commit
d8fbf80a4b
15 changed files with 1889 additions and 0 deletions
@ -0,0 +1,2 @@ |
|||||
|
My resources used to beat https://zzazzdzz.github.io/fools2019/ |
||||
|
No writeups or explanations provided. |
||||
@ -0,0 +1,98 @@ |
|||||
|
#include <stdlib.h> |
||||
|
#include <stdio.h> |
||||
|
#include <time.h> |
||||
|
#include <glib.h> |
||||
|
|
||||
|
int s03_A0F3 = 0x5D0B1C11; |
||||
|
int s03_A0F7 = 0x35E79125; |
||||
|
int s03_A0FB = 0x56596b10; |
||||
|
int s03_A0FF = 0x7FFFFB0A; |
||||
|
int s03_A103 = 0x1B080733; |
||||
|
|
||||
|
int s03_A107; |
||||
|
int s03_A10B; |
||||
|
int s03_A10D; |
||||
|
int s03_A10E; |
||||
|
|
||||
|
char buffer[0x200]; |
||||
|
|
||||
|
int main() |
||||
|
{ |
||||
|
FILE *f = fopen("fools.sav", "r"); |
||||
|
if (!f) { |
||||
|
perror("fopen"); |
||||
|
exit(1); |
||||
|
} |
||||
|
fseek(f, 0x6567, SEEK_SET); |
||||
|
fread(buffer, 1, 0x200, f); |
||||
|
fclose(f); |
||||
|
|
||||
|
GHashTable *hashtable = g_hash_table_new(g_direct_hash, g_direct_equal); |
||||
|
|
||||
|
double start = clock(); |
||||
|
do { |
||||
|
gint lcg = s03_A0F3 & 0xFFFFFE00; |
||||
|
gint cur_lcg = GPOINTER_TO_INT(g_hash_table_lookup(hashtable, GINT_TO_POINTER(lcg))); |
||||
|
cur_lcg += 1; |
||||
|
g_hash_table_replace(hashtable, GINT_TO_POINTER(lcg), GINT_TO_POINTER(cur_lcg)); |
||||
|
|
||||
|
s03_A0F3 = (s03_A0F3 * s03_A0F7 + s03_A0FB) & 0xFFFFFFFF; |
||||
|
|
||||
|
if (s03_A0FF % 0x100000 == 0) { |
||||
|
double framespers = 0x100000 / ((double)(clock() - start) / CLOCKS_PER_SEC); |
||||
|
unsigned eta = (double)(s03_A0FF) / framespers; |
||||
|
fprintf(stderr, "Progress: %d (speed: %.2f iter/s, ETA: %02u:%02u:%02u)\n", |
||||
|
s03_A0FF, framespers, |
||||
|
eta / 60 / 60, (eta / 60) % 60, eta % 60); |
||||
|
start = clock(); |
||||
|
} |
||||
|
} while (--s03_A0FF); |
||||
|
|
||||
|
int count = 0; |
||||
|
|
||||
|
GHashTableIter iter; |
||||
|
gpointer key, value; |
||||
|
g_hash_table_iter_init(&iter, hashtable); |
||||
|
while (g_hash_table_iter_next(&iter, &key, &value)) { |
||||
|
count += GPOINTER_TO_INT(value) % 2; |
||||
|
} |
||||
|
|
||||
|
int i = 0; |
||||
|
start = clock(); |
||||
|
g_hash_table_iter_init(&iter, hashtable); |
||||
|
while (g_hash_table_iter_next(&iter, &key, &value)) { |
||||
|
if (GPOINTER_TO_INT(value) % 2 == 0) { |
||||
|
continue; |
||||
|
} |
||||
|
|
||||
|
double framespers = 1 / ((double)(clock() - start) / CLOCKS_PER_SEC); |
||||
|
unsigned eta = (double)(count - i) / framespers; |
||||
|
fprintf(stderr, "Progress: %d/%d %.2f%% (speed: %.2f iter/s, ETA: %02u:%02u:%02u)\n", |
||||
|
i, count, (double)i / count * 100, framespers, |
||||
|
eta / 60 / 60, (eta / 60) % 60, eta % 60); |
||||
|
start = clock(); |
||||
|
i += 1; |
||||
|
|
||||
|
s03_A107 = s03_A103; |
||||
|
|
||||
|
s03_A10B = (GPOINTER_TO_INT(key) & 0xFF00) >> 8; |
||||
|
s03_A10D = (GPOINTER_TO_INT(key) & 0xFF0000) >> 16; |
||||
|
s03_A10E = (GPOINTER_TO_INT(key) & 0xFF000000) >> 24; |
||||
|
|
||||
|
int bufi = 0; |
||||
|
do { |
||||
|
s03_A10B = ((s03_A10B / 2) * s03_A10D + s03_A10E) & 0xFFFF; |
||||
|
buffer[bufi] ^= s03_A10B & 0xFF; |
||||
|
|
||||
|
if (++bufi >= 0x200) bufi = 0; |
||||
|
} while (--s03_A107); |
||||
|
} |
||||
|
|
||||
|
g_hash_table_destroy(hashtable); |
||||
|
|
||||
|
f = fopen("output.buf", "w"); |
||||
|
fwrite(buffer, 1, 0x200, f); |
||||
|
fclose(f); |
||||
|
|
||||
|
return 0; |
||||
|
} |
||||
@ -0,0 +1,38 @@ |
|||||
|
# Seed values (break at s03_A13A to fetch them) |
||||
|
s03_A0F3 = 0x5D0B1C11 # Match |
||||
|
s03_A0F7 = 0x35E79125 # Match |
||||
|
s03_A0FB = 0x56596b10 # Match |
||||
|
s03_A0FF = 0x7FFFFB0A # Match |
||||
|
s03_A103 = 0x1b080733 # Match |
||||
|
|
||||
|
file = open("fools.sav", "rb") |
||||
|
file.seek(0x6567) |
||||
|
buf = bytearray(file.read(0x200)) |
||||
|
file.close() |
||||
|
|
||||
|
while s03_A0FF != 0: |
||||
|
s03_A107 = s03_A103 |
||||
|
|
||||
|
s03_A10B = (s03_A0F3 & 0xFF00) >> 8 |
||||
|
s03_A10D = (s03_A0F3 & 0xFF0000) >> 16 |
||||
|
s03_A10E = (s03_A0F3 & 0xFF000000) >> 24 |
||||
|
|
||||
|
print(s03_A0FF - i_out) |
||||
|
|
||||
|
bufi = 0 |
||||
|
i = 0 |
||||
|
while s03_A107 != 0: |
||||
|
s03_A10B = ((s03_A10B // 2) * s03_A10D + s03_A10E) & 0xFFFF |
||||
|
buf[bufi] ^= (s03_A10B) & 0xFF |
||||
|
|
||||
|
bufi += 1 |
||||
|
if bufi >= 0x200: |
||||
|
bufi = 0 |
||||
|
|
||||
|
s03_A107 -= 1 |
||||
|
|
||||
|
s03_A0F3 = (s03_A0F3 * s03_A0F7 + s03_A0FB) & 0xFFFFFFFF |
||||
|
|
||||
|
s03_A0FF -= 1 |
||||
|
|
||||
|
file = open("output.buffer", "wb").write(buf) |
||||
@ -0,0 +1,222 @@ |
|||||
|
CopyDEtoHL_32bit: ; s03_A084 |
||||
|
; Copies value pointed to by de to hl |
||||
|
|
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
ret |
||||
|
|
||||
|
AddDEToHL_32bit: ; s03_A090 |
||||
|
; Adds value pointed to by de to value pointed to by hl |
||||
|
|
||||
|
ld a, [de] |
||||
|
add [hl] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
|
||||
|
ld a, [de] |
||||
|
adc [hl] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
|
||||
|
ld a, [de] |
||||
|
adc [hl] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
|
||||
|
ld a, [de] |
||||
|
adc [hl] |
||||
|
ld [hl], a |
||||
|
ret |
||||
|
|
||||
|
s03_A0A0: dl $FFFFFFFF |
||||
|
|
||||
|
DecHL_32bit: ; s03_A0A4 |
||||
|
; Decrements 32-bit value at hl, checks if result is 0 |
||||
|
|
||||
|
push hl |
||||
|
ld de, s03_A0A0 |
||||
|
call AddDEToHL_32bit |
||||
|
pop hl |
||||
|
|
||||
|
; Checks 4-byte value at hl is 0 |
||||
|
ld a, [hl+] |
||||
|
and a |
||||
|
ret nz |
||||
|
ld a, [hl+] |
||||
|
and a |
||||
|
ret nz |
||||
|
ld a, [hl+] |
||||
|
and a |
||||
|
ret nz |
||||
|
ld a, [hl+] |
||||
|
and a |
||||
|
ret |
||||
|
|
||||
|
Multiplier: ds 4 ; s03_A0B8 |
||||
|
CalcResult: ds 4 ; s03_A0BC |
||||
|
Clean32bit: dl $00000000 ; s03_A0C0 |
||||
|
|
||||
|
MulDEToHL_32bit: ; s03_A0C4 |
||||
|
; Multiplies value at de with value at hl, stores in hl |
||||
|
|
||||
|
push hl |
||||
|
|
||||
|
; Copy DE to the Multiplier |
||||
|
push hl |
||||
|
push de |
||||
|
ld hl, Multiplier |
||||
|
call CopyDEtoHL_32bit |
||||
|
pop de |
||||
|
pop hl |
||||
|
|
||||
|
; Clear the result value |
||||
|
push hl |
||||
|
ld hl, CalcResult |
||||
|
ld de, Clean32bit |
||||
|
call CopyDEtoHL_32bit |
||||
|
pop de |
||||
|
|
||||
|
; Add HL (now DE) Multiplier times to CalcResult |
||||
|
.loop |
||||
|
push de |
||||
|
ld hl, CalcResult |
||||
|
call AddDEToHL_32bit |
||||
|
pop de |
||||
|
push de |
||||
|
ld hl, Multiplier |
||||
|
call DecHL_32bit |
||||
|
pop de |
||||
|
jr nz, .loop |
||||
|
|
||||
|
; Copy the result back to HL |
||||
|
pop hl |
||||
|
ld de, CalcResult |
||||
|
jp CopyDEtoHL_32bit |
||||
|
|
||||
|
|
||||
|
s03_A0F3: ds 4 ; Initial value: $5D0B1C11 |
||||
|
s03_A0F7: dl $35E79125 |
||||
|
s03_A0FB: dl $56596b10 |
||||
|
s03_A0FF: ds 4 ; Initial value: $7FFFFB0A |
||||
|
|
||||
|
s03_A103: dl $1b080733 |
||||
|
s03_A107: ds 4 ; Initialized with A103 |
||||
|
|
||||
|
s03_A10B: dw |
||||
|
s03_A10D: db |
||||
|
s03_A10E: db |
||||
|
|
||||
|
s03_A10F: |
||||
|
; (u16)s03_A10B = ((u16)s03_A10B / 2) * s03_A10D + s03_A10E |
||||
|
|
||||
|
ld hl, s03_A10B |
||||
|
ld a, [hl+] |
||||
|
ld h, [hl] |
||||
|
ld l, a |
||||
|
|
||||
|
and a |
||||
|
srl h |
||||
|
rr l |
||||
|
|
||||
|
ld d, h |
||||
|
ld e, l |
||||
|
ld hl, 0 |
||||
|
ld a, [s03_A10D] |
||||
|
ld c, a |
||||
|
and a |
||||
|
jr z, .end |
||||
|
.loop |
||||
|
add hl, de |
||||
|
dec c |
||||
|
jr nz, .loop |
||||
|
.end |
||||
|
|
||||
|
ld a, [s03_A10E] |
||||
|
ld c, a |
||||
|
ld b, 0 |
||||
|
add hl, bc |
||||
|
|
||||
|
ld a, h |
||||
|
ld [s03_A10B + 1], a |
||||
|
ld a, l |
||||
|
ld [s03_A10B], a |
||||
|
ret |
||||
|
|
||||
|
s03_A13A: |
||||
|
; Main decryption routine |
||||
|
|
||||
|
.outer_loop |
||||
|
ld hl, s03_A107 |
||||
|
ld de, s03_A103 |
||||
|
call CopyDEtoHL_32bit |
||||
|
|
||||
|
; Initialize values |
||||
|
ld hl, s03_A0F3 + 1 |
||||
|
ld de, s03_A10B |
||||
|
ld a, [hl+] |
||||
|
ld [de], a |
||||
|
inc de ; s03_A10B + 1 |
||||
|
xor a |
||||
|
ld [de], a |
||||
|
inc de ; s03_A10D |
||||
|
ld a, [hl+] |
||||
|
ld [de], a |
||||
|
inc de ; s03_A10E |
||||
|
ld a, [hl] |
||||
|
ld [de], a |
||||
|
|
||||
|
ld hl, Buffer |
||||
|
ld bc, 0 |
||||
|
|
||||
|
; Problem with this routine: Writing to SRAM!!! |
||||
|
; This means that whatever is in hl's buffer is useless on next bootup, so we |
||||
|
; need to make sure to start from a clean save file. |
||||
|
|
||||
|
.loop ; s03_A15A |
||||
|
push hl |
||||
|
push bc |
||||
|
call s03_A10F ; (u16)s03_A10B = ((u16)s03_A10B / 2) * s03_A10D + s03_A10E |
||||
|
pop bc |
||||
|
pop hl |
||||
|
|
||||
|
; Exor the buffer |
||||
|
xor [hl] |
||||
|
ld [hl+], a |
||||
|
|
||||
|
; Reset HL to Buffer every $200 bytes |
||||
|
inc bc |
||||
|
ld a, b |
||||
|
cp $2 |
||||
|
jr nz, .s03_A16F |
||||
|
ld bc, 0 |
||||
|
ld hl, Buffer |
||||
|
.s03_A16F |
||||
|
|
||||
|
push hl |
||||
|
ld hl, s03_A107 |
||||
|
call DecHL_32bit |
||||
|
pop hl |
||||
|
jr nz, .loop |
||||
|
|
||||
|
ld hl, s03_A0F3 |
||||
|
ld de, s03_A0F7 |
||||
|
call MulDEToHL_32bit |
||||
|
ld hl, s03_A0F3 |
||||
|
ld de, s03_A0FB |
||||
|
call AddDEToHL_32bit |
||||
|
|
||||
|
ld hl, s03_A0FF |
||||
|
call DecHL_32bit |
||||
|
jr nz, .outer_loop |
||||
|
ret |
||||
|
|
||||
|
Buffer: ds $200 ; s03_A567 |
||||
Binary file not shown.
@ -0,0 +1,86 @@ |
|||||
|
// Written by luckytyphlosion
|
||||
|
|
||||
|
#include <stdio.h> |
||||
|
#include <time.h> |
||||
|
#include <string.h> |
||||
|
|
||||
|
typedef unsigned int uint; |
||||
|
typedef unsigned short u16; |
||||
|
typedef unsigned char u8; |
||||
|
|
||||
|
#define _A0F4 (_A0F3 >> 8) & 0xff |
||||
|
#define _A0F5 (_A0F3 >> 16) & 0xff |
||||
|
#define _A0F6 (_A0F3 >> 24) & 0xff |
||||
|
#define TRUE 1 |
||||
|
#define FALSE 0 |
||||
|
|
||||
|
u8 sA567[] = {0x15, 0xc8, 0x7b, 0x6b, 0x7f, 0xa1, 0xa3, 0x29, 0xe8, 0x81, 0x1, 0x99, 0x9f, 0xeb, 0xf2, 0x80, 0x5f, 0xa3, 0x96, 0x7c, 0x17, 0xdb, 0xd2, 0x41, 0xa1, 0xbc, 0xbb, 0x13, 0xbc, 0xd8, 0xc3, 0x9, 0xf4, 0x2, 0x1b, 0x95, 0xf3, 0x72, 0x65, 0xdb, 0x6f, 0x82, 0x9e, 0x52, 0xd9, 0x89, 0xd8, 0xdf, 0x5a, 0xb0, 0x3, 0xf2, 0x9a, 0xe6, 0xef, 0x81, 0x32, 0xa5, 0x57, 0x60, 0xe0, 0xc8, 0x2d, 0x8c, 0x52, 0x63, 0x5d, 0xd8, 0xf, 0x72, 0xdf, 0xa1, 0x36, 0x1c, 0x3e, 0xc8, 0xc2, 0x4f, 0x1e, 0xfd, 0x1d, 0x11, 0xc, 0x74, 0x13, 0x21, 0x49, 0xad, 0xc0, 0xd9, 0xba, 0xda, 0xd, 0xe4, 0x6, 0x8e, 0x94, 0xe6, 0x25, 0x8b, 0xba, 0xc2, 0x2b, 0x92, 0xa, 0x90, 0xa1, 0x4a, 0x6, 0x53, 0x84, 0x79, 0xe5, 0xe7, 0xcf, 0x60, 0x74, 0xd2, 0x3b, 0x2a, 0xe0, 0x56, 0x32, 0xa6, 0x10, 0x69, 0x52, 0xf, 0xd3, 0x3d, 0x7f, 0xf3, 0x12, 0x6d, 0x0, 0x57, 0x41, 0x3f, 0x96, 0x3b, 0x8, 0xb7, 0x48, 0x72, 0xb2, 0x1e, 0x12, 0x57, 0x60, 0x95, 0x23, 0xc8, 0xab, 0x52, 0xc8, 0x3f, 0xc4, 0xc0, 0x50, 0xc1, 0xd3, 0x38, 0x28, 0x6e, 0x96, 0x6d, 0xdf, 0x8f, 0x41, 0x24, 0x21, 0x91, 0xf4, 0x64, 0x3e, 0xc9, 0xe6, 0xc7, 0x45, 0x26, 0xa1, 0x4c, 0xa, 0xd3, 0x2f, 0x8f, 0x77, 0x7d, 0x68, 0x86, 0x23, 0x43, 0xcf, 0xbf, 0xe1, 0xf4, 0xc8, 0x9e, 0x35, 0x5a, 0x11, 0x26, 0xb7, 0x9f, 0x23, 0xcd, 0x68, 0xa2, 0xb5, 0xca, 0xd3, 0x53, 0x95, 0xda, 0xb, 0x87, 0x15, 0xca, 0xe7, 0x73, 0xbd, 0x66, 0x39, 0x90, 0xc0, 0xa4, 0x94, 0x94, 0x3e, 0x61, 0x9e, 0xef, 0x89, 0x1e, 0x93, 0x13, 0xc1, 0xfa, 0xd9, 0xee, 0x5b, 0x27, 0x71, 0x16, 0xcd, 0xa2, 0xef, 0x49, 0xcc, 0xd6, 0x1d, 0x24, 0xa6, 0x3b, 0x89, 0x94, 0x58, 0x28, 0xd2, 0x83, 0x5b, 0x25, 0x8a, 0x5f, 0x25, 0xfe, 0xe3, 0x2d, 0xe8, 0x58, 0x5e, 0xbb, 0x9b, 0xd5, 0xe8, 0x46, 0xa5, 0xdc, 0xde, 0x8f, 0x97, 0x3, 0xf1, 0x16, 0x1, 0xfc, 0x2e, 0x3f, 0x47, 0x5b, 0xaf, 0x71, 0x2e, 0x7f, 0x19, 0xce, 0xe3, 0x7d, 0xe2, 0x49, 0x5e, 0x71, 0xa, 0x57, 0xe1, 0x98, 0xac, 0xdd, 0x7f, 0xfd, 0x5d, 0xae, 0xdc, 0x24, 0xc5, 0x30, 0x3b, 0x65, 0xc1, 0xd6, 0xf4, 0x62, 0xa0, 0xee, 0xbc, 0x86, 0x68, 0xb4, 0x5, 0x68, 0x1b, 0xdb, 0x5c, 0xa8, 0x25, 0x92, 0x70, 0xc8, 0xa5, 0xf6, 0x1a, 0x55, 0xad, 0xae, 0x44, 0x2a, 0x4a, 0x77, 0xca, 0x2d, 0x6b, 0xdd, 0x47, 0x51, 0x95, 0x58, 0xff, 0x75, 0xdd, 0x30, 0x81, 0x80, 0x1b, 0xdb, 0xc2, 0xa9, 0x29, 0xce, 0xa8, 0xd6, 0xd8, 0x8, 0xc1, 0x86, 0x1c, 0xec, 0xf, 0x63, 0x48, 0x38, 0x1b, 0xeb, 0x32, 0xe3, 0xa0, 0xe6, 0x28, 0x5e, 0xf4, 0xa, 0xa2, 0x2d, 0xf1, 0xb0, 0x61, 0xfc, 0xdd, 0x4c, 0x6b, 0x43, 0xe8, 0x82, 0x4, 0xe8, 0xf3, 0x3d, 0x43, 0xf5, 0x6d, 0x4e, 0x8a, 0x45, 0xc9, 0x6a, 0x96, 0x1d, 0x37, 0x93, 0x76, 0x53, 0x9e, 0x33, 0xa, 0xaf, 0x8, 0x3e, 0x80, 0xfc, 0xe7, 0xc5, 0x17, 0x69, 0xe7, 0x91, 0x55, 0x52, 0x4a, 0xa5, 0x51, 0x6, 0xa8, 0x3e, 0x82, 0x1d, 0xff, 0x27, 0x14, 0xee, 0x26, 0x39, 0x55, 0xc0, 0x8f, 0xd7, 0xf2, 0x47, 0x14, 0x9a, 0x54, 0x5e, 0xac, 0x9a, 0xc2, 0x93, 0xc0, 0x96, 0x60, 0x44, 0x11, 0x8, 0xed, 0x22, 0x20, 0x44, 0x77, 0xb3, 0xfc, 0x78, 0xe5, 0xda, 0xa, 0xc5, 0xa1, 0xbe, 0x64, 0x80, 0x25, 0x20, 0xa7, 0xfb, 0x3e, 0xdb, 0x26, 0x39, 0x99, 0x2a, 0xee, 0xa3, 0x36, 0x7b, 0xb6, 0x63, 0x24, 0xf6, 0xf6, 0x13, 0xe, 0x83, 0x86, 0x1f, 0x3a, 0xf}; |
||||
|
|
||||
|
u16 values[65536] = {0}; |
||||
|
u16 values_set[65536] = {0}; |
||||
|
int values_size = 0; |
||||
|
|
||||
|
int main(void) { |
||||
|
uint _A0F3 = 0x5d0b1c11; |
||||
|
const uint _A0F7 = 0x35e79125; |
||||
|
const uint _A0FB = 0x56596b10; |
||||
|
struct timespec start_time; |
||||
|
|
||||
|
for (int i = 0; i < 0x3ffffb0a; i++) { |
||||
|
_A0F3 = _A0F3 * _A0F7 + _A0FB; |
||||
|
} |
||||
|
|
||||
|
for (int i = 0; i < 0x4f6; i++) { |
||||
|
u16 _A10B = _A0F4; |
||||
|
int _A10D = _A0F5; |
||||
|
int _A10E = _A0F6; |
||||
|
int data_count = 0; |
||||
|
int start_index = -1; |
||||
|
values_size = 0; |
||||
|
int sublcg_count = 0; |
||||
|
memset(values_set, 0xff, sizeof(values_set)); |
||||
|
while (TRUE) { |
||||
|
values[values_size++] = _A10B; |
||||
|
_A10B = (_A10B >> 1) * _A10D + _A10E; |
||||
|
if (values_set[_A10B] != 0xffff) { |
||||
|
start_index = values_set[_A10B]; |
||||
|
break; |
||||
|
} |
||||
|
values_set[_A10B] = values_size; |
||||
|
sA567[data_count++] ^= (_A10B & 0xff); |
||||
|
data_count = data_count & 0x1ff; |
||||
|
sublcg_count++; |
||||
|
} |
||||
|
int sublcg_index = start_index; |
||||
|
|
||||
|
int period = values_size - start_index; |
||||
|
while ((period & 1) == 0) { |
||||
|
period >>= 1; |
||||
|
} |
||||
|
|
||||
|
int num_xors_until_repeat = period * 512; |
||||
|
int num_repeat_iterations = (0x1b080733 - sublcg_count) / num_xors_until_repeat; |
||||
|
int remaining_sublcg_iterations = (0x1b080733 - sublcg_count) % num_xors_until_repeat; |
||||
|
if (num_repeat_iterations & 1 == 1) { |
||||
|
remaining_sublcg_iterations += num_xors_until_repeat; |
||||
|
} |
||||
|
|
||||
|
for (int j = 0; j < remaining_sublcg_iterations; j++) { |
||||
|
sA567[data_count++] ^= (values[sublcg_index++] & 0xff); |
||||
|
data_count = data_count & 0x1ff; |
||||
|
if (sublcg_index >= values_size) { |
||||
|
sublcg_index = start_index; |
||||
|
} |
||||
|
} |
||||
|
_A0F3 = _A0F3 * _A0F7 + _A0FB; |
||||
|
if (i % 10000 == 9999) { |
||||
|
struct timespec end_time; |
||||
|
clock_gettime(CLOCK_MONOTONIC, &end_time); |
||||
|
fprintf(stderr, "difftime: %f, iter: %u\n", 1000.0*end_time.tv_sec + 1e-6*end_time.tv_nsec - (1000.0*start_time.tv_sec + 1e-6*start_time.tv_nsec), i); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
for (int i = 0; i < 0x200; i++) { |
||||
|
printf("0x%02x, ", sA567[i]); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,29 @@ |
|||||
|
#!/usr/bin/env python3 |
||||
|
|
||||
|
from sys import argv |
||||
|
from struct import unpack |
||||
|
|
||||
|
gadgets = {} |
||||
|
|
||||
|
for line in open("ropgadgets.txt"): |
||||
|
split = line.split("-") |
||||
|
if len(split) < 2: |
||||
|
continue |
||||
|
|
||||
|
addr = int(split[0][1:], 16) |
||||
|
cmd = "-".join(split[1:]).strip() |
||||
|
gadgets[addr] = cmd |
||||
|
|
||||
|
mem = open("fools.dump", "rb").read() |
||||
|
|
||||
|
addr = int(argv[1], 0) |
||||
|
|
||||
|
while True: |
||||
|
gadget = unpack("<H", mem[addr:addr+2])[0] |
||||
|
if gadget in gadgets: |
||||
|
print(" ", gadgets[gadget]) |
||||
|
else: |
||||
|
print(" dw $%04X" % gadget) |
||||
|
if gadget == 0x1708: |
||||
|
break |
||||
|
addr += 2 |
||||
@ -0,0 +1,78 @@ |
|||||
|
#!/usr/bin/env python3 |
||||
|
|
||||
|
from sys import argv |
||||
|
from struct import unpack |
||||
|
|
||||
|
mem = open("fools.dump", "rb").read() |
||||
|
|
||||
|
addr = int(argv[1], 0) |
||||
|
|
||||
|
while True: |
||||
|
gadget = unpack("<B", mem[addr:addr+1])[0] |
||||
|
|
||||
|
if gadget == 0x01: |
||||
|
param = unpack("<H", mem[addr+1:addr+3])[0] |
||||
|
print(" ; sSaveSource = $%04X" % param) |
||||
|
print(" dbw $01, $%04X ; ROP_s02_AEF3" % param) |
||||
|
print() |
||||
|
addr += 3 |
||||
|
elif gadget == 0x02: |
||||
|
param = unpack("<B", mem[addr+1:addr+2])[0] |
||||
|
print(" ; sSaveBlockChecksum = $%02X" % param) |
||||
|
print(" dbb $02, $%02X ; ROP_s02_AF09" % param) |
||||
|
print() |
||||
|
addr += 2 |
||||
|
elif gadget == 0x03: |
||||
|
print(" ; w00_C800 = *(sSaveSource++)") |
||||
|
print(" db $03 ; ROP_s02_AF19") |
||||
|
print() |
||||
|
addr += 1 |
||||
|
elif gadget == 0x05: |
||||
|
print(" ; w00_C800 ^= func(s02_ADB1)") |
||||
|
print(" db $05 ; ROP_s02_AF3B") |
||||
|
print() |
||||
|
addr += 1 |
||||
|
elif gadget == 0x06: |
||||
|
print(" ; rotatebuffer(w00_C800)") |
||||
|
print(" db $06 ; ROP_s02_AF85") |
||||
|
print() |
||||
|
addr += 1 |
||||
|
elif gadget == 0x07: |
||||
|
param = unpack("<I", mem[addr+1:addr+5])[0] |
||||
|
print(" ; s02_ADB1 = $%08X" % param) |
||||
|
print(" dbl $07, $%08X ; ROP_s02_AFE3" % param) |
||||
|
print() |
||||
|
addr += 5 |
||||
|
elif gadget == 0x08: |
||||
|
print(" ; sSaveBlockChecksum += w00_C800") |
||||
|
print(" db $08 ; ROP_s02_B005") |
||||
|
print() |
||||
|
addr += 1 |
||||
|
elif gadget == 0x09: |
||||
|
print(" ; sSaveBlockChecksum ^= w00_C800") |
||||
|
print(" db $09 ; ROP_s02_B013") |
||||
|
print() |
||||
|
addr += 1 |
||||
|
elif gadget == 0x0B: |
||||
|
print(" ; w00_C800 = sSaveBlockChecksum") |
||||
|
print(" db $0B ; ROP_s02_B033") |
||||
|
print() |
||||
|
addr += 1 |
||||
|
elif gadget == 0x0C: |
||||
|
param1 = unpack("<H", mem[addr+1:addr+3])[0] |
||||
|
param2 = unpack("<B", mem[addr+3:addr+4])[0] |
||||
|
print(" dbwb $0C, $%03X, $%02X ; ROP_rept" % (param1, param2)) |
||||
|
print() |
||||
|
addr += 4 |
||||
|
elif gadget == 0x0D: |
||||
|
print(" ; *(sSaveSource++) = sSaveBlockChecksum") |
||||
|
print(" db $0D ; ROP_s02_B045") |
||||
|
print() |
||||
|
addr += 1 |
||||
|
elif gadget == 0x0E: |
||||
|
print(" ; sSaveBlockChecksum = *sSaveSource") |
||||
|
print(" db $0E ; ROP_s02_B069") |
||||
|
print() |
||||
|
addr += 1 |
||||
|
else: |
||||
|
break |
||||
@ -0,0 +1,997 @@ |
|||||
|
Text_WouldYouLikeToSaveTheGame EQU $5283 |
||||
|
Text_SavingDontTurnOffThePower EQU $5288 |
||||
|
SaveTheGame_yesorno EQU $4BAF |
||||
|
SaveMenu.refused EQU $4A4A |
||||
|
Text_WaitBGMap EQU $13B6 |
||||
|
SpeechTextBox EQU $103E |
||||
|
FarCall EQU $08 |
||||
|
FadeOutPalettes EQU $23:$4084 |
||||
|
LoadMapPalettes EQU $41:$47EB |
||||
|
ClearScreen EQU $0FDB |
||||
|
UpdateSprites EQU $1AD2 |
||||
|
GetSGBLayout EQU $3340 |
||||
|
SetPalettes EQU $32F9 |
||||
|
DelayFrame EQU $045A |
||||
|
DelayFrames EQU $0468 |
||||
|
PrintText EQU $1057 |
||||
|
Request1bpp EQU $0F1E |
||||
|
DoubleSpeed EQU $2FEF |
||||
|
hTransferVirtualOAM EQU $FFEC |
||||
|
rSTAT EQU $FF41 |
||||
|
CopyBytes EQU $3026 |
||||
|
|
||||
|
s02_9A12: db ; s02_9A12 |
||||
|
|
||||
|
SaveGame: ; s02_AD44 |
||||
|
push af |
||||
|
push bc |
||||
|
push de |
||||
|
push hl |
||||
|
ei |
||||
|
call Text_WaitBGMap |
||||
|
|
||||
|
ld a,[wSavingAllowed] |
||||
|
and a |
||||
|
jr z,.cantsave |
||||
|
|
||||
|
; Ask the player to save or some dumb shit idfk |
||||
|
ld hl,$B1E8 |
||||
|
ld a,$02 |
||||
|
ld [w01_DF34],a |
||||
|
call $A2A3 |
||||
|
ld bc,$0204 |
||||
|
ld hl,$A41A |
||||
|
ld de,Start |
||||
|
call $AB1F ; Get player input? |
||||
|
and a |
||||
|
jr z,.declined |
||||
|
|
||||
|
; Confirmed save |
||||
|
ld a,[wPartyCount] |
||||
|
cp a,$04 |
||||
|
jr c,.actuallysave |
||||
|
|
||||
|
; Too many party members yadda yadda |
||||
|
ld hl,$B323 |
||||
|
ld a,$02 |
||||
|
ld [w01_DF34],a |
||||
|
call $A2A3 |
||||
|
ld bc,$0204 |
||||
|
ld hl,$A41A |
||||
|
ld de,Start |
||||
|
call $AB1F |
||||
|
and a |
||||
|
jr z,$ADA7 |
||||
|
|
||||
|
.actuallysave ; s02_AD8F |
||||
|
ld a,BANK(FadeOutPalettes) |
||||
|
ld hl,FadeOutPalettes |
||||
|
rst FarCall |
||||
|
ld a,BANK(LoadMapPalettes) |
||||
|
ld hl,LoadMapPalettes |
||||
|
rst FarCall |
||||
|
jp SavingTheGame |
||||
|
|
||||
|
.cantsave ; s02_A9DC |
||||
|
ld hl,$B1A6 |
||||
|
ld a,$02 |
||||
|
ld [$DF34],a |
||||
|
call $A2A3 |
||||
|
|
||||
|
.declined ; s02_ADA7 |
||||
|
pop hl |
||||
|
pop de |
||||
|
pop bc |
||||
|
pop af |
||||
|
jp $0460 |
||||
|
|
||||
|
sSaveSource: dw ; s02_ADAE |
||||
|
sSaveBlockChecksum: db ; s02_ADB0 |
||||
|
s02_ADB1: dl ; s02_ADB1 |
||||
|
sBufferCarry: ; s02_ADB5 |
||||
|
sROPScriptBackup: dw ; s02_ADB6 |
||||
|
s02_ADB8: db ; s02_ADB8 |
||||
|
s02_ADB9: db ; s02_ADB9 |
||||
|
|
||||
|
ROPGadget_ldi_a_hl: ; s02_ADBA |
||||
|
ld a, [hl+] |
||||
|
ret |
||||
|
|
||||
|
ROPGadget_ldd_a_hl: ; s02_ADBC |
||||
|
ld a, [hl-] |
||||
|
ret |
||||
|
|
||||
|
ROPGadget_ld_hl_c: ; s02_ADBE |
||||
|
ld [hl], c |
||||
|
ret |
||||
|
|
||||
|
ROPGadget_ld_b_hl: ; s02_ADC0 |
||||
|
ld b, [hl] |
||||
|
ret |
||||
|
|
||||
|
ROPGadget_add_b: ; s02_ADC2 |
||||
|
add b |
||||
|
ret |
||||
|
|
||||
|
ROPGadget_srl_a: ; s02_ADC4 |
||||
|
srl a |
||||
|
ret |
||||
|
|
||||
|
ROPGadget_xor_hl: ; s02_ADC7 |
||||
|
xor [hl] |
||||
|
ret |
||||
|
|
||||
|
ROPGadget_call_z: ; s02_ADC9 |
||||
|
ret z |
||||
|
pop hl |
||||
|
ret |
||||
|
|
||||
|
ROPGadget_variable: ; s02_ADCC |
||||
|
add [hl] |
||||
|
ret |
||||
|
|
||||
|
SavingTheGame: ; s02_ADCE |
||||
|
; Cleanup shit because well fuck nobody cares |
||||
|
call ClearScreen |
||||
|
call UpdateSprites |
||||
|
call UninstallVBlankHook ; Only interesting line in this entire blob of fuzz |
||||
|
ld b,$08 |
||||
|
call GetSGBLayout |
||||
|
call SetPalettes |
||||
|
ld hl,wMusicFadeID |
||||
|
ld [hl],$00 |
||||
|
dec hl |
||||
|
dec hl |
||||
|
ld [hl],$08 |
||||
|
ld c,$32 |
||||
|
call DelayFrames |
||||
|
ld a,$03 |
||||
|
ld [wOptions],a |
||||
|
ld a,$05 |
||||
|
rst $10 |
||||
|
ld hl,Text_SavingDontTurnOffThePower |
||||
|
call PrintText |
||||
|
ld de,$B400 |
||||
|
ld hl,$8C00 ; This graphic is probably a picture of a cucumber |
||||
|
ld bc,$0104 |
||||
|
call Request1bpp |
||||
|
call DelayFrame |
||||
|
|
||||
|
; Now THAT's more like it |
||||
|
ld de,ROPScript_SaveMain |
||||
|
di |
||||
|
call DoubleSpeed |
||||
|
call UpdateSaveSpinner |
||||
|
ld sp,SaveROPMain |
||||
|
ret |
||||
|
|
||||
|
ROP_SaveMain: ; s02_AE18 |
||||
|
ld a, [de] |
||||
|
inc de |
||||
|
add a |
||||
|
|
||||
|
ld bc, 0 |
||||
|
ld c, a |
||||
|
ld hl, .jmptable |
||||
|
add hl, bc |
||||
|
ldw hl, [hl] |
||||
|
.jmptable ; s02_AE2C |
||||
|
jp hl |
||||
|
dw ROP_SetAddr ; $01 |
||||
|
dw ROP_InitChecksum ; $02 |
||||
|
dw ROP_FetchByte ; $03 |
||||
|
dw ROP_end ; $04 |
||||
|
dw ROP_ApplyCrypto ; $05 |
||||
|
dw ROP_RotateBuffer ; $06 |
||||
|
dw ROP_InitCrypto ; $07 |
||||
|
dw ROP_AddChecksum ; $08 |
||||
|
dw ROP_XorChecksum ; $09 |
||||
|
dw $0000 ; $0A |
||||
|
dw ROP_WriteChecksumByte ; $0B |
||||
|
dw ROP_rept ; $0C |
||||
|
dw ROP_StoreByte ; $0D |
||||
|
dw ROP_LoadByte ; $0E |
||||
|
|
||||
|
ROP_end: ; s02_AE4A |
||||
|
ld bc, $0100 |
||||
|
ld de, $CB00 |
||||
|
ld hl, $AE58 |
||||
|
ld af, $FF00 |
||||
|
call CopyBytes |
||||
|
; Here's the destination of the copied code, |
||||
|
; it does some shit to copy the buffer back to the SRAM. |
||||
|
; I don't really care what it does. |
||||
|
|
||||
|
UpdateSaveSpinner: ; s02_AEDB |
||||
|
ld hl,s02_9A12 |
||||
|
ld b,$C0 |
||||
|
ld a,[s02_ADB9] |
||||
|
inc a |
||||
|
and a,%11 |
||||
|
ld [s02_ADB9],a |
||||
|
add b |
||||
|
ld b,a |
||||
|
|
||||
|
; Wait for HBlank |
||||
|
.loop ; s02_AEEB |
||||
|
ldh a,[rSTAT] |
||||
|
and a,%11 |
||||
|
jr nz,.loop |
||||
|
|
||||
|
ld [hl],b |
||||
|
ret |
||||
|
|
||||
|
ROP_SetAddr: ; s02_AEF3 |
||||
|
; sSaveSource = param |
||||
|
|
||||
|
ld hl, sSaveSource |
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_InitChecksum: ; s02_AF09 |
||||
|
; sSaveBlockChecksum = param |
||||
|
|
||||
|
ld hl, sSaveBlockChecksum |
||||
|
ld a, [de] |
||||
|
inc de |
||||
|
ld [hl+], a |
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_FetchByte: ; s02_AF19 |
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
|
||||
|
; Fetch byte from pointer stored at sSaveSource |
||||
|
ld hl, sSaveSource |
||||
|
ldw hl, [hl] |
||||
|
ld a, [hl+] |
||||
|
|
||||
|
; Save incremented pointer back into sSaveSource |
||||
|
ld b, h |
||||
|
ld c, l |
||||
|
ld hl, sSaveSource |
||||
|
ld [hl], c |
||||
|
inc hl |
||||
|
ld [hl], b |
||||
|
|
||||
|
; Save byte into w00_C800 |
||||
|
ld hl, w00_C800 |
||||
|
ld [hl+], a |
||||
|
|
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_ApplyCrypto: ; s02_AF3B |
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
|
||||
|
; s02_ADB2 ^= (s02_ADB1 + 1) ^ s02_ADB4 |
||||
|
ld hl, s02_ADB1 |
||||
|
inc [hl] |
||||
|
ld b, [hl] ; s02_ADB1 |
||||
|
ld a, [hl+] |
||||
|
ld a, [hl+] |
||||
|
ld a, [hl+] |
||||
|
ld a, [hl-] ; s02_ADB4 |
||||
|
xor b |
||||
|
ld b, a |
||||
|
ld a, [hl-] |
||||
|
ld a, [hl-] ; s02_ADB2 |
||||
|
inc hl |
||||
|
xor b |
||||
|
ld [hl+], a ; s02_ADB2 |
||||
|
|
||||
|
; s02_ADB3 += s02_ADB2 |
||||
|
ld b, a |
||||
|
ld a, [hl-] ; s02_ADB3 |
||||
|
inc hl |
||||
|
add b |
||||
|
ld [hl+], a ; s02_ADB3 |
||||
|
|
||||
|
; s02_ADB4 = s02_ADB2 ^ (s02_ADB4 + (s02_ADB3 / 2)) |
||||
|
srl a |
||||
|
ld b, a |
||||
|
ld a, [hl-] ; s02_ADB4 |
||||
|
add b |
||||
|
ld b, a |
||||
|
ld a, [hl-] |
||||
|
ld a, [hl+] ; s02_ADB2 |
||||
|
xor b |
||||
|
inc hl |
||||
|
ld [hl+], a ; s02_ADB4 |
||||
|
|
||||
|
; w00_C800 ^= s02_ADB4 |
||||
|
ld hl, w00_C800 |
||||
|
xor [hl] |
||||
|
ld [hl+], a |
||||
|
|
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_RotateBuffer: ; s02_AF85 |
||||
|
; s02_ADB8 = ((s02_ADB8 + 1) | $C0) ^ $C0 |
||||
|
; s02_ADB8 = (s02_ADB8 + 1) & 0x3F |
||||
|
ld hl, s02_ADB8 |
||||
|
ld a, [hl-] |
||||
|
inc a |
||||
|
ld hl, $07FC |
||||
|
or [hl] |
||||
|
ld bc, $C000 |
||||
|
xor b |
||||
|
ld hl, s02_ADB8 |
||||
|
ld [hl+], a |
||||
|
|
||||
|
; Called every 64 times this function is ran |
||||
|
and a |
||||
|
call z, UpdateSaveSpinner |
||||
|
|
||||
|
; Save ROPScript pointer |
||||
|
ld hl, sROPScriptBackup |
||||
|
ld a, e |
||||
|
ld [hl+], a |
||||
|
ld [hl], d |
||||
|
|
||||
|
; Rotate the entire buffer, using sBufferCarry as carry |
||||
|
ld hl, w00_C800 |
||||
|
ld a, [hl+] |
||||
|
ld hl, sBufferCarry |
||||
|
ld [hl+], a |
||||
|
ld bc, $01B0 |
||||
|
ld de, w00_C800 |
||||
|
ld hl, w00_C800 + 1 |
||||
|
ld af, $FF00 |
||||
|
call CopyBytes ; bc bytes from hl to de |
||||
|
ld hl, sBufferCarry |
||||
|
ld a, [hl+] |
||||
|
ld hl, w00_C9AF |
||||
|
ld [hl+], a |
||||
|
|
||||
|
; Restore ROPScript pointer |
||||
|
ld hl, sROPScriptBackup |
||||
|
ld a, [hl+] |
||||
|
ld d, [hl] |
||||
|
ld e, a |
||||
|
|
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_InitCrypto: ; s02_AFE3 |
||||
|
; s02_ADB1 = param |
||||
|
|
||||
|
ld hl, s02_ADB1 |
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
ld a, [de] |
||||
|
ld [hl+], a |
||||
|
inc de |
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_AddChecksum: ; s02_B005 |
||||
|
; sSaveBlockChecksum += w00_C800 |
||||
|
|
||||
|
ld hl, ROPGadget_variable |
||||
|
ld af, $8600 ; add [hl] |
||||
|
ld [hl+], a |
||||
|
ld hl, ROP_s02_B01B |
||||
|
jp hl |
||||
|
|
||||
|
ROP_XorChecksum: ; s02_B013 |
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
|
||||
|
ld hl, ROPGadget_variable |
||||
|
ld af, $AE00 ; xor [hl] |
||||
|
ld [hl+], a |
||||
|
|
||||
|
; fallthrough |
||||
|
|
||||
|
ROP_s02_B01B: ; s02_B01B |
||||
|
ld hl, sSaveBlockChecksum |
||||
|
ld a, [hl+] |
||||
|
ld hl, w00_C800 |
||||
|
add [hl]/xor [hl] ; Modified by caller |
||||
|
ld hl, sSaveBlockChecksum |
||||
|
ld [hl+], a |
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_WriteChecksumByte: ; s02_B033 |
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
|
||||
|
ld hl, sSaveBlockChecksum |
||||
|
ld a, [hl+] |
||||
|
ld hl, w00_C800 |
||||
|
ld [hl+], a |
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_StoreByte: ; s02_B045 |
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
|
||||
|
; *sSaveSource = sSaveBlockChecksum |
||||
|
ld hl, sSaveBlockChecksum |
||||
|
ld b, [hl] |
||||
|
ld hl, sSaveSource |
||||
|
ldw hl, [hl] |
||||
|
ld [hl], b |
||||
|
inc hl |
||||
|
|
||||
|
; sSaveSource = sSaveSource + 1 |
||||
|
ld b, h |
||||
|
ld c, l |
||||
|
ld hl, sSaveSource |
||||
|
ld [hl], c |
||||
|
inc hl |
||||
|
ld [hl], b |
||||
|
|
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_LoadByte: ; s02_B069 |
||||
|
; sSaveBlockChecksum = *sSaveSource |
||||
|
|
||||
|
ld hl, sSaveSource |
||||
|
ldw hl, [hl] |
||||
|
ld a, [hl+] |
||||
|
ld hl, sSaveBlockChecksum |
||||
|
ld [hl+], a |
||||
|
|
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROP_rept: ; s02_B07D |
||||
|
; do {} while(param[2]--); |
||||
|
|
||||
|
; Fetch jump pointer to bc |
||||
|
ld a, [de] |
||||
|
ld c, a |
||||
|
inc de |
||||
|
ld a, [de] |
||||
|
ld b, a |
||||
|
inc de |
||||
|
|
||||
|
; If param == 0, return |
||||
|
ld a, [de] |
||||
|
inc de |
||||
|
ld hl, ROP_SaveMain |
||||
|
and a |
||||
|
call z, (jp hl) |
||||
|
|
||||
|
; Decrement parameter, if 0, return |
||||
|
dec a |
||||
|
dec de |
||||
|
ld [de], a |
||||
|
inc de |
||||
|
ld hl, ROP_SaveMain |
||||
|
call z, (jp hl) |
||||
|
|
||||
|
; Jump to the script at bc |
||||
|
ld d, b |
||||
|
ld a, c |
||||
|
ld e, a |
||||
|
ld hl, ROP_SaveMain |
||||
|
jp hl |
||||
|
|
||||
|
ROPScript_SaveMain: ; s02_B0B3 |
||||
|
; ========================================================================== |
||||
|
; Start compiling data into save blob, and applying first crypto layer. |
||||
|
; Each "section" of the save blob has its own, fixed crypto seed and checksum. |
||||
|
; ========================================================================== |
||||
|
|
||||
|
; sSaveSource = $FCDF |
||||
|
dbw $01, $FCDF ; ROP_SetAddr |
||||
|
|
||||
|
; sSaveBlockChecksum = $7F |
||||
|
dbb $02, $7F ; ROP_InitChecksum |
||||
|
|
||||
|
; s02_ADB1 = $8C10E62F |
||||
|
dbl $07, $8C10E62F ; ROP_InitCrypto |
||||
|
|
||||
|
.s02_B0BD |
||||
|
; rept ($48) { |
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; sSaveBlockChecksum += w00_C800 |
||||
|
db $08 ; ROP_AddChecksum |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
; } |
||||
|
dbwb $0C, .s02_B0BD, $48 ; ROP_rept |
||||
|
|
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
db $0B ; ROP_WriteChecksumByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveSource = $FA7A |
||||
|
dbw $01, $FA7A ; ROP_SetAddr |
||||
|
|
||||
|
; sSaveBlockChecksum = $C2 |
||||
|
dbb $02, $C2 ; ROP_InitChecksum |
||||
|
|
||||
|
; s02_ADB1 = $6AF528C2 |
||||
|
dbl $07, $6AF528C2 ; ROP_InitCrypto |
||||
|
|
||||
|
.s02_B0D5 |
||||
|
; rept ($14) { |
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
; } |
||||
|
dbwb $0C, .s02_B0D5, $14 ; ROP_rept |
||||
|
|
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
db $0B ; ROP_WriteChecksumByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveSource = $F84E |
||||
|
dbw $01, $F84E ; ROP_SetAddr |
||||
|
|
||||
|
.s02_B0E2 |
||||
|
; rept ($03) { |
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
; } |
||||
|
dbwb $0C, .s02_B0E2, $03 ; ROP_rept |
||||
|
|
||||
|
; sSaveSource = $F859 |
||||
|
dbw $01, $F859 ; ROP_SetAddr |
||||
|
|
||||
|
; sSaveBlockChecksum = $06 |
||||
|
dbb $02, $06 ; ROP_InitChecksum |
||||
|
|
||||
|
; s02_ADB1 = $EF7305A6 |
||||
|
dbl $07, $EF7305A6 ; ROP_InitCrypto |
||||
|
|
||||
|
.s02_B0F2 |
||||
|
; rept ($4C) { |
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; sSaveBlockChecksum += w00_C800 |
||||
|
db $08 ; ROP_AddChecksum |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
; } |
||||
|
dbwb $0C, .s02_B0F2, $4C ; ROP_rept |
||||
|
|
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
db $0B ; ROP_WriteChecksumByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveSource = $DE41 |
||||
|
dbw $01, $DE41 ; ROP_SetAddr |
||||
|
|
||||
|
; s02_ADB1 = $2A7FEC38 |
||||
|
dbl $07, $2A7FEC38 ; ROP_InitCrypto |
||||
|
|
||||
|
; sSaveBlockChecksum = $3C |
||||
|
dbb $02, $3C ; ROP_InitChecksum |
||||
|
|
||||
|
.s02_B10A |
||||
|
; rept ($21) { |
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; sSaveBlockChecksum += w00_C800 |
||||
|
db $08 ; ROP_AddChecksum |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
; } |
||||
|
dbwb $0C, .s02_B10A, $21 ; ROP_rept |
||||
|
|
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
db $0B ; ROP_WriteChecksumByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveSource = $DE99 |
||||
|
dbw $01, $DE99 ; ROP_SetAddr |
||||
|
|
||||
|
; sSaveBlockChecksum = $E2 |
||||
|
dbb $02, $E2 ; ROP_InitChecksum |
||||
|
|
||||
|
; s02_ADB1 = $4BFC1115 |
||||
|
dbl $07, $4BFC1115 ; ROP_InitCrypto |
||||
|
|
||||
|
.s02_B11E |
||||
|
; rept ($40) { |
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; sSaveBlockChecksum += w00_C800 |
||||
|
db $08 ; ROP_AddChecksum |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
; } |
||||
|
dbwb $0C, .s02_B11E, $40 ; ROP_rept |
||||
|
|
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
db $0B ; ROP_WriteChecksumByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; s02_ADB1 = $A23F387C |
||||
|
dbl $07, $A23F387C ; ROP_InitCrypto |
||||
|
|
||||
|
; sSaveBlockChecksum = $16 |
||||
|
dbb $02, $16 ; ROP_InitChecksum |
||||
|
|
||||
|
; sSaveSource = $A003 |
||||
|
dbw $01, $A003 ; ROP_SetAddr |
||||
|
|
||||
|
.s02_B132 |
||||
|
; rept ($04) { |
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; sSaveBlockChecksum += w00_C800 |
||||
|
db $08 ; ROP_AddChecksum |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
; } |
||||
|
dbwb $0C, .s02_B132, $04 ; ROP_rept |
||||
|
|
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
db $0B ; ROP_WriteChecksumByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; ========================================================================== |
||||
|
; End compiling data into save blob. |
||||
|
; ========================================================================== |
||||
|
|
||||
|
|
||||
|
; ========================================================================== |
||||
|
; Apply second layer of crypto onto the save file as a whole. |
||||
|
; The seed for this crypto is based on random bytes, |
||||
|
; which are stored in the final blob as well. |
||||
|
; ========================================================================== |
||||
|
|
||||
|
; sSaveBlockChecksum = $00 |
||||
|
dbb $02, $00 ; ROP_InitChecksum |
||||
|
|
||||
|
; sSaveSource = $FFE1 |
||||
|
dbw $01, $FFE1 ; ROP_SetAddr |
||||
|
|
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; sSaveBlockChecksum += w00_C800 |
||||
|
db $08 ; ROP_AddChecksum |
||||
|
|
||||
|
; sSaveSource = $B16B |
||||
|
dbw $01, $B16B ; ROP_SetAddr |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveSource = $FFE2 |
||||
|
dbw $01, $FFE2 ; ROP_SetAddr |
||||
|
|
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
db $0B ; ROP_WriteChecksumByte |
||||
|
|
||||
|
; sSaveSource = $B16C |
||||
|
dbw $01, $B16C ; ROP_SetAddr |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveSource = $FF04 |
||||
|
dbw $01, $FF04 ; ROP_SetAddr |
||||
|
|
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; sSaveBlockChecksum += w00_C800 |
||||
|
db $08 ; ROP_AddChecksum |
||||
|
|
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
db $0B ; ROP_WriteChecksumByte |
||||
|
|
||||
|
; sSaveSource = $B16D |
||||
|
dbw $01, $B16D ; ROP_SetAddr |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveSource = $FF05 |
||||
|
dbw $01, $FF05 ; ROP_SetAddr |
||||
|
|
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; w00_C800 = sSaveBlockChecksum |
||||
|
db $0B ; ROP_WriteChecksumByte |
||||
|
|
||||
|
; sSaveSource = $B16E |
||||
|
dbw $01, $B16E ; ROP_SetAddr |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; NOTE: The parameter of this command is modified by the commands above. |
||||
|
; s02_ADB1 = $EFBEADDE |
||||
|
dbl $07, $EFBEADDE ; ROP_InitCrypto |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveBlockChecksum = $55 |
||||
|
dbb $02, $55 ; ROP_InitChecksum |
||||
|
|
||||
|
; sSaveSource = $F350 |
||||
|
dbw $01, $F350 ; ROP_SetAddr |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
.s02_B178 |
||||
|
; rept ($1AB) { |
||||
|
; sSaveSource = $F350 |
||||
|
dbw $01, $F350 ; ROP_SetAddr |
||||
|
|
||||
|
; sSaveBlockChecksum = *sSaveSource |
||||
|
db $0E ; ROP_LoadByte |
||||
|
|
||||
|
; sSaveBlockChecksum += w00_C800 |
||||
|
db $08 ; ROP_AddChecksum |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; sSaveBlockChecksum = *sSaveSource |
||||
|
db $0E ; ROP_LoadByte |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
; } |
||||
|
dbwb $0C, .s02_B178, $D5 ; ROP_rept |
||||
|
dbwb $0C, .s02_B178, $D6 ; ROP_rept |
||||
|
|
||||
|
; sSaveBlockChecksum = $CC |
||||
|
dbb $02, $CC ; ROP_InitChecksum |
||||
|
|
||||
|
; sSaveSource = $ADB1 |
||||
|
dbw $01, $ADB1 ; ROP_SetAddr |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveBlockChecksum ^= w00_C800 |
||||
|
db $09 ; ROP_XorChecksum |
||||
|
|
||||
|
; *(sSaveSource++) = sSaveBlockChecksum |
||||
|
db $0D ; ROP_StoreByte |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; sSaveSource = $F350 |
||||
|
dbw $01, $F350 ; ROP_SetAddr |
||||
|
|
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
; w00_C800 = *(sSaveSource++) |
||||
|
db $03 ; ROP_FetchByte |
||||
|
|
||||
|
; w00_C800 ^= func(s02_ADB1) |
||||
|
db $05 ; ROP_ApplyCrypto |
||||
|
|
||||
|
; rotatebuffer(w00_C800) |
||||
|
db $06 ; ROP_RotateBuffer |
||||
|
|
||||
|
|
||||
|
; Copy save blob from the buffer to final location in SRAM, and end. |
||||
|
db $04 ; ROP_end |
||||
|
|
||||
|
|
||||
|
; Temporary save location for the DelayFrame return pointer |
||||
|
sVBlankReturnPointer: dw ; s02_B4E6 |
||||
|
|
||||
|
VBlankHook_Save: ; s02_B673 |
||||
|
; Saving hook code |
||||
|
|
||||
|
; Check if the "P" tile is on the screen (part of "PLAYER") |
||||
|
ld a,[$C4CD] ; wTileMap + ??? |
||||
|
cp a,"P" ; $8F |
||||
|
ret nz |
||||
|
|
||||
|
; Check that we're trying to make a textbox for saving the game |
||||
|
ld hl,[sp+$12] |
||||
|
ldi a,[hl] |
||||
|
cp a,LOW(Text_WouldYouLikeToSaveTheGame) |
||||
|
ret nz |
||||
|
ldd a,[hl] |
||||
|
cp a,HIGH(Text_WouldYouLikeToSaveTheGame) |
||||
|
ret nz |
||||
|
|
||||
|
; Change that text pointer to an empty text box (only include the TX_END command) |
||||
|
ld [hl],LOW($0134) |
||||
|
inc hl |
||||
|
ld [hl],HIGH($0134) |
||||
|
|
||||
|
; Change the MapTextbox return address to skip to the end of SaveTheGame_yesorno |
||||
|
ld hl,sp+$16 |
||||
|
ld [hl],LOW(SaveTheGame_yesorno + 27) ; $4BCA |
||||
|
|
||||
|
; Change the SaveTheGame_yesorno return address to skip to SaveMenu.refused |
||||
|
inc hl |
||||
|
inc hl |
||||
|
ld [hl],LOW(SaveMenu.refused) |
||||
|
inc hl |
||||
|
ld [hl],HIGH(SaveMenu.refused) |
||||
|
|
||||
|
; Overwrite return pointer for the vblank hook |
||||
|
ld hl,SaveGame |
||||
|
ld a,l |
||||
|
ld [sVBlankReturnPointer],a |
||||
|
ld a,h |
||||
|
ld [sVBlankReturnPointer + 1],a |
||||
|
ld a,BANK(SaveGame) |
||||
|
ld [wVBlankReturnBank],a ; Overwrite return bank? |
||||
|
ret |
||||
|
|
||||
|
UninstallVBlankHook: ; s02_B711 |
||||
|
ld hl, hTransferVirtualOAM |
||||
|
ld [hl], $3E ; ld a, n8 |
||||
|
inc hl |
||||
|
ld [hl], $C4 |
||||
|
ret |
||||
|
|
||||
|
w00_C800: ds $1b0 ; w00_C800 |
||||
|
w00_C9AF: ; w00_C9AF |
||||
|
|
||||
|
wOptions: db ; w01_CFCC |
||||
|
wPartyCount: db ; w01_DCD7 |
||||
|
|
||||
|
w01_DF34: db |
||||
|
wVBlankReturnBank: db ; w01_DF35 |
||||
|
wSavingAllowed: db ; w01_DF3A |
||||
Binary file not shown.
@ -0,0 +1,30 @@ |
|||||
|
|
||||
|
; Break for: |
||||
|
; BC=1A5 |
||||
|
; BC=1A6 |
||||
|
; BC=1A7 |
||||
|
; BC=1A8 |
||||
|
|
||||
|
; Hook this at 02:AF1F |
||||
|
; Unhook when 02:B13D is read (original: ADBA) |
||||
|
ld a, [$AD42] |
||||
|
ld c, a |
||||
|
ld a, [$AD43] |
||||
|
ld b, a |
||||
|
nop |
||||
|
ld a, c |
||||
|
ret |
||||
|
|
||||
|
; Hook this at the end of 02:AFDD |
||||
|
ld a, [$AD42] |
||||
|
ld c, a |
||||
|
ld a, [$AD43] |
||||
|
ld b, a |
||||
|
inc bc |
||||
|
ld a, c |
||||
|
ld [$AD42], a |
||||
|
ld a, b |
||||
|
ld [$AD43], a |
||||
|
|
||||
|
ld sp, $AE18 |
||||
|
ret |
||||
Binary file not shown.
@ -0,0 +1,41 @@ |
|||||
|
$0394 - and a |
||||
|
$0831 - ld hl, n16 |
||||
|
$08F1 - ld bc, n16 |
||||
|
$0933 - xor b |
||||
|
$09A2 - ld bc, de, hl, af, n16 |
||||
|
$09A4 - ld hl, af, n16 |
||||
|
$0D8E - ld c, a |
||||
|
$106A - inc de |
||||
|
$106A - inc de |
||||
|
$1380 - dec de |
||||
|
$1447 - inc hl |
||||
|
$1489 - ld b, a |
||||
|
$1708 - jp hl |
||||
|
$1898 - ld a, [de] |
||||
|
$18D0 - ld a, e |
||||
|
$18DC - ld c, l |
||||
|
$1C85 - ldw hl, [hl] |
||||
|
$1D17 - add hl, bc |
||||
|
$1FA5 - ld e, a |
||||
|
$1FEE - ld [hl], b |
||||
|
$2250 - ld [hl+], a |
||||
|
$2CAD - ld a, c |
||||
|
$2DE0 - or [hl] |
||||
|
$2EC9 - dec a |
||||
|
$3351 - ld [hl], d |
||||
|
$37C2 - inc a |
||||
|
$3E3D - add a |
||||
|
$4128 - ld [de], a |
||||
|
$4404 - ld b, h |
||||
|
$4D6A - ld d, b |
||||
|
$50EC - ld d, [hl] |
||||
|
$65E1 - inc [hl] |
||||
|
$ADBA - ld a, [hl+] |
||||
|
$ADBC - ld a, [hl-] |
||||
|
$ADBE - ld [hl], c |
||||
|
$ADC0 - ld b, [hl] |
||||
|
$ADC2 - add b |
||||
|
$ADC4 - srl a |
||||
|
$ADC7 - xor [hl] |
||||
|
$ADC9 - call z, n16 |
||||
|
$ADCC - add [hl]/xor [hl] |
||||
@ -0,0 +1,196 @@ |
|||||
|
#include <stdio.h> |
||||
|
|
||||
|
// Final buffer goes at 3:A100 of the save file
|
||||
|
|
||||
|
char buf[0x1b0]; |
||||
|
|
||||
|
int s02_ADB1; |
||||
|
|
||||
|
char s02_ADB1_b; |
||||
|
char s02_ADB2; |
||||
|
char s02_ADB3; |
||||
|
char s02_ADB4; |
||||
|
|
||||
|
char sSaveBlockChecksum; |
||||
|
|
||||
|
char func() |
||||
|
{ |
||||
|
s02_ADB1_b = (s02_ADB1 >> 0) & 0xFF; |
||||
|
s02_ADB2 = (s02_ADB1 >> 8) & 0xFF; |
||||
|
s02_ADB3 = (s02_ADB1 >> 16) & 0xFF; |
||||
|
s02_ADB4 = (s02_ADB1 >> 24) & 0xFF; |
||||
|
|
||||
|
s02_ADB2 ^= (s02_ADB1_b + 1) ^ s02_ADB4; |
||||
|
s02_ADB3 += s02_ADB2; |
||||
|
s02_ADB4 = s02_ADB2 ^ (s02_ADB4 + (s02_ADB3 / 2)); |
||||
|
|
||||
|
s02_ADB1 = (s02_ADB4 << 24) | (s02_ADB3 << 16) | (s02_ADB2 << 8) | s02_ADB1_b; |
||||
|
|
||||
|
return s02_ADB4; |
||||
|
} |
||||
|
|
||||
|
int main() |
||||
|
{ |
||||
|
int bufi = 0; |
||||
|
|
||||
|
// sSaveSource = $FCDF;
|
||||
|
sSaveBlockChecksum = 0x7F; |
||||
|
s02_ADB1 = 0x8C10E62F; |
||||
|
for (int i = 0; i < 0x48; i++) { |
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
buf[bufi] ^= func(); |
||||
|
sSaveBlockChecksum += buf[bufi]; |
||||
|
bufi++; |
||||
|
|
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
sSaveBlockChecksum ^= buf[bufi]; |
||||
|
buf[bufi] ^= func(); |
||||
|
bufi++; |
||||
|
} |
||||
|
buf[bufi] = sSaveBlockChecksum; |
||||
|
bufi++; |
||||
|
|
||||
|
// sSaveSource = $FA7A;
|
||||
|
sSaveBlockChecksum = 0xC2; |
||||
|
s02_ADB1 = 0x6AF528C2; |
||||
|
for (int i = 0; i < 0x14; i++) { |
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
buf[bufi] ^= func(); |
||||
|
sSaveBlockChecksum ^= buf[bufi]; |
||||
|
bufi++; |
||||
|
} |
||||
|
buf[bufi] = sSaveBlockChecksum; |
||||
|
bufi++; |
||||
|
|
||||
|
// sSaveSource = $F84E;
|
||||
|
for (int i = 0; i < 0x03; i++) { |
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
bufi++; |
||||
|
} |
||||
|
|
||||
|
// sSaveSource = $F859;
|
||||
|
sSaveBlockChecksum = 0x06; |
||||
|
s02_ADB1 = 0xEF7305A6; |
||||
|
for (int i = 0; i < 0x4C; i++) { |
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
buf[bufi] ^= func(); |
||||
|
sSaveBlockChecksum ^= buf[bufi]; |
||||
|
bufi++; |
||||
|
|
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
buf[bufi] ^= func(); |
||||
|
sSaveBlockChecksum += buf[bufi]; |
||||
|
bufi++; |
||||
|
} |
||||
|
buf[bufi] = sSaveBlockChecksum; |
||||
|
bufi++; |
||||
|
|
||||
|
// sSaveSource = $DE41;
|
||||
|
s02_ADB1 = 0x2A7FEC38; |
||||
|
sSaveBlockChecksum = 0x3C; |
||||
|
for (int i = 0; i < 0x21; i++) { |
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
sSaveBlockChecksum += buf[bufi]; |
||||
|
buf[bufi] ^= func(); |
||||
|
bufi++; |
||||
|
} |
||||
|
buf[bufi] = sSaveBlockChecksum; |
||||
|
bufi++; |
||||
|
|
||||
|
// sSaveSource = $DE99;
|
||||
|
sSaveBlockChecksum = 0xE2; |
||||
|
s02_ADB1 = 0x4BFC1115; |
||||
|
for (int i = 0 ; i < 0x40; i++) { |
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
buf[bufi] ^= func(); |
||||
|
sSaveBlockChecksum += buf[bufi]; |
||||
|
bufi++; |
||||
|
} |
||||
|
buf[bufi] = sSaveBlockChecksum; |
||||
|
bufi++; |
||||
|
|
||||
|
s02_ADB1 = 0xA23F387C; |
||||
|
sSaveBlockChecksum = 0x16; |
||||
|
// sSaveSource = $A003;
|
||||
|
for (int i = 0; i < 0x04; i++) { |
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
buf[bufi] ^= func(); |
||||
|
sSaveBlockChecksum ^= buf[bufi]; |
||||
|
sSaveBlockChecksum += buf[bufi]; |
||||
|
bufi++; |
||||
|
} |
||||
|
buf[bufi] = sSaveBlockChecksum; |
||||
|
bufi++; |
||||
|
|
||||
|
sSaveBlockChecksum = 0x00; |
||||
|
|
||||
|
// sSaveSource = $FFE1;
|
||||
|
buf[bufi] = (char)(bufi & 0xFF); |
||||
|
sSaveBlockChecksum += buf[bufi]; |
||||
|
sSaveSource = 0xB16B; |
||||
|
*(sSaveSource++) = sSaveBlockChecksum; |
||||
|
bufi++; |
||||
|
|
||||
|
// sSaveSource = $FFE2;
|
||||
|
// buf[bufi] = *(sSaveSource++);
|
||||
|
// sSaveBlockChecksum ^= buf[bufi];
|
||||
|
// buf[bufi] = sSaveBlockChecksum;
|
||||
|
// sSaveSource = $B16C;
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// bufi++;
|
||||
|
|
||||
|
// sSaveSource = $FF04;
|
||||
|
// buf[bufi] = *(sSaveSource++);
|
||||
|
// sSaveBlockChecksum += buf[bufi];
|
||||
|
// buf[bufi] = sSaveBlockChecksum;
|
||||
|
// sSaveSource = $B16D;
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// bufi++;
|
||||
|
// sSaveSource = $FF05;
|
||||
|
// buf[bufi] = *(sSaveSource++);
|
||||
|
// sSaveBlockChecksum ^= buf[bufi];
|
||||
|
// buf[bufi] = sSaveBlockChecksum;
|
||||
|
// sSaveSource = $B16E;
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// bufi++;
|
||||
|
// s02_ADB1 = $EFBEADDE;
|
||||
|
// bufi++;
|
||||
|
// bufi++;
|
||||
|
// sSaveBlockChecksum = $55;
|
||||
|
// sSaveSource = $F350;
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// rept ($1AB) {;
|
||||
|
// sSaveSource = $F350;
|
||||
|
// sSaveBlockChecksum = *sSaveSource;
|
||||
|
// sSaveBlockChecksum += buf[bufi];
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// sSaveBlockChecksum = *sSaveSource;
|
||||
|
// sSaveBlockChecksum ^= buf[bufi];
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// buf[bufi] ^= func(s02_ADB1);
|
||||
|
// bufi++;
|
||||
|
// };
|
||||
|
|
||||
|
// sSaveBlockChecksum = $CC;
|
||||
|
// sSaveSource = $ADB1;
|
||||
|
// sSaveBlockChecksum ^= buf[bufi];
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// bufi++;
|
||||
|
// sSaveBlockChecksum ^= buf[bufi];
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// bufi++;
|
||||
|
// sSaveBlockChecksum ^= buf[bufi];
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// bufi++;
|
||||
|
// sSaveBlockChecksum ^= buf[bufi];
|
||||
|
// *(sSaveSource++) = sSaveBlockChecksum;
|
||||
|
// bufi++;
|
||||
|
// sSaveSource = $F350;
|
||||
|
// buf[bufi] = *(sSaveSource++);
|
||||
|
// buf[bufi] ^= func(s02_ADB1);
|
||||
|
// bufi++;
|
||||
|
// buf[bufi] = *(sSaveSource++);
|
||||
|
// buf[bufi] ^= func(s02_ADB1);
|
||||
|
// bufi++;
|
||||
|
} |
||||
@ -0,0 +1,72 @@ |
|||||
|
# These are the patches I used to speed through the game. |
||||
|
# They include: |
||||
|
# - All pokemon's stats and HP are max when sent into battle |
||||
|
# - HP bars deplete instantly (to avoid destiny bond softlocking the game...) |
||||
|
# - No trainers can spot you (used to solve PK1 mostly) |
||||
|
|
||||
|
diff --git a/Makefile b/Makefile
|
||||
|
index e213bf63c..812cb9799 100644
|
||||
|
--- a/Makefile
|
||||
|
+++ b/Makefile
|
||||
|
@@ -89,6 +89,7 @@ endif
|
||||
|
pokecrystal.gbc: $(crystal_obj) pokecrystal.link |
||||
|
$(RGBLINK) -n pokecrystal.sym -m pokecrystal.map -l pokecrystal.link -o $@ $(crystal_obj) |
||||
|
$(RGBFIX) -Cjv -i BYTE -k 01 -l 0x33 -m 0x10 -p 0 -r 3 -t PM_CRYSTAL $@ |
||||
|
+ dd bs=1 if=baserom.gbc of=pokecrystal.gbc count=2 conv=notrunc skip=334 seek=334
|
||||
|
tools/sort_symfile.sh pokecrystal.sym |
||||
|
|
||||
|
pokecrystal11.gbc: $(crystal11_obj) pokecrystal.link |
||||
|
diff --git a/engine/battle/core.asm b/engine/battle/core.asm
|
||||
|
index 38abbb51f..f752e4d46 100644
|
||||
|
--- a/engine/battle/core.asm
|
||||
|
+++ b/engine/battle/core.asm
|
||||
|
@@ -3884,11 +3884,13 @@ InitBattleMon:
|
||||
|
ld bc, MON_NAME_LENGTH |
||||
|
call CopyBytes |
||||
|
ld hl, wBattleMonAttack |
||||
|
- ld de, wPlayerStats
|
||||
|
+ ld a, $ff
|
||||
|
ld bc, PARTYMON_STRUCT_LENGTH - MON_ATK |
||||
|
- call CopyBytes
|
||||
|
- call ApplyStatusEffectOnPlayerStats
|
||||
|
- call BadgeStatBoosts
|
||||
|
+ call ByteFill
|
||||
|
+ ld a, $ff
|
||||
|
+ ld [wBattleMonHP], a
|
||||
|
+ nop
|
||||
|
+ nop
|
||||
|
ret |
||||
|
|
||||
|
BattleCheckPlayerShininess: |
||||
|
diff --git a/engine/overworld/events.asm b/engine/overworld/events.asm
|
||||
|
index a84d72db4..9d1dd8d44 100644
|
||||
|
--- a/engine/overworld/events.asm
|
||||
|
+++ b/engine/overworld/events.asm
|
||||
|
@@ -294,8 +294,10 @@ PlayerEvents:
|
||||
|
CheckTrainerBattle_GetPlayerEvent: |
||||
|
nop |
||||
|
nop |
||||
|
- call CheckTrainerBattle
|
||||
|
- jr nc, .nope
|
||||
|
+ nop
|
||||
|
+ nop
|
||||
|
+ nop
|
||||
|
+ jr .nope
|
||||
|
|
||||
|
ld a, PLAYEREVENT_SEENBYTRAINER |
||||
|
scf |
||||
|
diff --git a/engine/pokemon/health.asm b/engine/pokemon/health.asm
|
||||
|
index d11a073b5..0cd97d237 100644
|
||||
|
--- a/engine/pokemon/health.asm
|
||||
|
+++ b/engine/pokemon/health.asm
|
||||
|
@@ -104,7 +104,9 @@ ComputeHPBarPixels:
|
||||
|
ret |
||||
|
|
||||
|
AnimateHPBar: |
||||
|
- call WaitBGMap
|
||||
|
+ ret
|
||||
|
+ ret
|
||||
|
+ ret
|
||||
|
call _AnimateHPBar |
||||
|
call WaitBGMap |
||||
|
ret |
||||
Loading…
Reference in new issue