News: 11 March 2016 - Forum Rules
Current Moderators - DarkSol, KingMike, MathOnNapkins, Azkadellia, Danke

Author Topic: RAM Address Discovery Question: T2 - The Arcade Game (Genesis)  (Read 1282 times)

eskayelle

  • Full Member
  • ***
  • Posts: 120
  • NBA Jam 2K20 TE / TMNT of Rage Developer
    • View Profile
Hello, all.  Looking for some guidance or help with respect to how I might find a certain RAM address in the Mega Drive / Genesis game, T2 – The Arcade Game.  I’m specifically looking for the “health” counter for the van in the Freeway stage.

Here's what I've done so far:

1)   Determined that in a previous stage (Trip to Skynet stage) the destruction of the automobile was determined in part by a counter adding up to a certain amount, so I made an assumption that to zero out a certain RAM address will also render the van in the Freeway stage indestructible.  This is not a perfect assumption, but it led me to be able to render the automobile in that Trip to Skynet level virtually indestructible by NOP’ing a TST.B function.

2)   Used a RAM search to determine and record what addresses went from 0 to 1 the moment the helicopter hits the van in the Freeway stage.  For each address, created a PAR code to set the address to zero.  Tested each PAR code on the Freeway level.  Each time, the van was destroyed or some other operation was corrupted.

3)   Used a trace log to identify commands where a RAM address was written to during the time before and after the van was impacted (could not precisely pinpoint the exact moment, however, so the log is several megabytes).  Created PAR codes setting each address to zero and tested.  Each time, the van was destroyed or some other operation was corrupted.  Addresses tested: $78C2; $765E; $77F0; $13F7E; $086C; $FBC1E; $FC4FA; and $13CC8.

4)   From the trace log, documented all instances of a TST.B function and NOP’d and tested each.  Each time, the van was destroyed or some other operation was corrupted. (Note these TST.B functions were not the same opcodes as the one in the previous level), that one being a TST.B $00(A1,D0) command.

Any other ideas or approaches as to how I might find this value, assuming it exists in the manner I’m assuming?

FAST6191

  • Hero Member
  • *****
  • Posts: 2813
    • View Profile
Re: RAM Address Discovery Question: T2 - The Arcade Game (Genesis)
« Reply #1 on: June 24, 2020, 05:25:45 pm »
So watched a video
https://www.youtube.com/watch?v=-zbDKXva-R8
I assume we are talking about the section at 26:27

If so looks like there are graphical changes as a result of damage here. Those will be reflected in the VRAM (though it might be there from the start), sprite assignment or map. If you can already trace things then you have a direct link to something in memory rather than searches.

Numbers going up is a reasonable guess, however numbers changing might be a better thing if you are doing a complete unknown, maybe with a round of stayed the same thrown in there to eliminate a few more, and you could possibly throw in some savestates if you only have a limited health pool to be playing with.

eskayelle

  • Full Member
  • ***
  • Posts: 120
  • NBA Jam 2K20 TE / TMNT of Rage Developer
    • View Profile
Re: RAM Address Discovery Question: T2 - The Arcade Game (Genesis)
« Reply #2 on: June 24, 2020, 08:20:31 pm »
Thanks, FAST6191. 

I searched for the tiles in VDP RAM using gens r57shell mod r665 and compared the offset for what I think is the first tile of the van to a dump of VRAM to .bin and a check in TileMolester.  It looks like the address is $1140 (I could be wrong), but that does not match anything in my trace log (my trace log having been from just before the helicopter crashes to just after).  As an example, there is never an LEA ($1140) command or anything close to that value.

I'm not sure how to tell when the game calls the function for the sprites to map differently and give the appearance of the crash to be able to work backward from it in the log.

I then tried to take a save state of the van before a crash and during, then paused the emulation and attempted to compare RAM values by loading the first save state, then the second, the emulation paused the entire time so as not to change any values otherwise.  There are hundreds of results for changes, so I didn't have a basis for how I might be able to pare these down.  I tried paring down the search to those changes that altered a value by one.  Of 23 results, I tried par codes for any that were single digit values being changed.  In all cases, the van was destroyed, or the game otherwise corrupted.

From what I can tell, there does not appear to be a case when an address changes from #$0000 to #$00FF or #$FFFF.  Likewise, I'm not seeing cases where an address has changed from #$00FF or #$FFFF to #$0000.  The RAM search functionality in gens mod confuses me a bit (I don't find it intuitive at all), so I could be messing something up.

moonmaster1

  • Jr. Member
  • **
  • Posts: 16
    • View Profile
Re: RAM Address Discovery Question: T2 - The Arcade Game (Genesis)
« Reply #3 on: June 25, 2020, 01:25:52 am »
I played with codes for level transition. Without any vulnerability to the van, the level seems boring and maybe a bit pointless.

This code will allow you to skip straight to the steel mill after cyberdyne. :)
A74A-AAH0
0074F6:0007

Here is how I pulled it off.
At 0074F4 there is a CMP function. It always branches if not equal to 9 in D0 and transitions to the next level. But when it is equal it take you straight to the steel mill with the battle against the T-1000. By setting it to 7, I was able to skip the escape from cyberdyne. Setting it to 8 doesn't seem to have an effect.

« Last Edit: June 25, 2020, 01:34:46 am by moonmaster1 »

eskayelle

  • Full Member
  • ***
  • Posts: 120
  • NBA Jam 2K20 TE / TMNT of Rage Developer
    • View Profile
Re: RAM Address Discovery Question: T2 - The Arcade Game (Genesis)
« Reply #4 on: June 25, 2020, 07:18:06 am »
Interesting.  In some of the corruptions I tried, I noted a similar but inconsistent effect, so I had thought about a level skip as an option if it transitioned cleanly. Thanks!

Tony H

  • Full Member
  • ***
  • Posts: 122
    • View Profile
    • The Code Hut
Re: RAM Address Discovery Question: T2 - The Arcade Game (Genesis)
« Reply #5 on: June 25, 2020, 08:29:04 pm »
Here are a couple Game Genie codes/addresses you can try that may get you in the ball park...

HTFT-CA7C / 010BA2:603C = This makes the van invincible (helicopter flies right through it), but also makes the helicopter kind of invincible, so there's no way to end the level since the helicopter keeps coming back. There are several conditional branches nearby this one that may be the ticket.  Didn't have much time to check anything. 

RHKA-A6W4 / 00D25A:4E71 = This one makes it so that the helicopter flies high enough so that it never hits the van, but also high enough so that you can't hit it with any weapons. Again, not useful because there's no way to finish the level since the helicopter keeps coming back.  Might be able to figure out how to get the helicopter down a little further so you can hit it. 

Since you're making trace logs, both of these addresses should show up and might help to figure out a solution.
The Code Hut: http://codehut.gshi.org/

Game Genie codes and ROM hacking guides