Pasted

BN3 Notes
 Rockcube bx to 080F8D1D.
 Timestop chips call a loop that is passed in that activates the action of the actual chip. The timestop is just a wrapper. On the first frame r0 that is passed into the entry loop is 0. It appears that chips are meant to increment this after the first loop. This is for areagrab only.
 Flameman Updates:
1. [DONE] Extra Candle State. It should raise his stats to a higher level and raise his AI to beta mode. Will need to figure out a way to store the original level value byte in memory to a safe space.
2. [DONE]Flames should not be stopped by holes
3. [NO] Widening Flames could shoot out the back center so its like a combo of the original 2. unsure how feasible this is. Maybe change how it works to something more exciting... like a snek
4. [DONE] Move the candles to the front row.
5. [DONE] Maybe make a fireratn or blackbomb or something. Fireman could trigger it.
6. [DONE] Random candle states. No more knowing whats coming.
7. [DONE]Make yellow flames track the player better.
 FlashmanBeta Number of Chips in White(In AI Data): 080AE652
FlashmanBeta Number of remaining usable chips (in memory): 0x0A off self pointer (0203735E)
   Your HP: 02037294
02037270
Player Pending Damage: 020371FE
Return to 080ad83e
 08000B08 - Writes to bottom left panel (bne)
 0200F48F = BOTTOM LEFT PANEL TYPE
 0200A818 = Current Time stop chip timer until start (when starting timestop)
 Find coordinates through ram searching.
See what is checking our coordinates. Manipulate AIs by moving into where the check would change results (in line of canodumb). This tells you tahts what is calling it.
Edit whats reading. does it affect everything? where its in the rom? lower is more specific.
Pop the r14 stack to go back to the bl routine and bne branch on result of that function.
Remove the BNE and BL by manulaly just setting the register its going to read to always return what we want.
 Spawn Loc 020389B0 it seems.
Branches to 0801455A to a mov r2, #0x28
080B0B08(W) mov r0, #0x8 => change to 4 and you don't flinch
 Y coordinate of megaman: 02037229
Y coordinate of megaman (2): 02037283
 Canodumb Tracker X value:
020371a8
020389b2
Possible 02005C68 (countdown on projectile as well)
  0x080013DC sub r0, r0, r1 is part of the "Check if in row" routine.
  Canodumb is writing the X value on spawn of tracker at 080D8EE0 (StoreByte).
 Returns to 0800309E, POP.
  10010
100000
Flashman Beta has 3 areagrabs he can use.
The counter for a single one is stored at 0203735E(W)
White version areagrab count routine subtract: 080B6734 sub r0, #0x1
 When bulb finishes an addr checks your X coordinate, returns to 080B6755
 Blinking bit stored at 080ADA7A
 seesm to return to 080B6755
 At start of the r5 block there is a bitmask bit.
When metalman loads the initial bitmask is 0x19
00011001
Then continues same frame to 0x11
00010001
And then the next time is 0x13
00010011
Then again to 0x11 (clear bit 2 at 080ADD2A)
00010001
 nop at 080ADA66
 020371E5
  Flashman checks at 080B6754 for your current column number. If iti s 1, he will continue to see if he can use areagrab.
 Comparison fix at 080B6762 set to 0x0.
  Flag that says if we are in time stop: 02006cb6
 FLASHMAN CHIP INFO? 
080B6726(W) (mov r0)
 Patch at addr 080B672A
 Vs Gutsman Beta
Seems next attack data may be stored in 0203734D-E. Seems to change as he changes moves and this value appears read by his routines...
 Byte 1 = Current Action
Byte 2 = Movement Indicator ACtion
 Gutsman: 18 = 
Gutsman: 1C = Dead
Gutsman: 20 = Flinch
Gutsman: 24 = ??? (Idle or Move)
Gutsman: 28 = Moving Frame
Gutsman: 2C = Shockwave
Gutsman: 30 = Panel Slam
Gutsman: 34 = 1sq punch
Gutsman: 38 = Flying punch
Gutsman: 3C = Use chip, become invis
Gustman: 40 = Use Areagrab Chip
 Flashman 04 = Move instantly
Flashman 24 = Move
Flashman 2A = Very Tiny teleporiting frame (1 pizel wide)
Flashman 2C = TeleportingFrame
Flashman 30 = Zapping - bit after = 8 means starting, C means... end?
Flashman 34 = Pull shoulder bulb and do tracer
Flashman 38 = Do AreaGrab
 Flameman = 28 - 0C Idle
  When calling 3C, it seems that everything is offset from register 6 which passed through multiple subroutines.
020373B4
 Top i checked is 080b7a4a
  HP of gutsman: [02037368]?
Gutsman right shifts his max HP at 080B7DCE, which cuts it in half.
If HP is > half, get random number and and it with 7 (111). Use the result as an offset from 080B7E10, which is 08 and 14's.
 Gutsman checks for a value of 0xA to determine ifhe should do the jump around move. instruction is at 080b7de8
 Gutsman, once reaching half HP, will track how many moves/attacks he has made. Once he hits 0xA moves, he will set his move count to 0xFF.
 Current Y Coordinate
020371E8
02037356 
 Gutsmans right before areagrab loads 080B7A49 to the branch where he would call the chip
 Gutsmans Chip Usage: 080B8588
 Gutsman next action ASM: 080AD76Eish (above bx r7, off r5)
 X Coordinate of WHERE WE ARE GOING:
02037358
020373B8
 METALMANNNNN
Reads gear speed at 080BD678
 Remaining time for your extra panels:
canidates
 020350a4
02038de4
 It seems panel columns have their own expiration timer.
2 rows of interest: 0200F7a0/b0 - 03 means not counting down ti seems... 02 means counting down, not sure if 01 or 00 does anything.
 Start of one set: 0200F7A4
Start of second set: 0200F7B0
2 byte timer 1 byte counter state (should be updated automatically for us...) 1 byte seeminly unused (or part of counter state)
 Flameman:
r6 - 0x4 = NextPositionX
r6 - 0x5 = NextPositionY
r6 - 0x6 = NextMoveDelay
r6 - 0x7 = Move Counter
r6 - 0x8 = ???? (0'd on move)
r6 - 0x9 = NextAction
r6 - 0xA = ???? (0'd on move)
 Flametower levels:
0 = Straight
  Candle Timer
020389C0 If forced to 1 candles always activate
 Candle Routine
0x60 off r5 is tested for bits. It's a pointer to a memory address.
 020373A4 r5+60h - Pointer to some sort of memory.
020373A8 r5+64h - Pointer to some sort of memory.
 Bitmasks
1 = Invincibility
2 = Healing
4 = Orange dudes
 080E310C
 FLAMEMAN HOOK AT 080E2CDE (timer is being reset, so candle has gone out.)
CurrentCandleEffect Set at 080E2CA6 (Activate)
080E2C12 (Deactivate?)
 Flameman Flames:
32-Bit Attack Pattern somehow.
0: lowest bit is 0 = striaght flames, lowest bit is 1 = pattern flames(Lowest Bits)
1: 
2: 
3:  (Highest Bits)
 0000 = 0 = Straight
0001 = 1 = WideFlame (both ways)
0010 = 2 = Wideflame (up only4)
0011 = 3 = Wideflame (down only)
0100 = 4 = Wideflame Down 2 only
 AddHPRoutine: Less than 7 in r0 
 080C1C72 PlantmanPostSpawnConstants
 r5 in AI routines is typically "self"
0x0 - Bitmask containing multiple values, e.g. paused, flickering, invisible... Not sure what the bitmask values are yet.
0x2 - Some value (lower 4 bits dropped by flameman)
0x4 - AI Level (0 being normal, 3 being omega)
0x5 - Invincibility Bit (1 = invincible)?
0x6 - Seems to be some timer value (flameman), position value (plantman)...
0x7 - Plantman Vine Spawn Position Y (1 byte)... not sure for other navis
0x8 - Set to 0 to make 'fade in' animation [Byte]
0x9 - ???? [byte] (Sprite Appear/Disappear?)
0xA - Current Action (Used as an array index offset, so it will always be a multiple of 4)
0xB - Movement Animation... something. Always in values of 4 it seems...
0x10 - ???? (Byte)
0x12 - Current X Position (1=left)
0x13 - Current Y Position (1=top)
0x14 - ???? (Byte)
0x15 - ???? (Byte)
0x16 - ???? (Byte) (Read and then -1'd)
0x1E- ???? Byte
0x20 - Timer Value 1 (can be used by multiple things)
0x22 - ???? (2 bytes)
0x24 - Current HP (2 bytes)
0x26 - Max HP (2 bytes)
0x2C - Impact Damage? (2 bytes)
0x2E - Unknown (2 bytes) - Appears to possibly be a bitmask. Flameman tests if this value has any bits from 20A in it and other areas bic and orr on it (many as 0x20)
0x30 - Unknown (2 bytes) - Set by plantman AI in PostNeedleSpawn
0x50 - Unknown (4 bytes) (Pointer)
0x60 - Pointer to memory elsewhere. (4 bytes)
0x68 - Pointer to memory elsewhere. (4 bytes)
0x6C - Pointer to memory elsewhere. Seems to maybe be a pointer to an object owned by this AI
0x8C - Pointer to AI's hardcoded constants in ROM. See Hart-Hunt's list for what each offset does for each enemy.
 Panel Info:
4 bytes
0x1000 bitmask = lava
 Blank   80010032 10000000 00000001 00000000 00110010
Cracked 00010073 00000000 00000001 00000000 01110011
Sand    0001023A 00000000 00000001 00000010 00111010
Metal   00030035 00000000 00000011 00000000 00110101
Grass   00010436 00000000 00000001 00000100 00110110
 LAVA             00000000 00000000 00010000 00000000
  1 = 1
10 = 2
100 = 4
 2 1 = Broken Bitmask 10
4 2 = Normal 
8 3 = Cracked 
10 4 = Poison
20 5 = Metal
40 6 = Grass
80 7 = Ice
100 8 = Lava
200 9 = Holy
400 A = Sand
 0200f5a0
 Lava = 1000h Bitmask
Grass = 400h (Most Likey)
 Flameman Yellow Guy Actions
0 = Not Exist
4 = Fading Out
8 = Preparing To Spawn
 BN3 WHITE AI VALUES
 Gutsman Beta:
080AE6A0 (to 0x7)
 Metalman Beta: 
080AE83E (to 0x6)
 FlameMan
080E2F84
 Mgamerz MMBN3 Hard Mode Patch
 Mettaur:
Damage 10 -> 15
Movement Speed Increased
Time until attack slightly nerfed (otherwise too many shockwaves could happen on screen at once)
 Mettaur2:
Damage 40 -> 55
Movement speed increased
 Canodumb Series: Constant scan rather than row lineup.
Patched in blue at addr 080BADA2 - 080BADA4 (remove bl and branch, set r0 to 0 and then tst r0, r0 to force return true.)