Ya Se Chuan Shuo/Notes

The following article is a Notes Page for Ya Se Chuan Shuo.

Gfx format

Most gfx are uncompressed but some are compressed. The compression scheme is as follows :

• special code on 1 byte, or 32 bits mask (if the first byte is 1, then the gfx data is over) read from msb to lsb
  • if mask bit is 1, then read the next byte and copy it
  • if mask bit is 0, repeat last read byte
• Special codes are :
  • 0: next 32 bytes are uncompressed
  • 1: end of data

For example:

   0xc0c70: e7 af ee bf 33 32 22 33 22 32 3f f3 2f 23 f2 f3 23 33 32 23 33 f2 33 32 f2 2f 33 f2 f3 
   
   mask=e7afeebf
   mask bits: 1  1  1   0 _   0  1  1  1_ 1   0   1   0 _ 1  1  1  1_ 1  1  1   0 _ 1  1  1   0 _ 1   0   1  1_ 1  1  1  1
   output:   33 32 22 (22)_(22) 33 22 32_3f (3f) f3 (f3)_2f 23 f2 f3_23 33 32 (32)_23 33 f2 (f2)_33 (33) 32 f2_2f 33 f2 f3 

Font format

There are 7 fonts of 240 characters and an 8th of 102 characters. Their address are stored in pointers at 0xc51b2. Their data is stored as 1bpp bitmaps as four 8x8 tiles, from top-left to bottom-right.

Tilemap format

Some tilemaps are compressed. The compression scheme is as follows.

• if byte == 0xff then next byte is read and becomes the upper byte of output (if next byte is 0xff, the tilemap is complete)
• else next byte is lower byte of output value and write output value

For example:

   0x10d3a4:
   ff 00 (upper_byte=00) 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10
   output: 0001 0002 0003 0004 0005 0006 0007 0008 0009 000a 000b 000c 000d 000e 000f 0010
   ff 08 (upper_byte=08) 10 0f 0e 0d 0c 0b 0a 09 08 07 06 05 04 03 02 01 
   output: 0810 080f 080e 080d 080c 080b 080a 0809 0808 0807 0806 0805 0804 0803 0802 0801
   ff 00 (upper_byte=00) 11...
   output: 0011...

Copy protection

The game use a copy protection system. Some data must be found outside the ROM address range (probably provided by some chip in the cart), else the game will show some malfunctions (random crashes, inventory cleared, bad music playing, bad samples, ...)

Here's what I found so far:

• at 0x282e:

   0c39 00c9 00400004    cmpi.b #0xc9, (0x400004)
   6700 0014             beq.w  0x284c

This test should be passed (0x400004 is an address out of ROM range and probably written by the card), but won't if played from an everdrive or emulator. Therefore it'll execute various instructions deleting inventory or money. You can replace it with:

   6000 001c    bra 0x284c

• at 0x1e498c:

   d039 00a00030    add.b (0xa00030), d0

It prevents playing the right sound track, and can cause crashes. You can replace it by

   4e71    nop
   4e71    nop
   4e71    nop

• at 0x1e3bc8:

   21 32 00        ld hl,0x32
   86              add a,(hl)

It prevents playing the right samples in a track. You can replace it by

   00 nop
   00 nop
   00 nop
   00 nop

• at 0x1e3b32:

   9d c8 37 b3

should be replaced by

   00 60 37 cb