I'm scratching my head a little in my attempt of making VS Duck Hunt usable on a standard NES. As soon as I change mapper number, the introscreen music freezes. The "aim and fire to start game" (efter coin inserted) gets a white background aswell.
I'm pretty sure this has something to do with the VS-"features" of $4016/$4017 but has a difficult time finding out what's causing this behaviour
Anyone got any ideas/experiences with this title?
what mapper are you changing it to? and what are you specifying for the PRG and CHR sizes?
this might have to do with some bankswitching, since VS Duckhunt has 16kb of CHR (changed on the VS by writing to $4016)
Also, keep in mind that $4016 is player 2 on the VS, and $4017 is player one. You may also have to invert the hit detection bit.
The Vs. System uses a special type of zapper which does not follow the normal protocol - rather than reading $4016/$4017 once and getting "sense" on D3 and "trigger" on D4, it strobes the light gun and reads 8 bits back, where the 7th bit is "sense" and the 8th bit is "trigger".
I'm changing it to mapper 1. I've patched the CHR-swapping so that's not the problem..
I'm pretty confident there's something about the $4016 that's causing the issues. I've debugged a bit of $4016-related code with FCEUX and detected that codepaths are not always
the same running the game as mapper 99 or mapper 1.
I've located some odd-looking code at $84D5 (see below). Check that "LDA $4016,Y" code. I can't see it's doing anything with the result at all. However if I instead patches this to a LDA #0 in the original mapper 99 ROM, I get the same freezing-issues as my mapper 1 version.
EDIT: Btw, thanks for the info about this special-Zapper, didn't knew that. I haven't seen this documented anywhere...(?)
Code:
0:84D5:A2 00 LDX #$00
00:84D7:AD 62 06 LDA $0662 = #$04
00:84DA:09 01 ORA #$01
00:84DC:8D 16 40 STA $4016 = #$FF
00:84DF:29 FE AND #$FE
00:84E1:8D 16 40 STA $4016 = #$FF
00:84E4:8D 62 06 STA $0662 = #$04
00:84E7:20 EB 84 JSR $84EB
00:84EA:E8 INX
00:84EB:A0 08 LDY #$08
00:84ED:48 PHA
>00:84EE:BD 16 40 LDA $4016,X @ $4016 = #$FF
00:84F1:4A LSR
00:84F2:68 PLA
00:84F3:2A ROL
00:84F4:88 DEY
00:84F5:D0 F6 BNE $84ED
00:84F7:DD 40 04 CMP $0440,X @ $0440 = #$00
00:84FA:D0 0F BNE $850B
00:84FC:FE 42 04 INC $0442,X @ $0442 = #$02
00:84FF:BC 42 04 LDY $0442,X @ $0442 = #$02
00:8502:C0 05 CPY #$05
00:8504:90 0D BCC $8513
00:8506:95 16 STA $16,X @ $0016 = #$00
00:8508:4C 0E 85 JMP $850E
00:850B:9D 40 04 STA $0440,X @ $0440 = #$00
00:850E:A9 00 LDA #$00
00:8510:9D 42 04 STA $0442,X @ $0442 = #$02
00:8513:60 RTS
I've patched pretty much everything now that relates to the VS Zapper and the game actually detects the trigger now (in FCEUX anyway..). However it doesn't registers any hit, not sure why's that so.. The player select screen comes with a constant white background, I am not sure why..
The "light sense" bit in the standard Zapper is inverted (0 = sensing light, 1 = not sensing light), while the equivalent bit in the Vs. Zapper is not inverted (1 = sensing light, 0 = not sensing light).
I'd like to write some tests for the Vs. Zapper, such as a modified zapkernel for Zap Ruder. But I don't own a Vs. Duck Hunt cabinet myself. Is there anyone willing to run some test ROMs for me?
I suspect the 5th bit, that's "1" in the $4016-stream, is somekind of "is connected" flag...
Oh I really hope you get this working and are willing to share. I got a 20 year
old itch to shoot that damn dog that needs to be scratched!
If I ever get it running, of course I'll share an .ips.
I think I've hacked this game into pieces now, can't still get pass the player select screen.
I've tried "hijacked" all $4016/$4017 reads on the original ROM to see if I can reproduce the behaviour, without any luck.
I get the feeling there's some weird stuff about the sense-bit since the player-select screen looks like I've pressed the trigger, all the time (light background).
Is the sense-bit updating itself "all the time" or only when trigger is pressed?
Why not put it on VS type, but dump 16 or so 4016/17 reads to RAM and see what causes them to go 1 to see from there? Or you can look at the emus source?
oRBIT2002 wrote:
I suspect the 5th bit, that's "1" in the $4016-stream, is somekind of "is connected" flag...
Yeah, it's used for an audible alarm in case someone tries to steal the gun (or otherwise disconnect it).
Anyone with some good 6502-asm skills/NES-hardware skills and interested in some DuckHunt(VS)-hacking? I'm beginning to give up here now and would really like to get some help. Interested? Send me a pm.
I finally did it! EDIT: Here it is:
http://nes.goondocks.seMy most complex patch yet, phew! Here are the features of this one:
* Patched to use mapper 1 instead of odd mapper 99.
* VS-Zapper emulation
* VS-Zapper theft-detection-alarm cracked.
* Coin-insert emulation by pressing "Start" on gamepad in port 1.
Love shooting that dog on my nes. Great job!
Why MMC1 (mapper 1) instead of CNROM (mapper 3)?
Saving high scores I believe.
Nice work, Orbit
Might prioritize acquiring a zapper just so I can give this a go!
It would be nice to have a nice little menu to change the dip switches settings like that hack :
http://www.romhacking.net/hacks/1014/
Awesome work! Thanks for your hard work! VS Duck Hunt was one of the most wanted game to be made compatible for the NES. Do you have any other patched planned?
Thanks guys for all kind words.
Highscores are not saved at the moment, perhaps I'll check that out.
I've got no other patches in progress at the moment, "VS Duck Hunt" took maaany hours to complete so I think I'll take it a bit slow at the moment anyway.
EDIT: Uploaded a new version of the patch to my website which adds highscore-saving.
tepples wrote:
I'd like to write some tests for the Vs. Zapper, such as a modified zapkernel for Zap Ruder. But I don't own a Vs. Duck Hunt cabinet myself. Is there anyone willing to run some test ROMs for me?
I would be glad to run any test roms on a VS Dualsystem for you. I dont have the actual VS zapper but i do have a NES zapper modified to work on it.
Just fixed a compability issue with the EverdriveN8 flashcart (implementation of MMC1 seems to differ from PowerPak). v1.2 of the DuckHunt(VS) patch uploaded to my website..
That's good news. But the link to v 1.2 appear to be broken at the moment.
That was fast, thanks
Again, great job with all your patch, I know they are greatly appreciated over at the Everdrive N8 forum and I really hope you'll do more of them in the future. But I'm glad because Duck Hunt VS was definitly one of the most wanted and now we have it!
Btw, found your anti-repro message in some of your patch, made me laugh
Incase no ones told you today... you're awesome!
Page bookmarked!
Looking foward to checking out.
I have another update coming soon, stay tuned..
This was fun.
oRBIT2002 wrote:
I finally did it! EDIT: Here it is:
http://www.goondocks.se/nespatches/My most complex patch yet, phew! Here are the features of this one:
* Patched to use mapper 1 instead of odd mapper 99.
* VS-Zapper emulation
* VS-Zapper theft-detection-alarm cracked.
* Coin-insert emulation by pressing "Start" on gamepad in port 1.
thank you sir!
I've updated the patch with a slight modification. You can leave the gamepad connected to port 1 (for coin-inserts), zapper now uses port 2 instead. Didn't know why I didn't do this from the beginning, but anyway, better late than never.
Much more convenient with the new control mapping! Thanks again.
I've learned that the VS-Duck Hunt game only uses one Zapper even if there's two players. My question is, is port 2 used on the arcade for anything usefull? I've found code-references to port 2 (not dip-switch related) so I'm curious what this might be..
Where in? The only things I can find are the reading and deserialization routines at $84D5-$84F5 (which always reads from $4017) and $A93E-A956 (which reads from $4016 or $4017 per the value in zeropage$b6, but discards the value returned). Everything else is congruous with the wiki:
http://wiki.nesdev.com/w/index.php/Vs._System.
Can you tell what kind of device it's trying to read in port 2?
I know that NES Duck Hunt uses the joypads to control the ducks (which is why the two ducks mode is called 2P... on the Famicom you can have both controllers and the gun together, and the two controllers can be used to control the ducks). Maybe something similar is going on here?
The code at $84D5 is reading both controllers but it's not discarding the values as it may first seem (if I am not mistaken). It's a pretty clever routine for reading the bits actually. Controllerdata for $4017 is stored at $441 and $443. Not sure what happens with that data however..
Updated my patch to v1.5 and it now includes a possibility to change dipswitch settings aswell.
Ok, I looked more closely:
The routine at $84D5-$84F5 deserializes $4016 and $4017 into $0440 and $0441, respectively. $0442 and $0443 contain the number of times that the joystick-reading routine has been called that the contents of $0440 or $0441 have been the same, respectively. Once the value in $0440 and $0441 has been the same 5 times in a row, it's copied to $16 and $17.
But the only place I can ever find any of these being used is for the alarm. (Then again, I can only get about 2/3 of the 32KiB PRG to show up in FCEUX's Code/Data Log viewer)
The routine at $A938-A956 specifically polls for the trigger of the lightgun, returning the eighth and final read from $4016 or $4017 (per $B6. But $B6 is always 0, so we only check the one gun attached to $4016). When entered at $A93C, it instead reads only 7 times, and so polls the "light sensed" output.
But you already know all this, since you made the patch
Has anyone put this on a donor MMC1 board with success?
I tried and got nothing but a blue screen and I read on another
forum that someone else tried and only was able to get as far
as the player select screen with garbled gfx. I know many
people have it running on SD card based multicarts but
I've not read anything about anyone getting it to work
with good ol' eproms and a MMC1 retail pcb donor. Any
info would be greatly appricated cause I have no idea
why it's not working as it should.
First one i did prior to battery buckup.
This one I did for 1.5 I think but ended up going back with non battery backup on it too. Never was able to get any with battery backup versions to work correctly. All would load and play but on high score screen there were no names just some sprite where they should be and all had a score of 606060 or something like that. Also the ducks and pigeons flight patterns always stayed the same and no dog jumping on bonus stage. Reported to oRBIT2002 and he looked into but never found anything that should lead to the problems I encountered so maybe something on my end.
proveaux wrote:
This one I did for 1.5 I think but ended up going back with non battery backup on it too. Never was able to get any with battery backup versions to work correctly. All would load and play but on high score screen there were no names just some sprite where they should be and all had a score of 606060 or something like that. Also the ducks and pigeons flight patterns always stayed the same and no dog jumping on bonus stage. Reported to oRBIT2002 and he looked into but never found anything that should lead to the problems I encountered so maybe something on my end.
It is funny you mentioned score of 606060 because a user named infidelity recently hacked Tetris to add a 2 players mode and high score saving with battery backup and had the exact same issue with the score all being displayed as 606060. Maybe oRBIT2002 should look how it was fixed since both hack added battery backup.
It occurs to me that $60 sounds like interpreting the open-bus value as BCD...
If I recall correctly, if the ducks fly the same path everytime, you've patched the wrong ROM.
Possibly true for others but according to WindHex the only difference between the one I had and the one you had was in the header and once it was patched with your 1.3 patch they were identical. Not sure what problem I have but don't think it's the rom. Still able to shoot that dog on earlier version so thankful for that.
Mine
4E 45 53 1A 02 02 38 61 00 00 00 00 00 00 00 00
Yours
4E 45 53 1A 02 02 31 61 00 00 00 00 00 00 00 00
Both after 1.3 Patch
4E 45 53 1A 02 02 13 00 00 00 00 00 00 00 00 00
I've now been able to reproduce this issue with my ROM. Seems to be SRAM related, I'll check it out.
EDIT: Identified problem. Will release updated version soon.
Played up to bonus stage. Ducks and pigeons all moved randomly as expected and dog was shootable on bonus stage.
Still had no names and 606000 on score screen. I have no battery on my test cart but wouldn't think that would matter until restarting NES?
Does the highscore looks like that when booting up the game for the first time?
Yes. This is how it looks if you hit select on dip switch screen and let it run through the demo and also after playing and losing.
Most certain SRAM issues, I'll see if I can figure that out..
had a bad dump of VS duck hunt. was sent a good working binary, I patched it and dropped it into a SEROM and I was shooting fried chickens in no time
Awesome to finally have this for the home console. Thanks so much!
proveaux wrote:
Yes. This is how it looks if you hit select on dip switch screen and let it run through the demo and also after playing and losing.
I've released an update to the patch. If you get a red flashing screen now for a few seconds when the game boots, your SRAM isn't working properly (or there's something wrong with my MMC-init code.)
Post it, I know MMC1 pretty well.
Go to the link in his sig for all his releases.
edit... oh you meant the code i bet.