Log In  

5

Here's a tool I did program to investigate the Hardware State Region, It displays all the 64 bytes in the hardware state, you can see whenever you re-run the tool the same data until you reboot. (try also to reset the cart in the browser, it will still show the same data)

Cart [#40756#] | Copy | Code | 2017-05-19 | Link
5

After reverse engineering I found that the addresses 0x5F40 -> 0x5F43 does something specials which is music corrupting as shown in this topic: https://www.lexaloffle.com/bbs/?tid=3561
And addresses 0x5F44 -> 0x5F7F are not used at all, and can be used to keep data between cart resets or cart changing, but clears on reboot.

I'm not sure if they are used in the other platforms like rpi or chip, nor if they will be used in future updates.

P#40750 2017-05-19 09:14

:: Reverse Engineering explained

I did run pico8, and my tool, and loaded pico8 process in cheatengine.
In my tool, I did set the first byte in hardware state to 10000001, and it cheat engine I set the value type to binary and bin input, then searched for the value, change the value in p8 and search again in cheatengine till I found it.

Selected the address and pressed "find what writes to this address", then switched to pico8 and inverted a bit in the byte, cheatengine did detect the assembly code that writes on the first byte in the hardware state.
Presses "Show disassembler", and found the poke function code, actually for everyregion in the ram a specific code is executed when poked, and as you see there are compares for each region.

eax -> The address to poke
edi -> The poke value
cmp -> compare
jg -> jump if greater
ing -> jump if not greater
je -> jump if exact
jne -> jump if not exact

once it reaches 0x31FF it compares in a different location.

In the last test it will jump and execute the code of the hardware state + draw state regions

As you see it does some compares, but for all the addresses from 0x5F44 -> 0x5F7F there is nothing

After the jump It just returns from the function

So for the current version (0.1.10C) of PICO-8 on windows 32bit, it does nothing for the addresses 0x5F44 -> 0x5F7F.

What's nice in this region that it's not cleared when the cart is reset, or another cart is loaded, It only clears when
rebooting.

P#40751 2017-05-19 10:20

Log in to post a comment

user:
password:

New User | Account Help
:: New User
X
About | Contact | Updates | Terms of Use
Follow Lexaloffle:        
Generated 2017-10-23 19:09 | 0.140s | 1572k | Q:18