[vonMuir]

I'm working on a specific part of my Genesis hack right now and it's giving me a headache. The code I wrote looks correct, but it's causing the game to freeze.

I'm writing a condition that affects trading items in game. If the value at a particular RAM offset (FF028F*) is 00, the code points to one routine. If the same offset* is FF, it points to another routine.

Half of the code works (if the offset equals 00). The other half cause the game to freeze (the game is still "running", but you can't do anything). I've highlighted the parts that almost definitely work in italics, and the parts that I think might be the problem in bold:

(offset being tested: FF028F*)

01283A          4EF90024008D          JMP  $0024008D          Jumps to $24008D
01286A          0C00002C                 CMPi.b #$2C, D0          The original ROM code, unedited
0128XX          irrelevant code          irrelevant                      N/A

24008D          4A3900FF028F          TST.b $00FF028F          Checks if value at $FF028F* is $00
240093          6700F0C8                  BEQ  $002400D0         Branches to $2400D0 if ^TRUE^
240097          0C000017                 CMPi.b #$17, D0          ***Compares $17 with the value at D0
24009B       6B2A                        BMI.s $0001286A        If value at D0>$17, branch to $01286A
24009D          4EF900012842          JMP  $00012C42          (if D0<$18) jumps to $012C42***

                <I've just got a bunch of "00"s separating the next command>

2400D0          4EF900012C42          JMP  $00012C42          Jumps to $012C42, the original ROM code
                 <this is followed by a bunch of "00"s>

***This portion of code is paraphrased from the original code at ROM offset $01283A. It is checking a second set of conditions before performing the trade. The major difference in coding is the BMI function, which originally directed the PC to add a value to its current location and begin reading there (instead of my code that tells it directly where to read from).***

Any ideas? I obviously either coded something wrong or else maybe I skipped a step when expanding the ROM? 

[KingMike]

Does 68k code need to be at least word-aligned (start at even addresses)?

[vonMuir]

I inserted "00"s to make all the addresses word-aligned. It still freezes. Here's the updated addresses:

(offset being tested: FF028F*)

01283A          4EF90024008D          JMP  $0024008D          Jumps to $24008D
01286A          0C00002C                 CMPi.b #$2C, D0          The original ROM code, unedited
0128XX          irrelevant code          irrelevant                      N/A

24008D          4A3900FF028F          TST.b $00FF028F          Checks if value at $FF028F* is $00
240094          6700F0C8                  BEQ  $002400D0         Branches to $2400D0 if ^TRUE^
240098          0C000017                 CMPi.b #$17, D0          ***Compares $17 with the value at D0
24009C       6B2A                        BMI.s $0001286A        If value at D0>$17, branch to $01286A
24009D          4EF900012842          JMP  $00012C42          (if D0<$18) jumps to $012C42***

                <I've just got a bunch of "00"s separating the next command>

2400D0          4EF900012C42          JMP  $00012C42          Jumps to $012C42, the original ROM code
                 <this is followed by a bunch of "00"s>

[STARWIN]

I should state the obvious. You can use a debugger for debugging bugs. Set an exec breakpoint before stuff happens, then step instructions one by one to see if values or PC location gets weird. Alternatively create a trace log with the working version and the bugged version, and compare.

edit: relative branches work relative to the executed instruction, so a long jump with such looks strange here.

edit2: also the machine code contains 842 when the disassembled version says C42 in that jump, which looks strange.

[jonk]

I should state the obvious. You can use a debugger for debugging bugs. Set an exec breakpoint before stuff happens, then step instructions one by one to see if values or PC location gets weird. Alternatively create a trace log with the working version and the bugged version, and compare.

edit: relative branches work relative to the executed instruction, so a long jump with such looks strange here.

edit2: also the machine code contains 842 when the disassembled version says C42 in that jump, which looks strange.

Yeah. I can't imagine how that bmi.s is valid. The signed relative offset is only one byte in the instruction. The instruction is located at $24009B and its target is supposedly at $01286A. Way, way too far apart.

[vonMuir]

It never hurts to state the obvious in this forum!!!

I used a debugger, and it didn't act the way it should: It said that "TST.b $00FF028F" is an "unkown op code" and seems to bug out there. BUT IT SHOULDN'T. Since the code works fine when $FF028F has a value of 00, the machine is obviously reading the op code just fine.

Except that's the weird part. After adjusting the offsets to be word-aligned, now none of the code works and the same things happens regardless of what value is in $FF028F. I can't really imagine why this would be...

Here's what my code looks like now. The "842" was one of two typos that have since been corrected:

(offset being tested: FF028F*)

01283A          4EF90024008E          JMP  $0024008E          Jumps to $24008E
01286A          0C00002C                 CMPi.b #$2C, D0          The original ROM code, unedited
0128XX          irrelevant code          irrelevant                      N/A

24008E          4A3900FF028F          TST.b $00FF028F          Checks if value at $FF028F* is $00
240094          6700F0C8                  BEQ  $002400D0         Branches to $2400D0 if ^TRUE^
240098          0C000017                 CMPi.b #$17, D0          ***Compares $17 with the value at D0
24009C       6B2A                        BMI.s $0001286A        If value at D0>$17, branch to $01286A
24009E          4EF900012842          JMP  $00012842          (if D0<$18) jumps to $012842***

                <I've just got a bunch of "00"s separating the next command>

2400D0          4EF900012C42          JMP  $00012C42          Jumps to $012C42, the original ROM code
                 <this is followed by a bunch of "00"s>
July 20, 2016, 04:15:41 pm - (Auto Merged - Double Posts are not allowed before 7 days.)

Yeah. I can't imagine how that bmi.s is valid.

I can't use bmi.s to point the PC to a direct location? I can only use it to add and subtract from the current address?

[tryphon]

The s is for short. You can use it only when the jump address is in the range-128, 127. Your assembler should have issued an error. But do you only use an assembler ?

[STARWIN]

yeah, using an assembler helps with branches and jumps a lot.

basically you want to do a little branch jump over the JMP to another JMP to make the execution flow divide into two long jumps I imagine.

[vonMuir]

Let me try and fix the BMI issue real quickly.

I seem to have also found why the code started acting weird when I moved stuff (the BEQ instruction isn't assembling correctly). I'll address this as well and see if the PC runs the way I want it to.
July 20, 2016, 05:19:32 pm - (Auto Merged - Double Posts are not allowed before 7 days.)Alright, all fixed!!! 

The problem, as I suspected, was my own ignorance. I'll post a more complete response later as a matter of record, but ATM I'm hungry and tired.

The BMI code was the issue, and the "wierd part" was caused by a bad BEQ code that I accidentallied while I was troubleshooting. I'm not sure whether or not my assembler cared about the word-alignment, but I'll keep an eye on it in the future.

Thank you to everyone for helping to guide me in the right direction.
July 21, 2016, 12:08:06 am - (Auto Merged - Double Posts are not allowed before 7 days.)OK, so here's my final code. I'll highlight the major changes in bold:

01283A          4EF90024008E          JMP  $0024008E          Jumps to $24008E
01286A          0C00002C                 CMPi.b #$2C, D0          The original ROM code, unedited
0128XX          irrelevant code          irrelevant                      N/A

24008E          4A3900FF028F          TST.b $00FF028F          Checks if value at $FF028F* is $00
240094          6738                        BEQ.s  #$3A                 Branches to $2400D0 if ^TRUE^
240098          0C000017                 CMPi.b #$17, D0          Compares $17 with the value at D0
24009C          6B06                        BMI.s $06                    If value at D0>$17, branch to $01286A
24009E          4EF900012842          JMP  $00012842          (if D0<$18) jumps to $012842
2400A2        4EF90001286A        JMP  $0001286A           Jumps back to $01286A

                <I've just got a bunch of "00"s separating the next command>

2400D0          4EF900012C42          JMP  $00012C42          Jumps to $012C42, the original ROM code
                 <this is followed by a bunch of "00"s>

As far as the assembler, I'm using Easy68K. I'm still figuring out the functionality, but I've been piecing my code together between that and these two other resources (plus the 68k Manual, of course):

http://info.sonicretro.org/SCHG:68000_ASM-to-Hex_Code_Reference

http://mrjester.hapisan.com/04_MC68/Index.html

I've been diagramming most of the branches/jumps/etc. on paper for the most part and then translating the op codes into hex using the assembler. I'm old fashioned I guess, but it's easier for me to plan and make changes with pencil and paper than a mouse and keyboard.

I'm very thankful for all of the help I've been given -not only in this thread, but in general on this forum. There are several of you who have been helping me in all or most of my threads. I greatly appreciate the fact that there's a community on this board that helps cultivate more hackers. In a short amount of time, I feel like I've become quite knowledgeable thanks to the guidance of a few dedicated members on this site. So THANKS!


Now, as a matter of public record (to help anyone searching the forums) I made at least two errors, if not three:

1) Word-aligning my code (putting op codes at even offsets: x0,2,4,6,8,A,C,E)

2) While troubleshooting, I accidentally altered my destination for my BEQ command. I cut and paste the correct code in from an earlier version.

3) I tried to write to a direct location using a BMI command. Instead, I needed to move the PC towards a nearby JMP command that accomplished the same thing I was trying to do.

Note: The reason the game froze but didn't crash: My poorly coded BMI command was directing the PC to an infinite loop of "00"s. I couldn't input any command because the emulator was trying to execute the commands (and I had recently added a LOT of "00"s to expand my ROM).

[KingMike]

For instruction size, I think you want .b, .w or .l for Byte (8 bits), Word (16 bits), or Longword (32 bits).

[tryphon]

No. If you use an assembler, you don't have to specify if the jump is s, w or l. That's the job of the assembler to do that.

Also you must use labels, what you don't seem to do...