Emulator Verification

The goal is to identify the last boundary routine reached between contact with the goal sign and the crash, then confirm that the transition completes after the correction.

WarningUse hhugboy or mGBA

This game requires the unusual bank switching of the unlicensed NT-new mapper rather than the MBC1 mapper declared in its ROM header. An emulator without NT-new support may load a different ROM region from the one requested by the game, producing a white screen or executing data as instructions and crashing.

The execution environments covered by this repository are hhugboy and mGBA. The debugger procedure below and dynamic verification of the corrected ROM use mGBA 0.10.3. The game did not run correctly in Gambatte or SameBoy under EmuHawk 2.11.1.

ImportantDynamically verified

After reaching $240A, the unmodified ROM does not return from the second banked call at $241C and crashes before $242A. In a manual test that supplied DE=1400, the destination returned normally to $FF9E; the corrected ROM also completed the real transition from Stage 1 to Stage 2.

Values to monitor

Set write watchpoints where possible.

  • C21C: in-stage state; expect 06 -> 07 at the end
  • C219: global state; expect 05 -> 06 -> 00 at the end
  • C21B: substate within each global state
  • C27D: logical level number; expect 00 -> 01 after Stage 1

Set execution breakpoints in this order:

  1. 240A — wait for the ending animation
  2. 242A — update the level number
  3. 0C98 — global-mode-5 dispatcher
  4. 0CA9 — mode-5 initialization
  5. 0D9F — transition from mode 5 to mode 6
  6. 0DA9 — global-mode-6 dispatcher
  7. 0E64 — choose the internal ID of the next level

Values to record

On the first arrival at each breakpoint, record:

  • PC
  • SP
  • AF, BC, DE, and HL
  • Current ROM bank or mapper state, if displayed
  • The four bytes at C219 C21B C21C C27D

At a crash, also record the stopped PC and the preceding few instructions.

Shortest expected path

240A -> 242A -> 0C98 -> 0CA9
     -> 0D9F -> 0DA9 -> 0E64

After $242A runs at the end of Stage 1, the expected values are C27D=01, C21B=00, and C219=05. At $0E64, the conversion table should set C21A=04, after which C219 should return to 00.

The corrected ROM has been verified to transition from Stage 1 to Stage 2.