SSB64 Gameshark Texture Swap

[novakain]

Duuuude! Fresh off the plane, konnichiwa. First-time post here.

I'll just dive right into it. A couple weeks ago, the N64 gameshark 3.3 I ordered arrived, and of course the first cheats I entered were the SSB64 stage modifiers that allow you to play on Battlefield and Metal Mario's stage. Everyone knows these cheats and they're great, but I feel they aren't enough. What I want is to change the actual Stage Select screen so that, (for example) if I replace Planet Zebes with Battlefield, instead of the Zebes background showing up, it's the Battlefield background, and furthermore, it loads a mini version of Battlefield in the preview box on the bottom-left instead of Planet Zebes. I couldn't find any such codes online, so I decided to flex my very rusty GS hacking muscles and try to find a code myself (seriously, the last time I tried something like this was more than 10 years ago...in elementary school). Using Cheat Engine, PJ64 2.1, and the rerecording Mupen (the TASing one), I actually made some progress. To clarify, I'm not talking about texture hacking here, I just want to swap a couple image files (or really just the pointers to them). Here's what I got.

I traced the following relevant variables through the code. These values are for SSB (U) on Mupen, not actual memory addresses on the cartridge. More on that later.

00A20658 (runs from 0-9; is 0 when the cursor/red box is over Peach's Castle, 9 when it's over Random)
012ABFE0 (where this is defined the disassembled code, replace the memory swap with an NOP)
0092F69C
012AC008
012AC018
[012ABFE8
[0092F644 (both these variables seem to contain the value for every texture that the game loads at some point)
012AC000

I'd like to draw attention to 0092F644. Using TAS Mupen in Cheat Engine, go to the Stage select screen, and pause the game. Input a direction (to change the stage) and advance one frame. On cheat editor, select Add Address Manually and add 0092F644. Then right click on it and select "Check what accesses this address" or whatever it's called. Go back to Mupen and advance one more frame. Four lines should pop up. Right click on the second one and select "View in Disassembler", and replace the line of code with "mov eax,8015BD68". Go back to Mupen, unpause it, and move arouond the stage select screen. You will a lot of "Sector Z" where other images should be.

To me, this means that at that particular line of code, the value for the next texture to be loaded passes through. So I got all excited, and went to make a cheat for it, which is a difficult process because Mupen doesn't support gameshark. So i had to find where 0092F644 is located in PJ64 (Pretty sure it's 4C683BC4) and then I had to find the actual cartridge memory. The bytes don't line up perfectly but it seems to be about 277442. I then made the following cheat.

D1277444 BD68 (If the least two significant bytes are equal to BD68)
81277444 BFA8 (Change them to BFA8)

I never really explained those values. You can get the (address value? I don't think so but maybe) image identifier from the formula 504+576n+0x8015B930, where n is the decimal value of the stage modifier. Sector Z is 1, which yields 8015BD68, and Congo Jungle is 2, which yields 8015BFA8.

In any case, the code didn't work. It's possible I got the address wrong (I did have to change it twice, from Mupen to PJ64 and PJ64 to actual), but my bigger fear is that the Gameshark doesn't update values fast enough. After all, this all takes place in less than one frame.

So my questions for the Smashboards community are:
1. How exactly does the Gameshark work, and what are its limitations?
2. Has someone already succeeded in making a texture swap code and its just not well publicized?
3. If not, can someone more knowledgeable than me finish what I started so I don't have to keep doing it?

Thanks, and sorry for TL;DRness

EDIT: Cheat Engine, not Cheat Editor lol. Also if my instructions don't make sense, just ignore them I guess

 

[Skrlx]

@NovaSmash

twinz

 

[Madao]

Unfortunately, you have more knowledge about this stuff than most people here. I recommend that you learn MIPS assembly if you haven't already. Once you know MIPS, you should use Nemu for debugging.

Is your goal to be able to do this on console? If not, then I recommend you just patch the rom. If you want to do this on console, then you should find a better coding method. Instead of freezing values that change very fast, you should just do ASM hacks to alter the game mechanics. I'll give it a shot, but I can't promise I'll find anything. In the meantime, check my out gameshark thread for unique codes you won't find anywhere else .

Idk gamesharks limitations, but I imagine gameshark works differently on emulator compared to the real thing.

Edit: you definitely put the wrong addresses. I recommend you use an offset calculator tool! I believe I found the correct n64 address, although you won't be able to freeze the value. 80043BC4

 

[novakain]

@ Madao ,
You're right, I was looking at the wrong sheet of paper (one my several prior failed attempts lol). I got 43BC4 too. Ultimately what it boils down to is, it's not necessary to freeze the value if I could set the lines of code that read from 43BC4. Problem is, at least on emulator, the addresses of individual lines of code vary each time you open it up, and anyway I don't know if the GS could even modify them. If I knew how to do it though I'd probably have a working cheat by tonight.
Also I've used your GS codes before, am a big fan. I've never seen spawn coordinate cheats anywhere else.

@ Skrlx , your signature message or whatever (the thing at the bottom) cracked me up. So true

 

[Madao]

Well, I got bad news. I was able to mess around in Memory Editor with Nemu, but I found out that values like 8015BFA8 was loaded via DMA. This means that it will be difficult or even impossible to make a gameshark code for. I've never found a way to deal with DMA, other than patching the rom, but that limits you to emulator only. Another problem I ran into is that it only effected the stage name and icon on the right side. The stage preview didn't change at all.

I remember a while ago, I tried to do a real stage swap code, but my problem was that the stage preview made the game glitch out. In the meantime, I will try seeing what I can do about the stage preview.

When you say "the addresses of individual lines of code vary each time you open it up", are you talking about the addresses in cheat engine? If so, then it depends on the emulator you use. PJ64 is weird and has dynamic addresses. Most other emulators have static addresses (Nemu, 1964, Mupen-rr).

 

[novakain]

Hm. I'm not really familiar with DMA, but what I mean by the addresses of individual code lines is something like this:
0092F644 (43BC4) is the actual value being changed (in Mupen rr), but
0F7862B3 is the address of the code that writes it.
But if I close Mupen and start it again, it might be 1060CA79, or something different.
As for the stage preview, I have some ideas about that. I can already do some things to it, like changing the size. I would imagine the method for loading it is a bit different and doesn't run through 43BC4.

 

[Madao]

When I say DMA, I mean that the numbers are loaded from the ROM data and not RAM data. Idk if hardware gamesharks can mess with ROM data, but emulator gameshark certainly cannot afaik.

Well, let me know when you find the location for the stage preview. If I can change that, then I should be able to do a stage swap rom patch. I'm guessing you also use a gameshark code to freeze the stage value? So that you can play in battlefield stage.

I think I know what you're talking about now, when you say the address keeps changing. Certain parts of the emulator will use dynamic addresses regardless of emulator. Nothing you can really do, other than maybe find pointer addresses for them. I remember how some of my frame counting variables would change everytime I restart emulator. Do you know x86 assembly? If so, you can use cheat engine to figure stuff out.

 

[novakain]

Well, I didn't know assembly two weeks ago, but I learned a ton through this process. If I could find a constant pointer to the relevant functions, I'd be off to the races. I'll try that next. Thanks a lot for your help, I'll update when I make more progress.

 

[novakain]

HUGE breakthrough. Get hyped

 

[Madao]

What did you figure out ?

 

[novakain]

I have codes for swapping stage name and logo with any image, working on background and stage preview. I'll post when I have those.

 

[KnitePhox]

there are code limits depending on how much RAM you are using on console. each code has a value in terms of the limit. the limit is like 250 or 251 with RAM expansion, cuz of master codes. codes that start with 800xxxx have a value of 1 for the limit and ones that start with 810xxxxx have a different limit as well as all others not listed here, if people want a ****load of codes at pnce we're going to have to find a different method such as using a flashcart to load a modded rom or if such a flashcart isn't as limited to same active code amounts, use that flash carta built in gameshark. im on mobile and can't hit return/enter to space this out. interesting stuff d00d

 

[novakain]

I'm on a roll. Found the stage pointer, should have all codes by tmrw (Sun.)

EDIT: @ KnitePhox : Also the codes are pretty minimal so I don't think there should be an issue

 

[novakain]

Alright folks. I'm not quite done yet, but here's a little appetizer before the main course is dished out. Pop this bad boy into your console gameshark and check out Planet Zebes.

D11344FE 0101
811344FE 010C

EDIT: Feel free to close this thread now, I made a new thread with the codes