SOS: Sink or Swim (USA, Europe) --- blue screen of water
Drop a bomb and start climbing down ladders. Blue Screen
of Death. Background scrolls around but not sprites.
Manual inspection of screen suggests status bar ~190-193.
Could be h-dma, but isn't. Safely waits for hblank transfers
then writes bg2 registers.
H-DMA[0] write (2) 0x0004BA->0x210F ind, Count: 3, Rep: no , V-LINE: 189 000389
H-DMA[1] write (2) 0x00043A->0x210D ind, Count: 3, Rep: no , V-LINE: 189 000309
IRQ logs
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:175 H: 90 F:52
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 84 F:52
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:177 H: 98 F:53
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 88 F:53
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:179 H: 82 F:54
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 92 F:54
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:181 H: 82 F:55
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 88 F:55
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:183 H: 88 F:56
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 96 F:56
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:185 H: 84 F:57
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 100 F:57
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:187 H: 94 F:58
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 82 F:58
*** key ***
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:189 H: 90 F:59
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 642 F:59
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 86 F: 0
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 90 F: 1
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nvMXdIzC V:190 H: 88 F: 2
00ff41 jml $80e6d1 [80e6d1] A:0003 X:0008 Y:000c S:01f4 D:0000 DB:80 nVMXdIzC V:190 H: 84 F: 3
Fires 2 IRQs per frame.
4207-4208 = H-IRQ
4209-420A = V-IRQ
*** IRQ
$80/E6D1 08 PHP A:0003 X:0008 Y:000C D:0000 DB:80 S:01F4 P:envMXdIzC HC:0148 VC:189
$80/E6D2 C2 30 REP #$30 A:0003 X:0008 Y:000C D:0000 DB:80 S:01F3 P:envMXdIzC HC:0180 VC:189
$80/E6D4 48 PHA A:0003 X:0008 Y:000C D:0000 DB:80 S:01F3 P:envmxdIzC HC:0210 VC:189
$80/E6D5 DA PHX A:0003 X:0008 Y:000C D:0000 DB:80 S:01F1 P:envmxdIzC HC:0250 VC:189
$80/E6D6 5A PHY A:0003 X:0008 Y:000C D:0000 DB:80 S:01EF P:envmxdIzC HC:0290 VC:189
$80/E6D7 0B PHD A:0003 X:0008 Y:000C D:0000 DB:80 S:01ED P:envmxdIzC HC:0330 VC:189
$80/E6D8 8B PHB A:0003 X:0008 Y:000C D:0000 DB:80 S:01EB P:envmxdIzC HC:0370 VC:189
$80/E6D9 E2 30 SEP #$30 A:0003 X:0008 Y:000C D:0000 DB:80 S:01EA P:envmxdIzC HC:0402 VC:189
$80/E6DB AD 11 42 LDA $4211 [$80:4211] A:0003 X:0008 Y:000C D:0000 DB:80 S:01EA P:envMXdIzC HC:0432 VC:189
$80/E6DE 6C 10 00 JMP ($0010)[$80:E7FD] A:00C2 X:0008 Y:000C D:0000 DB:80 S:01EA P:eNvMXdIzC HC:0468 VC:189
$80/E7FD E2 30 SEP #$30 A:00C2 X:0008 Y:000C D:0000 DB:80 S:01EA P:eNvMXdIzC HC:0514 VC:189
$80/E7FF 20 C3 CF JSR $CFC3 [$80:CFC3] A:00C2 X:0008 Y:000C D:0000 DB:80 S:01EA P:eNvMXdIzC HC:0584 VC:189
hblank safety
$80/CFC3 08 PHP A:00C2 X:0008 Y:000C D:0000 DB:80 S:01E8 P:eNvMXdIzC HC:0636 VC:189
$80/CFC4 E2 30 SEP #$30 A:00C2 X:0008 Y:000C D:0000 DB:80 S:01E7 P:eNvMXdIzC HC:0668 VC:189
$80/CFC6 AD 12 42 LDA $4212 [$80:4212] A:00C2 X:0008 Y:000C D:0000 DB:80 S:01E7 P:eNvMXdIzC HC:0698 VC:189
$80/CFC9 89 40 BIT #$40 A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIzC HC:0734 VC:189
$80/CFCB D0 F9 BNE $F9 [$CFC6] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:0758 VC:189
$80/CFCD AD 12 42 LDA $4212 [$80:4212] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:0782 VC:189
$80/CFD0 89 40 BIT #$40 A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIzC HC:0818 VC:189
$80/CFD2 F0 F9 BEQ $F9 [$CFCD] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:0842 VC:189
$80/CFCD AD 12 42 LDA $4212 [$80:4212] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:0872 VC:189
$80/CFD0 89 40 BIT #$40 A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIzC HC:0908 VC:189
$80/CFD2 F0 F9 BEQ $F9 [$CFCD] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:0932 VC:189
$80/CFCD AD 12 42 LDA $4212 [$80:4212] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:0962 VC:189
$80/CFD0 89 40 BIT #$40 A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIzC HC:0998 VC:189
$80/CFD2 F0 F9 BEQ $F9 [$CFCD] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:1022 VC:189
$80/CFCD AD 12 42 LDA $4212 [$80:4212] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:1052 VC:189
$80/CFD0 89 40 BIT #$40 A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIzC HC:1088 VC:189
$80/CFD2 F0 F9 BEQ $F9 [$CFCD] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:1178 VC:189
$80/CFCD AD 12 42 LDA $4212 [$80:4212] A:0002 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIZC HC:1208 VC:189
$80/CFD0 89 40 BIT #$40 A:0042 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIzC HC:1244 VC:189
$80/CFD2 F0 F9 BEQ $F9 [$CFCD] A:0042 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIzC HC:1268 VC:189
$80/CFD4 28 PLP A:0042 X:0008 Y:000C D:0000 DB:80 S:01E7 P:envMXdIzC HC:1292 VC:189
$80/CFD5 60 RTS A:0042 X:0008 Y:000C D:0000 DB:80 S:01E8 P:eNvMXdIzC HC:1330 VC:189
$80/E802 E2 20 SEP #$20 A:0042 X:0008 Y:000C D:0000 DB:80 S:01EA P:eNvMXdIzC HC:0018 VC:190
$80/E804 9C 30 21 STZ $2130 [$80:2130] A:0042 X:0008 Y:000C D:0000 DB:80 S:01EA P:eNvMXdIzC HC:0048 VC:190
$80/E807 A9 57 LDA #$57 A:0042 X:0008 Y:000C D:0000 DB:80 S:01EA P:eNvMXdIzC HC:0084 VC:190
$80/E809 8D 31 21 STA $2131 [$80:2131] A:0057 X:0008 Y:000C D:0000 DB:80 S:01EA P:envMXdIzC HC:0108 VC:190
$80/E80C A9 60 LDA #$60 A:0057 X:0008 Y:000C D:0000 DB:80 S:01EA P:envMXdIzC HC:0144 VC:190
$80/E80E 8D 32 21 STA $2132 [$80:2132] A:0060 X:0008 Y:000C D:0000 DB:80 S:01EA P:envMXdIzC HC:0168 VC:190
$80/E811 A9 98 LDA #$98 A:0060 X:0008 Y:000C D:0000 DB:80 S:01EA P:envMXdIzC HC:0204 VC:190
$80/E813 8D 32 21 STA $2132 [$80:2132] A:0098 X:0008 Y:000C D:0000 DB:80 S:01EA P:eNvMXdIzC HC:0228 VC:190
~~~~~~~~~~~~~~~~~~~~~~~
set next irq @ 190
$80/E816 C2 30 REP #$30 A:0098 X:0008 Y:000C D:0000 DB:80 S:01EA P:eNvMXdIzC HC:0264 VC:190
$80/E818 A2 86 E7 LDX #$E786 A:0098 X:0008 Y:000C D:0000 DB:80 S:01EA P:eNvmxdIzC HC:0294 VC:190
$80/E81B A9 BE 00 LDA #$00BE A:0098 X:E786 Y:000C D:0000 DB:80 S:01EA P:eNvmxdIzC HC:0324 VC:190
$80/E81E 20 CA E6 JSR $E6CA [$80:E6CA] A:00BE X:E786 Y:000C D:0000 DB:80 S:01EA P:envmxdIzC HC:0354 VC:190
$80/E821 E2 30 SEP #$30 A:00BE X:E786 Y:000C D:0000 DB:80 S:01EA P:envmxdIzC HC:0610 VC:190
$80/E823 4C E1 E6 JMP $E6E1 [$80:E6E1] A:00BE X:0086 Y:000C D:0000 DB:80 S:01EA P:envMXdIzC HC:0646 VC:190
~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~
pal
$80/E822 C2 30 REP #$30 A:0098 X:0008 Y:0002 D:0000 DB:80 S:01EA P:eNVMXdIzC HC:0152 VC:137
$80/E824 A2 92 E7 LDX #$E792 A:0098 X:0008 Y:0002 D:0000 DB:80 S:01EA P:eNVmxdIzC HC:0176 VC:137
$80/E827 A9 BE 00 LDA #$00BE A:0098 X:E792 Y:0002 D:0000 DB:80 S:01EA P:eNVmxdIzC HC:0200 VC:137
$80/E82A 20 D6 E6 JSR $E6D6 [$80:E6D6] A:00BE X:E792 Y:0002 D:0000 DB:80 S:01EA P:enVmxdIzC HC:0224 VC:137
$80/E82D E2 30 SEP #$30 A:00BE X:E792 Y:0002 D:0000 DB:80 S:01EA P:enVmxdIzC HC:0392 VC:137
$80/E82F 4C ED E6 JMP $E6ED [$80:E6ED] A:00BE X:0092 Y:0002 D:0000 DB:80 S:01EA P:enVMXdIzC HC:0416 VC:137
~~~~~~~~~~~~~~~~~~~~~~~
$80/E6CA 8E 10 00 STX $0010 [$80:0010] A:00BE X:E786 Y:0000 D:0000 DB:80 S:01E6 P:enVmxdIzC HC:1098 VC:234
$80/E6CD 8D 09 42 STA $4209 [$80:4209] A:00BE X:E786 Y:0000 D:0000 DB:80 S:01E6 P:enVmxdIzC HC:1138 VC:234
$80/E6D0 60 RTS A:00BE X:E786 Y:0000 D:0000 DB:80 S:01E6 P:enVmxdIzC HC:1174 VC:234
$80/E6E1 C2 30 REP #$30 A:00BE X:0086 Y:000C D:0000 DB:80 S:01EA P:envMXdIzC HC:0682 VC:190
$80/E6E3 AB PLB A:00BE X:0086 Y:000C D:0000 DB:80 S:01EA P:envmxdIzC HC:0718 VC:190
$80/E6E4 2B PLD A:00BE X:0086 Y:000C D:0000 DB:80 S:01EB P:eNvmxdIzC HC:0762 VC:190
$80/E6E5 7A PLY A:00BE X:0086 Y:000C D:0000 DB:80 S:01ED P:envmxdIZC HC:0814 VC:190
$80/E6E6 FA PLX A:00BE X:0086 Y:000C D:0000 DB:80 S:01EF P:envmxdIzC HC:0866 VC:190
$80/E6E7 68 PLA A:00BE X:0008 Y:000C D:0000 DB:80 S:01F1 P:envmxdIzC HC:0918 VC:190
$80/E6E8 28 PLP A:0003 X:0008 Y:000C D:0000 DB:80 S:01F3 P:envmxdIzC HC:0970 VC:190
$80/E6E9 40 RTI A:0003 X:0008 Y:000C D:0000 DB:80 S:01F4 P:envMXdIzC HC:1014 VC:190
Looks harmless. Trick though is follow this pattern:
V189: start irq
V190: enable irq @ 190
V190: rti
V190: start irq (immediately after rti)
V191: rti
V225: nmi
Canoe / Geiger does:
V189: start irq
V190: enable irq @ 190
V190: rti
** skip irq **
V225: nmi
We're missing back-to-back irq firing. IRQs can trigger
mid-scanline again. So to fix, we run irq 190 ourself.
org $80e816
jml start
org $8FFFe0
start:
; latch h/v counters + reset port
lda $2137
lda $213f
; check line 189-190
lda $213d
cmp #$be
beq +
cmp #$bd
beq +
; normal irq
rep #$30
ldx #$e786
jml $80e81b
+
; fire 190 irq
jml $80e786
Now Geiger does this check on V190. Canoe does it on V189.
Little faster, because it likely breaks out of HBlank spin
loop quicker. Meaning HBlank could signal early on Canoe.
Uniracers / Unirally (USA, Europe) --- game pak not found (pending)
no$sns and some snes9x builds can show this text.
Copier protection. Take a peek.
$83/8AFA AF 00 00 77 LDA $770000[$77:0000] A:0481 X:0000 Y:FFFF D:0000 DB:80 S:01FA P:eNvMxdIzC
$83/8AFE 48 PHA A:0441 X:0000 Y:FFFF D:0000 DB:80 S:01FA P:envMxdIzC
$83/8AFF A9 12 LDA #$12 A:0441 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIzC
$83/8B01 8F 00 00 77 STA $770000[$77:0000] A:0412 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIzC
$83/8AF7 08 PHP A:0481 X:0000 Y:FFFF D:0000 DB:80 S:01FB P:eNvMxdIzC
$83/8AF8 E2 20 SEP #$20 A:0481 X:0000 Y:FFFF D:0000 DB:80 S:01FA P:eNvMxdIzC
$83/8AFA AF 00 00 77 LDA $770000[$77:0000] A:0481 X:0000 Y:FFFF D:0000 DB:80 S:01FA P:eNvMxdIzC
$83/8AFE 48 PHA A:0441 X:0000 Y:FFFF D:0000 DB:80 S:01FA P:envMxdIzC
$83/8AFF A9 12 LDA #$12 A:0441 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIzC
$83/8B01 8F 00 00 77 STA $770000[$77:0000] A:0412 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIzC
$83/8B05 C2 20 REP #$20 A:0412 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIzC
$83/8B07 A9 56 34 LDA #$3456 A:0412 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envmxdIzC
$83/8B0A 8F FF 1F 77 STA $771FFF[$77:1FFF] A:3456 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envmxdIzC
USA, Europe
$83/8B0E E2 20 SEP #$20 A:3456 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envmxdIzC
$83/8B10 AF 00 00 77 LDA $770000[$77:0000] A:3456 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIzC
$83/8B14 C9 34 CMP #$34 A:3434 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIzC
$83/8B16 F0 04 BEQ $04 [$8B1C] A:3434 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIZC
==> 80 04
Game Pak not found
$83/8B18 5C EB 94 80 JMP $8094EB[$80:94EB] A:3434 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIzC
$83/8B1C 68 PLA A:3434 X:0000 Y:FFFF D:0000 DB:80 S:01F9 P:envMxdIZC
$83/8B1D 8F 00 00 77 STA $770000[$77:0000] A:3441 X:0000 Y:FFFF D:0000 DB:80 S:01FA P:envMxdIzC
$83/8B21 28 PLP A:3441 X:0000 Y:FFFF D:0000 DB:80 S:01FA P:envMxdIzC
$83/8B22 6B RTL A:3441 X:0000 Y:FFFF D:0000 DB:80 S:01FB P:eNvMxdIzC
Writes 771FFF = 56, 772000 = 34. Then checks 770000 for 34.
Note that sram size = 2000. And when we reach that #, wraps
back to 0000. We patch routine above to proceed.
=============================================
=============================================
Thanks everyone. Kinda nice break from doing (tiring) faster rom code rewrites. Bonus is that these are really strange behaviors, at my learning level.
Audio issues .. if I can get it to happen in emu, then definitely perhaps yeah. Could be "un-init" audio ram glitch. Or reverb buffer. Haven't checked this particular bugger yet.
Screenshot of this Nosferatu? Nothing mysterious so far.
(read docs - "Glitches on right side when scrolling." Huh.)
(Scratch Uniracers - snes9x log talks about color windows)
Alien 3, Beavis writeups done.