Having admittedly not had much time to look into it yet, my notes are currently:
Using WM0.BSZ (normal, non-underwater world map):
The first eight bytes of each (LZS) decompressed BSZ is always the same [at offset 0x00000000]:
02 00 00 00 08 00 00 00
Next, there's a 4-byte offset to something (I believe this offset is relative, as in 0x8 +
offset) [at offset 0x00000008]:
5C 47 00 00
Next, there's a 4-byte 80-type offset (to something in memory) [at offset 0x00000010]:
18 A6 14 80
Next, there's a 4-byte offset (I believe this offset is relative as well), the value of which is always 0x4 less than the value of the offset at 0x00000008. In this case [at offset 0x00000014]:
54 47 00 00
Next, there are 4 bytes of Unknown, which is 0x0F16FF01 in every case except the WM1 map, in which case it's 0x1119FF01 [at offset 0x00000018]:
01 FF 16 0F
...followed by another 4 bytes of Unknown, which is 0x0000000A in every case except the WM1 map, in which case it's 0x0000000B [at offset 0x0000001C]:
0A 00 00 00
Then 16 bytes of Unknown, which is always the same [at offset 0x00000020]:
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02
Then 4 bytes of Unknown, which is 0x02380058 in every case except the WM1 map, in which case it's 0x02840064 [at offset 0x00000030]:
58 00 84 02
Then a 4-byte 80-type offset, which is 0x8014A63C in every case except the snowstorm map, in which case it's 0x8016D1A4 [at offset 0x00000034]:
3C A6 14 80
Then there are 4 bytes of unknown, always 0x00000000 [at offset 0x00000038]:
00 00 00 00
Note: After this, WM3 (snowstorm map) diverges significantly from the pattern of the rest of the world map model files, although later it seems to return to the norm. For now, I'll leave out mention of WM3/snowstorm after this point.
There are then 8 bytes of Unknown; this value is always the same [at offset 0x0000003C]:
00 00 FF 00 00 00 00 01
In save state, the 'file' starts at 153625 (?) and ends at 1583DC. Perhaps it starts earlier, but has some header info, etc...
Hmm, according to tales-cless.org's 'The PSX Doc', "RAM begins in an (uncompressed) ePSXe savestate at offset 1BA."
Interesting: Even if I enable a cheat code, and save a state, if I look up the value at the location it should be at (even taking into account the 0x1BA shift), it isn't.
Rainsphere’s code:
___________________________________
Main Character Graphic Modifier
8010A5A4
?
"This code will change the main character on the world map into the selected items. All of these codes, unless otherwise specified, work on the 3rd Disc...testing into the others discs will be done."
0204 = White Chocobo
0200 = Cloud
0201 = Tifa
0202 = Cid
030A = Diamond Weapon (1st Disc only)
020D = Highwind
0307 = Propeller
030F = Phoenix
________________________________________
This turns out to be at the following address in the savestate (tested and verified):
1135C9
...the difference between the code and the savestate address being 0x9025.
15902D - Cloud super shiny pelvis thing. Strangely, only the first two addresses seem to be found here (even when I change all values and continue to match them in the same place)...although it could be that subsequent addresses are resisting value change or something.
Still, nothing in this area seems to exist in WM0.BSZ. Using the same difference that was successful in the graphic mod above didn't yield anything either.