view clojure/com/aurellem/exp/item_bridge.clj @ 233:49a709c555f2

succesful return of control to the game upon item injection.
author Robert McIntyre <rlm@mit.edu>
date Sat, 24 Mar 2012 16:19:43 -0500
parents 8523faa122b0
children 5becef6312b9
line wrap: on
line source
1 (ns com.aurellem.exp.item-bridge
2 (:use (com.aurellem.gb saves util constants gb-driver vbm items assembly))
3 (:use (com.aurellem.run title save-corruption))
4 ;;(:use (com.aurellem.exp pokemon))
5 (:import [com.aurellem.gb.gb_driver SaveState]))
7 (defn corrupt-item-state []
8 (second (destroy-item-end-of-list-marker)))
10 (defn corrupt-item-state []
11 (read-state "corrupt-items"))
13 (defn view-memory-range [state start end]
14 (dorun
15 (map (fn [loc val]
16 (println (format "%04X : %02X" loc val)))
17 (range start end) (subvec (vec (memory state)) start end)))
18 state)
20 (defn almost-broken
21 "if one more memory location is turned into 0x03, the game crashes."
22 [n]
23 (view-memory-range
24 (set-inv-mem (mid-game)
25 (concat [0xFF] (repeat 64 0x03)
26 (subvec (vec (memory (mid-game)))
27 (+ item-list-start 65)
28 (+ item-list-start 65 n))
29 (repeat (- 255 65 n) 0x03)))
30 item-list-start (+ item-list-start 255)))
32 (defn actually-broken
33 "if this memory location is turned into 0x03, the game crashes."
34 []
35 (set-memory (mid-game) 0xD35D 0x03))
38 ;; (almost-broken 20) more or less works
40 (defn capture-program-counter
41 "records the program counter for each tick"
42 [^SaveState state ticks]
43 (let [i (atom 0)]
44 (reduce (fn [[program-counters state] _]
45 (println (swap! i inc))
46 [(conj program-counters (PC state))
47 (tick state)])
48 [[] state]
49 (range ticks))))
52 (defn capture-program-counter
53 [^SaveState state ticks]
54 (tick state)
56 (loop [i 0
57 pcs []]
58 (if (= i ticks)
59 (filter (partial < 0x2000)(sort (set pcs)))
60 (do
61 (com.aurellem.gb.Gb/tick)
62 (recur (inc i)
63 (conj pcs (first (registers))))))))
65 (defn loop-program []
66 [0x00 ;0xD31D ;; disable-interrupts
68 0xC3 ;; loop forever
69 0x1D
70 0xD3])
72 (def map-function-address-start 0xD36D)
74 (defn test-loop []
75 (continue!
76 (-> (mid-game)
77 (set-memory-range 0xD31D (loop-program))
78 (set-memory-range
79 map-function-address-start
80 [0xD3 0x1D]))))
85 (defn-memo corrupt-moves []
86 (concat
87 (first
88 (->>
89 [[] (mid-game)]
90 (advance [:b] [:b :start])
91 (advance [] [:d])
92 (play-moves [[] [] [] [:d] [] [] [] [:d] [] [] [:a]])
93 scroll-text
94 (play-moves
95 ;; this section is copied from speedrun-2942
96 ;; and corrupts the save so that the end-of-list marker
97 ;; for the pokemon roster is destroyed, but the save is still
98 ;; playable.
99 [[] [] [] [] [] [] [] [] [] [] [] [] [] [] [] [] [] [] [] []
100 [] [] [] [] [] [] [] [] [] [] [:select] [:restart]])
101 (play-moves
102 (first (title)))
103 (advance [] [:start])
104 (advance [] [:a])
105 (advance [:a] [:a :start])))
106 [[]]))
110 (defn corrupt
111 "enter the codes to destroy the
112 pokemon list using save corruption"
113 ([^SaveState state]
114 (run-moves
115 state
116 (corrupt-moves)))
117 ([] (corrupt @current-state)))
119 (defn mid-game-corrupt []
120 (read-state "corrupt-mid-game"))
127 (defn test-memory-fun [n]
128 (capture-program-counter
129 (set-memory-range
130 (tick (mid-game))
131 0xD36D
132 [0 0])
133 n))
135 ;;(def good (test-memory-fun 17000))
137 ;;(def bad (test-memory-fun 18000))
141 (defn menu-open-state []
142 (read-state "menu-open"))
144 (defn prepare-memory
145 ([^SaveState state]
146 (-> state
147 (set-memory-range 0xD31D (loop-program))
148 (set-memory-range 0xD36D [0x1D 0xD3])))
149 ([] (prepare-memory @current-state)))
151 (def memory-function-address-start 0xD36D)
153 (defn read-map-function-address
154 ([^SaveState state]
155 (let [mem (memory state)]
156 [(aget mem memory-function-address-start)
157 (aget mem (inc memory-function-address-start))]))
158 ([] (read-map-function-address @current-state)))
160 (defn succesful-PC-capture
161 "This function demonstrates successful PC capturing by
162 setting 0xD36D to the value of the start location of
163 a specially prepared program.
165 You must run the function and then exit the open menu
166 to see the effect."
167 []
168 (dorun
169 (map #(println (Integer/toHexString %))
170 (capture-program-counter
171 (prepare-memory (menu-open-state))
172 9000000))))
174 (defn trampoline-assembly [^SaveState state]
175 (flatten
176 [0x3E ;;
177 0x3E ;; load lemonade into A
179 0xEA
180 0x1D
181 0xD3 ;; set first item to lemonade
183 0xC3 ;; return control to the game via absolute junp.
184 (read-map-function-address state)
185 ]))
187 (defn test-trampoline
188 "Demonstrates item-program execution via the map-function that
189 returns control to the main pokemon game after one loop."
190 []
191 (let [insertion-address 0xD33D
192 insertion-address-bits [0x3D 0xD3]]
193 (->
194 (menu-open-state)
195 (set-memory-range
196 insertion-address
197 (trampoline-assembly (menu-open-state)))
198 (set-memory-range
199 memory-function-address-start
200 insertion-address-bits))))