[Other] Hacking Pokemon Diamond and Pearl (Hex)

[pichu2000]

Hi, I'm pichu2000 and I want to tell you what I know on hacking DPP and HGSS(All languages) (Sorry for my bad English, I'm Italian)

PREPARATION

For hacking Pokemon Nds Roms you must have these things:

1. An Hex Editor(I suggest Crystal Tile 2 )
2. A ROM of DPP or HGSS
3. A lot of patience

IMPORTANT! MAKE A ROM BACKUP BEFORE HACKING!
NDS FILE SYSTEM

Open the Rom with Crystaltile 2, click F6(For open hex editor) and click Ctrl+N (Or the little icon in the shape of Nds).
You could see a little Windows with a series of lines. Go on the forth Menu(?????V) and clicking on the first name(?????T). Now we should see a series of directories.

1. MAP DATA
Maps are located into field-data/land-data/land data release.narc(Dpp) or a/0/6/5(Hgss) (For opening a NARC file, push right button and select forth options)
Now we see a lot of file(land-data release 0, land data release 1 etc...)
These are the maps!
A map is divided into multiple section.
A map starts with an header lne(0x16 byte) that rapresented the size of every section.
First section edits Movement Permissions
Second section edits the 3d object inserted in the maps. In fact buildings,lamps and other object are parted from the main model map.
We usually find a model in this form:
We see first model in this form :

0x0-0x4 Model Number(Linked with NSBMD file id into Build_Model.narc(dpp) or bm_field and bm_room(hgss))
0x5-0x8 X Coordinates
0x9-0xC Y Coordinates
0xD-0x10 Z Coordinates
0x11-0x1C Unknow bytes
0x1D-0x20 Model widht
0x21-0x24 Model height
0x25-0x28 Model wheight

The third section is a NSBMD model(Search kiwi.NSBMD model documentation)
The forth section, BDHC, tell us if there's stairs or elevated part of maps. We need still research about it.

2. EVENT DATA

I found event data(warp, signs, people) in zone_event-release.narc(dpp) or a/0/1/2(hgss)
Events are very similar to gba data.
An event file is usually divided into forth section.

First section contains Overwords data.
Overwords are showed as:

0x0-0x2 Overword Id
0x2-0x4 Overword Sprite
0x4-0x6 0verword Movement
0x6-0x8 Unknown Bytes
0x8-0xA Script Flag
0xA-0xC Script Number
0xC-0xE Unknown Bytes
0xE-0x18 Line of Sights(Trainer)
0x18-0x20 X coordinates
0x20-0x22 Y coordinates
0x22-0x24 Z coordinates

Second section is warps
Warps are showed as

0x0-0x2 X coordinates
0x2-0x4 Y coordinates
0x4-0x6 Map Id
0x6-0xa Maybe Warp Flag

Third section is signs
Signs are showed as

0x0-0x2 Script
0x2-0x4 Unknown
0x4-0x8 X Coordinates
0x8-0xC Y Coordinates
0xC-0xF Z Coordinates

Forth part contains Triggers
Triggers are showed as:

0x0-0x2 Script
0x2-0x4 X Coordinates
0x4-0x6 Y Coordinates
0x6-0x8 Width
0x8-0xA Lenght
0xA-0xC Weight
0xC-0xF Flag Number

3. SCRIPTS DATA

Now, scripts data are relocated in scrip-seq-release.narc(a/0/3/2 for hgss).
A script file is divided in two main section of variable lenght, divided by a particular costant,0xFD13
The header, that contains the lenght of every script.
The commands section, that contains all the script.

Commands

Commands are characterized by the command id, followed by 0+ parameters.
Almost all the commands has a predefined number of parameters.
Some has variable parameters, different each time.
We know the 80-85% commands used into dpp, and the 40% used into hgss.

4. MSG DATA

Msg data are inserted into msgdata/msg.narc(dpp) and a/0/2/7 (hgss)
We can extract them with thenewpoketext program, so search a tutorial for it for see how.

5. GRAPHIC DATA

Editing Graphic into forth generation is very simple.
If we open some narc, we can find a NCGR file(RCGN or Tile File), followed usually by a NCLR(RCLN or Palette File) and sometimes by a NCGR(RCGN or Map File), and other two uneditable files(NANR or Animation File and NCER or Cell Animation File).
In Crystaltile we only go on a Tile file, press BackSpace, then go on a Palette file, and press Backspace, and if we find the NCGR, make the same thing.
Then we can see the image onto the window of the rom.
Press Ctrl+e and export image as bmp. Edit with paint, and click Ctrl+I, and we only need to save the rom.
We need pay attention to not change the palette based map, and respect also the tile.

Some images are compressed(NCGR.L), like pokedex screen and other.
We need to decompress the three file associated (right click and press U() option), rebuild a new rom with dslazy, edit image like we done previously, save the three file uncompressed(right click and press E() option), open Crystal tile, go to T and Lz77 compression, select the three file(one for one), and rebuild the new rom.
This is more complicated, but it's the only way to edit the compressed graphic.

Now i insert a file contained a lot of useful list that i made.
(Some are incompleted)

[Gamer2020]

This is cool.
But I wish I could wrap my head around it.
Maybe someone could design a tool using this data to make it easier...

[-DarK-]

Originally Posted by Gamer2020

This is cool.
But I wish I could wrap my head around it.
Maybe someone could design a tool using this data to make it easier...

Easier said than done....

[Gamer2020]

I never said it wasn't...

[Joey the Cockroach]

this is great to what you can find in hex.... it is great, i can say. finding values in hex is quite hard but achieveable. nice one Pichu2000.

[Lady Berlitz]

Wow, very nice. At the moment, it's not very useful to a lot of ROM hackers out there until tools are made.
Eventually, this will help more experienced, hex editing hackers with their tools, or other stuff.

Thanks for posting this, pichu2000.

[Salamol_Goldfish]

Yea, this is cool. Im going to make a diamond hack
My friend gabe might help me:D

[liuyanghejerry]

It's really a good start,but a tool is really needed,or we must swim into the hex...

Anyway,good job~

[Argent Crusader]

Really nice tutorial! It's a very good documentation. If LU-HO comes here and sees this, it may be interesting. This data is enough to make a little and basic map editor (I guess).

[pichu2000]

Originally Posted by Kike-Scott

Really nice tutorial! It's a very good documentation. If LU-HO comes here and sees this, it may be interesting. This data is enough to make a little and basic map editor (I guess).

Thanks Kike, but there is a lot of work to do yet

Can someone helping me in this works?

[LU-HO]

hello all
yes, nice to hear ;-)

the problem is, i'm working on an new version of AdvanceMap at the moment, and i have only 2 hands.

I'm more interested in the Advance-Generation, i have much to do for these Roms...

But i bookmarked and saved these tutorial on my PC, if i found time i will try to make a DPMAP also.

pichu2000 tanks for this. but sorry i cannot help on Analyse the data, to busy ...
but i'm interested on updates for it ;-)

greetz LU-HO

[Lady Berlitz]

Originally Posted by LU-HO

hello all
yes, nice to hear ;-)

the problem is, i'm working on an new version of AdvanceMap at the moment, and i have only 2 hands.

I'm more interested in the Advance-Generation, i have much to do for these Roms...

But i bookmarked and saved these tutorial on my PC, if i found time i will try to make a DPMAP also.

pichu2000 tanks for this. but sorry i cannot help on Analyse the data, to busy ...
but i'm interested on updates for it ;-)

greetz LU-HO

A "DPMAP", huh? Sounds interesting.
I can't wait for the day there will be a 4th Generation mapping tool.

BUT, this is a very useful document, pichu2000.

[CR0SELL]

Hey Pichu2000, Im also currently looking for offsets. If you have an MSN, Pm it to me, then we could share our finds, and release more data, so one day, there will be a scripter for DP.

[poddish]

The thing about this is, before the advance generation and all the tools for it came out, ALMOST everyone relied more on hex editing than on tools. Because of this, few hacks were made because it was hard to hack, and the hacks that were completed were usually better than the ones made now (assuming graphics and number of pokemon don't matter, although it was possible to add more slots in r/b/y if you move the trainer sprites somewhere else, I know this because I saw coolboyman's new "final" version of pokemon brown on youtube, and he had 251 pokemon, IN A RED HACK, good job coolboyman!) Anyway, the hacks were usually better because they changed a LOT more than we ("toolhackers) (like me) can do with the tools, because someone's not going to make a tool for some nobody hacker just because he/she asked. Besides, what about the fact that tools can't completely change everything about something because they're limited by the skill of the creator and user.

Anyway, I hope to see some d/p hacks that don't rely on tools soon...

[CR0SELL]

Originally Posted by poddish

The thing about this is, before the advance generation and all the tools for it came out, ALMOST everyone relied more on hex editing than on tools. Because of this, few hacks were made because it was hard to hack, and the hacks that were completed were usually better than the ones made now (assuming graphics and number of pokemon don't matter, although it was possible to add more slots in r/b/y if you move the trainer sprites somewhere else, I know this because I saw coolboyman's new "final" version of pokemon brown on youtube, and he had 251 pokemon, IN A RED HACK, good job coolboyman!) Anyway, the hacks were usually better because they changed a LOT more than we ("toolhackers) (like me) can do with the tools, because someone's not going to make a tool for some nobody hacker just because he/she asked. Besides, what about the fact that tools can't completely change everything about something because they're limited by the skill of the creator and user.

Anyway, I hope to see some d/p hacks that don't rely on tools soon...

Umm, I was saying that I can help him find offsets, so we can work together. I wasnt asking him for offsets...

[pichu2000]

Well

I'm trying to make a simple dp map editor
but I don't know very much about programming
I wanna someone helping me to make the program, so also another man helping me to find the offset
because I must study very much in this year and I haven't much time to spend hacking

Anyone wanna help me?
P.m(Crosell i can't send you private message, you don't allowed this feature)

[WaterSplash]

Very nice, pichu2000. I'm going to try looking these offsets up and seeing what I can alter. This should lay a good foundation for changing the maps, with or without an editing program.

[pichu2000]

I need help from anyone can give a hand. I must study in this period so I can't update map list, etc...
I Really need nosgba debugger to make some progress, but the author is disappeared
There's anyone that can send me this wonderful tool?
It would be a beautiful dream
Thanks

[gamefreakfatty]

Originally Posted by pichu2000

I need help from anyone can give a hand. I must study in this period so I can't update map list, etc...
I Really need nosgba debugger to make some progress, but the author is disappeared
There's anyone that can send me this wonderful tool?
It would be a beautiful dream
Thanks

If I can, I would like to request it too. I was looking for it a long time ago, around when he first disappeared and stopped updating. His PayPal account is closed so I can't even try.

[SCV]

Originally Posted by pichu2000

I need help from anyone can give a hand. I must study in this period so I can't update map list, etc...
I Really need nosgba debugger to make some progress, but the author is disappeared
There's anyone that can send me this wonderful tool?
It would be a beautiful dream
Thanks

Well, Martin is VERY strict with his rules about not sharing no$gba debug. Even though he seems to have disappeared, I don't feel comfortable sharing mine.

I sent him and email asking what can be done so that you (and a few other people I know) can get a copy of no$gba debug. If he does not respond after some time, I will consider giving you a copy of mine.

However, if you don't know much about programming, I doubt it will be useful to you.

[gamefreakfatty]

Originally Posted by SCV

Well, Martin is VERY strict with his rules about not sharing no$gba debug. Even though he seems to have disappeared, I don't feel comfortable sharing mine.

I sent him and email asking what can be done so that you (and a few other people I know) can get a copy of no$gba debug. If he does not respond after some time, I will consider giving you a copy of mine.

However, if you don't know much about programming, I doubt it will be useful to you.

Thank you! That would be a great help to those of us who are still working at hacking D/P/P. I emailed him almost a year ago about the PayPal situation. I haven't checked for around two months to see if it is back up yet, but the last time I checked it was still not working.

[pichu2000]

MINI UPDATE
I DO SOME PROGRESS REGARDING SIMPLE POLYGONS
I CAN MOVE FLOWERS AROUND THE MAPS!

[SCV]

Hi Pichu2000, I was wondering whether you new how to find the script associated to a particular event.


For example, this is the galactic grunt at valley windworks:
06 00 00 00 00 00 7C 00 0F 00 00 00 AC 01 03 00 01 00
03 00 00 00 00 00 00 00 00 00 F3 00 8F 02 00 00 00 00

How would I find the script that corresponds to this event?



Here is some more stuff:
These are the Person events from the Sky Pillar.

The first two bytes of what I bolded seem to be script numbers. However in some places those are completely blank.

Notice that two of the events have the same first two bytes, this is because of the two double battles.
However there man

00 00 7D 00 0F 00 00 00 E6 01 06 00 01 00 00 00 
00 00 00 00 00 00 00 00 1E 00 30 00 00 00 00 00 
01 00 78 00 00 00 00 00 E8 01 01 00 01 00 00 00 
00 00 00 00 00 00 00 00 1F 00 1C 00 00 00 00 00 
02 00 79 00 0F 00 00 00 E7 01 0C 00 01 00 00 00 
00 00 00 00 00 00 00 00 21 00 20 00 00 00 00 00 
03 00 7C 00 0F 00 00 00 E6 01 06 00 01 00 00 00 
00 00 00 00 00 00 00 00 20 00 30 00 00 00 00 00 
04 00 7B 00 0F 00 00 00 E7 01 0B 00 01 00 00 00 
00 00 00 00 00 00 00 00 1D 00 20 00 00 00 00 00 
05 00 66 00 00 00 00 00 E2 01 01 00 01 00 00 00 
00 00 00 00 00 00 00 00 1F 00 15 00 00 00 00 00 
06 00 94 00 00 00 00 00 E3 01 01 00 00 00 00 00 
00 00 00 00 00 00 00 00 1E 00 23 00 00 00 00 00 
07 00 65 00 00 00 00 00 E4 01 07 00 00 00 00 00 
00 00 00 00 00 00 00 00 1D 00 23 00 00 00 00 00 
08 00 63 00 00 00 00 00 E5 01 08 00 01 00 00 00 
00 00 00 00 00 00 00 00 1D 00 24 00 00 00 00 00 
09 00 97 00 00 00 00 00 EC 01 00 00 01 00 00 00 
00 00 00 00 00 00 00 00 1F 00 10 00 00 00 00 00 
0A 00 98 00 00 00 00 00 ED 01 00 00 01 00 00 00 
00 00 00 00 00 00 00 00 19 00 17 00 00 00 00 00 
0B 00 99 00 00 00 00 00 EE 01 00 00 01 00 00 00 
00 00 00 00 00 00 00 00 25 00 17 00 00 00 00 00 
0C 00 57 00 00 00 00 00 FF 03 55 1C 00 00 00 00 
00 00 00 00 00 00 00 00 1F 00 0A 00 00 00 00 00 
0D 00 57 00 00 00 00 00 01 04 56 1C 00 00 00 00 
00 00 00 00 00 00 00 00 1F 00 0A 00 00 00 00 00

P.S. I decided that I am not going to leak no$gba debug. I don't know what happened to Martin but after taking to a few other people who own it, I decided that it would not be good to share. If you tell me how you intended to use it to make progress, I can try to study that.

I am going to get more active into studying scripting and events, so I will love to help you develop this topic.

[pichu2000]

Thanks Scv!

Miniupdate
I found how to edit script's movement
These are showed in this way
NN(Type of movement) 00 XX(movement repetition) 00 ....
For example Twinleaf town rival script(0x1d9fda0)

47 00 01 00 0D 00 01 00 48 00 01 00 FE 00 00 00
4B 00 ......

47 rapresented hero's movement(When crash with something)
0D rapresented hero's back jump
48 rapresented same hero's movement 47
FE idem
4B rapresented rival esclamation....

[SCV]

I take back what I said above about the first two bytes. They must be related to the script somehow, but I don't know how. The script is actually the last two bytes of what I bolded as stated in the original post.

I have found how trainer battles are scripted. I will update later with some examples. These are done in two different ways. One strictly from the event file and another through the scripts.

Pichu2000, do you know if there is any place that stores which event files and script files are associated for a certain map?