Created
February 12, 2017 13:03
-
-
Save yupferris/f7a11c9bd48a69b1b8ff08719c1e5f9a to your computer and use it in GitHub Desktop.
Some Vertical Force reverse-engineering notes
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| - Lots of things seem to be indexed with r4; looks like it's always 0x05008000 | |
| - This is consistent with the "global data pointer" info in the tech scroll | |
| - Looks like the offset into this mem is always negative | |
| - Known globals (as negative offsets from r4): | |
| -1402 (0x05007a86) - Effective OBJ group 3 ptr | |
| Routine that hits obj group ptr's (occurs once per frame) | |
| - r6 = data pointer. Appears to be 0x05007a80 every time (I believe this is only called from the code below). | |
| - Looks like this just copies the 8 bytes starting at r6 into the OBJ group ptr reg's | |
| updateGroupPtrRegs: | |
| 0x070007e8 c0bf0600 movhi 0x6, r0, r30 | |
| 0x070007ec dea300f8 movea 0xf800, r30, r30 // r30 = 0x0005f800 | |
| 0x070007f0 26c40000 ld.h 0[r6], r1 // r6 + 0 = 0x05007a80 <- these are the effective group ptr reg's then | |
| 0x070007f4 3ef44800 out.h 72[r30], r1 // OBJ group 0 ptr | |
| 0x070007f8 26c40200 ld.h 2[r6], r1 // r6 + 2 = 0x05007a82 | |
| 0x070007fc 3ef44a00 out.h 74[r30], r1 // OBJ group 1 ptr | |
| 0x07000800 26c40400 ld.h 4[r6], r1 // r6 + 4 = 0x05007a84 | |
| 0x07000804 3ef44c00 out.h 76[r30], r1 // OBJ group 2 ptr | |
| 0x07000808 26c40600 ld.h 6[r6], r1 // r6 + 6 = 0x05007a86 | |
| 0x0700080c 3ef44e00 out.h 78[r30], r1 // OBJ group 3 ptr | |
| 0x07000810 1f18 jmp [r31] | |
| 0x0701be6c: Routine called from VIP irq that eventually touches obj group 3 ptr at least (occurs once per frame) | |
| 0x0701be6c 7c44 add 28, r3 | |
| 0x0701be6e e3df0000 st.w 0[r3], r31 | |
| // If byte at r4-24778 != 0 | |
| 0x0701be72 44c1369f ld.b -24778[r4], r10 | |
| 0x0701be76 400d cmp r0, r10 | |
| 0x0701be78 7684 bz 0x76 (0x0701beee) | |
| // { | |
| 0x0701be7a feafde44 jal 66995422 (0x07000358) | |
| // If currently drawing to framebuffers ((0x0005F840 & 0x000c) != 0) | |
| 0x0701be7e 60bd0600 movhi 0x6, r0, r11 | |
| 0x0701be82 6ba140f8 movea 0xf840, r11, r11 | |
| 0x0701be86 4bc50000 ld.h 0[r11], r10 | |
| 0x0701be8a 4ab50c00 andi 0xc, r10, r10 | |
| 0x0701be8e 1084 bz 0x10 (0x0701be9e) | |
| // { | |
| // If not, set 0x0005f842 to 1 (disable/reset drawing) | |
| 0x0701be90 60bd0600 movhi 0x6, r0, r11 | |
| 0x0701be94 6ba142f8 movea 0xf842, r11, r11 | |
| 0x0701be98 2140 mov 1, r1 | |
| 0x0701be9a 2bd40000 st.h 0[r11], r1 | |
| // } | |
| 0x0701be9e: | |
| // Drawing is assumed to be disabled from here on out | |
| 0x0701be9e ffaf62a6 jal 67085922 (0x07016500) | |
| 0x0701bea2 feaffa41 jal 66994682 (0x0700009c) | |
| // If halfword at r4-1400 == 3 | |
| 0x0701bea6 44c588fa ld.h -1400[r4], r10 | |
| 0x0701beaa 434d cmp 3, r10 | |
| 0x0701beac 2694 bnz 0x26 (0x0701bed2) | |
| // { | |
| 0x0701beae c4a080fa movea 0xfa80, r4, r6 | |
| 0x0701beb2 feaf3649 jal 66996534 (0x070007e8) // call updateGroupPtrRegs | |
| 0x0701beb6 c4a080da movea 0xda80, r4, r6 | |
| 0x0701beba e0bc0400 movhi 0x4, r0, r7 | |
| 0x0701bebe e7a000e0 movea 0xe000, r7, r7 | |
| // r8 = (Halfword 0x05007a86 (effective OBJ group 3 ptr) + 1) * 2 | |
| 0x0701bec2 04c586fa ld.h -1402[r4], r8 | |
| 0x0701bec6 0145 add 1, r8 | |
| 0x0701bec8 0151 shl 1, r8 | |
| 0x0701beca 00ac7600 jal 118 (0x0701bf40) | |
| 0x0701bece 04d488fa st.h -1400[r4], r0 | |
| 0x0701bed2 44c1cbfa ld.b -1333[r4], r10 | |
| 0x0701bed6 414d cmp 1, r10 | |
| 0x0701bed8 0e94 bnz 0xe (0x0701bee6) | |
| 0x0701beda c4a0b5fa movea 0xfab5, r4, r6 | |
| 0x0701bede feaf8a48 jal 66996362 (0x07000768) | |
| // } | |
| 0x0701bed2: | |
| 0x0701bee2 04d0cbfa st.b -1333[r4], r0 | |
| 0x0701bee6: | |
| 0x0701bee6 ffaf52c3 jal 67093330 (0x07018238) | |
| 0x0701beea feaffe49 jal 66996734 (0x070008e8) | |
| // } | |
| 0x0701beee: | |
| 0x0701beee e3cf0000 ld.w 0[r3], r31 | |
| 0x0701bef2 6444 add 4, r3 | |
| 0x0701bef4 1f18 jmp [r31] | |
| 0x07001944: VIP irq (occurs once per frame, exact condition probably not important) | |
| 0x07001944 63a4b4ff addi 0xffb4, r3, r3 | |
| 0x07001948 e3df0000 st.w 0[r3], r31 | |
| 0x0700194c c3df0400 st.w 4[r3], r30 | |
| 0x07001950 2074 stsr r1, eipc | |
| 0x07001952 23dc0800 st.w 8[r3], r1 | |
| 0x07001956 2174 stsr r1, eipsw | |
| 0x07001958 23dc0c00 st.w 12[r3], r1 | |
| 0x0700195c 2574 stsr r1, psw | |
| 0x0700195e 23dc1000 st.w 16[r3], r1 | |
| 0x07001962 c3dc1400 st.w 20[r3], r6 | |
| 0x07001966 e3dc1800 st.w 24[r3], r7 | |
| 0x0700196a 03dd1c00 st.w 28[r3], r8 | |
| 0x0700196e 23dd2000 st.w 32[r3], r9 | |
| 0x07001972 43dd2400 st.w 36[r3], r10 | |
| 0x07001976 63dd2800 st.w 40[r3], r11 | |
| 0x0700197a 83dd2c00 st.w 44[r3], r12 | |
| 0x0700197e a3dd3000 st.w 48[r3], r13 | |
| 0x07001982 c3dd3400 st.w 52[r3], r14 | |
| 0x07001986 e3dd3800 st.w 56[r3], r15 | |
| 0x0700198a 03de3c00 st.w 60[r3], r16 | |
| 0x0700198e 23de4000 st.w 64[r3], r17 | |
| 0x07001992 43de4400 st.w 68[r3], r18 | |
| 0x07001996 63de4800 st.w 72[r3], r19 | |
| 0x0700199a 60bd0600 movhi 0x6, r0, r11 | |
| 0x0700199e 6ba100f8 movea 0xf800, r11, r11 | |
| 0x070019a2 4be50000 in.h 0[r11], r10 | |
| 0x070019a6 44d52c9f st.h -24788[r4], r10 | |
| 0x070019aa 44c52c9f ld.h -24788[r4], r10 | |
| 0x070019ae 4ab50400 andi 0x4, r10, r10 | |
| 0x070019b2 1c84 bz 0x1c (0x070019ce) | |
| 0x070019b4 c440 mov 4, r6 | |
| 0x070019b6 ffafdaee jal 67104474 (0x07000890) | |
| 0x070019ba 44c1ccfa ld.b -1332[r4], r10 | |
| 0x070019be 400d cmp r0, r10 | |
| 0x070019c0 0e84 bz 0xe (0x070019ce) | |
| 0x070019c2 c4a0c7fa movea 0xfac7, r4, r6 | |
| 0x070019c6 ffafaae9 jal 67103146 (0x07000370) | |
| 0x070019ca 04d0ccfa st.b -1332[r4], r0 | |
| 0x070019ce 44c52c9f ld.h -24788[r4], r10 | |
| 0x070019d2 4ab50800 andi 0x8, r10, r10 | |
| 0x070019d6 2284 bz 0x22 (0x070019f8) | |
| 0x070019d8 c840 mov 8, r6 | |
| 0x070019da ffafb6ee jal 67104438 (0x07000890) | |
| 0x070019de 40bd0005 movhi 0x500, r0, r10 | |
| 0x070019e2 4aa1907b movea 0x7b90, r10, r10 | |
| 0x070019e6 6acd0000 ld.w 0[r10], r11 | |
| 0x070019ea 6145 add 1, r11 | |
| 0x070019ec 6add0000 st.w 0[r10], r11 | |
| 0x070019f0 04d0369f st.b -24778[r4], r0 | |
| 0x070019f4 ffafd0ec jal 67103952 (0x070006c4) | |
| 0x070019f8 44c52c9f ld.h -24788[r4], r10 | |
| 0x070019fc 4ab50040 andi 0x4000, r10, r10 | |
| 0x07001a00 1484 bz 0x14 (0x07001a14) | |
| 0x07001a02 c0a00040 movea 0x4000, r0, r6 | |
| 0x07001a06 ffaf8aee jal 67104394 (0x07000890) | |
| 0x07001a0a 4141 mov 1, r10 | |
| 0x07001a0c 44d1369f st.b -24778[r4], r10 | |
| 0x07001a10 01ac5ca4 jal 107612 (0x0701be6c) // <- This is the call that ends up hitting the obj pointer reg's eventually (at least for group 3) | |
| 0x07001a14 63ce4800 ld.w 72[r3], r19 | |
| 0x07001a18 43ce4400 ld.w 68[r3], r18 | |
| 0x07001a1c 23ce4000 ld.w 64[r3], r17 | |
| 0x07001a20 03ce3c00 ld.w 60[r3], r16 | |
| 0x07001a24 e3cd3800 ld.w 56[r3], r15 | |
| 0x07001a28 c3cd3400 ld.w 52[r3], r14 | |
| 0x07001a2c a3cd3000 ld.w 48[r3], r13 | |
| 0x07001a30 83cd2c00 ld.w 44[r3], r12 | |
| 0x07001a34 63cd2800 ld.w 40[r3], r11 | |
| 0x07001a38 43cd2400 ld.w 36[r3], r10 | |
| 0x07001a3c 23cd2000 ld.w 32[r3], r9 | |
| 0x07001a40 03cd1c00 ld.w 28[r3], r8 | |
| 0x07001a44 e3cc1800 ld.w 24[r3], r7 | |
| 0x07001a48 c3cc1400 ld.w 20[r3], r6 | |
| 0x07001a4c 23cc1000 ld.w 16[r3], r1 | |
| 0x07001a50 2570 ldsr r1, psw | |
| 0x07001a52 23cc0c00 ld.w 12[r3], r1 | |
| 0x07001a56 2170 ldsr r1, eipsw | |
| 0x07001a58 23cc0800 ld.w 8[r3], r1 | |
| 0x07001a5c 2070 ldsr r1, eipc | |
| 0x07001a5e c3cf0400 ld.w 4[r3], r30 | |
| 0x07001a62 e3cf0000 ld.w 0[r3], r31 | |
| 0x07001a66 63a44c00 addi 0x4c, r3, r3 | |
| 0x07001a6a 23cc0000 ld.w 0[r3], r1 | |
| 0x07001a6e 6444 add 4, r3 | |
| 0x07001a70 0064 reti |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment