The PokéCommunity Forums  

Go Back   The PokéCommunity Forums > Fan Games > Binary ROM Hacking > Binary Hack Research & Development
Reload this Page Quick Research & Development Thread

Notices
For all updates, view the main page.

Binary Hack Research & Development Got a well-founded knack with your binary Pokémon hacks? Love reverse-engineering them? For the traditional Pokémon ROM hacker, this is the spot for polling and gathering your ideas, and then implementing them! Share your hypothesis, get ideas from others, and collaborate to create!

Ad Content
Reply
 
Thread Tools
  #751   Link to this post, but load the entire thread.  
Old October 23rd, 2015 (6:14 AM).
Blah's Avatar
Blah Blah is offline
Free supporter
 
Join Date: Jan 2013
Location: Unknown Island
Gender: Male
Posts: 1,924
Quote:
Originally Posted by laflacapkm View Post
I've expanded the Dex untill 721, so.. ¿What i should to do to change more bytes at this offset? :/
It might to be 2D1 in hex.
You need to rework the code in ASM. Maybe there are some parts where you can do some optimization and remove the need to hook, otherwise, this will be hook city.
__________________
...
Reply With Quote
  #752   Link to this post, but load the entire thread.  
Old October 24th, 2015 (8:12 AM).
Telinc1's Avatar
Telinc1 Telinc1 is offline
Weirdo Extraordinaire
 
Join Date: Jun 2013
Location: Sofia, Bulgaria
Gender: Male
Nature: Bold
Posts: 168
I've looked into FireRed's menu descriptions. You know, the blue box that tells you what each entry does. I'm trying to figure out how to get rid of it and I've made some discoveries, nothing complete though.

0x083A7394 is table of pointers to the descriptions. You can repoint each one of them if you want.
There's two offsets which point to it - 0806F104 and 0806F30A. They're referenced a couple of bytes back by ldr r2 opcodes.
The first pointer seems to be part of a routine which loads the description of the first entry. Changing stuff in it only breaks opening the menu. Changing options works fine.
The second pointer to the table seems to be part of a routine which loads the description of any entry you go to after opening the menu. There's a bunch of branching in there and screwing around with it seems to break either selecting options you've already went through or moving the cursor down in the menu. Don't know which of the two because I didn't test it.

While this may not be useful as it is, it's a least a start. One thing I do know is that I've found the routines which load the darn thing. Now to figure out where they start and stub them.
__________________

Check out my hacks by clicking on the userbar!
Check out my new website (this link now works!)!
Reply With Quote
  #753   Link to this post, but load the entire thread.  
Old October 24th, 2015 (7:01 PM).
Blah's Avatar
Blah Blah is offline
Free supporter
 
Join Date: Jan 2013
Location: Unknown Island
Gender: Male
Posts: 1,924
Quote:
Originally Posted by Telinc1 View Post
I've looked into FireRed's menu descriptions. You know, the blue box that tells you what each entry does. I'm trying to figure out how to get rid of it and I've made some discoveries, nothing complete though.

0x083A7394 is table of pointers to the descriptions. You can repoint each one of them if you want.
There's two offsets which point to it - 0806F104 and 0806F30A. They're referenced a couple of bytes back by ldr r2 opcodes.
The first pointer seems to be part of a routine which loads the description of the first entry. Changing stuff in it only breaks opening the menu. Changing options works fine.
The second pointer to the table seems to be part of a routine which loads the description of any entry you go to after opening the menu. There's a bunch of branching in there and screwing around with it seems to break either selecting options you've already went through or moving the cursor down in the menu. Don't know which of the two because I didn't test it.

While this may not be useful as it is, it's a least a start. One thing I do know is that I've found the routines which load the darn thing. Now to figure out where they start and stub them.
Check the ASM resource thread. I made a post about field moves and adding new ones.

To remove the descriptions, I think you can just nop out function calls to 08113018. Try writing 4 bytes of 0x0s to 0806F2CE, 0806F31C, and 080F798E.
__________________
...
Reply With Quote
  #754   Link to this post, but load the entire thread.  
Old November 6th, 2015 (3:34 AM). Edited November 6th, 2015 by jirachiwishmaker.
jirachiwishmaker's Avatar
jirachiwishmaker jirachiwishmaker is offline
 
Join Date: Jul 2007
Location: Forina
Gender: Male
Nature: Lonely
Posts: 116
For Emerald, if you want to enable the trainer's national Pokemon in the contests before beating the Elite Four, do the following changes:
Put 00 00 00 00 00 00 at 0xDABA6 (for removing the entire flag checking command).
Reply With Quote
  #755   Link to this post, but load the entire thread.  
Old November 6th, 2015 (6:52 AM).
Touched's Avatar
Touched Touched is offline
Resident ASMAGICIAN
 
Join Date: Jul 2014
Gender: Male
Posts: 625
Quote:
Originally Posted by pokemontutorialTV View Post
In firered prices above 9999$ will be displayed with ?xxxx$. Does somebody now how to fix this?
Try increasing the value at 0809B430 (FR) from 4 to 5. That number should be the digit length of prices for the Pokemart.
__________________

A Pokemon that is discriminated!
Support squirtle and make it everyone's favourite.
Reply With Quote
  #756   Link to this post, but load the entire thread.  
Old November 7th, 2015 (9:08 PM).
kearnseyboy6 kearnseyboy6 is offline
Aussie's Toughest Mudder
 
Join Date: Dec 2008
Posts: 300
Quote:
Originally Posted by pokemontutorialTV View Post
Annother question... if i have expanded items and i want to buy some from the new indices, the market closing immedetly. Do you have an idea where the limiter is or how to change this?
Try this:
0x98998 = number of new items
0x9a8ae = 00 00 00 00
__________________
HOLIDAYING CURRENTLY!!
Reply With Quote
  #757   Link to this post, but load the entire thread.  
Old November 8th, 2015 (12:47 PM). Edited December 3rd, 2015 by kleenexfeu.
kleenexfeu kleenexfeu is offline
 
Join Date: Aug 2013
Gender: Male
Posts: 218
Soul Dew works in the Battle Frontier for [email protected] :

C0 46 C0 46 at 0x806979E & 0x80697D4
__________________
Arceus and Giratina Forms
Dynamic Pokémon Data
Reply With Quote
  #758   Link to this post, but load the entire thread.  
Old November 8th, 2015 (1:27 PM). Edited April 10th, 2018 by DraconianWing.
DraconianWing's Avatar
DraconianWing DraconianWing is offline
 
Join Date: Aug 2012
Location: Fallarbor Town
Age: 23
Gender: Male
Nature: Mild
Posts: 959
Changing the pre-battle, post-battle and switch-in text in Emerald (BPEE) and FireRed (BPRE)

This post focuses on changing the challenge, defeat, and switch-in text strings that appear during battle in Emerald and FireRed. To clarify, I'm talking about these:
Quote:
[trainer]
would like to battle!
Quote:
Player defeated
[trainer]!
Quote:
[trainer] is
about to use [Pokemon].

Will [player] change
POKéMON?
With a few tips from Sky High, success has been achieved in modifying them :)

Green denotes Emerald offsets.
Red
denotes FireRed offsets.

This is the default challenge text, found in 0x5CBB9C, and has pointers at 0x14E228 and 0x14E264.
Located at 0x3FD366 and the pointer at 0xD73C0 for FireRed.
Code:
FD 1C 00 FD 1D FE EB E3 E9 E0 D8 00 E0 DD DF D9 00 E8 E3 00 D6 D5 E8 E8 E0 D9 AB FB FF
The default defeat text is in 0x5CBA2E, with pointers at 0x14E66C and 0x5CC744.
For FireRed, it's at 0x3FD1C7 with pointers at 0xD776C and 0x3FE410.
Code:
CA E0 D5 ED D9 E6 00 D8 D9 DA D9 D5 E8 D9 D8 FE FD 1C 00 FD 1D AB FB FF
Last but not least, here's the default switch-in dialogue at 0x5CB9ED. Its pointer is at 0x5CC6A8.
On FireRed, it's at 0x3FD186 and the pointer located at 0x3FE374. This exact form is only present in ROMs that have not been decapitalized.
Code:
FD 1C 00 FD 1D 00 DD E7 FE D5 D6 E3 E9 E8 00 E8 E3 00 E9 E7 D9 00 FD 01 AD FB D1 DD E0 E0 00 FD 23 00 D7 DC D5 E2 DB D9 FE CA C9 C5 1B C7 C9 C8 AC FF
Some bytes are used to load stored text, like the trainer class and trainer name. There are also others that stand for different functions. They are as follows:
Code:
FD 01: Loads the name of the Pokemon the opponent is switching into/sending out
FD 1C: Loads the trainer class
FD 1D: Loads the trainer's name
FA: Continues the string after FE has been used. Similar to XSE's "\l" command
FB: Moves to a new box altogether and carries on the string. Works like "\p" (Yes, from XSE as well)
FE: The "new line" function for the string, similar to "\n" in XSE scripting
FF: Terminates the string to avoid reading further bytes (I think).
Modifying them is quite simple. Just write a custom string that you want (either in raw hex form or with a script editor) while making use of the byte functions listed above, compile or insert into free space using a hex editor, then change the respective pointers! I'll put mine up as an example because I'm awful at explaining stuff; feel free to use them. Be aware that these are optimized for EM, but they might work for FR:

Challenge text:
Code:
D3 E3 E9 00 D5 E6 D9 00 D7 DC D5 E0 E0 D9 E2 DB D9 D8 00 D6 ED FE FD 1C 00 FD 1D AB FB FF

Defeat text:
Code:
D3 E3 E9 00 D8 D9 DA D9 D5 E8 D9 D8 FE FD 1C 00 FD 1D AB FB FF
Switch-in text:
Code:
FD 1C 00 FD 1D 00 DD E7 FE D5 D6 E3 E9 E8 00 E8 E3 00 E7 D9 E2 D8 00 DD E2 00 FD 01 AD FA D1 DD E0 E0 00 ED E3 E9 00 E7 EB DD E8 D7 DC 00 ED E3 E9 E6 00 CA E3 DF 1B E1 E3 E2 AC FF
__________________
"All dreams are but another reality. Never forget..."
Reply With Quote
  #759   Link to this post, but load the entire thread.  
Old November 9th, 2015 (9:15 AM).
PurpleOrange's Avatar
PurpleOrange PurpleOrange is offline
still don't know what I'm doing
 
Join Date: Sep 2013
Location: Littleroot Town (UK)
Age: 25
Gender: Male
Posts: 367
Not sure if anyone else has found this yet but meh

So to upgrade your pokedex to the national dex in ruby you put this is an xse script
Code:
writebytetooffset 0x2 0x2026B00
writebytetooffset 0x3 0x2026B01
writebytetooffset 0xDA 0x2024EBE
writebytetooffset 0x67 0x2026A5A
which Renegade worked out and documented in THIS old thread

well this kinda does the job but leaves it like this
Spoiler:
so it's kinda still the hoenn dex except now you can search the national dex, and the number on the summary screen will be the national dex number

in order to fix that we need to add another line to the script so it becomes this (with changes in bold)
Code:
writebytetooffset 0x2 0x2026B00
writebytetooffset 0x3 0x2026B01
writebtyetooffset 0x1 0x2024EBD
writebytetooffset 0xDA 0x2024EBE
writebytetooffset 0x67 0x2026A5A
so now it looks like this
Spoiler:
__________________

Reply With Quote
  #760   Link to this post, but load the entire thread.  
Old November 12th, 2015 (9:39 AM). Edited May 5th, 2018 by DraconianWing.
DraconianWing's Avatar
DraconianWing DraconianWing is offline
 
Join Date: Aug 2012
Location: Fallarbor Town
Age: 23
Gender: Male
Nature: Mild
Posts: 959
Previous post has been updated to include offsets for FireRed!

-------------------------------------------------------------------------------

In an attempt to further modernize the strings in the battle system, I've also looked into the text that prints whenever something happens with the opponent's Pokemon, namely the term "Foe." Basically, in-battle dialogue such as:
Quote:
Foe [Pokemon] used
[move]!
Quote:
Foe [Pokemon] is paralyzed!
It may be unable to move!
Because it's used in a lot of other strings, "Foe" seems to be loaded from stored text as opposed to being separate like the pre- and post-battle messages.

It's located at 0x5CBD8B and has quite a few pointers: 0x14EB28, 0x14EC9C, 0x14ED38, 0x14EDD4, 0x14EE70, 0x14EF0C, 0x14F390, 0x14F784. This doesn't cover the Screen move strings though (Light Screen and Reflect). On FireRed, the text is at 0x3FD55B and pointers at 0xD7B7C, 0xD7CA4, 0xD7D18, 0xD7D8C, 0xD7E00, 0xD7E74, 0xD82C0, 0xD8554.

Changing it is pretty much the same as the ones on my previous post, but note that you're only changing one word and not the messages themselves. Once again, I'll be putting up an example. This replaces "Foe" with "The opposing". Remember, insert into free space and re-point accordingly!

Code:
CE DC D9 00 E3 E4 E4 E3 E7 DD E2 DB 00 FF
A side effect of using this custom string is that it interferes with a few other dialogue, which become long enough to go off the screen when printing. Fortunately, these are easily fixed by making the following byte changes (I'll be updating my posts as more information is found):

Emerald:



Code:
0x5CAC2D: FE (Ingrain)
0x5CA8C9: FE (Ghost-type Curse)
0x5CA8CD: 00 (Ghost-type Curse)
0x5CACB3: FE (Skill Swap)
0x5CACBD: 00 (Skill Swap)
FireRed:
Code:
0x3FC3BD: FE (Ingrain)
0x3FC059: FE (Ghost-type Curse)
0x3FC05D: 00 (Ghost-type Curse)
EDIT: Updated with FireRed offsets. Credits to BlackWhiteRobin for finding them!

EDIT 2: Added Skill Swap fix for Emerald. Have yet to find FireRed equivalents.
__________________
"All dreams are but another reality. Never forget..."
Reply With Quote
  #761   Link to this post, but load the entire thread.  
Old November 13th, 2015 (5:38 AM). Edited November 13th, 2015 by Spherical Ice.
Spherical Ice's Avatar
Spherical Ice Spherical Ice is offline
 
Join Date: Nov 2007
Location: Leicester, UK
Age: 25
Posts: 5,251
Special 0x167 is used by the printer in the Game Corner in vanilla FireRed to add the icons of your party to your Trainer Card.

Vars 0x4043 - 0x4048 correspond to the six Pokémon icons on the back of the Trainer Card. You can change them at x89a78, but note that special 0x167 assumes they will be consecutively stored (and it will take the starting variable as the one stored at xCC3C0. 0x4042 is also used by the special, but it just appears to be a clone of 0x8004, which determines what colour the icons should use.

0x4049 - 0x404B controls the three stickers on the back of the Trainer Card. You can change them at x89a6c. They're checked by the script of the sticker kid on Four Island, too, so just change them there like usual too.
__________________
Reply With Quote
  #762   Link to this post, but load the entire thread.  
Old November 15th, 2015 (8:28 AM).
Trainer 781
Guest
 
Posts: n/a
This post is a little extension to JPAN's document on Battle Structs for Fire Red (link here). The bolded ones are the new ones found during my research.

Spoiler:
Hit Marker at x2023DD0 (single word):
Code:
Flag	   Function
x40	-   Destiny Bond
x80	-   Skip Move Animations
x100	-   Overrides substitute & outcome checks to enable graphical and data damage updates. Used for burn damage, leech seed heal, Hi Jump Kick Crash etc.
x200	-   Inhibit Attack String & PP reduction. Set before the second iteration of the move that target
both Foes. Also ensures that second iteration runs regardless of user faint.
x400	-   Inhibit Attack String Print
x800	-   Inhibit PP deduction. Set on struggle & second phase of charging turn moves.
x1000	-   Toggled in cmd5f. Further info not known
x2000	-   Set due to some contact abilities to adjust status affliction
x4000	-   Required to be set for Synchronize. Set in the seteffectcommands
x8000	-   Set on successful flee 
x10000  -   Overrides fly evasion
x20000  -   Overrides dig evasion
x40000  -   Overrides dive evasion
x80000	-   Set in Attack Canceler due to being unable to move (flinch, recharge, sleep etc). Used to prevent second iteration of Dual Foe Targeting move in doubles and delays the charge part of moves like Sky Attack etc.
x200000	-   Related to obedience check
x800000	-   Does something with Magic Coat 
x1000000  - Prevents setting of destiny bond.
x2000000 -   required to be set for minimize
x10000000 -	death marker for bank 0. further bits for death marker of other banks
Special Status Flags at x2023DFC (a word each for 4 banks):
Flag - Functions
Code:
x1 - ???	
x2 - ???	
x4 - Leech Seed
x8 -	lockon
x10 -	mind reader
x20 -	Perish song
x40 -	Airborne
x80 -	Underground
x100 -	Minized
x200 -	Charged
x400 -	Rooted
x800 -	Sleep this turn (yawn)
x1000 -	Sleep in one turn (yawn)
x2000 -	Imprisoned
x4000 -	Grudged
x8000 - ???	
x10000 -	Mud sport
x20000 -	Fire sport
x40000 -	Dive
x80000 - Intimidate BS Lock
x100000 - Trace BS Lock
The last 11 bits seem to be unused, so they can be used for things like Aqua Ring, Unburden boost, Smacked Down, Phantom Force, Electrify etc.
If you want to set a custom status which clears upon switching then this is the perfect spot to place it.
The word at x128EC controls the special status bits that can be Baton Passed. So Aqua Ring etc. can be passed by altering this word to accomodate to more bits.

[B]Protect Structure at x2023E8C (16 bytes allocated per bank):[B]
Code:
 
        Flag -  Function		
Byte 0x0:
        0x1 - Protect On		
	0x2 -	Endure On		
	0x4	Struggle On		
	0x8 -	Helping Hand On		
	0x10 -	Magic Coat On		
	0x20 -	Snatch On		
	0x40 -  ??			
	0x80 -	Set in Attack Canceler when unable to move due to being paralyzed		
Byte 0x1:
	0x1 -	Set due to confusion. Prevent contact abilties to activate due to the confusion hit		
	0x2 -	Set if move is not Effective		
	0x4 -	Set in a Repeating Attack along with x1000 secondary status 		
	0x8 -	Marker to print Smoke Ball Flee		
	0x10 -	Marker to print Run Away Flee		
	0x20 -	Set in Attack Canceler when attempting to use an imprisoned move		
	0x40 -	Set in Attack Canceler when immobilized by love		
	0x80 -	Set in Attack Canceler when attempting to use a disabled move		
Byte 0x2:	
        0x1 -	Set in Attack Canceler when attempting to use a status while being taunted		
	0x2 -	Don't know but is checked in a subroutine		
	0x4 -	Set in Attack Canceler when flinched		
	0x8 -	Set when PP is deducted. Checked for absorb abilities.		
	0x10 - Vacant			
	0x20 - Vacant		
	0x40 - Vacant		
	0x80 - Vacant
Remaining Bytes:			
0x3 -	Vacant		
0x4-0x7 - Physical damage suffered		(JPAN incorrectly labelled the physical & special damage locations)
0x8-0xB	- Special damage suffered		
0xC	- The bank that did physical damage (Used to select the counter target)		
0xD	- The bank that did special damage (Used to select the mirror coat)
0xE-0xF - Vacant 
The vacant places are good for Status that are cleared after end of turn and can be used to include things like King Shield, Spiky Shield etc.

I'll update this post after researching more locations.
Reply With Quote
  #763   Link to this post, but load the entire thread.  
Old November 15th, 2015 (8:05 PM). Edited November 15th, 2015 by GoGoJJTech.
GoGoJJTech's Avatar
GoGoJJTech GoGoJJTech is offline
(☞゚ヮ゚)☞ http://GoGoJJTech.com ☜(゚ヮ゚☜)
 
Join Date: Nov 2012
Location: Earth
Age: 24
Gender: Female
Nature: Jolly
Posts: 2,475
Code:
[10:59:13 PM] GoGoJJTech: http://sphericalice.com/romhacking/documents/script/#c-D5
[10:59:20 PM] GoGoJJTech: pokemon emerald 0x26E331
[10:59:24 PM] GoGoJJTech: I think it's the trick house
[10:59:41 PM] GoGoJJTech: map 29.9
[10:59:45 PM] GoGoJJTech: script tiles
[10:59:50 PM] GoGoJJTech: essentially this happens:
[11:00:19 PM] GoGoJJTech: http://hastebin.com/xuqoduhaho.hs (in xse)
[11:00:33 PM] GoGoJJTech: if we take into account that cmdd5 has no arguments, it'd appear as so:
[11:00:56 PM] GoGoJJTech: http://hastebin.com/jakigedicu.hs
[11:01:02 PM] GoGoJJTech: however, d3 is braille2
[11:01:12 PM] GoGoJJTech: meaning that d3 can change its effect based on d5 before it
[11:01:16 PM] GoGoJJTech: but why?
[11:01:20 PM] GoGoJJTech: and d4 too
[11:01:24 PM] GoGoJJTech: which is usually bufferitems
[11:01:30 PM] GoGoJJTech: this is pretty funky
Yeah, so apparently this is a thing and this happens. It's probably useless to us hackers because it's so specific in its existence, but that's what researching is for right? (btw the only reason I came across this was because my script decompiler flopped here, meaning that most script editors might also flop on these scripts)

EDIT: In Emerald, Command 0xD5 actually uses a halfword as its argument (meaning XSE is correct) for Emerald
Also, XSE states that D4 (bufferitems) only exists in FRLG, meaning that for Emerald, it's probably only used in this strange context
__________________
I believe in Jesus Christ my Savior. If you do too, and aren't scared to admit it, then copy and paste this into your signature.
The HGSS Music Patch - The BW/2 Music Patch - ASM: Switch Music Based on Seasons
Romhack.me Profile - Pokecommunity Profile - Youtube Channel

Support me at my site!
Pokémon Platinum Red and Blue
Reply With Quote
  #764   Link to this post, but load the entire thread.  
Old November 16th, 2015 (3:02 AM). Edited November 16th, 2015 by Touched.
Touched's Avatar
Touched Touched is offline
Resident ASMAGICIAN
 
Join Date: Jul 2014
Gender: Male
Posts: 625
Quote:
Originally Posted by GoGoJJTech View Post
Yeah, so apparently this is a thing and this happens. It's probably useless to us hackers because it's so specific in its existence, but that's what researching is for right? (btw the only reason I came across this was because my script decompiler flopped here, meaning that most script editors might also flop on these scripts)

EDIT: In Emerald, Command 0xD5 actually uses a halfword as its argument (meaning XSE is correct) for Emerald
Also, XSE states that D4 (bufferitems) only exists in FRLG, meaning that for Emerald, it's probably only used in this strange context
They seem to control those rotating obstacles as seen in the trickhouse 29.9 and mossdeep's gym.

cmdD3 does some nasty checking of the map tile ID. All those arrow panels are tile 0x298 and above. They're in groups of 8. Right, Down, Let, Up, Trigger, and then three blanks. D3 checks what group you're activating and rotates all the NPCs on those tiles in the correct directions. It uses movement scripts at 861269C, 86126A0, 86126A4 and 8612698 to accomplish this NPC movement. It also keeps track of their coordinates in the saveblock. I would guess this command also rotates the relevant tiles.

cmdD4 updates the facing of all relevant NPCs with applymovements and updates their behaviours so that they are facing the correct direction.

cmdD5 allocates memory for this whole process (if there is no memory already allocated). cmdD6 frees that memory, and updates the player's overworld sprite. It also waits for some task. For all these scripts, you'll see a cmdD5 first, then a cmdD6 at the end.

Summary:
cmdD3 - mossdeep gym trap rotate: takes a halfword (variable or number) of the trap type (panel colour)
cmdD4 - mossdeep gym trap update: no arguments
cmdD5 - mossdeep gym trap begin: takes a halfword (variable or number). true indicates trick house (panels start at 0x298), false indicates mossdeep gym (panels start at block id 0x250)
cmdD6 - mossdeep gym trap end: no arguments
__________________

A Pokemon that is discriminated!
Support squirtle and make it everyone's favourite.
Reply With Quote
  #765   Link to this post, but load the entire thread.  
Old November 16th, 2015 (6:47 AM).
Dr. Seuss's Avatar
Dr. Seuss Dr. Seuss is offline
Navegando en mi automóvil, hablando con la nena por el móvil 😎...
 
Join Date: Feb 2014
Location: Guatemala City
Age: 27
Gender: Male
Nature: Brave
Posts: 521
I've made a quick research about the background of the Oak's intro screen in Fire Red, to be accurate, this background


Tileset of Background: 0x460CA4
Tilemap:0x460CE8
Palletes: 0x460568
Tilemap size (In NTME): 30x20 (240x160)
Amount of colors: 16

I really don't understand why the Oak's intro uses 256 colors if a lot of colors aren't used.
__________________
Graphic design is my passion...

Click on the picture to see the best hack ever created (?
Reply With Quote
  #766   Link to this post, but load the entire thread.  
Old November 18th, 2015 (7:20 AM). Edited November 18th, 2015 by kleenexfeu.
kleenexfeu kleenexfeu is offline
 
Join Date: Aug 2013
Gender: Male
Posts: 218
For Emerald

Proper cry for limbo slots



This should theorically allow the limbo slots (between Celebi and Treecko) to have their proper cry, could be useful for forms etc, since the emerald expansion isn't finished yet :

Update : put C0 46 C0 46 C0 46 at 0x806D51C

A repoint might be needed, sadly I can't test on my PC as I don't have sound

Tbh the engine handles the cry weirdly, if someone has more information about how to repoint the tables correctly, please share. Thanks PurpleOrange :

Quote:
Originally Posted by PurpleOrange View Post
EDIT: It should be noted with this method the repointed table must include the the national dex number of the first 251 pokemon in hex -1 followed by 25 lots of 00 00 (which can be changed for new cries), then followed by the index numbers of the hoenn pokemon (in their weird order)

The game displays the default sprite, icon and base stats for Deoxys




01 BC 00 47 at 0x8034C32 for the sprite.

C0 46 C0 46 C0 46 C0 46 at 0x8068A2C for the stats.

C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 at 0x80D3030 for the icon.
__________________
Arceus and Giratina Forms
Dynamic Pokémon Data
Reply With Quote
  #767   Link to this post, but load the entire thread.  
Old November 18th, 2015 (8:31 AM). Edited November 18th, 2015 by PurpleOrange.
PurpleOrange's Avatar
PurpleOrange PurpleOrange is offline
still don't know what I'm doing
 
Join Date: Sep 2013
Location: Littleroot Town (UK)
Age: 25
Gender: Male
Posts: 367
Quote:
Originally Posted by kleenexfeu View Post
For Emerald

Proper cry for limbo slots



This should theorically allow the limbo slots (between Celebi and Treecko) to have their proper cry, could be useful for forms etc, since the emerald expansion isn't finished yet :

put C0 46 C0 46 at 0x80A359C

after that, you can fill 0x806D510-0x806D540 with FF bytes to create a bit of freespace

Though I don't have sound on my PC, so if someone could test I would appreciate
hey, there is another method for limbo cries that seems to work found in THIS POST.
Quote:
Originally Posted by ThomasWinwood View Post
write 00 00 00 00 00 00 00 00 00 00 (that's ten bytes) to x4330C and 00 00 00 00 (four) to x43318, then repoint the table at x4539D4 and expand it - it's now a table with one word for every ID
i found that the equivalent offsets for emerald are at 0x6D518, and 0x6D527
regardless, with your method, you'd still need to repoint and expand the cry table, no?

EDIT: It should be noted with this method the repointed table must include the the national dex number of the first 251 pokemon in hex -1 followed by 25 lots of 00 00 (which can be changed for new cries), then followed by the index numbers of the hoenn pokemon (in their weird order)
__________________

Reply With Quote
  #768   Link to this post, but load the entire thread.  
Old November 18th, 2015 (8:37 AM).
kleenexfeu kleenexfeu is offline
 
Join Date: Aug 2013
Gender: Male
Posts: 218
Quote:
Originally Posted by PurpleOrange View Post
hey, there is another method for limbo cries that seems to work found in THIS POST.

i found that the equivalent offsets for emerald are at 0x6D518, and 0x6D527
regardless, with your method, you'd still need to repoint and expand the cry table, no?
No idea, as I said I can't test. I never even tried to expand or look at any sound-related table :s
I just negate the function that replaces limbos cries with unown cries
__________________
Arceus and Giratina Forms
Dynamic Pokémon Data
Reply With Quote
  #769   Link to this post, but load the entire thread.  
Old November 18th, 2015 (8:55 AM).
PurpleOrange's Avatar
PurpleOrange PurpleOrange is offline
still don't know what I'm doing
 
Join Date: Sep 2013
Location: Littleroot Town (UK)
Age: 25
Gender: Male
Posts: 367
Quote:
Originally Posted by kleenexfeu View Post
No idea, as I said I can't test. I never even tried to expand or look at any sound-related table :s
I just negate the function that replaces limbos cries with unown cries
well tested out your method, the first 251 pokemon have the correct cries, but the rest of the hoenn pokemon seem to be in a messed up order, and not an order that i recognize at all
__________________

Reply With Quote
  #770   Link to this post, but load the entire thread.  
Old November 18th, 2015 (12:23 PM).
Telinc1's Avatar
Telinc1 Telinc1 is offline
Weirdo Extraordinaire
 
Join Date: Jun 2013
Location: Sofia, Bulgaria
Gender: Male
Nature: Bold
Posts: 168
I don't think this has been posted here, but if it has, sorry.
The step counter for the Safari Zone is at 02039996. It's completely unprotected by DMA and you can change it with cheat codes or ASM routines.
__________________

Check out my hacks by clicking on the userbar!
Check out my new website (this link now works!)!
Reply With Quote
  #771   Link to this post, but load the entire thread.  
Old November 22nd, 2015 (11:27 AM).
Telinc1's Avatar
Telinc1 Telinc1 is offline
Weirdo Extraordinaire
 
Join Date: Jun 2013
Location: Sofia, Bulgaria
Gender: Male
Nature: Bold
Posts: 168
Sorry for the double post, but this is something completely different and has nothing to do with the Safari Zone. I'm okay with it being merged though.
I've found a couple of graphics offsets for FireRed's slot machines. Maybe I'll post the palette offsets too later.

Code:
0x084659D0 - The slot machine itself. Definitely uses multiple palettes.
0x0846653C - Some Poké Ball looking thing. Gets decompressed when the slot machine loads, but I don't know if it's used there.
0x08466620 - Combo images. Used for the little popup when you hit the right arrow. Width: 14, uses palette 8 from the background palettes
0x08464A14 - The actual 32x32 slot images. Get loaded in the OAM. Width: 4, uses palette 2 from the sprite palettes
0x0846506C - Clefairy down at the bottom. Width: 4, uses palette 5 from the sprite palettes
0x08465544 - Bubble-looking things that I can't identify. Similarly to 0x0846653C, they get decompressed when the slot machine loads. Don't think they're used.
By the way, this is everything that has do with LZ77 in the log file I extracted those offsets out of. Maybe it'll be useful to somebody.
Spoiler:
Code:
LZ77UnCompWram: 0x084659d0,0x02006fe0 (VCOUNT=120)
LZ77UnCompWram: 0x0846653c,0x02008130 (VCOUNT=152)
LZ77UnCompWram: 0x084661d4,0x02004620 (VCOUNT=154)
LZ77UnCompWram: 0x08466620,0x020081c0 (VCOUNT=14)
LZ77UnCompWram: 0x08466998,0x02008a10 (VCOUNT=35)
LZ77UnCompWram: 0x08464a14,0x0201c000 (VCOUNT=134)
LZ77UnCompWram: 0x0846506c,0x0201c000 (VCOUNT=200)
LZ77UnCompWram: 0x08465544,0x0201c000 (VCOUNT=19)

__________________

Check out my hacks by clicking on the userbar!
Check out my new website (this link now works!)!
Reply With Quote
  #772   Link to this post, but load the entire thread.  
Old November 29th, 2015 (7:59 AM). Edited December 21st, 2015 by PurpleOrange.
PurpleOrange's Avatar
PurpleOrange PurpleOrange is offline
still don't know what I'm doing
 
Join Date: Sep 2013
Location: Littleroot Town (UK)
Age: 25
Gender: Male
Posts: 367
so I found this "table" in FireRed at 0x08466C58
Code:
13 14 27 29 FF FF FF 14 13 15 29 FF FF FF 15 14 16 FF FF FF FF 16 15 17 1B 2B
FF FF 17 16 18 19 1A 1B 2B 18 17 19 1A 1D FF FF 19 17 18 1A 22 FF FF 1A 17 18
19 1C 1E FF 1B 16 17 1C 2B FF FF 1C 1A 1B 1E FF FF FF 1D 18 1E FF FF FF FF 1E
1C 1D 1F FF FF FF 1F 1E 20 FF FF FF FF 20 1F 21 FF FF FF FF 21 20 24 25 FF FF
FF 22 19 23 FF FF FF FF 23 22 24 FF FF FF FF 24 21 23 25 FF FF FF 25 21 24 26
FF FF FF 26 25 27 FF FF FF FF 27 13 26 FF FF FF FF 29 13 14 2A FF FF FF 2A 29
14 FF FF FF FF 2B 16 17 1B FF FF FF 2C 2B 1B FF FF FF FF FF FF FF FF FF FF FF
each byte (other than the FF's) refer to the map number of the possible route the roaming pokemon can be found on. however I can't seem to find any sort of pattern for it, so expanding it doesn't seem to be easy. also, it doesn't seem to have a byte for the map bank (03), could that mean the map bank is calculated somewhere else?
__________________

Reply With Quote
  #773   Link to this post, but load the entire thread.  
Old November 30th, 2015 (6:27 PM). Edited December 1st, 2015 by Vendily.
Vendily's Avatar
Vendily Vendily is offline
 
Join Date: Aug 2015
Nature: Calm
Posts: 1,604
In PMD: Red Rescue, the tilemap that contains the letters and symbols in the game is located at 302088 and is 9E0 bytes long.
This is a dump of the first tile, a #, that fingerprints the sheet.
Code:
00 00 00 00 10 11 11 00 11 17 17 01 71 77 77 01 11 17 17 01 71 77 77 01 11 17 17 01 10 11 11 00
It appears to be formatted like this on a tile (Spaces separate pixels):
Code:
0 0 0 0 0 0 0 0
0 1 1 1 1 1 0 0
1 1 7 1 7 1 1 1
1 7 7 7 7 7 1 0
1 1 7 1 7 1 1 0
1 7 7 7 7 7 1 0
1 1 7 1 7 1 1 0
0 1 1 1 1 1 0 0
I have yet to find the palette.

EDIT: I suspect the Palette is controlled by ASM because I can't even find it saved in the rom.
There might be more tiles before and after but I'm not 100% sure about anything outside this range.

EDIT 2: I think I found the beginning of the tile map at 302048 which is just a one pixel column of black on the left and the rest is the transparent green.
Original:
Code:
03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00
Decompiled:
Code:
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
There is this block-large section of 7s right after it which doesn't make sense.
Original:
Code:
77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77
Decompiled:
Code:
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
There is also a 48 20 30 at 147E5, the only instance of it but it's immediately followed by a 05 so I don't know if it's a pointer to the tilemap. There was no pointer to the # though.

EDIT 3: Changed 48 20 30 to 48 20 40, there doesn't seem to be a visual effect. Conclusion: this is not a pointer (probably).
__________________
| VPP Stats

Common Errors (and How to Fix Them) in Essentials
Reply With Quote
  #774   Link to this post, but load the entire thread.  
Old December 4th, 2015 (10:16 AM).
Telinc1's Avatar
Telinc1 Telinc1 is offline
Weirdo Extraordinaire
 
Join Date: Jun 2013
Location: Sofia, Bulgaria
Gender: Male
Nature: Bold
Posts: 168
I'll just point out two things.
02036E58 contains the direction the player is facing. It's got the same key as 0x800C (1: down, 2: up, 3: left, 4: right), except that you can't change it (changing it will make it flip back to what it should be, so that makes me believe it's updated every frame) and it's also reliable. I haven't looked at it in a memory viewer, but 0x800C seems to behave funnily if you want to check the player's facing and not change it. Ergo, you should do something like comparefarbytetobyte 0x2036E58 0x2 instead of compare PLAYERFACING 0x2 in scripts.

The second I haven't looked into a lot, so I'm not sure if it's got truth in it, but type 0x7 level scripts seem to run only on menu close and not when the map is loaded (AdvanceMap 1.92 says they also run on map load). Maybe someone can confirm/reject this?
__________________

Check out my hacks by clicking on the userbar!
Check out my new website (this link now works!)!
Reply With Quote
  #775   Link to this post, but load the entire thread.  
Old December 4th, 2015 (10:58 AM). Edited December 9th, 2015 by Blah.
Blah's Avatar
Blah Blah is offline
Free supporter
 
Join Date: Jan 2013
Location: Unknown Island
Gender: Male
Posts: 1,924
Quote:
Originally Posted by Telinc1 View Post
I'll just point out two things.
02036E58 contains the direction the player is facing. It's got the same key as 0x800C (1: down, 2: up, 3: left, 4: right), except that you can't change it (changing it will make it flip back to what it should be, so that makes me believe it's updated every frame) and it's also reliable. I haven't looked at it in a memory viewer, but 0x800C seems to behave funnily if you want to check the player's facing and not change it. Ergo, you should do something like comparefarbytetobyte 0x2036E58 0x2 instead of compare PLAYERFACING 0x2 in scripts.

The second I haven't looked into a lot, so I'm not sure if it's got truth in it, but type 0x7 level scripts seem to run only on menu close and not when the map is loaded (AdvanceMap 1.92 says they also run on map load). Maybe someone can confirm/reject this?
That's the npc_states data structure. Basically, the first entry is always the player, and then the next entries are NPCs around the player (they include NPCs offscreen until a certain distance). The advantage to using this instead of "PLAYER_FACING" is that the temporary variable 0x800C (which is player_facing) is only updated when the "A" button is pressed. So if you wanted to use it with a green script tile, you'd a random result. Knizz has some more indepth research about the npc_states data struct in his IDB and he also made a thread about it some years ago, if you're interested.

For your inquiry about level script 0x7, I think they are all going to activate on map reload (just a guess). You can confirm by setting a break point at "08069940" with 0x7 as the only level script. See if it's breaking on the map reload/menu open-close :)

edit:
I thought I'd drop this here for archival purposes for anyone trying to do this:
http://www.pokecommunity.com/showpost.php?p=9028130&postcount=4
__________________
...
Reply With Quote
Reply

Quick Reply

Join the conversation!

Create an account to post a reply in this thread, participate in other discussions, and more!

Create a PokéCommunity Account
Ad Content

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -8. The time now is 8:53 AM.