Find My Content- Group:
- Researcher: Researcher
- Active Posts:
- 1157 (0.29 per day)
- Most Active In:
- General Sonic Discussion (559 posts)
- Joined:
- 16-June 04
- Profile Views:
- 10045
- Last Active:
A minute ago- Currently:
- Viewing Board Index
A minute agoMy Information
- Age:
- Age Unknown
- Birthday:
- Birthday Unknown
- Gender:
-
Male
Male
Contact Information
- E-mail:
- Click here to e-mail me
Previous Fields
- National Flag:
- None
- Wiki edits:
- 109
Latest Visitors
-
JorgeBunny 
10 Jun 2015 - 17:52 -
Jase
30 May 2015 - 20:16 -
Xeal
24 May 2015 - 09:55 -
MrTechNews
21 May 2015 - 09:43 -
golden retrie...
19 Mar 2015 - 04:02
Topics I've Started
-
Panzer Dragoon Saga Prototype (9/16/97) Title Debug Menus Enabled
07 July 2015 - 03:07 PM
Download here!
About 7 years a go, drx released a few prototypes for Panzer Dragoon Saga. The earliest one (9/16/97) is the most interesting of the bunch. While it does have a debugger activated by default on the second controller while in game, the prototype only has that much enabled which left a lot of the game unexplored. It was reported that the game had a sound test but as far as I know no one has figured out how to access it until now. It turns out that the game has two sets of title screen selections, one for retail release and one for development (the former is activated by default in this prototype). The two arrays contain the string for the entry on the title screen, some padding data (although it might be data relating to where it's printed on the screen?), and a loading subroutine for that option. See the code below:
ROM:0603E4D0 title_select_list:.data.l h'1FFFB ; DATA XREF: ROM:loc_6023174o ROM:0603E4D0 ; ROM:off_60231E0o ROM:0603E4D4 .data.l aNewGame ; "NEW GAME" ROM:0603E4D8 .data.l loc_60235D6 ROM:0603E4DC .data.l h'1FFFC ROM:0603E4E0 .data.l aContinue ; "CONTINUE" ROM:0603E4E4 .data.l loc_60235E0 ROM:0603E4E8 title_select_list_debug:.data.l h'1FFF8 ; DATA XREF: ROM:0602316Co ROM:0603E4E8 ; ROM:off_60231DCo ROM:0603E4EC .data.l aNewGame ; "NEW GAME" ROM:0603E4F0 .data.l loc_60235D6 ROM:0603E4F4 .data.l h'1FFF9 ROM:0603E4F8 .data.l aContinue ; "CONTINUE" ROM:0603E4FC .data.l loc_60235E0 ROM:0603E500 .data.l h'1FFFA ROM:0603E504 .data.l aTown ; "TOWN" ROM:0603E508 .data.l loc_60235EA ROM:0603E50C .data.l h'1FFFB ROM:0603E510 .data.l aField ; "FIELD" ROM:0603E514 .data.l loc_60235F2 ROM:0603E518 .data.l h'1FFFC ROM:0603E51C .data.l aBattle ; "BATTLE" ROM:0603E520 .data.l loc_60235FA ROM:0603E524 .data.l h'1FFFD ROM:0603E528 .data.l aSound ; "SOUND" ROM:0603E52C .data.l loc_6023602 ROM:0603E530 .data.l h'1FFFE ROM:0603E534 .data.l aMovie ; "MOVIE" ROM:0603E538 .data.l loc_602361C
In 1ST_READ.PRG, the game will do the following to determine which list to load:
ROM:06023160 loc_6023160: ; CODE XREF: ROM:06023154j ROM:06023160 mov.w #h'F6, r4 ; Move Immediate Word Data ROM:06023162 mov.l #sub_601DC88, r3 ; Move Immediate Long Data ROM:06023164 jsr @r3 ; sub_601DC88 ; Jump to Subroutine ROM:06023166 nop ; No Operation ROM:06023168 tst r0, r0 ; Test Logical ROM:0602316A bt loc_6023174 ; Branch if True ROM:0602316C mov.l #title_select_list_debug, r3 ; Move Immediate Long Data ROM:0602316E mov.l r3, @(8,r14) ; Move Structure Long Data ROM:06023170 bra loc_602317A ; Branch ROM:06023172 mov #7, r0 ; Move Immediate Byte Data ROM:06023174 ; --------------------------------------------------------------------------- ROM:06023174 ROM:06023174 loc_6023174: ; CODE XREF: ROM:0602316Aj ROM:06023174 mov.l #title_select_list, r2 ; Move Immediate Long Data ROM:06023176 mov #2, r0 ; Move Immediate Byte Data ROM:06023178 mov.l r2, @(8,r14) ; Move Structure Long Data
To fix this issue, I simply changed the branch if true to a branch if false and it worked just fine. I know I could've released a patch/code for this instead of just uploading the game again, but I wasn't sure if the release was still floating around or not so I figured I should put it up again just in case. I'm sure that this still exists in all release of Saga, so I could potentially come up with a patch/code for all the other releases as well.
Some pictures of the menus:
Enjoy!
PS: Select Town -> EVENT059 and watch the cutscene. All the voices are using the motion capture actor scratch voices. Pretty neat.
EDIT: I noticed SSF doesn't want to load the ISO for me. Here's a savestate instead (tested with the latest test version). -
Creating a 60fps patch for Jet Set Radio (PC)
02 July 2015 - 01:09 PM
Hey all.
I few months a go I wanted to find a way to get the PC port of Jet Set Radio running at 60fps. I found it odd that the game would unlock it's frame rate at times during fade outs, so I wanted to see if there was a way to have the frame rate unlocked all the time.
I recently discovered that the Android port of Jet Set Radio contains three ARM binaries in the lib folder (libjetsetradio.so and libjetsetradio-nn.so are the more interesting of the bunch). The best part is that the Android port, much like the port of Sonic Advance, contains the original symbols for the data/functions in both binaries. Since I assume the code base for the PC/Android ports are both somewhat similar, I figured that I could use the symbols from the Android version to help find the equivalent subroutines in the PC port.
Currently I'm looking at a function called "njRendererSetFpsLock", which looks as follows (addressing might not be exactly the same for you since I had to decrypt my executable):
.text:01291B40 ; =============== S U B R O U T I N E ======================================= .text:01291B40 .text:01291B40 ; Attributes: bp-based frame .text:01291B40 .text:01291B40 njRendererSetFpsLock proc near ; CODE XREF: j_njRendererSetFpsLockj .text:01291B40 .text:01291B40 arg_0 = dword ptr 8 .text:01291B40 .text:01291B40 push ebp .text:01291B41 mov ebp, esp .text:01291B43 cmp [ebp+arg_0], 0 .text:01291B47 mov ecx, _ZN6CVideo8instanceE_ptr .text:01291B4D mov eax, [ecx] .text:01291B4F mov eax, [eax+98h] .text:01291B55 setnz dl .text:01291B58 movzx edx, dl .text:01291B5B push edx .text:01291B5C call eax .text:01291B5E pop ebp .text:01291B5F retn .text:01291B5F njRendererSetFpsLock endp .text:01291B5F .text:01291B5F ; ---------------------------------------------------------------------------
This function will either take a 0 or 1 as a parameter (1 for enable, 0 for disable I'm assuming). In the Android port, this function is called by a couple subroutines - exAdxlogo, deProgress, coProgress, exSequenceFirstCheckEnd, exSequenceDemoEnd, exSequenceDemoWait, exSequenceFirstCheckInit. These calls exist to some extent in the PC port, but I can only somewhat guess as to which function is which (for example, I know exAdxlogo is where the Heritage video is loaded/played by putting a breakpoint where the call is).
The only problem with this is that I can't seem to get anything to happen if I change the parameter around in the IDA Pro debugger when it's pushed onto the stack. So I don't know if this really is the function that modifies the frame limit. There are some other curious functions in the Android port that I might investigate later.
The reason for this post is that I'm wondering if anyone is interested in helping me get the game running at 60fps. If you want, you can download the interesting binaries from the Android port along with the decrypted exe from the PC port (along with Ida Pro 6.7 databases for each). If you can't open the databases, you can just drag the executables in your favorite disassembler instead. -
Sonic Colors 60fps hack (NTSC/PAL)
26 April 2015 - 12:54 PM
I figured I'd post it here since I know it's something people have probably wanted for a long time.
AdderDee from the Dolphin-Emu forums came up with a patch that makes Sonic Colors run at 60fps. Quoting the post for prosperity:
Quote
So I've made this Action Replay code that allows the game to run at a constant 60FPS:
008F2D97 00000001 0090DB0B 00000001 0155FAB7 00000001 0155FCCF 00000001
You'll need to ramp up the emulated CPU clock a good bit so that you won't go below 60 in-game. You'll also need to check "Store EFB Copies To Texture Only."
Unfortunately, I don't own the NTSC version, so I don't have a code for that, but if anyone's willing to find/convert it, then that would be much appreciated!
For those who are unfamiliar with Dolphin or haven't used Dolphin before, you can grab the latest developmental version of Dolphin from dolphin-emu.org. You're going to have to use a strong PC to run the game (even without the patch). Have the game in your game list and go into Config->Advanced Tab and set the slider for the CPU Clock Override to around 200%. Go to the Graphics config and tick "Store EFB copies to Texture Only" under the Hacks tab. After that you should be all set.
I suspect someone will make a video of this shortly. I've tested the code myself on my NTSC copy and it works great. I wonder how it runs on Wii itself? -
Sonic Advance 1 Android Port Decompile
21 July 2014 - 02:10 PM
A few years a go, Sonic Advance 1 was ported to Android platforms in Japan. The port eventually made it's way to the states I believe by GameLoft. The original Japanese port, however, has symbol names for functions and variables/boolean. The GameLoft versions seems to have been truncated of both data and code. I noticed that there were a multitude of Java/Android decompilers out there. Perhaps we can find use with the knowledge we can get from this version?
Check this out. I ran AndroChef Java Decompiler on the .dex executable which was converted to a .jar:
We had a link to the Japanese APK when the game just came out, but I can't seem to find the original Japanese APK anywhere. I can provide the files, just not the package. The files themselves are interesting too. All the music is MIDI, either it's the original I have no idea (fun fact: the GameLoft version uses OGGs, and the mobile phone ports of the game use MIDIs. The 1UP midi used in the mobile phone port in particular was actually converted from the original rom using GBA2MID, lel). The sound effects are all ogg files. Tiles were converted to .png.
You can download the extracted files here, along with the decompiled java stuff. Just open the .jar up in your favorite archive explorer, the decompiled code are in the .java files. -
Phantasy Star Online NTE for DC ('prototype')?
24 June 2014 - 01:25 PM
Someone over at TCRF posted about the Network Trial Edition for PSO. It's technically a prototype of PSO V1 for the Dreamcast, and already seems to have some nice musical differences. I think there were some people who were researching the formats used in games like PSO, so I decided that maybe reposting it here would generate some interest.
Quoting here just in case.
Quote
I was waiting for this to come around. This isn't my dump, I don't know who's dump initially made it to TOSEC but it's about time.
About a month and a half before the final Japanese retail version of PSO V1 went gold, Sega allowed a few players a chance to play a "Network Trial" before the game's release to test the server load (as well as I think the last few parts of the game). Pretty rare as far as I know, and I don't know if the players had to send their copies back to Sega after they were done. But nonetheless, a few copies were distributed and found their ways into people willing to dump it. The trial now exists under the TOSEC catalog as of February of this year.
To save you the trouble of hunting it down, you can download the trial here.
Unfortunately, this was supposed to be an online only trial, so it's not possible to play the single player campaign. However, I believe the Sylverant PSO Server software can let you connect to a private server. I'm not sure how playable the server is, but there is login/lobby support at least. You'll also need an emulator that supports the broadband adapter. I think there were a few that can let you do this.
When prompted, you need to provide a serial number and access key. These keys are from VasiliyRS' copy of the game:
Serial No.: 4572564555550673
Access Key: pNgwyMTrN3VfuksW
Here are some screenshots I took.
And now, time for some differences! Just a few notable ones so far:
General:
- There are logos for ADX in the opening
- No movie files
- The options screen will only let you change one thing. I don't know what it is though.
- The 'Homepage' only contains a page with a link to Dricas and Sonic Team's website. The official PSO web page isn't linked for some reason.
- Instead of playing the opening cinematic when you start a new game, a text scroll detailing the game's story plays instead (see screenshot above).
- After the text scroll, you can create a character. Everything seems to be here as far as I know.
- OFFLINE MODE is listed but disabled, obviously.
- When ONLINE MODE is selected, it'll give a disclaimer to agree on. I think it then does some kind of calendar or adapter check to see if it should allow you to enter the Serial/Access key info. I'm not entirely sure though.
Sound and Music (click the link to hear and download the music):
BASS.ACX - This is the level warp sound effect (when you're appearing in a new area). This is completely different in the NTE.
CITY32K.ADX - This is 'Pioneer2". File not present in the final. I thought this was just a 32khz version of the Ship music, but it's actually a different mix of the song. A lot more reverb in this version.
DARK2.ADX - This is 'Cry, for 'IDOLA' the holy'. Sounds slightly different in comparison to the final.
DELO.ADX - This is 'From seeing the rough wave', the Cave boss theme. Differently mixed, uses sampled/synthesized strings instead of real orchestral strings.
EPI2.ADX - This is 'After the story2'. Sounds like a demo version of the track, using synthesized strings instead of real orchestral strings, etc.
J_CLEAR.ADX - Just a mono version of the jingle that plays when you complete a quest. File doesn't exist in the Final.
VOL_OPT2.ADX - This is 'You have nowhere to go'. Sounds like a demo version of the track, using sampling instead of a real orchestra.
Misc:
DUMMY.BIN - Just a blank 704 KB file, nothing inside.
GSL_#.GSL - All the GSL files for the maps are here, some even have the English script.
There are a lot more MAP_ANCIENT##.REL files in the NTE. What are these?
PLYMOTIONDATA.REL - doesn't exist in the final
There are definitely some in game differences. As I said, the Sylverant PSO Server software can probably get you in game. BlueCrab (the author) posted some screenshots of what it looks like in the lobby which he took screenshots of (I don't feel comfortable rehosting them without permission, so I'll link to them instead). Note though, I don't know if these are indeed differences in the NTE or just something with the server:
Lobby differences:
- The NPCs at the counter are male instead of female.
- The Lobby warps are all normal Area warps.
That's it from me so far. There's a lot of stuff to go through file wise. I don't know much about the other file formats used in PSO, so it should be interesting to see what's in there. Hopefully someone with more technical know how about the games can take a look.
Cheers!
EDIT: Supposedly, the latest version of Demul is the only known emulator that can emulate the BBA well enough to connect to a server. I still can't get past this message after selecting Online mode though:
