don't click here

SADX/SA1 Hacking/Modding

Discussion in 'Engineering & Reverse Engineering' started by MainMemory, Aug 15, 2009.

  1. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    New version of SETedit is on the wiki. You should note that the Debug Mode checkbox does not read from SADX, so if it's off, but the box is checked, you'll have to click it twice to turn it on. It is also very important that you don't go to another level (not act) with it on, or the game will crash.
    Almost as if it was trying to load code that isn't there anymore...

    Also, I look at the Mystic Ruins object list, and I wonder, what happened? The first part was off by one and there was an object that comes later in the list, and how is a Chaos Emerald nothing?
    Anyway, here's a look at some objects from Mystic Ruins, including some beta objects (I forgot the teleporter? though.)

    Edit: Now that I think about it, O EME P could be Object EMErald Piece, and O BIGWJUMP is Object BIG Water JUMP, denoting an area where Big can jump out of water instead of sinking.
    O KOMONORMLT is one of the lights on the ceiling of CYBER-MET INC.

    I would really like a screenshot of the properties for O EME P from the preview.
     
  2. Afti

    Afti

    ORIGINAL MACHINE Member
    3,521
    0
    0
    Holy crap, pushable blocks. Those would have been nice to see.

    Also, the land raft is the best thing ever.
     
  3. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    O EME P is a Master Emerald Shard. Teleporting to all of them in Speed Highway got me 2/3, and the last one was in a container.
    The light dash path's properties are:
    Code (Text):
    1. Misc1=Distance
    2. Misc2=Height
    3. Misc3=Spacing
    The switch, however, has me baffled. I've only been able to determine that Misc1 is Toggle/Push type, and changing Misc2 stops the light dash path from working. I bet the code for which switch the path uses is in the rotation values. I'm going to have to completely change how those are handled in SETedit.
    Edit: I almost forgot, only the Y Rotation seems to have any effect on the orientation of the path.
     
  4. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    The guy that made DXEdit, Total, just registered and informed me through the wiki page that there is a new version of DXEdit. I have uploaded this, and it looks like he knows about SETedit (although that was when I first released it as sadxedit).
    I would also like to thank Hivebrain for redoing the color tags in the Object Editing article.

    Edit: wait, he's been registered for 2 months... and still not promoted to Trial Member.

    Edit2: SETedit has had a minor update to v3.8. Feel free to skip this update, it doesn't actually add anything to the editing.
     
  5. Azu

    Azu

    I must be stupid. Member
    Any level you want see specifically?
     
  6. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    Station Square, I specifically want to see O EME P (Emerald Shard), O SWITCH, SCENE CHANGE, LINERING and LINERING V (Light Dash paths), and O LevelItem.

    Btw, here's a post Total made yesterday:
    And google translate:
    I think he thinks we hate Russians.
     
  7. ShadowDog

    ShadowDog

    Member
    I'm confused, I thought you said they took out 99% of the debug code? Is the debug mode you mentioned your own or did they leave just enough code for debug mode to be useful?
    EDIT: Nevermind.
     
  8. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    99% is an estimation. It's more like they took out most of the code that isn't object specific. (Collision display, free movement)
    If we could put object placement back in that would be awesome, but nearly impossible.
     
  9. Azu

    Azu

    I must be stupid. Member
    [​IMG]
    [​IMG]
    [​IMG]
    [​IMG]
    [​IMG]
    [​IMG]
    [​IMG]
     
  10. PsychoSk8r

    PsychoSk8r

    PsychedelAnt | Tone Turner Oldbie
    2,642
    57
    28
    Birmingham, UK
    30 Day Project: Revisited.A New Release!
    Is that what I think it is? O.O
     
  11. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    What I don't get is, if O TIKAL has one property and O EME P has none, why do the properties have different values in the SET files? Also, I want to make sure that the checkpoint has no properties. I don't need a screenshot, just tell me.

    Also,
    Wait, in the SET file, ANG Z is two bytes... how do you fit the Level, Act and Entrance into two bytes? My best guess based on the order they are mentioned would be that the entrance is the high nybble of the low byte, and the act is the low nybble. It would work, because there aren't any levels with 17 acts, and there probably aren't any acts with 17 entrances.

    Unfortunately, I think this means that you just can't get Emerald Shards to appear where they weren't meant to. (Emerald Coast, Station Square, etc.)

    I'm gonna have to start making special code for these objects that don't follow the format...
     
  12. Azu

    Azu

    I must be stupid. Member
    I don't think the checkpoint has any properties.
     
  13. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    What I really don't understand is the Chao Teleporter in Egg Carrier... it's an O LevelItem. The properties don't affect it. Maybe there's a special case for that act. But why?
     
  14. Sik

    Sik

    Sik is pronounced as "seek", not as "sick". Tech Member
    6,718
    1
    0
    being an asshole =P
  15. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    Well how about that? It looks like the list for the Egg Carrier's Inside is mostly wrong. In the ammunition room, the lift is O CONTAINER and the Jet Booster is O EMBLEM. The Spring, door and ring are at least right though.

    Problem Solved: There were two objects missing from the list.
    Edit: Same with the outside's list.
     
  16. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    I found the code that sets the restart position (at least for Emerald Coast):
    <div class='codetop'>CODE</div><div class='codemain' style='height:200px;white-space:pre;overflow:auto'>0044EE70 - 68 84 2f b4 03 - push 03b42f84;the base address is already on the stack and is at esp+8 after this instruction
    0044EE75 - 68 83 2f b4 03 - push 03b42f83;the base address is at esp+c
    0044EE7A - 68 82 2f b4 03 - push 03b42f82;the base address is at esp+10
    0044EE7F - e8 8c 77 fd ff - call 00426610;nothing in here touches the stack
    0044EE84 - 8b 44 24 10 - mov eax,[esp+10];the base address was pushed onto the stack 5 dwords ago
    0044EE88 - 8b 08 - mov ecx,[eax]
    0044EE8A - 89 0d 8c 2f b4 03 - mov [03b42f8c],ecx;move X position
    0044EE90 - 8b 50 04 - mov edx,[eax+04]
    0044EE93 - 8b 4c 24 14 - mov ecx,[esp+14]
    0044EE97 - 89 15 90 2f b4 03 - mov [03b42f90],edx;move Y position
    0044EE9D - 8b 40 08 - mov eax,[eax+08]
    0044EEA0 - a3 94 2f b4 03 - mov [03b42f94],eax;move Z position
    0044EEA5 - 8b 11 - mov edx,[ecx]
    0044EEA7 - 89 15 98 2f b4 03 - mov [03b42f98],edx;???
    0044EEAD - 8b 41 04 - mov eax,[ecx+04]
    0044EEB0 - 33 d2 - xor edx,edx;clear edx
    0044EEB2 - 8a 35 cc 2d b2 03 - mov dh,[03b22dcc];move current level to dh
    0044EEB8 - a3 9c 2f b4 03 - mov [03b42f9c],eax;???
    0044EEBD - 8b 49 08 - mov ecx,[ecx+08]
    0044EEC0 - 83 c4 0c - add esp,0c
    0044EEC3 - 89 0d a0 2f b4 03 - mov [03b42fa0],ecx;???
    0044EEC9 - c7 05 88 2f b4 03 01 00 00 00 - mov [03b42f88],00000001;???
    0044EED3 - 66 0b 15 ec 2d b2 03 - or dx,[03b22dec];or dx with current act
    0044EEDA - 66 89 15 80 2f b4 03 - mov [03b42f80],edx;move edx to some address
    0044EEE1 - c3 - ret
    </div>

    Edit: Emerald Coast 1's restart position is at 09D142C0 in RAM, or 99142C0 in sonic.exe (US).
    No, that's a RAM address... in the pointer area?

    Edit2: I've put a list of all the actions for each character (and other objects eventually) on the main page.
     
  17. Dude

    Dude

    Tech Member
    3,138
    0
    16
    Southbridge, MA
    Random VR/AR trash
    at 0040A4F3 (ram) is
    Code (Text):
    1. movsx eax,word ptr [03b22dcc]
    If you nop it, it doesn't load any lighting data other than the default. I've been trying to trace it, to see if I can find a tree or something that lists where the light data is per level. But I've had no luck, aside from this:
    [​IMG]
    Lights on, and off, respectively. So far it only seems to apply to objects.

    With another attempt, I was using the sadx preview debugger to find some floats that might sit in the lighting and or palette data, and did some scans of a certain float for speed highway. I found a tree of 0x30 bytes that seems to match the lighting data in the preview debug menu, it's 0x30 and starts with a level/act designation. Problem is, its never read from. Speed Highway's data starts at 5245400 (dec, sonic.exe)

    Edit:
    some further hackery seems to yield positive results. Here's a quick and dirty asm hack forcing the game to always load perfect chaos' data:

    [​IMG]
    top: regular
    bottom: level 19's data.

    Also, because the preview debugger calls this stuff "ls_palete" data, calling it palette data is something I'm going to do from now on. This will differentiate it from actual lighting data.
     
  18. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    this is as far as I got with that:
    Code (Text):
    1. ;esp=0012FD40
    2. 0040A4A0 - 83 ec 08                   - sub esp,08;push*2;esp=0012FD38
    3. 0040A4A3 - 0f bf 05 cc 2d b2 03       - movsx eax,word ptr [03b22dcc];move level to eax;eax=0000001A
    4. 0040A4AA - 0f bf 0d ec 2d b2 03       - movsx ecx,word ptr [03b22dec];move act to ecx;ecx=00000003
    5. 0040A4B1 - c1 e0 08                   - shl eax,08;shift eax left 8 times;eax=00001A00
    6. 0040A4B4 - 0b c1                      - or eax,ecx;combine eax and ecx;eax=00001A03
    7. 0040A4B6 - 8b c8                      - mov ecx,eax;copy eax to ecx;ecx=00001A03
    8. 0040A4B8 - c1 f9 08                   - sar cl,08;remove act from ecx;ecx=0000001A
    9. 0040A4BB - 83 f9 1a                   - cmp ecx,1a;test ecx for Station Square
    10. 0040A4BE - 0f b6 c0                   - movzx eax,al;remove level from eax;eax=00000003
    11. 0040A4C1 - 89 4c 24 04                - mov [esp+04],ecx;add ecx to stack without pushing;see 0040A4A0
    12. 0040A4C5 - 89 44 24 00                - mov [esp+00],eax;add eax to stack without pushing
    13. 0040A4C9 - 74 0a                      - je 0040a4d5;if level is SS, jump
    14. 0040A4CB - 83 f9 21                   - cmp ecx,21;if level is Mystic Ruins...
    15. 0040A4CE - 74 05                      - je 0040a4d5;jump
    16. 0040A4D0 - 83 f9 1d                   - cmp ecx,1d;if level not Egg Carrier (Outside)...
    17. 0040A4D3 - 75 29                      - jne 0040a4fe;jump
    18. 0040A4D5 - 53                         - push ebx
    19. 0040A4D6 - 57                         - push edi
    20. 0040A4D7 - 8d 7c 24 08                - lea edi,[esp+08];move address of act to edi
    21. 0040A4DB - 8d 5c 24 0c                - lea ebx,[esp+0c];move address of level to ebx
    22. 0040A4DF - e8 3c ff ff ff             - call 0040a420
    after that, it gets confusing.
     
  19. Dude

    Dude

    Tech Member
    3,138
    0
    16
    Southbridge, MA
    Random VR/AR trash
    Just a quick question, did you happen to find anything that calls data as opposed to more code (perhaps copying a large chunk of stuff to a new place)? That's what I'm mostly interested in. I can figure out which level goes with what data by trial and error. Also, the reason it's checking for the adventure fields is for "time-of-day" functionality.

    UPDATE: I found ALMOST what I was looking for, but still useful. This is NOT the ls_palette data:


    Sonic Light Data tree at: 5245208

    each struct is 0x30
    byte level;
    byte act;
    float lights[11];

    Windy valley isn't included in the tree because of its dynamic lighting used by the tornado. I'm sure there's a lost world exception too. There are dupes of this data floating around too. If one thing doesn't work, search for a copy of it and edit that.

    for testing purposes, I used speed highway:
    Speed Highway Lights:
    0x30 bytes @ 5247464
    duplicate @ 5245400 (duplicate? Error checking? I'll never know)

    [​IMG]

    I am so pumped right now ^_^
     
  20. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    Oh, so the lighting code would be after the call, where it jumps when you aren't in a field? But now I'm interested in that subroutine. I've looked for a "Time of day" value, but I couldn't find one. I'll look at the rest of the code after the call.

    Edit:
    [​IMG]
    What's wrong with this picture?
    Time of day is 1 byte at Pointer(03B0EF4C).
    Change it before the level and the bg changes, change it during the level and the lighting changes.
    Also, the lamps only change when they spawn. So if you have lamps far enough away, you can get lamps lit and unlit on screen at the same time.
    Edit2: in the Mystic Ruins, the BG changes instantly, and in the MR Chao Garden, nothing changes until you reload the stage.
    And it has no effect at all on the Egg Carrier, despite testing for it... cut feature, anybody?
    Edit3: The pointer points to an array of structs, 0xC in size indexed by character, starting at 03B183A8, with Super Sonic using the fourth slot.
    Edit4: The address it uses for indexing is 03B18A24. Changing it seems to have no effect. I think the 03B18xxx area needs to be looked into further, it's also where the upgrade flags are stored.

    Edit5: I looked into the SETMIllaac.BIN files, and the list looks something like this:
    <div class='codetop'>CODE</div><div class='codemain' style='height:200px;white-space:pre;overflow:auto'>[0]
    Name=Mission Card
    [1]
    Name=Point Mark
    [2]
    Name=Balloon
    [3]
    Name=Red Flag
    [4]
    Name=Medal
    [5]
    Name=SA2 Board
    [6]
    Name=Spinner (Attack)
    [7]
    Name=Spinner (Float)
    [8]
    Name=Electro Spinner
    [9]
    Name=Robo-Shark!
    [10]
    Name=Nothing?
    [11]
    Name=Statue
    [12]
    Name=Flag that moves with you?
    [13]
    Name=Crash
    </div>
    Unfortunately, it looks like the mission that an object is associated with, as well as when to show it, is stored elsewhere. And it seems like most of these object have the properties mapped to XYZ scale, but I didn't try all of them.

    Edit6: The time of day is saved with everything else, so now I have a 100% game with Sonic at night. Now I just need to find where it loads from and saves to. And despite having separate time of day values, the Adventure and Mission modes use the same address, so there has to be somewhere else it's getting the values from.