Kodewerx

ok. to be more specific, i need to learn how to find out where an address is reading from, and i need to learn how to find out where an address is writting to. as an example, i'll post the code i'm having trouble with. so that it's noted, i'm using gcnrd on the gamecube.

the code shows one of the current enemies that are on screen in X4. it works the same for X5 and X6 as well though. wierd thing is, if another enemy comes on screen, it doesn't show them up untill you've desroyed the first one. this also works for most bosses. (for some dumb reason, double's data is written a bit further down, while iris is at the same spot.) i tried running "break on read" and all the addresses shown didn't make much sense to me, mainly because i didn't see any that resembled the enemies id number at ALL. i tried poking a few, and the enemy stayed the same. another strange thing, is if i poke the enemy modifier address, the enemies sprites don't change, just it's behavior, which can lead to a crash. this is why i need to find where this is being written from. also, i tried searching the ram for the enemy's ID number, and everything that came up as a match, did squat. anyway, here's what i have so far. this is for X4 on MMX collection for the gamecube. the names aren't necesarily the real enemy names, thier just based on my observations of them.

80C68A68 current enemy 1

4100 the flying intro boss
4105 bees
4106 spike dozer
4107 wall claws
4108 intro boss (fight mode)
410C "flying" fish
4110 purple trident thing
4113 spider shooter thing

4131 roley poley gunner

if you can help me out, please do.

If it's a half-word, you might have the "wrong" address. Try 80C68A6A

_________________
I have to return some video tapes.

Feed me a stray cat.

no, i'm poking with gcnrd, usualy sending the address to the poker straight from the memory viewer. i'm hitting the right address.

Anything that hits a breakpoint will only write the things you see in the memory editor.

_________________
I have to return some video tapes.

Feed me a stray cat.

so what you're saying, is that it's unfixable? shoot then. i guess it's just reading the enemy data from the disk. ok then, let me ask you this. would it be possible to find the tileset modifier for the current enemy? i mean, if the enemy's actions change but the sprites don't, wouldn't that indicate that the tileset for that enemy is as well? also, if i switch tilesets, would that also prevent crashing?

No, I'm saying you're looking at the issue wrong; GCNrd only does what you tell it to. If you tell it to break on all writes to address 80C68A68, then it's going to, regardless of what you think might belong there.

_________________
I have to return some video tapes.

Feed me a stray cat.

well, one sure way to test if it's reading from the disk would be to start a level, and remove the disk, and play through a bit. either way though, i need to familiarize myself whith the things that the breakpoint viewer spits out, and floating points. heh, thank god X4, 5, and 6 all three use virtualy the same engine. a fix for one is a fix for all three, and i've got AR codes i've made myself that back that up.

You should probably paste the register (context) dump after the breakpoint hits, and then use the disassembler and go to the address (cause ... or something) given. Paste some of the disassembler listing, too. Then I can give you an idea of what you're supposed to be looking at.

There is also this: GCNrd Tutorial.

_________________
I have to return some video tapes.

Feed me a stray cat.

ok. i've got the stuff here. so you know, the address being written to is 80B34880, and usualy looks like this: 4101 0100 the 4101 part is the enemy modifier. the 41 seems to be consistant with each enemy while the 01 canges to match each enemy. the 0100 part, seems to change depending on what the enemy is doing. i'm guessing it's either a current action modifier or a current animation modifier. and so you know, this information given, is based on the breakpoint being hit from the first enemy of Metal Shark Player's stage in X6 on the GC version of Mega Man X Collection.

here's from the top window:

[General Purpose Registers]
r0 : 0000001A sp : 801AE860 rtoc: 801A6340 r3 : 80B34880
r4 : 00000000 r5 : 80B34880 r6 : 00000862 r7 : 00000200
r8 : 00000842 r9 : 000000B0 r10 : 00000020 r11 : 00000200
r12 : 80D504B8 r13 : 801A5BC0 r14 : 00000000 r15 : 00000000
r16 : 00000000 r17 : 00000000 r18 : 00000000 r19 : 00000000
r20 : 00000842 r21 : 00000862 r22 : 000000B0 r23 : 00000200
r24 : 00000200 r25 : 000000B0 r26 : 00000862 r27 : 000006C2
r28 : 80D979AC r29 : 00000001 r30 : 80B36924 r31 : 80A1DF78

cr : 28824088 lr : 80D49C8C ctr: 0000001A xer: 00000000


[Floating Point Registers, Approximate Real Numbers]
f00: 58 f01: 4.5036e+015 f02: 2.18965 f03: 0.0909088
f04: 0.333333 f05: 0.142857 f06: 0.0909088 f07: 0.0666107
f08: 0.0497688 f09: 0.00787401 f10: 3.84401e-009 f11: 6.20001e-005
f12: 0.003125 f13: 2560 f14: 0 f15: 0
f16: 0 f17: 0 f18: 0 f19: 0
f20: 0 f21: 0 f22: 0 f23: 0
f24: 0 f25: 0 f26: 0 f27: 0
f28: 0 f29: 0 f30: 0 f31: 0

[Floating Point Registers, Single Precision]
f00: 42680000 f01: 59800000 f02: 400C2348 f03: 3DBA2E68
f04: 3EAAAAA8 f05: 3E124920 f06: 3DBA2E68 f07: 3D886B30
f08: 3D4BDA58 f09: 3C010200 f10: 31841450 f11: 38820610
f12: 3B4CCCC8 f13: 45200000 f14: 00000000 f15: 00000000
f16: 00000000 f17: 00000000 f18: 00000000 f19: 00000000
f20: 00000000 f21: 00000000 f22: 00000000 f23: 00000000
f24: 00000000 f25: 00000000 f26: 00000000 f27: 00000000
f28: 00000000 f29: 00000000 f30: 00000000 f31: 00000000

[Floating Point Registers, Double Precision]
f00: 404D0000-00000000 f01: 43300000-80000000
f02: 40018469-E0000000 f03: 3FB745CD-C665A8DA
f04: 3FD55555-5555550D f05: 3FC24924-920083FF
f06: 3FB745CD-C54C206E f07: 3FB10D66-A1A296D8
f08: 3FA97B4B-24FFB83E f09: 3F802040-81020408
f10: 3E30828A-237153C9 f11: 3F1040C2-050C1C40
f12: 3F699999-A0000000 f13: 40A40000-00000000
f14: 00000000-00000000 f15: 00000000-00000000
f16: 00000000-00000000 f17: 00000000-00000000
f18: 00000000-00000000 f19: 00000000-00000000
f20: 00000000-00000000 f21: 00000000-00000000
f22: 00000000-00000000 f23: 00000000-00000000
f24: 00000000-00000000 f25: 00000000-00000000
f26: 00000000-00000000 f27: 00000000-00000000
f28: 00000000-00000000 f29: 00000000-00000000
f30: 00000000-00000000 f31: 00000000-00000000

fpscr: FFF80000


srr0: 80D504FC srr1: 0000A032

gqr00: 00000000 gqr01: 00000000 gqr02: 00040004 gqr03: 00050005
gqr04: 00060006 gqr05: 00070007 gqr06: 00000000 gqr07: 00000000

psf00: 43700000-00000000 psf01: 59800004-4B800000
psf02: 43700000-43700000 psf03: 43FB0000-43FB0000
psf04: 00000000-00000000 psf05: 43200000-43200000
psf06: 43AB0000-43AB0000 psf07: 43200000-43200000
psf08: C2F00000-C2F00000 psf09: 4B800000-4B800000
psf10: 31841451-3F800000 psf11: 38820610-BB888889
psf12: 3B4CCCCD-3B4CCCCD psf13: 45200000-45200000
psf14: 00000000-00000000 psf15: 00000000-00000000
psf16: 00000000-00000000 psf17: 00000000-00000000
psf18: 00000000-00000000 psf19: 00000000-00000000
psf20: 00000000-00000000 psf21: 00000000-00000000
psf22: 00000000-00000000 psf23: 00000000-00000000
psf24: 00000000-00000000 psf25: 00000000-00000000
psf26: 00000000-00000000 psf27: 00000000-00000000
psf28: 00000000-00000000 psf29: 00000000-00000000
psf30: 00000000-43800000 psf31: 00000000-00000000


and the bottom window:

80D504FC: 98850000 stb r4,0(r5)
80D50500: 98850001 stb r4,1(r5)
80D50504: 98850002 stb r4,2(r5)
80D50508: 98850003 stb r4,3(r5)
80D5050C: 98850004 stb r4,4(r5)
80D50510: 98850005 stb r4,5(r5)
80D50514: 38A50006 addi r5,r5,6
80D50518: 4200FFE4 bdnz+ 0x80d504fc
80D5051C: 3CA080B3 lis r5,-32589
80D50520: 3C80A41A lis r4,-23526
80D50524: 38054880 addi r0,r5,18560
80D50528: 39000000 li r8,0
80D5052C: 7C001850 sub r0,r3,r0
80D50530: 388441A5 addi r4,r4,16805
80D50534: 7CE40016 mulhwu r7,r4,r0
80D50538: 91030050 stw r8,80(r3)

and from the dissasembler tab:

80D504FC: 98850000 stb r4,0(r5)
80D50500: 98850001 stb r4,1(r5)
80D50504: 98850002 stb r4,2(r5)
80D50508: 98850003 stb r4,3(r5)
80D5050C: 98850004 stb r4,4(r5)
80D50510: 98850005 stb r4,5(r5)
80D50514: 38A50006 addi r5,r5,6
80D50518: 4200FFE4 bdnz+ 0x80d504fc
80D5051C: 3CA080B3 lis r5,-32589
80D50520: 3C80A41A lis r4,-23526
80D50524: 38054880 addi r0,r5,18560
80D50528: 39000000 li r8,0
80D5052C: 7C001850 sub r0,r3,r0
80D50530: 388441A5 addi r4,r4,16805
80D50534: 7CE40016 mulhwu r7,r4,r0
80D50538: 91030050 stw r8,80(r3)

virtualy a mirror of the above actualy. hopefuly you can make more sence out of this tan i currently can. i'm gonna read up and do some more poking arround. oh, and like said, X4, 5, and 6 all three use virtualy the same engine, so i'm assuming a fix for one would be a fix for all three. just need to find the offset. and to state, crap man, when you make something, you make sure you do it well, don't you?

i looked up that PPC reference list mentioned in the tutorial, and i didn't see a reference for bdnz+ there, so i have no idea what to make of it. if you want a screen shot of any location in the memory, just ask. i'll see what i can do. and thanks for the help.

"sb" is Store Byte. Since it is writing the same byte (r4 = 0x00) over this whole area (noted by the loop/decrement instruction "bdnz"), you can conclude that this is *not* the code you want to deal with. Try again. (Hit the run button again ... or maybe twice more, I don't know. Try to find something a little more interesting.)

The "+" is an artifact of the disassembler. I believe the author intended + to indicate branching backward, and - to indicate branching forward. No, I don't get it either. It's not standard PowerPC.

_________________
I have to return some video tapes.

Feed me a stray cat.

huh? what do you mean it's not the one i want to deal with? you mean i have the wrong address?

I mean the code (from the disassembler) only clears the area (surrounding and including) the address you set the breakpoint on. So unless the data you are looking for is supposed to be all zeros, these are not the writes you are looking for. Thus, "try again" ... pressing the Run button after the breakpoint will bring up the next instruction which writes your breakpoint address. This may (or may not) be the write you are looking for.

_________________
I have to return some video tapes.

Feed me a stray cat.

the run button? you mean the button that makes the game play again, or are you refering to another button and just calling it run? if you mean the button with the word Run on it... then crap. that's what i did in the first place. i'll try copy and pasting without hitting it... crap. thought something changed when i hit it. i'll get it later today. thanks though.

shoot! i just realized! you were right! it's SUPPOSED to be writing 0000 to the address! those check to see if the enemy is onscreen or destroyed! i hit run repeatedly, and all i got was this junk:

before hitting run

80D504FC: 98850000 stb r4,0(r5)
80D50500: 98850001 stb r4,1(r5)
80D50504: 98850002 stb r4,2(r5)
80D50508: 98850003 stb r4,3(r5)
80D5050C: 98850004 stb r4,4(r5)
80D50510: 98850005 stb r4,5(r5)
80D50514: 38A50006 addi r5,r5,6
80D50518: 4200FFE4 bdnz+ 0x80d504fc
80D5051C: 3CA080B3 lis r5,-32589
80D50520: 3C80A41A lis r4,-23526
80D50524: 38054880 addi r0,r5,18560
80D50528: 39000000 li r8,0
80D5052C: 7C001850 sub r0,r3,r0
80D50530: 388441A5 addi r4,r4,16805
80D50534: 7CE40016 mulhwu r7,r4,r0
80D50538: 91030050 stw r8,80(r3)

after hitting run once

80D504FC: 98850000 stb r4,0(r5)
80D50500: 98850001 stb r4,1(r5)
80D50504: 98850002 stb r4,2(r5)
80D50508: 98850003 stb r4,3(r5)
80D5050C: 98850004 stb r4,4(r5)
80D50510: 98850005 stb r4,5(r5)
80D50514: 38A50006 addi r5,r5,6
80D50518: 4200FFE4 bdnz+ 0x80d504fc
80D5051C: 3CA080B3 lis r5,-32589
80D50520: 3C80A41A lis r4,-23526
80D50524: 38054880 addi r0,r5,18560
80D50528: 39000000 li r8,0
80D5052C: 7C001850 sub r0,r3,r0
80D50530: 388441A5 addi r4,r4,16805
80D50534: 7CE40016 mulhwu r7,r4,r0
80D50538: 91030050 stw r8,80(r3)


after hitting run twice

80D504FC: 98850000 stb r4,0(r5)
80D50500: 98850001 stb r4,1(r5)
80D50504: 98850002 stb r4,2(r5)
80D50508: 98850003 stb r4,3(r5)
80D5050C: 98850004 stb r4,4(r5)
80D50510: 98850005 stb r4,5(r5)
80D50514: 38A50006 addi r5,r5,6
80D50518: 4200FFE4 bdnz+ 0x80d504fc
80D5051C: 3CA080B3 lis r5,-32589
80D50520: 3C80A41A lis r4,-23526
80D50524: 38054880 addi r0,r5,18560
80D50528: 39000000 li r8,0
80D5052C: 7C001850 sub r0,r3,r0
80D50530: 388441A5 addi r4,r4,16805
80D50534: 7CE40016 mulhwu r7,r4,r0
80D50538: 91030050 stw r8,80(r3)


but here's what's interesting! i set the same breakpoint, to read instead of write, and without even MOVING to get the enemy on screen, this crap came up!

top screen

[General Purpose Registers]
r0 : 00000000 sp : 801AE8B0 rtoc: 801A6340 r3 : 80B34880
r4 : 80A20000 r5 : 80B34880 r6 : 0000018A r7 : 80D8D650
r8 : 00000119 r9 : 00000000 r10 : 00000000 r11 : 800F3064
r12 : 80D44B04 r13 : 801A5BC0 r14 : 00000000 r15 : 00000000
r16 : 00000000 r17 : 00000000 r18 : 00000000 r19 : 00000000
r20 : 00000000 r21 : 00000000 r22 : 00000000 r23 : 00000000
r24 : 00000000 r25 : 00000000 r26 : 00000000 r27 : 00000000
r28 : 80B365C0 r29 : 80B36924 r30 : 80A1DF78 r31 : 80B367D0

cr : 88824082 lr : 80D12C18 ctr: 80D44B04 xer: 00000000


[Floating Point Registers, Approximate Real Numbers]
f00: 58 f01: 4.5036e+015 f02: 2.18965 f03: 360
f04: -1.#IND f05: 1.548 f06: -1.#IND f07: -1.#IND
f08: 4.5036e+015 f09: 2 f10: 1 f11: -0.00416667
f12: 0.003125 f13: 2560 f14: 0 f15: 0
f16: 0 f17: 0 f18: 0 f19: 0
f20: 0 f21: 0 f22: 0 f23: 0
f24: 0 f25: 0 f26: 0 f27: 0
f28: 0 f29: 0 f30: 0 f31: 0

[Floating Point Registers, Single Precision]
f00: 42680000 f01: 59800000 f02: 400C2348 f03: 43B40000
f04: FFC00000 f05: 3FC624D8 f06: FFC00000 f07: FFC00000
f08: 59800000 f09: 40000000 f10: 3F800000 f11: BB888888
f12: 3B4CCCC8 f13: 45200000 f14: 00000000 f15: 00000000
f16: 00000000 f17: 00000000 f18: 00000000 f19: 00000000
f20: 00000000 f21: 00000000 f22: 00000000 f23: 00000000
f24: 00000000 f25: 00000000 f26: 00000000 f27: 00000000
f28: 00000000 f29: 00000000 f30: 00000000 f31: 00000000

[Floating Point Registers, Double Precision]
f00: 404D0000-00000000 f01: 43300000-80000000
f02: 40018469-E0000000 f03: 40768000-00000000
f04: FFF80000-FFFFFFFF f05: 3FF8C49B-A5E353F8
f06: FFF80000-00000000 f07: FFF80000-00000000
f08: 43300000-80000000 f09: 40000000-00000000
f10: 3FF00000-00000000 f11: BF711111-20000000
f12: 3F699999-A0000000 f13: 40A40000-00000000
f14: 00000000-00000000 f15: 00000000-00000000
f16: 00000000-00000000 f17: 00000000-00000000
f18: 00000000-00000000 f19: 00000000-00000000
f20: 00000000-00000000 f21: 00000000-00000000
f22: 00000000-00000000 f23: 00000000-00000000
f24: 00000000-00000000 f25: 00000000-00000000
f26: 00000000-00000000 f27: 00000000-00000000
f28: 00000000-00000000 f29: 00000000-00000000
f30: 00000000-00000000 f31: 00000000-00000000

fpscr: FFF80000


srr0: 80D12C90 srr1: 0000A032

gqr00: 00000000 gqr01: 00000000 gqr02: 00040004 gqr03: 00050005
gqr04: 00060006 gqr05: 00070007 gqr06: 00000000 gqr07: 00000000

psf00: B80BD096-BF800117 psf01: BC088889-3F800000
psf02: 3BCCCCCD-BF800000 psf03: BF800000-BF800000
psf04: BC088889-BC088889 psf05: 380BD096-380BD096
psf06: 46EA6000-46EA6000 psf07: 00000000-00000000
psf08: 3BCCCCCD-3BCCCCCD psf09: 40000000-40000000
psf10: 3F800000-3F800000 psf11: BB888889-BB888889
psf12: 3B4CCCCD-3B4CCCCD psf13: 45200000-45200000
psf14: 00000000-00000000 psf15: 00000000-00000000
psf16: 00000000-00000000 psf17: 00000000-00000000
psf18: 00000000-00000000 psf19: 00000000-00000000
psf20: 00000000-00000000 psf21: 00000000-00000000
psf22: 00000000-00000000 psf23: 00000000-00000000
psf24: 00000000-00000000 psf25: 00000000-00000000
psf26: 00000000-00000000 psf27: 00000000-00000000
psf28: 00000000-00000000 psf29: 00000000-00000000
psf30: 00000000-43800000 psf31: 00000000-00000000


bottom window

80D12C90: 88830000 lbz r4,0(r3)
80D12C94: 7C800775 extsb. r0,r4
80D12C98: 41820054 beq- 0x80d12cec
80D12C9C: 881F00CC lbz r0,204(r31)
80D12CA0: 7C000775 extsb. r0,r0
80D12CA4: 40820018 bne- 0x80d12cbc
80D12CA8: 881D0012 lbz r0,18(r29)
80D12CAC: 7C000775 extsb. r0,r0
80D12CB0: 41820020 beq- 0x80d12cd0
80D12CB4: 54800739 rlwinm. r0,r4,0,28,28
80D12CB8: 40820018 bne- 0x80d12cd0
80D12CBC: 88030003 lbz r0,3(r3)
80D12CC0: 7C000775 extsb. r0,r0
80D12CC4: 41820028 beq- 0x80d12cec
80D12CC8: 4803C4AD bl 0x80d4f174
80D12CCC: 48000020 b 0x80d12cec


and after hitting run once:

80D12C90: 88830000 lbz r4,0(r3)
80D12C94: 7C800775 extsb. r0,r4
80D12C98: 41820054 beq- 0x80d12cec
80D12C9C: 881F00CC lbz r0,204(r31)
80D12CA0: 7C000775 extsb. r0,r0
80D12CA4: 40820018 bne- 0x80d12cbc
80D12CA8: 881D0012 lbz r0,18(r29)
80D12CAC: 7C000775 extsb. r0,r0
80D12CB0: 41820020 beq- 0x80d12cd0
80D12CB4: 54800739 rlwinm. r0,r4,0,28,28
80D12CB8: 40820018 bne- 0x80d12cd0
80D12CBC: 88030003 lbz r0,3(r3)
80D12CC0: 7C000775 extsb. r0,r0
80D12CC4: 41820028 beq- 0x80d12cec
80D12CC8: 4803C4AD bl 0x80d4f174
80D12CCC: 48000020 b 0x80d12cec


so, when it's writing to the address, it's telling it to set to 0000, for a reason. so question is, what on earth do i do with this now? try a read/write search? try an execute search? so it's noted, the enemy was not on screen with this run. however, here is a search where the enemy IS on screen.


top window:


[General Purpose Registers]
r0 : 00000000 sp : 801AE8B0 rtoc: 801A6340 r3 : 80B34880
r4 : 80A20000 r5 : 80B34880 r6 : 0000018A r7 : 80D8D650
r8 : 00000137 r9 : 00000000 r10 : 00000000 r11 : 800F3064
r12 : 80D44A00 r13 : 801A5BC0 r14 : 00000000 r15 : 00000000
r16 : 00000000 r17 : 00000000 r18 : 00000000 r19 : 00000000
r20 : 00000000 r21 : 00000000 r22 : 00000000 r23 : 00000000
r24 : 00000000 r25 : 00000000 r26 : 00000000 r27 : 00000000
r28 : 80B365C0 r29 : 80B36924 r30 : 80A1DF78 r31 : 80B367D0

cr : 88824082 lr : 80D12C18 ctr: 80D44A00 xer: 00000000


[Floating Point Registers, Approximate Real Numbers]
f00: 58 f01: 4.5036e+015 f02: 2.18965 f03: 360
f04: -1.#IND f05: 1.548 f06: -1.#IND f07: -1.#IND
f08: 4.5036e+015 f09: 2 f10: 1 f11: -0.00416667
f12: 0.003125 f13: 2560 f14: 0 f15: 0
f16: 0 f17: 0 f18: 0 f19: 0
f20: 0 f21: 0 f22: 0 f23: 0
f24: 0 f25: 0 f26: 0 f27: 0
f28: 0 f29: 0 f30: 0 f31: 0

[Floating Point Registers, Single Precision]
f00: 42680000 f01: 59800000 f02: 400C2348 f03: 43B40000
f04: FFC00000 f05: 3FC624D8 f06: FFC00000 f07: FFC00000
f08: 59800000 f09: 40000000 f10: 3F800000 f11: BB888888
f12: 3B4CCCC8 f13: 45200000 f14: 00000000 f15: 00000000
f16: 00000000 f17: 00000000 f18: 00000000 f19: 00000000
f20: 00000000 f21: 00000000 f22: 00000000 f23: 00000000
f24: 00000000 f25: 00000000 f26: 00000000 f27: 00000000
f28: 00000000 f29: 00000000 f30: 00000000 f31: 00000000

[Floating Point Registers, Double Precision]
f00: 404D0000-00000000 f01: 43300000-80000000
f02: 40018469-E0000000 f03: 40768000-00000000
f04: FFF80000-FFFFFFFF f05: 3FF8C49B-A5E353F8
f06: FFF80000-00000000 f07: FFF80000-00000000
f08: 43300000-80000000 f09: 40000000-00000000
f10: 3FF00000-00000000 f11: BF711111-20000000
f12: 3F699999-A0000000 f13: 40A40000-00000000
f14: 00000000-00000000 f15: 00000000-00000000
f16: 00000000-00000000 f17: 00000000-00000000
f18: 00000000-00000000 f19: 00000000-00000000
f20: 00000000-00000000 f21: 00000000-00000000
f22: 00000000-00000000 f23: 00000000-00000000
f24: 00000000-00000000 f25: 00000000-00000000
f26: 00000000-00000000 f27: 00000000-00000000
f28: 00000000-00000000 f29: 00000000-00000000
f30: 00000000-00000000 f31: 00000000-00000000

fpscr: FFF80000


srr0: 80D12C90 srr1: 00008032

gqr00: 00000000 gqr01: 00000000 gqr02: 00040004 gqr03: 00050005
gqr04: 00060006 gqr05: 00070007 gqr06: 00000000 gqr07: 00000000

psf00: 42680000-42680000 psf01: 59800004-00000000
psf02: 400C234F-400C234F psf03: 43B40000-43B40000
psf04: FFC00007-BC088889 psf05: 3FC624DD-380BD096
psf06: FFC00000-46EA6000 psf07: FFC00000-00000000
psf08: 59800004-3BCCCCCD psf09: 40000000-40000000
psf10: 3F800000-3F800000 psf11: BB888889-BB888889
psf12: 3B4CCCCD-3B4CCCCD psf13: 45200000-45200000
psf14: 00000000-00000000 psf15: 00000000-00000000
psf16: 00000000-00000000 psf17: 00000000-00000000
psf18: 00000000-00000000 psf19: 00000000-00000000
psf20: 00000000-00000000 psf21: 00000000-00000000
psf22: 00000000-00000000 psf23: 00000000-00000000
psf24: 00000000-00000000 psf25: 00000000-00000000
psf26: 00000000-00000000 psf27: 00000000-00000000
psf28: 00000000-00000000 psf29: 00000000-00000000
psf30: 00000000-43800000 psf31: 00000000-00000000



80D12C90: 88830000 lbz r4,0(r3)
80D12C94: 7C800775 extsb. r0,r4
80D12C98: 41820054 beq- 0x80d12cec
80D12C9C: 881F00CC lbz r0,204(r31)
80D12CA0: 7C000775 extsb. r0,r0
80D12CA4: 40820018 bne- 0x80d12cbc
80D12CA8: 881D0012 lbz r0,18(r29)
80D12CAC: 7C000775 extsb. r0,r0
80D12CB0: 41820020 beq- 0x80d12cd0
80D12CB4: 54800739 rlwinm. r0,r4,0,28,28
80D12CB8: 40820018 bne- 0x80d12cd0
80D12CBC: 88030003 lbz r0,3(r3)
80D12CC0: 7C000775 extsb. r0,r0
80D12CC4: 41820028 beq- 0x80d12cec
80D12CC8: 4803C4AD bl 0x80d4f174
80D12CCC: 48000020 b 0x80d12cec


after hitting run once:

80D12C90: 88830000 lbz r4,0(r3)
80D12C94: 7C800775 extsb. r0,r4
80D12C98: 41820054 beq- 0x80d12cec
80D12C9C: 881F00CC lbz r0,204(r31)
80D12CA0: 7C000775 extsb. r0,r0
80D12CA4: 40820018 bne- 0x80d12cbc
80D12CA8: 881D0012 lbz r0,18(r29)
80D12CAC: 7C000775 extsb. r0,r0
80D12CB0: 41820020 beq- 0x80d12cd0
80D12CB4: 54800739 rlwinm. r0,r4,0,28,28
80D12CB8: 40820018 bne- 0x80d12cd0
80D12CBC: 88030003 lbz r0,3(r3)
80D12CC0: 7C000775 extsb. r0,r0
80D12CC4: 41820028 beq- 0x80d12cec
80D12CC8: 4803C4AD bl 0x80d4f174
80D12CCC: 48000020 b 0x80d12cec


ok, that's all i got. let me know what you think.

Use only write breakpoints, but hit run continuously, until the cause address (shown in the disassembler) changes. When you have a different address causing the write (thus, a different instruction) then you have a better chance of finding something interesting.

Of second note, the reads will occur every frame, yes. How else is the game supposed to tell what the variable is set to, if it doesn't read it every frame?

_________________
I have to return some video tapes.

Feed me a stray cat.

heh heh, ok. i'll look into it either tommorow or monday. a little late for me right now. could be wrong, but i think i tried that already. idk, like said, could be wrong.

Having a good understanding of programming will really help you with any reverse engineering. When you can just look at a small disassembler excerpt, and spot patterns. For example, I knew right away that the first piece you pasted was a memory-clearing loop. All the pieces are there, you just have to make sense of them.

_________________
I have to return some video tapes.

Feed me a stray cat.

heh, ok. i figured it out. you said run, but should have said step. now that i understand, here's a load of info that gcnrd spits out.

80D504FC: 98850000 stb r4,0(r5)
80D50500: 98850001 stb r4,1(r5)
80D50504: 98850002 stb r4,2(r5)
80D50508: 98850003 stb r4,3(r5)
80D5050C: 98850004 stb r4,4(r5)
80D50510: 98850005 stb r4,5(r5)
80D50514: 38A50006 addi r5,r5,6
80D50518: 4200FFE4 bdnz+ 0x80d504fc
80D5051C: 3CA080B3 lis r5,-32589
80D50520: 3C80A41A lis r4,-23526
80D50524: 38054880 addi r0,r5,18560
80D50528: 39000000 li r8,0
80D5052C: 7C001850 sub r0,r3,r0
80D50530: 388441A5 addi r4,r4,16805
80D50534: 7CE40016 mulhwu r7,r4,r0
80D50538: 91030050 stw r8,80(r3)
80D5053C: 3C8080B3 lis r4,-32589
80D50540: 91030054 stw r8,84(r3)
80D50544: 38C00001 li r6,1
80D50548: 3884B044 subi r4,r4,20412
80D5054C: 7CA70050 sub r5,r0,r7
80D50550: 38000005 li r0,5
80D50554: 54A5F87E rlwinm r5,r5,31,1,31

and this time, that's all there is. if nothing's there, then my only other guess would be to let the breakpoint hit as the enemy leaves the screen.

No, I said "run" because I meant "run"

If I would have meant "step" I probably would have said "step" ... Just a guess.

80D504FC is still the same memory-clearing loop.

I don't know how to make this any more clear?

_________________
I have to return some video tapes.

Feed me a stray cat.

look, hitting run does nothing. hitting step gives me this. if i hit step AFTER hitting run, then i get nothing. are we using the same gcnrdgui here? or are you refering to a command propt from gcnrd?

or, there is this. if i hit "set breakpoint" right after the first hits, i do get a second set, is that what you mean? if it is, then shoot. other than that, all i know to do is try any of these ideas while making the enemy go offscreen.

GCnrdGUI should have an "ignore address" feature somewhere for breakpoints. Use that. GUI doesn't support remembering breakpoints, otherwise.

_________________
I have to return some video tapes.

Feed me a stray cat.

I'm not sure what should be called "standard PowerPC", but I've seen these +/- explanations in some docs somewhat linked to PowerPC :


@bowsersenemy : Also, indeed I believe that by saying "hit the run button" Parasyte meant "click the 'set breakpoint' button again". The goal is to set the breakpoint on write over and over, until it breaks on an instruction that is not the memory clear routine (ie. not on 0x80D504FC). And as Parasyte hinted, use the "Do not break on..." box to auto-skip an unwanted address. To achieve that write '80D504FC' under the 'Do not break on...' text, then click on the 'Add to list' button, then set the breakpoint on write. The game might slow down, but hopefuly it'll break on a "new" address at some point. If the slow down is too horrible (if you don't get any new break on write after some minutes), there could be a trick : replace the instruction that writes (at 0x80D504FC) with a nop (use the disassembler window for that). But it could/will lead to bad side effects/crashes (better remove the gc memcard before doing this, just in case).

thanks kenobi. i'll give it a shot and let you know what happens. oh, and i DO know that hitting set breakpoint a second time does show a second set of adresses, so i'll post that too in a few minutes.

OK. here we go.

80D49C98: 98030000 stb r0,0(r3)
80D49C9C: 881C0001 lbz r0,1(r28)
80D49CA0: 98030001 stb r0,1(r3)
80D49CA4: 881C0002 lbz r0,2(r28)
80D49CA8: 98030002 stb r0,2(r3)
80D49CAC: A81C0004 lha r0,4(r28)
80D49CB0: B0030008 sth r0,8(r3)
80D49CB4: A81C0006 lha r0,6(r28)
80D49CB8: B003000C sth r0,12(r3)
80D49CBC: 93830010 stw r28,16(r3)
80D49CC0: 881C0003 lbz r0,3(r28)
80D49CC4: 5400073E rlwinm r0,r0,0,28,31
80D49CC8: 2C000002 cmpwi r0,2
80D49CCC: 41810180 bgt- 0x80d49e4c
80D49CD0: 88BE000C lbz r5,12(r30)
80D49CD4: 3C8080D9 lis r4,-32551
80D49CD8: 881E000D lbz r0,13(r30)
80D49CDC: 38842884 addi r4,r4,10372
80D49CE0: 7CA50774 extsb r5,r5
80D49CE4: 88DC0001 lbz r6,1(r28)
80D49CE8: 54A51838 rlwinm r5,r5,3,0,28
80D49CEC: 7C000774 extsb r0,r0
80D49CF0: 7C842A14 add r4,r4,r5
80D49CF4: 38A00000 li r5,0
80D49CF8: 5400103A rlwinm r0,r0,2,0,29
80D49CFC: 7C84002E lwzx r4,r4,r0
80D49D00: 54A7063E rlwinm r7,r5,0,24,31
80D49D04: 7C0438AE lbzx r0,r4,r7
80D49D08: 280000FF cmplwi r0,255
80D49D0C: 41820014 beq- 0x80d49d20
80D49D10: 7C003040 cmplw r0,r6
80D49D14: 4182000C beq- 0x80d49d20
80D49D18: 38A50001 addi r5,r5,1
80D49D1C: 4BFFFFE4 b 0x80d49d00
80D49D20: 3CA080B2 lis r5,-32590
80D49D24: 54E0103A rlwinm r0,r7,2,0,29
80D49D28: 80C5E588 lwz r6,-6776(r5)
80D49D2C: 3C8080D9 lis r4,-32551
80D49D30: 38A42884 addi r5,r4,10372
80D49D34: 7C06002E lwzx r0,r6,r0
80D49D38: 38800000 li r4,0
80D49D3C: 5400CC3E rlwinm r0,r0,25,16,31
80D49D40: B0030040 sth r0,64(r3)
80D49D44: 88DE000C lbz r6,12(r30)
80D49D48: 881E000D lbz r0,13(r30)
80D49D4C: 7CC60774 extsb r6,r6
80D49D50: 88FC0001 lbz r7,1(r28)
80D49D54: 54C61838 rlwinm r6,r6,3,0,28
80D49D58: 7C000774 extsb r0,r0

this load of crap brought to you by the second press of the breakpoint button. please note that when i hit the end of the list, gcnrdgui kept looping back to 80D49D00.

thanks again guys.

I haven't used GCNrd in a very long time, so I'm getting kind of rusty. But now I remember that the console is single-threaded, so it only supports waiting for the breakpoint to hit, or canceling. Nothing else can be done while waiting. And after each hit, the breakpoint is immediately removed, and the console goes back to its normal command mode. So yeah, using the "run" command repeatedly in command mode would not do much. That said, setting the breakpoint again when in command mode will do what I've been trying to explain; It runs the game and waits for another break hit.

GCNrd only supports a single hardware breakpoint at a time. I've been spoiling myself with SRDP recently, which will require support for multiple breakpoints, asynchronous packet transmission (which itself will require multiple threads in a client GUI, if it intends to wait for breakpoints while sending pings and receiving a response back!) The multiple breakpoint support implies software breakpoints, since most CPUs with breakpoint facilities support only a very limited number of hardware breakpoints. (PPC supports only one.) And ultimately, lending itself to a multi-threaded, multi-breakpoint client means SRDP needs to keep breakpoints active until they are explicitly disabled or deleted. (Kind of like GDB, FCEUX, etc.) In this way, hitting a "run button" really would do what I expect it should do.

Anyway, sorry for the confusion. Also, thanks to Zeld and Kenobi for pointing out the PPC branch prediction bit. That one slipped by me.

_________________
I have to return some video tapes.

Feed me a stray cat.

bowsersenemy: What were the register contents when the breakpoint hit? Having the disassembly listing is only part of the puzzle. (Admittedly, having the register contents is also only a small part, but at least it will lead to the next clue...)

What you're looking for is probably the pointer in r28. I say this without definitely proof, but I assume, based on the instructions directly following, that this piece of code is copying data from the pointer in r28 to the pointer in r3 (which just so happens to be the same address you placed the breakpoint on).

_________________
I have to return some video tapes.

Feed me a stray cat.

ok. here's the register. i don't think it changes as i go through the list, and i hope that it doesn't.

[General Purpose Registers]
r0 : 00000041 sp : 801AE860 rtoc: 801A6340 r3 : 80B34880
r4 : 80B2E384 r5 : FFFFFFFE r6 : 00000001 r7 : 00000000
r8 : 00000000 r9 : 000000B0 r10 : 00000020 r11 : 00000200
r12 : 80D504B8 r13 : 801A5BC0 r14 : 00000000 r15 : 00000000
r16 : 00000000 r17 : 00000000 r18 : 00000000 r19 : 00000000
r20 : 00000842 r21 : 00000862 r22 : 000000B0 r23 : 00000200
r24 : 00000200 r25 : 000000B0 r26 : 00000862 r27 : 000006C2
r28 : 80D979AC r29 : 00000001 r30 : 80B36924 r31 : 80A1DF78

cr : 48824088 lr : 80D49C8C ctr: 00000000 xer: 00000000


[Floating Point Registers, Approximate Real Numbers]
f00: 58 f01: 4.5036e+015 f02: 2.18965 f03: 0.0909088
f04: 0.333333 f05: 0.142857 f06: 0.0909088 f07: 0.0666107
f08: 0.0497688 f09: 0.015748 f10: 6.15042e-008 f11: 0.000248
f12: 0.003125 f13: 2560 f14: 0 f15: 0
f16: 0 f17: 0 f18: 0 f19: 0
f20: 0 f21: 0 f22: 0 f23: 0
f24: 0 f25: 0 f26: 0 f27: 0
f28: 0 f29: 0 f30: 0 f31: 0

[Floating Point Registers, Single Precision]
f00: 42680000 f01: 59800000 f02: 400C2348 f03: 3DBA2E68
f04: 3EAAAAA8 f05: 3E124920 f06: 3DBA2E68 f07: 3D886B30
f08: 3D4BDA58 f09: 3C810200 f10: 33841450 f11: 39820610
f12: 3B4CCCC8 f13: 45200000 f14: 00000000 f15: 00000000
f16: 00000000 f17: 00000000 f18: 00000000 f19: 00000000
f20: 00000000 f21: 00000000 f22: 00000000 f23: 00000000
f24: 00000000 f25: 00000000 f26: 00000000 f27: 00000000
f28: 00000000 f29: 00000000 f30: 00000000 f31: 00000000

[Floating Point Registers, Double Precision]
f00: 404D0000-00000000 f01: 43300000-80000000
f02: 40018469-E0000000 f03: 3FB745CD-D6E4A738
f04: 3FD55555-5555550D f05: 3FC24924-920083FF
f06: 3FB745CD-C54C206E f07: 3FB10D66-ADF5D5C9
f08: 3FA97B4B-2D10B319 f09: 3F902040-81020408
f10: 3E70828A-237153C9 f11: 3F3040C2-050C1C40
f12: 3F699999-A0000000 f13: 40A40000-00000000
f14: 00000000-00000000 f15: 00000000-00000000
f16: 00000000-00000000 f17: 00000000-00000000
f18: 00000000-00000000 f19: 00000000-00000000
f20: 00000000-00000000 f21: 00000000-00000000
f22: 00000000-00000000 f23: 00000000-00000000
f24: 00000000-00000000 f25: 00000000-00000000
f26: 00000000-00000000 f27: 00000000-00000000
f28: 00000000-00000000 f29: 00000000-00000000
f30: 00000000-00000000 f31: 00000000-00000000

fpscr: FFF80000


srr0: 80D49C98 srr1: 00008032

gqr00: 00000000 gqr01: 00000000 gqr02: 00040004 gqr03: 00050005
gqr04: 00060006 gqr05: 00070007 gqr06: 00000000 gqr07: 00000000

psf00: 42680000-42680000 psf01: 59800004-00000000
psf02: 400C234F-400C234F psf03: 3DBA2E6E-43B40000
psf04: 3EAAAAAA-BC088889 psf05: 3E124924-380BD096
psf06: 3DBA2E6E-46EA6000 psf07: 3D886B35-00000000
psf08: 3D4BDA59-3BCCCCCD psf09: 3C810204-40000000
psf10: 33841451-3F800000 psf11: 39820610-BB888889
psf12: 3B4CCCCD-3B4CCCCD psf13: 45200000-45200000
psf14: 00000000-00000000 psf15: 00000000-00000000
psf16: 00000000-00000000 psf17: 00000000-00000000
psf18: 00000000-00000000 psf19: 00000000-00000000
psf20: 00000000-00000000 psf21: 00000000-00000000
psf22: 00000000-00000000 psf23: 00000000-00000000
psf24: 00000000-00000000 psf25: 00000000-00000000
psf26: 00000000-00000000 psf27: 00000000-00000000
psf28: 00000000-00000000 psf29: 00000000-00000000
psf30: 00000000-43800000 psf31: 00000000-00000000

never mind guys! that's it! ya nailed it! i succsesfuly replaced a junk bot with a mettaur! i'll now study the data so i can use this to replace bosses and the like! again guys, thanks tons! now i should know what to look for when working with X4 and X5! now i should finaly be able to give everyone the X vs Iris fight they've been wanting!