Mario_Bros_Crash.txt

Out of bounds write : 0xe55ec000
Out of bounds write : 0xe55ec001
Out of bounds write : 0xe55ec002
Out of bounds write : 0xe55ec003
Out of bounds write : 0xe55ec004
Out of bounds write : 0xe55ec005
Out of bounds write : 0xe55ec006
Out of bounds write : 0xe55ec007
Out of bounds write : 0xe55ec008
Out of bounds write : 0xe55ec009
Out of bounds write : 0xe55ec00a
Out of bounds write : 0xe55ec00b
Out of bounds write : 0xe55ec00c
Out of bounds write : 0xe55ec00d
Out of bounds write : 0xe55ec00e
Out of bounds write : 0xe55ec00f
Out of bounds write : 0xe55ec010
Out of bounds write : 0xe55ec011
Out of bounds write : 0xe55ec012
Out of bounds write : 0xe55ec013
Out of bounds write : 0xe55ec014
Out of bounds write : 0xe55ec015
Out of bounds write : 0xe55ec016
Out of bounds write : 0xe55ec017
CPU::Executing THUMB_15 : 0xc3dd

R0 : 0x03002748 -- R4  : 0xe55ec002 -- R8  : 0x00000000 -- R12 : 0x0000031e
R1 : 0x00000000 -- R5  : 0x00000000 -- R9  : 0x00000000 -- R13 : 0x03007d88
R2 : 0x000000d0 -- R6  : 0xe55ec002 -- R10 : 0x00000000 -- R14 : 0x08010ca5
R3 : 0xe55ec01a -- R7  : 0xe55ec002 -- R11 : 0x00000000 -- R15 : 0x030025b0
CPSR : 0x4000003f       (.Z..  ..T)

** Writes to 0xe55ec002, uses R3 as base I think. Real GBA would not write anything, but the problem here is that it should be writing to used memory space, not used
** When is R3 set to 0xe55ec002?


===========================================================================
CPU::Executing THUMB_15 : 0xc8da
R0 : 0x0000007c -- R4  : 0xe55ec002 -- R8  : 0x00000000 -- R12 : 0x0000031e
R1 : 0xe55ec002 -- R5  : 0x00000000 -- R9  : 0x00000000 -- R13 : 0x03007d88
R2 : 0x000000d0 -- R6  : 0xe55ec002 -- R10 : 0x00000000 -- R14 : 0x08010ca5
R3 : 0xe55ec002 -- R7  : 0xe55ec002 -- R11 : 0x00000000 -- R15 : 0x030025a6
CPSR : 0x0000003f       (....  ..T)
===========================================================================


-> Set here.
** Better question, when is ANY register set to 0xe55ec002?


===========================================================================
CPU::Executing THUMB_9 : 0x6b71
R0 : 0x00000000 -- R4  : 0x0000000f -- R8  : 0x00000000 -- R12 : 0x00000008
R1 : 0xe55ec002 -- R5  : 0x080f4020 -- R9  : 0x00000000 -- R13 : 0x03007d98
R2 : 0x00000000 -- R6  : 0x00000000 -- R10 : 0x00000000 -- R14 : 0x080b53ef
R3 : 0x00000000 -- R7  : 0x03007db4 -- R11 : 0x00000000 -- R15 : 0x080b59fa
CPSR : 0x4000003f       (.Z..  ..T)
===========================================================================


-> Set here. Happens pretty early.
** What do other emulators say?

-> VBAM says it should be that value though
** Okay, so the issue really is with whenever R3 is initially set to 0xe55ec002.
** What does no$gba say about that instruction?

-> The instruction is totally wrong. It should not be 0xC3DD, but 0xDD00, then 0xE0C3.
** Something is wrong with the DMAs (specifically DMA3). It may have to do with the fact that the addresses are not properly aligned? Crap, DMAs don't do mem_checks either :(