øAslickproductions.org/forum/index.php?PHPSESSID=5f0fck550j2m4m2fpbtkj2vkm1&topic=1756.msg17455e:/My Web Sites/Slick Productions - FFIV Message Board/slickproductions.org/forum/index2456.htmlslickproductions.org/forum/index.php?PHPSESSID=5f0fck550j2m4m2fpbtkj2vkm1&topic=1756.0e:/My Web Sites/Slick Productions - FFIV Message Board/slickproductions.org/forum/index2456.html.zx«^g^ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÈ…¬ã OKtext/htmlISO-8859-1gzip8:Öã ÿÿÿÿÿÿÿÿTue, 10 Mar 2020 09:48:50 GMT0ó°° ®0®P®€§²ð®ª^g^ÿÿÿÿÿÿÿÿô*ã  Changing the effects of call items?

« previous next »
Pages: 1 2 »

Author Topic: Changing the effects of call items?  (Read 4370 times)

chillyfeez

  • FF4 Hacker
  • *
  • Posts: 1,285
  • Gender: Male
  • Go ahead, ask me about Angel Feathers!
    • View Profile
Changing the effects of call items?
« on: September 11, 2012, 12:29:12 PM »
Hello, all - longtime reader, first-time poster.

As far as I can see, this hasn't been discovered yet: Anyone have any clue how one could change the effects of the call items? It would be great if we could use the Imp item to actually do something cool, like, say, teach Tellah Nuke or White.  (since Imp is useless, and it would be just as easy to have Rydia start with it)

I've searched the ROM for instances of "04 31" (which would be "Rydia learns Imp" in an event), and there are only 26 of them, so I could try playing with each one to see if there's any worthwhile change, but none of them seem to have "04 32," "04 33" and "04 34" all nearby (Learning Cockatrice, Mage and Bomb), so none of them seem to be likely candidates.  At 463C3, there's 04 31 04 32 04 33 but then no 04 34... not to mention the entire block is full of 04 xx's, so that's probably a red herring...

So it looks like the effect of the call items is dictated some other way.  I'm willing to do some experimentation, but I have no idea where to start.  Any thoughts?
 :hmm:
Logged

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Changing the effects of call items?
« Reply #1 on: September 11, 2012, 05:29:57 PM »
I like this thought process. I decided to try and use your first plan in checked to see if 04 31 was the target and replaced all instances, but unfortunately it was not the case.

Perhaps you could trace it with a memory editor, when you learn Imp? Put a Breakpoint on the item slot and trace back from there? Something I might want to consider in seeing how the game looks at event items.
Logged

chillyfeez

  • FF4 Hacker
  • *
  • Posts: 1,285
  • Gender: Male
  • Go ahead, ask me about Angel Feathers!
    • View Profile
Re: Changing the effects of call items?
« Reply #2 on: September 13, 2012, 04:04:18 PM »
well...
to be honest, I'm new to hacking, so I had to teach myself how to use breakpoints in Geiger's Snes9X.
So far all I can do is change who gets the spell.  The instruction is found at $1a8b3 - simply change the second byte to the RAM location of the first slot of the target spell list (for instance, changing from "99 C0 15" to "99 D8 15" makes Tellah learn the spell in his White list).
A couple of frustrating points about this, though:
1. It still says "Rydia learned..." This is easy enough to fix, though...
2. The game still checks to make sure Rydia is in the party, so I can't make Tellah learn Imp unless Rydia is there.
3. Seems all four call items execute the same instruction, so if Tellah learns Imp, he'll also be the one learning Mage, Cockatrice and Bomb.

and, of course,

4. Still haven't figured out how to change which spell is learned.

I'll keep playing around, will post findings.
Logged

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Changing the effects of call items?
« Reply #3 on: September 13, 2012, 08:05:16 PM »
What an odd way to program it, I guess it saves a couple of bytes though. So it seems that those items were ever meant to teach One character 4 spells. Ah well.

Either way, good work! I've tried using Geiger's a bit but have come up blank. Could you share how you found that value? It might help me realize what I'm missing in using it.
Logged

chillyfeez

  • FF4 Hacker
  • *
  • Posts: 1,285
  • Gender: Male
  • Go ahead, ask me about Angel Feathers!
    • View Profile
Re: Changing the effects of call items?
« Reply #4 on: September 13, 2012, 08:43:22 PM »
I tried a breakpoint on the item slot per your suggestion, but the ROM freezes and stays frozen when you open the item screen, like it's constantly referencing that part of the RAM whenever the item screen is open(?), so I tried from the other end - set a breakpoint to when the game writes to the first slot of the spell list, 7E15C0 (make sure you empty the first call magic slot before you go any further). 
If you do this, you see:

$01/A8B3 99 C0 15    STA $15C0,y[$7E:15C0]   A:1031 X:0040 Y:0000 P:envMXdIzC

"A:1031" is the instruction to add Imp to the spell list. if you hit Edit Registers at the break and change register A to "103F," Rydia learns Baham instead of Imp.  I don't know enough about ASM to know what to do with this knowledge, though (i presume there must be a place in the ROM somewhere where it finds that "1031").  I'm guessing that, since adding the spell is the last functional step the ROM takes, I'm also missing vital instructions that take place BEFORE this happens.
Logged

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Changing the effects of call items?
« Reply #5 on: September 13, 2012, 08:59:23 PM »
Good work! I'm always glad to hear the process as well as the result. As for other steps... in ROM you would be looking for 3F10 since the bytes reverse (as far as I recall anyhow) I'll do a quick search to see how many instances of that there are.

EDIT: Apparently replacing all instances of 1031 or 3110 did nothing dealing with Imp or Rydia learning Imp. A shame we're not entirely sure where it's grabbing 1031 to put it into Register A.
« Last Edit: September 13, 2012, 09:49:54 PM by Grimoire LD »
Logged

chillyfeez

  • FF4 Hacker
  • *
  • Posts: 1,285
  • Gender: Male
  • Go ahead, ask me about Angel Feathers!
    • View Profile
Re: Changing the effects of call items?
« Reply #6 on: September 13, 2012, 10:10:36 PM »
Now THIS is interesting...
I changed the 99 at $1A8B3 to a 98 and got "Rydia learned [blank]"
Then I tried 97 and got "Rydia Learned Fast," but then it crashed...
 :omg:

EDIT: Nevermind, I get "Rydia Learned Fast," (crash) for most other trials, and occasionally "Rydia learned [blank]." This must just be the ROM's way of telling me something isn't computing right.
« Last Edit: September 13, 2012, 10:32:54 PM by chillyfeez »
Logged

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Changing the effects of call items?
« Reply #7 on: September 13, 2012, 11:06:38 PM »
That is almost no doubt an ASM command, and changing that is probably causing the crash. At least that's what I would assume from what you're mentioning it.
Logged

Pinkpuff

  • Flan Princess
  • *
  • Posts: 924
  • Find a Megalixir in Unprecedented Crisis!
    • View Profile
Re: Changing the effects of call items?
« Reply #8 on: September 14, 2012, 05:05:44 AM »
If you are able to figure it out (or someone is), then it's going in the editor for sure.
Logged
Let's dance!

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Changing the effects of call items?
« Reply #9 on: September 14, 2012, 08:16:44 AM »
Thanks to your 1A8B3 hint I did manage to find the first part of what we're looking for, the ID of the sought after Party Member to learn spells.

At 0x1A877 there is a 03, this is Rydia's ID that she Must be in the party to learn the spell. Perhaps the game did intend for others to learn optional spells at one point, since...



Depending on the character ID it shows that name. However as you can imagine, it's all cosmetic. Though you must have Cecil in the party to learn Imp, it is still Rydia who learns Imp.  This goes back to what you first said about changing the owner of the spell and we still have yet to find that in RAM outside of the registers. With any luck we'll find it soon.

EDIT: Oh you were absolutely right, just didn't realize that you had already found the pointer, hehe. Well for reference sake in RAM it is at 1A8B3, the 99 C0 15 pointer.

EDIT 2: Unfortunately you were correct, that single byte is linked to all four Summons, no idea how to easily change that, as for all intents and purposes, we are sifting through ASM and only pulling at data rather than instructions.


EDIT 3: Found it in ROM, curiously enough this entire RAM section is located only 12,000 bytes removed from ROM. In a 1.1? Rom? (Whichever one happens to work with FF4kster) So it's at 0xAA77 for the ID to change who needs to be in the party for the spells to be learned and...

0xAAB3 for where the spells will be added to (still need to find how the spells are added.)

« Last Edit: September 14, 2012, 09:47:42 AM by Grimoire LD »
Logged

chillyfeez

  • FF4 Hacker
  • *
  • Posts: 1,285
  • Gender: Male
  • Go ahead, ask me about Angel Feathers!
    • View Profile
Re: Changing the effects of call items?
« Reply #10 on: September 14, 2012, 10:12:13 AM »
That's great! glad to have someone who actually has some experience helping with this.
I had a thought this morning: there must be some fixed location in the RAM that represents register A, right?
My next step is to search the entire RAM for 1031 (or 3110) at the break.  If I can find an instance (or a manageable number of instances), then I'll look for a change when using the bomb item (should change to 1032/3210). 
If we can figure out where Register A is, then we can set a breakpoint to catch operations that write there...

EDIT: As if this wasn't going to take a lot of time already... the Emu keeps crashing every 6000-7000 lines I search through.  So far I've found 3110 at offsets A100 and 6A100 (could there be a pattern here, and if so does that imply that this is meaningless?).
Anyway, I gotta get ready for work now.  I'll have to pick this up later.
« Last Edit: September 14, 2012, 10:50:32 AM by chillyfeez »
Logged

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Changing the effects of call items?
« Reply #11 on: September 14, 2012, 11:05:12 AM »
I've found a bit since I last posted, but it wasn't anything concrete.

1031 or 10... anything, really. is a red herring. There's nothing in ROM that deals with 10XX, in those manners, they appear to be somehow part of the instruction.

Now as for useful info. I found, I feel that we are Very close, with this new information.

I set a breakpoint on the start of the Summon Item Routine, Summon Items start at 0x1A86F. I traced the data and found the call to the Imp Item, E7 and where it was drawing this from. At 0x1B3B  it looks for the current item you're holding so I set a breakpoint and traced that back to where it was drawing the spell information and I didn't quite find that part specifically, but I did find that the game looks at the start of the Summon Item Routine, 0x1A86F (Seeing it at 6FA8) and sure enough I found nine references in ROM to 6FA8. I replaced them all, tried to use a Summon Item and was met with a black screen. We are Close! But, I need to find another compatible item address to see which of the 9 references is what we're looking for.

Incidentally this may help me with finding where items draw events from.
Logged

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Changing the effects of call items?
« Reply #12 on: September 14, 2012, 01:03:18 PM »
I think I found it. E7 - B6 = 31, the number of Imp, E8 - B6 = 32, the number of Bomb, E9 - B6 = 33, the number of Roc, EA - B6 = 34, the number of Mage.


What we were looking for this whole time was B6, not 31. Quite a bit of clever space saving on their part.



This is located in RAM at 0x1A892

And in ROM at...  0xAA92

This is quite unfortunate though. You can only have the four spells be spells that come in sequence. However this does free up four Summon Skill slots and allows players to learn some unique spells if they put their starting point in the Monster Spells portion...

Remember that it is normally E7,E8,E9,EA - B6, you change B6, do a little bit of Hex Math and you can decide where you want the four to go.


This was quite tricky to find, but in reality was staring me in the face for a while. I just did not realize that it was a -B6 we were searching for. The game makes a lot of references to Address 0x145, which is where starting addresses are placed, I followed that to 0x1A893 as I noticed the 1031 had been added at that time, but by that time it was too late in the sequence to search for it. So I chanced it by using the hex right before it 0x1A891 and there I saw a SEQ B6. I was very confused about what this had to do anything, then I realized that it may not be as simple as finding an elusive digit. This is ASM after all and hardly anything is that straight forward. Then I saw that right before this was the item reference of E7. Finally I came to the conclusion that they may be related, SBC meant to subtract something, put it in the calculator E7 - B6 did indeed equal 31. Everything made sense from there.
« Last Edit: September 14, 2012, 01:11:24 PM by Grimoire LD »
Logged

chillyfeez

  • FF4 Hacker
  • *
  • Posts: 1,285
  • Gender: Male
  • Go ahead, ask me about Angel Feathers!
    • View Profile
Re: Changing the effects of call items?
« Reply #13 on: September 14, 2012, 10:46:01 PM »
Grimoire, you are some kinda wizard.  That's awesome.
Logged

Pinkpuff

  • Flan Princess
  • *
  • Posts: 924
  • Find a Megalixir in Unprecedented Crisis!
    • View Profile
Re: Changing the effects of call items?
« Reply #14 on: September 15, 2012, 07:55:07 AM »
Slightly off-topic... but could they have used a similar technique to encode the ranges for the strange item equip properties (two-handed, bow, armor slots etc)?
Logged
Let's dance!
Pages: 1 2 »
« previous next »