Posts for bortreb

Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
As the author of the original ACE hack for pokemon yellow, I've got to say that this is the ultimate dream for taking control of pokemon yellow (or really any gameboy game). Kudos to you, MrWint! I'm so impressed with how far you've taken ASC: how compact the initial bootstrapping is, the massive bandwidth you've achieved to write bits to the GB, and how much more creative and well-storyboarded your payload is! And the sound and hiColor! Mad props to you and congratulations! You are now the true pokemon master forever!
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
I'm the guy who did the first pokemon yellow hack back in 2013 -- this run is awesome! My original inspiration was to make an interactive terminal with code injection in-game; it's wonderful to see it finally happen. Going back into the game and giving yourself god-like powers is so satisfying to watch. It really feels like Mario becomes the master of his reality in this run. happy hacking! --Robert McIntyre
Post subject: VBA Rerecording Sound Synchronization for Gameboy
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
I am curious how gameboy videos are currently encoded, due to my recent experience with my pokemon yellow TAS. When I created a demo encode for youtube, I used my own special purpose code to generate the final rendered file. This was a very simple implementation which simply output one png file for each frame of video, and wrote all sound to a target wav file. Internal emulation time was dilated to allow me to write these files regardless of the speed of my computer. The png files and wav file were then muxed and encoded to video using ffmpeg. My initial attempts were met with failure because the audio would gradually go out of sync with the video. Initially I thought that this was because the simulated gameboy did not use exactly 60 fps as its framerate, so I tried various other plausible framerates. Eventually I found to my surprise that there is no constant framerate which could work. So, I rewrote my AV rendering code to record the exact amount of time that had elapsed according to the recorded sound, and to adaptively drop and duplicate frames to keep the frames synced to the sound at a constant framerate of 60 fps, within an imperceptible drift tolerance. I found that there are different conditions during simulation which cause the frames to go out of sync with the video. During restarts and bootup sequence, there are many frames which must be added, and during normal operation, frames must be occasionally dropped at a rate of about 1 frame every three to four seconds. Source for this program is here: http://hg.bortreb.com/vba-clojure/file/aeb4b676ba8b/clojure/com/aurellem/run/final_cut.clj After making this modification to my A/V rendering code, I was able to achieve a perfect encode of my 12 minute video using my rather under-powered laptop over the course of a few hours. Listen to the encode of my TAS that was generated by my program, especially the beginning of the "My Little Pony" theme song at 12:20. Notice how there are no pops in any of the notes. http://www.youtube.com/watch?v=p5T81yHkHtI Now, listen to the official encode of my TAS, especially around 12:25, where the first note of the song plays. http://www.youtube.com/watch?v=aYQpl8Jj6Yg You will notice some pops in the audio when the "My Little Pony" theme song is played. You can also hear these pops during the "Pallet Town" song that plays at the start of each video. Looking at several other Gameboy encodes, I can notice similar pops a few times a minute. So, my questions are: How are Gameboy TAS encodes rendered? Why are there pops in the sound for many Gameboy TASs? Is there something wrong with vba-rerecording itself that is creating these pops? Would it be useful to add a command line option to vba-rerecording that would render a vbm file to a directory of images and a soundfile? something like vba-rerecording <rom> --rendermovie <vbm> \ --png-dir=<output> --audio-file=<audio> This would of course do automatic frame dropping and duplication to make everything stay in sync. As always, it's a pleasure to work with this great TAS community. --Robert
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
FractalFusion wrote:
Hm. I never expected my submission to generate half the attention it actually received. It seems that this run is judged to obsolete [url= http://tasvideos.org/2187M.html]bortreb's run[/url]. That's unfortunate, since bortreb put in way more effort (even constructing the TAS entirely from botted input). Just by looking at the submission text, it is clear that he knows GB specs inside out, something that I cannot lay claim to. Without bortreb's run, this submission would not exist. We should all thank him for such an innovative run. In comparison, my TAS is not innovative. If bortreb chose to do a Pi Day TAS, he would most certainly have done it better than me. That being said, I wonder what bortreb would think if he saw this run.
I've been hoping that someone would take my run and improve it ever since I released it. Your PI run is awesome! My favorite part is how you write each level of bootstrapping code "backwards" and actually overwrite the jump address of the last bootstrapping layer. That's some elegant self-modifying code and a beautiful approach. One of the best parts of making things is having other people take them and use them to build their own stuff. To those that think the visual output is not as impressive -- he could have written the exact same payload as the last video, so I don't see why that should be an issue. The cool part is the massive improvement in actual bootstrapping time. It's a very subjective thing to judge these types of runs, because I think there's two metrics: technical excellence of the bootstrapping, and entertainment of the payload. Anyway, this run just absolutely made my day! Thanks, FractalFusion!
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
Why did my star go away :( ? Seems like all the pokemon runs got just got demoted, along with a bunch of others.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
Thank you everyone, for all of your comments on my run, and thank you for welcoming me into this great community. The technical competence and understanding of this TAS community has continued to impress me, and I'm glad to now be part of it. Your enjoyment makes the many months of work worth it. As others have said, it's meant to be a technical showcase of a neat vulnerability of Pokemon yellow. I'd like to remind everyone that the source code to everything is available at http://hg.bortreb.com/vba-clojure/, and is completely free software. If you don't like ponies, take it and make it into anything you want! I would be very happy to see anyone build on this run to create something even more amazing! I'd be happy to help; just email me (rlm at mit dot edu) or pm me. When I'm less busy, I'll revisit this and try to apply the many things I've learned from talking with all of you. sincerely, --Robert McIntyre
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
Though, you can physically destroy the gameboy's LCD circuits by writing to Video Ram during times other than V-blank. However, I made sure that my program does not do this.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
"Executes Arbitrary Code" seems to me like a better name than "Total Control Hack" as well. However, I am worried that "Executes Arbitrary Code" might not be meaningful to those TAS viewers without a computer science background.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
This run is SUPREME and these people are Gods of the Mushroom Kingdom. Has siglemic seen this yet?
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
Spikestuff wrote:
bortreb Can you record how you did it because I cannot even figure out how to do it.
First, I have a bot that interacts with the bootstrapping program so that I can copy any code anywhere I want. Then, I write the program at the end in machine language using a primitive macro-based compiler that I wrote in clojure. I thought about using the C development kits to make the program, but ultimately didn't go through with it for two reasons: - You can't control the actual memory position for the output code, which makes it impossible to write non-relocatable/self-modifying code. - You can't use interrupts, so much of the "standard" library is not that useful. So I ended up just using a very basic clojure compiler I wrote myself to output that last program, and then put the machine code through my bot which wrote it to memory. If you wanted to use the development kits, then I'm sure there's a way to grab non-relocatable contiguous object files out of the compiler output and use those. It was just more trouble than it was worth for my small program. Also, copying the ROM/RAM of another game will in general not work too well, since that code is too large and uses interrupts. However, you can certainly copy specific routines/sprites from other game ROMs with no problem. You might also be able to compile a small game targeting a smaller system with much smaller specs, and then translate and copy that image into the gameboy. (I'm thinking something like pong/pacman/tetris here). The problem there is that it would be hard to translate the audio/visual direct accessing parts. Maybe the easiest way to make a bigger program would be to compile that program using the C development kit, then massage that ROM image into a form that can be written to RAM. Then, you can fuse the decompressor with the bootstrapping program and write the compressed image to RAM. Does that help?
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
franpa wrote:
Any encode available on Youtube without the buttons along the bottom? All the button presses aren't visible in it making it pointless and the bright yellow is an eye sore when contrasted against a near monochrome game.
I don't have anything on youtube but there's an encode on my website with no buttons. It's here: http://aurellem.org/pokemon-hack/rlm-yellow-hack-no-buttons.avi
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
Lollorcaust wrote:
Ilari wrote:
Abahbob wrote:
I'd rather not wait the long amount of time it would take to code an entire game over Pokemon Yellow lol. But it would be really interesting.
Using subframe input (and ignoring the physics of the buttons / detection circuits) would cut down the waiting time a lot.
Does VBA support this? Or it's not an emulator thingy?
VBA does not support subframe input to my knowledge.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
FractalFusion wrote:
I played this run back in VBA and looked at the memory. I'm very pleased with how it works. ... It actually starts writing a bit behind C000 but it doesn't matter since only the region C000-DFFF can be written to.
This is a very accurate view of the bootstrapping process! The third bootstrapping program does start at 0xC000 though. The first few numbers you see are part of the interface to the bootstrapping program that tells it where to start writing and how many bytes to write.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
FractalFusion wrote:
bortreb wrote:
When writing your payload program, you are not allowed to use any interrupts or the fixed jump instructions, since the interrupt handling code and fixed jump vectors are inside pokemon yellow's ROM. Without interrupts it's harder to play music and get input.
Does this apply to all programs written in RAM, or only the payload program? Also, since interrupts are like subroutines, does it mean that call routine instructions cannot be used?
The absolute jump and call routine instructions are fine, you just can't use interrupts (because they are registered with code in ROM as part of the gameboy's architecture), and you can't use the opcodes 0xCF, 0xDF, 0xEF, or 0xFF since those all call routines in ROM as well. See http://imrannazar.com/Gameboy-Z80-Opcode-Map for more details. The restriction doesn't limit what you can program, it just makes you have to constantly check on things instead of relying on interrupts. Thanks for letting me know about the Edit button. Is there something specific you wanted me to edit?
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
Ilari wrote:
bortreb wrote:
HOWEVER, you can only actually write 60 bytes per second because that is the maximum input rate of the buttons (it actually isn't, but you'd need a different emulator than vba-rerecording to go any higher.)
Any estimates how fast one could read data if the emulator supported sub-frame input?
It depends on your input program, and how physically realistic you want it to be for a real gameboy. The simpliest input reading program is just a tight loop of about say 20 opcodes, and the processor operates at around 4Mhz (8Mhz if you force the CPU into Double Speed Mode). So that's something like 400kb per second with unrealistic physical assumptions. But if we're talking about actual physical buttons, they have a certain amount of time to physically move forwards and backwards, and then the electrical resonance in the detection circuit has to settle down, and all that. I would be surprised if you could go any higher than say 5 times higher than the current artificial limit, so maybe 300bytes a second max? Now, you could also use the IR link to push data into RAM. That operates at 65kb a second, though I think it is sort of cheating to use the IR port.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
kaizoman666 wrote:
Anyway, very interesting run. For-sure yes vote. Though, I have to ask, why are there so many 00's in the code you wrote?
The 00s are part of the data for the image. I need to define a few empty or near-empty tiles to make the strings and background. Also, the balloon tiles have a lot of 00s in them as well.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
With regards to having more content: You can switch memory banks creatively to get access to about 36kb of program space. HOWEVER, you can only write 60 bytes per second, because that is the maximum input rate of the buttons (it actually isn't, but you'd need a different emulator than vba-rerecording to go any higher.) You can write a decompressor first but that takes time too. The 4kb payload program in my run takes about a minute to write. Writing 60 bytes a second is just about fast enough to play music on the fly using all the sound channels, but that's about it. When writing your payload program, you are not allowed to use any interrupts or the fixed jump instructions, since the interrupt handling code and fixed jump vectors are inside pokemon yellow's ROM. Without interrupts it's harder to play music and get input. SO, the payload program is limited to 36kb of space (plus whatever you can recycle from pokemon's ROM like sprites and such), can't use interrupts, and every byte costs 1/60 of a second to write to RAM. I think someone could make something very impressive indeed with enough knowledge of gameboy programming, especially if they reused some of the data in pokemon yellow's ROM and a decompressor. (Maybe something like the ending of earthbound, where there is a "roll call" with all the sprites.) I welcome anyone who wants to brave the gameboy's machine code to take what I've done as a starting point and make something even cooler --- it's all open source and available at http://hg.bortreb.com/vba-clojure . I was more interested in the attack side of this exploit so I just made something basic. (Though even that little program at the end took quite a while for me to write in machine language.)
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
jlun2 wrote:
Also, any other game that can also do something like this?
IMO you'd probably want to look at games that have function pointers in RAM and some user editable feature with a lot of degrees of freedom, like an item list or level editor. Quite a lot had to go right for me to take over pokemon, though, like 0x00 being a no-op and also worth so much money, and the game allowing items to have a quantity over 99.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
p4wn3r wrote:
bortreb wrote:
Also, the only part that may suffer from emulation problems is the "restarting glitch" used at the beginning, taken from p4wn3r's run. I believe that someone actually did that on a console if I'm not mistaken?
Do you mean the reset on the first frame I used to manipulate the trainer ID?
I mean the restart at about 52 seconds in which overwrites the pokemon list and other values with 0xFF. I don't need any trainer ID manipulation for this run, just a way to blow past the end of the item list. You could do this with the ZZAAZZ glitch too. In summary, you can do this hack as long as you can corrupt your item list, there's nothing else special needed.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
p4wn3r: I thought to myself, "what's the most trolltastic thing I could inject," and came up with mlp. There's two alternate songs at http://aurellem.org/pokemon-hack/mother.wav, and http://aurellem.org/pokemon-hack/regret.wav jlun2: I'd love to run it on a newer version of vba (and suspect that it would work, since the hack is robust), but their autotools scripts are broken, preventing me from compiling it for GNU/Linux. When I started the project, I downloaded 23.5 and spent a week learning autotools and fixing their script. That's what I used to make the movie. I emailed the vba guys and offered to contribute my fixes, but never heard back from them. Anyway, If someone with a working vba24 would check this, I would greatly appreciate it. Also, the only part that may suffer from emulation problems is the "restarting glitch" used at the beginning, taken from p4wn3r's run. I believe that someone actually did that on a console if I'm not mistaken?
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
Oh, thanks so much FractalFusion.
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
Even stranger --- In my visual boy advance the frames are 46313 and not 16777561 as the submission now reports.....
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
It appears that just changing that one part of the header didn't work. Now the total time is much larger :(. Here's my header: 00000000: 5642 4d1a 0100 0000 694a 584f b4e8 0000 VBM.....iJXO.... 00000010: 0000 0000 0001 0270 0000 0000 0000 0000 .......p........ 00000020: 0100 0000 504f 4b45 4d4f 4e20 5945 4c4c ....POKEMON YELL 00000030: 0197 7c04 0300 0000 0000 0000 0001 0000 ..|............. 00000040: 5f5f 5f5f 5f5f 5f5f 5f5f 5f5f 5f5f 5f5f ________________ 00000050: 526f 6265 7274 2020 4d63 496e 7479 7265 Robert McIntyre 00000060: 5f5f 5f5f 5f5f 5f5f 5f5f 5f5f 5f5f 5f5f ________________ 00000070: maybe the 694a should be 0000? I will investigate...
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
STBM helped me fix the frame count of the video. The corrected submission is at http://aurellem.org/pokemon-hack/rlm-yellow-hack.zip (The only difference is that the frame count in the header is now correct) Thanks STBM and Spikestuff!
Experienced Forum User, Published Author, Former player
Joined: 9/3/2012
Posts: 40
Location: boston
Thanks! So should I fix it and then update or should I not? And how do I change the submission now that it's already submitted?