Kuribo64
Views: 17,217,259 Home | Forums | Uploader | Wiki | Object databases | IRC
Rules/FAQ | Memberlist | Calendar | Stats | Online users | Last posts | Search
06-27-22 03:01 PM
Guest:

0 users reading Zelda DS Hacking [HELP] | 1 bot

Main - Misc. ROM hacking - Zelda DS Hacking [HELP] Hide post layouts | New reply

Pages: 1 2
Sparsite
Posted on 10-14-16 01:57 AM (rev. 4 of 11-19-16 05:12 AM) Link | #78711
This thread is for Zelda DS hacking. There are currently no tools for hacking this game specifically, except old documents from Ray and Freeze. Gericom also programmed a ZCB collision generator. However, these guys aren't hacking the Zelda DS games anymore.

Gericom handed his ZCB generator code over to me, and apparently Ray and Freeze programmed an unreleased editor that could edit ZMB files. I'll probably end up coding my own editor though. It will also double as an importer since I have Gericom's ZCB generator source code which converts OBJ files into Zelda specific ZCB collision files. (However it may cause some lag problems with bigger models since the format is not entirely known.)

Ray and Freeze's old notes

Editing these games are weird, because when you LZ decompress them to edit them, they will crash the game. If you LZ compress them after editing them, it only works in Desmume.

If anyone knows whats causing this error, it would be a huge help, otherwise hacking will be very limited.

Zelda: PH D-Pad Patch - https://gbatemp.net/threads/legend-of-zelda-phantom-hourglass-d-pad-patch.375388/

Zelda: SS D-Pad Patch - http://www.romhacking.net/hacks/2235/
Source Code: https://github.com/StraDaMa/Legend-of-Zelda-Spirit-Tracks-D-Pad-Patch

These fix all the control issues people have with this game. The touch screen is eliminated, but its also still an option if you wish to play like that.

Zelda DS Specific File Formats:
-ZCB: Collision (Zelda Collision Binary)
-ZMB: Level Data like object positions and header (Zelda Map Binary)
-ZEB: Enviorment Coloring (Zelda Enviorment Binary)
-ZOB: Object/NPC Type File
-ZAB: Unknown

Tools:
Hex Editing - NSMBe5
EveryFileExplorer - Replacing Files
Music Viewing/Exporting - MKDS CM
ZCB Collision Generation - MKDS CM>File>New>ZCB
NSBMD 3D Model Generation - MKDS CM>File>New>NSBMD
Animation Viewing - MKDS CM
Tinke - 2D Graphics Viewing

Basic Data Locations:
Map Data - root/Map
Sea Textures - root/Enviornment/Sea
Skyboxes - root/Enviornment/VRBox
Mist - root/Enviornment/Filter
Text - root/English/Message
Player Animations - root/Player
Ship Textures - root/Ship
Intro Slides - root/Event/Kamishibai/kami1

For testing purposes:
Mercay Island Starting Point: isle_main/map00.bin/nsbmd/isle_main_00.nsbmd

This is the first level of the game, so you can test stuff like imports here.

ASM hacking hasn't been looked into very much, but I've found some basic stuff like the main green rupee behavoir at 0213B1B0.

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

poudink
Posted on 10-14-16 04:48 PM Link | #78722
I know that they achieved model importing, we can see videos of it on their channel. It's spirit track, but I'm pretty sure both games are very similar.

____________________
Nothing to say, so jadnjkfmnjamnfjkldnajfnjkanfjdksan jsdnvj m.

Hiccup
Posted on 10-14-16 05:23 PM Link | #78723
You might have already tried this, but it threw me off before; in EFE - did you do File>Save?

Sparsite
Posted on 10-14-16 07:53 PM (rev. 2 of 10-14-16 07:54 PM) Link | #78728
Posted by poudink
I know that they achieved model importing, we can see videos of it on their channel. It's spirit track, but I'm pretty sure both games are very similar.


To clear things up, im aware about the zcb format being collsion, gericom programmed a ZCB generator and put it in MKDS CM so level importing isnt a problem. Im concerned about the ZMB files. These are the files that contain objects, warps, etc. And this is important to document otherwise custom levels wont function properly. zab and zob files may or may not be involved with the functionality of zmbs, but I dont think so.

Posted by Hiccup
You might have already tried this, but it threw me off before; in EFE - did you do File>Save?


Yes, I have clicked it. Click it 1 or 100 times the thing doesnt save my new zmb/zcb/zab/zob files.

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

cros107
Posted on 10-15-16 01:32 PM Link | #78761
IIRC, ray and freeze just did model importing, and didn't mess around with objects.
Anyway, try editing files in NSMBe. It should work a charm if you're just doing hex editing, and it should save just fine.

I was going to suggest getting in touch with ray or freeze via social media or NSMBHD, but they seem to have quit the internet. Not sure what you should do about that.



____________________
No, not doing SM64DS hacking, just here for the waffles.

shibboleet
Posted on 10-15-16 02:46 PM Link | #78777
if you want, send me a zmb in a pm and I can take a quick peek.

____________________
a

Sparsite
Posted on 10-15-16 05:54 PM (rev. 2 of 10-15-16 05:57 PM) Link | #78785
Posted by cros107
IIRC, ray and freeze just did model importing, and didn't mess around with objects.
Anyway, try editing files in NSMBe. It should work a charm if you're just doing hex editing, and it should save just fine.

I was going to suggest getting in touch with ray or freeze via social media or NSMBHD, but they seem to have quit the internet. Not sure what you should do about that.




They also said they programmed a buggy, but unreleased editor that will edit ZMB files and it can move around objects.

Posted by MrRean
if you want, send me a zmb in a pm and I can take a quick peek.


Here is the link to the ZMB/ZOB files for the starting level. (ZOB shouldn't matter but just incase)

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

Sparsite
Posted on 10-26-16 01:35 AM (rev. 3 of 10-27-16 12:09 AM) Link | #79183
Not sure if anyone has found this this crash screen before but it was not mentioned on The Cutting Room Floor.

I was digging in the decompressed ARM9.bin and found debug screen text (exactly like the SM64DS crash screen text which is also in ARM9.bin)

If anyone knows of this or has a vid of this crash screen, post it. Pretty cool if it hadn't been found yet though.

[image]

This was also not mentioned anywhere on the cutting room floor, but spirit tracks had the debug font mentioned on it's TCRF page, so I'm assuming no one has found this yet. Debug font is located at root/menu/UI_main/DbgFntm.bin

[image]

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

Sparsite
Posted on 10-27-16 09:05 PM (rev. 2 of 10-27-16 09:32 PM) Link | #79214
UPDATE: Ok, so, I was finally able to figure things out, somewhat.

The documentation Ray and Freeze posted was correct, except you need to re LZ compress the file once you modify the decompressed version, otherwise it crashes.

However, this only works for Desmume, no$gba wont even boot if its recompressed but desmume does it just fine.

Anyone have any ideas on getting it to run in no$gba debugger? Otherwise, hacking will be limited and I want to do some ASM hacking with this game.

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

Sparsite
Posted on 11-07-16 04:29 AM (rev. 2 of 11-07-16 04:29 AM) Link | #79551
Things are making progress. I've got a very early build of a ZMB editor I made from scratch. I still have to fix some bugs, but it works!

There's no way to actually replace the ZMB files though, because EFE and MKDS CM don't actually save the new ZMB file. I'm going to talk to Gericom about opening these bin files (compressed NARC files) and see if he can fix the save button.

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

Platinatic
Posted on 11-07-16 07:07 PM Link | #79556
I don't know if you know about this, but saving in EFE is a little weird.
You have to press save in every window in order to save the changes.
So pressing save in a subfolder of a file isn't enough, you have to press save on the window that opened when you opened the file (an intire rom, for example).
Saving works, but it's just not convenient.

Sparsite
Posted on 11-07-16 08:27 PM Link | #79557
Posted by Platinatic
I don't know if you know about this, but saving in EFE is a little weird.
You have to press save in every window in order to save the changes.
So pressing save in a subfolder of a file isn't enough, you have to press save on the window that opened when you opened the file (an intire rom, for example).
Saving works, but it's just not convenient.


Oh, thanks. It seems to be working now. Now the ZMB editor will actually be useful for now (I want to eventually integrate it so it edits the ZMB files just by opening the ROM itself).

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

Sparsite
Posted on 11-09-16 10:42 PM Link | #79604
Does anyone know if its possible to kill Linebeck in Phantom Hourglass? Theres a model just above linebeck's model called linedead.bin, it just contains a model.nsbmd and its a model of him lying face down, dead.

Creepy pasta time.

Interestingly, his assets are titled "Lineback" even though his name is spelt Linebeck.

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

Sparsite
Posted on 11-14-16 04:02 AM (rev. 2 of 11-14-16 04:02 AM) Link | #79698
Latest progress: I've been digging through the games code documenting stuff. I've been trying to swap the top screen and the bottom screen. I've done it in real time modifying the memory, but I need to make some sort of patch.

I need to swap Bit 15 of the Graphics Power Control Register.

//Swapping Screens
Bit 15 at 0x04000304 tells the DS what screen is the main screen.
Default: 111100000010
Swapped: 111100000000

0202F0BC writes to reg when you pull your map with select+down
0202FB08 is writing to the reg, storing a 2 byte value
0202EFF8 writes to it
01FFBBE8 writing back
0202EFE8 writing back

on loading file:
021047BC
021047BE - the only call, this is in thumb mode

other general game stuff:

ROM Map:
020AE2E4 - Increment Rupee counter when green ruppee collected
020198F8 - Something that loads the level geometry
0213EEAC sets health
020A7D54 take damage
0213F538 calls take damage
0210F4A4 calls entire take damage function (somewhere above/below respawns link on land)
0210F2DC check if health is equal to 0
0210F2E0 branch to display gameover screen
0210F2F8 display gameover screen
0210F0B8
0201CC40 messes with rotation


____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

Sparsite
Posted on 11-20-16 09:48 PM (rev. 5 of 11-20-16 10:06 PM) Link | #79806
New progress. Decided to fully understand most of the formats before I work on an editor. I will probably trash my current one because its probably pretty messy and inefficient.

Notes:
BOPM (Map Objects)
0x4: Header
0x8: Length of section (reversed ex. a length of 1090 would be 90 10 00 00)
0x9: Number of Map Objects
0x12: Padding

Each Map Object is 28 bytes long

Byte 1: Map Object ID

Map Object IDs:
00 = Tree
01 = Two Horizontal Grass Patches
02 = Boulder
03 = Blue Pot
04 = Fence Post
05 = Brown Floor Switch
06 = Game Crash (Bad Parameter Maybe?)
07 = Grey and Blue Stone Door
08 = Small Stone Slab
09 = Large Wooden/Stone Key Door
0A = Wooden Treasure Chest
0B = Unknown/Nothing
0C = Entering the area spawns a treasure chest (Conditional Treasure Chest Spawn?)
0D = Game Crash
0E = Blue Pot Again
0F = Game Crash
10 = Game Crash
11 = Red Campfire
12 = Game crash
13 = Game Crash
14 = Game Crash
15 = Stone Triangle Base With Pyramid and Entrance
16 = Game Crash
17 = Game Crash
18 = Game Crash
1F = Sign
2F = Main Island NPC House
88 = Stone Pyramid With Front Entrance
3C = Collisionless Vertical Grass Tile

This is where I think the ZOB files come in to play. ZOB files seem to be an object bank of sorts. Similar to SM64DS, there are objects such as Pots or Trees that are always loaded into memory.

There are 4 ZOB files with every map.bin file:
motype_XX_0 and motype_XX_1 (XX is just the numbers from the map.bin)
MO meaning Map Objects within the BOPM Header.

Next, there are npctype_XX_0 and npctype_XX_1. These seem to correspond with all the NPC's used in the map.bin's ZMB file.

I think these ZOB files may be the reason that the game is crashing with those certain object IDs.

The game also has some unexpected map objects. All the houses, fences, etc. which are completely static are map objects. Maybe they get moved around in different acts later in the game? Or maybe the game puts certain effects on them like anit-aliasing. Not sure though. ACPN objects have X/Y positions and Y rotations of 2 bytes, but this is what the map objects look like.

3C 00 00 00 22 25 00 00 01 00 00 00 02 00 03 00 01 01 00 00 00 00 00 00 FF 01 00 00
88 00 00 00 2F 11 00 00 01 00 00 00 00 00 00 00 01 01 00 00 00 00 00 00 FF 01 00 00
01 00 00 00 13 26 00 00 00 00 00 00 00 00 00 00 01 01 00 00 00 00 00 00 FF 01 00 00

Still unsure about the BMOR section, all I could find out was this:
BMOR (Unknown)
0x4: BMOR Header
0x8: Size of Section (reversed)
0x12: Number of entries in section?

Looked a little bit at the MOOR header:
MOOR (Room)
This is what stores the level area data such as music, skybox, etc.

0x4: Header
0x19: Music ID

Music Reference List - http://zeldauniverse.net/media/music/phantom-hourglass-original-soundtrack/

Music IDs:
00 - Overworld
01 - Dunegon
02 - Duplicate Overworld
03 - Mercay Island
04 - Inside House
05 - Duplicate Inside House
08 - Duplicate Mercay Island

Also, I figured out that the one ZEB file used called envcolor.ZEB has several headers inside th file such as 0AES and 0NGD followed by (most likely) enviornment/vertex coloring data.

Other things I still need to look at: EMAC Header (Camera), RYLP Header (Player), and PRAW Header (Warp)

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

shibboleet
Posted on 11-20-16 10:06 PM Link | #79808
little endian is ass

____________________
a

Sparsite
Posted on 11-20-16 10:18 PM (rev. 3 of 11-20-16 11:16 PM) Link | #79809
Posted by shibboleet
little endian is ass


Agreed.

More stuff found, that is not on The Cutting Room Floor.

The root/Map folder contains a NSBMD and NSBTX texture of an SM64DS skybox. It has the same name: vr01

Most likely used for testing purposes.

[image]

____________________
ASMR:
*quietly whispers*
move r0 r7
push r4 to r14
load register r4 into r0
POP

Natsu235
Posted on 12-23-16 02:45 PM Link | #80534
Hey, nice to see a topic for hacking Phantom Hourglass and Spirit Tracks.

Here is all I can say about ZCB Files (Zelda Collision):

Phantom Hourglass and Spirit Tracks ZCB are differents.
I already tried to import a map from ST into PH, model and textures worked great in-game but I fell through the floor. So I used the ZCB generator and same result meaning Gericom ZCB generator is only for ST.

While a ZCB file is in a Hex Editor,
0x0C mean the numbers of differents sections (04 for Phantom Hourglass, 05 for Spirit Tracks)

List of sections:
-BXTV
-BLCP
-BMRN (Spirit Tracks only)
-BIRT
-BDRG

Another weird thing in Phantom Hourglass ZCB
The BDRG section of every maps don't have the right size.

Example:
If I open dngn_flame_00.zcb (Fire Temple first floor) in a Hex Editor, I can see the total file size at 0x08 is DC5A. When I check with CTRL+A file size is only 6970.
BDRG section is wrong, it say 57EC instead of 2280.

shibboleet
Posted on 12-23-16 03:13 PM (rev. 2 of 12-23-16 03:13 PM) Link | #80535
well if you're looking at collision, look for pairs of 3 that are floats. Those are the vertices. Try looking for the triangles as well. That's what I did for Double Dash, and was able to build a viewer from that.

____________________
a

Natsu235
Posted on 01-03-17 12:25 PM Link | #80738
I don't have enough knowledge to build a tool.
Btw any way to replace ST double tap for rolling with PH ?
Pages: 1 2

Main - Misc. ROM hacking - Zelda DS Hacking [HELP] Hide post layouts | New reply

Page rendered in 0.101 seconds. (2048KB of memory used)
MySQL - queries: 29, rows: 235/235, time: 0.032 seconds.
[powered by Acmlm] Acmlmboard 2.064 (2018-07-20)
© 2005-2008 Acmlm, Xkeeper, blackhole89 et al.