The main analytical result used for this TAS

*DelayObjectGlitch
We came to be able to use "Delay Glitch" even in the world of Rockman1.
Mr. cstrakm reported on the case where the water current is generated.
In addition, FinalFighter investigated the cause accurately.

He discover "DelayStageClear" etc.
And, FinalFighter and Shinryuu worked on new TAS and accomplished shortening big time.

When we use DelayObjectGlitch, we can call a specific object in the specific location.
The kind of the object that can be called is decided by the place.

The following techniques were used in this TAS.

1:IceManStage DelayWaterCurrent(Object2F)

When we use DelayObjectGlitch

In the icemen stage, the water current is generated in the part of the image.

2:BombManStage DelayStageClear(ObjectF5)　1327665 rerecord

When we use DelayObjectGlitch with BombManStage, we can call the object of 00-FF.
"ObjectF5" can be called very uncommonly.
When ObjectF5 is called, the routine of a clear stage is suddenly called.

Program refers to a special memory when we use DelayObjectGlitch.
$2006+X: Special memory that PPU uses.
PPU uses this area. PPU reads, writes, and it changes intensely.

Therefore, being not able to reproduce this technique with NewPPU of FCEUX comes to light.
To test with various emulators, FinalFighter made HackRom for the verification.
Nestopia,Nintendulator(regular mode),FCUEX2.1.3(OldPPU):can DelayStageClear
Nintendulator(debug mode),FCEUX2.1.3(NewPPU):cannot DelayStageClear
This result confused the people with whom it had cooperated.( Mr.adelikat,Mr.Nach,Mr.Dwedit)

Mr.Inzult was tested by using PowerPak with a real NES.
It was corresponding to the result of OldPPU of FCEUX!
In a word, the thing that a DelayStageClear in the BombManStage is possible also by a real NES was shown.

I have increased the drop item beforehand.
(To make the amount of instructions become easily to 1.)
(Moreover, only Object10 and 20 appear when there are a lot of enemies.)
I executed BOT for a long time, and obtained the success case.

Number and probability of object(download） ObjectF5 is very rare.

3:WilyStage1 DelayStageClear(Object75) 1298595 rerecord

When we use DelayObjectGlitch with WilyStage1, we can call the object of 00-FF.
Object 75 go out only at time of which the drop item has gone out.
When Object75 is called, the routine of a clear stage is suddenly called as well as ObjectF5.

If software reset is not generated, it becomes a success.
I and Shinryuu executed BOT for a long time , and we get success case.

Number and probability of object(download） Object75 appears. However, there are a lot of patterns of soft reset.

4:WilyStage2 DelayStageClear(Object5D->75routine execute->DelayStageClear) 1467496rerecord

Object5D appear when DelayObjectGlitch is used in this part.
The routine of the magnet beam is called on the way when Object5D appears.
And, the memory for each $610-$6FF is mad.
At this time, the value that exists in $608 or $618 might be copied onto $6A8.
$6A8 is a memory used for the enemy's AI execution. When 0x75 enters here, the routine of a DelayStageClear is executed.

I have adjusted for $618 to become 0x75 easily. ($618 is the ninth enemy's Y coordinates. )
And ,I executed BOT, and obtained the success case.
Moreover, I am avoiding SoftReset by pushing the select-button immediately after the appearance of Object5D.

In many case, 0xF7 might enter $6A0 by Object5D.
Then, the stop of 247 frames is generated in the WilyStage3.

It took long time so that I obtain the pattern where this problem was not caused.

Number and probability of object(download） Object5D appears. However, there are a lot of patterns of soft reset and $618 is not 0x75.

* Explanation of DelayObjectGlitch
Why is DelayObjectGlitch caused?
This figure teaches causing.
When usually processing it, bank number changes into bank6, and the enemy is read.
However, when NMI is generated just before ChangeBank, the data of bank 5 is used.
As a result,DelayObjectGlitch was caused.

DelayObjectGlitch analytical result
----------------------

LoadEnemies
LoadEnemyNumber

0001D99A: BD 52 A4 lda EnemyDataPointers+0,x

X=#$02,$A454=#$8D,A=#$8D

Bank5($A454=#$8D) and 6($A454=#$29) changed by one frame in this part.

The value of $A454=#$29 is read usually.

But,the data of Bank5($A454=#$8D) is uncommonly read (by NMI).

0001D99D: 65 06 adc CurrentRoomPointer

A=A+$06=99 $06=$0C

0001D99F: 85 06 sta CurrentRoomPointer

$06=99 $07=85

Then,CurrentRoomPointer=($06)=#$8599!

-----------------------

LoadEnemies_Forward

0001D8F0: B1 06 lda (CurrentRoomPointer),y ;load enemy number

$06=#$8599 Y=#$03 $859C=#$2F

There is #$2F in $859C in the icemen stage.

0001D8F5: 20 AD D9 jsr SpawnObject

A=#$2F

-----------------------

SpawnObject

0001D9AD: 85 02 sta $02

$02=#$2F

0001D9E5: A5 02 lda $02 ;object type

0001D9E7: 9D E0 06 sta ObjectType,x

06F1=#$2F

The enemy of Object2F was generated.

-----------------------

DoEnemyAI

$AA29> BD E006: LDA ObjectType,X

AI of Object2F is executed.

-----------------------

AI_Object2F

$BA79> A9 30: LDA #$30

The water current is generated by AI of Object2F.

-----------------------

*Explanation of enemy AI of object

The execution address of enemy's AI is set to the object within the range of 0x00-0x3A
1:The enemy's AI routine execution
2: The jump adress is calculated from the object number.↓
3: AI is executed in the jump adress.

However, the object within other ranges might appear when DelayObjectGlitch is used.
Then, the jump address goes mad.

For instance, when object F5 appears.

1:The enemy's AI routine execution
2: The jump adress is calculated from the object number. Jump address=$C0BD
3: C0BD is an address on the way of stage clear processing.
4: StageClear is caused suddenly.

Enemy's AI routine analysis result.
DoEnemyAI
$AA29> BD E006: LDA ObjectType,X
  A=#$4C
$AA2D> A8: TAY
  Y=#$4C
$AA2E> B9 3BAA: LDA EnemyAIaddr+0,Y
  A=AAD1+4C=#$06
$AA31> 85 04: STA $04
  $04=#$06
$AA33> B9 3CAA: LDA EnemyAIaddr+1,Y
  A=AAD2+4C=#$D0
$AA36> 85 05: STA $05
  $05=#$D0
$AA38> 6C 0400: JMP ($0004)
  JMP (D006)

Analytical result at jump address list of each object
http://www.yuko2ch.net/rockman/JumpAddressList.txt　

*DelayObjectGlitch support LuaScript collection
*rm1delay.lua (download)
The DelayObjectGlitch succeeds when adjusting to NEXT=1.
This script is used to test whether the amount of instructions suffices.

X:X(XSpeed)
Y:Y(YSpeed)
PRE: Number of instructions from NMI end to ChangeBank
NEXT: Number of instructions from ChangeBank to NMI beginning If this value is adjusted to 1, DelayObjectGlitch is generated.

*rm1delaytest.lua (download)
LuaScript where "State for DelayObjectGlitch" is reproduced by using cheat.
When the selection is pushed twice,DelayObjectGlitch is caused.
We understand various examples occur.

WaterCurrent in IceManStage.


The number of enemies increases


ElecMan appears suddenly


SoftReset


When RockMan dies, the revival point becomes the boss ahead


An intense graphic bug


RockMan transforms to the character of the mystery. And, he comes to be able to pass wall.

*rm1delayobject_rev2.lua (download)

1:This Lua temporarily rewrites the bank number in 5(glitch emulate).
And, the appearing object number is traced. ( save or load is made good use of well)
If you save with the frame that rewrites the bank number in 5(glitch emulate frame), trouble is caused.
Therefore, please use S key and L key to the keyboard.
When the bank is 6(default frame), Lua is saved/loaded when you use the keyboard.

2:If the Rockman1Game mistake the bank with a specific frame, this Lua can measure "Object number".

3:And,the amount of instructions can be measured.
The mistake occurs when the value of "NEXT" becomes "1".

PRE:number of instructions of "NMIEnds->ChangeBank"
NEXT:number of instructions of "ChangeBank-> NMIStarts"
     We should adjust this value to "1"
NOWBANK:Bank number of the frame.
        "5" is a frame for the investigation.
        "6" is a frame for normal game.
         The NOWBANK changes like 5.5.6.5.5.6.5.5.6....
        Bank6 frame is only recorded in movie.

[6F0]..:ObjectNumbers. It is high of the possibility appearing in the same action and the frame.
        2F,AF:object of DelayWaterCurrent
        5D,DD:objcet of DelayWarpDeatch
        75,F5:object of DelayStageClear

*rm1delayobject_rev3.lua(download)

Because the processing of rm1delayobject_rev2.lua was heavy, I transplanted the processing of Rockman1 to Lua.
However, BombManStage was not able to be reproduced.

*delayclear.lua(download）
LuaScriptBOT used for DelayStageClear in BombManStage.
Moreover, the output function of the number of the object that appears with the DealyObjectGlitch is provided.
When the success case goes out, it stops temporarily.

* delayclear2.lua(download）

LuaScriptBOT used for DelayStageClear of WilyStage1.
Moreover, the output function of the number of the object that appears with the DealyObjectGlitch is provided.
When the success case goes out, it stops temporarily.

*delayclearw2.lua(download)

LuaScriptBOT used for DelayStageClear of WilyStage2.
Moreover, the output function of the number of the object that appears with the DealyObjectGlitch is provided.

1:Object 5D appears.

2:$618=0x75

3:The reset object doesn't appear simultaneously.

When it meets these 3 requirements, this script stops.
Still, soft reset might occur because of Object5D.
However, when the select button is pushed immediately after appearance of Object5D, soft reset might be avoided.

*rockman_beams.lua(download)　require LuaGD

LuaScript used when movie is made.
It makes not blinking the magnet beam.

Original(C++) is made by Bisqwit.
LuaTranslation is made by FinalFighter.

*DelayObjectGlitch support HackRom

HackRom with the same function as rm1delaytest.lua.
Validity in a real machine was confirmed by this HackRom.

*ipsPatch(Download）

Default Rockman(J):
A9 06 8D 06 C0 85 12 A5 8F F0 03 20 02 DB
lda #$06
sta $C006
sta CurrentBank
lda ZigZagFireStatus
beq +
jsr UpdateZigZagFire

Patch HackROM:
A5 16 A0 06 29 10 F0 02 A0 05 8C 06 C0 EA
lda $16
ldy #$06
and #$04
beq +
ldy #$05
+
sty $C006
nop