Posts for CLChambers00

1 2 3
Posted: 9/21/2017 1:46 AM
(Edited: 9/21/2017 9:21 PM)
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
This pertains to the Boss 2 skip that occurred at AGDQ 2017 during the Baster Master rrace. At the beginning of the game when the memory is initialized, address $03FB is set to #$00. Perhpas a simple hack of the rom could have this value set to 2 and this would still allow the first boss to spawn and cause the second boss not to be present since $03FB would be at value 3. Since the starting value is 2, then the amount it will increment is based upon the value 2 to the power of $0014 value. Since area 1 boss is in $0014 value zero, then 2 to the power of zero is 1, and therefore the resulting value of $03FB after Boss one is 3. This of course is assuming that the rom was hacked. 
STA $0300,X @ $03FB = #$00 ;Initializing memory, setting address to zero
Upon entering the Boss 1 room the following executes. Notable is that it loads the value of address $0014 to the A Register. When I used a Lua Script to change $0014 to a value of 1, the value of Boss 2 location, I was able to get the Boss 2 to spawn in the Boss 1 area. The value of $03FB is checked at this time. If the value is a 0, as it is supposed to be, then the Boss will spawn. If the value is 1, which it should be after the Boss fight, then the boss will not spawn. I also checked and even if this value was a 2 then the boss will still spawn. Basically here after the AND $03FB instruction it will Branch on Not Equal as seen BNE $963B. 
$961F:F0 03     BEQ $9624                                    A:00 X:0A Y:00 S:FB P:nvUbdIZC 
    $9624:20 1A 97  JSR $971A                                    A:00 X:0A Y:00 S:FB P:nvUbdIZC 
      $971A:A5 14     LDA $0014 = #$00                             A:00 X:0A Y:00 S:F9 P:nvUbdIZC 
      $971C:29 07     AND #$07                                     A:00 X:0A Y:00 S:F9 P:nvUbdIZC 
      $971E:AA        TAX                                          A:00 X:0A Y:00 S:F9 P:nvUbdIZC 
      $971F:BD 2B B6  LDA $B62B,X @ $B62B = #$01                   A:00 X:00 Y:00 S:F9 P:nvUbdIZC 
      $9722:60        RTS (from $971A) --------------------------- A:01 X:00 Y:00 S:F9 P:nvUbdIzC 
    $9627:2D FB 03  AND $03FB = #$00                             A:01 X:00 Y:00 S:FB P:nvUbdIzC 
    $962A:D0 0F     BNE $963B                                    A:00 X:00 Y:00 S:FB P:nvUbdIZC 
    $962C:A9 C0     LDA #$C0                                     A:00 X:00 Y:00 S:FB P:nvUbdIZC 
    $962E:85 51     STA $0051 = #$00                             A:C0 X:00 Y:00 S:FB P:NvUbdIzC 
    $9630:A9 08     LDA #$08                                     A:C0 X:00 Y:00 S:FB P:NvUbdIzC 
    $9632:20 8C C1  JSR $C18C                                    A:08 X:00 Y:00 S:FB P:nvUbdIzC
At the beginning of the Boss 1 fight when the boss begins to load, address 03FD is set to the value 255 and then decrements to 0, at which time the boss begins to move. Upon the death of the boss address 03FD increments up to 128 from zero. Once 03FD reaches 128 (#$80)then we see the following execute when the Comparision is made. It is at this time that the addition to $03FB will be 2 to the power of the value of $0014, the area locator. If at any time that $0014 is changed via Lua Script then the game starts to glitch between where you are and where you are telling the game where you are. I have observed some funny things as a result of this. What this means is that I think that it is unlikely that the game was confused as to your location and therefore gave a different value in $03FB, because it thought that you were in a different $0014 location. If $0014 was anything but 0 during the boss 1 fight then you would see graphical distortions. Since the addition to $03FB only occurs after a boss is defeated it would be curious how it might occur at any other time, and if so, then how? 
    $9C2D:20 23 97  JSR $9723                                    A:2D X:2A Y:00 S:FB P:nvUbdIzc 
      $9723:A5 53     LDA $0053 = #$00                             A:2D X:2A Y:00 S:F9 P:nvUbdIzc 
      $9725:F0 10     BEQ $9737                                    A:00 X:2A Y:00 S:F9 P:nvUbdIZc 
      $9737:A5 10     LDA $0010 = #$14                             A:00 X:2A Y:00 S:F9 P:nvUbdIZc 
      $9739:4A        LSR                                          A:14 X:2A Y:00 S:F9 P:nvUbdIzc 
      $973A:B0 19     BCS $9755                                    A:0A X:2A Y:00 S:F9 P:nvUbdIzc 
      $973C:AD FD 03  LDA $03FD = #$7F                             A:0A X:2A Y:00 S:F9 P:nvUbdIzc 
      $973F:D0 0A     BNE $974B                                    A:7F X:2A Y:00 S:F9 P:nvUbdIzc 
      $974B:EE FD 03  INC $03FD = #$7F                             A:7F X:2A Y:00 S:F9 P:nvUbdIzc 
      $974E:AD FD 03  LDA $03FD = #$80                             A:7F X:2A Y:00 S:F9 P:NvUbdIzc 
      $9751:C9 80     CMP #$80                                     A:80 X:2A Y:00 S:F9 P:NvUbdIzc 
      $9753:B0 4C     BCS $97A1                                    A:80 X:2A Y:00 S:F9 P:nvUbdIZC 
      $97A1:20 C9 C0  JSR $C0C9                                    A:80 X:2A Y:00 S:F9 P:nvUbdIZC 
        $C0C9:4C 5B D0  JMP $D05B                                    A:80 X:2A Y:00 S:F7 P:nvUbdIZC 
		(...)
        $D066:60        RTS (from $C0C9) --------------------------- A:0F X:FF Y:00 S:F7 P:NvUbdIzC 
      $97A4:20 1A 97  JSR $971A                                    A:0F X:FF Y:00 S:F9 P:NvUbdIzC 
        $971A:A5 14     LDA $0014 = #$00                             A:0F X:FF Y:00 S:F7 P:NvUbdIzC 
        $971C:29 07     AND #$07                                     A:00 X:FF Y:00 S:F7 P:nvUbdIZC 
        $971E:AA        TAX                                          A:00 X:FF Y:00 S:F7 P:nvUbdIZC 
        $971F:BD 2B B6  LDA $B62B,X @ $B62B = #$01                   A:00 X:00 Y:00 S:F7 P:nvUbdIZC 
        $9722:60        RTS (from $971A) --------------------------- A:01 X:00 Y:00 S:F7 P:nvUbdIzC 
      $97A7:0D FB 03  ORA $03FB = #$00                             A:01 X:00 Y:00 S:F9 P:nvUbdIzC 
      $97AA:8D FB 03  STA $03FB = #$00                             A:01 X:00 Y:00 S:F9 P:nvUbdIzC 
      $97AD:A9 5A     LDA #$5A                                     A:01 X:00 Y:00 S:F9 P:nvUbdIzC 
      $97AF:85 46     STA $0046 = #$63                             A:5A X:00 Y:00 S:F9 P:nvUbdIzC 
      $97B1:A9 00     LDA #$00                                     A:5A X:00 Y:00 S:F9 P:nvUbdIzC 
      $97B3:20 D5 C0  JSR $C0D5                                   A:00 X:00 Y:00 S:F9 P:nvUbdIZC
Twenty nine frames after this addition to $03FB occurs the $971A sub routine runs again (twice). After the first sub routine it checks the $03FB address, and then it will branch if not equal BNE $963B, the same as when we entered the room. And the second routine is followed by a check to $03FC, seeing if you have already collected the item, and then a branch if not equal BNE $965C. 
   $961F:F0 03     BEQ $9624                                    A:00 X:0A Y:00 S:FB P:nvUbdIZC 
    $9624:20 1A 97  JSR $971A                                    A:00 X:0A Y:00 S:FB P:nvUbdIZC 
      $971A:A5 14     LDA $0014 = #$00                             A:00 X:0A Y:00 S:F9 P:nvUbdIZC 
      $971C:29 07     AND #$07                                     A:00 X:0A Y:00 S:F9 P:nvUbdIZC 
      $971E:AA        TAX                                          A:00 X:0A Y:00 S:F9 P:nvUbdIZC 
      $971F:BD 2B B6  LDA $B62B,X @ $B62B = #$01                   A:00 X:00 Y:00 S:F9 P:nvUbdIZC 
      $9722:60        RTS (from $971A) --------------------------- A:01 X:00 Y:00 S:F9 P:nvUbdIzC 
    $9627:2D FB 03  AND $03FB = #$01                             A:01 X:00 Y:00 S:FB P:nvUbdIzC 
    $962A:D0 0F     BNE $963B                                    A:01 X:00 Y:00 S:FB P:nvUbdIzC 
    $963B:20 1A 97  JSR $971A                                    A:01 X:00 Y:00 S:FB P:nvUbdIzC 
      $971A:A5 14     LDA $0014 = #$00                             A:01 X:00 Y:00 S:F9 P:nvUbdIzC 
      $971C:29 07     AND #$07                                     A:00 X:00 Y:00 S:F9 P:nvUbdIZC 
      $971E:AA        TAX                                          A:00 X:00 Y:00 S:F9 P:nvUbdIZC 
      $971F:BD 2B B6  LDA $B62B,X @ $B62B = #$01                   A:00 X:00 Y:00 S:F9 P:nvUbdIZC 
      $9722:60        RTS (from $971A) --------------------------- A:01 X:00 Y:00 S:F9 P:nvUbdIzC 
    $963E:2D FC 03  AND $03FC = #$00                             A:01 X:00 Y:00 S:FB P:nvUbdIzC 
    $9641:D0 19     BNE $965C                                    A:00 X:00 Y:00 S:FB P:nvUbdIZC 
    $9643:A5 14     LDA $0014 = #$00                             A:00 X:00 Y:00 S:FB P:nvUbdIZC 
    $9645:C9 07     CMP #$07                                     A:00 X:00 Y:00 S:FB P:nvUbdIZC 
    $9647:D0 0E     BNE $9657                                    A:00 X:00 Y:00 S:FB P:NvUbdIzc 
    $9657:A9 6A     LDA #$6A                                     A:00 X:00 Y:00 S:FB P:NvUbdIzc 
    $9659:85 46     STA $0046 = #$5A                             A:6A X:00 Y:00 S:FB P:nvUbdIzc 
    $965B:60        RTS (from $C8EC) --------------------------- A:6A X:00 Y:00 S:FB P:nvUbdIzc
While there may not be anything revelatoty here beyond the previous posts concerning the matter, but it is where I am at with it at the moment.
Chambers_N
Posted: 9/10/2017 9:22 AM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
It finally dawned on me today to ask the most basic of questions: 1) Can this work in another location in the game? and 2) Can we scroll the screen slower than 4? And I can tell you that the answer is yes to both! I found another 017E memory address manipulation point in Level 3, under the same conditions as Level 4. And then I found that if I jumped straight up and did a one frame input to the left that my speed will maintain 1 every frame until I land. This made it so that we can effectually "convert" whatever micro frames (x position low byte) we have left to address 017E, the address that tracks your progress through the stage. Enjoy! https://www.twitch.tv/videos/173708890
Chambers_N
Posted: 9/10/2017 9:22 AM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Most excellent description Link! Thanks for posting it here!
Chambers_N
Posted: 9/9/2017 4:51 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Nice! So 0101 is decimal 5 because it has incremented 5 times - hence... 0001, 0010, 0011, 0100, 0101. There are 8 bits in a byte hence 00000000. And the actual binary value of 0101 would be the same as 00000101. Each place is a 2 to the power using these values 76543210. So 0101 would be (1)x2 to the zero and (1)x2 to the 2. So that is 1 plus 4, and that is 5. :D
Chambers_N
Posted: 9/9/2017 3:52 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Thank you for your help by the way. I actually learn more through a process like this. I really do appreciate it! :D
Chambers_N
Posted: 9/9/2017 3:51 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Its just that usually people try to help me with explanations and links and despite their help I don't understand most of what is being said. Aside from feeling stupid, when I read the Bit Operation AND as you linked, I simply don't know enough to understand it. How 0101 can be decimal 5 makes no sense. What is decimal 5, how can I get the number 5 from 0101? It isn't that I don't want to learn, it just seems that I pick up only little pieces here and there over a long period of time. In some of this there must be a Level 0 that links what is being said to something that I already know otherwise I will not be able to assimilate it.
Chambers_N
Posted: 9/9/2017 3:42 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Oh, I want to learn, don't get me wrong, I am just trying to pin down the solution that I can use in trials with TASEditor and RAM Watch. Thanks for the link. I have observed that in the TAS video I sent there are many occasions when $0030 is larger than $0002, so perhaps it is only CMP under certain conditions? Or I am failing to understand the values?
Chambers_N
Posted: 9/9/2017 3:30 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Here is the fm2 file: http://tasvideos.org/userfiles/info/41626445467426292 I don't quite understand the AND in this operation nor how 0x5F can equal 0x50. However, I don't need to understand as long as I know that as long as $0030 being a higher value than $0002 means that JSR $DFB5. If so I can skim through the game to see when this would be the case, that is, under what conditions would this be. Hopefully this is not the only case in the entire game, and if so, then I consider myself fortunate to have found it. :)
Chambers_N
Posted: 9/9/2017 3:14 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
I will post it in a moment. So as long as the value of $0030 is larger than #0002 when this CMP occurs then JSR $DFB4? Though if LDA occurs with the value of 5F then how does A:50 appear on the CMP line?
Chambers_N
Posted: 9/9/2017 3:03 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
I too have found the $DFB5 Subroutine. $0030 is the Macro Frame Location. I have already observed that if this value is 0x60 or higher then the glitch occurs, and if it is 0x5F or lower then it does not. The question is why? I have not seen this occur anywhere else where $0030 is exactly 0x60. Perhaps it must scroll to the left when $0030 is 0x60 for it to occur. I can experiment by finding such a location in the game but if I can not cause this to happen with those variables then it must be something else.
Chambers_N
Posted: 9/9/2017 2:13 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Thanks to Feos I was able to compile this data. Ok, so I figured out how to get a Trace Log snap shot of a single frame of events. I gathered the data on the exact same frame, the first frame of the damage animation when you get hit at the bottom of the 2nd elevator in level 4. You can use the Find function in Chrome to see the only occurrence of 017E in Increment text. I am still working on trying to use Notepad++ of something similar to help me isolate some differences. Help is always appreciated. Link to Increment - http://wiki.donkeykonggenius.com/Silius_Analysis Link to Non-Increment - http://wiki.donkeykonggenius.com/~donkeyko/mw/index.php?title=Silius_Analysis&oldid=2435
Chambers_N
Posted: 9/9/2017 1:55 AM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Hmm, when I did the frame advance hotkey for that frame it gave me this which does not seem right. This just looks like junk and does not even contain the 017E memory address with incremented during this frame. Did I do something wrong? 
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
f3830   A:55 X:48 Y:00 S:FD  $C8B8:D0 FC     BNE $C8B6
f3830   A:55 X:48 Y:00 S:FD  $C8B6:A5 F9     LDA $00F9 = #$55
Chambers_N
Posted: 9/8/2017 11:59 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Thank you. I did read the RE link. It was helpful. I am very new to all of this. Only a year ago I learned to use the TAS Editor when I TASed NES Jaws. And only recently I began to learn how to look for memory addresses, and very minimal glances at Trace Logger and Debugger when I learned how to manipulate Who Framed Roger Rabbit. All is still very new and most of what people say goes over my head. So please be patient with me if I do not immediately understand what you are saying. I like the NLFiles idea. I will try it. Right now I am just using a saved list that I call up in the Ram Watch. I have them labeled there for now. I pull up the Trace Logger and press Start Logging and then I will advance a frame with the arrow in the TAS Editor and then Stop Logging, and it logs nothing :( I have a TAS file where I can cause the glitch to occur or not to occur so I have something I can work with but what I mean by get Trace Log data from the non working case is that once I get the Trace Logger to capture one frame then I will be fine to compare and see what the glitched variation may be doing differently. It isn't the moment of death, but a boost in an address value that makes it work later on in the level. I don't know what padding tracer output by the stack size mean. Thank you for your help!
Chambers_N
Posted: 9/8/2017 10:35 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
I read the link on NLFiles but I did not understand it :(
Chambers_N
Posted: 9/8/2017 10:31 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Doing a side by side is what I would like to do but I am not sure I would understand it if I did, but I think someone else may be more willing to tell me what to do from there if I did some of the upfront work. Now, I can collect a single frame worth of info in the Trace Logger by putting a break point on 017E when it is written to due to where I would like to understand why. By setting it one frame earlier in the TAS Editor I was able to collect this data for that one frame alone: https://forums.nesdev.com/viewtopic.php?f=2&t=16458#p204135 What I was not certain how to do was to get the same frame in another state where the increment does not occur to see what may be different beyond what I have observed, but without a break point I don't know how to only get one frame since the trace logger doesn't seem to collect data with a single frame advance, as far as I can tell. I have Notepad++ and would be able to see the differences if I can get only that one frame. I trust you understand why this extra increment of 017E occurs as I have described? Thank you for your response.
Chambers_N
Posted: 9/8/2017 3:06 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Found a way to duplicate the BadBrakes death warp. See more information at a thread I had started with this project at NESDev: https://forums.nesdev.com/viewtopic.php?f=2&t=16458&p=204149#p204049 Pertinent Information 017E Spawn Location 0177 Scroll Boundary 0030 Macro Frame Location 0031 Micro Frame Location 0032 Vertical Location 0034 Run Speed Basic Observation #1 The Run Speed value is added to Micro Frame Location each frame. The Run Speed value has an acceleration stage such that it increases, 4, 8, 12, 16, 20, 24, and then fluctuates between 22 and 26 each frame. Basic Observation #2 While your character jumps the Run Speed value will fluctuate between 21, 22, and 23, so the length of a jump will also influence the final value of the Micro Frame Location upon reaching the Scroll Boundary. Basic Observation #3 When the Scroll Boundary value changes, the code increments Spawn Location by 1. Basic Observation #4 When the Micro Frame Location value exceeds 255 it will roll over to 0 and this will increment Macro Frame Location by 1. Basic Observation #5 Every 16 counts on the Macro Frame Location value will increment the Spawn Location by 1. The Macro Frame Location value increases with scrolling to the right, and decreases with scrolling to the left. Likewise every 16 counts on the Vertical Location will also increment the Spawn Location by 1. Vertical Location increases with scrolling down and decreases with scrolling up. Interestingly I can see what is occurring in order for this glitch to work but I do not understand why it happens. And if I could understand why then perhaps that knowledge could be used to determine if it could be exploited in other areas of the game and if so then where. When you reach the top of the 2nd elevator in Stage 4, when you reach this Scroll Boundary the Macro Frame Location value seems to reach 96 every time, as the Micro Frame Location rolls over around this time. Depending upon the Run Speed values through this section of stage 4, as well as the value changes when in a jump animation, or knock backs, this may cause the Micro Frame Location value to roll over to 0 or it could go as high as 24 depending upon the Micro Frame Location value the previous frame. Such that if the Micro Frame Location value were 230 and the Run Speed was 26 then on the following frame the Micro Frame Location value will roll over to 0. Likewise, if the Micro Frame Location value was 254, then it would roll over to 24 with a Run Speed of 26 the previous frame. Therefore, when you reach the top of the 2nd elevator in Stage 4, the Micro Frame Location value could be anywhere between 0 and 25. When you reach the bottom of the 2nd elevator and get hit by an enemy bullet the screen will scroll to the left, and the Micro Frame Location value will decrease by 4 every frame while in the damage animation which scrolls the screen. Depending upon the Micro Frame Location value, such that if it were 24, then it would reach 0 after 6 frames. Interestingly enough each time the Micro Frame Location value decreases by 4 while the Macro Frame Location value is 96, the Spawn Location value will increment by 1 each frame. Therefore, for some reason, once the Macro Frame Location reaches 95, the Spawn Location will no longer increment even though your character is in the same damage animation scrolling the screen. In other words, it is related to screen scrolling but the magic number seems to be Macro Frame Location value 96. As long as this value is 96, the Spawn Location value will increment by 1 each frame, otherwise it will not. Here is a video of me demonstrating these additional increments: https://www.twitch.tv/videos/173221791 Here is a video of me demonstrating the strategy I developed in order to get the best death warp 50% of the time: https://www.twitch.tv/videos/173225643
Chambers_N
Posted: 7/27/2017 8:02 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
ok, so the emulator route is totally out, I have exhausted today's nes emulation capability but I another twitch streamer by the name threecreepio hacked the rom so that it gives you the values in the score section upon starting the game so we can try out new variations, found a new route and carved off 1.5 seconds already, will grind it some more but another route may work better
Chambers_N
Posted: 7/27/2017 2:33 AM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Mesen or bust it sounds like? No other possible ideas for possible alignment? Would you be willing to write such a Lua Script, I would be very interested to know if such a desired state exists, etc. It could assist in my overall understanding of the game.
Chambers_N
Posted: 7/26/2017 10:09 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Who Framed Roger Rabbit initializes its memory so it does not matter whether you use a Top Loader or a Front Loader, Everdrive or original cart. Therefore changing the Initial RAM State does not alter results. What I wanted to do is utilize an Emulator with TAS Editor and Ram Watch so that I can TAS out 1000's of input manipulations in order to find the best route for speedrun purposes. What I did for the world record was the following: Press and hold A, reset the console, continue to hold A, I would then press and hold start around the earliest opportunity, I would then continue to hold A and start until I see the 3x Lives screen just before you gain control of the character. Since inputs affect the RNG every single frame I will only get the RNG that I wanted if I initiated pressing start on the exact same frame. These are the addresses for each of the item spawns. 0657 Shoes 064B Rattle 0639 Detonator 0631 Whistle 0645 Baseball 0661 Will Piece #1 065D Will Piece #2 0663 Will Piece #3 065F Will Piece #4 With the input manipulation that I use on original hardware I am able to get the following results, however, since this is done on hardware I can not tell you exactly what frame I am pressing start but I can tell you that it is within the first 20 frames, almost immediately. 0657 (40) 064B (42) 0639 (29) 0631 (21) 0645 (53) 0661 (6) 065D (2) 0663 (16) 065F (13) Some other things that I know... 0016-0019 are where controller inputs are stored (16 = gamepad 0, 17 = gamepad 0 new presses this frame, 18-19 = gamepad 1 similar 0002 seems to be a frame counter 0012-0014 seem to be part of a 24-bit PRNG seed RainWarrior on NESDev has also mentioned the following: "This just runs being called over and over in an infinite loop until an NMI interrupts it and eventually manipulates the stack to get it out of that infinite loop. This is setting up the 24-bit PRNG seed. It maybe runs 40 times per frame. Observation 2: this random seed loop is broken only by the NMI, so this will require precise PPU emulation to get correct. If it's even one cycle different, the PRNG seed could be changed." "Even one cycle difference in the specific timing of the NMI can also alter the seed. That last one in particular is one that emulators might easily behave differently on, especially reset/warmup behaviour of the PPU. It's also possible that on hardware the variability of PPU alignment might mean you only have a 1 in 4 chance of getting a consistent alignment on reset/power-up too, even if you could get that frame-perfect START every time." I am not certain about these last comments by Rainwarrior, but if I can only get my manipulation to work 25% of the time even with perfect inputs, I wonder if any of the other 3 out of 4 results would sync with an emulator? However, I don't know if this is really the case, and if what has been stated about resets and NMI interruption then I would doubt it, since I think the emulator simply is functioning differently in this regard, which is why Bizhawk and FCEUX differ in what frame they initially populate values in the PRNG addresses. Please let me know if you have any other questions, and in the mean time I will play with this other emulator and let you know what I observe.
Chambers_N
Posted: 7/26/2017 9:43 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
The input manipulation that I need to do will be frame perfect and will require me to press and hold start any where from the very first frame possible to press start, etc. Without a TAS editor this may be difficult to do. I will play around with it to see how I might be able to utilize it and will post my results here, in the mean time I will write up what I am looking for in the upcoming post.
Chambers_N
Posted: 7/26/2017 7:03 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Does Mesen have a TAS Editor and a way to watch Ram Addresses? I will write up what I am looking for later on and we can go from there. Thanks!
Chambers_N
Posted: 7/26/2017 1:47 PM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Also, I am offering a $200 bounty for the person who figures out how to get outcomes to match in original hardware and an emulator with TAS such as Bizhawk and FCEUX. If interested please send me a PM, and we can discuss the details.
Chambers_N
Posted: 7/26/2017 8:15 AM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
Is there a way to modify how FCEUX emulates the game? https://forums.nesdev.com/viewtopic.php?f=2&t=16226&start=45#p200923
Chambers_N
Posted: 7/22/2017 10:28 AM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
I have concluded that the state of NES emulation is not yet sufficient in order to TAS this game. It is a personal opinion of mine that it isn't the same if the emulator is not synced with the NES, and can't be reproduced on original hardware in the same way, therefore I will not TAS it. This non-sync issue will need to be corrected in the future so that emulators can be utilized to TAS 1000's of variations of this game which would otherwise take weeks. Until that day comes...
Chambers_N
Posted: 7/22/2017 7:35 AM
Quote
CLChambers00
Experienced Forum User
Joined: 7/21/2017
Posts: 54
I have also confirmed that it does not matter the hardware that you use. I have been able to get the same RNG manipulation for real cart with Top Loader, real cart with Front Loader, Everdrive with Top Loader, and Everdrive with Front Loader. All the outcomes are the same, just can't get any emulator with a TAS editor to sync with it.
Chambers_N
1 2 3