Zelda OoT Debug Crash Debugger Combination

[Airikita]

I have found a lead to the button combination for Zelda Debug on a console:

 

Note it may not work for an emulator (it doesn't for almost all of them, maybe all of them don't) but if you want to play it on console, here is the code for the Crash Debugger deciphered from the data in the Japanese text in the video:

1. L + R + Z
2. Up + C-down
3. C-Up + Down
4. Left + C-left
5. C-right + Right
6. B + A + START
7. L + R + Left + C-right + START

HeavyZ will confirm this.

 

EDIT: We are under the impression KeyWaitB implies controller two.

 

xdaniel:

 

KeyWaitB (ＬＲＺ 上下 上下 左左 å³å³ B A START)
L + R + Z
Up + C-Down
C-Up + Down
Left + C-Left
C-Right + Right
B + A + Start

KeyWaitB'(ï¼¬ï¼²å·¦å³ +START)
L + R + Left + C-Right + Start
 

...is what I gather from the video.

Seems more accurate, but still testing.

 

EDIT: we're under the impression that Nintendo used the Konami code for this.

[Airikita]

I have a request I need to make... HeavyZ has mysteriously vanished from Skype and the community... he mentioned some things that are worrying me, as I mentioned I was close to this discovery. It's possible he'll be back this weekend, but just in case can anyone with an ED64 and a console test out this find? Emulators are useless to test out if changing the functions at 0xB4D46C AND 0xB4D474 to 00000000 will even work.

 

The theory is good, I just need someone to actually test this for me...

[haddockd]

I would if I knew how but alas I am just an old lurker unfortunately.

 

If you would care to tell me how to test it I would be happy to

[Jack Walker]

I tested both alternative combinations and unfortunately they did not work.

[Airikita]

I would if I knew how but alas I am just an old lurker unfortunately.

 

If you would care to tell me how to test it I would be happy to

Well, if you go to 0xB4D46C AND 0xB4D474 in a hex editor for the debug rom, take the values that start with 0CXXXXXX and change them both to 00000000, then try the altered rom (after saving the changes, maybe make it a different file so you don't ruin your original), and try it on the console. You can crash room 124 I believe, and you should see the crash debugger come up with text (that's the theory anyways).

[DeathBasket]

Just out of curiosity, what method are you using to crash the game?

[Airikita]

Just out of curiosity, what method are you using to crash the game?

To find the crash debugger I didn't crash the game, the crash debugger never activates on emulators. I dug through the code and found where the functions are located in RAM.

[Arcaith]

I'll give this a test on my 64drive later this evening.

[Airikita]

That would be great. I have my own stuff to do today, so I won't be waiting all day for it (thank goodness).

[Arcaith]

Managed to cause a crash on 125, but didn't get any debug info. Changed the data in ROM, though wasn't sure if you meant change C0 XX XX XX to 00 00 00 00 or change it to C0 00 00 00.

[Airikita]

Managed to cause a crash on 125, but didn't get any debug info. Changed the data in ROM, though wasn't sure if you meant change C0 XX XX XX to 00 00 00 00 or change it to C0 00 00 00.

Supposed to be to 00000000 which is a NOP (cancels that operation), if you change it to 0C000000, it's just going to hang the system.

 

EDIT:

Try changing the one at B4D45C to 00000000 also, might be a mixture of commands.

[Arcaith]

I'll give that a go and see if it changes anything.

[HeavyZ]

Yeah sorry I haven't been around to test too much, and I did mention to both you Airikita and the community that I might be gone for a while. Still not all the way back, I don't own my own computer at the moment, so I'm just getting on when I can.. probably once a day or every two days really.

I'll test too if needed.. I'm just not able to recieve as many files as frequently as before, as well as being able to respond as fast.

 

Good to see this is still being worked on, if this thing gets cracked we can all find out how to make all of our hacks and programs N64 compatible with the info the debugger could provide.

[HeavyZ]

I may be a bit late with this info though I am still delivering. This is what Zoinkity messeged me back a while back after I had asked him about the subject so all cred for this goes to him and should be kept especially in mind when giving credit if it does prove useful.

 

Animal Forest uses ASM to test for keypresses, unlike the key lists like what you see in GE. The basics behind this require you to find the (usually multiple) controller read routines.

Typically there's multiple controller tests, but effectively they all work the same. Button input is usually tested for by passing a controller index (0-3, although up to 6 is valid for a complicated reason) to these along, sometimes with a buffer index, and the returned value is a short (2-byte) value. The standard return value is the current buttons either pressed or held, depending on the routine, and these correspond directly with the bits assigned each button via hardware:

Code: 8000   A button
4000   B button
2000   Z button
1000   Start button
0800   up-Dpad
0400   down-Dpad
0200   left-Dpad
0100   right-Dpad
0020   L button
0010   R button
0008   up-C button
0004   down-C button
0002   left-C button
0001   right-C button

Control stick routines are a little different. In general they only test one direction a time, passing a controller index, a deadzone range, and sometimes a buffer index as well. The return differs depending on the type of command it is; some will give a value from -2 to +2, some the actual value if it's above the deadzone, others only unidirectional. Typically there will be 3-4 times the number of stick readers than button readers.

If there's a debug string, I'd say looking for a bt of code that uses the pointer is a good place to start. Even if the string isn't used, it's a dead giveaway for the routine. Otherwise, trace and figure out the most common button reader routines, then search for every JAL to those addresses. A0 will always be the controller index unless they did something..unique. Just after the JAL should be button value tests, so look for one followed either by 0800, 0008, or 0808. Then, see if on a hit it looks for the next value in the series.

Hopefully, if you're really lucky, they'll code the delays right there. Otherwise, they might set bitflags or something that's passed to each additional test. Either way, searching for the button masks is probably the easiest way to find it (presuming it's still there).

[Airikita]

Hmmmm... okay well... I'd have to dig through that code again, and it's nearly exam time. I have the notes somewhere, and seeing as we have something to go by, this will be my first holiday project when I have time.

[DeathBasket]

Did anyone ever figure out the correct button combination?  I only remember MM's one because it's super easy but I know it doesn't work.

 

Anyway, just wondering if anyone knows what colour the bar that appears is in a normal (not debug) version of Master Quest? I noticed that on the debug ROM it's red like in MM while in all earlier versions of OoT it's yellow iirc.

[Vexiant]

ZZT32/mbr made this video and released the source YEARS ago.

[john_smith_account]

I just fought 1964, and a few other N64 emulators for 2 hours to get modding again.

 

So not worth it.  

 

More good work from you Aikita, but we all expected that, didn't we.

[DeathBasket]

ZZT32/mbr made this video and released the source YEARS ago.

 

Yes. I don't know if this was a response to what I posted or not but it's irrelevant. The crash debugger does not appear on emulators and the button combination shown in the video does not activate it on a console, I tried. Maybe extra controllers are required (as with some other features) but I only have one so I don't know.

[john_smith_account]

 

PURGED!

 

 

REASON:  Common sense.

 

Good find!

[Mallos31]

Now that it's been a while again, I wanted to see if anyone ever got any farther on the debugger activator. I have the debug rom working on my ED64 and have found some interesting crashes I want to check out.