| VL-Tone Member Super Mario 64 forum moderator Level: 53 Posts: 214/621 EXP: 1135503 For next: 21616 Since: 07-27-07 From: Montreal, Canada Since last post: 4.7 years Last activity: 1.2 years |
|
||||
|
![]() Register - Login |
||
| Main - Memberlist - Active users - Calendar - Wiki - IRC Chat - Online users Ranks - Rules/FAQ - Stats - Latest Posts - Color Chart - Smilies |
||
| Jul - SM64 Hacking (Archive) - Stuff inside the checksum protected area (Title Screen, etc.) | - - ![]() |
| Pages: 1 2 3 | Next newer thread | Next older thread |
| VL-Tone Member Super Mario 64 forum moderator Level: 53 Posts: 214/621 EXP: 1135503 For next: 21616 Since: 07-27-07 From: Montreal, Canada Since last post: 4.7 years Last activity: 1.2 years |
|
||||
|
| messiaen Catgirl Level: 68 Posts: 176/1085 EXP: 2594038 For next: 134762 Since: 11-20-07 Since last post: 8.1 years Last activity: 7.2 years |
|
||
| Amazing stuff! The list at 0xE8D98 seems to be related to the "select act" white screen. Swapping Bob-omb's value for Snowman's Land will only change that screen. If you set any level to "1B" (Peach's secret slide value) the act selector won't show up, but I'm not sure which act you end up on. Some time ago Yoshiman found some data in RAM which is used by the Tox Boxes to determine its movement. In the ROM, it is found at 0xEB8A8-EB8CC (this is probably just for one of the parameters, the data seems to begin at 0xEB850). Probably there are lots of interesting data used by objects in nearby areas. I also found some data used by the King Bob-Omb: 0xF28F0-0xF2903 (in RAM, begins at 803378F0): I'm not sure what it does. 0xF28FC seems to be read a lot (try placing a breakpoint there). It's probably a floating point number. From 0xF2904 to 0xF2917, there is a list of RAM pointers, and they are used by the King Bob-Omb like this: 802A7D40: LW T7, 0x7904 (AT) <-- Loads value from 80337904 and stores at $t7 802A7D44: JR T7 <-- Jump to value stored at register $t7 The last pointer (at 0xF2914) is responsible for creating the dialog box when the King is thrown off the cliff (more info on the ASM thread). --- At 0xED9CC, begins a long list of pointers mainly to Bank 0x07. I placed a few breakpoints in these values, and indeed some of them are hardcoded collision pointers. For instance, at RAM 80332A0C, we have "070113F0". This is the pointer for the Bob-Omb's Bridge collision data. If you look at its behavior, there isn't any 0x2A collision pointer. |
| VL-Tone Member Super Mario 64 forum moderator Level: 53 Posts: 220/621 EXP: 1135503 For next: 21616 Since: 07-27-07 From: Montreal, Canada Since last post: 4.7 years Last activity: 1.2 years |
|
||
|
|
| messiaen Catgirl Level: 68 Posts: 179/1085 EXP: 2594038 For next: 134762 Since: 11-20-07 Since last post: 8.1 years Last activity: 7.2 years |
|
||
| The table starts at 0x8032DD98. Placing a breakpoint at it and stepping through the code will help us find some meaningful values. So far, I haven't found nothing interesting. This if from Cellar Dweller's generalnotes.txt: for most code: (low text) ram - rom = 0x80245000 ram = 0x80245000 + rom rom = ram - 0x80245000 By the way, if you are considering making TT64 edit the checksum area, some Gameshark codes contain really interesting stuff. For instance: 0x6BD4 - NOP to Skip Intro (4 bytes) 0x6D98 - NOP to Skip Lakitu (4 bytes) 0x10018 - Ammount of lives to start (last 2 bytes, it's an ADD Immediate instruction) These codes were created by Viper, I just found the respective ROM offsets. The "Skip Intro" and "Skip Lakitu" could be very useful, otherwise if you change the Castle Grounds script most likely the intro will crash the game. There's also a bunch of codes to change the number of stars needed to open each door in the castle, these also would be useful. |
| Stevoisiak Member Level: 38 Posts: 100/283 EXP: 345476 For next: 24971 Since: 11-22-07 From: New York, Long Island Since last post: 12.3 years Last activity: 5.6 years |
|
||
Originally posted by messiaen Actually, if you use level select when first starting a game, and choose a level other than castle grounds, the game will not freeze. I tried it in the aquarium level. Also, can you show me the star door code? I'm verry interested in that. It could also lead to useful things if it's decoded. |
| rstewart215804 User Crazed Mario 64 Hacker!!! Level: 11 ![]() Posts: 14/18 EXP: 5578 For next: 407 Since: 09-13-07 Since last post: 13.2 years Last activity: 11.7 years |
|
||
| I know this lies outside the checksum but at 0x21F5E8 is the ASM that runs the stage select. It is strange that it uses data inside the checksum and how there are spots for extra levels. Maybe if ever we find a way around the checksum we could make more levels. ____________________ Just you wait until next time. Until then, keep that Control Stick smokin’! Buwaa ha ha! |
| messiaen Catgirl Level: 68 Posts: 182/1085 EXP: 2594038 For next: 134762 Since: 11-20-07 Since last post: 8.1 years Last activity: 7.2 years |
|
||
| I did some tests and the snow at "Cool Cool Mountain" is created by a function called in the Geo Layout. So, maybe you achieved the snow effect on Bob-omb when experimenting with the main terrain Geo Layout. I'll see if I can do the same. I know this may be a bit off-topic, but if there are more level characteristics besides the ones we already know, perhaps this command is worth looking at: [28] [0C] [00 01 00 00 00 00 00 00 00 00] [1]: 28= Sometimes seen after 0x26 commands, near the end, I don't know it's use [2]: Length byte (dec 12) [3-12]: ?? Look at struct_area.txt from Cwellar Dweller's Hacking Notes: void *off0x1c /* 4 @ 0x1c pointer to a array of four eight byte structures defined by command 0x28 */ |
| VL-Tone Member Super Mario 64 forum moderator Level: 53 Posts: 223/621 EXP: 1135503 For next: 21616 Since: 07-27-07 From: Montreal, Canada Since last post: 4.7 years Last activity: 1.2 years |
|
||||
|
| messiaen Catgirl Level: 68 Posts: 189/1085 EXP: 2594038 For next: 134762 Since: 11-20-07 Since last post: 8.1 years Last activity: 7.2 years |
|
||
| I can't help much in that, because this area is loaded very early in the initialization process, so probably this would require a good deal of low-level knowledge of the N64. By the way, in the header of the ROM there's the RAM address where this area is copied to (80246000), hence the ram = 0x80245000 + rom "formula". About the snow, this is the function called in the Geo Layout I was talking about: 18 00 00 [xx] 80 27 61 D0 xx = Some argument (usually 00). Values used: 01 = used in Cool Cool Mountain (area 1) and Snowman's Land (area 1). Produces the snow effect. 02 = used in Jolly Roger Bay (area 2) and Secret Aquarium. 0C = used in Lethal Lava Land (area 1), Bowser's Fire Sea and Bowser Second Battle 0D = used in Dire Dire Docks (area 1). 0E = used in Jolly Roger Bay and Dire Dire Docks (area 2). I tried using the 01 value in Bob-omb Battlefield, but instead of producing snow it produces strange polygon shapes. So, I guess it could be either that a specific bank loaded in Cool Cool Mountain/Snowman's Land is needed or that snow is in one of the shared banks but there isn't a 0x22 pointing to it in Bob-omb Battlefield. But getting back to the checksum area, I don't know if that's what you meant when you said you find Mario's move table, but a lot of the 8027xxxx RAM pointers are some sort of jump table for specific Mario actions. For instance, the value at 80336C60 is read and them jumped to (by a Jump Register opcode) when you do the "jump" action. All nearby values are jump related, such as double jump, triple jump, etc. By swapping these values you can make things like a instant triple jump or another changes. For example, here is a fun code I created that replaces the kick after two punches value with another punch value. This way you can punch very fast: 81336EE8 8027 81336EEA 4F90 |
| Stevoisiak Member Level: 38 Posts: 103/283 EXP: 345476 For next: 24971 Since: 11-22-07 From: New York, Long Island Since last post: 12.3 years Last activity: 5.6 years |
|
||
| To make some of these things clearer, can you post images for those of us who cannot do this ourselves? |
| Boing 450 ![]() ![]() ![]() ![]() ![]() Level: 46 Posts: 80/458 EXP: 709669 For next: 2105 Since: 12-16-07 From: Michigan, US Since last post: 11.1 years Last activity: 11.1 years |
|
||
|
| Stevoisiak Member Level: 38 Posts: 106/283 EXP: 345476 For next: 24971 Since: 11-22-07 From: New York, Long Island Since last post: 12.3 years Last activity: 5.6 years |
|
||
Originally posted by Boing I mean to see the effects of the editing. And I thought you hacked SMW. |
| messiaen Catgirl Level: 68 Posts: 193/1085 EXP: 2594038 For next: 134762 Since: 11-20-07 Since last post: 8.1 years Last activity: 7.2 years |
|
||
| This was way simpler than I thought, so here is a simple way to skip CRC check. Just NOP these two instructions: (ROM) 0x066C: BNE A3, T0, 0x800001C8 <-- Sends you to a dark trap room. 0x0678: BNE S0, T0, 0x800001C8 The emulator will complain about it ("unknown CIC"), but it works. There also could be an option in TT64 to restore this code and recalculate the CRC when your project is ready, to avoid emulator annoyances. |
| VL-Tone Member Super Mario 64 forum moderator Level: 53 Posts: 227/621 EXP: 1135503 For next: 21616 Since: 07-27-07 From: Montreal, Canada Since last post: 4.7 years Last activity: 1.2 years |
|
||||
|
| messiaen Catgirl Level: 68 Posts: 194/1085 EXP: 2594038 For next: 134762 Since: 11-20-07 Since last post: 8.1 years Last activity: 7.2 years |
|
||
| I tested it on a few emulators. Here are the results: 1964 - Doesn't complain at all. Mupen 0.5.1 - Same (haven't tried MupenPlus yet). Nemu64 0.8 - One error message ("Unknown bootcode. Chances that this game won't work are high"). Project 64 1.6 - Two error messages ("Unknown Cic Chip" and "Unhandled CicChip(-1) in first DMA". Now it's time to gather more data, I'll see what I can gather from Gameshark codes. |
| Lyskar 12210 ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() -The Chaos within trumps the Chaos without- Level: 192 ![]() Posts: 1618/12211 EXP: 99235505 For next: 638066 Since: 07-03-07 From: 52-2-88-7 Since last post: 7.4 years Last activity: 7.3 years |
|
|||||||||||||||||||||||
|
||||||||||||||||||||||||
| VL-Tone Member Super Mario 64 forum moderator Level: 53 Posts: 228/621 EXP: 1135503 For next: 21616 Since: 07-27-07 From: Montreal, Canada Since last post: 4.7 years Last activity: 1.2 years |
|
||||
|
| messiaen Catgirl Level: 68 Posts: 195/1085 EXP: 2594038 For next: 134762 Since: 11-20-07 Since last post: 8.1 years Last activity: 7.2 years |
|
||
| Great list! Just to narrow our searches, the non-ASM data seems to start at 0x0E6260. I think I found what the parameters after the RAM pointer does: it's the time before you regain camera control. To confirm this, I swapped the "00 01" parameter in the double door opening with "03 34" from the Lakitu tour, then opened another emulator window and watched the intro at the same time I opened the double door. When the intro's over, you can control the camera again. With parameter "7F FF", there is probably some kind of input (either from joypad or some function to be called) needed to regain camera control. By the way, at 0x8029000C lies some sort of StopCamera() function which is called by some behaviors (ie, collect star). And here's what I got from the behavior list on 0xEAED8 (updated): I used Yoshiman's Spawn any object anywhere code to discover most of this (code on his website). Most of these are "spawn" behaviors, and they have a hardcoded model setting. |
| VL-Tone Member Super Mario 64 forum moderator Level: 53 Posts: 230/621 EXP: 1135503 For next: 21616 Since: 07-27-07 From: Montreal, Canada Since last post: 4.7 years Last activity: 1.2 years |
|
||||
|
| Kenshi Member Level: 21 Posts: 19/75 EXP: 47437 For next: 2506 Since: 09-15-07 From: NY Since last post: 6.9 years Last activity: 6.2 years |
|
||
| So with this info, its possible to force the camera to show mario like a side scroller in vl-tone's smb 1 remake hack? ____________________ ![]() |
| Pages: 1 2 3 | Next newer thread | Next older thread |
| Jul - SM64 Hacking (Archive) - Stuff inside the checksum protected area (Title Screen, etc.) | - - ![]() |
![]() |
Acmlmboard - commit 47be4dc [2021-08-23] ©2000-2022 Acmlm, Xkeeper, Kaito Sinclaire, et al. Warning: You are using TidyHTML mode! Pages MAY and probably WILL break. To disable, click here or append 'xxx-off=1' to the URL! ![]() |
| Query execution time: | 0.137261 seconds |
| Script execution time: | 0.055750 seconds |
| Total render time: | 0.193011 seconds |