Jump to content

Any way to speed up INT returns


bruddog

Recommended Posts

I found a string of code that affects INt returns. I made one edit where an INT was an automatic TD as the rest of the players on the field danced around. It works more or less like the regular plays where its a pointer to something else. Still working on something that isn't completely rediculous

Link to comment
Share on other sites

found some code at 4E28-4E3F that controls INT returns.

I didn't look at that (it probably is the pointers to the location I found), but I'll give you another method...

Use FCE Ultra's debugger / memory viewer. During a play, the address of the players are stored in memory.

Bring up the memory viewer and scroll to the line 03ax.

The eighth and ninth columns (0x3a8 and 0x3a9) contain the address for team 1, player one. Skip a row to go to the next player (0x3c8 and 0x3c9).

You have to read the addresses from right to left. So if you see this:

03ax: 00 00 EA 87 00 7E 82 00 63 BF 00 C0 00 13 45 01

03bx: 13 22 4A 40 09 2C 47 00 00 00 00 20 00 1F 05 60

03cx: 06 00 3A AD 00 7E 82 01 65 BF 00 80 00 40 43 02

03dx: 1A 2A D1 61 09 00 81 00 00 00 00 1C 00 FF 04 A0

03ex: 00 00 D1 8D 00 7E 82 02 6D BF 00 78 00 11 53 04

03fx: 19 2C E0 5A 09 D5 81 00 00 00 00 20 00 DF 05 00

040x: 80 01 EA 87 01 66 81 03 7B BF 00 B8 00 D9 43 03

041x: 13 26 92 23 09 51 57 AA FF 7B 00 10 05 D7 B0 90

042x: 00 01 E3 9E 00 55 82 04 7D BF 00 68 00 70 53 05

The boldface bytes are the command sequence addresses. The top line is team 1, player 1 (0xBF63), the third line is team 1, player 2 (xBF65) and so forth.

These addresses change as the player moves from task to task. The next step is to scroll the memory viewer to the address of the player you are interested it.

Note that the ROM banks load in and out constantly, so you'll need to pause the ROM while doing this. An easy way is to set a write breakpoint on 0x3A9 (or the appropriate spot for the player) via the debugger. Any time the player's command changes, the emulator will pause and you can check it out.

Once it pauses, check the values at 0x3A9 and 0x3A8. You'll need to set a Read breakpoint based on those bytes. In this case, we'd set a read breakpoint on 0xBF63.

Now, we'll have to run it again until that breakpoint is triggered. The difficult thing here is that you need to recognize if it's a valid trigger. Due to the NES's limited memory, the same addresses are used a lot depending on the current bank that is loaded. For our purposes here, you know you have hit it right if it's doing a LDA-Y command.

So, scroll to that location now via the memory viewer (0xBF63) and notice the byte sequence. Now, do a search with a hex editor on the ROM itself to find where it is actually located in the ROM. It should only find one instance. If you find multiple, just increase the number of bytes you are searching for.

I did this for the INT code and found that the INT return man always runs the commands from 0xbfc5 in the ROM. (Interesting note: this is actually the exact spot in RAM--minus the 0x10 byte header--that the NES uses; this rarely happens...)

These are the commands that it runs:

e1 00 (set MS back to default)

e2 03 (set something to default + 3)

e3 ef (set something to something)

e4 (user control)

df & fe ? not sure how these even come into play

I didn't test with e2 and e3 but considering e0 and e1 tweak running speeds, I bet e2 and e3 do something with attributes as well.

If you want super sonic speed, try changing it to e1 ff. After a while the intercepting guy can run across the entire field in a second or two.

So, if you are looking to make punt returners a bit faster, increase the number after e1 until you like it. Note that e0 increases RS (acceleration), so you could add that in before the e4 command and just move everything over two bytes since there is plenty of room afterwords.

I would be interested in seeing exactly what the e2 and e3's do.

(Note: the attribute adjustment table that I posted about makes it nice to test interceptions. Just set all 16 PC INT bytes to 0 and the QB's will throw picks everytime.)

Link to comment
Share on other sites

  • 3 years later...

The comparable section of bytes to edit for this in TSB3 is located here:

x1D19A6

Interestingly, the E1 00 sequence is not included (like in the NES version). So, if you want to adjust MS without some sort of redirect hack, replace the E2 with E1 and edit the value.

Also, changing the E3 and/or E4 values doesn't necessarily impact more attributes. I altered both values in a test and when a ball was picked, the interceptor's behavior changed from trying to head to the endzone to chasing the opposing team's highlighted player (usually the WR being thrown to). It was pretty funny...

AM Rush

Link to comment
Share on other sites

That's because E4 returns the control back to the you the player!

Yeah I figured that either that and/or the other byte were behavior controls and not attribute mods... I haven't really f*cked with behavior mod in TSB3, in large part because I'm fearing it'll destroy another huge chunk of time in my life... Thankfully my rom is probably not going to need it in order for me to be happy with it.

The one last thing I really want that probably will destroy more months of my life is finding and modding the code for the COM player's logic for when to go for 2 points, when to kick FGs, when to fake punts and FGs, and when to go on 4th down... If you guys have found any of that (minus the 2 pt convs, of course) in the NES version, please point me to those threads...

AM Rush

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...