Twilight Princess and Skyward Sword hacking thread.

[Armos]

So I was thinking around and maybe I should say what the heck and start a Twilight Princess and Skyward Sword hacking Thread since there's already a Wind Waker hacking thread, do you think it's possible? Please post your thoughts. Or any information you've found in Twilight Princess or Skyward Sword. I noticed in Skyward Sword around youtube that someone made a code that you can see Gaepora bathing in the bathtub. "Pukes" But I don't know where to find the code. Also some other code for Twilight Princess on the gamecube where you can enter the mysterious "beta forest" so I was wondering what your thoughts on this, please share some information. This sounds really interesting since we have some hackers/modders already modding Wind Waker.

 

EDIT: I think I've found the video, Here is Gaepora taking a shower, I give the user some credit because I don't like stealing other peoples information.

 

Gaepora taking a shower.

 

http://www.youtube.c...ed/2dhY9gjG-is

 

"Beta Forest" "Used with cheats"

 

http://www.youtube.c...ed/M-OIRFMTCNM

 

As I said before, I didn't make the video, I just wanted to show you some thoughts.

[xdaniel]

GCN TP is pretty similar to WW - in fact, Wind Viewer can be used to load and view its maps, although I don't think I've tried editing them; it should work, tho. Collision is in a different format in TP (KCL, I think), some chunks in the stage and room files differ, but they're still pretty close.

 

SS on the other hand is a whole different beast, and I don't know much about it. There's some stuff going on ex. over on Unseen64's forums, with simple custom maps and stuff even, but AFAIK they don't even understand actors and other Zelda-specific stuff yet, and so far have relied on file format similarities between SS and other Wii games and just used Brawl Box (or whatever it's called).

[Conker]

That first video is, well... interesting, and awkward. Love it.

 

The second one, on the other hand, is not the beta forest.

Even says so in the description.

[Armos]

That first video is, well... interesting, and awkward. Love it.

 

The second one, on the other hand, is not the beta forest.

Even says so in the description.

 

Yeah, that's why I put the quote marks in my sentence. It is still cool though. I've also seen some glitches of Wind Waker and Skyward Sword called the "Back in Time" glitch. You should check it out when you get the chance.

[Zeth Ryder]

Anything we did Skyward Sword hacking wise started here:

http://www.the-gcn.com/topic/847-skyward-sword-demo-leaked/page__hl__demo

[xdaniel]

Anything we did Skyward Sword hacking wise started here:

http://www.the-gcn.c.../page__hl__demo

 

Oh yeah, totally forgot about the demo

[Zeth Ryder]

Oh yeah, totally forgot about the demo

 

It was hacking that demo we figured it could be easily applied to SS's full game! :3

[Jason777]

Here's one thread that displays alot of hacks for SS: http://forum.unseen64.net/viewtopic.php?f=2&t=3051

[Antidote]

It's funny you link that thread. I'm actually the creator of the SS Save Editor, and I'd be more than willing to delve into BOTH games. As a few people on kbfail.net's #zfgc know, i love documenting obscure formats :3

[Antidote]

Well I've been reverse engineering the Save format for Skyward Sword over the past year, and in that time I've also put some effort into a few of the other files, one of them being the zev.dat file that accompanies each room in the game, I've only figured out the primary structure of it and haven't actually decompiled the routines responsible for dealing with it, but it's a start.

 

Here it is:

//--------------------------------------
//--- 010 Editor v4.0.2 Binary Template
//
// File:
// Author:
// Revision:
// Purpose:
//--------------------------------------


struct Entry
{
    char name[0x20];
    short unk[4];
};

struct Entry2
{
    char name[0x12];
    short unk[5];
};

struct Entry3
{
    char name[0x04];
    short unk[4];
};

struct ZEV
{
    short magic;
    short section1Count;
    short section2Count;
    short section3Count;
    short section4Count;
    short section5Count;
    short unk; // This appears to be static
    short section6Count;
    short section7Count;
    short section8Count;
    Entry entries1[section1Count];
    Entry entries2[section2Count];
    Entry2 entries3[section3Count];
    Entry3 entries4[section4Count];
    Entry3 entries5[section5Count];
    int unkArray[section6Count];
    int unkArray2[section7Count];
    char unkArray3[section8Count];
}file;

[Conker]

Okay, now that I've moved this here:

Nice work on that, Antidote!

 

This is a great start, no doubt.

[Antidote]

Thanks, I'm working on the bzs files right now, and the format seems pretty simple structurally.

[Conker]

Very nice. Good luck!

[Antidote]

Don't know if anyone figured this out yet, but Twilight princess uses KCL for collision. Forest Temple collision for proof:

https://dl.dropbox.c...stTempleKCL.png

 

I decoded it to obj with wiimm's wkclt utility, so proof that KCL predates MKW >:3

[xdaniel]

Don't know if anyone figured this out yet, but Twilight princess uses KCL for collision. Forest Temple collision for proof:

https://dl.dropbox.c...stTempleKCL.png

 

I decoded it to obj with wiimm's wkclt utility, so proof that KCL predates MKW >:3

 

Yup, was known: http://www.the-gcn.com/topic/721-wind-waker-hacking-thread/page__st__40?do=findComment&comment=12234 - Also, considering the similarities between WW and TP (at least the GCN version), that thread might be interesting in general.

[Antidote]

Ah, well it's still useful to know.

[Airikita]

I would be interesting in actor AI hacking for TP, but I am looking for map data if anyone knows where I can find it in the ROM? I need to see what the actor data is like in TP to understand how to work something out.

[Antidote]

Actor data in Twilight princess is handled by two or three separate files, one is a PLC file which i'm working on right now.

If you're looking for logic then you need to look no further than the REL files located in /rel/<entity_name>.rel, the entities go by their Japanese names for obvious reasons.

 

You can also use the model names to some extent as well.

 

EDIT: Been working on this little puppy, it's by no means complete but it's starting to shape up.

You only need 010 Hex Editor and an STB file from Skyward Sword, WW or TP and it should work fine.

It seems to work on all files but there may be a few that don't work.

 

 //--------------------------------------//--- 010 Editor v4.0.4 Binary Template//// File:// Author:// Revision:// Purpose://-------------------------------------- BigEndian();  struct vec3{    float x;    float y;    float z;}; struct Node{    int dataLen;    union    {        struct        {            char magic[4];            if (magic == "JFVB") // Vertex buffer?            {                char magic2[4];                short BOM <format = hex>;                short unk;                int dataLen;                vec3 coords[(dataLen / (sizeof(float)*3)) - 1];            }             else if (magic == "JACT")            {                int strLen;                char str[(strLen + 3) & ~3];            }            else if (magic == "JPTC")            {                int strLen;                char str[(strLen + 3) & ~3];                ushort unk;                ushort unk;                uchar unk;                //short len;                uchar len;                ushort unk;                char data[(len + 3) & ~3];                short len1;                short unk;                char data2[(len1 + 3) & ~3];            }            else if (magic == "JCMR") // Camera            {                int nameLen;                char cameraName[(nameLen + 3) & ~3];                int unk1;                short unk2;                short unk3;                                struct                {                    short cmd1 <format = hex>;                    short cmd2 <format = hex>;                    switch (cmd1)                    {                        case 0x0004:                        {                            switch (cmd2)                            {                                case 0x04C2:                                    float camRot;                                    break;                                case 0x04D2:                                    int fvbIndex;                                    break;                                case 0x04E2:                                    float fov;                                    break;                                case 0x04F2:                                    int fvbStartIndex;                                    break;                            }                        }                        break;                        case 0x000C:                        {                            switch (cmd2)                            {                                case 0x0302:                                case 0x0308:                                    vec3 camPos;                                    break;                                case 0x0312:                                case 0x0392:                                    int fvbIndex[3];                            }                        }                        break;                    }                } commands [unk] <optimize = false>;            }        } nodeData <optimize = false>;        char data[dataLen - 4];    }crap <optimize = false>;;}; struct JStudio{    char magic[8];    int unk;    int unk; // Node Type?    Node nodes[file.numNodes] <optimize=false>;}; struct STBFile{    char magic[4]; // 'STB0'    short BOM <format = hex>;    short unk; // version?    int dataLength;    int numNodes;    JStudio jstudioData;}file;

[Antidote]

Go home Link, you're drunk

[Arcaith]

Fix'd your youtube tags; you only need to post the video ID between the tags, in this case LnBLKehFkyo.

[Antidote]

Thanks it was late when i posted XD

[Antidote]

https://code.google.com/p/skyward-sword-save-editor/source/browse/trunk/save+editor/SkywardSword+Save.bt

It's nearly complete, I could use some help finishing the documentation project, and once everything is done here I can do my rewrite of Wiiking2 Editor finally

[Antidote]

Not exactly hacking related, but it IS related to LOZ:SS, it's my widget for my save editor (so it DOES have something to do with hacking)

Code:

http://pastebin.com/kQb4nFs7

Just hoping you guys can give any critiques or ideas to improve upon it