 |
| Register | Login | |||||
 |
Main
| Memberlist
| Active users
| ACS
| Commons
| Calendar
| Online users Ranks | FAQ | Color Chart | Photo album | IRC Chat |
|
| | ||
|
| Register | Login | |||||
|
Main
| Memberlist
| Active users
| ACS
| Commons
| Calendar
| Online users Ranks | FAQ | Color Chart | Photo album | IRC Chat |
|
| | ||
1 user currently in Rom Hacking:  hukka |
| Acmlm's Board - I2 Archive - Rom Hacking - F-zero Maximum Velocity & GP legend |
 |  |  |
| Pages: 1 2 3 4 5 6 7 8 9 10 | Add to favorites | "RSS" Feed | Next newer thread | Next older thread |
| User | Post | ||
BGNG Snifit Level: 22  Posts: 165/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| As I mentioned in the thread Formal Announcement, I will be working on F-Zero Maximum Velocity for a while. This is effective immediately, and I will begin hacking the game tomorrow morning. I will do things my way; completely ignoring any findings so far, as nothing too concrete has been found. I would like to ensure that I'm heading in the right direction as not to go off on any false leads. I'll let you know what I find as I find it. (edited by BGNG on 07-27-05 09:08 PM) |
|||
Heian-794 Red Super Koopa Level: 44 Posts: 758/896 EXP: 611014 For next: 271 Since: 06-01-04 From: Kyoto, Japan Since last post: 21 days Last activity: 10 days |
| ||
| Looking forward to your observations, BGNG! If you need help reading any of the Japanese characters, don't hesitate to ask. |
|||
|
BGNG Snifit Level: 22 Posts: 166/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Okay... I've been digging around in the second half of the Non-Japanese ROM for about two hours, and I've found some nice little pieces of data. Here's what I've found in the memory map: 3c0000 3f0000 - Backgrounds & Horizons (Image Data) 3a0000 3c0000 - Text & Some Background 370000 380000 - Some Course Maps (Sprites) 1d0000 1e0000 - Some Tile Sets 1c0000 1d0000 - Major Scrambled Pawn 1 I've also found the course information definitions, which stores the course name, palette, music, and some other unknown (and unapparent when changed) data. Here's my document of that: 2B4EF0 - Course Info Definitions (76 bytes each) 00 1F - Unknown 20 3F - Name (Uppercase ASCII only) 40 43 - Music 44 47 - Unknown 48 4B - Palette Course Order: Knight 4 & Bishop 2 Pawn 3 Queen 4 Bishop 3 Pawn 5 Knight 2 Pawn 2 Knight 1 Championship Pawn 1 & Bishop 1 Queen 5 Queen 1 Queen 2 Queen 3 Bishop 4 Bishop 5 Knight 3 Pawn 4 Knight 5 Unknown (Synobazz 3?) Single-Pak Game Music Constants: 00 00 00 00 - (No Music) 04 AC 12 08 - Bianca City 10 B4 12 08 - Crater Land 14 C4 12 08 - Beacon Port 20 DA 12 08 - Stark Farm 60 CF 12 08 - Fire Field 70 E5 12 08 - Synobazz 80 06 13 08 - Ancient Mesa B8 FA 12 08 - Cloud Carpet CC 90 12 08 - Empyrean Colony EC A1 12 08 - Tenth Zone East Palette Constants: 0C 95 36 08 - Ancient Mesa 0C 97 36 08 - Beacon Port 0C 99 36 08 - Stark Farm 0C 9B 36 08 - Tenth Zone East 0C 9D 36 08 - Synobazz 0C 9F 36 08 - Bianca City 0C A1 36 08 - Fire Field 0C A5 36 08 - Crater Land 0C A9 36 08 - Empyrean Colony 0C AB 36 08 - Cloud Carpet 0C B5 36 08 - Silence Putting that into practice, we get stuff like this:  As you can see, there are two chunks of data that are shared by two courses. This will prove to be an inconvinience when naming new courses, but those two pairs are the only incedences of that. And as I mentioned in the map up top, I found a "Major Scrambled Pawn 1"... Racing on this course, all course features behave as they appear to, and there are no restrictions as to the normal flow of the course. This is in fact the level data for Pawn 1.  That's all for now. I'll update again later in the day. EDIT: I've isolated the starting bytes of Pawn 1 and Pawn 2 in the ROM (Non-Japan version), and I've found that they don't end on 16-byte boundaries. Pawn 1 is at 1CE410 and Pawn 2 is at 1CCAD2. Since Pawn 2 starts at xxxxx2, the courses must not all exist on a 16-byte boundary. This could be evidence of variable-length data segments for course definitions. I have found, however, in my first attempts to crack the data, that it's either generated off of a seed or the data is compressed; likely the latter. If it's compressed, then there's a real possibility that we may have a very limited number of bytes to work with; which may hinder the creation of new courses. But whatever the incedences, I moved the first several bytes from 1CCAD2 to 1CE410 and successfully imposed the Pawn 2 track data on Pawn 1:  EDIT 2: Looks like my suspicions were correct, but it's not all that bad. I've isolated the locations of all courses in the game ('cept for Championship, Single-Pak Game and possiby that mysterious "Synobazz 3") and calculated the differences in offsets to get the file sizes. Here's what I've found: Offset Course SizeThese might not be 100% accurate. I have not verified them for complete accuracy, but they'd only be 1 or 2 bytes off if any. Take note that Pawn 2 is smaller than Pawn 1. Because of that, it was possible for all of Pawn 2's data to be transposed to Pawn 1 without error. I'll still have to look up where the Championship and Single-Pak Game courses are stored. They're not in the same spot as the other 20. And there's also that nebulous "Synobazz 3" floating about. It just might be a hidden course. |
|||
|
Heian-794 Red Super Koopa Level: 44 Posts: 760/896 EXP: 611014 For next: 271 Since: 06-01-04 From: Kyoto, Japan Since last post: 21 days Last activity: 10 days |
| ||
| BGNG, fantastic job! Let me add to your awesome findings (how do you do this!?) a bit: Maybe my ROM is wonky, but for me all this stuff starts at 2B4EF4, not 2B4EF0 More Palette Constants (there are separate ones for each version of each course): 0C 8D 36 08 - Ancient Mesa Shifting these palettes around only seems to affect the track surface, and not the backgrounds:  |
|||
|
BGNG Snifit Level: 22 Posts: 167/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| It looks like my logic was incorrect as to the exact beginning of the track data. I assumed that the data would be on a 16-byte boundary, but that isn't necessarily the way it has to be. Since the first 32 bytes of these entries is completely unknown, you could slide them all to the right 4 bytes and the last four bytes of one entry will be in the unkown 32 area. There are four 00's at 2B4EF0, so I'd assumed they were just... zeroes... But looking back a bit in the ROM to 2B4DF0, we can see four valued bytes preceeding a large block of 00's that ends at 2B4EF3, so it appears you are correct: The global course info specifier data starts at 2B4EF4. Here's the revised specification for the Non-Jap version: 2B4EF4 - Course Info Definitions (76 bytes each) 00 1B - Unknown 1C 3B - Name (Uppercase ASCII only) 3C 3F - Music 40 43 - Unknown 44 47 - Palette 48 4B - Unknown In order to verify that I've got all the information I need for the locations and sizes of track data files, I wrote a small utility that will load up a ROM and transplant any data from one track to another. I used Knight 2 as the destination for most of them, since it's the biggest one (unless Bishop 5 turns out to be bigger). All of the courses mapped successfully except Bishop 2 and Bishop 5. Bishop 5 is probably a deal where I'm reading too many bytes (I set its size to 3000). Bishop 2 only displays a very small part of the course incorrectly, but when I used Bishop 2 as the destination of a different course, it mapped just fine. Hopefully the reason for that will make itself apparent. I also took some time to play around. Here's what I invented: Ancient Farm  Bianca Colony  Cloudobazz  Crater Port  Stark Zone East  EDIT: I found Championship and Single-Pak courses. No word yet on Synobazz 3. Silence took FOREVER to hack out of there because I had to keep rewriting my flash card to do a single-pak game between two real GBAs... NO$GBA crashed when I did the single-pak. Well, here's the update: 1D2CE0 Bishop 5 1,958 And here's a pic of Silence implemented on Knight 2:  It won't be too long before people can start getting Time Attack records on Silence; something the junkies at MFO have been wanting to do for a long time. (edited by BGNG on 07-28-05 10:48 PM) |
|||
|
firemaker Level: 26  Posts: 130/247 EXP: 94178 For next: 8097 Since: 03-23-04 From: UK berkshire Since last post: 17 days Last activity: 11 days |
| ||
| whoa!! i'm away for just a day and things explode. I've been hacking around the area 360000 - 361000 and it appears there is something there that seems to majorly srew up all the tiles in the game. if you set everything to the value 00 it seems to create a completely white track but with hiddden mines. aslo if you hit the side of te track you will crash immediately. i say more about this later. | |||
|
Heian-794 Red Super Koopa Level: 44 Posts: 763/896 EXP: 611014 For next: 271 Since: 06-01-04 From: Kyoto, Japan Since last post: 21 days Last activity: 10 days |
| ||
| BGNG has already shown us where to find "main" course names, which are stored in ASCII. In the vicinity of 39C000 (you can't miss it in a graphics editor set to GBA format), the game keeps all the "sub-names" of courses as plain graphics. Edit both of these, taking advantage of the nice long area available for the main name, and you can have this:  The problem is showing the course names on the Top 10 Times screen. They're stored in plain ASCII around 4B390, but each name only has as much space as it needs, so I couldn't fit "Mare Tranquilitatis" in there. |
|||
|
BGNG Snifit Level: 22 Posts: 168/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| I've been out all day, but I've come back and found more on what PiccoloCube found. Tile Molester reads an offset of "39996C" for the start of the description text images... which are for some reason, images. This was probably done to make translating easier by eliminating the need for multiple font sets. The graphics themselves are 48 8 (edited by BGNG on 07-29-05 11:36 PM) |
|||
|
Heian-794 Red Super Koopa Level: 44 Posts: 764/896 EXP: 611014 For next: 271 Since: 06-01-04 From: Kyoto, Japan Since last post: 21 days Last activity: 10 days |
| ||
| More graphic-related finds; view all in GBA format: The big "1", "2", "3" numbers that show what place you finished in are after 36B720. After that, starting at 36C70C (probably... this looks good in TLP), are the course mini-maps at the bottom left of the screen. Then come a ton of graphics seen on screen during races: 37948C: "LAP 1, 2, 3, 4, 5" gfx followed by some shadows I'm not sure about 379ACC: "2, 3, 4" used in "laps left" gfx. Following this are minute and second marks, km/h, power, box for power meter, actual levels of filled power meter, rank- and boost-related gfx, then pause screen "CONTINUE", "GIVE UP". More shadow-like things follow, then: 37C2EC: "spare machine", on-screen numbers, current position, results, warnings such as "TURN BACK", "POWER DOWN" etc. gfx Then more incomprehensibility, then: 38298C: Opening screen and menu graphics; a default font (the numbers seem to be used often, but not the letters), tutorial graphics such as buttons, 38A9AC: 8x16 font, two-color 38B9AC: 16x16 font, two-color (in both cases, space is the first character) 3939AC: 16x16 six-color font 3959AC: 8x8 two-color font 3961AC: 8x16 six-color font 3971AC: 8x8 six-color font, different color scheme Then some miscellaneous lettering, and we come to the course sub-names in graphical format, aligned as BGNG has described. An editor would be handy; I edited my "CLAVIUS CIRCUIT" by hand. |
|||
|
HyperLamer <||bass> and this was the soloution i thought of that was guarinteed to piss off the greatest amount of people Sesshomaru Tamaranian Level: 118 Posts: 6147/8210 EXP: 18171887 For next: 211027 Since: 03-15-04 From: Canada, w00t! LOL FAD Since last post: 2 hours Last activity: 2 hours |
| ||
Maybe you can whip up a hack to make the description text 2bpp then.  |
|||
|
Heian-794 Red Super Koopa Level: 44 Posts: 766/896 EXP: 611014 For next: 271 Since: 06-01-04 From: Kyoto, Japan Since last post: 21 days Last activity: 10 days |
| ||
Fiddling around with the fonts; how does this look? |
|||
|
BGNG Snifit Level: 22 Posts: 169/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Nice info and all, Heian-794, but... we're looking for information on the level data. Each course has a path that the CPU races on. We'll need to find these, as they're independant from the track data itself. |
|||
|
Heian-794 Red Super Koopa Level: 44 Posts: 767/896 EXP: 611014 For next: 271 Since: 06-01-04 From: Kyoto, Japan Since last post: 21 days Last activity: 10 days |
| ||
| BGNG, computer driver AI was one of the things nobody could find in the original game. There seemed to be a number of "target points" that the computer cars were drawn to; maybe this game also has that? I'm not much good at assembly so hopefully you or a similar expert can find that. I also spotted a lot of graphics for the horizons around 3E03E0 and higher. Looks like some compressed stuff is in there too, in between each background. Maybe a real graphics master like Dr. Mario could draw something good in a hack. |
|||
|
BGNG Snifit Level: 22 Posts: 171/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Most of the ROM is corruptable without crashing, so it shouldn't be too hard to find the path definitions... shouldn't. However, I have other news. Here is my first response: Awesome... awesome awesome awesome awesome awesom eawesome awesome awesome. Using some old hacks from the Japanese version, I've uncovered three new BGM soundtracks! They're not all that shabby, either. It turns out that the 4-byte values for music "constants" in the game are actually the locations in ROM that the music data is stored. But of the three hidden tunes: |
|||
|
Heian-794 Red Super Koopa Level: 44 Posts: 768/896 EXP: 611014 For next: 271 Since: 06-01-04 From: Kyoto, Japan Since last post: 21 days Last activity: 10 days |
| ||
| BGNG, so if the track data has "04 AC 12 08" for Bianca City, the music is stored at... 12AC04? (MSB last?) Do you have a ROM location that can be inserted into another track's data? How are you finding all this? Simple corruption wouldn't tell you this much info... do you have some kind of assembler? Just curious. |
|||
|
BGNG Snifit Level: 22 Posts: 172/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Yeah, the ROM address for the Bianca City music is 0812AC04. I'm not entirely sure what this maps to for the binary file data, but I think you just subtract 08000000... So the location inside youre .gba file should be 0012AC04 if I'm not mistaken. Almost everything I do when I hack ROMs is corruption and transposition. Based off of the results those two things cause, I can make all of my observations. For the track info data, for example, I just moved the one from "FIRE FIELD" to "BIANCA CITY" and went into the game to see what changed. The name, palette and music changed, but apparently nothing else... And it's just 76 bytes, so it was easy to find out what did what. After finding out all that I could, I looked at the other 21 entries and got the music and palette constants. I plan to do much of the same with the track data, but that can only go so far. From what I know, it's just the layout of the course itself; no graphics or path data included. So transposition won't work too well there. I'll need to reverse-engineer it by hand, which may take a while. In terms of the music, I found a program on Zophar's Domain called Sappy which can play the musics in Maximum Velocity as MIDI files. Handy tool it was, since it showed the in-ROM location of all the data, but it only worked for the Japanese version. Fortunately, all the music offsets were just 14,124 bytes away for every English counterpart, so it was easy to map them out. And it turns out that the one "unplayable" music does work. I must have used the wrong value. I also found a fourth hidden music. So here's the list ammendment for music constants in the English version of the ROM: 18 67 12 08 - Title 30 22 13 08 - Credits 38 6C 12 08 - Retire 7C F0 12 08 - Cup Review 80 69 12 08 - Race Review 18 5A 12 08 - BGM #16 98 50 12 08 - BGM #17 A4 4F 12 08 - BGM #18 F0 87 12 08 - BGM #19 BGM #16 is the really neat one I was talking about. There's also another Cup Review at 7C 11 13 08... No tellin' why there's two. |
|||
|
HyperLamer <||bass> and this was the soloution i thought of that was guarinteed to piss off the greatest amount of people Sesshomaru Tamaranian Level: 118 Posts: 6172/8210 EXP: 18171887 For next: 211027 Since: 03-15-04 From: Canada, w00t! LOL FAD Since last post: 2 hours Last activity: 2 hours |
| ||
Originally posted by Heian-794 That sounds just like FZX's control points. Only not being used to draw the tracks. |
|||
|
BGNG Snifit Level: 22 Posts: 173/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Don't hurt yourself by supplying all this useful information, HyperHacker. Maybe you should take a break and just sit back and relax. Heian-794 and I can take it from here. (-: EDIT: Well how 'bout them apples? The pointer table for the locations of tracks is at 360AB0. Just change a pointer, and different track data is loaded. How convenient! This means that we'll be able to use other ROM space for track data. And THAT means that there's virtually no limit to how big the courses can be. So I'm going to do some experimenting to see if I can expand the ROM size to 8MB and get it to work. EDIT 2: Scratch that. There's 60,336 leftover bytes at the end of the ROM. That's enough for 20, 3000-byte courses... That's plum plenty! And taking into account the space already in the ROM for track definitions, we get a grand total of 108,673 ready-to-serve bytes. That's enough for... oh... 36 really big courses. EDIT 3: Using only ROM corruption, I've located the Pawn 1 "path points" at 319630. Thanks for the heads-up about them being points, though. I didn't know quite what I was looking for, but what I found is consistent with the point idea (which makes a lot of sense). What I know right now is that it's just a sequential list of coordinates, XZ, defined by 16-bit, little-endian (least-significant byte first) values. It's becomming apparent that the ARM7 TDMI processor is little-endian based, where the MIPS 4300 of the Nintendo 64 was big-endian based. It's good to know that now. Anyways, the values are stored as (X, Z) coordinate pairs, in that order. (0, 0) corresponds to the top-left corner of the map; and thusly the track data. It appears that the first of these points--the one at index 0--doubles as the starting point for the track. So to move this data along with the track data, I ought to be able to move tracks around in the game. And thus: we're another step closer to unlocking Silence - Open Circuit in 1P mode. EDIT 4: I sure seem to be editing a lot. It turns out that, for some odd reason, the path points wrap back to 0 after every 03FF, but the ROM uses values like... 0F00 and the such, so that's an unnecessary calculation to clamp it into the proper region. Hopefully there's a reason for that. Anyhoo, take a look at this output:  See the peculiarity? The multiple paths that you can take in the course are plotted inline with the regular path. How many paths can you take simultaneously? How do we distinguish from one path and another? Either the data is in a header chunk of bytes, or it's hidden somewhere in the coordinate data itself. I'm going to do some testing to find out how it does this. EDIT 5: Somehow, the game knows how many points to use for each course. I'm not exactly sure how as of yet. But after all the point coordinates are defined, the possible path directions are defined. There are always exactly two paths to take for any course. After the coordinate data, there are pairs of bytes designating the order of points to use for each path. In that picture up there, the first split (going back to the beginning of the pit area) begins at point 12. This is a hex dump of the area in the ROM where the two paths are defined (3198A4): 01 01 02 0C 03 0D 04 0E 05 0F 06 10 There are more, obviously, but this is to promote understainding. Path 1 goes 01 02 03 04 05 06, and Path 2 goes 01 0C 0D 0E 0F 10. Get the picture? Now I'm gonna look for the "number of points" specifiers. EDIT 6: Phew. I'm glad there's no limit on editions. As far as those coordinates are concerned, you can trim off the leading 6 bits by running a (Value And 3FF) on whatever you take from the ROM.  No, your eyes do not decieve you. That is indeed Silence - Open Circuit in 1P Training mode. That particular shot is from a video I recorded; the first of its kind. You can snag it here: s_bgng_15024.mpg (11 MB). I used BGM #16 for the music. I think that one works best for the venue. So what's with the abrupt amount of progress? I found another handy pointer table. Check it out: 2C2F20 - Track Pointer Table B (28 bytes each) 00 03 - Unknown 04 07 - Path Coordinate Poitner 08 0B - Path Definition Pointer 0C 0F - Unknown 10 13 - Map Sprite 14 17 - Course to load 18 1B - Unknown The Path Coordinate Pointer is the location in ROM that I found earlier: where the track path coordinates are stored. Remember how I said I didn't know how the game knew how many coordinates to load? That's due to the Path Definition Pointer, which is the location in ROM immediately after the coordinates; where the two-path definitions start for the course. Just subtract the Coordinate Pointer from the Definition Pointer then divide by 4, and you get the number of coordinates. The Map Sprite and Course to load entries are just as they sound. They determine which tile data to use for the on-screen map and which course in that list I found on day 1. I don't know exactly how this data is stored yet, so I'm not gonna post on it. I'm tired. Leave me alone. More info on this table tomorrow when I have a chance to look at it in greater detail. The main event of the night was that Silence video. I'll be releasing a patch soon that transplants the Silence course into Championship. |
|||
|
Heian-794 Red Super Koopa Level: 44 Posts: 769/896 EXP: 611014 For next: 271 Since: 06-01-04 From: Kyoto, Japan Since last post: 21 days Last activity: 10 days |
| ||
BGNG = just plain awesome  ;I didn't have a chance to fiddle with this game yesterday but I have made some finds regarding palettes. Bianca City's basic "daytime" palette begins near 3EDED0. Then we've got all the colors for the grades of blue used in the sky, all stored in little-endian (R 0, G 31, B 31 = 0xFFE0 = E0 FF in the ROM). This extends up to 3EDF4F, and covers all the colors used in the horizon background only -- not the "background" below the course. There also seems to be a string of light blue colors at 368B0E, but I'm not sure where this is used. I'm trying to draw up a spreadsheet that will convert raw RGB values to the values stored in the ROM. I know there's an editor out there that does this, but I can't find it. Also looking for other palettes. I'd really like to at the very least make some new backgrounds for us to look at while driving. Now to try to insert that Silence in my own game! |
|||
|
BGNG Snifit Level: 22 Posts: 174/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| You mentioned a while back that the Rankings text isn't stored in the same spot in ROM as the GP and Training text... You said that "MARE TRANQUILITATIS" wouldn't fit... Remember that? Well, the pointer table for the Rankings strings is at 2BF920. It's an array of 21 (not 22) pointers that point to the location in ROM where to read a string from. It's in cup order; that is Pawn 1 through Queen 5 then Championship. All of these point to the strings that start at 4B390. Just by changing one of these values, it goes somewhere else. So we can use them leftover bytes at the end of the ROM to make these strings as long as we need. Even better yet, why not just repoint them to the OTHER strings that the game uses for GP and Training modes? *Slaps his forhead* (edited by BGNG on 07-31-05 06:50 PM) |
| Pages: 1 2 3 4 5 6 7 8 9 10 | Add to favorites | "RSS" Feed | Next newer thread | Next older thread |
| Acmlm's Board - I2 Archive - Rom Hacking - F-zero Maximum Velocity & GP legend |
| | |
