leech wrote:(Oh, maybe re-reading that, it sounds like MAME was used to disassemble the original ROM and then its source was modified, which is absolutely brilliant, though I also would think that any patches to the source could be distributed, just not the actual source, which would need to be disassembled by anyone who wants to work on this modification, right? Yeah, you're right, that gets into weird legal areas).
The MAME source has been modified so that it will save telemetry data when the game is running. This telemetry data and the program ROM are being processed by a special disassembler which produces a real source code of the program.
Here's an actual snippet:
Code: Select all
L_00016dca:
cmpi.b #$2,$50dc(a5) ; [00000001] 00016dca: 0c2d 0002 50dc
beq.b L_00016df4 ; [00000001] 00016dd0: 6722
move.w d0,d5 ; [00000001] 00016dd2: 3a00
jsr L_00002184.w ; [00000001] 00016dd4: 4eb8 2184
beq.b L_00016df4 ; [00000001] 00016dd8: 671a
addq.b #$1,-$766c(a5) ; [00000001] 00016dda: 522d 8994
addq.b #$1,$50dc(a5) ; [00000001] 00016dde: 522d 50dc
jsr L_000026dc.w ; [00000001] 00016de2: 4eb8 26dc
bsr.w L_00016e32 ; [00000001] 00016de6: 6100 004a
add.w d5,d5 ; [00000001] 00016dea: da45
move.w L_00016df6(pc,d5.w),d5 ; [00000001] 00016dec: 3a3b 5008
jmp L_00016df6(pc,d5.w) ; [00000001] 00016df0: 4efb 5004
L_00016df4:
rts ; [00000001] 00016df4: 4e75
L_00016df6:
dc.w L_00016e74-L_00016df6
dc.w L_00016ed4-L_00016df6
dc.w L_00016f9c-L_00016df6
dc.w L_00016f14-L_00016df6
L_00016dfe:
cmpi.b #$2,$50dc(a5) ; [00000001] 00016dfe: 0c2d 0002 50dc
beq.b L_00016e28 ; [00000001] 00016e04: 6722
move.w d0,d5 ; [00000001] 00016e06: 3a00
jsr L_00002184.w ; [00000001] 00016e08: 4eb8 2184
beq.b L_00016e28 ; [00000001] 00016e0c: 671a
addq.b #$1,-$766c(a5) ; [00000001] 00016e0e: 522d 8994
addq.b #$1,$50dc(a5) ; [00000001] 00016e12: 522d 50dc
jsr L_000026dc.w ; [00000001] 00016e16: 4eb8 26dc
bsr.w L_00016e32 ; [00000001] 00016e1a: 6100 0016
add.w d5,d5 ; [00000001] 00016e1e: da45
move.w L_00016e2a(pc,d5.w),d5 ; [00000001] 00016e20: 3a3b 5008
jmp L_00016e2a(pc,d5.w) ; [00000001] 00016e24: 4efb 5004
L_00016e28:
rts ; [00000001] 00016e28: 4e75
L_00016e2a:
dc.w L_00016ea4-L_00016e2a
dc.w L_00016ef4-L_00016e2a
dc.w L_00016fcc-L_00016e2a
dc.w L_00016f34-L_00016e2a
As you can see, the source is formatted and even jump tables are being detected and resolved. Unfortunately, there are still some dirty tricks in the code which will definitely lead to a crash when "moving" the whole program to a different address.
Reassembling this source with vasm without any changes will produce an identical program ROM and this can be reused by the modified MAME.
So what's different in the code on the Atari STE? Actually some program code below $800 has been moved to a higher address location and the exception vectors for the VBL and HBL have been hijacked. The Atari STE VBL now draws some red blocks, the JagPad/keyboard input is being processed and then it calls the original code. That's basically all.