NEORAINE修改教程(作者：Tux)

疾风之狼

console basics

. k9 _; W9 W% |$ H2 ^. R* J作者：Tux 文章来源：http://rainemu.swishparty.co.uk/msgboard/yabbse/index.php



I know a command line is quite intimitading, but it will be much more powerfull for what I want, and also it will be much easier to add new features this way.

So here in mslug, I wanted to look for the number of lifes, so I started by search 3 just at the begining of the game and there were more than 39000 results.
! E  C2 t8 O& X2 z+ uSo I lost a life, typed "search 2" and I was down to 4 results already !
( z9 k  F0 I$ `Lost another life, and this time "search 1" sent back only 1 result : 100397.
1 d* Q' `4 ]9 ^* @, e" C
This is the very first beta for this, I want to add other functions like the ability to modify any address in ram (to test the result by puting any life number for example), to be able to explore the ram at any address to see if there are other interesting addresses nearby, and so on...

As you see the syntax for the command line is extremely simple, and should remain as simple as possible...
And this thing could probably be used as a debuger too (68000/z80 debuger).
5 u2 x$ k( c0 `0 g- _9 K
[ 本帖最后由 疾风之狼 于 2009-3-31 20:36 编辑 ]

疾风之狼

console lessons level 2

0 {+ c4 h3 L/ ^作者：Tux 文章来源：http://rainemu.swishparty.co.uk/msgboard/yabbse/index.php

) K0 r* k/ t, P! H  s, ^how to find the location of the weapon for metal slug in ram ?
  M8 i+ J- O6 Q" n5 N) eWelcome to the relative searches we started to talk about in the other topic...
! u/ D; t7 S3 y9 b( a; ?
So just start the game as usual, and open the console just before picking the machine gun, and close it immediately. In doing so it takes a snapshot of the ram, and you'll be able to look for differences later. Now take the machine gun and type:
% c5 f$ J1 a" B9 gsearch !=
which will search all the bytes which are different.
Well there a few hundreds of differences, so it will take time.
The idea is to wait a little in game, then return to the console and type
9 d  `, c* R( _) W6 ?0 `! J/ \search ==
to look for the areas which didn't change. Half of the results are gone, but you still have a lot of them. Play a little until the flame thrower and just before picking it up, type :
) ?7 `' g/ C) b/ k" @8 xsearch ==
and after picking it up :
search !=
normally when you pick the machine gun again and you type search !=, you'll get only 2 results which are both valid :

2 k  t) Q) o' \* q! _
2 r  ~2 F. A$ r1 c2 g, \- [7 r  P
$ l) P" E7 [0 N: wAfter a few tests, the 2nd address is the one you want, puting 4 in it gives the machine gun and 2 is the flame thrower (I didn't test all the weapons !).
" R" M* g% G/ v# p
This is a lot harder than the simple life counter... !!!
But it works well. Todo : mouse support in the console (too tiresome to type all these addresses), history for the console to access the previous commands, and the scripts I talked about in the other topic to be able to save what we find.
6 j( _% r$ M. H7 q) D
1 S/ `6 C" R# m3 X$ bNow with the old cheat system, you would have to add 1 cheat/weapon, which is not very convinient. Here you can add a single cheat using the alert function. First here are the weapons you can get :
- 00 : Normal Gun
- 01 : Shotgun
$ n. n/ R7 j. L* u  _- S2 m- i- y - 02 : Flamer
; r3 n- z% n* P% O7 s' _  n) y - 03 : Rocket Launcher
- 04 : Machine Gun
the alert function works like this :
6 j( j: x' j- V" k: u, p3 t8 halert("message|button1|button2...")
and returns the number of the button you selected starting at 1, or 0 if you pressed ESC or used the 2nd button of your mouse.
/ K- u; _* d/ `) z  aSo you can type :
/ q/ O- C3 J- Q7 s: \$ P
Code:
  poke $1004d1 alert("select weapon (ESC for normal gun)|Shotgun|Flamer|Rocket l
0 ?! L7 u8 K# w* O; b/ O. Sauncher|Machine gun")
  dpoke $1004e2 999
  ]1 Y( W1 f3 D0 {) A

The 2nd line gives 999 munitions at the same time, it's more convinient. Once you have tested, you can add it to your scripts using the script command, and it will appear in the cheats dialog (which you can now call directly using a key from the game).

疾风之狼

Console lessons level 3 : invulnerability and timers
2 n3 Q& j0 l  v" X5 l, }
作者：Tux 文章来源：http://rainemu.swishparty.co.uk/msgboard/yabbse/index.php

7 x6 q0 F/ T7 h* }5 ?  n  GThis one is possible mainly because of the explanations from Stephh about how it works.

- D- }) d/ f4 C$ c8 q1 `  pYou probably noticed by now that almost every arcade game makes your character to blink when it first appears, and while it blinks it is invulnerable... This is the secret of invulnerability : while it works, there is a counter in ram which goes down to 0, and once it reaches 0 you are vulnerable again, so the idea is to use a script which will be called for each frame to prevent the counter from reaching 0.
1 I0 Q0 g7 l4 i, E2 n; D
It's a lilttle tricky in mslug because of the little animation when the player 1st appears in the level. For the 1st level, it starts to blink while it is still in the air, then stops blinking for a short time (it is vulnerable at this point), and then starts blinking again when reaching the floor. In fact the counter is set to a high value 3 times during this animation if I am not mistaken !
It's easier to loose a life and then start the search for the 2nd life because the counter is initialised only once then...
So : as soon as you see the player is starting to appear, go in pause mode (p key). Then call the console to take a first snapshot of the ram (using its key, default is tilde), and then exit immediately from the console. Press the space bar while still in pause mode, and the game will run exactly 1 frame. Do that until you see the player character has changed its color. It shows the invulnerability counter just changed. You can then type :
5 Z& [2 _  u; H, b. asearch <
! ?! p2 P* R) yIt will give you a lot of results of course, there are a lot of things which change at every frame in mslug. So you can repeat the same process a few times, calling the console every time the character changes on screen and type "search <", until the results shrink.
: v) Y6 O' H9 N: u, l8 ~Then once it has stopped to blink, you can type :
search 0
, D& g1 w/ r+ I0 k6 d5 R8 k9 gbecause then the counter should be at 0.
+ e7 @; a3 C: b' I+ G
In the end, you should have only 2 or 3 results if you made enough searches.
' h/ d1 f. F, O3 W% ?5 H2 o* iTo test this, just poke a big value inside. Since the value goes down by 1 for every frame, if you put 180 inside you will be invincible for 3s (60 frames/s). You should find quite quickly that $1004a5 works great for that.
Notice that you have a different invulnerability when you are in the tank. In this case, $1005e5 is the address you want.
' _+ a1 @+ m8 m: t4 jOf course all these cheats will be installed in the next release... !
) \4 \( F1 I, Y' m0 Q

疾风之狼

Cheat Searching
4 o0 I9 l. _& [) L' b4 [% h& w" v. GIn this window you can find new cheat data. To start a search, click new search, then choose a search mode. When you are ready to continue the search, click continue search. There are four search modes:
7 q; b, x7 G5 Y& R
Absolute search:


& V$ S$ S5 b& e) X* y6 g2 S+ d, lSearches for absolute byte values.
3 `- A! {0 \5 E( c, g2 G& YMost useful for lives and other data.
Relative search:
2 a- P4 g- M7 T& w; ^$ K4 [
4 E. Q6 M5 P5 R# d5 {
Searches for the difference between byte values.
  B4 b" D4 R: P/ u/ VUseful when absolute search fails, like if the game stores lives starting with ascii 0x30 or stores lives +/- 1 from the value shown ingame. Remember that if the difference is positive you should enter something like 0x01 (+1), if it is negative, then you should be searching for 0xFF (-1).
Single Bit search:

  }4 s7 G( t1 s1 ?- `9 O
Searches for single bit values.
8 j7 Z( U' D7 F( c. dUseful for status flags, and stuff like 'extend' in bubble symphony, which is stored in 6 bits of one byte.
Slow deep search:

8 A/ M6 T6 M! @7 X
, Q6 J( b2 }' D$ g. xSearches for the following changes in byte values:
! t% |4 v4 n9 ?1 a: A7 X7 V; G. k1 enew byte == old byte, new byte != old byte,
5 \' t# m- G( `- Z- W# ^new byte >  old byte, new byte >= old byte,
new byte <  old byte, new byte <= old byte
! J; u8 n5 [( G* F; h. {. NUseful for timers and anything not found with the other modes. A nice cheat to have is invulnerability, use this mode to find the invulnerability timer.
& g% Y5 E; |+ x" W7 |The search results are shown in a listbox, when there are more than 512 results, only the first 512 will be in the listbox. You can double click on the search results to open a scrollable hex/ascii view of the memory area where the result lies. Any bytes that are in the search results will have *..* around them, so you can easily spot them.

console简化指令

  - h = help
  - x = exit
( T6 t' r9 F; g2 U4 V0 O5 x0 o' X4 m  - s = search (could also be good to have "si" to initialise search)
+ `% A, U" N- @, S1 A  - d = dump / ds = dasm
  - r = registers
  - w = watchpoint
  - p = poke (put value in memory once)