code logs -> 2007 -> Sat, 17 Nov 2007< code.20071116.log - code.20071118.log >
--- Log opened Sat Nov 17 00:00:58 2007
00:14 You're now known as TheWatcher[T-2]
00:19 You're now known as TheWatcher[zZzZ]
00:25 mode/#code [+o Vornicus] by Vornicus
00:25
<@Vornicus>
http://www.squidi.net/three/index.php
01:31
<@Vornicus>
also, I have discovered that King Bounty's combat is not nearly so simple as I had thought.
01:32
<@Vornicus>
-- I'm getting creatures not dying when the model says they should be.
01:46
<@ToxicFrog>
To the disassembler!
01:54
<@Vornicus>
Very much so.
01:54 * Vornicus is glad he's working from the Mac version, because it's in 68k
01:55 * Kyrre offers Vorn a potion of seeing in the dark.
01:59
<@Vornicus>
...only problem, I don't seem to have a 68k disassembler floating around.
02:01
<@ToxicFrog>
IDA Pro will do 68k.
02:01
<@Vornicus>
IDA Pro is Windows only.
02:02
<@Vornicus>
...though I would have sworn ResEdit could disassemble. It's not doing that now, for some reason.
02:02
<@ToxicFrog>
...it is?
02:03
<@ToxicFrog>
Aah, it's windows and linux, but not OSX.
02:03
<@Vornicus>
It's certainly not available for Mac.
02:07
<@Vornicus>
Thing about it too is that 68k code in Mac apps are in the resource fork.
02:08
<@ToxicFrog>
It supports a terrifying quantity of file formats, so it may just be a matter of extracting that fork and feeding it to the disassembler.
02:08
<@ToxicFrog>
If there were a mac version.
02:08
<@Vornicus>
Right.
02:09
<@Vornicus>
I can get you hexdumps of the code segments (there are 9 of them).
02:09
<@Vornicus>
Or I can send you the resource fork as a binary file and let it figure it out; that might work.
02:10
<@ToxicFrog>
I don't have time!
02:10
<@Vornicus>
Can you take a hexdump, throw it at the disassembler, and send back the disassembly?
02:12
<@ToxicFrog>
Alright, although you definitely won't get cool stuff like the call graph and symbol table, and probably won't get the flow tracing arrows unless IDA has an export-to-PDF option I haven't seen yet.
02:17
<@Vornicus>
...where's my export button.
02:19
<@ToxicFrog>
Start with just the resource fork?
02:19
<@Vornicus>
okay. DCC?
02:19
<@ToxicFrog>
Sure.
02:20
<@Vornicus>
...hrm. that's not a very good thing.
02:20
<@ToxicFrog>
?
02:20
<@Vornicus>
Cannot access /Applications/Games/King's Bounty ?/KB.rsrc
02:20
<@Vornicus>
Looks like various things do not interpret folder names the same way, and it kinda broke
02:21
<@Vornicus>
There.
02:22
<@ToxicFrog>
Ok, it doesn't understand plain resource forks.
02:22
<@Vornicus>
okay.
02:22
<@ToxicFrog>
I'll need the individual code segments.
02:22 * Vornicus doesn't know the internal format either.
02:25
<@Vornicus>
That's the first segment, entirely hex'd. Hopefully that works.
02:27
<@ToxicFrog>
Hmm. What's a "Mac OS PEF Executable"?
02:27
<@ToxicFrog>
Because it groks those.
02:28
<@Vornicus>
PEF appears to be, uh, OSX.
02:28
<@ToxicFrog>
It has seperate listings for "OSX Executable" and "MacOS PEF Executable"
02:28
<@ToxicFrog>
Any idea where the entry point in this code block is?
02:28
<@ToxicFrog>
If any?
02:29
<@Vornicus>
No idea. I would say the very beginning, if any; this being the first segment, and looking at the stuff in it it's very regular, it almost looks like loader code.
02:30
<@Vornicus>
Okay, I believe PEF is a "carbon" application. PEF would have the code in the data fork, and would be PPC.
02:30
<@ToxicFrog>
Aah.
02:30
<@ToxicFrog>
Hmm. I think I need to convert this from hex to binary.
02:31
<@ToxicFrog>
Or possibly to S19, if I can remember how.
02:34
<@ToxicFrog>
My script works! I just trashed my terminal!
02:34
<@Vornicus>
fly.
02:35
<@ToxicFrog>
And shift in/shift out don't seem to be working right.
02:35 * ToxicFrog raids the DEC VT100 docs
02:35
<@Vornicus>
awesomesauce.
02:36
<@ToxicFrog>
IF I can find my bookmarks for them...
02:39
<@ToxicFrog>
Oh wait, it wasn't working because I was misreading the spec.
02:39 * ToxicFrog sends a real SI, gets his terminal back.
02:39
<@Vornicus>
what'd you do?
02:39
<@ToxicFrog>
I was sending ENQ and ACK.
02:40
<@Vornicus>
uh...huh.
02:42
<@ToxicFrog>
(I was reading the "hex code" column as the "control code" column, so SO and SI come out as ^E and ^F rather than ^N and ^O)
02:44
<@ToxicFrog>
Hmm. Starting from the beginning, it gets 48 bytes in and then hits something that can't be interpreted as a valid instruction.
02:44
<@ToxicFrog>
ori x6, btst, ori, bchg, move.w, _LoadSeg, bchg, move.w, _LoadSeg
02:45
<@ToxicFrog>
Hate variable-width instruction sets so much.
02:45
<@Vornicus>
I didn't think 68k was variable-width.
02:46
<@ToxicFrog>
Most of the instructions are 4 bytes, but bchg and _LoadSeg are 2 each
02:46
<@Vornicus>
ah
02:47
<@ToxicFrog>
So I can't just say "interpret every 4-byte word as an instruction, and leave the ones you don't understand as dc.b", since the point you start disassembly from affects things.
02:48
<@ToxicFrog>
It also can't properly create cross references without knowing where it's loaded into memory, but that's a lesser detail.
02:48
<@Vornicus>
There's also a Genesis version of KB, which may be easier to manipulate.
02:50
<@ToxicFrog>
Hmm. I don't think I ever disassembled any Genesis games.
02:50
<@ToxicFrog>
My S3K hackery was done with a hex editor and a lot of notes on the sound format.
02:51
<@Vornicus>
Ten bucks it's easier than the Mac version - you own the machine completely.
02:51
<@Vornicus>
And you're not fucking with external libs, either.
02:52
<@ToxicFrog>
And it's also a 68K processor, right?
02:52
<@Vornicus>
gnarg. I wish I could run IDA, then I could do this myself.
02:52
<@ToxicFrog>
So the only potential problem would be wacky ROM formats.
02:52
<@ToxicFrog>
Like SNES interleaved.
02:52
<@Vornicus>
Yeah.
02:52
<@ToxicFrog>
If it's a linear dump and I know the address it's mapped into, and there's no half-filled bank wackiness like the SNES, it's easy.
02:53
<@Vornicus>
half-filled bank wachiness?
02:54
<@ToxicFrog>
Err. s/bank/page
02:54
<@Vornicus>
Same question?
02:54
<@ToxicFrog>
IF you have a page's worth of data in the ROM, this is loaded into the lower halves of page n and page n+1 in memory
02:54
<@ToxicFrog>
Or upper half, depending on the cart type.
02:54
<@Vornicus>
:/
02:54
<@Vornicus>
That doesn't sound very sensical.
02:54
<@ToxicFrog>
And the half that the ROM isn't mapped into is RAM.
02:54
<@ToxicFrog>
So each page of memory is half ROM, half RAM.
02:55
<@ToxicFrog>
There's probably some mostly-reasonable explanation buried in the way the SNES MMU works.
02:56
<@Vornicus>
Possibly.
02:56
<@ToxicFrog>
Like, the page lines and address lines are seperate, and only the address lines can control whether it goes to ROM or RAM, so they dedicated the top bit of the address lines to that purpose.
02:56
<@ToxicFrog>
Etc.
03:00 * ToxicFrog experiments with Phantasy Star IV
03:02
<@ToxicFrog>
The Genesis gets a cookie.
03:02
<@ToxicFrog>
The ROM is linearly mapped starting at $000000, SP is loaded from $000000 and PC from $000004
03:02
<@Vornicus>
SP and PC?
03:03
<@ToxicFrog>
Stack pointer, program counter.
03:05
<@Vornicus>
aha
03:06
<@ToxicFrog>
And PC here is $000220
03:06
<@ToxicFrog>
Convert To Code!
03:08
<@ToxicFrog>
Dear god.
03:08
<@Vornicus>
?
03:08
<@ToxicFrog>
This thing has 27 functions it can locate, but scattered throughout the ROM with vast expanses of undisassembled data between them.
03:09
<@ToxicFrog>
This implies that there's some it can't find.
03:09
<@Vornicus>
that seems, uh, wrong
03:09
<@ToxicFrog>
Probably because it's calling them through pointers or something.
03:10
<@Vornicus>
ah, that's more sensical.
03:11
<@ToxicFrog>
Let's try something other than PS4.
03:11
<@ToxicFrog>
Like...Ristar.
03:11
<@Vornicus>
heh
03:12
<@Vornicus>
I remember wandering the FF7 filesystem once.
03:12
<@Vornicus>
It was mass insanity; each spell and summon was its own program.
03:12
<@ToxicFrog>
This one starts at $000206
03:12
<@Vornicus>
Convert To Code!
03:12
<@ToxicFrog>
Awesomesauce: I can right-click on $000004, hit "convert to 32-bit word", and it realizes it's a pointer within ROM bounds and converts it to a symbol.
03:13
<@ToxicFrog>
Upon which I can double-click to jump to that location.
03:13
<@Vornicus>
...okay I really need to get a PC, just for this program.
03:14
<@ToxicFrog>
And then I hit N (rename), "main", f (make function)
03:14
<@Vornicus>
heh.
03:14
<@ToxicFrog>
Interesting. This main is very, very similar to the PS4 one.
03:14
<@ToxicFrog>
I wonder if this is some standard boilerplate loader from the Genesis SDK.
03:14
<@ToxicFrog>
And we have the same problem, too. Gnar.
03:14
<@Vornicus>
That doesn't surprise me too much.
03:14
<@Vornicus>
:(
03:15
<@McMartin>
IDA Pro?
03:15
<@ToxicFrog>
Yep.
03:16
<@McMartin>
TF: See also Sega vs. Accolade, regarding boilerplate loaders, and what happens when you sue people for reverse-engineering them.
03:16 * ToxicFrog nods
03:16
<@ToxicFrog>
That's not the part I'm REing, though.
03:17
<@ToxicFrog>
I'm starting from the soft-reset entry point rather than the BIOS-invoked loader.
03:17
<@McMartin>
Ah.
03:17
<@McMartin>
I wish IDA Pro didn't cost more than my actual computer.
03:18
<@ToxicFrog>
I note that the free version does all this stuff too, it's just that it only supports 80x86.
03:18
<@McMartin>
Well, yes, but that does me no good for the Gradius Diasassembly Project.
03:19
<@ToxicFrog>
As for the rest, arrrrrrr ??
03:19
<@McMartin>
zomg work~
03:19
<@ToxicFrog>
Starflight uses the same main() and has the same issues with disassembly.
03:19
<@McMartin>
Gradius's opening code was funny.
03:19
<@McMartin>
First it checked a bunch of RAM locations for magic values, then it set the locations to those values
03:20
<@ToxicFrog>
...oh wait, no it doesn't.
03:20
<@McMartin>
Thus distinguishing between Power On and Reset.
03:20
<@ToxicFrog>
It's decoded a good fifth of the ROM as near-solid code.
03:20
<@McMartin>
LolPC
03:20
<@Vornicus>
That sounds about right.
03:21
<@McMartin>
If Flight of the Hummingbird weren't my current side project, I'd go back to making sense of my Gradius disassembly
03:21 * McMartin used a bunch of Python scripts to handle Convert To Code and new entry points
03:22
<@ToxicFrog>
Vornicus: got a copy of the KB ROM kicking around?
03:22
<@Vornicus>
Not on me, searching.
03:22
<@McMartin>
Gradius used this horrific hack involving popping the return address off the stack and not putting it back to do virtual dispatch.
03:23
<@Vornicus>
McM: ;_;
03:23
<@McMartin>
Well, it means you have a new pseudoop, basically:
03:23
<@McMartin>
JSR (routine), address 1, address 2, address 3, address 4...
03:23
<@McMartin>
And that's your jump table after the JSR.
03:23
<@McMartin>
Indexed by one of the registers
03:23
<@Vornicus>
Catch.
03:23
<@McMartin>
(What's KB?)
03:23
<@Vornicus>
King's Bounty
03:25
<@ToxicFrog>
Oh dear.
03:25
<@ToxicFrog>
SMD has headers.
03:25
<@McMartin>
SMD?
03:25
<@Vornicus>
SMD being a format of Genesis ROM dump
03:25
<@McMartin>
Ah.
03:25
<@Vornicus>
Being specifically the format of the ROM I just sent TF.
03:25
<@McMartin>
iNES has famously awful headers, but the replacement is if anything worse.
03:26
<@ToxicFrog>
Aha, emuparadise as a BIN.
03:29 Syloqs-AFH [Syloq@Admin.Nightstar.Net] has quit [Connection reset by peer]
03:30
<@ToxicFrog>
Dammit, "generate HTML" doesn't create in-page links between symbols.
03:30
<@McMartin>
Damn you, TF
03:30
<@McMartin>
Now I want to go back to my Gradius project.
03:34
<@ToxicFrog>
^.^
03:35
<@ToxicFrog>
Hmm. Vorn. Xref offsets: do you want them as label+offset, or as absolute addresses?
03:37
<@Vornicus>
Label + Offset is "it's 200 bytes away from here", right?
03:38
<@ToxicFrog>
200 bytes away from something
03:38
<@ToxicFrog>
Eg, "main+10" indicates it's 0x10 bytes from the start of main
03:38
<@Vornicus>
okay, give me that one.
03:38
<@ToxicFrog>
Whereas with absolute, it would say ROM:00000210
03:39
<@McMartin>
http://www.stanford.edu/~mcmartin/regradius-wip.txt
03:41
<@McMartin>
I like how the Gradius ROM appears to start with a revision control string.
03:42 * ToxicFrog pokepokepokes Vornicus
03:43
<@ToxicFrog>
If you don't connect the sockets will get cold!
03:44
<@ToxicFrog>
Oh. Also, the terminal specs I mentioned earlier: http://bjhttp://bjh21.me.uk/all-escapes/all-escapes.txth21.me.uk/all-escapes/all -escapes.txt
03:44
<@ToxicFrog>
Er
03:44
<@ToxicFrog>
http://bjh21.me.uk/all-escapes/all-escapes.txt
03:44
<@Vornicus>
Thankies
03:45
<@ToxicFrog>
They timed out, I'll re-send
03:45
<@Vornicus>
ok
03:45
<@ToxicFrog>
...
03:45
<@ToxicFrog>
Those sizes were in kilobytes?
03:45
<@ToxicFrog>
Ok, one moment while I toss them through bzip2.
03:46
<@Vornicus>
...meep
03:47
<@ToxicFrog>
75,727 - 75K, right? No, it's a 75MB HTML page.
03:47
<@ToxicFrog>
No wonder it took noticeable time to load.
03:47
<@Vornicus>
Heh
03:50
<@ToxicFrog>
This could take a while.
03:50
<@Vornicus>
heh.
03:50
<@ToxicFrog>
15825 ben 20 0 9116 6912 380 R 97 0.2 4:07.98 bzip2
03:50
<@ToxicFrog>
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
03:51
<@ToxicFrog>
...bzip2 terrifies me sometimes.
03:51
<@Vornicus>
?
03:52
<@ToxicFrog>
How's a 70:1 compression ratio grab you?
03:52
<@Vornicus>
03:52
<@Vornicus>
That's Holy Crap with a side of Damn.
03:54
<@ToxicFrog>
Oh, sorry, it's only 57:1.
03:54
<@Vornicus>
Still.
03:54
<@ToxicFrog>
Yeah.
03:57
<@McMartin>
Hey, someone with Gradius. Quick check to the default high score?
03:58
<@Vornicus>
50000
03:59
<@McMartin>
Sweet, I found the memory location that holds the high score, I think.
03:59
<@McMartin>
$07E0-$07E1, in BCD, divided by 10.
03:59
<@McMartin>
Possibly goes further than that.
04:05
<@Vornicus>
Probably. I'm seeing 7 digits.
04:09
<@McMartin>
During reset, it writes #$50 to $07E1.
04:09
<@McMartin>
Probably $07E0-$07E2.
04:10
<@McMartin>
The routine starting at $EC4C is a pure nightmare.
04:14 Thaqui [~Thaqui@Nightstar-12017.jetstream.xtra.co.nz] has left #code [Leaving]
04:16
<@McMartin>
http://www.stanford.edu/~mcmartin/regradius-wip.txt
04:23
<@Vornicus>
Why "regradius" anyway?
04:23
<@ToxicFrog>
reverse engineering gradius
04:24
<@McMartin>
Also "regrade".
04:25 * McMartin reuploads, having worked out where the interrupt handlers are and the top-level of what the do
04:25
<@McMartin>
Of course, for IRQ, that's "nothing".
04:28
<@McMartin>
The Virtual Dispatch call is at $83EE.
04:29
<@McMartin>
s/call/implementation/
05:29 Syloq [Syloq@Admin.Nightstar.Net] has joined #code
05:30 Syloq is now known as Syloqs-AFH
05:32 * McMartin bludgeons Subversion, makes it accept I7 projects.
05:33
<@Vornicus>
I7s are iirc big folders?
05:33
<@Vornicus>
(which in OSX have the bundle bit set so they look like single files in many circumstances)
05:48
<@McMartin>
Yes.
05:48
<@McMartin>
In the big folder, two files matter.
05:48
<@McMartin>
And one of them, to play nice with the IDE, needs CR linefeeds.
05:48
<@McMartin>
Not CRLF.
05:48
<@McMartin>
CR.
05:48
<@McMartin>
So, eol-style can handle it but doesn't by default.
05:49
<@McMartin>
(uuid.txt, Source/source.ni, and then the Build/ and Index/ folders need to exist but their contents may be unversioned.)
05:49 * McMartin also spells FOUNDATION and SECRETIVE for massive damage.
05:49
<@Vornicus>
I think I need to play Bookworm Adventures.
05:50
<@McMartin>
Is there a Mac version?
05:50
<@Vornicus>
No.
05:50
<@McMartin>
;_;.
05:50
<@McMartin>
It's even largely written in Lua.
05:50
<@McMartin>
Since it doesn't work in Wine and gives Lua errors. =P
05:50
<@Vornicus>
heh
05:58 * McMartin has given up on TADS 3.
05:58
<@Vornicus>
why?
05:58
<@McMartin>
Amount of work per reward is insufficient.
05:59
<@McMartin>
I've found one thing it does more conveniently than I7, I think.
05:59
<@McMartin>
And it's not remotely enough.
06:04 Vornicus is now known as Vornicus-Latens
07:10 GeekSoldier|bed [~Rob@Nightstar-4505.pools.arcor-ip.net] has quit [Ping Timeout]
07:41 You're now known as TheWatcher
07:50 GeekSoldier|bed [~Rob@Nightstar-3304.pools.arcor-ip.net] has joined #code
07:53 Attilla [~The.Attil@194.72.70.ns-11849] has quit [Ping Timeout]
08:01 Attilla [~The.Attil@194.72.70.ns-11849] has joined #code
08:15 GeekSoldier|bed is now known as GeekSoldier
08:29 You're now known as TheWatcher[pool]
09:25 AnnoDomini [AnnoDomini@Nightstar-28842.neoplus.adsl.tpnet.pl] has quit [Quit: There is no Dana, only Zuul.]
09:28 AnnoDomini [AnnoDomini@Nightstar-28842.neoplus.adsl.tpnet.pl] has joined #Code
09:28 mode/#code [+o AnnoDomini] by ChanServ
10:09 Forj [~Forj@Nightstar-10789.ue.woosh.co.nz] has quit [Quit: Gone]
10:33 You're now known as TheWatcher
12:28 Attilla [~The.Attil@194.72.70.ns-11849] has quit [Quit: <Insert Humorous and/or serious exit message here>]
12:42 GeekSoldier [~Rob@Nightstar-3304.pools.arcor-ip.net] has quit [Connection reset by peer]
12:47 GeekSoldier [~Rob@Nightstar-3304.pools.arcor-ip.net] has joined #code
13:04 * AnnoDomini frowns.
13:04
<@AnnoDomini>
What does a TEST instruction usually do in assembler?
13:06
<@AnnoDomini>
I'm talking about a "TEST ACC,Data".
13:07
<@AnnoDomini>
Nevermind. Found it.
13:46 gnolam [lenin@Nightstar-10613.8.5.253.static.se.wasadata.net] has joined #Code
13:47 mode/#code [+o gnolam] by ChanServ
14:37 Reiver is now known as ReivZzz
15:54 GeekSoldier [~Rob@Nightstar-3304.pools.arcor-ip.net] has quit [Ping Timeout]
16:00 GeekSoldier [~Rob@Nightstar-3304.pools.arcor-ip.net] has joined #code
16:40 GeekSoldier [~Rob@Nightstar-3304.pools.arcor-ip.net] has quit [Ping Timeout]
16:54 GeekSoldier [~Rob@Nightstar-6216.pools.arcor-ip.net] has joined #code
17:04 You're now known as TheWatcher[afk]
17:05 GeekSoldier is now known as GeekSoldier|gone
17:14 Chalcedon [~Chalcedon@Nightstar-10789.ue.woosh.co.nz] has joined #code
17:14 mode/#code [+o Chalcedon] by ChanServ
17:20 AnnoDomini [AnnoDomini@Nightstar-28842.neoplus.adsl.tpnet.pl] has quit [Ping Timeout]
17:21 AnnoDomini [AnnoDomini@Nightstar-28965.neoplus.adsl.tpnet.pl] has joined #Code
17:21 mode/#code [+o AnnoDomini] by ChanServ
18:13 AnnoDomini is now known as MCGrammar
18:50 You're now known as TheWatcher
19:50 Forj [~Forj@Nightstar-10789.ue.woosh.co.nz] has joined #code
19:50 mode/#code [+o Forj] by ChanServ
19:55 You're now known as TheWatcher[afk]
20:07 Forj [~Forj@Nightstar-10789.ue.woosh.co.nz] has quit [Connection reset by peer]
20:10 Forj [~Forj@Nightstar-10789.ue.woosh.co.nz] has joined #code
20:10 mode/#code [+o Forj] by ChanServ
21:21 Vornicus-Latens is now known as Vornicus
23:36 GeekSoldier|gone is now known as GeekSoldier|bed
23:53 You're now known as TheWatcher
--- Log closed Sun Nov 18 00:00:05 2007
code logs -> 2007 -> Sat, 17 Nov 2007< code.20071116.log - code.20071118.log >