view clojure/com/aurellem/exp/item_bridge.clj @ 235:5becef6312b9

working on item-injection; fixed off-by-one error in print-pokedex.
author Robert McIntyre <rlm@mit.edu>
date Sat, 24 Mar 2012 20:05:47 -0500
parents 49a709c555f2
children e23ab90fcc86
line wrap: on
line source
1 (ns com.aurellem.exp.item-bridge
2 (:use (com.aurellem.gb saves util constants gb-driver vbm items assembly))
3 (:use (com.aurellem.run title save-corruption))
4 ;;(:use (com.aurellem.exp pokemon))
5 (:import [com.aurellem.gb.gb_driver SaveState]))
7 (defn corrupt-item-state []
8 (second (destroy-item-end-of-list-marker)))
10 (defn corrupt-item-state []
11 (read-state "corrupt-items"))
13 (defn view-memory-range [state start end]
14 (dorun
15 (map (fn [loc val]
16 (println (format "%04X : %02X" loc val)))
17 (range start end) (subvec (vec (memory state)) start end)))
18 state)
20 (defn almost-broken
21 "if one more memory location is turned into 0x03, the game crashes."
22 [n]
23 (view-memory-range
24 (set-inv-mem (mid-game)
25 (concat [0xFF] (repeat 64 0x03)
26 (subvec (vec (memory (mid-game)))
27 (+ item-list-start 65)
28 (+ item-list-start 65 n))
29 (repeat (- 255 65 n) 0x03)))
30 item-list-start (+ item-list-start 255)))
32 (defn actually-broken
33 "if this memory location is turned into 0x03, the game crashes."
34 []
35 (set-memory (mid-game) 0xD35D 0x03))
38 ;; (almost-broken 20) more or less works
40 (defn capture-program-counter
41 "records the program counter for each tick"
42 [^SaveState state ticks]
43 (let [i (atom 0)]
44 (reduce (fn [[program-counters state] _]
45 (println (swap! i inc))
46 [(conj program-counters (PC state))
47 (tick state)])
48 [[] state]
49 (range ticks))))
52 (defn capture-program-counter
53 [^SaveState state ticks]
54 (tick state)
56 (loop [i 0
57 pcs []]
58 (if (= i ticks)
59 (filter (partial < 0x2000)(sort (set pcs)))
60 (do
61 (com.aurellem.gb.Gb/tick)
62 (recur (inc i)
63 (conj pcs (first (registers))))))))
65 (defn loop-program []
66 [0x00 ;0xD31D ;; disable-interrupts
68 0xC3 ;; loop forever
69 0x1D
70 0xD3])
72 (def map-function-address-start 0xD36D)
74 (defn test-loop []
75 (continue!
76 (-> (mid-game)
77 (set-memory-range 0xD31D (loop-program))
78 (set-memory-range
79 map-function-address-start
80 [0xD3 0x1D]))))
82 (defn-memo corrupt-moves []
83 (concat
84 (first
85 (->>
86 [[] (mid-game)]
87 (advance [:b] [:b :start])
88 (advance [] [:d])
89 (play-moves [[] [] [] [:d] [] [] [] [:d] [] [] [:a]])
90 scroll-text
91 (play-moves
92 ;; this section is copied from speedrun-2942
93 ;; and corrupts the save so that the end-of-list marker
94 ;; for the pokemon roster is destroyed, but the save is still
95 ;; playable.
96 [[] [] [] [] [] [] [] [] [] [] [] [] [] [] [] [] [] [] [] []
97 [] [] [] [] [] [] [] [] [] [] [:select] [:restart]])
98 (play-moves
99 (first (title)))
100 (advance [] [:start])
101 (advance [] [:a])
102 (advance [:a] [:a :start])))
103 [[]]))
105 (defn corrupt
106 "enter the codes to destroy the
107 pokemon list using save corruption"
108 ([^SaveState state]
109 (run-moves
110 state
111 (corrupt-moves)))
112 ([] (corrupt @current-state)))
114 (defn mid-game-corrupt []
115 (read-state "corrupt-mid-game"))
117 (defn gen-start-game-corrupt []
118 (->> (finish-title)
119 (advance [:b] [:a :b :start])
120 (play-moves (corrupt-moves))))
122 (defn start-game-corrupt []
123 (read-state "corrupt-start-game"))
125 (defn test-memory-fun [n]
126 (capture-program-counter
127 (set-memory-range
128 (tick (mid-game))
129 0xD36D
130 [0 0])
131 n))
133 ;;(def good (test-memory-fun 17000))
135 ;;(def bad (test-memory-fun 18000))
139 (defn menu-open-state []
140 (read-state "menu-open"))
142 (defn prepare-memory
143 ([^SaveState state]
144 (-> state
145 (set-memory-range 0xD31D (loop-program))
146 (set-memory-range 0xD36D [0x1D 0xD3])))
147 ([] (prepare-memory @current-state)))
149 (def memory-function-address-start 0xD36D)
151 (defn read-map-function-address
152 ([^SaveState state]
153 (let [mem (memory state)]
154 [(aget mem memory-function-address-start)
155 (aget mem (inc memory-function-address-start))]))
156 ([] (read-map-function-address @current-state)))
158 (defn succesful-PC-capture
159 "This function demonstrates successful PC capturing by
160 setting 0xD36D to the value of the start location of
161 a specially prepared program.
163 You must run the function and then exit the open menu
164 to see the effect."
165 []
166 (dorun
167 (map #(println (Integer/toHexString %))
168 (capture-program-counter
169 (prepare-memory (menu-open-state))
170 9000000))))
172 (defn trampoline-assembly [^SaveState state]
173 (flatten
174 [0x3E ;;
175 0x3E ;; load lemonade into A
177 0xEA
178 0x1D
179 0xD3 ;; set first item to lemonade
181 0xC3 ;; return control to the game via absolute junp.
182 (read-map-function-address state)
183 ]))
185 (defn test-trampoline
186 "Demonstrates item-program execution via the map-function that
187 returns control to the main pokemon game after one loop."
188 []
189 (let [insertion-address 0xD33D
190 insertion-address-bits [0x3D 0xD3]]
191 (->
192 (menu-open-state)
193 (set-memory-range
194 insertion-address
195 (trampoline-assembly (menu-open-state)))
196 (set-memory-range
197 memory-function-address-start
198 insertion-address-bits))))
202 ;;map-functions
204 ;; Room, Upstairs 0xBO 0x40
205 ;; Room, Downstairs 0x02 0x41
206 ;; Pallet Town 0xFA 0x4D
207 ;; Rival's House 0x3B 0x5C
208 ;; Oak's Lab 0x92 0x43
209 ;; Route 1 0x58 0x43
210 ;; Viridian City 0x2A 0x50
211 ;; Viridian PkmnCenter 0x5D 0x42
212 ;; Viridian Mart 0x7A 0x4C
213 ;; Viridian House #1 0x79 0x4D
214 ;; Viridian House #2 0xD3 0x4D
215 ;; Route 22 0xB3 0x4E
216 ;; League Front Gate 0x8D 0x5F