OTOGI [Otogi: Myth of Demons] [FS-002] [1.02]

[PatrickvL]

Wikipedia

From @jackchentwkh on April 1, 2017 2:57

Title Name: Otogi Myth of Demons XDK: 5558 Current Status: Crash/black screen. the title crashed after a certain period of black screen. the log shows an unsupported ADPCM sound stream, and some shaders generated. Xbe.txt KrnlDebug.txt

Copied from original issue: Cxbx-Reloaded/Cxbx-Reloaded#312

[ObiKKa]

This game manages to get in-game. The menus are not perfect with some garbled pictures (Be careful of the blue/purple circles) enlarging and covering up parts of the screen. Some menu text have black rectangles behind and others are blacked out. Hardly anything to see in-game, it's mostly black. There are only the unreadable in-game text. Hangs with the external fatal message:

* PushBuffer has fixups

• Cxbx-Reloaded Xbox Emulator - Otogi Intro / Ingame! (d52cc2d + WIP) (John GodGames Emus. Published on Mar 5, 2018.)

[MylesInglis]

Crashes on boot since this PR: https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/pull/1913

[0x4858] FATAL: X86 Popup : Received Exception Code 0xC0000005 @ EIP := 0x0007020C(=D3DDevice__m_VertexShader_OFFSET+0x6fe90)

[legolas119]

the game doesn't start, there is a black screen. I'm using the latest cxbx reloaded version (5 oct 2020)

[jackchentwkh]

try to debug the Otogi loading crash with current master bulid, found that it should be a issue with an inproperly initialized Dsound object. but couldn't figer out the true cause.

CXBXR current master, GAME Title: FS-002 v1.02 (OTOGI) game crashed while loading

crash prompt:

0007020c access violation, exception C0000005

reading address 0x00000000

guest code: .text:00070202 FF 52 14 call dword ptr [edx+14h] .text:00070205 85 C0 test eax, eax .text:00070207 74 C2 jz short loc_701CB .text:00070209 8B 4F 08 mov ecx, [edi+8]

EAX = 00000001 EBX = 00602D30 ECX = 00000001 EDX = 04650AF8 ESI = 00603130 EDI = 00603040 EIP = 00070209 ESP = 08ECFD70 EBP = 00000000 EFL = 00000202

0x00603048 = 00000000

.text:0007020C 8B 11 mov edx, [ecx]

ECX is a member of directSound object, this code is inside a member function of CSoundEffectManager

call stack: cxbxr-ldr.exe!0007020c() C++ sub_70120 EAX = 00603110 EBX = 00602D30 ECX = 00603040 EDX = 00183DD4 ESI = 00603040 EDI = 098EFE20 EIP = 00070120 ESP = 098EFDD8 EBP = 00602D20 EFL = 00000202

cxbxr-ldr.exe!0006fc12() C++ sub_6FBF0 EAX = 06B80840 EBX = 00602D30 ECX = 00603040 EDX = 00183DD4 ESI = 00602D20 EDI = 098EFE20 EIP = 0006FBF0 ESP = 098EFDE4 EBP = 00602D20 EFL = 00000202

cxbxr-ldr.exe!00076010() C++ sub_75fa0 InitDirectSound() sub_75FA0 EAX = 098DFE20 EBX = 0060CD90 ECX = 00602D20 EDX = 0060D02C ESI = 00000000 EDI = 00603110 EIP = 00075FA0 ESP = 098DFE04 EBP = 00602D20 EFL = 00000202

text:0007021F 8B 4F 08 mov ecx, [edi+8] .text:00070222 8B 01 mov eax, [ecx]

same address access @70222

call stack as below

cxbxr-ldr.exe!00041173() C++ cxbxr-ldr.exe!00041402() C++ cxbxr-ldr.exe!000f2e69() C++ cxbxr-ldr.exe!000e43a4() C++ cxbxr-ldr.exe!000e2f97() C++

by bisecting PRs, Apr 27 PR1879 is OK f296639 May 18 PR#1901 is ok d1580cd May 29 PR#1911 regressed this game

by comparing the functional build and recent build. I found that the access violations are the same. there are some unknown bugs causing an uninitialized variable in the game's sound effect class member. and old functional build has it's own exception handler which allows the game to proceed execution and feedback 0 for those access violation. recent build raised up error message window directly and refuse to proceed execution. that's the 2nd cause of recent build not getting this game in game.

patching 7020C to xor edx, edx 31 D2 original binary: 8B 11 52 5D 4F 14 E8 A9 FC CHANGE 8B 11 TO 31 D2

patching 70222 to xor eax, eax 31 c0 ORIGINAL BINARY: 8B 01 33 F6 3B C5 76 46 53 33 DB CHANGE 8B 01 TO 31 C0

pathcing these two places and not to use "loader executable" option, will get Otogi ingame. EDIT: with these two patches applied, the loader executable could get Otogi ingame, too.

by patching the game with 2 patches, recent build can get this game in game again. and there are further graphic related test cases appear as below:

LOG_TEST_CASE: FVF without position In XboxVertexShaderFromFVF (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbVertexShader.cpp line 131)

LOG_TEST_CASE: Unassigned Xbox vertex shader! In GetXboxVertexShader (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbVertexShader.cpp line 272)

LOG_TEST_CASE: Xbox should always have a VertexShader set (even for FVF's) In GetXboxVertexAttributeFormat (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbVertexShader.cpp line 360)

LOG_TEST_CASE: PS_TEXTUREMODES_PASSTHRU In GetPSTextureModes (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPixelShader.cpp line 246)

LOG_TEST_CASE: PushBuffer has fixups In EmuExecutePushBuffer (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 57)

LOG_TEST_CASE: Pushbuffer COMMAND_INSTRUCTION_JUMP In EmuExecutePushBufferRaw (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 498)

LOG_TEST_CASE: Last pushbuffer instruction exceeds END of Data In EmuExecutePushBufferRaw (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 434)

LOG_TEST_CASE: Pushbuffer COMMAND_FLAGS_RETURN with additional bits?! In EmuExecutePushBufferRaw (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 519)

LOG_TEST_CASE: Pushbuffer COMMAND_FLAGS_SLI_CONDITIONAL (NV40+) not available on NV2A In EmuExecutePushBufferRaw (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 537)

LOG_TEST_CASE: Pushbuffer COMMAND_TYPE unknown In EmuExecutePushBufferRaw (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 488)

LOG_TEST_CASE: pViewport = null In CxbxImpl_SetViewport (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\Direct3D9\Direct3D9.cpp line 4114)

LOG_TEST_CASE: Pushbuffer COMMAND_TYPE_JUMP_LONG In EmuExecutePushBufferRaw (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 469)

LOG_TEST_CASE: Pushbuffer COMMAND_TYPE_CALL In EmuExecutePushBufferRaw (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 480)

LOG_TEST_CASE: Pushbuffer COMMAND_TYPE_CALL while another call was active! In EmuExecutePushBufferRaw (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 475)

LOG_TEST_CASE: Pushbuffer COMMAND_INSTRUCTION unknown In EmuExecutePushBufferRaw (D:\a\Cxbx-Reloaded\Cxbx-Reloaded\src\core\hle\D3D8\XbPushBuffer.cpp line 506)