The game only directly references Toronto by name. None of the other tracks are directly referenced.
(08-04-2025, 03:49 PM)checkpoint10 Wrote: [ -> ]ICR2Edit 0.5.2 - small update to allow signed integers. And editable in-car camera position (for the Rendition DOS32A version)!!!
![[Image: attachment.php?aid=2450]](https://www.icr2.net/forum/attachment.php?aid=2450)
Binary: https://skchow.com/icr2/icr2edit/icr2edit_0.5.2.zip
Github: https://github.com/skchow03/icr2edit
Excellent! What's the offset for the camera? I've been floundering with the track limit. There's a parameter which is tested against and its always 1. It's never set to 0 directly. But somehow this fails.
Aspect ratio controls can't be far off from the camera position.
If it's a standard matrix, z scaling should be 20 bytes before cam z, y scaling 20 bytes before and x scaling 20 bytes before that.
Is there any way to fix the backtrack behaviour for Ghidra 10.2.2? The newer versions could take you back to where you came from, but the behaviour is erratic with 10.2.2. So clicking on a function call I have to note down every single address I came from manually. It makes stepping into and then back out into the caller difficult.
(08-04-2025, 07:38 PM)sharangad Wrote: [ -> ]If it's a standard matrix, z scaling should be 20 bytes before cam z, y scaling 20 bytes before and x scaling 20 bytes before that.
Is there any way to fix the backtrack behaviour for Ghidra 10.2.2? The newer versions could take you back to where you came from, but the behaviour is erratic with 10.2.2. So clicking on a function call I have to note down every single address I came from manually. It makes stepping into and then back out into the caller difficult.
Well there is a keyboard shortcut for that. Just didn't work with the mouse.
(08-04-2025, 04:48 PM)sharangad Wrote: [ -> ] (08-04-2025, 03:49 PM)checkpoint10 Wrote: [ -> ]ICR2Edit 0.5.2 - small update to allow signed integers. And editable in-car camera position (for the Rendition DOS32A version)!!!
Binary: https://skchow.com/icr2/icr2edit/icr2edit_0.5.2.zip
Github: https://github.com/skchow03/icr2edit
Excellent! What's the offset for the camera? I've been floundering with the track limit. There's a parameter which is tested against and its always 1. It's never set to 0 directly. But somehow this fails.
I found the function that sets up the in-car cams at 3d404 and 3d588.
(08-05-2025, 04:09 PM)checkpoint10 Wrote: [ -> ] (08-04-2025, 04:48 PM)sharangad Wrote: [ -> ] (08-04-2025, 03:49 PM)checkpoint10 Wrote: [ -> ]ICR2Edit 0.5.2 - small update to allow signed integers. And editable in-car camera position (for the Rendition DOS32A version)!!!
Binary: https://skchow.com/icr2/icr2edit/icr2edit_0.5.2.zip
Github: https://github.com/skchow03/icr2edit
Excellent! What's the offset for the camera? I've been floundering with the track limit. There's a parameter which is tested against and its always 1. It's never set to 0 directly. But somehow this fails.
I found the function that sets up the in-car cams at 3d404 and 3d588.
Thanks for that! I traced the function through to where it does multiplication and integer division didn't follow through on the maths. The camera position is affected by the aspect ratio since it needs to be centred in the view.
I've found a magic teleport setting:
0x09 27C0 (600,000)
Swapping this out causes the car to randomly teleport off track.
0x000040000 is related to the sound. Sample buffer size of 16,384 (8 kHz stereo sampling).
No luck with the aspect ratio/viewing transform, view distance, track and memory limits, yet.
Buffer swaps are controlled by V_FIFO_DISPLAY (00000004, 32bit value 4), followed by V_FIFO_WAIT_DISPLAY_SWITCH(00000006). There're only small number of these in the game of 4s and a load of 6s. These 32 bit values have to be written out using either FIFO (with the out command or memory mapped IO) or DMA (write values to a contiguous block of RAM).
Other fully documented values used in the game, these are 32 bit. Some of them have vertex types in the upper 16 bits (the triangle rendering for instance). In general these occur in the lower 16 bits of a 32 bit value. Actually I think searching for V_FIFO_DISPLAY as a 32 bit value is wrong.
V_FIFO_CONTEXT_INIT is issued at startup:
#define V_FIFO_RESERVED0 0
#define V_FIFO_RESERVED1 1
#define V_FIFO_CONTEXT_INIT 2
#define V_FIFO_DISPLAY 4
#define V_FIFO_STEREO_DISPLAY 5
#define V_FIFO_WAIT_DISPLAY_SWITCH 6
#define V_FIFO_SYNC_AND_RESPOND 8
#define V_FIFO_MEM_WRITE 9
#define V_FIFO_MEM_WRITE_RECT 10
#define V_FIFO_MEM_CLEAR_RECT 13
#define V_FIFO_MEM_WRITE_SPRITE 14
#define V_FIFO_DOT 15
#define V_FIFO_LINE 16
#define V_FIFO_POLYLINE 17
#define V_FIFO_INTLINE 18
#define V_FIFO_INTPOLYLINE 19
#define V_FIFO_AALINE 20
#define V_FIFO_SPAN 21
#define V_FIFO_SQUARE 22
#define V_FIFO_RECTANGLE 23
#define V_FIFO_TRIANGLE 24
#define V_FIFO_AAEDGE 25
#define V_FIFO_TRISTRIP 26
#define V_FIFO_TRIFAN 27
#define V_FIFO_AFFINE 28
#define V_FIFO_WARP 29
#define V_FIFO_BITBLT 30
#define V_FIFO_BITFILL 31
#define V_FIFO_RLEHACK 32
#define V_FIFO_PALETTE 33
#define V_FIFO_TIMER_FUNCS 34
#define V_FIFO_FRAME_MARKER 35
#define V_FIFO_COMPOSITE_RECT 36
#define V_FIFO_PARTICLES 37
#define V_FIFO_TRI_FILL 38
#define V_FIFO_QSPAN 39
#define V_FIFO_QLIGHT 40
#define V_FIFO_BITBLT_MEM 41
#define V_FIFO_LOOKUP 42
#define V_FIFO_QAAZEDGE 43
#define V_FIFO_FTRI_KXYZ 48
#define V_FIFO_FTRI_KXYZUVQ 49
#define V_FIFO_FTRI_KFXYZUVQ 50
#define V_FIFO_FTRI_KSXYZ 51
#define V_FIFO_FTRI_KSXYZUVQ 52
#define V_FIFO_D3DTRI 54
#define V_FIFO_D3DTRI_ODD 55
#define V_FIFO_D3DTRI_EVEN 56