Squashed series of ~50 distinct bugs found during a multi-day
security/correctness audit, ranging from ROM-triggerable heap
corruption and savestate-triggered OOB read primitives down to
obscure cross-platform savestate breakage.
Build is clean on `make platform=unix` with zero new warnings.
CRITICAL (ROM-triggerable, exploitable on the user's machine)
=============================================================
* ines.c iNES 2.0 PRG/CHR exponent overflow leading to undersized
allocation followed by heap buffer overflow on fread (pow() with
attacker-chosen exponent up to 63). Cap exponent at 30 and
compute size in uint32 with explicit cap below 2 GiB before
storing in int.
* ines.c miscROMSize int wraparound from attacker-controlled PRG/
CHR sizes; previous '& 0x8000000' check missed common underflow
cases. Compute in int64 and reject <= 0 or > 128 MiB.
* unif.c MAPR chunk OOB heap read on chunks of size < 4. Validate
chunk size before allocating board-name buffer.
* unif.c chunk size truncation: int conversion + missing cap allowed
a 4 GiB chunk size to wrap. Cap at 16 MiB.
* unif.c FixRomSize infinite loop on size > 0x80000000. Cap input.
* unif.c DINF chunk: months[(m - 1) % 12] is UB for m==0; m comes
from the .unf file. Clamp m into [1..12] before subtracting.
* unif.c NAME chunk: GameInfo->name = malloc(...) was unchecked.
* nsf.c size underflow: FCEU_fgetsize() - 0x80 wraps to ~UINT64_MAX
on tiny files, propagating a huge size into uppow2/FCEU_malloc.
Validate size > 0x80 before subtracting.
* nsf.c NSFMaxBank * 4096 cap tightened from 1<<20 (UB on signed-int
overflow) to 1<<19 (fits in int).
* general.c uppow2 had signed-int UB (1 << 32) and wrapped to 0 for
inputs near uint32 max. Cap at 0x80000000.
* cheat.c SubCheats[256] BSS overflow when more than 256 GG/PAR
substitution cheats are active. The array is adjacent to MMapPtrs[64]
in BSS which is exposed via retro_get_memory_data, making this
overflow visible from outside the core.
* libretro.c retro_cheat_set strcpy stack overflow with arbitrary-
length cheat strings from the frontend. Use strlcpy.
CRITICAL (savestate-triggerable on a malicious .fcs file)
=========================================================
* fds.c FDS savestate OOB read primitive: InDisk loaded from
savestate is used as index into 8-element diskdata[] static
pointer array. A value 8..254 dereferences arbitrary memory as
a pointer (heap-read primitive). Also bounds-checked SelectDisk,
mapperFDS_block, mapperFDS_blockstart, mapperFDS_diskaddr,
mapperFDS_blocklen so blockstart+diskaddr stays within the 65500-
byte disk buffer.
* 11 mappers had savestate-loaded variables masked at write time
but not at restore time, used as indices into fixed arrays:
- 88.c, KS7037.c, 112.c cmd indexes reg[8]
- sachen.c (S8259, S74LS374N) cmd indexes latch[8]
- 357.c dipswitch indexes outer_bank[4]
- unrom512.c flash_state indexes erase_a/d/b[5]
- 368.c preg indexes banks[8]
- 69.c sndcmd indexes sreg[14]
- mmc2and4.c latch0/latch1 index creg[4]
None individually exploitable into RCE - the array writes corrupt
adjacent BSS with constrained data flowing in - but each is an
out-of-bounds read or write from attacker-controllable input.
HIGH (memory-safety, reachable on any load)
===========================================
* fceu-memory.c FCEU_malloc deref-of-NULL on allocation failure
('ret = 0; memset(ret, 0, size);').
* file.c multiple FCEUFILE/MakeMemWrap/MakeMemWrapBuffer unchecked
allocations and unchecked filestream_tell return.
* libretro.c GameInfo NULL-derefs in three entry points
(retro_set_controller_port_device, retro_get_memory_data,
retro_get_memory_size) reachable on operations called before a
successful load.
* libretro.c framebuffer leak ~256 KB per failed FCEUI_LoadGame
(the libretro frontend doesn't call retro_unload_game on a
failed load).
* libretro.c 3DS retro_deinit unchecked linearFree.
* libretro.c stereo / NTSC filter unchecked malloc returns.
* fceu.c FCEUI_LoadGame unchecked GameInfo malloc.
* fds.c SubLoad and FDSLoad unchecked FCEU_malloc on diskdatao
backup buffers (NULL-deref in subsequent memcpy).
* fceu.c AllocGenieRW partial-failure leak: AReadG allocated but
BWriteG malloc fails -> 256 KB leak per retry.
* input/bworld.c Update(): unbounded strcpy from attacker-supplied
data into 20-byte bdata. Replaced with length-bounded copy.
* cart.c setprg2r/4r and setchr1r/2r/4r/8r mask-underflow guards.
SetupCartPRGMapping/SetupCartCHRMapping compute (size >> N) - 1
which underflows to 0xFFFFFFFF for chips smaller than the unit.
setprg8r/16r/32r and setchr8r already had defensive size checks;
the smaller units did not. malee.c (2 KB chip) and mapper 218
(2 KB NTARAM-as-CHR) accidentally avoid OOB; the primitive is
unsafe for any future board.
* video.c FCEU_InitVirtualVideo XBuf/XDBuf partial-failure leak.
* video.c, fceu.c FCEU_DispMessage / FCEU_printf / FCEU_PrintError:
vsprintf into fixed stack buffers replaced with vsnprintf.
* core: validate magic-string read length on FDS/UNIF/NSF load
(reject files too short to contain the magic so previous static
buffer / stack garbage doesn't spuriously match).
LEAKS (every cart load/unload cycle)
====================================
* mmc5.c MMC5 cart-side: WRAM (up to 64K) + MMC5fill (1K) + ExRAM
(1K) leaked per cycle. NSFMMC5_Close existed but was only used
for NSF code path.
* onebus.c Mapper 270/436: 8 KB CHRRAM leaked per cycle.
* 330.c, 375.c, 528.c: 8 KB WRAM each, no Close at all.
CORRECTNESS (UB / ABI / endianness)
===================================
* fceu-endian.c FlipByteOrder loop bound was 'count' instead of
'count/2', making it a no-op for every even count and silently
breaking savestate portability for every FCEUSTATE_RLSB-marked
field. The '#ifndef GEKKO' workarounds scattered through the
codebase (sound.c, vrc7.c, vrc6.c) were symptoms of this root
cause.
* state.c AddExState bounds check ran AFTER writing the entry, so
when SFEXINDEX hit the 63-entry cap the next call would write
the entry then immediately overwrite it with the terminator.
* state.c FCEUSS_Save_Mem: post-save callback was guarded by
'if (SPreSave)' instead of 'if (SPostSave)'.
* Sequence-point UB in counter expressions across 4 board files,
e.g. 'x = !x ? a : --x' and 'x = ++x % n'. GCC -Wsequence-point
flags all five sites (285.c, 413.c, asic_mmc3.c, jyasic.c).
* SFORMAT size mismatches between declared variable type and
AddExState size argument:
- asic_vrc3.c VRC3_count/VRC3_reload (uint16, saved as 1 byte)
- mmc3.c m555_count (uint32, saved as 2 bytes), m555_count_-
expired (uint8, saved as 2 bytes - OOB write into adjacent
BSS).
* unrom512.c UNROM-512 mapper 30 .srm save format: host-endian
uint32 flash write counters. Now stored as LE on disk regardless
of host (Battle Kid 2, Twin Dragons, Lizard, Sole, etc.).
* ~70 multi-byte single-variable SFORMAT/AddExState entries across
36 board files were saved as host-byte-order. After the
FlipByteOrder fix, these are now byte-swapped on BE so cross-
platform savestates round-trip correctly.
* coolgirl.c new ExStateLE() macro added; 22 multi-byte sites.
* pic16c5x.c 11 multi-byte AddExState calls (m_PC, m_PREVPC,
m_CONFIG, m_WDT, m_prescaler, m_opcode, m_STACK[0/1], m_icount,
m_delay_timer, m_rtcc, m_inst_cycles, m_clock2cycle).
* onebus.c PowerJoy Supermax submapper detection used non-portable
*(uint32*)&info->MD5 cast that read different bytes on LE vs BE.
* fds.c clean up redundant FCEUSTATE_RLSB encoding in AddExState
calls that also passed type=1 (idempotent OR; readability fix).
DOCUMENTATION
=============
* input.c UpdateGP's *(uint32*)data cast looks like a typical
endian bug but is actually correct (the libretro frontend builds
JSReturn with matching host-uint32 shifts). Comment added to
prevent future "fixes" from breaking it.
Limitations not addressed
=========================
* Element-stride-aware byte swapping. The savestate byte-swap
mechanism (FlipByteOrder over the entire SFORMAT entry buffer)
is structurally wrong for arrays of multi-byte values: it
reverses the whole buffer end-to-end instead of byte-swapping
each element. Several places that need cross-platform-portable
arrays (VRC7 sound state, jyasic chr[8]) work around this by
either splitting arrays into per-element SFORMAT entries (n106
PlayIndex, bandai reg) or by skipping save entirely on BE via
#ifndef GEKKO. A proper fix would extend the size encoding with
an element-stride field. Left for a future change because it
would change the savestate format.
* Strict-aliasing UB in ppu.c (around 9 sites doing
*(uint32*)uint8_buf for fast 4-byte writes via FCEU_dwmemset).
Works in practice with all common compilers because the patterns
are byte-symmetric, but is formally UB.
* FCEU_gmalloc calls exit(1) on OOM. A libretro core should never
exit() because that takes down the whole frontend. Used by
100+ call sites; refactoring to return-NULL is out of scope here.
Testing
=======
* Build: clean on `make platform=unix` with -O2; no new warnings.
* FlipByteOrder fix verified by hand-trace and a standalone unit
test for counts 2, 4, 8.
* uppow2 fix verified by unit test across 13 boundary cases.
* SFORMAT size mismatches and missing-RLSB cases identified by
Python static-analysis scripts that cross-reference SFORMAT
entries against variable declarations.
* iNES 2.0 exponent fix verified by hand-tracing what byte 0xFF
produces post-fix: exp=30 (capped), mult=7, size=3 GiB nominal,
capped to 1 GiB, capped to 2 GiB by uppow2, FCEU_malloc returns
NULL on most systems, loader returns 0. No heap overflow for
any input byte.
* Savestate-loaded array index audit: built a Python scanner that
extracts each AddExState/SFORMAT entry and cross-references the
variable name against array-index uses in the same file. All
flagged sites covered.
* A libFuzzer harness and seed corpus generator (fuzz_main.c,
gen_seed_corpus.py) accompany this submission for ongoing
regression testing.
546 lines
10 KiB
C
546 lines
10 KiB
C
/* FCE Ultra - NES/Famicom Emulator
|
|
*
|
|
* Copyright notice for this file:
|
|
* Copyright (C) 2003 Xodnizel
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
#include <stdarg.h>
|
|
|
|
#include "fceu.h"
|
|
#include "fceu-types.h"
|
|
#include "x6502.h"
|
|
#include "fceu.h"
|
|
#include "ppu.h"
|
|
#include "sound.h"
|
|
#include "general.h"
|
|
#include "fceu-endian.h"
|
|
#include "fceu-memory.h"
|
|
|
|
#include "cart.h"
|
|
#include "nsf.h"
|
|
#include "fds.h"
|
|
#include "ines.h"
|
|
#include "unif.h"
|
|
#include "cheat.h"
|
|
#include "palette.h"
|
|
#include "state.h"
|
|
#include "video.h"
|
|
#include "input.h"
|
|
#include "file.h"
|
|
#include "crc32.h"
|
|
#include "vsuni.h"
|
|
|
|
uint64 timestampbase;
|
|
|
|
FCEUGI *GameInfo = NULL;
|
|
void (*GameInterface)(int h);
|
|
|
|
void (*GameStateRestore)(int version);
|
|
|
|
readfunc ARead[0x10000];
|
|
writefunc BWrite[0x10000];
|
|
static readfunc *AReadG = NULL;
|
|
static writefunc *BWriteG = NULL;
|
|
static int RWWrap = 0;
|
|
|
|
static DECLFW(BNull)
|
|
{
|
|
}
|
|
|
|
static DECLFR(ANull)
|
|
{
|
|
return(X.DB);
|
|
}
|
|
|
|
int AllocGenieRW(void)
|
|
{
|
|
if (!AReadG)
|
|
{
|
|
if (!(AReadG = (readfunc*)FCEU_malloc(0x8000 * sizeof(readfunc))))
|
|
return 0;
|
|
}
|
|
else
|
|
memset(AReadG, 0, 0x8000 * sizeof(readfunc));
|
|
|
|
if (!BWriteG)
|
|
{
|
|
if (!(BWriteG = (writefunc*)FCEU_malloc(0x8000 * sizeof(writefunc))))
|
|
{
|
|
/* Free AReadG too on partial-failure to avoid leaking a
|
|
* 256 KB read-handler table. Subsequent calls would otherwise
|
|
* see AReadG != NULL and skip its alloc, but RWWrap stays 0
|
|
* because we return 0, so the table is never used or freed. */
|
|
free(AReadG);
|
|
AReadG = NULL;
|
|
return 0;
|
|
}
|
|
}
|
|
else
|
|
memset(BWriteG, 0, 0x8000 * sizeof(writefunc));
|
|
|
|
RWWrap = 1;
|
|
return 1;
|
|
}
|
|
|
|
void FlushGenieRW(void)
|
|
{
|
|
int32 x;
|
|
|
|
if (RWWrap)
|
|
{
|
|
for (x = 0; x < 0x8000; x++)
|
|
{
|
|
ARead[x + 0x8000] = AReadG[x];
|
|
BWrite[x + 0x8000] = BWriteG[x];
|
|
}
|
|
free(AReadG);
|
|
free(BWriteG);
|
|
AReadG = NULL;
|
|
BWriteG = NULL;
|
|
}
|
|
RWWrap = 0;
|
|
}
|
|
|
|
readfunc FASTAPASS(1) GetReadHandler(int32 a)
|
|
{
|
|
if (a >= 0x8000 && RWWrap)
|
|
return AReadG[a - 0x8000];
|
|
else
|
|
return ARead[a];
|
|
}
|
|
|
|
void FASTAPASS(3) SetReadHandler(int32 start, int32 end, readfunc func)
|
|
{
|
|
int32 x;
|
|
|
|
if (!func)
|
|
func = ANull;
|
|
|
|
if (RWWrap)
|
|
for (x = end; x >= start; x--)
|
|
{
|
|
if (x >= 0x8000)
|
|
AReadG[x - 0x8000] = func;
|
|
else
|
|
ARead[x] = func;
|
|
}
|
|
else
|
|
for (x = end; x >= start; x--)
|
|
ARead[x] = func;
|
|
}
|
|
|
|
writefunc FASTAPASS(1) GetWriteHandler(int32 a)
|
|
{
|
|
if (RWWrap && a >= 0x8000)
|
|
return BWriteG[a - 0x8000];
|
|
else
|
|
return BWrite[a];
|
|
}
|
|
|
|
void FASTAPASS(3) SetWriteHandler(int32 start, int32 end, writefunc func)
|
|
{
|
|
int32 x;
|
|
|
|
if (!func)
|
|
func = BNull;
|
|
|
|
if (RWWrap)
|
|
for (x = end; x >= start; x--)
|
|
{
|
|
if (x >= 0x8000)
|
|
BWriteG[x - 0x8000] = func;
|
|
else
|
|
BWrite[x] = func;
|
|
}
|
|
else
|
|
for (x = end; x >= start; x--)
|
|
BWrite[x] = func;
|
|
}
|
|
|
|
uint8 RAM[0x800];
|
|
|
|
uint8 PAL = 0;
|
|
|
|
static DECLFW(BRAML)
|
|
{
|
|
RAM[A] = V;
|
|
}
|
|
|
|
static DECLFR(ARAML)
|
|
{
|
|
return RAM[A];
|
|
}
|
|
|
|
static DECLFW(BRAMH)
|
|
{
|
|
RAM[A & 0x7FF] = V;
|
|
}
|
|
|
|
static DECLFR(ARAMH)
|
|
{
|
|
return RAM[A & 0x7FF];
|
|
}
|
|
|
|
void FCEUI_CloseGame(void)
|
|
{
|
|
if (!GameInfo)
|
|
return;
|
|
|
|
if (GameInfo->name)
|
|
free(GameInfo->name);
|
|
GameInfo->name = 0;
|
|
if (GameInfo->type != GIT_NSF)
|
|
FCEU_FlushGameCheats();
|
|
GameInterface(GI_CLOSE);
|
|
ResetExState(0, 0);
|
|
FCEU_CloseGenie();
|
|
free(GameInfo);
|
|
GameInfo = 0;
|
|
}
|
|
|
|
void ResetGameLoaded(void)
|
|
{
|
|
if (GameInfo)
|
|
FCEUI_CloseGame();
|
|
|
|
GameStateRestore = NULL;
|
|
PPU_hook = NULL;
|
|
GameHBIRQHook = NULL;
|
|
|
|
if (GameExpSound.Kill)
|
|
GameExpSound.Kill();
|
|
memset(&GameExpSound, 0, sizeof(GameExpSound));
|
|
|
|
MapIRQHook = NULL;
|
|
MMC5Hack = 0;
|
|
PEC586Hack = 0;
|
|
PAL &= 1;
|
|
default_palette_selected = 0;
|
|
}
|
|
|
|
int UNIFLoad(const char *name, FCEUFILE *fp);
|
|
int iNESLoad(const char *name, FCEUFILE *fp);
|
|
int FDSLoad(const char *name, FCEUFILE *fp);
|
|
int NSFLoad(FCEUFILE *fp);
|
|
|
|
FCEUGI *FCEUI_LoadGame(const char *name, const uint8_t *databuf, size_t databufsize,
|
|
frontend_post_load_init_cb_t frontend_post_load_init_cb)
|
|
{
|
|
FCEUFILE *fp;
|
|
|
|
ResetGameLoaded();
|
|
|
|
GameInfo = malloc(sizeof(FCEUGI));
|
|
if (!GameInfo)
|
|
return NULL;
|
|
memset(GameInfo, 0, sizeof(FCEUGI));
|
|
|
|
GameInfo->soundchan = 0;
|
|
GameInfo->soundrate = 0;
|
|
GameInfo->name = 0;
|
|
GameInfo->type = GIT_CART;
|
|
GameInfo->vidsys = GIV_USER;
|
|
GameInfo->input[0] = GameInfo->input[1] = -1;
|
|
GameInfo->inputfc = -1;
|
|
GameInfo->cspecial = 0;
|
|
|
|
fp = FCEU_fopen(name, databuf, databufsize);
|
|
|
|
if (!fp) {
|
|
FCEU_PrintError("Error opening \"%s\"!", name);
|
|
|
|
free(GameInfo);
|
|
GameInfo = NULL;
|
|
|
|
return NULL;
|
|
}
|
|
|
|
if (iNESLoad(name, fp))
|
|
goto endlseq;
|
|
if (NSFLoad(fp))
|
|
goto endlseq;
|
|
if (UNIFLoad(NULL, fp))
|
|
goto endlseq;
|
|
if (FDSLoad(NULL, fp))
|
|
goto endlseq;
|
|
|
|
FCEU_PrintError("An error occurred while loading the file.\n");
|
|
FCEU_fclose(fp);
|
|
|
|
if (GameInfo->name)
|
|
free(GameInfo->name);
|
|
GameInfo->name = NULL;
|
|
free(GameInfo);
|
|
GameInfo = NULL;
|
|
|
|
return NULL;
|
|
|
|
endlseq:
|
|
FCEU_fclose(fp);
|
|
|
|
if (frontend_post_load_init_cb)
|
|
(*frontend_post_load_init_cb)();
|
|
|
|
FCEU_ResetVidSys();
|
|
if (GameInfo->type != GIT_NSF)
|
|
if (FSettings.GameGenie)
|
|
FCEU_OpenGenie();
|
|
|
|
PowerNES();
|
|
|
|
if (GameInfo->type != GIT_NSF) {
|
|
FCEU_LoadGamePalette();
|
|
FCEU_LoadGameCheats();
|
|
}
|
|
|
|
FCEU_ResetPalette();
|
|
|
|
return(GameInfo);
|
|
}
|
|
|
|
int FCEUI_Initialize(void) {
|
|
if (!FCEU_InitVirtualVideo())
|
|
return 0;
|
|
memset(&FSettings, 0, sizeof(FSettings));
|
|
FSettings.UsrFirstSLine[0] = 8;
|
|
FSettings.UsrFirstSLine[1] = 0;
|
|
FSettings.UsrLastSLine[0] = 231;
|
|
FSettings.UsrLastSLine[1] = 239;
|
|
FSettings.SoundVolume = 100;
|
|
FCEUPPU_Init();
|
|
X6502_Init();
|
|
return 1;
|
|
}
|
|
|
|
void FCEUI_Kill(void) {
|
|
FCEU_KillVirtualVideo();
|
|
FCEU_KillGenie();
|
|
}
|
|
|
|
void FCEUI_Emulate(uint8 **pXBuf, int32 **SoundBuf, int32 *SoundBufSize, int skip) {
|
|
int r, ssize;
|
|
|
|
FCEU_UpdateInput();
|
|
if (geniestage != 1) FCEU_ApplyPeriodicCheats();
|
|
r = FCEUPPU_Loop(skip);
|
|
|
|
ssize = FlushEmulateSound();
|
|
|
|
timestampbase += timestamp;
|
|
|
|
timestamp = 0;
|
|
sound_timestamp = 0;
|
|
|
|
*pXBuf = skip ? 0 : XBuf;
|
|
*SoundBuf = WaveFinal;
|
|
*SoundBufSize = ssize;
|
|
}
|
|
|
|
|
|
void ResetNES(void)
|
|
{
|
|
if (!GameInfo)
|
|
return;
|
|
GameInterface(GI_RESETM2);
|
|
FCEUSND_Reset();
|
|
FCEUPPU_Reset();
|
|
X6502_Reset();
|
|
}
|
|
|
|
int option_ramstate = 0;
|
|
|
|
void FCEU_MemoryRand(uint8 *ptr, uint32 size)
|
|
{
|
|
int x = 0;
|
|
while (size) {
|
|
#if 0
|
|
*ptr = (x & 4) ? 0xFF : 0x00; /* Huang Di DEBUG MODE enabled by default */
|
|
/* Cybernoid NO MUSIC by default */
|
|
*ptr = (x & 4) ? 0x7F : 0x00; /* Huang Di DEBUG MODE enabled by default */
|
|
/* Minna no Taabou no Nakayoshi Daisakusen DOESN'T BOOT */
|
|
/* Cybernoid NO MUSIC by default */
|
|
*ptr = (x & 1) ? 0x55 : 0xAA; /* F-15 Sity War HISCORE is screwed... */
|
|
/* 1942 SCORE/HISCORE is screwed... */
|
|
#endif
|
|
uint8_t v = 0;
|
|
switch (option_ramstate)
|
|
{
|
|
case 0: v = 0xff; break;
|
|
case 1: v = 0x00; break;
|
|
case 2: v = (uint8_t)rand(); break;
|
|
}
|
|
*ptr = v;
|
|
x++;
|
|
size--;
|
|
ptr++;
|
|
}
|
|
}
|
|
|
|
void hand(X6502 *X, int type, uint32 A)
|
|
{
|
|
}
|
|
|
|
void PowerNES(void)
|
|
{
|
|
if (!GameInfo)
|
|
return;
|
|
|
|
encryptOpcodes =0;
|
|
|
|
FCEU_CheatResetRAM();
|
|
FCEU_CheatAddRAM(2, 0, RAM);
|
|
|
|
FCEU_GeniePower();
|
|
|
|
FCEU_MemoryRand(RAM, 0x800);
|
|
|
|
SetReadHandler(0x0000, 0xFFFF, ANull);
|
|
SetWriteHandler(0x0000, 0xFFFF, BNull);
|
|
|
|
SetReadHandler(0, 0x7FF, ARAML);
|
|
SetWriteHandler(0, 0x7FF, BRAML);
|
|
|
|
SetReadHandler(0x800, 0x1FFF, ARAMH); /* Part of a little */
|
|
SetWriteHandler(0x800, 0x1FFF, BRAMH); /* hack for a small speed boost. */
|
|
|
|
InitializeInput();
|
|
FCEUSND_Power();
|
|
FCEUPPU_Power();
|
|
|
|
/* Have the external game hardware "powered" after the internal NES stuff.
|
|
Needed for the NSF code and VS System code.
|
|
*/
|
|
GameInterface(GI_POWER);
|
|
if (GameInfo->type == GIT_VSUNI)
|
|
FCEU_VSUniPower();
|
|
|
|
timestampbase = 0;
|
|
X6502_Power();
|
|
FCEU_PowerCheats();
|
|
}
|
|
|
|
void FCEU_ResetVidSys(void)
|
|
{
|
|
int w;
|
|
|
|
if (GameInfo->vidsys == GIV_NTSC)
|
|
w = 0;
|
|
else if (GameInfo->vidsys == GIV_PAL)
|
|
{
|
|
w = 1;
|
|
dendy = 0;
|
|
}
|
|
else
|
|
w = FSettings.PAL;
|
|
|
|
PAL = w ? 1 : 0;
|
|
|
|
if (PAL)
|
|
dendy = 0;
|
|
|
|
normal_scanlines = dendy ? 290 : 240;
|
|
totalscanlines = normal_scanlines + (overclock_enabled ? extrascanlines : 0);
|
|
|
|
FCEUPPU_SetVideoSystem(w || dendy);
|
|
SetSoundVariables();
|
|
}
|
|
|
|
FCEUS FSettings;
|
|
|
|
void FCEU_printf(char *format, ...)
|
|
{
|
|
char temp[2048];
|
|
|
|
va_list ap;
|
|
|
|
va_start(ap, format);
|
|
/* vsnprintf instead of vsprintf so a long expansion (e.g. of a ROM
|
|
* filename or an attacker-controlled string field) is truncated
|
|
* rather than overflowing the stack buffer. */
|
|
vsnprintf(temp, sizeof(temp), format, ap);
|
|
FCEUD_Message(temp);
|
|
|
|
va_end(ap);
|
|
}
|
|
|
|
void FCEU_PrintError(char *format, ...)
|
|
{
|
|
char temp[2048];
|
|
|
|
va_list ap;
|
|
|
|
va_start(ap, format);
|
|
vsnprintf(temp, sizeof(temp), format, ap);
|
|
FCEUD_PrintError(temp);
|
|
|
|
va_end(ap);
|
|
}
|
|
|
|
void FCEUI_SetRenderedLines(int ntscf, int ntscl, int palf, int pall)
|
|
{
|
|
FSettings.UsrFirstSLine[0] = ntscf;
|
|
FSettings.UsrLastSLine[0] = ntscl;
|
|
FSettings.UsrFirstSLine[1] = palf;
|
|
FSettings.UsrLastSLine[1] = pall;
|
|
if (PAL || dendy)
|
|
{
|
|
FSettings.FirstSLine = FSettings.UsrFirstSLine[1];
|
|
FSettings.LastSLine = FSettings.UsrLastSLine[1];
|
|
}
|
|
else
|
|
{
|
|
FSettings.FirstSLine = FSettings.UsrFirstSLine[0];
|
|
FSettings.LastSLine = FSettings.UsrLastSLine[0];
|
|
}
|
|
}
|
|
|
|
void FCEUI_SetVidSystem(int a)
|
|
{
|
|
FSettings.PAL = a ? 1 : 0;
|
|
|
|
if (!GameInfo)
|
|
return;
|
|
|
|
FCEU_ResetVidSys();
|
|
FCEU_ResetPalette();
|
|
}
|
|
|
|
int FCEUI_GetCurrentVidSystem(int *slstart, int *slend)
|
|
{
|
|
if (slstart)
|
|
*slstart = FSettings.FirstSLine;
|
|
if (slend)
|
|
*slend = FSettings.LastSLine;
|
|
return(PAL);
|
|
}
|
|
|
|
void FCEUI_SetGameGenie(int a)
|
|
{
|
|
FSettings.GameGenie = a ? 1 : 0;
|
|
}
|
|
|
|
int32 FCEUI_GetDesiredFPS(void)
|
|
{
|
|
if (PAL || dendy)
|
|
return(838977920); /* ~50.007 */
|
|
else
|
|
return(1008307711); /* ~60.1 */
|
|
}
|