don't click here

Original Sonic CD symbol/label list

Discussion in 'Engineering & Reverse Engineering' started by evilhamwizard, Sep 26, 2009.

  1. evilhamwizard

    evilhamwizard

    Researcher
    1,392
    455
    63
    I sort of mentioned this in the "Supreme Topic of Other Knowledge" topic (and this might be old for the most hard core hackers), but I don't think I mentioned the symbol list in the ELF files of the Sonic CD port for the GEMS collection. But, there are:

    Here's an snippet:

    Code (Text):
    1. 0004:00000000       action
    2.  0004:00000080       speedset_0
    3.  0004:0000015C       speedset2
    4.  0004:00000238       actionsub
    5.  0004:000003E0       frameout
    6.  0004:00000420       patset
    7.  0004:000006A4       spatset
    8.  0004:00000944       flagwkclr
    9.  0004:000009A0       actsetchk
    10.  0004:000009DC       actsetinit
    11.  0004:00000BDC       actset
    12.  0004:00001044       tm_setchk
    13.  0004:0000114C       actnoset
    14.  0004:00001368       actwkchk
    15.  0004:000013C8       actwkchk2
    16.  0004:00001420       frameout_s
    17.  0004:00001454       frameout_s00
    18.  0004:00001608       frameout_s0
    19.  0004:00001734       dai_k
    20.  0004:000017BC       dai_k_init
    21.  0004:00001824       dai_k_move
    22.  0004:00001A1C       k_move
    23.  0004:00001AE8       jumpchk_d
    This was found in R11A.ELF, generated from the Gamecube port of ZONE 1 ACT 1. Both ports use ELF files as executables for each level and act, but there is another use for having this. For example, let's look at the 'action' subroutine in IDA:

    <div class='codetop'>CODE</div><div class='codemain' style='height:200px;white-space:pre;overflow:auto'> .text:813080C0 # =============== S U B R O U T I N E =======================================
    .text:813080C0
    .text:813080C0
    .text:813080C0 .globl action
    .text:813080C0 action: # CODE XREF: game+23Cp
    .text:813080C0 # DATA XREF: .debug:off_68o ...
    .text:813080C0
    .text:813080C0 .set var_8, -8
    .text:813080C0 .set var_4, -4
    .text:813080C0 .set arg_4, 4
    .text:813080C0
    .text:813080C0 stwu %sp, -0x10(%sp) # Store Word with Update
    .text:813080C4 mflr %r0 # Move from link register
    .text:813080C8 stw %r0, 0x10+arg_4(%sp) # Store Word
    .text:813080CC stw %r31, 0x10+var_4(%sp) # Store Word
    .text:813080D0 stw %r30, 0x10+var_8(%sp) # Store Word
    .text:813080D4 lis %r3, ((actwk-0x7ECA)@h) # Load Immediate Shifted
    .text:813080D8 addi %r31, %r3, ((actwk-0x3D3C)@l) # Add Immediate
    .text:813080DC li %r30, 0 # Load Immediate
    .text:813080E0 b loc_81308120 # Branch
    .text:813080E4 # ---------------------------------------------------------------------------
    .text:813080E4
    .text:813080E4 loc_813080E4: # CODE XREF: action+64j
    .text:813080E4 lbz %r0, ((ite0e+0x58+0x7A78)@l)(%r31) # Load Byte and Zero
    .text:813080E8 cmplwi %r0, 0 # Compare Logical Word Immediate
    .text:813080EC beq loc_81308118 # Branch if equal
    .text:813080F0 mr %r3, %r31 # Move Register
    .text:813080F4 lbz %r4, ((ite0e+0x58+0x7A78)@l)(%r31) # Load Byte and Zero
    .text:813080F8 subi %r0, %r4, 1 # Subtract Immediate
    .text:813080FC slwi %r5, %r0, 2 # Shift Left Immediate
    .text:81308100 lis %r4, ((act_tbl-0x7ECB)@h) # Load Immediate Shifted
    .text:81308104 addi %r0, %r4, ((act_tbl+0x4270)@l) # Add Immediate
    .text:81308108 add %r4, %r0, %r5 # Add
    .text:8130810C lwz %r12, 0(%r4) # Load Word and Zero
    .text:81308110 mtctr %r12 # Move to count register
    .text:81308114 bctrl # Branch unconditionally
    .text:81308118
    .text:81308118 loc_81308118: # CODE XREF: action+2Cj
    .text:81308118 addi %r30, %r30, 1 # Add Immediate
    .text:8130811C addi %r31, %r31, 0x44 # Add Immediate
    .text:81308120
    .text:81308120 loc_81308120: # CODE XREF: action+20j
    .text:81308120 cmpwi %r30, 0x80 # Compare Word Immediate
    .text:81308124 blt loc_813080E4 # Branch if less than
    .text:81308128 lwz %r31, 0x10+var_4(%sp) # Load Word and Zero
    .text:8130812C lwz %r30, 0x10+var_8(%sp) # Load Word and Zero
    .text:81308130 lwz %r0, 0x10+arg_4(%sp) # Load Word and Zero
    .text:81308134 mtlr %r0 # Move to link register
    .text:81308138 addi %sp, %sp, 0x10 # Add Immediate
    .text:8130813C blr # Branch unconditionally
    .text:8130813C # End of function action
    </div>

    Yep, this is the subroutine written in PPC assembly language. We can actually do the same thing with the PS2 port of SCD in IDA, for example, here's the same subroutine in the PS2 port:

    <div class='codetop'>CODE</div><div class='codemain' style='height:200px;white-space:pre;overflow:auto'>main:01000030 # ---------------------------------------------------------------------------
    main:01000034 .align 4
    main:01000040
    main:01000040 .globl action
    main:01000040 action: # CODE XREF: game+218p
    main:01000040 addiu $sp, -0x30 # Add Immediate Unsigned
    main:01000044 sd $ra, 0x20($sp) # Store Doubleword
    main:01000044 # ---------------------------------------------------------------------------
    main:01000048 .word 0x7FB10010, 0x7FB00000
    main:01000050 .half 0x1044774 >> 16
    main:01000052 .half 0x3C10
    main:01000054 .half 0x4670
    main:01000056 .half 0x2610
    main:01000058 # ---------------------------------------------------------------------------
    main:01000058 daddu $s1, $0, $0 # Doubleword Add Unsigned
    main:0100005C b loc_10000A4 # Branch Always
    main:01000060 nop
    main:01000064 # ---------------------------------------------------------------------------
    main:01000064
    main:01000064 loc_1000064: # CODE XREF: main:010000A8j
    main:01000064 lbu $v1, 0($s0) # Load Byte Unsigned
    main:01000068 beqz $v1, loc_100009C # Branch on Zero
    main:0100006C nop
    main:01000070 daddu $a0, $s0, $0 # Doubleword Add Unsigned
    main:01000074 lbu $v0, 0($s0) # Load Byte Unsigned
    main:01000078 andi $v0, 0xFF # AND Immediate
    main:0100007C addiu $v0, 0xFFFF # Add Immediate Unsigned
    main:01000080 sll $v1, $v0, 2 # Shift Left Logical
    main:01000084 la $v0, (clst1_1a0-0x100) # Load Address
    main:0100008C addu $v0, $v1 # Add Unsigned
    main:01000090 lw $v0, 0($v0) # Load Word
    main:01000094 jalr $v0 # Jump And Link Register
    main:01000098 nop
    main:0100009C
    main:0100009C loc_100009C: # CODE XREF: main:01000068j
    main:0100009C addiu $s1, 1 # Add Immediate Unsigned
    main:010000A0 addiu $s0, 0x44 # Add Immediate Unsigned
    main:010000A4
    main:010000A4 loc_10000A4: # CODE XREF: main:0100005Cj
    main:010000A4 slti $v1, $s1, 0x80 # Set on Less Than Immediate
    main:010000A8 bnez $v1, loc_1000064 # Branch on Not Zero
    main:010000AC nop
    main:010000B0 ld $ra, 0x20($sp) # Load Doubleword
    </div>

    This is from the PS2 version in MIPSL assembly.

    And here's a generated list of the symbols used for the PS2 version of R11A.ELF:

    http://pastie.org/631199

    As you can see, many of these are familiar. That's because some are the same symbols used in the Sonic 2NA symbol list (which in a way is probably part of the Sonic 1 symbol list as well). While it's obvious as to why, I think it's worth mentioning. But it goes to show you that at least when they were porting the game to the PC - they had the courtesy to retain the same labels while porting the game.

    Sorry if there are any inaccuracies in this topic, but I'm new to this. :p
     
  2. Hivebrain

    Hivebrain

    Administrator
    3,048
    160
    43
    53.4N, 1.5W
    Github
    Old topic, but thanks to your label list I was able to find a name for this badnik:

    http://info.sonicretro.org/Kamemusi

    Any chance you could do the rest of the zones? (I only need one list per zone to find the missing enemy names.)
     
  3. evilhamwizard

    evilhamwizard

    Researcher
    1,392
    455
    63
  4. Hivebrain

    Hivebrain

    Administrator
    3,048
    160
    43
    53.4N, 1.5W
    Github
  5. ICEknight

    ICEknight

    Researcher Researcher
    I've noticed a "scarab" and a "pat_scarab" in Metallic Madness labels. Perhaps those refer to the dung beetle?


    EDIT: Also, the Mecha-Bu seems to be referred to as "kabuto" in there. Perhaps that info should be reflected in the wiki as well?
     
  6. ColinC10

    ColinC10

    Tech Member
    I stuck a bunch of possible English names into Google Translate and then searched the label list for the resulting Japanese translations. I seem to have hit a match for CC Badnik 1 with "Ga" , which apparently means "moth". Anybody like to confirm this?

    Unfortunately I didn't have as much luck with "Bakudan" (bomb) for MM Badnik 2...
     
  7. ICEknight

    ICEknight

    Researcher Researcher
    Could this be the bomb?

    Code (Text):
    1. #
    2.  00000001:0000000000015D50&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bakuha
    3. #
    4.  00000001:0000000000015DE0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; baku_init
    5. #
    6.  00000001:0000000000015ED0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; baku_move
    7. #
    8.  00000001:0000000000015F10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; baku_die

    Or this?

    Code (Text):
    1. #
    2.  00000001:0000000000031070&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; baku_chg0
    3. #
    4.  00000001:0000000000031078&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; baku_chg1
    5. #
    6.  00000001:0000000000031080&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bakuchg
    7. #
    8.  00000001:0000000000031090&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bak00
    9. #
    10.  00000001:0000000000031110&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bak01
    11. #
    12.  00000001:0000000000031190&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bak02
    13. #
    14.  00000001:0000000000031210&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bak03
    15. #
    16.  00000001:0000000000031290&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bak04
    17. #
    18.  00000001:0000000000031310&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bak05
    19. #
    20.  00000001:0000000000031390&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bak06
    21. #
    22.  00000001:0000000000031410&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bakupat
    23. #
     
  8. ColinC10

    ColinC10

    Tech Member
    I noticed those too, but "bakuha" means "explosion". The same labels appear in the source code for all of the levels, meaning it's probably a generic explosion object. I'm not sure how an explosion can "move" or "die", though - perhaps they meant "animate" and "delete".
     
  9. Hivebrain

    Hivebrain

    Administrator
    3,048
    160
    43
    53.4N, 1.5W
    Github
    Is the bomb enemy in all 3 acts and every time period? The code might not be present if it's not used in this particular level.
     
  10. qiuu

    qiuu

    Tech Member
    144
    9
    18
    Blue Ball & Blocks
    I don't know how the GEMS collection version of Sonic CD is structured (indeed, I don't even know what exactly it is), but I can say that in the MegaCD version, the code for the big bomb is contained in all timezones for the MMZ2 .mmds, while it isn't contained in any .mmd for MMZ1 or MMZ3. (Likely of no use, but its internal object ID there is 0x23.)
    Are there symbol tables only one for each zone, or one for each former .mmd?

    I noticed a note in the wiki that "kabasira" is a slight misspelling of "kabashira"; however technically it's just a matter of how you romanize the original Japanese name. There's the syllable that is commonly romanized as 'shi', which in the code however is romanized as 'si'. It's the same with Kemushi etc.

    (On a totally unrelated note: I'll still continue to call 'Dango' a Rollbug. :P)
     
  11. evilhamwizard

    evilhamwizard

    Researcher
    1,392
    455
    63
    Oh yeah, I knew I was going to regret not saying where these are coming from. :P

    Like the originals, every zone and act and time is separated in their own executables. I got all the symbols from the first act (present?) of each zone. So yeah...

    But let me know what I exactly you need from which act/zone/time and I'll try to get it.
     
  12. qiuu

    qiuu

    Tech Member
    144
    9
    18
    Blue Ball & Blocks
    I think R82A (or any other of the R82, that is Metallic Madness 2, any timezone) should be sufficient to find the name for that last badnik, the bomb.

    R83C (Metallic Madness 3 Good Future) would be of personal interest to me, to see how closely the labels can be assigned to the labels I have in my disassembly of the MegaCD version, or if things have been restructured somehow.
     
  13. evilhamwizard

    evilhamwizard

    Researcher
    1,392
    455
    63
    Here you go!

    R82A
    R83C
     
  14. Hivebrain

    Hivebrain

    Administrator
    3,048
    160
    43
    53.4N, 1.5W
    Github
    Bigbom. That was easy enough to spot.
     
  15. McAleeCh

    McAleeCh

    Oldbie
    1,472
    532
    93
    Also of interest is that the light-bulb badnik, currently listed on the wiki as "Hotaru7" from its' label in Stardust Speedway, is labelled "Hotaru8" in Metallic Madness 3. Does this badnik act differently between the different zones or something? (I don't know my Sonic CD well enough, I'll confess). If so, I think it's safe to assume the intended badnik name is "Hotaru", with the 7 or 8 designating which Zone's version of the badnik is being used (since Stardust Speedway and Metallic Madness are Round 7 and 8 respectively).

    EDIT: Noticed the wiki page confirmed that the Badnik has different behaviour depending on which Round it was in. Attempted to add the above info to the "Hotaru" page; however, messed things up a bit and created a new page called "Hotaru" rather than moving the existing one. = / Not being a wiki sysop, can't delete the page I created. Have updated the existing "Hotaru7" page with the info for now; any chance someone with the correct privelages could delete it and move "Hotaru7" to "Hotaru" instead?

    Am really really sorry about this - this is why I don't usually attempt to edit the wiki. = (


    EDIT2: Big thanks to Frozen Nitrogen for fixing my goof. = ) Will be more careful in future.
     
  16. ColinC10

    ColinC10

    Tech Member
    Job done, then - all the Sonic CD badniks now have "proper" names. Good work, everyone! :thumbsup:
     
  17. DigitalDuck

    DigitalDuck

    Arriving four years late. Member
    5,349
    437
    63
    Lincs, UK
    TurBoa, S1RL
    Can the badniks' names use 'formal' Romanisation as opposed to the 'short' used in the ROM, as mentioned earlier? In this case, it only requires replacing 'si' with 'shi'.
     
  18. Hivebrain

    Hivebrain

    Administrator
    3,048
    160
    43
    53.4N, 1.5W
    Github
    No, because that's how they're written in the code. If they were written in Japanese, then we could convert them to latin text properly (and possibly translate them). As it is, we're copying the labels verbatim like we did with S2 (Redz, BBat etc).
     
  19. McAleeCh

    McAleeCh

    Oldbie
    1,472
    532
    93
    Ah, so that's where the name "Redz" comes from, is it? I did wonder. Might be worth pointing that out in the article, as with the SCD Badniks.

    Also, while we're talking about the S2 Unused Badniks, why is Buzzer's graphic and a sheet of its' concept art even used on the page for "Bee"? There's a handdrawn sheet on that page planning tile layouts for Buzzer, which says "refers to incorrectly as Wasp". But Buzzer's concept name *was* Wasp, as evidenced by the naming of the Digitizer images ICEknight was sent ages back and, IIRC, the images in S2 mobile, which refer to all badniks by their original labels (such as "Wasp" for Buzzer and, funnily enough, "Sandcrab" for Crawl).

    Which does bring up another issue - would ICEknight mind if the Digitizer images were added to the wiki? There's some interesting stuff in there, such as the extra unused frame for "Wasp"/Buzzer, the earlier version of "Snail" that's more similar to the concept art, etc. These things should really be archived on the wiki if at all possible.

    Anyway, it was always my understanding that "Bee" and "Wasp"/Buzzer were two separate entities with nothing to do with each other - where exactly has the notion they would have shared graphics come from? If it's not substantiated by anything we have, the image linking to the "Bee" page should really be changed to a picture of the badnik as depicted in its' concept art, where it looks startlingly like Buzz Bomber. Either way, the tile planning sheet should be moved to Buzzer's page, since it's labelled "Wasp" and clearly depicts the tile layout for Buzzer.

    EDIT: Also, one other thing - the images at the bottom of the sheet of Banper's concept art depict a version startlingly similar to the graphics of the early version of "Sandcrab"/Crawl found in prototypes of the game. This seems to suggest, bizarrely enough, that Banper eventually became the one and only Casino Night Badnik. However, this is unsubstantiated and only based on the similarity in design of the images (well, and the fact Crawl's label name is "Sandcrab" and that Banper was initially considered for a Desert Zone). Thought it was worth mentioning here at least.
     
  20. ICEknight

    ICEknight

    Researcher Researcher
    Sure, go ahead. Citing the site where they came from as a reference would be a nice touch.


    Regarding Sandcrab, I'm sure that's what Banper evolved into, after some more brainstorming. That must be the reason why the crab is sketched in the same page.