Super Smash Bros. 64 Frame Data & Info

[Karajan]

You mean the addresses for the frame counter or the moveset? It's kinda complicated, what method would you like me to use as far as posting addresses? I could post addresses for specific levels or post the pointers + offsets, but I know most people here don't know how to work with pointers. If you would like me to post addresses for a specific level and player, let me know. The frame counter for shield and jump delay are the same address, for some reason the shield is in integer format while jumping delay is in floating point. So I just switch between dec and hex on cheat engine, depending on what I'm looking at.

For Hurtbox data, I haven't fully documented the addresses but I know the general location and can easily write down the rest of them. Lol I just found them by spamming 0's in memory editor xD.

For moveset frame counter, i've only found an address that displays the attack duration of the last attack you did, but modifying the number won't change anything, unlike the address I found for shield drain count / jump delay. I still need to find the others as well. I'm confused why the attack duration shows 40 for Link's Aerial Back A, yet on the chart in this thread it says 38. I'll prolly double check to make sure it's not because of any modifications I did.

It would be nice to have an entire memory map of the ROM documented somewhere, to make it easier for people to make hacks in the future. This game lacks an active hacking community, unlike SM64, LoZ:OOT, FFVII, and countless NES and SNES games

 

[Madao]

It would be nice to have an entire memory map of the ROM documented somewhere, to make it easier for people to make hacks in the future. This game lacks an active hacking community, unlike SM64, LoZ:OOT, FFVII, and countless NES and SNES games

So I'm guessing you want the pointers then because the addresses change based on the player, stage, and mode. I'm confused because idk if my emulator is bugged but simply switching savestates changed the addresses for some of the frame counter stuff for attack duration, yet on a different emulator it didn't change when I switched savestates or exited and restarted the emulator. So I'm not sure if I'll be able to post some of the frame counting addresses, I'll do more testing and searching today though.

Hacking will be very difficult unless someone is able to decompress the game. I tried finding the original addresses for data, but no luck so far, due to compression and self modifying code. I'll need more knowledge and experience before I'm able to find the original addresses for data.

All I can do so far is know where the temporary addresses are for data while I'm in a match. The only hacking I'd be able to do is make gameshark codes / use cheat engine, so nothing permanent.

What I'll try to do is just write down pointers and offsets for the stuff I've found so far, and also breakpoints so other people can test or find data.

So I carefully started debugging and am now starting to understand the moveset data more. Now I can measure when the hitbox starts and when it ends. The chart in this thread is not 100% accurate. I have been testing Link and already see differences. It would take me a while to map out every move, and idk if I will bother doing the whole thing. I'll first focus on finding the pointers and breakpoints. Then I may make a script to make data collecting much quicker.

 

[Madao]

Well I took a break, but might as well post my recent findings before I take another break.

So I decided to write down addresses and offsets for important things. Firstly, anyone who is interested in exploring data should know about pointers. A pointer is a variable that stores the address of another variable. Pointers are good to know so that you can find where data is, regardless of what stage you are on. I will use Training Mode Dream Land playing as Player 1 Fox for the examples, since it's a good level and Toomai's moveset addresses are for that stage.

The address for Player 1's pointer = 80130D84. In Training Mode Dream Land using Fox as Player 1, 80130D84 points to 8027E928. So what you do is you add the offset of the variable you are trying to look at to 8027E928.
For example the address for Player 1's Hp = 8027E928 + 2C = 8027E954
Player 1's Shield = 8027E928 + 34 = 8027E95C
[collapse="Player Stat Address Offsets"]
002C = Health (2 Bytes)
0034 = Shield (4 Bytes)
0048 = X-Velocity (Float)
004C = Y-Velocity (Float)
0060 = Movement Speed on Ground (Float)
014B = Current Number of Jumps (4 Bytes)
014C = Player is in Air Flag (1 Byte)
01B0 = Controller Input Pointer (4Bytes)
039C = Something to do with Attack Hitbox (4 Bytes)
05AC = HurtBox State (4 Bytes)

05BC = HurtBox State for Lower Stomach (4 Bytes)
05C0 = HurtBox ID for Lower Stomach (4 Bytes)
05C4 = Pointer Address for Lower Stomach Hurtbox (4 Bytes)
05D0 = X Location of Lower Stomach Hurtbox (Float)
05D4 = Y Location of Lower Stomach Hurtbox (Float)
05D8 = Z Location of Lower Stomach Hurtbox (Float)
05DC = Width of Lower Stomach HurtBox (Float)
05E0 = Length of Lower Stomach HurtBox (Float)
05E4 = Height of Lower Stomach HurtBox (Float)

05E8 = HurtBox State for Head (4 Bytes)
05EC = HurtBox ID for Head (4 Bytes)
05F0 = Pointer Address for Head Hurtbox (4 Bytes)
05FC = X Location of Head Hurtbox (Float)
0600 = Y Location of Head Hurtbox (Float)
0604 = Z Location of Head Hurtbox (Float)
0608 = Width of Head HurtBox (Float)
060C = Length of Head HurtBox (Float)
0610 = Height of Head HurtBox (Float)

0614 = HurtBox State for Upper Right Arm (4 Bytes)
0618 = HurtBox ID for Upper Right Arm (4 Bytes)
061C = Pointer Address for Upper Right Arm Hurtbox (4 Bytes)
0628 = X Location of Upper Right Arm Hurtbox (Float)
062C = Y Location of Upper Right Arm Hurtbox (Float)
0630 = Z Location of Upper Right Arm Hurtbox (Float)
0634 = Width of Upper Right Arm HurtBox (Float)
0638 = Length of Upper Right Arm HurtBox (Float)
063C = Height of Upper Right Arm HurtBox (Float)

0640 = HurtBox State for Upper Right Arm (4 Bytes)
0644 = HurtBox ID for Upper Right Arm (4 Bytes)
0648 = Pointer Address for Upper Right Arm Hurtbox (4 Bytes)
0654 = X Location of Upper Right Arm Hurtbox (Float)
0658 = Y Location of Upper Right Arm Hurtbox (Float)
065C = Z Location of Upper Right Arm Hurtbox (Float)
0660 = Width of Upper Right Arm HurtBox (Float)
0664 = Length of Upper Right Arm HurtBox (Float)
0668 = Height of Upper Right Arm HurtBox (Float)

066C = HurtBox State for Upper Left Arm (4 Bytes)
0670 = HurtBox ID for Upper Left Arm (4 Bytes)
0674 = Pointer Address for Upper Left Arm Hurtbox (4 Bytes)
0680 = X Location of Upper Left Arm Hurtbox (Float)
0684 = Y Location of Upper Left Arm Hurtbox (Float)
0688 = Z Location of Upper Left Arm Hurtbox (Float)
068C = Width of Upper Left Arm HurtBox (Float)
0690 = Length of Upper Left Arm HurtBox (Float)
0694 = Height of Upper Left Arm HurtBox (Float)

0698 = HurtBox State for Lower Right Arm (4 Bytes)
069C = HurtBox ID for Lower Right Arm (4 Bytes)
06A0 = Pointer Address for Lower Right Arm Hurtbox (4 Bytes)
06AC = X Location of Lower Right Arm Hurtbox (Float)
06B0 = Y Location of Lower Right Arm Hurtbox (Float)
06B4 = Z Location of Lower Right Arm Hurtbox (Float)
06B8 = Width of Lower Right Arm HurtBox (Float)
06BC = Length of Lower Right Arm HurtBox (Float)
06C0 = Height of Lower Right Arm HurtBox (Float)

06C4 = HurtBox State for Lower Left Arm (4 Bytes)
06C8 = HurtBox ID for Lower Left Arm (4 Bytes)
06CC = Pointer Address for Lower Left Arm Hurtbox (4 Bytes)
06D8 = X Location of Lower Left Arm Hurtbox (Float)
06DC = Y Location of Lower Left Arm Hurtbox (Float)
06E0 = Z Location of Lower Left Arm Hurtbox (Float)
06E4 = Width of Lower Left Arm HurtBox (Float)
06E8 = Length of Lower Left Arm HurtBox (Float)
06EC = Height of Lower Left Arm HurtBox (Float)

06F0 = HurtBox State for Upper Right Leg (4 Bytes)
06F4 = HurtBox ID for Upper Right Leg (4 Bytes)
06F8 = Pointer Address for Upper Right Leg Hurtbox (4 Bytes)
0704 = X Location of Upper Right Leg Hurtbox (Float)
0708 = Y Location of Upper Right Leg Hurtbox (Float)
070C = Z Location of Upper Right Leg Hurtbox (Float)
0710 = Width of Upper Right Leg HurtBox (Float)
0714 = Length of Upper Right Leg HurtBox (Float)
0718 = Height of Upper Right Leg HurtBox (Float)

071C = HurtBox State for Upper Left Leg (4 Bytes)
0720 = HurtBox ID for Upper Left Leg (4 Bytes)
0724 = Pointer Address for Upper Left Leg Hurtbox (4 Bytes)
0730 = X Location of Upper Left Leg Hurtbox (Float)
0734 = Y Location of Upper Left Leg Hurtbox (Float)
0738 = Z Location of Upper Left Leg Hurtbox (Float)
073C = Width of Upper Left Leg HurtBox (Float)
0740 = Length of Upper Left Leg HurtBox (Float)
0744 = Height of Upper Left Leg HurtBox (Float)

0748 = HurtBox State for Lower Right Leg (4 Bytes)
074C = HurtBox ID for Lower Right Leg (4 Bytes)
0750 = Pointer Address for Lower Right Leg Hurtbox (4 Bytes)
075C = X Location of Lower Right Leg Hurtbox (Float)
0760 = Y Location of Lower Right Leg Hurtbox (Float)
0764 = Z Location of Lower Right Leg Hurtbox (Float)
0768 = Width of Lower Right Leg HurtBox (Float)
076C = Length of Lower Right Leg HurtBox (Float)
0770 = Height of Lower Right Leg HurtBox (Float)

0774 = HurtBox State for Lower Left Leg (4 Bytes)
0778 = HurtBox ID for Lower Left Leg (4 Bytes)
077C = Pointer Address for Lower Left Leg Hurtbox (
0788 = X Location of Lower Left Leg Hurtbox (Float)
078C = Y Location of Lower Left Leg Hurtbox (Float)
0790 = Z Location of Lower Left Leg Hurtbox (Float)
0794 = Width of Lower Left Leg HurtBox (Float)
0798 = Length of Lower Left Leg HurtBox (Float)
079C = Height of Lower Left Leg HurtBox (Float)

0864 = Camera Zoom (Float)
09C8 = Pointer Address for Character Stats (4 Bytes)
0B1C = Frame Counter for Shield & Jump Delay (4 Bytes)
1BF2 = Something to do with Dying (2 Bytes)
[/collapse]

[collapse="Character Stat Address Offsets"]
20 = Walking Speed Multiplier [Usually Multiplies with 80] (Float)
24 = Brake Force (Float)
28 = Initial Dashing Speed (Float)
2C = Dash deceleration (Float)
30 = Max Running Speed (Float)
34 = Frame delay before jumping (Float)
38 = Starting X-Air Velocity Multiplier after moving before 1st jump (Multiplied by 80)
3C = Jumping Height Multiplier (for both jumps) (Float)
40 = Jumping Height Variable (for both jumps) (Float)
44 = Starting X-Air Velocity Multiplier after moving before 2nd jump (Multiplied by 80)
48 = Multiplier for 2nd Jump (Float)
4C = X-Air Acceleration (Float)
50 = X-Air Maximum Speed (Float)
54 = X-Air Resistance (Float)
58 = Fall Speed Acceleration (Float)
5C = Maximum Falling Speed (Float)
60 = Maximum Fast Fall Speed (Float)
64 = Number of Jumps (4 Bytes)
68 = Weight (Float)
6C = Small combo connection F (Float)
70 = Dash traveling connection F (Float)
74 = Shield Radius (Float)
[/collapse]

I'll give a few examples. Since 8027E928 is the starting address for Player 1 info, if you want to find the character data, you add 9C8 to 8027E928 which = 8027F2F0.
8027F2F0 points to 802F7A8C. 802F7A8C is the starting address for Character Stats.
Walking speed = 802F7A8C + 20 = 802F7AAC

Also I tried finding out how hitboxes work and also getting them to show, without relying on savestates. First of all, how do I get it to show the hit boxes where it only shows the edges of the boxes instead of just showing red rectangles? It's unfortunate I have to rely on PJ64 for hitbox data since I rely on savestates. Anyway, I found the color values for hurt boxes if anyone wants to do a ram search. Just do a 4 byte hex search. D0D000FF = Yellow, 00D000FF = Green, 0000D0FF = Blue. Maybe the next time I get into it, I'll do some hitbox testing.

Well if anyone would like to help, I'd appreciate it. It would be nice to make a program that can display frames of any attack. It's not too difficult aside from collecting the pictures tbh.

 

[mixa]

how do I get it to show the hit boxes where it only shows the edges of the boxes instead of just showing red rectangles?

Do you mean this?

If yes, the way it works for me is: If I use the video plugin Glide, it'll show red rectangles, if I use Jabo's (Direct3D8 1.6), it'll show like in the picture.

 

[Madao]

Do you mean this?

If yes, the way it works for me is: If I use the video plugin Glide, it'll show red rectangles, if I use Jabo's (Direct3D8 1.6), it'll show like in the picture.

Oh thanks. I forgot I had used Jabo's (Direct3D8 1.6), but I didn't realise I messed with the graphics settings so I didn't like using it for Smash Bros.

Now I just need to figure out how to display hitbox whenever I want, since I don't like being forced to test things on PJ64. Also I don't like the background in Mario's BtT Stage. You guys think screenshots of the hitboxes would look better if you made the background black?

 

[Sangoku]

8027F2F0 points to 802F7A8C

How do you know what points to what? I mean does it change for everything or is there a simple rule (like adding something)?

Just do a 4 byte hex search. D0D000FF = Yellow, 00D000FF = Green, 0000D0FF = Blue.

How to search for it? I go in Cheat engine, do a 4 byte search, then what do I do?

I would like to help, but I'm seeing I really don't understand a thing about what is going on so I have no idea how I can catch up. The links you gave me above are really no help for noobs, sorry.

Edit: the best background would be dreamland IMO. If you can apply this to the ROM (or tell me how to have it in mupen otherwise) I will help making the screenshots.

 

[mixa]

the best background would be dreamland IMO

I agree with that. And I think a black background would give less perspective on the attack's range/size because you'd only have the character to compare it with.

 

[Madao]

How do you know what points to what? I mean does it change for everything or is there a simple rule (like adding something)?

How to search for it? I go in Cheat engine, do a 4 byte search, then what do I do?

You have to look at the addresses in memory to find where it points to. For pointers, you will see the address of the variable. For example on dreamland stage in training mode, using Fox for player 1, the 4 byte value of 80130D84 (Player 1's pointer to player data) will be in hex 8027E928. I guess it's confusing if you use an emulator like mupen or PJ64 since the addresses change a lot. I guess mentioning the N64 addresses won't do people much good, since most of you just use cheat engine rather than an internal memory editor. For cheat engine, you would need to convert the addresses using the emulator's offset. If you know the address for hp or shield, you can still use my offset chart. For example, lets say on mupen, the address for Player 1's hp is 1029E954, the address for shield would = 1029E954 + 8 = 1029E95C. Maybe I'll try and make a giant cheat engine table of addresses for Mupen if I am able to figure out how to deal with its address constantly changing.

I did the color search to see if I can trace how the hurtbox display works. Just like most of the frame counting addresses, the addresses for hurtbox colors seem to change even when I restart emulator lol. Problem with the color search is that I'm not sure you will find it, unless you're using that hitbox savestate. If you are using that savestate, then you just do a 4 byte hex search and type in the hex value of the current color (D0D000FF = Yellow, 00D000FF = Green, 0000D0FF = Blue). When you narrow down the search, you should see the addresses for the color of each body part.

I would like to help, but I'm seeing I really don't understand a thing about what is going on so I have no idea how I can catch up. The links you gave me above are really no help for noobs, sorry.

Edit: the best background would be dreamland IMO. If you can apply this to the ROM (or tell me how to have it in mupen otherwise) I will help making the screenshots.

Well it depends on what you are trying to do. I'd say the best way to learn is to just use nemu to debug code. For example, finding formulas is pretty easy, provided you have some experience setting breakpoints. Should I post some examples of formulas? Maybe that will help. I can post the assembly code of and explain step by step what happens.

I've been trying to get the gameshark codes to work on other emulators. The only thing I've been successful at is being able to load the BtT stage, but the hitbox code isn't activated. So I tried comparing data, then copying and pasting, but it would make the game either freeze or glitch up.

I might be able to make the program, I'll just need to read up on winapi for displaying pictures and implementing a slider.

I guess what I'll focus on is exploring hitbox data and trying to get the gameshark code to work.

Which version of Mupen should I use? I tried Mupen Plus and I couldn't even run it lol.

Well... Lesson learned. I need to read instructions carefully lol. I finally was able to do the hitbox glitch, but it only works on BtT Mario stage, so I need to do more testing.