Community

The PokéCommunity

We are still working on a better slogan!

Visit Index



Advertise here

Go Back   The PokéCommunity Forums > ROM Hacking > Research & Development
Notices

Research & Development Got a well-founded knack with ROM hacking? Love reverse-engineering the Pokémon games? Or perhaps you love your assembly language. This is the spot for polling and gathering your ideas, and then implementing them! Share your hypothesis, get ideas from others, and collaborate to create!
Research & Development programs in this forum are subject to moderator approval before they are displayed.

Post Reply
 
Thread Tools
  #1    
Old April 5th, 2013, 02:18 PM
Spherical Ice's Avatar
Spherical Ice
Community Supporter
 
Join Date: Nov 2007
Location: UK
Tournaments Joined: 0
Tournaments Won: 0
Send a message via Skype™ to Spherical Ice

Advertise here
As you may or may not be aware, last year I posted this thread to the Tutorials section, and was soon met by an amazing post by Haru~ that enabled a table of 255 different "diplomas" to be accessed. In short, this hack allowed you to display custom tilemaps using special 0x108 and setting a few variables.

Now, this hack is very useful, but it has a few bugs:
  • Upon loading the screen, a fanfare (the one played when you obtain a badge) plays.
  • The special ends the script

While not a glitch, the screen also remains until the player presses A.

Haru~ also managed to hack the X and Y positions of the text, use palettes with 256 colours, display three 64x64 sprites AND use custom animations.


http://www.youtube.com/watch?v=mDzdefq1lJA

In his PM, he gave me the following information:
Quote:
Originally Posted by Haru~
To activate the hack, you must set a 0x5XXX (or 0x4XXX) variable to:
Code:
0x0 - Original Diploma
0x1-0xFF - Use custom diploma from table (16 color mode)
0x101-0x1FF - Use custom diploma from the same table (256 color mode)
0x201-0xFFFF - Use custom diploma *blah blah blah* (256 color mode + 3 OAM images)
----------------
0x100, 0x200, 0x300, etc. - Disable palette loader.

Variables less than 0x3FFF or greater than 0x5FFF will fail.

For the images:
2 of them can be [] or [][].
And one [].
Where [] is a 64x64 image and [][] is a SINGLE 128x64 image. Both compressed in unLZ.
You'll also need 0x21 bytes of FREE WRAM space.
And an additional 0x400 bytes for the palettes. (Though I've been thinking about using the 0x3000000 area but it get's zeroed out most of the time and the palette loader disabler may spark interest for some.)
Sadly, he never got around to posting the source code and has been inactive since.

This thread is for the research into perhaps recreating what Haru~ had done, making it so that the fanfare doesn't play/is toggleable, and, most importantly, making it so the special doesn't have to end the script.

Alternatively, other methods of displaying tilemaps is open to discussion, as I know that it's something that can be used in thousands of different ways.
  #2    
Old April 19th, 2013, 08:16 AM
Spherical Ice's Avatar
Spherical Ice
Community Supporter
 
Join Date: Nov 2007
Location: UK
Tournaments Joined: 0
Tournaments Won: 0
Send a message via Skype™ to Spherical Ice
I'm just going to bump this thread because I am really interested in this but I'm unsure where to go from here.
  #3    
Old April 19th, 2013, 08:32 AM
Magic's Avatar
Magic
 
Join Date: Jan 2009
Location: UK
Age: 23
Gender: Male
Tournaments Joined: 0
Tournaments Won: 0
I used your previous research in my old hack and it was a great thing to have.

Hacking this further could mean a whole range of features! I think it would be particularly useful for a mail system, or... well anything! I've fallen back into noobiness with hacking lately but I hope you/someone can work out how Haru managed all that!
  #4    
Old May 18th, 2013, 01:28 AM
Spherical Ice's Avatar
Spherical Ice
Community Supporter
 
Join Date: Nov 2007
Location: UK
Tournaments Joined: 0
Tournaments Won: 0
Send a message via Skype™ to Spherical Ice
I just realised that whatever activates mail could possibly be hacked as that routine doesn't play any fanfares. I'm going to look into it a bit more and edit this post later.

Edit:

Okay, here's what I've found:

At 0x000BEEB0 there is a pointer to 0x3EE9C8.

At 0x3EE9C8 is the following:

Code:
A0 3E E9 08
20 40 E9 08
2C 52 E9 08
C0 02 00 00
4A 29 39 67
After some research, I discovered the following:

Code:
A0 3E E9 08: This is the palette for Orange Mail
20 40 E9 08: This is the tileset for Orange Mail
2C 52 E9 08: This is the tilemap for Orange Mail
C0 02 00 00: I'm really not sure, I've tried replacing it with FF FF FF FF and it has no effect on the display of the mail.
4A 29 39 67: Same as C0 02 00 00.
This pattern continues for each mail item.
Code:
C0 3E E9 08: Harbor Mail's Palette
C0 41 E9 08: Harbor Mail's Tileset
04 53 E9 08: Harbor Mail's Tilemap
E0 02 00 00
FF 7F 31 46
The "table" appears to end at 0x3EEAB8.

Maybe we can repoint this table and add new Mail items? I don't actually know how to find out what routine is called when you "Check" a mail item but I think if someone out there knows how we could call that routine and perhaps set a variable to indicate which mail tilemap we want to load.
  #5    
Old May 18th, 2013, 01:16 PM
GoGoJJTech's Avatar
GoGoJJTech
http://GoGoJJTech.com
 
Join Date: Nov 2012
Location: Earth
Age: 15
Gender: Male
Nature: Quiet
Tournaments Joined: 0
Tournaments Won: 0
Nice find but wouldn't it be a lot easier to edit the special than to find out this whole NEW routine to us (in our eyes at least)? The special table in FR v1.0 is at 0x15FD60
So basically just reference to the 108th spot of the table go to that pointer and debug it with VBA-SDL-H and find out why it plays a fanfare/ends the script. I will try this as well Spherical
  #6    
Old May 23rd, 2013, 04:31 PM
Shiny Quagsire's Avatar
Shiny Quagsire
どないやねん, ヤドン
 
Join Date: May 2009
Location: Hoenn Safari Zone
Age: 16
Gender: Male
Nature: Jolly
Tournaments Joined: 0
Tournaments Won: 0
The fanfare could very easily be removed provided we find the location in which it is called. Just replace the bl <fanfare asm routine> with something like add r0, r0, #0x0 or something to essentially null it out. Obviously, this would remove the fanfare on normal diplomas, but if it's really an issue you can script that in.



  #7    
Old December 22nd, 2013, 05:09 AM
Spherical Ice's Avatar
Spherical Ice
Community Supporter
 
Join Date: Nov 2007
Location: UK
Tournaments Joined: 0
Tournaments Won: 0
Send a message via Skype™ to Spherical Ice
Okay, the routine for Special 0x108 is located at 0xF5019. This is the first time I've really done any heavy reverse engineering, so I'm going to ask some questions.

On VBA-SDL-H, I put "bpr 0x080F5019 0xFF", and it worked as I expected and the breakpoint...happened when I activated special 0x108. I then typed n to scroll through the routine, but I'm unsure of what I'm looking for.

I passed a few "bl [something]"s, but I don't really know what to do with them. Could someone with a bit more experience help me out, or give me pointers on what to do to continue?

Last edited by Spherical Ice; December 22nd, 2013 at 05:26 AM.
  #8    
Old February 13th, 2014, 06:31 PM
GoGoJJTech's Avatar
GoGoJJTech
http://GoGoJJTech.com
 
Join Date: Nov 2012
Location: Earth
Age: 15
Gender: Male
Nature: Quiet
Tournaments Joined: 0
Tournaments Won: 0
Quote:
Originally Posted by Spherical Ice View Post
Okay, the routine for Special 0x108 is located at 0xF5019. This is the first time I've really done any heavy reverse engineering, so I'm going to ask some questions.

On VBA-SDL-H, I put "bpr 0x080F5019 0xFF", and it worked as I expected and the breakpoint...happened when I activated special 0x108. I then typed n to scroll through the routine, but I'm unsure of what I'm looking for.

I passed a few "bl [something]"s, but I don't really know what to do with them. Could someone with a bit more experience help me out, or give me pointers on what to do to continue?
Ok, I went and changed the bytes at 0x0F509A to 00 00 and it didn't freeze or restart, just played the "sunny day" sound and only the tileset and palette loaded. The tilemap and text didn't appear, but it at least did something. Going further..

EDIT: So I tried all Bl's and B's in the routine and the only one that didn't freeze was the one mentioned.

EDIT2: Well I followed that Bl and there were even more Bl's. Before I nulled out those, I couldn't find anything to do with song 0x104. I might have to null out the Bl's in the Bl...

EDIT3: Well I can't seem to null the playing of the fanfare. Someone else is going to have to do some research as well.

Last edited by GoGoJJTech; February 13th, 2014 at 06:53 PM.
  #9    
Old February 14th, 2014, 03:13 PM
knizz's Avatar
knizz
 
Join Date: Aug 2007
Tournaments Joined: 0
Tournaments Won: 0
write c0 46 c0 46 to 080F4D3E to mute the fanfare during the diploma screen
Firered IDA 6.1 DB: https://www.dropbox.com/s/hvvmxxoo1dkmdzc/firered.idb
VBA-M with lua scripting support (no longer in development)
  #10    
Old February 20th, 2014, 04:38 PM
knizz's Avatar
knizz
 
Join Date: Aug 2007
Tournaments Joined: 0
Tournaments Won: 0
write E1 to 080F4E20 to let the script continue afterwards
Firered IDA 6.1 DB: https://www.dropbox.com/s/hvvmxxoo1dkmdzc/firered.idb
VBA-M with lua scripting support (no longer in development)
  #11    
Old February 21st, 2014, 03:56 AM
knizz's Avatar
knizz
 
Join Date: Aug 2007
Tournaments Joined: 0
Tournaments Won: 0
Quote:
Originally Posted by Spherical Ice View Post
Code:
A0 3E E9 08: This is the palette for Orange Mail
20 40 E9 08: This is the tileset for Orange Mail
2C 52 E9 08: This is the tilemap for Orange Mail
C0 02 00 00: I'm really not sure, I've tried replacing it with FF FF FF FF and it has no effect on the display of the mail.
4A 29 39 67: Same as C0 02 00 00.
C0 02 00 00 seems to be unused.
4A 29 39 67 are two colors that are copied to palette 15 as 10th and 11th entry
also palette 0 has two colors at 10 and 11 which depend on the gender of the player

(not tested, just guessing)
Firered IDA 6.1 DB: https://www.dropbox.com/s/hvvmxxoo1dkmdzc/firered.idb
VBA-M with lua scripting support (no longer in development)
Post Reply
Quick Reply

Sponsored Links


Advertise here
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Minimum Characters Per Post: 25



All times are UTC -8. The time now is 01:08 AM.

About Us
© 2002 - 2014 The PokéCommunity™, pokecommunity.com. Pokémon characters and images belong to The Pokémon Company International and Nintendo. This website is in no way affiliated with or endorsed by Nintendo, Creatures, GAMEFREAK, The Pokémon Company or The Pokémon Company International. We just love Pokémon.

Copyright
All forum styles, their images (unless noted otherwise) and site designs are © 2002 - 2014 The PokéCommunity / PokéCommunity.com. PokéCommunity™ is a trademark of The PokéCommunity. All rights reserved. Sponsor advertisements do not imply our endorsement of that product or service. User generated content remains the property of its creator. Header artwork by Jordanice of deviantART.

Social Media
If you would like to stay up-to-date with us on the go, when we're down, or other such things, follow us on social media sites--most notibly Twitter, Facebook, and Google Plus--by clicking on the links provided.

Design presented by Peitharchia. Special thanks to Hiroshi Sotomura and Ausaudriel.