Posts for Omnigamer

Posted: 4/5/2014 3:21 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Very interesting agwawaf! Glad you're working on this game. Can you post the replay file for your WIP? Nico isn't cooperating for me at the moment.

Posted: 3/18/2014 5:42 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Small revival of this thread to mention two separate reports of a bug in Greenhill which triggers the ending cutscenes and credits. Posts quoted below, followed by a summary of the takeaways:

I just recalled the worst bug I've ever seen during Greenhill liberation. After beating Lucia and reaching the screen that shows hero behind the Greenhill academy (last screen before entering the academy), the screen suddenly changed into a screen of a path with trees on its sides (just like the path to Sindar ruin), faded black, then it showed the exact screen of Muse where Hero and Nanami waited for Jowy, again without characters. Then, the craziest of all, it suddenly changed to ending 108 stars screen as if I ended the game at that time. As it was still in Greenhill Liberation I didn't have 108 stars yet of course and thus the game showed the bad ending. I went mad as no matter how I reset psx or change memory card, the thing still stays the same whenever I wanted to continue the story to liberate Greenhill. It was not CD problem as well. I didn't have the slightest possibility why this happened. My brother was playing as well and his save data did not face such bug. Anyone knows why this happened? In all cases I deleted this save data already though...

I well, i just arrived at Greenhill, i go north and i save nina, then i continue to north where i think its the academy, but when i enter the area the game just start to show me the 108 stars.. and what happened to them, looking like i finished the game.....anyone know of this a way to fix? (withtout involving loading a different save because i only have 1 save... which is inside of Greenhill

Originals available here and here. -Both events occurred when entering Greenhill Academy grounds, but the two claims are at different parts of the story and even enter from different directions. -The descriptions of what happens are slightly different, but I believe the second could just be omitting some of the details. -It is in some way tied to save data since neither poster was able to get around it by reloading save data. Possibly happens from save corruption of story flags. Neither specifies whether they're on emulator or not, which could be part of it. Either way, it's worth disclosing in case somebody tries a TAS in the future. With some knowledge on the requirements/setup, a TAS could reasonably finish in under an hour. What I think is happening is that there's a particular memory flag that is set that indicates it is currently in the credits sequence. When the player enters the Greenhill area, a script checks for the flag to determine if it should arrange objects according to the ending cutscene in that same location. Since it finds it, it may force a jump to the remaining cutscenes and full credit sequence after. That's my best guess at least. As far as I know, no other instances of this glitch have been reported.

Posted: 3/4/2014 11:50 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Wow, I don't even. Glad to finally see a full TAS with the memory corruption stuffs. Yes vote. Also, it has been some time since I've seen any run with the cutscenes still in. Made me remember this.

Posted: 2/25/2014 3:03 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

It's a configuration used for convenience and consistency, and pretty much every other emulator will do something similar. The issue is that on actual hardware, power-on states of the RAM cells can be somewhat random. Many games will explicitly zeroize RAM addresses they intend to use, but plenty of games just take them as-is and assume they will be 0. This is why the RNG manipulation in Hagane works only some of the time, or why feasel has to wait long "cool-down" periods between attempts on FF1. That said, this doesn't strike me as a bug related to uninitialized memory addresses. Console behavior should still pretty closely match emulated work. If it's related to "dirty" RAM at all, it's probably from something that gets loaded directly during the Chptr 2 save that is not part of the TAS route due to optimization (going from the example with DrDarkLink).

Posted: 2/16/2014 12:28 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

So the main thing that happens from doing the grapple-entry glitch is that you force the game to think you are (currently) in a different room. When you enter another door, it takes that location and uses the door number as a pointer to figure out where you go to next. The current area address is $004C and the door entry number is $04BE. Thus by using a combination of higher-numbered doors and the appropriate current room you can get to some interesting/broken places. The ASM for the subroutine that handles room updates is below:

$E5B9:A9 00     LDA #$00                   A:00 X:0C Y:58 S:F7 P:nvUBdIZC
$E5BB:85 1B     STA $001B = #$B2           A:00 X:0C Y:58 S:F7 P:nvUBdIZC
$E5BD:A5 4C     LDA $004C = #$0B           A:00 X:0C Y:58 S:F7 P:nvUBdIZC
$E5BF:0A        ASL                        A:0B X:0C Y:58 S:F7 P:nvUBdIzC
$E5C0:26 1B     ROL $001B = #$00           A:16 X:0C Y:58 S:F7 P:nvUBdIzc
$E5C2:0A        ASL                        A:16 X:0C Y:58 S:F7 P:nvUBdIZc
$E5C3:26 1B     ROL $001B = #$00           A:2C X:0C Y:58 S:F7 P:nvUBdIzc
$E5C5:48        PHA                        A:2C X:0C Y:58 S:F7 P:nvUBdIZc
$E5C6:18        CLC                        A:2C X:0C Y:58 S:F6 P:nvUBdIZc
$E5C7:6D 13 A8  ADC $A813 = #$A3           A:2C X:0C Y:58 S:F6 P:nvUBdIZc
$E5CA:85 17     STA $0017 = #$0C           A:CF X:0C Y:58 S:F6 P:NvUBdIzc
$E5CC:A5 1B     LDA $001B = #$00           A:CF X:0C Y:58 S:F6 P:NvUBdIzc
$E5CE:6D 14 A8  ADC $A814 = #$AB           A:00 X:0C Y:58 S:F6 P:nvUBdIZc
$E5D1:85 18     STA $0018 = #$18           A:AB X:0C Y:58 S:F6 P:NvUBdIzc
$E5D3:68        PLA                        A:AB X:0C Y:58 S:F6 P:NvUBdIzc
$E5D4:18        CLC                        A:2C X:0C Y:58 S:F7 P:nvUBdIzc
$E5D5:6D 15 A8  ADC $A815 = #$63           A:2C X:0C Y:58 S:F7 P:nvUBdIzc
$E5D8:85 19     STA $0019 = #$08           A:8F X:0C Y:58 S:F7 P:NVUBdIzc
$E5DA:A5 1B     LDA $001B = #$00           A:8F X:0C Y:58 S:F7 P:NVUBdIzc
$E5DC:6D 16 A8  ADC $A816 = #$AD           A:00 X:0C Y:58 S:F7 P:nVUBdIZc
$E5DF:85 1A     STA $001A = #$10           A:AD X:0C Y:58 S:F7 P:NvUBdIzc
$E5E1:AC BE 04  LDY $04BE = #$02           A:AD X:0C Y:58 S:F7 P:NvUBdIzc
$E5E4:B1 19     LDA ($19),Y @ $AD91 = #$02 A:AD X:0C Y:02 S:F7 P:nvUBdIzc
$E5E6:8D BE 04  STA $04BE = #$02           A:02 X:0C Y:02 S:F7 P:nvUBdIzc
$E5E9:B1 17     LDA ($17),Y @ $ABD1 = #$5E A:02 X:0C Y:02 S:F7 P:nvUBdIzc
$E5EB:85 4C     STA $004C = #$0B           A:5E X:0C Y:02 S:F7 P:nvUBdIzc

Posted: 2/3/2014 1:55 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

If possible, I would advise using BizHawk. The variety of extra tools would help substantially, and you won't have to worry as much about lag inaccuracies.

Posted: 1/26/2014 9:35 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Improvements in any PO title? Yes please.

Posted: 1/17/2014 9:26 PM

Post subject: Re: And........... it's the small things

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Spikestuff wrote:

See it would've been nice that this was a Max Score in the branch (forgot about it). But even as I think about it (which is dangerous) I say a full Mercenaries run* would've been appropriate than this broken branch. Having Wesker as part of the branch is pointless like saying in Crash Team Racing the branch is Coco/N.Gin (Accel + Turn) because you didn't use Dingodile/Tiny (Top Speed + Accel). Instead you mention if you used Optimal or sub-optimal character within the TAS. Don't bring up Castlevania^ that game just is completely different when choosing different characters. *Village, Castle, Army Base and Water World ^Basically in Castlevania the stories are different when you do something, but Resident Evil this it's a "mini" map with guns, chicks, explosions, zombies, yadda yadda... (If that make sense.)

I also support a "full" run instead of just the single mission. While impressive, it just seems arbitrary to have it for a single mini-game mission. Also I feel that time should be a sub-goal beyond Max Score. The run achieves the maximum score quite a bit before the time drops out and I'm unfamiliar with whether you can quit mid-mission, but achieving the max score in an optimal way should be part of the criteria. It's a bit harder to compare if the timer has to run out after you've achieved the score, which would be the purpose in quitting the mission early. Just my two cents.

Posted: 1/16/2014 3:15 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

FractalFusion wrote:

Some questions require the locking of other questions to occur. For example, question 818 (TOOTSIE) in the bonus round requires locking all questions 800-817 (and a few others). Without that, question 818 cannot be called up. The routines that the game uses are at http://tasvideos.org/GameResources/NES/WheelOfFortune.html . Anyway, this TAS was intended as a demonstration of how fast Wheel of Fortune can be completed from a reset (allowing for whatever you want beforehand as a set-up; I don't know if this tactic has been used by speedrunners in other games, since they are obviously so used to pressing the reset button).

To the best of my knowledge, there are a few precedents used in real-time runs for other things. I believe it's Sly 2 has a bug that allows a New Game file 1 to "inherit" the skills abilities from a completed/nearly completed file 2. There's a general rule for submissions that anything required to set up a run, even if it's otherwise from "New Game," is included in the timing for the run. Which is to say such glitches are effectively banned since setting up the clone saves or otherwise are unlikely to be faster than just doing a run from New Game alone.

How long does the most recent RAM state persist in memory after the NES is shut off? Is it feasible to use a custom NES cart to write what you want in memory, and then turn it off, quickly switch to the cart of the game whose TAS you want to verify, and verify it?

I can't speak for NES personally, but SNES RAM states persist long enough to swap carts in and out of the system. I've observed on the order of minutes before specific addresses are cleared. feasel does runs of Final Fantasy where he expects a certain RNG on initial boot, and he often has to wait 10s of minutes between attempts for it to reset. Case: SNES Hagane does not initialize addresses for initial RNG seed on boot-up. -RNG can be manipulated in real-time according to a 0000 seed. It is obvious when the seed is not as expected. -The seed addresses are changed at some points during gameplay, but usually are zeroed before long. Resets (and power-offs) occasionally keep an alternate state. -Swapping between a US cart and JP cart preserved the same non-zero RNG state in both games. Solution: Swap in a non-Hagane cart that clears the memory, then switch back. Most carts I used would work fine for this, but I used Radical Rex or Skyblazer most often. In the reverse, it is theoretically possible to find a game that initializes RAM to how you expect it and then swap games. Finding an exact match is pretty unlikely, though.

Posted: 12/23/2013 8:39 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

SDA accepts games from official emulators, such as Wii Virtual Console or any collection-type games. Unofficial emulators are still a no-no though.

Posted: 11/27/2013 4:56 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Another thing to note with the Adventure video is that it was segmented and crowd-sourced, in a way. The consecutive clips likely came from different people on not only different versions, but different playthroughs. Thus any of the optimization in this TAS for per-frame manipulation of RNG is not taken into account whatsoever when we were making Adventure.

Posted: 11/26/2013 6:47 PM
(Edited: 11/26/2013 6:49 PM)

Post subject: Re: #4116: numerics's GC Super Smash Bros. Melee in 08:38.3

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Fishaman P wrote:

Also, you said you aimed for time first. What's up with the Ice Climbers stage then?

ICs spawn at a fixed point in time and are not dependent on distance traveled. Great TAS, I really enjoyed it. I feel like I remember a glitch from a long time ago that allowed Samus to superjump similar to Link in v1.0, but it may have had other components to it (items, specific terrain). I will see if I can find the video; it may help the escape if conditions permit. Also, there's a smash club at RIT? I'll have to point my brother there ;)

Posted: 10/3/2013 5:22 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

New glitch/trick: Just before the final boss is a crate with Booster in it. You have to use gravity to get up to it. If you Booster all the way to the right as Havoc, the boss will spawn inside of you and he acts just like a wall. This means you can jump and zip upwards a bit. With the right manipulation he also moves toward the ceiling. You can't quite clip your mech through, but you can eject into the ceiling and go back into the stage as a pilot. Some graphics are messed up, and travelling too far back will cause the game to softlock. It's a really interesting bug, but I haven't found any uses for it yet. Might be useful in a future TAS though.

Posted: 9/10/2013 1:34 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

The exit trigger isn't active until you grab the key, sadly. We also haven't found any way to clip in this stage yet, but if we had a way then it could be sped up a lot.

Posted: 9/9/2013 7:22 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Great work Dooty! Really enjoyed your improvements and the amount of creativity used in the TAS routes. The new time is about 4.5 minutes faster than my best splits in real-time... time to work on re-routing a bit! In response to some of the other comments in this thread: -Most of the glitches are covered in a series of videos by several spanish-speaking players on YouTube. The videos for the glitches in particular are here and here. The useful glitches are documented further in the Metal Warriors thread. -Unknown glitches that would possibly benefit the run currently include an infinite damage glitch with Ballistic (shown in the first video above), operating the ship and mech in Stage 3 at the same time (second video above), and being able to skip some text occasionally (as shown in one of my runs at 16:08 in the video). We've tried to replicate these, but they're not well enough understood at this time. -There's a lot of known ways to improve stages, but no currently known mechanism to achieve them. Examples include Stage 8, where you could potentially zip all the way to the exit if there was a way to clip into the wall. In stage 9-2 the loading zone for the exit is the entire top of the stage, so any way to get to the ceiling in a mech will end the stage much sooner. -There are a couple of other glitches that have not been explored to their full extent, particularly for memory corruption. For example, I've had real-time runs where the text on stage 2 does not close and writes the last character to the screen endlessly, and eventually the screen goes black and crashes at some point after. Also, graphical corruption occurs when some effects occur (Stage 5 gun, switch glitch), but longer lasting effects can occur if the player pauses just as a text box appears or if two or more text boxes appear at the same time. This may or may not be related to a similar glitch where the game softlocks if the player advances past a text box that also carries a change in the current music track. Last thing, some text events can be overwritten with others. The biggest example is in Stage 3, where the text trigger for moving the ship overwrites the trigger event for failing the mission. This may be useful in some other ways, or possibly to produce a wrong warp or other effect. As it stands, the TAS is very optimized and I commend Dooty and pushing it this far. I'm amazed it was able to get below 15 minutes, and I hope there's some future interest in this game for even more glitches and better understanding of all the triggers.

Posted: 9/3/2013 5:15 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Great stuff, really looking forward to it :) I'm wondering how much I can adapt for real-time use, since your strats on nearly every stage blow my current route away.

Posted: 8/31/2013 1:07 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

For completeness, the wrong warp has now been verified on console. Check this video at the 3:02:00 mark. Final time was about an hour 17 minutes with an unoptimized route... a TAS might feasibly be under an hour?

Posted: 8/29/2013 5:49 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

I considered using Gravity in Stage 8 as well during my routing, but the only crate I could find was after the first two barriers. You can get to it either by opening a gate or using rockets to blast open the big He3 canister. Alternatively, the cannon on the other side can also blast open the canister. Going out of the way to pick it up might still cost more than it saves though. I also haven't been able to look into the music/text bug, sadly. I keep running out of time to tackle it. Sorry :-/

Posted: 8/29/2013 5:40 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Documenting this here just so it exists somewhere: The high byte to 7E9BA9 is set to 7F for a very brief time after you kill Piercia (scorpion boss). The low byte is restored to 00, but the high byte is not touched and is apparently never used again until this scene. At the very least, we haven't found a way to change it. In regards to the wrong warp, we've determined that the button combinations and current state of 7EBB37 (1 byte) will determine the outcome. I haven't tested many of the button combinations yet, but I've mapped out what advancing past the text with B does for the following values of 7EBB37: 00 - diagonal orange/laugh 01 - diagonal orange 02 - diagonal orange 03 - diagonal orange 04 - DO 05 - WW 06 - Vert Orange 07 - reset 08 - reset 09 - WW 0A - reset 0B - WW 0C - WW 0D - DO 0E - flashy 0F - WW 10 - WW 11 - WW 12 - WW 13 - WW 14 - WW 15 - reset 16 - flashy 17 - diagonal orange Anything not marked WW is a crash. These values describe the outcome if you start holding B for 2 frames when the given value is in $BB37. I do not know why this is the case, but it seems to be fairly consistent. Oddly enough, $BB37 controls the lights flickering.

Posted: 8/29/2013 1:31 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

No clue. I based that side on reports from here and GFAQs; I don't have any zsnes saves or savestates at that point in the game. The bug may have been shortcut'd away. If they weren't keeping strict track of register/operation size, it is possible that it skips over the bug completely.

Posted: 8/29/2013 12:40 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Yes. PJ has started doing routing/attempts for SS and ran into this on emu first, and then it has now occurred twice on console. I can only think they never expected people to complete the game in one sitting. We first figured that it was an emu thing since there are pretty ancient reports of the same bug occurring, but turns out that this bug only occurs when the player never saves and quits/reloads.

Posted: 8/29/2013 12:01 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

Turns out my earlier report was not a core issue, but rather a case of bad game programming. Disregard it.

Posted: 8/28/2013 11:50 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

We've resolved the issue. Turns out to be a case of very poor programming on the game's part. The issue isn't with emulation, but rather lazy status flags or clearing during other parts of the game. As far as we know now though, the bug makes it impossible to clear the game without resetting. The core address at fault is $7E9BA9. It looks like the lower byte is normally used to describe certain events or character actions (such as room transitions). The high byte is typically 00; however at some point in the game (we haven't found where yet) it gets used and ends up as 7F. When the game begins the cutscene, it takes the full 16-bit value at $7E9BA9 to index into some other tables, despite only forcing the low byte to be 0x10. The scene works fine if you reset the game and load a save since that entire address is cleared and thus it doesn't blow up. We're still working to find out what specific events change the high byte. Of other significance: this same glitch can be abused to wrong warp to the end credits and cut off a significant portion of the run. So understanding how to make it work could lead to a pretty decent TAS. Thanks for your attention to this!

Posted: 8/28/2013 12:32 AM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

That is correct. It is working according to the status register, but unless it misses setting the flag elsewhere I don't know why it would break down like this. If we had an emulator that could get past this point, we could figure out what's messing up but AFAIK the only one that doesn't crash is zsnes.

Posted: 8/27/2013 11:00 PM

Quote

Omnigamer

Experienced Forum User, Published Author, Player (33)

Joined: 2/16/2012
Posts: 282

The core problem happens in the following sequence.

9180ac jsl $a0826c   [a0826c] A:0048 X:7f00 Y:0268 S:1fea D:0000 DB:91 nvMxdizc V:242
a0826c phb                    A:0048 X:7f00 Y:0268 S:1fe7 D:0000 DB:91 nvMxdizc V:242
a0826d ldx $e0       [0000e0] A:0048 X:7f00 Y:0268 S:1fe6 D:0000 DB:91 nvMxdizc V:242
a0826f lda $e2       [0000e2] A:0048 X:a98b Y:0268 S:1fe6 D:0000 DB:91 NvMxdizc V:242
a08271 pha                    A:007e X:a98b Y:0268 S:1fe6 D:0000 DB:91 nvMxdizc V:242
a08272 plb                    A:007e X:a98b Y:0268 S:1fe5 D:0000 DB:91 nvMxdizc V:242
a08273 ldy $0000,x   [7ea98b] A:007e X:a98b Y:0268 S:1fe6 D:0000 DB:7e nvMxdizc V:242
a08276 sty $e6       [0000e6] A:007e X:a98b Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a08278 inx                    A:007e X:a98b Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a08279 inx                    A:007e X:a98c Y:0000 S:1fe6 D:0000 DB:7e NvMxdizc V:242
a0827a ldy #$0000             A:007e X:a98d Y:0000 S:1fe6 D:0000 DB:7e NvMxdizc V:242
a0827d lda $0000,x   [7ea98d] A:007e X:a98d Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a08280 sta $02       [000002] A:0000 X:a98d Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a08282 inx                    A:0000 X:a98d Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a08283 lda #$08               A:0000 X:a98e Y:0000 S:1fe6 D:0000 DB:7e NvMxdizc V:242
a08285 sta $03       [000003] A:0008 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvMxdizc V:242
a08287 lsr $02       [000002] A:0008 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvMxdizc V:242
a08289 bcc $82aa     [a082aa] A:0008 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a082aa lda $0000,x   [7ea98e] A:0008 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a082ad and #$0f               A:0000 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a082af clc                    A:0000 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a082b0 adc #$03               A:0000 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvMxdiZc V:242
a082b2 sta $04       [000004] A:0003 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvMxdizc V:242
a082b4 rep #$20               A:0003 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvMxdizc V:242
a082b6 lda $0000,x   [7ea98e] A:0003 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvmxdizc V:242
a082b9 lsr a                  A:0000 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvmxdiZc V:242
a082ba lsr a                  A:0000 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvmxdiZc V:242
a082bb lsr a                  A:0000 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvmxdiZc V:242
a082bc lsr a                  A:0000 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvmxdiZc V:242
a082bd inc                    A:0000 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvmxdiZc V:242
a082be sta $00       [000000] A:0001 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvmxdizc V:242
a082c0 inx                    A:0001 X:a98e Y:0000 S:1fe6 D:0000 DB:7e nvmxdizc V:242
a082c1 inx                    A:0001 X:a98f Y:0000 S:1fe6 D:0000 DB:7e Nvmxdizc V:242
a082c2 lda $e3       [0000e3] A:0001 X:a990 Y:0000 S:1fe6 D:0000 DB:7e Nvmxdizc V:242
a082c4 sec                    A:7f80 X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvmxdizc V:242
a082c5 sbc $00       [000000] A:7f80 X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvmxdizC V:242
a082c7 sta $05       [000005] A:7f7f X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvmxdizC V:242
a082c9 and #$00ff             A:7f7f X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvmxdizC V:242
a082cc sep #$20               A:007f X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvmxdizC V:242
a082ce lda $e5       [0000e5] A:007f X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082d0 sbc #$00               A:007f X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082d2 sta $07       [000007] A:007f X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082d4 lda [$05],y   [7f7f7f] A:007f X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082d6 sta [$e3],y   [7f7f80] A:0004 X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082d8 iny                    A:0004 X:a990 Y:0000 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082d9 dec $04       [000004] A:0004 X:a990 Y:0001 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082db bne $82d4     [a082d4] A:0004 X:a990 Y:0001 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082d4 lda [$05],y   [7f7f80] A:0004 X:a990 Y:0001 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082d6 sta [$e3],y   [7f7f81] A:0004 X:a990 Y:0001 S:1fe6 D:0000 DB:7e nvMxdizC V:242
a082d8 iny                    A:0004 X:a990 Y:0001 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d9 dec $04       [000004] A:0004 X:a990 Y:0002 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082db bne $82d4     [a082d4] A:0004 X:a990 Y:0002 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d4 lda [$05],y   [7f7f81] A:0004 X:a990 Y:0002 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d6 sta [$e3],y   [7f7f82] A:0004 X:a990 Y:0002 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d8 iny                    A:0004 X:a990 Y:0002 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d9 dec $04       [000004] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082db bne $82d4     [a082d4] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdiZC V:243
a082dd jmp $8292     [a08292] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdiZC V:243
a08292 rep #$20               A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdiZC V:243
a08294 dec $e6       [0000e6] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdiZC V:243
a08296 beq $82a3     [a082a3] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e NvmxdizC V:243
a08298 and #$00ff             A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e NvmxdizC V:243
a0829b sep #$20               A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdizC V:243
a0829d dec $03       [000003] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a0829f bne $8287     [a08287] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a08287 lsr $02       [000002] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a08289 bcc $82aa     [a082aa] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdiZc V:243
a082aa lda $0000,x   [7ea990] A:0004 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdiZc V:243
a082ad and #$0f               A:0000 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdiZc V:243
a082af clc                    A:0000 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdiZc V:243
a082b0 adc #$03               A:0000 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdiZc V:243
a082b2 sta $04       [000004] A:0003 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizc V:243
a082b4 rep #$20               A:0003 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizc V:243
a082b6 lda $0000,x   [7ea990] A:0003 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdizc V:243
a082b9 lsr a                  A:0000 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdiZc V:243
a082ba lsr a                  A:0000 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdiZc V:243
a082bb lsr a                  A:0000 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdiZc V:243
a082bc lsr a                  A:0000 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdiZc V:243
a082bd inc                    A:0000 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdiZc V:243
a082be sta $00       [000000] A:0001 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdizc V:243
a082c0 inx                    A:0001 X:a990 Y:0003 S:1fe6 D:0000 DB:7e nvmxdizc V:243
a082c1 inx                    A:0001 X:a991 Y:0003 S:1fe6 D:0000 DB:7e Nvmxdizc V:243
a082c2 lda $e3       [0000e3] A:0001 X:a992 Y:0003 S:1fe6 D:0000 DB:7e Nvmxdizc V:243
a082c4 sec                    A:7f80 X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvmxdizc V:243
a082c5 sbc $00       [000000] A:7f80 X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvmxdizC V:243
a082c7 sta $05       [000005] A:7f7f X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvmxdizC V:243
a082c9 and #$00ff             A:7f7f X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvmxdizC V:243
a082cc sep #$20               A:007f X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvmxdizC V:243
a082ce lda $e5       [0000e5] A:007f X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d0 sbc #$00               A:007f X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d2 sta $07       [000007] A:007f X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d4 lda [$05],y   [7f7f82] A:007f X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d6 sta [$e3],y   [7f7f83] A:0004 X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d8 iny                    A:0004 X:a992 Y:0003 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d9 dec $04       [000004] A:0004 X:a992 Y:0004 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082db bne $82d4     [a082d4] A:0004 X:a992 Y:0004 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d4 lda [$05],y   [7f7f83] A:0004 X:a992 Y:0004 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d6 sta [$e3],y   [7f7f84] A:0004 X:a992 Y:0004 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d8 iny                    A:0004 X:a992 Y:0004 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d9 dec $04       [000004] A:0004 X:a992 Y:0005 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082db bne $82d4     [a082d4] A:0004 X:a992 Y:0005 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d4 lda [$05],y   [7f7f84] A:0004 X:a992 Y:0005 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d6 sta [$e3],y   [7f7f85] A:0004 X:a992 Y:0005 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d8 iny                    A:0004 X:a992 Y:0005 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082d9 dec $04       [000004] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:243
a082db bne $82d4     [a082d4] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdiZC V:243
a082dd jmp $8292     [a08292] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdiZC V:243
a08292 rep #$20               A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdiZC V:243
a08294 dec $e6       [0000e6] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdiZC V:243
a08296 beq $82a3     [a082a3] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e NvmxdizC V:244
a08298 and #$00ff             A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e NvmxdizC V:244
a0829b sep #$20               A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdizC V:244
a0829d dec $03       [000003] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a0829f bne $8287     [a08287] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a08287 lsr $02       [000002] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a08289 bcc $82aa     [a082aa] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdiZc V:244
a082aa lda $0000,x   [7ea992] A:0004 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdiZc V:244
a082ad and #$0f               A:0000 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdiZc V:244
a082af clc                    A:0000 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdiZc V:244
a082b0 adc #$03               A:0000 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdiZc V:244
a082b2 sta $04       [000004] A:0003 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizc V:244
a082b4 rep #$20               A:0003 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizc V:244
a082b6 lda $0000,x   [7ea992] A:0003 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdizc V:244
a082b9 lsr a                  A:0000 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdiZc V:244
a082ba lsr a                  A:0000 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdiZc V:244
a082bb lsr a                  A:0000 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdiZc V:244
a082bc lsr a                  A:0000 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdiZc V:244
a082bd inc                    A:0000 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdiZc V:244
a082be sta $00       [000000] A:0001 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdizc V:244
a082c0 inx                    A:0001 X:a992 Y:0006 S:1fe6 D:0000 DB:7e nvmxdizc V:244
a082c1 inx                    A:0001 X:a993 Y:0006 S:1fe6 D:0000 DB:7e Nvmxdizc V:244
a082c2 lda $e3       [0000e3] A:0001 X:a994 Y:0006 S:1fe6 D:0000 DB:7e Nvmxdizc V:244
a082c4 sec                    A:7f80 X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvmxdizc V:244
a082c5 sbc $00       [000000] A:7f80 X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvmxdizC V:244
a082c7 sta $05       [000005] A:7f7f X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvmxdizC V:244
a082c9 and #$00ff             A:7f7f X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvmxdizC V:244
a082cc sep #$20               A:007f X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvmxdizC V:244
a082ce lda $e5       [0000e5] A:007f X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d0 sbc #$00               A:007f X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d2 sta $07       [000007] A:007f X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d4 lda [$05],y   [7f7f85] A:007f X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d6 sta [$e3],y   [7f7f86] A:0004 X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d8 iny                    A:0004 X:a994 Y:0006 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d9 dec $04       [000004] A:0004 X:a994 Y:0007 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082db bne $82d4     [a082d4] A:0004 X:a994 Y:0007 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d4 lda [$05],y   [7f7f86] A:0004 X:a994 Y:0007 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d6 sta [$e3],y   [7f7f87] A:0004 X:a994 Y:0007 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d8 iny                    A:0004 X:a994 Y:0007 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d9 dec $04       [000004] A:0004 X:a994 Y:0008 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082db bne $82d4     [a082d4] A:0004 X:a994 Y:0008 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d4 lda [$05],y   [7f7f87] A:0004 X:a994 Y:0008 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d6 sta [$e3],y   [7f7f88] A:0004 X:a994 Y:0008 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d8 iny                    A:0004 X:a994 Y:0008 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082d9 dec $04       [000004] A:0004 X:a994 Y:0009 S:1fe6 D:0000 DB:7e nvMxdizC V:244
a082db bne $82d4     [a082d4] A:0004 X:a994 Y:0009 S:1fe6 D:0000 DB:7e nvMxdiZC V:244
a082dd jmp $8292     [a08292] A:0004 X:a994 Y:0009 S:1fe6 D:0000 DB:7e nvMxdiZC V:244
a08292 rep #$20               A:0004 X:a994 Y:0009 S:1fe6 D:0000 DB:7e nvMxdiZC V:244
a08294 dec $e6       [0000e6] A:0004 X:a994 Y:0009 S:1fe6 D:0000 DB:7e nvmxdiZC V:244
a08296 beq $82a3     [a082a3] A:0004 X:a994 Y:0009 S:1fe6 D:0000 DB:7e NvmxdizC V:244

This continues until $E6 finally hits 0 again, but a multitude of addresses are overwritten with junk along the way. I cannot find an instance when $7EA98B is ever set in normal gameplay, but $E7 is set prior to starting the sequence:

a2804e rep #$20               A:0000 X:ffff Y:000a S:1fe5 D:0000 DB:91 nvMxdizc V:242
a28050 lda [$e0],y   [aaf712] A:0000 X:ffff Y:000a S:1fe5 D:0000 DB:91 nvmxdizc V:242
a28052 sta $e7       [0000e7] A:0125 X:ffff Y:000a S:1fe5 D:0000 DB:91 nvmxdizc V:242
a28054 iny                    A:0125 X:ffff Y:000a S:1fe5 D:0000 DB:91 nvmxdizc V:242
a28055 iny                    A:0125 X:ffff Y:000b S:1fe5 D:0000 DB:91 nvmxdizc V:242
a28056 rep #$20               A:0125 X:ffff Y:000c S:1fe5 D:0000 DB:91 nvmxdizc V:242
a28058 and #$00ff             A:0125 X:ffff Y:000c S:1fe5 D:0000 DB:91 nvmxdizc V:242
a2805b sep #$20               A:0025 X:ffff Y:000c S:1fe5 D:0000 DB:91 nvmxdizc V:242
a2805d ldx $e7       [0000e7] A:0025 X:ffff Y:000c S:1fe5 D:0000 DB:91 nvMxdizc V:242
a2805f inx                    A:0025 X:0125 Y:000c S:1fe5 D:0000 DB:91 nvMxdizc V:242
a28060 stx $f7       [0000f7] A:0025 X:0126 Y:000c S:1fe5 D:0000 DB:91 nvMxdizc V:242