messiaen
Catgirl
Level: 68
   
Posts: 189/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
I can't help much in that, because this area is loaded very early in the initialization process, so probably this would require a good deal of low-level knowledge of the N64. By the way, in the header of the ROM there's the RAM address where this area is copied to (80246000), hence the ram = 0x80245000 + rom "formula".
About the snow, this is the function called in the Geo Layout I was talking about:
18 00 00 [xx] 80 27 61 D0
xx = Some argument (usually 00). Values used:
01 = used in Cool Cool Mountain (area 1) and Snowman's Land (area 1). Produces the snow effect.
02 = used in Jolly Roger Bay (area 2) and Secret Aquarium.
0C = used in Lethal Lava Land (area 1), Bowser's Fire Sea and Bowser Second Battle
0D = used in Dire Dire Docks (area 1).
0E = used in Jolly Roger Bay and Dire Dire Docks (area 2).
I tried using the 01 value in Bob-omb Battlefield, but instead of producing snow it produces strange polygon shapes. So, I guess it could be either that a specific bank loaded in Cool Cool Mountain/Snowman's Land is needed or that snow is in one of the shared banks but there isn't a 0x22 pointing to it in Bob-omb Battlefield.
But getting back to the checksum area, I don't know if that's what you meant when you said you find Mario's move table, but a lot of the 8027xxxx RAM pointers are some sort of jump table for specific Mario actions. For instance, the value at 80336C60 is read and them jumped to (by a Jump Register opcode) when you do the "jump" action. All nearby values are jump related, such as double jump, triple jump, etc. By swapping these values you can make things like a instant triple jump or another changes. For example, here is a fun code I created that replaces the kick after two punches value with another punch value. This way you can punch very fast:
81336EE8 8027
81336EEA 4F90 |
messiaen
Catgirl
Level: 68
Posts: 190/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
Trees, Mr. I and the flames are examples of objects which use this kind of effect. Since Mario64 is vey low-polygonish, this is a good trick to cut the number of polygons.
In the Goomba, it is used in the body. Rather than using a complex 3D structure such as the head, it's just a simple square (formed by two triangles) with a texture applied and the billboarding effect:
200FEC: 1400 0000 0000 0000 <-- Enable Billboarding for next
200FF4: 0400 0000
200FF8: 1504 0000 0801 B690 <-- Body (not animated). Uses texture #382.
|
messiaen
Catgirl
Level: 68
Posts: 191/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
To understand better these commands you need to take a closer look at the main Mario Hacking doc. Inside it, you'll find what each byte (or group of bytes) does for a specific command.
I don't recommend spending too much time on the polygon commands, especially now that VL-Tone is working on a .obj importer, but understanding the level scripts will be very useful for more advanced stuff.
Before going into pointers, you have to understand how segmented data is loaded into RAM.
For instance, 17 0C 00 [07] [01 20 30 00] [01 20 31 08] loads ROM data from 0x1203000 to 0x1203108 into "bank" 07, which is just an arbitrary number to reference the data in the RAM.
As for pointers, usualy they are the last 4 bytes of a command:
[2E] [08] [00 00] [07] [00 00 D8]
(command) | |--> Offset
--> Bank (or segment)
Since we already seen that for Flatworld Bank 0x07 starts at 0x1203000, this command points to 0x12030D8.
As for the triangle commands, the last tree bytes (for instance, 00 0A 14) are pointers to the vertex cache loaded before with the 0x04 command:
04 30 00 00 07 00 00 00 <------ Loads 4 vertices from 0x0000 of Bank 07 (that is, 0x1203000) into the vertex cache. Yes, this is very confusing at first!
BF |
---|------------
00 | First vertex
0A | Second vertex
14 | Third vertex
1E | Fourth vertex
You can download and experiment with the Platform Battlefield v0.2 patch, because the data is more organized - that is, less optimized - than the normal Flatworld and also there's free space so you can experiment adding things. A good way to see if you understood pointers is to move things around. |
messiaen
Catgirl
Level: 68
Posts: 192/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
I have made some great progress on the sequenced music format!
Here is a note table:
Octave|| Note Numbers
# || C | C# | D | D# | E | F | F# | G | G# | A | A# | B
------------------------------------------------------------------------------
x-1 || 1B | 1C | 1D | 1E | 1F | 20 | 21 | 22 | 23 | 24 | 25 | 26
x || 27 | 28 | 29 | 2A | 2B | 2C | 2D | 2E | 2F | 30 | 31 | 32
x+1 || 33 | 34 | 35 | 36 | 37 | 38 | 39 | 3A | 3B | 3C | 3D | 3E
When this table is used, here is the format:
{58} 85 [22] (18) # eight-note G
{} = Velocity
= Not really sure, but something like ticks before NoteOff.
[] = Pitch (normal table)
() = Duration (18 = eight-note, 30 = quarter-note, 60 = half-note, 20 = triplets, all simple proportions) [delta-tick?]
This alternate note table is also used. It's basically the same plus 80 (hex), so it sets some kind of flag:
Octave|| Note Numbers
# || C | C# | D | D# | E | F | F# | G | G# | A | A# | B
------------------------------------------------------------------------------
x-1 || 9B | 9C | 9D | 9E | 9F | A0 | A1 | A2 | A3 | A4 | A5 | A6
x || A7 | A8 | A9 | AA | AB | AC | AD | AE | AF | B0 | B1 | B2
x+1 || B3 | B4 | B5 | B6 | B7 | B8 | B9 | BA | BB | BC | BD | BE
When this alternate table is used, we have 3 bytes instead of 4. "Duration" is omitted (it uses the last parameter supplied). Excerpt:
{64} 40 [24] (60) # half-note A (normal pitch table)
{5C} C8 [26] (20) # triplet B
{64} *40* ~AC~ triplet F # Begins alternate, 3 byte format. Duration = 20 (last one)
{5E} *88* ~AC~ triplet F
{62} *90* ~AC~ triplet F
{5C} *50* ~AB~ triplet E
{5E} *60* ~A9~ triplet D
{64} *58* [27] (80) C
And here is one VERY important thing, the *JUMP* command, which is also used for Loops!
[FC] [1B EE]
[00] = Jump
[01, 02] = Jumps to offset 0x1BEE, counting from the begginning of the sequence.
The "FF" character to indicate when to jump back. Here is one loop example using this command:
FC 1B EE # Jump to 0x1BEE (0x00 = 7B4080,start of track). Return when ch = FF.
FC 1B F9 # Jump to 0x1BF9
FC 1B EE # Again (Manual Loop)
FC 1B F9
FC 1B EE # Again (Manual Loop)
FC 1B F9 |
messiaen
Catgirl
Level: 68
Posts: 193/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
This was way simpler than I thought, so here is a simple way to skip CRC check. Just NOP these two instructions:
(ROM)
0x066C: BNE A3, T0, 0x800001C8 <-- Sends you to a dark trap room.
0x0678: BNE S0, T0, 0x800001C8
The emulator will complain about it ("unknown CIC"), but it works. There also could be an option in TT64 to restore this code and recalculate the CRC when your project is ready, to avoid emulator annoyances. |
messiaen
Catgirl
Level: 68
Posts: 194/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
I tested it on a few emulators. Here are the results:
1964 - Doesn't complain at all.
Mupen 0.5.1 - Same (haven't tried MupenPlus yet).
Nemu64 0.8 - One error message ("Unknown bootcode. Chances that this game won't work are high").
Project 64 1.6 - Two error messages ("Unknown Cic Chip" and "Unhandled CicChip(-1) in first DMA".
Now it's time to gather more data, I'll see what I can gather from Gameshark codes. |
messiaen
Catgirl
Level: 68
Posts: 195/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
Great list! Just to narrow our searches, the non-ASM data seems to start at 0x0E6260.
I think I found what the parameters after the RAM pointer does: it's the time before you regain camera control.
To confirm this, I swapped the "00 01" parameter in the double door opening with "03 34" from the Lakitu tour, then opened another emulator window and watched the intro at the same time I opened the double door. When the intro's over, you can control the camera again. With parameter "7F FF", there is probably some kind of input (either from joypad or some function to be called) needed to regain camera control.
By the way, at 0x8029000C lies some sort of StopCamera() function which is called by some behaviors (ie, collect star).
And here's what I got from the behavior list on 0xEAED8 (updated):
1300 24AC - Produces "white dust" when Mario starts/stops running.
1300 0A54 - Produces little yellow stars (when Mario hits a wall)
1300 0A98 - Produces little yellow starts (when Mario pounds the ground)
1300 2B08 - ??
1300 02B8 - ??
1300 2C14 - ??
1300 2CE0 - ??
1300 0428 - Produces snow?? (Not sure. Hardcoded model setting in ASM = 0xA4).
1300 2DC0 - ??
1300 11EC - ??
1300 2D50 - ??
1300 2D7C - ??
1300 1390 - Produces leaves (when Mario is on a tree?)
1300 0E58 - Produces little snowballs (when Mario is walking on snow?)
1300 0D98 - Produces shadows
1300 0E3C - Produces little red objects (when Mario hits something?)
1300 0E24 - Produces the dust when Mario pounds the ground
1300 0AD8 - Same effect as 0xA54, but producing little arrows?
I used Yoshiman's Spawn any object anywhere code to discover most of this (code on his website). Most of these are "spawn" behaviors, and they have a hardcoded model setting. |
messiaen
Catgirl
Level: 68
Posts: 196/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
I don't care much about textures, but when you release the new TT64 version you could still keep the download link of 0.5.9b with texture export. Or perhaps you could include in the download package (or as a separate file) all the exported textures.
By the way, have you seen this texture list on the japanese forum? There's some interesting offsets there, such as the water texture.
Also, I have been experimenting with background swaps, and while this may be a bit dangerous to include, as the differented sized background banks could crash the game, it would still be useful when creating new levels. One of the common functions in the main terrain Geo Layout is responsible for handling the background textures, and there is some minor adjustments depending on which Background Bank (0x0A) you load. I'll document a bit more this stuff and send it to you in a few days. |
messiaen
Catgirl
Level: 68
Posts: 197/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
If you have sucessfully applied the Flat Lava Land patch, I'm not sure what could be going wrong with this. Are you patching to an extended non-Flatworld enabled ROM? Have you tried patching to another ROM? Have you tried another emulator? Where exactly in the file screen does it crashes? Does the emulator crashes too (and what kind of error) or just the game?
Anyone else with this problem? |
messiaen
Catgirl
Level: 68
Posts: 198/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
| That "useless bottom" of yours just kept me entertained for about 300 clicks. I guess the same happens to about 75% of the people. The other 25% are probably anal. |
messiaen
Catgirl
Level: 68
Posts: 199/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
You'll have to experiment and see for yourself! Just remember to patch the ROM as described to get rid of the checksum infinite loop.
I tried to force the "Stuck drunk Lakitu cam cam from far away" values for all the camera settings, and it shows that none of these values are used for the normal camera movement, all of these are used for special events. |
messiaen
Catgirl
Level: 68
Posts: 200/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
An entertaining review by SydLexia!
Gotta look for this on some abbandonware site!
|
messiaen
Catgirl
Level: 68
Posts: 201/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
| Never understimate the power of negative media! |
messiaen
Catgirl
Level: 68
Posts: 202/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
rstewart215804 posted some info about backgrounds texture pointers on the Flatworld thread, but probably you already know about that.
Here is a list I compiled with the necessary changes use any background on Flatworld (or any other level, for anyone who wants to swap backgrounds).
Besides changing the 0x0A Bank Loaded, you need to adjust this function in the Terrain Geo Layout: 19 00 00 xx 80 27 63 D4.
See the list below for correct values:
# | Level | Bank 0x0A | Arg
---------------------------------------------------
01 | Haunted House | C3AFD5-C4F915 | 06
02 | Cool Cool Mountain | B5D855-B7D995 | 04
03 | Inside Castle | No Background | 00
04 | Hazy Mazy Cave | No Background | 00
05 | Shifting Sand Land | C12E95-C32FD5 | 05
07 | Bob-omb Battlefield | B35715-B55855 | 00
08 | Snow Man's Land | B5D855-B7D995 | 04
09 | Wet Dry World | BC2C15-BE2D55 | 02
10 | Jolly Roger Bay | B85995-B9A2D5 | 08
11 | Tiny Huge Island | B35715-B55855 | 00
12 | Tick Tick Clock | No Background | 00
13 | Rainbow Ride | BEAD55-C0AE95 | 03
14 | Castle Grounds | B35715-B55855 | 00
15 | Bowser 1 Course | C57915-C77A55 | 07
16 | Vanish Cap | No Background | 00
17 | Bowser's Fire Sea | BA22D5-BBAC15 | 01
18 | Secret Aquarium | BEAD55-C0AE95 | 03
19 | Bowser Third Course | C7FA55-C9FB95 | 09
20 | Lethal Lava Land | BA22D5-BBAC15 | 01
21 | Dire Dire Docks | B35715-B55855 | 00
22 | Whomp's Fortress | BEAD55-C0AE95 | 03
23 | Castle Courtyard | C3AFD5-C4F915 | 00
24 | Peach's Secret Slide | No Background | 00
25 | Metal Cap | No Background | 00
26 | Wing Cap | BEAD55-C0AE95 | 03
27 | Bowser First Battle | C57915-C77A55 | 07
28 | Rainbow Clouds | BEAD55-C0AE95 | 03
29 | Bowser Second Battle | BA22D5-BBAC15 | 01
30 | Bowser Third Battle | C7FA55-C9FB95 | 09
31 | Tall Tall Mountain | B35715-B55855 | 00
There is also a function in the Geo Layout which repositions the entire background, but I have to test it again to provide more consistent information. |
messiaen
Catgirl
Level: 68
Posts: 203/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
| This site has both games. Use DOSBox to run. |
messiaen
Catgirl
Level: 68
Posts: 204/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
The v0.4 patch replaces Whomp's Fortress with an "empty" terrain, but it would be very easy to replace some other levels with a Flat terrain setting. I may produce a patch with a few corrections and more "flat" templates.
---
Also, here are the custom objects merged with my "Bowser in Bob-omb" modification. There's also some changes in the title screen music (check my last post on the Music Editing thread for some handy information on the music format).
<object width="425" height="350"> <embed src="http://www.youtube.com/v/NACPNe8kukA" type="application/x-shockwave-flash" width="425" height="350"> </embed> </object> |
messiaen
Catgirl
Level: 68
Posts: 206/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
Ops, acidentally deleted this post. Anyway, rstewart215804, this was just the piece of info I was looking for!
I'm doing a 100% "deconstruction" of the Toad's Music, here is how far I got. I omitted the music data because I'm not done with it, and because the overall format should be our focus now.
One easy way to find out what's in a channel before looking at the music data is to replace all the main 0x9x pointers with the same value. This is a good trick to use also on level scripts to NOPe something (ie, creating a repeated 0x22 command).
It's also worth looking for bit patterns in these 1 byte commands.
------------------------
Toad's music - 0x7CA8F0
------------------------
D3 80 (Sort of Header?)
D7 01 81 <- According to DJ Bouche, Channel enable flag?
90 00 19 <-- Pointer to track data (chan 00?) --> E E E E G G F G A B
97 00 2D <-- Pointer to track data (chan 07?) --> C Bb A Ab G
98 00 47 <-- Pointer to track data (chan 08?) --> C Bb A Ab G one octave lower
DB 50
DD AA (Tempo = 170 BPM)
FD 81 28
D6 01 81 <-- Probably related to the 0xD7 on the beggining (certainly not a jump)
FF
------
0x19 <-- Entry-point for channel 00?
------
C4
90 00 5B <-- Call this
91 00 79 <-- Call this
DF 7F 6A
DD 4A
D4 14
C1 00
FD 81 20
FF
------
0x2D <-- Entry-point for channel 07?
------
C4
90 00 86 <-- Call this
91 00 93 <-- Call this
92 00 A0 <-- Call this
93 00 AB <-- Call this
DF 7F 69
DD 36 <-- In this context, I don't think this is the tempo setting.
D4 14
C1 07
FD 81 28
FF
-----
0x47 <-- Entry point for channel 08?
-----
C4 <-- Marks the beggining / initializes something?
90 00 B8 <-- Call this
91 00 C5 <-- Call this
C1 08
DF 6E 68
DD 28
D4 14
FD 81 28
FF
|
messiaen
Catgirl
Level: 68
Posts: 207/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
Nice, I'll check more on this track later. I think you got the correct byte order, I was experimenting before and I noticed that the velocity (volume) I was changing affected the previous note, so that's probably the correct order: [pitch] [ticks] [velocity] [something].
Have you checked all these 0xDD commands? I believe the first one is the global tempo, but I find hard to believe there's different tempo settings for each channel, especially because the values aren't simple proportions. That is just, unmusical!. Could you check on this?
Here is more from the Toad's song music. The jump structure is sort like the polygon data:
90 00 19 <-- Pointer to track data (chan 00?) --> High melody E E E E G G F G A B
------
0x19 <-- Entry-point for channel 00?
------
C4
90 00 5B <-- Call this
------
0x5B
------
[37] (18) 63 AA E (18)
~B7~ 5C B5 E
~B7~ 54 B5 E
~B7~ 61 AA E
[3A] (30) 67 E0 G (30)
~BA~ 61 DA G
[38] (52) 5F 16 F (52) [ 60 - 52 = 0E, ticks to fill the measure)
7C 07 5F
C0 06
FF
91 00 79 <-- Call this
------
0x79
------
C0
81 08
[3A] (0E) 5A 37 G
7E 09 67
C0 01
FF
DF 7F 6A
DD 4A
D4 14
C1 00
FD 81 20
FF
The problem is that I can't find the last two notes, high A and B. They should be 3C, 3E or A4, A6. Also, these two parts of data called by the 9x aren't played at the same time. I have to check more, but this could be just jumps, and simultaneuos notes are made by using a 00 duration. At least, this is how it's done in MIDI as far as I can remember. |
messiaen
Catgirl
Level: 68
Posts: 208/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
Nice discovery, it works exactly like MIDI:
MIDI Value 0 - pan hard left
MIDI Value 1 - pan hard left
MIDI Value 64 - pan center
MIDI Value 127 - pan hard right
(edited: rephrased this) So, The last byte is the actual duration of the note, while the () one is the "tick before next event" one.
I confirmed that 0xDB and 0xDF are respectively Global Volume and Track Volume from DJBouche's notes, however I'm not getting success changing instruments, is this really done by the 0xC1 command?
---
Here is the pitch table (more testing will be necessary to find the correct range for this):
Octave|| Note Numbers
# || C | C# | D | D# | E | F | F# | G | G# | A | A# B
------------------------------------------------------------------------------
x-1 || 67 | 68 | 69 | 6A | 6B | 6C | 6D | 6E | 6F | 70 | 71 | 72
x || 73 | 74 | 75 | 76 | 77 | 78 | 79 | 7A | 7B | 7C | 7D | 7E
x+1 || 7F
I find it high likely that more optimizations of this kind will be found, especially for pauses. This 0xB0 command on the Title Music makes a two 4/4 measure pause, but I still have to check how it's used on other tracks:
B0 54 F0
(All the range between 0xB0 - 0xB9 seems to commands).
---
Look in the beggining of the Slide Melody how the three "formats" are mixed to get maximum optimization (I labeled them as [xx], ~xx~ and "xx").
0xE0 Main Melody
C4
90 04 75
0x475
36 (60) 57 E0
~B0~ 5A 28 <--A
[30] 30 52 3B <-- A
~B4~ 6D 3B <-- C#
~B2~ 60 30 <-- B
"71" 2A 5F <-- Bb
FF
91 04 8A
92 04 95
93 04 A0
D4 14
C1 02
DF 6E 6C
DD 48 <-- Pan
D3 00
FD
81 80
I also did a little experience setting an infinite loop:
LoopStart:
C0 83 00
notes
FC LoopStart
What's interesting is that the first "C0 83 00" is probably a pause command, because there is a delay before the loops repeats. When I change it to "C0 80 00", the loop starts right away.
---
I did a Mario 64 port of the "underwater" SMB1 theme!
<object width="425" height="350"> <embed src="http://www.youtube.com/v/SW6XEwrqq9M" type="application/x-shockwave-flash" width="425" height="350"> </embed> </object> |
messiaen
Catgirl
Level: 68
Posts: 209/1085
EXP: 2596326
For next: 132474
Since: 11-20-07
Since last post: 8.1 years
Last activity: 7.2 years
|
|
I just noticed that there are sequences before 0x7B3E10, then went back in the ROM and guess what, I found the pointers for the sequences! They are at 0x7B0860.
Also, I took a look at the 0x37 commands in the first rstewart215804 post. They are used in the main level scripts, not only for the press start/title screen but also for the "act select" music and something else I forgot  . The song numbers for this command are a bit different, but perhaps it will be clear by looking at this pointer table. |
