Posts for jlun2

Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
glitch less
Its entertainment value has been increased substantially (in my opinion) by using the new Duel Escape Glitch to skip the tutorial duel. It chooses not to use that glitch for any future duels, as a speed/entertainment trade-off.
🤔 That sounds like some abuse of the term glitchless more so than most runs that use the term lol Also, if this console verifies, would you try to get a console verifiable run of the glitched version too? For next year, are there anything in game that works as 100% completion? Maybe try Duel Escape Glitch 100% if so and see what happens.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
You made a 4 hour TAS for this 1 event; that's quite some dedication. Reading the submission notes, the game is also quite ambitious for a unlicensed bootleg; usually I would've expected some hack of another game with Digimon names added to it, not an entire Pokemon-like RPG with 171 monsters, each with their own different stats and moves. Looking at the run at a glance, the sudden battle transitions was rather disorienting.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
I have no idea if it's intended or not, but the lua console in BizHawk 2.4 (and interim) is now restricted to 25 lines in a script. For example: Download test.lua
Language: lua

console.clear() for i = 1,50 do console.log(i) end console.log("Hello World")
This stops at 25, and never prints out "Hello World" now.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
About your savestate, as soon as I load it in 2.4, it goes into battle, then immediately resets. Which BizHawk version did you use, and if it's also 2.4 can you please upload a new one? Edit: In 2.3, got the message: Core rejected the state. This appeared to be the first battle, so I can probably go try going there. I can see what you meant by the help menu now; managed to get NPC to miss as well; nice find! 0x274A in IWRAM is damage dealt. A tracelog of that reveals 0x5574, 0x5580, 0x5584 is changed before 0x274A is determined. Freezing 0x5580 appeared to make it constant; eg. freezing 0x5580 to 33564852 made the book always miss for me so far. Maybe the RNG? It appears to have an effect on other battles as well. That value also changed during the title screen because of the wand selector's sparkles when moving through options. That probably explained why the RNG advanced in the help screen; the wand's sparkle effect is random.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Are you sure? From what I grasped in jlun2's post, the request is to be able to modify the date setting during the movie.
Correct. I need to get to a certain stage in game, save and reset to the DS date change screen, change the time from ~1:00 AM to 2:00 AM, then start the game again. The items require for 100% only appear if the DS clock is at 0:XX, 1:XX, 2:XX, 3:XX where XX is any minute. I reach that point in about 50 minutes in or so, and while the game needs to be done twice to get all items, that still far below the 3 hour wit from 0:XX to 3:00ish.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Using the latest interim build, it seems the addresses are at a different location for GBHawk than Gamebetta. For instance, in Wario Land 2 GB, Gamebetta has NPC data at 0x1000 in WRAM. In GBHawk, it's now at 0x2000. This also appeared to be the case for tile info, and thus the script won't work. Also while attempting to open hex viewer after RAM Search/Watch I get this error: https://pastebin.com/HVjq75Gg Edit: The tile data is also different, despite being located in ROM. Not sure what is making it different. Here's a screenshot of what I meant by the script isn't working: This is the code: https://github.com/lunjesse/BizHawk-display-scripts/blob/master/WL2Overlay.lua
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
EZGames69 wrote:
One thing that I am really curious about is how BIOS will work for movies. As in what starts of movies are going to look like. Will they be something like this: https://youtu.be/mWnIkIYGWjA Or something like this: https://youtu.be/yRTtXG4jsI8
TIL of 2nd option. How did you do that? Also I hope there's a way to do 1st one; I need to change system clock in Nanashi No Game Me, or else the run would need to wait an hour doing nothing for a certain item to appear in the stage.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Nice work on the Pokemon TAS. Will you be attempting "gltichless" Silver/Gold in the future?
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
I resynced the current run up to the last boss: https://cdn.discordapp.com/attachments/280808167993245707/690749647098216458/Wario_Land_II_Resync.bk2 Here's a 819 frame improvement to the above due to a OoB exit in "Storm the castle: https://cdn.discordapp.com/attachments/280808167993245707/690857660412592158/Wario_Land_II_Resync.bk2 This is the exit used: I have no idea if it's console-able however. The TAS is also probably improveable, due to kinda forgetting some of the movement tricks. If anyone wants to help, please do. Edit: Now it improves even more; OoB used in 2-2, 2-3, 2-5. Stage 8; GBC OoB exit: https://cdn.discordapp.com/attachments/280808167993245707/691314394251919430/Wario_Land_II_8.bk2 Here's the same door, but causes a reset: https://cdn.discordapp.com/attachments/280808167993245707/691316866295267338/Wario_Land_II_8_reset.bk2 Not sure what made it work. Couldn't get it to work in GB so far. The upper OoB region is inaccessible; there's an entire row of warp tiles that causes the game to reset.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Not sure where to post this, but for lua "memory.getmemorydomainlist()", Gamebatte returns the following: "0": "WRAM" "1": "ROM" "2": "VRAM" "3": "CartRAM" "4": "OAM" "5": "HRAM" "6": "System Bus" While GBHawk returns this: "0": "Main RAM" "1": "Zero Page RAM" "2": "System Bus" "3": "ROM" "4": "VRAM" "5": "Cart RAM" Can this please be made consistent (numbering + naming)? It broke my lua script for Wario Land 2 due to "Wram" missing, and "Cart Ram" having a different spacing. I have no idea which one has the right name, but making both cores use the same name and index would be really helpful.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
TheKDX7 wrote:
Lots of very interesting things and funny to see how broken this game can be. Are you working on a 100% run or do you planning to do this on the futur ? And would it be better to run it on GBC or GB for faster execution ?
GBC has a different OoB layout; for instance the glitched area in 2-2 in the current TAS still works in GB in BizHawk, but doesn't in GBC. However, certain tricks that do work in GBC (such as the one mentioned in the post above with bonus room leading to final boss room, and similar tricks in the 2 stages before it) can't seem to be done in GB (yet), or is slower. So might need to check every slow stage to see what is faster. Not helped by the fact it seems the OoB layout sometimes changes in the same room, in the same game version. I just edited the post from before, but it seems in GB Factory Final, the OoB can be either extremely easy to reach, or mostly out of reach like in GBC, and I have no idea what caused the change. Unrelated, but messing around while not recording changed all the bees into skull in 2-2: I can't seem to replicate it however.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
I was recently asked about this game in terms of "All Stages"/"100%" routing. Some discoveries as follows: 1. Secret doors in final boss stages count as boss defeated. Normal exits count as next level. 2. Stage ID addresses are 0x1510 (GBC) or 0x0510 (GB). 3. With respect to the above, this means if you can find a secret exit in the robot spear man stage (ID 29), you can trigger the credits. Beating it via normal exit OoB advances to ID 30 (Chapter 2 basement) So with that said, from the submission text:
From what I remember, using a goal door in this level warps you to Chapter 1, Story 2's level or something. TODO: Is this correct?
I can now say, sorry, me and mugg remembered it wrong. 4. If you tried the trick at the factory final stage (ID 49), you can advance to the Secret stage. If you managed to beat the secret stage, this occurs: Then, you're stuck forever. However, if you tried it AFTER beating the game once on the stage select, this happens instead: 5. Factory Final GBC OoB is mostly unbreakable blocks below the stage, and unreachable glitch blocks at the top. Even attempting to use the hammer NPC to get the bouncy status fails, since there's a ceiling of unbreakable blocks. In GB, the glitched blocks are much lower, thus a secret exit (and trigger credits) can easily be reached 6. The same situation almost occurred with ID 29, but luckily there's an NPC that allowed you to reach an opening. The closest normal exit I found in GBC was: https://cdn.discordapp.com/attachments/688394402472788033/689339903649120267/Wario_Land_II_USA_Europe_exit.bk2 And for 100%: https://cdn.discordapp.com/attachments/688394402472788033/689375423548882984/Wario_Land_II_USA_Europe_treasure__boss.bk2 This input file finds an OoB bonus door, then immediately goes to the boss room in the first room. While that is normally slower than using exit door, since getting the level select as fast as possible was apparently quicker to skip cutscenes, this may help. 7. I managed to find a workable OoB exit in the latest BizHawk version in GB for Chapter 2 To The Castle (ID 25): In GBC, this completely breaks apart, since the red blocks vanish shortly after touching them from the sides or above. 8. For both "Defeat the giant spear man" and "Go through the grand hall" (IDs 27, 28), I found OoB bonus rooms right near a exit in GBC. Need to test GB as well. 9. The original script only works for GBC. After messing around, it appears the layout is similar, but with different addresses and IDs. So I changed it (among other things) to include GB support: Download WL2Overlay.lua
Language: lua

local x, y, camx, camy, tref, ttype, ttypehigh, tcolor, warpdest local address = { gbc = { x = 0x153c, y = 0x153a, camx = 0x660, camy = 0x65f, tref = 0x704, warpdest = 0xa1, stageid = 0x1510 }, gb = { x = 0x053c, y = 0x053a, camx = 0x1652, camy = 0x1651, tref = 0x16EB, stageid = 0x0510 } } local tiles = { gbc = { [0x47bc] = "Switch platform", [0x49cb] = "Slideable slope (left)", --Press down to roll [0x495e] = "Slideable slope (right)", --Press down to roll [0x4a10] = "Platform", [0x4a33] = "Platform (NPC)", --NPCs can walk on them, you cannot [0x4a70] = "Breakable", --(ttype>0x4a70) and (ttype<0x4d9f) or (ttype==0x4a10) [0x4d9f] = "Breakable", [0x4da0] = "Breakable (NPC)", --throw npcs to destroy them [0x4e8a] = "Water", [0x4fbe] = "Minigame", --varies by stage [0x4ecd] = "Minigame", --varies by stage [0x4edb] = "Door", [0x4ef6] = "Boss door", --varies by stage [0x4f3a] = "Exit", [0x4f60] = "Secret exit", [0x4ffb] = "Switch" }, gb = { [0x47bc] = "Switch platform", [0x49cb] = "Slideable slope (left)", [0x495e] = "Slideable slope (right)", [0x4a10] = "Platform", [0x4a33] = "Platform (NPC)", --NPCs can walk on them, you cannot [0x4a70] = "Breakable", --(ttype>0x4a70) and (ttype<0x4d9f) or (ttype==0x4a10) [0x4d9f] = "Breakable", [0x4d95] = "Breakable (NPC)", --throw npcs to destroy them [0x4d99] = "Breakable (NPC)", --throw npcs to destroy them [0x4e83] = "Water", [0x4fb7] = "Minigame", [0x4ed4] = "Door", [0x4eef] = "Boss door", [0x4f33] = "Exit", [0x4f59] = "Secret exit", [0x4cef] = "Breakable (Invisible)", [0x4ff4] = "Switch", [0x50fb] = "Water" } } function bitswap (swappy) nib2 = bit.band(swappy,0xF) return (nib2*0x10+bit.rshift(swappy,4)) end function gettile (wx,wy) hix = bit.rshift(bit.band(0xFF00,wx),8) hiy = bit.rshift(bit.band(0xFF00,wy),8) lox = bit.band(0xFF,wx) loy = bit.band(0xFF,wy) ccea = bit.band(bitswap(bit.band(hiy,0x0F))+bit.band(bitswap(loy),0x0F)+0xA0,0xFF) cceb = bitswap(bit.band(hix,0x0F))+bit.band(bitswap(lox),0x0F) rawloc = ccea*0x100+cceb -- not the final location!!! can vary if above 0xa000 return (rawloc) -- return (bit.band(0x2000 + 0x100*math.floor(wy/16+1) + math.floor(wx/16),0x7FFF)) works for most space, not glitch rooms end function tileid (ntile) if (ntile >= 0xa000) then memory.usememorydomain('CartRAM') -- where normal level data is realloc = ntile - 0x8000 else memory.usememorydomain('System Bus') realloc = ntile end tlookup = memory.readbyte(realloc) memory.usememorydomain('ROM') local address = 0x7c002+tref+bit.band(tlookup*2,0xFF) local result = memory.read_u16_le(address) -- -- if result == 0x4f60 then -- if result == 0x4f3a then -- -- memory.write_u16_le(address,0x4f3a) -- memory.write_u16_le(address,0x4f60) -- end return result end local game_address = address.gbc local game_tiles = tiles.gbc while true do x = mainmemory.read_u16_be(game_address.x) -- position in level y = mainmemory.read_u16_be(game_address.y) camx = mainmemory.readbyte(game_address.camx) -- position relative to upper left camera edge camy = mainmemory.readbyte(game_address.camy) tref = mainmemory.read_u16_be(game_address.tref) -- warpdest = mainmemory.readbyte(game_address.warpdest) -- sector coordinates for a warp (??) -- 160x144 -- gui.drawText(3,130,string.format("%X",bit.rshift(warpdest,4))..' '..string.format("%X",bit.band(warpdest,0xF))) for i = -1,17,1 do for j = -1,17,1 do ttype = tileid(gettile(x-camx+15+16*i,y-camy+15+16*j)) ttypehigh = bit.band(ttype,0xFF00) if (ttype~=0x47ab) and (ttype~=0x49a7) and not ((ttype>=0x4e29) and (ttype<=0x4e39)) and not ((ttype>=0x5400) and (ttype<=0x54ff)) then --if (ttype~=0x47ab) and (ttype~=0x4cf3) and (ttype~=0x4cef) and (ttype~=0x4d03) and (ttype~=0x4cff) and (ttype~=0x4e29) and (ttype~=0x4e35) and (ttype~=0x4f3a) then -- if (ttype==0x4ecd) or (ttype==0x4edb) or (ttype==0x4f3a) or (ttype==0x4f60) then -- door, minigame, exit -- tcolor = 'GREEN' if game_tiles[ttype] ~= nil then if (game_tiles[ttype]=="Door") then --Regular door tcolor = 'BLACK' elseif (game_tiles[ttype]=="Boss door") then --Boss door tcolor = 'GREEN' elseif (game_tiles[ttype]=="Minigame") then -- Minigame tcolor = 'PURPLE' elseif (game_tiles[ttype]=="Exit") then -- exit tcolor = 'CYAN' elseif (game_tiles[ttype]=="Secret exit") then --secret exit tcolor = 'GOLD' elseif (game_tiles[ttype]=="Water") then -- water tcolor = 'BLUE' elseif (game_tiles[ttype]=="Platform") then -- platform tcolor = 'WHITE' elseif (game_tiles[ttype]=="Platform (NPC)") then -- platform tcolor = 'GREY' elseif (game_tiles[ttype]=="Slideable slope (left)") or (game_tiles[ttype]=="Slideable slope (right)") then -- platform tcolor = 'BROWN' elseif (ttype>0x4a70) and (ttype<0x4d9f) or (ttype==0x4a10) then -- breakable tcolor = 'PINK' elseif (game_tiles[ttype]=="Breakable (NPC)") then tcolor = "DEEPPINK" else -- solid or unknown tcolor = 'RED' end end gui.drawBox((camx-x)%16-8+16*i,(camy-y)%16-16+16*j,(camx-x)%16+7+16*i,(camy-y)%16+16*j-1,tcolor) end end end gui.drawText(3,3,string.format("%X",gettile(x,y-32))..' '..string.format("%X",tileid(gettile(x,y-32)))) gui.drawText(3,12,string.format("%X",gettile(x,y-16))..' '..string.format("%X",tileid(gettile(x,y-16)))) gui.drawText(3,21,string.format("%X",gettile(x,y))..' '..string.format("%X",tileid(gettile(x,y))),"BLACK","BLACK") gui.drawText(4,22,string.format("%X",gettile(x,y))..' '..string.format("%X",tileid(gettile(x,y)))) gui.drawText(3,31,"X:"..x.." Y:"..y,"BLACK","BLACK") gui.drawText(4,32,"X:"..x.." Y:"..y,"WHITE") emu.frameadvance() end
Original script: http://tasvideos.org/userfiles/info/16322306121342073 Thanks very much for Slamo for the initial version! 10. For floating OoB doors, you need swimming status to enter them 11. Last night, when exploring Factory Final (ID 49) on GB, the glitched area was solidish, and easily reachable: Attempting to record it from start of stage however, changed it into this: Which made the glitched area much harder to reach. I have no idea what changed the layout, since the 1st attempt was from a savestate, not start of stage.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Note: Replied to the above on discord, so if any future person thinks I was ignoring them, oops! Thanks again! For memory addresses that uses "System Bus" memory domain in GB, how does one convert them to SGB, given it doesn't seem to have "System Bus"? GB memory.getmemorydomainlist():
"0": "WRAM"
"1": "ROM"
"2": "VRAM"
"3": "CartRAM"
"4": "OAM"
"5": "HRAM"
"6": "System Bus"
SGB memory.getmemorydomainlist():
"0": "WRAM"
"1": "ROM"
"2": "VRAM"
"3": "CartRAM"
"4": "OAM"
"5": "HRAM"
"6": "IO"
"7": "BOOTROM"
"8": "BGP"
"9": "OBP"
I'm trying to convert a script for Wario Land to work on GB, SGB, GBC, and no idea how to make it work for System Bus.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Thanks. I found another bug though. If 2 games, for GB and GBC share the same name, it messes up with savestates. For instance: 1. Get 2 ROMs, Wario Land II (USA, Europe).gb and Wario Land II (USA, Europe).gbc 2. Open up BizHawk 3. Load Wario Land II (USA, Europe).gbc 4. Make a savestate using the hotkeys for it. This should make a file called Wario Land II (USA, Europe).Gambatte.QuickSave1.State 5. Load Wario Land II (USA, Europe).gb 6. Use hotkey to load the 1st savestate. This will give an error, and crash BizHawk:
System.InvalidOperationException: Savestate buffer size mismatch!
   at BizHawk.Emulation.Cores.Nintendo.Gameboy.Gameboy.LoadStateBinary(BinaryReader reader)
   at BizHawk.Client.Common.BinaryStateLoader.GetLump(BinaryStateLump lump, Boolean abort, Action`2 callback)
   at BizHawk.Client.Common.BinaryStateLoader.GetCoreState(Action`1 callbackBinary, Action`1 callbackText)
   at BizHawk.Client.Common.SavestateManager.LoadStateFile(String path, String name)
   at BizHawk.Client.EmuHawk.MainForm.LoadState(String path, String userFriendlyStateName, Boolean fromLua, Boolean suppressOSD)
   at BizHawk.Client.EmuHawk.MainForm.LoadQuickSave(String quickSlotName, Boolean fromLua, Boolean suppressOSD)
   at BizHawk.Client.EmuHawk.MainForm.CheckHotkey(String trigger)
   at BizHawk.Client.EmuHawk.MainForm.<ProcessInput>b__130_1(Boolean current, String trigger)
   at System.Linq.Enumerable.Aggregate[TSource,TAccumulate](IEnumerable`1 source, TAccumulate seed, Func`3 func)
   at BizHawk.Client.EmuHawk.MainForm.ProcessInput()
   at BizHawk.Client.EmuHawk.MainForm.ProgramRunLoop()
   at BizHawk.Client.EmuHawk.Program.SubMain(String[] args)
7. Optionally, make a savestate (different than the first one; savestate 2 works) with Wario Land II (USA, Europe).gb. Note the file name (Wario Land II (USA, Europe).Gambatte.QuickSave2.State) 8. Go to the file explorer and rename Wario Land II (USA, Europe).gb to something else like Wario Land II (USA, Europe) gb.gb 9. Make savestate 1 using hotkeys. This still overwrites the GBC savestate 1 instead of making a new state, despite the file name change. ie, it still saves as Wario Land II (USA, Europe).Gambatte.QuickSave1.State Please help?
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Did GBC support break for anyone else in the latest interim build (https://ci.appveyor.com/project/zeromus/bizhawk-udexo/build/artifacts, from here)? Attempting to open a gbc rom is giving me this error: Other console games like GBA seems fine however.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Used the latest interim build: 1. Open up TAStudios and set save interval to 0 under Config > Autosave 2. Make a change anywhere (set autosave interval to 0 first) 3. Notice the star at the top. This means changes have not been saved. Verify by attempting to exit TAStudios. It will give a warning asking to save. 4. Edit 1 frame somewhere else and add an input. 5. Click on the exact same input to remove it. (Don't press Undo) 6. TAStudios now thinks you saved, even though you haven't. This means if you exit it, it will not give a box telling you to save. You can verify this by exiting TAStudios, and attempting to open the tasproj again. The change you made will not be there.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Trying to investigate the glitch in the gif gave something: 1. Under normal circumstances, the jump status is set when jumping off platforms such as the ground floor balcony at the very first room. 2. If you used cheats to increase your speed, this glitch can also occur, but the address for it is set in a different instruction. 3. This glitch is simply walking upright at the corner of a stairs, yet I can't seem to replicate it on other stairways. I'll assign the 3 cases as A. Glitch B. Cheats C. Jump For A, the value 1 is set at the following trace log line: 0800DB11: 00007008 STRB r0, [r1] For B, the value is set at: 0800DA55: 00007018 STRB r0, [r3] For C, the value is set at: 08004FD5: 00007408 STRB r0, [r1, #16] Curiously, all 3 cases don't share the same code: All 3 cases executes ```08049A7B: 00004708 BX r1 0800D94B: 00002001 MOV r0, #1 ``` But it diverges later at ```0800D967: 0000BC02 POP {r1} 0800D969: 00004708 BX r1``` This is the block segment before the divergence:
08049A77:  0000BC30  POP     {r4,r5}
08049A79:  0000BC02  POP     {r1}
08049A7B:  00004708  BX      r1

0800D94B:  00002001  MOV     r0, #1
0800D94D:  0000E005  B       #+10
0800D95B:  0000B023  ADD     SP, SP, #140
0800D95D:  0000BC38  POP     {r3-r5}
0800D95F:  00004698  MOV     r8, r3
0800D961:  000046A1  MOV     r9, r4
0800D963:  000046AA  MOV     r10, r5
0800D965:  0000BCF0  POP     {r4-r7}
0800D967:  0000BC02  POP     {r1}
0800D969:  00004708  BX      r1  
Case A becomes:
0800DB05:  00000600  LSL     r0, r0, #24
0800DB07:  00002800  CMP     r0, #0
0800DB09:  0000D100  BNE     #+0
0800DB0D:  00002001  MOV     r0, #1
0800DB0F:  00004651  MOV     r1, r10
Glitch here
0800DB11:  00007008  STRB    r0, [r1]
Case B becomes:
0800DA4B:  00000600  LSL     r0, r0, #24
0800DA4D:  00002800  CMP     r0, #0
0800DA4F:  0000D0B6  BEQ     #+-148
0800DA51:  00002001  MOV     r0, #1
0800DA53:  00004653  MOV     r3, r10
Glitch here
0800DA55:  00007018  STRB    r0, [r3]
Case C becomes:
08004F3D:  00000600  LSL     r0, r0, #24
08004F3F:  00002800  CMP     r0, #0
08004F41:  0000D049  BEQ     #+146
08004F43:  00006970  LDR     r0, [r6, #20]
08004F45:  000069B1  LDR     r1, [r6, #24]
08004F47:  0000F030  
08004F49:  0000F8B4
3000 more lines later
0800989F:  0000BCF0  POP     {r4-r7}
080098A1:  0000BC01  POP     {r0}
080098A3:  00004700  BX      r0
08004FD1:  00002001  MOV     r0, #1
08004FD3:  00009909  LDR     r1, [SP, #36]
Set value here
08004FD5:  00007408  STRB    r0, [r1, #16]
Need to investigate what's the common thing that calls all 3, and how does the 1st 2 cases occur. The function that the glitch calls starts at 0800D96B: 0000B5F0 PUSH {r4-r7,LR}
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
I'm certainly interested in the doll glitch. I wonder would it help making a video about this to spread awareness, like how Wind Waker, Super Mario 64, and Paper Mario posted videos about "almost skips" that got people to try different things out (although it didn't help for SM64 even with the 1k bounty so there's that).
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Thanks. In addition to the above, it appears 0x3710 IWRAM is Spongebob's ID. For the bosses (except the first), all IWRAM. 0x383C - ID 0x3854 - X 0x3858 - Y Regarding your coordinates, I'm not sure if 0x372E is good for Y; That's half the address for 0x372C, so when I go up/down hill or jump out of bounds, the number goes crazy and jumps to some large value. Also, using the address, I realize the lowest I managed to go in terms of 0x372E is 11263 in stage 1, yet the values in the document are in the 30 and 40 thousands. How did you manage to do that? There seems to be either a large "kill zone", or a large area of flat land at this Y coordinate. If possible, can you please make an input file on how you managed to get there?
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
NoControl wrote:
So, I've managed to make my game look like this by fooling around OoB: https://media.discordapp.net/attachments/441010589163323394/534841397455355934/2019-01-15_at_22-08-31.jpg That's memory corruption, right? For a credits warp, the 030025C0 address would have to be manipulated to 3.
If you ever encounter that again, can you please post which X/Y location did you encounter that from? So far on the first stage, I've seen: * Infinite shell spot at X 65251, Y 1057279 (need to land on an OOB platform to the far left of the stage, then walk a bit to the right to X == 10, fall a bit, then move back left to get there. Jumping and moving left resets the game. * A non reset crash at X 65048 Y 1051344 (Use Patrick's pants and fly left). Edit: Input file reaching it for 2.8 BizHawk https://cdn.discordapp.com/attachments/537350250805985301/1057858832468037662/SpongeBob_SquarePants_Movie_The_USA_OoB_1-1.bk2 * Infinite shell + some wierd downward warp thing at X 58200 Y 1059770. Touching it warps you to 268446719 in Y. The X/Y addresses I used are 0x1642, 0x1702, both in IWRAM. Changing them don't change Spongebob's position though. Do you know any addresses that does? Edit: X: 0x3728, Y: 0x372C seems to work for this purpose (at least for 1st stage I tried). The number is huge in comparison though. Can make a script to fly around and see what other things are there. Download sp.lua
Language: lua

memory.usememorydomain("IWRAM") local Addresses = { display_x = 0x1642, display_y = 0x1702, game_state = 0x25C0, x = 0x3728, y = 0x372C } --function for checking an input with how many frames to delay function inputdelay(inputs, delay) local is = input.get() local start = false if inputs ~= nil and (is[tostring(inputs)] ~=nil) then --console.log(is) --debugging while (delay > 0) do emu.frameadvance() delay = delay -1 end start = true return start end return start end while true do local x = memory.read_u32_le(Addresses.x) local y = memory.read_u32_le(Addresses.y) local display_x = memory.read_u32_le(Addresses.display_x) local display_y = memory.read_u32_le(Addresses.display_y) local x_speed = 6 local y_speed = 16 if (joypad.getimmediate().R == true) then if (joypad.getimmediate().Left == true) then x = memory.read_u32_le(Addresses.x)-65536*x_speed elseif (joypad.getimmediate().Right == true) then x = memory.read_u32_le(Addresses.x)+65536*x_speed else x = memory.read_u32_le(Addresses.x) end if (joypad.getimmediate().Down == true) then y = memory.read_u32_le(Addresses.y)+65536*y_speed elseif (joypad.getimmediate().Up == true) then y = memory.read_u32_le(Addresses.y)-65536*y_speed else y = memory.read_u32_le(Addresses.y) end memory.write_u32_le(Addresses.x,x) memory.write_u32_le(Addresses.y,y) end gui.text(0,20, "X:"..display_x.." Y:"..display_y) gui.text(0,40, "State: "..memory.read_u8(Addresses.game_state)) emu.frameadvance() end
Hold R then move around to "Fly". Change x_speed/y_speed to make spongebob move around faster. Use this to explore OoB quickly Using this script, I discovered a end stage trigger at Netpune's Wrath, but I have no idea how to reach it legit. If you can somehow go OoB, there's also an end stage trigger at: * Dennis (Very far from stage, to the left) * Ice Cream Monster (Very close to stage, both sides) * Return of Dennis Can't find any at Thug Fish, Thug Tug Thug, Cyclops
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Nice work. You mentioned real time runners have a strategy for ACE; how does that work? Just box and pokemon names only, given they probably can't do frame perfect input for instructions? Also, this is probably not going to be very useful for most people (including me), but what was the payload in THUMB? I'm really curious on how you can access any RAM addresses using a limited amount of possible opcodes.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
xy2_ wrote:
I made a more comprehensive version of this post in my blog: https://xy2.dev/article/re-skgba/re-skgba.html
Nice post and visuals. If you ever make a sequel post to that, I hope you also make a rough guide on how would one determine how the RNG is actually used (eg. How is 0x3039 related to the NPC's movement pattern?) Right now, I'm just looking at thousands of lines of assembly, and have no clue how the RNG is even used after figuring how how said RNG is advanced.
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Not sure how TAS related it is, but does anyone know any method to duplicate spoils bag items? Especially blue jellies?
Experienced Forum User, Published Author, Skilled player (1710)
Joined: 9/17/2009
Posts: 4953
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
On BizHawk 2.3.2: Right now, on the VBA-next core, you're allowed to edit ROM memory region (which isn't permanent; any changes seems to be reverted on reset, which is nice for testing things). On the mgba core, the ROM region cannot be changed. Can this please be made so that on both cores, the ROM region can be poked around (and have any changes reverted on reset)? I'm using this feature to figure out what is stored in ROM, as well as how branching works. This is a problem since on vba-next, it appears for the game Monster House at least, saving seems to be broken (SRAM doesn't change on save). You can save on mgba, but not poke around ROM in that core, so I have to constantly switch cores to get further into the game before poking around ROM.