 |
| Register | Login | |||||
 |
Main
| Memberlist
| Active users
| ACS
| Commons
| Calendar
| Online users Ranks | FAQ | Color Chart | Photo album | IRC Chat |
|
| | ||
|
| Register | Login | |||||
|
Main
| Memberlist
| Active users
| ACS
| Commons
| Calendar
| Online users Ranks | FAQ | Color Chart | Photo album | IRC Chat |
|
| | ||
| Acmlm's Board - I2 Archive - - Posts by BGNG |
| Pages: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
| User | Post | ||
BGNG Snifit Level: 22  Posts: 161/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Hyper Hacker: Thanks. I'll check that out. fzeroman: I've taken a look at the machine statistical definition data in the ROM, which begins at offset 0x0691B0 in the North American version. Found in there is information about booster configuration, color definitions, machine number, Body/Boost/Grip stats and machine weight. All I did was search the RAM for the values I found and superimposed them with new ones. What I ended up with was a systematical ordering of codes: Machine model, Character, Color, Body, Boost, Grip and Weight; all in that order. If any code that I've found happens to coincide with codes that you've found, then it's simply a coincidence as they obviously use the same addreses in RAM. I'm not about to look up the entire internet to ensure any codes I find haven't already been found in the past. Additionally, this thread is intended to be geared exclusively towards the data stashed in the ROM that's used by the Expansion Kit. Please do not use it to describe findings about normal features of the game; and certainly don't make large posts for things you could have linked to. Sukasa: Well, if the data can be read by the GameShark, then I see no reason for it to not be outputted. It certainly can't do that as-is 'cause it's illegal to do so and it would never have sold in the US that way, but with flashable BIOS, there's sure to be a modification out there somewhere that can dump a ROM through the back-side link port. |
|||
|
BGNG Snifit Level: 22 Posts: 162/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Thanks, spoondiddly. This may be particularly useful. I'll see what I can do with it and go after PiccoloCube with it. He'll surely be willing to dump any data if it doesn't require very much work on his part. And why might the game crash? If the 64DD is understood to be just more bytes in memory to the N64, then wouldn't it just be like having a lotta RAM? And you can certainly read from and write to RAM. |
|||
|
BGNG Snifit Level: 22 Posts: 163/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| The shadows and booster configurations past the end of the pilot-exclusive machines probably only apply to the Body parts of the original machines. I don't think that any Cockpit/Rear-end Doodads have boosters on them, so that would make sense. But again, there are only 7 Body parts to choose from in the Expansion Kit. I've found 15 shadows, and you've found 11 usable whatsits. It may be that there are more parts in the game than even the Expansion Kit allows. If we get the Expansion Kit dumped and emulated, we can go nuts with GameShark on it to see what we can see. |
|||
|
BGNG Snifit Level: 22 Posts: 164/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| After some long and careful consideration, I've decided to change my personal policy a little bit in regards to my projects. I've discerned that given my tastes and personality, it would be better for me to remove myself from any obligation binding me to a specific project and do what I'm comfortable doing. What does this mean for F-Zero? It means I'll be setting down F-Zero X for the time being. Work on that game is not halted, but it's not the main focus. If I'm bored one night before going to bed, I may open up the programming I'm doing and make some more progress... But if that doesn't happen, then it will sit. What does this mean for ROM hacking? It means that if there's another project that I wish to resume work on (like my going-on-three-years audio project: CVA), then I'll set down ROM hacking entirely and go about my merry business. I am formally declaring here and now that I no longer wish to be expected to remain in the tracks of any given project. I will document all my findings on each of the ROMs that I hack so that others can use what I've found and further the research and development. I am currently documenting my F-Zero X information. I do offer this, though: If anyone needs help with any of their projects, come to me and I'll see what I'm able to do. I'm not unwilling to work on any given project; I simply would rather not be bound to any of them and expected to be working on them. But I'm not going to take any requests like "I can't hack this game. Will you do it?" and the like, so don't bring those to me. Do something like "I've found this strange data that has odd effects. Any idea why?" As for now, F-Zero X gets suspended as it is. No further utilities or alpha versions of the editor software will be released unless they become ready by unanticipated means. So now, I will begin work on another game: F-Zero Maximum Velocity. |
|||
|
BGNG Snifit Level: 22 Posts: 165/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| As I mentioned in the thread Formal Announcement, I will be working on F-Zero Maximum Velocity for a while. This is effective immediately, and I will begin hacking the game tomorrow morning. I will do things my way; completely ignoring any findings so far, as nothing too concrete has been found. I would like to ensure that I'm heading in the right direction as not to go off on any false leads. I'll let you know what I find as I find it. (edited by BGNG on 07-27-05 09:08 PM) |
|||
|
BGNG Snifit Level: 22 Posts: 166/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Okay... I've been digging around in the second half of the Non-Japanese ROM for about two hours, and I've found some nice little pieces of data. Here's what I've found in the memory map: 3c0000 3f0000 - Backgrounds & Horizons (Image Data) 3a0000 3c0000 - Text & Some Background 370000 380000 - Some Course Maps (Sprites) 1d0000 1e0000 - Some Tile Sets 1c0000 1d0000 - Major Scrambled Pawn 1 I've also found the course information definitions, which stores the course name, palette, music, and some other unknown (and unapparent when changed) data. Here's my document of that: 2B4EF0 - Course Info Definitions (76 bytes each) 00 1F - Unknown 20 3F - Name (Uppercase ASCII only) 40 43 - Music 44 47 - Unknown 48 4B - Palette Course Order: Knight 4 & Bishop 2 Pawn 3 Queen 4 Bishop 3 Pawn 5 Knight 2 Pawn 2 Knight 1 Championship Pawn 1 & Bishop 1 Queen 5 Queen 1 Queen 2 Queen 3 Bishop 4 Bishop 5 Knight 3 Pawn 4 Knight 5 Unknown (Synobazz 3?) Single-Pak Game Music Constants: 00 00 00 00 - (No Music) 04 AC 12 08 - Bianca City 10 B4 12 08 - Crater Land 14 C4 12 08 - Beacon Port 20 DA 12 08 - Stark Farm 60 CF 12 08 - Fire Field 70 E5 12 08 - Synobazz 80 06 13 08 - Ancient Mesa B8 FA 12 08 - Cloud Carpet CC 90 12 08 - Empyrean Colony EC A1 12 08 - Tenth Zone East Palette Constants: 0C 95 36 08 - Ancient Mesa 0C 97 36 08 - Beacon Port 0C 99 36 08 - Stark Farm 0C 9B 36 08 - Tenth Zone East 0C 9D 36 08 - Synobazz 0C 9F 36 08 - Bianca City 0C A1 36 08 - Fire Field 0C A5 36 08 - Crater Land 0C A9 36 08 - Empyrean Colony 0C AB 36 08 - Cloud Carpet 0C B5 36 08 - Silence Putting that into practice, we get stuff like this:  As you can see, there are two chunks of data that are shared by two courses. This will prove to be an inconvinience when naming new courses, but those two pairs are the only incedences of that. And as I mentioned in the map up top, I found a "Major Scrambled Pawn 1"... Racing on this course, all course features behave as they appear to, and there are no restrictions as to the normal flow of the course. This is in fact the level data for Pawn 1.  That's all for now. I'll update again later in the day. EDIT: I've isolated the starting bytes of Pawn 1 and Pawn 2 in the ROM (Non-Japan version), and I've found that they don't end on 16-byte boundaries. Pawn 1 is at 1CE410 and Pawn 2 is at 1CCAD2. Since Pawn 2 starts at xxxxx2, the courses must not all exist on a 16-byte boundary. This could be evidence of variable-length data segments for course definitions. I have found, however, in my first attempts to crack the data, that it's either generated off of a seed or the data is compressed; likely the latter. If it's compressed, then there's a real possibility that we may have a very limited number of bytes to work with; which may hinder the creation of new courses. But whatever the incedences, I moved the first several bytes from 1CCAD2 to 1CE410 and successfully imposed the Pawn 2 track data on Pawn 1:  EDIT 2: Looks like my suspicions were correct, but it's not all that bad. I've isolated the locations of all courses in the game ('cept for Championship, Single-Pak Game and possiby that mysterious "Synobazz 3") and calculated the differences in offsets to get the file sizes. Here's what I've found: Offset Course SizeThese might not be 100% accurate. I have not verified them for complete accuracy, but they'd only be 1 or 2 bytes off if any. Take note that Pawn 2 is smaller than Pawn 1. Because of that, it was possible for all of Pawn 2's data to be transposed to Pawn 1 without error. I'll still have to look up where the Championship and Single-Pak Game courses are stored. They're not in the same spot as the other 20. And there's also that nebulous "Synobazz 3" floating about. It just might be a hidden course. |
|||
|
BGNG Snifit Level: 22 Posts: 167/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| It looks like my logic was incorrect as to the exact beginning of the track data. I assumed that the data would be on a 16-byte boundary, but that isn't necessarily the way it has to be. Since the first 32 bytes of these entries is completely unknown, you could slide them all to the right 4 bytes and the last four bytes of one entry will be in the unkown 32 area. There are four 00's at 2B4EF0, so I'd assumed they were just... zeroes... But looking back a bit in the ROM to 2B4DF0, we can see four valued bytes preceeding a large block of 00's that ends at 2B4EF3, so it appears you are correct: The global course info specifier data starts at 2B4EF4. Here's the revised specification for the Non-Jap version: 2B4EF4 - Course Info Definitions (76 bytes each) 00 1B - Unknown 1C 3B - Name (Uppercase ASCII only) 3C 3F - Music 40 43 - Unknown 44 47 - Palette 48 4B - Unknown In order to verify that I've got all the information I need for the locations and sizes of track data files, I wrote a small utility that will load up a ROM and transplant any data from one track to another. I used Knight 2 as the destination for most of them, since it's the biggest one (unless Bishop 5 turns out to be bigger). All of the courses mapped successfully except Bishop 2 and Bishop 5. Bishop 5 is probably a deal where I'm reading too many bytes (I set its size to 3000). Bishop 2 only displays a very small part of the course incorrectly, but when I used Bishop 2 as the destination of a different course, it mapped just fine. Hopefully the reason for that will make itself apparent. I also took some time to play around. Here's what I invented: Ancient Farm  Bianca Colony  Cloudobazz  Crater Port  Stark Zone East  EDIT: I found Championship and Single-Pak courses. No word yet on Synobazz 3. Silence took FOREVER to hack out of there because I had to keep rewriting my flash card to do a single-pak game between two real GBAs... NO$GBA crashed when I did the single-pak. Well, here's the update: 1D2CE0 Bishop 5 1,958 And here's a pic of Silence implemented on Knight 2:  It won't be too long before people can start getting Time Attack records on Silence; something the junkies at MFO have been wanting to do for a long time. (edited by BGNG on 07-28-05 10:48 PM) |
|||
|
BGNG Snifit Level: 22 Posts: 168/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| I've been out all day, but I've come back and found more on what PiccoloCube found. Tile Molester reads an offset of "39996C" for the start of the description text images... which are for some reason, images. This was probably done to make translating easier by eliminating the need for multiple font sets. The graphics themselves are 48 8 (edited by BGNG on 07-29-05 11:36 PM) |
|||
|
BGNG Snifit Level: 22 Posts: 169/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Nice info and all, Heian-794, but... we're looking for information on the level data. Each course has a path that the CPU races on. We'll need to find these, as they're independant from the track data itself. |
|||
|
BGNG Snifit Level: 22 Posts: 170/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Which program are you using to make the Flash animation? Adobe LiveMotion has peculiar difficulties when it comes to synchronization. | |||
|
BGNG Snifit Level: 22 Posts: 171/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Most of the ROM is corruptable without crashing, so it shouldn't be too hard to find the path definitions... shouldn't. However, I have other news. Here is my first response: Awesome... awesome awesome awesome awesome awesom eawesome awesome awesome. Using some old hacks from the Japanese version, I've uncovered three new BGM soundtracks! They're not all that shabby, either. It turns out that the 4-byte values for music "constants" in the game are actually the locations in ROM that the music data is stored. But of the three hidden tunes: |
|||
|
BGNG Snifit Level: 22 Posts: 172/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Yeah, the ROM address for the Bianca City music is 0812AC04. I'm not entirely sure what this maps to for the binary file data, but I think you just subtract 08000000... So the location inside youre .gba file should be 0012AC04 if I'm not mistaken. Almost everything I do when I hack ROMs is corruption and transposition. Based off of the results those two things cause, I can make all of my observations. For the track info data, for example, I just moved the one from "FIRE FIELD" to "BIANCA CITY" and went into the game to see what changed. The name, palette and music changed, but apparently nothing else... And it's just 76 bytes, so it was easy to find out what did what. After finding out all that I could, I looked at the other 21 entries and got the music and palette constants. I plan to do much of the same with the track data, but that can only go so far. From what I know, it's just the layout of the course itself; no graphics or path data included. So transposition won't work too well there. I'll need to reverse-engineer it by hand, which may take a while. In terms of the music, I found a program on Zophar's Domain called Sappy which can play the musics in Maximum Velocity as MIDI files. Handy tool it was, since it showed the in-ROM location of all the data, but it only worked for the Japanese version. Fortunately, all the music offsets were just 14,124 bytes away for every English counterpart, so it was easy to map them out. And it turns out that the one "unplayable" music does work. I must have used the wrong value. I also found a fourth hidden music. So here's the list ammendment for music constants in the English version of the ROM: 18 67 12 08 - Title 30 22 13 08 - Credits 38 6C 12 08 - Retire 7C F0 12 08 - Cup Review 80 69 12 08 - Race Review 18 5A 12 08 - BGM #16 98 50 12 08 - BGM #17 A4 4F 12 08 - BGM #18 F0 87 12 08 - BGM #19 BGM #16 is the really neat one I was talking about. There's also another Cup Review at 7C 11 13 08... No tellin' why there's two. |
|||
|
BGNG Snifit Level: 22 Posts: 173/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Don't hurt yourself by supplying all this useful information, HyperHacker. Maybe you should take a break and just sit back and relax. Heian-794 and I can take it from here. (-: EDIT: Well how 'bout them apples? The pointer table for the locations of tracks is at 360AB0. Just change a pointer, and different track data is loaded. How convenient! This means that we'll be able to use other ROM space for track data. And THAT means that there's virtually no limit to how big the courses can be. So I'm going to do some experimenting to see if I can expand the ROM size to 8MB and get it to work. EDIT 2: Scratch that. There's 60,336 leftover bytes at the end of the ROM. That's enough for 20, 3000-byte courses... That's plum plenty! And taking into account the space already in the ROM for track definitions, we get a grand total of 108,673 ready-to-serve bytes. That's enough for... oh... 36 really big courses. EDIT 3: Using only ROM corruption, I've located the Pawn 1 "path points" at 319630. Thanks for the heads-up about them being points, though. I didn't know quite what I was looking for, but what I found is consistent with the point idea (which makes a lot of sense). What I know right now is that it's just a sequential list of coordinates, XZ, defined by 16-bit, little-endian (least-significant byte first) values. It's becomming apparent that the ARM7 TDMI processor is little-endian based, where the MIPS 4300 of the Nintendo 64 was big-endian based. It's good to know that now. Anyways, the values are stored as (X, Z) coordinate pairs, in that order. (0, 0) corresponds to the top-left corner of the map; and thusly the track data. It appears that the first of these points--the one at index 0--doubles as the starting point for the track. So to move this data along with the track data, I ought to be able to move tracks around in the game. And thus: we're another step closer to unlocking Silence - Open Circuit in 1P mode. EDIT 4: I sure seem to be editing a lot. It turns out that, for some odd reason, the path points wrap back to 0 after every 03FF, but the ROM uses values like... 0F00 and the such, so that's an unnecessary calculation to clamp it into the proper region. Hopefully there's a reason for that. Anyhoo, take a look at this output:  See the peculiarity? The multiple paths that you can take in the course are plotted inline with the regular path. How many paths can you take simultaneously? How do we distinguish from one path and another? Either the data is in a header chunk of bytes, or it's hidden somewhere in the coordinate data itself. I'm going to do some testing to find out how it does this. EDIT 5: Somehow, the game knows how many points to use for each course. I'm not exactly sure how as of yet. But after all the point coordinates are defined, the possible path directions are defined. There are always exactly two paths to take for any course. After the coordinate data, there are pairs of bytes designating the order of points to use for each path. In that picture up there, the first split (going back to the beginning of the pit area) begins at point 12. This is a hex dump of the area in the ROM where the two paths are defined (3198A4): 01 01 02 0C 03 0D 04 0E 05 0F 06 10 There are more, obviously, but this is to promote understainding. Path 1 goes 01 02 03 04 05 06, and Path 2 goes 01 0C 0D 0E 0F 10. Get the picture? Now I'm gonna look for the "number of points" specifiers. EDIT 6: Phew. I'm glad there's no limit on editions. As far as those coordinates are concerned, you can trim off the leading 6 bits by running a (Value And 3FF) on whatever you take from the ROM.  No, your eyes do not decieve you. That is indeed Silence - Open Circuit in 1P Training mode. That particular shot is from a video I recorded; the first of its kind. You can snag it here: s_bgng_15024.mpg (11 MB). I used BGM #16 for the music. I think that one works best for the venue. So what's with the abrupt amount of progress? I found another handy pointer table. Check it out: 2C2F20 - Track Pointer Table B (28 bytes each) 00 03 - Unknown 04 07 - Path Coordinate Poitner 08 0B - Path Definition Pointer 0C 0F - Unknown 10 13 - Map Sprite 14 17 - Course to load 18 1B - Unknown The Path Coordinate Pointer is the location in ROM that I found earlier: where the track path coordinates are stored. Remember how I said I didn't know how the game knew how many coordinates to load? That's due to the Path Definition Pointer, which is the location in ROM immediately after the coordinates; where the two-path definitions start for the course. Just subtract the Coordinate Pointer from the Definition Pointer then divide by 4, and you get the number of coordinates. The Map Sprite and Course to load entries are just as they sound. They determine which tile data to use for the on-screen map and which course in that list I found on day 1. I don't know exactly how this data is stored yet, so I'm not gonna post on it. I'm tired. Leave me alone. More info on this table tomorrow when I have a chance to look at it in greater detail. The main event of the night was that Silence video. I'll be releasing a patch soon that transplants the Silence course into Championship. |
|||
|
BGNG Snifit Level: 22 Posts: 174/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| You mentioned a while back that the Rankings text isn't stored in the same spot in ROM as the GP and Training text... You said that "MARE TRANQUILITATIS" wouldn't fit... Remember that? Well, the pointer table for the Rankings strings is at 2BF920. It's an array of 21 (not 22) pointers that point to the location in ROM where to read a string from. It's in cup order; that is Pawn 1 through Queen 5 then Championship. All of these point to the strings that start at 4B390. Just by changing one of these values, it goes somewhere else. So we can use them leftover bytes at the end of the ROM to make these strings as long as we need. Even better yet, why not just repoint them to the OTHER strings that the game uses for GP and Training modes? *Slaps his forhead* (edited by BGNG on 07-31-05 06:50 PM) |
|||
|
BGNG Snifit Level: 22 Posts: 175/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| I s'pose you could go through and find out which characters are supported and which ones aren't? That info will be needed. EDIT: Oh, and um... Yes: The game reads bytes until 00 is encountered. Zero-termination is the norm for strings in programming. EDIT 2: Like you found out earlier, Heian-794, the course map sprite data starts at 36C70C. This isn't anything too spectacular. It's just a normal array of 64 tiles, aligned by rows of 8 tiles; from left to right, top to bottom.  (edited by BGNG on 07-31-05 07:27 PM) (edited by BGNG on 07-31-05 08:41 PM) |
|||
|
BGNG Snifit Level: 22 Posts: 176/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| No offense to anyone, but personally... I would rather not look at the generic "big picture with an anim | |||
|
BGNG Snifit Level: 22 Posts: 177/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Of course I know how to block layouts. But every time a new anim | |||
|
BGNG Snifit Level: 22 Posts: 178/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| I started this thread to find out why people use such layouts and where they got started; not to complain about them. | |||
|
BGNG Snifit Level: 22 Posts: 179/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| Kasumi-Astra: I'm not sure I follow about "the link being right there." What exactly are you referring to? Place: (-: Anyhoo, the question still remains: Who came up with it first? Are there any records that we can check to find out? |
|||
|
BGNG Snifit Level: 22 Posts: 180/276 EXP: 56579 For next: 1771 Since: 06-03-05 Since last post: 8 days Last activity: 3 hours |
| ||
| You can cross-check the username colors with this list to determine what the user has his or her gender specified as. |
| Pages: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
| Acmlm's Board - I2 Archive - - Posts by BGNG |
