Finding the Points Table
========================

So let's look a little further back in the trace, it looks like there's some math being done with the mathbox. There's writes to $1871 which is a mathbox address, and it's accessing data at 3C88, using LDA ($3b), y where 3b=3C5A and y=2e
Code
  49839 5DC1: lda ($3b), y
  49840 READ addr=5DC2 data=3B
  49841 READ addr=3B data=5A
  49842 READ addr=3C data=3C
  49843 READ addr=3C88 data=FD
  49845 A=FD X=1C Y=2E P=B4 NV__DIZC
  49847 5DC3: sta $1871


so let's scan backwards for where 3b gets set:

and that leads us to this table lookup at $388e:

Code
?WRITE addr=3B

  46690 5D76: lda $0270, x                 <<<<< loads the object # from $0270, x
  46693 READ addr=276 data=0F              <<<< number is 0xF
  46695 A=0F X=06 Y=00 P=34 NV__DIZC
  46697 5D79: asl a                        <<< multiply by 2
  46702 5D7A: tay                          <<<< transfer into y
  46705 A=1E X=06 Y=1E P=34 NV__DIZC
  46707 5D7B: lda $388e, y                 <<<<< lookup table at 388e
  46710 READ addr=38AC data=5A             <<<< get the low byte
  46712 A=5A X=06 Y=1E P=34 NV__DIZC
  46714 5D7E: sta $3b
  46716 WRITE addr=3B data=5A              <<<<< 3b gets written here
  46718 A=5A X=06 Y=1E P=34 NV__DIZC
  46720 5D80: lda $388f, y                 <<<<< now get the high byte
  46723 READ addr=38AD data=3C
  46727 5D83: sta $3c
  46729 WRITE addr=3C data=3C               <<<<< 3c gets written here
  46731 A=3C X=06 Y=1E P=34 NV__DIZC           full address is $3c5a

Taking a hexdump of the 0x388e table:

Code
[MAME]> hexdump16(0x388e,15)
HEXDUMP16 addr=388e  len=0f
388e: 38e6 3905 3955 3936 3a55 3a30 3a0b 39e6 
389e: 3a7a 3a9f 3ac4 3ae9 3c3b 3b0e 3b3f 3c5a   <<<<<<<< 3c5a at offset 1E

and the entry for item 0xf is $3c5a so let's have a look:
Code
[MAME]> hexdump(0x3c5a,48)
HEXDUMP addr=3c5a  len=30
3c5a: 31 80 fd 80 fd c0 fe 80 
3c62: fd 80 02 c0 fe 80 02 80 
3c6a: 02 c0 fe 80 02 80 fd c0 
3c72: fe 80 fd 80 fd d8 ff 80 
3c7a: fd 80 02 d8 ff 80 02 80 
3c82: 02 d8 ff 80 02 80 fd d8 


The first number must be the # of bytes in the point table plus 1 (since it includes the first byte), 0x31=49.

So 48 bytes of points, each point is 2 bytes, 3 points for (x,y,z) so there's 48/2/3=8 points.
Code
[MAME]> hexdump16(0x3c5a+1,8*3,3)
HEXDUMP16 addr=3c5b  len=18
3c5b: fd80 fd80 fec0 
3c61: fd80 0280 fec0 
3c67: 0280 0280 fec0 
3c6d: 0280 fd80 fec0 
3c73: fd80 fd80 ffd8 
3c79: fd80 0280 ffd8 
3c7f: 0280 0280 ffd8 
3c85: 0280 fd80 ffd8 

Hex is hard to decode so let's look at it in decimal:
Code
[MAME]> a=mem:read_u8(0x3c5a) 
[MAME]> print(a)
49

[MAME]> for i=0x3c5a+1,0x3c5a+1+a-1-1,6 do  x=mem:read_i16(i) y=mem:read_i16(i+2) z=mem:read_i16(i+4) print(hex(i,4),"("..int(x)..","..int(y)..","..int(z)..")") end
3c5b	(-640,-640,-320)
3c61	(-640,640,-320)
3c67	(640,640,-320)
3c6d	(640,-640,-320)
3c73	(-640,-640,-40)
3c79	(-640,640,-40)
3c7f	(640,640,-40)
3c85	(640,-640,-40)


They all seem to be multiples of 40, so let's divide by 40 to make the numbers a little simpler for us to understand.

Code
[MAME]> for i=0x3c5a+1,0x3c5a+1+a-1-1,6 do  x=mem:read_i16(i) y=mem:read_i16(i+2) z=mem:read_i16(i+4) print(hex(i,4),"("..int(x/40)..","..int(y/40)..","..int(z/40)..")") end
3c5b	(-16,-16,-8)
3c61	(-16,16,-8)
3c67	(16,16,-8)
3c6d	(16,-16,-8)
3c73	(-16,-16,-1)
3c79	(-16,16,-1)
3c7f	(16,16,-1)
3c85	(16,-16,-1)
[MAME]> 


If you draw the (x,y) components you get a square, and there's one square at z=-8 and another at z=-1 so definitely a cube, and it's the cube we're looking for.

So now let's see if we can change a point and see it visibly change on screen:

We'll open up a memory viewer in the debugger and go to our table at 0x3c5b. Note that we are in region :maincpu as the default region won't let you change the memory.



[Linked Image from i.imgur.com]

-> change 0x3c77 from 0xffd8 to 0 -> (changing the z coordinate from -40 to 0)

[Linked Image from i.imgur.com]

and you can see the vertex move right up to the horizon line.

[Linked Image from i.imgur.com]
[Linked Image from i.imgur.com]