Useful hacks for mods (Debug ROM)

[Twili]

Change (almost) all GameCube colors back to N64 colors:

 

0x00B7DBBB: 0xFF -> 0x96

0x00B7DBEF: 0x96 -> 0xFF

0x00B7DC15: 0x26 -> 0x38

0x00B7DC1D: 0x26 -> 0x38

 

^

A Button icon on musical staff.

 

0x00B8808B: 0xFF -> 0x96

0x00B8809D: 0xEE -> 0xE0

0x00B880AB: 0xC8 -> 0x5A

0x00B880AD: 0x03 -> 0x0E

0x00B880B5: 0x23 -> 0x20

0x00B880BF: 0x32 -> 0xFF

0x00B880E1: 0xC0 -> 0xCF

 

^

A & B Button in HUD.

 

0x00BCAB6B: 0xC8 -> 0x50

0x00BCAB6D: 0x50 -> 0xC8

0x00BCAB71: 0xFF -> 0x82

0x00BCAB73: 0x82 -> 0xFF

0x00BCAB7D: 0xFF -> 0x82

0x00BCAB7F: 0x82 -> 0xFF

 

^

Text box cursor.

 

What's missing: A Button highlight after successfully playing a song at a musical prompt, Start Button when paused, aura around Game Over/Save options. Anyone want to tackle those?

[â–²ChriisTiianâ–²]

I made this documentation of some Title Screen (object_mag) ROM Addresses:

 

 

Flamming Effect:

0x00E5B176 0x80 -> 0x00 ; Disable the Effect.

0x00E5B3D7 0x40 ; Position x.

0x00E5B27F 0xFF ; Color Green.

0x00E5B28F 0xFB ; Color Blue.

 

 

Main Logo:

0x00E5B42F 0x98 ; Position x.

0x00E5B433 0x64 ; Position y.

0x00E5B443 0xFF ; Alpha.

 

 

Master Quest + Ocarina:

0x00E5B787 0xAE ; Position x.

0x00E5B78B 0x91 ; Position y.

0x00E5B79B 0xFF ; Alpha.

 

 

"The Legend Of" + "Ocarina of Time":

0x00E5B58B 0xFF ; Alpha Shadow.

0x00E5B6B3 0xFF ; Alpha Normal.

0x00E5B68E 0x14 ; Normal Color Brightness.

0x00E5B66A 0x64 ; Normal Color Red.

0x00E5B66B 0x96 ; Normal Color Green.

0x00E5B66E 0xFF ; Normal Color Blue.

 

 

"The Legend Of":

0x00E5B5C7 0x92 ; x Position of the Shadow.

0x00E5B59B 0x49 ; y Position of the Shadow.

0x00E5B687 0x91 ; x Position of the Normal.

0x00E5B69B 0x48 ; y Position of the Normal.

 

 

"Ocarina of Time":

0x00E5B607 0x90 ; x Position of the Shadow.

0x00E5B60B 0x7F ; y Position of the Shadow.

0x00E5B6FF 0x8F ; x Position of the Normal.

0x00E5B703 0x7E ; y Position of the Normal.

 

 

Press Start:

0x00E5B093 0xFF ; y Position.

0x00E59B9F 0xFF ; Red colour.

0x00E59BAB 0x1E ; Green & Blue colour.

 

 

Nintendo ©:

0x00E5B963 0x13 ; Position x.

0x00E5B84B 0xFF ; Alpha.

 

 

 

EDIT1: Fixed a address & added Normal Colour Brightness.

EDIT2: Added Nintendo ©.

[Three_Pendants]

That can lend itself to a lot of interesting screen set ups there ChriisTian. Good finds! 

[Airikita]

Here's a good one for anyone who wanted this badly:

-------------------------------------------------------------------

Shut up Navi from auto-alerting you:

0xC0A6E4 -> 3C010020 to 3C010000

[john_smith_account]

Here's a good one for anyone who wanted this badly:

-------------------------------------------------------------------

Shut up Navi from auto-alerting you:

0xC0A6E4 -> 3C010020 to 3C010000

[!Tommy]

Here's a good one for anyone who wanted this badly:

-------------------------------------------------------------------

Shut up Navi from auto-alerting you:

0xC0A6E4 -> 3C010020 to 3C010000

Oh my God Airikita, you're the BEST!!! *high fives* I was so used to Navi's hey that I actually knew when it was coming up, I had it timed perfectly. No more!

[Jason777]

Related: http://www.cs.utexas.edu/~jason777/Izou_Zelda/Misc/Patches/Navi_Disable.ppf

 

And documentation...

http://www.cs.utexas.edu/~jason777/Izou_Zelda/Misc/Hacking%20Notes/Navi_ZTarget_80086FF8_80087008.txt

http://www.cs.utexas.edu/~jason777/Izou_Zelda/Misc/Hacking%20Notes/Navi_Quest_800F455C_800F4564.txt

[Airikita]

The bane (or source) of (most) status controls:

------------------------------------------------------------

80224C2C in RAM (Nemu Memory Debugger during gameplay - controls various conditions based on game behavior. Binary booleans)

 

Length: first three words contain a lot of obvious situational booleans. Swinging your sword and items might control one word while riding Epona dictates 2 values in 2 separate words, and cutscenes, Navi, stuff gallore. Especially freezing animations.

 

 

RAM Expansion Hack:

-----------------------------

ROM:
-------
0xB415B0 -> 3C188044 to 3C188074 for extended RAM memory
AND
0xB33C5C -> 3C05001D to 3C05004D ""

 

*** Note: for custom expansion, change the values by the same incremental amount, and too much will crash the ROM when trying to play. ***

*** Can cause the memory to load past 8Mb if too high; every 0010 added is 1Mb more space. ***

*** This allows loading more actors and objects into a single map, and allows more enemies to co-exist when riding Epona to remove unusual glitches. ***

[Xenix]

Airikita, this is fantastic. Thank you for sharing this. I appreciate this so much as this will save me much headache in the future. Some of my maps were going to be big, and with that comes the need for more actors and objects to make that space less boring (enemies, torches, blocks, etc.), so this helps a lot.

[Airikita]

Airikita, this is fantastic. Thank you for sharing this. I appreciate this so much as this will save me much headache in the future. Some of my maps were going to be big, and with that comes the need for more actors and objects to make that space less boring (enemies, torches, blocks, etc.), so this helps a lot.

Yes, and you don't have to worry about lower polys, but I think you have to be careful not to make it bigger than Hyrule Field (however, I could be wrong). So good luck.

[Xenix]

Well, this is still fantastic. I was able to finally do what I needed and it loaded. Perfect! Only problem is there is a little delay when loading scenes and such. Mupen64Plus pauses for a brief second or two and then the intro starts. But whatever. At least it works.

[!Tommy]

It's too bad Hyrule Field couldn't be broken up into several maps like in Twilight Princess, that way it could still be vast but not too huge at the same time and therefor you could have a ton of actors. That is if you were to actually redo Hyrule Field completely.

[Airikita]

It's too bad Hyrule Field couldn't be broken up into several maps like in Twilight Princess, that way it could still be vast but not too huge at the same time and therefor you could have a ton of actors. That is if you were to actually redo Hyrule Field completely.

Personally, I wouldn't touch Hyrule Field because of it being the intro, so I would suggest a different map. It is actually possible to make the scene use multiple maps like that, just they had so many restrictions on Epona when it came to maps (don't ask why, I question Nintendo's motives) that it suggests they did that so Epona was restricted. Idk, Nintendo was weird with that one.

 

EDIT:

Function that sets text in Link's code:

-----------------------------------------------

803DA4DC -> JAL changes text at 80221EA8

 

 

ROM changes for stuff:

------------------------------

0xBD2B3C -> AC400004 to AC4E0004 for young Link in title screen (this also means no Epona without my young Epona patch)

 

Disable mini-map permanently:

--------------------------------------

Key pointer: 0x0DD2 on 802120A0 (or something like that)

Key address in RAM: 80081A34 -> Change to: 100001F9

Key secondary address: 80081A98 -> Change to: 100001E0

Key address for showing or hiding map: 80111B34 -> change to: A7040DD2 (saves 0001 to mini-map display status)

[Airikita]

Another speed-up trick:

------------------------------

800FDE40, this JAL 80106860 comes after ADDIU A1, R0, 0x00AB

 

- If you remove the JAL at this address to 00000000 (it's easy to find in ROM too) then it will prevent the Debug ROM from writing AB to empty slots in RAM. This process does add a little slow-down if left be.

 

------------------------------

 

Shaders are listed starting at 0xB9D420, using the indexes from the lists here: http://wiki.spinout182.com/w/Shop_Documentation

Each shader will end with DF000000 00000000, usually 0x30 in length.

 

-------------------------------

 

8009096C shader index loaded here


800694E4 060004B0
aaaaaaaa bbbbbbbb
a = RAM pointer to shader (Or the shader code)
b = gi model offset

80224728

80000498 - exception thrown

803DB078 - Player code checks for error/exception when gi item is loaded? (change to 1000XXXX to bypass console exception)
Exception/error: 0C0007FC - JAL 0x80001FF0 - When exception is thrown

Edited June 1, 2014 by Airikita

[Airikita]

0xC0A5B4 -> change to 10000072 to skip talking to Navi, shutting her up for good (no alerts, no talking with Navi ever again)

0xDBC024 -> change to 10000003 to prevent Navi's c-up notice

[haddockd]

What I wouldn't have given to have that back in the old N64 days. 

 

"Hey, Listen" -> Gunshot to Navi's face -> problem solved

[Airikita]

Hey guys, this is for HUD items and value displays in particular:

-------------------------------------------------------------------------------

80089D54 -> displays counters for various items in c-buttons

BF9330 - BF9330 [ROM] -> determines what item value is displayed in the Item Select menu/screen of the pause menu

                      -> Change to FF to hide value display, or change to item # to display the value for an item of that number in that slot in the Item Select screen

[Jason777]

Hey guys, this is for HUD items and value displays in particular:

-------------------------------------------------------------------------------

80089D54 -> displays counters for various items in c-buttons

BF9330 - BF9330 [ROM] -> determines what item value is displayed in the Item Select menu/screen of the pause menu

-> Change to FF to hide value display, or change to item # to display the value for an item of that number in that slot in the Item Select screen

To expand upon that post, I had documented a bit of that myself when helping out HeavyZ with his mod.

 

You can find some notes that also contain information on counter highlighting (i.e. when you have max ammo, the ammo count is green).

http://www.cs.utexas.edu/~jason777/OoT_Rebirth/Arrow_Rupee_Decrement/

 

Old video of the hack that builds upon that documentation:

[Airikita]

JAL 80094F40 [0C0253D0] -> Deals with texture animations (water also)

 

This deals with the F2 command in the F3DEX2 display list applied to RAM:

0xF2 G_SETTILESIZE

Sets the texture coordinates and size

 

It calculates the value applied to A2 to "slide" or "move" the rendering of the texture on the current display list loaded to RAM, referenced via a DE000000 80?????? command.

 

---------------------------------------------------------------

 

More for RAM expansion:

--------------------------------

0xAAA240 -> change to 10000003 to always destroy enemies, despite RAM limitations (this allows overflow, so there is a cost)

 

* This goes with the RAM expansion, yet be aware of limitations. Stalchildren can still be glitch-abused in Hyrule Field with Epona and spamming items, spin attacks, and song effects while destroying multiple Stalchildren. Eventually they "glitch out" by not allowing their models to be destroyed, so this fixes the problem and allows Stalchildren to be removed to free up space.

 

--------------------------------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------------------------------

 

Faster boot loading (for RAM) and Extended RAM:

-----------------------------------------------------------------------------------------------

[ROM] 0x5DF8 -> 3C010080 AFA10008 00000000

 

This can also extend RAM even more than imaginable! 3C010080 is 8Mb, just change it according to how much RAM you want to use.

You can use up to 90Mb for Emulators (this can bring us high-poly models if need be), but the Memory limit (in theory) for hardware goes up to 55Mb (03F00000)

 

This works on hardware without any errors for booting, this does read from A0400000 and up this function, so I'm not sure what exactly is there... however it appears irrelevant as it's a boot-only function that loops for no particular reason. It also generates a Debug text which reads "RAM 8M mode (N64DD".

 

On par with an earlier post of mine for Expansion RAM hack: https://www.the-gcn.com/topic/565-useful-hacks-for-mods-debug-rom/page-2?do=findComment&comment=45936

 

The changes can be made to push Link's file further down the RAM where you extended it to allow more space for graphics and actors. This also includes maps, and pretty much anything.

Edited July 10, 2014 by Airikita

[DeathBasket]

I don't consider this useful. To me, ROM hacking is about taking a game and changing its functionality while remaining within the constraints of the hardware you're given. This is not it. This is like the URA project where you're going to need a very specific setup to get the game to work at all when the goal imho should be to release something that would work on a retail N64/expansion pak/cartridge and not require additional hardware. Nobody has a 51MB expansion pak. Emulator-only hacks are less impressive. Let's not do this.

[Airikita]

I don't consider this useful. To me, ROM hacking is about taking a game and changing its functionality while remaining within the constraints of the hardware you're given. This is not it. This is like the URA project where you're going to need a very specific setup to get the game to work at all when the goal imho should be to release something that would work on a retail N64/expansion pak/cartridge and not require additional hardware. Nobody has a 51MB expansion pak. Emulator-only hacks are less impressive. Let's not do this.

I agree, however it's an idea for high-res modding. Tbh, some emulators can't handle high poly, nor the memory mapping can conflict. It is a possibility to allow mobs of enemies, but I'd have to test that. I think the hardware would crap out, and there isn't a great need for it. However, a 16Mb expansion would be a good call considering that modding a memory pack could be possible.

 

It's just an option, but for now this hack makes boot time a bit quicker. The option of changing the RAM size is up to the modder.

 

On hardware there is a slight noticeable difference in start-up time.

 

Also, to say emulator hacks are not impressive is misled. I'd hate to bring up old bones, but the URA Project would have benefited from this.

[Zeth Ryder]

To be truthful, High poly and N64 really just don't go together. If you are wanting to add higher poly, the best option would be to switch to a much more capable engine such as the one used in Twilight Princess or Skyward Sword.

Also, can we stop throwing Ura's name around, it just digs up bad vibes for everyone, myself included.

[Airikita]

Sorry, but that was not my intention. I have seen Nemu handle high-poly however, just not on console of course.

 

For something like importing Twilight Princess maps and models into OoT, that was the idea of the RAM extension. Also, perhaps even OoT3D stuff can be ported to the ROM for some fun.

 

I can also mean a special challenge in ZEY that won't be available for hardware compatibility since the console can't handle large amounts of spawns. So it might be possible to add more enemies to some areas for a harder mode, but that mode won't be available for console as mentioned. The RCP can only handle a set amount of polys (but, of course, I'm looking at a certain spot where graphics are allocated where it might be possible to move... but then it's a matter of the RCP).

[43512]

How to extend the Scene Table and Entrance Table arbitrarily (offsets are for the OOT Debug ROM):

1. Copy the code from 0x21CC - 0x2264 and put it in a separate file (we’ll call it codefile_loader.bin; pastebin of raw hex).
2. Make the following changes to codefile_loader.bin:
   • 0x90: 03E00008 -> 27BD0038   (JR RA               -> ADDIU SP, SP, $0038)
   • 0x94: 27BD0038 -> 8FBF0038   (ADDIU SP, SP, $0038 -> LW RA, $0038 (SP))
   • 0x98: insert bytes, 03E00008 (null -> JR RA)
   • 0x9C: insert bytes, 27BD0040 (null -> ADDIU SP, SP, $0040)
3. Insert the modified codefile_loader.bin into a sufficiently-large area of free space in the ROM (in an unmodified OOT Debug ROM, unused space starts at 0x35CE040).  Make a note of the starting offset.
4. Copy the code from 0x5050 - 0x50E8 and put it in a separate file (we’ll call it ram_clearer.bin; pastebin of raw hex).
5. Add the following lines to the top of ram_clearer.bin:
   • 3C088015  (LUI T0, $8015)
   • 35087D90  (ORI T0, T0, $7D90)
   • 10880026  (BEQ A0, T0, $000050E4)
   • 00000000  (NOP)
6. Insert the modified ram_clearer.bin at 0x5050.
7. Copy the scene table from 0xBA0BB0 - 0xBA1448 and put it in a separate file (pastebin of raw hex).
8. Add as many additional entries to the bottom of the table as you want or need (keep track of the new file length for later).
9. Insert the modified scene table into a block of free ROM space.  Again, remember the starting offset.
10. Copy the entrance table from 0xB9F360 - 0xBA0BB0 and put it in a separate file (pastebin of raw hex).
11. Add as many new entries onto the end of the table as you need or want (again, keep track of the new file length for later).
12. Insert the modified entrance table into another segment of free space.  Like with the others, record the starting offset.
13. Create a new file and add the following lines to it (pastebin of raw hex; XXXXs are still present):
    • 27BDFFC0 (ADDIU SP, SP, $FFC0)
    • AFBF0038 (SW RA, $0038 (SP))
    • 3C048001 (LUI A0, $8001)
    • 3484CE60 (ORI A0, A0, $CE60)
    • 3C08XXXX (LUI T0, $XXXX [1st half of scene table start])
    • 3508XXXX (ORI T0, T0, $XXXX [2nd half of scene table start])
    • 3C098015 (LUI T1, $8015)
    • 35298000 (ORI T1, T1, $8000)
    • 340AXXXX (ORI T2, R0, $XXXX [new length of scene table])
    • AC880000 (SW T0, $0000 (A0))
    • AC890004 (SW T1, $0004 (A0))
    • 0C0004FF (JAL $000013FC)
    • AC8A0008 (SW T2, $0008 (A0))
    • 3C048001 (LUI A0, $8001)
    • 3484CE60 (ORI A0, A0, $CE60)
    • 3C08XXXX (LUI T0, $XXXX [1st half of entrance table start])
    • 3508XXXX (ORI T0, T0, $XXXX [2nd half of entrance table start])
    • 3C098015 (LUI T1, $8015)
    • 35299000 (ORI T1, T1, $9000) [if scene table length > $1000, you’ll need to increase this from $9000]
    • 340AXXXX (ORI T2, R0, $XXXX [new length of entrance table])
    • AC880000 (SW T0, $0000 (A0))
    • AC890040 (SW T1, $0004 (A0))
    • 0C0004FF (JAL $000013FC)
    • AC8A0008 (SW T2, $0008 (A0))
    • 3C048001 (LUI A0, $8001)
    • 3484CE60 (ORI A0, A0, $CE60)
    • 3C08XXXX (LUI T0, $XXXX [1st half of codefile_loader.bin start])
    • 3508XXXX (ORI T0, T0, $XXXX [2nd half of codefile_loader.bin start])
    • 3C098015 (LUI T1, $8015)
    • 35297DC0 (ORI T1, T1, $7DC0)
    • 340A00A0 (ORI T2, R0, $00A0)
    • AC880000 (SW T0, $0000 (A0))
    • AC890004 (SW T1, $0004 (A0))
    • AC8A0008 (SW T2, $0008 (A0))
    • 080004FF (J $000013FC)
    • 0009F821 (ADDU RA, R0, T1)
14. Insert this new file at 0x21CC.
15. Change the values as shown below at the following offsets in ROM:

• 0xB371B4: 3C0F8013 -> 3C0F8015 (LUI T7, $8013       -> LUI T7, $8015)
• 0xB371BC: 25EF9A10 -> 35EF8000 (ADDIU T7, T7, $9A10 -> ORI T7, T7, $8000)
• 0xB33EC4: 3C088013 -> 3C088016 (LUI T0, $8013       -> LUI T0, $8016)
• 0xB33EC8: 250881C0 -> 25089000 (ADDIU T0, T0, $81C0 -> ADDIU T0, T0, $9000)
• 0xB33FE4: 3C098013 -> 3C098016 (LUI T1, $8013       -> LUI T1, $8016)
• 0xB33FF4: 812981C0 -> 81299000 (LB T1, $81C0 (T1)   -> LB T1, $9000 (T1))
• 0xB341E0: 3C0B8013 -> 3C0B8016 (LUI T3, $8013       -> LUI T3, $8016)
• 0xB341F4: 956B81C2 -> 956B9002 (LHU T3, $81C2 (T3)  -> LHU T3, $9002 (T3))
• 0xC15E74: 3C098013 -> 3C098016 (LUI T1, $8013       -> LUI T1, $8016)
• 0xC15E84: 952981C2 -> 95299002 (LHU T1, $81C2 (T1)  -> LHU T1, $9002 (T1))
• 0xB1064C: 3C088013 -> 3C088016 (LUI T0, $8013       -> LUI T0, $8016)
• 0xB106D8: 950881C2 -> 9C089002 (LHU T0, $81C2 (T0)  -> LHU T0, $9002 (T0))
• 0xB347A0: 3C0C8013 -> 3C0C8016 (LUI T4, $8013       -> LUI T4, $8016)
• 0xB347B0: 958C81C2 -> 958C9002 (LHU T4, $81C2 (T4)  -> LHU T4, $9002 (T4))
• 0xAE0530: 3C098013 -> 3C098016 (LHU T1, $8013       -> LHU T1, $8016)
• 0xAE0540: 812981C0 -> 81299000 (LB T1, $81C0 (T1)   -> LB T1, $9000 (T1))

 

If you want the ROM to be playable with Project64, be sure to use a tool like RN64CRC to correct the ROM CRCs, as the old CRCs will be invalidated by these changes.

[Jason777]

Nice one. Did you find that code by yourself or were you using spinout's hack as a reference?