Disassembling Tennokoe Bank

[MooZ]

Hi there!
I started disassembling the Tennokoe Bank some days ago. I put all the files [there].
There are a lot of "weird" stuffs. The first on I encountered is in the code for reading joypad state.
$260b contains the current pad state.
$260d contains the previous pad state.
$260e seems to contains the diff between those two (($260b eor $260d) and $260b) but I'm not sure about it.
The "weird" part is about $260e. It's ORed with current pad state ($260d)... Why?
The code from line 42 to 47 as long as the code following the call to l_e3d1 in the reset irq are cryptic... But in the case of the tennokoe bank, it's never executed. It only looks for 1 pad so $260f is equals 0. But who knows, maybe it's changed somewhere else.

Another funny stuffs. You can find NEUTOPIA (file offset: $8816), BOMBERMAN, COBRA, as long as other game names in the rom... Maybe it's the saved data stored on the card when it was dumped
You can also find some infos in the rom. For example :

Code: Select all

00001FC0   4B 65 69 27  73 20 49 44  20 41 52 45  41 2E 20 20  Kei's ID AREA.
00001FD0   93 56 82 CC  90 BA 83 6F  83 93 83 4E  56 31 2E 34  .V.....o...NV1.4
00001FE0   44 61 74 65  2E 31 39 39  31 2D 41 50  52 2D 31 35  Date.1991-APR-15

And there's also what seems to be the team credits at the end of the rom (file offset: $1FBA4). You can also find the name of Takaki Kobayashi ($1FDF6) who seems to belong to Hudson Soft's pc-engine development tool staff (source : [1], [2], [3]).

Enough stalking, I had to find the BRAM to Tennokoe bank transfer routines

[MooZ]

Here're some updates :
The BRAM is mapped in MPR #4. $40,$41 is used as a pointer to $8000 (the bram).
As stated by http://pcedev.net/pce_docs/pcetech.txt BRAM is unlock by writing the sequence $48, $75, $80 to $1807. This is done using the tin instruction :

Code: Select all

TIN $fd77, $1807, $0003

It's used at $fd63, $ec69, $e671, $ee08. For example $e671, belongs to what can be cold the unlockBram routine (starts at $e667). On the other hand the BRAM is locked (read from $1803) at $fd92, $ec80, $e681. And like $e667, there's what seems to be a lockBram routine at $e67c.

It seems that BRAM download to Tennokoe is done in 2 steps. The first one involves copying the 2Kb of BRAM to BSS with:

Code: Select all

TII $8000, $3800, $0800

This can be found at the subroutine starting at $ee02.
It still haven't found the part where the BSS data is copied to the tennokoe...

Bonus : etripator csv file for all this.

Code: Select all

code;l_fd57.asm;0;fd57;1d57;-1
code;l_ec40.asm;0;ec40;0c40;-1
code;l_e667.asm;0;e667;0667;-1
code;l_ee02.asm;0;ee02;0e02;-1
code;l_f97a.asm;0;f97a;197a;-1
code;l_e67c.asm;0;e67c;067c;-1
code;l_fcdc.asm;0;fcdc;1cdc;-1
code;l_fcdd.asm;0;fcdd;1cdd;-1
code;l_eef4.asm;0;eef4;0ef4;-1

[tomaitheous]

Is it doing the TII to BSS while in CSH or CSL?

[MooZ]

Woot! Found it!
So the tennokoe's flash is at segment $40. And according to http://turbo.mindrec.com/tginternals/hw/ it's right in the HuCard storage.
The bad news is that this piece of code is located at $2755 (MPR 1 : $F8) in bss
It's initialized at $edea.

Code: Select all

TII $edf2, $2755, $0008
RTS

And set up $eeb6 (the routine seems to start at $eeac)

Code: Select all

LDA #$00
STA $2756
LDA #$38
STA $2757
LDA $edfa,X
STA $2758
STA $0b
LDA $edfb,X
STA $2759
STA $0c

$edfa contains the list of offsets to tennokoe internal flash

Code: Select all

00 80 00 88 00 90 00 98

So that's $8000, $8800, $9000 and $9800. That matches the 4 little chests

edit: @tomaitheous it seems to be done in csl mode.

[Duchemole]

I can explain the cobra/bomber man/urusei thing
When you got a brand new ten no koe, there were many hidden saves for Hudson games in box 4 (mostly at the end of games)
You could make them appear doing an amazingly complicated dpad/buttons code (that I can post here later if anyone is interested in ...)

[MooZ]

That'd be awesome!

[Duchemole]

ok, here it is, but good luck, it's complicated, i've tried to make it on emulator, never managed to
i could on a true ten no koe, but you need to have never used box 4 (not to delete hidden files)
but i'm sure it would be possible to make it using emulation (good luck, if you manage to, please, share save file ...)
so, here we go, before turning on the console, hold down II, I, select, run, up/left, until title screen appears
then release the buttons, and push:
Left + I (simultaneously) X 4
Down + I X 6
Right + I X 2
Up + I X 2
now, hold on select button, and do
left X 4
down X 6
right X 2
up X 2
release select then push run
watch in box 4
good luck !!!

[MooZ]

With mednafen and the no-intro dump:

I got this after the 10th attempt. I think the key is to rearrange the keyboard layout in order to have I,II,SEL and RUN on the same line.
And also press the evil II, I, SEL, RUN, UP, LEFT and press F11 to reset the hw.

The 7z archive contains the mednafen save state ( Ten no Koe Bank (Japan).e0047b06dc84cb242cced8c5fa7efafe.nc1 )

[MooZ]

Here's the names of the savegames in the no-intro rom:

• NEUTOPIA1
• MOTURBO-1
• MOMODE2-1
• MOMOKATSU
• BOMBERMAN
• POPULOUS.
• ADVENTURE1
• TENGAI1
• COBRA1
• YS.DATA.01
• YS.DATA.02
• YS3.DAT.01
• URUSEI1
• MITUBATI1

[MooZ]

Those savegames are in ROM. The box 4 of my Ten no Koe bank already contains a save game. So I decided to dump it with a Magic Griffin to see if I find some 14 hidden savegames. And indeed they were there. Only the ROM was dumped. I couldn't find my save games in it.
So I wrote a small program that upload those savegames to the BRAM.
box4.pce