Author Topic: [FF8] Engine reverse engineering  (Read 10395 times)

Callisto

  • Fast newbie
  • *
  • Posts: 39
  • Karma: 1
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #25 on: 2016-05-02 15:12:05 »
Amazing work JWP! Just tried this myself and it seems to work perfectly. By making these changes, it is very simple to adjust Vit 0 resistance for each enemy individually, especially in conjunction with Ifrit enemy editor. Almost like a dream becoming true.. Can finally get back to work now. Thanks a ton! :-D

JWP

  • Crazy poster
  • *
  • Posts: 149
  • Karma: 19
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #26 on: 2016-05-03 18:43:10 »
No problem :). Btw, here's all the stuff you were after in http://forums.qhimm.com/index.php?topic=16679.0:

Quote
2. Damage formulas for Kamikaze and Darkside abilities

Kamikaze:
Code: [Select]
CPU Disasm
Address   Hex dump               Command                                      Comments
00492D6C  |.  8B81 2C7BD201      MOV EAX,DWORD PTR DS:[ECX+1D27B2C]           ; EAX = caster max HP
00492D72  |.  8D0480             LEA EAX,[EAX*4+EAX]                          ; EAX = EAX*5
Some sites say that the damage multiplier is 6 for kamikaze, so either it's been changed or the code for critting is elsewhere.

Darkside:
Code: [Select]
CPU Disasm
Address   Hex dump               Command                                      Comments
00491069  |> \8D3476             LEA ESI,[ESI*2+ESI]                          ; ESI = ESI * 3 - darkside multiplier

Quote
3. Angel Wing damage multiplier

Code: [Select]
CPU Disasm
Address   Hex dump               Command                                      Comments
00491085  |.  8D34B6             LEA ESI,[ESI*4+ESI]                          ; ESI = ESI * 5 - angel wing multiplier

Quote
6. Changing character base stats and starting level, also giving Squall, Zell and Quistis some default spells at the beginning of the game

Most of the stuff looks like it's loaded from init.out in main.fi, I'd imagine it's a similar format to sections of: http://wiki.qhimm.com/view/FF8/GameSaveFormat

Looks like init.out starts at the GF data and the character data starts at 0x440 of init.out - the level looks like it's determined by the XP (level = 1+(XP/1000)) and the magic + stats you can change too - note the stats listed in the save file are bonuses and are added to the usual level calculated stat.
The HP stat for each of the characters is set to 9999 and then capped to the max after loading - the max being calculated from the level-calculated HP + the HP bonus (I think it's HP bonus rather than the max HP that the wiki says).
The parameters for the formula that controls the level curve for each character are located in section 7 of kernel.bin, see http://forums.qhimm.com/index.php?topic=16923.msg240609#msg240609
EDIT: does anyone know where the calculation of crisis level for limit breaks is? - it'd be pretty useful for some of my investigation stuff
EDIT1: Callisto helped me find the function, it's at 0x4941F0
« Last Edit: 2016-05-04 23:44:27 by JWP »

Maki

  • Lana Del Rey
  • Insane poster
  • *
  • Posts: 431
  • Karma: 76
  • Final Fantasy VIII reverse team
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #27 on: 2016-05-05 20:40:04 »
So much data... Nice! <3 I need to update database and wiki with this. JWP, do you have wiki account?

@topic:
I investigated the harata.cnf file. I came up with another theory.

Battle module has rich debug data code written, but it's destroyed/unusable

From the beginning: I traced all the way harata.cnf is loaded (the myserious file that looks like debug loader for battle programmer). Keep note battle is one module that has no DebugOutput strings. I didn't really find anything, it's loaded and that's kinda all. It's loaded by SmPcRead function before main menu shows along with font and namedic.bin and two hardcoded paths to Y:/work/battle/batwave.dat (Programmer loaded file independently to jumpover archive process). I tried to find the file in memory and see if there are any refferences, however I found the words that were made to recognize harata.cnf file like: 'start' 'manual' 'bdprint' 'pinch' and extreme amount of others that even harata.cnf consist. They ARE used, bad thing is their code is never used (I mean no function calls it- only jump, but it's impossible case due to battle state system overwriting update function for checking states).

Example for displaying/outputing/writing to log file (most probably) for showing current EncounterID from Scene.out:

47FCEE pushes this mysterious "SCENE " (Many of them further have the %s when pushing)
47FCF8 This is missing from final game. Did the programmer delete the "StreamToLogFile" like function? This looks like the programmer commented out the function before final release
47FD11 Puts EncounterID (01CFF8B8 ; unsigned __int16 EncounterID if you want :) )
I don't understand this though:
push    1F800000h (and I think we all won't understand, since the function is null now.... )

The scheme for above example is like this:
mov     edx, dword ptr EncounterID                -Get Encounter ID to edx (Encounter ID is uint16 !!! )
and     edx, 0FFFFh - Force EDX to be 16 bit by doing the bitwise operation
push    edx - Push EncounterID
push    1F800000h - Push mysterious something??
call    nullsub_7 - deleted output function

It's complete mess.
Any other data (that is used for writing log file) is obtained from dword_1CFFA28, the only instruction that writes it is 0047F0F9.
There's whole function for this. The function that consists jump to this unused section is: 0047EEF0
Well... the problem is it's fired, when battle state is == 4 (the only case when it's equal to 4 is BattleResultScreen). Simple? Nope. When the game goes into BattleState==4 it's automatically stopped, and the parent function reroutes the state to BattleResult screen, therefore the code for state 4 is never fired (it's no more called by update function). That way the code remain 'unused'. There's a way to force battleState = 4 by memory hacking, but the game crashes (After unlocking user from endless loop at 0047EF09) (the script also loads btitle.ovl file [this file doesn't exist])

Getting out of the loop and stepping over (to avoid instant crash, but to see all the logic) we find those variables are beign written for the first time (It's unknown size byte array):
unk_1CFFB98; unk_1D13C10; unk_1CFFBF4; unk_1D13C6C
We again get into endless loop at 0047F073 (the conditional jump to beginning of function without again testing variables makes it impossible case, till something bad happens). Let's break out of it. Finally we get into core unused sub-routine that directly manages the unused battle debug data.
The software crashes at 'mov     ds:1F800000h, edx' because 1F800000h is unallocated.

Sad...

I found this function in FFVIII Demo version. It's decompilable there. There's pseudocode fragment:
Code: [Select]
v1F800000 = dword_CD2868 + 16496;
  v1F800004 = 17;
  v1F800006 = EncounterID;
  v1F800008 = 1;
  v1F80000C = &off_5FD158;
  nullsub_7(528482304, (unsigned __int16)EncounterID_0, 0, 0);
  v1F800000 = dword_CD2868 + 16496;
  v1F800004 = 3;
  v1F800006 = 00CFAACA + 1;
  v1F800008 = v45;
  v1F80000C = aTime;
  nullsub_7(528482304, 0, 0, 0);
  v1F800000 = dword_CD2868 + 16496;
  v1F800004 = 17;
  v1F800006 = 00CFAACA + 1;
  v1F800008 = 1;
  v1F80000C = &off_5FD164;
  nullsub_7(528482304, dword_CD1944, 0, 0);
  v1F800000 = dword_CD2868 + 16496;
  v1F800004 = 3;
  v1F800006 = 00CFAACA + 2;
  v1F800008 = v46;
  v1F80000C = aRate100;
  nullsub_7(528482304, 0, 0, 0);

Looks now like it outputs Encounter data (only for this fragment)
Does anyone understand the 1F800000 phenomenon?
« Last Edit: 2016-05-05 21:39:36 by MaKiPL »

paul

  • Crazy poster
  • *
  • Posts: 180
  • Karma: 33
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #28 on: 2016-05-06 05:55:03 »
This is all artifacts of lack of whole program optimization by old (<=MSVC 6.0 C/C++) compilers. They would have used a #define to control the debug stuff, but because the compiler couldn't prove if some functions where used or not indirectly it had to leave them in.

The 1F800000 stuff is writing directly to a PSX memory address, probably another function that should have been compiled out.

JWP

  • Crazy poster
  • *
  • Posts: 149
  • Karma: 19
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #29 on: 2016-05-06 22:00:23 »
JWP, do you have wiki account?
I'm afraid not. I'm not really sure how I would go about getting one.
I've updated the list of magic IDs to include all the function pointers (690 of them!), I'll probably add the texture names at some point if I get around to it.

EDIT: They don't all load .TIM files as I had originally thought, for example:
Code: [Select]
0x0006--0x00B58050--0x00B58080--Leviathan Summon (Tsunami)loads "mag005_b.00" and "mag005_b.01"

Code: [Select]
0x008D--0x0061DE50--0x0061DE70--Renzokuken - 5 Hitsloads "mag140-158-159-258-331-332.tim"

Code: [Select]
0x0074--0x006C3560--0x006C3550--Quezacotl Summon (Thunder Storm)loads "mag115.tim"

it seems that to find any associated files, you subtract 1 from the magic ID, convert it to decimal and any files with that number in it tend to get loaded.
It looks like those 2 functions are all that are needed, since I made magic ID 0xE0 turn into the cure/fire animations and assigned that ID to the fire spell.
« Last Edit: 2016-05-07 09:01:38 by JWP »

paul

  • Crazy poster
  • *
  • Posts: 180
  • Karma: 33
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #30 on: 2016-05-07 09:55:05 »
I wish you guys would use github pages to document stuff, then anyone can download a copy or fork it and edit it.

Maki

  • Lana Del Rey
  • Insane poster
  • *
  • Posts: 431
  • Karma: 76
  • Final Fantasy VIII reverse team
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #31 on: 2016-05-07 10:14:41 »
I'm not very familiar with GitHub. How could github help us collect research? As a big notepad or? So far I know github is used to store source code and as source control. Paul, please lend some tips. :)

paul

  • Crazy poster
  • *
  • Posts: 180
  • Karma: 33
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #32 on: 2016-05-07 11:01:44 »
Github pages uses a git repo for displaying a website, and since its a git repo you can fork/edit/push back changes. Instead of source code text its wiki page text :P

Maki

  • Lana Del Rey
  • Insane poster
  • *
  • Posts: 431
  • Karma: 76
  • Final Fantasy VIII reverse team
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #33 on: 2016-05-07 11:36:15 »
"
One... Two... Three...
Teach me how to GitHub" - kid to Tidus, Zanarkand 1000 years ago

A notes page that everyone can edit sounds terrific. I'll make sure to create one today.
:)

JWP

  • Crazy poster
  • *
  • Posts: 149
  • Karma: 19
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #34 on: 2016-05-08 11:17:18 »
Let me know if you do and I'll add a bunch of stuff to it :). I've just finished documenting all of the character section of kernel.bin in this post

Maki

  • Lana Del Rey
  • Insane poster
  • *
  • Posts: 431
  • Karma: 76
  • Final Fantasy VIII reverse team
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #35 on: 2016-05-08 12:29:21 »
Looks like this:
https://github.com/MaKiPL/FF8_Reverse

I'm confused what now. xD
I'll copy all my notes of files there.

EDIT: I'm really... really confused...
EDIT2: Ahh... The wiki page: https://github.com/MaKiPL/FF8_Reverse/wiki
EDIT3: No, really. Maybe I'm just stupid, but I don't understand how github is better than this thread and wiki here.
« Last Edit: 2016-05-08 12:37:28 by MaKiPL »

halkun

  • Global moderator
  • No life
  • *
  • Posts: 2109
  • Karma: 20
  • NicoNico :)
    • View Profile
    • Q-Gears Homepage
Re: [FF8] Engine reverse engineering
« Reply #36 on: 2016-05-08 16:45:22 »
Because I pretty much control the wiki, and there hasn't been a lit of demand for people to gain access. If you PM me your username, email address, and password. I can add you to the qhimm wiki

paul

  • Crazy poster
  • *
  • Posts: 180
  • Karma: 33
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #37 on: 2016-05-09 07:03:28 »
Looks like this:
https://github.com/MaKiPL/FF8_Reverse

I'm confused what now. xD
I'll copy all my notes of files there.

EDIT: I'm really... really confused...
EDIT2: Ahh... The wiki page: https://github.com/MaKiPL/FF8_Reverse/wiki
EDIT3: No, really. Maybe I'm just stupid, but I don't understand how github is better than this thread and wiki here.

You need to make a branch called gh-pages and set it as the default branch name. For example https://github.com/munificent/wren/tree/gh-pages

Then your URL is something like username.repo.github.io

Edit: The github wiki isn't the same as github pages, its a normal wiki that sucks since you have to manually add people like on qhimm wiki and no one and easily grab a whole backup of the wiki.

gh-pages docs: https://help.github.com/articles/what-are-github-pages/
« Last Edit: 2016-05-09 07:05:22 by paul »

volvania

  • Fast newbie
  • *
  • Posts: 48
  • Karma: 0
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #38 on: 2016-05-20 10:53:20 »
i dont really understand what i just read but i think you could increase the damage cap and also change music lets say for example make seifer battle music same as edea battle music that would be epic we already know how to change damage and levels and abilities of enemy and gfs and magic damage and affect on enemies and junction ,we only need to change the stupid easy enemy ai (just to add more twist and strategy in battle -seymour and two guado guards- seifer and two elite guards taking damage from seifer and healing him would be nice we know that biggs heal wedge in the communication tower but the condition is hard to met its easly done if we know how to read enemy ai, lastly if you guys can put all this info into a working program like ifrit or mystre save editor and make modifing easier . all the power to you one day we can make the perfect ff8 remake just like ff7 .   :lol:

Kefka

  • Crazy poster
  • *
  • Posts: 115
  • Karma: 4
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #39 on: 2016-05-23 16:50:03 »
Amazing work JWP! Just tried this myself and it seems to work perfectly. By making these changes, it is very simple to adjust Vit 0 resistance for each enemy individually, especially in conjunction with Ifrit enemy editor. Almost like a dream becoming true.. Can finally get back to work now. Thanks a ton! :-D

Wait, how are you changing Vit0 resistance with Ifrit? I just looked again, and Ifrit doesn't have the Vit0 status byte to edit (the last one available is the byte for the unused Percent spell). So even by using JWPs code changes in the .exe, you'd still have to edit the Vit0 byte in each enemy file with a hex editor, or am I missing something obvious here? Sorry if this is a dumb question.

JWP

  • Crazy poster
  • *
  • Posts: 149
  • Karma: 19
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #40 on: 2016-05-23 19:20:38 »
The patch I made makes the unused byte in the .dat files (which is marked as percent in ifrit) change vit0, there is no vit0 byte normally.
He's just changing percent byte in Ifrit after applying the patch I made, which edits vit0.
« Last Edit: 2016-05-23 19:28:01 by JWP »

Callisto

  • Fast newbie
  • *
  • Posts: 39
  • Karma: 1
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #41 on: 2016-05-23 19:30:16 »
No, there is no need for manually changing that byte with a hex editor. After applying JWP's code changes to the .exe, you can use Ifrit and adjust that byte to your liking for Vit 0 resistance. For example, choose 155 for complete immunity, then start up the game and try inflicting Vit 0 on that enemy. It should no longer work.

Kefka

  • Crazy poster
  • *
  • Posts: 115
  • Karma: 4
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #42 on: 2016-05-24 14:27:42 »
Ah, ok, I got it now. Thanks to the both of you.

JWP

  • Crazy poster
  • *
  • Posts: 149
  • Karma: 19
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #43 on: 2016-05-24 22:04:26 »
So I had another look at the GFs today... it seems that there are a bunch more functions than I had anticipated =/.

Take for example Shiva...
the main function that I've put in this post is 0x005C0D50.
a bit later in that function, function pointers are pushed as arg2 to the function 0x508360 (it's called twice) - the function pointers that are pushed are 0x5C7F50 and 0x5C0F30 - I'm assuming the function 0x508360 stages those 2 functions to be called every frame.
both of these functions appear to be called every frame (I guess it controls the animation) since there's a switch at 0x5C0FC5 that switches on a number that increases every time the function is called.
This switch appears to control things that happen during the animation - I'm assuming that it's switching on the frame number (e.g. loading extra files - the function 0x508480 loads files from this array)
The arg to both of these functions is a pointer to some sort of struct, of which the DWORD at offset 0x0C is the current frame number.

Since the constants in the function 0x5C0F30 appear to be for Shiva - (for example the file loaded at 0x5C0FFE uses the constant 0x21F for MAG184_D.DAT), I'm assuming that there are functions like this for all the GFs and possibly magic too.
« Last Edit: 2016-05-24 22:35:28 by JWP »

Kefka

  • Crazy poster
  • *
  • Posts: 115
  • Karma: 4
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #44 on: 2016-05-27 14:29:56 »
@JWP: one more question about your Vit0 patch, I tried it with the german version but it didn't work, and I realised that the offsets in the German FF8.exe are all exactly 48 bytes further down than in the English version that you posted earlier.

While your offsets are:

0x8BEE8:
0x8BF95:
0x8C014:
0x8C131:

Mine are:

0x8BF18:
0x8BFC5:
0x8C044:
0x8C161:

I suppose due to this the patch can't be applied 1:1 because certain jumps in your patch might lead to wrong places. Do you by any chance know what I would need to change in order to make it work for my version?

JWP

  • Crazy poster
  • *
  • Posts: 149
  • Karma: 19
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #45 on: 2016-05-27 18:18:13 »
Should work with the new addresses as long as they are offset by the same amount and the code around the area is actually the same because all the jumps are encoded with relative addresses.
Although they appear to be absolute addresses in the assembly code, at the machine code level they are encoded as relative jumps.
EB and E9 opcodes (which are used for the jumps in the patch) both use relative addresses, see here.

If patching the new addresses doesn't work, could you give me a disassembly of the area in question?
« Last Edit: 2016-05-27 19:11:46 by JWP »

Kefka

  • Crazy poster
  • *
  • Posts: 115
  • Karma: 4
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #46 on: 2016-05-27 20:52:54 »
If patching the new addresses doesn't work, could you give me a disassembly of the area in question?

Sure, I've sent you a PM. Thanks.

JWP

  • Crazy poster
  • *
  • Posts: 149
  • Karma: 19
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #47 on: 2016-05-27 21:18:21 »
Ah thanks, I think I see what's wrong now.
The offset of the battle data in memory is different so the offset 0x1D27BC0 in the code no longer works. It looks like the battle data is offset 0x1A80 higher in memory in the German version.
I think the full patch for the German version should be:

Code: [Select]
from: 0x8BF18: B90A 0A0A 0A
to:   0x8BF18: E9A8 0000 00

from: 0x8BFC5: 9090 9090 9090 9090
to:   0x8BFC5: 8A87 7B01 0000 EB77

from: 0x8C044: 9090 9090 9090 9090 9090 90
to:   0x8C044: 8886 4096 D201 E912 0100 00

from: 0x8C161: 9090 9090 9090 9090 9090
to:   0x8C161: B90A 0A0A 0AE9 B2FD FFFF

let me know if it works :)
« Last Edit: 2016-05-27 21:27:58 by JWP »

Kefka

  • Crazy poster
  • *
  • Posts: 115
  • Karma: 4
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #48 on: 2016-05-28 06:52:36 »
Thanks a ton, it worked now! I just tried it in the Cerberus battle and casted about 20-30 Meltdowns on him without inflicting the status once!

JWP

  • Crazy poster
  • *
  • Posts: 149
  • Karma: 19
    • View Profile
Re: [FF8] Engine reverse engineering
« Reply #49 on: 2016-06-02 19:02:09 »
I'm guessing this is known but I can't find a list anywhere.
I found an array of function pointers starting at 0xB8DE94 which appear to be related to all the field opcodes.

Here's a full dump of addresses corresponding to these opcodes:
Code: [Select]
000 0x0051C160
001 0x0051C4B0
002 0x0051C4D0
003 0x0051C4F0
004 0x0051C530
005 0x0051C570
006 0x0051C5C0
007 0x0051C990
008 0x0051CAB0
009 0x0051CC70
00A 0x0051CAF0
00B 0x0051CCA0
00C 0x0051CB30
00D 0x0051CCD0
00E 0x0051CB70
00F 0x0051CD00
010 0x0051CBB0
011 0x0051CBF0
012 0x0051CC30
013 0x0051CD30
014 0x0051CD60
015 0x0051CED0
016 0x0051D060
017 0x0051D1F0
018 0x0051D360
019 0x0051D530
01A 0x0051DD80
01B 0x0051D700
01C 0x0051D710
01D 0x0051D720
01E 0x0051D780
01F 0x0051D7F0
020 0x0051D830
021 0x0051FF00
022 0x00520460
023 0x005256A0
024 0x00525740
025 0x00525900
026 0x00525A30
027 0x00525B60
028 0x00525CA0
029 0x00521A20
02A 0x00521AC0
02B 0x0051D8F0
02C 0x0051D9B0
02D 0x00526570
02E 0x00526620
02F 0x005266D0
030 0x00526810
031 0x00526890
032 0x00526910
033 0x00526990
034 0x005269E0
035 0x00526A30
036 0x00526AB0
037 0x0051DA00
038 0x00521B70
039 0x0051DC30
03A 0x0051DCE0
03B 0x0051DD00
03C 0x0051D870
03D 0x005233E0
03E 0x00523410
03F 0x00523640
040 0x00523880
041 0x00523AD0
042 0x00523C20
043 0x00525800
044 0x005264D0
045 0x005264F0
046 0x00528E40
047 0x00528F20
048 0x00529900
049 0x00528D40
04A 0x00529520
04B 0x00529A20
04C 0x00529B60
04D 0x0051DDA0
04E 0x0051DE90
04F 0x0051F390
050 0x0051F4F0
051 0x0051E0E0
052 0x00526E60
053 0x00526E90
054 0x00526F30
055 0x00526F70
056 0x0051F520
057 0x0051EBB0
058 0x0051EBD0
059 0x0051EBF0
05A 0x0051EC10
05B 0x0051ED80
05C 0x00521C30
05D 0x00521CB0
05E 0x00521CC0
05F 0x00528E10
060 0x0051EAD0
061 0x0051EB40
062 0x0051EDD0
063 0x0051EE00
064 0x00529020
065 0x005291E0
066 0x0051EE30
067 0x0051ED40
068 0x0051ED60
069 0x00523270
06A 0x005232E0
06B 0x00523300
06C 0x00523330
06D 0x0051DA50
06E 0x0051DAA0
06F 0x005296C0
070 0x0051EEB0
071 0x00520C40
072 0x00520C90
073 0x00520CF0
074 0x00520D50
075 0x00520D90
076 0x00520DF0
077 0x00520F50
078 0x00524030
079 0x005241A0
07A 0x00524310
07B 0x00524490
07C 0x00524550
07D 0x00524600
07E 0x0051D8B0
07F 0x00520E50
080 0x00520E90
081 0x00520EF0
082 0x00527250
083 0x00527320
084 0x005273F0
085 0x005274C0
086 0x0051E160
087 0x0051E270
088 0x0051E350
089 0x0051E5D0
08A 0x0051E400
08B 0x0051E5E0
08C 0x0051E670
08D 0x0051E710
08E 0x0051E7D0
08F 0x00527590
090 0x00527690
091 0x00527790
092 0x005278A0
093 0x00524BA0
094 0x005299F0
095 0x00520570
096 0x00520640
097 0x005206E0
098 0x00520780
099 0x005207A0
09A 0x00520800
09B 0x00520850
09C 0x005216E0
09D 0x00521730
09E 0x005217F0
09F 0x00526C30
0A0 0x00526C80
0A1 0x0051F620
0A2 0x0051F670
0A3 0x0051F2C0
0A4 0x00521710
0A5 0x005283B0
0A6 0x00528490
0A7 0x00528CA0
0A8 0x00520BA0
0A9 0x00520C20
0AA 0x00528D10
0AB 0x0051EC30
0AC 0x0051ECF0
0AD 0x00523370
0AE 0x00523380
0AF 0x00526E30
0B0 0x00526D30
0B1 0x00523D70
0B2 0x00523ED0
0B3 0x00526CD0
0B4 0x0051F7F0
0B5 0x0051F730
0B6 0x00528CE0
0B7 0x00526B00
0B8 0x00526B80
0B9 0x005217B0
0BA 0x0051FA50
0BB 0x0051FB00
0BC 0x0051FEA0
0BD 0x0051FDE0
0BE 0x0051F680
0BF 0x0051FBD0
0C0 0x0051FC70
0C1 0x0051FCD0
0C2 0x0051FD40
0C3 0x0051FFA0
0C4 0x0051FFD0
0C5 0x00520010
0C6 0x00520040
0C7 0x00520080
0C8 0x005200C0
0C9 0x00520110
0CA 0x00520150
0CB 0x0051F700
0CC 0x00523230
0CD 0x005201A0
0CE 0x00520880
0CF 0x0051F690
0D0 0x005208B0
0D1 0x00520AD0
0D2 0x005209A0
0D3 0x00520FA0
0D4 0x00521010
0D5 0x00521090
0D6 0x00521110
0D7 0x00521170
0D8 0x005211F0
0D9 0x00521270
0DA 0x005212D0
0DB 0x00521350
0DC 0x00520F60
0DD 0x005213D0
0DE 0x00521D00
0DF 0x00521CF0
0E0 0x005204E0
0E1 0x00520500
0E2 0x00520520
0E3 0x00520550
0E4 0x00521960
0E5 0x0051DD60
0E6 0x00525090
0E7 0x005264A0
0E8 0x0051D8D0
0E9 0x00528570
0EA 0x00528670
0EB 0x00528770
0EC 0x005288A0
0ED 0x005289D0
0EE 0x00528B20
0EF 0x00528C70
0F0 0x00525DE0
0F1 0x00525E70
0F2 0x00525F30
0F3 0x00525FF0
0F4 0x005260A0
0F5 0x00526150
0F6 0x00526180
0F7 0x00526170
0F8 0x00521CD0
0F9 0x00521CE0
0FA 0x00526190
0FB 0x0051D910
0FC 0x0051D960
0FD 0x00527B90
0FE 0x00527C30
0FF 0x00527D30
100 0x00528300
101 0x00527E40
102 0x0051DB90
103 0x0051DBC0
104 0x0051DBF0
105 0x0051DC10
106 0x00528D80
107 0x00528350
108 0x00527AF0
109 0x0051EFB0
10A 0x005218E0
10B 0x00523350
10C 0x00520490
10D 0x00521820
10E 0x00527F10
10F 0x00527FA0
110 0x00528030
111 0x00528130
112 0x00528240
113 0x00527AD0
114 0x0051F0C0
115 0x0051F140
116 0x00529380
117 0x00520B00
118 0x005261C0
119 0x005261A0
11A 0x00521D10
11B 0x00521D40
11C 0x005216B0
11D 0x0051E640
11E 0x00521D60
11F 0x00523390
120 0x005214C0
121 0x00521530
122 0x005215F0
123 0x00524840
124 0x00524810
125 0x00522380
126 0x00523180
127 0x005231C0
128 0x0051EA10
129 0x00521DA0
12A 0x005220A0
12B 0x00524620
12C 0x005246F0
12D 0x0051F1F0
12E 0x00522190
12F 0x005221B0
130 0x00522280
131 0x0051EA50
132 0x0051F600
133 0x00523200
134 0x00521930
135 0x0051F9A0
136 0x005224D0
137 0x00522770
138 0x00522230
139 0x0051E0B0
13A 0x005225A0
13B 0x00529BF0
13C 0x00529C40
13D 0x00529E70
13E 0x00521460
13F 0x0051EF70
140 0x0051FC20
141 0x0051F880
142 0x0051DD40
143 0x0051DD20
144 0x0051F900
145 0x005220B0
146 0x00522110
147 0x00522150
148 0x005247E0
149 0x0051FDC0
14A 0x00526390
14B 0x005263F0
14C 0x0051DAF0
14D 0x0051DB40
14E 0x005230E0
14F 0x00523110
150 0x0051FBA0
151 0x005223C0
152 0x00522420
153 0x00522480
154 0x00523140
155 0x00523030
156 0x00522070
157 0x0051E910
158 0x0051E990
159 0x0051E9C0
15A 0x00522010
15B 0x00526240
15C 0x00526280
15D 0x005262C0
15E 0x00522500
15F 0x00522540
160 0x00522570
161 0x005222D0
162 0x0051E8A0
163 0x0051E860
164 0x0051F5B0
165 0x00529D40
166 0x00529EB0
167 0x00529EF0
168 0x00529F70
169 0x00526210
16A 0x00522350
16B 0x00526FD0
16C 0x00527070
16D 0x00527110
16E 0x005271B0
16F 0x0051FC40
170 0x005279B0
171 0x00527AB0
172 0x00520200
173 0x00520230
174 0x005258D0
175 0x005230A0
176 0x005219F0
177 0x00522030
178 0x00320000
179 0x00960064

I've not actually tested them yet though :P
Not sure if they're numbered correctly since there are some jumps in the opcode numbers.
« Last Edit: 2016-06-02 19:11:54 by JWP »