This document is intended to document certain inner workings of the CPU.
There have been efforts by emu-russia and gekkio to have the CPU decapped, and so we have the decode ROM accessible to us. This means, that we know exactly what each opcode does (besides some nuanced behavior related to HALT, STOP, and some state management related to interrupts and power saving which are hard to untangle).
Pokémon Battle Revolution had an issue where certain effects (those that distort the camera) caused the entire screen to shift slightly.
This writeup mainly analyzes the psycho cut fifolog (from issue 12629, though the actual issue is described in issue 11875).
All of the effects work using indirect textures. First, the game draws the main environment (see ZPBR_Psy_base_new.png and ZPBR_Rain_base_new.png). Then, it makes an EFB copy, and clears the screen (but not the depth buffer). It then draws a second effect, which will serve as an offset to the screen (see ZPBR_Psy_indirect.png and ZPBR_Rain_indirect.png). This might be drawn in 3D space (as with the energy pattern used by Psycho Cut) or it might be drawn in 2D
The fifolog in question is ea-pink, downloadable here, which shows gameplay from EA Sports Active. There are several oddities with how this is rendered; for instance, it is rendered in two halves (vertically) and some objects are only rendered in one of the halves (this is best seen by using freelook), similar to nhl-slap (but that game does it to a greater extent). The game also renders a vignette (causing the edges of the image to be darker) and the hud after the broken effect. But it is that broken effect, resulting in everything being pink, that this document is about.
The broken effect is object 819 in that fifolog (numbered 842 with better-fifo-analyzer-part-3).
See https://gist.github.com/Pokechu22/f06db7a9f226d9b0c72507886d7a72ce for additional images as well a
| ASCII EQUS "␀\t\n \r !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz\{|}~" | |
| err: MACRO | |
| println "error: ", \1 | |
| ; print where the error occurred | |
| println " {src}" | |
| print " " | |
| rept src_i - 1 | |
| print "_" | |
| endr |
| import idaapi | |
| from idc import * | |
| logo = "CE ED 66 66 CC 0D 00 0B 03 73 00 83 00 0C 00 0D 00 08 11 1F 88 89 00 0E DC CC 6E E6 DD DD D9 99 BB BB 67 63 6E 0E EC CC DD DC 99 9F BB B9 33 3E".replace(" ", "").decode("hex") | |
| registers = { | |
| 0xFF00: "rJOYP", | |
| 0xFF01: "rSB", | |
| 0xFF02: "rSC", | |
| 0xFF04: "rDIV", |
[oxfoo1m3][crackme] is a relatively simple crackme with elements of anti-debugging, anti-disassembly, and, as the author put it, anti-libbfd.
I created a new Vagrant virtual machine, and after a bit of fiddling with shared folders, ran the binary:
vagrant@debian9:/vagrant/oxfoo1m3$ ./oxfoo1m3
oxfoo1m3 started ;]
3nt4 p455w0rD:
ABCDABCDABCD