Page 3 of 3
Posted: Fri Dec 10, 2010 7:17 pm
by Dwedit
I was considering using the unofficial opcodes, but Martin Korth's NO$NES page gives stern warnings against using them.
Posted: Fri Dec 10, 2010 8:35 pm
by MottZilla
tokumaru wrote:What I really want to know is, after you guys finish this arguably pointless discussion, how do you plan on making this new name official, considering that the presence of the 6502 is much wider than its use on the NES. We can't even change stuff that only pertains to the NES (iNES header, for example)!
QFT. The only thing to keep in mind is the actual NES behaves a certain way on these instructions and that unless you have good reason to use them, don't use them in your own projects. But if writing a NES emulator, you need to keep in mind some software might use/abuse them. However in my experience with emulation, no game I encountered ever executed an undocumented opcode unless the emulator had a bug/crash like incorrect bankswitching and jumping to code that wasn't there.
Re: illegal opcodes on 6502 nes version
Posted: Mon Sep 10, 2012 8:09 am
by puzzud
I know this thread has been inactive for some time, but I figure it was worth mentioning. I'm in the process of trying to hack the Duck Hunt VS ROM to work from a PowerPak. After having disassembled the PRG ROM, not too long after the RESET vector, the code path encounters illegal opcodes. It's pretty obvious and it is not misinterpreted interrupt code. The disassembler I'm using does not yet support illegal opcodes, so it doesn't attempt to make sense of code after the illegals either.
I thought it very odd that I would see Nintendo using illegal opcodes. From reading this thread, it seems like it's really odd. I can provide more detail about where and what opcodes I'm seeing. I think some are double nops, but I was going to put those sections of bytes through an illegal opcode enabled disassembler before I made any serious attempts to figure out what's going on.
Re: illegal opcodes on 6502 nes version
Posted: Mon Sep 10, 2012 11:51 am
by lidnariq
puzzud wrote:[in Duck Hunt VS] not too long after the RESET vector, the code path encounters illegal opcode
Byte offsets? I just disassembled $8000-$80C2 and didn't see any. (image CRC32: 45B180F7)
Re: illegal opcodes on 6502 nes version
Posted: Mon Sep 10, 2012 3:37 pm
by puzzud
Follow the code down from $8000 (RESET) to $805f, where there are a handful of subroutine jumps. One of those calls goes to $80b6:
Code: Select all
P_80B6 ; [80B6]
lda Z_24
beq A_80BD
jmp J_8101 ; [8101]
A_80BD ; [80BD]
lda Z_25
jsr P_85B3 ; [85B3]
tax
!byte $82 ; illegal opcode
E_80C4 ; [80C4]
!byte $D4 ; .
E_80C5 ; [80C5]
!byte $9C ; .
E_80C6 ; [80C6]
ora Z_9D
!byte $1C ; illegal opcode
E_80C9 ; [80C9]
sta A_A9A3,X
cmp A_6D87,Y
txa
!byte $AF ; illegal opcode
E_80D1 ; [80D1]
!byte $89, $16, $AC, $4E, $AC, $6D, $AC ; ...N.m.
!byte $EF, $AC, $A3, $A9, $FC, $80, $62 ; ......b
!byte $A0, $D9, $87, $D9, $87, $C2, $84 ; .......
!byte $34, $88, $55, $B2, $81, $B2, $B6 ; 4.U....
!byte $B2, $CE, $B7, $17, $BA, $E6, $B7 ; .......
!byte $48, $83, $22, $81, $1F, $82, $27 ; H."...'
!byte $9A, $A9, $0A, $85, $25, $60 ; ....%`
J_8101 ; [8101]
lda Z_26
jsr P_85B3 ; [85B3]
!byte $92 ; illegal opcode
E_8107 ; [8107]
sty A_8CC8
!byte $13 ; illegal opcode
E_810B ; [810B]
sta A_8E1D
lsr Z_8E
!byte $5A ; illegal opcode
S_8111
@lidnariq, am I am looking at this code incorrectly? The CRC32 for the image I'm using is e2554e0a. I got the image form a large comprehensive NES ROM torrent, the file name is "Duck Hunt (VS).nes". The torrent includes just one other copy of Duck Hunt VS entitled "Duck Hunt (VS) [b1].nes". Its CRC32 is 8862afd7 but I notice there seems to be graphical corruption with the dog.
Re: illegal opcodes on 6502 nes version
Posted: Mon Sep 10, 2012 3:54 pm
by hcs
Is that 85B3 by any chance the handler for the funky embedded switch that I've heard about? I don't have the ROM on hand, but it may be expecting to be followed by a table, the next few bytes are (according my reassembly):
AA 82
D4 9C
05 9D
1C 9D
Which look like plausible jump targets. For reference:
viewtopic.php?f=10&t=8956
Re: illegal opcodes on 6502 nes version
Posted: Mon Sep 10, 2012 4:07 pm
by lidnariq
Yeah, $85B3 looks like:
Code: Select all
__85b3: STX $27 ; $85b3: 86 27
STY $28 ; $85b5: 84 28
ASL ; $85b7: 0a
TAY ; $85b8: a8
INY ; $85b9: c8
PLA ; $85ba: 68
STA $14 ; $85bb: 85 14
PLA ; $85bd: 68
STA $15 ; $85be: 85 15
LDA ($14),y ; $85c0: b1 14
TAX ; $85c2: aa
INY ; $85c3: c8
LDA ($14),y ; $85c4: b1 14
STA $15 ; $85c6: 85 15
STX $14 ; $85c8: 86 14
LDX $27 ; $85ca: a6 27
LDY $28 ; $85cc: a4 28
JMP ($0014) ; $85ce: 6c 14 00
which takes the address it was called from, uses A to index into a table after it, and jumps to that.
Re: illegal opcodes on 6502 nes version
Posted: Mon Sep 10, 2012 4:14 pm
by puzzud
Ahhh. This sounds familiar. I was getting ready to start comparing the code to the disassembled Metroid source code to look for any similarities. I seem to recall they used this funky jump method in Metroid, as well.
@hcs, just confirmed those vectors are all valid code. So much for fully automated disassembly. At least I can start identifying these locations are data vs code.
Now I feel silly
. Thanks for both of your help.