NEORAINE修改教程(作者：Tux)

疾风之狼

console basics

作者：Tux 文章来源：http://rainemu.swishparty.co.uk/msgboard/yabbse/index.php
+ @" X3 R$ Q# ?: H
$ t* ^5 |3 r) @7 C: y' e3 ?& J
3 r, x. }4 d% h
I know a command line is quite intimitading, but it will be much more powerfull for what I want, and also it will be much easier to add new features this way.
- ~% V7 J. N- G1 J
So here in mslug, I wanted to look for the number of lifes, so I started by search 3 just at the begining of the game and there were more than 39000 results.
So I lost a life, typed "search 2" and I was down to 4 results already !
Lost another life, and this time "search 1" sent back only 1 result : 100397.

  D+ i% ~2 k" L) D; zThis is the very first beta for this, I want to add other functions like the ability to modify any address in ram (to test the result by puting any life number for example), to be able to explore the ram at any address to see if there are other interesting addresses nearby, and so on...

As you see the syntax for the command line is extremely simple, and should remain as simple as possible...
% U0 |$ r) x: k- z" H, }* X' NAnd this thing could probably be used as a debuger too (68000/z80 debuger).
+ i: y9 V. }; g4 `, E: S& w
[ 本帖最后由 疾风之狼 于 2009-3-31 20:36 编辑 ]

疾风之狼

console lessons level 2
8 i$ y% u9 E8 B& ^! |! |
, Z# S) a9 Y8 h- k! D' J  `" D, }作者：Tux 文章来源：http://rainemu.swishparty.co.uk/msgboard/yabbse/index.php
& a7 _9 j! [$ b( ~
how to find the location of the weapon for metal slug in ram ?
6 X$ w% C3 ~, k* E9 Q4 y. lWelcome to the relative searches we started to talk about in the other topic...
& W' F/ ^" `1 j3 W2 Q# ]
So just start the game as usual, and open the console just before picking the machine gun, and close it immediately. In doing so it takes a snapshot of the ram, and you'll be able to look for differences later. Now take the machine gun and type:
5 D% u# K, H1 Z# v: z* }/ K: Dsearch !=
' ]/ f  Q) M* C! ]4 i+ J9 t' P2 awhich will search all the bytes which are different.
2 Y) x: H. v0 I8 ^2 f7 l0 L) KWell there a few hundreds of differences, so it will take time.
; S* }5 K% h5 |( |% P0 CThe idea is to wait a little in game, then return to the console and type
search ==
to look for the areas which didn't change. Half of the results are gone, but you still have a lot of them. Play a little until the flame thrower and just before picking it up, type :
search ==
9 h: ?& r/ y. I  Hand after picking it up :
search !=
+ J  c2 g% z4 V7 X' Unormally when you pick the machine gun again and you type search !=, you'll get only 2 results which are both valid :
% O! m# _6 j3 i6 v


After a few tests, the 2nd address is the one you want, puting 4 in it gives the machine gun and 2 is the flame thrower (I didn't test all the weapons !).
: O4 t& o5 d$ Z2 I
This is a lot harder than the simple life counter... !!!
But it works well. Todo : mouse support in the console (too tiresome to type all these addresses), history for the console to access the previous commands, and the scripts I talked about in the other topic to be able to save what we find.

8 y" U! q' v3 INow with the old cheat system, you would have to add 1 cheat/weapon, which is not very convinient. Here you can add a single cheat using the alert function. First here are the weapons you can get :
- 00 : Normal Gun
- 01 : Shotgun
# q1 ~3 L; P. f - 02 : Flamer
8 ^, Z8 _* U2 {% M  d1 ^9 Q7 u - 03 : Rocket Launcher
$ l, R0 N4 r5 H& x$ B( h - 04 : Machine Gun
the alert function works like this :
# Q% x# B6 V# o: k; r$ yalert("message|button1|button2...")
; l8 ~, d+ ]; C4 u( Wand returns the number of the button you selected starting at 1, or 0 if you pressed ESC or used the 2nd button of your mouse.
So you can type :

& k( V  j7 M1 e) mCode:
, [/ Y; n# r, p8 m1 o  poke $1004d1 alert("select weapon (ESC for normal gun)|Shotgun|Flamer|Rocket l
auncher|Machine gun")
  dpoke $1004e2 999
8 P: F8 ~9 p! D  O

The 2nd line gives 999 munitions at the same time, it's more convinient. Once you have tested, you can add it to your scripts using the script command, and it will appear in the cheats dialog (which you can now call directly using a key from the game).

疾风之狼

Console lessons level 3 : invulnerability and timers
* w, H, X7 i3 h) ?7 j9 r9 x7 i
作者：Tux 文章来源：http://rainemu.swishparty.co.uk/msgboard/yabbse/index.php

, ^, w/ M0 v, r( gThis one is possible mainly because of the explanations from Stephh about how it works.

0 e. h! ?; b; F  d3 b$ T0 d2 V' `You probably noticed by now that almost every arcade game makes your character to blink when it first appears, and while it blinks it is invulnerable... This is the secret of invulnerability : while it works, there is a counter in ram which goes down to 0, and once it reaches 0 you are vulnerable again, so the idea is to use a script which will be called for each frame to prevent the counter from reaching 0.

. G. y0 b- i! f: sIt's a lilttle tricky in mslug because of the little animation when the player 1st appears in the level. For the 1st level, it starts to blink while it is still in the air, then stops blinking for a short time (it is vulnerable at this point), and then starts blinking again when reaching the floor. In fact the counter is set to a high value 3 times during this animation if I am not mistaken !
It's easier to loose a life and then start the search for the 2nd life because the counter is initialised only once then...
So : as soon as you see the player is starting to appear, go in pause mode (p key). Then call the console to take a first snapshot of the ram (using its key, default is tilde), and then exit immediately from the console. Press the space bar while still in pause mode, and the game will run exactly 1 frame. Do that until you see the player character has changed its color. It shows the invulnerability counter just changed. You can then type :
" d/ A; j: z) x3 v; f. D& u* d: ysearch <
It will give you a lot of results of course, there are a lot of things which change at every frame in mslug. So you can repeat the same process a few times, calling the console every time the character changes on screen and type "search <", until the results shrink.
3 z( ^+ t% j+ cThen once it has stopped to blink, you can type :
search 0
because then the counter should be at 0.

In the end, you should have only 2 or 3 results if you made enough searches.
5 k; ~" \' b8 e$ g0 Y9 FTo test this, just poke a big value inside. Since the value goes down by 1 for every frame, if you put 180 inside you will be invincible for 3s (60 frames/s). You should find quite quickly that $1004a5 works great for that.
# Z" r) B. |* X1 U; kNotice that you have a different invulnerability when you are in the tank. In this case, $1005e5 is the address you want.
Of course all these cheats will be installed in the next release... !

疾风之狼

Cheat Searching
In this window you can find new cheat data. To start a search, click new search, then choose a search mode. When you are ready to continue the search, click continue search. There are four search modes:

Absolute search:
9 y, e9 B6 Y% {4 |2 ]' O% q

% ?; I! H' i. V! P  {Searches for absolute byte values.
' z# o# h0 @2 }4 K1 FMost useful for lives and other data.
Relative search:


Searches for the difference between byte values.
* Y$ S) ^5 u# ?$ Z, |, fUseful when absolute search fails, like if the game stores lives starting with ascii 0x30 or stores lives +/- 1 from the value shown ingame. Remember that if the difference is positive you should enter something like 0x01 (+1), if it is negative, then you should be searching for 0xFF (-1).
Single Bit search:
! z4 x% p. o. [6 w* U9 P
/ A+ g7 Y3 {8 V; ?9 B" W9 r9 X3 [3 m
Searches for single bit values.
0 K" F; I. E0 H3 g5 s- ^" N" }Useful for status flags, and stuff like 'extend' in bubble symphony, which is stored in 6 bits of one byte.
8 d, f* d! q' s. ^5 Y" kSlow deep search:


Searches for the following changes in byte values:
& Y; T* B" H" |/ v" N# _new byte == old byte, new byte != old byte,
new byte >  old byte, new byte >= old byte,
) d3 b: T  q. ?6 k- qnew byte <  old byte, new byte <= old byte
Useful for timers and anything not found with the other modes. A nice cheat to have is invulnerability, use this mode to find the invulnerability timer.
The search results are shown in a listbox, when there are more than 512 results, only the first 512 will be in the listbox. You can double click on the search results to open a scrollable hex/ascii view of the memory area where the result lies. Any bytes that are in the search results will have *..* around them, so you can easily spot them.
# ]2 M( g- l8 R8 K/ D
: j$ Z: ]4 P( v* y+ d; A; Hconsole简化指令
  l) ~- D' m$ S5 k) m
  - h = help
. W0 Q2 o/ ~% E# u5 `  - x = exit
+ _, p( Q7 \# u0 }# T5 `- K1 u  - s = search (could also be good to have "si" to initialise search)
  - d = dump / ds = dasm
* W7 ?4 s, W9 p5 K# f" v  - r = registers
  - w = watchpoint
8 u/ t+ A" _3 A) C, j1 m  - p = poke (put value in memory once)