I've been working on applying the translation someone else did for the NES game Zoids Chuuou Tairiku no Tatakai. I've received a lot of great help learning the basics of changing text location, but felt this specific question was unique enough to start a new thread.
I have a text block with various lines from 0x9E17 to 0x9FEB and another text block in the 0x1xxxx range. In the higher range I've found the pointer table and made changes with no issues. My (very limited) understanding is that pointer tables by their nature are limited to the 10000 range and I can tell this text in the 9E17 area occurs at special times. For instance, as soon as you start the game, there's a black screen and a line of text telling you to go talk to the President. Or when you recruit someone the text " became an ally" is in this area, or when prompted the "Yes/No" is in this area.
I also know that this game is using an 8000 offset for its pointers.
I've even been able to find out that hex 78 when used in a dialog is a Go To memory address command, and that 78 08 C0 takes you back to the title screen (which I've been able to track down to memory address 0xA0C8-0xA181 or I guess technically xA0B8-xA171 since the header adds 10 to memory locations. (Edit: okay to be fair, I don't know for certain that 78 is a goto command, I just know that 78 08 C0 takes you back to the title screen and I'm making some assumptions)
Which to make a long story short (too late), brings me around to the question: How can I find where these addresses are referenced so I can change that reference to a new location? If I can find this out, I feel like I can also figure out how to fix the menu (where right now I have to say DAT instead of DATA because I can't figure out how to get the program to read one more letter location in the menu)
September 21, 2020, 01:14:42 pm - (Auto Merged - Double Posts are not allowed before 7 days.)
I think I'm making some headway in figuring it out.
Using FCEUx as my emulator, I went to Debug-> Code/Data Logger and started it, then went to Debug->Trace Logger. I logged things to a file and then under extra's I selected "Only log newly mapped code" and "Only log code that accesses newly mapped data" these two options skip repeating lines (and there are a ton of repeating lines as you sit there doing nothing while the game loops through instructions).
I let the first screen pop up that had my special text area and once it was done stopped logging.
Then I search for the lower address area. For example, I knew that the black screen with a line of text telling you to go talk to the President. Was located at x09E3B (so minus 10 for the header would be x09E2B). Spitting this address of 9E2B into two parts, the upper and lower memory address, gives me 9E and 2B.
Since I stopped the log as soon as the screen had come up, I knew the reference to it should be "close" to the bottom. starting from the bottom of the log I searched for #$2B. I'm a little shaky on the details of the #$, but this is how the logger represents things so that's what I search for.
For me the relevant instruction was LDA #$2B, this is telling the CPU to load the number 2B into the Accumulator, though this could have just as likely bene LDX (Load into X Register) or LDY (Load into Y Register).
Once it found LDA #$2B, I looked a few lines down from that point to search for the first half of my address, which in this case is 9E. If I didn't find LDA (or LDY or LDX) 9E within a couple lines I kept search up. Eventually, I was able to find the two pair together and had my first potential candidate for the instruction that was looking for that code. The lines that ended up being correct read:
A:00 X:00 Y:FF S:4D $F631: A9 2B LDA #$2B
A:2B X:00 Y:FF S:4D $F633: 85 DF STA $DF = #$B9
A:2B X:00 Y:FF S:4D $F635: A9 9E LDA #$9E
Breaking down the first line, the A: X: Y: are the current values loaded in the Accumulators, which I believe are basically 3 addresses for doing work in. It's like they're variables that never have to be declared, you just get to use them for quick operations.
$F631 is the location in the Rom file that the instruction on that line is located at. That means if I open my rom file in a hex editor and go to xF631 (+10 for the header so x1F641) I will find the instruction A9 2B)
A9 is the instruction code for that line. Looking up 6502 Instruction set (6502 Assembly is the instruction set the NES used I believe) shows that A9 is the Hex code for Load (a value into the "A") Accumulator
2B is the value to load into the "A" accumulator
Finally, FCEUx is kind enough to actually show a translation of the hex instruction A9 2B as LDA #$2B so I don't have to look up what instruction A9 is each time I see it.
The next line STA $DF stores the current value of the "A" accumulator into the memory address DF
The last line LDA #$9E loads 9E, the upper half of my memory location in the the "A" accumulator. And with that it has effectively fully loaded my memory address of 9E2B into memory.
To change where it points, I just have to find some blank space in my ROM to enter in new text (For example x98A6), split it into two pairs of 98 A6, subtract a Hex 10 from the second pair to compensate for the NES header giving me 98 96, swap the order to 96 98 and then replace 2B 9E with 98 96.
So going to x1F631+10 for the header = x1F641 I find
A9 2B 85 DF A9 9E
and I change it to
A9 96 85 DF A9 98
September 21, 2020, 03:06:23 pm - (Auto Merged - Double Posts are not allowed before 7 days.)
Okay, I've done a trace of the code that pulls up the menu box (it's a box drawn on top of whatever screen you're currently on)
I was able to trace down the section of code that should display the option to speak to a character, currently I have that set to SPK, but I hope to change this to TALK.
The first thing it (Trace attached at the end of the post) loads on the line is #$F9 which is a vertical line for the menu box outline on the left side, then it loads #$1C for the "S". I am uncertain what the #$86 and #$02 do, but the next two #$FF are for setting any kind of required accent markings over the next two letter (or previous 2, I'm not 100% certain). I'm again uncertain what the #$24, #$A6, and #$02 do, but the #$19 gives me the "P" and the #$14 gives me "K". Not sure about the #$24, #$88, #$02 (Screen positioning stuff, maybe? Maybe just advancing the pointer to where the next relevant hex code is??), but the final #$FF gives me a black square, and #$FB gives me a vertical line for the right hand side of the box.
Seeing as how each time it does an LDA, X instruction it is only incremented 1 higher shouldn't that mean I have a line of Hex code somewhere in my ROM that goes
F9 1C 24 86 02 FF FF 24 A6 02 19 14 24 88 02 FF FB
However, I assure you that line of code appears NOWHERE in my ROM file
I have tried changing the FF hex values near where my SPK is in the file. It's stored as
F9 FF F9 1C FF FF 19 14 FF FF FF 33 FF FF 33 29 FF FF 26 FF FF FF FF 39 57 FF 2C 4C FF FF FF 35 FF 57 FF 36 F6 57 F9 FF F7 F7 FF FF F7 F8 FF FB
I am uncertain as to why there's that much before the final FB. The menu entry for LOOK is
F9 FF F9 15 FF 57 18 18 FF FB 14 FB
Where "L" is 15, "O" is 18, and "K" is 14. I believe the reason it starts with F9 FF F9 15 is because there is a line between each menu entry where they put accents in the Japanese text. So we get a left hand line for the accent line and a black square (since there are no accents required), then a left hand line for the actual line I'm writing to followed by "L". Same goes for the FF FB 14 FB at the end of the line.
It makes me think the entry for SPK is all mangled, I'll try making it match the way "LOOK" looks.