Parallel Worlds Impa's Ways crystal glitch

Ok, so I'm still on a bit of a bug hunt in PW, and the next one that I'm trying to tackle is the crystal glitch in Impa's Ways where if you kill Moldorm before all of the floor tiles have broken, the crystal won't appear.  This isn't as much of a game-breaking bug as some people have claimed, because even if you make the mistake of killing him too quickly, you can simply fall down the hole to the room outside and then re-enter the fight and he'll re-appear, and even after repeating the process multiple times to be sure, beating him "correctly" does still trigger the crystal.  So it's not like killing him early permanently screws up your game or anything.

However, I'd still like to hunt down the bug.  I've traced out what I believe to be the offending code:

Code:

$01/C709 AD 03 04    LDA $0403  [$00:0403]   A:004A X:004A Y:0000 P:envMXdizc
$01/C70C 29 80       AND #$80                A:0080 X:004A Y:0000 P:eNvMXdizc
$01/C70E F0 3D       BEQ $3D    [$C74D]      A:0080 X:004A Y:0000 P:eNvMXdizc
$01/C710 AD 0C 04    LDA $040C  [$00:040C]   A:0080 X:004A Y:0000 P:eNvMXdizc
$01/C713 4A          LSR A                   A:0018 X:004A Y:0000 P:envMXdizc
$01/C714 AA          TAX                     A:000C X:004A Y:0000 P:envMXdizc
$01/C715 AF CA F3 7E LDA $7EF3CA[$7E:F3CA]   A:000C X:000C Y:0000 P:envMXdizc
$01/C719 D0 0C       BNE $0C    [$C727]      A:0040 X:000C Y:0000 P:envMXdizc

$01/C70E F0 3D       BEQ $3D seems to be the key, along with memory location $0403.  This instruction gets executed once per frame during the fight, and it always resolves true (and executes the branch to $C74D) until you defeat Moldorm.  If you defeat him early, it continues to resolve true indefinitely, but when you defeat him "correctly" it finally resolves false on one of the last frames of his explosion and falls through to the immediately following code where you can see the LDA $7EF3CA, which is reading the memory location storing the crystals that you have already collected, which then triggers the crystal to appear.

That's as far as I've gotten right now.  Before I go any further, I want to check whether or not that same instruction is ever executed in any of the other Moldorm fights, to rule out potential side effects.  I know there is one in the cave on the way to the sky isles in the light world, and at least two in the parallel tower, are there any others?

Also, I need to figure out a bit more about how to use Geiger's Snes9x debugger.  In the mean time, I wanted to post this here to document my progress, and also because if recent history is any indicator, somebody like superskuj will manage to figure it out by the end of the day as soon as I post  something...

Ok, so a bit more back tracing, I found where $0403 gets set

Code:

$09/EE2E 90 11      BCC $11    [$EE41]      A:8500 X:0002 Y:0002 P:envMXdizC
$09/EE30 BC 20 0E    LDY $0E20,x[$09:0E22]  A:8500 X:0002 Y:0002 P:envMXdizC
$09/EE33 C0 D6      CPY #$D6                A:8500 X:0002 Y:0009 P:envMXdizC
$09/EE35 B0 0D      BCS $0D    [$EE44]      A:8500 X:0002 Y:0009 P:envMXdizc
$09/EE37 C0 7A      CPY #$7A                A:8500 X:0002 Y:0009 P:envMXdizc
$09/EE39 D0 11      BNE $11    [$EE4C]      A:8500 X:0002 Y:0009 P:eNvMXdizc
$09/EE4C 8C B5 0F    STY $0FB5  [$09:0FB5]  A:8500 X:0002 Y:0009 P:eNvMXdizc
$09/EE4F A9 DA      LDA #$DA                A:8500 X:0002 Y:0009 P:eNvMXdizc
$09/EE51 A0 0E      LDY #$0E                A:85DA X:0002 Y:0009 P:eNvMXdizc
$09/EE53 22 96 FA 07 JSL $07FA96[$07:FA96]  A:85DA X:0002 Y:000E P:envMXdizc


$07/FA96 AD 03 04    LDA $0403  [$09:0403]  A:85DA X:0002 Y:000E P:envMXdizc
$07/FA99 09 80      ORA #$80                A:8500 X:0002 Y:000E P:envMXdiZc
$07/FA9B 8D 03 04    STA $0403  [$09:0403]  A:8580 X:0002 Y:000E P:eNvMXdizc
$07/FA9E 22 5F F6 1D JSL $1DF65F[$1D:F65F]  A:8580 X:0002 Y:000E P:eNvMXdizc

Ok, now we're getting somewhere.  One step further back in the tracing gives a nice long comparison tree at $09/AF32 that fires off when Moldorm dies, regardless of the tiles.  If it reaches the RTL at $09/AF88, the crystal drops.  Otherwise, it doesn't.  Now, to start bisecting the comparison tree and see if I can find the culprit.

Code:

$09/AF32 DA          PHX                     A:8500 X:0002 Y:0002 P:eNvMXdizc
$09/AF33 A2 0F       LDX #$0F                A:8500 X:0002 Y:0002 P:eNvMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DDF]   A:8500 X:000F Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8504 X:000F Y:0002 P:envMXdizc
$09/AF3A BD 60 0F    LDA $0F60,x[$09:0F6F]   A:8504 X:000F Y:0002 P:envMXdizc
$09/AF3D 29 40       AND #$40                A:8543 X:000F Y:0002 P:envMXdizc
$09/AF3F D0 1B       BNE $1B    [$AF5C]      A:8540 X:000F Y:0002 P:envMXdizc
$09/AF5C CA          DEX                     A:8540 X:000F Y:0002 P:envMXdizc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8540 X:000E Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DDE]   A:8540 X:000E Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8504 X:000E Y:0002 P:envMXdizc
$09/AF3A BD 60 0F    LDA $0F60,x[$09:0F6E]   A:8504 X:000E Y:0002 P:envMXdizc
$09/AF3D 29 40       AND #$40                A:8543 X:000E Y:0002 P:envMXdizc
$09/AF3F D0 1B       BNE $1B    [$AF5C]      A:8540 X:000E Y:0002 P:envMXdizc
$09/AF5C CA          DEX                     A:8540 X:000E Y:0002 P:envMXdizc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8540 X:000D Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DDD]   A:8540 X:000D Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8504 X:000D Y:0002 P:envMXdizc
$09/AF3A BD 60 0F    LDA $0F60,x[$09:0F6D]   A:8504 X:000D Y:0002 P:envMXdizc
$09/AF3D 29 40       AND #$40                A:8543 X:000D Y:0002 P:envMXdizc
$09/AF3F D0 1B       BNE $1B    [$AF5C]      A:8540 X:000D Y:0002 P:envMXdizc
$09/AF5C CA          DEX                     A:8540 X:000D Y:0002 P:envMXdizc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8540 X:000C Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DDC]   A:8540 X:000C Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8500 X:000C Y:0002 P:envMXdiZc
$09/AF5C CA          DEX                     A:8500 X:000C Y:0002 P:envMXdiZc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8500 X:000B Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DDB]   A:8500 X:000B Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8509 X:000B Y:0002 P:envMXdizc
$09/AF3A BD 60 0F    LDA $0F60,x[$09:0F6B]   A:8509 X:000B Y:0002 P:envMXdizc
$09/AF3D 29 40       AND #$40                A:8554 X:000B Y:0002 P:envMXdizc
$09/AF3F D0 1B       BNE $1B    [$AF5C]      A:8540 X:000B Y:0002 P:envMXdizc
$09/AF5C CA          DEX                     A:8540 X:000B Y:0002 P:envMXdizc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8540 X:000A Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DDA]   A:8540 X:000A Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8509 X:000A Y:0002 P:envMXdizc
$09/AF3A BD 60 0F    LDA $0F60,x[$09:0F6A]   A:8509 X:000A Y:0002 P:envMXdizc
$09/AF3D 29 40       AND #$40                A:8554 X:000A Y:0002 P:envMXdizc
$09/AF3F D0 1B       BNE $1B    [$AF5C]      A:8540 X:000A Y:0002 P:envMXdizc
$09/AF5C CA          DEX                     A:8540 X:000A Y:0002 P:envMXdizc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8540 X:0009 Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD9]   A:8540 X:0009 Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8500 X:0009 Y:0002 P:envMXdiZc
$09/AF5C CA          DEX                     A:8500 X:0009 Y:0002 P:envMXdiZc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8500 X:0008 Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD8]   A:8500 X:0008 Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8500 X:0008 Y:0002 P:envMXdiZc
$09/AF5C CA          DEX                     A:8500 X:0008 Y:0002 P:envMXdiZc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8500 X:0007 Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD7]   A:8500 X:0007 Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8500 X:0007 Y:0002 P:envMXdiZc
$09/AF5C CA          DEX                     A:8500 X:0007 Y:0002 P:envMXdiZc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8500 X:0006 Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD6]   A:8500 X:0006 Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8500 X:0006 Y:0002 P:envMXdiZc
$09/AF5C CA          DEX                     A:8500 X:0006 Y:0002 P:envMXdiZc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8500 X:0005 Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD5]   A:8500 X:0005 Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8500 X:0005 Y:0002 P:envMXdiZc
$09/AF5C CA          DEX                     A:8500 X:0005 Y:0002 P:envMXdiZc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8500 X:0004 Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD4]   A:8500 X:0004 Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8500 X:0004 Y:0002 P:envMXdiZc
$09/AF5C CA          DEX                     A:8500 X:0004 Y:0002 P:envMXdiZc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8500 X:0003 Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD3]   A:8500 X:0003 Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8500 X:0003 Y:0002 P:envMXdiZc
$09/AF5C CA          DEX                     A:8500 X:0003 Y:0002 P:envMXdiZc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8500 X:0002 Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD2]   A:8500 X:0002 Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8500 X:0002 Y:0002 P:envMXdiZc
$09/AF5C CA          DEX                     A:8500 X:0002 Y:0002 P:envMXdiZc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8500 X:0001 Y:0002 P:envMXdizc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD1]   A:8500 X:0001 Y:0002 P:envMXdizc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8509 X:0001 Y:0002 P:envMXdizc
$09/AF3A BD 60 0F    LDA $0F60,x[$09:0F61]   A:8509 X:0001 Y:0002 P:envMXdizc
$09/AF3D 29 40       AND #$40                A:8540 X:0001 Y:0002 P:envMXdizc
$09/AF3F D0 1B       BNE $1B    [$AF5C]      A:8540 X:0001 Y:0002 P:envMXdizc
$09/AF5C CA          DEX                     A:8540 X:0001 Y:0002 P:envMXdizc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8540 X:0000 Y:0002 P:envMXdiZc
$09/AF35 BD D0 0D    LDA $0DD0,x[$09:0DD0]   A:8540 X:0000 Y:0002 P:envMXdiZc
$09/AF38 F0 22       BEQ $22    [$AF5C]      A:8509 X:0000 Y:0002 P:envMXdizc
$09/AF3A BD 60 0F    LDA $0F60,x[$09:0F60]   A:8509 X:0000 Y:0002 P:envMXdizc
$09/AF3D 29 40       AND #$40                A:8540 X:0000 Y:0002 P:envMXdizc
$09/AF3F D0 1B       BNE $1B    [$AF5C]      A:8540 X:0000 Y:0002 P:envMXdizc
$09/AF5C CA          DEX                     A:8540 X:0000 Y:0002 P:envMXdizc
$09/AF5D 10 D6       BPL $D6    [$AF35]      A:8540 X:00FF Y:0002 P:eNvMXdizc
$09/AF5F 80 15       BRA $15    [$AF76]      A:8540 X:00FF Y:0002 P:eNvMXdizc
$09/AF76 A2 07       LDX #$07                A:8540 X:00FF Y:0002 P:eNvMXdizc
$09/AF78 BD 00 0B    LDA $0B00,x[$09:0B07]   A:8540 X:0007 Y:0002 P:envMXdizc
$09/AF7B C9 14       CMP #$14                A:8500 X:0007 Y:0002 P:envMXdiZc
$09/AF7D F0 F1       BEQ $F1    [$AF70]      A:8500 X:0007 Y:0002 P:eNvMXdizc
$09/AF7F C9 18       CMP #$18                A:8500 X:0007 Y:0002 P:eNvMXdizc
$09/AF81 F0 ED       BEQ $ED    [$AF70]      A:8500 X:0007 Y:0002 P:eNvMXdizc
$09/AF83 CA          DEX                     A:8500 X:0007 Y:0002 P:eNvMXdizc
$09/AF84 10 F2       BPL $F2    [$AF78]      A:8500 X:0006 Y:0002 P:envMXdizc
$09/AF78 BD 00 0B    LDA $0B00,x[$09:0B06]   A:8500 X:0006 Y:0002 P:envMXdizc
$09/AF7B C9 14       CMP #$14                A:8500 X:0006 Y:0002 P:envMXdiZc
$09/AF7D F0 F1       BEQ $F1    [$AF70]      A:8500 X:0006 Y:0002 P:eNvMXdizc
$09/AF7F C9 18       CMP #$18                A:8500 X:0006 Y:0002 P:eNvMXdizc
$09/AF81 F0 ED       BEQ $ED    [$AF70]      A:8500 X:0006 Y:0002 P:eNvMXdizc
$09/AF83 CA          DEX                     A:8500 X:0006 Y:0002 P:eNvMXdizc
$09/AF84 10 F2       BPL $F2    [$AF78]      A:8500 X:0005 Y:0002 P:envMXdizc
$09/AF78 BD 00 0B    LDA $0B00,x[$09:0B05]   A:8500 X:0005 Y:0002 P:envMXdizc
$09/AF7B C9 14       CMP #$14                A:8500 X:0005 Y:0002 P:envMXdiZc
$09/AF7D F0 F1       BEQ $F1    [$AF70]      A:8500 X:0005 Y:0002 P:eNvMXdizc
$09/AF7F C9 18       CMP #$18                A:8500 X:0005 Y:0002 P:eNvMXdizc
$09/AF81 F0 ED       BEQ $ED    [$AF70]      A:8500 X:0005 Y:0002 P:eNvMXdizc
$09/AF83 CA          DEX                     A:8500 X:0005 Y:0002 P:eNvMXdizc
$09/AF84 10 F2       BPL $F2    [$AF78]      A:8500 X:0004 Y:0002 P:envMXdizc
$09/AF78 BD 00 0B    LDA $0B00,x[$09:0B04]   A:8500 X:0004 Y:0002 P:envMXdizc
$09/AF7B C9 14       CMP #$14                A:8500 X:0004 Y:0002 P:envMXdiZc
$09/AF7D F0 F1       BEQ $F1    [$AF70]      A:8500 X:0004 Y:0002 P:eNvMXdizc
$09/AF7F C9 18       CMP #$18                A:8500 X:0004 Y:0002 P:eNvMXdizc
$09/AF81 F0 ED       BEQ $ED    [$AF70]      A:8500 X:0004 Y:0002 P:eNvMXdizc
$09/AF83 CA          DEX                     A:8500 X:0004 Y:0002 P:eNvMXdizc
$09/AF84 10 F2       BPL $F2    [$AF78]      A:8500 X:0003 Y:0002 P:envMXdizc
$09/AF78 BD 00 0B    LDA $0B00,x[$09:0B03]   A:8500 X:0003 Y:0002 P:envMXdizc
$09/AF7B C9 14       CMP #$14                A:8500 X:0003 Y:0002 P:envMXdiZc
$09/AF7D F0 F1       BEQ $F1    [$AF70]      A:8500 X:0003 Y:0002 P:eNvMXdizc
$09/AF7F C9 18       CMP #$18                A:8500 X:0003 Y:0002 P:eNvMXdizc
$09/AF81 F0 ED       BEQ $ED    [$AF70]      A:8500 X:0003 Y:0002 P:eNvMXdizc
$09/AF83 CA          DEX                     A:8500 X:0003 Y:0002 P:eNvMXdizc
$09/AF84 10 F2       BPL $F2    [$AF78]      A:8500 X:0002 Y:0002 P:envMXdizc
$09/AF78 BD 00 0B    LDA $0B00,x[$09:0B02]   A:8500 X:0002 Y:0002 P:envMXdizc
$09/AF7B C9 14       CMP #$14                A:8500 X:0002 Y:0002 P:envMXdiZc
$09/AF7D F0 F1       BEQ $F1    [$AF70]      A:8500 X:0002 Y:0002 P:eNvMXdizc
$09/AF7F C9 18       CMP #$18                A:8500 X:0002 Y:0002 P:eNvMXdizc
$09/AF81 F0 ED       BEQ $ED    [$AF70]      A:8500 X:0002 Y:0002 P:eNvMXdizc
$09/AF83 CA          DEX                     A:8500 X:0002 Y:0002 P:eNvMXdizc
$09/AF84 10 F2       BPL $F2    [$AF78]      A:8500 X:0001 Y:0002 P:envMXdizc
$09/AF78 BD 00 0B    LDA $0B00,x[$09:0B01]   A:8500 X:0001 Y:0002 P:envMXdizc
$09/AF7B C9 14       CMP #$14                A:8500 X:0001 Y:0002 P:envMXdiZc
$09/AF7D F0 F1       BEQ $F1    [$AF70]      A:8500 X:0001 Y:0002 P:eNvMXdizc
$09/AF7F C9 18       CMP #$18                A:8500 X:0001 Y:0002 P:eNvMXdizc
$09/AF81 F0 ED       BEQ $ED    [$AF70]      A:8500 X:0001 Y:0002 P:eNvMXdizc
$09/AF83 CA          DEX                     A:8500 X:0001 Y:0002 P:eNvMXdizc
$09/AF84 10 F2       BPL $F2    [$AF78]      A:8500 X:0000 Y:0002 P:envMXdiZc
$09/AF78 BD 00 0B    LDA $0B00,x[$09:0B00]   A:8500 X:0000 Y:0002 P:envMXdiZc
$09/AF7B C9 14       CMP #$14                A:8500 X:0000 Y:0002 P:envMXdiZc
$09/AF7D F0 F1       BEQ $F1    [$AF70]      A:8500 X:0000 Y:0002 P:eNvMXdizc
$09/AF7F C9 18       CMP #$18                A:8500 X:0000 Y:0002 P:eNvMXdizc
$09/AF81 F0 ED       BEQ $ED    [$AF70]      A:8500 X:0000 Y:0002 P:eNvMXdizc
$09/AF83 CA          DEX                     A:8500 X:0000 Y:0002 P:eNvMXdizc
$09/AF84 10 F2       BPL $F2    [$AF78]      A:8500 X:00FF Y:0002 P:eNvMXdizc
$09/AF86 FA          PLX                     A:8500 X:00FF Y:0002 P:eNvMXdizc
$09/AF87 38          SEC                     A:8500 X:0002 Y:0002 P:envMXdizc
$09/AF88 6B          RTL                     A:8500 X:0002 Y:0002 P:envMXdizC

Edit: Hold on... that's not a big compare tree, it's a loop. This looks suspiciously like code checking for floor tiles to complete. Following my success and failure traces, on success (all floor tiles completed), it sets the carry flag and returns, on failure it clears the flag and returns.

WOOO I THINK I GOT IT

Code:

PC 0x04EE2E 90 11 -> EA EA (BCC $11 -> NOP NOP)

Now to test for side effects.  Basically, I need to be sure that 0x04EE2E ($09EE2E) never gets executed anywhere else.  Fun times.

if you want to be on the safe side, hijack the code at this place before the bcc, check $A0 if you are in the moldorm room, and if yes, set the carry.
Like:
jsl empty space
empty space:
repeat native code where you hijacked
LDA $A0 (a5 a0) - load room number
cmp xx (c9 xx) - compare moldorm room
bne $01 (d0 01) - branch one byte if not
SEC (38) - set carry
RTL (6b) - return

then it will not branch on clear carry only (bcc)