Instantly share code, notes, and snippets.

What would you like to do?
Some Vertical Force reverse-engineering notes
- Lots of things seem to be indexed with r4; looks like it's always 0x05008000
- This is consistent with the "global data pointer" info in the tech scroll
- Looks like the offset into this mem is always negative
- Known globals (as negative offsets from r4):
-1402 (0x05007a86) - Effective OBJ group 3 ptr
Routine that hits obj group ptr's (occurs once per frame)
- r6 = data pointer. Appears to be 0x05007a80 every time (I believe this is only called from the code below).
- Looks like this just copies the 8 bytes starting at r6 into the OBJ group ptr reg's
0x070007e8 c0bf0600 movhi 0x6, r0, r30
0x070007ec dea300f8 movea 0xf800, r30, r30 // r30 = 0x0005f800
0x070007f0 26c40000 ld.h 0[r6], r1 // r6 + 0 = 0x05007a80 <- these are the effective group ptr reg's then
0x070007f4 3ef44800 out.h 72[r30], r1 // OBJ group 0 ptr
0x070007f8 26c40200 ld.h 2[r6], r1 // r6 + 2 = 0x05007a82
0x070007fc 3ef44a00 out.h 74[r30], r1 // OBJ group 1 ptr
0x07000800 26c40400 ld.h 4[r6], r1 // r6 + 4 = 0x05007a84
0x07000804 3ef44c00 out.h 76[r30], r1 // OBJ group 2 ptr
0x07000808 26c40600 ld.h 6[r6], r1 // r6 + 6 = 0x05007a86
0x0700080c 3ef44e00 out.h 78[r30], r1 // OBJ group 3 ptr
0x07000810 1f18 jmp [r31]
0x0701be6c: Routine called from VIP irq that eventually touches obj group 3 ptr at least (occurs once per frame)
0x0701be6c 7c44 add 28, r3
0x0701be6e e3df0000 st.w 0[r3], r31
// If byte at r4-24778 != 0
0x0701be72 44c1369f ld.b -24778[r4], r10
0x0701be76 400d cmp r0, r10
0x0701be78 7684 bz 0x76 (0x0701beee)
// {
0x0701be7a feafde44 jal 66995422 (0x07000358)
// If currently drawing to framebuffers ((0x0005F840 & 0x000c) != 0)
0x0701be7e 60bd0600 movhi 0x6, r0, r11
0x0701be82 6ba140f8 movea 0xf840, r11, r11
0x0701be86 4bc50000 ld.h 0[r11], r10
0x0701be8a 4ab50c00 andi 0xc, r10, r10
0x0701be8e 1084 bz 0x10 (0x0701be9e)
// {
// If not, set 0x0005f842 to 1 (disable/reset drawing)
0x0701be90 60bd0600 movhi 0x6, r0, r11
0x0701be94 6ba142f8 movea 0xf842, r11, r11
0x0701be98 2140 mov 1, r1
0x0701be9a 2bd40000 st.h 0[r11], r1
// }
// Drawing is assumed to be disabled from here on out
0x0701be9e ffaf62a6 jal 67085922 (0x07016500)
0x0701bea2 feaffa41 jal 66994682 (0x0700009c)
// If halfword at r4-1400 == 3
0x0701bea6 44c588fa ld.h -1400[r4], r10
0x0701beaa 434d cmp 3, r10
0x0701beac 2694 bnz 0x26 (0x0701bed2)
// {
0x0701beae c4a080fa movea 0xfa80, r4, r6
0x0701beb2 feaf3649 jal 66996534 (0x070007e8) // call updateGroupPtrRegs
0x0701beb6 c4a080da movea 0xda80, r4, r6
0x0701beba e0bc0400 movhi 0x4, r0, r7
0x0701bebe e7a000e0 movea 0xe000, r7, r7
// r8 = (Halfword 0x05007a86 (effective OBJ group 3 ptr) + 1) * 2
0x0701bec2 04c586fa ld.h -1402[r4], r8
0x0701bec6 0145 add 1, r8
0x0701bec8 0151 shl 1, r8
0x0701beca 00ac7600 jal 118 (0x0701bf40)
0x0701bece 04d488fa st.h -1400[r4], r0
0x0701bed2 44c1cbfa ld.b -1333[r4], r10
0x0701bed6 414d cmp 1, r10
0x0701bed8 0e94 bnz 0xe (0x0701bee6)
0x0701beda c4a0b5fa movea 0xfab5, r4, r6
0x0701bede feaf8a48 jal 66996362 (0x07000768)
// }
0x0701bee2 04d0cbfa st.b -1333[r4], r0
0x0701bee6 ffaf52c3 jal 67093330 (0x07018238)
0x0701beea feaffe49 jal 66996734 (0x070008e8)
// }
0x0701beee e3cf0000 ld.w 0[r3], r31
0x0701bef2 6444 add 4, r3
0x0701bef4 1f18 jmp [r31]
0x07001944: VIP irq (occurs once per frame, exact condition probably not important)
0x07001944 63a4b4ff addi 0xffb4, r3, r3
0x07001948 e3df0000 st.w 0[r3], r31
0x0700194c c3df0400 st.w 4[r3], r30
0x07001950 2074 stsr r1, eipc
0x07001952 23dc0800 st.w 8[r3], r1
0x07001956 2174 stsr r1, eipsw
0x07001958 23dc0c00 st.w 12[r3], r1
0x0700195c 2574 stsr r1, psw
0x0700195e 23dc1000 st.w 16[r3], r1
0x07001962 c3dc1400 st.w 20[r3], r6
0x07001966 e3dc1800 st.w 24[r3], r7
0x0700196a 03dd1c00 st.w 28[r3], r8
0x0700196e 23dd2000 st.w 32[r3], r9
0x07001972 43dd2400 st.w 36[r3], r10
0x07001976 63dd2800 st.w 40[r3], r11
0x0700197a 83dd2c00 st.w 44[r3], r12
0x0700197e a3dd3000 st.w 48[r3], r13
0x07001982 c3dd3400 st.w 52[r3], r14
0x07001986 e3dd3800 st.w 56[r3], r15
0x0700198a 03de3c00 st.w 60[r3], r16
0x0700198e 23de4000 st.w 64[r3], r17
0x07001992 43de4400 st.w 68[r3], r18
0x07001996 63de4800 st.w 72[r3], r19
0x0700199a 60bd0600 movhi 0x6, r0, r11
0x0700199e 6ba100f8 movea 0xf800, r11, r11
0x070019a2 4be50000 in.h 0[r11], r10
0x070019a6 44d52c9f st.h -24788[r4], r10
0x070019aa 44c52c9f ld.h -24788[r4], r10
0x070019ae 4ab50400 andi 0x4, r10, r10
0x070019b2 1c84 bz 0x1c (0x070019ce)
0x070019b4 c440 mov 4, r6
0x070019b6 ffafdaee jal 67104474 (0x07000890)
0x070019ba 44c1ccfa ld.b -1332[r4], r10
0x070019be 400d cmp r0, r10
0x070019c0 0e84 bz 0xe (0x070019ce)
0x070019c2 c4a0c7fa movea 0xfac7, r4, r6
0x070019c6 ffafaae9 jal 67103146 (0x07000370)
0x070019ca 04d0ccfa st.b -1332[r4], r0
0x070019ce 44c52c9f ld.h -24788[r4], r10
0x070019d2 4ab50800 andi 0x8, r10, r10
0x070019d6 2284 bz 0x22 (0x070019f8)
0x070019d8 c840 mov 8, r6
0x070019da ffafb6ee jal 67104438 (0x07000890)
0x070019de 40bd0005 movhi 0x500, r0, r10
0x070019e2 4aa1907b movea 0x7b90, r10, r10
0x070019e6 6acd0000 ld.w 0[r10], r11
0x070019ea 6145 add 1, r11
0x070019ec 6add0000 st.w 0[r10], r11
0x070019f0 04d0369f st.b -24778[r4], r0
0x070019f4 ffafd0ec jal 67103952 (0x070006c4)
0x070019f8 44c52c9f ld.h -24788[r4], r10
0x070019fc 4ab50040 andi 0x4000, r10, r10
0x07001a00 1484 bz 0x14 (0x07001a14)
0x07001a02 c0a00040 movea 0x4000, r0, r6
0x07001a06 ffaf8aee jal 67104394 (0x07000890)
0x07001a0a 4141 mov 1, r10
0x07001a0c 44d1369f st.b -24778[r4], r10
0x07001a10 01ac5ca4 jal 107612 (0x0701be6c) // <- This is the call that ends up hitting the obj pointer reg's eventually (at least for group 3)
0x07001a14 63ce4800 ld.w 72[r3], r19
0x07001a18 43ce4400 ld.w 68[r3], r18
0x07001a1c 23ce4000 ld.w 64[r3], r17
0x07001a20 03ce3c00 ld.w 60[r3], r16
0x07001a24 e3cd3800 ld.w 56[r3], r15
0x07001a28 c3cd3400 ld.w 52[r3], r14
0x07001a2c a3cd3000 ld.w 48[r3], r13
0x07001a30 83cd2c00 ld.w 44[r3], r12
0x07001a34 63cd2800 ld.w 40[r3], r11
0x07001a38 43cd2400 ld.w 36[r3], r10
0x07001a3c 23cd2000 ld.w 32[r3], r9
0x07001a40 03cd1c00 ld.w 28[r3], r8
0x07001a44 e3cc1800 ld.w 24[r3], r7
0x07001a48 c3cc1400 ld.w 20[r3], r6
0x07001a4c 23cc1000 ld.w 16[r3], r1
0x07001a50 2570 ldsr r1, psw
0x07001a52 23cc0c00 ld.w 12[r3], r1
0x07001a56 2170 ldsr r1, eipsw
0x07001a58 23cc0800 ld.w 8[r3], r1
0x07001a5c 2070 ldsr r1, eipc
0x07001a5e c3cf0400 ld.w 4[r3], r30
0x07001a62 e3cf0000 ld.w 0[r3], r31
0x07001a66 63a44c00 addi 0x4c, r3, r3
0x07001a6a 23cc0000 ld.w 0[r3], r1
0x07001a6e 6444 add 4, r3
0x07001a70 0064 reti
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment