BN3 Notes

Rockcube bx to 080F8D1D.

Timestop chips call a loop that is passed in that activates the action of the actual chip. The timestop is just a wrapper. On the first frame r0 that is passed into the entry loop is 0. It appears that chips are meant to increment this after the first loop. This is for areagrab only.

Flameman Updates:
1. [DONE] Extra Candle State. It should raise his stats to a higher level and raise his AI to beta mode. Will need to figure out a way to store the original level value byte in memory to a safe space.
2. [DONE]Flames should not be stopped by holes
3. [NO] Widening Flames could shoot out the back center so its like a combo of the original 2. unsure how feasible this is. Maybe change how it works to something more exciting... like a snek
4. [DONE] Move the candles to the front row.
5. [DONE] Maybe make a fireratn or blackbomb or something. Fireman could trigger it.
6. [DONE] Random candle states. No more knowing whats coming.
7. [DONE]Make yellow flames track the player better.

FlashmanBeta Number of Chips in White(In AI Data): 080AE652
FlashmanBeta Number of remaining usable chips (in memory): 0x0A off self pointer (0203735E)



Your HP: 02037294
02037270
Player Pending Damage: 020371FE
Return to 080ad83e

08000B08 - Writes to bottom left panel (bne)

0200F48F = BOTTOM LEFT PANEL TYPE

0200A818 = Current Time stop chip timer until start (when starting timestop)

Find coordinates through ram searching.
See what is checking our coordinates. Manipulate AIs by moving into where the check would change results (in line of canodumb). This tells you tahts what is calling it.
Edit whats reading. does it affect everything? where its in the rom? lower is more specific.
Pop the r14 stack to go back to the bl routine and bne branch on result of that function.
Remove the BNE and BL by manulaly just setting the register its going to read to always return what we want.

Spawn Loc 020389B0 it seems.
Branches to 0801455A to a mov r2, #0x28
080B0B08(W) mov r0, #0x8 => change to 4 and you don't flinch

Y coordinate of megaman: 02037229
Y coordinate of megaman (2): 02037283

Canodumb Tracker X value:
020371a8
020389b2
Possible 02005C68 (countdown on projectile as well)


0x080013DC sub r0, r0, r1 is part of the "Check if in row" routine.


Canodumb is writing the X value on spawn of tracker at 080D8EE0 (StoreByte).

Returns to 0800309E, POP.

 10010
100000
Flashman Beta has 3 areagrabs he can use.
The counter for a single one is stored at 0203735E(W)
White version areagrab count routine subtract: 080B6734 sub r0, #0x1

When bulb finishes an addr checks your X coordinate, returns to 080B6755

Blinking bit stored at 080ADA7A

seesm to return to 080B6755

At start of the r5 block there is a bitmask bit.
When metalman loads the initial bitmask is 0x19
00011001
Then continues same frame to 0x11
00010001
And then the next time is 0x13
00010011
Then again to 0x11 (clear bit 2 at 080ADD2A)
00010001

nop at 080ADA66

020371E5


Flashman checks at 080B6754 for your current column number. If iti s 1, he will continue to see if he can use areagrab.

Comparison fix at 080B6762 set to 0x0.


Flag that says if we are in time stop: 02006cb6

FLASHMAN CHIP INFO?
080B6726(W) (mov r0)

Patch at addr 080B672A

Vs Gutsman Beta
Seems next attack data may be stored in 0203734D-E. Seems to change as he changes moves and this value appears read by his routines...

Byte 1 = Current Action
Byte 2 = Movement Indicator ACtion

Gutsman: 18 =
Gutsman: 1C = Dead
Gutsman: 20 = Flinch
Gutsman: 24 = ??? (Idle or Move)
Gutsman: 28 = Moving Frame
Gutsman: 2C = Shockwave
Gutsman: 30 = Panel Slam
Gutsman: 34 = 1sq punch
Gutsman: 38 = Flying punch
Gutsman: 3C = Use chip, become invis
Gustman: 40 = Use Areagrab Chip

Flashman 04 = Move instantly
Flashman 24 = Move
Flashman 2A = Very Tiny teleporiting frame (1 pizel wide)
Flashman 2C = TeleportingFrame
Flashman 30 = Zapping - bit after = 8 means starting, C means... end?
Flashman 34 = Pull shoulder bulb and do tracer
Flashman 38 = Do AreaGrab

Flameman = 28 - 0C Idle


When calling 3C, it seems that everything is offset from register 6 which passed through multiple subroutines.
020373B4

Top i checked is 080b7a4a


HP of gutsman: [02037368]?
Gutsman right shifts his max HP at 080B7DCE, which cuts it in half.
If HP is > half, get random number and and it with 7 (111). Use the result as an offset from 080B7E10, which is 08 and 14's.

Gutsman checks for a value of 0xA to determine ifhe should do the jump around move. instruction is at 080b7de8

Gutsman, once reaching half HP, will track how many moves/attacks he has made. Once he hits 0xA moves, he will set his move count to 0xFF.

Current Y Coordinate
020371E8
02037356

Gutsmans right before areagrab loads 080B7A49 to the branch where he would call the chip

Gutsmans Chip Usage: 080B8588

Gutsman next action ASM: 080AD76Eish (above bx r7, off r5)

X Coordinate of WHERE WE ARE GOING:
02037358
020373B8

METALMANNNNN
Reads gear speed at 080BD678

Remaining time for your extra panels:
canidates

020350a4
02038de4

It seems panel columns have their own expiration timer.
2 rows of interest: 0200F7a0/b0 - 03 means not counting down ti seems... 02 means counting down, not sure if 01 or 00 does anything.

Start of one set: 0200F7A4
Start of second set: 0200F7B0
2 byte timer 1 byte counter state (should be updated automatically for us...) 1 byte seeminly unused (or part of counter state)

Flameman:
r6 - 0x4 = NextPositionX
r6 - 0x5 = NextPositionY
r6 - 0x6 = NextMoveDelay
r6 - 0x7 = Move Counter
r6 - 0x8 = ???? (0'd on move)
r6 - 0x9 = NextAction
r6 - 0xA = ???? (0'd on move)

Flametower levels:
0 = Straight


Candle Timer
020389C0 If forced to 1 candles always activate

Candle Routine
0x60 off r5 is tested for bits. It's a pointer to a memory address.

020373A4 r5+60h - Pointer to some sort of memory.
020373A8 r5+64h - Pointer to some sort of memory.

Bitmasks
1 = Invincibility
2 = Healing
4 = Orange dudes

080E310C

FLAMEMAN HOOK AT 080E2CDE (timer is being reset, so candle has gone out.)
CurrentCandleEffect Set at 080E2CA6 (Activate)
080E2C12 (Deactivate?)

Flameman Flames:
32-Bit Attack Pattern somehow.
0: lowest bit is 0 = striaght flames, lowest bit is 1 = pattern flames(Lowest Bits)
1:
2:
3:  (Highest Bits)

0000 = 0 = Straight
0001 = 1 = WideFlame (both ways)
0010 = 2 = Wideflame (up only4)
0011 = 3 = Wideflame (down only)
0100 = 4 = Wideflame Down 2 only

AddHPRoutine: Less than 7 in r0

080C1C72 PlantmanPostSpawnConstants

r5 in AI routines is typically "self"
0x0 - Bitmask containing multiple values, e.g. paused, flickering, invisible... Not sure what the bitmask values are yet.
0x2 - Some value (lower 4 bits dropped by flameman)
0x4 - AI Level (0 being normal, 3 being omega)
0x5 - Invincibility Bit (1 = invincible)?
0x6 - Seems to be some timer value (flameman), position value (plantman)...
0x7 - Plantman Vine Spawn Position Y (1 byte)... not sure for other navis
0x8 - Set to 0 to make 'fade in' animation [Byte]
0x9 - ???? [byte] (Sprite Appear/Disappear?)
0xA - Current Action (Used as an array index offset, so it will always be a multiple of 4)
0xB - Movement Animation... something. Always in values of 4 it seems...
0x10 - ???? (Byte)
0x12 - Current X Position (1=left)
0x13 - Current Y Position (1=top)
0x14 - ???? (Byte)
0x15 - ???? (Byte)
0x16 - ???? (Byte) (Read and then -1'd)
0x1E- ???? Byte
0x20 - Timer Value 1 (can be used by multiple things)
0x22 - ???? (2 bytes)
0x24 - Current HP (2 bytes)
0x26 - Max HP (2 bytes)
0x2C - Impact Damage? (2 bytes)
0x2E - Unknown (2 bytes) - Appears to possibly be a bitmask. Flameman tests if this value has any bits from 20A in it and other areas bic and orr on it (many as 0x20)
0x30 - Unknown (2 bytes) - Set by plantman AI in PostNeedleSpawn
0x50 - Unknown (4 bytes) (Pointer)
0x60 - Pointer to memory elsewhere. (4 bytes)
0x68 - Pointer to memory elsewhere. (4 bytes)
0x6C - Pointer to memory elsewhere. Seems to maybe be a pointer to an object owned by this AI
0x8C - Pointer to AI's hardcoded constants in ROM. See Hart-Hunt's list for what each offset does for each enemy.

Panel Info:
4 bytes
0x1000 bitmask = lava

Blank   80010032 10000000 00000001 00000000 00110010
Cracked 00010073 00000000 00000001 00000000 01110011
Sand    0001023A 00000000 00000001 00000010 00111010
Metal   00030035 00000000 00000011 00000000 00110101
Grass   00010436 00000000 00000001 00000100 00110110

LAVA             00000000 00000000 00010000 00000000


1 = 1
10 = 2
100 = 4

2 1 = Broken Bitmask 10
4 2 = Normal
8 3 = Cracked
10 4 = Poison
20 5 = Metal
40 6 = Grass
80 7 = Ice
100 8 = Lava
200 9 = Holy
400 A = Sand

0200f5a0

Lava = 1000h Bitmask
Grass = 400h (Most Likey)

Flameman Yellow Guy Actions
0 = Not Exist
4 = Fading Out
8 = Preparing To Spawn

BN3 WHITE AI VALUES

Gutsman Beta:
080AE6A0 (to 0x7)

Metalman Beta:
080AE83E (to 0x6)

FlameMan
080E2F84

Mgamerz MMBN3 Hard Mode Patch

Mettaur:
Damage 10 -> 15
Movement Speed Increased
Time until attack slightly nerfed (otherwise too many shockwaves could happen on screen at once)

Mettaur2:
Damage 40 -> 55
Movement speed increased

Canodumb Series: Constant scan rather than row lineup.
Patched in blue at addr 080BADA2 - 080BADA4 (remove bl and branch, set r0 to 0 and then tst r0, r0 to force return true.)