Register - Login
Views: 99790879
Main - Memberlist - Active users - Calendar - Wiki - IRC Chat - Online users
Ranks - Rules/FAQ - Stats - Latest Posts - Color Chart - Smilies
05-03-22 04:18:27 AM
Jul - Posts by hedgehog89
Pages: 1 2 3 4
hedgehog89
Member
Level: 19


Posts: 1/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-02-14 03:06:47 AM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-07-14 08:27:56 PM) Link
Hello

I've been visiting TCRF for quite a long time, as it's the best site to learn about games secret and hidden stuff.

About FFXIII, it was my first FF game and I really love it, so much I have played it around seven times.

By having played it a lot I've noticed some areas in the 'hallway' that couldn't be reached, since the game events port you from one location to another leaving small and even big portions of the map behind.

Thanks to BruteForce Save Data and FFXIII Encryptor tools I did hack the savegames in order to be able to access these areas. I've found your post the perfect place to share my findings and hope you will enjoy it. Feel free to spread the info!

The hack is about changing the save point, going to the one before the no return point, with is stored at 0x2E20 in the decrypted save. It is saved as a string of two types, s_point_xxxx_yy for save stations and sp_chpt_xxxx_yy for events, where xxxx is the area code and yy is the save point / event number. It seems the save points have numbers assigned in order, in the same order you reach them.

So far the area code list I've got is

Hanging Edge: hang
Pulse Vestige: hgin
Lake Bresha: hgcr
Vile Peaks: vpek
Gapra Whitewood: gapr
Sunleth Waterscape: snls
Palumpolum: pmpm
Palamecia: hiku
Fifth Ark: fark
Grand Pulse: gpcg
Eden: eden
Orphan's Cradle: lasd

So, the trick is for example in Vile Peaks, where the biggest secret area lies, just after the party splits you start playing with Light and Hope and a huge, unreachable area behind you. It's just about hacking this save to go to the savestation before the party splitting, since that splitting event happened it won't trigger again allowing you to explore the area.

There are rules however, the game manages the events on some kind of checklist, if you hack a save to go to a further point, it will act like the preceding events happened and will continue on. The other rule, you can't go back to savepoints of a preceding chapter, the game will not finish loading the map and freeze.

I do believe there must be some values yet to discover in the save that would allow to go back to areas of preceding chapters and why not believing the possibility of making the game load unplayable maps. It's clear to me that these maps could be played by doing advanced hacking:

Euride Gorge
Bodhum Train Station, where Light and Sazh are boarding the purge train.
Lightning House: Seems to be complete in the game files, appears in Gapra Woods when Lightning remember Serah telling her about being a Pulse l'Cie.
Palumpolum Park, where Hope tries to kill Snow, this area seems huge and is completely unreachable.

It would be interesting to know, if there is a way of getting all the map codes and savepoints list in order to see if there might be one not used in the game that could lead to beta stuff, events, etc.

Edit 09-07-2014: New Revision 2.

Finally, a link to the hacked savegames: http://www.mediafire.com/download/4c8osk7sr2y5572/HASVGFF13_REV2.7z

The areas available are:

#17 Bresha Ruins (Lake Bresha) 01: Garuda Battle Zone, it's huge.
#9 Vile Peaks 01: Dreadnought Battle Area
#8 Vile Peaks 02: Party's Splitting Area, The biggest secret area.
#11: Vile Peaks 03: Light & Hope Camping Area, there is a secret area to the right.
#14: Vile Peaks 04: Sasz & Vanilla Camping Area, although never seen in the cutscenes, there is a well rendered landscape displaying an huge lake.
#22: Gapra's Wood 01: End, if you get the most close as posible to the end and look to the right you will see and interesting building of sorts.
#54: Sunleth Waterscape 01: The Terminal to Nautilus. (Rev 2)
#28: Palumpolum 01: A small alley where Snow and Hope have a call.
#32: Palumpolum 02: Ushumgal Battle Zone
#33: Palumpolum 03: A small street before getting to Felix hieghts.
#34: Palumpolum 04: Ushumgal Battle Zone 2
#37: Nautilus 01: Chocobo Park, the second most huge secret area.
#42: Palamecia 01: Door where Sazh and Vanille leave the zone.
#43: Palamecia 02: Kalavinka Battle Zone.
#49: Fifth Ark 01: Go all the way down to the pulsian ship. (Rev 2)
#21: Seventh Ark. (Rev 2)

I hope you will have fun with them. I didn't make videos or anything as I lack HD capturing equipement for doing so.
hedgehog89
Member
Level: 19


Posts: 2/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-03-14 02:17:20 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-03-14 02:22:07 PM) Link
Thanks for the info.

I did test most of the codes and, while not able to load hidden areas, I found something.

The codes asre, hmob, stst and tttt aren't recognized by the game and so it freezes.
The codes bodm and test are recognized, by being part of the 1st or an unknown chapter number that shares the same loading screen (where the chapter number and description is shown) background, the Hanging Edge one.
The code that gave the prize, eark, did react, showing an unused loading background that displays a Berserker in an area that looks like Fifth Ark Hibernatorium.

You can see it here http:// i59. tiny pic .com/24eqqmc.jpg

So by the code I can assume there was an Eight Ark, that could have been the Seven Ark according to this article http://www.escapistmagazine.com/news/view/103997-Final-Fantasy-XIII-Producer-Wants-a-Sequel and this is the background displayed when loading it.

The other gpXX codes are Grand Pulse codes.

gpda (or gpda23) Archylte Steppe
gpoc (or gpoc30) This one freezes
gpst (or gpst20) Faultwarrens
gptk (or gptk24) Yaschas Massif
gptt (or gptt26) Taejin Tower
gpwo (or gpwo27) Oerba
gpyu (or gpyu22) Mah'habara

I will try to find where does the game in the save, stores what seem to be a coordinate or map number that tells the game where to look into when loading maps. If you find any file that says eark, it might be related to the eight ark. It might even be interesting to look on the files that store the chapters and subchapters descriptions that appear on the loading screen, maybe there is stuff about the eight ark too.
hedgehog89
Member
Level: 19


Posts: 3/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-05-14 12:46:14 AM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-06-14 05:43:41 PM) Link
Thanks, I really appreciate your help.

Finally, I've managed to discover the value that needs to be changed in order to go back or forward in a chapter map.

It's located at the offset 0x3EAB. Each map code have it's own value. So far this is the value list:

EDIT: The list had errors, codes 0x06 and 0x16 are NATI and GPYU respectively.


HANG - Hanging Edge 0x10
HGIN - Pulse Vestige 0x11
HGCR - Lake Bresha 0x02
VPEK - Vile Peaks 0x04
GAPR - Gapra Whitewood 0x0F
SNLS - Sunleth Waterscape 0x0A
PMPM - Palumpolum 0x08
NATI - Nautilus 0x06
HIKU - Palamecia 0x03
FARK - Fifth Ark 0x12
GPCG - GP - Vallis Media 0x15
GPDA - GP - Archylte Steppe 0x17
GPST - GP - Yaschas Massif 0x14
GPYU - GP - Mah'habara 0x16
GPTK - GP - Sulyya Springs 0x18
GPTT - GP - Taejin Tower 0x1A
GPWO - GP - Oerba 0x1B
GPOC - GP - Faultwarrens 0x1E
EDEN - Eden 0x13
LASD - Orphan's Cradle 0x1D


This allowed me to make savegames that allow exploration of the Terminal at Sunleth Waterscape and to go all the way down to the Pulse ship in the Fifth Ark.

Now, if we analize the codes in order, this is the list, being GPOC 0x1E the one with higher value:


0x00
0x01
0x02 HGCR
0x03 HIKU
0x04 VPEK
0x05
0x06 NATI
0x07
0x08 PMPM
0x09
0x0A SNLS
0x0B
0x0C
0x0D
0x0E
0x0F GAPR
0x10 HANG
0x11 HGIN
0x12 FARK
0x13 EDEN
0x14 GPST
0x15 GPCG
0x16 GPYU
0x17 GPDA
0x18 GPTK
0x19
0x1A GPTT
0x1B GPWO
0x1C
0x1D LASD
0x1E GPOC


So what do I have there?, The need of finding what code should I put there in order to make the codes EARK, BODM, TEST and ZJUMP (shows hanging edge background too) and the others I haven't tested yet to load. If there were files for those codes they might end up being loaded.

What I will do now is to bruteforce the code with eark, from 0x00 to 0xFF. I have tested to 0x24 so far. 0x00 freezes the game in a way that you have to power down yor ps3 manually and hear the double beep when games crashes badly.

It's interesting to note that, when bruteforcing, if there's nothing the game will never end loading but, if there's something the game reacts just like when changing the save point with one of another chapter, it will end loading faster and 'freeze' with a black screen and a map, only allowing to pause without chance of going to title screen.

Edit: I was wrong here.


Codes 0x06 and 0x16 have reacted in this way, but eark, test, bodm and zjump didn't worked with them.

This leads me to your save point info. Sunleth Waterscape only have 4 but in the RAM have 9. However when trying the 5th one, it behaves like when trying a save point of another chapter so, I should try all the codes with 0x06 and 0x16 to see if something happens.


I tried too one of the weird entries, mset_vpek_bt01, but it behave like the code asre, it doesn't put a loading background and freezes with black screen.
hedgehog89
Member
Level: 19


Posts: 4/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-06-14 05:47:41 AM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
Well Ladies and Gentlemen, I've finally managed to access the Seven Ark!!

It is posible by hacking a savegame that must have completed the game, otherwise it might make the game crash when loading.

The savepoint string at offset 0x2E20 must be changed to s_point_eark_00 and the byte at offset 0x3EAB must be changed to 0x69.

A savefile ready for the seventh, is available here: http://www.mediafire.com/download/7pa9xuvzhrd9spy/SEVEN_ARK.7z

So far, only one save point works, the 00. It only seems to have a room that is identical to Fifth Ark Hibernatorium, with a Beserker that doesnt fight, a door with a passage that leads to a portal without inner background that port you in front of the Nathex portal in Orphan's Cradle and, four switches that when activated start spinning and immobilize your character, freezing the game. The portal and switches doesn't display any kind of text when close to them and activating them.

None of this would have been possible without VIRGIN KLM's info. That z106u file helped me notice the relation between the zXXu decimal value in the disc filesystem and the hex value in the 0x3EAB offset.

However, it seems it might not be possible to access the test map. No matter what savepoint I put in, just by having the value 0x6A (106) makes the game to cancel the loading process, then asks for pressing X and when doing so it plays the game's ending, so it only leaves me with a savegame that can let me watch the ending without fighting Orphan!!

However the hope is not lost. Maybe there are some flags in the save that must be activated somehow and will allow loading the test map.

Maybe that can be tried by having a complete list of these strange values in the save, that seem to be flags, they appear around offset 0x46F0, and doesn't have a fixed place to appear. Examples are


IP_gpst02
PV_gpst_02_3a
IP_gpyu10_0101
PV_gpyu_17all3
PV_gpda_16_3b
IP_gptk01
PV_gptk_01_3a
IP_gptt06_03
PV_gptt_18_3a
PV_gpwo_02_3b
PV_gpoc_00_3b
IP_eden01_0103
PV_eden_add00c
IP_lasd05
PV_lasd_12_3b


Those appear on a finished savegame, in saves of 1-11 chapters only appear 2 or 3 maximum. Anything that says test, bodm, eark, zjump and of course, debug, dbg or something would be of great help to try out.

About the maps, I can tell you z06u, z16u, z105u (Seventh Ark) and z106u are likely the maps with unreleased stuff, please take a peek on them too.
hedgehog89
Member
Level: 19


Posts: 5/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-06-14 03:09:53 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-11-14 12:45:24 AM) Link
I will be trying more ideas and continue the analysis that let me find the 0x3EAB offset. The analysis was made by having a savegame on Sunleth Waterscape, then, without fighting or making changes to inventory, etc, went forward to Palumpolum. Then, it was about comparing the two saves to get the offsets where it changed, going one after one, changing save B with original data on Save A until I got it, but I've stopped there.

For example, I don't know what offset to change in order to put the title "Seventh Ark" and the chapter description on the loading screen.

I will try carefully analysing all these changed offsets on the cluster of saves I have, to see if the values have a pattern and so, begin trying.

The offsets are these:


0x2E62, 0x2E63, 0x2E67
0x31AA, 0x31AB, 0x31AE, 0x31AF
0x3AA3
0x3EAB (I've stopped here)
0x3EF3
0x46B0 to 0x4700 (Those IP PV values)
Edit: 0x4723 to 0x4727
0x4733
0x4874
0x56F0


There are others, starting from 0x1BE20, but they look like the data log info.

The info I would like to have, is the same one you gave me of the z106u map, but from z105u and specially, z06u and z16u. Maybe by looking at the land layout we could guess the code and savepoint number that could make these two load (For example if it looks like Bodhum or Euride Gorge). While z06u doesn't have music when loading, z16u plays the music from Vile Peaks, Mah'habara.

By the way, you can get the tool I'm using for decrypting the savegames here at 360haven forum. Bruteforce savedata doen't decrypt them well, but at least can resign them with another user info. I hasn't tested it with my JP version saves, but I'm afraid it will not work with those. Who knows if the JP could have more hidden content.

And thanks to HxD Hex Editor I can modify the saves and easily compare two of them.
hedgehog89
Member
Level: 19


Posts: 6/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-06-14 05:57:55 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
It seems this list solves the puzzle. It made me notice I was wrong with 0x06 and 0x16, with are z006u and z022u, not z016u. Indeed, they are Nautilus and Mah'habara. I already edited the earlier post with the codes list.

z004u loads Bodhum right, it's because I am really sure the actual Lightning House, complete map, lies there. It appears in the cutscene when Lightning remembers Serah giving her the knife she later shares with Hope.

z010u is Sunleth Waterscape and is of interest seeing it loading bodm files. Maybe they are part of a cutscene in Bodhum, I think it was a cutsecene of Sazh remembering being there with Dajh.

Those who loads mset_something seem to be removed stuff. When I tried most of these codes the game never ends loading.

About the event at Seventh Ark, I've tried the save point of style s_chpt_eark_00, those appear on saves that when loaded trigger events and cutsecenes, but it wasn't recognized by the game and freezed with black screen, no loading background. Maybe you should try looking for these s_chpt_ values.
hedgehog89
Member
Level: 19


Posts: 7/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-06-14 07:01:15 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-06-14 07:11:19 PM) Link
I've tried the sv_point_z100_1, but the game doesn't recognize it and freeze with black screen.

This may be a little off-topic but I think it's worth to show.

It seems that, when you reach Grand Pulse for the first time, and after you get to Archylte Steppe for the first time (and maybe after winning the first mission) if you go back to Vallis Media and just before reaching the bridge you must stop and look to the front, moving your camera a little up, you will see a Purple Dragon passing by in around 2 seconds (it's really fast).

So what about it? This only happens once in the game, after it passes if you save it will never pass again. Due to the place it flies by, it seems most players never see it and only hear it's scream. Most even seeing it a little believe it's fal'cie Dahaka, as he appers on other GP areas, but it's not.

This purple dargon seems to be a fal'cie, it's metallic and have amethyst crystal throghout it's body.

Here is a link to a savegame where it can be seen. http://www.mediafire.com/download/vho8n6euw7qr3aq/PURPLE_DRAGON.7z

Just after it loads, go back to Vallis Media, stop before the bridge and look up to see it.

So far I hasn't found information about it.

Edit, best pictures I could get:

Picture 1: http://i62.tiny pic.com/2niy4gj.jpg
Picture 2: http://i62.tiny pic.com/vcxxzo.jpg
hedgehog89
Member
Level: 19


Posts: 8/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-06-14 09:33:44 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
Thanks.

It seems I've got deceived with a high quality HD video in that Lightning House cutscene after all.

And about the dragon, I've made some color, brightness and contrast changes to the model image to allow a better look at the textures, trying to get it closer to the way it looks in game.

http://i61.tiny pic.com/2mnqkjd.jpg
hedgehog89
Member
Level: 19


Posts: 9/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-07-14 07:50:06 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
Sorry, I just have an OFW one. I'm actually a noob in this, and I've just had luck that the way the game manages the savepoints wasn't hard to learn.

I've been trying many offsets on an Orphan Cradle save, but no luck. I think that, what triggers the event in the Seventh Ark might be something that the DLC would do on the save, for example, I've tried hacking a Sunleth Waterscape save to go forward to Nautilus. The game loads Nautilus and automatically recognizes the chapter and triggers the events just like when normally getting to Nautilus however, this doesn't happen when doing the opposite (going backwards).

Maybe the trick would be, how to change values in the save to go backwards and, trigger the events of the preceding chapter?, maybe that will show how that works.

I've just found that a shop seems to have been removed from the game. In the save appears strings for key items, they are key_shop_XX, from 00 to 13, but there was no 04. I tried to put it but the game didn't recognized and just put Key_shop_04 in the inventory.

I will be editing my first reply soon, where I will upload an updated package of savegames, including two more (Sunleth Terminal and Fifth Ark Pulsian ship) and the Seventh Ark one.
hedgehog89
Member
Level: 19


Posts: 10/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-10-14 02:01:49 AM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
I don't think it is. If you see the cutscene you will notice it looks more like a worm (with insect like body parts) rather that a dragon, it is really big compared to the Lightning and, it doesn't have crystals.
hedgehog89
Member
Level: 19


Posts: 11/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-11-14 11:25:36 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
I've already saw them, and even found text in the Orphan Cradle that somehow worries me.

It seems to be part of the event when the portals to Eden and Grand Pulse are open, the characters describe the Eden portal, then the Grand Pulse one in the current event, however in the text lies a description for the Seventh Ark too (It says "This one is connected to an ark"). I wonder if they've deleted the portal from the event, but the text is in the file, however this text doesn't have the Eden one. The text it's on /txtres/ac/ac_lasd420 on the Orphan's Cradle files and it's localized.

These text looks like they are compressed in a, for example, zip/lzma like format. If you notice big text files are more unreadable as text if more compressed due to it's volume.

Reviewing the Cradle maps, none seem to have a modification to show the seventh ark in a form of a scenario extension so, if the portal where to exists, it would be on the same layout we have in the ordinary map.

Interesting findings are, that the Cradle files have more content that the 7th, maybe it's the deleted stuff or, the 7th somehow use some of the Orphan's Cradle files.

Promising news is, that I've found the Orphan's Cradle layout status offset. It's at 0x3762. It's values are 0x20 when the portals open, 0x40 when going further into the cradle and 0x02 is the final value I've got from saves of a Cradle playthrogh from the beginning. So far when bruteforcing values, if one doesn't exists it acts like 0x02, the final state.

Values 0x80, 0x16 and 0xFF works by setting the status to locked Narthex gate and, a combination of "White / Dark Eden Entity", those characters that open the portals and guide you through the Cradle that can appear at the begginng and / or at the right side of the central scenario.

So I will try more values to see if hopefully one could unlock the portal to the 7th.
hedgehog89
Member
Level: 19


Posts: 12/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-12-14 01:50:05 AM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
Yeah, me too, but until then I will continue on, I won't give up anytime soon.
hedgehog89
Member
Level: 19


Posts: 13/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-12-14 04:53:05 AM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-12-14 10:07:44 PM) Link
OPEN SESAME!!

http://www.mediafire.com/download/bt7l7b378tam874/SEVEN_ARK_REV2.7z

After being really, frustrated, sad, and having lost any hope of getting it to work, I've just went mad and did a padding attack of replacing 0x00 values with 0xFF near the Orphan's Cradle's layout status offset (0x3762) I've found. (See Nemesis save for this).

And, although corrupting character statuses, some databases entries and not allowing return to Orphan's Cradle (game freezes), it did finally unlock the locked door of the 7th Ark. A treasure with 100 gil appears, going forward appears one of those switches... Maybe it will behave like the former four ones, but when you press down, then accept, the game will freeze for around 10 secs then, load the battle arena that would appear in FFXIII-2 vs Proto Fal'Cie Adam (I was going to post about that this saturday) and after a somewhat not polished cutscene a battle will begin against Anima !?, well no, looks like, but it's called Nemesis and doesn't have a image in his database entry.

EDIT: To fight Nemesis, use this save, the other got 'fixed' by the game and it does other things yet to explore. This fixed savegame however, will allow me to find the offset (or one of them if many).

http://www.mediafire.com/download/wff79emfl1e0w4z/SEVEN_ARK_NEM.7z

The entry for the 7th appears and it's really funny to read it's localized text, which it's likely to be complete in the JP version, you will know why

At the time of posting this, I hasn't continued further.

Enjoy.

I will try to know what actual offset or offsets are the ones that activated it, by removing by half and half the padded offsets.

EDIT: I've improved the grammar of the post, I've wrote it late at night.

What made this possible was the way the Orphan's Cradle layout status code works, it gets a value and, if the value is not valid it will take the most close valid preceding value in the list. So, the Nemesis battle it's the last event of the 7th, nemesis doesn't attack and to kill it fast just use Thunder magic, after that you see a cutscene that clarifies the story behind the 7th and then you get to the beginning and, the battle will not happen again, and entry for Namesis will appear in the Fal'Cie database with the same 7th placeholder text and eveything will behave like the fixed savegame.

The fixed save by unknown reason changed some offsets and the battle will not trigger, instead a cutscene of the players going back to the beginning will happen and four switches will look activated. It seems the actual switch code is broken (maybe intentionally) or, if I put more 0xFF values where there are 0x00 maybe they will work properly.

What I will do is to find the actual offsets that activate the 7th. Then play around with the offsets changed by the fixed save to see if I can unlock more areas and events of the 7th, by putting in values less than 0xFF.
hedgehog89
Member
Level: 19


Posts: 14/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-12-14 11:32:36 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
Thanks Gamma. Spanish is my first language and, your translation is right and accurate.
hedgehog89
Member
Level: 19


Posts: 15/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-13-14 04:26:27 AM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-13-14 05:50:16 PM) Link
I've located the exact offsets that made the job.

So this is the actual offset list of values that must be edited on a savegame in order to play the Seventh Ark the best as possible so far. I will edit it if I find more offsets and values for each one of them that do different things.


0x2E20 = Save Point. Must change the text to s_point_eark_00
0x3EAB value 0x69 = Zone offset. 0x69 loads Seventh Ark zone data.
0x3770 value 0xFF = Possible event offset.
0x3776 value 0xFF = Loads the 100 gil treasure box.
0x3777 value 0xFF = Opens the doors to the bottom of the area.
0x6750 to 0x69E9, Fill with 0xFF, replacing anything = Unlocks the 7th Map, showcasing three GIANT areas with a small room.
EDIT: (Although it worked on one of my saves, it's not working on another, it needs more research).


About the 0x3770 offset, the value 0xFF triggers the Nemesis battle when pressing down then the X button on the bottom portal. The fixed savegame changed it to 0xFB. Values 0x10 and 0x20 do the same as 0xFB, a cutscene that makes some of the four portal look activated, then goes forward, opening the doors and focus on the bottom portal.

I will try padding other offsets beyond the ones I did yesterday, hoping one of them make the portals work and Nemesis attack.

Here is the map:

hedgehog89
Member
Level: 19


Posts: 16/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-13-14 06:18:44 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-13-14 06:19:30 PM) Link
It was kinda easy, I've noticed a part of another area gets revealed if you go to the northeast corner of the bottom area. I've just saved in another savegame and compared it with the former. Then began trying values until I did the 0xFF thing and revealed it at full. The offsets are described in the map post, but they seem to change from one save to another on certain conditions.

Now, if you look carefully the area that appears in the southwest, it seems to have ladders that go down, showing the possibility of another map for that area below.
hedgehog89
Member
Level: 19


Posts: 17/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-14-14 04:19:03 AM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-14-14 04:25:46 AM) Link
Well, this one is strange.

The offsets 0x3770 and 0x3777 seem to be related.

0x3770, if it have a value higher than 0xFB, it will trigger Nemesis battle otherwise, will trigger a cutsecene of the switches being activated, doors opening, focus on bottom switch, however, this event will NOT happen if the value of 0x3770 is so low that doesn't open the doors (I'm trying to know at which value higher than does it open the doors).

The strange thing is that, if the doors are closed and I fight Nemesis (example offsets: 0x3770 = 0xFF, 0x3777 = 0x50) it will change the dialogue after the battle and, it will not unlock the datalog entries, and will return to the bottom switch and, eerily will focus one of the switches at the beginning.

So far, the behavior of those offsets are quite narrow, actually true or false (or it does 'A' or it does 'B' only), making it impossible to get to the other areas using them.

I think the 7th was meant to work as follows: The switches are portals that, if they weren't broken, would port you to the huge areas. You advance through them and fight a boss (Ereshkigal, Raspatil, Gorgyra, etc). After the battle you would go back to the beginning and the switch will show it was activated. After going through the four ones, the cutscene of they getting activated will happen, open the doors and show you the bottom switch, that leads to the final battle against Nemesis.

I'm thinking there may be more offsets involved, that in order to access the preceding areas require offset 0x3777 to have the doors locked. But I haven't any luck with my attempts yet.

By the way, I wonder what happens on RAM when the switches freeze after activating them, who knows if a clue could be there.

Here is the save with the 'full' map open: http://www.mediafire.com/download/1vko37vy57mcvbi/SEVEN_ARK_MAP.7z
hedgehog89
Member
Level: 19


Posts: 18/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-14-14 03:47:32 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
This is the list, the same of a previos post, but with the 7th and Test map included:


HANG - Hanging Edge 0x10
HGIN - Pulse Vestige 0x11
HGCR - Lake Bresha 0x02
VPEK - Vile Peaks 0x04
GAPR - Gapra Whitewood 0x0F
SNLS - Sunleth Waterscape 0x0A
PMPM - Palumpolum 0x08
NATI - Nautilus 0x06
HIKU - Palamecia 0x03
FARK - Fifth Ark 0x12
GPCG - GP - Vallis Media 0x15
GPDA - GP - Archylte Steppe 0x17
GPST - GP - Yaschas Massif 0x14
GPYU - GP - Mah'habara 0x16
GPTK - GP - Sulyya Springs 0x18
GPTT - GP - Taejin Tower 0x1A
GPWO - GP - Oerba 0x1B
GPOC - GP - Faultwarrens 0x1E
EDEN - Eden 0x13
LASD - Orphan's Cradle 0x1D
EARK - Seventh Ark 0x69
TEST - Test Map 0x6A


Narthex is included in Orphan's Cradle Map.

About the test map, It seems to be impossible to load from a savegame. If you see the script file in \db\script\script00106.wdb the functions text is really small and the functions names somehow tells that is a call to the process that triggers the game's ending. Other areas script files have tons of functions names compared to this one.
hedgehog89
Member
Level: 19


Posts: 19/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-14-14 08:23:57 PM, in Final Fantasy XIII (Unused/Beta/Early stuff) Link
I've translated the text that appears on the switches when they got activated, in the vertical golden light at the right side of them.

It reads "time showing the rest of". I think in order it must be "Showing the rest of time".

http://oi59.tinypic.com/2eoefdv.png
hedgehog89
Member
Level: 19


Posts: 20/75
EXP: 34369
For next: 1408

Since: 09-02-14


Since last post: 7.1 years
Last activity: 6.7 years

Posted on 09-17-14 03:54:18 AM, in Final Fantasy XIII (Unused/Beta/Early stuff) (last edited by hedgehog89 at 09-17-14 04:00:34 AM) Link
I don't think I will be able to find something on a memory dump.

I wonder what would happen if for example you force the 44590A1B (3EAB) to be 6A when playing in for example, Sunleth Waterscape, then trigger the scene to go to Palumpolum. Will it load the test map instead? Or trying 69, will it load the 7th, if it were to, it means maybe we should find the RAM offset again and do the same on other versions of the game not supported by FFXIII Encryptor, like the JP. Other try would be going to Grand Pulse's Vallis Media with 69 value from Orphan's Cradle.

Yesterday, I've made a little program for viewing the WDB files. They have a format where you have entries, then the entry's data offset and length. I could see how the data from one savepoint to another vary in savepoint.wdb, I think this could help in knowing exactly how things are managed in RAM (in case the RAM data match the WDB one).

http://www.mediafire.com/download/263su5f6t6b55f6/WDB_Viewer.7z

It may take a while to load certain entries, just wait.

I've still have more things to try. I've noticed when I made the padding attack on the same offsets but with 0x50 that Orphan's Cradle didn't froze and loaded with more stuff than the previous try on the layout offset. I think it froze with 0xFF because it was going to load too much stuff. So, there's another chance of getting the 7th portal to unlock (if it's there that is).
Pages: 1 2 3 4
Jul - Posts by hedgehog89


Rusted Logic

Acmlmboard - commit 47be4dc [2021-08-23]
©2000-2022 Acmlm, Xkeeper, Kaito Sinclaire, et al.

20 database queries, 57 query cache hits.
Query execution time: 0.073385 seconds
Script execution time: 0.033309 seconds
Total render time: 0.106694 seconds