pandocs

pandocs copied to clipboard

according to some research i have done, with some help from @leinacc, there is no "jump packet", instead it seems to just be a termination code. to actually jump somewhere you need to do one of:

• inject a jmp at either $0635 or $0e74, then write $00 to all 4 ports (otherwise the SNES locks up)
• jump to SNES code that communicates with the SPC
• mis-use sound, which was not tested and probably wont actually work

the page also calls the N-SPC driver "the SNES MIDI engine", which is misleading, despite the format being somewhat similar to MIDI (or so i heard)

lastly, if the first "packet"s length is 0, its instead treated as a length of 65536, which almost certainly will lock up the SPC (guess how i found out)

according to some research i have done, with some help from @leinacc, there is no "jump packet", instead it seems to just be a termination code. to actually jump somewhere you need to do one of:

* inject a `jmp` at either `$0635` or `$0e74`, then write `$00` to all 4 ports (otherwise the SNES locks up)

* `jump` to SNES code that communicates with the SPC

* mis-use `sound`, which was **not** tested and _probably_ wont actually work

Can you test it, and provide a test ROM, a link to a disassembly, or anything that can be cited? Otherwise, there's not much to go off of here.

the page also calls the N-SPC driver "the SNES MIDI engine", which is misleading, despite the format being somewhat similar to MIDI (or so i heard)

Best align with what #484 did, then.

lastly, if the first "packet"s length is 0, its instead treated as a length of 65536, which almost certainly will lock up the SPC (guess how i found out)

So that simply means that the BIOS expects the first packet to be a data one.

if you mean a test ROM for how to actually perform a jump (a one time-ish thing, unless you jump to a snippet that fixes the data it overwrites), then i can make the repo public (snippet), but if you mean $0000 packet crashing the SPC then i can also make the repo public, and tell you which line to change to cause the crash, and if you mean anything else then ill see what i can do

so after some messing around it, looks like a $0000 length packet must have destination $0400, despite everything hinting at it being "ignored". i dont exactly want to do more research on this, at least not right now, but thought this weird thing may be worth mentioning