Jump to content
IGNORED

Melody Blaster Disassembly


Zendocon

Recommended Posts

I started looking at a disassembly of Melody Blaster, after I became curious as to which ECS games supported tape expansions.  My hope is to create virtual tape images for jzintv that can be used to allow extra music into the game.  As an intermediate step, I'll try creating a ROM hack with new music in it.

 

The ROM follows the standard memory map for 12K Mattel games: 8K in the $5000-6FFF range, and 4K in the $Dxxx range.  Most of what's in $6xxx is the Help text, and it overflows a little into $D0xx.  After that is the 11 tunes.  There are a bunch of calls in the code to functions at $40xx and $41xx, so the ECS "Executive ROM" must be located there.  The ECS does have onboard RAM, and I'm pretty sure tunes are loaded there and then parsed by the ECS EXEC.

 

The list of pointers to the starting addresses of each tune starts at $57E7 (cartridge ROM), with the low-order byte listed first, and the starting address for the current tune is loaded into $354 (16-bit system RAM address).  The game allows for one extra tune to be loaded into memory, either from a tape or by playing a tune (one channel only).  I hope tape tunes aren't limited to a single channel, but I don't know yet.  All the music data fits into 8-bit words, probably because that's the width of the ECS RAM.

 

As for the tunes, the first 18 bytes comprise the title.  I looked at the first 2 tunes so far, which both had a 9-byte signature starting with 0 1 1 9 6 6 9 4.  After that was the data for each of the 4 channels used by the game (2 sprite-based notes per channel).  The channels' lines are listed separately, in order from low to high, and not all of them are used.  The music data consists of byte pairs: a note ($18 is Middle-C) or $80 for a rest, and then a duration in "ticks".  In most cases, channel data is separated by the signatue 1 1 $80 1, but I found an exception in Tune 2 "ROW,ROW THE BOAT".  That signature appears twice in a row in Tune 1 "BLASTER'S BLUES" because one channel is not used.

 

In many cases, channels' music data is prefaced with a rest, because another channel has a starting pick-up.  The first channel for BLASTER'S BLUES is the left-hand harmony line, which has a small pause to allow the pickup in the right hand melody line.  Then the channel-separator signature appears twice, followed by the melody line.  Strangely, the fourth channel has a series of rests which add up to 234 ticks, where it is then used to play a second note in the right hand at the tune's end.  There are a total of 9 consecutive rests here, the first 8 of which are 25 ticks each ("$19"), and the last of which is 34 ticks ("$22").  There's a little more data here which I haven't yet deciphered.

 

ROW,ROW THE BOAT is played as a round, with the harmony line picking up a measure behind the melody line.  The same value $18 is used for the C note in their respective octaves, which leaves me to believe that the ninth byte in the signature following the title contains bits to tell us which channels have octave offsets (in other words, are meant to be played by the left hand or the right hand).  The end-of-channel signature is also absent at one point, so maybe the header signature tells us which channels are not used at all?

 

That's as far as I got so far.  I'll take the time to study the other tunes later today.  Another interesting point is that there will sometimes be tiny spaces between notes at what appear to be arbitrary points: a note played for 2 ticks followed by a 1-tick rest in one hand and for the full 3 ticks in the other hand.  That indicates to me that the music data was created by a device that a MIDI keyboard was connected to, and that data was only moderately cleaned up afterwards to get a consistent tempo across all channels.

Edited by Zendocon
8 bits, not 8 bytes.
  • Like 8
Link to comment
Share on other sites

Status update.  I went through the next three tunes, five so far.  That signature after the title changes slightly.  The instruction at $5811 fetches the fifth word from this signature and loads it into R1, but that's as far as I got.

 

I tried poking garbage values into the ninth word at $D0A9 as well as the mystery word between channels at $D107, which affected BLASTER'S BLUES, the tune that plays at start.  As expected, the channels got confused as to where to get their data from and how far to go before looping.  Maybe I'll try a baby step and only poke values with one off from the original, but that's for another day.

 

As a correction to the original post for anybody who just might care, the signature after the title for the first two songs is 0 0 1 1 9 4 6 1.

  • Like 3
Link to comment
Share on other sites

After stepping through all the instructions starting at $5811, I got much closer to deciphering the music data.  It turns out all 6 channels are used after all, not just 4.  They seem to go in order from low to high: 3 channels in the left hand, followed by 3 channels in the right hand.

 

Channels that are not used contain the data 1 1 $80 1.  Channels that are used begin with a 1 followed by a value that is the combined number of notes and rests for that channel - think of it as a "length" value - then the actual data in the byte pairs I mentioned earlier.  Two pointers to each channel's data (probably one for the beginning and one for the current note/rest) are saved in byte pairs in the ECS RAM address range $40DB-$40F2, but that isn't really important.  When starting a new tune, the length values are used to write the appropriate pointer values to this range.

 

I'll check the other tunes to make sure it's consistent.  If all goes well, that just leaves the first seven bytes after the title.  The eighth byte will always be a 1 because it's followed by the length of the first channel's music data.  The fifth byte is saved to address $179, where it is then used to determine how fast the text blinks that displays your current speed.  That just leaves the first four bytes and the two after the speed indicator.

  • Like 2
Link to comment
Share on other sites

Here's a start.  Make a copy of your Melody Blaster ROM and call it "Melody Blaster (Hack).bin".  If you have a .rom file, run rom2bin, which is included with jzintv.

 

I replaced the first song with measures 4-11 of Handel's Messiah #44, aka "The Hallelujah Chorus".  It was bigger in size than the original first song, "Blaster's Blues", so I replaced the pointer to the second song so they would both point to this.

 

There's a little slowdown where the sixteenth notes come in, and I tried to handle it by eliminating 1-tick spaces between those notes, thinking the music engine couldn't quite keep up at that point.  The duration values are correct though.

 

I don't plan to keep posting updated .cfg files until I've replaced all 11 songs.  Hopefully, I can easily open up the $fxxx range in case I run out of space.

Melody Blaster 1.png

Melody Blaster (Hack).cfg

  • Like 2
  • Thanks 1
Link to comment
Share on other sites

I have an update to the hack for Melody Blaster which replaces all 11 tunes in the ROM.  It's posted on my website with the other ROM hacks.  It's subject to change.

 

The tunes are larger in size because I used mostly 3-4 channels, whereas most of the original tunes used only 2-3 channels.  So I opened up the $Fxxx address range and had a whole 23 bytes of space left over when I was finished.  That also caused slowdown issues, especially with 2 tunes in particular.  I might try adjusting the duration values to compensate.

 

My Music Keyboard isn't working, so I'll have to depend on somebody else to play test these tunes.  At least you can listen to them without any trouble.  Enjoy.

 

My next goal will be to try putting tunes onto virtual ECS tapes so they can be loaded directly into ECS RAM.

  • Like 4
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...