[Vague Rant]

The last few days I’ve been fooling around with the debug modes in a few Virtual Boy games.

The biggest discovery was that Vertical Force’s debug menu is fully accessible in the retail game without hacking. I was also able to make a tiny bit of progress getting SD Gundam’s debug menu up, and lastly I made a small custom patch to change how the Virtual Bowling debug menu is launched. I want to give Parasyte huge credit for the Vertical Force discovery and my little Bowling mod, as both relied heavily on that original hacking work done some 20 years ago.

Vertical Force
Notably, Parasyte predicted in the readme for the original debug mode hack that, given its high-quality presentation, the menu might be accessible in-game. Well, it’s nice to know that hunch was right, all these years later! To access the debug menu, open the Config menu then press the following sequence of buttons:

• Left D-Pad Left
• Left D-Pad Left
• Right D-Pad Right
• Right D-Pad Right
• Left D-Pad Up
• Right D-Pad Down
• Left D-Pad Up
• Right D-Pad Down
• L
• R
• Right D-Pad Right
• Right D-Pad Right
• Left D-Pad Left
• Left D-Pad Left
• Right D-Pad Up
• Left D-Pad Down
• Right D-Pad Up
• Left D-Pad Down
• R
• L

If you don’t want to remember all that, there’s obviously Parasyte’s existing hack here on virtual-boy.com, which forces the debug menu to load on startup. Alternatively, there’s now a patch on The Cutting Room Floor’s Vertical Force page which replaces this button sequence with a single press of Select on the Config screen.

SD Gundam: Dimension War
It’s been known that SD Gundam has some sort of stage select for a while now, but as far as I know nobody has managed to trigger it in-game. I wasn’t able to get the menu working, but I did manage to get it to at least load and display on-screen.

The function at 41EE8 in the ROM is responsible for the debug menu. I wasn’t able to find if there’s anywhere in code which jumps to this function, but I’m just goofing around in an emulator. Somebody more capable (and with access to a disassembler?) may very well be able to take this further and get the debug menu fully working.

That said, you can force the game to jump to this function to at least see the menu, albeit without it actually functioning. Editing offset 7FD0 in the ROM from 01 AC E4 FE (jal fff27eb4) to 03 AC 18 9F (jal fff41ee8) will replace the main menu screen with the “SELECT GAME MODE” menu. From here, you can’t really do anything. A/Start will boot the game, but it’s not otherwise possible to navigate the menu or do anything useful. I’ve attached a screenshot of this menu, since looking at a screenshot is about as good as doing it for real with this half-baked modification.

I haven’t bothered making an IPS patch for this change because it’s basically useless, but I think it’s very likely somebody knowledgeable could get it into a completely working state. Who knows, it could even be like Vertical Force where the debug mode is accessible without hacking but nobody’s figured out how to open it yet.

EDIT: I finally managed to figure out Bob Vanderclay’s V810 Disassembler and got SD Gundam disassembled. I can confirm that there are no jumps to the debug menu function anywhere in the game (unless they’re obfuscated, but I’ll get into why I think that’s unlikely). What there is, however, is a dummy function at 7B8C which immediately jmp [lp]s, i.e. calling the function simply returns. There are also 28 calls (!) of this function scattered throughout the game’s program, including in conspicuous places like the start of the main menu function. Every single one of them is additionally stepped over with a jr, so the dummy function itself is never actually called.

My supposition is that the central portion of the game’s debug code lived in this function, which was compiled out for retail. This function would have handled jumping off to the various debug functions based on what functionality was called for at any given point in execution. This means it’s substantially more difficult for debug to be re-enabled in the retail build, because whatever this function used to do is completely opaque to us from the perspective of the final build. Depending on how thoroughly the rest of the debug code was scrubbed, it could be theoretically possible to restore the functionality by reproducing this function blind, but that would be a huge undertaking and require somebody with much greater ability than I have. Sorry for the downer result!

Virtual Bowling
This one is probably the least interesting, but I made a small hack to adjust how the debug menu is launched in Virtual Bowling. Parasyte’s patch here on virtual-boy.com simply forces the debug menu to open on start-up. This sort of means you need to keep two separate Virtual Bowling ROMs around depending on whether you want debug today or not. My modified patch instead checks whether you’re holding the Select button on start-up. If you are, the debug menu is triggered, otherwise the game boots normally. You can download this modified patch from The Cutting Room Floor’s Virtual Bowling page.

• This topic was modified 8 months, 3 weeks ago by Vague Rant.

Attachments:

1. 

   sdebugam.png
   

Golf
Technically this isn’t debug stuff, but I’ve been messing with Golf for the last couple of days. There’s two findings of particular interest.

Firstly, the Japanese ROM is capable of saving if you run it via emulation or on a flash cart with save support, because the game has a whole save system set up which relies on a check for functioning saveRAM on the cart. This removes the preset save slot 1 (T&ESOFT, called Duff in the US version) and password screens entirely. For cost-cutting reasons, when T&E Virtual Golf (the Japanese version) was released it did not have saveRAM on the board, so on official cartridges that check does its job and causes the game to fall back to the familiar password-save mechanism.

For the USA release, they went further: in addition to the physical saveRAM being MIA, the saveRAM check is hardcoded to fail, and once again the game drops back to the password system. However, it was only that check which was disabled in the US version; all of the other saving code has been sitting on the ROM unused for the last 29 years or so. Fortunately, it was possible to restore the saveRAM check by comparing against the Japanese version, and there’s now a patch available here on virtual-boy.com or at the Golf page on The Cutting Room Floor to restore saving in the USA version when played via emulators or flash carts with saveRAM support.

Secondly, there’s a newly discovered cheat in the game which disables the wind. Simply (or not that simply, it’s a little bit awkward) hold the following buttons while starting up the console:

• Select
• Left D-Pad Left
• Right D-Pad Right

If you’re playing on the stock game (e.g. official cartridges or an unpatched USA ROM), this will also change the default save slot name from Duff (US)/T&ESOFT (JP) to VICTORIA.WON. I don’t know who Victoria is or what they won, anybody have ideas? Is this some sort of golf joke that I’m too uncultured to understand? Anyway, if you’re playing on a version of (T&E Virtual) Golf which supports saving, you won’t see the VICTORIA.WON part, because as mentioned, default player names don’t exist when saving is enabled. However, the wind will still be disabled.

[abarth]

Amazing stuff those save patches!
I have also seen your other patches for Red Alarm and Mario Clash.
So in theory this means you can create reporcards with sram saving features for those three games?

• This reply was modified 8 months, 2 weeks ago by abarth.

Thanks!

I have also seen your other patches for Red Alarm and Mario Clash.

Just to catch people up who aren’t on the Discord, after I restored the dummied saving feature in Golf, Super Bros. asked if it would be possible to get games to save even if they weren’t originally designed for saving, like Golf. I answered, perhaps a little optimistically, yes: you’d just have to redirect writes to memory to SRAM instead. In practice it’s been a bit more complicated than that, but you can see the results on my vb-patches GitHub repo, which currently has save patches for Golf, Jack Bros. (also doubles as a debug mode patch), Mario Clash and Red Alarm.

So in theorey this means you can create reporcards with sram saving features for those three games?

I can say with a high degree of confidence: maybe. If they work on flash carts, then they should also work on reproduction carts. That said, I really don’t even know that they work on flash carts currently. I don’t own a Virtual Boy myself, so all of this has only been tested via emulation in Mednafen and Red Viper. There shouldn’t really be anything dramatically different about running them on real hardware, but you never know.

There’s also at least some potential that I broke something in the process of creating these patches. I haven’t tested the games all the way through to make sure there’s no negative effects. For example, the initial release of the Golf save patch had a bug which caused it to overwrite a graphic on the in-game Depth settings screen. That was relatively harmless and it’s been fixed and updated since, but making a repro of any of these hacks would require a high level of faith in these relatively untested hacks.

In short, it should be possible to make repros of any one of these games with added SRAM support, but I’d personally warn against it until the hacks have been field-tested a bit more.

Oh, damn, even Jack Bros now! Amazing!
I am really tempted to get reprocards with those patches (perhaps not Jack Bros, because there the password system is not that annoying, but Golf for example takes really a step upwards with proper saving). I am not that guy who uses flashcarts, I like changing the cartridges and have a game physically in hand.
I will think about it and keep an eye on your progress.
Keep up the great work!

Well I have tested the patches on real hardware with my hyperboy.
Result:
– Save patch for Golf (US version) works fine
– Golf (japanese version) saves fine as predicted
– Save patch for Red Alarm (I used the japanese Version) causes the game to crash before the intro, and the graphics are messed up
– Save patch for Mario Clash (I used the version available here on planet virtual boy) messes up the graphics, but no crashes.

Thanks, that’s fantastic feedback. I’ll try to figure out what’s going wrong.

In Red Alarm, the only custom code that runs before the title screen appears is the SRAM initialization, so something must be going wrong in there. I don’t see anything obvious currently, so I might have to make some test builds for both/all games to see if I can narrow down the problem.

In the meantime, if you get a chance, would you mind testing a couple of button combos in Mario Clash to see if they make any difference?

First up, from basically anywhere in the game (title screen, intro, gameplay), press L + R + Select + Start + A + B. I know that’s a lot of buttons to press at once, sorry. This is the soft reset feature built into the game, so I’m just curious if a reboot would fix the graphical issues.

Secondly, I’d like you to try the SRAM reset button combo. From the title screen (and only the title screen, it won’t work anywhere else), press L + R + Left D-Pad Down + Right D-Pad Down. That should erase the SRAM and restart the game, similar to the soft reset. I’d be very interested to know if that fixes anything.

Yes, I will check the combos this evening and let you know the outcome.
Btw, I like how you changed the level select in Mario Clash (i.e. that you can only choose a level when you have already cleared the previous one. This is great with save feature enabled and creates a much better gaming experience in my opinion).

Thanks so much, I really appreciate your help.

Currently my running theory is that perhaps there’s less SRAM available than I’ve been assuming. I think the understanding is that there’s 64 KB available, although the Sacred Tech Scroll doesn’t really specify, it technically lists a range of 06000000-06FFFFFF which is like 2 GB, but I’ve been running with the theory that it behaves the same as work RAM, where the range is technically 05000000-05FFFFFF but the effective range is 05000000-0500FFFF (64 KB) and the rest is mirrors. Emulator saves are all 64 KB, so this seemed like a reasonable assumption, but emulators be emulatin’.

If the SRAM range is actually smaller than that, then something weird could be happening when I do my SRAM initialization, because I’m writing out the full 64 KB with zeroes before I start using it. If some of that range is inaccessible or mirrors for something else and those writes are bouncing to somewhere they’re not supposed to, I could be wiping out something the games actually need to run correctly, hence the issues.

Re: Mario Clash: Thanks! Yeah, it seemed to me like if the game had been released with saving, they never would have given you 40 levels to select from right at the start. That seems like a feature that exists purely because the game doesn’t save. In a world where the game did have saving back on release, I think it would absolutely be like the way I patched it, where you can only play levels you’ve previously reached. If I can get that save fixed up I really feel like that will be the definitive way to play Mario Clash (once you’ve also applied DogP’s button-swap patch).

Sounds totally reasonable to me.
And yes, buttwon-swap patch is a must have 🙂

I talked to KR155E on the Discord about this, and apparently on retail releases/flash carts, only the high bytes in SRAM are accessible (as in, you have to read/write only the even bytes, the odd bytes are not valid).

Taking this into account, the likely reason for Red Alarm crashing was that it was trying to read in the depth values before displaying the intro, and it was only getting half of the bytes off the SRAM. With this info in hand, I’ve made a version of the Red Alarm patch which only reads/writes from the high bytes which I’ve attached to this post. Fingers crossed, this means it will work on hardware and I can start switching the rest over to only reading/writing single bytes at a time.

(Also why is the Virtual Boy like this, this is incredibly inconvenient.)

Cool, I will test this also this evening!

Well my feedback:
– Red Alarm worked once, but as soon as there is a save in the SRAM and you restart the system it crashes before the intro.
– Mario Clash: neither the soft restart nor the SRAM reset combo worked, graphics are still glitchy (way too much contrast).

Thanks so much for your help, once again. That’s some progress. Shows we’re on the right track, although I’m not sure currently what the next problem is with Red Alarm.

For Mario Clash, that makes sense. The original game stores the brightness in 05005A63 (odd number!) so when my save patch switched that to 06005A63, I was unknowingly dropping it into one of those SRAM holes and the game is never able to read that value back. While I try to figure out what’s wrong with Red Alarm, attached is a test build of Mario Clash with only high bytes.

EDIT: I’ve also attached a test build of Jack Bros. Obviously only test if you feel like it, since I know it’s not a game you’re too bothered about!

EDIT2: And another Red Alarm test build. I was accidentally still using an odd byte for one of the eye offsets–I’ve been assuming it’s the left eye because it comes first, but I do all development in 2D, so I don’t actually know that. Fingers crossed. This might have caused a crash if you ever went into the Options and manually adjusted the depth and got an invalid value saved into SRAM, which was read in on the next load. Really hope this is it.

So I have tested your new ips-patches:
– Mario Clash: works fine! Games looks normal, and the progress is saved. I played only the first three levels though, but I am confident that it works.
– Red Alarm: works now! The game starts normal even when you have played it just before and have set a new highscore.
– Jack Bros: I used the US-version and applied your patch. I used a password, played the game for a quick moment and restarted the system. But on the main menu it still shows “password” and you can´t simply choose continue. Did I do something wrong?

That’s fantastic, very happy to hear Red Alarm and Mario Clash are working! Jack Bros. has changed quite a bit since the last version, the Start option now lets you start a new game or continue a saved game. Passwords are still available, but you can play the whole thing with saving from the Start menu (assuming it’s working!) now.

EDIT: I’ve just put up the final updated builds for all three games (Jack Bros., Mario Clash and Red Alarm) on my GitHub, so I’d recommend against anybody downloading the test patches from the above posts.

[abarth]

Simply outstanding! Jack Bros is incredible with the save feature. It is a whole new game! I didn´t thought that this would be so cool.
Now I only need all of those 4 games as reprocards, which sure will cost a lot of money.
Again, amazing work!

PS: are there any other games where save features could be included?

EDIT: forgot to mention that Jack Bros patch 1.2 works on my console with Hyperboy-Flashcart.

EDIT2: the Mario Clash Highscores are a bit mixed up (see attached image).

• This reply was modified 8 months, 1 week ago by abarth.
• This reply was modified 8 months, 1 week ago by abarth.

Attachments:

1. 

   img_20240420_111551062-scaled.jpg
   

Whoops, sorry about that! I broke it in the process of adjusting to 8-bit/high-byte SRAM writes, I didn’t update to the new addressing correctly. I’ve updated the Mario Clash patch to version 1.2 which should fix that bug.

Tested and confirmed working 🙂

One more question regarding Jack Bros: on github it is written: “added debug toggle (hold Select while booting) and title screen message”. This does not work for me, at least I can´t see any changes. What would one see / able to do when this mode is active?