Research: Displaying Custom Tilemaps / Hacking the Diploma Screen

[Spherical Ice]

As you may or may not be aware, last year I posted this thread to the Tutorials section, and was soon met by an amazing post by Haru~ that enabled a table of 255 different "diplomas" to be accessed. In short, this hack allowed you to display custom tilemaps using special 0x108 and setting a few variables.

Now, this hack is very useful, but it has a few bugs:

• Upon loading the screen, a fanfare (the one played when you obtain a badge) plays.
• The special ends the script

While not a glitch, the screen also remains until the player presses A.

Haru~ also managed to hack the X and Y positions of the text, use palettes with 256 colours, display three 64x64 sprites AND use custom animations.


https://www.youtube.com/watch?v=mDzdefq1lJA

In his PM, he gave me the following information:

To activate the hack, you must set a 0x5XXX (or 0x4XXX) variable to:

0x0 - Original Diploma
0x1-0xFF - Use custom diploma from table (16 color mode)
0x101-0x1FF - Use custom diploma from the same table (256 color mode)
0x201-0xFFFF - Use custom diploma *blah blah blah* (256 color mode + 3 OAM images)
----------------
0x100, 0x200, 0x300, etc. - Disable palette loader.

Variables less than 0x3FFF or greater than 0x5FFF will fail.

For the images:
2 of them can be [] or [][].
And one [].
Where [] is a 64x64 image and [][] is a SINGLE 128x64 image. Both compressed in unLZ.

You'll also need 0x21 bytes of FREE WRAM space.
And an additional 0x400 bytes for the palettes. (Though I've been thinking about using the 0x3000000 area but it get's zeroed out most of the time and the palette loader disabler may spark interest for some.)

Sadly, he never got around to posting the source code and has been inactive since.

This thread is for the research into perhaps recreating what Haru~ had done, making it so that the fanfare doesn't play/is toggleable, and, most importantly, making it so the special doesn't have to end the script.

Alternatively, other methods of displaying tilemaps is open to discussion, as I know that it's something that can be used in thousands of different ways.

 

[Spherical Ice]

I'm just going to bump this thread because I am really interested in this but I'm unsure where to go from here.

 

[Mana1]

I used your previous research in my old hack and it was a great thing to have.

Hacking this further could mean a whole range of features! I think it would be particularly useful for a mail system, or... well anything! I've fallen back into noobiness with hacking lately but I hope you/someone can work out how Haru managed all that!

 

[Spherical Ice]

I just realised that whatever activates mail could possibly be hacked as that routine doesn't play any fanfares. I'm going to look into it a bit more and edit this post later.

Edit:

Okay, here's what I've found:

At 0x000BEEB0 there is a pointer to 0x3EE9C8.

At 0x3EE9C8 is the following:

A0 3E E9 08
20 40 E9 08
2C 52 E9 08
C0 02 00 00
4A 29 39 67

After some research, I discovered the following:

A0 3E E9 08: This is the palette for Orange Mail
20 40 E9 08: This is the tileset for Orange Mail
2C 52 E9 08: This is the tilemap for Orange Mail
C0 02 00 00: I'm really not sure, I've tried replacing it with FF FF FF FF and it has no effect on the display of the mail.
4A 29 39 67: Same as C0 02 00 00.

This pattern continues for each mail item.

C0 3E E9 08: Harbor Mail's Palette
C0 41 E9 08: Harbor Mail's Tileset
04 53 E9 08: Harbor Mail's Tilemap
E0 02 00 00
FF 7F 31 46

The "table" appears to end at 0x3EEAB8.

Maybe we can repoint this table and add new Mail items? I don't actually know how to find out what routine is called when you "Check" a mail item but I think if someone out there knows how we could call that routine and perhaps set a variable to indicate which mail tilemap we want to load.

 

[GoGoJJTech]

Nice find but wouldn't it be a lot easier to edit the special than to find out this whole NEW routine to us (in our eyes at least)? The special table in FR v1.0 is at 0x15FD60
So basically just reference to the 108th spot of the table go to that pointer and debug it with VBA-SDL-H and find out why it plays a fanfare/ends the script. I will try this as well Spherical

 

[Shiny Quagsire]

The fanfare could very easily be removed provided we find the location in which it is called. Just replace the bl <fanfare asm routine> with something like add r0, r0, #0x0 or something to essentially null it out. Obviously, this would remove the fanfare on normal diplomas, but if it's really an issue you can script that in.

 

[Spherical Ice]

Okay, the routine for Special 0x108 is located at 0xF5019. This is the first time I've really done any heavy reverse engineering, so I'm going to ask some questions.

On VBA-SDL-H, I put "bpr 0x080F5019 0xFF", and it worked as I expected and the breakpoint...happened when I activated special 0x108. I then typed n to scroll through the routine, but I'm unsure of what I'm looking for.

I passed a few "bl [something]"s, but I don't really know what to do with them. Could someone with a bit more experience help me out, or give me pointers on what to do to continue?

 

[GoGoJJTech]

Okay, the routine for Special 0x108 is located at 0xF5019. This is the first time I've really done any heavy reverse engineering, so I'm going to ask some questions.

On VBA-SDL-H, I put "bpr 0x080F5019 0xFF", and it worked as I expected and the breakpoint...happened when I activated special 0x108. I then typed n to scroll through the routine, but I'm unsure of what I'm looking for.

I passed a few "bl [something]"s, but I don't really know what to do with them. Could someone with a bit more experience help me out, or give me pointers on what to do to continue?

Ok, I went and changed the bytes at 0x0F509A to 00 00 and it didn't freeze or restart, just played the "sunny day" sound and only the tileset and palette loaded. The tilemap and text didn't appear, but it at least did something. Going further..

EDIT: So I tried all Bl's and B's in the routine and the only one that didn't freeze was the one mentioned.

EDIT2: Well I followed that Bl and there were even more Bl's. Before I nulled out those, I couldn't find anything to do with song 0x104. I might have to null out the Bl's in the Bl...

EDIT3: Well I can't seem to null the playing of the fanfare. Someone else is going to have to do some research as well.

 

[knizz]

write c0 46 c0 46 to 080F4D3E to mute the fanfare during the diploma screen

 

[knizz]

write E1 to 080F4E20 to let the script continue afterwards

 

[knizz]

A0 3E E9 08: This is the palette for Orange Mail
20 40 E9 08: This is the tileset for Orange Mail
2C 52 E9 08: This is the tilemap for Orange Mail
C0 02 00 00: I'm really not sure, I've tried replacing it with FF FF FF FF and it has no effect on the display of the mail.
4A 29 39 67: Same as C0 02 00 00.

C0 02 00 00 seems to be unused.
4A 29 39 67 are two colors that are copied to palette 15 as 10th and 11th entry
also palette 0 has two colors at 10 and 11 which depend on the gender of the player

(not tested, just guessing)

 

[Adke]

I've managed to display correctly the tilemap with the help of Spherical Ice but I could only get it to work in 16 colours.

What should I do to be able to display it in 256 colours?

EDIT: Is there a way to display two tilemaps one after the other? Just duplicating the script with a new value por var 8002 doesn't work correctly. It shows the map eventhough it is not suposed to do it

The tilemap there was just for testing

 

[anxz86]

you can use fadescreen??