add update

Author: zengfr

Android/Android逆向破解_动态分析技巧.png

@@ -0,0 +1,194 @@
+https://github.com/zengfr/romhack
+https://gitee.com/zengfr/romhack
+Conversion SF2' to Carrier Air Wing (CPS1)
+Originally the World version of Carrier Air Wing runs on a 89624B-3 B-board and 88622-C-5 C-board.
+
+To use a different B-board, files need to be rearranged (merged, interleaved, ect.) and one of the B-board PALs (CA24B for Carrier Air Wing) must be adapated (handcrafted). This will not be covered by this article as I want to keep it at a reasonnable size (and prevent readers to fall asleep).
+
+To use a different C-board, program ROMs must be modified to use different registers addresses and different layer masks.
+I will try to give some useful information on how to proceed.
+
+1) Modifying MAME source and recompiling
+
+Carrier Air Wing originally uses a CPS-B-16 chip on the C-board while SF2' uses a CPS-B-21 chip with no battery.
+Everything is detailed in MAME:
+Carrier Air Wing (World 901009)                              1990  89624B-3   CA24B            IOB1  88622-C-5    CPS-B-16  DL-0411-10011  None
+Street Fighter II': Champion Edition (World 920313)          1992  91635B-2   S9263B   BPRG1   IOB1  92631C-6     CPS-B-21  DL-0921-10014  C632    IOC1
+In order to test my work in MAME I've modified the file cps1.cpp located in mame\src\mame\video
+I've edited the following line:
+{"cawing",      CPS_B_16,     mapper_CA24B },
+To:
+{"cawing",      CPS_B_21_DEF, mapper_CA24B },
+This will force MAME to use the CPS-B-21 chip (no battery hence CPS_B_21_DEF in the line above) instead of CPS-B-16.
+
+To recompile MAME you can follow the instructions on MAME's official website:
+http://mamedev.org/tools/
+
+2) Editing registers addresses
+
+Again the needed information can be found in the cps1.cpp file mentionned earlier:
+/*                     CPSB ID    multiply protection      unknown      ctrl     priority masks   palctrl    layer enable masks  */
+#define CPS_B_16     0x00,0x0406,          __not_applicable__,          0x0c,{0x0a,0x08,0x06,0x04},0x02, {0x10,0x0a,0x0a,0x00,0x00}
+#define CPS_B_21_DEF 0x32,  -1,   0x00,0x02,0x04,0x06, 0x08, -1,  -1,   0x26,{0x28,0x2a,0x2c,0x2e},0x30, {0x02,0x04,0x08,0x30,0x30}
+The base address for registers is always 0x800140 for all CPS1 games.
+
+So we can calculate the different adresses for a CPS-B16 chip (Carrier Air Wing):
+Layer control = 0x800140 + 0x0C = 0x80014C
+Priority mask 1 = 0X800140 + 0x0a = 0x80014A
+Priority mask 2 = 0X800140 + 0x08 = 0x800148
+Priority mask 3 = 0X800140 + 0x06 = 0x800146
+Priority mask 4 = 0X800140 + 0x04 = 0x800144
+Palette control = 0X800140 + 0x02 = 0x800142
+
+And the same for a CPS-B-21 chip with no battery (SF2'):
+Layer control = 0x800140 + 0x26 = 0x800166
+Priority mask 1 = 0X800140 + 0x28 = 0x800168
+Priority mask 2 = 0X800140 + 0x2A = 0x80016A
+Priority mask 3 = 0X800140 + 0x2C = 0x80016C
+Priority mask 4 = 0X800140 + 0x2E = 0x80016E
+Palette control = 0X800140 + 0x30 = 0x800170
+
+Now in the program ROMs of Carrier Air Wing we will replace address 0x80014A by 0x800166 (layer control). And so on for the priority masks and palette control.
+
+But that's not all, base register 0x800140 is used to read the CPS-B chip ID, which is 0x0406 for a CPS-B-16 and -1 (0xFFFF) for a CPS-B-21.
+Carrier Air Wing does read it several times and in different ways (sometimes as a word from 0x800140, sometimes as a byte from 0x800141 etc.).
+So each time the game tries to read the ID we will have to make it to believe the chips is a CPS-B-16.
+For instance
+move.w  $800140.l, D0
+will have to be replaced by
+move.w #$406, D0 (followed by a NOP instruction as it needs only 4 bytes instead of 6).
+For a byte
+move.b  $800140.l, D0
+can be replaced by
+move.b #$4, D0 (first byte of 0x0406)
+and
+move.b  $800141.l, D0
+can be replaced by
+move.b #$6, D0 (second byte of 0x0406).
+
+Once done game should boot in MAME but with the wrong layers enabled (as expected).
+
+3) Editing layer masks
+
+An other particularity of CPS-B chips is they used different values to enable layers.
+Back to the MAME's source:
+/*                     CPSB ID    multiply protection      unknown      ctrl     priority masks   palctrl    layer enable masks  */
+#define CPS_B_16     0x00,0x0406,          __not_applicable__,          0x0c,{0x0a,0x08,0x06,0x04},0x02, {0x10,0x0a,0x0a,0x00,0x00}
+#define CPS_B_21_DEF 0x32,  -1,   0x00,0x02,0x04,0x06, 0x08, -1,  -1,   0x26,{0x28,0x2a,0x2c,0x2e},0x30, {0x02,0x04,0x08,0x30,0x30}
+So for a CPS-B-16 offsets are:
+Layer 1 enable = 0x10
+Layer 2 enable = 0x0A
+Layer 3 enable = 0x0A
+Layer 4 enable = 0x00
+Layer 5 enable = 0x00
+When 2 layers share the same offset it means they are simulteneously activated.
+Here we can see layers 2 and 3 are activated together, so as layers 4 and 5.
+
+For a CPS-B-21 offsets are:
+Layer 1 enable = 0x02
+Layer 2 enable = 0x04
+Layer 3 enable = 0x08
+Layer 4 enable = 0x30
+Layer 5 enable = 0x30
+
+To enable/disable layers, game must write to the layer control register. As seen before this is address 0x80014C for a CPS-B-16 and 0x800166 for a CPS-B-21.
+The value must contain a base offset of 0x12C0 (identical for all CPS1 games) then add the desired values.
+Example:
+to activate only layer 1 with a CPS-B-21 chip, game must write 0x12C0 + 0x02 = 0x12C2 to the register 0x800166.
+
+Using MAME dissasembler with the modified program ROMs I've found Carrier Air Wing accesses the layer control register either directly:
+000482: 33FC 12D0 0080 0166        move.w  #$12d0, $800166.l
+Or indirectly:
+001CDE: 33ED 004A 0080 0166        move.w  ($4a,A5), $800166.l
+
+For the direct access it's quite simple: 0x12D0 for a CPS-B-16 chip corresponds to 0x12FE for a CPS-B-21 chip, so the line
+000482: 33FC 12D0 0080 0166        move.w  #$12d0, $800166.l
+Is replaced by
+000482: 33FC 12FE 0080 0166        move.w  #$12FE, $800166.l
+
+For the indirect access I had to set breakpoints and found the mask value is written to RAM @ 0xFF804A before being written to the layer control register.
+So I searched for all the writes to 0xFF804A and modified the values being written according to the different offsets.
+Example:
+000606: 3B7C 12DA 004A             move.w  #$12da, ($4a,A5)
+is replaced by
+000606: 3B7C 12FE 004A             move.w  #$12FE, ($4a,A5)
+
+Here are the different values I've found being used and their equivalent for the CPS-B-21 chip:
+CPS-B-16 CPS-B-21
+0x12DA  0x12FE
+0x139A  0x13BE
+0x06DA  0x06FE
+0x24DA  0x24FE
+0x18DA  0x18FE
+0x079A  0x07BE
+
+Then I ran the game but found 2 problems:
+- incorrect layers enabled during attract
+- missing Game Over text (again incorrect layers enabled)
+
+By watching the RAM I could see the wrong value written to RAM @ 0xFF804A during attract was 0x12DA so I set a conditionnal breakpoint in the MAME debugger:
+wpset FF804A,1,w,wpdata==12DA
+This informed me the game sometimes uses the layer control offset as a mask:
+000F3C: 006D 001A 004A             ori.w   #$1a, ($4a,A5)
+Here the value used is 0x1A (all layers enabled for a CPS-B-16) which corresponds the 0x3E for a CPS-B-21 chip.
+I replaced the line as follow
+ori.w   #$3E, ($4a,A5)
+and now attract was correct.
+I followed the same procedure for the missing Game Over text (value 0x12D0 written).
+This time value 0x10 was used (layers 1, 4 and 5):
+001234: 006D 0010 004A             ori.w   #$10, ($4a,A5)
+Which I replaced by
+ori.w   #$32, ($4a,A5)
+And game was finally working perfectly!
+
+4) Material needed
+
+4.1) If you use a 91634B-2 B-board (EPROM)
+ - 6 * 27C4096 ROM (4 for the graphics and 2 for the program)
+ - 2 * 27C010 ROM (audio)
+ - 1 * 27C512 ROM (audio)
+ - 1 * GAL16V8 (PAL)
+
+4.2) If you use a 91635B-2 B-board (mask ROM)
+ - 4 * 27C400 ROM (graphics)
+ - 2 * 27C4096 ROM (program)
+ - 2 * 27C010 ROM (audio)
+ - 1 * 27C512 ROM (audio)
+ - 1 * GAL16V8 (PAL)
+
+5) ROMs and PAL burning
+
+Now it's time to burn the files on the appropriated devices.
+
+5.1) If you use a 91634B-2 B-board (EPROM)
+ - ROMs 01/02/03/04/22/23 => 27C4096
+ - ROM 09 => 27C512
+ - ROM 18/19 => 27C010
+ - CAW_PAL_1A => GAL16V8
+
+5.2) If you use a 91635B-2 B-board (mask ROM)
+ - ROMs 01/02/03/04 => 27C400
+ - ROMs 22/23 => 27C4096
+ - ROM 09 => 27C512
+ - ROM 18/19 => 27C010
+ - CAW_PAL_1A => GAL16V8
+
+6) ROMs installation
+
+All SF2' ROMs must be removed from the B-board.
+The PAL named S963B at position 1A has to be removed too.
+Double check you've put the devices the right way (the silkscreen should help you)!
+
+6.1) If you use a 91634B-2 B-board (EPROM)
+ - Install the ROMs in the corresponding socket (ROM 01 in socket 01, etc.)
+ - Install the GAL16V8 in position 1A (where the S963B was)
+
+6.2) If you use a 91635B-2 B-board (mask ROM)
+ - Install the ROMs 01/04/18/19/22/23 in the corresponding socket (ROM 01 in socket 01, etc.)
+ - Install ROM 02 in socket 03
+ - Install ROM 03 in socket 02
+ - Install the GAL16V8 in position 1A (where the S963B was)
+
+7) Test
+https://github.com/zengfr/romhack
+https://gitee.com/zengfr/romhack

Android/Smali学习笔记.pdf

@@ -0,0 +1,63 @@
+; ====================================================================
+; ----------------------------------------------------------------
+; Genesis / Mega drive 68k map
+; ----------------------------------------------------------------
+
+sys_exram	equ	$200000		; External RAM
+z80_cpu		equ	$A00000		; Z80 CPU RAM, size: $2000
+ym_ctrl_1	equ	$A04000		; YM2612 Reg 1, channels 1-3
+ym_data_1	equ	$A04001		; YM2612 Reg 2
+ym_ctrl_2	equ	$A04002		; YM2612 Reg 1, channels 4-6
+ym_data_2	equ	$A04003		; YM2612 Reg 2
+sys_io		equ	$A10001		; bits: OVRSEAS(7)|PAL(6)|DISK(5)|VER(3-0)
+sys_data_1	equ	$A10003		; Port 1 DATA
+sys_data_2	equ	$A10005		; Port 2 DATA
+sys_data_3	equ	$A10007		; Modem DATA
+sys_ctrl_1	equ	$A10009		; Port 1 CTRL
+sys_ctrl_2	equ	$A1000B		; Port 2 CTRL
+sys_ctrl_3	equ	$A1000D		; Modem CTRL
+sys_tmss	equ	$A14000		; Write "SEGA" here if ver > 0
+z80_bus 	equ	$A11100		; Only use bit 0 (bit 8 as WORD)
+z80_reset	equ	$A11200		; WRITE only ($0000 reset/$0100 cancel)
+md_mars_id	equ	$A130EC		; MARS ID "MARS"
+md_bank_sram	equ	$A130F1		; Make SRAM visible at $200000
+vdp_data	equ	$C00000		; Video data port (mirror: $C00002)
+vdp_ctrl	equ	$C00004		; Video control port (mirror: $C00006)
+psg_ctrl	equ	$C00011		; PSG Sound port
+
+; ----------------------------------------------------------------
+; Genesis / Mega drive Z80 map
+; ----------------------------------------------------------------
+
+zym_ctrl_1	equ	$4000		; YM2612 reg 1
+zym_data_1	equ	$4001		; YM2612 reg 2
+zym_ctrl_2	equ	$4002		; YM2612 reg 1
+zym_data_2	equ	$4003		; YM2612 reg 2
+zbank		equ	$6000		; ROM BANK 24bits %XXXXXXXX X0000000 00000000
+zvdp_data	equ	$7F00		; Video data port
+zvdp_ctrl	equ	$7F04		; Video control port
+zpsg_ctrl	equ	$7F11		; PSG control
+
+; ----------------------------------------------------------------
+; If a SEGA CD is attached
+; ----------------------------------------------------------------
+
+syscd_prgram	equ	$020000		; SubCPU PRG-RAM, up to $1FFFF, banked
+syscd_wordram	equ	$200000		; WORD-RAM seen in MAIN-CPU
+syscd_bus	equ	$A12000		; WORD | Sub-CPU BUS/RESET
+syscd_memory	equ	$A12003		; BYTE | Sub-CPU memory mode
+syscd_cdcmode	equ	$A12004		; WORD | CDC Mode
+syscd_hint	equ	$A12006		; WORD | VDP HBlank jump ($FFxxxx)
+syscd_cdchost	equ	$A12008		; WORD | CDC Host
+syscd_stopwtch	equ	$A12008		; WORD | Stopwatch
+syscd_comm_m	equ	$A1200E		; BYTE | MainCPU R/W comm byte
+syscd_comm_s	equ	$A1200F		; BYTE | Sub-CPU Read comm byte
+syscd_args_m	equ	$A12010		; DATA | Comm R/W list, max size: $E
+syscd_args_s	equ	$A12020		; DATA | Comm Read list, max size: $E
+
+; ----------------------------------------------------------------
+; If a 32X is attached
+; ----------------------------------------------------------------
+
+sysmars_ID	equ	$A130EC		; MARS ID "MARS"
+sysmars_reg	equ	$A15100		; MARS 32X buffer (check for mars_ID first)

Android/Smali开发详解.pdf

@@ -0,0 +1,20 @@
+SSG registers decode
+
+AB CD EF GH IJ KL
+x  x   x  x  x xx -> 00111 Channel enable flags
+x   x x  x  x  xx -> 01000 Volume A
+x   x x  x   x xx -> 01001 Volume B
+x   x x   x x  xx -> 01010 Volume C
+x   x  x x   x xx -> 01101 Envelope shape
+
+AB CD EF GH IJ K
+x   x  x x  x  x -> 01100 Coarse envelope
+x  x  x  x   x x -> 00000 Fine tune A
+x  x  x   x  x x -> 00010 Fine tune B
+x  x   x x   x x -> 00100 Fine tune C
+x  x   x x  x  x -> 00101 Coarse tune C
+x  x  x   x x  x -> 00011 Coarse tune B
+x  x  x  x  x  x -> 00001 Coarse tune A
+x   x x   x  x x -> 01011 Fine envelope
+
+x  x   x  x x  x -> 00110 Noise tune

Android/android-elf-20151022180146951.png

@@ -0,0 +1,91 @@
+https://github.com/zengfr/romhack
+https://gitee.com/zengfr/romhack
+Z80 Sound Commands
+
+The Z80 can recieve single byte commands from the 68000 to the Z80, it can also return a single byte
+Command	Meaning
+$00	nop/do nothing
+$01	Slot switch (needed by bios)
+$02	Play eyecatch music (needed by bios)
+$03	Soft Reset (needed by bios)
+$04	Disable All (Music & Sounds)
+$05	Disable Music
+$06	Disable Sounds
+$07	Enable All (Music & Sounds)
+$08	Enable Music
+$09	Enable Sounds
+$0A	Silence SSG channels
+$0B	Silence FM channels
+$0C	Stop all ADPCM-A samples
+$0D	Stop current ADPCM-B sample
+$0E	Tempo Change (1 argument; new tempo)
+$0F	unused
+$10	Fade Out (1 argument; fade speed)
+$11	Stop Fade In/Out
+$12	Fade In (1 argument; fade speed)
+$13-$1F	Unused
+$20-FF	Free for user use
+----------------------------------------------------------------------------------
+map(0x800180, 0x800187).w(FUNC(cps_state::cps1_soundlatch_w));    /* Sound command */
+map(0x800188, 0x80018f).w(FUNC(cps_state::cps1_soundlatch2_w));   /* Sound timer fade */
+map(0xf18000, 0xf19fff).rw(FUNC(cps_state::qsound_sharedram1_r), FUNC(cps_state::qsound_sharedram1_w));  /* Q RAM */
+map(0xf1e000, 0xf1ffff).rw(FUNC(cps_state::qsound_sharedram2_r), FUNC(cps_state::qsound_sharedram2_w));  /* Q RAM */
+$800180 $800181 Sound command
+$800188 $800189 Sound fade
+$f18000 $f19fff QSound RAM
+----------------------------------------------------------------------------------	
+Improved CPS1 mute codes
+
+bp 00C0,audiocpu.rb@D7E1>0,{pc=006A;g}
+bp 025A,1,{pc=030F;g}
+
+<cheat desc="No Background Music">
+<script state="on">
+<action>temp0=audiocpu.rd@00AA</action>
+<action>temp1=audiocpu.rd@025A</action>
+</script>
+<script state="run">
+<action condition="audiocpu.rb@D048 gt 0">audiocpu.od@00AA=00006AC3</action>
+<action condition="audiocpu.rb@D048 eq 0">audiocpu.od@00AA=temp0</action>
+<action>audiocpu.od@025A=00030FC3</action>
+</script>
+<script state="off">
+<action>audiocpu.od@00AA=temp0</action>
+<action>audiocpu.od@025A=temp1</action>
+</script>
+</cheat>
+--------------------------------------------------------------------------------------
+ <cheat desc="No Background Music">
+    <script state="run">
+      <action>audiocpu.pw@D048=0000</action>
+      <action>audiocpu.pq@D300=00, audiocpu.pq@D310=00, audiocpu.pq@D320=00, audiocpu.pq@D330=00, audiocpu.pq@D340=00, audiocpu.pq@D350=00, audiocpu.pq@D360=00, audiocpu.pq@D370=00</action>
+      <action>audiocpu.pq@D380=00, audiocpu.pq@D390=00, audiocpu.pq@D3A0=00, audiocpu.pq@D3B0=00, audiocpu.pq@D3C0=00, audiocpu.pq@D3D0=00, audiocpu.pq@D3E0=00, audiocpu.pq@D3F0=00</action>
+    </script>
+  </cheat> 
+  
+    cheat "BGM"
+    default 1
+    0 "BGM default"
+    1 "BGM off", 1, 0xD048, 0x00,1, 0xD049, 0x00
+
+    cheat "D300"
+    default 1
+    0 "default"
+    1 "1st note off", 1, 0xD300, 0x00, 1, 0xD301, 0x00, 1, 0xD302, 0x00, 1, 0xD303, 0x00, 1, 0xD304, 0x00, 1, 0xD305, 0x00, 1, 0xD306, 0x00, 1, 0xD307, 0x00, 1, 0xD310, 0x00, 1, 0xD311, 0x00, 1, 0xD312, 0x00, 1, 0xD313, 0x00, 1, 0xD314, 0x00, 1, 0xD315, 0x00, 1, 0xD316, 0x00, 1, 0xD317, 0x00, 1, 0xD320, 0x00, 1, 0xD321, 0x00, 1, 0xD322, 0x00, 1, 0xD323, 0x00, 1, 0xD324, 0x00, 1, 0xD325, 0x00, 1, 0xD326, 0x00, 1, 0xD327, 0x00, 1, 0xD330, 0x00, 1, 0xD331, 0x00, 1, 0xD332, 0x00, 1, 0xD333, 0x00, 1, 0xD334, 0x00, 1, 0xD335, 0x00, 1, 0xD336, 0x00, 1, 0xD337, 0x00
+
+    cheat "D340"
+    default 1
+    0 "default"
+    1 "1st note off", 1, 0xD340, 0x00, 1, 0xD341, 0x00, 1, 0xD342, 0x00, 1, 0xD343, 0x00, 1, 0xD344, 0x00, 1, 0xD345, 0x00, 1, 0xD346, 0x00, 1, 0xD347, 0x00, 1, 0xD350, 0x00, 1, 0xD351, 0x00, 1, 0xD352, 0x00, 1, 0xD353, 0x00, 1, 0xD354, 0x00, 1, 0xD355, 0x00, 1, 0xD356, 0x00, 1, 0xD357, 0x00, 1, 0xD360, 0x00, 1, 0xD361, 0x00, 1, 0xD362, 0x00, 1, 0xD363, 0x00, 1, 0xD364, 0x00, 1, 0xD365, 0x00, 1, 0xD366, 0x00, 1, 0xD367, 0x00, 1, 0xD370, 0x00, 1, 0xD371, 0x00, 1, 0xD372, 0x00, 1, 0xD373, 0x00, 1, 0xD374, 0x00, 1, 0xD375, 0x00, 1, 0xD376, 0x00, 1, 0xD377, 0x00
+
+    cheat "D380"
+    default 1
+    0 "default"
+    1 "1st note off", 1, 0xD380, 0x00, 1, 0xD381, 0x00, 1, 0xD382, 0x00, 1, 0xD383, 0x00, 1, 0xD384, 0x00, 1, 0xD385, 0x00, 1, 0xD386, 0x00, 1, 0xD387, 0x00, 1, 0xD390, 0x00, 1, 0xD391, 0x00, 1, 0xD392, 0x00, 1, 0xD393, 0x00, 1, 0xD394, 0x00, 1, 0xD395, 0x00, 1, 0xD396, 0x00, 1, 0xD397, 0x00, 1, 0xD3A0, 0x00, 1, 0xD3A1, 0x00, 1, 0xD3A2, 0x00, 1, 0xD3A3, 0x00, 1, 0xD3A4, 0x00, 1, 0xD3A5, 0x00, 1, 0xD3A6, 0x00, 1, 0xD3A7, 0x00, 1, 0xD3B0, 0x00, 1, 0xD3B1, 0x00, 1, 0xD3B2, 0x00, 1, 0xD3B3, 0x00, 1, 0xD3B4, 0x00, 1, 0xD3B5, 0x00, 1, 0xD3B6, 0x00, 1, 0xD3B7, 0x00
+
+    cheat "D3C0"
+    default 1
+    0 "default"
+    1 "1st note off", 1, 0xD3C0, 0x00, 1, 0xD3C1, 0x00, 1, 0xD3C2, 0x00, 1, 0xD3C3, 0x00, 1, 0xD3C4, 0x00, 1, 0xD3C5, 0x00, 1, 0xD3C6, 0x00, 1, 0xD3C7, 0x00, 1, 0xD3D0, 0x00, 1, 0xD3D1, 0x00, 1, 0xD3D2, 0x00, 1, 0xD3D3, 0x00, 1, 0xD3D4, 0x00, 1, 0xD3D5, 0x00, 1, 0xD3D6, 0x00, 1, 0xD3D7, 0x00, 1, 0xD3E0, 0x00, 1, 0xD3E1, 0x00, 1, 0xD3E2, 0x00, 1, 0xD3E3, 0x00, 1, 0xD3E4, 0x00, 1, 0xD3E5, 0x00, 1, 0xD3E6, 0x00, 1, 0xD3E7, 0x00, 1, 0xD3F0, 0x00, 1, 0xD3F1, 0x00, 1, 0xD3F2, 0x00, 1, 0xD3F3, 0x00, 1, 0xD3F4, 0x00, 1, 0xD3F5, 0x00, 1, 0xD3F6, 0x00, 1, 0xD3F7, 0x00
+
+  

Android/debugging_dalvik.pdf

@@ -0,0 +1,16 @@
+arcade_game_romhacking_sourcecode_top_secret_data
+for Arcade mame mess sfc snes sega md geoneo
+
+arcade game romhacking sourcecode data asm mame m68k m68000 cps1 capcom rom assember
+
+https://github.com/zengfr/arcade_game_romhacking_sourcecode_top_secret_data
+https://gitee.com/zengfr/arcade_game_romhacking_sourcecode_top_secret_data
+other data:
+
+github:https://github.com/zengfr/romhack
+
+gitee:https://gitee.com/zengfr/romhack
+
+blog:https://my.oschina.net/zengfr
+
+video:https://space.bilibili.com/492484080/video