MAMEWorld >> Programming
Previous thread Previous  View all threads Index   Next thread Next   Flat Mode Flat  

VasiliyFamiliya
MAME Fan
Reged: 08/18/17
Posts: 88
Send PM
KOF '94 reverse engineering.
08/26/19 08:36 AM


When I was analyzing the KoF '94 disassembly code, I found such strings:


Code:

04AC56: 0839 0004 0010 FD97      btst    #$4, $10fd97.l
04AC5E: 6700 0024 beq $4ac84 ; if (p1e&JOY_A)=0 then skip to $4ac84
04AC62: 4EBA 04B4 jsr ($4b4,PC) ; ($4b118) ; else goto $4b118 subroutine
04AC66: 4E71 nop
04AC68: 1E04 move.b D4, D7
04AC6A: 4EBA 0186 jsr ($186,PC) ; ($4adf2)
04AC6E: 4E71 nop
04AC70: 1807 move.b D7, D4
04AC72: 4EBA 04CC jsr ($4cc,PC) ; ($4b140)
04AC76: 4E71 nop
04AC78: 4EBA 0504 jsr ($504,PC) ; ($4b17e)
04AC7C: 4E71 nop
04AC7E: 3081 move.w D1, (A0)
04AC80: 6000 0162 bra $4ade4
04AC84: 0839 0005 0010 FD97 btst #$5, $10fd97.l
04AC8C: 6700 0024 beq $4acb2 ; if (p1e&JOY_B)=0 then skip to $4acb2
04AC90: 4EBA 0486 jsr ($486,PC) ; ($4b118) ; else goto $4b118 subroutine
04AC94: 4E71 nop
04AC96: 1E03 move.b D3, D7
04AC98: 4EBA 0158 jsr ($158,PC) ; ($4adf2)
04AC9C: 4E71 nop
04AC9E: 1607 move.b D7, D3
04ACA0: 4EBA 049E jsr ($49e,PC) ; ($4b140)
04ACA4: 4E71 nop
04ACA6: 4EBA 04D6 jsr ($4d6,PC) ; ($4b17e)
04ACAA: 4E71 nop
04ACAC: 3081 move.w D1, (A0)
04ACAE: 6000 0134 bra $4ade4
04ACB2: 0839 0006 0010 FD97 btst #$6, $10fd97.l
04ACBA: 6700 0024 beq $4ace0 ; if (p1e&JOY_C)=0 then skip to $4ace0
04ACBE: 4EBA 0458 jsr ($458,PC) ; ($4b118) ; else goto $4b118 subroutine
04ACC2: 4E71 nop
04ACC4: 1E02 move.b D2, D7
04ACC6: 4EBA 012A jsr ($12a,PC) ; ($4adf2)
04ACCA: 4E71 nop
04ACCC: 1407 move.b D7, D2
04ACCE: 4EBA 0470 jsr ($470,PC) ; ($4b140)
04ACD2: 4E71 nop
04ACD4: 4EBA 04A8 jsr ($4a8,PC) ; ($4b17e)
04ACD8: 4E71 nop
04ACDA: 3081 move.w D1, (A0)
04ACDC: 6000 0106 bra $4ade4
04ACE0: 0839 0007 0010 FD97 btst #$7, $10fd97.l
04ACE8: 6700 00FA beq $4ade4 ; if (p1e&JOY_D)=0 then end the subroutine
04ACEC: 41F9 0040 0000 lea $400000.l, A0 ; else A0=[$400000]
04ACF2: 7000 moveq #$0, D0 ; D0=0
04ACF4: 102D 5678 move.b ($5678,A5), D0 ; D0=[A5+$5678] value
04ACF8: EB48 lsl.w #5, D0 ; D0=[A5+$5678] value<<5
04ACFA: D1C0 adda.l D0, A0 ; A0=[[A5+$5678] value<<5]
04ACFC: 43ED 567A lea ($567a,A5), A1 ; A1=[A5+$567a]
04AD00: 303C 000F move.w #$f, D0 ; D0=#$f
04AD04: 32D8 move.w (A0)+, (A1)+ ; [A5+$567b] value=[[A5+$5678] value<<5] value
04AD06: 51C8 FFFC dbra D0, $4ad04 ; D0-1, if D0<>0 then jump back to previous step
04AD0A: 6000 00D8 bra $4ade4 ; else if D0=0 then end the subroutine
04AD0E: 0839 0004 0010 FD97 btst #$4, $10fd97.l
04AD16: 6700 0024 beq $4ad3c ; if (p1e&JOY_A)=0 then skip to $4ad3c
04AD1A: 4EBA 03FC jsr ($3fc,PC) ; ($4b118)
04AD1E: 4E71 nop
04AD20: 1E04 move.b D4, D7
04AD22: 4EBA 00DC jsr ($dc,PC) ; ($4ae00)
04AD26: 4E71 nop
04AD28: 1807 move.b D7, D4
04AD2A: 4EBA 0414 jsr ($414,PC) ; ($4b140)
04AD2E: 4E71 nop
04AD30: 4EBA 044C jsr ($44c,PC) ; ($4b17e)
04AD34: 4E71 nop
04AD36: 3081 move.w D1, (A0)
04AD38: 6000 00AA bra $4ade4
04AD3C: 0839 0005 0010 FD97 btst #$5, $10fd97.l
04AD44: 6700 0024 beq $4ad6a ; if (p1e&JOY_B)=0 then skip to $4ad6a
04AD48: 4EBA 03CE jsr ($3ce,PC) ; ($4b118)
04AD4C: 4E71 nop
04AD4E: 1E03 move.b D3, D7
04AD50: 4EBA 00AE jsr ($ae,PC) ; ($4ae00)
04AD54: 4E71 nop
04AD56: 1607 move.b D7, D3
04AD58: 4EBA 03E6 jsr ($3e6,PC) ; ($4b140)
04AD5C: 4E71 nop
04AD5E: 4EBA 041E jsr ($41e,PC) ; ($4b17e)
04AD62: 4E71 nop
04AD64: 3081 move.w D1, (A0)
04AD66: 6000 007C bra $4ade4
04AD6A: 0839 0006 0010 FD97 btst #$6, $10fd97.l
04AD72: 6700 0024 beq $4ad98 ; if (p1e&JOY_C)=0 then skip to $4ad98
04AD76: 4EBA 03A0 jsr ($3a0,PC) ; ($4b118)
04AD7A: 4E71 nop
04AD7C: 1E02 move.b D2, D7
04AD7E: 4EBA 0080 jsr ($80,PC) ; ($4ae00)
04AD82: 4E71 nop
04AD84: 1407 move.b D7, D2
04AD86: 4EBA 03B8 jsr ($3b8,PC) ; ($4b140)
04AD8A: 4E71 nop
04AD8C: 4EBA 03F0 jsr ($3f0,PC) ; ($4b17e)
04AD90: 4E71 nop
04AD92: 3081 move.w D1, (A0)
04AD94: 6000 004E bra $4ade4
04AD98: 0839 0007 0010 FD97 btst #$7, $10fd97.l
04ADA0: 6700 0042 beq $4ade4 ; if (p1e&JOY_D)=0 then end the subroutine
04ADA4: 0A2D 0004 569A eori.b #$4, ($569a,A5) ; [A5+$569a] value^4
04ADAA: 3B6D 566E 566A move.w ($566e,A5), ($566a,A5) ; [A5+$566a] value=[A5+$566e] value
04ADB0: 3B6D 5670 566C move.w ($5670,A5), ($566c,A5) ; [A5+$566c] value=[A5+$5670] value
04ADB6: 4EBA 04A2 jsr ($4a2,PC) ; ($4b25a)
04ADBA: 4E71 nop
04ADBC: 41FA 05B0 lea ($5b0,PC) ; ($4b36e), A0
04ADC0: 4E71 nop
04ADC2: 303C 8F00 move.w #$8f00, D0 ; lowest word of swapped (([A5+$566e] value<<5)+[A5+$5670] value+#$7002) value=#$8f00
04ADC6: 082D 0002 569A btst #$2, ($569a,A5)
04ADCC: 6600 0006 bne $4add4 ; if 3rd bit of old [A5+$569a] value^4 is not equal to 0 then skip next step
04ADD0: 303C 0F00 move.w #$f00, D0 ; else lowest word of swapped (([A5+$566e] value<<5)+[A5+$5670] value+#$7002) value=#$f00
04ADD4: 223C 0020 0000 move.l #$200000, D1 ; D1=#$200000
04ADDA: 4EBA 04E4 jsr ($4e4,PC) ; ($4b2c0)
04ADDE: 4E71 nop
04ADE0: 6000 0002 bra $4ade4
04ADE4: 4E75 rts



Code:

04B36E: 5041                     addq.w  #8, D1



Code:

04B2C0: 1018                     move.b  (A0)+, D0 ; D0=[$4b36f] value=#$41 at the beginning of cycle
04B2C2: 6B00 000C bmi $4b2d0
04B2C6: 23C0 003C 0000 move.l D0, $3c0000.l ; send D0 to REG_VRAMADDR
04B2CC: D081 add.l D1, D0 ; D0+#$200000
04B2CE: 60F0 bra $4b2c0 ; return to the beginning of cycle
04B2D0: 4E75 rts



At a certain moment I suspected something was wrong at once - when 04B2CE operation makes processor to skip to beginnning of subroutine, the same value - #$41 (not negative at all) - are getting loaded to D0 at this beginning. What's may to activate N flag after 04B2C0 operation, to don't let this cycle to turn up infinitive?







Entire thread
Subject Posted by Posted on
* MAME debugger vs. IDA Pro VasiliyFamiliya 02/22/19 05:03 PM
. * KOF '94 reverse engineering. VasiliyFamiliya  08/26/19 08:36 AM
. * KOF '94 reverse engineering. VasiliyFamiliya  05/30/19 04:25 AM
. * Re: KOF '94 reverse engineering. MooglyGuy  05/30/19 08:02 PM
. * Re: KOF '94 reverse engineering. Haze  05/31/19 11:23 AM
. * Re: MAME debugger vs. IDA Pro Rotwang  03/20/19 06:38 AM
. * Re: MAME debugger vs. IDA Pro VasiliyFamiliya  03/21/19 03:21 PM
. * Re: MAME debugger vs. IDA Pro Rotwang  03/21/19 04:57 PM
. * Re: MAME debugger vs. IDA Pro VasiliyFamiliya  03/21/19 06:03 PM
. * Re: MAME debugger vs. IDA Pro Rotwang  03/22/19 05:53 AM
. * Re: MAME debugger vs. IDA Pro R. Belmont  02/26/19 06:53 PM
. * Re: MAME debugger vs. IDA Pro VasiliyFamiliya  02/27/19 05:00 AM

Extra information Permissions
Moderator:  Pi 
0 registered and 3 anonymous users are browsing this forum.
You cannot start new topics
You cannot reply to topics
HTML is enabled
UBBCode is enabled
Thread views: 1717