76
Scripting and Reverse Engineering / Re: Enemy attacks don't respect range (FFVII). Can we change this?
« on: 2014-02-04 20:15:12 »
Perhaps I could look there first. If I can actually open the file property - I've managed to decompress it, and I've opened it in LemASM, but I can't match the functions in the reversing doc with the assembler I'm looking at. Am I supposed to parse the binary in little- or big-endian format?
Edit: Aha! Apparently, I needed to do a wordswap as well as a byteswap. I didn't know the words were read in reverse. Now the disassembled file looks a lot like Akari's reverse. For the sake of any future reader, I found that the point 0x32530 in the decompressed file matches up with line 26789 in the reverse, or 0x800D2530 in the PSX memory map. It's a distinctive jump opcode in a sea of NOPs.
Edit 2: I think I've found the assembler in question. It's at 0x0000DB00 in the decompressed BATTLE.X:
I found this by looking at the excellent Q-Gears resources, under the 'reverse' folder. The function http://sourceforge.net/p/q-gears/code/ci/default/tree/reversing/ffvii/ffvii_battle/damage/damage_lower_calculation_function.cpp showed that the branch for applying back row modifiers was straight after the main X1 damage equation, just as in the PC version. Then, using http://sourceforge.net/p/q-gears/code/ci/default/tree/reversing/ffvii/ffvii_battle/ffvii_battle.asm as my guide, I found that the function for lower_01 damage resides at 0x8000D944.
From there... well, I cheated. I don't know MIPS assembler, but I do know what registers to look out for (the Q-Gears source helpfully uses them as local variables) and I know what the branch statements look like. I also know about some hardcoded numbers that I could look out for whilst eyeballing the source. From there, I could find a patch I could examine a lot closer.
Of course, none of this may have worked - I've yet to try actually modifying the source, and I could be totally wrong. I can't wait to give it a go though!
Edit3: Huzzah! It works! Setting the 20 to 50 re-enables the check. Only I now just realized... I don't want to re-enable the check; enemy attacks are already tested for range. I want to disable row effects for long range enemy attacks. Changing DB00 causes long range attacks to take quarter damage, because now row effects are being considered twice.
I feel so thick. I'm going to pick this up again tomorrow with a clearer head; I'm far too tired to continue tonight.
The odd thing is, when I look at http://sourceforge.net/p/q-gears/code/ci/default/tree/reversing/ffvii/ffvii_battle/damage/damage_lower_calculation_function.cpp#l46, I can see that the enemy back row status is considered, and that the user back row status is considered, but no checks around the long-rangedness of the attack. I need to find out where this is being handled.
Edit: Aha! Apparently, I needed to do a wordswap as well as a byteswap. I didn't know the words were read in reverse. Now the disassembled file looks a lot like Akari's reverse. For the sake of any future reader, I found that the point 0x32530 in the decompressed file matches up with line 26789 in the reverse, or 0x800D2530 in the PSX memory map. It's a distinctive jump opcode in a sea of NOPs.
Edit 2: I think I've found the assembler in question. It's at 0x0000DB00 in the decompressed BATTLE.X:
Code: [Select]
30 42 00 20 ANDI V0, V0, $0020
10 40 00 03 BEQ V0, R0, $0000DB14
I found this by looking at the excellent Q-Gears resources, under the 'reverse' folder. The function http://sourceforge.net/p/q-gears/code/ci/default/tree/reversing/ffvii/ffvii_battle/damage/damage_lower_calculation_function.cpp showed that the branch for applying back row modifiers was straight after the main X1 damage equation, just as in the PC version. Then, using http://sourceforge.net/p/q-gears/code/ci/default/tree/reversing/ffvii/ffvii_battle/ffvii_battle.asm as my guide, I found that the function for lower_01 damage resides at 0x8000D944.
From there... well, I cheated. I don't know MIPS assembler, but I do know what registers to look out for (the Q-Gears source helpfully uses them as local variables) and I know what the branch statements look like. I also know about some hardcoded numbers that I could look out for whilst eyeballing the source. From there, I could find a patch I could examine a lot closer.
Of course, none of this may have worked - I've yet to try actually modifying the source, and I could be totally wrong. I can't wait to give it a go though!
Edit3: Huzzah! It works! Setting the 20 to 50 re-enables the check. Only I now just realized... I don't want to re-enable the check; enemy attacks are already tested for range. I want to disable row effects for long range enemy attacks. Changing DB00 causes long range attacks to take quarter damage, because now row effects are being considered twice.
I feel so thick. I'm going to pick this up again tomorrow with a clearer head; I'm far too tired to continue tonight.
The odd thing is, when I look at http://sourceforge.net/p/q-gears/code/ci/default/tree/reversing/ffvii/ffvii_battle/damage/damage_lower_calculation_function.cpp#l46, I can see that the enemy back row status is considered, and that the user back row status is considered, but no checks around the long-rangedness of the attack. I need to find out where this is being handled.