68000 Assembly Info

[Tony H]

The ol' VG School of Hacking board has been kinda quiet lately, so I thought I'd post some random 68000 instructions that you would see in an assembly trace log (i.e. Gens Tracer), and include a brief explanation of what it means.

I remember when I first starting using 68000 assembly traces, I really struggled with some of this. I understood the actual instruction, but had trouble with the other stuff, like: (A0)+,$0080(A3) or $02(A6,D0),A6. I'm hoping this post will help people who are just starting to use assembly traces.

I'm not an expert in 68000 assembly, so if you see a mistake in my explanations, feel free to correct it, or make any additional comments.

To keep these as short as possible, I'm only including the relevant registers.

Keep in mind that the parenthesis in my explanations are NOT part of any mathematical equation. I just use the parenthesis to make it easier to read.

========================

01:A01C 53 6A SUBQ.W #1,$0012(A2) A0=FFFF98F0 A1=FFFF98F0 A2=FFFF885C

This means subtract 1 from RAM address FFFF886E: (register A2 (FFFF885C) + $12 = FFFF886E)

========================

EDIT: 68000 assembly is used in the Sega Genesis.

[Helder]

It might be better to split the different instructions between the commas and then put things together,like using your example:

01:A01C 53 6A SUBQ.W #1,$0012(A2) A0=FFFF98F0 A1=FFFF98F0 A2=FFFF885C


subtract 1hex from , add 12hex to value of register A2 = 12+FFFF885C

|
V

subtract 1hex from , FFFF886E


I think it might be easier like this when starting out. I'm not super familiar with 68000 assembly myself but most op codes and instructions are very similar from other assembly languages. I tend to do it this way to understand what is going on, its also nice that 68000 reads from left to right,thumb/arm is the opposite.

[Tony H]

I guess I should include which values are registers in the explanation. I originally wrote these explanations as quick notes to myself.

00:3966 3D 81 MOVE.w D1,$0A(A6,D2) A0=000C9A8C A1=00FF0CB6 A2=00FF8AFC A3=000C9A80 A4=0000BB04 A5=00FF0006 A6=00FF0000 A7=00FFFFFA D0=00000290 D1=0000003F D2=0001021A

This means move the value from D1 ($003F) to RAM address FF0224: (register A6 + register D2 + $0A).

[Helder]

Great info Tony! I think what we need is a little guide of the most common instructions with a little info on their function. I believe this will be very useful for anyone just jumping in and need to understand what the instructions are making happen.

[Tony H]

Great info Tony! I think what we need is a little guide of the most common instructions with a little info on their function. I believe this will be very useful for anyone just jumping in and need to understand what the instructions are making happen.

Good idea helder. In my little collection of assembly notes that I've started posting here, I have: SUBQ.W, MOVE.w, SUB.L, ADDQ.W, CMPM.B, JMP, LEA, JSR, and MOVE.l. I guess I could add NOP, BRA, BEQ, BNE, RTS, etc.

To be honest with you, there are some that I don't really understand. For example:

00:13AC 4C DF MOVEM.L (A7)+,{a7-d0}[7f ff] A0=00FF9736 A1=00FF9736 A2=00C00000 A3=00FFF760 A4=00000000 A5=00000000 A6=00FFF780 A7=00FFFEBA D0=00000000 D1=9186B51D D2=00000000 D3=0080EA13 D4=0000E1C8 D5=00000001 D6=00000000 D7=00000000 xnZvc

or

00:141E 48 E7 MOVEM.L {d0-a7}[c0 c0],-(A7) A0=00FF850A A1=00C00000 A2=00FFF808 A3=00FFF760 A4=00000000 A5=00000000 A6=00FFF780 A7=00FFFEFC D0=000600D5 D1=000900A3 D2=00000000 D3=0080EA06 D4=0000E1C8 D5=00000001 D6=00000000 D7=0000FFFF xnZvc

I think those have something to do with putting text on the screen, or maybe graphics. Maybe someone can tell me how those work.

[Helder]

Maybe Pugsy or someone very familiar with it can explain better but looking at the Part that says {a7-d0} makes me think of the push and pop instructions of the arm/thumb assembly where it would push the values of the said registers to the stack then put new info in the registers {a7-d0} and after the routine was done it would pop the original values back to the registers and continue running the instructions. Basically it jumps to a sub routine fills the registers temporarily that are called up {a7-d0} and once its done it jumps back to the original routine and puts the register data back. I could be wrong in this but it makes sense if this is what it is.

[Tony H]

I suppose that's possible. A7 is the stack register, so that part fits.

More 68000 assembly...

00:3948 93 AE SUB.L D1,$0286(A6) A0=000C9A8C A1=00FF0CB6 A2=00FF8AFC A3=000C9A80 A4=0000BB04 A5=00FF0006 A6=00FF0000 A7=00FFFFFA D0=00000290 D1=00000017

Means to subtract the value in register D1 ($17) from RAM address FF0286: ($0286 + register A6 = FF0286).

[Tony H]

01:0230 52 6E ADDQ.W #1,$0000(A6) A0=00001441 A1=00FF1486 A2=00FF733C A3=00C00000 A4=00000000 A5=00C00004 A6=00FF0000

Means add 1 to address in register A6 (which is FF0000).

Some extra info on these types (5xxx) of ADD (and SUBTRACT) instructions...

The second digit in these types of instructions determine if it adds or subtracts, and by how much. Here's the format:

If the second digit is an even number, then it adds. If it's an odd number, it subtracts. If the example above, the instruction is 526E. The second digit is 2, so since it's an even number, we know it's going to add. Here's how we figure out how much it's going to add (or subtract)...

If the second digit is a 2, it will add 1. If the second digit is 4, it will add 2. If the second digit is 6, it will add 3, and so on.

If the second digit is 3, it will subtract 1. If the second digit is 5, it will subtract 2. If the second digit is 7, it will subtract 3, and so on. Just remember to use hex values.

The maximum value you can add or subtract with this type of instruction is 8. To add 8, the second digit is 0. To subtract 8, the second digit is 1.

For those of you that have used Game Genie codes for any of the Sonic the Hedgehog games, you may have noticed that the maximum number of rings you can get for each ring collected is 8. That's because it uses this type of "add" instruction.

EDIT: The very first instruction I posted above: 53 6A SUBQ.W #1,$0012(A2) is the same type of instruction. As you can see, the second digit is an odd number, so we know it subtracts. it's a 3, so using the guide above, we know it subtracts 1.

[Helder]

I use that guide that has all the 68000 instructions by Pugsy, to figure out what I can change it to if I don't know the instruction value and it has all variations of all the instructions. Definitely a necessity for any genesis hacker,its int the Library section http://gshi.org/?s=faqs#section21

[Tony H]

Yes, Pugsy's 68000 instruction list is very valuable. I use it all the time.

===============

01:205E B3 08 CMPM.B (A0)+,(A1)+ A0=0005FB32 A1=00FF03D0

Means compare value at ROM address 05FB32 to value at RAM address FF03D0 (registers A0 and A1), then add 1 (that's what the "+" is for) to each register (A0 and A1) so they would become 05FB33 and FF03D1.

If I remember correctly, this particular compare instruction was used in a game to compare a special secret password in the ROM/game, to the password you entered. So the secret password starts at ROM address $05FB32 (the address in register A0), and the letters you entered in the password screen are stored starting at RAM address FF03D0 (register A1). The program compares the first letter of the secret password to the first letter you entered. If they match, it goes to the next letter (because it added 1 to each of the registers/addresses), and so on.

[Helder]

Say Tony do you know if the genesis has some unused or useless parts of memory that might be written to and not affect the actual game? I know the GBA and NDS have such areas, I have used these areas to make custom routines. If the genesis had these it would be interesting to make use of these areas for some custom coding and better control of what we would want a code to do.

[Tony H]

I've never heard of any areas of RAM in the Genesis/MD that are specifically not used.

I wonder if there are any programs that monitor RAM and would tell you which RAM addresses were never accessed/used during the game? Of course you would have to play through the entire game to make sure you covered all the bases, but like you said, it would be very useful to know which areas of memory aren't being used. I would think it's somewhat common for games not to use every RAM address available.

[Helder]

Did a little searching and found this: http://cgfm2.emuviews.com/txt/gen-hw.txt We might be able to write to the Ram Range E00000,I will do some tests when time permits to see if its plausible/works. In case you're wondering what I use to hack/edit the assembly its the emulator Regen(get the newer version here http://aamirm.hacking-cult.org/www/regen.html) it has a great debug features although breakpoints leave something to be desired the rest make up for it.

[Tony H]

I've tried slightly older versions of Regen (095D) but had problems with the breakpoints. But like you said, some of the other stuff is pretty useful.

[Tony H]

This one is pretty straight forward...

00:2180 4E F9 JMP ($00012054)

Means jump to ROM address $00012054.