|
|
本帖最后由 yandagui 于 2015-10-28 19:02 编辑 / h, K- E5 N+ N
4 H& s) }3 E* P# Z' P1 q4 |FC自动演示修改教程
2 ]3 L0 r8 a4 T, r3 t作者:火焰烈旋风
* ^- |7 f; N( s7 l' c$ `7 h工具:FCEUX中文版(www.9553.cn搜FCEU即可)! e+ K0 F7 R6 {$ g
1.找按键地址:
# d2 y& o8 Z6 U& t' ? 首先,我们打开FCEUX,再打开魂斗罗美版,进入游戏无动作,打开FCEUX的工具>作弊,若左下角的"活跃时暂停"没打勾请点击打勾,游戏暂停了,点击中上部的"重设",在已知值输入后输入框中00,点击按钮"已知值",此时搜到大量数据为00的地址.单击FCEU窗口,游戏正常运行,按住一个按键不放如上键,点击作弊窗口的">",游戏暂停了,此时剩下几个地址,再单击FCEU窗口,按住两个按键如上+选择键不放,点击作弊窗口的">",游戏暂停了,只剩下几个地址了,再单击FCEU窗口,不要按任何按键键,点击作弊窗口的"已知值:00"最后剩下两个地址F1,F2,点中其中一个,再点左下角的"添加",发现按什么按键人物都不能动,说明这两个地址就是按键地址,双击左上部的锁定地址,前面的"*"号消失就解除了锁定,并且通过调试知道上=08,下=04,左01,右=02,A=80,B=40,选择=20,开始=10.5 ~0 e; z; \" T& P( {' L3 |1 `
2.找演示时按键的数据来源:
- }5 W* K) B$ E. c, Y" G 既然知道了按键的地址,那么就要看演示时是什么改变了这些值.点击FCEUX的>游戏>重设,等进入自动演示时,我们打开打开FCEUX的调试>调试器,在右上部分点击"断点"下的"添加",此时弹出"添加断点"窗口,我们在"地址"第一个输入框输入F1(我们找到的按键),将输入框下面的"写"打上勾,CPU也打勾,点"确定".此时调试窗口出现如下指令: o q! H- y! I9 _0 A; h' c
07:C38F:94 F1 STY $F1,X @ $00F1 = #$01
$ `" J2 q; r- O; g07:C391:94 F9 STY $F9,X @ $00F9 = #$00
+ l& E+ W: x: |6 ]# Q2 X! y07:C393:CA DEX. V# h$ D# Z' _$ p% E
07:C394:10 F0 BPL $C3868 e$ w$ m# {: j! s. c8 U
07:C396:60 RTS
! X- Y+ ?$ y: b: I; W& U) O$ v我们点击"运行"左边的上拉按钮上拉,看到如下指令:
: v; T, s: s% i; R0 b07:C378:A5 1D LDA $001D = #$07
7 u2 a/ ^; x; i07:C37A:29 04 AND #$04% R; c, Y! d9 N. G$ N" R) O
07:C37C:D0 06 BNE $C384& O% U1 T- T% N3 @0 g( G Z$ A0 f
07:C37E:A5 04 LDA $0004 = #$00 N! m- |6 F0 w c4 `
07:C380:05 05 ORA $0005 = #$00
; K; {' e7 @; i; k07:C382:85 04 STA $0004 = #$00& L' A& t! C3 [+ c5 @" K7 Z
07:C384:A2 01 LDX #$01
( G8 ?$ p! d: z- g2 n0 [07:C386:B5 04 LDA $04,X @ $0004 = #$00$ m* T) e+ a) z6 a U
07:C388:A8 TAY
' s0 C; c5 d7 Y. q: S6 `, i07:C389:55 F9 EOR $F9,X @ $00F9 = #$00
* H& O3 ^: T+ ^. q07:C38B:35 04 AND $04,X @ $0004 = #$00* u2 H; k/ m) r! `0 [% f1 N
07:C38D:95 F5 STA $F5,X @ $00F5 = #$00
: g# ^; ]3 R' I1 F9 o5 `07:C38F:94 F1 STY $F1,X @ $00F1 = #$01
3 J: | j! C# Z4 m" i07:C391:94 F9 STY $F9,X @ $00F9 = #$00
8 L5 O. Z4 k/ W3 u. |3 M3 k07:C393:CA DEX! o: a/ {1 S" x; M
07:C394:10 F0 BPL $C386. a# n( ? ]8 ]3 Y; t
07:C396:60 RTS7 l' h) D1 ~2 w
由于演示的数据存放在某处,然而这里并没有读取某处的值送F1的指令,所以很可能不是我们要找的指令,点击"断点"窗口旁边的"运行",窗口中出现如下数据:+ j* _ u' m1 K- @8 @) {) y, g) R" g
05:B3A3:95 F1 STA $F1,X @ $00F1 = #$00+ b: }' y5 x* ~
05:B3A5:A5 2E LDA $002E = #$C8
) A. ]+ D/ ^( u! q7 r05:B3A7:C9 50 CMP #$50
9 p, N9 P: {- t) R$ }" F2 M05:B3A9:90 20 BCC $B3CB
& w" C9 P' y* v5 Z( V% C05:B3AB:B5 AA LDA $AA,X @ $00AA = #$002 X+ w" r) I& g8 o% M
05:B3AD:29 0F AND #$0F
; _1 j1 Q+ g! r4 C/ L/ {2 v7 o05:B3AF:C9 01 CMP #$011 S2 G' j' f f& a* x0 Q& y2 u
05:B3B1:F0 04 BEQ $B3B7" ]4 `: M. @% k4 z- k$ |* Y, W' a
05:B3B3:C9 04 CMP #$04. [7 `" V" W0 h. z8 M, W
.........
. f/ ^! \' N+ f% ] [; v我们点击"运行"左边的上拉按钮上拉,看到如下指令:
9 z5 W1 f: ~) Q05:B39F:B5 5C LDA $5C,X @ $005C = #$014 c' w3 v) A+ D4 Z! F4 l0 h2 N
05:B3A1:95 F5 STA $F5,X @ $00F5 = #$01$ F, S/ K' g* L- }7 H) f4 ~
05:B3A3:95 F1 STA $F1,X @ $00F1 = #$005 q& m7 [! `3 P2 R# R/ g
05:B3A5:A5 2E LDA $002E = #$C8
7 F, b& g" K5 Q05:B3A7:C9 50 CMP #$507 }. B( E' ?3 e/ s7 q: k
05:B3A9:90 20 BCC $B3CB
- V1 U* I. X- n05:B3AB:B5 AA LDA $AA,X @ $00AA = #$00
5 H. L; v t1 O; ^; Y05:B3AD:29 0F AND #$0F3 ~, T% d! v- ]4 z+ X& ?' P3 `( [
看到
( H4 m0 U) h! p- _+ `8 Q05:B39F:B5 5C LDA $5C,X @ $005C = #$01# C( K1 y" h' y" N7 X
05:B3A1:95 F5 STA $F5,X @ $00F5 = #$01, H) t$ y: A1 m3 b; R
05:B3A3:95 F1 STA $F1,X @ $00F1 = #$008 k$ s/ @/ F/ M. e. D0 @4 {
没有?这个说明F1的数据是从地址5C送出得到的,说明我们要找到存储演示按键数据必须从地址5C入手.* u- F0 P+ L# J a, [
接下来调试器,双击取消F1断点,点击"断点"下的"添加",此时弹出"添加断点"窗口,我们在"地址"第一个输入框输入5C,同样"写"打上勾,点"确定",一会出现如下指令:, g4 B* } H, V- i7 l, }; y
05:B392:95 5C STA $5C,X @ $005C = #$01
3 A% ?1 Q$ k+ r" _. `# M2 J8 n05:B394:C8 INY% b4 k# t+ p7 A+ T* T3 I3 o
05:B395:B1 08 LDA ($08),Y @ $B3F2 = #$09# G! V' Q% F2 q3 n5 \' e
05:B397:95 5A STA $5A,X @ $005A = #$00$ @5 T- d X/ @6 G. z1 X# d( g
05:B399:C8 INY0 U# [2 f0 `7 B3 Q5 d" I
05:B39A:98 TYA" }: b9 M# ?: B" b0 H$ |4 b7 O5 r
然后我们再上拉,得到如下指令:
# N6 @+ ~1 ~- v5 x05:B38C:B1 08 LDA ($08),Y @ $B3F2 = #$09: N' S3 L h7 S; N6 u; F- [+ \
05:B38E:C9 FF CMP #$FF' M, z4 a; b; \, ?4 {$ y$ Y
05:B390:F0 3D BEQ $B3CF5 J: w" N1 E) q. U/ A8 \6 F
05:B392:95 5C STA $5C,X @ $005C = #$017 D1 ?$ |% c" P/ i9 @. \5 t6 S3 ?
05:B394:C8 INY
; l: p G: p+ t6 v; V05:B395:B1 08 LDA ($08),Y @ $B3F2 = #$09% b7 N# P: A8 O* k% E8 G
05:B397:95 5A STA $5A,X @ $005A = #$00
8 F' `9 K+ ]' E9 v+ F+ n05:B399:C8 INY8 D4 Y" R: ^) S" O
05:B39A:98 TYA0 z& X; L3 D1 @5 j' I
看到05:B38C:B1 08 LDA ($08),Y @ $B3F2 = #$09
2 l; D& ?4 i' p# S I没有?说明现在5C的值来源于变址得到的$B3F2,哈哈,演示按键的数据找到了,在游戏CPU的$B3F2附近.
* `3 c8 j* U! s/ R `" h3.修改演示:& `& z2 C9 [% V- X8 q
打开FCEUX的调试>十六进制编辑器,按Ctrl+A或点击十六进制编辑器>转到地址,输入B3F2,此时黑色光标标记的地方就是CPU的$B3F2,右击黑色光标>转至ROM文件中对应位置,此时已转至ROM文件中对应位置了.) `$ r" v6 R9 m! {' l
我们要修改,必须从开始演示的第一个演示按键开始,接下来去找到它:
5 j, T5 ?5 T. u& _打开FCEUX的游戏>重设,此时游戏暂停无状态,点击调试器的"运行",出现黑屏,再点击两次"运行"游戏运行了,过一会又暂停,再点击两次"运行"游戏运行了,出现背景画面时暂停了,调试器窗口中出现了如下数据:
" ~- v# }% _( D; q) ?05:B392:95 5C STA $5C,X @ $005C = #$00
$ R* x- |& i( i, g9 n05:B394:C8 INY/ o1 ~) C% @# B9 S9 }
05:B395:B1 08 LDA ($08),Y @ $B3DE = #$00$ B" u* V3 {+ Q$ p7 O. _" [$ Y0 @$ \
05:B397:95 5A STA $5A,X @ $005A = #$00
9 l$ u* p. }6 J4 z05:B399:C8 INY
* M4 f; m0 s/ P0 H05:B39A:98 TYA
0 K* E8 u0 [! t! l9 b+ @7 V我们上拉看到了:! \# O& A; U: M* o2 F" h' g
05:B38C:B1 08 LDA ($08),Y @ $B3DE = #$00
+ z# U( B. D! Z' D05:B38E:C9 FF CMP #$FF! G* n9 S" C; f
05:B390:F0 3D BEQ $B3CF! H2 d0 d" v# ~' v1 D4 {. z* [; q" u
05:B392:95 5C STA $5C,X @ $005C = #$00
a+ m" K& ~! }( B( [/ D' F8 F! i05:B394:C8 INY: u6 u, w3 B; h- q# A5 b/ c
05:B395:B1 08 LDA ($08),Y @ $B3DE = #$002 u) R" I/ t8 ]
05:B397:95 5A STA $5A,X @ $005A = #$00 s' R1 S/ ]. o. s( u0 ~
05:B399:C8 INY3 ], v$ g" d* z: J
05:B39A:98 TYA: G- _9 P" t" U# o
看到
3 K: S# G9 d1 S9 m! J7 C05:B38C:B1 08 LDA ($08),Y @ $B3DE = #$00
& @' f5 C4 H) Z; o' q没有?它应该是第一个演示按键,接下来进入十六进制编辑器,点击查看>NES内存,此时切换到NES的CPU内存,按Ctrl+A或点击十六进制编辑器>转到地址,输入B3DE,此时黑色光标标记的地方就是CPU的$B3DE,右击黑色光标>转至ROM文件中对应位置,此时已转至ROM文件中对应位置了,这里就是演示按键的开始地址.
$ d2 I1 u+ q0 F4 d, m3 g' @3 Z说明:演示按键地址的结构,以开始的00 21 01 03 00 0E 01 3D 04 06 05 33 00 0E 04 0A 05 01为例:第1个00是按键数值(无行动),第2个21是指按键数值21前的按键保持21(时间),第3个01是按键数值(向右走),第4个03是指按键数值03前的按键保持03(时间).......以此类推,判断根据:! k+ i) w4 W) j' e) V7 x$ k6 G
05:B371:B5 5A LDA $5A,X @ $005A = #$7F
, C5 e( O% R5 `2 I- J0 G05:B373:D0 28 BNE $B39D(如果5A=00,那么就会跳过28字节执行2A递减的指令)
~4 E7 p, _7 H4 n F5 a2 Z05:B375:A5 30 LDA $0030 = #$00; R3 @7 n }+ ]
05:B377:0A ASL
. O# |3 e; h' z9 O6 |8 m- m' J& {05:B378:0A ASL
) {( E n7 ]% ~% Q- i0 A. t2 |/ `& v05:B379:85 08 STA $0008 = #$29! \5 b2 n1 E0 W" Z4 x3 p/ e; S/ }
05:B37B:8A TXA
0 R7 V0 j1 h$ A6 g; y! G2 Q05:B37C:0A ASL
% Z/ E, r( v' F7 J+ _1 b05:B37D:65 08 ADC $0008 = #$29
# b3 O- `+ ~1 {! S% Y5 A05:B37F:A8 TAY( R$ h/ y# e3 Y3 w7 L- A/ o5 K- [
05:B380:B9 D2 B3 LDA $B3D2,Y @ $B3D7 = #$B40 p1 M5 w; K* G K
05:B383:85 08 STA $0008 = #$29
. S7 ~1 }+ @, A& m: ]: X05:B385:B9 D3 B3 LDA $B3D3,Y @ $B3D8 = #$FC5 w3 }. ~% ^, C/ i5 [& e( G
05:B388:85 09 STA $0009 = #$B22 ^6 ^+ k( G z* _
05:B38A:B4 5E LDY $5E,X @ $005E = #$02
5 _% B) \; Q: X3 @7 K0 V05:B38C:B1 08 LDA ($08),Y @ $B22E = #$10
! C$ S4 s6 V. q' [& R+ I8 t: c/ t05:B38E:C9 FF CMP #$FF
& z5 i" t9 w( P2 G1 C05:B390:F0 3D BEQ $B3CF) q& A8 x$ T, i! A
05:B392:95 5C STA $5C,X @ $005C = #$00/ _& ~! H6 o5 [8 a7 z% a! |1 l4 n1 D
05:B394:C8 INY) I/ \4 F5 ?! ^/ V5 M$ Y& O% f0 k
05:B395:B1 08 LDA ($08),Y @ $B22E = #$10
7 N+ s) G7 J) Q5 F( w05:B397:95 5A STA $5A,X @ $005A = #$7F
% ?% t/ p% z5 A' `% A2 A( I" C5 U05:B399:C8 INY
' Z$ J5 E1 @! y8 d; B1 S2 J, ]05:B39A:98 TYA
) X5 C7 T9 K- J/ y05:B39B:95 5E STA $5E,X @ $005E = #$02- _5 @) R7 I5 Y* d6 S" @4 Z
05:B39D:D6 5A DEC $5A,X @ $005A = #$7F(5A递减): O1 m' s/ q. e
05:B39F:B5 5C LDA $5C,X @ $005C = #$00: _9 [# s! g9 Q P
05:B3A1:95 F5 STA $F5,X @ $00F5 = #$00" o/ t( \- q, O" `
05:B3A3:95 F1 STA $F1,X @ $00F1 = #$00
! Y- S9 t: U: q( P& U+ |+ U' _* M& Y* C- y2 A/ p5 Y
由于技术原因,本人以前只能改到打完三关,因为间址LDA ($08),Y得到的地址发生改变,那时本人无能力了.现在全部完成,用到其他方法们再次难以叙述了
/ m. h; |1 Z0 f' b可以下载玩一玩# G& N y1 G/ j7 o3 M# K
http://pan.baidu.com/s/1bnE0AwZ |
|