MMBN6 Reverse Engineering

Hello everyone, it has been a long time since i posted something here, however i will try to post more often with random things that I do/I have done in my free time. For now i will talk about something that i have been working on lately.

Every fan of the Mega Man  series, will probably know that Mega Man Battle Network 6 is for the Game Boy Advance. I really like this game and i wanted to learn more about how the game works. I was searching on Google about ROM Hacks and found a forum with some good information, that is called The Rockman X Zone, There I found some skilled people which are working withMMBN6 as well(For example GreigaMaster made a thread with some addresses and how to write your own custom attack chip !). Anyway, I started digging in the MMBN6 ROM(to be more exact, the cybest falzar one).
To people who aren’t familar with the GBA Architecture, it uses an ARMv4(ARM7TDMI) and is very well documented in GBATek. With documentation in hands, a good dissasembler(i personally like IDA Pro) and NO$GBA Debugger i started looking into the game’s structure. I found some interesting stuff and did some pseudoC and notations(looking at memory while i played the game), All of this can be found in my page dedicated to this dissasembly. I probably won’t finish this project, but I believe that it will help other people that want explore this game engine, i will update whenever i have time !. By the way, if you want explore this world, here some hints:

First of all you will need a good dissasembler, IDA Pro has a plugin with support to ARM processors, You may find it the internet. The second part is knowing how map the memory segments in IDA Pro. You will need use these segments:

08000000 -> Game Code(You may specify this when IDA asks where the code begins).
02000000 -> WRAMo
03000000 -> WRAMc
04000000 -> IOREG
05000000 -> CRAM
06000000 -> VRAM
07000000 -> OAM
0E000000 -> SRAM

So after you map the segments regions, you will need use the debugger version of NO$GBA, which you may find this in their official page, with everything in hand, you may use the breakpoints and try find how each function work, for example: you found a function in IDA Pro which stores information in the OAM(Object Attribute Memory), so you can use a breakpoint in NO$GBA at this address and look at what happen when the function is loaded, the values of registers and what is loaded in the OAM. This way you can figure out in how this funcitons is used.

So that is all, until next time.