+  RHDN Forum Archive
|-+  Romhacking
| |-+  ROM Hacking Discussion
| | |-+  Soul Blazer map problems
Pages: [1]
Author Topic: Soul Blazer map problems  (Read 2 times)
nomit
Guest
« on: December 04, 2008, 09:00:45 pm »

I'm trying to figure out how the maps are being built in Soul Blazer, I have the offset for the area but I'm not sure what to do next. I have tried to change a few valued and see how it behaves but changing something usually lead to the whole map getting messed up. I've also tried to looking at the code for some pattern.
It might very well be compressed but I don't know how to check, and if it turns out it's compressed what compression it is.

What can be recommended for figuring this out? I'm guessing a debugger would be a good tool but if so I would love a tips on what to look for.

The room I'm trying to figure out is:


and the hex at the offset is:

01 01 00 01 CC BB FB 27 A1 D6 68 40 2F 94 77 86 6F 53 B4 D4 84 5F 38 EF 0C D6 C3 71 BC DC EC
36 22 53 E4 66 1D E1 B3 D8 EF 7F 7B EE 27 07 92 36 0E 1E C7 81 B2 0F 16 EB 7F BB E0 64 32 3A
BC 8E 48 56 79 A1 43 13 C7 80 2D 21 29 0F 04 00 1A 21 58 0F 48 50 A1 00 D5 16 CC 40 1D 5E B7
5C B8 22 00 15 37 77 BD DF 36 08 C0 3F A3 B4 E0 F9 7C DE 7E 12 18 46 C3 CA 16 8E 8C 8E 24 70
D2 2B C4 8E 2B 60 5F 74 01 9F EE 0C


Just to clarify, I'm not asking for anyone to figure it out for me. Sure I wouldn't be angry at anyone if they did  but what I'm asking for are some guidelines on how to figure it out.
Tauwasser
Guest
« Reply #1 on: December 05, 2008, 10:21:13 am »

Firstly, are you sure this is the beginning of map data both in the rom and on the screen you show?

Secondly, from some Zelda gbc games I got to know that those compressions can be tiresome to say the least. Make sure you get a good debugger and start debugging the hell out of it. The gbc Zelda for instance placed blocks everywhere until the map was full and could fill spaces and crap. Really didn't save much with all the control codes, but then again...

Anyway, debug. It's as simple as that... or not Cheesy

cYa,

Tauwasser
nomit
Guest
« Reply #2 on: December 05, 2008, 11:38:35 am »

Thank you Tauwasser for reading and taking the time to reply.

I got the offsets from datacrystal so I can't be sure but the file seems to have figured a lot of the data out. I have played with it some more by doing some boring trial and error editing a byte manually and see what changes (It's less then 150 bytes otherwise I wouldn't have the patience).

So far I've at least got a few of the bytes figured out (I think), I will play around with it some more tonight and report back if I figure something big out.

Is  there any good guide on how to debug in a snes game? I have changed text, graphic and *looked* at a little ASM before but I have never learned to debug.
MathOnNapkins
Guest
« Reply #3 on: December 05, 2008, 01:17:48 pm »

No guide that I know of. I'm not even sure what would be in said guide. You pretty much use intuition and cunning to figure out whatever it is you need to figure out as quickly as you can. If you know the location of the map data in the rom you can set a read breakpoint on a location that is in range. Keep in mind that you might have to convert a rom address to a CPU address in order to set the breakpoint. If you get a hit on that breakpoint when the room loads you know you've hit the code that handles that data.
Tauwasser
Guest
« Reply #4 on: December 05, 2008, 02:41:41 pm »

Maybe one of these days, somebody writes one up or something. This theme has been around lately. The problem seems to be to write a guide that is universal as consoles and debuggers differ widely. Then there is this part where you as a user just have to get stuff. Nobody can teach you that in my opinion.
You may now look for all posts of a user named "Rai" and look at his attempt to learn this.
Basically, he just could not see beyond the single opcodes. You really have to have the whole picture in mind! It's cool to be able to say that one function in the rom writes X bytes of Y value to ram 7E:8000++ or something (making a SNES example off of the top of my head, no guarantees).
It'd be cooler to say tho that said function transfers monochrome tiles (for every 0x10 X) to the start of vram!

Basically, the idea here is to familiarize yourself with the console you're hacking, i.e. get tech docs on registers and hardware, and then start understanding stuff as you trace your way thru the rom. Fortunatley, for SNES there is a lot of stuff already out here, right on RHDN!! If you do not understand everything, you may ask questions here in the forums.
The thing most people get angry about is to ask questions that could have been solved by a) reading the text or b) using the search function.

Quote
Title: Hellllllppppppppppppppp SadSadSad:(    Help, I opened anomie's doc and I don't understand no nutting?
will probably get your thread closed because random passers-by just got pissed of and tell you all about it.

Quote
Title: Anomie's Register Doc    Hi, I read anomie's register doc and I have trouble understanding the Addr 2115 register (ll. 305 to 329). What exactly is meant with "01 = Remap addressing aaaaaaaaBBBccccc => aaaaaaaacccccBBB"? Is this a bit layout for graphic tiles? Or what exactly is address remapping for video port control?
might actually make people that do that kind of hacking reply to your post!

Just a friendly heads up! Cheesy

cYa,

Tauwasser
nomit
Guest
« Reply #5 on: December 05, 2008, 05:12:16 pm »

Thanks for the advice both of you. Yes I understand about having to understand myself, otherwise I won't be able to do anything unless someone teaches me every new function step by step.

My biggest problem is that I don't really know much about the snes hardware or how a debugger works. I have some idea what CPU address is but no idea how to convert it, although I would probably be able to find such a thing out pretty easy looking into the documents here.

The debugger I'm trying now is "Geiger's Snes9x Debugger" and there are a lot of options, like when I'm going to trace what should I trace, when should I start tracing, what happens when a breakpoint finally occurs, should I use Next Op, Step Into or anything else so I will easier find the function.

I will start reading some documents about hardware right away like the one you posted.

And yes I will try to ask polite, as much for my own sake as others, so I can read my own posts without having to get annoyed.
KingMike
Guest
« Reply #6 on: December 05, 2008, 07:50:47 pm »

Well, one of the first steps is to find the map data in RAM (searching in a ZSNES savestate).
creaothceann
Guest
« Reply #7 on: December 06, 2008, 02:18:59 am »

You can extract the WRAM with vSNES, btw.
nomit
Guest
« Reply #8 on: December 06, 2008, 11:12:20 am »

I've tried vSNES a little, it seems like a very good tool. Like with every problem there seems to be many ways to find out how the map is being drawn I will try toying with a savestate some more but yesterday MathOnNapkins give me some short tips about debugging and I will try that out some more first, while reading "anomie's register doc". Can't say I get everything in the guide but I'm taking a few notes while reading and hopefully I will get more of it when it when I re-read the notes after I've read it once.
Alchemic
Guest
« Reply #9 on: December 06, 2008, 11:34:56 am »

Soul Blazer... I did some poking around with its map system a while back.
*rummages through disorganized notes*

The map pointers are part of the map metadata at 0x28200. The metadata is actually a small control code system that I haven't worked out completely, but the [10 01] command loads the map data. ([10 02] is probably for overlays/underlays, like the Grass Valley clouds or the animated background in Leo's Painting.)

A dump of 0x28200

The map data pointed to by a [10 01] has a four-byte header: one byte for width, one for height, and two for the total number of bytes to decompress. The rest is the compressed data.

To decompress, treat the bytes as a stream of bits. There are two basic commands:

Code:
Literal
(1) <8 bits>
The next position in RAM is filled with <8 bits>.

Repeat
(0) <8 bits> <4 bits>
Copy (2 + <4 bits>) bytes from a previous address.
To get the previous address, add 0x11 to <8 bits> and modulo by 0x100.
Find the most recent address in RAM that ends with this value, and start copying from there.

C source code for decompression
Sample output: Trial Room (the map from the first post)
Sample output: Mountain of Souls
Sample output: Magridd Castle

The current map is stored in RAM at 7E8000.
The map is divided into blocks of 256 bytes, corresponding to a 16x16 grid of 16x16-pixel map tiles.
These tiles are ordered left to right, and top to bottom.
The blocks themselves are also ordered this way.

ex. A 2x2-block map:
Code:
a..b  e..f
.  .  .  .
.  .  .  .
c..d  g..h

i..j  m..n
.  .  .  .
.  .  .  .
k..l  o..p

a = 7E8000
b = 7E800F
c = 7E80F0
d = 7E80FF
e = 7E8100
f = 7E810F
...
i = 7E8200
...
m = 7E8300
...
p = 7E83FF

I'm pretty sure the maximum size for a map is 0x1000 bytes, or 16 blocks - more than this and the game thinks the map has multiple "levels", which is how the lair-sealing resurrected areas work. The basic starting "town" map is described by the first 0x1000 bytes, and the next 0x1000 is an overlay with some houses and stuff, and so on.

Because of this, I'm not sure if "height" is the best description for the second byte of the map data header. For example, the Mountain of Souls and Magridd Castle (actually, all of the towns...) have a "height" of 0x10 (16 blocks), but the height of the map you can actually walk on is a mere four blocks.



Unrelated but interesting: Illusion of Gaia uses the same algorithm for map compression. It has different commands for map metadata - [06] instead of [10], for example - but the actual compression is the same.

ASCII maps from Illusion of Gaia, produced with an early version of the decompressor - I think every byte in these maps was ORed by 0x20 to avoid control characters (such as newlines, tabs, and the dreaded 0x07 bell).
nomit
Guest
« Reply #10 on: December 06, 2008, 02:17:11 pm »

Wow, I'm speechless.. I never even hoped to get that much information handed to me, let alone that someone would go out of their way to create an account, and describe is so well. I can't find a fitting smile to express my gratitude but a huge thank you goes to you and I'm a little curious if you plan on doing something hack-related with Soul Blazer?

If I do release some hack or editor or something in the future, you will without a doubt me mentioned.
Pages: [1]  


Powered by SMF 1.1.4 | SMF © 2006-2007, Simple Machines LLC