Cutting my teeth - 3 to 6 button layout?

likshot · Post by **likshot** » Sat Oct 31, 2009 12:32 am

Going to embark on a project and I'm trying to see if it's possible to change a function of a game to a different button.. Problem is the game uses the general 3 and I would like to map this (basically involves depressing B) to a 4th button - ala 6 button layout.

Is this feasible?

Rifling through some of the documents with my brow furrowed it looks like there's no speed reading course.
This would be arduous for me, and probably daunting but you have to eat the elephant one bite at a time and I'm willing to earn my hax0rz1! certificate.

Not looking to be bottle fed but can you guys help get me on the right path?
Do I start with trackers to detect the input?

Chilly Willy · Post by **Chilly Willy** » Sat Oct 31, 2009 6:14 pm

Disassemble the game and look for references to the IO ports. Once you've found the subroutine that gets the port, look for code that calls it (or if the subroutine stores the port to memory, look for references to that memory location).

likshot · Post by **likshot** » Sun Nov 01, 2009 8:00 am

Chilly Willy wrote:Disassemble the game and look for references to the IO ports. Once you've found the subroutine that gets the port, look for code that calls it (or if the subroutine stores the port to memory, look for references to that memory location).

Thanks for the reply CW. I think you actually answered a question of mine at tototek's boards about their md pro cards.

The game doesn't have typical 4.5MM bit screws, Id have to wreck the cart to get it open.

Is there anyway to do this with watchers? I was messing with kmod earlier.

EDIT: Your referring to IDA pro?

Flygon · Post by **Flygon** » Sun Nov 01, 2009 9:15 am

Yeah, he actually means disassembling it with IDA, not the cartridge itself.

Chilly Willy · Post by **Chilly Willy** » Sun Nov 01, 2009 5:51 pm

Flygon wrote:Yeah, he actually means disassembling it with IDA, not the cartridge itself.

What he said.

Just get a rom image of the game of the net and run it through your favorite disassembler. Windows folks mainly use IDA.

Most disassemblers have search features, so if you search for the IO base address, it can narrow down what you need to disassemble quickly.

likshot · Post by **likshot** » Mon Nov 02, 2009 8:26 pm

Chilly Willy wrote:
Flygon wrote:Yeah, he actually means disassembling it with IDA, not the cartridge itself.
What he said.

Just get a rom image of the game of the net and run it through your favorite disassembler. Windows folks mainly use IDA.

Most disassemblers have search features, so if you search for the IO base address, it can narrow down what you need to disassemble quickly.

Left myself wide open for a insult there, thanks for taking the high road on my question about opening the cart

. Thankfully you guys don't appear to be that callused.

Looking for the IO in IDA I think that I've found the subroutines(?) in CTRL(1-3) and DATA(1-3). Opening the sub and viewing in HEX A I've found some hex offsets and values. I'm not sure if they are useful or worth pursuing.

Here's a screen shot from IDA. Am I following the right bread crumbs?

likshot · Post by **likshot** » Fri Nov 06, 2009 6:52 pm

Any takers?

Chilly Willy · Post by **Chilly Willy** » Sat Nov 07, 2009 12:05 am

The code around the spots labeled data1 and data2 look like they're probably the subroutines that read port 1 and port 2. Disassemble the code around those spots to see what's going on. If you see a joypad reading routine there, then look for stuff calling the address where the routine starts.