Sega Model 3

[john-peterson]

No description provided.

[john-peterson]

model3emu

Memory base address

The .emul entry is

*Sega Model 3
Supermodel r261 x64;Supermodel.exe;N;723aca17f4d75748d47eb926c7533b74
;RAM;0;Supermodel.exe+P001966B8;800000
;NVRAM;F00C0000;Supermodel.exe+P00271E50,70h,0;20000

Supermodel r261 x86;Supermodel.exe;N;1c6d1f604f44919fea36d73648c6e8aa
;RAM;0;Supermodel.exe+P0013222C;800000
;NVRAM;F00C0000;Supermodel.exe+P0020C350,3C,0;20000

Supermodel 0.2a x64;Supermodel.exe;N;e1f7fdf03941461e2554a3e42013fe89
;RAM;0;Supermodel.exe+P00191508;800000
;NVRAM;F00C0000;Supermodel.exe+P00270DA0,70h,0;20000

Supermodel 0.2a x86;Supermodel.exe;N;5166526585e4ae1cdfbc56fb825a2cd3
;RAM;0;Supermodel.exe+P001262BC;800000
;NVRAM;F00C0000;Supermodel.exe+P0020253C,3C,0;20000

Prerequisites for finding RAM

RAM location in the .st# state: 0x81. 0x10 bytes into the "Model 3{\0}Src/Model3/Model3.cpp{\0}" state

NVRAM location in the .nv state: 0x147, at the "Backup RAM{\0}..\Src\Model3\Model3.cpp{\0}" state

Process location in RAM: located with Process → Process map, for example 0x29b000 bytes 0x01340000 → 0x15db00

The location is different every time Supermodel.exe is started

Find the RAM pointer

Select a ROM that has data (rather than zeroes) at 0 in RAM as that makes it easier to find the start of RAM. F.e. swtrilgy has 0x781a637c at 0

Start swtrilgy and search for the 4 byte value 7c631a78h (Search → Address range: ALL). It finds four locations, the lowest location, 0x10090020, is where RAM begin

Add the address to the table and search for pointer (select table entry → Alt + P) in the process (Search -→ Address range: Custom). It finds one location, 0x0147222c

The pointer is at 0x0147222c-0x01340000 = 0x13222C. The .emul entry is Supermodel.exe+P0013222C

Find the NVRAM pointer

Write a 4 byte identifier such as "AbCd" at 0 in NVRAM in the .nv file as that makes it easier to find the start of NVRAM

Start the corresponding game and search for the 4 byte value, 64436241h ("dCbA") (Search → Address range: ALL). It finds one location, 0x1d090020, this is where NVRAM begin

Add the address to the table and search for pointer (select table entry -→ Alt + P) in the process (Search → Address range: Custom). It finds no pointers

Search for pointer to pointer (select table entry → Alt + 2) in the process region. Reduce maximum offset to 100h so that you find few addresses. It finds two locations, both might work, we can select the lowest one 0x0154c350 +60,0

The pointer is 0x0154c350-0x01340000 = 0x20c350. The .emul entry is Supermodel.exe+P0020C350,60,0

[john-peterson]

ArtMoney

.emul

This Model 2 Emulator .emul value illustrate the .emul file notation

Model 2 Emulator 1.0 multicpu;emulator_multicpu.exe;07d590e636c865f723e145ba02cbe079
;RAM 1MB;500000;emulator_multicpu.exe+P0018F930,100h,0;100000
;RAM2 128kB;200000;emulator_multicpu.exe+P0018F930,108h,0;20000

• 500000: virtual base address is 0x500000
• "emulator_multicpu.exe+P0018F930,100h,0" is a pointer to pointer

a simple pointer is

"emulator_multicpu.exe+P0018F930"

• emulator_multicpu.exe is where the exe memory space begins, for example 0x400000, P0018F930 is then 0x400000 + 0x18F930 where a memory address is stored, 100h means the memory address + 0x100, 0 means that we should add 0, nothing, to that address.

100000 means that the memory is 0x100000 big