Register | Login
Views: 19364387
Main | Memberlist | Active users | ACS | Commons | Calendar | Online users
Ranks | FAQ | Color Chart | Photo album | IRC Chat
11-02-05 12:59 PM
1 user currently in Rom Hacking: hukka | 2 guests
Acmlm's Board - I2 Archive - Rom Hacking - INCOMPLETE SMA4 Level Data Document
  
User name:
Password:
Reply:
 

UserPost
caitsith2
Posts: 3/3
Or if we could figure out how to encode our own e-reader cards, they could be loaded up that way. [Firefly] figured out how to do so more than a year ago, unfortunately, he will not release his tools, for he fears they will be used for piracy purposes, and he is dead against piracy. This effectively means someone else is going to have to research it. It is possible, to print working dotcodes, and the tool to do so, is released.

I already know how to attach a valid e-reader card level header to the level data, but that info is useless if it can't be encoded to the raw format that it needs to be in, that includes reed solomon error correction info.

----------------- UPDATE, new info ---------------------------------

I found a level that fills in the unknown in the e-reader level data header, and fooled around with e-coin formats some more.

Header format
------------------------------------
0x000 0x01 E-Coin present (If 0, none is present. Anything other than 0 tells the game where in the ecoin fortress to place the coin.)
0x001 0x01 Ace Coins present (0-7)
0x002 0x01 E-Level Class (0x01 = Star, 0x02 = Mushroom, 0x30 = Promotional)
0x003 0x01 E-Level Number
0x004 0x01 Level Icon
Repeat the following 4 times. (Only the first entry is absolutely required.)
0x005 0x02 Level Objects (required)
0x007 0x02 Level Settings (required)
0x009 0x02 Level to Level transports (pipes/doors)
0x00B 0x02 Level Sprites (Some form of level ending sprite required)
0x00D 0x02 Block platform movement vectors
0x00F 0x02 Level Scroll vectors (Optional)
End Repeat, Fill with 0x00 until 0x40. What follows this depends on if an ecoin is present or not. If an ecoin is present, then the ecoin graphics follow, then the name of the level, otherwise just the name of the level follows. The name can be a maximum length of 0x15 characters. You do not have to terminate it with 0xFF if the name is exactly 0x15 characters long, but in practice, you should anyways.

The e-coin graphics is unfortunately, like the level, on the e-card, and not the game. On the bright side though, you can make the e-coin look like whatever you want, if you wish.

E-coin values 1-8 are the first floor. 9-16 for second floor, 17-24 for third floor. The game will only display one floor however, if you only have coins 9-16 loaded, or 17-24, or 1-8, and only two floors if a combination of 1-8 and 9-16, or 9-16 and 17-24, or any combination whatsoever. 24 e-coins is the maximum possible. If I make a level editor, I will not allow it to make e-coins 1-8, as nintendo has already used those.

For each moving block platform that exist in the level, the following format applies.
0x001 0x01 Block platform properties.
AB - A = Block length * 2. Valid values are 1-15.
B = Block platform speed.
0x002 0x01 First movement byte. Direction of the first movement must be right.
[Repeat while movement byte not = 0xFF]
0x003 0x01 Movement byte
[End Repeat]

Movement byte is in following format.
AAAAAABB
A = Number of blocks to move. (1-63)
B = Direction to move. (0 = Right, 1 = Left, 2 = Up, 3 = Down).
Because 0xFF is the stop platform movement command, it is not possible to move down 63 blocks, in one go, it must be done in two shorter ones.
HyperLamer
Posts: 7883/8210
In this case, it could be as simple as putting the hacked levels into a save file and loading it onto your cart via Gameshark. Problem is someone needs to hack some levels first.

For other games, you need to rip apart the cart and replace the ROM chip with a rewriteable one, or get a flash cart.
Roneo Strife
Posts: 59/60
Originally posted by Santa Claus
Nice. I might just have to buy a copy of this game. Playing hacked levels on a real cart would rule so much.



Not to sound like a total n00b but how do you do that?
Kyoufu Kawa
Posts: 2416/2481
Originally posted by Parasyte

*shrug* He always was hard to get ahold of.

Slightly offtopic but hey... guess who I got an email from yesterday?
caitsith2
Posts: 2/3
One other detail I forgot to mention is where e-level slots 13-32 exist in the save. The only reason they are not in the above list, is because there were only 12 levels officially released in the US.

E-Level: (All of them are compressed.)
(In .sav file)
0x00000808 Unfinished e-level, primary slot.
0x00006018 E-Level 1
0x00006808 E-Level 2
0x00007018 E-Level 3
0x00007808 E-Level 4
0x00008018 E-Level 5
0x00008808 E-Level 6
0x00009018 E-Level 7
0x00009808 E-Level 8
0x0000A018 E-Level 9
0x0000A808 E-Level 10
0x0000B018 E-Level 11
0x0000B808 E-Level 12
0x0000C018 E-Level 13
0x0000C808 E-Level 14
0x0000D018 E-Level 15
0x0000D808 E-Level 16
0x0000E018 E-Level 17
0x0000E808 E-Level 18
0x0000F018 E-Level 19
0x0000F808 E-Level 20
0x00010808 Unfinished e-level, backup slot.
0x00016018 E-Level 21
0x00016808 E-Level 22
0x00017018 E-Level 23
0x00017808 E-Level 24
0x00018018 E-Level 25
0x00018808 E-Level 26
0x00019018 E-Level 27
0x00019808 E-Level 28
0x0001A018 E-Level 29
0x0001A808 E-Level 30
0x0001B018 E-Level 31
0x0001B808 E-Level 32

The save allows up to 32 saved levels, plus one in the unfinished slot. This means you can have up to 33 levels e-levels on one cartridge.

There appears to be These save sections.

--------- Repeated in both bank 0 & 1 of save file, for redundancy -------
SMA4MWE0 / SMA4MWJ0 - 0x0000 - 0x1000 - 1 (E-Level master index, including the unfinished level slot, and the names of up to 72 levels.
M3E0 / M3J0 - 0x1000 - 0x0800 - 6 (Save slots)
S4RE / S4RJ - 0x4000 - 0x2000 - 1 (unknown)
--------- End of Repeat --------------------
S4CE / S4CJ - [0x6000 - 0x1000 - 10], [0x16000 - 0x1000 - 6] (E-Levels (2 per slot))
S4KE / S4KJ - 0x1C000 - 0x1000 - 4 (Saved level replays)



In order to change the save, you have to know how to calculate the checksum. The formula is extremely easy. Add up the save slot section bytes (first 8 for SMA4MW?0, 4 for M3?0, S4R?, S4C?, S4K?). Skip over two bytes, and add each of the remaining bytes in that section.

Example, in the S4CE section (e-levels)
Add bytes 0, 1, 2, and 3 together. Skip bytes 4 and 5, then add the remainder of the bytes. The 2 bytes skipped at offset 4 & 5, should equal to the least significant 16 bits of the total you came up with. The game saves are specifically region coded.
SoNotNormal
Posts: 698/793
Well, it may be a bump, but it's a very imformative bump, so I can't see why this should be closed.

Good find there. Although I don't ever hack anything past SNES, if i ever get into something like this, I am going to use this info
caitsith2
Posts: 1/3
I have been doing some reverse engineering of the format myself, and came up with a few things.

After level decompression (and I even reversed the decompression, just not the recompression), however, I still was able to figure out the level format regardless, on the emulator. Here is the necessary breakpoints/memory locations for the US version.

The compressed data ends up at 0x2014BD8. The data is decompressed into 0x2005000. You can change the decompressed data in runtime, however, for the change to actually take effect, you have to do something that changes the area, like go down a pipe or enter a door. However, there are some things that cannot be changed at runtime, like how many A-coins to collect, and whether or not there is an e-coin to collect, It only can be changed immediately after the decompression has finished. The end of the decompressor code is at 0x80A7BEC. If you can stop execution at this point, you can change the data, and have the changes take effect when the level loads.

There is always 0x40 bytes in the header, following this format.

Header format
------------------------------------
0x000 0x01 E-Coin present (0,1)
0x001 0x01 Ace Coins present (0-7)
0x002 0x01 E-Level Class (0x01 = Star, 0x02 = Mushroom, 0x30 = Promotional)
0x003 0x01 E-Level Number
0x004 0x01 Level Icon
Repeat the following 4 times. (Only the first entry is absolutely required.)
0x005 0x02 Level Objects (required)
0x007 0x02 Level Settings (required)
0x009 0x02 Level to Level transports (pipes/doors)
0x00B 0x02 Level Sprites (Some form of level ending sprite required)
0x00D 0x02 Unknown
0x00F 0x02 Level Scroll vectors (Optional)
End Repeat, Fill with 0x00 until end of header.

Whether to follow this with the 0xFF terminated level name, depends on if an e-coin is present. If an e-coin is present, then there is (IIRC) 0x800 bytes for the e-coin pallete/gfx data, that must be filled in first.

Here is the name character set.
Title Format Character Set (US version)
----------------------------------
ABCDEFGHIJKLMNOPQRSTUVWXYZ - 00-19
abcdefghijklmnopqrstuvwxyz - 20-39
0123456789 - 76-7F (normal)
0123456789 - E4-ED (supertyped)
0123456789 - EE-F7 (subtyped)
'?!- ' - E0-E3
[PR] - FE
[NULL] - FF

Just one correction I would like to make with objects.

The first byte should be broken into 8 Bits
AABBBBBB CC DD EE FF
A - Bank (2 bits)
B - First Length (6 bits)
C - X
D - Y
E - Type
F - Second Length (Only if 5 byte object type.)

Enemy/Sprite types
AA BB CC DD
A - Enemy/Sprite
B - X
C - Y
D - Parameter, usually 0 for most purposes. However, for things like A coins, 0 is the first coin, 1 is the second, and so on.

The level object pointer also contains a header that I have yet to document.

-----------------------------
Level Transport format
----------------------------
0x000 0x02 Number of transports (ZZ)
[REPEAT ZZ times]
0x002 0x01 Source entrance X (This should match X location of pipe/door you can enter)
0x003 0x01 Soucce entrance Y (Should also match pipe/door).
0x004 0x01 Area to transport to. 0-3
0x005 0x01 unknown
0x006 0x01 Destination X
0x007 0x01 Destination Y
0x008 0x01 View screen Center X
0x009 0x01 View screen Center Y
0x00A 0x01 unknown
0x00B 0x01 Exit type
[END REPEAT]

Level Transport Exit Types
------------------------------
0 - Appear at X, Y (used for Doors)
1 - Come up from pipe
2 - Come down from pipe
3 - Come right from pipe
4 - Come Left from pipe
5 - Drop from X, Y

--------------------------
Scroll Vector format
---------------------------
Offset Length Description
[REPEAT START]
0x000 0x01 X position to travel to.
0x001 0x01 Y position to travel to.
0x002 0x01 Speed to travel at.
[REPEAT END] - Repeat until X = 0xFF, Y = 0xFF, Speed = 0xFF.

Parasyte
Posts: 347/514
*shrug* He always was hard to get ahold of.
I don't have much of the work he did on the game. Like I said, just a few "ECL" files, which are the complete, compressed E-Card Levels.
captain Qball
Posts: 8/57
Is there anywhere that has anything about Bouche's work? Several months ago someone emailed me saying that If I was interested in Hacking into SMA4 I should look for him. So I searched the net and all I found were a couple messageboards (this being one of them) and that he apparently has given up and/or disappeared.
HyperLamer
Posts: 3556/8210
Nice. I might just have to buy a copy of this game. Playing hacked levels on a real cart would rule so much.
Parasyte
Posts: 339/514
http://parasyte.panicus.org/projects/sma4/elevel-decmp.zip - decompressor and source
http://parasyte.panicus.org/projects/sma4/vpk-to-bin-v10.zip - vpk to bin converter

The vpk to bin converter is Tim Schuerewegen's (FireFly). I don't even know where you would get any vpk files, but the output from the program should be what you would pass to the decompressor. The decompressor will output a final decompressed bin file for you to experiment with. There is no compressor yet, so you won't be able to make changes and use them right away. But it should get you started to figuring out the level format and such.

Note that I'm not sure about the vpk files, since we wrote the decompressor for some ecl files that Bouche had. And I have no idea where he got those from.
captain Qball
Posts: 6/57
Parasyte, I (for one), would be very interested to see that. I've been wanted to hack SMA4 for a while now, but since I've no experience, I didn't know where to tstart. When I found the address topic here yesterday, I spent the rest of the day just fooling around in a hex editor.


and purplebridge, for the background color in the level header, you say it only has one didgit allocated, but your table lists values all teh way up to 1F, how do you enter in those above 0F?

edit, nevermind, I got it now.
Parasyte
Posts: 336/514
Bouche and I wrote a decompressor for the E-Levels. We never studied the algorithm or anything, and the source is a nice mess. But I suppose it would be something you're interested in? I won't bother uploading it anywhere if you have no need for it, however.
purplebridge001
Posts: 3/4
Updated on 03-07-05 04:58 AM

WARNING: This document is incomplete. It was tested only on 1-1. most objects are different in other level. and some information maybe wrong.


*** Level List ********************************************************
Normal Level:
See http://board.acmlm.org/thread.php?id=10272 (incomplete)

E-Level:
(All levels are encrypted?)
(In .sav file)
0x00000808 Unknown
0x00006018 E-Level 1
0x00006808 E-Level 2
0x00007018 E-Level 3
0x00007808 E-Level 4
0x00008018 E-Level 5
0x00008808 E-Level 6
0x00009018 E-Level 7
0x00009808 E-Level 8
0x0000A018 E-Level 9
0x0000A808 E-Level 10
0x0000B018 E-Level 11
0x0000B808 E-Level 12


*** Level Header ******************************************************
AA AA BB BB CD EE FG HH IJ KL NN

A : Next Area Level ID
B : Next Area Enemy ID
C : Starting Y Position
D : Level Length
E : Starting X Position & Background Color
F : Scroll Type (if this < 8, enter any pipe to end level)
G : Next Area Object Set
H : GFX
I : Time Limit
J : Music
K : "Extra" Color
L : "Extra" Type
N : Background

[Starting X Position]
00-10 Starting X = 01
20-30 Starting X = 07
40-50 Starting X = 08
60-70 Starting X = 0D

[Background Color]
00-03 Black
04-07 Sky blue
08-0B Blue
0C-0F Orange(Desert Level)
10-13 Ice Level
14-17 Dark blue 1
18-1B Light blue
1C-1F Dark blue 2

[Time Limit]
0 : 300
4 : 400
8 : 200
C : 000 (Unlimited)

[Music]
0 : Plains
1 : Underground
2 : Underwater
3 : Fortress
4 : Boss Battle
5 : Airship
6 : Hammer bros
7 : P-Switch & Mushroom House
8 : Hills
9 : Castle room
A : Clouds/Sky
B : Underground
C : Classic Overworld
D : Underground
E : Classic Underwater
F : Classic Castle

["Extra" Color]
0 : Black
1 : Blue
2 : White 1
3 : Dark Blue
4 : Dark Green
5 : Dark Brown
6 : Dark Gray and Dark Green
7 : Blue
8 : Black
9 : Dark gray
A : White 2
B : *Use isn't recommend
C : *Use isn't recommend
D : *Use isn't recommend
E : *Use isn't recommend
F : *Use isn't recommend

["Extra" Type]
0 : Nothing
1 : Very High Water(doesn't act like it)
2 : Clouds (like 1-1)
3 : Ship Fog(it can use only on ship level)
4 : Ship Fog(it can use only on ship level)
5 : Low Water(doesn't act like it)
6 : Weird Water
7 : Very High Water(Background becomes a high position)
8 : Fog
9 : Sub Background of Fortress
A : Sub Background of 1-5
B : 3-7 Clouds
C : Nothing?
D : 8-Ship1 Water(doesn't act like it)
E : Nothing?
F : Sub Background of Bowser's Castle

[Background]
00 Nothing
01 Underwater 1
02 *Weird (with lightning. Airship?)
03 Ship boss room (with lightning)
04 Cave entry (1-5)
05 Plains
06 Dungeon
07 Anchors Away
08 Snow
09 Pipe
0A Hills
0B Cave
0C Big Land
0D Desert 1
0E Desert 2
0F High Hills
10 Prison 1
11 Volcano
12 Clouds(Won't scroll )
13 Bonus Area
14 Ice Cave
15 Cave
16 WaterFall 1
17 Mushroom House
18 Snow Hills
19 Sub area of 7-2
1A Plains (different one)
1B Bowser's Castle 1
1C Leaves(8-1)
1D Night Hills(8-2)
1E WaterFall 2
1F Prison 2
20 5-1 Bonus Area
21 Underwater 2
22 Bowser's Castle 2
23 *Weird (Coin ship?)
24 Ship boss room (without lightning)
25 Underwater 3
26 Underwater 4
27 Orange clouds
28 Orange bricks
29 Bowser's Castle 3
2A Night Sky
2B Prison 3
2C Ghost House 1
2D Ghost House 2
2E Bowser's Castle 3
2F *Weird
30 Minigames 1
31 Minigames 2
32 Minigames 3
33 Colored Block
34 Cave entry (without sky)
35 Pipe
36 Hills (high position)
37 Cave
38 Snow Hills (high position)
39 Blue Hills
3A Prison 4
3B WaterFall (different position)
3C Prison 5
3D Leaves (without night sky)
3E WaterFall (different position)
3F WaterFall (different position)
40-FF *Crash*


*** Level Data ********************************************************
Level objects (4/5 bytes each) :

AB CC DD EE FF
A : Object Bank
B : "First" Length
C : Y position
D : X position
E : Type
F : "Second" Length (only if 5 byte object)

Enemy objects (4 bytes each) :

AA BB CC DD
A : Type
B : X position
C : Y position
D : Unknown(always 0)


*** Object List (Plains) **********************************************

; Object bank 0
00 Background Hills A
01 Background Hills B
02 Background Hills C
03 Nothing
04 Door (CAN go in)
05 Weird Door (CAN'T go in)
06 Vine
07 Weird Background
08-0F *Crash*
10 '?' with Flower
11 '?' with Leaf
12 '?' with Star
13 '?' with Single coin
14 '?' with 10 coins
15 Muncher
16 Brick with Flower
17 Brick with Leaf
18 Brick with Star
19 Brick with Single coin
1A Brick with 10 coins
1B Brick with 1-UP
1C Brick with Wine
1D Brick with P-Switch
1E Invisible Coin
1F Invisible 1-UP
20 Invisible Note Block
21 Note Block with Flower
22 Note Block with Leaf
23 Note Block with Star
24 Wooden Block with Flower
25 Wooden Block with Leaf
26 Wooden Block with Star
27 Red Invisible Note Block
28 P-Switch
29 Level Ending
2A-42 *Crash*
43 '?' with Shoe
44 '?' with Feather
45 Unknown Background Object
46 Door(different from 04)
47 '?' with directional coins
48 Downward Green Spikes
49 Downward Green Spikes
4A Unknown
4B SMW Goal Sign
4C Reversed SMW Goal Sign
4D Red Spike Ball
4E Unknown : Scroll will become mad
4F Wall from bonus level
50 Left triangle block
51 Right triangle block
52 Upside down Left triangle block
53 Upside down Right triangle block
54 Unknown White Block
55 '?' with P-Wing
56 '?' with Nothing
57 Nothing
58 Nothing
59 POW Block
5A *Crash*
5B *Crash*
5C *Crash*
5D *Crash*
5E *Crash*
5F *Crash*
60-FF *Untested*

; Object bank 4
00 White block platform (extends to ground)
01 Orange block platform (extends to ground)
02 Green block platform (extends to ground)
03 Blue block platform (extends to ground)
04 White block platform (floating)
05 Orange block platform (floating)
06 Green block platform (floating)
07 Blue block platform (floating)
08 Background Bushes
09 Gap
0A Cloud platform
0B Flat ground (5 bytes)
0C Underwater ground (5 bytes)
0D Nothing
0E Underwater Gap
0F Bricks
10 '?' blocks with single coin
11 Bricks with single coin
12 Wooden blocks
13 Colored Note Blocks - movable four directions
14 Note Blocks - movable two directions
15 Wooden Blocks - movable
16 Coins
17 Downward Pipe (CAN go down)
18 Downward Pipe (CAN'T go down)
19 Downward Pipe (CAN go down;; ignores pointers)
1A Upward Pipe (CAN go up)
1B Upward Pipe (CAN'T go up)
1C Rightward Pipe (CAN go in)
1D Rightward Pipe (CAN'T go in)
1E Leftward Pipe (CAN go in)
1F Leftward Pipe (CAN'T go in)
20 Bullet Bill Machine
21 Bridge
22 Silver Coins (appear when you hit a P-Switch)
23 Waterfall (5 bytes)
24 Water (moves to left) (5 bytes)
25 Water (still) (5 bytes)
26 Water (moves to right) (5 bytes)
27 Weird Background Object (5 bytes)
28 Blue X-Blocks (5 bytes)
29 Weird Quicksand (doesn't act like it) (5 bytes)
2A Weird Orange Background (5 bytes)
2B White Turtle Blocks
2C Double-Ended Vertical Pipe
2D Cloud platform
2E Bonus Level Wall? (5 bytes)
2F Background Hills D
30-50 *Crash*
51 Mushroom Blocks from SMB2 (5 bytes)
52 '1' Blocks (5 bytes)
53 '2' Blocks (5 bytes)
54 '3' Blocks (5 bytes)
55 Unbreakable silver bricks (5 bytes)
56 Line Block
57 Rightward conveyor belt
58 Blue Platform
59 Rope (it can use like the wines)
5A Nothing
5B Nothing
5C Nothing
5D Downward Spikes(Castle)
5E Downward Spikes(Ghost House?)
5F White Blocks(5 bytes)
60 Ghost House Stairs
61 Ghost House Platform?
62 Ghost House Background?
63 Nothing
64 Nothing
65 Nothing
66 Nothing
67 Nothing
68 Nothing
69 Nothing
6A Sand from SMB2 (5 bytes)
6B *Crash*
6C *Crash*
6D *Crash*
6E *Crash*
6F Weird Background (5 bytes)
70 Nothing (5 bytes)
71 Coins (5 bytes)
72 *Unknown and Weird* (5 bytes)
73 *Unknown and Weird* (5 bytes)
74 *Unknown and Weird* (5 bytes)
75 *Unknown and Weird* (5 bytes)
76 Background Eraser? (First Length : if this is 1, background will not show up.)(5 bytes)
77 Change "extra" position? (First Length : if this is 1, extra will change position.)(5 bytes)
78 *Crash*
79 *Crash*
7A-FF *Untested*

; Object Bank 8
(Pointer?)

; Object Bank C
(Untested)


*** Enemy List ********************************************************
See http://www.remorse.nl/~bosjoh/sma4/docs/data/enemies.txt (Created by Sludge)


*** Thanks to *********************************************************
Sludge (a lot of SMA4 data)
hukka (object name, some header information, etc..)
Acmlm's Board - I2 Archive - Rom Hacking - INCOMPLETE SMA4 Level Data Document


ABII


AcmlmBoard vl.ol (11-01-05)
© 2000-2005 Acmlm, Emuz, et al



Page rendered in 0.013 seconds.