Original Post


I attached a zip with new a RB build I did where I fixed a few audio related things (mostly noise channel related). There’s no huge changes, so you’re not likely to notice much of a difference, but I figured I’d post it anyway.

The other thing is… there’s also a build called reality_boy_rommap.exe . This build creates a file (or files) mapping out the ROM, determining which parts are code and data, and also code alignment. It does this by tagging all ROM accesses as either code (which means it was fetched by the processor to execute), or as data (meaning it was read with the load operation). While there may be some cases where this method doesn’t work, I don’t have any reason to believe any of the existing VB games do any of them, and this should at least be a good reference.

What I’m requesting is if you plan on playing a game in the emulator for a while, if you could use the _rommap version, and then zip/post to this thread the .map file that gets output, it’d give us a lot of information regarding the ROMs and save a lot of time for those of us looking to hack/modify/reverse engineer ROMs.

Since different parts of the ROMs get used depending on where you’re at in the game, that’s why I said if you plan on playing for a while, since just starting level one will only touch parts of the ROM related to the startup and first level. You can incrementally post them though, if you can start later in the game, like Wario Land or Teleroboxer… I can merge multiple files to get a master map (which is what I plan on doing anyway).

Also, for those looking to hack ROMs, you can use this by pressing T in the game to dump the current map to file and clear the map… then do whatever you want, like start a level, then hit T again to dump any accesses since the last T press. If you look at the file, it’ll be a file the same size as the ROM, full of 0’s, except the character D for data, I for instruction (first byte of the instruction), and C for code (rest of the instruction, tells whether it was 16 or 32 bits).

The location of the characters corresponds to the location in the ROM. So, if you want to know where the speech data in Red Alarm is, press T just before “T&E Soft Presents”, then press it again right after, and look at the .map that gets output and look for the cluster of D’s… it’s likely there. The .map file names get incremented each time you output a map (and it outputs a final one when you exit RB), though they’ll get overwritten if you run the same ROM in Reality Boy again.

You’ll also need the normal libraries that RB needs… if you have an existing version, you should be able to just drop it in the same directory… otherwise download RB, then drop these in the directory. Let me know if you have any problems w/ it.

BTW, I’ll post several utilities to use w/ the ROM maps in the next day or two (merge and mask).


44 Replies

Excellent! This should jumpstart the ‘ol VB ROM-hacking scene!

Great work!

How about disassembly, any news on that? 😉

No news on that yet… I haven’t looked at that code in several years, though it’s something I’d really like to pick up again, and it seems that this might be the right time to do it.


Okay… attached are a couple utilities (with source) to go with the ROM maps.

The first is map_merge, which allows you to merge multiple maps. You can use this for combining several sessions of playing a game in Reality Boy.

The second is map_mask, which outputs the original ROM masked by the map file. This is useful for inspecting just the parts that are in the map, like the code for disassembling, or the data for finding specific values, level data, etc.

I threw these together very quickly, so as usual, there’s likely bugs… let me know if you come across any.



The audio sounds great, nice work.

I tried reality_boy_rommap.exe on two different computers, but it crashes when I close the program. I get a data execution prevention warning, followed by a “x has encountered a problem…” error message.

Hmm… I’m not sure about that error… I assume you’re using some new version of Windows? I’ve only tested these on XP Pro.

BTW, there was a bug in the old _rommap version that caused the maps to be slightly wrong, which prevented you from creating a working ROM (up to about the point that you quit) by masking it with the map. Attached is a new version that should work properly.

Let me know if it works or doesn’t… and if it doesn’t, I’ll try it on my friend’s Windows 7 box. It’s very possible that I didn’t do some sort of cleanup that I should have when closing.


I’m running XP Pro SP3 on both machines. If I press T to dump the map file, the program crashes immediately. Turning off DEP has no effect.

Ah… okay, I was able to reproduce it on my computer. It had to do with the length of the file path. This one should fix it.


That fixed it. I didn’t play very far, but I’ve attached a map file for Mario’s Tennis – seemed like a good place to start.

Thanks for the start dasi!

BTW, I updated the map mask tool, as well as created a map diff tool. In the mask tool, you can now specify what the fill byte is (nice for looking at disassemblies of masked code). You can also output “all except code” and “all except data”, which masks off data specified as code or data, rather than masking the entire ROM except those.

The diff tool takes the difference between two maps. This is basically to allow you to get a map of the same part of the game, except do two different things (select different character, jump instead of run, etc), and see what the difference in the code and data is. Hopefully this would pinpoint the specific differences.

They’re attached to this post.


I played through a bunch of Mario’s Tennis, trying to exercise as much code and data as possible (selecting all characters, playing different modes, etc)… so here’s the map. It’s getting pretty well mapped out, and I looked at this… I believe all the “extra” code is at 0x015fdc and before. I don’t see anything particularly interesting, though there’s still a lot of code, so it’s hard to try to make sense of it all.

I didn’t beat any tournaments in Special mode though, so if someone has some spare time and is any good at it, please upload a map of beating Special Easy, Medium, and Hard (and when you get to credits, menus, etc, let them play through as much as possible).



The latest version (with the graphic “error” fixes) seems to ask for a file called alleg42.dll which it hasn’t been using before. I don’t seem to have it on any of my harddrives – what does it do, why is it new?

e5frog wrote:
The latest version (with the graphic “error” fixes) seems to ask for a file called alleg42.dll which it hasn’t been using before. I don’t seem to have it on any of my harddrives – what does it do, why is it new?

It is the Allegro game library. It allows RB to access graphics, sound, and input devices, and simplifies some other stuff. I don’t know why it hasn’t been using it before. It has always used Allegro. Maybe you accidentally deleted it?

I attached the one I use, but you can also download it (with a bunch of other stuff) from here:


The new versions from David Tucker don’t require that file because he statically linked the dll… his old versions (built w/ VC6) didn’t, and my builds are based off that, which requires the dll file.


Have you talked to David about incorporating your changes and releasing a new “official” version of Reality Boy?

DogP wrote:
…he statically linked the dll…

Ah, that explains why your exe was so much smaller than the one I replaced with it… (Actually, come to think of it, I think I had to move an Allegro DLL into the folder, too…)

“Latest” version of Reality Boy 164kB
Allegro dll 253kB
“Old” Reality Boy 636kB

It doesn’t really add up…

Also, even if I select “Red” palette it runs in black/white mode. And affine mode seems to be stuck in red/green mode or something…

Did you check to see if the DLL is UPX packed? (I’m testing out GNUstep right now, or I would do it myself.) Also, the DLL is probably newer than the static lib DT linked with, so it could just be more efficiently coded, or have certain code disabled, or something.

About the problems: by “pick” do you mean from the front-end? If so, are you using my modified front-end, or one from a specific version of RB, or… The front-end may not be using the same command-line syntax the emulator is expecting.

The workaround is to run RB from a shortcut with manually chosen options, or associate .VB files with it in the registry.

EDIT: It is UPX’ed.

I second e5frog. The anaglyph red/cyan mode doesn’t work anymore (“-dspmode affine -pallet rc”) It’s greenish/yellow/red inverted sort of. Did you change the command line parameters?


Write a reply

You must be logged in to reply to this topic.