User:Torchickens/Custom screen: Difference between revisions
>Torchickens No edit summary |
>Torchickens No edit summary |
||
| (7 intermediate revisions by the same user not shown) | |||
| Line 2: | Line 2: | ||
==Concept== |
==Concept== |
||
| ⚫ | 1. Assemble a ROM, with an assembler or software development tool |
||
{{incomplete|OAM sprites will still appear on the screen. Elaborate on the copying from SRAM to VRAM process. Can we just use RGBDS to generate the bytes without having to assemble a whole ROM?}} |
|||
| ⚫ | 2. Open the ROM with BGB and open the VRAM Viewer via right click. On the BG map tab, locate the beginning and end of the map |
||
| ⚫ | 1. Assemble a ROM, with an assembler or software development tool. The ROM will need to display a screen you will later copy. A very user friendly GUI/WYSIWYG one for Windows, Mac and Linux is [https://www.gbstudio.dev/ GB Studio]; which generates Game Boy games albeit limited ones. They can be exported as ROMs. Alternatively, you can grab graphics on the screen from another game. |
||
| ⚫ | 2. Open the ROM with BGB and open the VRAM Viewer via right click. On the BG map tab, locate the beginning and end of the map addresses. Now, right click and go to Other>Debugger. "Go to" the beginning of the map address and right click, select "Copy data". The number of bytes you'll need to copy is the difference between the beginning and end of the map address (+1), but in decimal. For example, 9A33-9800 (with Windows Calculator on Programmer mode) =hex:233, which converts to 563 bytes; +1=564 bytes. Save these bytes in a place to retrieve later, such as Notepad. |
||
3. Do the same as 2. but with the start and end of tile addresses for tiles you want on the Tiles tab. |
3. Do the same as 2. but with the start and end of tile addresses for tiles you want on the Tiles tab. |
||
| Line 10: | Line 13: | ||
4. Use a [[write to SRAM]] method to save these bytes on a Game Boy Pokémon save file. |
4. Use a [[write to SRAM]] method to save these bytes on a Game Boy Pokémon save file. |
||
5. Program your arbitrary code execution to copy the bytes from SRAM directly into VRAM. To identify |
5. Program your arbitrary code execution to copy the bytes from SRAM directly into VRAM, at the correct map address and tile address locations. To identify where you need to copy the VRAM addresses from, use the VRAM Viewer again but on the Pokémon game. It may also be possible to change the palette (e.g. if the arbitrary code execution access point is from D36D-E on Yellow (map script), changing D35E (current map) will change the palette to match that map (IDs for the maps but currently not the palettes can be found [[https://bulbapedia.bulbagarden.net/wiki/List_of_locations_by_index_number_(Generation_I) here])) |
||
[[Category:Arbitrary code execution]] |
[[Category:Arbitrary code execution]] |
||
Latest revision as of 22:28, 26 April 2020
Arbitrary code execution can be used to copy large amounts of data into VRAM; creating a custom screen.
Concept
| This article is incomplete. Please feel free to add any missing information about the subject. It is missing: OAM sprites will still appear on the screen. Elaborate on the copying from SRAM to VRAM process. Can we just use RGBDS to generate the bytes without having to assemble a whole ROM?. |
1. Assemble a ROM, with an assembler or software development tool. The ROM will need to display a screen you will later copy. A very user friendly GUI/WYSIWYG one for Windows, Mac and Linux is GB Studio; which generates Game Boy games albeit limited ones. They can be exported as ROMs. Alternatively, you can grab graphics on the screen from another game.
2. Open the ROM with BGB and open the VRAM Viewer via right click. On the BG map tab, locate the beginning and end of the map addresses. Now, right click and go to Other>Debugger. "Go to" the beginning of the map address and right click, select "Copy data". The number of bytes you'll need to copy is the difference between the beginning and end of the map address (+1), but in decimal. For example, 9A33-9800 (with Windows Calculator on Programmer mode) =hex:233, which converts to 563 bytes; +1=564 bytes. Save these bytes in a place to retrieve later, such as Notepad.
3. Do the same as 2. but with the start and end of tile addresses for tiles you want on the Tiles tab.
4. Use a write to SRAM method to save these bytes on a Game Boy Pokémon save file.
5. Program your arbitrary code execution to copy the bytes from SRAM directly into VRAM, at the correct map address and tile address locations. To identify where you need to copy the VRAM addresses from, use the VRAM Viewer again but on the Pokémon game. It may also be possible to change the palette (e.g. if the arbitrary code execution access point is from D36D-E on Yellow (map script), changing D35E (current map) will change the palette to match that map (IDs for the maps but currently not the palettes can be found [here))