don't click here

REZ Hacking

Discussion in 'Technical Discussion' started by Woofmute, Dec 11, 2009.

  1. AJ 187

    AJ 187

    it's freemtastic! Oldbie
    Generalized heavily, but:
    1. Find a bunch of example files.
    2. Start examining similarities between the files with a hex editor (sometimes files will have a header, sometimes they won't; depends on the format)
    3. Start changing things that look interesting to you and see what happens in game.
    4. Use emulators with debugging tools (I'm not sure if any Dreamcast emulators have debuggers)
     
  2. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    I'll try that, thanks.
     
  3. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    Found the boss entry text in the beta for Area1 and edited it in a hex editor, surprisingly, it worked!

    [​IMG]
    Then it would scroll down and say 'Oh Noes!'. But I'm not playing for another 20 mins on an emulator.
     
  4. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    Just so anyone interested knows-For a while now, I've been looking into the first read binary files from the beta and final, to get debug code working again, and thinking there were some values set to zero. Just a few minutes ago I realized that from offset 000B8D10 downwards, everything was nop'd out. So theoretically it's just a matter of taking the code from the beta and inserting it. But, the binary does not contain enough space for the code. So I can either-A) Create space and rewrite pointers. Or B) Insert it anyway and rebuild the game. Any ideas which one might be easier?

    There is one keyboard command that still functions, but all it does is saves the game. (It's the 'Home' button)
     
  5. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    This qualifies as beta material.
    In a chat with Jake Kazdal, I sent him a quick 3D mockup of a beta Rez form, referenced from a Youtube video. He then sent me a quick painted on version showing what that beta form was more closer to;
    [​IMG]
     
  6. Phos

    Phos

    Going for the high score on whatever that little b Member
    3,318
    0
    0
    I should make a model out of that.
     
  7. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    I was a bit late posting some of this stuff, but here I go;

    This is the part of the conversation-

    'I was part of all of that, long time since I've seen that! I've done a quickie paintover to show what the actual form was closer to. I wish I still had more pictures from that time, but here is some stuff I dug out of my old hard drive! I don't know if this wicked big painting was ever actually released, I grabbed it when I left, so you didnt get it from me!!!'

    The 'wicked big painting'- Here
    Japanese cover art (I think)-Here
    The finished version of the beta character (Made by me)-And here


    As well as that I've continued to dig through the K-Project beta by experimenting with pressing keys at different times while using different debug modes, etc.

    Here is a text document of every known command and key so far-Beta Commands
    And the test mode commands-Test Commands

    You probably know most, if not all of those keys and commands if you've spent time with the beta, or from places around the net.
     
  8. Lobotomy

    Lobotomy

    35% Cognac Banned
    4,394
    1
    0
    Traverse City
    Project: Matter/Energy
    Keep doing what you're doing, man. I want to see some more K-Project stuff!

    Any hopes on finding the girl running on that thin strip of land from an EARLY AS HELL alpha?
     
  9. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    So far, only time will tell.

    I'm messing with the file types in hex editors, changing one or two values and seeing how it affects the game, so if I find or achieve anything, it'll be straight on here! I haven't figured out where the player is stored in the game, but I will one day, probably.

    The tutorial level seems to be one of the few used links between the concepts and the final, as it is one of the level segments from This video.

    EDIT: Oh, when you try to save the .eve file by pressing 'S' while using the Mainflow editor, it will attempt to save to drive 0. Drive 0 is the first VMU, or other form of memory card, in controller 1. Using a VMU that links to the computer, I can then extract custom .eve files, and use them in the final version of Rez, well, in theory.
     
  10. FuzzballFox

    FuzzballFox

    Hmmmmm Member
    575
    0
    0
    UK - Hampshire
    Nothing anymore
    Fuck yes <3 Rez <3333
    Aphex Twin? Holy shit I would never have guessed...;_; Come to Daddy is one of my favourite tracks for RDJ...
     
  11. ccat

    ccat

    Member
    74
    0
    0
    Hello, people-things-whatever.

    I'm damn glad that this game hasn't been forgotten yet, and there are more people besides me researching it.
    I read the topic and I'd like to point out a few things that may have escaped your attention.

    First off, the music. Someone (Jake?) said that the music is in MID files, with the two other containing samples and whatnot - well, I gotta disagree. You were right about the midis, but they sure as hell can be replaced with your own - if you don't forget important things such as track count(32 max), meta keys (indicating where it should loop, how many times and such - play around with beta area 5, track #18 with info on to see that it's a bit more than just notes). If you want to edit the music, I highly suggest tweaking an existing file instead of making a new one.
    The other two files do not contain samples however - these are in the STG directories. (M05.fpb is only 3KB large, so it couldn't contain the lead, choirs, pads, vox and all) My guess is that the samples might be in :\STG##\S##_CH.STP as it weighs enough for sound and a little too big for any textures or models. Note that STG06 (boss rush) contains no such file, and it has no music playing in the background(only the sound effects playing to the BPM in Underworld's MID which does have a copy numbered 06 in the music directory). Another thing that proves it would be that the STP file is the same in all of the stages which have Cowgirl as the BGM(Somebody could try swapping an STP with a retail/STG05 one. Yes, I'm lazy).
    I'd go with a theory that FPB and MPB files are for referencing samples only - inside the MPB is a lot of strings with hex addresses, but it's written in plain ascii so it's for humans to read, not the code. Maybe for debug purposes. It also contains an incrementing number chain ranging from value 00 to 7F near the beginning(lines 4C-E4), but what for - no idea so far.
    The FPB contains a string saying "ad_eff.FPD" near the header. I know of no such file on the ROM, so I guess it's inside some archive. The rest of the file is mostly empty bytes, with char(byte) and int(two bytes) values ranging from 01 to FA (FA and AA are quite frequent there) placed in seemingly random order. They might be for swapping tracks per layer(For those who didn't know, that's how the music is played in REZ - by switching MIDI tracks on and off at different layer levels so the sequence plays smoothly and can be jumped at any time - with the exception of Area 5 [track 18 yet again, it has to be played from start]).

    Next, I see that there's a nice recreation of the test character mesh, but something tells me that this mesh is used in the final version as one of the enemies because I know I have seen it somewhere before. At first I thought it's the Area 5 common bot, but its tail is a little different. Then I went to Area 1, but then again the closest I found is the one with two pairs of wings. So, if you're ever digging in the models you might try looking for it among the enemy meshes, it might be somewhere.

    Going back to the STP file, and the samples - the header of the STP file says STMP. If anyone knows what kind of a file has this kind of a header, I'd be very grateful. The file itself contains nothing that says RIFF or WAVE so if there are any PCMs, they're compressed and/or encrypted. In worst case, some of the sound in the game might be directly synthesized by the console - making it even harder to edit the audio.

    Someone above said that the best way to reverse engineer a file would be to compare two examples - I'll add that the best examples you can get to compare are the files from Area 1 from the beta and from retail as the differences are small. Even smaller if you pick the score attack/direct assault layout, as it's based off the beta one.

    For the end's sake, one tip for debugging - using nullDC emulator ver. 1.0.0 beta 1.6 won't load any enemies into the game which is very helpful if you need to edit some data on the fly without stopping the game flow. Just keep in mind a lot other things don't work in that version, so just launch the stages with the left-click menu if you don't want an annoying sound buffer glitch bugging you for eternity. With that said, I'm off to dig in the hex trash more, maybe I'll find something tasty.

    Update 04.04: I found only three raw PCM headers while digging through the disk image with a hex editor. Looks like most of the stuff is archived, and in a difficult way as well because any traces of common archives (zip, etc.) are absent. I tried messing with some text, will update as soon as I find out if it works the way I did it(using null bytes as extra string space). (edit yet again: it works pretty nicely, strings behave normally just like in PC games)
     
  12. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    Yes. I agree with most of what you are saying. But the .mpb files actualy do contain samples. After a little experimenting in Audacity, importing the raw data .mpb files with different settings, I got these-

    Area1- I'll update tomorrow.
    Area2- I'll update tomorrow. (Sounds too distorted, but you can hear parts of it.)
    Area3- Area3 (Also quite distorted)
    Area4- I'll update tomorrow. (Same here)
    Area5- I keep getting 'Upload failed' errors.
    Area6- I'll update tomorrow. ('' '')
    Lost Area- Lost Area ('' '')
    Trance Mission- Trance Mission ('' '')
    Menu SE- Menu SE ('' '')
    Eden Battle- Eden battle ('' '')
    Beta Area1- Beta Area1 ('' '')
    Level Select- I'll update tomorrow. ('' '')
    Beta Level Select- I'll update tomorrow.
     
  13. ccat

    ccat

    Member
    74
    0
    0
    Something tells me they used some heavy compression due to the file size and the distortion. Have you tried changing the wave's bitrate parameters and such in the header? Also, the sample rate seems to be different for each sound.
     
  14. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    I have only messed with import settings, but not the sample rates. I'll have some more time to do that today.

    EDIT: If you have Audacity, and the .mpb files from Rez, or the beta, you can open them by doing this;

    -Click FIle>Import>Raw Data.
    -Import a file such as S_M01.mpb
    -Change the encoding tyoe to VOX ADPCM.

    This should allow you to achieve results similar to mine. This is still not the correct encoding to play .mpb files correcly, but it's pretty close.
     
  15. ccat

    ccat

    Member
    74
    0
    0
    Oh, you. I was going to post exactly the same thing as I'm playing around with these too... anyway, I'll look for some software to import other types of ADPCM as it turns out to be quite accurate. (another edit, I was wrong - btw the best result is if you choose no endianness as byte order)

    Area 5 (44 and 22 kHz mixed)
    Area Selection (44kHz)

    another edit:

    HA HA HA HA HA!
    Try opening Cowgirl sample pack and setting the sample rate to 32k(used for voice) then skip to the "everything" voice samples.
    ...Japanese can't spell english for shit :D (in a razor brow! I feeru rike frying!) Also this shows it was a mockup sample, not rip from the actual song.

    Another thing: Stream files I mentioned earlier are 44k 16 bit PCM, and have a weird echo effect when imported. I see that they're not related to samples at all, but contain other stuff.
     
  16. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    I'll do some more experimenting after I try out some more STG20.BIN mods. As well as a PLAYER.NB mod.

    EDIT: Thanks for putting those up, my links got all muddled up, and so I'm leaving them untilI have some time.
     
  17. ccat

    ccat

    Member
    74
    0
    0
    Let us know what you find. I just found something in Eden stream that I haven't ever heard in the game. There seem to be streams for each ending music from worst to best, but the one that's first (supposedly worst) is something I actually never heard. Was it perhaps planned that Eden could shut down? (Maybe she even can, but then again nobody sucked as much as to take so long fighting the system)

    I dumped that part as a wave...
    Area 6 unknown sound
     
  18. Woofmute

    Woofmute

    stuck in ram Member
    184
    0
    16
    turning into a dreamcast
    I'll let you know how things go. PLAYER.NB doesn't seem to contain the characters data. I just hope it's not part of the level binaries.

    Interesting...It sounds like it would have got it's own long cut-scene, but the only ones I know that are long is the 100% scene, and the 9X% scene...
     
  19. ccat

    ccat

    Member
    74
    0
    0
    I suppose that'd be a self-destruct event, but nobody ever failed so much as to trigger it.
    Do you have a VMU image with the game finished so I could check it out on nulldc real quick? I don't have a memory card on the real hardware so I always gotta start over. I want to finish the level with a horrible shotdown, get hit a lot in the boss rush and take as long with Eden as possible.

    I also don't know what the choppy sound in the streams could mean. Is that maybe a different way of splitting stereo channels? (importing as dual channel just downsamples the rate by half)

    You'd be better off digging in the PVM rather than NB, if you want to swap the character model. Otherwise, I must have no clue what you're trying to do :D
     
  20. Polygon Jim

    Polygon Jim

    Eternal Tech Member
    0
    3
    0
    across town from Hinchy
    All the bitches.

    Er... .NB are Ninja model files from my experience. PVM's are texture archives.