don't click here

SADX/SA1 Hacking/Modding

Discussion in 'Engineering & Reverse Engineering' started by MainMemory, Aug 15, 2009.

  1. Dude

    Dude

    Tech Member
    3,138
    0
    16
    Southbridge, MA
    Random VR/AR trash
    Yes, I can do it. Its alot of work and I'm in the process of porting other characters first but I may do it eventually.

    I'm no moderator, and I frequently ponder this question myself, but I'd say post whenever you've got something new.

    Code (Text):
    1. 0043A2CE - 85 c0                      - test eax,eax
    2. 0043A2D0 - 8b 4e 0c                   - mov ecx,[esi+0c] // stores geo address in ecx
    3. 0043A2D3 - 53                         - push ebx
    4. 0043A2D4 - 57                         - push edi
    5. 0043A2D5 - 7e 29                      - jle 0043a300
    6. 0043A2D7 - 8d 79 18                   - lea edi,[ecx+18]
    7. 0043A2DA - 8b d8                      - mov ebx,eax
    8. 0043A2DC - 8d 64 24 00                - lea esp,[esp+00]
    9. 0043A2E0 - 8b 47 08                   - mov eax,[edi+08]
    10. 0043A2E3 - 25 00 00 00 84             - and eax,84000000
    11. 0043A2E8 - 3d 00 00 00 80             - cmp eax,80000000
    12. 0043A2ED - 75 0b                      - jne 0043a2fa
    This little tidbit (the commented one) pushes the location of the geometry loader + key into the register ecx. I'm using this to finish my list of level headers, but if you don't feel like waiting you can use that plus a level/act combination to find the loader in question.

    Also, if you wanted to port super sonic's frame data to metal sonic you could, but it would mostly break sonic as well.
     
  2. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    So, are the animations model independent? I know the data pointed to in that array says what model to use, but if we could find the transformation data or whatever, could it be applied to any model? If we could do that, it would certainly open possibilities.
     
  3. Dude

    Dude

    Tech Member
    3,138
    0
    16
    Southbridge, MA
    Random VR/AR trash
    Yes, this is why the old supersonic hack used sonic's animations. Remember that animations in sadx are per object, there is no skeletal animation system. I have no idea how the game assigns which frames to which model piece, but I'm almost 100% certain its in order of ID.
     
  4. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    So, it would be entirely possible to give Amy Sonic's "Surfer Stance" then? :D
    In other news, I tried looking around the "Metal Sonic & Tails" code, and I found something that checks for Sonic, but disabling it did nothing. :(
    However, I DID find this: 03ABDC7C. Set it to 8, and the intro movie will play, 12, the title screen. THIS is the Game Mode I was looking for with the other address.
     
  5. Dude

    Dude

    Tech Member
    3,138
    0
    16
    Southbridge, MA
    Random VR/AR trash
    Through careful manipulation yes, but it wouldn't be (very) practical unless the id's for the character pieces matched up, for instance amy's head would need to have the same id as sonic's head and whatnot, or they at least have the same relative setup and number of ID's.

    Also, have you come across how the game handles the menu layouts? I've always wanted to change the menu screens around abit to make things abit more refreshing. Also when the game shows the SEGA screens, if you try making the pvr black, the screen still has a white border in the higher resolutions. I've never been able to find (nor did I look very hard) where the BGRA value is stored.
     
  6. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    I have no idea how the menus work, I couldn't even find the selected item value! (Except for the Character Select)

    Some values for the Game Mode address:
    Code (Text):
    1. *0 - Restart Game (Doesn't stop music)
    2. *2 - Exit SADX?
    3. *3 - Black out screen, game still playing Edit: or in level, disable object collision?
    4. *4 - Action Stage (Adventure Mode)
    5. *5 - Adventure Field (Adventure Mode)
    6. *6 - Clear Screen, Disable movement
    7. *7 - Clear Screen, Disable movement
    8. *8 - Intro Movie (-> Title Screen) (Doesn't stop music)
    9. *9 - Action Stage (Trial Mode)
    10. *10 - Adventure Field/Action Stage (Mission Mode)
    11. *11 - Return to Character Select
    12. *12 - Title Screen + Menus
    13. *13 - Restart Game
    14. *17 - Jump to Adventure
    15. *18 - Story Introduction Screen
    16. *21 - Start Credits
    17. *22 - Credits
     
  7. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    So, above the sound effect filenames, there's a list of .rel files (which don't exist) and the SET/CAM files to use for each act, looking like this:
    Code (Text):
    1. SS05 - Act 5
    2. SS04 - Act 4
    3. SS03 - Act 3
    4. SS02 - Act 2
    5. SS01 - Act 1
    6. SS00 - Act 0
    7. _Adv00.rel - Station Square
    Then, before that, there's the character ID list:
    Code (Text):
    1. L - Super Sonic (Last Story)
    2. B - Big
    3. E - E-102 Gamma
    4. A - Amy
    5. TI - Tikal?
    6. K - Knuckles
    7. M - Tails
    8. EG - Eggman?
    9. S - Sonic
    Note: all of the text lists in SADX are backwards. They start at the end and move towards the beginning.
    This list mostly matches the character ID's that you can set in RAM, except that Super Sonic is Sonic and IDs 1,4 and 8 crash the game.
     
  8. Polygon Jim

    Polygon Jim

    Eternal Tech Member
    0
    3
    0
    across town from Hinchy
    All the bitches.


    The .rel files would be leftovers from the GC version. Lot's of files are stored as .rel.


    I've found it twice today. First time it was 0B9C4128, second time it was 0B874128. The values of the options should help you track it down.

    Code (Text):
    1. 00 - Adventure
    2. 01 - Trial
    3. 02 - Mission
    4. 03 - Options
    5. 04 - Quit Game.
    edit: After 6 times finding it I can tell you it is always 0B??4128.
     
  9. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    I know what .rel files are, it's just strange that their names are still in the PC version. And that's the only place you can find them.

    09AD4128.
    Also, I got
    Code (Text):
    1. 0 - Adventure
    2. 1 - Trial
    3. 2 - Mission
    4. 3 - Mini Game Collection
    5. 4 - Options
    6. 5 - End Game
    Code (Text):
    1. EAX=FFCD2501
    2. EBX=00000000
    3. ECX=00000001
    4. EDX=09AD412A
    5. ESI=09AD4100
    6. EDI=09AD412A
    7. EBP=007EE3A0
    8. ESP=0012FD44
    9. EIP=00432A7F
    10.  
    11. Probable base pointer =09AD4100
    12.  
    13. 00432a74 - lea edi,[esi+2a]
    14. 00432a77 - call 00431e50
    15. 00432a7c - mov [esi+28],al <-
    16. 00432a7f - jmp 00432ac1
    17. 00432a81 - mov eax,[eax+0c]
    Edit: Can't find a pointer.
     
  10. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    Code (Text):
    1. 004157CC - 33 ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- xor edi,edi;clear edi
    2. 004157CE - 8b ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- mov edi,edi;move edi to edi?
    3. 004157D0 - 66 85 ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - test di,di;test di for 0
    4. 004157D3 - 0f 85 4c 01 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jne 00415925;if not 0, jump
    5. 004157D9 - 66 39 3d c0 2d b2 03&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - cmp [03b22dc0],di;test for Sonic
    6. 004157E0 - 75 38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jne 0041581a;if not, jump
    Disabling the jne here and entering Casinopolis as Knuckles resulted in Sonic and Knuckles both spawning and under my control, with the camera focusing on Sonic. Then I jumped with them too close, Sonic died and the game crashed.
     
  11. Dude

    Dude

    Tech Member
    3,138
    0
    16
    Southbridge, MA
    Random VR/AR trash
    This has so much awesome potential. I know there's a way to accept a second controller input, tails in 1p mode can be controlled with one. The only problem is that the game only uses one controller mapping, so if you've got 2 different types of controllers it won't work. I've wanted 2p in sadx since the beginning.
     
  12. 2P Sonic DX?! Sign me up!!
     
  13. Dude

    Dude

    Tech Member
    3,138
    0
    16
    Southbridge, MA
    Random VR/AR trash
  14. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    [​IMG]
    Code (Text):
    1. 004157CC - 33 ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- xor edi,edi
    2. 004157CE - 8b ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- mov edi,edi
    3. 004157D0 - 66 85 ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - test di,di
    4. 004157D3 - 0f 85 4c 01 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jne 00415925
    5. 004157D9 - 66 39 3d c0 2d b2 03&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - cmp [03b22dc0],di;test for Sonic
    6. 004157E0 - 75 38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jne 0041581a
    7. ----
    8. 00415842 - 66 83 3d c0 2d b2 03 02&nbsp;&nbsp;&nbsp;&nbsp;- cmp word ptr [03b22dc0],02;test for Tails
    9. 0041584A - 75 38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jne 00415884
    10. ----
    11. 0041581A - 66 83 3d c0 2d b2 03 03&nbsp;&nbsp;&nbsp;&nbsp;- cmp word ptr [03b22dc0],03;test for Knuckles
    12. 00415822 - 75 1e&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jne 00415842
    13. ----
    14. 004158AD - 66 83 3d c0 2d b2 03 05&nbsp;&nbsp;&nbsp;&nbsp;- cmp word ptr [03b22dc0],05;test for Amy
    15. 004158B5 - 75 1e&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jne 004158d5
    16. ----
    17. 004158D5 - 66 83 3d c0 2d b2 03 06&nbsp;&nbsp;&nbsp;&nbsp;- cmp word ptr [03b22dc0],06;test for Gamma
    18. 004158DD - 75 1f&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jne 004158fe
    19. ----
    20. 00415884 - 66 83 3d c0 2d b2 03 07&nbsp;&nbsp;&nbsp;&nbsp;- cmp word ptr [03b22dc0],07;test for Big
    21. 0041588C - 75 1f&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jne 004158ad
    The only thing left now is figuring out CPU Tails and CPU Sonic. We definitely need to look at the code after these, it likely will tell us more about how the characters work.

    Edit: Huh, it looks like the order is Sonic -> Knuckles -> Tails -> Big -> Amy -> Gamma.
    Edit2: Causing the game to not load any characters makes it crash. Which I expected.
     
  15. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    Right after the code I just posted:
    Sonic:
    Code (Text):
    1. 004157E2 - 66 a1 cc 2d b2 03&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- mov ax,[03b22dcc];move level to ax
    2. 004157E8 - 66 3d 24 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- cmp ax,0024;test for Sky Chase Act 1
    3. 004157EC - 74 0d&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- je 004157fb;jump if equal
    4. 004157EE - 66 3d 25 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- cmp ax,0025;test for Sky Chase Act 2
    5. 004157F2 - 74 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- je 004157fb;jump if equal
    6. 004157F4 - 68 b0 a9 49 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 0049a9b0;push character's address onto the stack
    7. 004157F9 - eb 05&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jmp 00415800;skip the next line
    8. 004157FB - 68 c0 7e 62 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 00627ec0;push Tornado's address onto the stack
    9. 00415800 - 6a 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 01
    10. 00415802 - 6a 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 07
    11. 00415804 - e8 ed 5f ff ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - call 0040b860;call character loading subroutine
    Tails:
    Code (Text):
    1. 0041584C - 66 a1 cc 2d b2 03&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- mov ax,[03b22dcc];move level to ax
    2. 00415852 - 66 3d 24 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- cmp ax,0024;test for Sky Chase Act 1
    3. 00415856 - 74 0d&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- je 00415865;jump if equal
    4. 00415858 - 66 3d 25 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- cmp ax,0025;test for Sky Chase Act 2
    5. 0041585C - 74 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- je 00415865;jump if equal
    6. 0041585E - 68 00 17 46 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 00461700;push character's address onto the stack
    7. 00415863 - eb 05&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- jmp 0041586a;skip next line
    8. 00415865 - 68 c0 7e 62 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 00627ec0;push Tornado's address onto the stack
    9. 0041586A - 6a 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 01
    10. 0041586C - 6a 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 07
    11. 0041586E - e8 ed 5f ff ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - call 0040b860;call character loading subroutine
    Knuckles:
    Code (Text):
    1. 00415824 - 68 70 a7 47 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 0047a770;push character's address onto the stack
    2. 00415829 - 6a 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 01
    3. 0041582B - 6a 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 07
    4. 0041582D - e8 2e 60 ff ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - call 0040b860;call character loading subroutine
    Amy:
    Code (Text):
    1. 004158B7 - 68 f0 ab 48 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 0048abf0;push character's address onto the stack
    2. 004158BC - 6a 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 01
    3. 004158BE - 6a 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 07
    4. 004158C0 - e8 9b 5f ff ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - call 0040b860;call character loading subroutine
    Gamma:
    Code (Text):
    1. 004158DF - 68 30 34 48 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 00483430;push character's address onto the stack
    2. 004158E4 - 6a 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 01
    3. 004158E6 - 6a 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 07
    4. 004158E8 - e8 73 5f ff ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - call 0040b860;call character loading subroutine
    Big:
    Code (Text):
    1. 0041588E - 68 00 0a 49 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 00490a00;push character's address onto the stack
    2. 00415893 - 6a 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 01
    3. 00415895 - 6a 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 07
    4. 00415897 - e8 c4 5f ff ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - call 0040b860;call character loading subroutine
    You may now be amazed.
    Notice that the last three lines are the same for every character.

    Edit: http://www.youtube.com/watch?v=NmEg7APFJjg
     
  16. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    Code (Text):
    1. 0047EDC0 - 68 00 17 46 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 00461700;push Tails' address
    2. 0047EDC5 - 6a 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 01
    3. 0047EDC7 - c6 40 08 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- mov byte ptr [eax+08],01;set CPU mode (object already exists?)
    4. 0047EDCB - 6a 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 07
    5. 0047EDCD - c7 45 18 10 db 47 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - mov [ebp+18],0047db10
    6. 0047EDD4 - e8 87 ca f8 ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - call 0040b860;load character
     
  17. Dude

    Dude

    Tech Member
    3,138
    0
    16
    Southbridge, MA
    Random VR/AR trash
    oh good I'll be able to use that pointer edit to make big load sonic or just crash.

    Big needs to come out of the game. srsly
     
  18. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    It's funny how the different characters act with Tails' AI. Normally Tails jumps and starts flying to keep up with you, Sonic will do a jump dash when he hits the ground to keep up with you, Amy for some reason hits the ground with her hammer, Big and Gamma are completely hopeless.

    Edit: CPU Sonic:
    Code (Text):
    1. 0047DA1B - 68 b0 a9 49 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - push 0049a9b0;push Sonic's address
    2. 0047DA20 - 6a 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 01
    3. 0047DA22 - 6a 07&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- push 07
    4. 0047DA24 - e8 37 de f8 ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - call 0040b860;call sub
     
  19. MainMemory

    MainMemory

    Kate the Wolf Tech Member
    4,742
    338
    63
    SonLVL
    First we have Sonic teaming up with everyone (except Tails) in Emerald Coast. Then, Sonic races to save Station Square from a missile attack!

    Also, I disabled the code to load the Tornado in Sky Chase Act 1, and I died as soon as the level started. Turns out I was spawning inside the dragon boss I left in the level. And everything else can hurt normal Sonic as well. It looks like the camera (and everything else) is programmed to go based on where you are, because the camera only started when I went near the normal starting area. From there everything is based on time. And even if the Tornado isn't spawned, it will show up to get hit by the laser.

    Oh yeah, loading the Tornado in any other level crashes the game.
     
  20. Overlord

    Overlord

    Now playable in Smash Bros Ultimate Moderator
    19,239
    972
    93
    Long-term happiness
    Awesome stuff. I love especially how retarded Big looks trying to get up that ramp and failing =P


    Also, interesting in the Tails video - the lives icon stays as his, and the life boxes work as Tails lives (that are awarded to you correctly), so something somewhere is still keeping track of the original character for the level.