PDA

View Full Version : Research: [IDB available] Crash Bandicoot 2: N-Tranced Research Thread


Team Fail
June 3rd, 2012, 10:05 AM
IDB Here: https://dl.dropboxusercontent.com/u/34957059/CB2%20IDB/CRASH2_AC8E00.idb

So last night I was talking to Darthatron about his VB6 Hex Editing Modules, and that they wouldn't work on VB.NET and that there are better alternatives in VB.NET as well. I then mentioned my idea of making (for now) a Text Editor for this game. He then mentioned he had an interest in wanting to hack this game, as I do too, because I see a lot of potential for fangames. Anyways, I have a little bit of information documented so far, and I just wanted a place where I could get together information and have others contribute to finding info on this game.

Anyways, let's get on to what I do have (And what little there is.)

UnLZ.GBA graphics info (I can't get pallet data because pallets don't load correctly) :
7- Fog? (IMG 052EDE8)
8- Unknown graphic (IMG 0052EDE8)
10- Unknown graphic (Possibly level parts) (IMG 053156C)
11- BG Parts? (IMG 05351E0)
20- Crash Head (IMG 07D63CB)
21- Crunch Head (IMG 07D6964)
22- Coco Head (IMG 07D64C4)
23- Fake Crash Head (IMG 07D6548)
24- N. Trance Head (IMG 07D65CC)
25- N. Trophy Head (IMG 07D66D4)
26. Uka Uka? Head (Img 07D66D4)
27. Dingodile Head (IMG 07D6754)
28. Tiny Head (IMG 07D67D0)
29. N. Gin Head (IMG 07D685C)
30. Neo Cortex Head (IMG 07D68D8)
31. Left Edge Textbox (IMG 07D6964)
32. Middle Textbox (IMG 07D69FC)
33. Aku Aku talking Textbox Right (IMG 07D6D90)
34. Red Arrow (Right)(IMG 07D6D90)
35. Crunch Menu Head (IMG 07D7B24)
36. Part of Left Arrow? (IMG 07DB660)
37. Part of Right Arrow? (IMG 07DB69C)
38. Small Game Font (IMG 052A9BC)
42. Crash Menu Head (IMG 07D79E0)
43. ? Crate (IMG 07D7DE4)
44. Crown (IMG 07D7F64)
45. Flag (IMG 07D8060)
46. KO (IMG 07D811C)

Text Information
All text displayed in the game is stored in standard ASCII, making it easy to modify.

Regional Differences contribute to slightly different offsets for the text in each region.
At 0x001D153C begins all of the English text, going through 0x001D3984. (EUR & US)

At 0x001D3C94 begins all of the French text, going through 0x001D5C1F. (EUR)

At 0x001D5F30 begins all of the German text, going through 0x001D7F4F. (EUR)

At 0x001D8260 begins all of the Spanish text, going through 0x001DA157. (EUR)

At 0x001DA468 begins all of the Italian text, going through 0x001DC443. (EUR)

Finally, at 0x001DC754 begins all of the Dutch text, going through 0x001DE72F. (EUR)


It seems there is also the ability to format text too.
Value - Color - Usage
0x00 - None - None
0x01 - Orange - Used for normal stuff
0x02 - White/None - Not used?
0x03 - Green - Used for names

Other tidbits of Text info:
Pointers to in-game text (All of them are 0x310 bytes in length)
English: 0x001D3984
French: 0x001D5C20
German: 0x001D7F50
Spanish: 0x001DA158
Italian: 0x001DC444
Dutch: 0x001DE730

Table Layout:
No. - Meaning - Use
0 - Pointer to "press start" - Titlescreen
1 - Pointer to "new game" - Main menu
2 - Pointer to "load game" - Main menu
3 - Pointer to "link game" - Main menu
4 - Pointer to "credits" - Main menu
5 - Pointer to "atlasphere" - Link Game sub-menu
6 - Pointer to "link race" - Link Game sub-menu
7 - Pointer to "back" - Link Game sub-menu
...
195 - Pointer to "use <#> to brake..." - Controls for..? - Last entry

-00 00 ends the text, but MAY require 00 00 00 00
http://i.imgur.com/a3ZaG.png

Regional Differences
The EUR version of the game has a language select, the USA version does not.
There are graphical differences, and encoding differences for the JAP releases.

RAM
Offset - Purpose
02000010 to 02000014 - Timer? (Goes up by one each frame)
02000018 to 0200001C - Key state

Values
> 0000FC00 - Nothing
> 0000FC01 - A button
> 0000FC02 - B button
> 0000FC04 - Select
> 0000FC08 - Start
> 0000FC20 - Left
> 0000FC10 - Right
> 0000FC40 - Up
> 0000FC80 - Down
> 0000FD00 - R button
> 0000FE00 - L button
020001CC to 020001D0 - Another timer?
02000E54 to 02000E5B - Player's sprite frame
02000E5C to 02000E60 - Altitude of player. All extra will be F if A is pressed, or 0 is not.

For example, if the player is jumping, and his altitude is 23A, it would look like this: 0000023A.
However, if the A button is being pressed, if would look like this: FFFFF23A.


Now, I want to also figure out how levels are stored in the game (All three kinds: 2D sidescrolling, isometric atlasphere levels, and Mode 7 wakeboarding and Space Coco levels), where the graphics are, and how time trial relic data is stored, as well as gem shard data, and how we can edit all of it. Last thing I want to do is music as the game doesn't use the standard Sappy engine most GBA games do. Any input and other research you all do is welcomed too because I don't think I can do all of the research, especially ASM. :3

CURRENTLY-KNOWN DEBUGGING FEATURES
Right as of now, we know of:
Song Test (Unknownfile - HCS Forum)
Speed increaser (Team Fail - PC)
Complete Audio Engine crash handler (Team Fail - PC)
Due to the fact that these two debugging options exist, that means there must be more within the game's code. Help us find it and be credited!

STUFF OF MAJOR INTEREST IN THIS POST. (http://www.pokecommunity.com/showpost.php?p=8702196&postcount=33)

Lastly, now that people want to contribute, I want to provide my thanks to Darthatron for showing interest in this unloved game, and agentgeo/itari for providing some more information.

Hopeless Masquerade
June 4th, 2012, 05:34 AM
Just to correct and add to the knowledge of text, the English text goes from 0x001D153C to 0x001D3984.

At 0x001D3C94 begins all of the French text, going through 0x001D5C1F.

At 0x001D5F30 begins all of the German text, going through 0x001D7F4F.

At 0x001D8260 begins all of the Spanish text, going through 0x001DA157.

At 0x001DA468 begins all of the Italian text, going through 0x001DC443.

Finally, at 0x001DC754 begins all of the Dutch text, going through 0x001DE72F.

Also, I've figured out how the game accesses the text!
Following each text section, is a table of 195 pointers to different sections of the text. (It is 0x310 bytes long)

Here are the offsets of each table (for clarification):
English: 0x001D3984
French: 0x001D5C20
German: 0x001D7F50
Spanish: 0x001DA158
Italian: 0x001DC444
Dutch: 0x001DE730

Here's the layout of the table, as far as I have bothered to figure out.

No. - Meaning - Use
0 - Pointer to "press start" - Titlescreen
1 - Pointer to "new game" - Main menu
2 - Pointer to "load game" - Main menu
3 - Pointer to "link game" - Main menu
4 - Pointer to "credits" - Main menu
5 - Pointer to "atlasphere" - Link Game sub-menu
6 - Pointer to "link race" - Link Game sub-menu
7 - Pointer to "back" - Link Game sub-menu
...
195 - Pointer to "use <#> to brake..." - Controls for..? - Last entry


Obviously it needs some people to go through and finish it out.

Also, I have noticed what look like two message codes, "<#>" and "<$>"
However, it should be noted that they are separate characters!
"<" and ">" print < and >, while "#" prints "A" and "$" prints "A", this is because "#" and "$" are 'invalid.' They have not font representation.

Also, to end a message, there are 2 bytes ,00 00, just like Team Fail said.
However, sometimes there are 4 bytes (00 00 00 00).

On the subject of newlines, it is quite simple... just put two the hex value 0x0A (newline in ASCII)
I'm not really sure on this, though.

Now, onto text color.
To set the text color, you just set one byte.
Value - Color - Usage
0x00 - None - None
0x01 - Orange - Used for normal stuff
0x02 - White/None - Not used?
0x03 - Green - Used for names
All else - puts "A" instead of color.

Team Fail
June 4th, 2012, 08:07 AM
useful information

I assume you got a rom from each region and looked up the tables? Or are all the languages in the one game?

And I'll add that text parse data soon as well. As for it showing AAAAAAA constantly, it's because if it's an invalid character, it defaults to the first character, which happens to be A.

Hopeless Masquerade
June 4th, 2012, 08:23 AM
All the languages are in one game. And I figured that was why A was showing up.

Team Fail
June 4th, 2012, 08:35 AM
All the languages are in one game. And I figured that was why A was showing up.

Was it as I said? That it was the default character?

Edit: I then assume all the other languages are encrypted? I wonder where their text graphics are.

Hopeless Masquerade
June 4th, 2012, 08:59 AM
The languages are most definitely not encrypted they're in ASCII just like English.
We just need to find the fonts for the characters.

Also, when I put 00 as the first character, the message box didn't show up. Does this mean just 00 is the terminator?

Team Fail
June 4th, 2012, 09:01 AM
The languages are most definitely not encrypted they're in ASCII just like English.
We just need to find the fonts for the characters.

Weird. I go to the offsets and I see nothing like French or anything. Perhaps it's because I'm using my own dump and you might be using a European version.

Hopeless Masquerade
June 4th, 2012, 09:02 AM
Weird. I go to the offsets and I see nothing like French or anything. Perhaps it's because I'm using my own dump and you might be using a European version.

That may be the case. I downloaded mine, and all the languages are there. You have to choose one at startup.

Team Fail
June 4th, 2012, 09:05 AM
That may be the case. I downloaded mine, and all the languages are there. You have to choose one at startup.

Yeah. Mine just goes into the game. There's a regional difference right there. I'll add that to the OP.

Hopeless Masquerade
June 4th, 2012, 09:17 AM
Yeah. Mine just goes into the game. There's a regional difference right there. I'll add that to the OP.

Okay.

On another note, I took a look at the RAM, and I've identified the use of some offsets

Offset - Purpose
02000010 to 02000014 - Timer? (Goes up by one each frame)
02000018 to 0200001C - Key state

Values
> 0000FC00 - Nothing
> 0000FC01 - A button
> 0000FC02 - B button
> 0000FC04 - Select
> 0000FC08 - Start
> 0000FC20 - Left
> 0000FC10 - Right
> 0000FC40 - Up
> 0000FC80 - Down
> 0000FD00 - R button
> 0000FE00 - L button
020001CC to 020001D0 - Another timer?
02000E54 to 02000E5B - Player's sprite frame
02000E5C to 02000E60 - Altitude of player. Signed integer.

For example, if the player is jumping, and his altitude is 23A, it would look like this: 0000023A.
However, if the A button is being pressed, if would look like this: FFFFF23A.

This because when it is filled with F's instead of 0's, it is negative (it's a signed integer).

Team Fail
June 4th, 2012, 10:09 AM
Added. Dang. I need to get on my home computer and do some research. All I have is TeamViewer but it's laggy D:

Hopeless Masquerade
June 5th, 2012, 05:15 AM
I actually just got the USA ROM, and I now have something else to add for text.
In the USA version, the text begins at 0x001D3820 and goes through 0x001D5C03, with the table starting at 0x001D5C04.

Also, it turns out the text is different from the EUR version completely!

In the EUR version, the last text is "use <#> to brake...", but in the USA version, the last text is "...but i have created turbo gates to help you stay ahead of the danger."

Also, the table for the USA version is shorter, being only 2FC bytes long, with 191 entries!

EDIT: A correction to the RAM addresses 02000E5C to 02000E60. It is the altitude of the player, but the extra is F if the player is going up, and 0 if he is going down.

EDIT 2: The tilesets are 256 colors, for the record.

Team Fail
November 10th, 2012, 10:29 AM
Ok, so today I decided to grab a J copy of the rom. As of now, I've already found localization changes.

First of all, let's look at some graphical changes.
Note: Left is E/U, Right is J unless otherwise stated.
http://i.imgur.com/Y8dUn.pnghttp://i.imgur.com/JmGAI.png
The TNT crates had the graphic changed in the J release. In the J release, there is a simple bomb on the crate as opposed to the letters "TNT". When jumped on, the countdown timer remains the same.

http://i.imgur.com/tyyuP.pnghttp://i.imgur.com/HoT6j.png
Nitro crates were also changed. ニトロ (Ni-To-Ro) translates directly to Nitro.

http://i.imgur.com/pCVwQ.pnghttp://i.imgur.com/HjjZC.png
The Nitro translation is retained in the Atlas Sphere levels. I still need to check if this change is also retained in the Wakeboard levels, although I presume it does.

http://i.imgur.com/4HXuJ.pnghttp://i.imgur.com/fEzhO.png
The title screen was also translated, and the graphic (imo) looks better in the J release. Note, it's before this screen, but after the Vicarious Visions screen, that you select a language in the E release. Therefore, Press Start will be in a different language depending on what is chosen. There is no language select in the U release, however, as previously stated.

http://i.imgur.com/zYo1X.pnghttp://i.imgur.com/41vag.png
Here's the copyright screen. It was updated for the J release.

There's also translation changed, for example, when you first enter Globe Trottin', in the J release, Aku Aku gives you a rundown of the controls, but it's left to a ? info spot in the EU releases to give you those same instructions, which also exists in the J release in case you forget.

I'm going to look into all three roms later on, but I am most curious as to how the J release has the text encoded. I'm thinking it's in Unicode, though. I'll have to look and see.

As well, there's some extras in the intro to the game, mostly that there's a Konami logo (KONAMI CODE PLS), and there's a screen change. I'll add that image in a minute.

Edit: Images added.

Edit 2: Was looking in the J rom, and came across this beauty: Debug text!
GAX2_INIT...OUT OF MEMORY...GAX2_NEW....PARAMS ARG IS NULL..GAX2_NEW_FX.FXPARAMS ARG IS NULL....WHEN USING DIFFERENT FX_MIXING_RATE, FLAG GAX_FX_REVERB AND GAX_HALFRATE_FX ARE NOT ALLOWED.....GAX2_JINGLE.GAX_NO_JINGLE FLAG IS SET...GAX_IRQ.GAX_PLAY HAS NOT FINISHED BEFORE GAX_IRQ. USE LOWER MIXING RATE OR LESS FX CHANNELS OR PUT GAX_PLAY IN VBLANK IRQ...GAX_FX..YOU TRIED TO PLAY A SPEECH FX BUT HAVE NOT USED THE GAX_SPEECH FLAG WITH GAX2_INIT..GAX2_FX.FXPARAMS->FXID IS GAX_DEFAULT
(Offsets 0x51CBD0-0x51CDB4)

Edit 3: Even more!
GAX ENGINE V3.01 Sep 13 2002..EXCEPTION. PROGRAM HALT...ÔÎQ.FUNCTION NAME:
(Offsets 0x51CED4-0x51CF1D)

Edit 4: After some Googling, it seems the Gax Engine is still in use. http://www.shinen.com/music/music.php3?gax
More games that use the GAX engine: http://www.mobygames.com/game-group/sound-engine-gax

Edit 5: This is the most interesting part. In the UE releases, text is stored in all-lower case, like this:

"crash"

Now, here's the same word in the Japanese release, spelling his Japanese name:

"KURAXTSHIXYU"

It's all stored as romanized characters, each character 2 or 3 bytes long. I need to decipher this.

Edit 6: Characters seem to be stored in 2-byte arrays. KU RA XT SH IX YU Therefore, the X characters seem to be some kind of termination byte.

Edit 7: More debug text in the U release:
GAX Sound Engine 3.01 (Sep 13 2002) © Shin'en Multimedia. Code: B.Wodok

Now, I want to look for world map pointers. There should be a table 29+ entries long for level headers. Where it is in the rom, I'm not sure as of yet.

Edit 8: I opened the rom in Audacity, and using Unsigned 8 Bit PCM, I got this:
https://dl.dropbox.com/u/34957059/Crash%20Bandicoot%202%20Ripped%20Samples.mp3

Hopeless Masquerade
November 10th, 2012, 01:36 PM
Very nice. That confirms the use of a different sound engine for the game.

Team Fail
November 11th, 2012, 09:54 AM
Well, I opened it in CrystalTile as well to see if I can rip the font, but I've found some other useful stuff that UnLZGBA never highlighted.

Starting at 0x7D8540 are some level-oriented objects. I can see, as of now, barrels for the Atlas Sphere levels, some numbers (For counters at the top of the screen), some kind of marker (For what I presume is the multiplayer Atlas Sphere games), various crate graphics in isometric position, various Wumpa Fruit graphics (Large and small), crystal shard graphics (for each frame, 10 frames), gem graphics (again, for each frame, 10 frames), a ? tile for Atlas Sphere levels (15 frames), portal graphics for the overworld (2 frames), (What I think is, but can someone verify? Look at 0x7DF6E0 in CT2.) gem shard graphics (10 frames), gem shard collection glow (10 frames), and CHECK POINT graphics (17 frames, but seems to be in the rom two times for some reason).

Edit: In writing a program I'm working on, I've generated a text dump of the U copy:
crash bandicoot 2: n-tranced


{color:green}developed by{color:orange}
vicarious visions


{color:green}ceo - chief creative officer{color:orange}
karthik bala


{color:green}vp product development{color:orange}
tobi saulnier


{color:green}project management{color:orange}
michael meischeid
jesse booth


{color:green}game design{color:orange}
chris degnan
tim stellmach
luis barriga


{color:green}programming{color:orange}
chris pruett
eric caraszi
nate trost
brian sox
viktor kuzmin
jesse raymond
mikhail barg


{color:green}graphics{color:orange}
steve derrick
yin zhang
theodore bialek
christopher winters


{color:green}audio{color:orange}
shin'en multimedia


{color:green}additional support{color:orange}
robert trevellyan
todd masten
rob caminos


{color:green}special thanks to...{color:orange}
guha bala
nehme frangie
kerry coffey
ida thornburg
lauren costello
dawn harrington
red eye studios
manfred linzner
daniel suarez
sean krankel
carlos schulte
naughty dog


{color:green}kid testers{color:orange}
ben godgart
tom wainwright
renee matthews
tyler hickey
michael brunick
george karathomas
sean kelton
luke citriniti
ellen waggoner
matt spiak
greg izzo
joseph isaacson
jordan kennedy
ryan kelton
sean o'brien-macari
matt maurer



{color:green}published by{color:orange}
universal interactive


{color:green}associate producer{color:orange}
carlos schulte


{color:green}producer{color:orange}
sean krankel

{color:green}senior producer{color:orange}
daniel suarez


{color:green}sr. software engineer{color:orange}
gary lake


{color:green}additional production support{color:orange}
chris kirk


{color:green}president{color:orange}
jim wilson


{color:green}general manager{color:orange}
nicholas longano


{color:green}vice president of production{color:orange}
neal robison


{color:green}director of production{color:orange}
suzan rude


{color:green}sr. product manager{color:orange}
craig howe


{color:green}assoc. product manager{color:orange}
michael scharnikow


{color:green}director of promotions{color:orange}
chandra hill


{color:green}director of publics relations{color:orange}
alex skillman


{color:green}junior publicist{color:orange}
sandra shagat


{color:green}special thanks{color:orange}
letty cadena
virginia fout
scott johnson
marcus sanford
erica dart
jason covey
jason subia



{color:green}testing by{color:orange}
absolute quality


{color:green}lead tester{color:orange}
matt kutrik


{color:green}testers{color:orange}
chris 't-bag' baguley
angel eastman
david freeman
john harold
richard padilla
trevor rose
david russell
tony sideris
jason 'butters' butterhoff





{null}{null}{null}{null}press start{null}new game{null}{null}{null}{null}load game{null}{null}{null}link game{null}{null}{null}credits{null}atlasphere{null}{null}link race{null}{null}{null}back{null}{null}{null}{null}waiting for connection...{null}{null}{null}a link error occurred.
the connection was dropped.{null}{null}player 1 wins{null}{null}{null}player 2 wins{null}{null}{null}play again{null}{null}start{null}{null}{null}game: {null}{null}map: {null}{null}{null}rounds: {null}{null}{null}{null}connection established.
waiting for player 1...{null}crash{null}{null}{null}crunch{null}{null}coco{null}{null}{null}{null}fake crash{null}{null}n. trance{null}{null}{null}n. tropy{null}{null}{null}{null}neo cortex{null}{null}dingodile{null}{null}{null}tiny{null}{null}{null}{null}n. gin{null}{null}megamix{null}double cross{null}{null}{null}{null}five points{null}long trail{null}{null}ring master{null}domination{null}{null}king of the hill{null}{null}{null}{null}bumpers{null}continue
and save
{null}continue
without save{null}{null}player 1{null}{null}{null}{null}player 2{null}{null}{null}{null}level{null}{null}{null}island intro{null}{null}{null}{null}prints of persia{null}{null}{null}{null}lagoony tunes{null}{null}{null}globe trottin'{null}{null}pharaoh's funhouse{null}{null}runaway rug{null}tiki torture{null}{null}{null}{null}hoppin' coffins{null}barrel roll{null}flockful of seagulls{null}{null}{null}{null}magma mania{null}run from the sun{null}{null}{null}{null}now it's istanbul{null}{null}{null}mister lava lava{null}{null}{null}{null}water logged{null}{null}{null}{null}slip-n-slidin' sphinx{null}{null}{null}rocks can roll{null}{null}rock the casaba{null}eruption disruption{null}spaced out{null}{null}king too uncommon{null}{null}{null}wild nile ride{null}{null}101 arabian kites{null}{null}{null}fire walker{null}evil crunch{null}evil coco{null}{null}{null}load-save{null}{null}{null}load link game{null}{null}delete game{null}save game{null}{null}{null}quit{null}{null}{null}{null}exit{null}{null}{null}{null}error saving data{null}{null}{null}save ok{null}cancel{null}{null}complete{null}{null}{null}{null}empty{null}{null}{null}delete?{null}overwrite?{null}{null}continue?{null}{null}{null}yes{null}no{null}{null}transferring data{null}{null}{null}error transferring data{null}unlocked neo cortex{null}unlocked dingodile{null}{null}unlocked tiny{null}{null}{null}unlocked n. gin{null}unlocked megamix{null}{null}{null}{null}push {btn_B} to quit{null}{null}push start to continue{null}{null}start: load-save{null}{null}{null}music{null}{null}{null}sound{null}{null}{null}resume{null}{null}warp zone{null}{null}{null}restart trial{null}{null}{null}powers{null}{null}crystals{null}{null}{null}{null}gems{null}{null}{null}{null}gem shards{null}{null}relics{null}{null}time trial{null}{null}none{null}{null}{null}{null}super slide{null}rocket jump{null}tornado spin{null}{null}{null}{null}turbo run{null}{null}{null}hold {btn_L} and push {btn_R} to break
crates and go farther as you slide.{null}hold {btn_L} and push {btn_A} to
jump even higher.{null}push {btn_B} repeatedly to spin
longer and temporarily float.{null}{null}{null}{null}hold {btn_L} for a burst of speed.{null}{null}{null}{null}main menu{null}{null}{null}quit to main menu?{null}{null}quit game{null}{null}{null}player 1 pause{null}{null}player 2 pause{null}{null}follow the wumpa fruit! collect 100 wumpa fruit to earn an extra life.{null}{null}press {btn_B} to spin and break crates!{null}{null}{null}press {btn_A} to jump!{null}{null}{null}{null}bouncy crates allow you to bounce on them several times before breaking.{null}{null}{null}{null}crates can be stacked. spin or jump on them to get past.{null}{null}{null}{null}do not spin tnt crates or they will explode! jump on them to start the timer.{null}{null}{null}break the aku aku crate to summon me. i will protect you from one hit.{null}{null}press {btn_A} two times to jump even higher.{null}{null}press {btn_R} while jumping to body slam. this breaks steel crates.{null}{null}{null}the crash crate will give you an extra life.{null}{null}{null}{null}hold {btn_A} while bouncing to bounce even higher{null}press {btn_R} while running to slide.{null}tnt crates can break other crates. just jump on one to start the timer.{null}{null}{null}{null}do not touch green nitro crates or they will explode!{null}{null}{null}spin the slot crate before it becomes unbreakable!{null}{null}the green nitro switch box destroys all nitro crates in a level.{null}{null}{null}{null}did you collect the purple crystal? did you break all of the crates?{null}{null}{null}{null}deep in the heart of hyperspace...{null}{null}{color:green}uka uka:{color:orange} that incompetent neo cortex. he cannot do anything right! his last scheme to shrink the earth failed miserably! you have been a great asset to the cause of evil over the years n. tropy.{null}{null}{null}{null}{color:green}n. tropy:{color:orange} thank you, my lord.{null}{color:green}uka uka:{color:orange} that is why i trust you with the task of aiding me in universal domination.{null}{null}{color:green}n. tropy:{color:orange} great uka uka, i am honored! and i have the perfect scheme.{null}{color:green}n. tropy:{color:orange} allow me to harness my powers of time and space to peer into the future...{null}{null}{color:green}n. tropy:{color:orange} of course! since those wretched bandicoots keep thwarting us, the solution is to get them on our side. and i know just the fellow for the job.{null}{null}{color:green}uka uka:{color:orange} a new recruit?{null}{null}{null}{color:green}n. tropy:{color:orange} indeed. meet my secret weapon.{null}{null}{color:green}n. trance:{color:orange} i am n. trance, master of hypnotism!{null}{null}{null}meanwhile... {null}{null}{null}{color:green}coco:{color:orange} crash, heeeeeelp!{null}{null}{null}{color:green}aku aku:{color:orange} crash! wake up! coco and crunch have been abducted! find me a power crystal so i can look into what's going on! hurry!{null}{null}{null}{color:green}aku aku:{color:orange} oh, no! watch out crash!{null}{color:green}aku aku:{color:orange} i've got you crash!{null}{null}{color:green}n. tropy:{color:orange} something is holding on to crash. we need more power!{null}{null}{null}{color:green}aku aku:{color:orange} this vortex must be the work of n. tropy.{null}{null}{null}{null}{color:green}n. tropy:{color:orange} i've finally captured that infernal bandicoot!{null}{null} {null}{null}{null}{color:green}n. tropy:{color:orange} i finally got all you obnoxious bandicoots! would you do the honors, n. trance!{null}{color:green}n. trance:{color:orange} with pleasure!{null}somewhere else in hyperspace...{null}{color:green}aku aku:{color:orange} that took almost all the power i had, crash. good job getting the power crystal before you were pulled into the vortex. but, i'll need a lot more crystals if we are to put an end to n. tropy's plans.{null}{null}{color:green}aku aku:{color:orange} that floating island up ahead will allow us to go to different worlds and find crystals. hopefully we can find coco and crunch and stop n. tropy!{null}{null}{null}{null}{color:green}crunch:{color:orange} oohh man...brainwashed again! thanks for saving me crash.{null}{color:green}aku aku:{color:orange} good news crash. the crystals you've collected have allowed me to open up a new area of the island. we can get to new worlds from there.{null}{color:green}coco:{color:orange} oh, crash, thank you. how did you break out of n. trance's hypnosis?{null}{null}{null}{null}{color:green}aku aku:{color:orange} something strange happened when you were being pulled into the vortex, crash. coco saw someone in n. tropy's secret base that looked like you. i'll try to find out who while you go collect more crystals.{null}{null}{color:green}n. tropy:{color:orange} n. trance, you blundering idiot! that was not crash! it was some sort of... fake crash!{null}{color:green}n. trance:{color:orange} how was i supposed to know? he fooled you too. besides, they will never find our hideout. not in a million years!{null}{null}{color:green}aku aku:{color:orange} good job crash! with a few more crystals, i'll be able to open the vortex to n. tropy's hideout!{null}{color:green}aku aku:{color:orange} yes! we've made it to n. tropy's secret base.{null}{null}{null}{color:green}n. tropy:{color:orange} n. trance, you fool! they have found us! destroy them!{null}{null}{color:green}n. trance:{color:orange} it should have taken a million years to find us... how?{null}{null}{null}{null}{color:green}aku aku:{color:orange} time does not pass in the vortex... i had all the time i needed to find you!{null}{color:green}n. tropy:{color:orange} you have one last chance to stop them. do not disappoint me again!{null}{null}{color:green}n. trance:{color:orange} destroy all bandicoots!{null}{null}{null}{null}{color:green}n. tropy:{color:orange} noooo! i can't defeat all these wretched bandicoots myself!{null}{color:green}n. tropy:{color:orange} but mark my words. i'll be baaaack!{null}{color:green}aku aku:{color:orange} good job crash! you've rescued the other bandicoots from n. tropy and defeated n. trance! too bad n. tropy got away. if only we had all of the gem shards, i could re-open his space vortex and you could go after him!{null}{null}the end??{null}{null}{null}{color:green}aku aku:{color:orange} good job, crash! you've rescued the other bandicoots from n. tropy and defeated n. trance! lucky thing you collected all of the gem shards. i can use them to re-open his space vortex and you can go after him!{null}{null}{null}{null}{color:green}aku aku:{color:orange} congratulations everyone, for defeating n. tropy and capturing him! let's take a picture to celebrate!{null}{null}{null}{color:green}uka uka:{color:orange} that's it! no more underlings! next time you will face a real adversary!{null}the end... for now...{null}{null}{null}{color:green}aku aku:{color:orange} crash, these mayan ruins can only be traversed by using one of your favorite toys, the atlasphere. look out for nitro traps and ledges.{null}{null}{color:green}aku aku:{color:orange} now it is your turn to use the atlasphere, crunch. but be careful! n. tropy has added some new dangers.{null}{null}{null}{null}{color:green}aku aku:{color:orange} crash, in this water world you will need to use your wakeboard to collect the power crystal. the waters are guarded by a vicious shark so be careful!{null}{null}{null}{null}{color:green}aku aku:{color:orange} the next power crystal is located in space, coco. you must use your space suit and rocket tug to retrieve it. n. tropy has sent a huge fireball that will destroy the crystal if you do not move fast enough, but i have created turbo gates to help you stay ahead of the danger.

Edit 2:

I've been looking at the text, and agentgeo and I figured out where the text is stored at for the Japanese games (0x5136C8) and I noticed that all of the characters, both Hiragana, and Katakana, are stored in there. So I looked at the first few lines of Japanese that are used for the main menu. I then made an amazing discovery.

Here is the data for 0x1C60C0-1C60C0F:
23 53 55 54 41 2D 54 4F 42 4F 54 41 4E 4E 23 57 | #SUTA-TOBOTANN#W
4F 4F 53 48 49 54 45 4E 45 | OOSHITENE
This code makes the Start Button screen look like so (This is default, by the way, in Katakana, until after the ン character.):
http://i.imgur.com/Q1k7x.png
Now, let's modify that code a little:
53 55 54 41 2D 54 4F 42 4F 54 41 4E 4E 58 58 57 | SUTA-TOBOTANNXXW
4F 4F 53 48 49 54 45 4E 45 | OOSHITENE
Here's what happens:
http://i.imgur.com/Q64FX.png
It's all in Hiragana!

This means, that when it parses Japanese text, it uses hashtags (#), byte 0x23, to switch between Hiragana and Katakana. The example I used above is the first occurrence of the hashtag switcharoo, which means that the text, by default, is set to display Hiragana, but since it's also the first Japanese string, and it needs to be written in Katakana, it switches it. As well, I think it uses an "X" character to "push" text along. What I mean by that, is that the game uses it to align characters for certain symbols that use 3 letters, such as tsu and shi, or chi. However, it doesn't render them. Look in the screens to see this.

Edit 3: These games also have english characters too, which, afaik, are only used in the credits. LOVE MY TRANSLATION:
http://i.imgur.com/bTuzq.png

Hopeless Masquerade
November 13th, 2012, 01:28 PM
Very nice. Great job figuring out the "switcher"

Team Fail
November 13th, 2012, 03:34 PM
Very nice. Great job figuring out the "switcher"

Thanks. I also noticed the games used the X character a lot, so I looked into it and I think I've figured out exactly how it works. Take a look at the post above, I've edited in the "X factor."

Hopeless Masquerade
November 13th, 2012, 03:39 PM
Very interesting. Makes sense, but definitely adds a layer of complexity to the code.

Team Fail
November 13th, 2012, 03:59 PM
Very interesting. Makes sense, but definitely adds a layer of complexity to the code.

I think this is the last of the methods they've employed for text encoding/reading, but hopefully I don't find any other odd characters.
Edit: nope.avi I need to find more bytes for the Japanese games. The codes to display the buttons in text are different from the UE releases. I'm going to have to write a completely custom parsing method for the Japanese games. @___@

Team Fail
December 5th, 2012, 10:01 AM
So now that I've got more time to work on the program, I've been looking at the rom and found some kind of level data. I know it's not objects, but I think it may be crate counts for each level. I'm not sure what it is yet, but there's a table at 0x14D20 (U), and if you zerobyte it and attempt to go in a level, the game will simply hang.

Team Fail
June 24th, 2013, 08:38 PM
Sooo super awesome bump that actually has useful info.

So I found this post by ipatix (http://www.pokecommunity.com/showpost.php?p=7686002&postcount=2) that contains a program that generates a list of offsets for sound tables. I used it on the U version of the game and it gave me the following offsets. I plan to look at it soon and see if I can make heads and tails of the GAX sound engine. Although, with limited time, anyone can look at it if they wish. Now, on to the tables' offsets!

AC8E:
No 01: 2A3684
No 02: 216934
No 03: 211BA0
No 04: 21430C
No 05: 2A9684
No 06: 263990
No 07: 29E7A0
No 08: 2A5278
No 09: 7FC150
No 10: 261320

Major important edit:

So, I was looking on the interwebs to find a music rip of this game, and I came across a jewel of information that could be unused content within the game.
-Crash Bandicoot 2 N-Tranced - There is a song test feature that can be accessed when the Current Level identifier is hacked. I might consider using a savestate for the GSFLib. (That's your cue to add state support.)
Source - HCS Forums (http://hcs64.com/mboard/forum.php?showthread=39&showpage=8)

My next question, is what is this level identifier? I presume it's something in the RAM, but I'll have to look deeper and find out.

Edit: (U VERSION ONLY) If you pop open a memory viewer and go to 0x0200014 (or rom offset 0x007FBD18) and change it to a non-zero value, you'll enable a hidden debug option still in the game. I'm not gonna say what it is, but I plan to add it onto TCRF at some point soon.

Edit: mehhh I'll spill what this does. When that byte is set to a non-zero value, it doubles the speed of the game. However, audio remains at 1x speed. It'd probably have been binded to a button combo or debugger menu option so that it could be enabled/disabled at will to speed up slow parts of the game, like the intro or credits.

(Gameshark SP/Codebreaker code E99B8028 EC01 will also activate this unused feature. Works on hardware as well.)

Edit: Level identifiers by hex! Identifiers: 02002744:XX 03007DA8:XX, credits to Einstein95 (http://www.pokecommunity.com/member.php?u=404599) on TCRF (Also signed up on PC, Thanks a ton!) for finding this.

00 - Island Intro (Level 1)
01 - Prints of Persia (Level 2)
02 - Lagoony Tunes (Level 3)
03 - Globe Trottin' (Level 4)
04 - Pharaoh's Funhouse (Level 5)
05 - Runaway Rug (Level 6)
06 - Tiki Torture (Level 7)
07 - Hoppin' Coffins (Level 8)
08 - Barrel Roll (Level 9)
09 - Flockful of Seagulls (Level 10)
0A - Magma Mania (Level 11)
0B - Run From The Sun (Level 12)
0C - Now It's Istanbul (Level 13)
0D - Mister Lava Lava (Level 14)
0E - Water Logged (Level 15)
0F - Slip-N-Slidin' Sphinx (Level 16)
10 - Rocks Can Roll (Level 17)
11 - Rock The Casaba (Level 18)
12 - Eruption Disruption (Level 19)
13 - Spaced Out (Level 20)
14 - King Too Uncommon (Level 21)
15 - Wild Nile Ride (Level 22)
16 - 101 Arabian Kites (Level 23)
17 - Fire Walker (Level 24)
18 - Evil Crunch (No level number)
19 - Evil Coco (No level number)
1A - Fake Crash (No level number)
1B - N. Trance (No level number)
1C - N. Tropy (No level number)

Notice anything? Yes, the level numbers are the hex equivalents. That's how the game draws the level numbers. Also, I don't know if there's any unused levels in there yet, all I've done is up to 1C. I don't know where the bonus levels are identified at.

And while I'm at it, I'm documenting some of these things on TCRF as well. http://tcrf.net/Crash_Bandicoot_2:_N-Tranced

Also, going along theory, I think that there is not only a current level identifier, but a current map identifier because of the bonus levels, and the fact that they need to be loaded as well. I want to see if I can find this as well.

einstein95
July 9th, 2013, 09:39 PM
Hey, it's the same Einstein95 from TCRF here. I found these weird offsets after playing around for a bit:

0x03007DA3 (scrolls map (Y)):
00 - Return to Crash
<7F - Right
>7F - Left

0x03007DA7 (scrolls map (X)):
00 - Return to Crash
<7F - Down
>7F - Up

For example, if you were to set 0x03007DA7 to 80, then the camera moves up. It seems like it was planned to have a way of looking around the map, like in other games (Super Mario World springs to mind). This is probably true given that 00 returns back to Crash in a smooth camera movement.


ETA: Oh, and I found the time trial counter (not the gems)
Time Trial counter:
02002708 - Minutes
0200270C - Seconds
02002710 - Deciseconds (1/10th of a second)
02002714 - Centiseconds (1/100th of a second)

What's interesting is that it counts the centiseconds which aren't displayed in the timer.

Team Fail
August 13th, 2013, 04:02 PM
ETA: Oh, and I found the time trial counter (not the gems)
Time Trial counter:
02002708 - Minutes
0200270C - Seconds
02002710 - Deciseconds (1/10th of a second)
02002714 - Centiseconds (1/100th of a second)

What's interesting is that it counts the centiseconds which aren't displayed in the timer.

I'm thinking they're there to ensure the timer is still accurate, but I'm not too sure. I can add that to the TCRF page.

Hopeless Masquerade
October 20th, 2013, 11:02 AM
I was taking a look at the thread again, and I decided I'd do a little bit of research.

So, I come with information!

Here's what little I found about palettes in the ROM. I'll add more to the list as I go.
00475D34 - Crash
004761D4 - Textbox/AkuAku
004761F4 - Font 1


Yay!

Team Fail
July 9th, 2014, 11:21 AM
< snip, moved to http://www.pokecommunity.com/showthread.php?t=335312 >

Edit: Fast fact... If you edit the pointer to the sound table (Search E8 FB 1C 08 with a hex editor, it should only return one result), and you edit that pointer to something that doesn't exist, you can force the game to display a crash debugger for the audio engine. THAT MEANS EVEN MORE DEBUGGING CODE (And possibly an audio test) EXISTS!

http://i.imgur.com/9EfAzeQ.png

Edit: There are two pointers I discovered. One points to the sound table, and one points to a sfx table. The offsets to these pointers are as follows:

Sound Table pointer: 0x1910
SFX Table pointer: 0x1914

They are both 4 bytes long.

Team Fail
October 5th, 2014, 07:21 PM
So, unexpected bump, but I decided to open the rom in IDA, and I've been poking around in it for the last little bit, commenting off code that I can refer to. It's making things a bit easier, but it might be a while before I can get anywheres with this, however, if you'd like to take a peek, I can give you the IDB file.

So, here's a few subroutines you can chew on.

First of all, here's part of the gax2_init subroutine: http://pastebin.com/H7BqknzU
It actually loads the audio engine, as well as the audio that is playing. I nop'd the instruction that calls this subroutine to see what happens, and just as expected, no audio loads whatsoever. I'm not entirely sure yet if it is the routine itself, or if it's just a branch of it, but I plan to find out soon.

Secondly, here's some of that debugging code: http://pastebin.com/ZFMRYTBd
This code seems to be responsible for activating the speed trigger that doubles the speed of the game. I'm working on tracing to the actual modifier itself. This is run once every frame, so the modifier can be called at any time the player wants.

Team Fail
October 8th, 2014, 07:38 AM
Well, I can't work on it myself, so here is a link to the IDB I am currently working on. I've been able to identify only a small fraction of things, so if you'd like to get started, feel free!

I'll probably update this often, so I'll post a date below when I do update it. For now, here's a link:

https://dl.dropboxusercontent.com/u/34957059/CB2%20IDB/CRASH2_AC8E00.idb
You will need a (U) rom for this!

Team Fail
December 7th, 2014, 09:13 PM
Decided to update the IDB today. It now contains the SVC calls the game uses (Prefixed with SVC_) as well as the text load function found by itari. Link in the post above.

Edit: I'm also currently working on fixing a small portion of the IDB. There is an ArcTan2 SVC call in the game, however, IDA didn't pick up on it when disassembling.

http://i.imgur.com/lRYPl03.png

Team Fail
December 12th, 2014, 12:48 PM
Update: Managed to fix the ArcTan2 SVC not showing up, thanks to Bond697 for showing me a few things with working around that in IDA. I've also identified the routine for loading and running Atlas Sphere levels, as well as possibly the routine for updating the Atlas Sphere's movement. I haven't updated the IDB at the link yet, I'd like to see what else I can find first before I update it again.

Team Fail
December 18th, 2014, 10:44 PM
So, an interesting turn of events occurred today...

I was working on music engine research with someone that's been working on some articles for TCRF, and I got a link to a particular scene discussion thread, and I might be able to get some insight on how the game works - straight from one of the developers (indirectly).

One of the developers in the previous title, Crash Bandicoot - The Huge Adventure (Or XS in Europe), whose name is Florian Freisleder, developed some of the graphics for the game. Using one of the other video games he was involved in, and using a small cheat code built into that game allowed me to get a scene name for this particular person, and you may recognise it - Wintermute. If this game's engine is based off of THA's engine, it could be an interesting avenue of research on the development of the game, perhaps a bit of a story, and some insight into how it works.

http://stream1.gifsoup.com/view/204031/the-more-you-know-o.gif

Hopeless Masquerade
December 20th, 2014, 06:21 PM
So I was looking around in the ASM, and I saw an interesting function at 08001C1C.
It has to do with playing songs, and I think it may have to deal with how stages play songs.

Team Fail
February 28th, 2015, 10:45 AM
So I've gone and updated the IDB. Link is the same as before:

https://dl.dropboxusercontent.com/u/34957059/CB2%20IDB/CRASH2_AC8E00.idb

I've added some Atlas Sphere stuff, and all SVCs are in it.

Team Fail
April 11th, 2015, 03:57 PM
Internal song list order. To hear these, place a breakpoint on 08001882 in No$GBA, then when it breaks, edit r1 to hear the following songs:

00 - mayan
01 - persian
02 - egypt
03 - volcano
04 - wake
05 - jaws
06 - coco
07 - bonus round
08 - evil crunch
09 - evil coco
0A - fake
0B - ntrance
0C - ntropy
0D - theme
0E - warproom
0F - drums
10 - cutscenes normal
11 - cutscenes spooky
12 - cutscenes //unused

==Anything further crashes the game==

Edit: There's a subroutine at 08023EFC, it seems to be called only when levels are loading. It also seems to control Aku Aku's state (0, 1, 2, or an unused 3 which renders you invincible at level start), as well as load level pallets, as well as a reference number to what level is currently being played. See below for more information on this.

==Ram Stuff==
When the subroutine at 08023EFC is called, it reads 02002740 for some level information. Playing with this number in accordance to the level table I posted earlier can allow you to sequence break the game by playing an easier level but have you beat a harder level (For example, select Island Intro, and when it breaks to 08023EFC, set 02002744 to 1C, then continue execution. You'll be playing Island Intro, but the game thinks you're playing on N. Tropy's level. Beat Island Intro, and the game will continue on as if you have just beat the game. It's quite fun to sequence break the game!). There's also a pointer at 0200275C that points to another pointer in the ROM. This other pointer is for the level pallet data. Editing this pointer in the rom will modify the pallet in the level and make it look weird af.

As well, from this research, it seems that Island Intro has some flag control tied to the crystal you can obtain in the level. If the purple crystal has not been obtained, you'll encounter a cutscene halfway through the level, just before the checkpoint, similar to when you first play the level. However, in doing the wrong-level sequence break, since the game thinks you're playing a different level, the crystal will be there, and will still play the Island Intro cutscenes.

Edit: On further analysis, it seems there's a loop that always jumps to 080214D4 whenever a level is loaded. It's around there somewhere, as it also seems to read the byte at 02002744. I think it loads the level header by taking the number of the level, in hex, and does a binary shift left twice on the register, then uses that absolute offset to get the pointer to the header for that particular level (Similar to how the pointer to text is obtained), but feel free to correct me.