Debugging VRAM strategies

By Averre

Supporter (2)

Averre's picture

19-11-2018, 23:32

New to the MSX world here and have for the last few days been playing around with debugging a game in openmsx.
I've gotten acquainted with the data format of the pattern generator table and others, and wrote some code to draw the tables and nametables as PNG images, based on dumped VRAM from openmsx.

But what I would like to do now is find out the source of the data in ROM, and I'm having a hard time coming up with debugging strategies.
So I thought that people here might have som tips and tricks to accomplish what I'm trying to do.

Platform: MSX1
VDP: TMS9918a
Screen mode: M=4; SCREEN 2
Pattern generator table address: 02000

If I have understood correctly, it's not possible to add watchpoints to VRAM read/write. Correct?
I tried add watchpoints to the I/O ports 0x98 and 0x99. Is my assumption correct that the value 0x60 has to be
written to the I/O port 0x98 to write to the base of the pattern generator table?

So has anyone else attempted to do something similar?
Are there better ways of accomplishing what I'm trying to do?
What are your strategies when dissassembling a game?

Any help is appreciated! Cheers!

Login or register to post comments

By wouter_

Champion (417)

wouter_'s picture

20-11-2018, 12:39

Here's a script that will trace all vram writes:

set vram_write_trace 1

debug set_watchpoint write_io 0x98 {$::vram_write_trace} print_vram_write

proc vram_pointer {} {
    expr {[debug read "VRAM pointer" 0] + 256 * [debug read "VRAM pointer" 1]}

proc print_vram_write {} {
    puts stderr [format "vram\[0x%04x\] = 0x%02x" [vram_pointer] $::wp_last_value]

Save this to e.g. "vram_write_trace.tcl" and either place this file in your openmsx/share/scripts directory or pass this file as an extra parameter on the openMSX command line.

Now any write to VRAM will be logged to stderr (it will be visible in the terminal from which you started openMSX). You can pause tracing by executing "set vram_write_trace 0" in the openMSX console, and resume tracing with "set vram_write_trace 1".

By Averre

Supporter (2)

Averre's picture

22-11-2018, 01:05

Thanks! Works great!


Enlighted (6238)

ARTRAG's picture

01-05-2019, 23:41

Question: how can I add a breakpoint on the change of a given VRAM area?
I want to break the execution of the section of a given rom that writes at 2008h-2010 in VRAM

By wouter_

Champion (417)

wouter_'s picture

02-05-2019, 08:45

ARTRAG wrote:

Question: how can I add a breakpoint on the change of a given VRAM area?

You can modify the above Tcl script to, instead of logging, execute 'debug break' when 'vram_pointer' is inside the desired region. Note that this only works for CPU->VRAM writes, not for VRAM writes triggered by the VDP command engine.

OpenMSX has a general watchpoint mechanism for the CPU-address-space accesses, but not for other memory regions (like VRAM or sample ram, ...). The reason is that the former can be implemented with zero-overhead. That is when no watchpoints are in use (the common case), the emulation speed is exactly the same as-if openMSX did not implement this feature at all. Watchpoints on other regions 1) will have overhead, 2) are not that often needed and 3) can often be approximated by CPU-memory or CPU-IO watchpoints (like in the script above).