Secret of Evermore/Alchemy RAM manipulation

This is a sub-page of Secret of Evermore.

Affects of the Alchemy Crash to a Player

Details

Usually there are only up to 2-3 spells active, because the game limits how many can be cast:

• The boy has an internal cooldown on opening the ring menu after using alchemy
• Bosses have some kind of internal cooldown
• Only 8 alchemy spells per type can be active at any given moment
  • Projectile type alchemy (like Flash and Fireball)
  • Animation type alchemy (like Crush and Acid Rain)

But there are known ways to circumvent these limitations:

• Opening the boys ring menu as the dog can be done once per frame (Also known as 8cast, because the same spell can be cast up to 8 times)
• Bosses cast their spells regardless of the limit (Which can lead to a crash, if 8 spells of that type are already active)
  • Magmar casts at a certain damage threshold Heat Wave, which is an animation spell
  • Aquagoth randomly casts Lightning Storm and other spells, which are animation spells
  • Verminator randomly casts Acid Rain and other spells, which is are animation spells

Additional facts:

• The 2x8 alchemy slots aren't cleared once the spell has been resolved, they are just flagged as inactive (Leaving the game overrides all memory with zeros, though)

Crash

Once the game tries to put the 9th alchemy spell in a slot the game somewhat freezes:

• The game no longer progresses states
  • User inputs are blocked
  • Spell projectiles stop moving
  • Enemies stop moving
• The music keeps playing

Reproducing the Crash

Preparation:

• Read up on 8casts
• Stock up on ingredients and/or Call Beads

Triggered by a Boss

• Damage Magmar if neccessary (Heat Wave is triggered by a damage threshold)
• Cast 8 animation spells via 8cast (E.g. Storm from Fire Eyes Call Beads)
• Magmar will cast Heat Wave in response to the damage
• The game tries to adds a 9th animation spell in a slot (Sometimes refereed to as 9cast)
• The game "freezes"

With Screen Transitions

• 8cast on an enemy near a map exit
• Leave the screen instantly
• The game ends up in a buggy state, where the information of the 8cast is being stored somehow (Similar to to a 9cast)
• Once the next spell is being cast the game "freezes"

Manipulating Memory

Affects on the Hardware

S-CPU:

• 99% of crashes end up in a "freeze" (S-CPU comes to a halt)
• The rest of the crashes aren't freezing the game, but produce severe visual glitches (The S-CPU keeps going)
  • Black screen
  • Repeating patterns
  • Colorful forms

Sound:

• Unaffected

Details on the Crash

Casting 6 Hard Balls in the transition leads to the game crashing on the next 3+cast, which in almost all cases looks the same:

9198f7 ldx $0014,y   [7e3378] A:000a X:0000 Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 72 H:226 F:48
9198fa beq $9907     [919907] A:000a X:d22c Y:3364 S:1ff1 D:0000 DB:7e NvmxdizC V: 72 H:236 F:48
9198fc lda $0028,y   [7e338c] A:000a X:d22c Y:3364 S:1ff1 D:0000 DB:7e NvmxdizC V: 72 H:239 F:48
9198ff sta $4c       [00004c] A:4e89 X:d22c Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 72 H:249 F:48
919901 jsl $919750   [919750] A:4e89 X:d22c Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 72 H:256 F:48
919750 lda $910000,x [91d22c] A:4e89 X:d22c Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 72 H:270 F:48
919754 tax                    A:800a X:d22c Y:3364 S:1fee D:0000 DB:7e NvmxdizC V: 72 H:279 F:48
919755 jsr ($8000,x) [91000a] A:800a X:800a Y:3364 S:1fee D:0000 DB:7e NvmxdizC V: 72 H:282 F:48
00885f stp                    A:800a X:800a Y:3364 S:1fe8 D:0000 DB:7e NvmxdIzC V: 72 H:312 F:48

Address/Value	Register/Usage	Comment
0x7e3378 (16 bit)	X	Is the 14th and 15th byte of the first animation alchemy slot (7E3364-7E3563, 40 bytes per slot)
0x7e338c (16 bit)	A	Is the 28th and 29th byte of the first animation alchemy slot (7E3364-7E3563, 40 bytes per slot)
0x910000	Base jump address	Bank $91 mirrors bank $11 ($0000-$1FFF refer to LowRAM)
#8000	Jump offset	-

Which means that the jump address can be altered, by casting alchemy. Animation alchemy, which ends up in the first animation alchemy slot, to be specific.

Manipulating the Jump Address

Alchemy	Possible 0x7e3378 Values	Comment
Hard Ball (Or any other projectile type alchemy)	0x00	Projectile based alchemy does not alter the first animation spell slot
Acid Rain	0x00, 0xF0, 0xF2, 0xFE, 0x16, 0x1C, 0x1E, 0x22, 0x26	Contains two animations
Shield	0x00, 0x2A, 0x2C, 0x32, 0x40, 0x44	-

6 Hard Balls + 3 Hard Balls → 0x91000a:

9198f7 ldx $0014,y   [7e3378] A:000a X:0000 Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 72 H:226 F:48
9198fa beq $9907     [919907] A:000a X:d22c Y:3364 S:1ff1 D:0000 DB:7e NvmxdizC V: 72 H:236 F:48
9198fc lda $0028,y   [7e338c] A:000a X:d22c Y:3364 S:1ff1 D:0000 DB:7e NvmxdizC V: 72 H:239 F:48
9198ff sta $4c       [00004c] A:4e89 X:d22c Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 72 H:249 F:48
919901 jsl $919750   [919750] A:4e89 X:d22c Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 72 H:256 F:48
919750 lda $910000,x [91d22c] A:4e89 X:d22c Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 72 H:270 F:48
919754 tax                    A:800a X:d22c Y:3364 S:1fee D:0000 DB:7e NvmxdizC V: 72 H:279 F:48
919755 jsr ($8000,x) [91000a] A:800a X:800a Y:3364 S:1fee D:0000 DB:7e NvmxdizC V: 72 H:282 F:48
00885f stp                    A:800a X:800a Y:3364 S:1fe8 D:0000 DB:7e NvmxdIzC V: 72 H:312 F:48

6 Hard Balls + 3 Hard Balls + 1 Acid Rain → 0x918300:

9198f7 ldx $0014,y   [7e3378] A:000a X:0000 Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 62 H: 28 F:22
9198fa beq $9907     [919907] A:000a X:ff85 Y:3364 S:1ff1 D:0000 DB:7e NvmxdizC V: 62 H: 38 F:22
9198fc lda $0028,y   [7e338c] A:000a X:ff85 Y:3364 S:1ff1 D:0000 DB:7e NvmxdizC V: 62 H: 41 F:22
9198ff sta $4c       [00004c] A:4e89 X:ff85 Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 62 H: 51 F:22
919901 jsl $919750   [919750] A:4e89 X:ff85 Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 62 H: 58 F:22
919750 lda $910000,x [91ff85] A:4e89 X:ff85 Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 62 H: 72 F:22
919754 tax                    A:0300 X:ff85 Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 62 H: 81 F:22
919755 jsr ($8000,x) [918300] A:0300 X:0300 Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 62 H: 84 F:22
91001a rol $ff00     [7eff00] A:0300 X:0300 Y:3364 S:1fec D:0000 DB:7e nvmxdizC V: 62 H: 97 F:22
91001d sbc $000000,x [000300] A:0300 X:0300 Y:3364 S:1fec D:0000 DB:7e nvmxdizc V: 62 H:112 F:22
00885f stp                    A:c8c1 X:0300 Y:3364 S:1fe8 D:0000 DB:7e NvmxdIzc V: 62 H:150 F:22

6 Hard Balls + 3 Hard Balls + 1 Shield → 0x91004e:

9198f7 ldx $0014,y   [7e3378] A:000a X:0000 Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 78 H: 74 F:53
9198fa beq $9907     [919907] A:000a X:004e Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 78 H: 84 F:53
9198fc lda $0028,y   [7e338c] A:000a X:004e Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 78 H: 87 F:53
9198ff sta $4c       [00004c] A:4e89 X:004e Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 78 H: 97 F:53
919901 jsl $919750   [919750] A:4e89 X:004e Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 78 H:104 F:53
919750 lda $910000,x [91004e] A:4e89 X:004e Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 78 H:117 F:53
919754 tax                    A:00b2 X:004e Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 78 H:127 F:53
919755 jsr ($8000,x) [9180b2] A:00b2 X:00b2 Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 78 H:130 F:53
918988 bit $00,x     [0000b2] A:00b2 X:00b2 Y:3364 S:1fec D:0000 DB:7e nvmxdizC V: 78 H:153 F:53
91898a cop #$00               A:00b2 X:00b2 Y:3364 S:1fec D:0000 DB:7e nvmxdizC V: 78 H:162 F:53
00885e stp                    A:00b2 X:00b2 Y:3364 S:1fe8 D:0000 DB:7e nvmxdIzC V: 78 H:177 F:53

6 Hard Balls + 1 Shield + 3 Hard Balls → 0x918300:

9198f7 ldx $0014,y   [7e3378] A:000a X:0000 Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 62 H: 28 F:22
9198fa beq $9907     [919907] A:000a X:ff85 Y:3364 S:1ff1 D:0000 DB:7e NvmxdizC V: 62 H: 38 F:22
9198fc lda $0028,y   [7e338c] A:000a X:ff85 Y:3364 S:1ff1 D:0000 DB:7e NvmxdizC V: 62 H: 41 F:22
9198ff sta $4c       [00004c] A:4e89 X:ff85 Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 62 H: 51 F:22
919901 jsl $919750   [919750] A:4e89 X:ff85 Y:3364 S:1ff1 D:0000 DB:7e nvmxdizC V: 62 H: 58 F:22
919750 lda $910000,x [91ff85] A:4e89 X:ff85 Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 62 H: 72 F:22
919754 tax                    A:0300 X:ff85 Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 62 H: 81 F:22
919755 jsr ($8000,x) [918300] A:0300 X:0300 Y:3364 S:1fee D:0000 DB:7e nvmxdizC V: 62 H: 84 F:22
91001a rol $ff00     [7eff00] A:0300 X:0300 Y:3364 S:1fec D:0000 DB:7e nvmxdizC V: 62 H: 97 F:22
91001d sbc $000000,x [000300] A:0300 X:0300 Y:3364 S:1fec D:0000 DB:7e nvmxdizc V: 62 H:112 F:22
00885f stp                    A:c8c1 X:0300 Y:3364 S:1fe8 D:0000 DB:7e NvmxdIzc V: 62 H:150 F:22

Desired Values for X

X Value	Bank	Resulting Addresses	Comment
0x0000-0x7FFF	$11	?	-
0x8000-0x9FFF	$12	0x7E0000-0x7E1FFF	LowRAM is shadowed in banks $00-$3F
0xA000-0xFFFF	$12-$13	?	-