Pokemon Stadium

From en64 wiki
Jump to: navigation, search

Uses Yay0, iirc.

A lot of Zoinkity's notes.
For RAM and ROM finds.

OS, Graphic and Audio Functions

0x8010b7e0,__assertBreak
0x8014ebc8,spShow
0x8014ebc8,spHide
0x801568b0,__osSetCause
0x801568c0,osSendMesg
0x80156a10,osStopThread
0x80156ad0,osRecvMesg
0x80156c10,osSetIntMask
0x80156cb0,__osDequeueThread
0x80156cf0,guScaleF
0x80156d44,guScale
0x80156d90,__sinf/fsin/sinf
0x80156f50,alUnlink
0x80156f80,alLink
0x80156fa4,alClose
0x80156fdc,alInit
0x80157410,__ull_rshift
0x8015743c,__ull_rem
0x80157478,__ull_div
0x801574b4,__ll_lshift
0x801574e0,__ll_rem
0x8015751c,__ll_div
0x80157578,__ll_mul
0x801575a8,__ull_divremi
0x80157608,__ll_mod
0x801576a4,__ll_rshift
0x80157fd0,bzero/_bzero/blkclr/_blkclr
0x80158174,alBnkfNew
0x80158278,alSeqFileNew
0x80158cc0,osCreateThread
0x80158ff0,__osSetCount
0x80159090,osVirtualToPhysical
0x80159110,__osSetSR
0x80159120,osWritebackDCache
0x801594f0,__osGetSR
0x8015a5c0,guPerspectiveF
0x8015a7f0,guPerspective
0x8015a9e0,osViBlack
0x8015aaa0,osSpTaskYield
0x8015b1c0,osViSetMode
0x8015b230,osViRepeatLine
0x8015b5e0,__osProbeTLB
0x8015bd00,osGetCount
0x8015ceb0,sqrtf
0x8015cee0,guMtxXFMF
0x8015cf80,guMtxCatF
0x8015d0f0,guMtxXFML
0x8015d150,guMtxCatL
0x8015d1b0,guRandom
0x8015e020,sprintf
0x8015e0f0,osEPiStartDma
0x8015e1d0,alHeapInit
0x8015e250,memcpy
0x8015e27c,strlen
0x8015e2a4,strchr
0x8015e2f0,osInvalDCache
0x8015e3a0,osCreateMesgQueue
0x8015e3d0,osInvalICache
0x8015e540,__osSpDeviceBusy
0x8015e570,__osSiDeviceBusy
0x8015e5a0,guTranslateF
0x8015e5e8,guTranslate
0x8015e640,osJamMesg
0x8015e790,osSetThreadPri
0x8015e870,osGetThreadPri
0x8015e9f0,osViSwapBuffer
0x8015ec20,osSpTaskYielded
0x8015eca0,guRotateRPYF
0x8015edec,guRotateRPY
0x8015ee40,bcmp/_bcmp
0x8015ef60,guRotateF
0x8015f0f4,guRotate
0x8015f150,osGetTime
0x801615f0,alLoadParam
0x801617c4,alRaw16Pull
0x80161c9c,alAdpcmPull
0x80162140,alFilterNew
0x80162220,__osSetGlobalIntMask
0x801623c0,osDpGetCounters
0x80162420,guNormalize
0x801624b0,__osSetCompare
0x801624c0,osAiGetStatus
0x801624d0,osDpSetStatus
0x801624e0,alCopy
0x80162560,bcopy/_bcopy
0x80162870,__osResetGlobalIntMask
0x801628d0,guOrthoF
0x80162a24,guOrtho
0x80162f60,osPiGetCmdQueue
0x80162f90,__cosf/fcos/cosf
0x801632b0,osSetTime
0x801632e0,osViSetEvent
0x801636f0,__osSetFpcCsr
0x80163700,osAiGetLength
0x80163760,osMapTLBRdb
0x801637c0,osYieldThread
0x80163e00,__osGetCause
0x80163f70,osSetTimer
0x80164050,_Ldtob
0x80164b10,lldiv
0x80164c10,ldiv
0x80164ca0,_Litob
0x80164f90,__osSpSetStatus
0x80164fa0,__osSpGetStatus
0x801652e0,osWritebackDCacheAll
0x80165310,alHeapDBAlloc
0x80165370,osStartThread
0x801654c0,osViSetXScale
0x801655f0,osViSetYScale
0x80165650,__d_to_ll
0x8016566c,__f_to_ll
0x80165688,__d_to_ull
0x80165728,__f_to_ull
0x801657c4,__ll_to_d
0x801657dc,__ll_to_f
0x801657f4,__ull_to_d
0x80165828,__ull_to_f
0x80165860,alSynAllocFX
0x80165900,alSynDelete
0x80165c50,__osAiDeviceBusy
0x80165ed0,osViGetCurrentFramebuffer
0x80165ed0,osViGetNextFramebuffer
0x80165f10,__osSpSetPc
0x80179730,osViModeNtscLpf1
0x801797d0,osViModeNtscLaf1
0x80179820,osViModeNtscLpn2
0x80179870,osViModeNtscLpf2
0x801798c0,osViModeNtscLan2
0x80179910,osViModeNtscLaf2
0x80179960,osViModeNtscHpn1
0x801799b0,osViModeNtscHpf1
0x80179a00,osViModeNtscHan1
0x80179a50,osViModeNtscHaf1
0x80179aa0,osViModeNtscHpn2
0x80179af0,osViModeNtscHpf2
0x80179ff0,osViModeMpalLpf1
0x8017a090,osViModeMpalLaf1
0x8017a0e0,osViModeMpalLpn2
0x8017a130,osViModeMpalLpf2
0x8017a180,osViModeMpalLan2
0x8017a1d0,osViModeMpalLaf2
0x8017a220,osViModeMpalHpn1
0x8017a270,osViModeMpalHpf1
0x8017a2c0,osViModeMpalHan1
0x8017a310,osViModeMpalHaf1
0x8017a360,osViModeMpalHpn2
0x8017a3b0,osViModeMpalHpf2
0x8017e210,__osRcpImTable
0x8017e5d0,__libm_qnan_f

GB emulation

Zoinkity's information

Also, if you want to watch pak reads, the functions in question in CPSJ:
80051110 osGbpakCheckConnector()
800515B0 osGbpakPower()
80052480 osGb****nit()
80059210 osGbpakReadId()
80059790 request SI write of data A3 to queue A0 on channel A1 at offset A2
8005C670 osGbpakReadWrite()


Throw a breakpoint down on 801214E0 to catch when it initializes the pak. Throw another one down on 80121504 to catch when the ID is loaded. Note this is done twice; one loads the thing to a control structure, the other to a buffer to verify the contents.

The header is tested for integrity twice. The N64 does a test on the header data similar to the one used by the GB, but the normal GB test is also run. Believe it or not, they copy the bootstrap over the first 0x102 of ROM and run it like normal, then overwrite it with the original contents if it runs successfully. From the return value (0xFF), it's probably the GB Pocket bootstrap. It differs only from a standard GB bootstrap in the return value and the additional two bytes, acting as an infinite loop.