(10-29-2015, 01:41 AM)Flavor Wrote: Thanks, Loïc. I knew all the technical details from the flash chip hardware side of things, but it's very interesting to see how you searched the ROM and patched it.
Basicaly, I searched for (already found in Cotton and Melon Chan) :
LD (0x6F),0x4E
SWI 1
==> "08 6F 4E F9" in the rom.
From that point, I used neopop to trigger a break point at the supposed 'SWI 1' code location, or a break point at bios call (easiest method).
Run the game until I reach a meaningfull break point, then use disassembly function to retrieve the nearby code.
The writing function after the bios call gives the adress of the writen data (00 A0 0F 00).
I searched this string on the rom and set break point at nearby adresses. then run the emulator to find which break point is reached.
I had to use the Toshiba TLC900/H documentaion to understand the SCC instruction, or to help with some disassembly.
The rom structure wasn't intended for you !
