Final Fantasy Hacktics

I'm searching for such a hack in the forum currently, wondering if it exists. If not, how do I make it myself?

The gameshark codes for activating the sound novels are in the FFT Complete main info thread. But I'd prefer if I could access the novels without needing to use the gameshark every time.



Edit: Hmm, I just watched Wiz's video tutorial on hex editing using HxD and CDmage. Its a great tutorial! Can these gameshark codes be translated into some sort of code that we can use to hex edit in the iso?

Edit2: Alright, I went to read up on gameshark files on the following site: http://gamehacking.org/faqs/hackv500c.html#playstation_code_types (http://gamehacking.org/faqs/hackv500c.html#playstation_code_types)

Using HxD, I opened up my ISO file (FF Tactics.img) and tried changing the values in the four offset addresses according to the above gameshark codes.

In offset 09EB99, changed 00 to 01
In offset 09EB9A, changed 00 to 02
In offset 09EB9B, changed 00 to 03
In offset 09EB9C, changed 00 to 04

After doing that, I hit save and then tried loading it up using epxse. But the novels still don't work.  :cry:

I've attached a screenshot of the HxD window for the changes I've made. Is there any step that I've done wrong? The gameshark codes themselves should be correct as I've tried them using pec.

Could you post a screencap of the ram viewer for pSXfin, at the ram location where the code is?

Hmm.. I've just downloaded psxfin. Tried playing with the r3000 debugger but couldn't figure out how to use it. How do I find the ram location?

Do I not have the actual asm hack uploaded in the FFT:Complete area? I can upload it there if you would like Life. What are your plans?

Cheetah, that would be great! I've read through every post in the complete area but couldn't find the hack. Or perhaps I missed it somewhere.

I wanted to make a simple patch to unlock the sound test and novels in the US version and leaving them as they are with Japanese text. No other changes will be made in that patch. This way there wouldn't be a need to hunt down the Japanese iso just to mess around with these two removed features in their original form. Also, the patched iso can still be used as a base to play around with FFTpatcher. The iso is still technically 'clean' as no changes were made that directly affects the core gameplay mechanics of fft.

I tested it and it should work. It doesn't show the input command needed, Triangle, but pressing it when looking at the novels does cause the novels to begin.

It works! Thank you so much!

You're welcome ^_^'

Good to hear you got it taken care of. If you are ever interested in inserting the actual translations let me know.

Alright thanks. I'm still figuring out the basic of hacking fft though. I love your FFT Complete patch btw. It got me interested to learn more about hacking.  ;)

I'm thinking of trying another thing related to gameshark - enable the world debug and battle debug codes through asm. Has this been done before? Is it possible to figure out the offset address from the asm just by looking at the gameshark codes? I can't see the link between the offset address for the asm and the gameshark codes in the sound novel case...

I had to find what file the gameshark code was editing to create that little edit, which in this case was wldcore.bin. wldcore.bin is loaded at 0x67000. So 0x9eb99 - 0x67000 leads to the offset change needed in the actual game (0x37b99).

I see. So we need to first figure out which file the gameshark modifies, and then using the gameshark address, subtract the offset where the file is loaded, to obtain the actual offset change. If we modify the iso itself like I initially did, why wouldn't it work?

Hmm.. Since we need to find the file that the code is modifying, has it been documented in this site which file is loaded at which offset?

The problem lies in the way FFT loads files. You noticed that I said wldcore.bin is loaded at 0x67000? Well, that's only true when you're not in a battle and possibly an event... But when you're in battle, this file is replaced by battle.bin and battle.bin begins at 0x67000.

A few files are known where they are loaded, I've heard its not hard to figure out what file is being loaded at a certain time.

http://ffhacktics.com/wiki/Offset_Conversion

If I remember correctly, the world debug codes just extend the number of options in menus and reassign what those new options point to. It will be easy to do.

Yup, that's what it does. These are the actual codes.

World Debug Menu code:
D0198090 0000
80198090 0006

Battle Debug Menu code:
8016BC1C 0003

I'm still not sure how determining which file is loaded works. Like for the sound novel example with wldcore.bin, the offset conversion page did not list wldcore.bin. How did you figure out that it loads wldcore.bin at 0x67000 and not, for example, world.bin?

For the world debug codes, how do I figure out which file they are modifying? 198090 - E0000 = B8090. I tried changing the value at B8090 in world.bin to 06 (it was 00 originally), but it didn't work.

For the battle debug code, 16BC1C - E0000 = 8BC1C. I tried changing the value at 8BC1C in battle.bin, it didn't activate the code as well.

Quote from: Life on November 20, 2011, 02:06:47 am
Yup, that's what it does. These are the actual codes.

World Debug Menu code:
D0198090 0000
80198090 0006

Battle Debug Menu code:
8016BC1C 0003

I'm still not sure how determining which file is loaded works. Like for the sound novel example with wldcore.bin, the offset conversion page did not list wldcore.bin. How did you figure out that it loads wldcore.bin at 0x67000 and not, for example, world.bin?

For the world debug codes, how do I figure out which file they are modifying? 198090 - E0000 = B8090. I tried changing the value at B8090 in world.bin to 06 (it was 00 originally), but it didn't work.

For the battle debug code, 16BC1C - E0000 = 8BC1C. I tried changing the value at 8BC1C in battle.bin, it didn't activate the code as well.

It's not that simple.  Many times, only part of a file is loaded into RAM, so what you need to do is go to the RAM address in the Memory Viewer in pSX, and post a pic of what's going on there.  What we want is the original data from around that address.  We can then use that information to search for the same block of data in the game's files, which we can then edit.

I don't remember enough about pSX to help you, but I do know that there are different versions.  I think the one named psxfin.exe is the one you want.

Is this what is needed? Using HxD to open the .psv savestate and going to the memory addresses stated in the gameshark codes.

A pSX save state (aka *.PSV) has a header on it.
http://ffhacktics.com/wiki/Offset_Conversion

Quote*RAM to PSV: Add 0x2B0

Add 0x2b0 to the RAM address to get the same address in a *.psv, and then post another screenshot of that location in the psv.

Alright. 2B0+198090=198340, 2B0+16BC1C=16BECC.

In the second screenshot (battle debug) of your savestate, that data seems to definitely be from WORLD.BIN (0x8BC1C), but I can't seem to figure out which file is responsible for the data in the first screenshot (RAM 0x198090). It doesn't seem like anything obvious. If it's the same savestate, we know the world files are loaded and the battle ones aren't, at least.

Life you should not be testing things out in a hex editor, its far too slow. you should be doing all the testing directly in the debugger, that way you get instant feedback. When you're done testing that is the right time to go ahead and convert your addresses from RAM pointers to file offsets and make your permanent changes in a hex editor. Follow these links they've got a good overview of how to work with pSX debugger:

http://www.zophar.net/forums/showthread.php?t=13521
http://www.gamefaqs.com/boards/914326-vagrant-story/58898231#9

Just thought of this: When does this *.PSV save state take place?  Is it mid-battle, or is it on the world map, or what?  Because that can tell us a lot (or, even better, you could put the save state in a *.zip archive and upload it with your reply).

Anyways, the general gist is that, now that you know what the original data looks like, you can search for it in the actual game files on the game disk.  You do that by taking some data from just before or after the gameshark code location and searching for that data in the game files, using a hex editor.  If I had access to a windows machine and I wasn't homeless right now, I'd do it for you, but it looks like you have to do it on your own.

It looks like it must not have been in a battle/event because I wouldn't have found WORLD.BIN data in the savestate if it was... world map seems like a decent bet... but more details, would, of course, be useful!

Yup, that save state took place on the world map. It occurs right after I load the date from the memory card. The debug codes were not activated. Or rather, I don't really know how to get gameshark codes to work with psxfin yet. Haha. I tried playing with the debugger, but don't really understand how to get it working either.. >_> I'll have to read more about that...

I've also made another save state during mid battle. I suppose that's when the battle debug codes will be activated? The world debug modifies ram address of the data loaded from the disk when we are on the world map, while the battle debug modifies ram address of the data loaded from the disk when we are in battle. I should be searching for the world debug address in the first world map save state, and the battle debug address in the second mid battle save state right? Since that's supposed to be when the codes are in effect.

I've attached both screenshots at the point where I saved the states, also as you suggested, the *.zip of both the *.psv save states.

If you wanna do some GameSharking with pSXfin Go Here and download CEP
http://psxemulator.proboards.com/index.cgi?board=rules&action=display&thread=1060

In the first *.PSV file (world map save state), when I changed the value of the 198340 from 00 to 06, upon loading the state, the cursor is automatically placed at the bottom of the menu options as shown in the screen shot below. This means the code is activated. But if I scroll up back into the main menu, I can no longer select the debug options. The code becomes deactivated. Pressing down when the cursor is highlighting 'options' will move it back to 'Move' just like the original main menu. Is there another value that I need to change to make the debug menu always selectable? I'm thinking it has to do with the first code: D0198090 0000

The same thing happened for the battle debug code as well. In the second save state (Mid battle), changing 16BECC causes the cursor to be automatically located below 'Options' when loaded, as shown in the screen shot below. However, scrolling back into the default menu causes the code to be deactivated.

I've attached the updated save states at the end of this post. They are the original states that I've posted previously, but with the 198340 altered to 06 in save state 1(world map) and 16BECC altered to 03 in save state 2(mid battle).

Also, I'm having a really difficult time searching for the exact location of the two save state addresses in the game's files.. >_< Is there a trick to it?

0xD0 is a prefix in gameshark codes, which is attached to the front of a RAM address.  Basically it means when the following RAM address has this value, activate the following 0x80 prefixed code.

And I hate to say this, but if you don't understand after everything that's been explained, then give up.  I can't find this stuff for you, since I don't have access to a Windows machine (and therefore can't use pSX, or the savestates you posted), and it looks like nobody else will help you.  It sucks that no one else will help you, because I could find this within a couple hours at the very most, as could anyone else with pSXfin, a hex editor, and some time on their hands.

PS - the reason why the debug mode starts out with the cursor pointing at the right place, but doesn't work aftewards, is a gameshark constantly forces a RAM address to change it's data to something else.  Just changing a position in a save state won't work, but, since you found the correct location in a save state, you can now search for them in the game files.

LATER

I spent about 15 minutes lookinf for the string A0 86 10 80 from the World Debug Menu.  I found it, and took a screencap.  While trying to find the string 93 FF AF FF 78 78 BC 7C 18 00 08 00 00 in the data above it, I failed, but I think it's somewhere in the EVENT folder.  I could be wrong.  Glain, could you look around the location I found in WORLD.BIN, and see if you can find anything related to the World Debug Menu?

Do you understand what you have to do?

Okay.

The obvious places to look for those addresses (BATTLE.BIN 0x104C1C and WORLD.BIN 0xB8090), and the areas around them, are both just full of zeroes. But honestly, why wouldn't they be?

I think I now understand what the numbers are. They represent the index of the current selected option in their respective menus. The world menu has 7 options (including the invisible debug option), and it indexes the options starting at zero, so option 7 is index 6. When we change that memory location to 6, we now have the seventh option selected (the debug option).

Similarly, the battle menu has 4 options, including debug. Starting at zero, the 4th option would be index 3, so changing the index to 3 means the fourth (debug) option is selected.

What we're dealing with are volatile memory addresses. This isn't memory that gets loaded in from the files and stays static... it gets constantly written and overwritten by the game. The reason the gameshark codes work, as PGF mentioned, is that the codes are constantly reapplied. So even if we found the locations in the game's files and changed them, who cares? It wouldn't last, just like the savestate changes don't.

...I guess the real solution would just be to make the options for debug visible and selectable at will. Not sure what that entails, but simply adapting the gameshark codes to file hex addresses isn't going to work.

Those memory addresses might be a clue though, because we can see when they get changed in the pSX debugger, so they might give a clue as to how the menus are created. It's a thought.

I understand what you mean Glain, editing those values wouldn't help because they are dynamic. Making the options visible and selectable at will seems way too difficult for me to pull off. I guess I can only leave it here for now. Hopefully in the future someone will be interested in this to pick this up and make this possible.

The reason I was interested in this in the first place was after playing around with the debug codes in the Japanese version. The Japanese debug menus are much more organised than in the US version. It would be nice if something like that can be recreated in the US version.

For anyone interested, in the world debug menu, the three new options that appear below the usual six have proper text and are labeled 'Debug', 'Flag' and 'Party'. All the game crashing options that were present in the US debug menus are not present and cannot be selected. Overall, it functioned more like a real menu. Pressing down when the cursor is highlighting 'Party' will bring it back to 'Move' rather than scroll it out of the screen.

For the battle debug menu, there is an additional 'Parameter Change' listed in the menu along with the standard 'AT', 'Unit List' and 'Options'. There are two more invisible options below 'Parameter Change', and they function exactly like they do in the US battle debug. The 1st invisible option cancels the menu, while the 2nd invisible option brings up a weird menu showing the active character's Action commands. Similar to the world debug menu, pressing down when the cursor is highlighting the second invisible option will return it to 'AT'. None of the game crashing options are present either.

These are the codes for the Japanese version if anyone wants to try them out.



To mimic the Japanese version, the values 06, 07, 08 would be made visible and selectable at will in 0xB8090 of WORLD.BIN, and likewise for 03, 04 and 05 in 0x104C1C of BATTLE.BIN.

I don't really know much about programming and am new to hacking. This seem quite impossible for me to pull off.. >_<

Thanks for your help too PGF. I really wish I could do more.. >_<

It will help if someone who has a Japanese FFT disc creates a PPF file against the American FFT disc, so we have a PPF patch which can turn the American FFT into the Japanese FFT.

I've made the two PPF patches to convert the US FFT to version 1.0 and 1.1 of the Japanese FFT. The patches are huge though. Like 316mb each. It'll take a while to upload.

Have you tried putting them in an archive, or uploading them to megaupload?  You can get a free account with Megaupload, you know.

I've just created a new account on Fileserve and uploading one of the patches there now. Should have used Megaupload, but oh well, its already more than halfway uploaded. May as well finish it. I've also split the patches up into 3 pieces each using winrar, will be uploading them to mediafire where they should remain stored for a while.

Edit: Here's the link to the first patch: fft jp ver 1.0.ppf (http://www.fileserve.com/file/w473Zq9/fft jp ver 1.0.ppf) It changes the US FFT to version 1.0 of the Japanese FFT. If I'm not wrong, version 1.0 is the original Japanese release while version 1.1 is the Square Millennium Collection release.

So, if I have it right, the only thing which prevents the player from accessing the debug menu in normal gameplay is that the bottom options can't be chosen.

I believe that to be the case based on what I'm seeing, since the gameshark can force the unselectable options to be selected. I'm wondering if there's something in the menu that flags it as unselectable or invisible or what have you, and if we can turn it off.

I know that there's something which toggles what happens when you try to go beyond the boundries of the menu.  In some menus, trying to go up at the top-most option will bring you to the bottom-most option (and vice-versa), but in others the game won't let you go cycle through the menu options by going up at the top-most option (or vise-versa).

I imagine that FFT Complete found a way to mess around with the menus, and I'm pretty sure Xifanie did the same when she corrected the Unlimited JP On Learn Ability Menu bug.

Here's the patches on mediafire split into 3 parts each.

Mediafire link:
FFT JP Version 1.0 ppf: Part 1 (http://www.mediafire.com/download.php?2duqfktatngdnk8) Part 2 (http://www.mediafire.com/download.php?3ewm55o3v0333jj) Part 3 (http://www.mediafire.com/download.php?puopatv1n851arq)
FFT JP Version 1.1 ppf: Part 1 (http://www.mediafire.com/download.php?vyvnynpl924rp20) Part 2 (http://www.mediafire.com/download.php?npcejm9eb5e63tr) Part 3 (http://www.mediafire.com/download.php?ko8se8u8a8ts31c)