Hacking for VGMs

Got a new set? Wanna point something out with an old set? Wanna update an existing set? Here's your place to do it!
andlabs
New Around Here
Posts: 8
Joined: Wed Mar 02, 2011 1:29 pm

Re: Hacking for VGMs

Post by andlabs »

This is the base code for my custom sound test as I first had it; I would typically modify it heavily (getting rid of the equates and patching up the code a bit) before using it.

Code: Select all

; pietro gagliardi 20-22 march 2011

; ya se chuan shuo

ControllerAddress   equ $FF2000
MaxSong            equ $FF
StopSong         equ $00

   ori      #$700,sr

   move.l   #$C00000,a5
   move.l   #$C00004,a6

   move.w   #$8006,(a6)      ; HV latch enable
   move.w   #$8134,(a6)      ; MD, display off, no DMA, 224 lines
   move.w   #$8228,(a6)      ; plane A at $A000
   move.w   #$833E,(a6)      ; window at $F800
   move.w   #$8406,(a6)      ; plane B at $C000
   move.w   #$851E,(a6)      ; sprites at $3C00
   move.w   #$8700,(a0)      ; background color: line 0 color 0
   move.w   #$8B00,(a0)      ; disable external int
   move.w   #$8D0B,(a0)      ; H scroll at $2C00
   move.w   #$8F02,(a0)      ; skip words each write

   ; TODO see if I can use DMA to clear VRAM
   move.w   #$FFFF,d0
   move.l   #$40000000,(a6)
clearvramloop:
   move.w   #0,(a5)
   dbf      d0,clearvramloop

   lea      numbers(pc),a1
   move.l   #$40000000,(a6)
   move.w   #numbers_end-numbers,d0
   lsr.w   #1,d0
   subq.w   #1,d0
copynumloop:
   move.w   (a1)+,(a5)
   dbf      d0,copynumloop
   bra.w   numbers_end

numbers:
   dcb.l   8,$00000000      ; blank tile!

   dc.l   $01111110
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $01111110

   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001

   dc.l   $11111110
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $01111110
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $01111111

   dc.l   $11111110
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $01111110
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $11111110

   dc.l   $10000001
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $01111111
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001

   dc.l   $01111111
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $01111110
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $11111110

   dc.l   $01111111
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $11111110
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $01111110

   dc.l   $11111111
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001

   dc.l   $01111110
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $01111110
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $01111110

   dc.l   $01111110
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $01111111
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $11111110

   dc.l   $01111110
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $11111111
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $10000001

   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $11111111
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $11111111

   dc.l   $11111111
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $11111111

   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $00000001
   dc.l   $11111111
   dc.l   $10000001
   dc.l   $10000001
   dc.l   $11111111

   dc.l   $11111111
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $11111111
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $11111111

   dc.l   $11111111
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $11111111
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
   dc.l   $10000000
numbers_end:

   move.l   #$C0000000,(a6)   ; load palette
   move.l   #$00000EEE,(a5)

   clr.l   d0
   clr.l   d4
   clr.l   d7
   move.w   #$8174,(a6)      ; display on, enable VInt
   andi   #~$700,sr

mainloop:
   stop   #$2500         ; wait for VInt
   bsr.w   DoControllers
   bsr.w   PrintNumber
   bra.s   mainloop

DoControllers:
   move.b   (ControllerAddress).l,d0
   btst   #2,d0   ; left?
   bne.s   CtlLeft
   btst   #3,d0   ; right?
   bne.s   CtlRight
   btst   #4,d0   ; B
   bne.s   StopMus
   btst   #6,d0   ; A
   bne.s   PlayMus
   rts
CtlLeft:
   tst.b   d4
   beq.s   noleft
   subq.b   #1,d4
noleft:
   rts
CtlRight:
   cmpi.b   #MaxSong,d4
   beq.s   noright
   addq.b   #1,d4
noright:
   rts
StopMus:
   move.b   #StopSong,d7
   bra.w   DoPlay
PlayMus:
   move.b   d4,d7
   bra.w   DoPlay

PrintNumber:
   ori      #$700,sr
   move.l   #$60000002,(a6)
   move.b   d4,d7
   lsr.b   #4,d7
   and.w   #$F,d7
   addq.w   #1,d7
   move.w   d7,(a5)
   move.b   d4,d7
   and.w   #$F,d7
   addq.w   #1,d7
   move.w   d7,(a5)
   andi   #~$700,sr
   rts

DoPlay:
   ; THIS PART IS GAME SPECIFIC!


Thanks to Sik for help with the VDP registers.

To use this, you need to know where the game loads its sound driver (optional... you could also just jump into this code after the game loads everything), reads controllers, plays a song. I think you need to wait more than one frame to prevent control from moving too fast. Let me know if you need any help with this; I should probably strip some stuff out and make a more template-y version.
ValleyBell
Board Regular
Posts: 128
Joined: Mon Aug 30, 2010 7:10 am

Hacking Guide for Data East/Side Pocket sound driver

Post by ValleyBell »

I can't use it either.

Here's my hacking method for this driver. It requires less knowledge about the MD:
At first you need to find the sound driver in the MD's RAM. This is easiest to do with a RAM viewer that refreshes its state every frame. (like Gens KMod, MESS is slower)
After opening the RAM viewer, let the game play some music and scroll through the RAM of the 68k maincpu (FF0000 - FFFFFF). Stop where the numbers change in the rhythm of the music.
Now look at the first 2-byte-number (its offset always ends with 00) of this block. It should change to 00xx when a music or to 80xx when a sound starts playing.

(Note: The following steps assume that you use MESS' debugger.)
Now as you have found the Sound ID, you can set a watchpoint to its address that stops everytime the value is changed.

Code: Select all

wpset FFED00,2,w
(where FFED00 is the address of the Sound ID)

Now make the game play some sound or music. The debugger should now stop the emulator and the disassembly show some lines. The line above the highlighted one should look like this:

Code: Select all

move.w  #$0005, $ffed00.l
Now search for a line that starts with "jsr" and press F10 (Step Over) until you reach it. (It may already be the highlighted line.) Now press F11 (Step Into) one time and set a breakpoint. (either using the F9 key or a bpset-command)

Now the major work is done - all you have to do is recording the music:
At first you should type "wpdisable", because you now have a breakpoint and don't need the watchpoint anymore.
Now search some place in the game where nothing interrupts the music and you can play sounds when you want. An options screen, if available, works best, as the game won't need to load or process too much.

To play a song, make the game play a sound. Now the debugger will stop the emulator and you can change the Sound ID. To do that either use the memory editor or this line:

Code: Select all

w@FFED00 = ID
where "FFED00" is the address of the Sound ID, as above, and "ID" is the hexadecimal number of the song to play.
Now press F5 (Run) or F12 (Run and Hide Debugger) and the song will play instead of a sound effect.

Note: There's often a Sound ID that stops the music, but this ID doesn't need to be 0, or even exist. Wrong IDs can produce bugs or crash the game.

To make a long story short: All I do is making the game play music instead of SFX.
ValleyBell
Board Regular
Posts: 128
Joined: Mon Aug 30, 2010 7:10 am

Re: Hacking for VGMs

Post by ValleyBell »

Rapidkirby3k, can you please post the music modifier for Batman & Robin here?
I'm collecting hacking information.

Thanks.
TEOL
Been Here for a Bit
Posts: 30
Joined: Thu Jul 14, 2011 1:00 pm

Hacking for VGMs

Post by TEOL »

Hacking information for native 2612 SMPL1.dat files from Mr. Nutz Hoppin Mad Source for the Audios Entertainment TFMX Driver:

A.U.D.I.O.S Entertainment

Sega Megadrive Soundsystem
--------------------------


The system provides complex use of all Megadrive sound sources. Using a little
CPU-time from the 68000 main processor together with the Z80 makes it possible
to play high quality FM / PSG sound and 2 superb sampling voices at one time.
Also a complex FX handler is included.



How to put sound in your game !
-------------------------------

The "samples.dat" file has Rom-location $C0000
The "code" file has this time Rom-location $d0000 (Can be changed !)
All calls are relative to $D0000 (TFMX)

1. Call TFMX+0 for first init (To set up Z80)
2. To select the rom-music-file put the number in d0.w and call TFMX+4
3. To play a song put the number in d0.w and call TFMX+8
4. Call TFMX+12 with 50/60 Hz from the end of your VBL IRQ
5. To play FX put the number in d0.w and call TFMX+16
- TFMX+20 has no function
6. To stop the sound call TFMX+24

- All routines save the CPU-registers except D0 if used
for parameters (File/Song/FX)

Now for test select file 0 song 0 fx $0-$f

The files in the set:

https://app.box.com/s/75qn0hbhovbpzq4dwfqe
User avatar
Rapidkirby3k
Posts: 12
Joined: Sun Jul 02, 2006 12:24 pm
Location: USA
Contact:

Re: Hacking for VGMs

Post by Rapidkirby3k »

ValleyBell wrote:Rapidkirby3k, can you please post the music modifier for Batman & Robin here?
I'm collecting hacking information.

Thanks.


Many apologies for the year-long delay, but here's the Action Replay code for Batman & Robin. I found this at GScentral:

Music Test Modifier - FFF60B:XX (XX is Hex 0 thru F, I think)

I hope this helps.
ValleyBell
Board Regular
Posts: 128
Joined: Mon Aug 30, 2010 7:10 am

Paperboy

Post by ValleyBell »

I finally had some spare time and did some hacking with Paperboy. (which uses an 68k sound driver + Z80 DAC driver)

The "Load Music" routine is located at ROM offset 002D5E and requires register D0 to contain the song/SFX to load.
This is done ingame at various places, so there is no music trigger.
Sound IDs are 00..7F in general (music and SFX mixed), IDs 76..7F play DAC sounds.

If you want to force the game to play a certain song somewhere in the game, you need to search for "70xx 4EB9 0000 2D5E" where xx is the Sound ID of the song it plays.
A good starting point is to search for Sound ID 13 (hex), which plays on the stage select screen.

Additional info:
- The PSG SFX sound update routine is at ROM offset 05E488. (its work RAM begins at C1DA)
- The sound update routine for music is at ROM offset 05F680. (its work RAM begins at C1E6)
- both routines are called from within the Vertical Interrupt routine which starts at 001E36 (the sound calls are at 002128 and 00212E)
- If you set RAM offset C1CE to 01..FF, sound commands are disabled.
- There is no checksum check, so at least you don't need to bother about that.
- RAM value C01C/1D (16-bit word) seems to be the game mode. 04 is the demo mode and disables sound commands, too.
Koto
Been Here for a Bit
Posts: 48
Joined: Tue Apr 08, 2008 1:01 pm

Hacking for VGMs

Post by Koto »

A tiny question. I was messing around with the Fatman/Slaughter Sports and I think I could log all the music without hacking... Except win and lose fanfares (always include some hit and cry noise). But I found the game only use the DAC for sounds, and if you mute it, the fanfares play free of noises and with all the instruments. So my question is... Is possible to "erase" the DAC (Or another channel) data in a VGM? It's the only thing I need to complete the set. Thanks!

See ya
Last edited by Koto on Tue Apr 08, 2014 6:12 pm, edited 1 time in total.
Monkeymook
Posts: 120
Joined: Sun Aug 22, 2010 2:33 am
Location: Virginia Beach, VA

Hacking for VGMs

Post by Monkeymook »

I think using ValleyBell's VGM editing tools, you can strip off certain channels from the VGM, including PCM data as well.
ValleyBell
Board Regular
Posts: 128
Joined: Mon Aug 30, 2010 7:10 am

Hacking for VGMs

Post by ValleyBell »

Actually that's one of the few things that doesn't work.
I never finished that part of vgm_ptch, so it can only strip whole chips, but not single channels.

I have a few unfinished mini-tools that filter certain commands out, so if you kindly ask me to remove the DAC, I'll do it.
Koto
Been Here for a Bit
Posts: 48
Joined: Tue Apr 08, 2008 1:01 pm

Hacking for VGMs

Post by Koto »

ValleyBell wrote:Actually that's one of the few things that doesn't work.
I never finished that part of vgm_ptch, so it can only strip whole chips, but not single channels.

I have a few unfinished mini-tools that filter certain commands out, so if you kindly ask me to remove the DAC, I'll do it.


Oh, Mr. ValleyBell, could you please remove the DAC of these sinners files for me? :cry: :cry: :cry:

The Bonapart Theme also needs it, because this character have a permanent heartbeat sound when it's battling. Thanks!!

EDIT: Oops, more issues with Fatman, I'm having problems playing the files with VGMPlay or in_vgm 40.4. YM2612 Channel 4 doesn't play properly in, at least, those themes: Title, Rex's, Stump's, Ramses's, Webra's and Mondu's. Character Selection generates noise at the beginning, and Rex's Theme have it too... Could you check it out, please VB? And I thought this gonna be a easy set... :(

https://www.dropbox.com/s/dskt1259dgkm13z/Fatman.zip

See ya
Post Reply