401
Scripting and Reverse Engineering / Re: [FF8] Engine reverse engineering
« on: 2016-03-07 15:47:35 »
Okay. I have my notes:
FF8 2000 PC - Game memory start as:
General Kernel.dll LoadFile:
Real Sound ID for sound.dat ("The second uint32 in FMT file"):
Unknown notes [Those I'm unsure if are correct] I have saved:
*STEAM!
How to know which battle file FF8 wants to load? Engine uses "Battle stage file list" which is array of 1117 elements. Full content is available here:
http://wiki.qhimm.com/view/FF8/Engine_const/BattleFiles
I though I had the buffer location, but it turns out I did not save it.
EDIT: GameShark codes to real memory location in ePSXe 1.9.2 calculation guide: http://wiki.qhimm.com/view/User:MaKiPL#GameShark_codes_to_PC_version_-_memory_calculation
EDIT2:
Just checked with IDA. For Sound initialization, there's a function at .TEXT:00469990
It takes five parameters, four unsigned and one signed. Probably IDs and etc. Needs more testing in game and maybe I'm close to force sound play whenever I want to.
BTW> Just saying, you can force game to load other file by changing the register to load modified ID of battle list array. Though it's problematic.
Here is the function to play sound in C (cleared and one named function):
http://pastebin.com/m1AzrVpb
46FED0 takes one parameter only.
I wish we could someday create full IDA database containing named variables and function names, so instead of sub_ABCDEF you will see PlaySound or something...
FF8 2000 PC - Game memory start as:
Code: [Select]
FF8.exe = 0x400000
General Kernel.dll LoadFile:
Code: [Select]
FF8.exe + 0x15d323 [0x55d323] //Used for opening data files (battle.fs, field.fs etc.)
FF8.exe + 0x15d27b [0x55d27b] //As above
You can test function return addresses to track the process of given file initialization.Real Sound ID for sound.dat ("The second uint32 in FMT file"):
Code: [Select]
Sound ID: FF8.exe+69D9D - lea ebp,[edi+edx] //Check EAX or ECX or ESI register for sound ID (I don't remember, but normally EAX is used for math, so probably ECX or ESI)
Audio.dat register: FF8.EXE+69DDB [00469DDB] //Check ECX register for Sound ID
Code: [Select]
FF8.exe+69E26 - E8 B5450000 - call FF8.exe+6E3E0 - // play sound call [already loaded] ?
Unknown notes [Those I'm unsure if are correct] I have saved:
*STEAM!
Code: [Select]
FF8_EN.exe+10DB40(50DB40) - mov ecx,[esp+04] = GENERIC LEVEL loader. HOLDS ALREADY CAMERA POINTER! [The relative address where the battle stage file starts, as the BS file has no pointers in header]
00482610 - z array Battle load file //Whatever I meant writing this?
How to know which battle file FF8 wants to load? Engine uses "Battle stage file list" which is array of 1117 elements. Full content is available here:
http://wiki.qhimm.com/view/FF8/Engine_const/BattleFiles
I though I had the buffer location, but it turns out I did not save it.
EDIT: GameShark codes to real memory location in ePSXe 1.9.2 calculation guide: http://wiki.qhimm.com/view/User:MaKiPL#GameShark_codes_to_PC_version_-_memory_calculation
EDIT2:
Just checked with IDA. For Sound initialization, there's a function at .TEXT:00469990
It takes five parameters, four unsigned and one signed. Probably IDs and etc. Needs more testing in game and maybe I'm close to force sound play whenever I want to.
BTW> Just saying, you can force game to load other file by changing the register to load modified ID of battle list array. Though it's problematic.
Here is the function to play sound in C (cleared and one named function):
http://pastebin.com/m1AzrVpb
46FED0 takes one parameter only.
I wish we could someday create full IDA database containing named variables and function names, so instead of sub_ABCDEF you will see PlaySound or something...