jsgroth / jgenesis

Sega Genesis / Sega CD / SNES / Master System / Game Gear emulator
MIT License
56 stars 3 forks source link

Arkagis Revolution (World) (En,Fr,Es) (Beta) (2020-03-04) (Aftermarket) (Unl).md crashes out emulator #123

Closed benderscruffy closed 2 weeks ago

jsgroth commented 3 months ago

This seems to depend on $A11100 almost immediately reading 0 after the 68000 sets the Z80 BUSREQ line via writing to $A11100, due to a buggy loop in the game code:

move.w #0x0100, ($A11100)   ; set Z80 BUSREQ
btst #0, ($A11100)          ; test Z80 BUSACK
bne -14                     ; bugged instruction, should be either `bne -18` or `bne -10`

If it ever takes that branch then it will jump to an address halfway through the MOVE.W instruction, which causes it to get into an infinite loop:

or.l #0x11000839, -(a1)
or.b #0xA0, d0
move.b d0, -(a0)
bne -14      ; always taken because the zero flag is always false after the above instructions