Open rom to "Start Game" screen (and maybe some help understanding things)

[adscl84]

I found it by accident, so I'm hoping the experts can help me understand exactly what is going on here.

=======

I knew of a "hack" that opens the rom to the main menu (set 20038 to 4c8980), but wanted to try to make the game to open to the "start game" screen.

 

From my very limited understanding, 4c (JMP) is telling the rom to go to a certain location.  In this case, it's whatever 8980 means.  I assumed it was a pointer, of which I have some understanding from editing the large helmets. 

 

Looking at my playoff code, I thought the 8980 might refer to 20099 (80 = 200, 99 = 89+10).  Afterall, one of the codes I have goes to 23fe4 as a result of "d4bf" (23f = bf and e4 = d4+10).  I also figure it must be in that area since I'm working in the 20000 area of the rom since I doubted the 3 byte hack involved bank switching.  Running the code logger when I navigated from the start game screen to the main menu revealed activity at 20099, so I thought my suspicions are valid.

 

Well, I ran the code logger while going from the Tecmo bunny to the start game screen.  I found a lot of activity, but got stuck quickly.  The first activity I found was at 20044, so I put in 4c3480 and got a blank screen.  However, when I pushed "A", I got the start screen.  The next activity was at 20052, so I put in 4c4280 with the same result. 

 

Now, the next activity I found was at 2c1f6, so I put in...

 

Well, that's where I got stuck.  200 - 80 = 180 in hex, but 2c1 - 180 = 141 in hex.  I don't know what to do with that 1, since I can't put in e6141.  I remembered from the big helmet tutorial that the Jets' pointer was F3A5 and how drove me nuts back in the day, before I realized that the F3 turning to 103 meant the A5 turned from 105 into 106 (hence, their helmet data being located at 10603).  Does it turn into e651?  I tried that and got nothing, so I didn't know either way.

 

In a last ditch effort, I opened the debugger hoping to miraculously somehow find something.  I noticed a 4c4880 and tried that, thinking it must have a purpose if it's already programmed in the game.  To my pleasant surprise, it worked!  That's great, but I don't really understand what I did. I know I told the rom to go to 20058, which irritatingly was buried within some other stuff the code logger picked up, but I don't know why the code needs to be at 20038 to begin with.  Also, I still don't understand the pointers as much as I thought.

 

So, to have the rom open to the "start game" screen, set 20038 to 4c4880.

 

If it's a lot of explaining, don't worry about it I guess.  It's just very late and I'd hate to have my post go to waste since maybe it can help someone other than myself.  I'm trying to better understand this stuff so I can avoid writing long posts before finding the answer myself by random chance...

[DrunkenGamer]

The jumper "20" tells the game to jump inside the current bank of the Rom and to come back to this code once the code you jump to has finished.  This is done by putting the code "60" at the end of a code string of the code you jumped to.  Both "20" and "4C" jump inside what ever bank you are in.  IE you can't jump from location x000000 to x030000 using the "20" or "4C" codes.  I'm not sure how to jump to different banks in the NES.  Anyways, "4C" is a bridge that tells the game to not come back to this code but to the code that pointed to code containing the "4C" jumper.  Example:

 

First code

x0000 - E230 A901 201080 8D0280 8D0480 AA E8 60

Second Code

x0010 - E230 AA E8 E8 4C2080 60

Third Code

x0020 - 8E0080 A901 60

 

This code reads as follows.  To help, I put a space between each step in the above code to go along with the breakdown below:

1.  starting at x0000, Set to 8 bit

2.  Load A with #01.  A now equals 01

3.  Jump to location x0010

4.  Set to 8 bit

5.  Move A value to X. X now equals 01

6.  Increase X.  X now equals 02

7.  Increase X.  X now equals 03

8.  Jump with no return to x0020

9.  Store X to Ram x0000.  Ram loc x0000 now equals 03

10.  Load A with #01.  A now equals 01

11.  End code and return to x0006 because of the "4C" usage, if "20" was used then the return location would be x0018 and you would have to end that coding with another "60" to get the code back to x0006.

12.  Store A in Ram x0002.  Ram loc x0002 now equals 01

13.  Store A in Ram x0004.  Ram loc x0004 now equals 01

14.  Move A to X.  X now equals 01

15.  Increase X.  X now equals 02

16.  End code return to whatever code that points to this code.

 

I only deal with SNES coding so the way the game stores to RAM in the NES may not look like this.  When I'm writing code for the SNES I have a Store long code the lets me put the whole location in the code.  I know the shorthand codes but it makes it easier for me to read seeing the whole location.  Also, in the SNES there are times when "4C" doesn't jump to the exact location you point to.  IE if you put 4C0080 it'll jump to x0001 not x0000.  I've never tried to find out why, I just know in certain areas it does this and I adjust my coding in those locations.  I hope this helps.

Edited December 31, 2015 by drunken_honkey

[bruddog]

Let me try and explain what is going on. 

 

L_17_8012:                                      ; LOCATION 0x20022 in the ROM                

      LDX #$F1                                  ; Set Stack Pointer

      TXS

      LDX #$11                                  ; SET BANK = BANK 18

      JSR $D8E3                                 ; SWAP A000 BANK (X= BANK TO SWAP TO)

      JSR $D28B                                 ; FADE IN PALLETE() = SET COLORS AND FADE THEM IN

      JSR $D10E                                 ; CLEAR NAMETABLES() = CLEAR BACKGROUND

      JSR $D571                                 ; clear sprites() = CLEAR TILES DRAWN OVER BACKGROUND

 

The above routine set our location on the stack for temporary variables for this part of the game. It sets the second swappable bank to the bank of data adjacent to the one we are in. JSR's are subroutines. The jump to a different locaiton in the rom to run a routine. In this case the routines above are basically clearing the screen. Routines that start with C,D,E,F are in the fixed bank which for tecmo super bowl starts at 0x3c010. and goes through 0x40010

 

 

 

L_17_8023:                                      ; DRAW INTRO

      LDA #$01                                  ; LOAD 1 FRAME

      JSR $CC9A                                 ; WAIT (A= # FRAMES BEFORE RETURNING)                            

      LDA #$00                                  ; SET CUTSCENE  = INTRO

      LDX #$06                                  ; SET CUTSCNE BANK = BANK 7

      JSR $C390                                 ; DRAW CUTSCENE(A= INDEX, X= BANK)

      LDA #$04                                  ; LOAD 4 FRAMES

      JSR $CC9A                                 ; WAIT (A= # FRAMES BEFORE RETURNING)

 

This section gets our intro screen started. the LDA #$01 JSR $CC9A  are basically just delays to give the PPU time to do all the rendering. 

 

 

L_17_8034:                                      ; INTRO LOOP 0x20044

      LDA #$01                                  ; LOAD 1 FRAME

      JSR $CC9A                                 ; WAIT (A= # FRAMES BEFORE RETURNING)

      LDA $38                                   ; CHECK FOR DOWN PRESSED

      AND #$04                                  ;

      BEQ L_17_8034                             ;

      INC $06F6                                 ; INCREASE SLOW MOTION/STOP DEBUG

 

L_17_8042:

      LDA $3A                                   ; IS P1/P2 PRESS = A,B,SELECT,START 

      AND #$F0                                  ; THIS MASKS OUT THE DIRECTIONAL BUTTONS 

      BEQ L_17_8034                             ; NO-> INTRO LOOP

 

The above  loop  keeps playing the intro until A or B is pressed. It also registers down presses for the slow motion/freeze the game debug mode. 

L_17_8048:                                      ; DRAW START SCREEN

 

Finally here is the start of the start screen.  So if we wanted to skip right to the start screen we would put in 4C4880 at 0x20044 which is the start of our intro loop. This would effectively let us skip past the intro loop. 

[adscl84]

Mother of God...

 

I can't even begin to comprehend how you're able to make the hacks you do.

 

Did you type out the notes in the right column,  or can those be found somewhere?

Edited January 1, 2016 by adscl84

[bruddog]

Yes i typed them.

[TheFes75]

I have a question in the Tecmo Bowl (Original) forum that asks if there is something I can watch while playing the game to see what causes a defensive player to be pushed away or slingshotted away from the receiver on slants and curls. Could this be detected similarly by looking at what is being explained above.? 

[bruddog]

2 hours ago, TheFes75 said:

I have a question in the Tecmo Bowl (Original) forum that asks if there is something I can watch while playing the game to see what causes a defensive player to be pushed away or slingshotted away from the receiver on slants and curls. Could this be detected similarly by looking at what is being explained above.? 

 

Yes but you are kind of starting from scratch with the TB rom. And its much harder to figure out the source of the issue during gameplay because  there is so much going on. 

 

The slingshot problem likely occurs because the game is trying to move them to the final ball location. 

[adscl84]

5 hours ago, bruddog said:

Yes i typed them.

 

Holy cow.

 

I remember messing around with editing TSB roms back in the fall of 2000.  IIRC, this used to be knobbe.org (and Knobbe was known as Rod Woodson on the old forums).

 

I only mention that because TSB rom editing/hacking has therefore been going on for at least 15 years.  How long did it take for you to have a reasonable understanding of 6502 as it relates to TSB?

[DFM]

Jstout wrote some great tutorials on 6502 that can be found here: http://tecmobowl.org/forum/topic/55469-nes-programming-info/

[adscl84]

5 hours ago, davefmurray said:

Jstout wrote some great tutorials on 6502 that can be found here: http://tecmobowl.org/forum/topic/55469-nes-programming-info/

 

I've started reading those as well some other stuff I've found through google searching.  I have no background in programming and am trying to learn this stuff on my own, outside being able to ask questions here.

 

I have no real expectations of being able to do anything remotely close to what bruddog, jstout, xplozv, or some of the others can do to this game.  But, if it's possible to self teach myself enough to be able to make minor tweaks to the gameplay, that'd be pretty cool.

[DFM]

2 minutes ago, adscl84 said:

I have no real expectations of being able to do anything remotely close to what bruddog, jstout, xplozv, or some of the others can do to this game.  But, if it's possible to self teach myself enough to be able to make minor tweaks to the gameplay, that'd be pretty cool.

4

 

It is absolutely possible. Everyone here is self-taught.

[adscl84]

8 hours ago, davefmurray said:

 

It is absolutely possible. Everyone here is self-taught.

That's good to hear.  I'm hoping that since it's more a matter of changing the existing code to get the game to do different things, rather than creating the game from scratch, it won't be as daunting as i first thought.  We'll see... 

 

I have a few ideas for (hopefully simple) things i may want to try to implement just to see if i can.  I'll make a new thread when i start looking into them so they don't get lost in here.