{"id":1076,"date":"2016-10-29T22:56:18","date_gmt":"2016-10-29T21:56:18","guid":{"rendered":"http:\/\/blog.blockos.org\/?p=1076"},"modified":"2016-11-01T14:57:37","modified_gmt":"2016-11-01T13:57:37","slug":"final-match-sewashinasa-bijin","status":"publish","type":"post","link":"https:\/\/blog.blockos.org\/?p=1076","title":{"rendered":"Final Match Sewashinasa Bijin"},"content":{"rendered":"

Some times ago, some fellas from the Necstasy forum<\/a> discussed the fact that parts of Human Sports Festival<\/strong> can be extracted into standalone games. Human Sports Festival<\/strong> (or HSF<\/b> for the connoisseurs) is a sports compilation made of a Fine Shot Golf<\/strong>, Formation Soccer Human Cup 92<\/strong> and last but not least Final Match Tennis Ladies<\/strong>.
\n\"human-sports-festival-j-0000\"\"human-sports-festival-j-0003\"<\/p>\n

\"human-sports-festival-j-0005\"\"human-sports-festival-j-0006\"<\/p>\n

The first thing to do is to find the sectors where the game is stored and more importantly, is there any CD-ROM access during the game?
\nInstead of mindlessly put a breakpoint on the cd_read routine ($e009<\/b>), a less painful and efficient alternative is to use the mednafen logger. Press alt<\/b>+d<\/b> then alt<\/b>+4<\/b> to view it. Don’t forget to press T<\/b> to enable logging. The next screenshot shows what you get when you launch Final Match Tennis Ladies<\/b>
\n\"fmtl00\"<\/a>
\nHopefully nothing more shows up during the game. This means that the last read command loads the whole game. Let’s take a look at it.<\/p>\n

Read: start=0x000011c8(track=2, offs=0x000003c2), cnt=0x00000080<\/pre>\n
Remember that the offset and count refers to sectors. A sector being 2048 bytes long, we will open the 2nd track with our favorite hexadecimal editor (here bless<\/a>), jump to the offset 0x1e1000<\/b> (that is 0x3c2 * 2048) and dump the following 262144<\/b> bytes (0x80 * 2048). <\/p>\n
But it’s not over yet! We must take a look at what is done after the game is loaded in HSF<\/b> just in case we have to add the IRQ and other stuffs to make it work. Let’s check it!
\nFirst, we put a breakpoint on the cd_read<\/b> ($e009<\/b>) and painstakingly walk along it until we reach the rts<\/b> instruction and jump back to the calling code.
\n\"fmtl01\"<\/a>
\nWe land back at $2309<\/b>.
\n\"fmtl02\"<\/a>
\nThe whole routine in text form:<\/p>\n
\r\n22ef: sta $fc\r\n22f1: lda #$03\r\n22f3: sta $fd\r\n22f5: lda #$c2\r\n22f7: sta $fe\r\n22f9: lda #$06\r\n22fb: sta $ff\r\n22fd: lda $22d0\t\t; = 68\r\n2300: sta $fa\r\n2302: lda #$80\r\n2304: sta $f8\r\n\r\n2306: jsr $e009\r\n\r\n2309: and #$ff\r\n230b: bne $22ed\r\n\r\n230d: sei\r\n230e: lda #$ff\r\n2310: sta $1402\r\n2313: stz $0C01\r\n2316: jsr $e081\r\n2319: jsr $e087\r\n\r\n231c: cli\r\n231d: lda $22d0\r\n2320: tam #$80\r\n2322: jmp $e000\r\n<\/pre>\n
From $22ef<\/b> to $2304<\/b> the parameters to cd_read<\/b> is set. At $2306<\/b> cd_read<\/b> is called. What follows is very interesting. If no error occurred during the cd read, first the interrupts are disabled by calling sei<\/b> and setting all the bits of $1402<\/b> to 1<\/b>. The timer is disabled by setting $0C01<\/b> to 0<\/b>. Then $e081<\/b> (ex_rcroff<\/b>) and $e087<\/b> (ex_irqoff<\/b>) routines are called. Those 2 routines respectively disables system card hsync<\/b> and IRQ<\/b> handlers.
\nAfter that, the CD-ROM<\/b> RAM<\/b> bank where the game is stored is mapped to mpr #7<\/b>. Then we dive into the unknown by jumping to $e000<\/b>.
\nThere’s something important to note here. As the whole game data is stored in RAM and mapped to the mpr #7<\/b>, IRQ<\/b> vectors will be the one stored in RAM<\/b> and not the ones from the system card. That’s a pretty good news. We are not forced to butcher the ROM to force feed IRQ<\/b> vectors into it.
\nAs free cakes are always dubious, we will see what $e000<\/b> is made of.
\n\"fmtl03\"<\/a>
\nA simple jump to $e072<\/b>. Fantastic!
\nThis routine looks like a standard RESET<\/b> interrupt handler.
\n\"fmtl04\"<\/a><\/p>\n
Let’s test the extracted ROM<\/b>… Blimey! The screens is jogging. The controls are sloppy. And the game freezes after player selection.<\/p>\n
Oh mighty quick-tempered bearded fanciful overlord, why have you forsaken me?<\/p>\n
Let’s look back at the mednafen<\/b> debugger.
\n\"fmtl05\"<\/a>
\nWe see that SPD<\/b> (the CPU<\/b> speed mode) is set to 0<\/b>. The PC Engine<\/b> CPU<\/b> is in SLOW<\/b> mode.
\nIf we look at Final Match Tennis for cross-reference, we see that the CPU is in HI-SPEED<\/b> mode.
\n\"fmtl06\"<\/a><\/p>\n
We will have to find a place where we can safely put the necessary instruction to switch the CPU<\/b> to the required mode. $e074<\/b> is a relatively promising spot. <\/p>\n
\r\ne074: cla\r\ne075: sta $22d1\r\n<\/pre>\n
The cla\/sta<\/b> combo can be rewritten with a single stz<\/b>, leaving us with an extra byte where to put the csh<\/b> instruction that will set our CPU<\/b> at the correct speed.<\/p>\n
Another issue was reported by one of the good old chap from the necstasy forum. During a set, a soft reset (SEL<\/b>+RUN<\/b>) will crash the game. To keep things short and entertaining, instead of jumping to the RESET<\/b> IRQ<\/b> vector, it jumps to $22d6<\/b> in RAM<\/b>. That bugger is at $e027<\/b>.<\/p>\n
And voil\u00e0, you should be able to enjoy Final Match Tennis Ladies<\/b> on a HuCard<\/b>.
\nThe following IPS patch will fix the aforementioned issues on the extracted ROM<\/b>.<\/p>\n