-
Notifications
You must be signed in to change notification settings - Fork 0
amaurea/sm_eac
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
The recent discovery of arbitrary code execution in Super Metroid opens up the possibility for entertaining playaround TASes of the game that reprogram the game on the fly. However, quite a bit of bootstrapping is necessary before that can be done, and tools for doing that are quite lacking. When I started trying to implement this, I found that to set up the main resident code, I had to fist write it in assembly, then assemble it, then write new assembly code for loading those bytes, then assemble that code, and convert the result into lsnes input. That's not something you want to do manually if you can avoid it! So instead of doing things that way, I wrote a lsnes input file pre-processor that allows you to insert assembly code inline in input files using a simple macro language. As a simple example, the end of the current any% movie looks like F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|......l.AX......|................|................|................ F.|........AX......|................|................|................ F.|.........X......|................|................|................ F.|...Su...A.L.0..3|....ud...XL.0...|B...ud.r.X....2.|.Ys......XLR0.2. F.|................|................|................|................ F.|..s..dl.A.L.0..3|....u..rA..R0...|B...ud.r........|.........XL..... F.|................|................|................|................ F.|B.......A.L.0..3|BY.Su.....L....3|B...udlr........|.Ys......XLR012. F.|................|................|................|................ F.|BY..udlrA.L.0..3|....u..rAX..0...|B...ud.r...R..2.|.........XL..... F.|................|................|................|................ F.|.Y......A..R01..|................|.Ys.........01..|................ The normal controller input ends on line 6 - the rest corresponds to assembly code. This can be generated using F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|......l.AX......|................|................|................ F.|........AX......|................|................|................ F.|.........X......|................|................|................ @inline 1 lda #$4218 sta $0c68 ply @inline 1 lda #$26 sta $998 @inline 1 lda #$80 sta $7ed821 @inline 1 lda #$12cf sta $09c8 @inline 1 stz $0c40 For something as simple as this, there isn't much of an improvement. A more realistic example is F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|......l.AX......|................|................|................ F.|........AX......|................|................|................ F.|.........X......|................|................|................ @global main = $f440 main_long = $7ef440 bufaddr = $f500 run_every_frame = $f600 tbuffer = $01df # Make sure we're called repeatedly @inline 1 lda #$4218 sta $0c68 ply # Bootstrap the following code, placing it at the previously defined # main_long, which is a region of free space in ram. # This will be our main loop later. @boot main_long 1 ldx #bufaddr ldy $421a dataloop jsr read_controller_bytes jsr bufaddr tya bne dataloop jsr run_every_frame jmp @$90e695 read_controller_bytes recloop lda #1 sta $4016 stz $4016 phy ldy #$10 bitloop lda $4016 lsr rol 0,x lsr rol 4,x lda $4017 lsr rol 2,x lsr rol 6,x dey bne bitloop ply txa clc adc #8 tax dey bne recloop rts # Set up our per-frame jump to the main loop @boot tbuffer 1 jmp main_long @inline 1 lda #tbuffer sta $a42 # At this point we're fully bootstrapped. We can now return control to the # game (but it will now call our resident function every frame) @inline 0 stz $0c40 # We can now play the game normally... F.|.........X......|................|................|................ F.|B......r........|................|................|................ F.|B......r........|................|................|................ F.|B......r........|................|................|................ F.|B......r........|................|................|................ F.|B......r........|................|................|................ # And run large amounts of code any frame we want, at a far greater # speed than the bootstrapping code. This does not interfer with normal # input during this frame. For example, this code jumps to the end of the # game. But since we're now dealing with subframe input, we can easily # do much more now. @code lda #$26 sta $998 This assembles into the following input. The repeated patterns are due to the repeated lda-sta-rts pattern involved in the bootstrapping procedure (which is all handled transparently by the @boot macro). The amount of lag-frames to insert are controlled by the last argument of @inline and @boot. These were 1 in this case, hence all the empty lines. Towards the end, you can see some subframe input from the @code macro. Notice how the previous frame's controller two input has been changed to indicate the number of subframes to read. That's done automatically by @code. F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|........AX......|................|................|................ F.|......l.AX......|................|................|................ F.|........AX......|................|................|................ F.|.........X......|................|................|................ F.|...Su...A.L.0..3|....ud...XL.0...|B...ud.r.X....2.|.Ys......XLR0.2. F.|................|................|................|................ F.|B.s...l.A.L.0..3|BYsS.d...X......|B...udlr........|.Ys......XLR012. F.|................|................|................|................ F.|BYsS.d.rA.L.0..3|BYsS.d...X....2.|B...udlrA.L.01..|.Ys......XLR012. F.|................|................|................|................ F.|...Su.l.A.L.0..3|BYsS.d...X...1..|B...udlr.X....2.|.Ys......XLR012. F.|................|................|................|................ F.|..s.....A.L.0..3|BYsS.d...X...12.|B...udlr...R.12.|.Ys......XLR012. F.|................|................|................|................ F.|...S....A.L.0..3|BYsS.d...X..0...|B...udlr..L.....|.Ys......XLR012. F.|................|................|................|................ F.|........A.L.0..3|BYsS.d...X..0.2.|B...udlrAXLR.1.3|.Ys......XLR012. F.|................|................|................|................ F.|B..Su...A.L.0..3|BYsS.d...X..01..|B...udlrAX.R....|.Ys......XLR012. F.|................|................|................|................ F.|BYsS.dlrA.L.0..3|BYsS.d...X..012.|B...udlr..L.....|.Ys......XLR012. F.|................|................|................|................ F.|........A.L.0..3|BYsS.d...X.R....|B...udlrAXLR.12.|.Ys......XLR012. F.|................|................|................|................ F.|.Y.Sud..A.L.0..3|BYsS.d...X.R..2.|B...udlrA..R.1.3|.Ys......XLR012. F.|................|................|................|................ F.|BYs..dl.A.L.0..3|BYsS.d...X.R.1..|B...udlrA..R....|.Ys......XLR012. F.|................|................|................|................ F.|B.s.u..rA.L.0..3|BYsS.d...X.R.12.|B...udlr.......3|.Ys......XLR012. F.|................|................|................|................ F.|........A.L.0..3|BYsS.d...X.R0...|B...udlrA...01.3|.Ys......XLR012. F.|................|................|................|................ F.|...S.dl.A.L.0..3|BYsS.d...X.R0.2.|B...udlr.X......|.Ys......XLR012. F.|................|................|................|................ F.|B..Sud..A.L.0..3|BYsS.d...X.R01..|B...udlr...R.12.|.Ys......XLR012. F.|................|................|................|................ F.|.Y......A.L.0..3|BYsS.d...X.R012.|B...udlr.X.R0.2.|.Ys......XLR012. F.|................|................|................|................ F.|B.s.....A.L.0..3|BYsS.d...XL.....|B...udlr...R....|.Ys......XLR012. F.|................|................|................|................ F.|........A.L.0..3|BYsS.d...XL...2.|B...udlrA.L.01.3|.Ys......XLR012. F.|................|................|................|................ F.|...S.dl.A.L.0..3|BYsS.d...XL..1..|B...udlr.X......|.Ys......XLR012. F.|................|................|................|................ F.|.Y..u.l.A.L.0..3|BYsS.d...XL..12.|B...udlr..LR.12.|.Ys......XLR012. F.|................|................|................|................ F.|........A.L.0..3|BYsS.d...XL.0...|B...udlr.X..0.2.|.Ys......XLR012. F.|................|................|................|................ F.|..sS.dl.A.L.0..3|BYsS.d...XL.0.2.|B...udlr.....1..|.Ys......XLR012. F.|................|................|................|................ F.|B.s.ud.rA.L.0..3|BYsS.d...XL.01..|B...udlr...R.123|.Ys......XLR012. F.|................|................|................|................ F.|.Y......A.L.0..3|BYsS.d...XL.012.|B...udlr.X..0.2.|.Ys......XLR012. F.|................|................|................|................ F.|..sS.dl.A.L.0..3|BYsS.d...XLR....|B...udlr......2.|.Ys......XLR012. F.|................|................|................|................ F.|.Y..u.l.A.L.0..3|BYsS.d...XLR..2.|B...udlr..LR.12.|.Ys......XLR012. F.|................|................|................|................ F.|.....dl.A.L.0..3|BYsS.d...XLR.1..|B...udlrA...0...|.Ys......XLR012. F.|................|................|................|................ F.|BY.S....A.L.0..3|BYsS.d...XLR.12.|B...udlrAXL.0.23|.Ys......XLR012. F.|................|................|................|................ F.|.YsSu.l.A.L.0..3|BYsS.d...XLR0...|B...udlrA...0.2.|.Ys......XLR012. F.|................|................|................|................ F.|...Su...A.L.0..3|BYsS.d...XLR0.2.|B...udlr.XL.0..3|.Ys......XLR012. F.|................|................|................|................ F.|....u...A.L.0..3|BYsS.d...XLR01..|B...udlr........|.Ys......XLR012. F.|................|................|................|................ F.|B.s.u.l.A.L.0..3|BYsS.d...XLR012.|B...udlrA...0...|.Ys......XLR012. F.|................|................|................|................ F.|BY.S....A.L.0..3|BYsS.d..A.......|B...udlrAX.R.1..|.Ys......XLR012. F.|................|................|................|................ F.|.Ys.....A.L.0..3|BYsS.d..A.....2.|B...udlr........|.Ys......XLR012. F.|................|................|................|................ F.|.Y.Sud..A.L.0..3|.......rAX.R0123|B...ud.r.X......|.........XL..... F.|................|................|................|................ F.|BYsS.d..A.L.0..3|.......rAXL....3|B...ud.r.XLR012.|.........XL..... F.|................|................|................|................ F.|BY.SudlrA.L.0..3|....u.l..X....2.|B...ud.r.......3|.........XL..... F.|................|................|................|................ F.|.Y......A..R01..|................|.Ys.........01..|................ F.|................|................|................|................ F.|.........X......|................|................|................ F.|B......r........|................|................|................ F.|B......r........|................|................|................ F.|B......r........|................|................|................ F.|B......r........|................|................|................ F.|B......r........|................|..............2.|................ ..|..s..dl.A.L.0..3|....u..rA..R0...|B...ud.r........|........A.L..... ..|.Ys.............|................|................|................
About
Super Metroid Arbitrary Code Execution
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published