NSF ripper Guide Level 11


Level 0   Level 1   Level 2   Level 3   Level 4  

Level 5   Level 6   Level 7   Level 8   Level 9

Level 10   Level 11   Level 12   Level 13   Level 14

Level 15   Level 16   Level 17   Level 18   Level 19

Level 20


LEVEL 11 Carry Lab Mystery Quest

This game is a pain to rip if you don't know how. You can use nes2nsf and you will get a 16K bank output but you won't know where the play address is and you won't be able to find the code with sound register writes. So you need to use a emulator and you make a breakpoint write to 4000 - 4009 and you never get a snap. This is because the sound registers are written to indirectly. Any emulator with a debugger will ignore indirect writes to any register because it could mess up emulation. So you gotta figure out where the play address is. So what you can do is either keep tracing the NMI code which could take hours sometimes or you can use Nintendulator with the trace log option in the debugger. So go ahead and use Nintendulator and while the music is playing log a trace for a moment or 2, don't trace for too long or you will get a gigantic log that's too big to open. Open this log and use the search function and search for 4000 or any of the other sound registers. If you get a match then you see more writes in the same place then you found part of the play address. If you don't find a match then you need to do the log over again. Write this down and then close everything. Now open FCEUD or Nesten and set a address breakpoint for the address where the sound register is being written to. Once you get a snap then you can dump the bank and look at the stack to get an idea where the play entry is and now you should be able to find where in the NMI code the entry to the play code begins. Now here is some part of the play code.


$F775:A9 00     LDA #$00

$F777:A0 02     LDY #$02

$F779:91 09     STA ($09),Y @ $400A = #$FF

$F77B:C8        INY

$F77C:91 09     STA ($09),Y @ $400A = #$FF

$F77E:E6 04     INC $04 = #$19

As you can see the sound registers are being written to indirectly and isn't much of a problem to find once you know how. There is lots of games out there like this. Init and play is F5D1/F664 respectively. I will explain optimizing in the next level and you could try to optimize it for practice.