Qhimm.com Forums
Miscellaneous Forums => Scripting and Reverse Engineering => Topic started by: Synergy Blades on 2006-09-13 00:40:28
-
A call to those with opcode knowledge (halkun, Qhimm, whoever else...)
I've done well over 100 opcodes on the Wiki, and with halkun's maths/assignment write-up and Qhimm's RET/REQs I reckon we've got about 90 opcodes left to nail down. I'm not putting anything up with any "unknown" in, and in my view the remainder range from "I'm not 100% sure what this argument does" to "what on Earth is this supposed to do?" I've also done my best to categorise them, though there's still a few left to do.
With a bit of concerted effort I think we can get the unknowns down to below the 20 mark. If you know any that haven't been done then feel free to put them in. I'll write up a few musings I've had with some opcodes I can't 100% document and post it here to see if anyone has any ideas.
Good idea/bad idea?
-
21 TUTOR (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/21_TUTOR): Opens the menu and should play a tutorial, but on fields without tutorials, lets you control the menu; quit the menu, and it comes straight back up again. The field file contains the PSX version of the tutorial ("insert a memory card into either slot..."), whereas the flevel LGP contains the PC version. So how are these accessed/referenced?
22 BTMD2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/22_BTMD2): Battle mode: no victory celebration, celebration without music, etc.
28 KAWAI (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/28_KAWAI): Why after each KAWAI is there often a WAIT(1) followed by KAWAI(subop, 1)?
31 IFKEYON (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/31_IFKEYON)/32 IFKEYOFF (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/32_IFKEYOFF): How do these differ from IFKEY if IFKEY lets you check whether a key is down or up?
3C HMPMAX1 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/3C_HMPMAX1)/3D HMPMAX2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/3D_HMPMAX2): How do these differ from HMPMAX3? [EDIT] They may not be - HMPMAX1 and HMPMAX2 are not used in the game
5C DMTRA (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/5C_DMTRA)/5D CMTRA (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/5D_CMTRA): Can't figure out argument usage for DMTRA (only used in blackbg4 anyway); CMTRA not used in the game which doesn't help figuring out args
5E SHAKE (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/5E_SHAKE): (bank, bank, ?, ?, y-direction?, force, regularity): shakes the screen, but direction specification seems hit and miss
5F NOP (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/5F_NOP): Can we assume this is as per a CPU NOP? Just a no-op command?
6D IDLCK (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/6D_IDLCK): In some fields, come under an entity called "IDlock"; what IDs are they locking?
6E LSTMP (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/6E_LSTMP): Often used before accessing a 16-bit value from the temporary bank, such as; LSTMP(6,20) followed by if(<6>[20] == 100)...
7E TLKON (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/7E_TLKON): Talk on? Doesn't seem to stop dialogs
7F RDMSD (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/7F_RDMSD): Random seed?
9D SETX (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/9D_SETX)/9E GETX (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/9E_GETX)/9F SEARCHX (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/9F_SEARCHX): All unused in the game, and a hefty argument list
B2 MSPED (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/B2_MSPED): Second argument is..?
B4 TURNGEN (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/B4_TURNGEN): Generate turn? Differs from other turn opcodes how?
C6 SLIDR (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/C6_SLIDR): Seems to combine with LADER
D4 SIN (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/D4_SIN)/D5 COS (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/D5_COS): kuro_4 > mover > Script 0 only. (Bank[4]/Bank[4],Bank[4]/Bank[4],?S16,?S16,?S16,?U8)
DA AKAO2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/DA_AKAO2)/F2 AKAO (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/F2_AKAO): Even though they're seperate opcodes do they have different functions within each? Does one/either play sound and if so how does it differ to SOUND?
So those are a few that have been bugging me the most, as for the remainder I might stick up the understood arguments for each remaining opcode on its talk page if there's any demand for them. If you want to take a look at each you might find this little tool helpful as it dumps the locations of each opcode for the entire field set.
Unused opcodes (assuming the two fields my script analyser falls over on don't contain these):
3C HMPMAX1 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/3C_HMPMAX1)
3D HMPMAX2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/3D_HMPMAX2)
55 WROW (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/55_WROW)
56 GWCOL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/56_GWCOL) (but 57 SWCOL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/57_SWCOL) *is* used)
5D CMTRA (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/5D_CMTRA)
5F NOP (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/5F_NOP)
61 SCRLO (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/61_SCRLO) (on/off? but doesn't seem to stop scrolls)
94 XOR2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/94_XOR2)
9D SETX (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/9D_SETX)
9E GETX (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/9E_GETX)
9F SEARCHX (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/9F_SEARCHX)
D7 SLDR2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/D7_SLDR2)
D9 PMJMP2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/D9_PMJMP2)
EB STPLS (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/EB_STPLS)
EC LDPLS (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/EC_LDPLS)
EE RTPAL2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/EE_RTPAL2)
F4 MUSVM (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/F4_MUSVM)
F7 CHMPH (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/F7_CMPMH)
While I'm at it: check "yougan" (or whichever one it is where Yuffie steals your materia). I absolutely cannot find any script that removes the party's materia, and changing a gateway to replay that field and going through the field again removes only a certain subset of materia. Any ideas?
+++EDIT: Halkun+++
CRAP! I edited and accidently deleted this post. I lost the links. Sorry. I'm lame ;_;
EDIT: You are lame. Good thing I'm around. :P /Q
-
31 IFKEYON (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/31 IFKEYON)/32 IFKEYOFF (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/32 IFKEYOFF): How do these differ from IFKEY if IFKEY lets you check whether a key is down or up?
Umm, sorry, IFKEY might be wrong, the center argument was always zero. I made the assumption that as buttins only have two states, the center argument has to be what you are checking for.
It might just be "0"
-
A few suggestions/observations to investigate:
BTMD2 - Battle Mode 2; used in the Nibelheim memory sequence with Sephiroth and Cloud. No item or XP after battle.
LSTMP- List Map; Used to find values in Temporary Memory?
IDLCK- ID lock; Used to temporarily "seal" commands out of operation; for instance, bad spins in Battle Arena, 'Berzerk' status, 'toad' status, etc. Operations identified with the ID lock become disabled. (?)
RDMSD- I think your correct that this is Random Seed. Probably used early in the program to generate semi-random numbers. Usually uses the format of RNDSD nnnn with the value being applied to a specific randomising algorithim.
MSPED- Message Speed?
TURNGEN- Used to RET to the top of the Turn OP? Or to start Turn?
SLIDR- Slider; Combined with LADER, provides x,y coordinates for some function (?)
-
Hmm...
0x5F - NOPIt just increases the IP by 1, it's one byte in size, no arguments - so it's equivalent to CPU NOP :P
Cloned opcodes:
0x3C - HMPMAX1
0x3D - HMPMAX2
0x3F - HMPMAX3Are the same
0xA3 - ANIME1
0xAE - ANIME2Are the same
0xAF - ANIM!1
0xBA - ANIM!2Are the same
0xB0 - CANIM1
0xBB - CANIM2Are the same
0xB1 - CANM!1
0xBC - CANM!2Are the same
0xD4 - SIN
0xD5 - COS
OP SID1 SID2 ANGLE MUL BASE RES
OP - byte 0xD4 / 0xD5
SID1 - source/dest byte for ANGLE and MUL
SID2 - source/dest byte for BASE and RES
ANGLE - WORD
MUL - WORD
BASE - WORD
RES - WORD
size - 0x0A
res = (trunc(sin(angle*2*pi/4096)*4096)*mul+base)/4096Angle is 4096 based because it's not precise enough to store it in radians. Edit: Oh, and it is probably used to calculate the position of clock's hand in Ancient's Temple :)
Rest will come here as I check them :P
Edit:
0x7F - RDMSD
OP SEED
OP - byte 0x7F
SEED - BYTEseed = (byte)(seed<<0x04 + 1)
Which is then used when picking the value from an array or "random" numbers.
position = (byte)(position+seed)
random = random_numbers[position]
When changing the seed, you change the leap which is done before each pick up.
-
No, the ANIM opcodes aren't the same, they're as I've documented them. The ones with 1 after them *do* pause script execution; the ones with 2 after them *do not* pause script execution. In addition, the ANIM! ones leave the object in the last frame of animation; the ANIME ones return the object to its initial pose.
RW_66:
BTMD2: Yep, but it's figuring out the arguments and combinations that's the difficult part.
LSTMP: Is it possible to do an if on the 16-bit temp bank without using LSTMP?
MSPED: Yep, not sure what the second arg is though.
SLIDR: I edited one SLIDR that is present on the *up* portion of the ladder. Saw no changes, except when I tried to come back down the ladder, Cloud got stuck at the top.
-
No, the ANIM opcodes aren't the same
Didn't say that.
-
You said:
0xA3 - ANIME1
0xAE - ANIME2
Are the same
0xAF - ANIM!1
0xBA - ANIM!2
Are the same
..they're not :-P
-
They may work different, but they share the same .text area.
Edit:
I take that back. Now I see that they fork inside the function.
-
SLIDR I think is used in the entrance to Gaia's cave where you have to fall to certain locations. I believe the minigame on the tracks between Costa Del Sol and North Coral <sp> it's used as well (falling minigame?)
Anyhow SLIDR is used where an uncontroled movement happens to the PC.
If for example you change the 'leap onto a ladder' function where I think SLIDR is used you'll end up possibly not being able to move.
of course this is shear speculation .. but you could check those areas for meaningful information on the SLIDR opcode.
if someone could would they insert the information for PMVIE? I'm curious how movies are setup to run from the script as I had a sudden suspicion the other day :D
Cyb
-
Yuffie's materia theft is carried out by a dedicated game "mode" (accessed through MENU, I believe). Looks like a lot of specific can't-quite-do-in-script actions were hard-coded in this manner.
-
Ah, I mistook that for MENU E (save game menu). I did notice several MENUs in the debug rooms with values >0xF that didn't seem to do anything in other fields so I guess they'll all need to be looked at.
-
DMTRA and CMTRA don't work as someone might think they should. Can't find Qhimm's post about it so:
DMTRA was supposed to Delete Materia. The thing is, it doesn't :)
Arguments:
OP SID1 SID2 B1 B2 B3 B4 UNKNOWN
OP - 0x5C
SID1 - source/dest byte for B1 and B2
SID2 - source/dest byte for B3 and B4
B1 - BYTE
B2 - BYTE
B3 - BYTE
B4 - BYTE
UNKNOWN - BYTEB4*16777216 + B3*65536 + B2*256 + B1 is probably a materia with a certain amount of AP (an unknown byte might be a mode, like 1-delete every single materia that matches, 2-ignore APs etc.)
CMTRA was supposed to Check if Materia is in party's possesion (maybe even count them). The checking function isn't implemented (PC version).
Arguments:
OP SID1 SID2 SID3 B1 B2 B3 B4 UNKNOWN RES
OP - 0x5D
SID1 - source/dest byte for B1 and B2
SID2 - source/dest byte for B3 and B4
SID3 - source/dest byte for RES
B1 - BYTE
B2 - BYTE
B3 - BYTE
B4 - BYTE
UNKNOWN - BYTE
RES - BYTEResult is always 0.
-
Could the arguments be similar to adding materia? So
DMTRA (00,00,14,FF,FF,FF,63)
Would be deleting all materia with a materia type of 14, and AP 63FFFFFF?
-
Yes, that would be the most logic way :P There is also that unknown byte... You said that it uses it in blackbg4. What are the arguments there? Is it accessible?
Edit:
AP is 24bit, that unknown byte isn't used (I might be wrong again).
-
[EDIT] Oops - wrong, forgot AP was a three-byte value in SMTRA
Well if that is the way it works, then there's no unknown byte, as it'd be:
DMTRA(B/B,B/B,Type,AP,AP,AP,AP)
Then CMTRA would be the same, just with the address to store the result on the end.
Here's the call from blackbg4 > gss > Script 2:
DLITM(0,8F,0,63)
DMTRA(0,0,14,FF,FF,FF,63)
DMTRA(0,0,14,0,0,0,63)
I did test it on another field where it didn't delete anything but forgot that it'd probably need the required AP to be deleted, so I might test it again later. Not entirely sure how to Wiki this pair, I'll probably just add a note on the page about it not being implemented on the PC version.
[EDIT2] Could it be quantity to delete, as per the ITM opcodes? 0x63 = 99.
-
[EDIT2] Could it be quantity to delete, as per the ITM opcodes? 0x63 = 99.
Most likely.
AP == 0 for newborn materia and FFFFFF for mastered one, 14 is W-Summon Materia, 8F is Ultima Weapon. Sounds fishy :P
-
It's the debug room, it does all sorts of odd things. :-D From there it goes on to change fields with JUMPMAP so I think it's just a check for the field programmers.
-
It's the debug room, it does all sorts of odd things. :-D
:roll:
Another update:
IFKEY
IFKEYON
IFKEYOFF
Usage is similar:
OP KEY JUMP
OP - 0x30/0x31/0x32
KEY - WORD
JUMP - BYTEKEY is a key to check for (surprise!), JUMP is a number of bytes to skip if the condition isn't true (IP+3+JUMP).
IFKEY is used to check if the button is being pressed.
IFKEYON is used to check if the button has been pressed (was OFF, became ON)
IFKEYOFF is used to check if the button has been released (was ON, became OFF)
What I don't understand is:
KEY & 0x0200
It's a condition which determines which key status to use (2 statuses for each mode - being pressed/was pressed/was released - they are always the same :/). 0x0200 is probably not a valid key... Help?
-
Here are some extra pointers (can't post details because I'm at work):
MPPAL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/DF_MPPAL), STPAL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/E5_STPAL), LDPAL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/E6_LDPAL), CPPAL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/E7_CPPAL), RTPAL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/E8_RTPAL), ADPAL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/E9_ADPAL), MPPAL2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/EA_MPPAL2), STPLS (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/EB_STPLS), LDPLS (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/EC_LDPLS), CPPAL2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/ED_CPPAL2), RTPAL2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/EE_RTPAL2) and ADPAL2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/EF_ADPAL2) involve the manipulation of field palettes. Palettes are manipulated in the script, then uploaded to and downloaded from VRAM as needed (palettes are only "active" when in VRAM, of course). MultiPlyPALette, CoPyPALette, STorePALette, LoaDPALette, RoTatePALette, ADdPALette etc., with the "duplicate" commands working on either the entire palette or a subset of it. Arguments to the various commands are a bit inconsistent, but the last argument typically denotes the size of the palette (0x0F or 0xFF, signifying 16- or 256-sized palettes). The MPPAL opcodes use fixed-point values for the R, G and B coefficients.
BGROL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/E2_BGROL), BGROL2 (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/E3_BGROL2): Compound BGON/BGOFF commands. "Rolls" the set of visible blocks for a certain background, e.g. "if block i is visible, make block i+1 visible next frame". Useful when a number of blocks work together as an animation.
GWCOL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/56_GWCOL) and SWCOL (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/57_SWCOL): GetWindowCOLors and SetWindowCOLors, respectively. Does exactly what you'd think, setting the colors of the four corners of your regular gradient-adorned message window.
Oh, and RDMSD (http://wiki.qhimm.com/FF7/Field/Script/Opcodes/7F_RDMSD) is very correctly RanDoMSeeD. The lower 4 bits of the argument is used as a seed for the internal 8-bit random number generator.
That's all I can remember off the top of my head, you did a mighty good job at filling out the wiki page for most of the opcodes I know already. Might fill in more details later if there are questions.
-
Could someone with the reverse-engineered opcodes confirm/disprove that SWCOL doesn't work (at least on the PC version)? The args seem straight-forward but my windows still come out the standard blue colour even after setting every corner to black.
[EDIT] Nor does it work in blackbg2, the only place it's used.
-
It changes wrong variables for it to work as described.
-
GWCOL works just fine, mind. RDMSD has two arguments; is this so it can operate as (Bank,Add) as well as just specifying (0,VAL)? (Something I can't check by observation :-))
-
Yeah, RDMSD has a standard source/dest byte, so you can feed it with byte from anywhere. GWCOL works fine, because it reads the mirrored (kind of) variables. Writing to mirrored variables doesn't change much.
-
if someone could would they insert the information for PMVIE? I'm curious how movies are setup to run from the script as I had a sudden suspicion the other day :D
Done a partial list for that opcode.
-
Looking over the Wiki I thought over a few more things:
2D BGSCR- BackGround Scroll
69 MPDSP- Map Display (probably toggles the mini-map w/radar)
D4 SIN - Trigometric SINE function
D5 COS - Trigometric COSINE function
2E WCLS- Window Clear List (?) Basically, "wipes" the current window being displayed
-
Many of them have fairly obvious sounding uses from their shorthand form, it's trying to figure out exactly how to call them and the argument list that's the issue.
-
Sin (and Cos) description in my first post in this thread is most likely correct :P
-
Your argument list is too long, but I'll take another look.
-
Done a partial list for that opcode.
Thanks it seems to use an index value which means it references an internal table. Now to play, FIND THAT TABLE on the disk! Knowing the order of the parts of the table helps a LOT :D
Cyb
-
I got full array of indexes/names somewhere, just need to type it. Starting from FMV number 0x14, it makes a difference on which disc you are.
-
Is that PC or PS1? I'm examining the ISO for the PS1 myself.
Cyb
-
Is that PC or PS1?
It's for PC version. Hope it helps.
Indexes/names for all discs:
00 - fship2.cam
01 - fship2n.cam
02 - dropego.cam
03 - dropein.cam
04 - uropein.cam
05 - uropego.cam
06 - gold2.cam
07 - gold3.cam
08 - gold4.cam
09 - gold6.cam
0A - gold5.cam
0B - boogup.cam
0C - boogdown.cam
0D - junaird.cam
0E - junairu.cam
0F - junelein.cam
10 - junelego.cam
11 - junin_in.cam
12 - junin_go.cam
13 - moriya.cam
For 1st disc only:
14 - mkup.cam
15 - northmk.cam
16 - mk8.cam
17 - ontrain.cam
18 - mainplr.cam
19 - smk.cam
1A - southmk.cam
1B - plrexp.cam
1C - fallpl.cam
1D - monitor.cam
1E - bikeget.cam
1F - mtnvl.cam
20 - mtnvl2.cam
21 - brgnvl.cam
22 - nvlmk.cam
23 - nivlsfs.cam
24 - nivljnr.cam
25 - junon.cam
26 - hiwind0.cam
27 - mtcrl.cam
28 - gold1.cam
29 - biskdead.cam
2A - boogdemo.cam
2B - boogstar.cam
2C - setogake.cam
2D - rcktfail.cam
2E - jairofly.cam
2F - jairofal.cam
30 - gold7_2.cam
31 - gold7_2.cam
32 - earithdd.cam
33 - funeral.cam
34 - car_1209.cam
35 - opening.cam
2nd disc only:
14 - greatpit.cam
15 - cscene1.cam
16 - cscene2.cam
17 - cscene3.cam
18 - biglight.cam
19 - metosky.cam
1A - weapon0.cam
1B - weapon1.cam
1C - weapon2.cam
1D - weapon3.cam
1E - weapon4.cam
1F - weapon5.cam
20 - hwindfly.cam
21 - phoenix.cam
22 - nrcrl.cam
23 - nrcrlb.cam
24 - dumcrush.cam
25 - zmind11.cam
26 - zmind21.cam
27 - zmind31.cam
28 - gelnica.cam
29 - rcketoff.cam
2A - white2.cam
2B - junsea.cam
2C - rckthit.cam
2D - rckthit2.cam
2E - meteofix.cam
2F - canonon.cam
30 - feelwin0.cam
31 - feelwin1.cam
32 - canonht1.cam
33 - canonht2.cam
34 - canonh3f.cam
35 - parashot.cam
36 - hwindjet.cam
37 - canonhit0.cam
38 - wh2e2.cam
39 - loslake1.cam
3A - lslmv.cam
3B - canonh1p.cam
3C - canon.cam
3rd disc only:
14 - last4_2.cam
15 - last4_3.cam
16 - last4_4.cam
17 - lastmap.cam
18 - lastflor.cam
19 - ending1.cam
1A - ending3.cam
1B - fcar.cam
1C - white2.cam
1D - ending2.cam
I'd be surprised if there were no typos.
-
Now I see why you can swap media in the PS1 version and the game will play different movies. Hmmmm this could be quite difficult to find on the PS1 version. Grrr. Time to play 'find the table'.
Cyb