ROM Hack Reverse engineering GBA patching

[Destructobot]

These are all of the 2in1 sets that I know cannot be patched (I don't remember if I've tried any others or not):

2129 - Dr. Mario & Panel de Pon (J)
2213 - 2 Games in 1 - Dr. Mario & Puzzle League (E) (M5)
2261 - 2 Games in 1 - Dr. Mario & Puzzle League (U)

2472 - 2 Games in 1 - Dragon Ball Z - Buu's Fury + Dragon Ball GT - Transformation (U)


I'll test some others later to see if any of them can be patched.

 

[TrolleyDave]

Nice one, I'll look into them tomorrow after finishing off the other save types. Although I think for a couple of the save types it might be the same task. Is it just the 2-in-1 games that have problems? I was looking at the PocketHeaven release list just now and they share the same save type as alot of other games. If the single games work then it gives me a clue as to why GBATA doesn't patch them correctly.

All the 2-in-1 games that don't patch correctly have been released as single game carts before I'm guessing? Sorry my knowledge of GBA releases is pretty limited and after staring at hex patterns all day my brain is burned out a little!

Do you know if there's any standalone patches that patch the roms correctly for SRAM saving?

 

[Destructobot]

All the 2-in-1 games that don't patch correctly have been released as single game carts before I'm guessing? Sorry my knowledge of GBA releases is pretty limited and after staring at hex patterns all day my brain is burned out a little!

Do you know if there's any standalone patches that patch the roms correctly for SRAM saving?

Dr. Mario & Puzzle League were only released in the 2 in 1 pack. I don't know of any other games that were not released seperately, but I haven't really paid much attention to the multipacks. The single releases of those Dragon Ball games can be patched normally.

There are also 3 in 1 and (I think) 4 in 1 game packs; they may have similar patching issues.

I don't know of any standalone save patches for the multipacks. The only collection of standalone save patches that I know of is at No Frills.

 

[TrolleyDave]

I've finished all the different save types, I've updated the structures in the main post for those interested. I've also updated the SRAM patching test program if people wouldn't mind testing it out for me.

 

[FAST6191]

Sorry I have not been around to comment on this, it looks like you got on pretty good with it.
I am going to sleep for a couple of hours and then I will test it.
I did a little bit of work on what actually happens to the rom (asm level) too on the simple stuff (so not Dragon Ball titles with EEPROM check and other fun things like that) so I might be able to figure out how to get the multipacks to work properly.

 

[TrolleyDave]

Sorry I have not been around to comment on this, it looks like you got on pretty good with it.
I am going to sleep for a couple of hours and then I will test it.
I did a little bit of work on what actually happens to the rom (asm level) too on the simple stuff (so not Dragon Ball titles with EEPROM check and other fun things like that) so I might be able to figure out how to get the multipacks to work properly.

Cheers mate! My part was pretty easy, it was just hunting down changed byte patterns (apart from eeprom_v111). There's no way I'm good enough to do the asm level stuff with internal checks though so your help would be greatly appreciated.

 

[Destructobot]

I think I've managed to manually SRAM patch Dr. Mario & Puzzle League. I haven't done enough testing to be sure saving works properly for both games, but Dr. Mario is retaining the settings in the options menu, and GBATA reports that the game is SRAM patched and refuses to patch it again.

I compared the unpatched & GBATA patched versions of two other games that use the same save type. There are two different chunks of data that were replaced in each of those games. The Dr. Mario & Puzzle League rom had the same two chunks of data, but each one appears three times in the file. I replaced all six chunks with the ones I got from the other patched roms, and that seems to have worked.

I'll have to do more testing to be sure it works as expected, but it looks like you can use the same routines to patch the "2 games in 1" roms that you use for normal games, you just have to replace every instance of each chunk instead of just one.


Edit: I just tried patching Dr. Mario & Puzzle League three times in a row with GBATA, and it produced exactly the same file I did.

Edit #2: Both games in the rom are saving correctly. I'll try this same method on other multipacks to see if it works for every save type, as well as the 3 in 1 multipacks.

Edit #3: I did some more testing, and patching the rom multiple times in GBATA works for some save types, but not others. I was going to look into further and see if I could patch the other multipacks, but then I realized that I don't care, and nobody else does either. We already know how to patch Dr. Mario & Puzzle League, and the rest of the games are shovelware that had seperate releases anyway.

 

[TrolleyDave]

You didn't happen to jot down the release numbers of the ones that worked with multiple patches by any chance did you? I was thinking I could grab the header info and put it in my app. That way I can check if it's one of those games and use a routine to multiple patch it automatically. As for the others, if it's like FAST says and it's an actual copy protection then I won't be able to solve it, but I have an idea that the others might need forced patching for a few different types

My thinking is that one of the games might have been Eeprom_V120 in it's original form, the other say Eeprom_V121 and then the multi-loader uses Eeprom_V126 and does some clever redirection when the multi-cart version tries to save. I haven't had a chance to test the theory out yet but hopefully will in the next couple of days.

On another note my patching routines seem to work fine, I've been testing it out on alooot of games today and they all seemed to work ok. Most of them were tested up to the first save point, then a reboot and reload. When I started each game it loaded the save game just fine. There's probably a few that I didn't try that don't patch properly but it should be easy enough to fix any problems that anyone comes across.

I'd say the info was safe to use in any management/patching apps that anyone is writing.

 

[Destructobot]

2014 - 2 in 1 - hermano oso and disney princesas (S) --- EEPROM_V122 - can be patched normally; not tested
2099 - 2 in 1 - Spider-Man & Spider-Man 2 (E) --- EEPROM_V125 - patches after two tries; not tested
2261 - 2 in 1 - Dr. Mario and Puzzle League (U) --- EEPROM_V124 - patches after three tries; works
2421 - 2 in 1 - Crash Bandicoot Purple & Spyro Orange --- EEPROM_V126 - patches after two tries; not tested
2472 - 2 in 1 - Dragon Ball Z - Buu's Fury & Dragon Ball GT --- EEPROM_V124 - patches after two tries; not tested

As you can see, I didn't bother testing them to see if they work, I just checked in GBATA to see if it thought the game was patched.

Unless there is an excessive performance hit, I think it would be better to just find and replace every instance of each block of EEPROM code in every rom (or every rom that uses those save types), rather than only doing it to specific games. That would make the patcher automatically work for every rom that can be patched this way, and eliminate the need to add support for individual games.


Edit: While I was doing this, I made a big list of multipacks that use EEPROM or Flash saves, sorted by save type. Here it is if you want it:
EEPROM_V122 (4Kbit)

2009 2 in 1 - Barenbruder & Disney Prinzessinen Germany Independent
2012 2 in 1 - Hermano Oso & Disney Princesas Spain Independent
2644 2 in 1 - Madagascar & Shrek 2 USA Independent
2703 2 in 1 - Koda Fratello Orso & Disney Principesse Italy Independent
2780 2 in 1 - Brother Bear & Disney Princess Europe Independent
2784 2 in 1 - Crash & Spyro Super Pack USA Sir VG

2434 3 in 1 - Rugrats, SpongeBob, Tak


EEPROM_V122 (64Kbit)

2053 2 in 1 - Spyro - Season of Ice & Crash Bandicoot 2 - N-Tranced Europe Rising Sun
2054 2 in 1 - Spyro 2 - Season of Flame & Crash Nitro Kart Europe Rising Sun
2196 2 in 1 - Crash Bandicoot 2 - N-Tranced & Crash Nitro Kart USA Trashman


EEPROM_V124

2570 2 in 1 - Scooby-Doo & Scooby-Doo 2 Monsters Unleashed USA Sir VG
2571 2 in 1 - SpongeBob Squarepants Battle for Bikini Bottom & Nicktoons Freeze Frame Frenzy USA Sir VG
2572 2 in 1 - Ms. Pac-Man - Maze Madness & Pac-Man World USA Sir VG
2573 2 in 1 - Madagascar Operation Penguin & Shrek 2 USA Sir VG
2574 2 in 1 - Looney Tunes Double Pack USA Sir VG
2575 2 in 1 - Cabela's Sportsman's Pack


EEPROM_V124 (4Kbit)

2030 2 in 1 - Asterix and Obelix Europe Rising Sun
2042 2 in 1 - El Rey Leon Y Disney Princesas Spain Independent
2087 2 in 1 - Insect Monster & Suchai Labyrinth Japan Independent
2088 2 in 1 - Kisekae Wanko Ex & Puzzle Rainbow Magic 2 Japan Independent
2104 2 in 1 - Spider-Man - Mysterio's Menace & X2 - Wolverine's Revenge USA Independent
2133 2 in 1 - Scooby Doo & Scooby Doo 2 - Desatado Spain Independent
2197 2 in 1 - Hugo Bukkazoom & Hugo & The Evil Mirror Europe Rising Sun
2230 2 in 1 - Peter Pan Return to Neverland & Lilo and Stitch 2 Europe sUppLeX
2261 2 in 1 - Dr. Mario and Puzzle League USA Independent
2303 2 in 1 - Looney Tunes Double Pack - Acme Antics & Dizzy Driving Europe Rising Sun
2388 2 in 1 - Prince of Persia - The Sands of Time & Tomb Raider - The Prophecy Europe Independent
2391 2 in 1 - Ms. Pac-Man - Maze Madness & Pac-Man World Europe Independent
2480 2 in 1 - Disney Principesse & Il Re Leone Italy Independent
2503 2 in 1 - Frere des Ours & Disney Princesse France Independent
2532 2 in 1 - Shark Tale & Shrek 2 USA Sir VG
2623 2 in 1 - Winnie the Pooh's Rumbly Tumbly Adventure & Rayman 3 Europe Independent
2624 2 in 1 - The SpongeBob SquarePants Movie & Freeze Frame Frenzy Europe Sir VG
2695 2 in 1 - Madagascar & Shrek 2 Europe Independent
2698 2 in 1 - Scooby Doo le Film & Scooby Doo 2 Monstres se Dechainment France Independent
2716 2 in 1 - Scooby-Doo & Scooby-Doo 2 Europe Independent
2717 2 in 1 - Shrek 2 & Madagascar Operation Penguin Europe Independent
2745 2 in 1 - Disney Princess & The Lion King Europe Sir VG


EEPROM_V124 (64Kbit)

2041 2 in 1 - V-Rally 3 & Stuntman Europe Rising Sun
2288 2 in 1 - Dragon Ball Z - The Legacy of Goku I & II USA Rising Sun
2342 2 in 1 - Teenage Mutant Ninja Turtles Double Pack Europe sUppLeX
2394 2 in 1 - Spyro - Season of Ice & Spyro - Season of Flame USA Independent
2472 2 in 1 - Dragon Ball Z - Buu's Fury & Dragon Ball GT - Transformation USA Independent
2763 2 In 1 - Pferd And Pony (Mein Pferdehof) & Lass Uns Reiten 2 Germany sUppLeX


EEPROM_V125 (4Kbit)

2099 2 in 1 - Spider-Man & Spider-Man 2 Europe Rising Sun
2552 2 in 1 - Spider-Man & Spider-Man 2 USA Sir VG


EEPROM_V126 (4Kbit)

2421 2 in 1 - Crash Bandicoot Purple - Ripto's Rampage & Spyro Orange - The Cortex Conspiracy USA Independent


EEPROM_V126 (64Kbit)

2186 2 in 1 - Spyro - Fusion & Crash Bandicoot - Fusion Europe Rising Sun


FLASH1M_V102 (1024Kbit)

1802 Gameboy Wars Advance 1+2 Japan Caravan


FLASH512_V133 (512Kbit)

2218 2 in 1 - Sonic Advance & Sonic Pinball Party Europe Rising Sun
2225 2 in 1 - Columns & Chu Chu Rocket Europe Rising Sun
2227 2 in 1 - Sonic Pinball Party & Sonic Battle Europe Rising Sun
2228 2 in 1 - Sonic Advance & Sonic Battle Europe Rising Sun
2295 2 in 1 - Sonic Advance & Sonic Pinball Party USA Trashman
2400 2 in 1 - Sonic Pinball Party & Sonic Battle Japan sUppLeX
2401 2 in 1 - Sonic Advance & Sonic Battle Japan sUppLeX
2456 2 in 1 - Sonic Advance & Chuuchu Rocket Japan WRG
2671 2 in 1 - Sonic Advance & Chu Chu Rocket Europe Independent
2750 2 in 1 - Sonic Battle & ChuChu Rocket! Europe Independent
2752 2 in 1 - Sonic Pinball Party & Columns Crown Europe Independent

 

[TrolleyDave]

2014 - 2 in 1 - hermano oso and disney princesas (S) --- EEPROM_V122 - can be patched normally; not tested
2099 - 2 in 1 - Spider-Man & Spider-Man 2 (E) --- EEPROM_V125 - patches after two tries; not tested
2261 - 2 in 1 - Dr. Mario and Puzzle League (U) --- EEPROM_V124 - patches after three tries; works
2421 - 2 in 1 - Crash Bandicoot Purple & Spyro Orange --- EEPROM_V126 - patches after two tries; not tested
2472 - 2 in 1 - Dragon Ball Z - Buu's Fury & Dragon Ball GT --- EEPROM_V124 - patches after two tries; not tested

As you can see, I didn't bother testing them to see if they work, I just checked in GBATA to see if it thought the game was patched.

Unless there is an excessive performance hit, I think it would be better to just find and replace every instance of each block of EEPROM code in every rom (or every rom that uses those save types), rather than only doing it to specific games. That would make the patcher automatically work for every rom that can be patched this way, and eliminate the need to add support for individual games.


Edit: While I was doing this, I made a big list of multipacks that use EEPROM or Flash saves, sorted by save type. Here it is if you want it:
EEPROM_V122 (4Kbit)

2009 2 in 1 - Barenbruder & Disney Prinzessinen Germany Independent
2012 2 in 1 - Hermano Oso & Disney Princesas Spain Independent
2644 2 in 1 - Madagascar & Shrek 2 USA Independent
2703 2 in 1 - Koda Fratello Orso & Disney Principesse Italy Independent
2780 2 in 1 - Brother Bear & Disney Princess Europe Independent
2784 2 in 1 - Crash & Spyro Super Pack USA Sir VG

2434Â Â 3 in 1 - Rugrats, SpongeBob, Tak


EEPROM_V122 (64Kbit)

2053 2 in 1 - Spyro - Season of Ice & Crash Bandicoot 2 - N-Tranced Europe Rising Sun
2054 2 in 1 - Spyro 2 - Season of Flame & Crash Nitro Kart Europe Rising Sun
2196 2 in 1 - Crash Bandicoot 2 - N-Tranced & Crash Nitro Kart USA Trashman


EEPROM_V124

2570 2 in 1 - Scooby-Doo & Scooby-Doo 2 Monsters Unleashed USA Sir VG
2571 2 in 1 - SpongeBob Squarepants Battle for Bikini Bottom & Nicktoons Freeze Frame Frenzy USA Sir VG
2572 2 in 1 - Ms. Pac-Man - Maze Madness & Pac-Man World USA Sir VG
2573 2 in 1 - Madagascar Operation Penguin & Shrek 2 USA Sir VG
2574 2 in 1 - Looney Tunes Double Pack USA Sir VG
2575 2 in 1 - Cabela's Sportsman's Pack


EEPROM_V124 (4Kbit)

2030 2 in 1 - Asterix and Obelix Europe Rising Sun
2042 2 in 1 - El Rey Leon Y Disney Princesas Spain Independent
2087 2 in 1 - Insect Monster & Suchai Labyrinth Japan Independent
2088 2 in 1 - Kisekae Wanko Ex & Puzzle Rainbow Magic 2 Japan Independent
2104 2 in 1 - Spider-Man - Mysterio's Menace & X2 - Wolverine's Revenge USA Independent
2133 2 in 1 - Scooby Doo & Scooby Doo 2 - Desatado Spain Independent
2197 2 in 1 - Hugo Bukkazoom & Hugo & The Evil Mirror Europe Rising Sun
2230 2 in 1 - Peter Pan Return to Neverland & Lilo and Stitch 2 Europe sUppLeX
2261 2 in 1 - Dr. Mario and Puzzle League USA Independent
2303 2 in 1 - Looney Tunes Double Pack - Acme Antics & Dizzy Driving Europe Rising Sun
2388 2 in 1 - Prince of Persia - The Sands of Time & Tomb Raider - The Prophecy Europe Independent
2391 2 in 1 - Ms. Pac-Man - Maze Madness & Pac-Man World Europe Independent
2480 2 in 1 - Disney Principesse & Il Re Leone Italy Independent
2503 2 in 1 - Frere des Ours & Disney Princesse France Independent
2532 2 in 1 - Shark Tale & Shrek 2 USA Sir VG
2623 2 in 1 - Winnie the Pooh's Rumbly Tumbly Adventure & Rayman 3 Europe Independent
2624 2 in 1 - The SpongeBob SquarePants Movie & Freeze Frame Frenzy Europe Sir VG
2695 2 in 1 - Madagascar & Shrek 2 Europe Independent
2698 2 in 1 - Scooby Doo le Film & Scooby Doo 2 Monstres se Dechainment France Independent
2716 2 in 1 - Scooby-Doo & Scooby-Doo 2 Europe Independent
2717 2 in 1 - Shrek 2 & Madagascar Operation Penguin Europe Independent
2745 2 in 1 - Disney Princess & The Lion King Europe Sir VG


EEPROM_V124 (64Kbit)

2041 2 in 1 - V-Rally 3 & Stuntman Europe Rising Sun
2288 2 in 1 - Dragon Ball Z - The Legacy of Goku I & II USA Rising Sun
2342 2 in 1 - Teenage Mutant Ninja Turtles Double Pack Europe sUppLeX
2394 2 in 1 - Spyro - Season of Ice & Spyro - Season of Flame USA Independent
2472 2 in 1 - Dragon Ball Z - Buu's Fury & Dragon Ball GT - Transformation USA Independent
2763 2 In 1 - Pferd And Pony (Mein Pferdehof) & Lass Uns Reiten 2 Germany sUppLeX


EEPROM_V125 (4Kbit)

2099 2 in 1 - Spider-Man & Spider-Man 2 Europe Rising Sun
2552 2 in 1 - Spider-Man & Spider-Man 2 USA Sir VG


EEPROM_V126 (4Kbit)

2421 2 in 1 - Crash Bandicoot Purple - Ripto's Rampage & Spyro Orange - The Cortex Conspiracy USA Independent


EEPROM_V126 (64Kbit)

2186 2 in 1 - Spyro - Fusion & Crash Bandicoot - Fusion Europe Rising Sun


FLASH1M_V102 (1024Kbit)

1802 Gameboy Wars Advance 1+2 Japan Caravan


FLASH512_V133 (512Kbit)

2218 2 in 1 - Sonic Advance & Sonic Pinball Party Europe Rising Sun
2225 2 in 1 - Columns & Chu Chu Rocket Europe Rising Sun
2227 2 in 1 - Sonic Pinball Party & Sonic Battle Europe Rising Sun
2228 2 in 1 - Sonic Advance & Sonic Battle Europe Rising Sun
2295 2 in 1 - Sonic Advance & Sonic Pinball Party USA Trashman
2400 2 in 1 - Sonic Pinball Party & Sonic Battle Japan sUppLeX
2401 2 in 1 - Sonic Advance & Sonic Battle Japan sUppLeX
2456 2 in 1 - Sonic Advance & Chuuchu Rocket Japan WRG
2671 2 in 1 - Sonic Advance & Chu Chu Rocket Europe Independent
2750 2 in 1 - Sonic Battle & ChuChu Rocket! Europe Independent
2752 2 in 1 - Sonic Pinball Party & Columns Crown Europe Independent

Thanks mate, that helped loads. I've added multi-pass patching into the app I released, I didn't test all the games but the ones I did seemed to play and save ok, I'll test them all eventually.

On another note, I came across a couple of games of the save type Flash_V124 that had a couple of variations in the byte structures so I've altered the patch data in my main post accordingly.

 

[BrianTokyo]

Thank you very much for all this useful data I'm finally implementing this into my trimmer, but I have a doubt:

Patch block 1
The unpatched search block 1 is standard between all roms so the same kind of search routines you used for all the others will do. Before patching the data though you need to fill in bytes 5,6 and 7 of the patch block. This data needs to be the first 3 bytes of the 32 bit number that you stored the EOF position in. The number that you should be patching in is the EOF marker position you stored earlier plus 1. So if the patch starts at file position 3000000 you need to apply the number 300001.

I'm confused there:
QUOTEThe number that you should be patching in is the EOF marker position you stored earlier plus 1. So if the patch starts at file position 3000000 you need to apply the number 300001

You say the number must be the EOF+1 (I guess you mean the first free byte after the rom data, after it's aligned to 16 bytes), but then you say if the block1 patch starts at 300.000, the number should be 300.001, but shouldn't it be the EOF like you previously said?

 

[TrolleyDave]

Thank you very much for all this useful data

I'm finally implementing this into my trimmer, but I have a doubt:

Patch block 1
The unpatched search block 1 is standard between all roms so the same kind of search routines you used for all the others will do. Before patching the data though you need to fill in bytes 5,6 and 7 of the patch block. This data needs to be the first 3 bytes of the 32 bit number that you stored the EOF position in. The number that you should be patching in is the EOF marker position you stored earlier plus 1. So if the patch starts at file position 3000000 you need to apply the number 300001.

I'm confused there:
QUOTEThe number that you should be patching in is the EOF marker position you stored earlier plus 1. So if the patch starts at file position 3000000 you need to apply the number 300001

You say the number must be the EOF+1 (I guess you mean the first free byte after the rom data, after it's aligned to 16 bytes), but then you say if the block1 patch starts at 300.000, the number should be 300.001, but shouldn't it be the EOF like you previously said?

You don't have to align the file until after the patch is applied, although I suppose you could create the free space and then patch it in. I do everything in a large buffer in memory to make it faster and easier but there's probably a much better way of doing it.

The PatchStart+1 byte (which is actually EOF+2 bytes) thing had me confused as well. I don't know enough about the internals of how the patching works on GBA to know why it works like that. I could be completely wrong and looked at it totally the wrong way, but using that method seems to work fine. The really annoying thing is it's only someting like 5-10 games that use that save type!

EDIT: Also there seems to be a problem patching Wolfenstein 3D. I'll fix it later and update the codes in the thread.

 

[BrianTokyo]

I'm still not sure what you meant there

Unpatched block 1 (8 Bytes)
($0e,$48,$39,$68,$01,$60,$0e,$48)
Patch with
($00,$48,$00,$47,$XX,$XX,$XX,$08)

Those 3 XX, what address needs to be there, the offset where block1 starts, or eof+1?

Also, the 16 bit align, do you treat the eof as the real eof after rom data, or eof aligned to 16 bytes?

Thanks!

 

[TrolleyDave]

I'm still not sure what you meant there

Unpatched block 1 (8 Bytes)
($0e,$48,$39,$68,$01,$60,$0e,$48)
Patch with
($00,$48,$00,$47,$XX,$XX,$XX,$08)

Those 3 XX, what address needs to be there, the offset where block1 starts, or eof+1?

Also, the 16 bit align, do you treat the eof as the real eof after rom data, or eof aligned to 16 bytes?

Thanks!

The 3 XXs are the address for the offset where block 2 starts + 1. I always append block 2 directly after the last byte of data in the rom, which is what I treat as the EOF, so for me the 3 XXs contained EOF + 2 (Block 2 starts at EOF + 1 so the XXs are EOF + 2).

I treat the last byte of actual data in the rom as the EOF, so after patching block 2 to the rom the end of the patch becomes the physical end of the file. Then I just padded if with $FF until it became divisible by 16.

Does this make more sense? My technical knowledge ain't the greatest so it's a little hard to put across what I mean well!

 

[BrianTokyo]

Ok that was helpful, I'm releasing the new trimmer now, although it's all theorical since I have no 3-in-1 thingie to test, we'll see!

Thanks!

 

[TrolleyDave]

Ok that was helpful, I'm releasing the new trimmer now, although it's all theorical since I have no 3-in-1 thingie to test, we'll see!

Thanks!

Not a problem mate.

 

[BrianTokyo]

http://gbatemp.net/index.php?showtopic=551...p;#entry1035071