I've encountered two games now that do this, but I thought it was impossible. The games are Dragonball Z 3 and Dragonball Z Gaiden. They use Mapper 16 and have 16 banks of PRG-ROM, but some data (title screen for one and some minor text for another) is stored in the area of the rom that *should* be CHR-ROM. FCEUXD won't allow me to set a breakpoint for this area either, either. Anyone care to explain HOW this works?
SMB does this as well
Anyway, $2007 is readable. When read it operates the same way as is written to... only the reads are buffered. Once you read, the value currently in the buffer gets returned, and the byte at the current PPU address goes in the buffer, then the PPU address is incremented normally.
Code:
LDA #$00
STA $2000 ; increment PPU address by 1
STA $2001 ; turn off rendering
STA $2006
STA $2006 ; set ppu address to start of CHR
LDA $2007 ; buffered read, this is garbage
LDA $2007 ; this will be the first byte of CHR (ppu $0000)
LDA $2007 ; this will be the second byte of CHR (ppu $0001)
edit:
also, I believe Final Fantasy 3 may use this method with CHR-RAM to read and modify CHR for some animation (look at its overworld water animation once). I did something like that when I added an overworld water animation hack to Final Fantasy 1 (read CHR-RAM, roll it, write it back)
If you can't use breakpoints, maybe you can find the code that loads the pointer to the CHR data (2 immediate loads and stores to $2006). Then you just need to know where in CHR the data begins.
FCEUXD should allow you to set breakpoints on PPU reads. At least the option is there... does it not work or something?
When adding a breakpoint, just select the "PPU mem" radio button and keep the address between $0000-$1FFF (PPU area where CHR is stored).
Or... you could just set a breakpoint on $2007 reads to accomplish the same thing if that doesn't work for some reason.
Wrong, Final Fantasy 3 doesn't read the CHRRAM, it has a RAM copy of the water tile, and it does rotate it right then write them to $2007 every frame. Final Fantasy 2, however, does pretty much the same but reads the CHRRAM rotate it left and write to it.
Inster brackpoint with FCEUXD is slightly easy, but if you check for a read that doesn't occur, it will of course not work.
Yeah I wasn't sure about FF3... my mistake.
That's exactly what it's doing. I didn't know you use CHR-ROM as extra PRG-ROM though, or that you could read $2007. Thanks a lot guys.
That's me above. Forgot to log-on.
Dragon Quest used a CNROM-like board, since it was developed when that was the only kind of bankswitched Famicom cartridge available; it has entire banks of its CHR ROM filled with data.
M.C. Kids stores levels in CHR ROM as well. So does Lemmings.
So can you only read CHR ROM during vblank?
Snake Rattle 'n Roll stores its MUSIC data in CHR ROM. Evidently, this made the NSF rip quite an interesting task.
And yes, CHR-ROM can only be read during VBLANK (or whenever you disable rendering, such as during level load transitions)
AWJ wrote:
Dragon Quest used a CNROM-like board, since it was developed when that was the only kind of bankswitched Famicom cartridge available; it has entire banks of its CHR ROM filled with data.
It has one bank for graphics, one half for the title screen, and the rest (20 Kbytes) is just data. When it was released, it was a hit technically but it had very bad graphics (except the monster design).