Is there an ASM for unlocking the sound novels? (gameshark to HEX question)

[Valendian]

Life you should not be testing things out in a hex editor, its far too slow. you should be doing all the testing directly in the debugger, that way you get instant feedback. When you're done testing that is the right time to go ahead and convert your addresses from RAM pointers to file offsets and make your permanent changes in a hex editor. Follow these links they've got a good overview of how to work with pSX debugger:

http://www.zophar.net/forums/showthread.php?t=13521
http://www.gamefaqs.com/boards/914326-vagrant-story/58898231#9

[Pickle Girl Fanboy]

Just thought of this: When does this *.PSV save state take place?  Is it mid-battle, or is it on the world map, or what?  Because that can tell us a lot (or, even better, you could put the save state in a *.zip archive and upload it with your reply).

Anyways, the general gist is that, now that you know what the original data looks like, you can search for it in the actual game files on the game disk.  You do that by taking some data from just before or after the gameshark code location and searching for that data in the game files, using a hex editor.  If I had access to a windows machine and I wasn't homeless right now, I'd do it for you, but it looks like you have to do it on your own.

[Glain]

It looks like it must not have been in a battle/event because I wouldn't have found WORLD.BIN data in the savestate if it was... world map seems like a decent bet... but more details, would, of course, be useful!

[Life]

Yup, that save state took place on the world map. It occurs right after I load the date from the memory card. The debug codes were not activated. Or rather, I don't really know how to get gameshark codes to work with psxfin yet. Haha. I tried playing with the debugger, but don't really understand how to get it working either.. >_> I'll have to read more about that...

I've also made another save state during mid battle. I suppose that's when the battle debug codes will be activated? The world debug modifies ram address of the data loaded from the disk when we are on the world map, while the battle debug modifies ram address of the data loaded from the disk when we are in battle. I should be searching for the world debug address in the first world map save state, and the battle debug address in the second mid battle save state right? Since that's supposed to be when the codes are in effect.

I've attached both screenshots at the point where I saved the states, also as you suggested, the *.zip of both the *.psv save states.

[Valendian]

If you wanna do some GameSharking with pSXfin Go Here and download CEP
http://psxemulator.proboards.com/index.cgi?board=rules&action=display&thread=1060

[Life]

In the first *.PSV file (world map save state), when I changed the value of the 198340 from 00 to 06, upon loading the state, the cursor is automatically placed at the bottom of the menu options as shown in the screen shot below. This means the code is activated. But if I scroll up back into the main menu, I can no longer select the debug options. The code becomes deactivated. Pressing down when the cursor is highlighting 'options' will move it back to 'Move' just like the original main menu. Is there another value that I need to change to make the debug menu always selectable? I'm thinking it has to do with the first code: D0198090 0000

The same thing happened for the battle debug code as well. In the second save state (Mid battle), changing 16BECC causes the cursor to be automatically located below 'Options' when loaded, as shown in the screen shot below. However, scrolling back into the default menu causes the code to be deactivated.

I've attached the updated save states at the end of this post. They are the original states that I've posted previously, but with the 198340 altered to 06 in save state 1(world map) and 16BECC altered to 03 in save state 2(mid battle).

Also, I'm having a really difficult time searching for the exact location of the two save state addresses in the game's files.. >_< Is there a trick to it?

[Pickle Girl Fanboy]

0xD0 is a prefix in gameshark codes, which is attached to the front of a RAM address.  Basically it means when the following RAM address has this value, activate the following 0x80 prefixed code.

And I hate to say this, but if you don't understand after everything that's been explained, then give up.  I can't find this stuff for you, since I don't have access to a Windows machine (and therefore can't use pSX, or the savestates you posted), and it looks like nobody else will help you.  It sucks that no one else will help you, because I could find this within a couple hours at the very most, as could anyone else with pSXfin, a hex editor, and some time on their hands.

PS - the reason why the debug mode starts out with the cursor pointing at the right place, but doesn't work aftewards, is a gameshark constantly forces a RAM address to change it's data to something else.  Just changing a position in a save state won't work, but, since you found the correct location in a save state, you can now search for them in the game files.

LATER

I spent about 15 minutes lookinf for the string A0 86 10 80 from the World Debug Menu.  I found it, and took a screencap.  While trying to find the string 93 FF AF FF 78 78 BC 7C 18 00 08 00 00 in the data above it, I failed, but I think it's somewhere in the EVENT folder.  I could be wrong.  Glain, could you look around the location I found in WORLD.BIN, and see if you can find anything related to the World Debug Menu?

Do you understand what you have to do?

[Glain]

Okay.

The obvious places to look for those addresses (BATTLE.BIN 0x104C1C and WORLD.BIN 0xB8090), and the areas around them, are both just full of zeroes. But honestly, why wouldn't they be?

I think I now understand what the numbers are. They represent the index of the current selected option in their respective menus. The world menu has 7 options (including the invisible debug option), and it indexes the options starting at zero, so option 7 is index 6. When we change that memory location to 6, we now have the seventh option selected (the debug option).

Similarly, the battle menu has 4 options, including debug. Starting at zero, the 4th option would be index 3, so changing the index to 3 means the fourth (debug) option is selected.

What we're dealing with are volatile memory addresses. This isn't memory that gets loaded in from the files and stays static... it gets constantly written and overwritten by the game. The reason the gameshark codes work, as PGF mentioned, is that the codes are constantly reapplied. So even if we found the locations in the game's files and changed them, who cares? It wouldn't last, just like the savestate changes don't.

...I guess the real solution would just be to make the options for debug visible and selectable at will. Not sure what that entails, but simply adapting the gameshark codes to file hex addresses isn't going to work.

Those memory addresses might be a clue though, because we can see when they get changed in the pSX debugger, so they might give a clue as to how the menus are created. It's a thought.

[Life]

I understand what you mean Glain, editing those values wouldn't help because they are dynamic. Making the options visible and selectable at will seems way too difficult for me to pull off. I guess I can only leave it here for now. Hopefully in the future someone will be interested in this to pick this up and make this possible.

The reason I was interested in this in the first place was after playing around with the debug codes in the Japanese version. The Japanese debug menus are much more organised than in the US version. It would be nice if something like that can be recreated in the US version.

For anyone interested, in the world debug menu, the three new options that appear below the usual six have proper text and are labeled 'Debug', 'Flag' and 'Party'. All the game crashing options that were present in the US debug menus are not present and cannot be selected. Overall, it functioned more like a real menu. Pressing down when the cursor is highlighting 'Party' will bring it back to 'Move' rather than scroll it out of the screen.

For the battle debug menu, there is an additional 'Parameter Change' listed in the menu along with the standard 'AT', 'Unit List' and 'Options'. There are two more invisible options below 'Parameter Change', and they function exactly like they do in the US battle debug. The 1st invisible option cancels the menu, while the 2nd invisible option brings up a weird menu showing the active character's Action commands. Similar to the world debug menu, pressing down when the cursor is highlighting the second invisible option will return it to 'AT'. None of the game crashing options are present either.

These are the codes for the Japanese version if anyone wants to try them out.

spoiler

World Debug

D016781E 0005
8016781E 0008
D016781C A010
8016781C A00F
D0167806 0070
80167806 00A0
D0167816 0070
80167816 00A0

Battle Debug

D0164E6E 0002
80164E6E 0005
D0164E6C 502E
80164E6C 502C
D0164E56 0040
80164E56 0050
D0164E66 0040
80164E66 0050

To mimic the Japanese version, the values 06, 07, 08 would be made visible and selectable at will in 0xB8090 of WORLD.BIN, and likewise for 03, 04 and 05 in 0x104C1C of BATTLE.BIN.

I don't really know much about programming and am new to hacking. This seem quite impossible for me to pull off.. >_<

Thanks for your help too PGF. I really wish I could do more.. >_<

[Pickle Girl Fanboy]

It will help if someone who has a Japanese FFT disc creates a PPF file against the American FFT disc, so we have a PPF patch which can turn the American FFT into the Japanese FFT.

[Life]

I've made the two PPF patches to convert the US FFT to version 1.0 and 1.1 of the Japanese FFT. The patches are huge though. Like 316mb each. It'll take a while to upload.

[Pickle Girl Fanboy]

Have you tried putting them in an archive, or uploading them to megaupload?  You can get a free account with Megaupload, you know.

[Life]

I've just created a new account on Fileserve and uploading one of the patches there now. Should have used Megaupload, but oh well, its already more than halfway uploaded. May as well finish it. I've also split the patches up into 3 pieces each using winrar, will be uploading them to mediafire where they should remain stored for a while.

Edit: Here's the link to the first patch: fft jp ver 1.0.ppf It changes the US FFT to version 1.0 of the Japanese FFT. If I'm not wrong, version 1.0 is the original Japanese release while version 1.1 is the Square Millennium Collection release.

[Pickle Girl Fanboy]

So, if I have it right, the only thing which prevents the player from accessing the debug menu in normal gameplay is that the bottom options can't be chosen.

[Glain]

I believe that to be the case based on what I'm seeing, since the gameshark can force the unselectable options to be selected. I'm wondering if there's something in the menu that flags it as unselectable or invisible or what have you, and if we can turn it off.

[Pickle Girl Fanboy]

I know that there's something which toggles what happens when you try to go beyond the boundries of the menu.  In some menus, trying to go up at the top-most option will bring you to the bottom-most option (and vice-versa), but in others the game won't let you go cycle through the menu options by going up at the top-most option (or vise-versa).

I imagine that FFT Complete found a way to mess around with the menus, and I'm pretty sure Xifanie did the same when she corrected the Unlimited JP On Learn Ability Menu bug.

[Life]

Here's the patches on mediafire split into 3 parts each.

Mediafire link:
FFT JP Version 1.0 ppf: Part 1 Part 2 Part 3
FFT JP Version 1.1 ppf: Part 1 Part 2 Part 3