Author Topic: Grimoire LD's Notes, Patches, and Hacks (Dark Knight/Paladin Swap In Battle!)  (Read 78631 times)

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #30 on: September 15, 2013, 02:12:00 PM »
Here's a surprisingly straightforward command in Dispel. with no jumps, nothing complicated and everything (for the most part) easily distinguishable. You can see what Square was Trying to do with the status, but you can then also notice how they messed one thing up (two since it can't dispel Reflect because it is Reflectable...) leading to a glitch.



Dispel Routine

Code: [Select]
$03/D8B0 A5 CE LDA $CE    [$00:00CE] A:0003 X:0020 Y:FFFF P:envMxdizc - Load A into CE.
$03/D8B2 10 03 BPL $03    [$D8B7] A:0080 X:0020 Y:FFFF P:eNvMxdizc - Branch if positive to 03D8B7
$03/D8B4 18 CLC A:0080 X:0020 Y:FFFF P:eNvMxdizc - Clear Carry Flag.
$03/D8B5 69 05 ADC #$05 A:0080 X:0020 Y:FFFF P:eNvMxdizc - Add 05 into A.
$03/D8B7 AA TAX A:0085 X:0020 Y:FFFF P:eNvMxdizc - Transfer A to X.
$03/D8B8 9E 6D 35 STZ $356D,x[$7E:35F2] A:0085 X:0085 Y:FFFF P:envMxdizc - Store Zero in 7E35F2.
$03/D8BB AD 04 27 LDA $2704  [$7E:2704] A:0085 X:0085 Y:FFFF P:envMxdizc - Load Status Byte 2 of Target into A.
$03/D8BE 85 A9 STA $A9    [$00:00A9] A:0040 X:0085 Y:FFFF P:envMxdizc - Store Current Status in A9. 
$03/D8C0 29 FB AND #$FB A:0040 X:0085 Y:FFFF P:envMxdizc - -4 to A (if the bit is set?) (This removes Berserk in some way. Likely because FF - FB = 4 so therefore FB would be -4. )
$03/D8C2 8D 04 27 STA $2704  [$7E:2704] A:0040 X:0085 Y:FFFF P:envMxdizc - Store A into 7E2704
$03/D8C5 A5 A9 LDA $A9    [$00:00A9] A:0040 X:0085 Y:FFFF P:envMxdizc - Load Initial Status2 from A9 into A. (Before the 04 bit was removed)
$03/D8C7 29 04 AND #$04 A:0040 X:0085 Y:FFFF P:envMxdizc - Is it Berserk?
$03/D8C9 F0 0E BEQ $0E    [$D8D9] A:0000 X:0085 Y:FFFF P:envMxdiZc - If not, branch to 03D8D9.
-----------------------------------------------------------------------------------------------------------------------------------------------------------
$03/D8CB AD CE 00 LDA $00CE  [$7E:00CE] A:0004 X:0085 Y:FFFF P:envMxdizc - Load A from CE.
$03/D8CE 10 04 BPL $04    [$D8D4] A:0080 X:0085 Y:FFFF P:eNvMxdizc - Branch to 03D8D4 if not 80. (Not sure how this wouldn't be 80..)
$03/D8D0 A9 E1 LDA #$E1 A:0080 X:0085 Y:FFFF P:eNvMxdizc - Load Value E1 into A.
$03/D8D2 80 02 BRA $02    [$D8D6] A:00E1 X:0085 Y:FFFF P:eNvMxdizc - Branch Always to 03D8D6.
(Likely used to set the Berserked character back into a usable state)
-----------------------------------------------------------------------------------------------------------------
 (Couldn't be copied since I couldn't access so...) A9 21 - Load 21 into A.
-----------------------------------------------------------------------------------------------------------------
$03/D8D6 8D 51 27 STA $2751  [$7E:2751] A:00E1 X:0085 Y:FFFF P:eNvMxdizc - Store A in ?Next Action of Target?) - (If A was not 80 before somehow, it would be 21.)
-----------------------------------------------------------------------------------------------------------------------------------------------------------
$03/D8D9 AD 06 27 LDA $2706  [$7E:2706] A:0000 X:0085 Y:FFFF P:envMxdiZc - Load Status Byte 4 of Target into A.
$03/D8DC 29 83 AND #$83 A:000C X:0085 Y:FFFF P:envMxdizc - (Add -7C (83) into A, nulling (4) Image 1, (8) 2, (10) Barrier, (20) Wall, and (40)HP Leak. (=73)
$03/D8DE 8D 06 27 STA $2706  [$7E:2706] A:0000 X:0085 Y:FFFF P:envMxdiZc - Store the new Target's Status Byte 4 into A.
$03/D8E1 A5 CF LDA $CF    [$00:00CF] A:0000 X:0085 Y:FFFF P:envMxdiZc - Load A from CF.
$03/D8E3 0A ASL A A:0005 X:0085 Y:FFFF P:envMxdizc - Multiply A by 2.
$03/D8E4 AA TAX A:000A X:0085 Y:FFFF P:envMxdizc - Transfer A to X.
$03/D8E5 BD EB 29 LDA $29EB,x[$7E:29F5] A:000A X:000A Y:FFFF P:envMxdizc - Load A into 7E29F5 . (The Tower of Babil docs say that this is 29EB-2A03 Bitmask of status events that are to expire (?) for each slot. Which must be causing the odd Stop glitch. It's actually programmed to remove the timer, but isn't programmed to remove Stop. If I had to guess it is likely supposed to remove HP Leak's timer. Or Dispel's functionality may have been different at one point in development. )
$03/D8E8 29 5F AND #$5F A:0040 X:000A Y:FFFF P:envMxdizc- ?? (Presumably removes Stop's timer if present. Not sure how though. When stopped the value reads C0. which is a +80 from 40. 5F, either positive or negative would not return it to basics.
$03/D8EA 9D EB 29 STA $29EB,x[$7E:29F5] A:0040 X:000A Y:FFFF P:envMxdizc - Store A into 7E29F5.
$03/D8ED 60 RTS A:0040 X:000A Y:FFFF P:envMxdizc - Return


$03/D8BE   85 A9   STA $A9    [$00:00A9]   A:0040   X:0085   Y:FFFF   P:envMxdizc - Store Current Status in A9.  (Just a point of curiosity, this was used on a flying enemy which apparently have Float innately. I had thought that their Quake-resistance came from their Weakness set? Or does that weakness set also give Float?)

Improvements: While having it effect Protect and Shell boosts is fairly difficult (because to my knowledge default defense is never saved and in the menu stats the increased defense is saved over from the battle stats until the start of the next battle where the battle stats are somehow corrected, but the menu stats are not, therefore finding a default for them seems quite tricky.) We could at least have it normalize speed getting rid of both Haste/Slow effects as all you would need to do is put a 10  (LDA 10, as easy as that) into that. It would probably be best to change the part where it looks and removes Stop's timer to reset Speed.

Are there any other improvements people can think of for Dispel that they think could be usable?
« Last Edit: September 15, 2013, 02:19:28 PM by Grimoire LD »

chillyfeez

  • FF4 Hacker
  • *
  • Posts: 1,285
  • Gender: Male
  • Go ahead, ask me about Angel Feathers!
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #31 on: September 15, 2013, 11:47:14 PM »
... having it effect Protect and Shell boosts is fairly difficult (because to my knowledge default defense is never saved and in the menu stats the increased defense is saved over from the battle stats until the start of the next battle where the battle stats are somehow corrected, but the menu stats are not, therefore finding a default for them seems quite tricky.)
The (for lack of a better term) permanent stat record for each character is stored in RAM at 1000-113F, each is 40 bytes long. When a battle starts, this is copied into the more-temporary 80 byte record at 2000-227F. So, to remove Protect from the first character (for example), just re-copy 102A to 202A.

As for floating/flying and quake - this works rather unlike other elements. When using a spell or item, the elemental damage check looks for (first) is the target floating, (then) is an item being used, (if so) is it the earth drum, (if not) is the spell quake, titan or monster skill quake - if so, then the damage subroutine is skipped.

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #32 on: September 16, 2013, 06:45:16 AM »
I had thought the same thing Chillyfeez but a while back when I was experimenting with Bluff I noticed that the stat changes were carried over into the Out-of-Battle menu stats at 1000. You can see this in action as well when you use Protect and Shell your Magic Defense and Defense will be altered outside of battle. This makes using it as a default to reset Protect and Shell as not reliable because each battle that stat could potentially increase since that heightened value isn't overwritten until after the battle. Say Cecil has 20 Defense and Protect adds 5 to Defense, outside of battle this would display 25. Next time you go into battle it would still read 25 in the Outside-of-battle but somehow it will reset properly in battle to what it should be. So you use Dispel on yourself and instead of resetting your Defense to 20 it instead raises it to 25 because of the not-yet reset stat bonuses.


Here's most of Weak's routine. It seems straightforward enough but there are still some things that need to be confirmed and reviewed.
Tornado (Weak) Routine -

Code: [Select]
$03/D453 A2 01 00 LDX #$0001 A:0003 X:0006 Y:0000 P:envMxdizc - Load 01 into X.
$03/D456 A9 09 LDA #$09 A:0003 X:0001 Y:0000 P:envMxdizc - Load 09 into A.
$03/D458 20 79 83 JSR $8379  [$03:8379] A:0009 X:0001 Y:0000 P:envMxdizc (Looks to be a random number generator where it takes the values between 1 and 9 to get their final HP, decided by the first two bytes above. So you can have it give a random value from 1-255.)
$03/8379 E2 10 SEP #$10 A:0009 X:0001 Y:0000 P:envMxdizc ?Set Processor Bits?
$03/837B 86 96 STX $96    [$00:0096] A:0009 X:0001 Y:0000 P:envMXdizc - Store the value in  to x96.
$03/837D E0 FF CPX #$FF A:0009 X:0001 Y:0000 P:envMXdizc - Compare X to ?FF?
$03/837F D0 02 BNE $02    [$8383] A:0009 X:0001 Y:0000 P:envMXdizc - Branch if ?not equal? to 038383.
------------------------------------------------------------------------------------------------------------------------------------------------------

----------------------------------------------------------------------------------------------------------------------------------------------------------
$03/8383 C9 00 CMP #$00 A:0009 X:0001 Y:0000 P:envMXdizc - Compare A to 00.
$03/8385 F0 2F BEQ $2F    [$83B6] A:0009 X:0001 Y:0000 P:envMXdizC - Branch if 00 to 0383B6
$03/8387 C5 96 CMP $96    [$00:0096] A:0009 X:0001 Y:0000 P:envMXdizC - Is it 96?
$03/8389 F0 2B BEQ $2B    [$83B6] A:0009 X:0001 Y:0000 P:envMXdizC - If so branch to 0383B6
$03/838B A6 97 LDX $97    [$00:0097] A:0009 X:0001 Y:0000 P:envMXdizC - Load X into x97.
$03/838D 38 SEC A:0009 X:0049 Y:0000 P:envMXdizC - Clear Carry Flag
$03/838E E5 96 SBC $96    [$00:0096] A:0009 X:0049 Y:0000 P:envMXdizC - Subtract A from the value in 96.
$03/8390 C9 FF CMP #$FF A:0008 X:0049 Y:0000 P:envMXdizC - Compare to FF
$03/8392 D0 05 BNE $05    [$8399] A:0008 X:0049 Y:0000 P:envMXdizc - Branch if it is not FF to 038399
-----------------------------------------------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------------------------------------------------------------------------------
$03/8399 1A INC A A:0008 X:0049 Y:0000 P:envMXdizc - Increment A (how this results in 3, I have no idea, but this is what is saved into HP.)
$03/D45B AA TAX A:0003 X:0000 Y:0000 P:envMxdizc - Transfer A to X.
$03/D45C 86 A9 STX $A9    [$00:00A9] A:0003 X:0003 Y:0000 P:envMxdizc - Store X in A9.
$03/D45E C2 20 REP #$20 A:0003 X:0003 Y:0000 P:envMxdizc - Reset Professor Status (0x20?)
$03/D460 AD 07 27 LDA $2707  [$7E:2707] A:0003 X:0003 Y:0000 P:envmxdizc - Load Target's HP.
$03/D463 C5 A9 CMP $A9    [$00:00A9] A:01F4 X:0003 Y:0000 P:envmxdizc - Compare between the the value in A9.
$03/D465 90 08 BCC $08    [$D46F] A:01F4 X:0003 Y:0000 P:envmxdizC - Branch and carry flag to 03D465 if applicable.
$03/D467 A5 A9 LDA $A9    [$00:00A9] A:01F4 X:0003 Y:0000 P:envmxdizC - Load the 03 from where it was stored.
$03/D469 8D 07 27 STA $2707  [$7E:2707] A:0003 X:0003 Y:0000 P:envmxdizC - Store it in Target's HP.
$03/D46C E2 20 SEP #$20 A:0003 X:0003 Y:0000 P:envmxdizC - Set Processor Status
$03/D46E 60 RTS A:0003 X:0003 Y:0000 P:envMxdizC - Return.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------------------------------------------------------

I'll try to fix this later once I can find out how to get to the branches.

chillyfeez

  • FF4 Hacker
  • *
  • Posts: 1,285
  • Gender: Male
  • Go ahead, ask me about Angel Feathers!
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #33 on: September 16, 2013, 07:30:49 AM »
I would think, then, that the master stat would be copied to some backup location to be referenced later. The game does this a lot in-battle. Specifically I've noticed it using blocks of RAM in the 00s and the 3000s as placeholders but I'm sure there's more. Probably could be found by setting a breakpoint on reading the 1000-level defense and mag defense stats. I'd bet they copy to the 2000-level locations and somewhere else at the beginning of battle, but maybe the placeholding copy isn't set until armor/shell is cast.

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #34 on: September 16, 2013, 10:59:16 AM »
Hmm, well here is what I've found so far but its not exactly helpful.

Code: [Select]
$03/9A18 18 CLC A:0017 X:0002 Y:0017 P:eNvMxdIzc - Clear Carry Flag
$03/9A19 B1 82 LDA ($82),y[$7E:2797] A:0017 X:0002 Y:0017 P:eNvMxdIzc Load A from 7E2797 (apparently a 2)
$03/9A1B 65 A9 ADC $A9    [$00:00A9] A:0002 X:0002 Y:0017 P:envMxdIzc - Add the value from A9 (which makes it a 10.)
$03/9A1D 85 A9 STA $A9    [$00:00A9] A:0010 X:0002 Y:0017 P:envMxdIzc - Store A in A9.
$03/9A1F 98 TYA A:0010 X:0002 Y:0017 P:envMxdIzc  - Transfer Y to A.
$03/9A20 18 CLC A:0017 X:0002 Y:0017 P:envMxdIzc - Clear Carry Flag.
$03/9A21 69 0B ADC #$0B A:0017 X:0002 Y:0017 P:envMxdIzc - Add B to A making 22.
$03/9A23 A8 TAY A:0022 X:0002 Y:0017 P:envMxdIzc - Transfer A to Y.
$03/9A24 E8 INX A:0022 X:0002 Y:0022 P:envMxdIzc Increment X.
$03/9A25 E0 03 00 CPX #$0003 A:0022 X:0003 Y:0022 P:envMxdIzc - Compare to X?
$03/9A28 D0 EE BNE $EE    [$9A18] A:0022 X:0003 Y:0022 P:envMxdIZC -  Branch if not equal to 039A18.
$03/9A2A A0 2A 00 LDY #$002A A:0022 X:0003 Y:0022 P:envMxdIZC - Load Y into 2A.
$03/9A2D 18 CLC A:0022 X:0003 Y:002A P:envMxdIzC - Clear Carry Flag.
$03/9A2E A5 A9 LDA $A9    [$00:00A9] A:0022 X:0003 Y:002A P:envMxdIzc - Load the place where 10 was stored.
$03/9A30 6D 6F 39 ADC $396F  [$7E:396F] A:0010 X:0003 Y:002A P:envMxdIzc -  Add to the value in ADC 7E396F (It's 1)
$03/9A33 20 31 9E JSR $9E31  [$03:9E31] A:0011 X:0003 Y:002A P:envMxdIzc - Jump to routine.
-----------------------------------------------------------------------------------------------------------------------------------------------------------
$03/9E31 90 02 BCC $02    [$9E35] A:0011 X:0003 Y:002A P:envMxdIzc - Branch if Carry is Cleared.
$03/9E35 60 RTS A:0011 X:0003 Y:002A P:envMxdIzc Return.
-------------------------------------------------------------------------------------------------------------------------------------------------------------
$03/9A36 91 80 STA ($80),y[$7E:202A] A:0011 X:0003 Y:002A P:envMxdIzc Store A in Defense (11)

So it draws it somehow from somewhere in A9 adding +2 in a completely different place and finally having +1 added from 7E396F.

This seems to be the way all stats are eventually put into the battle stats. One: They're erased. Two: They are overwritten with the stats in 7E1000 and 3 some values are overwritten from the values in this block of code.

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #35 on: September 17, 2013, 05:54:52 PM »
Effect 06 - Status Routine

Code: [Select]
$03/D515 AD A3 28 LDA $28A3  [$7E:28A3] A:0003 X:000C Y:0000 P:envMxdizc - Load Status to Inflict from 7E28A3.
$03/D518 10 0A BPL $0A    [$D524] A:0004 X:000C Y:0000 P:envMxdizc - Branch if Plus to 03D524. (Death and Curse would be the branch point here)
-----------------------------------------------------------------------------------------------------------------------------------------------
$03/D51A AD 40 27 LDA $2740  [$7E:2740] A:0080 X:000C Y:0000 P:eNvMxdizc - Check Target's Creature Type.
$03/D51D 29 8A AND #$8A A:0000 X:000C Y:0000 P:envMxdiZc - Is it Machine, Spirit, or Undead?
$03/D51F F0 03 BEQ $03    [$D524] A:0000 X:000C Y:0000 P:envMxdiZc - If not, branch to 03D524.
----------------------------------------------------------------------------------------------------------------------------------------------------
$03/D521 4C B2 D5 JMP $D5B2  [$03:D5B2] A:0008 X:000C Y:0000 P:envMxdizc - Jump to 03D5B2 (which leads to a Return)
----------------------------------------------------------------------------------------------------------------------------------------------
$03/D524 AD 03 27 LDA $2703  [$7E:2703] A:0004 X:000C Y:0000 P:envMxdizc - Load Target's Status Byte 1 into A.
$03/D527 85 AC STA $AC    [$00:00AC] A:0000 X:000C Y:0000 P:envMxdiZc - Store Current Status1 in AC.
$03/D529 85 A9 STA $A9    [$00:00A9] A:0000 X:000C Y:0000 P:envMxdiZc - Store Current Status1 in A9.
$03/D52B AD 04 27 LDA $2704  [$7E:2704] A:0000 X:000C Y:0000 P:envMxdiZc - Load Target's Status Byte 2 into A.
$03/D52E 85 AA STA $AA    [$00:00AA] A:0000 X:000C Y:0000 P:envMxdiZc - Store Current Status2 in AA.
$03/D530 29 BF AND #$BF A:0000 X:000C Y:0000 P:envMxdiZc - (-48 meaning it will get rid of ?Charm and Float? Maybe for other purposes, as that doesn't actually happen to the target)
$03/D532 85 AB STA $AB    [$00:00AB] A:0000 X:000C Y:0000 P:envMxdiZc - Store Current Status2 in AB.
$03/D534 AD A3 28 LDA $28A3  [$7E:28A3] A:0000 X:000C Y:0000 P:envMxdiZc - Load Status to inflict from 7E28A3.
$03/D537 85 AE STA $AE    [$00:00AE] A:0004 X:000C Y:0000 P:envMxdizc - Store it in AE.
$03/D539 AD A4 28 LDA $28A4  [$7E:28A4] A:0004 X:000C Y:0000 P:envMxdizc - Load Second Status to Inflict from 7E28A4.
$03/D53C 85 AD STA $AD    [$00:00AD] A:0000 X:000C Y:0000 P:envMxdiZc - Store it in AD.
$03/D53E C2 20 REP #$20 A:0000 X:000C Y:0000 P:envMxdiZc - Reset Processor.
$03/D540 A5 AB LDA $AB    [$00:00AB] A:0000 X:000C Y:0000 P:envmxdiZc - Load Current Status2 from AB.
$03/D542 C5 AD CMP $AD    [$00:00AD] A:0000 X:000C Y:0000 P:envmxdiZc - Compare it to Second Status to inflict from AD.
$03/D544 90 06 BCC $06    [$D54C] A:0000 X:000C Y:0000 P:eNvmxdizc - If equal, branch to 03D54C.
---------------------------------------------------------------------------------------------------------------------------------
(Appears to be the Miss or Resist Routine?)
$03/D546 7B TDC A:0400 X:000C Y:0000 P:envmxdizC -Transfer Direct Page to A?
$03/D547 E2 20 SEP #$20 A:0000 X:000C Y:0000 P:envmxdiZC - Set Processor Status.
$03/D549 4C B2 D5 JMP $D5B2  [$03:D5B2] A:0000 X:000C Y:0000 P:envMxdiZC - Jump to 03D5B2.
-----------------------------------------------------------------------------------------------------------------------------------
$03/D54C 7B TDC A:0000 X:000C Y:0000 P:eNvmxdizc - Transfer Direct Page to A?
$03/D54D E2 20 SEP #$20 A:0000 X:000C Y:0000 P:envmxdiZc  - Set Processor Status.
$03/D54F AD 2B 27 LDA $272B  [$7E:272B] A:0000 X:000C Y:0000 P:envMxdiZc - Load Target's Status Immunity1 into A.
$03/D552 2D A3 28 AND $28A3  [$7E:28A3] A:00B9 X:000C Y:0000 P:eNvMxdizc - Check it against Status to Inflict1.
$03/D555 D0 06 BNE $06    [$D55D] A:0000 X:000C Y:0000 P:envMxdiZc - If bits aligned branch to 03D55D.
$03/D557 AD 2C 27 LDA $272C  [$7E:272C] A:0000 X:000C Y:0000 P:envMxdiZc - Load Target's Status Immunity2 into A.
$03/D55A 2D A4 28 AND $28A4  [$7E:28A4] A:0030 X:000C Y:0000 P:envMxdizc - Check it against Status to Inflict2.
$03/D55D D0 53 BNE $53    [$D5B2] A:0000 X:000C Y:0000 P:envMxdiZc - If bits aligned branch to 03D5B2.
$03/D55F AD 03 27 LDA $2703  [$7E:2703] A:0000 X:000C Y:0000 P:envMxdiZc - Load Target's Status Byte 1 into A.
$03/D562 05 AE ORA $AE    [$00:00AE] A:0000 X:000C Y:0000 P:envMxdiZc - Somehow adds the Stored Status to inflict from AE.
$03/D564 8D 03 27 STA $2703  [$7E:2703] A:0004 X:000C Y:0000 P:envMxdizc - Store A in Target's Status Byte 1.
$03/D567 AD 04 27 LDA $2704  [$7E:2704] A:0004 X:000C Y:0000 P:envMxdizc - Load Target's Status Byte 2 into A.
$03/D56A 05 AD ORA $AD    [$00:00AD] A:0000 X:000C Y:0000 P:envMxdiZc - Somehow adds the Stored Status2 to inflict from AD.
$03/D56C 8D 04 27 STA $2704  [$7E:2704] A:0000 X:000C Y:0000 P:envMxdiZc - Store A in Target's Status Byte 2.
$03/D56F AD A4 28 LDA $28A4  [$7E:28A4] A:0000 X:000C Y:0000 P:envMxdiZc - Load A from Status to Inflict2.
$03/D572 29 28 AND #$28 A:0000 X:000C Y:0000 P:envMxdiZc - Is it Charm or Paralyze
$03/D574 F0 3A BEQ $3A    [$D5B0] A:0000 X:000C Y:0000 P:envMxdiZc - Branch if not to 03D5B0.
--------------------------------------------------------------------------------------------------------------------------------------------
$03/D576 AD 04 27 LDA $2704  [$7E:2704] A:0008 X:000C Y:0000 P:envMxdizc - Load A from Target's Status Byte 2.
$03/D579 29 FB AND #$FB A:000C X:000C Y:0000 P:envMxdizc - ?? (-4 somehow?) Replaces Berserk with Charm.
$03/D57B 8D 04 27 STA $2704  [$7E:2704] A:0008 X:000C Y:0000 P:envMxdizc  - Store A in Target's Status Byte 2.
$03/D57E A5 CF LDA $CF    [$00:00CF] A:0008 X:000C Y:0000 P:envMxdizc - Load CF into A.
$03/D580 85 DF STA $DF    [$00:00DF] A:0008 X:000C Y:0000 P:envMxdizc - Store A in DF.
$03/D582 A9 15 LDA #$15 A:0008 X:000C Y:0000 P:envMxdizc - Load 15 into A.
$03/D584 85 E1 STA $E1    [$00:00E1] A:0015 X:000C Y:0000 P:envMxdizc - Store A in E1.
$03/D586 20 E0 83 JSR $83E0  [$03:83E0] A:0015 X:000C Y:0000 P:envMxdizc - Jump to Subroutine.
$03/D589 A6 E3 LDX $E3    [$00:00E3] A:0000 X:0000 Y:0000 P:envMxdiZc - Load the value in E3 into X.
$03/D58B 8E 30 35 STX $3530  [$7E:3530] A:0000 X:00A8 Y:0000 P:envMxdizc - Store X in 7E3530.
$03/D58E A9 03 LDA #$03 A:0000 X:00A8 Y:0000 P:envMxdizc - Load 03 into A.
$03/D590 20 69 85 JSR $8569  [$03:8569] A:0003 X:00A8 Y:0000 P:envMxdizc - Jump to Subroutine.
$03/D596 AD 04 27 LDA $2704  [$7E:2704] A:0000 X:00AB Y:0000 P:envMxdizc - Target's Status Byte 2.
$03/D599 29 20 AND #$20 A:0008 X:00AB Y:0000 P:envMxdizc - Is it Paralyze?
$03/D59B F0 13 BEQ $13    [$D5B0] A:0000 X:00AB Y:0000 P:envMxdiZc - If not branch to 03D5B0
-----------------------------------------------------------------------------------------------------------------------
$03/D59D AD 04 27 LDA $2704  [$7E:2704] A:0020 X:00AB Y:FFFF P:envMxdizc - Load Target's Status Byte 2.
$03/D5A0 29 F7 AND #$F7 A:0020 X:00AB Y:FFFF P:envMxdizc - Get rid of Charm, if affecting Target.
$03/D5A2 8D 04 27 STA $2704  [$7E:2704] A:0020 X:00AB Y:FFFF P:envMxdizc - Store Paralyze in Status Byte 2.
$03/D5A5 A9 01 LDA #$01 A:0020 X:00AB Y:FFFF P:envMxdizc - Load 01 into A.
$03/D5A7 9D 04 2A STA $2A04,x[$7E:2AAF] A:0001 X:00AB Y:FFFF P:envMxdizc - Store in 7E2A04
$03/D5AA 9E 05 2A STZ $2A05,x[$7E:2AB0] A:0001 X:00AB Y:FFFF P:envMxdizc - Store Zero in 7E2A05.
$03/D5AD 9E 06 2A STZ $2A06,x[$7E:2AB1] A:0001 X:00AB Y:FFFF P:envMxdizc - Store Zero in 7E2A06
-----------------------------------------------------------------------------------------------------------------------
$03/D5B0 80 03 BRA $03    [$D5B5] A:0000 X:00AB Y:0000 P:envMxdiZc - Always Branch to 03D5B5.
--------------------------------------------------------------------------------------------------------------------------------------------
$03/D5B2 20 2D E0 JSR $E02D  [$03:E02D] A:0000 X:000C Y:0000 P:envMxdiZC - Jump to Subroutine
------------------------------------------------------------------------------------------------------------------------------------------
$03/D5B5 60 RTS A:0000 X:000C Y:0000 P:envMxdiZc - Return.


Now this is strange. As far as I can see and from my own tests there is nothing that prevents this from working on any specific monster type. Mute, Charm, Berserk, Float works perfectly fine on Zombie-type, Machine-type,  and Spirits. They all use the formula that says it shouldn't work on them. The only thing I can think of is that Yousei may have looked at the start of the data, not paying attention that this only occurs if the status to inflict is Death or Curse.
So this...

    06 status: various, does not affect spirits, undead, or machines

Is debunked. It works on anything that doesn't resist it.

However the purpose of the separate routine for statuses with timers make sense as this formula does not appear to have any safety drop for them. Even its special coding for Paralyze doesn't work (do I foresee some Free Code in our future?) the enemy will never properly recover from Paralyze when used from this routine. That is a freed up 19 bytes for us to use if we ever wanted to add something else special to the Status Routine. Even the Creature Type check at the start is rather redundant as you can set it easily enough in the monster's individual status, freeing up even more bytes.

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #36 on: September 17, 2013, 07:21:14 PM »
07 Immobilizing Routine

Code: [Select]
$03/D5B6 A9 04 LDA #$04 A:0003 X:000E Y:FFFF P:envMxdizc - Load 04 into A.
$03/D5B8 85 D6 STA $D6    [$00:00D6] A:0004 X:000E Y:FFFF P:envMxdizc - Store A in D6.
$03/D5BA A5 CF LDA $CF    [$00:00CF] A:0004 X:000E Y:FFFF P:envMxdizc - Load A from CF.
$03/D5BC 20 36 9E JSR $9E36  [$03:9E36] A:0008 X:000E Y:FFFF P:envMxdizc - Jump to Subroutine.
$03/D5BF A9 03 LDA #$03 A:0000 X:0029 Y:0029 P:envMxdizc - Load 03 into A.
$03/D5C1 20 69 85 JSR $8569  [$03:8569] A:0003 X:0029 Y:0029 P:envMxdizc - Jump to Subroutine.
$03/D5C4 AE 98 35 LDX $3598  [$7E:3598] A:0000 X:0029 Y:0029 P:envMxdiZc - Load X from 7E3598.
$03/D5C7 BD 06 2A LDA $2A06,x[$7E:2AB1] A:0000 X:00AB Y:0029 P:envMxdizc - Load A from 7E2AB1.
$03/D5CA D0 29 BNE $29    [$D5F5] A:0000 X:00AB Y:0029 P:envMxdiZc - Seems to pass because it reads 00 so it is considered Equal, if not equal branch to 03D5F5.
$03/D5CC AD 2C 27 LDA $272C  [$7E:272C] A:0000 X:00AB Y:0029 P:envMxdiZc - Load Target's Status Immunity 2.
$03/D5CF 2D A4 28 AND $28A4  [$7E:28A4] A:0000 X:00AB Y:0029 P:envMxdiZc - Is it the same as the Second Status to Inflict?
$03/D5D2 D0 21 BNE $21    [$D5F5] A:0000 X:00AB Y:0029 P:envMxdiZc - If not branch to 03D5F5.
$03/D5D4 AD 03 27 LDA $2703  [$7E:2703] A:0000 X:00AB Y:0029 P:envMxdiZc - Load Target's Status Byte 1.
$03/D5D7 85 AC STA $AC    [$00:00AC] A:0000 X:00AB Y:0029 P:envMxdiZc - Store it in AC.
$03/D5D9 AD 04 27 LDA $2704  [$7E:2704] A:0000 X:00AB Y:0029 P:envMxdiZc - Load Target's Status Byte 2.
$03/D5DC 29 BF AND #$BF A:0000 X:00AB Y:0029 P:envMxdiZc - Ignore Flying or Charm
$03/D5DE 85 AB STA $AB    [$00:00AB] A:0000 X:00AB Y:0029 P:envMxdiZc - Store it in AB.
$03/D5E0 AD A3 28 LDA $28A3  [$7E:28A3] A:0000 X:00AB Y:0029 P:envMxdiZc - Load Status to Inflict 1 into A.
$03/D5E3 85 AE STA $AE    [$00:00AE] A:0000 X:00AB Y:0029 P:envMxdiZc - Store it in AE.
$03/D5E5 AD A4 28 LDA $28A4  [$7E:28A4] A:0000 X:00AB Y:0029 P:envMxdiZc - Load Status to Inflict 2 into A.
$03/D5E8 85 AD STA $AD    [$00:00AD] A:0020 X:00AB Y:0029 P:envMxdizc - Store it in AD.
$03/D5EA C2 20 REP #$20 A:0020 X:00AB Y:0029 P:envMxdizc - Reset Processor Status.
$03/D5EC A5 AB LDA $AB    [$00:00AB] A:0020 X:00AB Y:0029 P:envmxdizc Load Target's Status Byte 2 (after Charm and Flying have been removed) into A.
$03/D5EE C5 AD CMP $AD    [$00:00AD] A:0000 X:00AB Y:0029 P:envmxdiZc - Compare it to Status Byte 2.
$03/D5F0 90 06 BCC $06    [$D5F8] A:0000 X:00AB Y:0029 P:eNvmxdizc - If equal, branch to 03D5F8.
------------------------------------------------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------------------------------------------
$03/D5F8 A5 CE LDA $CE    [$00:00CE] A:0000 X:00AB Y:0029 P:eNvmxdizc - Load A from CE.
$03/D5FA 10 08 BPL $08    [$D604] A:0883 X:00AB Y:0029 P:envmxdizc - Branch if Plus to 03D604.
$03/D604 7B TDC A:0883 X:00AB Y:0029 P:envmxdizc - Transfer Direct Page into A.
$03/D605 E2 20 SEP #$20 A:0000 X:00AB Y:0029 P:envmxdiZc - Set Processor Status.
$03/D607 AD 04 27 LDA $2704  [$7E:2704] A:0000 X:00AB Y:0029 P:envMxdiZc - Load A from Target's Status Byte 2.
$03/D60A 0D A4 28 ORA $28A4  [$7E:28A4] A:0000 X:00AB Y:0029 P:envMxdiZc - Add the value from Status to Inflict 2.
$03/D60D 8D 04 27 STA $2704  [$7E:2704] A:0020 X:00AB Y:0029 P:envMxdizc - Store it in Target's Status Byte 2.
$03/D610 AE 98 35 LDX $3598  [$7E:3598] A:0020 X:00AB Y:0029 P:envMxdizc - Load X from 7E3598.
$03/D613 A5 D4 LDA $D4    [$00:00D4] A:0020 X:00AB Y:0029 P:envMxdizc - Load A from D4.
$03/D615 9D 04 2A STA $2A04,x[$7E:2AAF] A:0029 X:00AB Y:0029 P:envMxdizc - Store A in to Character's Speed Record.
$03/D618 A5 D5 LDA $D5    [$00:00D5] A:0029 X:00AB Y:0029 P:envMxdizc - Load A from D5.
$03/D61A 9D 05 2A STA $2A05,x[$7E:2AB0] A:0000 X:00AB Y:0029 P:envMxdiZc - Store A in Character's Speed Record 2.
$03/D61D A9 40 LDA #$40 A:0000 X:00AB Y:0029 P:envMxdiZc - Load a 40 into A.
$03/D61F 9D 06 2A STA $2A06,x[$7E:2AB1] A:0040 X:00AB Y:0029 P:envMxdizc - Store A in 7E2AB1.
$03/D622 60 RTS A:0040 X:00AB Y:0029 P:envMxdizc - Return.

So from what we've seen above there is no formulaic difference between Sleep and Hold's literal statuses. They both have a stunning duration of 29. The only difference is one's ability to hit with Hold is Will based where as hitting with Sleep is Wisdom based and that's to do with their positions in the lists rather than anything else.

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #37 on: September 17, 2013, 07:57:25 PM »
09 Wall Routine

Code: [Select]
$03/D62C AD 06 27 LDA $2706  [$7E:2706] A:0003 X:0012 Y:0000 P:envMxdizc - Load Target's Status Byte 4.
$03/D62F 0D A4 28 ORA $28A4  [$7E:28A4] A:0000 X:0012 Y:0000 P:envMxdiZc - Add Reflect to it.
$03/D632 8D 06 27 STA $2706  [$7E:2706] A:0020 X:0012 Y:0000 P:envMxdizc - Store Reflect in Target's Status Byte 4.
$03/D635 AD 9D 28 LDA $289D  [$7E:289D] A:0020 X:0012 Y:0000 P:envMxdizc - Load 7E289D into A.
$03/D638 8D 7B 39 STA $397B  [$7E:397B] A:0000 X:0012 Y:0000 P:envMxdiZc - Store A in 7E397B.
$03/D63B A9 08 LDA #$08 A:0000 X:0012 Y:0000 P:envMxdiZc - Load 08 into A.
$03/D63D 85 D6 STA $D6    [$00:00D6] A:0008 X:0012 Y:0000 P:envMxdizc - Store A in D6.
$03/D63F A5 CF LDA $CF    [$00:00CF] A:0008 X:0012 Y:0000 P:envMxdizc - Load A from CF.
$03/D641 20 36 9E JSR $9E36  [$03:9E36] A:0000 X:0012 Y:0000 P:envMxdiZc - Jump to Subroutine.
$03/D644 A9 0F LDA #$0F A:0000 X:001E Y:001E P:envMxdizc - Load 0F into A.
$03/D646 20 C8 85 JSR $85C8  [$03:85C8] A:000F X:001E Y:001E P:envMxdizc - Jump to Subroutine.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
(There's a lot of mostly useless stuff in here, but this part is useful for our needs.)

$03/9F34 69 1E ADC #$1E A:0000 X:0300 Y:0010 P:envMxdiZc - Add 1E to A. 1E is the timer of Wall. (Then stored in A9)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
$03/D649 A9 40 LDA #$40 A:0000 X:000F Y:001E P:envMxdiZc - Load 40 into A.
$03/D64B 9D 06 2A STA $2A06,x[$7E:2A15] A:0040 X:000F Y:001E P:envMxdizc - Store A in 7E2A15
$03/D64E A5 CF LDA $CF    [$00:00CF] A:0040 X:000F Y:001E P:envMxdizc - Load A from CF.
$03/D650 0A ASL A A:0000 X:000F Y:001E P:envMxdiZc - Divide A by 2.
$03/D651 AA TAX A:0000 X:000F Y:001E P:envMxdiZc - Transfer A to X.
$03/D652 BD EB 29 LDA $29EB,x[$7E:29EB] A:0000 X:0000 Y:001E P:envMxdiZc - Load A from 7E29EB.
$03/D655 09 04 ORA #$04 A:0040 X:0000 Y:001E P:envMxdizc - Add 04.
$03/D657 9D EB 29 STA $29EB,x[$7E:29EB] A:0044 X:0000 Y:001E P:envMxdizc Store A in 7E29EB.
$03/D65A 60 RTS A:0044 X:0000 Y:001E P:envMxdizc

Well that was interesting. So in one of these Dreadfully Dull looping jumps it eventually breaks out of it to show the timer for Wall. I should go back and see if I can't find the timer for Sleep/Paralyze in that case.

 :edit: No, I cannot. It is so deeply buried it seems that I can barely even find when it changes. It's in the middle somewhere of the looping portions that I can't seem to locate it.
« Last Edit: September 17, 2013, 08:47:36 PM by Grimoire LD »

Deathlike2

  • Moderator
  • *
  • Posts: 3,538
  • I'm looking at you, bitch!
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #38 on: September 18, 2013, 01:13:39 AM »
Effect 06 - Status Routine

Now this is strange. As far as I can see and from my own tests there is nothing that prevents this from working on any specific monster type. Mute, Charm, Berserk, Float works perfectly fine on Zombie-type, Machine-type,  and Spirits. They all use the formula that says it shouldn't work on them. The only thing I can think of is that Yousei may have looked at the start of the data, not paying attention that this only occurs if the status to inflict is Death or Curse.
So this...

    06 status: various, does not affect spirits, undead, or machines

Is debunked. It works on anything that doesn't resist it.

I remember Phoenix mentioning Death as the natural immunity based on the creature type property. Curse was not mentioned, but that probably isn't too farfetched though.

With respect to "various stats", I don't think that was the intended description you are trying to get from it.

If you ever used lightning on some of the "machines" in this game, the monsters themselves have special code that operates based on a reaction to lightning, generally causing them to hur themselves at random, despite not having a Charm status.

The early monsters Spirits and Souls (and Ghost, I think) stop attacking you when hit with Ice. The IceRod with Rydia will allow you to test this...

Although... as I'm reading it, I think "Charm+Float" has more to do with the visual aspect. Float has its own set of odd bugs (being crit is one) and a Charmed character under float visually removes Float. It doesn't remove Float status though.

Quote
However the purpose of the separate routine for statuses with timers make sense as this formula does not appear to have any safety drop for them. Even its special coding for Paralyze doesn't work (do I foresee some Free Code in our future?) the enemy will never properly recover from Paralyze when used from this routine. That is a freed up 19 bytes for us to use if we ever wanted to add something else special to the Status Routine. Even the Creature Type check at the start is rather redundant as you can set it easily enough in the monster's individual status, freeing up even more bytes.

There is a reason why I've put in the fun bug report about Paralysis and Stop. Stop is a lot more gamebreaking than anything.
Working on the next Yet To Be Named FF4 "Hardtype" Hack Download Latest: v1.48

Video Demos: #1 #2 #3

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #39 on: September 18, 2013, 12:59:52 PM »
I was wrong. I thought the Status to Inflict was sequential, one after the other, but it's not. It's set by the byte it will occupy. So you and Phoenix were correct. Curse is not considered in the check (I just tested it) because it is considered the second byte.

I know what you mean by special attributes. It's written into their AI Codes rather than their initial data or formulaic manner. The Charm and Float subtracting check seems to take those two status away from consideration. As not to touch them in the final equation, (the end result will be added onto them if applicable). At least as far as I can make out.


As the Heal Routine for some reason appears to be over 200 bytes long... I'm going to skip that one for now (I can't see gleaning anywhere near as useful information from that as I did with the normal attack routine) and go to the Shape Changing Routine which is a fair amount more compact.

Shape Changing Routine

Code: [Select]
$03/D82A AD 2B 27 LDA $272B  [$7E:272B] A:0003 X:0018 Y:0000 P:envMxdizc - Load Target's Status Immunity 1.
$03/D82D 2D A3 28 AND $28A3  [$7E:28A3] A:0030 X:0018 Y:0000 P:envMxdizc - Check it against Status to Inflict 1.
$03/D830 D0 10 BNE $10    [$D842] A:0000 X:0018 Y:0000 P:envMxdiZc - Branch if equal to 03D842.
$03/D832 AD 03 27 LDA $2703  [$7E:2703] A:0000 X:0018 Y:0000 P:envMxdiZc - Load Target's Status Byte 1.
$03/D835 2D A3 28 AND $28A3  [$7E:28A3] A:0000 X:0018 Y:0000 P:envMxdiZc - Check it against Status to Inflict 1.
$03/D838 D0 0B BNE $0B    [$D845] A:0000 X:0018 Y:0000 P:envMxdiZc - If equal go to 03D845.
$03/D83A AD 03 27 LDA $2703  [$7E:2703] A:0000 X:0018 Y:0000 P:envMxdiZc - Load Target's Status Byte 1.
$03/D83D CD A3 28 CMP $28A3  [$7E:28A3] A:0000 X:0018 Y:0000 P:envMxdiZc - Compare it against Status to Inflict 1.
$03/D840 90 03 BCC $03    [$D845] A:0000 X:0018 Y:0000 P:eNvMxdizc - If they are not the same go to 03D845.
------------------------------------------------------------------------------------------------------------------------------
$03/D842 4C 2D E0 JMP $E02D  [$03:E02D] A:0008 X:0018 Y:0000 P:envMxdizc - Jump to Subroutine (which eventually Returns on its own accord out of the Routines)
-------------------------------------------------------------------------------------------------------------------------------
$03/D845 AD 03 27 LDA $2703  [$7E:2703] A:0000 X:0018 Y:0000 P:eNvMxdizc  - Load Target's Status Byte 1.
$03/D848 4D A3 28 EOR $28A3  [$7E:28A3] A:0000 X:0018 Y:0000 P:envMxdiZc - ?Exclusive Or... something... or other. Just adding Status if applicable.
$03/D84B 8D 03 27 STA $2703  [$7E:2703] A:0008 X:0018 Y:0000 P:envMxdizc -  Store A in Target's Status Byte 1.
$03/D84E 60 RTS A:0008 X:0018 Y:0000 P:envMxdizc - Return

Well. That was much simpler than I anticipated. No graphics data or anything in there apparently though.

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #40 on: September 23, 2013, 10:59:24 AM »
Protect Routine

Code: [Select]
$03/D84F AD 2A 27 LDA $272A  [$7E:272A] A:0003 X:001A Y:0000 P:envMxdizc - Load Target's Physical Defense Base into A.
$03/D852 C9 FF CMP #$FF A:0011 X:001A Y:0000 P:envMxdizc - Is it FF?
$03/D854 D0 03 BNE $03    [$D859] A:0011 X:001A Y:0000 P:envMxdizc - If not branch to 03D859
-------------------------------------------------------------------------------------------------------------------------------------------
$03/D856 4C 2D E0 JMP $E02D  [$03:E02D] A:00FF X:001A Y:0000 P:envMxdiZC - Jump to Magic Fail Routine.
-----------------------------------------------------------------------------------------------------------------------------------------
$03/D859 AD 00 18 LDA $1800  [$7E:1800] A:0011 X:001A Y:0000 P:envMxdizc - Load Current Encounter
$03/D85C C9 B7 CMP #$B7 A:0004 X:001A Y:0000 P:envMxdizc - Is it Zeromus?
$03/D85E D0 05 BNE $05    [$D865] A:0004 X:001A Y:0000 P:envMxdizc - If not branch to 03D865 (This is what Phoenix must have been referring to)
------------------------------------------------------------------------------------------------------------------------------------------------
$03/D860 AD 01 18 LDA $1801  [$7E:1801] A:00B7 X:001A Y:0000 P:envMxdiZC - Load Current Encounter Byte 2.
$03/D863 D0 0D BNE $0D    [$D872] A:0000 X:001A Y:0000 P:envMxdiZC - If it is 01 (causing the flag to activate) branch to 03D872.
----------------------------------------------------------------------------------------------------------------------------------------------
$03/D865 18 CLC A:0004 X:001A Y:0000 P:envMxdizc - Clear Carry Flag
$03/D866 AD 2A 27 LDA $272A  [$7E:272A] A:0004 X:001A Y:0000 P:envMxdizc - Load Target's Physical Defense Base into A.
$03/D869 69 05 ADC #$05 A:0011 X:001A Y:0000 P:envMxdizc - Add 05 to A.
$03/D86B 90 02 BCC $02    [$D86F] A:0016 X:001A Y:0000 P:envMxdizc - Branch if Carry is Clear to 03D86F.
----------------------------------------------------------------------------------------------------------------------------------------------------------
(Not sure how to get there.)
-----------------------------------------------------------------------------------------------------------------------------------------------------------
$03/D86F 8D 2A 27 STA $272A  [$7E:272A] A:0016 X:001A Y:0000 P:envMxdizc - Store A in Target's Physical Defense Base.
$03/D872 60 RTS A:0016 X:001A Y:0000 P:envMxdizc - Return

Shell Routine

Code: [Select]
$03/D873 AD 24 27 LDA $2724  [$7E:2724] A:0003 X:001C Y:0000 P:envMxdizc - Load Target's Magic Defense Base into A.
$03/D876 C9 FF CMP #$FF A:0010 X:001C Y:0000 P:envMxdizc - Is it FF?
$03/D878 D0 03 BNE $03    [$D87D] A:0010 X:001C Y:0000 P:envMxdizc - If not branch to 03D87D
--------------------------------------------------------------------------------------------------------------------------
(Covered Above)
----------------------------------------------------------------------------------------------------------------------------
$03/D87D AD 00 18 LDA $1800  [$7E:1800] A:0010 X:001C Y:0000 P:envMxdizc - Load Current encounter
$03/D880 C9 B7 CMP #$B7 A:00B7 X:001C Y:0000 P:eNvMxdizc - Is it Zeromus?
$03/D882 D0 05 BNE $05    [$D889] A:00B7 X:001C Y:0000 P:envMxdiZC - If not branch to 03D889.
----------------------------------------------------------------------------------------------------------------------------------------------
(Covered Above)
-------------------------------------------------------------------------------------------------------------------------------------------------
$03/D889 18 CLC A:0000 X:001C Y:0000 P:envMxdiZC - Clear Carry Flag.
$03/D88A AD 24 27 LDA $2724  [$7E:2724] A:0000 X:001C Y:0000 P:envMxdiZc - Load Target's Magic Defense Base.
$03/D88D 69 03 ADC #$03 A:0010 X:001C Y:0000 P:envMxdizc - Add 03 to A.
$03/D88F 90 02 BCC $02    [$D893] A:0013 X:001C Y:0000 P:envMxdizc - Branch if Carry Flag is clear to 03D88F.
$03/D893 8D 24 27 STA $2724  [$7E:2724] A:0013 X:001C Y:0000 P:envMxdizc - Store A in Target's Magic Defense Base.
$03/D896 60 RTS A:0013 X:001C Y:0000 P:envMxdizc - Return


Not many surprises here. Simple confirmation of what Phoenix said a long time ago about being unable to use Protect and Shell to increase defense if in the Zeromus encounter. Aside from that everything else there is pretty par for the course.

As noted before in another thread you can easily change what Protect and Shell increases (or sets if you change the LDA to something else entirely if you want to have a Mage character load their Wisdom or Will into it or something (if such is the case you may even want to change the ADC into a ASL to double it since 99 Defense at the end game is probably weaker than what they currently have on)

As mentioned before elsewhere you could even recreate TMPR (Temper) from FFI (No, I don't mean a broken spell! I mean its intended effect.) to look at 271B and add +1 to that on each cast.
« Last Edit: September 23, 2013, 11:07:13 AM by Grimoire LD »

Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #41 on: September 23, 2013, 11:36:13 AM »
Stop Routine

Code: [Select]
$03/D8EE AD 05 27 LDA $2705  [$7E:2705] A:0003 X:0022 Y:0000 P:envMxdizc - Load Target's Status Byte 3 into A.
$03/D8F1 09 40 ORA #$40 A:0000 X:0022 Y:0000 P:envMxdiZc - Add 40 to its value (Stop)
$03/D8F3 8D 05 27 STA $2705  [$7E:2705] A:0040 X:0022 Y:0000 P:envMxdizc - Store it in Target's Status Byte 3.
$03/D8F6 AD 9D 28 LDA $289D  [$7E:289D] A:0040 X:0022 Y:0000 P:envMxdizc - Load 40 from 7E289D (likely something related to stop)
$03/D8F9 8D 7B 39 STA $397B  [$7E:397B] A:000A X:0022 Y:0000 P:envMxdizc - Store A in 7E397B
$03/D8FC A9 0A LDA #$0A A:000A X:0022 Y:0000 P:envMxdizc - Load 0A into A.
$03/D8FE 85 D6 STA $D6    [$00:00D6] A:000A X:0022 Y:0000 P:envMxdizc - Store A in D6.
$03/D900 A5 CF LDA $CF    [$00:00CF] A:000A X:0022 Y:0000 P:envMxdizc - Load A from CF.
$03/D902 20 36 9E JSR $9E36  [$03:9E36] A:0007 X:0022 Y:0000 P:envMxdizc - Jump to Subroutine.
$03/D905 AE 30 35 LDX $3530  [$7E:3530] A:0000 X:001E Y:001E P:envMxdizc - Load the value in 7E3530 into X.
$03/D908 A5 D4 LDA $D4    [$00:00D4] A:0000 X:0093 Y:001E P:envMxdizc - Load A from D4.
$03/D90A 9D 04 2A STA $2A04,x[$7E:2A97] A:001E X:0093 Y:001E P:envMxdizc - Store A in Slot's Timer
$03/D90D A5 D5 LDA $D5    [$00:00D5] A:001E X:0093 Y:001E P:envMxdizc - Load A from D5.
$03/D90F 9D 05 2A STA $2A05,x[$7E:2A98] A:0000 X:0093 Y:001E P:envMxdiZc - Store A in Slot's Timer (2).
$03/D912 A9 40 LDA #$40 A:0000 X:0093 Y:001E P:envMxdiZc - Load 40 (Stop) into A.
$03/D914 9D 06 2A STA $2A06,x[$7E:2A99] A:0040 X:0093 Y:001E P:envMxdizc - Store A in Slot's Status to Remove after Timer elapses?
$03/D917 A5 CF LDA $CF    [$00:00CF] A:0040 X:0093 Y:001E P:envMxdizc - Load A from CF.
$03/D919 0A ASL A A:0007 X:0093 Y:001E P:envMxdizc - Multiply A.
$03/D91A AA TAX A:000E X:0093 Y:001E P:envMxdizc - Transfer A to X.
$03/D91B BD EB 29 LDA $29EB,x[$7E:29F9] A:000E X:000E Y:001E P:envMxdizc - Load A from Slot's current Statuses.
$03/D91E 09 80 ORA #$80 A:0040 X:000E Y:001E P:envMxdizc - Add 80 to A.
$03/D920 9D EB 29 STA $29EB,x[$7E:29F9] A:00C0 X:000E Y:001E P:eNvMxdizc - Store A in Slot's Current Statuses.
$03/D923 60 RTS A:00C0 X:000E Y:001E P:eNvMxdizc - Return

This is an interesting bit of information. How this appears to work is that it loads Stop and its compatriot parts into a timer. What is most intriguing about this is we now know that Stop is measured in increments of 3. Stop's initial power is 10. This makes it last for 1E or 30 ticks. Where as the power of the Golden Hourglass is 200 making it worth 600 ticks.


Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #42 on: September 23, 2013, 01:38:23 PM »
Peep Routine

Code: [Select]
$03/D924 AD 00 18 LDA $1800  [$7E:1800] A:0003 X:0024 Y:0000 P:envMxdizc - Load Current Encounter
$03/D927 C9 B7 CMP #$B7 A:0010 X:0024 Y:0000 P:envMxdizc - Is it Zeromus?
$03/D929 D0 08 BNE $08    [$D933] A:0010 X:0024 Y:0000 P:envMxdizc - If not branch to 03D933
-------------------------------------------------------------------------------------------------------------------------------------------

-------------------------------------------------------------------------------------------------------------------------------------------
$03/D933 C2 20 REP #$20 A:0010 X:0024 Y:0000 P:envMxdizc - Reset Processor Status
$03/D935 AD 07 27 LDA $2707  [$7E:2707] A:0010 X:0024 Y:0000 P:envmxdizc - Load Target's HP into A
$03/D938 8D 9A 35 STA $359A  [$7E:359A] A:01F4 X:0024 Y:0000 P:envmxdizc - Store Target's HP in 7E359A (presumably a place to read from later)
$03/D93B AD 09 27 LDA $2709  [$7E:2709] A:01F4 X:0024 Y:0000 P:envmxdizc - Load Target's Max HP into A.
$03/D93E 8D 9D 35 STA $359D  [$7E:359D] A:01F4 X:0024 Y:0000 P:envmxdizc - Store Target's Max HP in 7E359D.
$03/D941 7B TDC A:01F4 X:0024 Y:0000 P:envmxdizc - Transfer Direct Page
$03/D942 E2 20 SEP #$20 A:0000 X:0024 Y:0000 P:envmxdiZc - Set Processor Status
$03/D944 9C 9C 35 STZ $359C  [$7E:359C] A:0000 X:0024 Y:0000 P:envMxdiZc - Store Zero in 7E359C.
$03/D947 9C 9F 35 STZ $359F  [$7E:359F] A:0000 X:0024 Y:0000 P:envMxdiZc - Store Zero in 7E359F.
$03/D94A AD 20 27 LDA $2720  [$7E:2720] A:0000 X:0024 Y:0000 P:envMxdiZc - Load Target's Elemental Weaknesses.
$03/D94D 2D 25 27 AND $2725  [$7E:2725] A:0010 X:0024 Y:0000 P:envMxdizc - ?And Elemental Defense?
$03/D950 49 FF EOR #$FF A:0000 X:0024 Y:0000 P:envMxdiZc - Exclusive Or Accumulator?
$03/D952 2D 20 27 AND $2720  [$7E:2720] A:00FF X:0024 Y:0000 P:eNvMxdizc - And Target's Elemental Weaknesses.
$03/D955 29 3F AND #$3F A:0010 X:0024 Y:0000 P:envMxdizc - ?And 3F?
$03/D957 85 A9 STA $A9    [$00:00A9] A:0010 X:0024 Y:0000 P:envMxdizc - Store A in A9.
$03/D959 D0 07 BNE $07    [$D962] A:0010 X:0024 Y:0000 P:envMxdizc - Branch if flag is not set to 03D962.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
$03/D962 7B TDC A:0010 X:0024 Y:0000 P:envMxdizc - Tranfer Direct Page
$03/D963 AA TAX A:0000 X:0024 Y:0000 P:envMxdiZc - Transfer A to X.
$03/D964 A8 TAY A:0000 X:0000 Y:0000 P:envMxdiZc - Transfer A to Y.
$03/D965 46 A9 LSR $A9    [$00:00A9] A:0000 X:0000 Y:0000 P:envMxdiZc - Divide the value in A9 by 2.
$03/D967 90 08 BCC $08    [$D971] A:0000 X:0000 Y:0000 P:envMxdizc - Branch to 03D971 if carry is clear (Which will happen when A8 is rotated to 0.)
---------------------------------------------------------------------------------------------------------------------------------------------------
$03/D969 98 TYA A:0000 X:0000 Y:0004 P:envMxdiZC - Transfer Y to A.
$03/D96A 18 CLC A:0004 X:0000 Y:0004 P:envMxdizC - Clear Carry Flag.
$03/D96B 69 15 ADC #$15 A:0004 X:0000 Y:0004 P:envMxdizc - Add 15 to A.
$03/D96D 9D CB 34 STA $34CB,x[$7E:34CB] A:0019 X:0000 Y:0004 P:envMxdizc - Store Message Data Value in Message Data Byte 2.
------------------------------------------------------------------------------------------------------------------------------------------------------
$03/D971 C8 INY A:0000 X:0000 Y:0000 P:envMxdizc - +1 to Y.
$03/D972 C0 06 00 CPY #$0006 A:0000 X:0000 Y:0001 P:envMxdizc - Compare Y to 0006.
$03/D975 D0 EE BNE $EE    [$D965] A:0000 X:0000 Y:0001 P:eNvMxdizc - Loop until 0006 is reached.
====================================================
$03/D977 A9 1E LDA #$1E A:0019 X:0001 Y:0006 P:envMxdiZC - Load 1E into A.
$03/D979 8D CA 34 STA $34CA  [$7E:34CA] A:001E X:0001 Y:0006 P:envMxdizC - Store A in Battle Message data..
$03/D97C 4C B1 85 JMP $85B1  [$03:85B1] A:001E X:0001 Y:0006 P:envMxdizC - Jump to Subroutine
$03/85B1 A9 F8 LDA #$F8 A:001E X:0001 Y:0006 P:envMxdizC - Load F8 into A.
$03/85B3 8D C8 33 STA $33C8  [$7E:33C8] A:00F8 X:0001 Y:0006 P:eNvMxdizC Store A in 7E33C8.
$03/85B6 A9 03 LDA #$03 A:00F8 X:0001 Y:0006 P:eNvMxdizC - Load 03 into A.
$03/85B8 8D C9 33 STA $33C9  [$7E:33C9] A:0003 X:0001 Y:0006 P:envMxdizC Store 03 in 7E33C9.
$03/85BB 60 RTS A:0003 X:0001 Y:0006 P:envMxdizC - Return.

Now this is interesting! So far this has been the first time I've seen FFIV use a number to roll down until it reaches 00. In this case it reads the Target's Elemental Weakness and in the next portion continues to roll down that number to 00 and depending on how many times it rolled to reach that number is the amount used when determining weaknesses according to the message. Because of this behavior is it a bit difficult to change. You could change it to other values that use a bit signature like Creature Type, or Elemental Attack... or something equivalent to that.

For instance if you wanted the player to be able to tell what statuses (on one byte) they were invulnerable to, you could set this...

$03/D952   2D 20 27   AND $2720  [$7E:2720]   A:00FF   X:0024   Y:0000   P:eNvMxdizc - And Target's Elemental Weaknesses.

to...

$03/D952   2D 2B 27   AND $272B  [$7E:272B]   A:00FF   X:0024   Y:0000   P:eNvMxdizc - And Target's Status Immunity Byte 1.

So say you're fighting a Zombie which has a Status Immunity Byte of B9 and you go to use Peep. You would get their HP and then you would get message... 19, 1C, 1D, and 1E.

So if you changed those each to "Immune to Poison, Immune to Pig, Immune to Mini, Immune to Frog (because of the way the game works you wouldn't be able to check if an enemy is immune to Petrify, KO (or if you're using the second immunity byte) Float, and Curse. The reason this is, is because the game has no message to display for Absorb and Immune bytes) the game would display those when you use Peep on an Enemy telling you their effective resistances.

So there is a little bit of leeway, but not as much as one may like in some respects. This kind of change though seems more appropriate for Cid's Peep to differentiate it in effect (as it should have done in the first place...) from White Magic Peep.



Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #43 on: September 23, 2013, 02:03:06 PM »
Exit Routine

Code: [Select]
$03/D97F AD E5 38 LDA $38E5  [$7E:38E5] A:0003 X:0026 Y:0000 P:envMxdizc - Load Second Set of Encounter Flags.
$03/D982 29 01 AND #$01 A:0000 X:0026 Y:0000 P:envMxdiZc - Is it 01? (Cannot Flee)
$03/D984 D0 0B BNE $0B    [$D991] A:0000 X:0026 Y:0000 P:envMxdiZc - If so branch to 03D991.
$03/D986 EE F3 38 INC $38F3  [$7E:38F3] A:0000 X:0026 Y:0000 P:envMxdiZc - +1 the value in 7E38F3.
$03/D989 1A INC A A:0000 X:0026 Y:0000 P:envMxdizc - +1 to A.
$03/D98A 8D D3 38 STA $38D3  [$7E:38D3] A:0001 X:0026 Y:0000 P:envMxdizc - Store A in ?Battle Determination? (When set to 1, the player will flee)
$03/D98D 8D A3 35 STA $35A3  [$7E:35A3] A:0001 X:0026 Y:0000 P:envMxdizc - Store A in 7E35A3 (May have something to do with stopping actions or something?)
$03/D990 60 RTS A:0001 X:0026 Y:0000 P:envMxdizc
--------------------------------------------------------------------------------------------------
$03/D991 9C 50 35 STZ $3550  [$7E:3550] A:0001 X:0026 Y:0000 P:envMxdizc - Store Zero in 7E3550
$03/D994 20 B1 85 JSR $85B1  [$03:85B1] A:0001 X:0026 Y:0000 P:envMxdizc - Jump to Subroutine.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$03/85B1 A9 F8 LDA #$F8 A:0001 X:0026 Y:0000 P:envMxdizc - Load F8 into A.
$03/85B3 8D C8 33 STA $33C8  [$7E:33C8] A:00F8 X:0026 Y:0000 P:eNvMxdizc Store A in 7E33C8 (Must somehow cancel the Exit visual code)
$03/85B6 A9 03 LDA #$03 A:00F8 X:0026 Y:0000 P:eNvMxdizc - Load 03 into A.
$03/85B8 8D C9 33 STA $33C9  [$7E:33C9] A:0003 X:0026 Y:0000 P:envMxdizc - Store A in 7E33C9. (As above?)
$03/85BB 60 RTS A:0003 X:0026 Y:0000 P:envMxdizc - Return
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$03/D997 A9 22 LDA #$22 A:0003 X:0026 Y:0000 P:envMxdizc - Load 22 into A. (Message - "Can't Run.")
$03/D999 8D CA 34 STA $34CA  [$7E:34CA] A:0022 X:0026 Y:0000 P:envMxdizc - Store A in Battle Message Area.
$03/D99C 60 RTS A:0022 X:0026 Y:0000 P:envMxdizc - Return.

Short, sweet, and to the point. No surprises there really.


Grimoire LD

  • FF4 Hacker
  • *
  • Posts: 1,684
    • View Profile
Re: Grimoire LD's Notes, Methods, and Hacks (Basic Attack/Defense Disassembly)
« Reply #44 on: September 23, 2013, 02:33:09 PM »
A bit of a jump, but nearly out of time for the day so...

Roc Routine - (Damage, Status to Living Creatures)

Code: [Select]
$03/DA73 20 FD E0 JSR $E0FD  [$03:E0FD] A:0003 X:0030 Y:0000 P:envMxdizc - Jump to "Is it Absorb?" Routine.
$03/DA76 AD FE 38 LDA $38FE  [$7E:38FE] A:0000 X:0030 Y:0000 P:envMxdiZc - Load A from 7E38FE.
$03/DA79 10 08 BPL $08    [$DA83] A:0002 X:0030 Y:0000 P:envMxdizc - Branch if Positive to 03DA83 (Branch if Heal Tag is not activated)
-----------------------------------------------------------------------------------------------------------------------------------------------------
(Further information can be found in the Mage Subroutine)
------------------------------------------------------------------------------------------------------------------------------------------------------
$03/DA83 20 30 E1 JSR $E130  [$03:E130] A:0002 X:0030 Y:0000 P:envMxdizc - Jump to Subroutine (Elemental Determination)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$03/E130 AD FE 38 LDA $38FE  [$7E:38FE] A:0002 X:0030 Y:0000 P:envMxdizc - Load 7E38FE.
$03/E133 C9 02 CMP #$02 A:0002 X:0030 Y:0000 P:envMxdizc - Is it 02?
$03/E135 D0 1B BNE $1B    [$E152] A:0002 X:0030 Y:0000 P:envMxdiZC - If not branch to 03E152.
$03/E137 AD 21 27 LDA $2721  [$7E:2721] A:0002 X:0030 Y:0000 P:envMxdiZC - Load Target's Elemental Very Weakness.
$03/E13A 2D A2 28 AND $28A2  [$7E:28A2] A:0000 X:0030 Y:0000 P:envMxdiZC - And Spell's Elemental.
$03/E13D F0 06 BEQ $06    [$E145] A:0000 X:0030 Y:0000 P:envMxdiZC - If they are not equal branch to 03E145.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------------------------------------------------------------------------------------------------
$03/E145 AD 20 27 LDA $2720  [$7E:2720] A:0000 X:0030 Y:0000 P:envMxdiZC - Load Target's Elemental Weakness.
$03/E148 2D A2 28 AND $28A2  [$7E:28A2] A:0010 X:0030 Y:0000 P:envMxdizC - And Spell's Elemental.
$03/E14B F0 05 BEQ $05    [$E152] A:0000 X:0030 Y:0000 P:envMxdiZC - If they are not equal branch to 03E152.
----------------------------------------------------------------------------------------------------------------------------------------------------------------------

---------------------------------------------------------------------------------------------------------------------------------------------------------------------
$03/E152 60 RTS A:0000 X:0030 Y:0000 P:envMxdiZC - Return
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$03/DA86 20 AF C9 JSR $C9AF  [$03:C9AF] A:0000 X:0030 Y:0000 P:envMxdiZC - Jump to Subroutine. (Damage Determination)
$03/DA89 4C 15 D5 JMP $D515  [$03:D515] A:0000 X:0000 Y:0000 P:envMxdizc - Jump to Subroutine (Status Routine)
(In the Status Routine it eventually RTS's out of the routine)

Hmm, apparently this routine even allows for Elemental Determination. Something that you would never see in the normal game because of its single use on Roc.

Here is Yousei's Elemental Determination Routine from the Tower of Bab-il Docs that uses 1.0 offsets to clear up the missing matters in my own records.

Code: [Select]
03:E11B   LDA  $38FE    ;check the elemental damage multiplier
03:E11E   CMP  #$02
03:E120   BNE  $E13D    ;if it isn't normal damage (there was an elemental
                        ;defense involved), return
03:E122   LDA  $2721
03:E125   AND  $28A2    ;check to see if target is very weak vs. any of the
                        ;attack elements
03:E128   BEQ  $E130    ;if not, go check for normal weakness
03:E12A   LDA  #$08
03:E12C   STA  $38FE    ;if so, set elemental damage to four times normal
03:E12F   RTS
03:E130   LDA  $2720
03:E133   AND  $28A2    ;check to see if target is weak vs. any of the attack
                        ;elements
03:E136   BEQ  $E13D    ;if not, return
03:E138   LDA  #$04
03:E13A   STA  $38FE    ;if so, set elemental damage to twice normal
03:E13D   RTS

One thing of importance I've learned is that Damage Determination is normally consisting of a JMP to 03C9AF. This is absolutely crucial if we want to make more damage-based matters down the line. I'll hopefully get to documenting that routine soon. Maybe then I'll be able to see how the game can tell what formula is being accessed at a given time.

 :edit: Slight edit to account for being slightly off at the start of the routine.
« Last Edit: September 27, 2013, 12:14:08 PM by Grimoire LD »