Reply to thread

Message

<blockquote data-quote="SpiderDave" data-source="post: 97" data-attributes="member: 1105">Ok so in fceux, open the jpn version, open up the nametable viewer and hover the top left tile of the cross.The PPU Address is 0x211c, the tile is 0x60.Using the debugger, set a breakpoint for 211c, write, ppu mem.&nbsp; Add a condition A==#60.Reset the game (still need to unpause after the reset too), it will stop when that tile is written to the PPU.&nbsp; Sometimes this is it, you can see right where it stops where it&#039;s grabbing data from.&nbsp; This game needs more.You can see where it stops with the line above here:```&nbsp;07:C5D3: BD 00 06&nbsp; LDA $0600,X @ $0689 = #$60&gt;07:C5D6: 8D 07 20&nbsp; STA PPU_DATA = #$00```So we see it&#039;s getting the tile from 0x689, which is just memory so it&#039;s processing it from somewhere else.&nbsp; So we set another breakpoint on 0689, write, CPU mem this time, condition A==#60.Reset/unpause the game and when it stops we see this:```&nbsp;07:C6B5: AD B1 04&nbsp; LDA $04B1 = #$60&nbsp;07:C6B8: E8&nbsp; &nbsp; &nbsp; &nbsp; INX&gt;07:C6B9: 9D 00 06&nbsp; STA $0600,X @ $0689 = #$30```We see a few lines above that it&#039;s getting the tile from 0x4b1, still not the rom.Set another breakpoint for 04b1, write, CPU mem, condition A==#60Reset/unpause and when it stops we have this:```&nbsp;04:B890: B1 24&nbsp; &nbsp;&nbsp; LDA ($24),Y @ $996B = #$60&gt;04:B892: 8D B1 04&nbsp; STA $04B1 = #$00```Now we see it&#039;s grabbing that tile from 0x996b.&nbsp; You can put that in the &quot;Seek To&quot; field and it will still be in the correct bank so we can see the rom address.&nbsp; Ignore the asm here, we know it&#039;s actually data.```&nbsp;04:996B: 60&nbsp; &nbsp; &nbsp; &nbsp; RTS -----------------------------------------&nbsp;04:996C: 61 62&nbsp; &nbsp;&nbsp; ADC ($62,X) @ $0000 = #$47&nbsp;04:996E: 63&nbsp; &nbsp; &nbsp; &nbsp; UNDEFINED&nbsp;04:996F: 00&nbsp; &nbsp; &nbsp; &nbsp; BRK&nbsp;04:9970: 67&nbsp; &nbsp; &nbsp; &nbsp; UNDEFINED&nbsp;04:9971: 00&nbsp; &nbsp; &nbsp; &nbsp; BRK&nbsp;04:9972: 6B&nbsp; &nbsp; &nbsp; &nbsp; UNDEFINED&nbsp;04:9973: 68&nbsp; &nbsp; &nbsp; &nbsp; PLA&nbsp;04:9974: 69 6C&nbsp; &nbsp;&nbsp; ADC #$6C&nbsp;04:9976: 6D 6A 00&nbsp; ADC $006A = #$00&nbsp;04:9979: 6E 00 00&nbsp; ROR $0000 = #$47&nbsp;04:997C: 70 00&nbsp; &nbsp;&nbsp; BVS $997E&nbsp;04:997E: 74&nbsp; &nbsp; &nbsp; &nbsp; UNDEFINED&nbsp;04:997F: 71 72&nbsp; &nbsp;&nbsp; ADC ($72),Y @ $0000 = #$47&nbsp;04:9981: 75 76&nbsp; &nbsp;&nbsp; ADC $76,X @ $007A = #$00&nbsp;04:9983: 73&nbsp; &nbsp; &nbsp; &nbsp; UNDEFINED&nbsp;04:9984: 00&nbsp; &nbsp; &nbsp; &nbsp; BRK```Hovering the first line we see the rom offset is 0x1197b.&nbsp; That&#039;s the file offset where the top left part of the cross is.You can do this for the USA rom now with the top of the church and find the area close to where it would be.&nbsp; I can tell you they didn&#039;t just blank out the cross, it&#039;s removed, so you have to figure it out and find some space, but this should help.EDIT: code tags</blockquote>

[QUOTE="SpiderDave, post: 97, member: 1105"] Ok so in fceux, open the jpn version, open up the nametable viewer and hover the top left tile of the cross. The PPU Address is 0x211c, the tile is 0x60. Using the debugger, set a breakpoint for 211c, write, ppu mem. Add a condition A==#60. Reset the game (still need to unpause after the reset too), it will stop when that tile is written to the PPU. Sometimes this is it, you can see right where it stops where it's grabbing data from. This game needs more. You can see where it stops with the line above here: ``` 07:C5D3: BD 00 06 LDA $0600,X @ $0689 = #$60 >07:C5D6: 8D 07 20 STA PPU_DATA = #$00 ``` So we see it's getting the tile from 0x689, which is just memory so it's processing it from somewhere else. So we set another breakpoint on 0689, write, CPU mem this time, condition A==#60. Reset/unpause the game and when it stops we see this: ``` 07:C6B5: AD B1 04 LDA $04B1 = #$60 07:C6B8: E8 INX >07:C6B9: 9D 00 06 STA $0600,X @ $0689 = #$30 ``` We see a few lines above that it's getting the tile from 0x4b1, still not the rom. Set another breakpoint for 04b1, write, CPU mem, condition A==#60 Reset/unpause and when it stops we have this: ``` 04:B890: B1 24 LDA ($24),Y @ $996B = #$60 >04:B892: 8D B1 04 STA $04B1 = #$00 ``` Now we see it's grabbing that tile from 0x996b. You can put that in the "Seek To" field and it will still be in the correct bank so we can see the rom address. Ignore the asm here, we know it's actually data. ``` 04:996B: 60 RTS ----------------------------------------- 04:996C: 61 62 ADC ($62,X) @ $0000 = #$47 04:996E: 63 UNDEFINED 04:996F: 00 BRK 04:9970: 67 UNDEFINED 04:9971: 00 BRK 04:9972: 6B UNDEFINED 04:9973: 68 PLA 04:9974: 69 6C ADC #$6C 04:9976: 6D 6A 00 ADC $006A = #$00 04:9979: 6E 00 00 ROR $0000 = #$47 04:997C: 70 00 BVS $997E 04:997E: 74 UNDEFINED 04:997F: 71 72 ADC ($72),Y @ $0000 = #$47 04:9981: 75 76 ADC $76,X @ $007A = #$00 04:9983: 73 UNDEFINED 04:9984: 00 BRK ``` Hovering the first line we see the rom offset is 0x1197b. That's the file offset where the top left part of the cross is. You can do this for the USA rom now with the top of the church and find the area close to where it would be. I can tell you they didn't just blank out the cross, it's removed, so you have to figure it out and find some space, but this should help. EDIT: code tags [/QUOTE]

Verification