SoulofDeity Posted April 7, 2013 Share Posted April 7, 2013 These are the notes I've been taking for OoT 1.0 (U), be it assembly hacking, rom poking, reverse engineering gameshark code, porting debug rom stuff, etc. It still a work in progress, but I hope it helps some of you people out there who don't like working with the debug rom Terms and Definitions##########################################################################* All hexadecimal values are big endian* binary values are prefixed with % eg. %00000101 is binary for 5* hexadecimal values are prefixed with $ eg. $10 is 16* decimal values either have no prefix or are prefixed with # eg. 5 or #5 is 5* groups of bytes that are the same value types are surrounded by brackets with a type prefix. eg. %{00000000 00000010 00000101} would be 3 binary values #{0, 1, 5} would be 3 decimal values ${00 01 05} would be 3 hexadecimal valuesBYTE = 1 byte = 8 bits = $00 - $FFHALFWORD = 2 bytes = 16 bits = $0000 - $FFFFWORD = 4 bytes = 32 bits = $00000000 - $FFFFFFFFSegments---------------------------------------------------------------- $00 code $01 code (same as $00) $02 current scene $03 current map $04 gameplay keep $05 field keep / dungeon keep $06 current object $07 link animation $08 texture bank 1 $09 texture bank 2 $0A ??? $0B ??? $0C actor bank $0D limb matrices $0E ??? $0F ???ROM STUFF##########################################################################$00F03000 - $00F5ECE0 gameplay_keep.zdata$00F5F000 - $00F6C330 gameplay_field_keep.zdata$00F6D000 - $00F84AF0 gameplay_dangeon_keep.zdata$00F86000 - $00FBD800 object_link_boy.zobj$00FBE000 - $00FEAF80 object_link_child.zobj$00A87000 - $00B8AD30 code.zasm Offset Size Description---------------------------------------------------------------- $00045E20 write the following data here to force game to check for all 6 medallions [UNTESTED: PORTED FROM DBG ROM] ${ 8E0200A4 3049003F 392A003F 1540001A } ${ 00000000 00000000 00000000 00000000 } $00045F9E 2 $0000 = create normal files, $0001 = create 64dd files [DO NOT USE. IT'S A BROKEN FUNCTION, WILL CRASH GAME] $0007F01A 2 default water temple water level $0007FBAE 2 intro custscene exit number $0007FBB3 2 start as $01=child link, $00=adult link $0007FBBA 2 intro cutscene number $FFF? or $0000 (no cutscene) $000D7184 4 navi normal color $000D7194 4 navi npc color $000D719C 4 navi enemy color $000D71A4 4 navi sign color $000D71AC 4 navi checkable color $000D71BC 4 navi boss color $000D7530 actor table $000DEC64 cutscene table Entry Format: ${ee ee ff ff oo oo oo oo} e = entrance index f = flags o = pointer to cutscene $000E64DC 2 green rupee value $000E64DE 2 blue rupee value $000E64E0 2 red rupee value $000E64E2 2 purple rupee value $000E64E4 2 orange rupee value $000E6A38 3 kokiri tunic color $000E6A3B 3 goron tunic color $000E6A3E 3 zora tunic color $000E7C2E 2 small quiver capacity $000E7C30 2 medium quiver capacity $000E7C32 2 large quiver capacity $000E7C36 2 small bomb bag capacity $000E7C38 2 medium bomb bag capacity $000E7C3A 2 large bomb bag capacity $000E7C4C 2 child wallet capacity $000E7C4E 2 adult wallet capacity $000E7C50 2 giant wallet capacity $000E7C56 2 small deku seed bag capacity $000E7C58 2 medium deku seed bag capacity $000E7C5A 2 large deku seed bag capacity $000E7C5E 2 small deku stick capacity $000E7C60 2 medium deku stick capacity $000E7C62 2 large deku stick capacity $000E7C66 2 small deku nut capacity $000E7C68 2 medium deku nut capacity $000E7C6A 2 large deku nut capacity $000E7F58 object table $000EA440 scene table$00BB11E0 - $00BCDB70 ovl_kaleido_scope.zactor Offset Size Description---------------------------------------------------------------- $000165B4 item selectable table $000165DC item icon mode table$00BCDB70 - $00BF40D0 ovl_player_actor.zactor---------------------------------------------------------------- $000004E0 4 link's voice changer. value is ${34 18 ?? ??} $0000 - $001F adult link $0020 - $003F young link with some adult link sounds $0043 - $004F navi $0050 - $0053 talon $0054 - $0057 ingo $0058 - $0059 great fairy $005A - $0066 ruto with some navi sounds $0067 - $0068 cursed skulltalla person $0069 - $006E young zelda $006F - $0074 shiek with some navi sounds $0075 - $0079 adult zelda $007A - $007A king zora $00015C12 2 player state %{00000000 0000t0c0} t - is z-targetting c - is falling if you enable t at the same time as c, link swaps between falling and standing every frame, which has the neat effect of letting you walk through walls, and pressing 'z' will make you fall through the floor. $00018A54 8 force link to be ${3C 0E 00 00 25 CE ?? ??} $0000 - adult $0001 - child$00DD1A00 - $00DD34B0 ovl_Obj_Oshihiki.zactor Offset Size Description---------------------------------------------------------------- $00001186 2 block pushing speed $000011CE 2 block pushing distance $00001326 2 block pushing delayRAM STUFF##########################################################################Important Addresses---------------------------------------------------------------- $800110A0 code $8011A5D0 savedata $8011DC44 ??? [possible memory pool for alloc] $80120C38 segment tableFunctions---------------------------------------------------------------- $80003BCC Used as a delay, called continously throughout the entire game. <HOOKABLE> $80002E80 DMA Transfer Arguments: a0=ramAddr, a1=romAddr, a2=sizeVariables----------------------------------------------------------------; miscellaneous$8005703C create file type $0000 = normal HALFWORD $0001 = 64DD$800900BC default waterlevel for water temple HALFWORD; savestate stuff$8011A600 health (20*16) HALFWORD$8011A5FE max health (20*16) HALFWORD$8011A605 number of rupees HALFWORD$8011A6A1 skulltulas killed BYTE$8011A699 number of small keys BYTE; item slots$8011A644 item slot 0 (default:deku sticks) BYTE$8011A645 item slot 1 (default:deku nuts) BYTE$8011A646 item slot 2 (default:bombs) BYTE$8011A647 item slot 3 (default:fairy bow) BYTE$8011A648 item slot 4 (default:fire arrow) BYTE$8011A649 item slot 5 (default:din's fire) BYTE$8011A64A item slot 6 (default:fairy slingshot) BYTE$8011A64B item slot 7 (default:ocarina) BYTE$8011A64C item slot 8 (default:bombchus) BYTE$8011A64D item slot 9 (default:hookshot) BYTE$8011A64E item slot 10 (default:ice arrow) BYTE$8011A64F item slot 11 (default:farore's wind) BYTE$8011A650 item slot 12 (default:boomerang) BYTE$8011A651 item slot 13 (default:lens of truth) BYTE$8011A652 item slot 14 (default:magic beans) BYTE$8011A653 item slot 15 (default:megaton hammer) BYTE$8011A654 item slot 16 (default:light arrow) BYTE$8011A655 item slot 17 (default:nayru's love) BYTE$8011A656 item slot 18 (default:bottle 1) BYTE$8011A657 item slot 19 (default:bottle 2) BYTE$8011A658 item slot 20 (default:bottle 3) BYTE$8011A659 item slot 21 (default:bottle 4) BYTE$8011A65A item slot 22 (default:adult trade item) BYTE$8011A65B item slot 23 (default:child trade item) BYTE; ammmunition$8011A65C deku stick ammo BYTE$8011A65D deku nut ammo BYTE$8011A65E bomb ammo BYTE$8011A65F arrow ammo BYTE$8011A662 slingshot ammo BYTE$8011A664 bombchu ammo BYTE$8011A66A number of magic beans BYTE; controller$801C84B4 control pad %{abzstgfh 00qwikjl} HALFWORD a = a button b = b button z = z trigger s = start button q = l trigger w = r trigger t = d-up button g = d-down button f = d-left button h = d-right button i = c-up button k = c-down button j = c-left button l = c-right button$801C84B6 analog stick x-axis BYTE$801C84B7 analog stick y-axis BYTEItem Slot Values----------------------------------------------------------------$00 deku sticks $01 deku nuts $02 bombs$03 fairy bow $04 fire arrow $05 din's fire$06 fairy slingshot $07 fairy ocarina $08 ocarina of time$09 bombchus $0A hookshot $0B longshot$0C ice arrow $0D farore's wind $0E boomerang$0F lens of truth $10 magic beans $11 megaton hammer$12 light arrow $13 nayru's love $14 empty bottle$15 red potion $16 green potion $17 blue potion$18 fairy $19 fish $1A full lon lon milk$1B ruto's letter $1C blue flame $1D bugs$1E big poe $1F half lon lon milk $20 poe$21 weird egg $22 chicken $23 zelda's letter$24 keaton mask $25 skull mask $26 spooky mask$27 bunny hood $28 goron mask $29 zora mask$2A gerudo mask $2B mask of truth $2C sold out$2D pocket egg $2E pocket cucco $2F cojiro$30 odd mushroom $31 odd potion $32 poacher saw$33 broken goron sword $34 prescription $35 eyeball frog$36 eye drops $37 claim check $38 powered fire arrow$39 powered ice arrow $3A powered light arrow $3B kokiri sword$3C master sword $3D giant's knife $3E deku shield$3F hylian shield $40 mirror shield $41 kokiri tunic$42 goron tunic $43 zora tunic $44 kokiri boots$45 iron boots $46 hover boots $47 small bullet bag$48 medium bullet bag $49 large bullet bag $4A small quiver$4B medium quiver $4C large quiver $4D small bomb bag$4E medium bomb bag $4F large bomb bag $50 goron bracelet$51 silver gauntlets $52 golden gauntlets $53 silver scale$54 golden scale $55 broken giants knife $56 adult wallet$57 giant wallet $58 deku seeds $59 fishing rod 4 Link to comment Share on other sites More sharing options...
mzxrules Posted April 8, 2013 Share Posted April 8, 2013 This is some good stuff. Some things...8011A5D0 ram is the start position of the save data (which is where all of the stuff in your variables section is located). I posted some notes on it on the wiki here. I also have a table somewhere on ZeldaSpeedRuns which documents the perm scene flags in relation to v1.0. Aside from the different internal character set between PAL and NTSC, the save data has the same structure between versions. In the Code file there should be some code that sets the Water Temple's default water level to 3 when creating a new file. Specifically, it writes a half word (at least it's a half word in the Debug version) of 4000h to 8011A734. Can you find that?    $0007F31E  2  intro cutscene exit number Why do you call an entrance an exit? Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 8, 2013 Author Share Posted April 8, 2013 This is some good stuff. Some things...  8011A5D0 ram is the start position of the save data (which is where all of the stuff in your variables section is located). I posted some notes on it on the wiki here. I also have a table somewhere on ZeldaSpeedRuns which documents the perm scene flags in relation to v1.0. Aside from the different internal character set between PAL and NTSC, the save data has the same structure between versions.  In the Code file there should be some code that sets the Water Temple's default water level to 3 when creating a new file. Specifically, it writes a half word (at least it's a half word in the Debug version) of 4000h to 8011A734. Can you find that?  Why do you call an entrance an exit?  I'll have a go at it   I call the entrance an exit because that's what it is; an entry in the exit table Link to comment Share on other sites More sharing options...
mzxrules Posted April 8, 2013 Share Posted April 8, 2013 but it's not a table of exits. An entry does not store enough information to define a unique exit point. Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 8, 2013 Author Share Posted April 8, 2013 I don't work much with maps anyway, that's just what my understanding of it was  btw, found it.  0x800900BC  in ram is the halfword default waterlevel. I can try to find it in the rom too, but it might take a while  EDIT: nope, evidently not. found it quick. 0x00B0601A  EDIT #2: yep, I changed the value to 0x2000, started a new game, made a dart for the water temple. it started off with the water on the second floor instead of the third.   ---------------------------------  EDIT #3: just wanted everyone to know I updated the first post with these new values and the extra offsets mzxrules mentioned. plus, I did a little digging and found out I was using the wrong pointers for the intro scene changing stuff and fixed it. also added the value used to change whether you start as adult link or child link Link to comment Share on other sites More sharing options...
spinout Posted April 8, 2013 Share Posted April 8, 2013 This is wonderful information. Some of it isn't even available for MQ debug. If the authors are cool with it it should go up on the wiki. Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 8, 2013 Author Share Posted April 8, 2013 This is wonderful information. Some of it isn't even available for MQ debug. If the authors are cool with it it should go up on the wiki.  thanks I've been blowing my brains out the past 2 hours tho. I noticed the savestate doc. on the wiki said there was a field that stated whether or not the file was a 64DD save, so I tried locating where the value was at in ram. I was hoping to trace it back to the rom and make a patch that makes all files be created as 64DD saves, but I honestly just can't find it... I mean, I've found 4 areas in memory that contain save data; the first 3 only being active at the file menu, and you can edit the player name and whatnot in one of them. I tried changing all of the 0x00 bytes within 0x30 bytes of it to 0x01 since the wiki said changing it to 1 flags it as a 64DD save, but I didn't see any visual change (am I wrong in believing a DISK tag should appear?) The fourth pointer appears in game, changing 0x8011A602 to 0x01 makes a little '0' appear under the player health. I'm honestly not sure if it's the timer or that field for the 64DD that I've found. I'm leaning towards the timer, but there's no icon, just the number '0'...   EDIT: - I moved the pointers for the actor/object/scene tables to be relative to the start of code.zasm since that's where they're at  --------------------  ~~progress~~ I found a gameshark code to enable the 64dd file on the debug rom, so I decided to take a step back and try to reverse engine the gameshark code; and managed to succeed to getting a rom value   changing the 2 bytes at 0x00AE05CE will make all files be created as 64dd files. back to trying to figure this out on 1.0 (U) again ---------------------  lulz,  I found it,  0x00ACCF9E  (0x00045F9E in code.zasm), however you can't use it. it's a broken function. changing the value to 0x0001 will crash the game  *hangon* I think it might have been something else. the ram address is $8005703C, if you write $0001 there and create a new file, it's a 64dd. maybe the game was just crashing because I had other saves created?   EDIT #??? nahp, I was right. editing the value in the rom causes it to crash (at least for the OoT 1.0 (U) rom, haven't tested the MQ one yet). the ram offset only works halfway as well. the created files will have a grey disk tag, but will not be registered  EDIT 0.0000523434 sec. l8r: nahp. you can't set the value in the rom period. always crashes the game on both 1.0 (U) and MQ debug. well, at least I found the rom offsets for it in 1.0 (U)... 1 Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 20, 2013 Author Share Posted April 20, 2013 Changes: [*]fixed the ram offset of code (was accidently off by 2 bytes)Â [*]added a value that allows you to force link to be a certain age (thanks to Airkita for finding this in the debug rom )Â Link to comment Share on other sites More sharing options...
mzxrules Posted April 20, 2013 Share Posted April 20, 2013 At B65C64 I found a table that determines what cutscene to play when entering from a particular entrance. It appears to be in the format  EEEE XX FF BBBBBBBB  E - is a two byte entrance index value X - is currently unknown but i theorize that it factors into whether a cutscene should play all the time, or only when a flag is not set. F - affects what event flag to flip when using a specific entrance B - is offset to find the cutscene. First two digits are the bank number (02 for scene), last three is offset from that bank. Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 21, 2013 Author Share Posted April 21, 2013 At B65C64 I found a table that determines what cutscene to play when entering from a particular entrance. It appears to be in the format  EEEE XX FF BBBBBBBB  E - is a two byte entrance index value X - is currently unknown but i theorize that it factors into whether a cutscene should play all the time, or only when a flag is not set. F - affects what event flag to flip when using a specific entrance B - is offset to find the cutscene. First two digits are the bank number (02 for scene), last three is offset from that bank. great find!   I'll add it to the doc.   EDIT: just found the player state flags, pretty neat stuff. lets you turn link into a phantom who can phase through walls and floors Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 21, 2013 Author Share Posted April 21, 2013 some epic goodies I just found ~2 minutes ago! will add them to the list later $801DB09C $80000000 = drop through floor like grotto and warp $08000000 = focus camera in direction $02000000 = lock camera (doesn't move) $00800000 = is on epona $00200000 = is climbing $00004000 = camera overhead view $00002000 = camera side view $00000400 = make navi run away like a pussy $00000100 = make link swing sword on his own (if it's out) $00000080 = freeze all object animations $00000010 = reset action icon $00000001 = disable control of link$801DB0A0 $80000000 = link screams, screen goes black, renter scene? $20000000 = makes link go invisible $08000000 = disable non-link object sounds $00200000 = makes navi go "hey!" $00100000 = makes navi come out of link's hat $00040000 = disables (dims) the hud $00010000 = makes action icon flip $00008000 = freezes link $00000800 = can dive $00000001 = make action button flip$801DB0B0 $80000000 = make link listen to navi's hint $40000000 = make navi say "hey!" $00000100 = disable collision with map 2 Link to comment Share on other sites More sharing options...
Jason777 Posted April 22, 2013 Share Posted April 22, 2013 Nice! I'm curious as to how you find some of these RAM addresses. Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 22, 2013 Author Share Posted April 22, 2013 Nice! I'm curious as to how you find some of these RAM addresses. well, a couple of days ago I was helping Airkita find the offset that sets the default c-down button as an adult in the debug rom, and accidently found a value that when changed to 0x000A made link walk through walls, climb onto objects instantly, and when holding z drop through floors and lock his states (eg. if he's walking, he'll stay walking in air, if he's swimming, he'll stay swimming). So, I ported it to the 1.0 rom. Â I set a breakpoint on the value, turns out it was a beq instruction, and changing it to 0x000A made it skip over some player state checking on register v0, I traced it back to an address stored in s0, and observed the changes in the values in game. after goofing around for a bit, I pretty much had them all listed out. Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 22, 2013 Author Share Posted April 22, 2013 found these for Satoshi a little bit ago ; OoT MQ Debug Rom Offsets00C235B4 rrggbbaa sword slash start outer color00C235B8 rrggbbaa sword slash end outer color00C235BC rrggbbaa sword slash start inner color00C235C0 rrggbbaa sword slash end inner color; OoT 1.0 (U) Rom Offsets00BEFF7C rrggbbaa sword slash start outer color00BEFF80 rrggbbaa sword slash end outer color00BEFF84 rrggbbaa sword slash start inner color00BEFF88 rrggbbaa sword slash end inner color 2 Link to comment Share on other sites More sharing options...
giadrosich Posted April 22, 2013 Share Posted April 22, 2013 Â found these for Satoshi a little bit ago ; OoT MQ Debug Rom Offsets 00C235B4 rrggbbaa sword slash start outer color 00C235B8 rrggbbaa sword slash end outer color 00C235BC rrggbbaa sword slash start inner color 00C235C0 rrggbbaa sword slash end inner color ; OoT 1.0 (U) Rom Offsets 00BEFF7C rrggbbaa sword slash start outer color 00BEFF80 rrggbbaa sword slash end outer color 00BEFF84 rrggbbaa sword slash start inner color 00BEFF88 rrggbbaa sword slash end inner color These are cool, I might have to incorporate some sword slash colour change. Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 23, 2013 Author Share Posted April 23, 2013 I found a function that's only called at the start of the game and wrote a hook for it. I'm planning to use it to write a modloader .org 0x8000085CdmaTransfer:.org 0x03472000evInitModLoader_rom:.org 0x00000080evInitModLoader_size:.org 0x80000E6CinitModLoader_hook: addiu sp, sp, 0xFFF0 sw ra, 0x0000 (sp) sw a0, 0x0004 (sp) sw a1, 0x0008 (sp) sw a2, 0x000C (sp) li a0, evInitModLoader_rom li a1, evInitModLoader_ram jal dmaTransfer li a2, evInitModLoader_size j evInitModLoader_ram nop.org 0x80170000evInitModLoader_ram:; put your code here, you will need to adjust evInitModLoader_size lw ra, 0x0000 (sp) lw a0, 0x0004 (sp) lw a1, 0x0008 (sp) lw a2, 0x000C (sp) addiu sp, sp, 0xFFF0 lui v0, 0x0000 addiu v0, v0, 0x7430 sw ra, 0x001C (sp) lui t6, 0x0001 addiu t6, t6, 0xD390 lui a1, 0x8001 addiu a1, a1, 0xB140 subu a2, t6, v0 jal dmaTransfer or a0, v0, r0 lui t8, 0x8001 lw t8, 0xB144 (t8) lui t7, 0x0000 addiu t7, t7, 0x1060 beq t7, t8, l80000EBC lui a0, 0x8000 addiu a0, a0, 0x65D4 jal 0x800AF734 addiu a1, r0, 0x0345l80000EBC: lui a0, 0x8000 lui a1, 0x8000 addiu a1, a1, 0x7D58 addiu a0, a0, 0x7D40 jal 0x80004220 addiu a2, r0, 0x0020 j 0x80000ED4 nop the hook part overwrites the code at 0x00001A6C in the rom. the stub should be put at 0x03472000 in the rom Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 23, 2013 Author Share Posted April 23, 2013 few more goods (player actor stuff) 80388B60 ovl_player_actor in ram800A1934 main entrypoint (only called once at start of game)800A19A0 called every time link walks into another map800A19C0 main loop80388B78 called when a cutscene starts (including spells)80391A9C called when the player uses a spell Link to comment Share on other sites More sharing options...
mzxrules Posted April 24, 2013 Share Posted April 24, 2013 I figured out a formula for how scene files are allocated into memory  They are placed at 80384980 - file_size, without extra padding of course. Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 24, 2013 Author Share Posted April 24, 2013 I figured out a formula for how scene files are allocated into memoryThey are placed at 80384980 - file_size, without extra padding of course. have you tested to make sure that still works when there are persistent objects like epona or princess ruto? if so, and it still works, that's a pretty useful find Link to comment Share on other sites More sharing options...
SoulofDeity Posted April 29, 2013 Author Share Posted April 29, 2013 I found 2 pretty useful things just now $801DAB72 1-byte, item currently held in hand$8038A3A4 function to make link pull out / put away item a0 = $801C84A0 a1 = $801DAA30 a2 = item to pull out (00 = no item) Link to comment Share on other sites More sharing options...
SoulofDeity Posted May 5, 2013 Author Share Posted May 5, 2013 a few more miscellaneous things $01795300 160x160 rgba32 main logo$017AEB00 192x192 i4 logo mask; a 3x3 grid of 64x64 tiles $017AEB00 64x64 i4 top-left of logo mask $017AF300 64x64 i4 top of logo mask $017AFB00 64x64 i4 top-right of logo mask $017B0300 64x64 i4 left of logo mask $017B0B00 64x64 i4 center of logo mask $017B1300 64x64 i4 right of logo mask $017B1B00 64x64 i4 bottom-left of logo mask $017B2300 64x64 i4 bottom of logo mask $017B2B00 64x64 i4 bottom-right of logo mask$017B3700 72x8 i8 "the legend of"$017B3940 96x8 i8 "ocarina of time"Usage Tables: 00 = adult, 01 = child, 09 = both::: NOTE ::: slots != items and with the exception of the last 3 values values in the item usage table, they're all listed in the same order as their item value. $00BC7794 select item slot usage table $00BC77AC equipment slot usage table $00BC77BC item usage table $00BC77D0 bottled items $00BC77F7 swords $00BC77FA shields $00BC77FD tunics $00BC7800 boots $00BC7803 deku seed bags $00BC7806 quivers $00BC7809 bomb bags $00BC780C bracelets / gauntlets $00BC780F scales$00B67390 change to below to enable map select ${00 00 00 00 00 B9 E4 00 00 BA 11 60 80 80 09 C0} {80 80 37 20 00 00 00 00 80 80 1C 14 80 80 1C 08} here's some rips of the logo stuff I did in case people need it. (you probably will since Rice's plugin screws up the texture formatting a bit) Â NOTE: the below is actually 9 textures arranged in a 3x3 grid of 64x64 i4 textures!!! Â (and because some people prefer to use the debug rom) Â Â some extra notes the debug rom: $017F7000 160x160 rgba32 main logo$01817000 192x192 i4 logo mask; a 3x3 grid of 64x64 tiles $01817000 64x64 i4 top-left of logo mask $01817800 64x64 i4 top of logo mask $01818000 64x64 i4 top-right of logo mask $01818800 64x64 i4 left of logo mask $01819000 64x64 i4 center of logo mask $01819800 64x64 i4 right of logo mask $0181A000 64x64 i4 bottom-left of logo mask $0181A800 64x64 i4 bottom of logo mask $0181B000 64x64 i4 bottom-right of logo mask$0181BC00 72x8 i8 "the legend of"$0181BE40 96x8 i8 "ocarina of time" -------------------------------- Â EDIT: almost forgot, here's a patch for the 1.0 rom that enables file select. i did it because I was tired of having to retype it in every time I made a new nemu cheat file 3 Link to comment Share on other sites More sharing options...
SoulofDeity Posted May 6, 2013 Author Share Posted May 6, 2013 took me forever to find these... $8000085C dmaTransfer a0 = ram address a1 = rom address a2 = size$80000B0C getFile a0 = pointer to instance of structure with format: ${vv vv vv vv dd dd dd dd ss ss ss} v = rom virtual address d = destination in ram (must be allocated!!!) s = size of file$80020F88 setActorSize a0 = pointer to the actor's structure a1 = floating point scale to set it to$800812F0 spawnObject a0 = $801D9C44 a1 = object number$80025110 spawnActor a0 = $801CA0C4 a1 = $801C84A0 (global context) a2 = actor number sp = floating point x, y, z position half-float (s10.5) x, y, z rotation actor variable$800CAA70 setBackgroundMusic a0 = sequence number I re-posted the dmaTransfer function again because I found out I had it wrong before. Â Â Â ----------------------- Â Â EDIT: I figured this wasn't really important enough to make a new post about, but for those having problems getting epona to load in your custom maps... epona: actor = $0014 variable = $0100 group = $001Aother ridable horse (may not work): actor = $0014 variable = $FFFF group = $001A 2 Link to comment Share on other sites More sharing options...
SoulofDeity Posted May 6, 2013 Author Share Posted May 6, 2013 I was working on a mod involving epona and came across something that truly confused me. Â looking at the hierarchy in a hex editor, I noticed that unlike all the other objects, the entries in epona's hierarchy are 16-bytes each like in link's. however, here's where it gets interesting...it's apparently neither the link, normal, or beta hierarchy format. I haven't figured out everything yet, but what I do know is the following: Hierarchy Header: ${oo oo oo oo nn 00 00 00} o = offset of limb indices n = number of limbsLimb Indices (for each limb): ${oo oo oo oo} o = offset o limb dataLimb Data: ${xx xx yy yy zz zz cc ss tt tt tt tt oo oo oo oo} x, y, z = position of bone c = child index s = sibling index t = limb type $00000000 = no display list $00000004 = extended entry $00000005 = unknown (no offset) $0000000B = normal entry o = offsetIf the limb type is a normal entry, then the offset points at a display list that can be directly rendered.If the limb type is an extended entry, then things get confusing. the offset points at the last entry in a table, which points to the start of the table itself, and has the following format: ${?? ?? ss ss tt tt tt tt oo oo oo oo} s = size of table / 16 t = pointer to start of table o = offset of display list for limbthe rest of the entries are 16-bytes each. no idea what the first 8 bytes are, but the second 8 seem to be pointers to what looks like animation data; which is weird considering one of the limbs points to this table :/there seems to be only 1 extended limb in the horses hierarchy tho, and display list offset pointed to by the struct the limb points at seems to be made up using vertices from segment 08; which is most likely why most of the horse fails to load 1 Link to comment Share on other sites More sharing options...
SoulofDeity Posted May 12, 2013 Author Share Posted May 12, 2013 some more stuff I found while looking for pointers to the audiobank $80000E6C initialize the dmadata table$800C6B54 play sequence a0 = $00000000 a1 = sequence number the sequence numbers are the ones on the wiki Link to comment Share on other sites More sharing options...
SoulofDeity Posted May 12, 2013 Author Share Posted May 12, 2013 here's a small mod I wrote using the play sequence function I listed above. Press D-Up to play sequence81170000 3C0881170002 801C81170004 350881170006 84B481170008 85098117000A 00008117000C 3C088117000E 801781170010 350881170012 004081170014 850A81170016 000081170018 15498117001A 00028117001C A5098117001E 000081170020 03E081170022 000881170024 340A81170026 080081170028 11498117002A 00028117002C 3C048117002E 000081170030 03E081170032 000881170034 3C0581170036 000081170038 08038117003A 1AD58117003C 24A58117003E 001E ; replace this with sequence number to play81170040 240081003BD4 080581003BD6 C00081003BD8 2400----- For Nemu64 -----[THE LEGEND OF ZELDA.Cheats]NumCheats=1CheatName0=Play SequenceCheatName0Count=36CheatName0Code0=81170000 3C08CheatName0Code1=81170002 801CCheatName0Code2=81170004 3508CheatName0Code3=81170006 84B4CheatName0Code4=81170008 8509CheatName0Code5=8117000A 0000CheatName0Code6=8117000C 3C08CheatName0Code7=8117000E 8017CheatName0Code8=81170010 3508CheatName0Code9=81170012 0040CheatName0Code10=81170014 850ACheatName0Code11=81170016 0000CheatName0Code12=81170018 1549CheatName0Code13=8117001A 0002CheatName0Code14=8117001C A509CheatName0Code15=8117001E 0000CheatName0Code16=81170020 03E0CheatName0Code17=81170022 0008CheatName0Code18=81170024 340ACheatName0Code19=81170026 0800CheatName0Code20=81170028 1149CheatName0Code21=8117002A 0002CheatName0Code22=8117002C 3C04CheatName0Code23=8117002E 0000CheatName0Code24=81170030 03E0CheatName0Code25=81170032 0008CheatName0Code26=81170034 3C05CheatName0Code27=81170036 0000CheatName0Code28=81170038 0803CheatName0Code29=8117003A 1AD5CheatName0Code30=8117003C 24A5CheatName0Code31=8117003E 001ECheatName0Code32=81170040 2400CheatName0Code33=81003BD4 0805CheatName0Code34=81003BD6 C000CheatName0Code35=81003BD8 2400 by default, it plays the intro cutscene music. Link to comment Share on other sites More sharing options...
Recommended Posts