------------

Incase you are interested in how I found what I was looking for:

I used both the RAM Viewer of the hex editor, to look at both the stack ($100 - $1FF) and sprite ($200 - $2FF) addresses.

I found out that the sprite data was being pushed to $1F1 of the stack, and then pulled to be written to the sprite addresses.  I followed the code in the Debugger to find the LDA that preceded the PHA (Push Accumulator onto Stack).  I then went to that address, and found what I was looking for.

I shouldn't have told you to look for 4 sprite bytes, since from my past experience, most sprite data is stored as 2 bytes, the sprite tile ID number and the palette/rotation value.  However, those 4 bytes ARE the correct format for sprites, as I stated in my previous post above.  It's just that the X and Y values are handled elsewhere.  I'm very hands on, so I'm not able to really tell you much unless I actually take a look at it for myself.

Code: [Select]
0F:F25B:B1 11     LDA ($11),Y @ $91EC = #$00
0F:F25D:D0 05     BNE $F264

This is the block of code that I looked at to find what I was looking for.  I set a breakpoint of write to $225 (where the "P" is located), and when the debugger snapped, I had to find out how it was writing to that $225.  The value was being pulled from the stack (PLA), as it was said, but then you had to find out how it was getting on the stack to begin with.  It is done with a PHA, but in order to push it onto the stack, it had to be read from somewhere first.  That $91EB address is where it was being read from.

1. Load the Accumulator.
2. Push it on the stack
3. Pull it from the stack.
4. Write it to the Sprite address.

That is what happened here.

That LDA ($11), Y is an indirect way of reading an address.  I can explain indirect reading to you some other time.

Cool.  I saw that line a couple of times but didn't know it was the culprit.  I'll definitely ask you about indirect reading as well since that's still a mystery to me.

Also, seriously man, this was pretty much my only roadblock.

Thank you, Rockman.  I love you. 



And just as I thought, I found the Japanese HANEDA in the world map and changed it to the English name using what you told me!




« Last Edit: March 11, 2016, 08:29:15 pm by RaidouJFlo »

RetroRain

  • Sr. Member
  • ****
  • Posts: 286
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #15 on: March 11, 2016, 09:35:05 pm »
You're welcome! :)

Is that world map screen with the HANEDA text from the same game?  That area looks cool too.

EDIT:

Oh yes I see that it is from the same game.  I figured it out when I looked at the border of the text box.  The reason I was asking is because the layout looked very different, and having tested the game, the character sprite on the screen looked much smaller in I guess what I would call the dungeon areas.
« Last Edit: March 11, 2016, 09:41:42 pm by Rockman »

RaidouJFlo

  • Jr. Member
  • **
  • Posts: 67
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #16 on: March 11, 2016, 10:12:50 pm »
You're welcome! :)

Is that world map screen with the HANEDA text from the same game?  That area looks cool too.

EDIT:

Oh yes I see that it is from the same game.  I figured it out when I looked at the border of the text box.  The reason I was asking is because the layout looked very different, and having tested the game, the character sprite on the screen looked much smaller in I guess what I would call the dungeon areas.

Yeah that's the world map I was talking about, or otherwise the "latter" section I could not figure out, but thankfully you solved the first area's problem and it applies to every instance of it in FPS/world map mode.

It is a bit of a surprise too this game is pretty darn unique.  You've got that overhead view from Devil Buster, FPS dungeon crawling and world map traversal (map is pretty big so far).  I will not spoil much, but it blew my mind to see how much more content was in the game after beating Devil Buster.  That was pretty much the tip of the iceberg heh.  Can't forget about that expansion audio chip either!  It really does make the music sound fantastic.

KingMike

  • Forum Moderator
  • Hero Member
  • *****
  • Posts: 6900
  • *sigh* A changed avatar. Big deal.
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #17 on: March 11, 2016, 10:15:31 pm »
Note that when using sprite-based text it will be subjected to the hardware sprite limit of 8 tiles on a horizontal line.
"My watch says 30 chickens" Google, 2018

RaidouJFlo

  • Jr. Member
  • **
  • Posts: 67
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #18 on: March 12, 2016, 01:51:26 am »
Note that when using sprite-based text it will be subjected to the hardware sprite limit of 8 tiles on a horizontal line.

That's cool to know and yeah that makes sense, at least when I'm looking at this.  For POISON, just after the N comes A8 which is the white line border, then A7 is after that which points to the white border under on the left most side.

A7 00 99 00 98 00 92 00 9C 00 98 00 97 00 A8 00

A7 00 AC 00 8B 00 8A 00 9B 00 AC 00 AC 00 A8 00


I did want to fit ELEVATOR in one room that has Japanese text but that limit is forcing me to put

ELEVA
 TOR

instead.  This is possibly subject to change for aesthetics purposes lol.

RetroRain

  • Sr. Member
  • ****
  • Posts: 286
    • View Profile
Re: FCEUX PPU Viewer: Left Table
« Reply #19 on: March 12, 2016, 01:10:24 pm »
I don't know how many sprites are on the second line, but instead of ELEVATOR, you could call it:

TURBO
LIFT

or just LIFT.  Just an idea.

EDIT:

By the way, I have never even considered doing a translation before.  But in light of your project, I may one day do a translation of my own, assuming it's a game that I like and it hasn't been done yet. :P
« Last Edit: March 12, 2016, 01:19:03 pm by Rockman »