Page 1 of 10
comprehensive SMB1 disassembly
Posted: Tue Feb 20, 2007 8:26 pm
by doppelganger
Some of you out there in the #nesdev channel may already know about this, but under the sage advice of Memblers, I have decided to post it here. (The old link at the geocities page no longer works for obvious reasons.)
http://www.romhacking.net/docs/344/
As-is, it will work with x816 without any modifications. I have gotten it to work with cc65's assembler, ca65. However, you need to make some modifications to make it work properly.
First, you gotta change all the ".dw" to ".word", and ".db" to ".byte". Then you gotta make a small modification to the directives portion of the file.
Code: Select all
;-------------------------------------------------------------------------------------
;DIRECTIVES
; .index 8 <-- either remove these two or comment them out
; .mem 8
.p02 <-- you need to add this directive
.org $8000
;-------------------------------------------------------------------------------------
Once you assemble the file, you will end up with an object file. In order to get the binary out of it, you need to run ld65. However, ld65 requires a config file to link to the object file properly. So create a text file with any name and put this in it:
Code: Select all
MEMORY {
ROM0: start = $8000, size = $8000, file = "smbdis.bin" ;
}
SEGMENTS {
CODE: load = ROM0, type = ro;
}
Then run the linker and you should end up with the appropriate binary. If you want to, you can change the name of the filename in the "file" portion of the MEMORY config section, but the rest of it must be left as-is.
I hope this has been helpful.
Posted: Tue Feb 20, 2007 10:45 pm
by baisoku
Very interesting reading. Thanks for sharing.
Posted: Wed Feb 21, 2007 3:37 am
by tepples
Posted: Wed Feb 21, 2007 4:44 am
by doppelganger
No. Although it is true I did compare notes between both my disassembly and that one (mostly in regards to the level data format), my disassembly was built completely from scratch using a disassembly run on the program rom with tracer.exe written by koitsu, with no distinction between data and code.
There are some other files on this page that are related to smbnotes.zip (and one of them is a much older copy of smbnotes.asm)
Link removed because it was broken.
Posted: Wed Feb 21, 2007 6:13 am
by commodorejohn
We can always use more of these. Personally, I'd like to see someone take apart Final Fantasy or another RPG (Dragon Warrior, maybe, it's only 80KB.)
Posted: Wed Feb 21, 2007 9:36 am
by dvdmth
commodorejohn wrote:We can always use more of these. Personally, I'd like to see someone take apart Final Fantasy or another RPG (Dragon Warrior, maybe, it's only 80KB.)
I went through Final Fantasy some time ago (in a hex editor). The code for its menus and playfield mode is pretty straightforward, but its battle system is a HUGE mess (no wonder it had so many bugs). You can tell that the battle system was written by a different group of programmers and that the group had very limited 6502 experience (lots of zero-page accesses in absolute addressing mode, arithmetic operations done in very inefficient ways, and even some basic assembly errors that contribute to problems like the LOCK spell not working). Frankly, it's amazing to me that the battle system worked at all.
The code in Final Fantasy 2 and 3 (for NES) is much cleaner, although both suffer from a bad pseudo-random number generator (affecting battle mode only), and both still have their share of bugs (the infamous level-up chear in FF2 and the "item upgrade" cheat in FF3).
Posted: Wed Feb 21, 2007 9:37 am
by Bregalad
Personally, I'd like to see someone take apart Final Fantasy or another RPG (Dragon Warrior, maybe, it's only 80KB.)
I've taken apart a considerable amount of the last two banks of Final Fantasy (the second-to last is holing all the menu stuff, and the last does the field engine amont other general-purpose stuff). However, I did it for myself, and now I think all my notes about it are lost and I really don't remember where they are since I've changed my PC.
However, FF2 and FF3's code are very similar to FF1's (down to the loaction of some variables), but the only one I traced seriously was FF1. I've also traced some stuff in Hanjuku Hero, but it wasn't getting too well, because the game is constantly testing variable it is never writing to, and writing to variables it will never test, and that makes it very confusing. I tried tracing Just Breed a very little bit, but it was incredibly confusing.
Posted: Wed Feb 21, 2007 2:05 pm
by dvdmth
Bregalad wrote:However, FF2 and FF3's code are very similar to FF1's (down to the loaction of some variables), but the only one I traced seriously was FF1.
There are a lot of similarities between FF1 and FF2/3 in the playfield engine, but the engine was significantly enhanced (particularly regarding dialogue and cutscenes, which are very primitive in FF1). Menus have a more structured approach in FF2 and FF3, allowing for more flexibility. Having said that, the biggest change (by far) is the battle system, which was completely rewritten, seemingly from scratch.
Posted: Thu Feb 22, 2007 11:48 am
by Bregalad
I traced FF1's menu wich allow a lot of flexibility : Each window can be positionned and sized independantly. However, a few thing, like the cursor position and the orb's attribute in the main menu, are 'hard coded', and need to be manually chnaged if desired. I remember doing a FF1 hack with a completely different menu setup (the winow were positionned on the left and the menu on the right, like recent FF games).
FF3 allowed the same system to work even more easily, because the cursor's position is calculated from the windows position. I don't know about FF2, but it shouldn't be very different.
I haven't traced any battle stuff for any of the 3 games, so I don't know. The only thing I think I traced is that sound effect from battle were handled by a simple sound effect engine, while the other ones were just hard-coded APU writes with a variable disabling the Square 2 channel begin used.
Posted: Thu Feb 22, 2007 2:16 pm
by doppelganger
Well, good luck with that if you decide to pluck at it some more.
Posted: Thu Feb 22, 2007 2:58 pm
by Bananmos
Thanks for sharing it! A really nice RE work, with enough comments so that even the lazy ones among us can easily learn what made the old classic tick. A must read on a rainy day! :)
Posted: Fri Feb 23, 2007 10:07 am
by doppelganger
Glad you guys like it :-)
Posted: Thu Mar 29, 2007 1:29 pm
by beneficii
One bug, on line 7162, I think the beq $bcea should read as beq ExitPUp. Other than that, this is excellent! Thank you for this!
Posted: Thu Mar 29, 2007 10:47 pm
by doppelganger
Wow, awfully keen eyes you have there. I did not notice that myself. The address was correct, I just forgot to change it to a label. Anyway, correction made.
Posted: Fri Mar 30, 2007 12:50 am
by beneficii
And don't mean to be picky, but other one bug at line number 11,469: I think jsr $e02f should read as jsr SetStun.
^_^
Still, thank you for this!
EDIT: BTW, what was your methodology for doing this disassembly?