Hacking for VGMs

by **andlabs** » Mon Aug 15, 2011 11:25 pm

This is the base code for my custom sound test as I first had it; I would typically modify it heavily (getting rid of the equates and patching up the code a bit) before using it.

Code: Select all: ; pietro gagliardi 20-22 march 2011 ; ya se chuan shuo ControllerAddress equ $FF2000 MaxSong equ $FF StopSong equ $00 ori #$700,sr move.l #$C00000,a5 move.l #$C00004,a6 move.w #$8006,(a6) ; HV latch enable move.w #$8134,(a6) ; MD, display off, no DMA, 224 lines move.w #$8228,(a6) ; plane A at $A000 move.w #$833E,(a6) ; window at $F800 move.w #$8406,(a6) ; plane B at $C000 move.w #$851E,(a6) ; sprites at $3C00 move.w #$8700,(a0) ; background color: line 0 color 0 move.w #$8B00,(a0) ; disable external int move.w #$8D0B,(a0) ; H scroll at $2C00 move.w #$8F02,(a0) ; skip words each write ; TODO see if I can use DMA to clear VRAM move.w #$FFFF,d0 move.l #$40000000,(a6) clearvramloop: move.w #0,(a5) dbf d0,clearvramloop lea numbers(pc),a1 move.l #$40000000,(a6) move.w #numbers_end-numbers,d0 lsr.w #1,d0 subq.w #1,d0 copynumloop: move.w (a1)+,(a5) dbf d0,copynumloop bra.w numbers_end numbers: dcb.l 8,$00000000 ; blank tile! dc.l $01111110 dc.l $10000001 dc.l $10000001 dc.l $10000001 dc.l $10000001 dc.l $10000001 dc.l $10000001 dc.l $01111110 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $11111110 dc.l $00000001 dc.l $00000001 dc.l $01111110 dc.l $10000000 dc.l $10000000 dc.l $10000000 dc.l $01111111 dc.l $11111110 dc.l $00000001 dc.l $00000001 dc.l $01111110 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $11111110 dc.l $10000001 dc.l $10000001 dc.l $10000001 dc.l $01111111 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $01111111 dc.l $10000000 dc.l $10000000 dc.l $01111110 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $11111110 dc.l $01111111 dc.l $10000000 dc.l $10000000 dc.l $11111110 dc.l $10000001 dc.l $10000001 dc.l $10000001 dc.l $01111110 dc.l $11111111 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $01111110 dc.l $10000001 dc.l $10000001 dc.l $01111110 dc.l $10000001 dc.l $10000001 dc.l $10000001 dc.l $01111110 dc.l $01111110 dc.l $10000001 dc.l $10000001 dc.l $01111111 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $11111110 dc.l $01111110 dc.l $10000001 dc.l $10000001 dc.l $11111111 dc.l $10000001 dc.l $10000001 dc.l $10000001 dc.l $10000001 dc.l $10000000 dc.l $10000000 dc.l $10000000 dc.l $10000000 dc.l $11111111 dc.l $10000001 dc.l $10000001 dc.l $11111111 dc.l $11111111 dc.l $10000000 dc.l $10000000 dc.l $10000000 dc.l $10000000 dc.l $10000000 dc.l $10000000 dc.l $11111111 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $00000001 dc.l $11111111 dc.l $10000001 dc.l $10000001 dc.l $11111111 dc.l $11111111 dc.l $10000000 dc.l $10000000 dc.l $11111111 dc.l $10000000 dc.l $10000000 dc.l $10000000 dc.l $11111111 dc.l $11111111 dc.l $10000000 dc.l $10000000 dc.l $11111111 dc.l $10000000 dc.l $10000000 dc.l $10000000 dc.l $10000000 numbers_end: move.l #$C0000000,(a6) ; load palette move.l #$00000EEE,(a5) clr.l d0 clr.l d4 clr.l d7 move.w #$8174,(a6) ; display on, enable VInt andi #~$700,sr mainloop: stop #$2500 ; wait for VInt bsr.w DoControllers bsr.w PrintNumber bra.s mainloop DoControllers: move.b (ControllerAddress).l,d0 btst #2,d0 ; left? bne.s CtlLeft btst #3,d0 ; right? bne.s CtlRight btst #4,d0 ; B bne.s StopMus btst #6,d0 ; A bne.s PlayMus rts CtlLeft: tst.b d4 beq.s noleft subq.b #1,d4 noleft: rts CtlRight: cmpi.b #MaxSong,d4 beq.s noright addq.b #1,d4 noright: rts StopMus: move.b #StopSong,d7 bra.w DoPlay PlayMus: move.b d4,d7 bra.w DoPlay PrintNumber: ori #$700,sr move.l #$60000002,(a6) move.b d4,d7 lsr.b #4,d7 and.w #$F,d7 addq.w #1,d7 move.w d7,(a5) move.b d4,d7 and.w #$F,d7 addq.w #1,d7 move.w d7,(a5) andi #~$700,sr rts DoPlay: ; THIS PART IS GAME SPECIFIC!

Thanks to Sik for help with the VDP registers.

To use this, you need to know where the game loads its sound driver (optional... you could also just jump into this code after the game loads everything), reads controllers, plays a song. I think you need to wait more than one frame to prevent control from moving too fast. Let me know if you need any help with this; I should probably strip some stuff out and make a more template-y version.

by **ValleyBell** » Tue Aug 16, 2011 8:59 am

I can't use it either.

Here's my hacking method for this driver. It requires less knowledge about the MD:
At first you need to find the sound driver in the MD's RAM. This is easiest to do with a RAM viewer that refreshes its state every frame. (like Gens KMod, MESS is slower)
After opening the RAM viewer, let the game play some music and scroll through the RAM of the 68k maincpu (FF0000 - FFFFFF). Stop where the numbers change in the rhythm of the music.
Now look at the first 2-byte-number (its offset always ends with 00) of this block. It should change to 00xx when a music or to 80xx when a sound starts playing.

(Note: The following steps assume that you use MESS' debugger.)
Now as you have found the Sound ID, you can set a watchpoint to its address that stops everytime the value is changed.

Code: Select all: wpset FFED00,2,w

(where FFED00 is the address of the Sound ID)

Now make the game play some sound or music. The debugger should now stop the emulator and the disassembly show some lines. The line above the highlighted one should look like this:

Code: Select all: move.w #$0005, $ffed00.l

Now search for a line that starts with "jsr" and press F10 (Step Over) until you reach it. (It may already be the highlighted line.) Now press F11 (Step Into) one time and set a breakpoint. (either using the F9 key or a bpset-command)

Now the major work is done - all you have to do is recording the music:
At first you should type "wpdisable", because you now have a breakpoint and don't need the watchpoint anymore.
Now search some place in the game where nothing interrupts the music and you can play sounds when you want. An options screen, if available, works best, as the game won't need to load or process too much.

To play a song, make the game play a sound. Now the debugger will stop the emulator and you can change the Sound ID. To do that either use the memory editor or this line:

Code: Select all: w@FFED00 = ID

where "FFED00" is the address of the Sound ID, as above, and "ID" is the hexadecimal number of the song to play.
Now press F5 (Run) or F12 (Run and Hide Debugger) and the song will play instead of a sound effect.

Note: There's often a Sound ID that stops the music, but this ID doesn't need to be 0, or even exist. Wrong IDs can produce bugs or crash the game.

To make a long story short: All I do is making the game play music instead of SFX.

by **ValleyBell** » Mon Apr 09, 2012 6:45 am

Rapidkirby3k, can you please post the music modifier for Batman & Robin here?
I'm collecting hacking information.

Thanks.

by **TEOL** » Sat Aug 17, 2013 6:08 am

Hacking information for native 2612 SMPL1.dat files from Mr. Nutz Hoppin Mad Source for the Audios Entertainment TFMX Driver:

A.U.D.I.O.S Entertainment

Sega Megadrive Soundsystem
--------------------------

The system provides complex use of all Megadrive sound sources. Using a little
CPU-time from the 68000 main processor together with the Z80 makes it possible
to play high quality FM / PSG sound and 2 superb sampling voices at one time.
Also a complex FX handler is included.

How to put sound in your game !
-------------------------------

The "samples.dat" file has Rom-location $C0000
The "code" file has this time Rom-location $d0000 (Can be changed !)
All calls are relative to $D0000 (TFMX)

1. Call TFMX+0 for first init (To set up Z80)
2. To select the rom-music-file put the number in d0.w and call TFMX+4
3. To play a song put the number in d0.w and call TFMX+8
4. Call TFMX+12 with 50/60 Hz from the end of your VBL IRQ
5. To play FX put the number in d0.w and call TFMX+16
- TFMX+20 has no function
6. To stop the sound call TFMX+24

- All routines save the CPU-registers except D0 if used
for parameters (File/Song/FX)

Now for test select file 0 song 0 fx $0-$f

The files in the set:

https://app.box.com/s/75qn0hbhovbpzq4dwfqe

Website · by **Rapidkirby3k** » Sun Aug 18, 2013 9:50 pm

ValleyBell wrote:Rapidkirby3k, can you please post the music modifier for Batman & Robin here?
I'm collecting hacking information.

Thanks.

Many apologies for the year-long delay, but here's the Action Replay code for Batman & Robin. I found this at GScentral:

Music Test Modifier - FFF60B:XX (XX is Hex 0 thru F, I think)

I hope this helps.

by **ValleyBell** » Mon Apr 07, 2014 2:45 pm

I finally had some spare time and did some hacking with Paperboy. (which uses an 68k sound driver + Z80 DAC driver)

The "Load Music" routine is located at ROM offset 002D5E and requires register D0 to contain the song/SFX to load.
This is done ingame at various places, so there is no music trigger.
Sound IDs are 00..7F in general (music and SFX mixed), IDs 76..7F play DAC sounds.

If you want to force the game to play a certain song somewhere in the game, you need to search for "70xx 4EB9 0000 2D5E" where xx is the Sound ID of the song it plays.
A good starting point is to search for Sound ID 13 (hex), which plays on the stage select screen.

Additional info:
- The PSG SFX sound update routine is at ROM offset 05E488. (its work RAM begins at C1DA)
- The sound update routine for music is at ROM offset 05F680. (its work RAM begins at C1E6)
- both routines are called from within the Vertical Interrupt routine which starts at 001E36 (the sound calls are at 002128 and 00212E)
- If you set RAM offset C1CE to 01..FF, sound commands are disabled.
- There is no checksum check, so at least you don't need to bother about that.
- RAM value C01C/1D (16-bit word) seems to be the game mode. 04 is the demo mode and disables sound commands, too.

by **Koto** » Tue Apr 08, 2014 6:01 pm

A tiny question. I was messing around with the Fatman/Slaughter Sports and I think I could log all the music without hacking... Except win and lose fanfares (always include some hit and cry noise). But I found the game only use the DAC for sounds, and if you mute it, the fanfares play free of noises and with all the instruments. So my question is... Is possible to "erase" the DAC (Or another channel) data in a VGM? It's the only thing I need to complete the set. Thanks!

See ya

by **Monkeymook** » Tue Apr 08, 2014 6:09 pm

I think using ValleyBell's VGM editing tools, you can strip off certain channels from the VGM, including PCM data as well.

by **ValleyBell** » Wed Apr 09, 2014 2:07 am

Actually that's one of the few things that doesn't work.
I never finished that part of vgm_ptch, so it can only strip whole chips, but not single channels.

I have a few unfinished mini-tools that filter certain commands out, so if you kindly ask me to remove the DAC, I'll do it.

by **Koto** » Wed Apr 09, 2014 8:06 am

ValleyBell wrote:Actually that's one of the few things that doesn't work.
I never finished that part of vgm_ptch, so it can only strip whole chips, but not single channels.

I have a few unfinished mini-tools that filter certain commands out, so if you kindly ask me to remove the DAC, I'll do it.

Oh, Mr. ValleyBell, could you please remove the DAC of these sinners files for me? :cry:

The Bonapart Theme also needs it, because this character have a permanent heartbeat sound when it's battling. Thanks!!

EDIT: Oops, more issues with Fatman, I'm having problems playing the files with VGMPlay or in_vgm 40.4. YM2612 Channel 4 doesn't play properly in, at least, those themes: Title, Rex's, Stump's, Ramses's, Webra's and Mondu's. Character Selection generates noise at the beginning, and Rex's Theme have it too... Could you check it out, please VB? And I thought this gonna be a easy set...

https://www.dropbox.com/s/dskt1259dgkm13z/Fatman.zip

See ya

Hacking for VGMs

Re: Hacking for VGMs

Hacking Guide for Data East/Side Pocket sound driver

Re: Hacking for VGMs

Hacking for VGMs

Re: Hacking for VGMs

Paperboy

Hacking for VGMs

Hacking for VGMs

Hacking for VGMs

Hacking for VGMs

Who is online