+-----------------------------------------------------------------+
| PCEmon RS232 MONITOR BY CHRIS COVELL <chris_covell-at-yahoo.ca> |
+-----------------------------------------------------------------+
 Version 1.27.4 (10/25/2015)  BufSize:$0000  Baud Rate:19200bps

 General Commands
         ? [c] all/each command help. 
         / command listing and status.
         ! extra developer commands.
         O [e/r/s] toggle output/echo.
         B <0..2> 9600/19200/57600 baud.
         P <dd> hexdump lines before pause.
         N next screen palette.
         T [0..2 [aaaa dd]] - view (clear/set) cheats.
         # [c]list/execute external helper command.

 Memory Commands
         H [v]<aaaa> [bbbb] hexdump (v)address.
         H <mm> : [mm] hexdump mpr banks.
         D [v]<aaaa> [bbbb] dump binary.
         D <mm> : [mm] bindump mpr banks.
         M <aaaa> <dd> [...dd] data to memory.
         F <aaaa> <bbbb> <dd> fill memory.
         U [v][aaaa] upload data to buffer (no option) or (v)ram address.
         U [mm]: upload data to MPR banks.
         J <aaaa> jump to address.
         G [l/s/r] Go to (resume) savestate / (Load/Save savestate / save Raw RAM).

 Buffer Commands
         L <size> load buffer from serial.
         S save buffer to serial.
         C check buffer.
         W [v]<aaaa> copy buffer to (v)ram.
         ( vce pals to buffer.
         ) buffer to vce.
         < bram to buffer.
         > buffer to bram.

 Register Commands
         A/X/Y <dd> set register value.
         0..7 <dd> set mpr bank value.
         8 set jump mpr7.
         V <rr> <dddd> data to vdc register.
         R see cpu registers.

 CD System Card hacked Cheat Menu
 Save State Procedure
 Helper Commands

?
    .... (all commands get printed)
? J
    J <AAAA> - Jump to (execute) address 

/
   .... (command overview gets printed)

These are a bunch of miscellaneous commands that would help the more technically-inclined, so I'm hiding them here:

• Resolution-changing commands let you change the horizontal screen resolution before returning to a game.
• ADPCM (CD unit sample memory) transfer commands let you copy the 64K ADPCM RAM data to CDRAM for viewing or dumping, as well as copying this RAM area back to the ADPCM area.
• ADPCM play commands let you play ADPCM data at a specified sample rate (0-F).

!L
   .... (screen resolution set to 256 wide)
!M
   .... (screen resolution set to 352 wide)
!H
   .... (screen resolution set to 512 wide)
!<
   ADPCM copied to Banks 80:87.
U 80:
!>
   Banks 80:87 copied to ADPCM RAM.
!P 9   
   .... (ADPCM memory gets played)
!P
   .... (sample is silenced)

This will show you (and change) where the program output goes.  By default, program output goes to the screen and out the RS-232 port to your computer.  "Echo" means each letter that you type also gets echoed back to your computer's terminal program.

When dumping binaries from the PCE, you'll want to turn Echo and RS-232 off beforehand, so that your typing, etc, doesn't get saved alongside the binary file.  When examining screen contents or VRAM, you might want to turn Screen output off.

*IMPORTANT*  If you use a terminal program that isn't interactive, ie: it has a text entry line that doesn't get sent over the serial port until you hit Enter, you should turn OFF echo.  Otherwise, incoming characters to PCEmon will get lost or corrupted.  (This is not a bug; echo means it sends back whatever came in over the serial line as soon as it receives it (which, obviously takes an equal amount of time to send back.)

O
     Output Device(s): SCREEN RS-232 [ECHO ON]
O S
     Output Device(s): RS-232 [ECHO ON]
ORE
     Output Device(s): SCREEN [ECHO OFF]
       

B 0
    Baud Rate: 9600 bps

P 10
     Hexdump Pause now $10 

Version 1.27 of PCEmon adds a form of cheating that I'm sure you're familiar with: Action Replay-style cheat codes!  You can activate between 1 to 3 cheat codes (in slots 0, 1, or 2) that a CD System Card, hacked with version 1.27 of PCEmon, will keep active during CD games.

First, of course, you start up your hacked System Card, and press Select (or Select+Run, whatever) to start up PCEmon, hopefully anywhere you want: in the Syscard menu, on the game's title screen, or in-game even.  Then after connecting the serial adaptor to your PCE, invoke the Trainer command in PCEmon.  Finally type 'G' to Go back to the game, and swap the PCE joypad back in.  If the border around the screen is a dark blue, the Trainer is working!

Note that you can also optionally enable cheats through a hacked CD System Card that I recently made.  Where do you get cheats from?  Well, look for PCE RAM hacks online, or use the G R option several times in a CD game, then search for them using the new # T Trainer Search.

T 2 3CF5 09
   Trainer (Cheats): x  x  $3CF5:09
T   
   Trainer (Cheats): x  x  $3CF5:09
T 2
   Trainer (Cheats): x  x  x

Although the standard commands are built-in to PCEmon's startup bank, you might want to load in larger one-time functions -- for example, things like a disassembly or screen dump.  So, this command will search through the buffer and all the banks (either ROM or CD-RAM) to find the signature of these optional helpers.

The ROM-based PCEmon probably has the helpers already there, but you'll have to upload them into CD RAM yourself when using PCEmon that's embedded in a CD System Card.

>#
 06  D <AAAA>[BBBB] - Disassemble address range
 07  X [B/W/S/G [pal]] Save Screen (BG/Wide/Spr/Grouped) as PCX
>u
  Okay, send your binary!
  Received $0790 bytes, saved from $2200 to $298F
>#
 Buf D <AAAA>[BBBB] - Disassemble address range
 06  D <AAAA>[BBBB] - Disassemble address range
 07  X [B/W/S/G [pal]] Save Screen (BG/Wide/Spr/Grouped) as PCX
>u 87:
  Okay, send your binary!
  Received $002000 bytes, saved from $87:0000 to $87:1FFF
>#
 87  X [B/W/S/G [pal]] Save Screen (BG/Wide/Spr/Grouped) as PCX
># X
  ...(PCX save gets executed)

This shows a HEX and ASCII representation of any address in the CPU's memory map.  Note that RAM usually is between $2000-$3FFF, ROM is usually $4000-$FFFF, and I/O is $0000-$1FFF (not really useful to read a whole range of this.)  You can examine VRAM also by specifying its word address, ie: 64K of VRAM ranges from $0000-$7FFF.

Any of the MPR banks (00-FF) can be dumped (all 8192 bytes in one shot) by specifying the starting bank and optional finishing bank.  CD-RAM for example is in banks $68-$87.

I've made the hexdump round up to the next 16 bytes, so that by typing H 2000 4000 you can view all the RAM (you could type H 2000 3FFF if you really wanted to, though.)

Every 24 lines, the hexdump will pause and wait for you to press <SPACE> to continue the dump.  Or you can press any other key to stop the hexdump.  You can change this pause setting with the P <dd> command.

H 2000 2200
   ... (RAM from $2000-$21FF is shown)
H V 1000 1080
   ... (256 bytes of VRAM from $1000 to $107F is shown)
H 80:81 
   ... (CD-RAM banks $80 and $81 are shown)
H 01:
   ... (ROM bank $01 is shown)

This dumps any address in the CPU's memory map directly as a binary through your PC's serial port.  Note that if you set the dump range to a large value, it could take a long time.  It's best to turn off RS-232 messages and Echo through the O <R/E> command prior to dumping the binary (as you would be logging it using a terminal program on your PC.)

Any of the MPR banks (00-FF) can be dumped (all 8192 bytes in one shot) by specifying the starting bank and optional finishing bank.

D 4000 FFFF
   ... (dumps the current ROM/CD-RAM space)
D V 0 8000
   ... (dumps all VRAM)
D 68:87 
   ... (dumps all (Super)CD-RAM banks)
D 00:
   ... (dumps ROM bank $00)

M 2200 A9 80 53 80 4C 00 E0
    ...(writes some code to the buffer at $2200)
M 0402 00 01
M 0404 FF FF
    ...(writes to the VCE and sets the border colour to white)

F 4000 DFFF 00
    ...(zeroes-out all RAM(?) in the above memory range)

This command allows you to upload large binary files from your PC over to the PC-Engine.  PCEmon will wait for the first byte to come over, and then will write it and successive bytes directly to the specified address or memory range until it detects a gap in the upload (ie: the file has finished.)

If you don't specify a destination address, the binary file will be put into PCEmon's buffer at $2200-$3FFF, and the buffer size will be set to the amount of bytes received.  The buffer size is limited to $1E00 bytes, however.

U 
    Okay, send your binary!
    Received $0352 bytes, saved from $2200 to $2551
U 3000
    Okay, send your binary!
    Received $1000 bytes, saved from $3000 to $3FFF
U 80:
    Okay, send your binary!
    Received $006000 bytes, saved from $80:0000 to $82:1FFF
U 68:
    Okay, send your binary!
    Received $040000 bytes, saved from $68:0000 to $87:1FFF

This command will send the CPU to the subroutine that you specify the address to.  Be careful, though, because if there is no code there or the routine never exits with an RTS ($60) instruction, control might never return to PCEmon.

PCEmon keeps stored variables for the A, X, and Y registers, as well as for MPR7, and it will load up these registers and the MPR right before jumping through RAM to your address.  This is how you can set entry conditions (and a different "Jump MPR7" for mapping in ROM/CD-RAM) when you have your own code you want to take over the system with.

If the code you jump to hits a BRK ($00) instruction, then PCEmon should restart, letting you know of this.  The "PC" register in the register list should show where the PC was when the BRK occurred.

J 2200
    PC   A  X  Y  NVTBDIZC  SP  MPR 0  1  2  3  4  5  6  7 (J7)
   EA25 00 02 01  10010100  F6     FF F8 03 04 0C 0A 04 00  00
   ...(jumps to some code you have at 2200, and the program returns)
8 68
J E000
   ...(sets MPR7 to $68 right before a jump to, effectively, $68:E000
   ...but never returns)

PCEmon saves the CPU's state in RAM on startup, which allows you to freeze a game, view memory, etc., and then resume the game (hopefully) exactly where you left off, like an emulator's save state function.

(The "R" option for this command tries to save the full 8K RAM region as it appeared right when the state was frozen, so that you can compare successive Raw RAM dumps on your computer (ie: for finding cheats), or even in PCEmon using the # T Cheat Finder command.)

If you alter the memory buffer after starting up PCEmon, the save state will be lost, so it's best to Save it to your computer first.  Later, you can re-upLoad it into PCEmon and then Go back to the saved game.

Read about the full save state procedure for more details.

G S
   .... (save state is dumped to your computer)
G L
    Okay, send your binary!
    Received $1EC0 bytes, saved from $2140 to $3FFF
G
   .... (border goes green and saved game should resume)

L 800
   Okay, send your binary!

C
    2200: 4855424D 0088F284 00000000 00000000 |HUBM............
    2210: 3000CFF9 00004E45 55544F50 49413120 |0.....NEUTOPIA1
    ... 
    29E0: 0B001B1B 1B1B1D21 201B0F14 0B001B1B |.......! .......
    29F0: 1B1B1D21 1B1B1415 1A001B1B 1B1B1D20 |...!........... 

W V 0
    ...(buffer copied to the start of VRAM)
W C000
    ...(buffer copied to $C000, naturally.)

)
   ...(palette copied to index 0)
) 100
   ...(palette copied starting at the sprite palette)

Y 44
   PC   A  X  Y  NVTBDIZC  SP  MPR 0  1  2  3  4  5  6  7 (J7)
  0000 00 02 44  10010100  F6     FF F8 03 04 0C 0A 04 00  00

2 68
R
   PC   A  X  Y  NVTBDIZC  SP  MPR 0  1  2  3  4  5  6  7 (J7)
  0000 01 02 FF  10010100  F6     FF F8 68 04 0C 0A 04 00  00

8 80
R
   PC   A  X  Y  NVTBDIZC  SP  MPR 0  1  2  3  4  5  6  7 (J7)
  0000 01 02 FF  10010100  F6     FF F8 81 82 83 84 85 00  80

V 7 0080
    ...(sets horizontal scroll to $0080)
V 5 CC
    ...(turns on Sprites, BG, and interrupts)
V 9 30
    ...(changes the BAT width & height to 128x32)

R
   PC   A  X  Y  NVTBDIZC  SP  MPR 0  1  2  3  4  5  6  7 (J7)
  0000 01 02 FF  10010100  F6     FF F8 02 04 0C 0A 04 15  15

I've hacked the code of the Super System Card 3.0 (Japanese ROM patch for now; no guarantee about the US version) so that cheat codes are usable without starting up PCEmon.  Once you have the hacked system card ROM working on your PCE/Turbo (through an Everdrive or flash cart), press Select from the System Card screen, and you'll be able to move the cursor down to the cheat codes.

Controls are:

• I to enable / disable each code
• II to finish code editing
• L/R to move between the address and data digits
• U/D to alter the digit above the blue cursor.

Like the T command, the border of the screen should be a dark blue as long as the codes are active.

PCEmon can save most of the PCE's memory space so that you can resume a game mid-way through it.  This is especially useful for the 8K version of PCEmon that can be hacked into a System Card, so we'll use that.

For Saving a savestate:

1. Play your game using the hacked System Card, optionally pause the game, then press <Select> or whatever the PCEmon trigger button is.  The game will freeze.
2. If the screen border isn't red, the savestate compressed OK, so swap your joypad with the PCE serial cable.
3. Turn off Echo, and get ready to save binary logs from your PC's terminal program.
4. Back up the state to your PC.
5. Back up (S)CD-RAM to your PC.
6. Copy ADPCM RAM to RAM and back that up to your PC.
7. Copy the palette to the buffer and back that up to your PC.
8. Back up VRAM to your PC.

And you're done.  It should be safe to turn off your PCE or do whatever you like.

1. 
2.
3. O RE
4. G S
5. D 68:87
6. !<
   D 80:87
7. (
   S
8. D V 0 8000

Loading a savestate is the reverse of this process.  Start up PCEmon and make sure it's working, then:

1. Upload your VRAM file to the PCE.
2. Upload the palette file to the PCEmon buffer and copy it to the VCE.
3. Upload the ADPCM file to banks 80:87, and transfer that to ADPCM RAM.
4. Upload the (S)CD-RAM file to banks 68:87.
5. Upload the savestate file to the PCE.
6. Adjust the screen resolution and BAT size to bring the game's background image back to normal.
7. Press "G" to Go to the savestate.
8. While the screen border is green, you can safely unplug your serial cable and plug the PCE joypad back in.

1. U V 0
2. U
   )
3. U 80:
   !>
4. U 68:
5. G L
6. !L or !H , V 9 10 or V 9 40 etc.
7. G
8.

This will show the HuC6280 opcodes starting at the specified disassembly address. If the disassembly starts to look strange, then you may have not aligned the disassembly correctly with the start of the instruction.

The disassembly will pause after a full screen's worth, using the same setting as defined in the Pause command.

The disassembler gets loaded into $4000-$5FFF, so if you want to disassemble code in that region, I'd recommend uploading and running the version that goes into the buffer from $2200.

# D E6A6 E800
  E6A6:  STZ  $0402                    ;9C 02 04 
  E6A9:  STZ  $0403                    ;9C 03 04 
  E6AC:  TAI  $0404,$2200,#$0400       ;F3 04 04 00 22 00 04 
  E6B3:  LDA  #$00                     ;A9 00 
  E6B5:  STA  $15                      ;85 15 
  E6B7:  LDA  #$04                     ;A9 04 
  E6B9:  STA  $16                      ;85 16 
  E6BB:  RTS                           ;60 
  ...

# X
  ...(the current map gets dumped)
# X B f
  ...(VRAM gets dumped as BG tiles, using BG palette $0F)
# X G
  ...(VRAM gets dumped as Grouped SPR tiles, using SPR palette 0)

After dumping 8K of RAM using the G R command, you can search through this RAM to find certain byte values, or compare successive RAM dumps for differences.  It works exactly like the Action Replay / Game Shark series of cheat devices, so hopefully you're familiar with them.

This command can be loaded anywhere (to the buffer or to a (S)CD-RAM bank), but it uses CD RAM from banks 80-86 while searching.

This is an interactive cheat finder, so you need only press a key to issue a command.  The commands available to you will change depending on how many 8K RAM dumps you have uploaded in the cheat finder.

# T
   ...
 +---------------------------------------------------------+
 | RAM Cheat Search Tool  --  Step 2  --  Press a key:     |
 |   X - exit to PCEmon                                    |
 |   U - upload RAM image                                  |
 |   R - restart search                                    |
 |                                                         |
 | -- Comparison Options --                                |
 |  V - equal to numerical value                           |
 |  E - equal to previous                                  |
 |  N - not equal to previous                              |
 |  L - less than previous                                 |
 |  G - greater than previous                              |
 |                                                         |
 |  S - show search results                                |
 +---------------------------------------------------------+