Fast3D Microcodes

[David]

I've been busy the past couple of days going through some N64 roms and extracting the Fast3D microcode from them, and now I'm here to share them with you all. I'm also sharing a couple basic tools that I wrote to dump some of the microcodes, and disassemble the .bin files into readable assembly code.

Download
  N64 graphics microcode dumps (Nov 17th 2018).zip (Size: 183.25 KB / Downloads: 995)

Show ContentList of games and their microcodes that I have so far

007 - GoldenEye
- gspFast3DNoN.fifo(2.0G)

Banjo-Kazooie
- gspF3DEX.fifo(1.21)
- gspL3DEX.fifo(1.21)

Banjo-Tooie
- gspF3DEX2.fifo(2.08)
- gspF3DEX2NoN.fifo(2.08)
- gspL3DEX2.fifo(2.08)

Conker's Bad Fur Day*
- gspF3DConkerN64.fifo
- gspF3DConkerN64NoN.fifo
- gspF3DConkerN64NoN.fifo(ext)
- gspF3DEX2.fifo
- gspF3DEX2NoN.fifo
- gspF3DEX2BS.fifo
- gspF3DEX2BSNoN.fifo
- gspF3DEX2BG.fifo
- gspF3DEX2BGNoN.fifo
- gspF3DEX2BGBS.fifo
- gspF3DEX2BGBSNoN.fifo

* Note: "gspF3DConkerN64" was a name I made up, as the signature for the microcode is just "Conker N64 - Rare Ltd". It seems like it is a modified version of gspFast3D, but I'm not 100% sure on that. The "gspF3DConkerN64NoN.fifo(ext)" microcode is nearly identical to "gspF3DConkerN64NoN.fifo", except that 6 lines of assembly code were added. I currently have no idea of what those extra lines do.

Diddy Kong Racing**
- gspF3DDKR
- gspF3DDKR.dram
- gspF3DDKR.fifo

** Note: "F3DDKR" is the name given to the microcode by Mupen64. It looks like a modified version of gspFast3D.

Doraemon - Nobita to 3tsu no Seireiseki
- gspFast3D
- gspFast3D.dram
- gspFast3D.fifo
- gspFast3DNoN
- gspFast3DNoN.dram
- gspFast3DNoN.fifo

Gex 64: Enter the Gecko
- gspF3DEX.fifo(1.23)

Mario Kart 64
- gspF3DEX.fifo(0.95)
- gspF3DLX.fifo(0.95)

Super Mario 64
- gspFast3D.fifo(2.0D)

Super Mario 64 (Shindou Edition)
- gspFast3D.fifo(2.0H)

Super Smash Bros
- gspF3DEX2.fifo(2.04H)

The Legend of Zelda: Ocarina of Time
- F3DZEXNoN.fifo(2.06H)
- S2DEX.fifo(2.05)

The Legend of Zelda: Majora's Mask
- F3DZEXNoN.fifo(2.08I)
- S2DEX.fifo(2.08)


---

How do I use these .bin files with an OSTask structure?

It is straight forward. The .code.bin file is the microcode that gets pointed to by t.ucode, while the .data.bin file is the data that gets pointed to by t.ucode_data. I've also included the boot microcode from every game in their respective folders in the microcode dump. I'm not sure if they are actually needed or not, but if you do need them they are pointed to by t.ucode_boot.

---

Dumping Fast3D microcodes from N64 games

The way that I got most of these microcodes is by using shygoo's Javascript API in the latest version Project64 (You will have to compile Project64 from the github repo). It is not perfect, but it should be able to get you at-least some Fast3D microcodes from most of the N64 games. Some of microcodes are harder to get than others. For example: I had to dump all 11 of Conker's Fast3D microcodes manually, since only 2 of them are loaded into RAM.

  DumpMicrocode.js.zip (Size: 4.75 KB / Downloads: 749)

This script will look for microcode signatures or RSP overlay tables in RAM to find the location of the data section of all the Fast3D microcodes in the ROM. Once I find the data section, I can then look for an OSTask structure. The OSTask structure will tell me where the main code lies within memory. Once you find the location of one fast3d microcode, then you can easily find the rest. This is because, for most N64 games, the Fast3D microcodes are contiguous in memory. For example: if you find the first microcode at address 0x80010000 and the size of the microcode is 0x1408 bytes, then you can expect the next Fast3D microcode to be at the address 0x80011410 (Both the microcode and data have to be 16-byte aligned for some reason).

To calculate the size of the microcode, you will need to find the overlay table entries in the .data section of the Fast3D microcode. For the Fast3D / F3DEX microcodes, the overlay table is simply at the beginning of the data section and are all contiguous (Usually has 5 entries). F3DEX2 works differently, and has the overlay entries near the bottom of the data section. They can be in different places depending on the exact microcode. Do note that the entries are 4-byte aligned.





The overlay table is used to dynamically overwrite code in IMEM, which means that most of the fast3d microcodes are actually bigger than 4KB. Each entry in the overlay table is 8 bytes long. The first 4 bytes tell you the source offset from the start of the microcode section in RDRAM. The following 2 bytes tell you the size of the section (minus 1). The last two bytes tells you the destination offset in IMEM where the code will be copied to.

To get the size of the microcode from the overlay entries you just simply calculate RDRAM_Offset + Size + 1 for each entry, and the largest value out of all the entries will be your total microcode size. For example, the total size for the SM64 microcode is: 0x000013A0 + 0x0067 + 1 = 0x1408.

---

Disassembling the microcode into RSP assembly

I'm sure there are plenty of free and open source MIPS R4300 disassemblers out there, but I wanted to write my own to get a better understanding of the vector registers and opcodes. 

You will need to look at the overlay table entries in the .data section to be able to correctly view the RSP assembly, otherwise the branch opcodes will not be correct. You need to set "RAM address" as the IMEM destination offset (prefixed with 0400), and set "Length" as the size + 1. Once the code has been disassembled, you can just simply select all the text with Ctrl-A and then copy-paste the assembly code into your favorite text editor.

Download: https://github.com/DavidSM64/David-s-N64...r/releases
Source: https://github.com/DavidSM64/David-s-N64...sassembler

[Redetzky]

Status on importing microcodes in Super Mario 64 (using decompiled rom):

F3DEX:

Fully functional provided you fix the adjust the display lists for the different commands, fix the perspnorm, and adjust the task yield buffer.

F3DEX2:

Fully functional* provided you adjust the display lists for the different commands, fix the perspnorm, and adjust the task yield buffer.

* Geometry corruption occurs and environment/hilite mapping is broken.

Turbo3D (Super3D):

Mostly works. Requires perspnorm fix, backface culling also needs to be disabled.
Issues: Lighting is broken and the viewport is flipped.
It should be noted that this variant of Turbo3D is only available in the FIFO variety.

[David]

As a request from Redetzky, I ported my RSP disassembler to javascript so that it can be used on platforms other than windows. It works exactly in the same way as the C# version. It should be compatible with most modern web browsers (chrome, firefox, and edge are the 3 that I tested).

You can use it here: https://bin.smwcentral.net/u/26355/N64_R...MBLER.html

[Redetzky]

Ayy lmao sm64 now runs perfectly on F3DEX2