Native sleep mode fix patches for EZ-FLASH IV

[patters]

Like the thread about idle loop fixes, what follows here is more information that was lost with the demise of the ezflash.sosuke.com forum.

Although the newer 2.0x firmwares for the EZ-FLASH IV contain a sleep patcher (GSS), this more often than not brings its own compatibility issues - with many games failing to work at all, or developing strange faults like failing to work reliably during serial comms in multiplayer mode.

However, many first party Nintendo GBA games contain their own sleep mode functions, but these don't work properly when using an EZ-FLASH IV. They will wake the GBA instantly when engaged, apparently because the EZ-FLASH generates spurious gamepak interupts. Back in the day, ROM patches were figured out to fix many of them. This was difficult information to track down in the present day.
https://web.archive.org/web/20180904111600/https://ezflash.sosuke.com/viewtopic.php?f=16&t=12662
https://web.archive.org/web/2018090...osuke.com/wiki/index.php?title=GBA_sleep_mode

The format used for these patches was rather non-standard, depending on a Windows binary tool called hexalter. I decided to read the specification for IPS patches, and convert them so they're a bit more cross-platform friendly, and I have added a few more patches where some variants or regions of the game were missing. Since the Good ROM tools and their naming conventions seem to have disappeared I have added the crc32 checksum of the target ROM file to each IPS patch filename, so that you can verify that you have the specific ROM version which each patch expects.

Here are the games which can be fixed, IPS patches for each are attached:

[EDIT - updated on 02/08/23]

Baldur's Gate - Dark Alliance (E)
Baldur's Gate - Dark Alliance (U)
Bit Generations Dial Hex (J)
Classic NES Series - Bomberman (UE)
Classic NES Series - Castlevania (UE)
Classic NES Series - Donkey Kong (UE)
Classic NES Series - Dr. Mario (UE)
Classic NES Series - Excitebike (UE)
Classic NES Series - Ice Climber (UE)
Classic NES Series - Metroid (UE)
Classic NES Series - Pac-Man (UE)
Classic NES Series - Super Mario Bros. (UE)
Classic NES Series - The Legend of Zelda (UE)
Classic NES Series - Xevious (UE)
Classic NES Series - Zelda II - The Adventure of Link (UE)
Dr. Mario & Puzzle League (E)
Dr. Mario & Puzzle League (U)
Drill Dozer (U)
Famicom Mini 01 - Super Mario Bros. (J) (Rev 1)
Famicom Mini 02 - Donkey Kong (J)
Famicom Mini 03 - Ice Climber (J)
Famicom Mini 04 - Excitebike (J)
Famicom Mini 05 - Zelda no Densetsu 1 - The Hyrule Fantasy (J)
Famicom Mini 06 - Pac-Man (J)
Famicom Mini 07 - Xevious (J)
Famicom Mini 08 - Mappy (J)
Famicom Mini 09 - Bomber Man (J)
Famicom Mini 10 - Star Soldier (J)
Famicom Mini 11 - Mario Bros. (J)
Famicom Mini 12 - Clu Clu Land (J)
Famicom Mini 13 - Balloon Fight (J)
Famicom Mini 14 - Wrecking Crew (J)
Famicom Mini 15 - Dr. Mario (J)
Famicom Mini 16 - Dig Dug (J)
Famicom Mini 17 - Takahashi Meijin no Bouken Jima (J)
Famicom Mini 18 - Makaimura (J)
Famicom Mini 19 - Twin Bee (J)
Famicom Mini 20 - Ganbare Goemon! - Karakuri Douchuu (J)
Famicom Mini 21 - Super Mario Bros. 2 (J)
Famicom Mini 22 - Nazo no Murasame Jou (J)
Famicom Mini 23 - Metroid (J)
Famicom Mini 24 - Hikari Shinwa - Palthena no Kagami (J)
Famicom Mini 25 - The Legend of Zelda 2 - Link no Bouken (J)
Famicom Mini 26 - Famicom Mukashibanashi - Shin Onigashima - Zen, Kouhen (J)
Famicom Mini 27 - Famicom Tantei Club - Kieta Koukeisha - Zen, Kouhen (J)
Famicom Mini 28 - Famicom Tantei Club Part II - Ushiro ni Tatsu Shoujo - Zen, Kouhen (J)
Famicom Mini 29 - Akumajou Dracula (J)
Famicom Mini 30 - SD Gundam World - Gachapon Senshi Scramble Wars (J)
Golden Sun (UE)
Legend of Zelda, The - A Link To The Past Four Swords (E)
Legend of Zelda, The - A Link To The Past Four Swords (U)
Legend of Zelda, The - The Minish Cap (E)
Legend of Zelda, The - The Minish Cap (U)
Metroid - Zero Mission (E)
Metroid - Zero Mission (U)
Metroid Fusion (E)
Metroid Fusion (U)
Mother 3 (J)
Scurge - Hive (E)
Super Mario Advance 3 - Yoshi's Island (E)
Super Mario Advance 3 - Yoshi's Island (U)
Super Mario Advance 4 - Super Mario Bros. 3 (E) (Rev 1)
Super Mario Advance 4 - Super Mario Bros. 3 (E)
Super Mario Advance 4 - Super Mario Bros. 3 (U) (Rev 1)
Super Mario Advance 4 - Super Mario Bros. 3 (U)

Enjoy!

 

[hippy dave]

This is great, thanks for sharing. Reading the old thread about how they work, I'm hopeful they'll fix the same issue on the Omega too, I noticed it when playing Metroid Fusion.

 

[patters]

Good point, I think I did read somewhere that they should also work on the Omega. Let me know if that's the case and I will update the thread title to show that (I don't own an Omega).

 

[patters]

Uploaded to GitHub:
https://github.com/patters-syno/gba-ezflash-sleep-fixes

 

[The Real Jdbye]

Like the thread about idle loop fixes, what follows here is more information that was lost with the demise of the ezflash.sosuke.com forum.

Although the newer 2.0x firmwares for the EZ-FLASH IV contain a sleep patcher (GSS), this more often than not brings its own compatibility issues - with many games failing to work at all, or developing strange faults like failing to work reliably during serial comms in multiplayer mode.

However, many first party Nintendo GBA games contain their own sleep mode functions, but these don't work properly when using an EZ-FLASH IV. They will wake the GBA instantly when engaged, apparently because the EZ-FLASH generates spurious gamepak interupts. Back in the day, ROM patches were figured out to fix many of them. This was difficult information to track down in the present day.
https://web.archive.org/web/20180904111600/https://ezflash.sosuke.com/viewtopic.php?f=16&t=12662
https://web.archive.org/web/2018090...osuke.com/wiki/index.php?title=GBA_sleep_mode

The format used for these patches was rather non-standard, depending on a Windows binary tool called hexalter. I decided to read the specification for IPS patches, and convert them so they're a bit more cross-platform friendly, and I have added a few more patches where some variants or regions of the game were missing. Since the Good ROM tools and their naming conventions seem to have disappeared I have added the crc32 checksum of the target ROM file to each IPS patch filename, so that you can verify that you have the specific ROM version which each patch expects.

Here are the games which can be fixed, IPS patches for each are attached:

Baldur's Gate - Dark Alliance (E)
Baldur's Gate - Dark Alliance (U)
Bit Generations Dial Hex (J)
Dr. Mario & Puzzle League (E)
Dr. Mario & Puzzle League (U)
Drill Dozer (U)
Legend of Zelda, The - A Link To The Past Four Swords (E)
Legend of Zelda, The - A Link To The Past Four Swords (U)
Legend of Zelda, The - The Minish Cap (E)
Legend of Zelda, The - The Minish Cap (U)
Metroid - Zero Mission (E)
Metroid - Zero Mission (U)
Metroid Fusion (E)
Metroid Fusion (U)
Mother 3 (J)
Scurge - Hive (E)
Super Mario Advance 3 - Yoshi's Island (E)
Super Mario Advance 3 - Yoshi's Island (U)
Super Mario Advance 4 - Super Mario Bros. 3 (E)
Super Mario Advance 4 - Super Mario Bros. 3 (E) (Rev 1)
Super Mario Advance 4 - Super Mario Bros. 3 (U)
Super Mario Advance 4 - Super Mario Bros. 3 (U) (Rev 1)

Enjoy!

No-Intro is what you want these days, and ClrMamePro can be used with the DAT files from No-Intro, instead of GoodTools.

 

[patters]

For the odd check I do from time to time I use the website for the no-intro database:
https://datomatic.no-intro.org/index.php?page=search&s=23

That's what I used for retrieving the crc32 values in my IPS patch filenames. It's surprising that the IPS format never included any validation of the target file though.

 

[patters]

This is great, thanks for sharing. Reading the old thread about how they work, I'm hopeful they'll fix the same issue on the Omega too, I noticed it when playing Metroid Fusion.

Did these patches also work on the Omega btw @hippy dave ?

 

[hippy dave]

Did these patches also work on the Omega btw @hippy dave ?

I... didn't check yet. Will try to do that soon!

 

[DanTheManMS]

I take it you've probably already got this figured out, but I have the source code for that "hexalter" program stored here if that would help you in any way. You've already determined that it's pretty simplistic.

 

[patters]

Created a bunch more patch files on the GitHub repo
https://github.com/patters-syno/gba-ezflash-sleep-fixes

• Added additional patches for the games detailed in this forum thread, namely:
  • Golden Sun
  • All 12 Classic NES Series titles
  • 4 Famicom Mini titles
• Updated the patches for Super Mario Advance 3 - Yoshi's Island and Super Mario Advance 4 - Super Mario Bros. 3 (all variants), using the enhancements from that same thread.

If anyone makes any new ones, please do fork the repo and create a pull request.

 

[patters]

The good news:

By searching for similar code regions in other ROMs I have now published sleep patches for 22 more games in the Famicom Mini Series. Series 2 & 3 are complete. However there are 4 titles in Series 1 which are divergent.

• Famicom Mini series 1
• Famicom Mini series 2
• Famicom Mini (Disk System) series 3

I for one hadn't realised that series 3 was specifically FDS games, and only recently when I reimplemented the builder for HVCA in Python did I realise that the FDS had better audio for many of these titles than the later cartridge releases. Though I like the scaling in HVCA, I do think Nintendo did a good job on curating these official titles to fit the GBA screen resolution.

In this forum thread it explains a method to find the sleep patch location. I have run through this with the games that I can successfully patch, and I can confirm that the code jumps to Thumb instructions in ROM after 0x08000000, as described.


The not so good:

However, there are 4 games that use a different method to invoke their sleep function:

• Famicom Mini 04 - Excitebike (J)
• Famicom Mini 05 - Zelda no Densetsu 1 - The Hyrule Fantasy (J)
• Famicom Mini 09 - Bomber Man (J)
• Famicom Mini 10 - Star Soldier (J)

For these titles, if I use the disassembler to step through the instructions after triggering sleep from the menu I see ARM instructions running from 0x06000000 which is VRAM. I don't ever see a mov instruction loading 0xC0 into a register, and there are no Thumb instructions. Furthermore if I take a specific one of these ARM instructions and then search the ROM for it - I don't find any mention, even if I flip it to the opposite endianness. So even if I found the actual instructions that trigger the sleep mode, I would be unable to determine where they came from in the ROM, to create a patch. Is it compressed data that's unpacked to VRAM perhaps?

Anyone up for the challenge of unravelling the sleep function used in these four games?

 

[TechieSaru]

The good news:

By searching for similar code regions in other ROMs I have now published sleep patches for 22 more games in the Famicom Mini Series. Series 2 & 3 are complete. However there are 4 titles in Series 1 which are divergent.

• Famicom Mini series 1
• Famicom Mini series 2
• Famicom Mini (Disk System) series 3

I for one hadn't realised that series 3 was specifically FDS games, and only recently when I reimplemented the builder for HVCA in Python did I realise that the FDS had better audio for many of these titles that the later cartridge releases. Though I like the scaling in HVCA, I do think Nintendo did a good job on curating these official titles to fit the GBA screen resolution.

In this forum thread it explains a method to find the sleep patch location. I have run through this with the games that I can successfully patch, and I can confirm that the code jumps to Thumb instructions in ROM after 0x08000000, as described.


The not so good:

However, there are 4 games that use a different method to invoke their sleep function:

• Famicom Mini 04 - Excitebike (J)
• Famicom Mini 05 - Zelda no Densetsu 1 - The Hyrule Fantasy (J)
• Famicom Mini 09 - Bomber Man (J)
• Famicom Mini 10 - Star Soldier (J)

For these titles, if I use the disassembler to step through the instructions after triggering sleep from the menu I see ARM instructions running from 0x06000000 which is VRAM. I don't ever see a mov instruction loading 0xC0 into a register, and there are no Thumb instructions. Furthermore if I take a specific one of these ARM instructions and then search the ROM for it - I don't find any mention, even if I flip it to the opposite endianness. So even if I found the actual instructions that trigger the sleep mode, I would be unable to determine where they came from in the ROM, to create a patch. Is it compressed data that's unpacked to VRAM perhaps?

Anyone up for the challenge of unravelling the sleep function used in these four games?

Done. All four of these were setting up sleep mode in ARM mode, which is why they were different.

 

[patters]

Excellent! I have added those to the repo and credited you in the Readme. Updated the first post above with the full list. Thanks for your help. Famicom Mini collection complete!

EDIT - Would you be able to post an anotated disassembly of the part that invokes the sleep, to show how you figured it out? I've taken a look at that region and it looks very complex (loads of conditional instructions etc.). It might be useful to someone else at some future time, perhaps for another game. Plus I am personally curious, to improve my reverse engineering skills