PHO - Pokémon Hackers Online
Go Back   PHO - Pokémon Hackers Online > General Chat > Archive

Archive Old threads that serve no purpose are here.

Reply
 
Thread Tools Display Modes
Old 6th July 2013, 02:26 AM   #1
Team Fail
Balance and Ruin
Ex-StaffStyle AdminstratorPHO VIP
 
Team Fail's Avatar
 
Join Date: Jul 2010
Posts: 585
Team Fail Team Fail Team Fail Team Fail Team Fail
Default Crash Bandicoot 2: N-Tranced Hacking Research Thread.

I'm basically gonna copy/paste the main post from PC that I have in a spoiler below:

Spoiler:
So last night I was talking to Darthatron about his VB6 Hex Editing Modules, and that they wouldn't work on VB.NET and that there are better alternatives in VB.NET as well. I then mentioned my idea of making (for now) a Text Editor for this game. He then mentioned he had an interest in wanting to hack this game, as I do too, because I see a lot of potential for fangames. Anyways, I have a little bit of information documented so far, and I just wanted a place where I could get together information and have others contribute to finding info on this game.

Anyways, let's get on to what I do have (And what little there is.)

UnLZ.GBA graphics info (I can't get pallet data because pallets don't load correctly) :
Spoiler:
7- Fog? (IMG 052EDE8)
8- Unknown graphic (IMG 0052EDE8)
10- Unknown graphic (Possibly level parts) (IMG 053156C)
11- BG Parts? (IMG 05351E0)
20- Crash Head (IMG 07D63CB)
21- Crunch Head (IMG 07D6964)
22- Coco Head (IMG 07D64C4)
23- Fake Crash Head (IMG 07D6548)
24- N. Trance Head (IMG 07D65CC)
25- N. Trophy Head (IMG 07D66D4)
26. Uka Uka? Head (Img 07D66D4)
27. Dingodile Head (IMG 07D6754)
28. Tiny Head (IMG 07D67D0)
29. N. Gin Head (IMG 07D685C)
30. Neo Cortex Head (IMG 07D68D8)
31. Left Edge Textbox (IMG 07D6964)
32. Middle Textbox (IMG 07D69FC)
33. Aku Aku talking Textbox Right (IMG 07D6D90)
34. Red Arrow (Right)(IMG 07D6D90)
35. Crunch Menu Head (IMG 07D7B24)
36. Part of Left Arrow? (IMG 07DB660)
37. Part of Right Arrow? (IMG 07DB69C)
38. Small Game Font (IMG 052A9BC)
42. Crash Menu Head (IMG 07D79E0)
43. ? Crate (IMG 07D7DE4)
44. Crown (IMG 07D7F64)
45. Flag (IMG 07D8060)
46. KO (IMG 07D811C)


Text Information
All text displayed in the game is stored in standard ASCII, making it easy to modify.

Regional Differences contribute to slightly different offsets for the text in each region.
Spoiler:
At 0x001D153C begins all of the English text, going through 0x001D3984. (EUR & US)

At 0x001D3C94 begins all of the French text, going through 0x001D5C1F. (EUR)

At 0x001D5F30 begins all of the German text, going through 0x001D7F4F. (EUR)

At 0x001D8260 begins all of the Spanish text, going through 0x001DA157. (EUR)

At 0x001DA468 begins all of the Italian text, going through 0x001DC443. (EUR)

Finally, at 0x001DC754 begins all of the Dutch text, going through 0x001DE72F. (EUR)


It seems there is also the ability to format text too.
Spoiler:
Value - Color - Usage
0x00 - None - None
0x01 - Orange - Used for normal stuff
0x02 - White/None - Not used?
0x03 - Green - Used for names


Other tidbits of Text info:
Spoiler:
Pointers to in-game text (All of them are 0x310 bytes in length)
English: 0x001D3984
French: 0x001D5C20
German: 0x001D7F50
Spanish: 0x001DA158
Italian: 0x001DC444
Dutch: 0x001DE730

Table Layout:
No. - Meaning - Use

0 - Pointer to "press start" - Titlescreen
1 - Pointer to "new game" - Main menu
2 - Pointer to "load game" - Main menu
3 - Pointer to "link game" - Main menu
4 - Pointer to "credits" - Main menu
5 - Pointer to "atlasphere" - Link Game sub-menu
6 - Pointer to "link race" - Link Game sub-menu
7 - Pointer to "back" - Link Game sub-menu
...
195 - Pointer to "use <#> to brake..." - Controls for..? - Last entry

-00 00 ends the text, but MAY require 00 00 00 00



Regional Differences
  • The EUR version of the game has a language select, the USA version does not.
  • There are graphical differences, and encoding differences for the JAP releases.

RAM
Offset - Purpose
02000010 to 02000014 - Timer? (Goes up by one each frame)
02000018 to 0200001C - Key state
Spoiler:

Values
> 0000FC00 - Nothing
> 0000FC01 - A button
> 0000FC02 - B button
> 0000FC04 - Select
> 0000FC08 - Start
> 0000FC20 - Left
> 0000FC10 - Right
> 0000FC40 - Up
> 0000FC80 - Down
> 0000FD00 - R button
> 0000FE00 - L button

020001CC to 020001D0 - Another timer?
02000E54 to 02000E5B - Player's sprite frame
02000E5C to 02000E60 - Altitude of player. All extra will be F if A is pressed, or 0 is not.
Spoiler:

For example, if the player is jumping, and his altitude is 23A, it would look like this: 0000023A.
However, if the A button is being pressed, if would look like this: FFFFF23A.


Now, I want to also figure out how levels are stored in the game (All three kinds: 2D sidescrolling, isometric atlasphere levels, and Mode 7 wakeboarding and Space Coco levels), where the graphics are, and how time trial relic data is stored, as well as gem shard data, and how we can edit all of it. Last thing I want to do is music as the game doesn't use the standard Sappy engine most GBA games do. Any input and other research you all do is welcomed too because I don't think I can do all of the research, especially ASM. :3

CURRENTLY-KNOWN DEBUGGING FEATURES
Right as of now, we know of:
  • Song Test (Unknownfile - HCS Forum)
  • Speed increaser (Team Fail - PC)
Due to the fact that these two debugging options exist, that means there must be more within the game's code. Help us find it and be credited!

Lastly, now that people want to contribute, I want to provide my thanks to Darthatron for showing interest in this unloved game, and agentgeo for providing some more information.


And the rest can be found here: http://www.pokecommunity.com/showthread.php?p=7713224 (Too lazy to copy, paste, and update all that information).

Anyways, the most important information that needs the most attention is below:
-----------------------
Sooo super awesome bump that actually has useful info.

So I found this post by ipatix that contains a program that generates a list of offsets for sound tables. I used it on the U version of the game and it gave me the following offsets. I plan to look at it soon and see if I can make heads and tails of the GAX sound engine. Although, with limited time, anyone can look at it if they wish. Now, on to the tables' offsets!

AC8E:
No 01: 2A3684
No 02: 216934
No 03: 211BA0
No 04: 21430C
No 05: 2A9684
No 06: 263990
No 07: 29E7A0
No 08: 2A5278
No 09: 7FC150
No 10: 261320

Major important edit:

So, I was looking on the interwebs to find a music rip of this game, and I came across a jewel of information that could be unused content within the game.
Quote:
-Crash Bandicoot 2 N-Tranced - There is a song test feature that can be accessed when the Current Level identifier is hacked. I might consider using a savestate for the GSFLib. (That's your cue to add state support.)
Source - HCS Forums

My next question, is what is this level identifier? I presume it's something in the RAM, but I'll have to look deeper and find out.

Edit: (U VERSION ONLY) If you pop open a memory viewer and go to 0x0200014 (or rom offset 0x007FBD18) and change it to a non-zero value, you'll enable a hidden debug option still in the game. I'm not gonna say what it is, but I plan to add it onto TCRF at some point soon.

Edit: mehhh I'll spill what this does. When that byte is set to a non-zero value, it doubles the speed of the game. However, audio remains at 1x speed. It'd probably have been binded to a button combo or debugger menu option so that it could be enabled/disabled at will to speed up slow parts of the game, like the intro or credits.

(Gameshark SP/Codebreaker code E99B8028 EC01 will also activate this unused feature. Works on hardware as well.)

Edit: Level identifiers by hex! Identifiers: 02002744:XX 03007DA8:XX, credits to Einstein95 on TCRF for finding this.

00 - Island Intro (Level 1)
01 - Prints of Persia (Level 2)
02 - Lagoony Tunes (Level 3)
03 - Globe Trottin' (Level 4)
04 - Pharaoh's Funhouse (Level 5)
05 - Runaway Rug (Level 6)
06 - Tiki Torture (Level 7)
07 - Hoppin' Coffins (Level 8)
08 - Barrel Roll (Level 9)
09 - Flockful of Seagulls (Level 10)
0A - Magma Mania (Level 11)
0B - Run From The Sun (Level 12)
0C - Now It's Istanbul (Level 13)
0D - Mister Lava Lava (Level 14)
0E - Water Logged (Level 15)
0F - Slip-N-Slidin' Sphinx (Level 16)
10 - Rocks Can Roll (Level 17)
11 - Rock The Casaba (Level 18)
12 - Eruption Disruption (Level 19)
13 - Spaced Out (Level 20)
14 - King Too Uncommon (Level 21)
15 - Wild Nile Ride (Level 22)
16 - 101 Arabian Kites (Level 23)
17 - Fire Walker (Level 24)
18 - Evil Crunch (No level number)
19 - Evil Coco (No level number)
1A - Fake Crash (No level number)
1B - N. Trance (No level number)
1C - N. Tropy (No level number)

Notice anything? Yes, the level numbers are the hex equivalents. That's how the game draws the level numbers. Also, I don't know if there's any unused levels in there yet, all I've done is up to 1C. I don't know where the bonus levels are identified at.

And while I'm at it, I'm documenting some of these things on TCRF as well. http://tcrf.net/Crash_Bandicoot_2:_N-Tranced

Also, going along theory, I think that there is not only a current level identifier, but a current map identifier because of the bonus levels, and the fact that they need to be loaded as well. I want to see if I can find this as well.
-------------------
And as mentioned, I have started a TCRF page on this game: http://tcrf.net/Crash_Bandicoot_2:_N-Tranced If you find anything of interest, be sure to add it if it is relevant (Like, unused content, debugging features...)
__________________
twitter | dropbox | youtube | bro

Thank you for your time, PHO. I won't soon forget it.
Team Fail is offline   Reply With Quote
Sponsored Links
Old 10th July 2013, 05:02 AM   #2
Pirate Ninja
P l a y t h e f i e l d
 
Pirate Ninja's Avatar
 
Join Date: Jul 2013
Location: The seas
Age: 21
Posts: 50
Pirate Ninja
Default

Not any progress but on my behalf it is, I managed to repoint the "PRESS START" and make it bigger and more cheesy. Apparently, all the letters shouldn't be in caps or else problems may occur, since the default text doesn't have ANY capitalisation.

Oh, see for yourself.



(The pointers work just like the Pokémon GBA ones! Yey!)
Pirate Ninja is offline   Reply With Quote
Old 10th July 2013, 05:05 AM   #3
droomph
握りモンスター
Ex-StaffPHO VIP
 
droomph's Avatar
 
Join Date: Apr 2012
Location: maybe.
Age: 20
Posts: 439
droomph
Default

Quote:
Originally Posted by Pirate Ninja View Post
Not any progress but on my behalf it is, I managed to repoint the "PRESS START" and make it bigger and more cheesy. Apparently, all the letters shouldn't be in caps or else problems may occur, since the default text doesn't have ANY capitalisation.

Oh, see for yourself.



(The pointers work just like the Pokémon GBA ones! Yey!)
lol don't they all work the same on the GBA
__________________
droomph is offline   Reply With Quote
Old 10th July 2013, 05:07 AM   #4
Pirate Ninja
P l a y t h e f i e l d
 
Pirate Ninja's Avatar
 
Join Date: Jul 2013
Location: The seas
Age: 21
Posts: 50
Pirate Ninja
Default

Quote:
Originally Posted by droomph View Post
lol don't they all work the same on the GBA
Pretty sure, but you can never know, can you?
Pirate Ninja is offline   Reply With Quote
Old 10th July 2013, 05:17 AM   #5
droomph
握りモンスター
Ex-StaffPHO VIP
 
droomph's Avatar
 
Join Date: Apr 2012
Location: maybe.
Age: 20
Posts: 439
droomph
Default

Quote:
Originally Posted by Pirate Ninja View Post
Pretty sure, but you can never know, can you?
well you're really using the same hardware so all the programming should be the same.
__________________
droomph is offline   Reply With Quote
Old 10th July 2013, 06:08 AM   #6
Pirate Ninja
P l a y t h e f i e l d
 
Pirate Ninja's Avatar
 
Join Date: Jul 2013
Location: The seas
Age: 21
Posts: 50
Pirate Ninja
Default

Quote:
Originally Posted by droomph View Post
well you're really using the same hardware so all the programming should be the same.
I guess so. Mebbe we can find more of this

Anyway, how does the map work?
I want to go deeper into getting the tiles changed.
The VBA Map Viewer showed me this:



And the second overlaying bg was the sky tiles. So the land tiles have a Priority 2 and the sky has Priority 3 (I guess).
The next two bgs... didn't get much (possibly RAM related?) but they too have assigned priorities. And the second one is pure pink.

Last edited by Pirate Ninja; 10th July 2013 at 06:14 AM.
Pirate Ninja is offline   Reply With Quote
Old 10th July 2013, 03:59 PM   #7
Team Fail
Balance and Ruin
Ex-StaffStyle AdminstratorPHO VIP
 
Team Fail's Avatar
 
Join Date: Jul 2010
Posts: 585
Team Fail Team Fail Team Fail Team Fail Team Fail
Default

Quote:
Originally Posted by Pirate Ninja View Post
Not any progress but on my behalf it is, I managed to repoint the "PRESS START" and make it bigger and more cheesy. Apparently, all the letters shouldn't be in caps or else problems may occur, since the default text doesn't have ANY capitalisation.

Oh, see for yourself.



(The pointers work just like the Pokémon GBA ones! Yey!)
The one thing I'm curious about is how you did it. Did you go in the location of the text and create a pointer to free space, or did you locate the text table pointers that agentgeo found and use that? Also, what version of the game are you using? U or E?

As for level formats, I know there's an area near the end of the WRAM that is all zerobytes until a level is loaded, then level layouts are loaded there. What's odd, is that if you exit the level, the layout remains loaded there until you choose another level, then it's overwritten.
__________________
twitter | dropbox | youtube | bro

Thank you for your time, PHO. I won't soon forget it.

Last edited by Team Fail; 10th July 2013 at 04:10 PM.
Team Fail is offline   Reply With Quote
Old 10th July 2013, 10:35 PM   #8
droomph
握りモンスター
Ex-StaffPHO VIP
 
droomph's Avatar
 
Join Date: Apr 2012
Location: maybe.
Age: 20
Posts: 439
droomph
Default

Quote:
Originally Posted by Team Fail View Post
What's odd, is that if you exit the level, the layout remains loaded there until you choose another level, then it's overwritten.
why is it odd? Maybe there just isn't a use for that space otherwise…and besides, if you were to clear that section up, it would take around a frame (200k instructions) to free that up where you could be loading the target map, so clearing up isn't a priority if you're not even going to use that area…
__________________
droomph is offline   Reply With Quote
Old 11th July 2013, 03:36 AM   #9
Pirate Ninja
P l a y t h e f i e l d
 
Pirate Ninja's Avatar
 
Join Date: Jul 2013
Location: The seas
Age: 21
Posts: 50
Pirate Ninja
Default

Quote:
Originally Posted by Team Fail View Post
The one thing I'm curious about is how you did it. Did you go in the location of the text and create a pointer to free space, or did you locate the text table pointers that agentgeo found and use that? Also, what version of the game are you using? U or E?

As for level formats, I know there's an area near the end of the WRAM that is all zerobytes until a level is loaded, then level layouts are loaded there. What's odd, is that if you exit the level, the layout remains loaded there until you choose another level, then it's overwritten.
I found the table apparently by myself, since the ANSII encoding is without any encryption. And yes, I repointed the first pointer leading to the first offset somewhere at the bottom. This game is probably packed tight, with very little FS. We might have to expand it for further hacking.

And I suppose the RAM can handle two layouts at a time, and the developers thought the layout refresher was redundant since this doesn't affect the gameplay.
Pirate Ninja is offline   Reply With Quote
Old 13th August 2014, 06:53 AM   #10
Team Fail
Balance and Ruin
Ex-StaffStyle AdminstratorPHO VIP
 
Team Fail's Avatar
 
Join Date: Jul 2010
Posts: 585
Team Fail Team Fail Team Fail Team Fail Team Fail
Default

Anyways, regardless of that spambot post, feel free to look back on the PC thread, I've gotten a boatload of information on the audio engine in the last post.
__________________
twitter | dropbox | youtube | bro

Thank you for your time, PHO. I won't soon forget it.
Team Fail is offline   Reply With Quote
Reply

Tags
bandicoot, crash, hacking, ntranced, research, thread, [Ongoing]

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 02:04 PM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2017, vBulletin Solutions, Inc. User Alert System provided by Advanced User Tagging (Lite) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.
Feedback Buttons provided by Advanced Post Thanks / Like (Lite) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.
Pokémon characters and images belong to Pokémon USA, Inc. and Nintendo.
Pokémon Hackers Online (PHO) is in no way affiliated with or endorsed by Nintendo LLC, Creatures, GAMEFREAK inc,
The Pokémon Company, Pokémon USA, Inc., The Pokémon Company International, or Wizards of the Coast.
All forum/site content (unless noted otherwise) and site designs are © 2006-2013 Pokémon Hackers Online (PHO).
Green Charizard Christos TreeckoLv100

"Black 2" by ARTPOP. Kyurem artwork by XOUS.

no new posts