User:Andlabs/Notes:Thunder Spirits

$7F0000 - 'Ohda' used for reset check does not appear to be used by any other SNES game? no name match with any of the Thunder Force III staff

$7F0004 - $FF if 'Ohda'; $00 otherwise

sub_9CE - Toshiba EMI screen
 * sub_B8000 - the actual gruntwork

sub_9DF - ending; starts after the fadeout for the final level but before the HUD is removed from the screen as well
 * sub_30003 -> loc_30107 -> sub_38000 -> loc_38005 - ending cutscene
 * $381E3 is right after "was eventually extinguished." has been output
 * $3823F is right after this block of text scrolls offscreen
 * $3828A is right after this part of the cutscene ends, leading into the slideshow
 * sub_3897E appears to be the routine that loads the slideshow image, with byte $7FFD80 choosing (zero for first, nonzero for second)
 * $38391 is right before the THE END screen shows up
 * verdict: seems to be nothing unused, unless I am missing extra data

00038262 4CD181   jmp loc_381D1  ; normal branch 00038265 A90100   lda #$0001     ; target 1 - NOTHING 00038268 8D901A   sta $1A90 0003826B 4CDA83   jmp loc_383DA 0003826E 9C901A   stz $1A90      ; target 2 - NOTHING, but controller input stops working? 00038271 4CDA83   jmp loc_383DA 00038274 A90200   lda #$0002     ; target 3 - NOTHING, but controller input stops working 00038277 8D901A   sta $1A90 0003827A 4CDA83   jmp loc_383DA 0003827D 20 42 93 9C DB sub_3827D if they all do nothing, I'll need to try subroutiune calls... loc_383DA: jsr	sub_383DF		; $383DA plb		; $383DD rtl		; $383DE sub_383DF: ; does stuff so we want 20DF83 - and the game hangs ok final verdict: got nothing; off to the name entry code

$021A98 - level number (0..7; not sure what higher values would do)

huh? demo recording? loc_B39: sta	$ABAD8C,x		; $B3B | $ABAD8C -> ROM $55AD8C loc_B3D: beq	loc_B4D		; $B40 lda	$1B69		; $B42 | $1B69 -> $001B69 bit	#$00		; $B45 bpl	loc_B39		; $B47

loc_28BFD - actual start of name entry code (after following some jumps)

sub_2891F - PrintString - looks like I need to add a noreturn feature of sort, since this behaves like the PrintString in tecnosoft's MD games (pulls strings from instruction stream)
 * actually here the string starts after three bytes and ends on a null byte so maybe I can do a string feature...

loc_28FC7 - start of built in name check
 * loc_28FFA - loads EMI (replacement name)
 * verdict - doe not appear to check any other names

00282e0: d0e4 9c14 1c20 2183 a900 00ab 6b4d 5354 ..... !.....kMST 00282f0: 0053 484f 004e 4153 0054 3a4b 0050 4950 .SHO.NAS.T:K.PIP 0028300: 0053 4d49 0045 584f 0059 4f55 0056 3132 .SMI.EXO.YOU.V12 0028310: 004e 414f 0054 4945 004b 5234 0038 3431 .NAO.TIE.KR4.841 are TIE, KR4, 841 names that do not appear?

bugs in the disassembler rep	#$20		; $134F lda	$7F038A		; $1351 | $7F038A bne	loc_1360		; $1355 lda	#$F3		; $1357 brk	#$20		; $1359 lda	($AC),y		; $135B | $AC + d=$00 -> $0000AC jmp	loc_A0D		; $135D loc_1360: lda	#$00F4		; $1360 jsr	sub_2CB1		; $1363 jmp	loc_A0D		; $1367 (need to actually add environment saving/restoring)