• Topic Archived
You're browsing the GameFAQs Message Boards as a guest. Sign Up for free (or Log In if you already have an account) to be able to post messages, change how messages are displayed, and view media in posts.

User Info: MeteorStrike

MeteorStrike
11 years ago#11
Going from a ROM's runtime address to its address in the ROM file can be a pain in the butt... The problem is that you don't really know which page is currently loaded in ROM, so it could be at multiple places. Here's a quick way to help in this:

Take the address of BC4C, and then add 0x11 to it. This is because NES games have 16 bytes of header data, which is not included in the run-time address. (The extra 1 byte you will need to add if your addresses are 1-based instead of 0-based)

Next, go to that address in the ROM and see if your data there matches the data in the ROM. If so, experiment with it to verify you got it, otherwise, add 8192 bytes to your current calculated address, and check there (essentially, you are checking the next ROM page.)

So you can see that BC4C = 3BC5D in the ROM because BC4C + 0x11 + ( 24 * 8192 ) = 3BC5D. It's basically located in the 25th ROM page... isn't that great... >_>

*NOTE:* I think a page is 8192 bytes, but I could be off... it's either 4096, 8192, or 16384 bytes. I'm pretty sure it's actually 8192 bytes but I'd rather put this note here just in case I got that wrong... >_>

So for the Ambush data:


// $75 = Battle ID. If the ID is positive, this is a boss battle, otherwise, it's a random battle.
$9CD8:A5 75 LDA $75 = #$3D

// If this battle is one of the following boss battles, make sure the enemy gets to strike first:
$9CDA:C9 48 CMP #$48
$9CDC:F0 1C BEQ $9CFA
$9CDE:C9 39 CMP #$39
$9CE0:F0 18 BEQ $9CFA
$9CE2:C9 3D CMP #$3D
$9CE4:F0 14 BEQ $9CFA
$9CE6:C9 4E CMP #$4E
$9CE8:F0 10 BEQ $9CFA


This code starts at $9CD8, and the 2 sequential bytes there are A5 and 75, which together make up the instruction of LDA $75. Following the same pattern above, you will find that:

9CD8 = 0x39CE8 in the ROM, because 9CD8 + 0x10 + ( 24 * 8192 ) = 0x39CE8
(Note that I added 0x10 instead of 0x11 because most hex editors are 0-based on their addressing mode.)

There's actually a much easier way to find the ROM address but it requires knowing how to use the NES debugger in FCE Ultra and I'd rather not explain all that here... you can read the readme to learn more...

Be extremely careful about changing this data, though... in this case, you won't be changing data, but executable code... it can crash the game if you put something wrong... before you edit the Ambush stuff, I suggest you learn some NES assembly and stuff... if you want to dive this deep in your game hacking, you definitely will need to know NES assembly and how to work with it... Based on your response, I am assuming you don't really know / do any NES assembly hacking... if this is true, then I'm actually amazed that you guys have made so many modifications to this game with nothing other than data hacking... :O

User Info: MeteorStrike

MeteorStrike
11 years ago#12
I almost forgot to mention, some games have some of its data repeated in multiple ROM pages. For a variety of reasons, this means that making one modification in one location in the ROM is not guaranteed to have the effect you want every time... I'm not sure if this game does this at any time, but just be aware of this fact, in case some modification seems to work sometimes but not in others. This can happen with both data AND executable code...

User Info: MeteorStrike

MeteorStrike
11 years ago#13
The Elixir items' healing values are calculated as follows:



// $4D = Item ID that was used.
// #$31 = Elixir A
// #$32 = Elixir B
// #$33 = Elixir C
// #$34 = Elixir D
$8980:A5 4D LDA $4D = #$31
$8982:38 SEC
$8983:E9 18 SBC #$18
$8985:20 0C C1 JSR $C10C



The function $C10C will calculate the function pointer of the function that handles the item's effect. In the case of the Elixirs, it takes you to one of the following locations:



// We jumped here if we used Elixir A
$8CAE:A9 00 LDA #$00
$8CB0:85 11 STA $11 = #$A7
$8CB2:A9 64 LDA #$64
$8CB4:85 10 STA $10 = #$10
$8CB6:D0 1C BNE $8CD4

// We jumped here if we used Elixir B
$8CB8:A9 01 LDA #$01
$8CBA:85 11 STA $11 = #$A7
$8CBC:A9 F4 LDA #$F4
$8CBE:85 10 STA $10 = #$10
$8CC0:D0 12 BNE $8CD4

// We jumped here if we used Elixir C
$8CC2:A9 03 LDA #$03
$8CC4:85 11 STA $11 = #$A7
$8CC6:A9 E8 LDA #$E8
$8CC8:85 10 STA $10 = #$10
$8CCA:D0 08 BNE $8CD4

// We jumped here if we used Elixir D
$8CCC:A9 11 LDA #$11
$8CCE:85 11 STA $11 = #$A7
$8CD0:A9 94 LDA #$94
$8CD2:85 10 STA $10 = #$10

// Continue execution
$8CD4:20 69 8D JSR $8D69




So basically, depending on where we jumped, we place the value of 100, 500, 1000 or 4500 into $11 - $12. The value at $11 - $12 will then be used as the healed amount...

As you can see from this new example, not everything in this game (or any other) is data-driven. Here, the healing amounts for these items is hard-coded into the actual executed code... this sucks for you, but it saves memory for the programmers of the game... Yet another example of why you need to learn NES assembly to continue your work in this game hack...

8CAE = 0x38CBE in the ROM file...



The use of Resurrect is a little more complex, because it requires that the General be revived before he gets healed for 400 HP. The place in the code that I traced the value is at:



// Storing the value of 400 into $11 - $12 so that it can be added
// to the General's HP when Resurrect is used:
$8C8F:A9 01 LDA #$01
$8C91:85 11 STA $11 = #$A7
$8C93:A9 90 LDA #$90
$8C95:85 10 STA $10 = #$10



Again, here is yet another value that is hard-coded into the assembly code...
8C8F = 0x38C9F

User Info: Xian_Zhu_Xuande

Xian_Zhu_Xuande
11 years ago#14
Thanks again! I'm going to play around with what you've shared to see what I can accomplish in the ROM. I'll probably also mess around a bit with the FCE Ultra feature you mentioned. I seem to remember reading a pretty great explanation of how this data translates to the ROM and even into Game Genie codes, so that could make for quite a bit of fun. Just need to find the appropriate time in my workday to put it all together.

Yeah, everything we've done we've done simply by hunting through the ROM and identifying data values which we can edit. It took quite a bit of stubborn perseverance to get this far, but there are more than a handful of people out there who are interested in doing this. It just so happens that none of us know the assembly language necessary to edit on the level you've suggested. I'm not sure how much work would be involved in learning that, but if it gets too complicated I think the next languages I plan to learn are the ones that will allow me to make tens of thousands of dollars selling odd random programs on the iTunes App Store. Haha...

Thanks—it should be pretty easy to figure out how to make additional changes to those Game Genie codes, too!

One more big question!

It just came to me. Certain officers, such as Zhang Fei, Guan Yu, Lu Bu, Zhuge Liang, Zhang Bao and Guan Xing cannot be placed into billeting (the officer storage) once they've been added to your party. We've wondered for a long time how we might remove those officers from our party and always suspected that there might be a simple flag somewhere—perhaps similar to what they did with An Sha? Is that something you could check out? It would be easy to duplicate with a new game by trying to place Guan Yu or Zhang Fei in billeting. Actually, Liu Bei is probably stuck in your party too.
Kongming’s Archives: kongming.net (Three Kingdoms Web Site)
Scholars of Shen Zhou: the-scholars.com (Three Kingdoms Forum)

User Info: MeteorStrike

MeteorStrike
11 years ago#15
When you try to place someone in storage, this happens:



// $5B = General's slot in the formation that is being stored.
// $6090,Y = The current order of the formation of the party.
// $60A8,X = General IDs of the party.
$943E:A4 5B LDY $5B
$9440:BE 90 60 LDX $6090,Y
$9443:86 4A STX $4A
$9445:BD A8 60 LDA $60A8,X

// At this point, Accumulator = General ID that the player is trying to store away.

// $9570,Y = The list of Generals that cannot be put away.
$9448:A0 06 LDY #$06
$944A:D9 70 95 CMP $9570,Y
$944D:F0 05 BEQ $9454
$944F:88 DEY
$9450:10 F8 BPL $944A
$9452:30 06 BMI $945A

$9454:20 0D D1 JSR $D10D



So the game maintains a list of 7 possible Generals that cannot be stashed away:
0x39580 = $9570,Y = A8 A9 AA AC AD BC D5

Which means that, according to the above algorithm, the following Generals cannot be stashed away after they join the party:
A8 = Liu Bei
A9 = Guan Yu
AA = Zhang Fei
AC = Guan Xing
AD = Zhang Bao
BC = Lu Bu
D5 = Zhu Ge Liang

In this case, the data IS stored in a data array at 0x39580 in the ROM, so you can edit this type of info easily...

User Info: Xian_Zhu_Xuande

Xian_Zhu_Xuande
11 years ago#16
Sweet!

Do you suppose the scripts are tied to specific entries in the array? Pitching Zhuge Liang, for example, complains that he is young and still has potential (or something along those lines), while attempting to pitch Lu Bu offers up a different script. I suppose it would be easy enough to discover by switching entries around and loading up the ROM.

Thank you. This has been very helpful.
Kongming’s Archives: kongming.net (Three Kingdoms Web Site)
Scholars of Shen Zhou: the-scholars.com (Three Kingdoms Forum)

User Info: Xiahou Mao

Xiahou Mao
11 years ago#17
Do you suppose the scripts are tied to specific entries in the array? Pitching Zhuge Liang, for example, complains that he is young and still has potential (or something along those lines), while attempting to pitch Lu Bu offers up a different script.

I'm pretty sure Lu Bu gets the exact same "young and has potential" line if you try to remove him from your party. ;)
Xiahou Mao, True Hero of the Three Kingdoms!

User Info: Xian_Zhu_Xuande

Xian_Zhu_Xuande
11 years ago#18
Lu Bu does. I'm still curious about the others. Will have to check.
Kongming’s Archives: kongming.net (Three Kingdoms Web Site)
Scholars of Shen Zhou: the-scholars.com (Three Kingdoms Forum)

User Info: MeteorStrike

MeteorStrike
11 years ago#19
As far as I know, the scripts are all the same...

As far as the Rebel Forces data, I don't think I'm gonna get to do that... at least not for a while... I may come back to it later... a lot of it is probably data-driven, but there's gonna be details in the algorithm that I really don't wanna trace right now, and that will be important on figuring out how their info is generated...

The calculation of damage done by tactics I already got mostly done, but I still got to look for the healing tactics' data. I'll get back to you on those at another time though... I got other, more important stuff to do right now... like finding a job... lol...

User Info: Xian_Zhu_Xuande

Xian_Zhu_Xuande
11 years ago#20
Finding a job... haha... yeah, that's pretty important right now. Good luck!

I read a bit of what you wrote about tactic damage and I imagine healing tactics are somewhat similar (aside from the target and failure checks). What I didn't notice was how damage is set for each tactic and whether it can be increased or decreased.
Kongming’s Archives: kongming.net (Three Kingdoms Web Site)
Scholars of Shen Zhou: the-scholars.com (Three Kingdoms Forum)
  • Topic Archived

GameFAQs Q&A