Mushihimesama Futari/Reverse engineering notes - Revision history

Komidore64 at 17:37, 6 December 2020

2020-12-06T17:37:35Z

Komidore64: replace instances of `with Code template`


2020-08-29T02:06:20Z
replace instances of <code> with Code template

				
				
				
				
				
				← Older revision
				Revision as of 02:06, 29 August 2020
				
Line 14:
Line 14:
    
  ===== 0xc06db00: schedule_enemy_bullet =====   ===== 0xc06db00: schedule_enemy_bullet =====
− signature: <code>struct enemy_bullet_plan * schedule_enemy_bullet(byte type, int x, int y, short speed, short angle)</code> + signature: {{code|struct enemy_bullet_plan * schedule_enemy_bullet(byte type, int x, int y, short speed, short angle)}}
    
  This function is used to create a single bullet or a simple pattern.   This function is used to create a single bullet or a simple pattern.
Line 23:
Line 23:
    
  ===== 0xc06dc90: spawn_enemy_bullets =====   ===== 0xc06dc90: spawn_enemy_bullets =====
− signature: <code>void spawn_enemy_bullets(struct gamestate *state)</code> + signature: {{code|void spawn_enemy_bullets(struct gamestate *state)}}
    
  This function spawns all the bullets planned by 0xc06db00. Notice that a single bullet plan can spawn multiple bullets.   This function spawns all the bullets planned by 0xc06db00. Notice that a single bullet plan can spawn multiple bullets.
    
  ===== 0xc06e350: new_enemy_bullet =====   ===== 0xc06e350: new_enemy_bullet =====
− signature: <code>struct enemy_bullet * new_enemy_bullet(int type,int x,int y,ushort speed,ushort angle,void *param_6,short param_7)</code> + signature: {{code|struct enemy_bullet * new_enemy_bullet(int type,int x,int y,ushort speed,ushort angle,void *param_6,short param_7)}}
    
  This function spawns a single bullet.   This function spawns a single bullet.
Line 67:
Line 67:
    
  ===== 0xc0631f0: randint =====   ===== 0xc0631f0: randint =====
− signature: <code>ushort randint(ushort max)</code> + signature: {{code|ushort randint(ushort max)}}
    
  Random number generator (RNG). Uses the standard C [https://en.wikipedia.org/wiki/Linear_congruential_generator LCG]   Random number generator (RNG). Uses the standard C [https://en.wikipedia.org/wiki/Linear_congruential_generator LCG]



Olifante at 11:10, 17 August 2020
2020-08-17T11:10:59Z


				
				
				
				
				
				← Older revision
				Revision as of 11:10, 17 August 2020
				
Line 14:
Line 14:
    
  ===== 0xc06db00: schedule_enemy_bullet =====   ===== 0xc06db00: schedule_enemy_bullet =====
− signature: ```struct enemy_bullet_plan * schedule_enemy_bullet(byte type, int x, int y, short speed, short angle)``` + signature: <code>struct enemy_bullet_plan * schedule_enemy_bullet(byte type, int x, int y, short speed, short angle)</code>
    
  This function is used to create a single bullet or a simple pattern.   This function is used to create a single bullet or a simple pattern.
Line 23:
Line 23:
    
  ===== 0xc06dc90: spawn_enemy_bullets =====   ===== 0xc06dc90: spawn_enemy_bullets =====
− signature: ```void spawn_enemy_bullets(struct gamestate *state)``` + signature: <code>void spawn_enemy_bullets(struct gamestate *state)</code>
    
  This function spawns all the bullets planned by 0xc06db00. Notice that a single bullet plan can spawn multiple bullets.   This function spawns all the bullets planned by 0xc06db00. Notice that a single bullet plan can spawn multiple bullets.
    
  ===== 0xc06e350: new_enemy_bullet =====   ===== 0xc06e350: new_enemy_bullet =====
− signature: ```struct enemy_bullet * new_enemy_bullet(int type,int x,int y,ushort speed,ushort angle,void *param_6,short param_7)``` + signature: <code>struct enemy_bullet * new_enemy_bullet(int type,int x,int y,ushort speed,ushort angle,void *param_6,short param_7)</code>
    
  This function spawns a single bullet.   This function spawns a single bullet.
Line 67:
Line 67:
    
  ===== 0xc0631f0: randint =====   ===== 0xc0631f0: randint =====
− signature: ```ushort randint(ushort max)``` + signature: <code>ushort randint(ushort max)</code>
    
  Random number generator (RNG). Uses the standard C [https://en.wikipedia.org/wiki/Linear_congruential_generator LCG]   Random number generator (RNG). Uses the standard C [https://en.wikipedia.org/wiki/Linear_congruential_generator LCG]





Olifante: This page contains notes gathered while reverse engineering the futari15 mame romset. Addresses will be different for other versions of the game.
2020-08-17T10:46:44Z
This page contains notes gathered while reverse engineering the futari15 mame romset. Addresses will be different for other versions of the game.
New page
This page contains notes gathered while reverse engineering the [https://github.com/mamedev/mame/blob/028b43b74446cae777967321587a83b0fffbb09a/src/mame/drivers/cv1k.cpp#L613 futari15] mame romset. Addresses will be different for other versions of the game.



== Players ==

Most of the player1 data is stored in the range [0xc38aabc..0xc38ab73]. Setting 0xc38ab24 to 0x7fffffff makes the player invulnerable, which can be useful while debugging enemy patterns.





== Enemy Bullets ==

Enemy bullets are stored in a doubly linked list (head: 0xc38a3b8, tail: 0xc38a3bc).



The physical data of the bullets is stored in an array of 2000 structures in [0xc3c64d8..0xc40e917].





=== Functions related to enemy bullets ===



===== 0xc06db00: schedule_enemy_bullet =====

signature: ```struct enemy_bullet_plan * schedule_enemy_bullet(byte type, int x, int y, short speed, short angle)```



This function is used to create a single bullet or a simple pattern.



All bullets constructed on the current frame are temporarily stored in an array of 500 structures in [0xc40e934..0xc41b453].



This is a great place place to start from when trying to find the AI of an enemy: simply put a breakpoint in this function when the desired enemy is about to shoot a bullet and when the breakpoint gets triggered, step out of the function to find where it was called from (which is usually the AI of the enemy).



===== 0xc06dc90: spawn_enemy_bullets =====

signature: ```void spawn_enemy_bullets(struct gamestate *state)```



This function spawns all the bullets planned by 0xc06db00. Notice that a single bullet plan can spawn multiple bullets.



===== 0xc06e350: new_enemy_bullet =====

signature: ```struct enemy_bullet * new_enemy_bullet(int type,int x,int y,ushort speed,ushort angle,void *param_6,short param_7)```



This function spawns a single bullet.



== Enemies ==

Enemies are stored in a doubly linked list (head: 0xc38a2c8, tail: 0xc38a2cc).



The logic data of enemies is stored in an array of 128 structures in [0xc41b560..0xc464560].



The physical data of the enemy is dynamically allocated in [0xc464560..0xc47bc5f] by the enemy_entity_malloc function at 0xc075990.



Additional data can be allocated dynamically in "closures" (allocated in [0xc491e18..0xc498217]).



Each enemy has a different constructor and uses its dynamically allocated memory in a different way (e.g. the position is not always at the same offset).



The pointers to the constructors of the enemies are listed at [0xc2857e0..0xc285bdf].



For example, enemy 88 is the flying lobster from stage 2, therefore its constructor is at 0xc2857e0 + 4*88 = 0xc285940.



Depending on the game mode (original=0, maniac=1, ultra=2), which is stored at 0xc38a580, different update logics are selected for the enemies. For example, the flying lobster has 3 different update functions for the different game modes: 0x0c0b5f20 for original 0xc0b6210 for maniac, 0xc0b6440 for ultra.



Bosses are more complicated, as their AI changes over time. Each phase is usually represented by a [https://en.wikipedia.org/wiki/Closure_(computer_programming) closure] a function pointer to the updater function which is called once per frame together with its contextual data (e.g. number of frames to wait before shooting the next bullets).

There are different closures for shooting AI, movement AI, rendering... These closures are used to implement a sort of parallelism even though this game runs on a single thread.



As an example, the shooting AI of the second pattern of the first phase of the stage 2 ultra boss is at 0xc174cf0, but the chain of function pointers that link the constructor to that pattern is 8 pointers long:

* 0xc15e890 stage2_ultra_boss_constructor()

* 0xc166ad0 (allocates 12 bytes closure for next function)

* 0xc1668e0 stage2_ultra_boss_spawning_animation_updater()

* 0xc16a5a0 (allocates 16 bytes closure for next function)

* 0xc16a620 stage2_ultra_boss_phase1_updater()

* 0xc16a8e0 (allocates 82 bytes closure for next function)

* 0xc16afa0 stage2_ultra_boss_phase1_pattern2()

* 0xc1747d0 (allocates 64 bytes closure for next function)

* 0xc174cf0 stage2_ultra_boss_phase1_pattern2_shoot()





== Other useful functions ==



===== 0xc0631f0: randint =====

signature: ```ushort randint(ushort max)```



Random number generator (RNG). Uses the standard C [https://en.wikipedia.org/wiki/Linear_congruential_generator LCG]

Mushihimesama Futari/Reverse engineering notes - Revision history

Komidore64 at 17:37, 6 December 2020

Komidore64: replace instances of with Code template

Olifante at 11:10, 17 August 2020

Olifante: This page contains notes gathered while reverse engineering the futari15 mame romset. Addresses will be different for other versions of the game.

Komidore64: replace instances of `with Code template`