|
|
Now I researching the KOF '94 main CPU disassembly code, and once upon a time I found the very strange string there:
Code:
0330C4: 41FA 002C lea ($2c,PC) ; ($330f2), A0
After few attempts to define a meaning of this string I was adviced to load game program rom to IDA Pro. But, cause of Neo-Geo support is not added to IDA yet, the M68000 IDA disassembler sees a dc.b's only after file loading (see below).
What do you think, does it's should to create a Neo-Geo support plugin for IDA?
And what semicolon doing in the middle of instruction I quoted previously, before second operand designation? Is this code string auto-commented, or something else?
[ATTACHED IMAGE - CLICK FOR FULL SIZE]
Edited by VasiliyFamiliya (02/22/19 05:04 PM)
|
|
|
| R. Belmont |
|
Cuckoo for IGAvania
|
|
|
|
|
|
Reged: 09/21/03
|
|
Posts: 9716
|
|
Loc: ECV-197 The Orville
|
|
|
|
Send PM
|
|
|
Re: MAME debugger vs. IDA Pro
[Re: VasiliyFamiliya]
#381254 - 02/26/19 06:53 PM
|
|
|
> After few attempts to define a meaning of this string I was adviced to load game
> program rom to IDA Pro. But, cause of Neo-Geo support is not added to IDA yet, the
> M68000 IDA disassembler sees a dc.b's only after file loading (see below).
>
> What do you think, does it's should to create a Neo-Geo support plugin for IDA?
>
> And what semicolon doing in the middle of instruction I quoted previously, before
> second operand designation? Is this code string auto-commented, or something else?
The semicolon means you or someone using your computer commented that line previously.
IDA Pro does not disassemble automatically; you must click on the starting address to disassemble and press C.
|
|
|
|
|
> IDA Pro does not disassemble automatically; you must click on the starting address to
> disassemble and press C.
This trick covers adresses till 200A only.
> The semicolon means you or someone using your computer commented that line
> previously.
I looked inside MAME Debugger internal disassembler sources recently - and made sure that semicolon really means an auto-comment:
Code:
case 0x3a:
{
/* program counter with displacement */
u16 temp_value = read_imm_16();
return util::string_format("(%s,PC) ; ($%x)", make_signed_hex_str_16(temp_value), (make_int_16(temp_value) + m_cpu_pc-2) & 0xffffffff);
}
And now, here is a code executing after first joypad interaction string I found in KoF '94 disassembly (main1.asm file). Well, please check, did I understood all in the commented strings correctly.
Code:
0330B8: 1039 0010 FD96 move.b $10fd96.l, D0 ;P1_CURRENT value moving to D0
0330BE: 0240 000F andi.w #$f, D0 ;D0 first 4 bits (active joystick directions) check
0330C2: D040 add.w D0, D0 ;why this D0 self-doubling is need, prompt me please!
0330C4: 41FA 002C lea ($2c,PC) ; ($330f2), A0
0330C8: 4E71 nop
0330CA: 3230 0000 move.w (A0,D0.w), D1
0330CE: 6B20 bmi $330f0 ;end of suroutine if result of A0+D0 moving to D1 is negative
0330D0: 203C 0002 0000 move.l #$20000, D0
0330D6: 4EB9 0000 27EC jsr $27ec.l ;jump to $27ec subroutine (this subroutine code will be quoted separately)
0330DC: 2944 0050 move.l D4, ($50,A4)
0330E0: 2945 0058 move.l D5, ($58,A4)
0330E4: 4844 swap D4
0330E6: 4845 swap D5
0330E8: D96C 0024 add.w D4, ($24,A4)
0330EC: DB6C 0026 add.w D5, ($26,A4)
0330F0: 4E75 rts
Code:
0027EC: 2800 move.l D0, D4
0027EE: 3A01 move.w D1, D5
0027F0: 6100 0010 bsr $2802
0027F4: C144 exg D0, D4
0027F6: 1205 move.b D5, D1
0027F8: 6100 000C bsr $2806
0027FC: C145 exg D0, D5
0027FE: 4485 neg.l D5
002800: 4E75 rts
Code:
002802: 0601 0040 addi.b #$40, D1
002806: 0281 0000 00FF andi.l #$ff, D1
00280C: 4A01 tst.b D1
00280E: 6A02 bpl $2812
002810: 4480 neg.l D0
002812: D241 add.w D1, D1
002814: 41F9 00C0 4000 lea $c04000.l, A0
00281A: 3230 1000 move.w (A0,D1.w), D1
00281E: 0C41 0001 cmpi.w #$1, D1
002822: 6704 beq $2828
002824: 6000 0004 bra $282a
002828: 4E75 rts
Code:
00282A: 4A80 tst.l D0
00282C: 40C3 move SR, D3
00282E: 6722 beq $2852
002830: 6A02 bpl $2834
002832: 4480 neg.l D0
002834: 3400 move.w D0, D2
002836: 4840 swap D0
002838: C4C1 mulu.w D1, D2
00283A: 0682 0000 8000 addi.l #$8000, D2
002840: 4242 clr.w D2
002842: 4842 swap D2
002844: C0C1 mulu.w D1, D0
002846: D082 add.l D2, D0
002848: 44C3 move D3, CCR
00284A: 6A02 bpl $284e
00284C: 4480 neg.l D0
00284E: 4E75 rts
Edited by VasiliyFamiliya (02/27/19 05:07 AM)
|
|
|
| Rotwang |
|
Life is too short to be little...
|
|
|
|
|
Reged: 03/21/17
|
|
Posts: 109
|
|
|
|
|
|
Send PM
|
|
|
Re: MAME debugger vs. IDA Pro
[Re: VasiliyFamiliya]
#381653 - 03/20/19 06:38 AM
|
|
|
You don't need a Neo-Geo plugin. Those bytes you're looking at in IDA are actually part of the M68K's vector table.
https://wiki.neogeodev.org/index.php?title=68k_vector_table
This table is, conveniently enough, used to find what you're after: the starting address of the ROM as a 4 byte address. The first 3 bytes of it are actually in your screenshot at address $0004 and on (looks like $0000FF?? replace the ?? with whatever byte is at $0007). Jump to that address to disassemble the real start of the game's program.
Edited by Rotwang (03/20/19 06:38 AM)
|
|
|
|
Re: MAME debugger vs. IDA Pro
[Re: Rotwang]
#381666 - 03/21/19 03:21 PM
|
|
|
So, I need to define the 0000FF address as ROM start during loading?
|
|
|
| Rotwang |
|
Life is too short to be little...
|
|
|
|
|
|
Reged: 03/21/17
|
|
Posts: 109
|
|
|
|
|
|
Send PM
|
|
|
Re: MAME debugger vs. IDA Pro
[Re: VasiliyFamiliya]
#381669 - 03/21/19 04:57 PM
|
|
|
No, because there is likely still code before it that is executed later on. You just go to that address and press C to start disassembling there. It's not technically the start of the ROM, but it's the start of the program as that's where the program counter begins at power-on.
|
|
|
|
Re: MAME debugger vs. IDA Pro
[Re: Rotwang]
#381671 - 03/21/19 06:03 PM
|
|
|
> You just
> go to that address and press C to start disassembling there.
I just tried it, but but IDA refuses to react to this actions.
|
|
|
| Rotwang |
|
Life is too short to be little...
|
|
|
|
|
|
Reged: 03/21/17
|
|
Posts: 109
|
|
|
|
|
|
Send PM
|
|
|
Re: MAME debugger vs. IDA Pro
[Re: VasiliyFamiliya]
#381674 - 03/22/19 05:53 AM
|
|
|
Keep trying. I believe in you.
|
|
|
|
|
|
|
|
Re: KOF '94 reverse engineering.
[Re: VasiliyFamiliya]
#382625 - 05/30/19 08:02 PM
|
|
|
> I have a question - what are pieces of code located by 04BA6E, 04BDBA, 04CD6E,
> 04D28A, 04DB40 and 04E1D6 addresses of KoF '94 disassembly responsible for?
How should any of us know? Once again you're demanding other people do work for you.
|
|
|
|
Re: KOF '94 reverse engineering.
[Re: MooglyGuy]
#382645 - 05/31/19 11:23 AM
|
|
|
> > I have a question - what are pieces of code located by 04BA6E, 04BDBA, 04CD6E,
> > 04D28A, 04DB40 and 04E1D6 addresses of KoF '94 disassembly responsible for?
>
> How should any of us know? Once again you're demanding other people do work for you.
Indeed, they could tell the studio staff to make a cup of tea for all we know.
Problem is pretty much ALL of the posts by this poster are asking other people to do the work for him even when that work is a massive time investment. You learn nothing that way and it simply comes across as rude, lazy and demanding.
|
|
|
|
KOF '94 reverse engineering.
[Re: VasiliyFamiliya]
#383433 - 08/26/19 08:36 AM
|
|
|
When I was analyzing the KoF '94 disassembly code, I found such strings:
Code:
04AC56: 0839 0004 0010 FD97 btst #$4, $10fd97.l
04AC5E: 6700 0024 beq $4ac84 ; if (p1e&JOY_A)=0 then skip to $4ac84
04AC62: 4EBA 04B4 jsr ($4b4,PC) ; ($4b118) ; else goto $4b118 subroutine
04AC66: 4E71 nop
04AC68: 1E04 move.b D4, D7
04AC6A: 4EBA 0186 jsr ($186,PC) ; ($4adf2)
04AC6E: 4E71 nop
04AC70: 1807 move.b D7, D4
04AC72: 4EBA 04CC jsr ($4cc,PC) ; ($4b140)
04AC76: 4E71 nop
04AC78: 4EBA 0504 jsr ($504,PC) ; ($4b17e)
04AC7C: 4E71 nop
04AC7E: 3081 move.w D1, (A0)
04AC80: 6000 0162 bra $4ade4
04AC84: 0839 0005 0010 FD97 btst #$5, $10fd97.l
04AC8C: 6700 0024 beq $4acb2 ; if (p1e&JOY_B)=0 then skip to $4acb2
04AC90: 4EBA 0486 jsr ($486,PC) ; ($4b118) ; else goto $4b118 subroutine
04AC94: 4E71 nop
04AC96: 1E03 move.b D3, D7
04AC98: 4EBA 0158 jsr ($158,PC) ; ($4adf2)
04AC9C: 4E71 nop
04AC9E: 1607 move.b D7, D3
04ACA0: 4EBA 049E jsr ($49e,PC) ; ($4b140)
04ACA4: 4E71 nop
04ACA6: 4EBA 04D6 jsr ($4d6,PC) ; ($4b17e)
04ACAA: 4E71 nop
04ACAC: 3081 move.w D1, (A0)
04ACAE: 6000 0134 bra $4ade4
04ACB2: 0839 0006 0010 FD97 btst #$6, $10fd97.l
04ACBA: 6700 0024 beq $4ace0 ; if (p1e&JOY_C)=0 then skip to $4ace0
04ACBE: 4EBA 0458 jsr ($458,PC) ; ($4b118) ; else goto $4b118 subroutine
04ACC2: 4E71 nop
04ACC4: 1E02 move.b D2, D7
04ACC6: 4EBA 012A jsr ($12a,PC) ; ($4adf2)
04ACCA: 4E71 nop
04ACCC: 1407 move.b D7, D2
04ACCE: 4EBA 0470 jsr ($470,PC) ; ($4b140)
04ACD2: 4E71 nop
04ACD4: 4EBA 04A8 jsr ($4a8,PC) ; ($4b17e)
04ACD8: 4E71 nop
04ACDA: 3081 move.w D1, (A0)
04ACDC: 6000 0106 bra $4ade4
04ACE0: 0839 0007 0010 FD97 btst #$7, $10fd97.l
04ACE8: 6700 00FA beq $4ade4 ; if (p1e&JOY_D)=0 then end the subroutine
04ACEC: 41F9 0040 0000 lea $400000.l, A0 ; else A0=[$400000]
04ACF2: 7000 moveq #$0, D0 ; D0=0
04ACF4: 102D 5678 move.b ($5678,A5), D0 ; D0=[A5+$5678] value
04ACF8: EB48 lsl.w #5, D0 ; D0=[A5+$5678] value<<5
04ACFA: D1C0 adda.l D0, A0 ; A0=[[A5+$5678] value<<5]
04ACFC: 43ED 567A lea ($567a,A5), A1 ; A1=[A5+$567a]
04AD00: 303C 000F move.w #$f, D0 ; D0=#$f
04AD04: 32D8 move.w (A0)+, (A1)+ ; [A5+$567b] value=[[A5+$5678] value<<5] value
04AD06: 51C8 FFFC dbra D0, $4ad04 ; D0-1, if D0<>0 then jump back to previous step
04AD0A: 6000 00D8 bra $4ade4 ; else if D0=0 then end the subroutine
04AD0E: 0839 0004 0010 FD97 btst #$4, $10fd97.l
04AD16: 6700 0024 beq $4ad3c ; if (p1e&JOY_A)=0 then skip to $4ad3c
04AD1A: 4EBA 03FC jsr ($3fc,PC) ; ($4b118)
04AD1E: 4E71 nop
04AD20: 1E04 move.b D4, D7
04AD22: 4EBA 00DC jsr ($dc,PC) ; ($4ae00)
04AD26: 4E71 nop
04AD28: 1807 move.b D7, D4
04AD2A: 4EBA 0414 jsr ($414,PC) ; ($4b140)
04AD2E: 4E71 nop
04AD30: 4EBA 044C jsr ($44c,PC) ; ($4b17e)
04AD34: 4E71 nop
04AD36: 3081 move.w D1, (A0)
04AD38: 6000 00AA bra $4ade4
04AD3C: 0839 0005 0010 FD97 btst #$5, $10fd97.l
04AD44: 6700 0024 beq $4ad6a ; if (p1e&JOY_B)=0 then skip to $4ad6a
04AD48: 4EBA 03CE jsr ($3ce,PC) ; ($4b118)
04AD4C: 4E71 nop
04AD4E: 1E03 move.b D3, D7
04AD50: 4EBA 00AE jsr ($ae,PC) ; ($4ae00)
04AD54: 4E71 nop
04AD56: 1607 move.b D7, D3
04AD58: 4EBA 03E6 jsr ($3e6,PC) ; ($4b140)
04AD5C: 4E71 nop
04AD5E: 4EBA 041E jsr ($41e,PC) ; ($4b17e)
04AD62: 4E71 nop
04AD64: 3081 move.w D1, (A0)
04AD66: 6000 007C bra $4ade4
04AD6A: 0839 0006 0010 FD97 btst #$6, $10fd97.l
04AD72: 6700 0024 beq $4ad98 ; if (p1e&JOY_C)=0 then skip to $4ad98
04AD76: 4EBA 03A0 jsr ($3a0,PC) ; ($4b118)
04AD7A: 4E71 nop
04AD7C: 1E02 move.b D2, D7
04AD7E: 4EBA 0080 jsr ($80,PC) ; ($4ae00)
04AD82: 4E71 nop
04AD84: 1407 move.b D7, D2
04AD86: 4EBA 03B8 jsr ($3b8,PC) ; ($4b140)
04AD8A: 4E71 nop
04AD8C: 4EBA 03F0 jsr ($3f0,PC) ; ($4b17e)
04AD90: 4E71 nop
04AD92: 3081 move.w D1, (A0)
04AD94: 6000 004E bra $4ade4
04AD98: 0839 0007 0010 FD97 btst #$7, $10fd97.l
04ADA0: 6700 0042 beq $4ade4 ; if (p1e&JOY_D)=0 then end the subroutine
04ADA4: 0A2D 0004 569A eori.b #$4, ($569a,A5) ; [A5+$569a] value^4
04ADAA: 3B6D 566E 566A move.w ($566e,A5), ($566a,A5) ; [A5+$566a] value=[A5+$566e] value
04ADB0: 3B6D 5670 566C move.w ($5670,A5), ($566c,A5) ; [A5+$566c] value=[A5+$5670] value
04ADB6: 4EBA 04A2 jsr ($4a2,PC) ; ($4b25a)
04ADBA: 4E71 nop
04ADBC: 41FA 05B0 lea ($5b0,PC) ; ($4b36e), A0
04ADC0: 4E71 nop
04ADC2: 303C 8F00 move.w #$8f00, D0 ; lowest word of swapped (([A5+$566e] value<<5)+[A5+$5670] value+#$7002) value=#$8f00
04ADC6: 082D 0002 569A btst #$2, ($569a,A5)
04ADCC: 6600 0006 bne $4add4 ; if 3rd bit of old [A5+$569a] value^4 is not equal to 0 then skip next step
04ADD0: 303C 0F00 move.w #$f00, D0 ; else lowest word of swapped (([A5+$566e] value<<5)+[A5+$5670] value+#$7002) value=#$f00
04ADD4: 223C 0020 0000 move.l #$200000, D1 ; D1=#$200000
04ADDA: 4EBA 04E4 jsr ($4e4,PC) ; ($4b2c0)
04ADDE: 4E71 nop
04ADE0: 6000 0002 bra $4ade4
04ADE4: 4E75 rts
Code:
04B36E: 5041 addq.w #8, D1
Code:
04B2C0: 1018 move.b (A0)+, D0 ; D0=[$4b36f] value=#$41 at the beginning of cycle
04B2C2: 6B00 000C bmi $4b2d0
04B2C6: 23C0 003C 0000 move.l D0, $3c0000.l ; send D0 to REG_VRAMADDR
04B2CC: D081 add.l D1, D0 ; D0+#$200000
04B2CE: 60F0 bra $4b2c0 ; return to the beginning of cycle
04B2D0: 4E75 rts
At a certain moment I suspected something was wrong at once - when 04B2CE operation makes processor to skip to beginnning of subroutine, the same value - #$41 (not negative at all) - are getting loaded to D0 at this beginning. What's may to activate N flag after 04B2C0 operation, to don't let this cycle to turn up infinitive?
|
|
|
|
Index 
Threaded 
MAME debugger vs. IDA Pro
Reply
[Re: 
