Bubsy: Exploring with Hex Editor

[doctorclu]

(I've posted this on Atariage and JS2... would love to get your input on this...)


I've been searching for a few years to find the Bubsy source code with no luck. But I have had some good suggestions on how to decompile the rom, and yesterday, to look at it with a hex editor. Don't know why the hex editor escaped my mind, I used to use one all the time back in on the Atari 800.

When I did, it went from basic non sense, to an interesting patch of ascii, and then back to non sense again. But what was found was interesting, and by changing a few ascii characters I was able to do some interesting things, like swap voice tracks around, and even change some level information.

Some have said after playing Bubsy that the game would have been better off if it started on the much easier level seven. (Ali Baba). I was almost able to do that with some nonserious tinkering.

These are the bad guy files I figure. The files that say what the bad guys are, where they will be, etc. Interestingly, when I had the level 7 maps in the place of level one but didn't change the bad guy characteristics, the redlight/greenlight "keys" to open doors were placed where enemies (snakes/Vultures) would have been.

--Initially I couldn't change this one because "ali" and "alice" were not the same amount of characters for me to switch around. So far what changes I've made were one character for one character replacements, and when you stray from that in the hex editor, things get wonky. But if you have an idea on how I could add two characters in hex edit, I'm all ears.
ALI.BAD
ALICE.BAD
HANSEL.BAD
JACK.BAD
WATER.BAD

----No idea what these are.
CIRC.BIN
SINE.BIN

---The boss files!!
ALICE.BOS
GENIE.BOS
HANSEL.BOS
JACK.BOS
WATER.BOS

--Not exactly sure what these are, but as you can see, the character character size, I could change a 1 out for a 5, and swapped fine. Come to find out world 5 was the Ali Baba world of level 7. Well, that is is true if Alice is truly world 1. icon_smile.gif
BSET1.BTR
BSET2.BTR
BSET3.BTR
BSET4.BTR
BSET5.BTR.

--CPL? Not really sure what these are.
INTRO.CPL
TITLE.CPL

-This one .cry stands alone. Interesting to note later on in the "BSETx.RGB" number 4 is missing. Makes me think this is a part of that set, but given a different extension.
BSET4.CRY

-More world information. Not exactly sure what these are.
WORLD1A.CTL
WORLD1B.CTL
WORLD1C.CTL
WORLD2A.CTL
WORLD2B.CTL
WORLD2C.CTL
WORLD3A.CTL
WORLD3B.CTL
WORLD3C.CTL
WORLD4A.CTL
WORLD4B.CTL
WORLD4C.CTL
WORLD5A.CTL
WORLD5B.CTL
WORLD5C.CTL

-And this one. But glad to see worlds 1 through 5 all present.
BSET1.DAT
BSET2.DAT
BSET3.DAT
BSET4.DAT
BSET5.DAT

-Sound Effects data?
SFX.DAT

-Implies game data?
GAME.DTA

-Strikes me as intro information.
FONT1.JHD
INTRO.JHD
LOGOS.JHD

-JPL.. any idea on this?
ATARI.JPL
BUBSY.JPL
IDI.JPL
STAR.JPL
WATERFON.JPL

-I find it intereting how "font1", "Intro" and "logos" keep popping up.
FONT1.JSP
INTRO.JSP
LOGOS.JSP

-The map layout. Strangely, if you simply swap 1 for 5 in this case, tricking it to think that world5a is world1a, you get level 9, which is the Genie level. Once again, need to tinker with this a bit more to figure out what world is what level. Very nice is how all 15 level are represented. Also need to figure out what file provides the placement on the map for Bubsy.
WORLD1A.MAP
WORLD1B.MAP
WORLD1C.MAP
WORLD2A.MAP
WORLD2B.MAP
WORLD2C.MAP
WORLD3A.MAP
WORLD3B.MAP
WORLD3C.MAP
WORLD4A.MAP
WORLD4B.MAP
WORLD4C.MAP
WORLD5A.MAP
WORLD5B.MAP
WORLD5C.MAP

-Not exactly sure what this is, but there are 15 of them! Woot!
WORLD1A.MPR
WORLD1B.MPR
WORLD1C.MPR
WORLD2A.MPR
WORLD2B.MPR
WORLD2C.MPR
WORLD3A.MPR
WORLD3B.MPR
WORLD3C.MPR
WORLD4A.MPR
WORLD4B.MPR
WORLD4C.MPR
WORLD5A.MPR
WORLD5B.MPR
WORLD5C.MPR

-The ingame music. I was able to successfully switch the w5 music with the world 1 music. I know these are actually mod files since I have the extracted mod files somewhere else. Wish I knew how they did that.
GAMEOVER.MUS
HIGH.MUS
TITLE.MUS
W1MUSIC.MUS
W2MUSIC.MUS
GAME.TXT
W3MUSIC.MUS
W4MUSIC.MUS
W5MUSIC.MUS

-This is the backdrop picture. Since Ali and Alice were not the same character lengths, I tried switching WATER and ALICE and got the Water backdrop with the Ali Baba map. icon_smile.gif
ALI.PIC
ALICE.PIC
HANSEL.PIC
JACK.PIC
TITLE.PIC
WATER.PIC

-These are animations. The arrow that points you onward, the Bubble around Bubsy in the water levels. Was neat to see this.
ARROW.PP
BUBBLE.PP
BUBSY__G.PP
GAMEOVER.PP
GLOBAL_G.PP
OVERLAY.PP
PAUSED.PP
RESET.PP

-Not really sure what this is.
BSET1.RGB
BSET2.RGB
BSET3.RGB
BSET5.RGB
TITLE.RGB

-The voice files!! This was the first thing I changed for the fun of it, and I got a kick hearing Bubsy say "Nothing can stop me now!" (levels 13-15) on level 1. icon_smile.gif
KEEPITUP.W11
PILOT.W22
NOTHING.W33
FLIPPER.W44
TORTURE.W55

And I got the game to do some wonky stuff as I would play with it in hex then save and then load on the Skunkboard. icon_smile.gif

I haven't fully explored which worlds are what levels above, and if you know a way where I could swap uneven character ascii, like say "ali" and "alice" (how to add hex ascii without messing with the programming around it) I would appreciate the input. Would also enjoy input on some of the files above and what they do exactly.

And if there was a way to extract some of those subfiles from the rom image, I would like to know what it takes. As said before, the mod files have been extracted. I would love to see the map files extracted as well. Even some of the animations would be cute to get.

Again, trying to understand this game, swap the levels around as suggested by some players who have played Bubsy, and as you see above, looks like even in the crude hex editor there is a lot to work with.


[Also interesting to note, doing an ascii search, the first two level codes were findable. I did see where the title ascii was viewable for level 7 (Rushing Roulette), but didn't see others. Geez... wish the source code would surface for this!!!]

[SpiderJerusalem]

Well, it seems you found the game's file system!

Of course they're not real files inside the ROM, but they were at some point stored in a hard drive, so they had to have proper names.

Now, typically games store their file systems in the following format: filename.ext (in ascii), any zero padding if required and an offset to the file. This means that for each filename, a fixed amount of bytes is reserved. Which is present on the bubsy rom too (from what I initially see).

So what we need to do is this: Find at least one file's starting position, and figure out how to decode the offset and we'll be able to couple the offset to the file and we'll have all the game files!

OTOH, if you just want to swap filenames around I guess you could simply change the filenames around, add any additional zero padding required and then swap the offsets around.

Anyway, I'll sleep over it

[doctorclu]

I had someone figure this much out.  To them I say thanks for the input (name kept anonymous unless they want credit here.)

Bubsy name table
Table runs from 29FE to 33F5
Alignment of these records is not certain yet.
Each record is 22 bytes.
Offset is always padded to a word-aligned (even) address.
Filename is NUL padded to 14 characters.
All numbers are 32-bit, big endian.
(4 bytes) Offset (from where?)
(14 bytes) filename
(4 bytes) Length

Looks like this is the likely layout
  Offset       Filename   Length
00000074 ALI.BAD        000095C1
000009FA ALICE.BAD      0000A53F
00009FBC HANSEL.BAD     00007EC0
000144FC JACK.BAD       00006F1E
0001C3BC WATER.BAD      000080F8
000232DA CIRC.BIN       0000074E
0002B3D2 SINE.BIN       00000800
0002BB20 ALICE.BOS      0000416A
0002C320 GENIE.BOS      000070EC
0003048A HANSEL.BOS     000060C2
00037576 JACK.BOS       00005150
0003D638 WATER.BOS      000028F7
00042788 BSET1.BTR      00000544
00045080 BSET2.BTR      00000336
000455C4 BSET3.BTR      0000043E
000458FA BSET4.BTR      0000027F
00045D38 BSET5.BTR      00000569
00045FB8 INTRO.CPL      00000498
00046522 TITLE.CPL      00000160
000469BA BSET4.CRY      0000013F
00046B1A WORLD1A.CTL    00000413
00046C5A WORLD1B.CTL    00000604
0004706E WORLD1C.CTL    00000426
00047672 WORLD2A.CTL    0000051D
00047A98 WORLD2B.CTL    00000565
00047FB6 WORLD2C.CTL    000004BA
0004851C WORLD3A.CTL    00000626
000489D6 WORLD3B.CTL    000005AD
00048FFC WORLD3C.CTL    00000690
000495AA WORLD4A.CTL    0000068F
00049C3A WORLD4B.CTL    00000638
0004A2CA WORLD4C.CTL    0000062F
0004A902 WORLD5A.CTL    00000671
0004AF32 WORLD5B.CTL    000005B9
0004B5A4 WORLD5C.CTL    0000058C
0004BB5E BSET1.DAT      0000F9CE
0004C0EA BSET2.DAT      0000ADA5
0005BAB8 BSET3.DAT      00008A75
0006685E BSET4.DAT      000096C6
0006F2D4 BSET5.DAT      0000BF34
0007899A SFX.DAT        0002469C
000848CE GAME.DTA       000006CB
000A8F6A FONT1.JHD      0000014B
000A9636 INTRO.JHD      000000B5
000A9782 LOGOS.JHD      00000020
000A9838 ATARI.JPL      000001BE
000A9858 BUBSY.JPL      000000AB
000A9A16 IDI.JPL        00000122
000A9AC2 STAR.JPL       00000044
000A9BE4 WATERFON.JPL   00000044
000A9C28 FONT1.JSP      00000D86
000A9C6C INTRO.JSP      0000B60C
000AA9F2 LOGOS.JSP      00003290
000B5FFE WORLD1A.MAP    00002A25
000B928E WORLD1B.MAP    000037AE
000BBCB4 WORLD1C.MAP    000024B0
000BF462 WORLD2A.MAP    00002B39
000C1912 WORLD2B.MAP    0000414E
000C444C WORLD2C.MAP    0000182A
000C859A WORLD3A.MAP    00002F91
000C9DC4 WORLD3B.MAP    000027DB
000CCD56 WORLD3C.MAP    00002CA9
000CF532 WORLD4A.MAP    00004DC1
000D21DC WORLD4B.MAP    0000482B
000D6F9E WORLD4C.MAP    0000499E
000DB7CA WORLD5A.MAP    00002C86
000E0168 WORLD5B.MAP    000028BF
000E2DEE WORLD5C.MAP    00002C96
000E56AE WORLD1A.MPR    00000CE8
000E8344 WORLD1B.MPR    00000FA7
000E902C WORLD1C.MPR    000008ED
000E9FD4 WORLD2A.MPR    00000C03
000EA8C2 WORLD2B.MPR    00000D05
000EB4C6 WORLD2C.MPR    00000351
000EC1CC WORLD3A.MPR    0000070C
000EC51E WORLD3B.MPR    0000074B
000ECC2A WORLD3C.MPR    000005AE
000ED376 WORLD4A.MPR    00000DAE
000ED924 WORLD4B.MPR    00000C42
000EE6D2 WORLD4C.MPR    00000C66
000EF314 WORLD5A.MPR    000007CD
000EFF7A WORLD5B.MPR    00000841
000F0748 WORLD5C.MPR    000006AF
000F0F8A GAMEOVER.MUS   00008D71
000F163A HIGH.MUS       00019A6B
000FA3AC TITLE.MUS      0001D951
00113E18 W1MUSIC.MUS    0000FF27
0013176A W2MUSIC.MUS    00011168
00141692 GAME.TXT       0001015E
001527FA W3MUSIC.MUS    00010368
00162958 W4MUSIC.MUS    0000E100
00172CC0 W5MUSIC.MUS    00012C89
00180DC0 ALI.PIC        000068EC
00193A4A ALICE.PIC      00009233
0019A336 HANSEL.PIC     0000484D
001A356A JACK.PIC       00008299
001A7DB8 TITLE.PIC      000084E1
001B0052 WATER.PIC      000082BA
001B8534 ARROW.PP       00000B89
001C07EE BUBBLE.PP      000005CC
001C1378 BUBSY__G.PP    000100BD
001C1944 GAMEOVER.PP    00001678
001D1A02 GLOBAL_G.PP    000042AE
001D307A OVERLAY.PP     00003961
001D7328 PAUSED.PP      0000025A
001DAC8A RESET.PP       00000419
001DAEE4 BSET1.RGB      0000019D
001DB2FE BSET2.RGB      0000016F
001DB49C BSET3.RGB      00000169
001DB60C BSET5.RGB      0000019C
001DB776 TITLE.RGB      0000015B
001DB912 KEEPITUP.W11   00004366
001DBA6E PILOT.W22      00003FD3
001DFDD4 NOTHING.W33    000048D2
001E3DA8 FLIPPER.W44    00003DD3
001E867A TORTURE.W55    000064C5

Then goes on to say...
"there's an obvious error in there. I'm still not 100% certain which record the offset and length words belong to, you can tell by looking at the first couple of records it's not quite correct.

But the fields themselves seem to be identified.

It's possible that ALI.BAD is just a corrupt, unused record, and that ALICE.BAD is the first file. In that case, the layout would be LENGTH/OFFSET/FILENAME, which is a reasonable assumption."

[Sauron]

I probably won't be hacking Bubsy anytime soon, but reading this thread so far makes me want to start splitting apart some other ROM files, just to see what I can learn.

[ggn]

First post here, no time for itnroduction, this thread needs me

Had a look this morning at the ROM, and right after the filesystem entries, I saw three magic letters: R N C.

Ding ding!

For those who are unfamiliar with those initials, it's "Rob Nothern Computing". Now, Rob was an old hacker turned legit, and he wrote one of the most used pieces of protection on ST and Amiga: Copylock. In addition to copylock he offered to companies his filesystem routines and custom packer.

Now, each file packed with Rob's packer has his company's initials as a header... yep, you guessed it, RNC

Soooo, after this was established it was time to get busy

I set about to find a depacker for RNC files for PC, and because my desktop PC (which I think has it) was not available, I googled around, and struck gold!

I found a program called "Multi Ripper", which you give it a file and it starts searching for lots of known files. You name it, mod formats, jpegs, some more obsucre ones, aaaaand... RNC files

So as it is, all the RNC files are sitting in a directory on my laptop, ready to be unpacked (still haven't found the propack unpacker!). Anyone wants em, they're available on request, or you can google around for mrip260.zip and do it yourselves



So it's down to you now doc: what do you want to do with bubsy?

[doctorclu]

That was in interesting read.  Yeh I would love to see what the files have to say.  

GGN PM sent.  

I think this is the kind of fun and input I was hoping for here.    So Sauron, what classic rom images have you curious?  (Start a thread!)

Meanwhile can't wait to see what GGN found (and try to introduce yourself at some point.)

[doctorclu]

Alright I have the files over here, and true to form, they are RNC files.  I'll need to take the directory that the other anonymous person gave above, and try to figure out what is what.  Fairly exciting.  And naturally my head is filled with "This is sooo cool!"  and "what the heck am I looking at"    But this really is cool.

117 RNC files and 116 files in the hexedited directory from the Bubsy Image.  So the initial theory is all the backup files and one main file? 

Anyway, I made a spreadsheet of the two directories.  The RNC files are sizes in K, and the Bubsy image directory is in hex still.  The person who made that hex directory said the Offset and Length might actually be reversed.

Anyway, if anyone is curious and want to make those hex to decimal conversions to make theories of what file is what, Have at it! 

[SpiderJerusalem]

Great stuff doc!

We're counting on your (and your little helpers ) to give us the most comprehensive analysis of your beloved cart!

[doctorclu]

Great stuff doc!

We're counting on your (and your little helpers ) to give us the most comprehensive analysis of your beloved cart!

Thanks!  

Little helpers.  Ha!  Nothing little about them.  Big help.

Anyone know good ways to convert these Hex sizes to decimal sizes?   Give suggestions, I'll try them out later tonight.

[SpiderJerusalem]

Anyone know good ways to convert these Hex sizes to decimal sizes?   Give suggestions, I'll try them out later tonight.

If you're under windows, you can use the built-in calculator. Just change it to "scientific" mode, then change it to hex, type the offset and it'll get converted when you press dec.

Also, I just looked that excel has a hex->dec function built in, called hex2dec(), so since you're already in excel you could find it useful

Finally, I personally use a calculator called "total calculator v2" (not available anywhere anymore), in which I just type $ and the number in hex and it gets converted to the other bases (dec, binary, octal, exponential) in realtime!

Hope any of this helps

[TheGrandPubaa]

I was following this over at JSII with mild interest. To be honest, I never liked the Jaguar Bubsy much at all, but I was a huge fan of the SNES/Genesis Bubsy game(the first one, the good one in my opinion). If there were some way to recreate that one on Jaguar, that'd be a cool hack indeed.

[SpiderJerusalem]

I was following this over at JSII with mild interest. To be honest, I never liked the Jaguar Bubsy much at all, but I was a huge fan of the SNES/Genesis Bubsy game(the first one, the good one in my opinion). If there were some way to recreate that one on Jaguar, that'd be a cool hack indeed.

Short of having the source code for both versions, the only viable route for that imho is a snes (or genesis) emulator

[TheGrandPubaa]

That's true, but it would still be cool.

And I doubt an SNES emulator would work out particularly well. The SPC alone would be a nightmare to emulate. Even the GP2x has trouble with SNES emulation, and it's quite a fair bit beefier than the Jaguar.

[doctorclu]

Trust me, I would like to see Bubsy and Bubsy 2 on the Jaguar some day.  Strangely, I think the original intent was to publish the original for the Jaguar.  But you know we might know more about that VERY soon.

Just found the producer of Bubsy, Faran Thomason:
http://freejag.atari.org/forum/index.php?topic=50.msg402#msg402

[doctorclu]

Well, this has been interesting.  I was able to get PP (Pro Pack) to unpack the 104 of the 116 files.  It all unpacked to like a 7.8 meg folder from 2 meg.

There are RNC files 83, 84, 90, and 91 that I was able to play on my modplayer.  I think I see how Facing Twilight was able to extract the mods years ago.

The errors in unpacking were...
0,2,35,82,85,86,87,88,89,97,111,112

The rest is still fairly unknown, and part of the challenge is figuring out applications that can load the files.

Here's how you can help me in unlocking Bubsy:

1) SpiderJerusalem you mentioned a Hex2Dec function in Excel.   Wasn't able to find it on my home Mac version, can't guarentee work Pc will have it.  Can you run that function on the Offset and Length columns and post the updated spreadsheet here?

2) If you would like to look at what is unpacked so far and want to help identify what's what, drop me a PM.  Would appreciate all the help I can get.

3) There are many different types of extensions, I'm sure many are specific to the game environment, and others are actual extensions of a application.

.pic seems to be the backdrop pics. 
.w11 voice track for Ali baba   (not sure what would play these voice tracks or format)
.w22 Voice track for Jack and the Bean Stolk
.w33 Voice track for Hansel and gretel
.w44 Voice track for 20,000 leagues
.w55 Voice track for Alice in wonderland
.pp seem to be animated additions (the arrow that points where to go, etc)
.mus files are established straight up .mod files.
.bad I believe the files containing the bad guy information for the levels.
.bos the boss animations.  I know this from switching the bosses around.
.bin  would appear to be a binary, not confirmed.
.txt  There is one "Game.txt" file.
.dta another file with the name "Game" in it.  In this case "Game.dta"

The next part I'll present extensions how they interact with each other.
There are files BSET1.XXX through BSET5.XXX  There are basically five worlds.
The extensions that go with these labled files are
.BTR
.CRY  (only one of these and for world 4)
.DAT (also has a "SFX.DAT" file)
.RGB (in these 4 is missing.. I believe .RGB and .CRY are graphics formats?)

There are files that say World1A.XXX-World5C.XXX  There are a total of five worlds, with three levels in each for 15 levels.  The associated extentions are...
.MAP
.MPR
.CTL

"Font1", "Intro", "Logos" has these assoctiated:
.JHD
.JSP

"Atari", "Bubsy" "IDI", "Star", "Waterfon" all use
.JPL
And I'm thinking these are the opening screens that cycle at the beginning of the game.


And that covers all of the extentions.  Now we need to somehow figure out which ones of the above are what in the RNC files that were unpacked, and then figure out what applications can work with and view the files above.

The modplayer files worked straight up, so that is an encouragement.

For those that want to try your hand at uncompressing the last 12 stragglers I have the zipped file below with the 12 RNC files that errored out.  I included 90, and 91 which not only worked but are established mods to practice with.

With 90 and 91 I was able to run Pro Pack (included) on the them with the command:
pp u m *.rnc

That is ProPack.. with the "U"npack "M"otorola 68K and "*.rnc" all files in the directory ending with ".rnc"

Once you do that, just change the extension to .mod at the end 90 and 91 and they will play in your modplayer.

And that command and file structure seemed good to the program for 104 of the 116 files.  Of the remaining 12, I tried the PC, ST, Amiga, Data, and Motorola types with no luck.

Again,
- help with the hex conversion
-Help with identifying the file in the directory in the excel spreadheet attached to RNC file
-Help finding applications to open these files

Any or all would be appreciated.

Question I have to wonder, what type of computer was this developed on?  (A ST, PC, Amiga... probably not Amiga).  They had to work the graphics, and I believe that there is a program to convert graphics to work on the Jaguar?  What app would that be?

Good luck in whatever you try on this, and if you don't yield results, have fun trying.

My hope, worse caase scenario... extract the maps.  Many have asked for those.