22 Nov 2017

Ribbit- Sega System C2 - Palette hack

This is the last game running on Sega System C2 I had to patch to have a full patched set.
But Ribbit is one of the two games on System C2 which uses palette shuffling. For Twin Squash it was simply handled by offsets read from the program ROMs. Ribbit was really different, the
subroutine writing to the palette RAM is loaded in RAM and can be modified according to the security chip mode used.
I've identified 4 different subroutine but upon my trials I discovered they can all be used to display correct colours.
There are also 4 different palette shufflings used (well 3 as the first one is just no shuffling).







Whatever the subroutine used, it's always called at the same spot:


01F766: 4EB8 E274                  jsr     $e274.w


I simply dumped the first subroutine used:


FFFFE274: move.b  $c026.w, D0
FFFFE278: ori.b   #$7, D0
FFFFE27C: move.b  D0, $800201.l
FFFFE282: lea     $c124.w, A2
FFFFE286: moveq   #$0, D2
FFFFE288: move.b  #$ff, $c036.w
FFFFE28E: move.w  #$8b00, D0
FFFFE292: andi.b  #$4, $c021.w
FFFFE298: move.b  $c021.w, D0
FFFFE29C: or.b    $c020.w, D0
FFFFE2A0: move.w  D0, $c00004.l
FFFFE2A6: move.b  #$ff, $c03f.w
FFFFE2AC: bsr     $ffffe34e
FFFFE2B0: adda.w  #$8, A2
FFFFE2B4: bsr     $ffffe34e
FFFFE2B8: adda.w  #$8, A2
FFFFE2BC: bsr     $ffffe34e
FFFFE2C0: adda.w  #$8, A2
FFFFE2C4: bsr     $ffffe34e
FFFFE2C8: clr.b   $c036.w
FFFFE2CC: move.w  #$8b00, D0
FFFFE2D0: ori.b   #$80, $c021.w
FFFFE2D6: move.b  $c021.w, D0
FFFFE2DA: or.b    $c020.w, D0
FFFFE2DE: move.w  D0, $c00004.l
FFFFE2E4: move.b  #$ff, $c03f.w
FFFFE2EA: move.b  $c026.w, D0
FFFFE2EE: ori.b   #$6, D0
FFFFE2F2: move.b  D0, $800201.l
FFFFE2F8: tst.w   D2
FFFFE2FA: bne     $ffffe2fe
FFFFE2FE: andi.w  #$fc, D7
FFFFE302: or.b    $c02b.w, D7
FFFFE306: move.b  D7, $84000f.l
FFFFE30C: rts
FFFFE34E: move.w  ($6,A2), D4
FFFFE352: bne     $ffffe356
FFFFE356: moveq   #-$1, D2
FFFFE358: move.w  (A2), D7
FFFFE35A: rol.w   #6, D7
FFFFE35C: or.b    $c0be.w, D7
FFFFE360: move.b  D7, $84000f.l
FFFFE366: lea     $8c0000.l, A0
FFFFE36C: move.w  (A2), D0
FFFFE36E: andi.w  #$3ff, D0
FFFFE372: adda.w  D0, A0
FFFFE374: movea.l ($2,A2), A1
FFFFE378: move.w  (A2), D0
FFFFE37A: andi.w  #$c00, D0
FFFFE37E: adda.w  D0, A1
FFFFE380: subq.w  #1, D4
FFFFE382: lea     $fffe30e.l, A3
FFFFE388: move.w  A0, D0
FFFFE38A: lsr.w   #4, D0
FFFFE38C: move.w  (A3,D0.w), D0
FFFFE390: lsl.w   #4, D0
FFFFE392: lea     $8c0000.l, A3
FFFFE398: adda.w  D0, A3
FFFFE39A: moveq   #$7, D0
FFFFE39C: move.l  (A1)+, (A3)+
FFFFE39E: dbra    D0, $ffffe39c
FFFFE3A2: adda.w  #$20, A0
FFFFE3A6: dbra    D4, $ffffe382
FFFFE3AA: move.w  #$0, ($6,A2)
FFFFE3B0: rts



And moved it in the program ROMs space (there's plenty of space at the end).
I also inserted jumps to use the correct palette adressing depending of the mode used.


Here are the palette offsets used:


Mode 1 (no shuffling)


    0000 0002 0004 0006 0008 000A 000C 000E
    0010 0012 0014 0016 0018 001A 001C 001E
    0020 0022 0024 0026 0028 002A 002C 002E
    0030 0032 0034 0036 0038 003A 003C 003E


Mode 2


    0008 000A 000C 000E 0018 001A 001C 001E
    0028 002A 002C 002E 0038 003A 003C 003E
    0020 0022 0030 0032 0000 0002 0010 0012
    0024 0026 0034 0036 0004 0006 0014 0016


Which had to be recalculated as when using a different security chip palette shuffling isn't    supported (only the ones on Twin Squash and Ribbit! support it).
   
    0028 002A 0038 003A 0000 0002 0004 0006
    002C 002E 003C 003E 0008 000A 000C 000E
    0020 0022 0030 0032 0010 0012 0014 0016
    0024 0026 0034 0036 0018 001A 001C 001E


Mode 3


    0020 0022 0028 002A 0000 0002 0008 000A
    0024 0026 002C 002E 0004 0006 000C 000E
    0030 0032 0038 003A 0010 0012 0018 001A
    0034 0036 003C 003E 0014 0016 001C 001E


    Recalculated
   
    0008 000A 0018 001A 000C 000E 001C 001E
    0028 002A 0038 003A 002C 002E 003C 003E
    0000 0002 0010 0012 0004 0006 0014 0016
    0020 0022 0030 0032 0024 0026 0034 0036


Mode 4


    0000 0002 0008 000A 0004 0006 000C 000E
    0010 0012 0018 001A 0014 0016 001C 001E
    0030 0032 0034 0036 0020 0022 0024 0026
    0038 003A 003C 003E 0028 002A 002C 002E


    Recalculated


    0000 0002 0008 000A 0004 0006 000C 000E
    0010 0012 0018 001A 0014 0016 001C 001E
    0028 002A 002C 002E 0038 003A 003C 003E
    0020 0022 0024 0026 0030 0032 0034 0036











Patched files for sale, contact apocalypse-mods@outlook.co.nz


P.S.: This game doesn't seem to have an end




Yes, I've been that far, in fact the game just loops on the first 45 levels.







Also available:
- Columns
- Columns II
- Puzzle & Action: Ichidant-R
- Puzzle & Action: Tant-R
- Poto Poto
- Puyo Puyo
- Puyo Puyo 2
- Ribbit!
- Stack Columns
- Thunder Force AC
- Twin Squash (with joystick hack)
- Zunzunkyou No Yabou

No comments:

Post a Comment