Important Melee, Hacks, and You -- New Hackers Start Here, in the OP!

[flieskiller]

UPDATE: Dios Mios Booter booted the 2.7gb ISO and also played the custom song I added the end of the original ISO! Looks like we're in the clear boys!

(but CFG loader didn't recognize the ISO...)

I expect 40 custom costumes for each characters now.

Have you tried it with Nintendon't?

 

[Achilles1515]

I expect 40 custom costumes for each characters now.

Have you tried it with Nintendon't?

I've never used Nintendont. Try it yourself, though. Open the .iso up in a hex editor, copy everything, go to the very end and paste, save. Then see if Nintendont recognizes and boots it.

 

[CeLL]

So I am working on decompiling ISOs now. Almost done with extracting all the files in the TOC, but how would I get the ones from GCR's &&systemdata folder?

 

[Achilles1515]

http://hitmen.c02.at/files/yagcd/yagcd/chap13.html

shows you the offset for apploader.bin in the ISO. And then 0x424 is the offset of the TOC. iso.hdr is the disk header.

And then that also gives the offset for the DOL.

 

[Achilles1515]

So I am working on decompiling ISOs now. Almost done with extracting all the files in the TOC, but how would I get the ones from GCR's &&systemdata folder?

and it looks like size of the apploader is apploader offset +0x14

 

[DRGN]

You definitely need the table of contents. It’s what tells the game where file offset starts are within the ISO.

Aside from Sham Rock’s custom file loading code, all he figured out how to do is tell GCR to make it’s own TOC instead of using the TOC in a root folder that you load up. But no one knew how to do this, so it’s a huge discovery. By telling it to make its own, it then constructs the custom TOC based on every file that is within the root folder, meaning you can add your own files.

So during my lunch break, I got curious and took a look at the TOC. It’s just a series of pointers and then a string table at the bottom. The string table contains the names of every file within the ISO. Then a block of 0xC in length at the top corresponds to each string (or basically…file).

0x00 = string offset (in the string table or list of file names)
0x04 = offset in the ISO (if you open the entire ISO up in a hex editor)
0x08 = length of the file

This is how the game differentiates “files” within it’s chunk of data. So I know you were interested in overwriting files within an ISO – all you would need to do is parse the TOC and find the start of the offset for each filename. Then just copy and paste the contents of a new file at this location. Simple.

Side idea as I’m writing this: Ah! So this is probably how ISO “scrubbers” work. It takes the offsets of each file in the ISO, deletes the space in between them, then scrunches all their data together. Then just adjusts the pointer in the TOC for each file name to the new location!

And now the ISO rebuilding process makes sense as well.

So I first had to test what the limiting factor is with the “default” ISO size of 1.35gb. Is it just GCR? I opened up the ISO in a hex editor, copied the entire thing, then pasted it at the end of the file, doubling it’s size. So I had a Melee ISO 2.7gb in size. Booted it up in Dolphin and it worked just fine. Okay….good news.

“GCR won’t let me go over the size limit, but what if I just manually did it.” So then I took the contents of an HPS file and pasted it at the end of a regular ISO. Then I went into the location of the TOC within the huge ISO file and changed the “offset within the ISO file” to the very end. Changed the “file size” as well. Booted it up, and it played the custom music!

Since I booted a 2.7gb ISO, I assume I could just change pointers in the TOC location to point to anywhere in that entire location. So who knows how big we could go….

If we start extending the ISO size past the default limits, I believe this breaks GCR. This is where you and Cell may come in handy…hehe.

Other info:

ISO.hdr is the first info in the ISO file.
0x0424 = offset of the TOC.dat within the ISO
0x0428 = size of TOC
0x042c = maximum size of TOC (usually the same as the size)

the TOC is called the FST in the "Yet Another Gamecube Documentation" site.

I really need to test it on console though…my gut feeling tells me Dios Mios has an ISO limit too which would suck…but we’ll see. The flexibility of Dolphin might just be getting my hopes up. So much to research and test.

I also opened up the toc not too long ago and noticed all of the file strings, but I didn't look any deeper into the rest of the structure since I didn't need it at the time. I can already get offsets via wit (the Wiimms tool I introduced in the ISO programming thread) or GCR, as well as export/import files in the ISO. But that was only with files of the same size, so this toc info is awesome. (Plus, writing our own functions to get file offsets -if we need to get them dynamically/programmatically- rather than rely on an external tool like wit is more efficient), Too bad we couldn't reproduce this kind of benefit with the Crazy Mod method.

Edit: I almost forgot, I wanted to ask about IDing the version of an ISO. I know the version is found at 0x07, but is this only for NTSC? Does PAL show there as 00, just like NTSC v1.00 (as if there are different versions of PAL, which afaik there aren't)? Or maybe 03? I don't even think I have a PAL ISO at home to check. If I can't ID there, then of course I could check elsewhere for other known difference, but I'm not sure which I would pick, since some differences are tweaked by various mods.

 

[CeLL]

I also opened up the toc not too long ago and noticed all of the file strings, but I didn't look any deeper into the rest of the structure since I didn't need it at the time. I can already get offsets via wit (the Wiimms tool I introduced in the ISO programming thread) or GCR, as well as export/import files in the ISO. But that was only with files of the same size, so this toc info is awesome. (Plus, writing our own functions to get file offsets -if we need to get them dynamically/programmatically- rather than rely on an external tool like wit is more efficient), Too bad we couldn't reproduce this kind of benefit with the Crazy Mod method.

Edit: I almost forgot, I wanted to ask about IDing the version of an ISO. I know the version is found at 0x07, but is this only for NTSC? Does PAL show there as 00, just like NTSC v1.00 (as if there are different versions of PAL, which afaik there aren't)? Or maybe 03? I don't even think I have a PAL ISO at home to check. If I can't ID there, then of course I could check elsewhere for other known difference, but I'm not sure which I would pick, since some differences are tweaked by various mods.

Yes, PAL has a version byte of 00, but the region byte of the game code is different, thus the game code is GALP01 instead of GALE01. Other than that the date (0x2440) is also different than NTSC's (PAL's is 2001/12/17).

 

[DRGN]

Yes, PAL has a version byte of 00, but the region byte of the game code is different, thus the game code is GALP01 instead of GALE01. Other than that the date (0x2440) is also different than NTSC's (PAL's is 2001/12/17).

Yeah, but I can't use the gamecode since it's so often changed. I forgot about the date thing. I guess I could use that. Can't imagine why someone would want to change theirs, haha.

Cool new avatar btw.

 

[CeLL]

@ Achilles1515
How do you find the size of the dol?

 

[Achilles1515]

@ Achilles1515
How do you find the size of the dol?

Not sure.

 

[CeLL]

Not sure.

Well right now it's 100% working at decompiling isos except it's just using the specific size of Melee's dol for the dol's size. I will see about compiling soon.

 

[DRGN]

@ Achilles1515
How do you find the size of the dol?

Kind of weird that that's not listed in the disc header after the offset to the dol. But we can just take the offset of the toc file and subtract the offset of the dol to get the dol's length. In fact I guess if it's that simple maybe that explains why it's not in the disc header.

 

[GopherHat]

What format are images stored as in the game's iso? How can I get them?

Specifically I want the background image to the Melee main menu, when choosing between "1-P Mode", "VS Mode", "Trophies", etc. (The first menu after pressing start at the title screen.)

I realize there are a lot of moving parts in the background. Maybe it would be possible to remove the menu graphics temporarily to take a snapshot of everything behind it?

I found the menu pointer for 1.02 while i was messing around yesterday

Menu Pointer: 004a04f0
0 main menu
1 red
2 grenn
3 yellow
4 purple
5 grey
1000000 1p mode
2000000 vs mode
3000000 trophies
4000000 options
5000000 data
6000000 1-p mode regular match
7000000 eventmatch
8000000 1p mode blank?
9000000 1p stadium!
A000000 training
B000000 tourneyment
C000000 special
D000000 custom rules
E000000 name entry
F000000 aditional rules
10000000 item switch
11000000 random stage
12000000 vsmode name entry ??? twice?
13000000 options / rumble
14000000 options sound
15000000 options / screen display
16000000 options ... ? I think its announcements
17000000 language options
18000000 erase data
19000000 data/ snapshots
1A000000 data/Archives
1B000000 Sound Test
1C000000 Data Melee records
1D000000 Data/ Special
1E000000 Data/Melee Records/Vs. records
1F000000 Data/Melee Records/Bonus Records
20000000 Data/Melee Records/Misc. Records
21000000 1-P Mode / Stadium (Multi man Melee (choose the mode))
22000000 main menu
50000000 just the background
yeah everything else is the main menu

So about what you were wanting with the background. Well, it turns out that if you go into the custom rules section and change the menu value at that time it will remove the custom rules section and have no menu elements!

screenshots:
imgur.com/a/lJ0Gx

Sorry if this post is a bit long I'm a bit new to this forum thing

EDIT: jesus I am making horrible grammar and spelling mistakes. I probably should have slept instead of doing this

 

[GopherHat]

take a look at this little secret: :3

looks like Sand Bag has a few phantom limbs and, a tail??

SANDBAG HAS A SKELETON!!!!! BRB going to spend the next 6 months trying to make sandbag a playable

 

[CeLL]

SANDBAG HAS A SKELETON!!!!! BRB going to spend the next 6 months trying to make sandbag a playable

You can already play as him with the debug menu. Do you mean finishing him so he has attacks and whatnot?

 

[GopherHat]

You can already play as him with the debug menu. Do you mean finishing him so he has attacks and whatnot?

Yeah like give him a spot on the CSS screen and give moves. This is going to be really difficult. I might need everyones help a bit. I have seen the thread where you can replace moves with other moves by changing the pointer but the actual animation format is really unexplored as far as I'm aware. I have been trying to change the character select screen a bunch with no luck but it looks like some of the people on here have made extraordinary progress.

Sandbag is going to be a heavy character with good attack but a limited recovery.

 

[flieskiller]

Yeah like give him a spot on the CSS screen and give moves. This is going to be really difficult. I might need everyones help a bit. I have seen the thread where you can replace moves with other moves by changing the pointer but the actual animation format is really unexplored as far as I'm aware. I have been trying to change the character select screen a bunch with no luck but it looks like some of the people on here have made extraordinary progress.

Sandbag is going to be a heavy character with good attack but a limited recovery.

The problem about this is the lack of custom animations. If you can find a way to make animation modifications possible, it will be super huge.

 

[GopherHat]

I think the first thing we should try to do is try to put a clones move into the original character. Like luigi's forward air into mario. Since the skeletons are the same it should just work. I'll go and try it

EDIT: mario was a bad Idea since his character id is 00 00 00

 

[GopherHat]

I really don't have the experience to do this on my own. It takes me about 2 hours to change one move because of the sheer magnitude of moves that it could be :/

 

[MagicScrumpy]

I really don't have the experience to do this on my own. It takes me about 2 hours to change one move because of the sheer magnitude of moves that it could be :/

It gets faster with experience.

 

[Tcll]

but the actual animation format is really unexplored as far as I'm aware.

I'm hoping to fix that when I get UMC up to speed...
I'm currently having issues with my UT data transformer:

I don't think it's UMC though, I think it's my MDL0 script sending in the weights incorrectly,
which would make sense seeing as Pachirisu doesn't import because of that very system:

Traceback (most recent call last):
File "C:\Users\Tcll\Copy\UMC_v3.0a\data\VIEWER.py", line 705, in _ImportModel
script.ugeImportModel(filepath.split('.')[-1].lower(),None)
File "scripts\MDL02.py", line 557, in ugeImportModel
XF_VtxMtxCache[XFAddr/12]=_Definitions['NodeMix'][Link] #[ [BoneID, Weight],
[] ]
KeyError: 2

but yea, as for the format Pl**Aj.dat is an archive of dat-formatted files which contain the animation data:

## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## //outer header
## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## //animation dat header
... //animation data
...
## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## //animation relocation pointers
...
## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## //animation root nodes and strings
... //another animation dat file here
...
## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## //outer relocation pointers (I think)
...
## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## //outer root nodes and strings (1 node for 1 dat file)


I should've written this on my DAT format page a while back >.>
http://wiki.tockdom.com/wiki/HAL_DAT_(File_Format)
you'll see it there relatively soon

 

[DRGN]

@ Achilles1515 , would you happen to know a reliable, simple way to determine the game version from the dol alone? I don't want to use file size, since it seems we can change that.

 

[Dantarion]

I -may- have found some nice stuff on data relocation (for extending and reducing the lengths of sub/action programs), but I don't want to say much yet because I'm not quite sure. Once I get a better idea of what's going on, I'll update.

To do this you would have to finish MasterHand or figure out a way to abuse commands to jump to an arbitrary spot in memory and then back again. (The PM method)

 

[MagicScrumpy]

How would I go about making characters unselectable at the CSS? I found the code made by Achilles that makes only Falcon selectable, and I was able to modify it so that Falco was the only selectable character, but the random character thing would still only pick Falcon. I'm not good at assembly (though I'm ready and willing to learn), so I don't know what to do outside of changing instances of Falcon's character ID to that of Falco's.

 

[Achilles1515]

How would I go about making characters unselectable at the CSS? I found the code made by Achilles that makes only Falcon selectable, and I was able to modify it so that Falco was the only selectable character, but the random character thing would still only pick Falcon. I'm not good at assembly (though I'm ready and willing to learn), so I don't know what to do outside of changing instances of Falcon's character ID to that of Falco's.

You need to modify this portion of the code.

Opening Slots/Random Defaults to C. Falcon
0425fb78 3BE00007

3BE00007 = li r31, 0x7

For whatever reason, 0x7 in this scenario corresponds to Falcon. I say "for whatever reason" because the ID value of 7 does not correspond with the external or internal character ID of Falcon. Changing the 0x7 to some other value will change what character always shows up. I don't know what values correspond to each character. I'm not going to look further into the ASM at the moment, but I assume it takes that value of 7 and uses it to pull a legitimate character ID from a table of some sort.

You can look into it yourself by setting a breakpoint at that code's address (8025fb78), and then stepping through the next, hopefully only couple, few lines to see what it actually does with that value of 7 and how it uses it to find C. Falcon.

 

[Achilles1515]

@ Achilles1515 , would you happen to know a reliable, simple way to determine the game version from the dol alone? I don't want to use file size, since it seems we can change that.

No. Not "reliable" in the way that I know you're thinking of.

I found the menu pointer for 1.02 while i was messing around yesterday

Menu Pointer: 004a04f0
0 main menu
1 red
2 grenn
3 yellow
4 purple
5 grey
1000000 1p mode
2000000 vs mode
3000000 trophies
4000000 options
5000000 data
6000000 1-p mode regular match
7000000 eventmatch
8000000 1p mode blank?
9000000 1p stadium!
A000000 training
B000000 tourneyment
C000000 special
D000000 custom rules
E000000 name entry
F000000 aditional rules
10000000 item switch
11000000 random stage
12000000 vsmode name entry ??? twice?
13000000 options / rumble
14000000 options sound
15000000 options / screen display
16000000 options ... ? I think its announcements
17000000 language options
18000000 erase data
19000000 data/ snapshots
1A000000 data/Archives
1B000000 Sound Test
1C000000 Data Melee records
1D000000 Data/ Special
1E000000 Data/Melee Records/Vs. records
1F000000 Data/Melee Records/Bonus Records
20000000 Data/Melee Records/Misc. Records
21000000 1-P Mode / Stadium (Multi man Melee (choose the mode))
22000000 main menu
50000000 just the background
yeah everything else is the main menu

So about what you were wanting with the background. Well, it turns out that if you go into the custom rules section and change the menu value at that time it will remove the custom rules section and have no menu elements!

screenshots:
imgur.com/a/lJ0Gx

Sorry if this post is a bit long I'm a bit new to this forum thing

EDIT: jesus I am making horrible grammar and spelling mistakes. I probably should have slept instead of doing this

This is really awesome, btw. Nice find!

To do this you would have to finish MasterHand or figure out a way to abuse commands to jump to an arbitrary spot in memory and then back again. (The PM method)

Did you guys create your own commands for PM?

 

[Doq]

For whatever reason, 0x7 in this scenario corresponds to Falcon. I say "for whatever reason" because the ID value of 7 does not correspond with the external or internal character ID of Falcon. Changing the 0x7 to some other value will change what character always shows up. I don't know what values correspond to each character. I'm not going to look further into the ASM at the moment, but I assume it takes that value of 7 and uses it to pull a legitimate character ID from a table of some sort.

Hypothesis: 0x7 is 8 counting from 0. Starting with Dr. Mario at 0, counting to the right 7 spaces lands us on Captain Falcon's spot. So by this logic, 0x7 should be changed to 0x9 for Falco.

Or I'm just talking out of my ass again and should get a USB Gecko or something.

 

[Achilles1515]

Hypothesis: 0x7 is 8 counting from 0. Starting with Dr. Mario at 0, counting to the right 7 spaces lands us on Captain Falcon's spot. So by this logic, 0x7 should be changed to 0x9 for Falco.

Or I'm just talking out of my *** again and should get a USB Gecko or something.

Oh yeah. That reminds me that the game does use that for things. Without looking at the ASM, I'd almost bet 100% that you're right. It probably takes that value, multiplies it by the length of each character select info data table item, and then pulls the external character ID from that.

 

[MagicScrumpy]

I tested it, and it checks out. Nice, Doqtor Kirby!

 

[GopherHat]

Thanks @ Achilles1515 and @ MagicScrumpy and @ Tcll and @ CeLL and @ flieskiller for all support

I have a few questions:
firstly I wanted to see if I can change where the menu points when you press start with a gecko code, but i am having issues. Such as changing it so that it hovers over the melee menu option rather than one player which is the default. I found the value 004a04f0 which is the memory address of the menu position. so by default it would be set to 0 since thats the value for the 1-player selected on the main menu.

So then I loaded up debug fast dolphin in debug mode, and set a memory breakpoint at 004a04f0 on write to break. This way it would break at the write and stop at the position in the code where the menu number is set.

So i boot it up, it breakpoints(breaks?) after I press enter on the start screen.

It stops on this line:

8022c010 cmpwi r3,0

It's setting the l value in register 3 (the address is probably 004a04f0, but im not actually sure.. it was in a subroutine for some reason.) to 0 from what I can see, so I think oh this should be pretty easy just a simple replace. But then I realised I had to actually write the gecko code.

I have no idea how to convert the assembler to machine code
so i literally just copied the line of hex corresponding to the code and hoped for the best.

I got 2C030000 4082000C

So based on my basic knowledge of machine code I infer that the last character is probably for the second arguement of the assembler so i incremented it.

so heres the final NON WORKING gecko code

$ NOT WORKING Change the starting position of the menu (NTSC 1.02) [GopherHat]
C222c010 00000001
2C030000 4082000D
4E800020 00000000

I run it with normal debug dolphin with cheats on and the enter key at the end of the gecko ini file, ticked the checkbox and nothing happened.


....

All I can do now is pray to the almighty @ Tcll and hope he fixes the weight node thingies on the UMC plugin.

@ Tcll you are sandbag's only hope of being brought to life

 

[Tcll]

lol thanks

tbh, I hate to say this, but don't expect anything soon

I have yet to work on UMC's verifier which would fix alot of issues with other formats that supply less data... (such as Melee)
right now my mind is set on SIDE as I need an advanced hex viewer (like HexEdit) in order to fix the above issue with my MDL0-2 script.
(I think UMC's transformer actually works properly, but I want to make sure)

a plus for SIDE is HexEdit is not capable of my new pathfinder method for reading HAL data
(it freezes when the relocation table contains over 200 pointers)
don't expect SIDE to freeze

also, the reason I call it "HAL" data is because the format is found in games formatted by HAL Labs (so far Melee and Kirby Air Ride)

 

[GopherHat]

Is there any chance that I might be able to help with the debugging for UMC?
If you want to contact me I'll send you my skype or whatever way you want to be contacted

I think that the hal dat type is also the data type that is used to contain 3d model data in Hal's development kit: SysDolphin. Man If we could get our hands on sysDolphin and the source of melee we could legitamently change everything and understand everything. It wont ever happen though

 

[Tcll]

Is there any chance that I might be able to help with the debugging for UMC?

sure, my skype is Tcll5850 (DarkPikachu)
just let me know it's you as I get too many skype bots. XD
(the default request message is used by a bot)

 

[CeLL]

There are a couple of DATs in the Brawl ISO, afaik. Is it possible the Brawl modding scene knows a bit about them (perhaps some that we don't)?

 

[Tcll]

There are a couple of DATs in the Brawl ISO, afaik. Is it possible the Brawl modding scene knows a bit about them (perhaps some that we don't)?

dummy1.dat, dummy2.dat, and border.dat
they're just nothing but 0's
I assume they're just meant to preallocate the RAM
possibly to init the boot in some space or something.

idk much when it comes to backend stuff like that

 

[Tcll]

I'm the biggest dunce.
all this time, Pichu had a black and green body because I forgot to add 32 to the data pointer.
as of recently, the same thing applied to pallet data, in which both are fixed now.

EDIT:
btw, I found out another use for the low poly model aside from shadows:

^take a look in the magnifying glass

thank you Revel8n

 

[Achilles1515]

I'm the biggest dunce.
all this time, Pichu had a black and green body because I forgot to add 32 to the data pointer.
as of recently, the same thing applied to pallet data, in which both are fixed now.

EDIT:
btw, I found out another use for the low poly model aside from shadows:

^take a look in the magnifying glass

thank you Revel8n

Last picture is too small.

Tcll, it’s obvious what you’re doing is amazing, but what does this actually mean in terms of Melee hacking? Something like taking a Lanky Kong model and replace DK’s model with it super easily? I’ve just been a little confused as to what the actual application of the program can provide. Can you provide some examples? Once your program is totally working, what will be the first Melee hack you do with it?

 

[Tcll]

it's name says everything it's meant to do
it should make things easy to convert models to whatever format you need

once UMC is able to export a HAL-formatted model and import MDL0 models w/o any flaws, my first hack I'd like to do would be Pachirisu over Pichu.

of course, you'd need to make sure the bone structure and everything is ready for conversion to HAL format.

to answer a lingering Q:
"Why did I go through the trouble of writing my own program instead of using what's existing?"
sum of answers:
- I hate 3DS's UI, it's too messy and cluttered
- I love Blender, but as of Blender25, writing scripts has gotten unbearably complex. (UMC 3.0a can now boast ~63% less code needed than a Blender25 script)
- no other program handles and modifies model data as easily as UMC was meant to (custom data structures and automation)
- unlike other 3D programs, UMC is designed for noobs to help teach them aspects of 3D programming by writing scripts

there's more reasons, but I'm not recalling them atm

EDIT:

Last picture is too small.

click on it to expand it

 

[Achilles1515]

it's name says everything it's meant to do
it should make things easy to convert models to whatever format you need

once UMC is able to export a HAL-formatted model and import MDL0 models w/o any flaws, my first hack I'd like to do would be Pachirisu over Pichu.

of course, you'd need to make sure the bone structure and everything is ready for conversion to HAL format.

to answer a lingering Q:
"Why did I go through the trouble of writing my own program instead of using what's existing?"
sum of answers:
- I hate 3DS's UI, it's too messy and cluttered
- I love Blender, but as of Blender25, writing scripts has gotten unbearably complex. (UMC 3.0a can now boast ~63% less code needed than a Blender25 script)
- no other program handles and modifies model data as easily as UMC was meant to (custom data structures and automation)
- unlike other 3D programs, UMC is designed for noobs to help teach them aspects of 3D programming by writing scripts

there's more reasons, but I'm not recalling them atm

EDIT:

click on it to expand it

Okay, I trust that it will be revolutionary. There's nothing to expand on the picture. I click and nothing happens.

 

[Tcll]

There's nothing to expand on the picture. I click and nothing happens.

huh, it's supposed to do this:

the image is shrunk by the forum, copy the link to view the full size

EDIT:
@ Achilles1515 if you need me to make a thumbnail, I can upload the image to Picasa and post multiple sizes if needed

if you're confused as to what I mean, here's an example using the image above:

I can even crop:

no I did not upload multiple images, feel free to edit the URL if you think I'm bluffing