Author Topic: General CTDS hacking discovery thread  (Read 3909 times)

Ozzie

  • Porrean (+50)
  • *
  • Posts: 53
    • View Profile
General CTDS hacking discovery thread
« on: November 21, 2008, 04:59:21 pm »
Found something cool in CTDS through hacking or modding? Post it here!

Having recently discoverd that hacking ds saves and savestates won't work, I needed to find a way to cheat to access stuff at a whim.

One way I've discovered is Cheat Engine 5.4. It's a tool that examines and allows you to search and edit the running memory of any given program on your computer. In this case, I'm using No$GBA. The game's memory is fully searchable and editable within here. The first thing I found through a search is Crono's stats, and equipment.

I did a search for 70 HP and 08 MP, Crono's starting stats. Boom. Found it and edited it to my liking.

In No$GBA's memory section, Crono's HP and MP begin at address 0BD52A3B.
All kinds of neat search functions and technical stuff to play with in Cheat Engine 5.4, and it's free.

http://www.cheatengine.org/index.php

Just like searching for cheats in any snes emu, only a little different. This is how we are going to load up every monster, npc, playable character and unlockable.  8)

We can post addresses of anything we find here.

Crono's other stats and equipment are right under his starting stats, by changing the next 20 bytes or so to random numbers, I had crono with all kinds of different stats and a dummied item or two equipped (the name of the items were actually "dummy", It's so cool they still use that term :D).


What's neat is we have memory addresses from the SNES version, and can find and edit all of it.
What I've been successful at is looking at the SNES RAM while CT is running, copying a section of bytes and searching the No$GBA memory for the same string, and often I find exactly what I'm looking for, meaning some things are layed out exactly the same between the two games.


-edit-
Crono's weapon slot - 0BD52A66
Characters in your party - 0BE800A80   *06 is Magus and 07 is Epoch, nothing after that :P*
Scroll mask values - 0BC25D12




[attachment deleted by admin]
« Last Edit: November 21, 2008, 06:21:48 pm by Ozzie »

justin3009

  • Fan Project Leader
  • God of War (+3000)
  • *
  • Posts: 3296
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #1 on: November 21, 2008, 08:13:34 pm »
Very nice

FaustWolf

  • Guru of Time Emeritus
  • Arbiter (+8000)
  • *
  • Posts: 8972
  • Fan Power Advocate
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #2 on: November 21, 2008, 08:14:18 pm »
Fabulous work! The game's only been out for 24 hours, and look what Kajar Labs has accomplished already thanks to you guys!

Vehek

  • Errare Explorer (+1500)
  • *
  • Posts: 1761
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #3 on: November 21, 2008, 08:43:49 pm »
I've been working on finding how the text is stored. Making a table isn't as quick as I expected, as the letters aren't in order. For example, 'a' is on 0x05 while 'b' is on 0x1C.

justin3009

  • Fan Project Leader
  • God of War (+3000)
  • *
  • Posts: 3296
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #4 on: November 21, 2008, 09:38:16 pm »
Well that certainly explains why I couldn't find anything inside the rom.

Vehek

  • Errare Explorer (+1500)
  • *
  • Posts: 1761
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #5 on: November 22, 2008, 12:24:27 am »
Here's what I have so far.

[attachment deleted by admin]

justin3009

  • Fan Project Leader
  • God of War (+3000)
  • *
  • Posts: 3296
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #6 on: November 22, 2008, 12:31:11 am »
Pretty good.  That's so strange that the DS stuff is so scrambled like that.

Luminaire85

  • Guru of Time Emeritus
  • Chronopolitan (+300)
  • *
  • Posts: 311
    • View Profile
    • Chrono Cinema
Re: General CTDS hacking discovery thread
« Reply #7 on: November 22, 2008, 10:01:12 am »
I've attached a few utilities that may help with the ROM exploration:

DSBuff - Unpacks the ROM into its component files. Can also pack component files back into ROM.

CrystalTile2 - Viewer for many of the ROM files. Originally in Chinese, this version has been adapted with just enough English to be usable.

NDS Sound Extractor - Command-line tool that extracts the sound files from the ROM and converts them to MIDI/WAV.

These were found as I was investigating how to extract the soundtrack from the ROM, which I believe is taken care of by the last of these utilities. Hopefully more on that later.

[attachment deleted by admin]

tushantin

  • CC:DBT Dream Team
  • Hero of Time (+5000)
  • *
  • Posts: 5645
  • Under Your Moonlight, Stealing Your Stars
    • View Profile
    • My Website
Re: General CTDS hacking discovery thread
« Reply #8 on: November 22, 2008, 11:30:01 am »
I use T-search, not Cheat Engine, though I didn't really wanna actually cheat the game yet.  :lol:

Note: Some of the addresses and float values are not really fixed. When I used the same method in Chrono Cross ISO the rainbow equipments had some unique addresses that often altered. I can assume the same with CTDS.

Vehek

  • Errare Explorer (+1500)
  • *
  • Posts: 1761
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #9 on: November 23, 2008, 03:36:44 pm »
It looks like the script files contain both the Japanese script and the English script in the same files. It seems to go: Japanese version of line 1, English version of line 1, Japanese version of line 2, etc.

ZeaLitY

  • Entity
  • End of Timer (+10000)
  • *
  • Posts: 10797
  • Spring Breeze Dancin'
    • View Profile
    • My Compendium Staff Profile
Re: General CTDS hacking discovery thread
« Reply #10 on: November 23, 2008, 03:40:07 pm »
Wow, and you can actually view them? Ramsus and I have decided to keep any overt assets under wraps until the hype dies down (just in case SE would get mad), but if you've succeeded in finding the scripts, we can...well, I guess there is no secret ROM hacking lab or something, but could you forward them to me? We'll find some way of disassociating them with the site.

I suppose we'll create text versions for each (won't be rolled out until the hype dies down) and then decide what kind of spreadsheet would be apt.

Vehek

  • Errare Explorer (+1500)
  • *
  • Posts: 1761
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #11 on: November 23, 2008, 03:58:40 pm »
I can't view the Japanese script in whole yet, but I have enough to read most of the English script. I don't have a script dumper yet.

Ozzie

  • Porrean (+50)
  • *
  • Posts: 53
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #12 on: November 24, 2008, 07:40:43 pm »
I'll have to convert my memory addresses to Action Replay codes for DS (which can be entered directly in No$GBA).

Equipping just the wrong thing on some of his equipment will cause a freeze (probably trying to update stats or other effects upon equip that just don't exist or conflict with stuff).

Replace the VV with the value you want loaded

Crono's equipped weapon - 22072966 000000VV
Crono's equipped helmet - 22072967 000000VV
Crono's equipped armor - 22072968 0000000VV
Crono's equipped accessory - 22072969 000000VV
« Last Edit: November 24, 2008, 07:42:26 pm by Ozzie »

justin3009

  • Fan Project Leader
  • God of War (+3000)
  • *
  • Posts: 3296
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #13 on: November 24, 2008, 07:50:19 pm »
Neat.  Now that makes it easier to get all the item names.

Ozzie

  • Porrean (+50)
  • *
  • Posts: 53
    • View Profile
Re: General CTDS hacking discovery thread
« Reply #14 on: November 24, 2008, 08:46:49 pm »
Consumable inventory item slot 1 - 22072FE1 000000VV
Consumable inventory item amount slot 1 - 22072FE2 000000VV
Consumable inventory item 'Unknown' slot 1- 22072FE3 000000VV


This is mostly correct, though I'm unsure of how the third byte works. I've seen it change a few things about the item, kind of confusing me.



« Last Edit: November 24, 2008, 08:56:23 pm by Ozzie »