Bypass start screen

[TsilaAllaoui]

Hi, tried to contact you but couldn't find your email. This is not really an issue but can you show me where in the decomp i can bypass the start screen to directly go to campaign. I need it for personal purpose. Thanks in advance.
Also are you on discord?

[Veslyquix]

from using my fork of this, I can see the procs on screen: https://github.com/Veslyquix/GBAFE-LuaUtilities

I search the disassembly (eg. https://github.com/Eebit/aw2bhr/blob/main/asm/code-0801D390.s) for `849EB34`, the campaign proc. This leads me to this function:

	thumb_func_start sub_0803BA4C
sub_0803BA4C: @ 0x0803BA4C
	push {lr}
	bl sub_0803BA1C
	bl sub_080846F4
	lsls r0, r0, #0x18
	cmp r0, #0
	beq _0803BA64
	movs r0, #1
	bl sub_08038690
	b _0803BA6A
_0803BA64:
	movs r0, #0
	bl sub_08038690
_0803BA6A:
	bl sub_08016E74
	ldr r0, _0803BA80 @ =gUnknown_03003FC0
	movs r1, #1
	strb r1, [r0, #1]
	ldr r0, _0803BA84 @ =gUnknown_0849EB34
	movs r1, #3
	bl Proc_Start
	pop {r0}
	bx r0
	.align 2, 0
_0803BA80: .4byte gUnknown_03003FC0
_0803BA84: .4byte gUnknown_0849EB34

Which I tried injecting in Title_Tree3_08581CF8 proc like this:

ORG $581C68
WORD 2  
POIN 0x803BA4D
WORD 0 0 

It leads to a fun gif below. I think you need to inject the code somewhere else, or call custom code that does ProcEnd on some title screen procs to stop things like the screen scrolling or the start button flashing.

[TsilaAllaoui]

I'm a beginner in gba dev so can you tell me what to modify and where?
Also how you injected the code? Wich emu you are using?
And last, how yout script works?
Thanks in advance

[Eebit]

Hi! This decompilation is still in its very early days, so I'm afraid it won't be terribly useful as a hacking reference yet.

What Vesly is referring to (as far as "injecting") is an Event Assembler script. The command is essentially a recipe that says: "open the binary file, navigate to offset 0x581C68 (ORG 0x581C68) , then write 02 00 00 00 (WORD 2), 4D BA 03 08 (POIN 0x803BA4D), 00 00 00 00 00 00 00 00 (WORD 0 0)".

If you're interested, Event Assembler is a useful tool for ROM hacking that you can download here. It's quite popular in the FE ROM hacking scene, but it can be used more broadly as well. There are lots of useful tutorials about getting started with this tool, such as:

• https://tutorial.feuniverse.us/
• https://feuniverse.us/t/contros-buildfile-tutorial/14088
• https://github.com/Veslyquix/Guide#table-of-contents

Other useful "getting started" resources include:

• https://feuniverse.us/t/gbafe-assembly-for-dummies-by-dummies/3563
• https://feuniverse.us/t/guide-doc-asm-hacking-in-c-with-ea/3351
• https://feuniverse.us/t/guide-doc-asm-procs-or-6cs-coroutines-threads-fibers-funky-structs-whatever/3352 (discusses "procs" which are the way that the Intelligent Systems GBA games, e.g. Fire Emblem and Advance Wars, do parallel processing on the single-core GBA)

[Eebit]

For my part, I found that I could at least skip directly to the campaign from the title screen. The function at AW2U:0x0806CA84 (I'm tentatively calling this Title_StartMainMenu) is what hands control from the title screen (i.e. "Press Start") to the main menu where you can select Campaign, CO Mode, etc.

If you open a hex editor and go to 0x6CA94, then write 34 EB 49 08, you will directly start a new campaign after pressing start on the title screen. It may not be quite what you're looking for, but it gets us a bit closer:

In Event Assembler script:

// Start campaign from title screen (bypass main menu)
ORG 0x6CA94         // (AW2U:0x0806CA84)
POIN 0x0849EB34     // ProcScr_CampaignStart

This works because you're replacing the pointer to the address of the "proc script" (read more here) that usually starts the main menu with the one that starts a new campaign.

I'll try to spend some time decompiling this area of the code in the next few days and see what comes out of that, which may help me to understand what needs to be done to bypass the title screen altogether.

[TsilaAllaoui]

This is indeed a very good start, i think i have to give more context. I need this because on a SupercardSD flashcart on GBA, AW2 freeze after pressing start. So i'm testing if going directly to Campaign will work.
Also, in the decomp, is there a part of the code that change Waitcnt register waitstate? It's because SupercardSD only works on lowest speed possible, the fw patch this but maybe it's done in another way in the decomp/rom when pressing start on title screen.
If you are progressing in the decomp, can you try to find a way to do it. Or at least on rom start, directly go to first mission to test that it's the title screen press who freeze it. Thanks

[Veslyquix]

This is a problem with your flashcard, not something that should be changed in the rom itself. Cheap flashcards only support certain types of saves and would have poor compatibility with vanilla games, so they modify certain games' code to make saving possible. Your save file is probably created or referenced when you press start. Even if you manage to skip the title screen, it won't fix your freeze, because it will just freeze as soon as it needs to save/load something. Complain to your flashcard company, or buy a different card.

[TsilaAllaoui]

I know but it's for research purpose, the fw is open source so that's why i want to find a way but thanks. Also waht is the routine/way of saving of the game? Can it be modified to not save at all? or redirect the save routine to wrtie the save at somewhere else?

If it is not appropriate, we can close the issue.

Thanks

[Veslyquix]

Perhaps if you changed the 4 letter game identifying code in the gba rom header to something else, then their software wouldn't autopatch it with their modification that freezes the game. But it still wouldn't save properly.

It's up to eebit, but I think this should be closed and you should seek support related to your flashcard elsewhere. Sorry.

[TsilaAllaoui]

I'm just gonna try the hex edit for now and test.If it works, then great. If not, maybe wait for eebit to fully decompile saving routine and try later. I'm using the custom fw SuperFW by the way, not the crappy stock software they gave. If i manage to find how the save works, i may be find a custom fix for the game by recompling the custom fw.
We will wait for eebit to close this as this was just a way to contact him.
Thanks.

[TsilaAllaoui]

Little update, correct me if i'm worng somewhere:

• changed all value from 0x581E10..0x581E38 to 00 bypass intro cutscene
• changed 0x581502 and 0x581508 to 0 to not start child proc and not sleep (don't know for sure why though)
• 0x581C68 to 07 and 0x581C6C..0x581C6F to 18 E8 49 08 and 0x581C70 to 00 to go directly to main menu

With all that it works on the SuperCard SD but i get this weird text on bottom of the screen (leftovers from the title screen i guess).

Can you help me figure out how to remove this and maybe correct some step i did if it's not correct?

Thanks in advance.

Here is a preview of the output:

aw2.mp4

It crash with visual glitches in a battle animation though. I don't know if it is related to the modification i did.

[Veslyquix]

Vivi Blossom wrote this:

0x0806757C: 01 20
0x0806C9FA: C0 46
0x0806CA08: C0 46

This way it instantly boots to the main menu