[Vague Rant]

The last few days I’ve been fooling around with the debug modes in a few Virtual Boy games.

The biggest discovery was that Vertical Force’s debug menu is fully accessible in the retail game without hacking. I was also able to make a tiny bit of progress getting SD Gundam’s debug menu up, and lastly I made a small custom patch to change how the Virtual Bowling debug menu is launched. I want to give Parasyte huge credit for the Vertical Force discovery and my little Bowling mod, as both relied heavily on that original hacking work done some 20 years ago.

Vertical Force
Notably, Parasyte predicted in the readme for the original debug mode hack that, given its high-quality presentation, the menu might be accessible in-game. Well, it’s nice to know that hunch was right, all these years later! To access the debug menu, open the Config menu then press the following sequence of buttons:

• Left D-Pad Left
• Left D-Pad Left
• Right D-Pad Right
• Right D-Pad Right
• Left D-Pad Up
• Right D-Pad Down
• Left D-Pad Up
• Right D-Pad Down
• L
• R
• Right D-Pad Right
• Right D-Pad Right
• Left D-Pad Left
• Left D-Pad Left
• Right D-Pad Up
• Left D-Pad Down
• Right D-Pad Up
• Left D-Pad Down
• R
• L

If you don’t want to remember all that, there’s obviously Parasyte’s existing hack here on virtual-boy.com, which forces the debug menu to load on startup. Alternatively, there’s now a patch on The Cutting Room Floor’s Vertical Force page which replaces this button sequence with a single press of Select on the Config screen.

SD Gundam: Dimension War
It’s been known that SD Gundam has some sort of stage select for a while now, but as far as I know nobody has managed to trigger it in-game. I wasn’t able to get the menu working, but I did manage to get it to at least load and display on-screen.

The function at 41EE8 in the ROM is responsible for the debug menu. I wasn’t able to find if there’s anywhere in code which jumps to this function, but I’m just goofing around in an emulator. Somebody more capable (and with access to a disassembler?) may very well be able to take this further and get the debug menu fully working.

That said, you can force the game to jump to this function to at least see the menu, albeit without it actually functioning. Editing offset 7FD0 in the ROM from 01 AC E4 FE (jal fff27eb4) to 03 AC 18 9F (jal fff41ee8) will replace the main menu screen with the “SELECT GAME MODE” menu. From here, you can’t really do anything. A/Start will boot the game, but it’s not otherwise possible to navigate the menu or do anything useful. I’ve attached a screenshot of this menu, since looking at a screenshot is about as good as doing it for real with this half-baked modification.

I haven’t bothered making an IPS patch for this change because it’s basically useless, but I think it’s very likely somebody knowledgeable could get it into a completely working state. Who knows, it could even be like Vertical Force where the debug mode is accessible without hacking but nobody’s figured out how to open it yet.

EDIT: I finally managed to figure out Bob Vanderclay’s V810 Disassembler and got SD Gundam disassembled. I can confirm that there are no jumps to the debug menu function anywhere in the game (unless they’re obfuscated, but I’ll get into why I think that’s unlikely). What there is, however, is a dummy function at 7B8C which immediately jmp [lp]s, i.e. calling the function simply returns. There are also 28 calls (!) of this function scattered throughout the game’s program, including in conspicuous places like the start of the main menu function. Every single one of them is additionally stepped over with a jr, so the dummy function itself is never actually called.

My supposition is that the central portion of the game’s debug code lived in this function, which was compiled out for retail. This function would have handled jumping off to the various debug functions based on what functionality was called for at any given point in execution. This means it’s substantially more difficult for debug to be re-enabled in the retail build, because whatever this function used to do is completely opaque to us from the perspective of the final build. Depending on how thoroughly the rest of the debug code was scrubbed, it could be theoretically possible to restore the functionality by reproducing this function blind, but that would be a huge undertaking and require somebody with much greater ability than I have. Sorry for the downer result!

Virtual Bowling
This one is probably the least interesting, but I made a small hack to adjust how the debug menu is launched in Virtual Bowling. Parasyte’s patch here on virtual-boy.com simply forces the debug menu to open on start-up. This sort of means you need to keep two separate Virtual Bowling ROMs around depending on whether you want debug today or not. My modified patch instead checks whether you’re holding the Select button on start-up. If you are, the debug menu is triggered, otherwise the game boots normally. You can download this modified patch from The Cutting Room Floor’s Virtual Bowling page.

• This topic was modified 1 month, 1 week ago by Vague Rant.

Attachments:

1. 

   sdebugam.png
   

Nice! Waiting for further patches and my T&E reprocard to arrive.
When things are settled I think I will order more reprocards with SRAM save feature.

One more question: can you check why the Red Alarm haptics patch and the save patch are incompatible? At least the game crashes before the intro when you apply both.

Forum seems to be having issues again. I posted this previously, trying one more time:

Huh, thanks for discovering that! I haven’t tested with the haptics patch at all, will look into what’s going on there before I get properly started looking at Bound High.

As discussed elsewhere, before I started actually doing anything to Bound High, I wanted to understand how the three different password systems all work. That led to this password generator spreadsheet, which can create passwords for all three game modes which use them (Adventure of Chalvo, Score Attack!! and Pocket and Cushion). I noticed a couple of mildly interesting things in the process of creating this password generator.

For one, in the Adventure of Chalvo mode, you can play through Expert mode with the Standard enemies or vice versa, as the difficulty level and enemy types are tracked separately in the password system. Even though the game will never give you the “mismatched” passwords, you can generate perfectly valid passwords that have the wrong enemy types for that difficulty.

For two, one of the Score Attack passwords that’s been all over the web for years (including here on vb.com) is technically incorrect. Bound High requires you to complete stages 1-16 to unlock stages 17-20. A common code found online, XPJCZ, has the game in an impossible state where stages 1-15 plus 17 and 19, which are not unlocked yet, have all been completed.

The passwords in Score Attack!! mode follow a pretty consistent pattern, so I strongly suspect what happened here is that somebody took the existing “All Stages Clear” password and then replaced characters one at a time until they got a password that seemed to work correctly, but which the game would never give you because the specific scenario is not possible.

Thirdly, I discovered that the game can actually give you an invalid password if you play the stages in an order that it doesn’t expect. If you play Score Attack!! mode and beat Stage 16 before you beat one/both of Stage 2 and Stage 8, the password it gives you is not possible to enter because it’s using a character from beyond the end of the password entry keyboard. It’s sort of like the game is giving you a password with a % sign in it, even though there’s no % sign on the keyboard. However, in the game, the invalid character gets replaced with a 0 (zero). Technically, you can enter this password (using the zero on the keyboard), but it doesn’t accurately track your progress because the zero you typed is not the same as the impossible one the game gave you.

Here’s a few passwords from the generator which I think are most likely to be useful or interesting to people:

Score Attack!!

• 8PJ3Q
  Stages 1-16 Clear (for real this time), allows access to stages 17-20
• 8P83Q
  Stages 2-16 Clear, complete Stage 1 to see the “All 16 Stages Clear” cutscene
• XD8HZ
  Stages 2-20 Clear, complete Stage 1 to see the “All 16 Stages Clear” cutscene followed by the “All 20 Stages Clear” cutscene; this one is impossible in normal gameplay but works fine

Pocket and Cushion

• 0QFJF
  Stages 2-16 Clear, complete Stage 1 to see the “All 16 Stages Clear” cutscene
• PJSJ0
  Stages 2-20 Clear, complete Stage 1 to see the “All 16 Stages Clear” cutscene followed by the “All 20 Stages Clear” cutscene; impossible normally

EDIT: Red Alarm looks like a simple fix. One of the problems when making a ROM hack which adds functionality instead of just changing it is finding somewhere unused inside the ROM to put all the new code. These empty spaces are sometimes referred to as “code caves”, since they’re essentially empty holes you can fill up with code. It turns out enthusi’s haptics patch and my save patch both used the same code cave, so whichever patch you applied last would overwrite the previous patch’s changes with disastrous results. I’m attaching a new build of my patch which moves the save functionality a bit “deeper into the cave” so it’s no longer overlapping with enthusi’s changes and both patches should be able to cohabit.

Attachments:

1. red-alarm_vb_save-support_v1.5_haptics-test.ips

As always, nice seeing how serious you dig into those games 🙂

I have tested the v1.5 Red Alarm patch with the haptics patch and it seems to work! The game does not crash anymore.
I have ordered a rumble pack from Retroonyx, but this will take some time until it arrives in Germany, so I can not say if the haptics really work. But I am confident that they will.

Nice, fingers crossed for the haptics patch. I’ll hold off making a new release on GitHub until it’s confirmed working on real hardware, but as you say I’m pretty sure it’ll be fine since the patches are no longer clashing with one another.

In the meantime, attached is an initial test build of Bound High. I’m not sure if this is done yet necessarily, but hopefully everything is functional.

List of changes:

• Most recent Adventure of Chalvo mode password is saved to SRAM; password is pre-entered on the Continue screen
  • Passwords are saved either when earned via gameplay or typed manually, these will replace each other
• Scores and progress are recorded to SRAM in Score Attack!! and Pocket and Cushion
  • Score Attack!!/Pocket and Cushion passwords removed entirely; the password entry screen is gone and the Stage Select screen no longer shows your current password
• SRAM can be erased with L + R + Left D-Pad Down + Right D-Pad Down on the title screen

As you can tell, I took different approaches for the Adventure mode and the score-chaser modes. I haven’t really decided that this is definitely the approach I want to take for the Adventure mode. It would be possible to remove passwords there too and I started doing that (tested disabling the intervals between stages where the game tells you your new password), but it would need more effort to really be satisfying. The difficulty selection would need to be expanded to support Expert (since that’s otherwise only available via password) and the password interval screens would be better if modified into some sort of “Game Saved!” screen instead of skipping them completely. For now, I think everything should work, but the question is open as far as whether Adventure mode should be handled differently.

Attachments:

1. bound-high_vb_save-support_v0.9-test.ips

[abarth]

I have tried the save patch for Bound High, but strangely the game does not start at all.
Just a black screen, no sound, no image, no nothing.
I used the Bound High vb-file from this forum.

• This reply was modified 6 days, 6 hours ago by abarth.

Huh, that’s no good. I mentioned the issue on the Discord and KR155E noted that there are a lot of Bound High ROMs floating around: there’s one dumped from a real proto cartridge–I think this is the one I’m building for, the filename I have is Bound High (Japan) (En) (Proto).vb

There’s several others compiled from the leaked source code, including the debug ROM by thunderstruck and a few other attempts at compiling the final game. I actually had no idea there were so many. Hopefully the issue is something as simple as this, but if not I’ll try to put together a few test builds tomorrow which just disable different parts of the hack. If you can test those, we may be able to at least narrow down where the problem is.

You mean I shall try your save patch with a Bound High (Japan) (En) (Proto).vb rom?

Yeah, it’s possible the issue is just one of ROM compatibility, depending on whether the ROM you have is the same one I worked on. If that’s the case, the existing patch would hopefully work on the Bound High (Japan) (En) (Proto).vb ROM. If that works, we’re fine and people who wish to use the patch will just need to have that ROM version specifically.

If we’re lucky, it’ll be the above issue (different ROMs), but if not I’ll have to look into what’s causing the problem. In that case, I must have broken something in the patch, so I’m attaching three builds which remove successively more of the patch to this post. These will be completely broken in terms of the game being able to save because I’m just taking parts out of it, but the goal is just to get the game to boot up for now.

Attachments:

1. bound-high_vb_save-support_v0.9-boot-test-1.ips
2. bound-high_vb_save-support_v0.9-boot-test-2.ips
3. bound-high_vb_save-support_v0.9-boot-test-3.ips

The game starts when having applied the patch bound-high_vb_save-support_v0.9-test.ips to Bound High (Japan) (En) (Proto).vb.
Results:
score attack: score and progress is saved
pocket & cushion: progress is saved, but no score
adventure mode: password is prewritten in the continue screen

I have attached a clean save after sram deletion with the combination and a normal save.

Attachments:

1. bound-high-save-tests.rar

Ooh, fantastic eye! I’ve been messing with it for days and never noticed the Pocket scores not working. I was actually saving them to SRAM correctly but reading them back into RAM wrong, so the score is there in your save file, but doesn’t show up in the score list. That was super useful to know, great work as always! Seeing the score working in SRAM allowed me to identify the problem immediately and get it fixed pretty quick.

This whole situation with Bound High!’s multiple builds/dumps is pretty interesting to me. I looked into it after my last post and Bound High (Japan) (En) (Proto).vb is actually the build from the leaked source code, not a dump off a prototype board as I was assuming before. I think the actual prototype board dump was the ROM you were using before, which my patch was incompatible with?

As mentioned in that thread, the builds are slightly different throughout–just enough to frustrate easy comparison–but I was surprised to discover that there are at least some minor noticeable differences, with the vowels replaced with cute little animal graphics on the password screen. If I had to guess, I’d say the animal version off the prototype board is probably more recent, because I can’t imagine why you’d do that then switch to letters later.

Anyway, all this to say that I decided to port my patch over to the prototype board dump as well, so it now builds for both the Kintaro compile (Bound High (Japan) (En) (Proto).vb) and the Cpt. F. prototype (BoundHigh-cleanFullGame2018.vb). Personally, I think I’ll be using the Cpt. F. version going forward, because I like the animals on the password screen and if my speculation that it’s newer than the Kintaro build is accurate, there could potentially be other improvements. But now that I can build for both, people can go with whichever one they prefer.

I’ve attached two test builds, one for the “build” (Kintaro) and one for the “board” (Cpt. F.). Both should behave identically in terms of saving, but obviously the Kintaro version has had a couple of days’ testing while the Cpt. F. version is brand new (finished about 15 minutes ago), so I’m sorry if I broke anything in the porting process! Obviously I’ll give it some further testing on my end as well since it’s the one I plan to play going forward.

Attachments:

1. 

   vowels.png
   

2. 

   fauna.png
   

1. bound-high_build_vb_save-support_v0.9-test-2.ips
2. bound-high_board_vb_save-support_v0.9-test-2.ips

Where can I find the Cpt. F. prototype rom? Or is this the one from planet virtual boy?

Yep, it’s the one here on the site. You can find it attached to the thread I linked above as boundhigh-cleanfullgame2018.zip or on the PVB game page for Bound High as “Bound High! (JU) (Official)”.

Thanks for explanation.
I will try to test it today, yesterday was no spare time.

No problem, there’s no hurry. FYI, I discovered and fixed another bug specific to the new patch, the “board” one. I missed another difference between the old and new ROMs, so I had to accommodate that change in the patch. It was similar to the issue you had previously with score saving but for the Score Attack!! mode. Attaching a new patch for the “board” version specifically, the “build” one should be fine.

Attachments:

1. bound-high_board_vb_save-support_v0.9-test-3.ips

BTW, I have in the meantime renamed the download link to Cptn.N’s dumped version (“boundhigh-cleanfullgame2018.zip”) from “Bound High! (JU) (Official)” to just “Bound High! (JU)”. Thanks to investigations done by Vague Rant and dasi we can now safely assume that this is a (slightly) newer version than the one built from source. The “real” final version so to say.

So i have tested both versions (proto and board) and everything works (adventure mode, score attack and pocket & ..).
I have attached my saves.

Attachments:

1. bound-high-saves.rar

Fantastic, thanks. All looking good once again, should be just about ready to go after I polish up my comments and stuff.

Before that, though, I got a bit side-tracked working on something else for Bound High. I’ll do a quick rundown since the naming has changed recently just to make sure we’re all on the same page.

There’s three main ROMs for Bound High these days:

• Bound High! (JU)
  • This is the probably-final build dumped by Cpt. F. with the animals on the password screen. Debug features are disabled. This is the one I’ve been calling the “board”. As a general rule, this is the ROM people should be using unless they have a specific reason to use something else.
• Bound High! (JU) (Proto)
  • This is the very-near-final build compiled from source by Kitaro. This is the ROM that’s in the No-Intro database as Bound High (Japan) (En) (Proto).vb and is the one I’ve been calling the “build”. It has vowels on the password screen and a palette bug visible on certain consoles. (The bug was in the source code, it’s not something introduced by the community.)
• Bound High! (JU) (Proto) (Debug)
  • This is another ROM compiled from the source, this time by thunderstruck. It’s probably pretty close to the Kitaro build since it’s built off the same source code, albeit thunderstruck used a different compiler and re-enabled the debug features in this version.

With that out of the way, I was curious about re-enabling debug support in the final build. Most of the debug functionality is still in the final ROM, just without any way to access it because the button codes have been disabled. Using a debug ROM as reference, I ported the missing code back to the final game, so attached is a debug patch for that version.

To be clear, I haven’t tested this with the save patch at all, this is a completely separate project. I did go out of my way to avoid the patches overlapping each other, so they … probably work together? I’ll put some time into testing that before I publish either patch officially since some people may want to use them together.

Anyway, on with the details.

All debug features are accessed from the Pause screen.

• Round Select
  • Hold R, then press Right D-Pad Up, Down, Left, Right
  • Left D-Pad Up/Down to skip one stage up/down, Left D-Pad Right/Left to skip an entire world
  • Press R to jump back to the first level or L to jump to the last level
  • Press A to start playing the currently selected level
• Sound Test Mode
  • Hold R, then press B, A, L, L
  • Cycle through music tracks one at a time with Left D-Pad Up/Down or skip forward/back 12 tracks with Left D-Pad Right/Left
  • Play current selected track with B, stop track with L
  • Cycle through sound effects one at a time with Right D-Pad Up/Down or skip forward/back 12 sounds with Right D-Pad Right/Left
  • Play currently selected sound with A
  • Return to normal gameplay by pressing Start
• Automatic Play
  • Hold R, then press L, Right D-Pad Left, L, Right D-Pad Right, L, Right D-Pad Down
  • The CPU plays for you. It’s pretty good at normal levels, but pretty useless against bosses. Repeat the combo to restore player control
• Enable Expert Enemies
  • Hold R, then press Right D-Pad Down, Left, Up, Right, Left D-Pad Down, Right, Up, Left
  • Can be enabled for tougher enemies without enabling the full Expert difficulty
  • Repeat the combo to restore normal enemies
• Change Difficulty
  • Hold R, then press Left D-Pad Up eight (8) times
  • Cycles through Easy, Normal and one of Hard/Expert, depending on whether Expert enemies are enabled
• Frame Advance Mode
  • Hold L and R, then press B
  • The game advances by a single frame each time you repeat this combo. Pro tip, modes like this were generally used when authoring the manual or other promotional media to capture good screenshots.

It’s probably fair to ask what the point of this is when there’s already a debug ROM freely available. I don’t have a great answer for that. This is slightly different to thunderstruck’s debug ROM in that it retains the original button combos for all debug features and comes with whatever other advantages you get from playing the final ROM (no palette bug … that cool fish on the password screen). Plus, at least in theory, it’s probably compatible with the save patch. But if you’re happy with thunderstruck’s debug ROM, there’s no reason to switch.

Attachments:

1. bound-high_board_vb_debug-restoration_v0.9.ips