Messages

126

Scripting and Reverse Engineering / Re: How do I edit damage formulas? [FFVIII]

« on: 2016-06-11 16:14:14 »

It's likely that will be in the abilities sections and it will be added if we find the data for it.
The draw command seems to be an odd case though as it's not in any of the ability lists for GFs (according to alexfilth's research), so I'm not sure about that particular case.

127

Scripting and Reverse Engineering / Re: How do I edit damage formulas? [FFVIII]

« on: 2016-06-10 22:56:58 »

Probably a while, 4/30 data sections have all of the known data done (Magic, GFs, GF Attacks and Weapons), two more have a GUI and alexfilth is working on the code for the Character section atm (with pretty graphs).
If you want to test it, you can use Visual Studio Community to compile it from the git repo.

128

Scripting and Reverse Engineering / Re: How do I edit damage formulas? [FFVIII]

« on: 2016-06-10 12:52:24 »

We now know what every kernel.bin section does , see this post.
I'm currently working with alexfilth to get Doomtrain steaming ahead - also a big thanks to Maki for the bulk of the coding groundwork.

129

Gameplay / Re: FF8 Steam EN Save anywhere hex and Switch anytime hex

« on: 2016-06-07 01:17:00 »

As in I edited the values in my post.
The "offset" is the location in the EXE in this case, see here for more information on the word usage.

130

Gameplay / Re: FF8 Steam EN Save anywhere hex and Switch anytime hex

« on: 2016-06-07 00:53:34 »

Odd, works for me, although I did update the offsets again.

131

Gameplay / Re: FF8 Steam EN Save anywhere hex and Switch anytime hex

« on: 2016-06-07 00:26:25 »

Ah, you might have to change:
0x1221D5 from 740F to 9090 - makes enable/disable save point function always enable save points
0x1222AD from 740F to 9090 - makes enable/disable switch menu function always enable the switch menu
0x12BE2E from E2FC to CA03 - screen loading activates save + switch menu instead of disabling them

otherwise it gets reset on screen change and it won't activate unless you touch a savepoint at least once. What exactly was wrong with the numbers?
Also if you want a nice hex editor, I'd suggest: HxD.

EDIT: added cleaner solution

132

Gameplay / Re: FF8 Steam EN Save anywhere hex and Switch anytime hex

« on: 2016-06-06 23:55:20 »

I'd suggest keeping a backup anyway but you'd still be able to load older saves with the modified exe.
The issue is that save files can get into a state that the game isn't expecting, so be prepared to save to different files a lot.

133

Gameplay / Re: FF8 Steam EN Save anywhere hex and Switch anytime hex

« on: 2016-06-06 23:45:36 »

As in certain game scripts depend on some characters being in your party and saving in some places might screw the event scripting up when reloading.
Basically it could lead to some very erratic behavior e.g. being unable to do anything and needing to reload.

134

Gameplay / Re: FF8 Steam EN Save anywhere hex and Switch anytime hex

« on: 2016-06-06 22:29:13 »

try this:
[EDIT: see a few posts below for solution]

Although I'm not sure if the game will like you doing that sort of stuff

135

Gameplay / Re: FF8 (Steam) Limit Breaks always active

« on: 2016-06-05 10:00:42 »

I could provide you with details, with 2 caveats:
1.) it would involve patching the memory using something like CheatEngine or hex editing the EXE
2.) There are 4 crisis levels (which determine the power of the limit break, see this link), always setting this to a fixed level is easy, varying it is harder

Also which language of the game do you have?

for FF8_EN.exe (the Steam English version), there are at least 2 ways to do this, one would be to patch the EXE at 0x9431E or the memory of the process at 0x49431E:

Code: [Select]

from: 7D04
to:   EB09
That will permanently set the crisis level to 4.

The second way to do this (the way the Steam version does it) is patching memory address 0x1CFF838 to 0x01 - which sets the crisis level to always be 1 - you could set it to anywhere up to 4.

However, the addresses would be different for other versions of the game.

136

Scripting and Reverse Engineering / Re: [FF8] Engine reverse engineering

« on: 2016-06-04 15:55:56 »

I've been looking through and documenting some of the field stuff.
It seems like all of the field functions are called with 2 arguments:
arg1 = pointer to current entity data
arg2 = function argument

Background entities are 436 bytes each.
Door entities are 396 bytes each.
line entities are 416 bytes each.
Other entities are 612 bytes each.

the entity data looks something like the following (note there are gaps between the entries since I'm still filling the data in and there are probably some differences between entities):
There is probably a base class with all the stack and instruction stuff that the entities have in common and then it's extended differently depending on the entity type.

Code: [Select]

struct entity {
DWORD stack[];
DWORD templist[8]; //+0x140
WORD instruction_pointer; //+0x176
BYTE stack_count; //+0x184
DWORD x_pos; //+0x190
DWORD y_pos; //+0x194
DWORD z_pos; //+0x198
WORD push_radius; //+0x1F6
WORD talk_radius; //+0x1F8
WORD triangle_id; //+0x1FA
WORD move_speed; //+0x1FE
WORD move_speed; //+0x200
WORD anime_speed; //+0x208
WORD model; //+0x218
BYTE angle; //+0x241
BYTE push_disabled; //+0x249
BYTE talk_disabled; //+0x24B
BYTE through_enabled; //+0x24C
BYTE base_anim_id; //+24F
BYTE base_anim_first; //+250
BYTE base_anim_last; //+251
BYTE ladder_anim_id; //+252
BYTE ladder_anim_first; //+253
BYTE ladder_anim_last; //+254
}

for init, the scripts are executed in this order (called in func 0x52C650):
1. background
2. door
3. line
4. other

during each frame, they are executed in this order (called in func 0x529FF0):
1. other
2. line
3. door
4. background

notable memory variables (offsets are for English Steam version):

Code: [Select]

BYTE 0x1D9CDF1 current_entity
DWORD 0x1D9CF88 entity_ptr_other
DWORD 0x1D9CF8C entity_ptr_background
DWORD 0x1D9CF90 entity_ptr_door
BYTE 0x1D9D019 entity_count_other
BYTE 0x1D9D0E0 entity_count_line
BYTE 0x1D9D0E1 entity_count_door
BYTE 0x1D9D0E8 entity_count_background
DWORD 0x1D9D0F0 entity_ptr_line


137

Scripting and Reverse Engineering / Re: [FF8] Editing the contents of Draw points

« on: 2016-06-02 23:54:41 »

it looks like the UNKNOWN16 (0x175) function (as listed in Deling) binds the draw point to a variable since changing the parameter can cause the draw point to be restocked.
Generally this is the same as the draw point id but I'm not sure if this is always the case.
Aha! Found the variable in the save data, each draw point has 2 bits allocated to it starting at savegame + 0xDD4 (field vars 100-164) - 64 bytes are allocated to this.
0 = fully stocked
1 = partially stocked
2 = not stocked (white swirls - restocks)
3 = not stocked (blue swirls - doesn't restock)

the required byte is found by indexing by (drawpoint_id - 1)/4 and then it's shifted by the remainder*2 and then masked by anding with 3.

EDIT: I thought I was incorrect at first but it seems like the last draw point id seen (with 1 already subtracted) is stored in memory at savegame + 0xE52 (field var 226 - note this is what function UNKNOWN16 - 0x175 writes to) and the function for pulling the draw point data from memory (0x52D150) keeps getting called even if there isn't a draw point in the current scene - I mean aside from the restocking code.
I guess this also means that you can only have 1 draw point on a scene.

More on the draw point mechanics:
every 10,240 (0x2800) steps (the counter is reset after this - it's stored as a WORD in savegame + 0xE14 - field var 164), all of the draw points are checked to see if they need to be restocked.
For each draw point, a random number between 0 and 32,767 is calculated, this is then anded with 1 (x86 TEST opcode) to give a 50% chance that the draw point is restocked.
It also seems like there are 2 stages of stocking (the counter is decremented every time it is stocked to a minimum of zero) - might be that 0 means it's more likely to give more magic.

EDIT2:
the amount you can draw is determined as follows - for field draw points:
((rand[0-255] + 128)*draw_var)/512 + 1
draw_var is 20 if the MSB of the draw byte in the array is 1 (i.e. AND 0x80) and 10 otherwise, this is then halved if the draw point is partially stocked.
this gives a range of:
6-15 - fully stocked with bit set
3-8 - if partially stocked with bit set or fully stocked with bit not set
2-4 - if partially stocked with bit not set

For the world map:
((rand[0-255] + 128)*draw_var)/512 + 1
draw_var is 6 if the MSB of the draw byte in the array is 1 (i.e. AND 0x80) and 2 otherwise.
this gives a range of:
2-5 - with bit set
1-2 - with bit not set

138

Scripting and Reverse Engineering / Re: [FF8] Engine reverse engineering

« on: 2016-06-02 20:53:14 »

Ah yeah, there are a bunch of function pointers for other stuff before the offset I listed, I was wondering what those were for.

139

Scripting and Reverse Engineering / Re: [FF8] Engine reverse engineering

« on: 2016-06-02 20:36:47 »

Odd, I tested the following:

Code: [Select]

137 0x00522770 DRAWPOINT
and

Code: [Select]

155 0x00523030 SETDRAWPOINT
and they both seemed correct to me, what version of the game are you using? - it might be offset slightly in your version.
Easiest way to find the function pointer address list is to put a breakpoint on the DRAWPOINT opcode function, then exec until return and look at the line that called it, should be something like CALL DWORD PTR DS:[EAX*4+some_address]
some_address is where the function pointer list starts.

The only time the opcodes get weird is near all the unknown stuff but I think that might be the wiki since they're all called with opcode*4+function_pointer_base.
For instance, UNKNOWN16 in Deling (0x175) is labelled UNKNOWN10 on the wiki.

140

Scripting and Reverse Engineering / Re: [FF8] Engine reverse engineering

« on: 2016-06-02 19:02:09 »

I'm guessing this is known but I can't find a list anywhere.
I found an array of function pointers starting at 0xB8DE94 which appear to be related to all the field opcodes.

Here's a full dump of addresses corresponding to these opcodes:

Code: [Select]

000 0x0051C160
001 0x0051C4B0
002 0x0051C4D0
003 0x0051C4F0
004 0x0051C530
005 0x0051C570
006 0x0051C5C0
007 0x0051C990
008 0x0051CAB0
009 0x0051CC70
00A 0x0051CAF0
00B 0x0051CCA0
00C 0x0051CB30
00D 0x0051CCD0
00E 0x0051CB70
00F 0x0051CD00
010 0x0051CBB0
011 0x0051CBF0
012 0x0051CC30
013 0x0051CD30
014 0x0051CD60
015 0x0051CED0
016 0x0051D060
017 0x0051D1F0
018 0x0051D360
019 0x0051D530
01A 0x0051DD80
01B 0x0051D700
01C 0x0051D710
01D 0x0051D720
01E 0x0051D780
01F 0x0051D7F0
020 0x0051D830
021 0x0051FF00
022 0x00520460
023 0x005256A0
024 0x00525740
025 0x00525900
026 0x00525A30
027 0x00525B60
028 0x00525CA0
029 0x00521A20
02A 0x00521AC0
02B 0x0051D8F0
02C 0x0051D9B0
02D 0x00526570
02E 0x00526620
02F 0x005266D0
030 0x00526810
031 0x00526890
032 0x00526910
033 0x00526990
034 0x005269E0
035 0x00526A30
036 0x00526AB0
037 0x0051DA00
038 0x00521B70
039 0x0051DC30
03A 0x0051DCE0
03B 0x0051DD00
03C 0x0051D870
03D 0x005233E0
03E 0x00523410
03F 0x00523640
040 0x00523880
041 0x00523AD0
042 0x00523C20
043 0x00525800
044 0x005264D0
045 0x005264F0
046 0x00528E40
047 0x00528F20
048 0x00529900
049 0x00528D40
04A 0x00529520
04B 0x00529A20
04C 0x00529B60
04D 0x0051DDA0
04E 0x0051DE90
04F 0x0051F390
050 0x0051F4F0
051 0x0051E0E0
052 0x00526E60
053 0x00526E90
054 0x00526F30
055 0x00526F70
056 0x0051F520
057 0x0051EBB0
058 0x0051EBD0
059 0x0051EBF0
05A 0x0051EC10
05B 0x0051ED80
05C 0x00521C30
05D 0x00521CB0
05E 0x00521CC0
05F 0x00528E10
060 0x0051EAD0
061 0x0051EB40
062 0x0051EDD0
063 0x0051EE00
064 0x00529020
065 0x005291E0
066 0x0051EE30
067 0x0051ED40
068 0x0051ED60
069 0x00523270
06A 0x005232E0
06B 0x00523300
06C 0x00523330
06D 0x0051DA50
06E 0x0051DAA0
06F 0x005296C0
070 0x0051EEB0
071 0x00520C40
072 0x00520C90
073 0x00520CF0
074 0x00520D50
075 0x00520D90
076 0x00520DF0
077 0x00520F50
078 0x00524030
079 0x005241A0
07A 0x00524310
07B 0x00524490
07C 0x00524550
07D 0x00524600
07E 0x0051D8B0
07F 0x00520E50
080 0x00520E90
081 0x00520EF0
082 0x00527250
083 0x00527320
084 0x005273F0
085 0x005274C0
086 0x0051E160
087 0x0051E270
088 0x0051E350
089 0x0051E5D0
08A 0x0051E400
08B 0x0051E5E0
08C 0x0051E670
08D 0x0051E710
08E 0x0051E7D0
08F 0x00527590
090 0x00527690
091 0x00527790
092 0x005278A0
093 0x00524BA0
094 0x005299F0
095 0x00520570
096 0x00520640
097 0x005206E0
098 0x00520780
099 0x005207A0
09A 0x00520800
09B 0x00520850
09C 0x005216E0
09D 0x00521730
09E 0x005217F0
09F 0x00526C30
0A0 0x00526C80
0A1 0x0051F620
0A2 0x0051F670
0A3 0x0051F2C0
0A4 0x00521710
0A5 0x005283B0
0A6 0x00528490
0A7 0x00528CA0
0A8 0x00520BA0
0A9 0x00520C20
0AA 0x00528D10
0AB 0x0051EC30
0AC 0x0051ECF0
0AD 0x00523370
0AE 0x00523380
0AF 0x00526E30
0B0 0x00526D30
0B1 0x00523D70
0B2 0x00523ED0
0B3 0x00526CD0
0B4 0x0051F7F0
0B5 0x0051F730
0B6 0x00528CE0
0B7 0x00526B00
0B8 0x00526B80
0B9 0x005217B0
0BA 0x0051FA50
0BB 0x0051FB00
0BC 0x0051FEA0
0BD 0x0051FDE0
0BE 0x0051F680
0BF 0x0051FBD0
0C0 0x0051FC70
0C1 0x0051FCD0
0C2 0x0051FD40
0C3 0x0051FFA0
0C4 0x0051FFD0
0C5 0x00520010
0C6 0x00520040
0C7 0x00520080
0C8 0x005200C0
0C9 0x00520110
0CA 0x00520150
0CB 0x0051F700
0CC 0x00523230
0CD 0x005201A0
0CE 0x00520880
0CF 0x0051F690
0D0 0x005208B0
0D1 0x00520AD0
0D2 0x005209A0
0D3 0x00520FA0
0D4 0x00521010
0D5 0x00521090
0D6 0x00521110
0D7 0x00521170
0D8 0x005211F0
0D9 0x00521270
0DA 0x005212D0
0DB 0x00521350
0DC 0x00520F60
0DD 0x005213D0
0DE 0x00521D00
0DF 0x00521CF0
0E0 0x005204E0
0E1 0x00520500
0E2 0x00520520
0E3 0x00520550
0E4 0x00521960
0E5 0x0051DD60
0E6 0x00525090
0E7 0x005264A0
0E8 0x0051D8D0
0E9 0x00528570
0EA 0x00528670
0EB 0x00528770
0EC 0x005288A0
0ED 0x005289D0
0EE 0x00528B20
0EF 0x00528C70
0F0 0x00525DE0
0F1 0x00525E70
0F2 0x00525F30
0F3 0x00525FF0
0F4 0x005260A0
0F5 0x00526150
0F6 0x00526180
0F7 0x00526170
0F8 0x00521CD0
0F9 0x00521CE0
0FA 0x00526190
0FB 0x0051D910
0FC 0x0051D960
0FD 0x00527B90
0FE 0x00527C30
0FF 0x00527D30
100 0x00528300
101 0x00527E40
102 0x0051DB90
103 0x0051DBC0
104 0x0051DBF0
105 0x0051DC10
106 0x00528D80
107 0x00528350
108 0x00527AF0
109 0x0051EFB0
10A 0x005218E0
10B 0x00523350
10C 0x00520490
10D 0x00521820
10E 0x00527F10
10F 0x00527FA0
110 0x00528030
111 0x00528130
112 0x00528240
113 0x00527AD0
114 0x0051F0C0
115 0x0051F140
116 0x00529380
117 0x00520B00
118 0x005261C0
119 0x005261A0
11A 0x00521D10
11B 0x00521D40
11C 0x005216B0
11D 0x0051E640
11E 0x00521D60
11F 0x00523390
120 0x005214C0
121 0x00521530
122 0x005215F0
123 0x00524840
124 0x00524810
125 0x00522380
126 0x00523180
127 0x005231C0
128 0x0051EA10
129 0x00521DA0
12A 0x005220A0
12B 0x00524620
12C 0x005246F0
12D 0x0051F1F0
12E 0x00522190
12F 0x005221B0
130 0x00522280
131 0x0051EA50
132 0x0051F600
133 0x00523200
134 0x00521930
135 0x0051F9A0
136 0x005224D0
137 0x00522770
138 0x00522230
139 0x0051E0B0
13A 0x005225A0
13B 0x00529BF0
13C 0x00529C40
13D 0x00529E70
13E 0x00521460
13F 0x0051EF70
140 0x0051FC20
141 0x0051F880
142 0x0051DD40
143 0x0051DD20
144 0x0051F900
145 0x005220B0
146 0x00522110
147 0x00522150
148 0x005247E0
149 0x0051FDC0
14A 0x00526390
14B 0x005263F0
14C 0x0051DAF0
14D 0x0051DB40
14E 0x005230E0
14F 0x00523110
150 0x0051FBA0
151 0x005223C0
152 0x00522420
153 0x00522480
154 0x00523140
155 0x00523030
156 0x00522070
157 0x0051E910
158 0x0051E990
159 0x0051E9C0
15A 0x00522010
15B 0x00526240
15C 0x00526280
15D 0x005262C0
15E 0x00522500
15F 0x00522540
160 0x00522570
161 0x005222D0
162 0x0051E8A0
163 0x0051E860
164 0x0051F5B0
165 0x00529D40
166 0x00529EB0
167 0x00529EF0
168 0x00529F70
169 0x00526210
16A 0x00522350
16B 0x00526FD0
16C 0x00527070
16D 0x00527110
16E 0x005271B0
16F 0x0051FC40
170 0x005279B0
171 0x00527AB0
172 0x00520200
173 0x00520230
174 0x005258D0
175 0x005230A0
176 0x005219F0
177 0x00522030
178 0x00320000
179 0x00960064

I've not actually tested them yet though
Not sure if they're numbered correctly since there are some jumps in the opcode numbers.

141

Scripting and Reverse Engineering / Re: [FF8] Editing the contents of Draw points

« on: 2016-06-02 12:52:19 »

Here's a list of the draw points as they are in the array using the descriptions from here
I might finish the descriptions off later.

Code: [Select]

001 0 1 Cure - Balamb Garden courtyard
002 0 1 Blizzard - Balamb Garden training center
003 1 0 Full-Life - Balamb Garden MD level
004 1 0 Esuna - Balamb Garden library next to the book shelf
005 0 0 Demi - Balamb Garden cafeteria (only during Garden Riot)
006 1 1 Bio - Balamb Garden B2 floor
007 1 1 Thunder - Balamb outside junk shop
008 1 1 Cure - Balamb harbor
009 1 1 Fire - Fire Cavern
010 1 1 Silence - Dollet town square
011 1 1 Blind - Dollet Communications Tower
012 0 1 Scan - Timber Pub Aurora back alley
013 0 1 Cure - Timber outside the pub
014 0 0 Blizzaga - Timber Maniacs Building left room
015 1 1 Haste - Galbadia Garden lobby
016 1 1 Life - Galbadia Garden changing rooms
017 1 1 Shell - Galbadia Garden courtyard
018 1 1 Protect - Galbadia Garden ice rink
019 0 0 Double - Galbadia Garden auditorium
020 1 0 Aura - Outside Galbadia Garden during Garden war
021 0 1 Cure - Timber forests in a Laguna dream
022 0 1 Water - Timber forests in a Laguna dream
023 0 1 Thundara - Deling City park
024 0 1 Zombie - Deling City Sewers
025 0 1 Esuna - Deling City Sewers
026 0 1 Bio - Deling City Sewers
027 1 1 Fira
028 1 1 Berserk - D-District Prison Floor 9 - right cell
029 0 0 Thundaga - D-District Prison Floor 11 - right cell
030 0 1 Aero - Outside D-District Prison
031 1 1 Blizzara - Missile Base - control room
032 1 1 Blind - Missile Base room with G-Soldiers who ask to deliver a message
033 0 1 Full-Life - Missile Base - silo room
034 1 1 Drain - Winhill road south from town square
035 1 1 Dispel - Winhill town square
036 0 0 Curaga - Winhill Laguna's room in the dream
037 0 0 Reflect - Winhill east road
038 1 1 Protect - Tomb of the Unknown King - outside
039 1 1 Float - Tomb of the Unknown King - north room
040 0 1 Cura - Tomb of the Unknown King - east room
041 1 1 Haste - Fishermans Horizon abandoned train station
042 1 1 Shell - Fishermans Horizon junk shop
043 1 1 Regen - Fishermans Horizon overlooking the sun panel
044 0 0 Full-Life - Fishermans Horizon Master Fisherman's fishing spot
045 1 0 Ultima - Fishermans Horizon mayor's house
046 1 1 Thundaga - Great Salt Lake past the dinosaur skeleton
047 0 0 Meteor - Great Salt Lake dinosaur skeleton
048 0 1 Curaga - Esthar city streets near city entrance
049 0 1 Blizzard - Esthar outside palace
050 1 1 Quake - Esthar outside Odine's Lab
051 0 1 Tornado - Esthar shopping mall
052 1 1 Double - Esthar Odine's Lab in a Laguna dream
053 0 0 Pain
054 0 0 Flare - Esthar Odine's Lab in a Laguna dream
055 0 1 Stop - Sorceress Memorial
056 0 1 Stop
057 1 1 Life - Tears' Point entrance
058 0 0 Reflect - Tears' Point middle
059 1 1 Death - Lunatic Pandora Laboratory in a Laguna dream
060 0 0 Holy - Lunatic Pandora near Elevator #1
061 0 1 Silence - Lunatic Pandora
062 0 0 Ultima - Lunatic Pandora
063 0 1 Confuse
064 0 1 Break - Lunatic Pandora on the way to fight Adel
065 1 1 Meteor - Lunatic Pandora entrance
066 0 1 Curaga - Lunatic Pandora elevator room
067 0 1 Slow
068 0 1 Curaga - Edea's Orphanage
069 0 0 Flare
070 1 0 Holy
071 0 1 Sleep - Centra Excavation Site
072 1 1 Confuse - Centra Excavation Site
073 0 1 Aero - Centra Ruins right ladder after the lift
074 0 0 Drain - Centra Ruins platform after the first staircase
075 0 0 Pain - Centra Ruins next to the dome
076 1 1 Thundaga - Trabia Garden in front of the statue
077 0 0 Zombie - Trabia Garden cemetery
078 0 0 Aura - Trabia Garden stage
079 1 1 Ultima - Shumi Village - above ground
080 0 1 Blizzaga - Shumi Village - outside elder's house
081 0 1 Firaga - Shumi Village workshop
082 1 1 Tornado
083 1 1 Holy - White SeeD Ship
084 0 1 Cura - Ragnarok room with a red Propagator
085 0 1 Life - Ragnarok hangar upstairs
086 0 0 Full-Life - Ragnarok room with save point
087 0 1 Dispel - Deep Sea Research Center second level
088 0 1 Esuna - Deep Sea Research Center secret room
089 1 0 Triple - Deep Sea Research Center third screen on the way to Ultima Weapon's lair
090 0 0 Ultima - Deep Sea Research Center fifth screen on the way to Ultima Weapon's lair
091 1 1 Meltdown - Lunar Base room before the escape pods
092 0 0 Meteor - Lunar Base Ellone's room
093 1 1 Haste
094 1 1 Slow
095 1 1 Curaga
096 1 1 Life
097 1 1 Stop
098 1 1 Regen
099 1 1 Double
100 0 0 Triple
101 0 0 Flare - Ultimecia Castle outside
102 0 1 Curaga - Ultimecia Castle storage room
103 0 1 Cura - Ultimecia Castle passageway
104 0 1 Scan
105 0 1 Esuna
106 0 1 Slow - Ultimecia Castle courtyard
107 0 1 Dispel - Ultimecia Castle chapel
108 0 1 Stop - Ultimecia Castle clock tower
109 0 1 Life
110 0 0 Flare
111 0 0 Aura - Ultimecia Castle wine cellar
112 0 0 Holy - Ultimecia Castle treasure room
113 0 0 Meteor
114 0 0 Meltdown - Ultimecia Castle art gallery
115 0 0 Ultima - Ultimecia Castle armory
116 0 0 Full-Life - Ultimecia Castle prison
117 0 0 Triple
118 1 0 Fire
119 1 0 Fire
120 1 0 Fire
121 1 0 Fire
122 1 0 Fire
123 1 0 Fire
124 1 0 Fire
125 1 0 Fire
126 1 0 Fire
127 1 0 Fire
128 1 0 Fire
129 0 1 Cure
130 0 1 Esuna
131 0 1 Thunder
132 0 1 Fira
133 0 1 Thundara
134 0 1 Blizzara
135 0 1 Blizzard
136 0 1 Fire
137 0 1 Cure
138 0 1 Water
139 0 1 Cura
140 0 1 Esuna
141 0 1 Scan
142 0 1 Shell
143 0 1 Haste
144 0 1 Aero
145 0 1 Bio
146 0 1 Life
147 0 1 Demi
148 0 1 Protect
149 0 1 Holy
150 0 1 Thundaga
151 0 1 Stop
152 0 1 Firaga
153 0 1 Regen
154 0 1 Blizzaga
155 0 1 Confuse
156 0 1 Flare
157 0 1 Dispel
158 0 1 Slow
159 0 1 Quake
160 0 1 Curaga
161 0 1 Tornado
162 0 0 Full-Life
163 0 1 Reflect
164 0 0 Aura
165 0 0 Quake
166 0 1 Double
167 0 1 Break
168 0 0 Meteor
169 0 0 Ultima
170 0 0 Triple
171 0 1 Confuse
172 0 1 Blind
173 1 1 Quake
174 0 1 Sleep
175 0 1 Silence
176 1 1 Flare
177 0 1 Death
178 0 1 Drain
179 1 1 Pain
180 0 1 Berserk
181 0 1 Float
182 0 1 Zombie
183 0 1 Meltdown
184 1 0 Ultima
185 1 1 Tornado
186 1 1 Quake
187 1 1 Meteor
188 1 1 Holy
189 1 1 Flare
190 1 1 Aura
191 1 1 Ultima
192 1 1 Triple
193 1 1 Full-Life
194 1 1 Tornado
195 1 1 Quake
196 1 1 Meteor
197 1 1 Holy
198 1 1 Flare
199 1 1 Aura
200 1 1 Ultima
201 1 1 Triple
202 1 1 Full-Life
203 1 1 Tornado
204 1 1 Quake
205 1 1 Meteor
206 1 1 Holy
207 1 1 Flare
208 1 1 Aura
209 1 1 Ultima
210 1 1 Triple
211 1 1 Full-Life
212 1 1 Ultima
213 1 1 Meteor
214 1 1 Holy
215 1 1 Flare
216 1 1 Aura
217 1 1 Ultima
218 1 1 Triple
219 1 1 Full-Life
220 1 1 Meteor
221 1 1 Holy
222 1 1 Triple
223 1 1 Aura
224 1 1 Ultima
225 1 1 Triple
226 1 1 Full-Life
227 1 1 Meteor
228 1 1 Holy
229 1 1 Flare
230 1 1 Aura
231 1 1 Ultima
232 1 1 Triple
233 1 1 Full-Life
234 1 1 Meteor
235 1 1 Triple
236 1 1 Flare
237 1 1 Aura
238 1 1 Ultima
239 1 1 Triple
240 1 1 Full-Life
241 1 1 Meteor
242 1 1 Holy
243 1 1 Flare
244 1 1 Aura
245 1 1 Ultima
246 0 1 Blizzard
247 0 1 Cure
248 1 1 Dispel
249 1 1 Confuse
250 0 0 Meteor
251 0 0 Double
252 0 0 Aura
253 0 0 Holy
254 0 0 Flare
255 0 0 Ultima
256 1 1 Scan

The second bit listed controls if the drawpoint is refilled or not (1 = refills, 0 = doesn't refill).
See below post at EDIT2 for full explanation of what the first bit does.

In summary, the bytes in the array are set as follows:
magic_id
OR 0x40 if you can refill it
OR 0x80 to be able to draw more magic

to determine the parameters from the byte in the array you can do the following:
magic_id = byte & 0x3F
refill = (byte >> 6) & 1
extra_magic = byte >> 7

142

Scripting and Reverse Engineering / Re: [FF8] Editing the contents of Draw points

« on: 2016-06-02 00:05:25 »

You'd either have to hex edit the exe or edit the values in memory.
In my case the values are at offset 0xB92328 or offset 0x792328 in the exe (I just searched for the bytes in the code that MaKiPL showed).

Say you wanted to edit the draw point of ID 15, you first subtract 1 from it to get the index in the array.
This gives us 14 (0x0E), then you'd add this to the start offset of the array.
This means that you would change the value at 0x792336 in the exe.

143

Scripting and Reverse Engineering / Re: [FF8] Editing the contents of Draw points

« on: 2016-06-01 23:50:23 »

Nice work .
Any idea if the upper 2 bits do anything?
looking at this list

Cure has a magic ID of 0x15 but it's listed as 0x55 in the table... looking at the binary:

Code: [Select]

HEX  BIN
0x15 00010101
0x55 01010101

seems like the upper 2 bits are ignored or they're doing something else - might be one of the bits is a boolean that controls if it's refilled or not, see this list
The highest magic ID is 0x38, so it makes sense that it can fit into 6 bits.

144

Scripting and Reverse Engineering / Re: [FF8] battle.fs/MAG files, r0win, b0wave and a9btlfnt.bft

« on: 2016-05-28 22:52:30 »

You can get encodings where certain areas store different things, so it might be that the 3 least significant bits are used for something else.
e.g. 8-bit RGB colour is encoded in a byte as follows:

Code: [Select]

Bit    7  6  5  4  3  2  1  0
Data   R  R  R  G  G  G  B  B

Also that hole might not be a mistake, it's quite common to not include faces that will not be seen in a model.
For example, if that side was touching the floor, it wouldn't be visible and it wouldn't need to be included in the model.

145

Scripting and Reverse Engineering / Re: [FF8] Engine reverse engineering

« on: 2016-05-27 21:18:21 »

Ah thanks, I think I see what's wrong now.
The offset of the battle data in memory is different so the offset 0x1D27BC0 in the code no longer works. It looks like the battle data is offset 0x1A80 higher in memory in the German version.
I think the full patch for the German version should be:

Code: [Select]

from: 0x8BF18: B90A 0A0A 0A
to:   0x8BF18: E9A8 0000 00

from: 0x8BFC5: 9090 9090 9090 9090
to:   0x8BFC5: 8A87 7B01 0000 EB77

from: 0x8C044: 9090 9090 9090 9090 9090 90
to:   0x8C044: 8886 4096 D201 E912 0100 00

from: 0x8C161: 9090 9090 9090 9090 9090
to:   0x8C161: B90A 0A0A 0AE9 B2FD FFFF

let me know if it works

146

Scripting and Reverse Engineering / Re: [FF8] Engine reverse engineering

« on: 2016-05-27 18:18:13 »

Should work with the new addresses as long as they are offset by the same amount and the code around the area is actually the same because all the jumps are encoded with relative addresses.
Although they appear to be absolute addresses in the assembly code, at the machine code level they are encoded as relative jumps.
EB and E9 opcodes (which are used for the jumps in the patch) both use relative addresses, see here.

If patching the new addresses doesn't work, could you give me a disassembly of the area in question?

147

Scripting and Reverse Engineering / Re: [FF8] Engine reverse engineering

« on: 2016-05-24 22:04:26 »

So I had another look at the GFs today... it seems that there are a bunch more functions than I had anticipated =/.

Take for example Shiva...
the main function that I've put in this post is 0x005C0D50.
a bit later in that function, function pointers are pushed as arg2 to the function 0x508360 (it's called twice) - the function pointers that are pushed are 0x5C7F50 and 0x5C0F30 - I'm assuming the function 0x508360 stages those 2 functions to be called every frame.
both of these functions appear to be called every frame (I guess it controls the animation) since there's a switch at 0x5C0FC5 that switches on a number that increases every time the function is called.
This switch appears to control things that happen during the animation - I'm assuming that it's switching on the frame number (e.g. loading extra files - the function 0x508480 loads files from this array)
The arg to both of these functions is a pointer to some sort of struct, of which the DWORD at offset 0x0C is the current frame number.

Since the constants in the function 0x5C0F30 appear to be for Shiva - (for example the file loaded at 0x5C0FFE uses the constant 0x21F for MAG184_D.DAT), I'm assuming that there are functions like this for all the GFs and possibly magic too.

148

FF8 Tools / Re: [FF8] Enemy editor - IFRIT (0.11)

« on: 2016-05-24 19:02:02 »

Ah, you're right... finding stuff around here can be a pain xD.
Looks like the information is here

149

FF8 Tools / Re: [FF8] Enemy editor - IFRIT (0.11)

« on: 2016-05-24 16:24:00 »

Only GFs that you fight (Ifrit, Brothers, Diablos, Cerberus, Bahamut, Cactuar and Tonberry) will have a battle model (.dat files - which is what Ifrit deals with) and this is only used for the battle with them.
The actual summon animations are in the magic files that haven't been fully deciphered yet.

I've pointed out which functions deal with the actual summons in the exe in this post.
Those functions load the files needed for each animation but no-one has yet managed to work out the geometry/animations as far as I'm aware.
The only information I can see on the wiki for these files is here.

150

Scripting and Reverse Engineering / Re: [FF8] Engine reverse engineering

« on: 2016-05-23 19:20:38 »

The patch I made makes the unused byte in the .dat files (which is marked as percent in ifrit) change vit0, there is no vit0 byte normally.
He's just changing percent byte in Ifrit after applying the patch I made, which edits vit0.