Hacking .hack//Infection (How to make Skeith spawn anywhere)

Xu Yuan · Post by **Xu Yuan** » Fri Jul 24, 2015 12:31 pm

Hmm? Weapons that are not of their original class should load just fine, otherwise my "change class" mods would be completely worthless, hehe.

I am glad to see someone picking up this project though! I hope my notes have been of some use and I would love to see what notes you have accumulated as well!

Slip · Post by **Slip** » Fri Jul 24, 2015 2:08 pm

I'm honestly surprised you saw the post I made considering this topic has been so inactive. Heh.
To make the weapon models load fine, do I have to change the class too? You can equip weapons from other classes by changing int16 [ 0x20A46F20 ] Kite's Current Weapon. The models just don't appear visible.

My notes atm are currently very disorganized (as I have so many things to write about, including addresses of where things are, OPCodes, pointers, and data structures). Once I get enough notes to be proud of, I'd be happy to share them. It's just going to be huge xD.

I really love this game, and one of the things I want to be able to do is keep Kite's original green model, instead of using the red one.

but I've had trouble with doing everything via RAM editing through CE, I'm not advanced enough to go into the files and edit things yet.

Edit (this only works if you edit a certain memory value at the very beginning of the storyline):

Xu Yuan · Post by **Xu Yuan** » Fri Jul 24, 2015 7:17 pm

Despite not replying as much these days I am still very much a lover of dot hack and I cheer on anyone else who still is! It has been too long now since CCCorp threw anything our way to hope upon. Like you though I love this series and the first four games (more like.. //Infection is easily moddable) are so easy to mold due to still having their tags attached to them. (Which shows that all four games are in just //Infection!! -cutscenes and certain extras)

Have you seen my notes? I consider those to be rather disorganized as well.

NCDyson was doing great work here and I believe he figured out what you were having issues.

http://www.dothackers.net/forums/viewto ... 39#p467838

As to your question, yes. Changing a class will automatically change the held weapon to the corresponding weapon as per class. So changing Kite from a Twin Blade to a Heavy Blade will automatically put the Kikuichimonji in his weapon slot. But until you reload the area (or equip a different weapon) the weapon displayed will still be the one you started with.

Slip · Post by **Slip** » Fri Jul 24, 2015 8:27 pm

Xu Yuan wrote:Despite not replying as much these days I am still very much a lover of dot hack and I cheer on anyone else who still is! It has been too long now since CCCorp threw anything our way to hope upon. Like you though I love this series and the first four games (more like.. //Infection is easily moddable) are so easy to mold due to still having their tags attached to them. (Which shows that all four games are in just //Infection!! -cutscenes and certain extras)

Have you seen my notes? I consider those to be rather disorganized as well.

NCDyson was doing great work here and I believe he figured out what you were having issues.

http://www.dothackers.net/forums/viewto ... 39#p467838

As to your question, yes. Changing a class will automatically change the held weapon to the corresponding weapon as per class. So changing Kite from a Twin Blade to a Heavy Blade will automatically put the Kikuichimonji in his weapon slot. But until you reload the area (or equip a different weapon) the weapon displayed will still be the one you started with.

I have a full copy of your notes (as seen on page 7, read every last page of and post here), those notes were extremely helpful in finding certain points in the data (as reading through all of the RAM would be an incredibly long process and would probably yield low amounts of results due to seeing a bunch of jibberish, such as the Event Data which I'm currently splicing through now)

Love your work here, I just don't understand everything you posted about (such as spawning Skeith, which is a very intriguing thing all in itself. I do understand how to change what spawns in an area though, using the basic monster list, ofc.)

NCDyson's note there simply stated what the model names were, and as I have no knowledge of how to edit the images from inside the data.bin I cannot just copy ctu1body to ctu1bodyc1. I can, however, view some images using .hackPics, and the link to the other image viewer is broken so there is no finding that anywhere. Heh. I am determined to figure this all out though.

As for events and how they act inside the little bundles of commands that are "cutscenes/tutorials", I've found this much out by staring and testing on a Save State for the past 2 hours.

Code: Select all

** Reference Data: Event TBL ** 
	Scripts:
		
		Commands:
			00 00 - NOP
			
			02 00 - 
			05 00 - Yield
			AA AA
			A = Frames
			
			06 00 - Play Message
			AA AA
			A = Message ID
			
			Note: Some messages cannot be played on certain menus, or scenes, due to differences in handling.
			
			0B 00 - Load Character Model
			AA BB BB CC CC DD DD
			A = Model List
			B = Model ID
			C = Orientation
			D = Behavior
			
			10 00 - ???
			
			12 00 - Set GUI Mode
			AA AA BB BB CC CC DD EE
			
			28 00 - Set Camera
			AA AA BB BB CC CC DD DD EE EE FF FF
			A = X Rotation
			B = Z Rotation
			C = Y Rotation
			D = Camera Position - X
			E = Camera Position - Z
			F = Camera Position - Y
			
			2A 00 - ???
			
			29 00 - Delta Camera
			AA AA BB BB CC CC DD DD EE EE FF FF GG GG HH HH
			G = X Rotation Speed
			H = Y Rotation Speed
			
			30 00 - Focus Camera
			AA AA BB BB CC CC DD EE FF FF
			A = Type of Character
			B = Character #
			C = Height Offset
			D = Y rotation
			E = X Rotation
			F = X Distance (Don't ask me why this was done the way it was.)
			
			3C 00 - Warp in Character
			AA AA BB BB
			A = Who?
			
			41 00 - [IMPORTANT] Handles Sound Loading?
			AA BB CC DD EE FF GG HH
			
			50 00 - Receive Member Address
			AA AA
			A = Party Member
			
			5B 00 - ???
		
			
	Models:
		00 - Kite (When loaded in event, prevents Kite's character from loading)
		01 - Mia
		02 - Orca
		03 - Marlo
		04 - Sanjuro
		05 - Nuke Usagimaru
		06 - Balmung
		07 - Moonstone
		08 - Piros
		09 - Wiseman
		0A - Elk
		0B - Natsume
		0C - Rachel
		0D - Gardenia
		0E - Terajima Ryoko
		0F - BlackRose
		10 - Mistral
		11 - Helba
		12 - Out of Bounds. FILE NONE
		
	Orientations:
		00 - Center
		01 - Bottom Right
		02 - Bottom Left
		03 - Center Right
		04 - Center Left
		05 - Center Bottom
		06 - Center Top
		07 - ???
		
	Anim: 
		00 - Warped in Running. - Acts like an NPC. "Guess I'll store some stuff."
		01 - Spawned Running. - Acts like an NPC
		02 - Invisible. [OK]
		03 - Invisible. [OK]
		04 - Warp in Standing.
		05 - Spawn Standing.
		06 - Invisible. [OK]
		07 - Invisible. [OK]
		08 - Warped in Running. - Acts like an NPC.
		09 - Warped in Running. - Acts like an NPC.
		0A - Warped in Running. - Acts like an NPC.

One of my other goals is to make a ROM hack of the entire game, rewriting it from the base story up. Really long process, but I Really want to learn this.

Xu Yuan · Post by **Xu Yuan** » Fri Jul 24, 2015 9:21 pm

Oy, event editing... I know that pain. It was only during my second pass through events that I realized that instructions were of variable length, now let's see if I actually wrote what those variable lengths presumably were...

The original games are rather strange, and this may be the case for PS2 games in total, but those files names are not just file names, changing them has profound effects, hence why changing some labels can go as far as to change the current character you're playing as. Granted that's in ISO rather than RAM.

Though an easier way to stay default Kite is to erase the code that gives Kite the new palette. It would also erase Data Drain though.

Do you have PS2dis? That helped me an absolute ton in identifying much of the files I came across.

Now that is a snazzy looking Command index you have there! I did something similar as I'm sure you're aware on Page 8 and spawning Skeith (or any phase) is actually very simple. It's the same concept as summoning any other NPC through an event.

Hrmm... I noticed that all of my notes on Event Progress appears to have been lost. I thought I revisited the concept, but... maybe I didn't? Oh well.

Slip · Post by **Slip** » Fri Jul 24, 2015 9:48 pm

Xu Yuan wrote:Oy, event editing... I know that pain. It was only during my second pass through events that I realized that instructions were of variable length, now let's see if I actually wrote what those variable lengths presumably were...

The original games are rather strange, and this may be the case for PS2 games in total, but those files names are not just file names, changing them has profound effects, hence why changing some labels can go as far as to change the current character you're playing as. Granted that's in ISO rather than RAM.

Though an easier way to stay default Kite is to erase the code that gives Kite the new palette. It would also erase Data Drain though.

Do you have PS2dis? That helped me an absolute ton in identifying much of the files I came across.

Now that is a snazzy looking Command index you have there! I did something similar as I'm sure you're aware on Page 8 and spawning Skeith (or any phase) is actually very simple. It's the same concept as summoning any other NPC through an event.

Hrmm... I noticed that all of my notes on Event Progress appears to have been lost. I thought I revisited the concept, but... maybe I didn't? Oh well.

You did write some notes about the events, they were included in your set that you posted on the 7th page. You thought they were all 4 bytes, but through testing it is clear that each event type has a different amount of arguments it can have, though most arguments are only 2 bytes in length each making it rather uniform during testing.

To test the length of an event, just use the good ole' 6th command (Display Dialogue), if it doesn't display, that's where an argument should be.

Hmm, Not just filenames? Perhaps internally there are the filenames called by the I/O system, then there is an additional set of pointers for each filename written in the game's code?

In RAM format, changing models is very difficult (and feels somewhat impossible) because when you switch rooms it'll re-read the ISO over that same section and rewrite your changes on the model filenames / etc. Making it reset to the same model everytime. Editing through the ISO would probably make it much easier to keep changes.

I've been thinking that perhaps there is an integer that controls the progression of the story, that increments each time a new event is completed. Once that value is > a certain value, it loads Palette B over Palette A, in which case... you could patch an OP Code to choose Palette A regardless. Though I haven't found much evidence for that.

PS2dis? Never heard of it. I'll take a look into it.

I'll take a look back into your notes on Page 8

thank you.

Event Progression... hmm, how I think I would do it if I was a programmer:

Code: Select all

startingPointer = 0x003180E0
eventCompleted = false
eventcmds = {
 [ 0x00 ] = { {} , function () end },
 [ 0x0B ] = { {1,2,2,2} , function ( A , B , C , D ) LoadModel(List[A],ID[B],Orientation[C],Behavior[D]) end }
}
progressionOffset = 0x0
while eventCompleted == false do
	cmd = read2ByteInteger(startingPointer+progressionOffset)
	if eventcmds[cmd] ~= nil then
		cmde = eventcmds[cmd]
		arguments = {}
		argumentOffset = 0x0
		for i=1, #cmde[1] do
			if cmde[1][i] == 1 then
				arguments[i] = readByteInteger(startingPointer + progressionOffset + 0x2 + argumentOffset)
				argumentOffset = argumentOffset + 0x1 
			elseif cmde[1][i] == 2 then
				arguments[i] = read2ByteInteger(startingPointer + progressionOffset + 0x2 + argumentOffset)
				argumentOffset = argumentOffset + 0x2
			end
		end
		cmde[2](unpack(arguments))
	else
		progressionOffset=progressionOffset + 0x2
	end
end

Edit: looked at PS2dis, have no clue how to use. I use .iso files for PCSX2.

Xu Yuan · Post by **Xu Yuan** » Fri Jul 24, 2015 10:17 pm

It's kind of odd, I can read hex and ASM at a pretty good level, but when it comes to actual scripting I can never grasp it. From what I can make out of your supposition that seemed right, I did at least list the variable event instruction length, even if I never did get around to making use of them in recording down normal events, heh.

That is a solid idea you have for testing the length of commands.

I believe you are right. The filenames are likely looked at as pointers in some manner. This likely made programming easier for everyone, instead of leaving programming to only... well the programmers. Granted you would still need the character's Graphic Pointer pointing to the right area which are near the start of an entity's file.

Ah? Seems you may have missed my redone event notes on Page 8, the ones of variable length.

7E 00 - How the game lifts the "green" from Kite and gives him Data Drain. You can test this out as early as you will. But this is what controls what palette Kite will be using.

Progression of the story is also part of the notes on Page 8, the game is very particular with how and when the story will proceed...

FE FF XX YY - Location an event is to occur if within a dungeon. The dungeon marks it as XX = 05 and YY - Room where the event occurs.

I elaborated on this confusing process a little further down.

31858C Dead End Event
FEFF05000600 - Room where event will occur
FEFF03000400 - ??
01000000
1200
06001500 - "It's a dead end." Text
13000000 - Return to normal gameplay

PS2dis is not too difficult to use, if you open the ISO with WinRAR or an equivalent you will see that there is a SLUS file, that is where... I'd say 90% of the game's programming actually is and //Infection is unique among the quadrilogy (and among PS2 games all around to my knowledge) by still having its tags intact. Someone got a little lazy, hehe.

Slip · Post by **Slip** » Fri Jul 24, 2015 10:44 pm

Xu Yuan wrote:It's kind of odd, I can read hex and ASM at a pretty good level, but when it comes to actual scripting I can never grasp it. From what I can make out of your supposition that seemed right, I did at least list the variable event instruction length, even if I never did get around to making use of them in recording down normal events, heh.

That is a solid idea you have for testing the length of commands.

I believe you are right. The filenames are likely looked at as pointers in some manner. This likely made programming easier for everyone, instead of leaving programming to only... well the programmers. Granted you would still need the character's Graphic Pointer pointing to the right area which are near the start of an entity's file.

Ah? Seems you may have missed my redone event notes on Page 8, the ones of variable length.

7E 00 - How the game lifts the "green" from Kite and gives him Data Drain. You can test this out as early as you will. But this is what controls what palette Kite will be using.

Progression of the story is also part of the notes on Page 8, the game is very particular with how and when the story will proceed...

FE FF XX YY - Location an event is to occur if within a dungeon. The dungeon marks it as XX = 05 and YY - Room where the event occurs.

I elaborated on this confusing process a little further down.

31858C Dead End Event
FEFF05000600 - Room where event will occur
FEFF03000400 - ??
01000000
1200
06001500 - "It's a dead end." Text
13000000 - Return to normal gameplay

PS2dis is not too difficult to use, if you open the ISO with WinRAR or an equivalent you will see that there is a SLUS file, that is where... I'd say 90% of the game's programming actually is and //Infection is unique among the quadrilogy (and among PS2 games all around to my knowledge) by still having its tags intact. Someone got a little lazy, hehe.

Edit: A SLUS File? You mean Slus_202.67?

Read your notes, they were effective in teaching me the way to spawn Phases in the root town (I replaced Mia's spawn event in the process, rip.)
It is strange that you can't read scripting but can read ASM, I'm the complete opposite (except when it comes to the 6502 NES CPU).

Once I get all the event notes down, I plan on making a script that'll extract all the event data and place it into a neat little bundle of event data, I did the same with monster data, over 400KB of it due to labels. xD

The Dungeon Events look like they're obnoxiously large.
You know one thing I'm curious about? Resetting the story line to the very first event. Like a New Game+ (except it'd just make things extremely grindy as all the monsters would be Lv.1 at the start).

Edit: Corbenik's name appears to be translated, but the seeds he casts are not. Also, none of the phases cause a game crash in the root town for me.

Xu Yuan · Post by **Xu Yuan** » Fri Jul 24, 2015 11:08 pm

Now that Monster Data is something I would love to see!

What you mention with a new game + is interesting... I am unsure if the chain can be restored once it has been broken. I do know you can jump ahead (as accessing Cracked Worst Milestone in //Infection...) but I never tried to go back.

But yep, Slus202.67, all you would need to do is load it up in PS2dis and the entire matter is revealed. Press Control+G to look at the labels, (ordinarily close to the labels is a matter of some importance, e.g. the Area Treasure Lists), also of note every single bit of text is in there as well, it can be a bit daunting at first but there's some good information.

Well done on spawning Innis! I imagine that once he tried to do Data Drain or the Doll Attack it was lights out though.

Slip · Post by **Slip** » Fri Jul 24, 2015 11:16 pm

Xu Yuan wrote:Now that Monster Data is something I would love to see!

What you mention with a new game + is interesting... I am unsure if the chain can be restored once it has been broken. I do know you can jump ahead (as accessing Cracked Worst Milestone in //Infection...) but I never tried to go back.

But yep, Slus202.67, all you would need to do is load it up in PS2dis and the entire matter is revealed. Press Control+G to look at the labels, (ordinarily close to the labels is a matter of some importance, e.g. the Area Treasure Lists), also of note every single bit of text is in there as well, it can be a bit daunting at first but there's some good information.

Well done on spawning Innis! I imagine that once he tried to do Data Drain or the Doll Attack it was lights out though.

I tested 4 phases, Skeith, Innus, Macha, and Corbenik. All of each never casted anything besides the normal pattern attacks (and Corbenik had one broken attack that just shook the screen and did 0 damage).

Skeith would: Attack Attack, Strike Down, Judgement repeatedly in a loop, as if you have to get him to a certain HP to trigger some of his attacks (which could be possible, considering I had like 0 attack on my hacked character, so I was dealing piddly damage).

The monster data is horribly formatted:

Code: Select all

	== Razine ==
	ID: {0x00,}
	NamePointer: 0x006AEC50
	NamePointer2: 0x006AEC58
	NPCType: {0x20,0x00,0x00,0x00,}
	EnemyDesignation: {0x00,0x00,}
	Level: {0x00,0x00,}
	UnknownA: {0x00,0x00,0x00,0x00,}
	UnknownB: {0x00,0x00,0x00,0x00,}
	HPBarHeight: 0x43480000
	UnknownC: {0x00,0x00,0x70,0x42,}
	MaxHP: {0x32,0x00,}
	MaxMP: {0x05,0x00,}
	Attack: {0x19,0x00,}
	Defense: {0x14,0x00,}
	Accuracy: {0x14,0x00,}
	Evade: {0x64,0x00,}
	Magic_Attack: {0x05,0x00,}
	Magic_Defense: {0x05,0x00,}
	Magic_Accuracy: {0x0A,0x00,}
	Magic_Evade: {0x01,0x00,}
	Earth: {0x00,0x00,}
	Water: {0x00,0x00,}
	Fire: {0x00,0x00,}
	Wood: {0x00,0x00,}
	Light: {0x05,0x00,}
	Dark: {0x00,0x00,}
	Spirit: {0x0A,0x00,}
	Body: {0x0A,0x00,}
	DataDrain_Item01: {0x00,0x00,0x00,0x00,}
	DataDrain_Item02: {0x00,0x00,0x00,0x00,}
	DataDrain_Item03: {0x00,0x00,0x00,0x00,}
	UntilBreak: {0x00,0x00,0x00,0x00,}
	SpawnRate: {0x18,0xA3,0x5D,0x00,}
	Behavior01: {0x00,0x40,0x1C,0x46,}
	Behavior02: {0x00,0x80,0xBB,0x45,}
	Behavior03: {0x00,0x80,0xBB,0x45,}
	Behavior04: {0x00,0x00,0xC8,0x43,}
	Behavior05: {0x00,0x00,0x48,0x44,}
	Behavior06: {0x00,0x80,0xBB,0x44,}
	RunAnimation: {0x00,0x00,0xA0,0x41,}

So I'll hold off on posting it anywhere until I get it neatly formatted, and freshened up a bit to where it's more practical.

Xu Yuan · Post by **Xu Yuan** » Fri Jul 24, 2015 11:28 pm

Fair enough on the monster data. A great start though! You even found out their Spawn rate (which... I'm not sure what that means) and definitively found out what "Until Break" reall meant.

So when you loaded Skeith, Judgement didn't freeze the game? It did when he tried it on me... but I was right next to the Chaos Gate, maybe that was somehow throwing the game for a loop.

I had never fought anything but Skeith and I would love to know how the others react. From what you're describing it may be that their AI is not actually fully complete yet and interesting note with Corbenik using a broken attack.

Slip · Post by **Slip** » Sat Jul 25, 2015 1:59 am

Xu Yuan wrote:Fair enough on the monster data. A great start though! You even found out their Spawn rate (which... I'm not sure what that means) and definitively found out what "Until Break" reall meant.

So when you loaded Skeith, Judgement didn't freeze the game? It did when he tried it on me... but I was right next to the Chaos Gate, maybe that was somehow throwing the game for a loop.

I had never fought anything but Skeith and I would love to know how the others react. From what you're describing it may be that their AI is not actually fully complete yet and interesting note with Corbenik using a broken attack.

I didn't discover that, my notes are a compilation from what I found out here too.
Spawn Rate would probably be: Priority, the higher the value, the more likely the spawn is when encountering a magic portal.

Judgement didn't freeze the game at all. None of the special moves do (though Data Drain is untested) All of the moves were performed by the bridge in Mac Anu (if positioning might be something related, however, I doubt it.)

About Corbenik's attack: It moves the camera properly, there is no display name for the skill, plays a sound similar to ice magic (which you have the BOOM! BOOM! BOOM! (heavy based attack)) but no animation or models are seen, but screen effects are present. This may due to improper translation, I'm not sure the filenames are consistent between each version of .hack//Infection.

Edit: I'm working on the monster data right now, and it is coming out much better than before. The secondary pointer (the one beside the name pointer) is for the Model Name. Here is a piece:

Code: Select all

	[0x00] - Razine
		Pointer A: 0x006AEC50 / Pointer B: 0x006AEC58
		Pointer B Value: E1X1

		NPC: 20000000
		Des.: 0000
		HPHeight: 00004843

		Level: 0
		HP: 50		MP: 5

		ATK: 2.5		DEF: 2
		ACC: 2.5		EVA: 2
		MTK: 2.5		MEF: 2
		MCC: 2.5		MVA: 2

		Earth: 0		Water: 0
		 Fire: 0		 Wood: 0
		Light: 0.5		 Dark: 0
		Spirt: 1		 Body: 1

The formatting is much better under Notepad++ though, as tabs are formatted differently.
It also would appear, monster data isn't loaded until you get past the title screen, which made debugging rather weird for me (I thought I made some mistake somewhere).

My main purpose behind extracting all of this data is for modding, of course. Programming simplifies this long, harsh, process of writing down Item name after Item name (which you surprisingly was able to sit through!).

I really hope today I'll be able to make some more progress finding addresses to work with.

It would appear that Net Slum has everything set up, from Chaos Gate to Weapon Shop, everything is in there. Though, attempt to warp to any 'roll-over' or out of bound servers simply freeze the game, though... if you do warp into any fields in servers that don't necessarily exist, really strange patterns (There was one pattern that looked like it was legitimate, yet unique from the other servers.) can appear on the dungeons and game glitches happen. If you want to see the floor pattern I talked about for yourself, go to Null Server at Server 15 (0F) and go to Bursting Passed Over Aqua Field.
Can be triggered when you warp to Bursting Passed Over Aqua Field, but before you warp, change byte: 20318262 to 0x0F (15).

I double checked, no legit server has this pattern. I feel like I've seen it in another dungeon type though.

Xu Yuan · Post by **Xu Yuan** » Sat Jul 25, 2015 1:50 pm

Well done! I love that formatting, and yes what dot hack hacking is missing are dedicated programs and what you have set up there in that Monster Data is fantastic! Unfortunately as mentioned I am not a programmer and while I can amass large amounts of data I can't simplify it's use as programs and programmers tend to do.

I was actually unaware you could change the field it would take you to (or if I did know at one time, I had forgotten...) so that is some very useful info! I'll try this out, I had never thought to go beyond the five servers.

I have to say you've inspired me to jump back into this, and I have a (mostly) decoded starting event to go with it.

Code: Select all

00C07E31 - 317EC0 - (Pointers to Events)

Game Start Event
0100 - Likely game where the event takes place.
0000 - Link in the Chain
04000200 - Location where event will take place (unknown how it works at game start)
0000
FEFF0300
000000
71000200 - ??
72000300 - Something with game start events?
0A000200 - Play Epitaph Cutscene
71000100 - ??
0A006A00 - Altimit Boot-up
72000100 - ??
06000100 - "OK user registration is done. Now for a name..."
06000200 - "Yasuhiko's probably already there..."
9C00 - Something with naming procedure?
0E000101 - Restricts all but Email.
0F000B000000 - Seems to work in conjunction with the above, but not part of same instruction.
6B000400 - Email to Receive (Registered Yet?)
6B000500 - Email to Receive (Thank You)
6B004001 - Email to Receive (Version Update 3.75)
68003E000100 - Forum Post
68003E000200 - " "
68003E000300 - " "
68003E000500 - " " 
68003E000400 - " "
68003E000600 - " "
6F000000 - News to Receive
6F000100 - News to Receive
6F000200 - News to Receive
6F002500 - News to Receive
53000100 - Makes... Mia unreachable by Flash Mail, alright?
51000200 - Makes Orca available to reach by Flash Mail. (Which by default he is, making these reachable/unreachable instructions useless in this event)
53000600 - Makes Balmung unreachable by Flash Mail
53000800 - Makes Piros unreachable by Flash Mail
53000900 - Makes Wiseman unreachable by Flash Mail
53000A00 - Makes Elk unreachable by Flash Mail
53000F00 - Makes Blackrose unreachable by Flash Mail
53001000 - Makes Mistral unreachable by Flash Mail (well! That sure is  a lot of wasted space!)
00000000 - ??
FEFF - 
0300040001000E00 - (May be some way to move the event along interspersed with gameplay)
FFFF0100 - ?? (May be some sort of internal instruction on calling the text below)
06000000 - "I'll check my email first!" when the wrong selection is chosen.
04000000 - ??
12000400 - Must Read "Registered Yet?'
12000500 - Must Read "Thank You!"
0000 - ??
0F0001000100 - Lifts the restrictions.
680000000000 - System Explanation
680000000100 - " "
680000000200 - " "
680000000300 - " "
680000000400 - " "
680000000500 - " "
680000000600 - " "
680000000700 - " "
680000000800 - " "
680000000900 - " "
680000000A00 - " "
680000000B00 - " "
680000000C00 - " "
680000000D00 - " "
680000000E00 - " "
680000000F00 - " "
680000001000 - " "
680000001100 - " "
680001000000 - Play Knowledge
680001000100 - " "
680001000200 - " "
680001000300 - " "
68001F000000 - New Transportation System
68001F000100 - " "
680020000000 - "The World" Reaches 20 Million!
680021000000 - Neuro Goggle FMD
680035000000 - Keyword Creation
680035000100 - " "
680035000200 - " "
680035000300 - " "
680035000400 - " "
680036000000 - What's a Grunty?
680036000100 - " "
680036000200 - " "
680036000300 - " "
680037000000 - Spring of Myst (9 Messages)
(From hereon out lines of Forums will only list the first and the rest will be truncated)
680038000000 - Item Trade (3 Messages)
680039000000 - Symbol (2 Messages)
68001D000000 - Zeit Statue (2 Messages)
0100FFFF - ??
FFFF000000 - ??

Slip · Post by **Slip** » Sat Jul 25, 2015 3:08 pm

Xu Yuan wrote:Well done! I love that formatting, and yes what dot hack hacking is missing are dedicated programs and what you have set up there in that Monster Data is fantastic! Unfortunately as mentioned I am not a programmer and while I can amass large amounts of data I can't simplify it's use as programs and programmers tend to do.

I was actually unaware you could change the field it would take you to (or if I did know at one time, I had forgotten...) so that is some very useful info! I'll try this out, I had never thought to go beyond the five servers.

I have to say you've inspired me to jump back into this, and I have a (mostly) decoded starting event to go with it.
Code: Select all
-snip-

You were aware of being able to change the field "0E 00 64 00 - Field Identifier- (Changing it to 0F will load a generic Hidden Forbidden Holy Ground)", though the actual command is 76: 76 00 - Set Field Condition ( int16 ID ) (See Field Reference), you set the field condition to be in a certain area, then you use command 64 00 to warp to that area (64 00 - Warp to Designated Area (See Special Zone reference)). It's really nice they had a command just for warping directly to the next event.

Thank you, it's awesome that I was able to get you motivated to look into this again, when I saw your notes you inspired me to do so. xD before I saw this topic I was just playing around with the game's RAM for giggles (such as modding stats and switching equipment).

The event data is pretty interesting to me, because... it makes the game much more fluent with modding, you don't need to go through a bunch of OPCodes and stuff to modify the game because of this, and the Event handler is a purely hardcoded simplification of the entire game. If that makes sense.

Also, from testing I found 13 00 00 00 doesn't break you out of an event. 13 00 basically resets A.I. behaviors from NPCs / monsters, so if you run this command while an event is executing without returning control to the player, you'll find yourself being attacked while the event is running. (which I found out quickly after my first test with Skeith, in which I spawned him and tried to use 13 00 to break the event, but ended up being instantly game-over'd in the process.)

Xu Yuan · Post by **Xu Yuan** » Sat Jul 25, 2015 3:35 pm

Oh, so that's what 0E actually did, hehe. Though 64 00 is Warp to Designated Area? I have that down in my notes as purely the next field where the event will actually continue. ...Unless that's what you were referring to I do see in my notes that 76 00 is also used in a similar fashion, now I'm confused.

Event Data is thankfully parsed in such a way that does make it fairly moddable. Unlike a lot of games of this era .hack// is a fairly simple game and didn't need too much ASM magic to get what they were going for. I feel that this was likely the case with adding Data Drain and enabling Protect Break (since that is accomplished through just one event instruction) but aside from special conditionals like that, the rest of the game is fairly straight forward with its commands.

So 1300 doesn't return the player to gameplay, but only resets behaviors? Hmm... I'll need to take a closer look on what actually does return a character to normal gameplay then.

Slip · Post by **Slip** » Sat Jul 25, 2015 5:16 pm

Xu Yuan wrote:Oh, so that's what 0E actually did, hehe. Though 64 00 is Warp to Designated Area? I have that down in my notes as purely the next field where the event will actually continue. ...Unless that's what you were referring to I do see in my notes that 76 00 is also used in a similar fashion, now I'm confused.

Event Data is thankfully parsed in such a way that does make it fairly moddable. Unlike a lot of games of this era .hack// is a fairly simple game and didn't need too much ASM magic to get what they were going for. I feel that this was likely the case with adding Data Drain and enabling Protect Break (since that is accomplished through just one event instruction) but aside from special conditionals like that, the rest of the game is fairly straight forward with its commands.

So 1300 doesn't return the player to gameplay, but only resets behaviors? Hmm... I'll need to take a closer look on what actually does return a character to normal gameplay then.

Really? Try modifying 64 00 in any way in Orca's tutorial, and you will no longer warp to that area. You'll just stay there endlessly. Hmm, what events have you tested this on? I've only tested it once (with several different command changes.) 64 00 is called immediately after the tutorial Global Event is called.
96 00 AA 00 calls an event or "Scene" to happen, Data Drain is one of the events in here. Which is why when you nulled "4E 00 76 00 - When nulled, the Chaos Gate screen turns to your normal menu." (mentioned on Page 7), it opened the Normal Menu, because each menu is a scene.
The tutorial scene for the Chaos Gate actually will not warp you anywhere, it has no functionality in doing so.

96 00 4E 00 - Calls Chaos Gate Tutorial
76 00 0E 00 - Set destination field for event
64 00 - Warp to field

Is what I could gather from that little bit in Orca's tid-bit in the beginning. I'll try forcing a warp without using the Chaos Gate with the event to see if it really works...

Result:

Code: Select all

96 00 4E 00 4E 00 76 00 0E 00 64 00
Starts Chaos Gate Tutorial
Warp SFX

When you inject this into 2031817A, all that happens is that much so I guess I was wrong. Hmm.
Though, Kite is completely warped out. So I guess there is more to it than just that.

Code: Select all

05 00 05 00 4E 00 76 00 0E 00 64 00 01 00 00 00 - Failure
05 00 05 00 4E 00 76 00 0E 00 64 00 01 00 00 00 0E 00 FF FF FF FF FF FF 01 00 FF FF 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 - Failure
05 00 05 00 76 00 0E 00 64 00 01 00 00 00 0E 00 FF FF FF FF FF FF 01 00 FF FF 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 - Success
 ^ I kept doing 4E by mistake instead of command 76.
 
76 00 0e 00
0e -> 02 = Buried Primitive Aqua Field, field still has traits of tutorial

76 00 0e 00 64 00
64 -> 62 = Freezes event. (Suggests that 64 is a command, not an argument.)

76 00 0e 00 64 00 01 00
01 -> 02 = Game Crash
01 -> 00 = Root Town (Area Mode) (Perhaps 64 switches game mode?)

76 00 0e 00 64 00 01 00 XX 00
X = Server, setting to 4 warps to Omega Server; however, when you switch either Game Mode or Server, the tutorial breaks however will resume upon going to <Delta> Bursting Passed Over Aqua Field.

76 00 0e 00 64 00 01 00 00 00 XX 00
X = Special Zone, all quest related areas are included in here; this does not change the Area Information, nor the spawns of monsters.

76 00 0e 00 64 00 01 00 00 00 XX 00 ?? ?? ?? ?? ?? ?? AA AA
If A is nulled, Event will exit out after teleporting you, leaving you stranded in story line. Orca isn't present in Root Town either; meaning 01 00 is a command.

76 00 0e 00 64 00 01 00 00 00 XX 00 ?? ?? ?? ?? ?? ?? 01 00 AA AA
When A < 0 then Event Continues, else it dies. (00 80 or above value)

76 00 0e 00 64 00 01 00 00 00 xx 00 ?? ?? ?? ?? ?? ?? 01 00 , AA AA , ?? ?? , ?? ?? , ?? ?? , ?? ?? , ?? ?? , ?? ?? , ?? ??
76 00 0E 00 64 00 01 00 00 00 0E 00 FF FF FF FF FF FF 01 00 FF FF 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00
Another way to make this run however, is by using 05 00 instead of 01 00, 05 yields which appears to give the game time to load. If you try to play a message using 06 00, it will error out the loading event for the map and cause a game crash (being an infinite loop)

Hmm... My final result is this:

Code: Select all

76 00 0e 00 64 00 01 00 00 00 0e 00 ff ff ff ff ff ff 05 00 05 00 00 00

shortest implementation:
76 00 0e 00 - Set Area Keywords: 0e 00 (Bursting Passed Over Aqua Field)
64 00 01 00 00 00 0e 00 ff ff ff ff ff ff- Warp to: Area Mode 01 , Server 00 , Hardcoded Field 0e , ? , ? , ?
05 00 05 00 - Yield (give game time to think.)
00 00 - Exit Event.

Edit: Noticed that this took 1 hour and 20 minutes of testing LOL

This is the easiest way to warp someone to a field through an event, has no warping animation, just immediately cuts to the loading screen.
Try injecting that data into 0x2031817A, and you'll be able to test it out too.

Xu Yuan · Post by **Xu Yuan** » Sat Jul 25, 2015 6:19 pm

That is some fine experimentation! Some interesting results there. I am still confused about the function of 00 00. Is it literally just "Exit Event"? Or does it stop the event for the time being before resuming when the proper condition is reached? In this case it would be going to (Delta) Bursting Passed Over Aqua Field. You are right though that Orca's event is unique in warping to a field in the guise of a normal transfer. All other events in the game(s) use the normal Keyword System as I recall.

I never considered a possibility of 01 00 being a command and I couldn't even begin to guess at its proper function. Some curiousities brought up here, to be sure.

Slip · Post by **Slip** » Sat Jul 25, 2015 6:58 pm

Xu Yuan wrote:That is some fine experimentation! Some interesting results there. I am still confused about the function of 00 00. Is it literally just "Exit Event"? Or does it stop the event for the time being before resuming when the proper condition is reached? In this case it would be going to (Delta) Bursting Passed Over Aqua Field. You are right though that Orca's event is unique in warping to a field in the guise of a normal transfer. All other events in the game(s) use the normal Keyword System as I recall.

I never considered a possibility of 01 00 being a command and I couldn't even begin to guess at its proper function. Some curiousities brought up here, to be sure.

01 feels like it has something to do with the Condition the event is continued. Like: "Continue event if (Condition Type 1) (Condition Value 1) and (Condition Type 2) (Condition Value 2) and (Condition Type 3) (Condition Value 3) is met." Since in Orca's event, 01 00 FF FF 00 00 FF FF 00 00 , FF FF = -127 which probably means Invalid Condition or No Condition. Which is why when FF FF is switched to a value below 00 80 (which would, on the contrary become a really big value, from -1 to 127), it sets a condition for when the event is continued. Though, this is all speculation until I can find more Proper usage of it.

I think maybe 00 00 acts like an "End of Event" marker, similar to how Strings have the "End of String" 00 marker. Meaning, Events can be of dynamic length; though, if you never set it to move on to the next event, I guess that means "Game Over."

Also, I read some things earlier mentioning a possible "Debug Mode" or "Debug Menu". I believe the only way to activate it would be by using the 96 Command (which switches scenes / menus), 96 00 XX 00. If you want to give it a test and start mapping things out

Also, I heard earlier in a post you found a way to remap the options in the menus? Like, opening Trade with a chaos gate? What address would you find this stuff at if I may ask?

Xu Yuan · Post by **Xu Yuan** » Sat Jul 25, 2015 7:32 pm

Hmm, I have in my notes its part of a "sequence of events" so... I guess i had considered 0100 to be a valid event instruction, but that's only when it's at the start of an event to continue the "Chain". That it is set to FFFF to imply "no condition" is reasonable, it may mean that it doesn't need to adhere to the event chain.

I think back in the day I went through the tutorial menus, there are a lot of Debug strings and a mention of a Debug mode, just no luck actually finding it, it's worth another look though.

That... hmm, let me think... or look through my notes rather.

Ah, here we are... if I didn't post them it's because they're a complete mess...

Code: Select all

Follows the list of NPC's above.
NPCTbl

619460 - Each NPC is 70 Bytes (112) in size

NPC Data?
Weapon Shop

78 0C 6B 00 - Name Pointer
88 0C 6B 00 - Model Pointer
NPC Functionality
00 - PC Functions?
00 - Investigate
01 - Talk (inside the stats)
02 - Talk (at the bottom of stats, can also Talk/Trade/Gift)
---------------
08 - Talk (only the Talk command, which spits out garbage)
09 - As above, except it shows their HP/SP
-----
1F - Spits out text you can't close.
20 - Treats NPC as enemy, with HP, et al? (Can't take any of their HP it seems though)

21 - Shows their SP as well as their HP, but still treats them as a foe. Unused functionality of being able to see the enemies SP?
-----
2F - Game still seems to treat him as an enemy, but he only talks now.
30 - Same as 1F
31 - Same as 1F 
(Seems to repeat)



01 Shops/Chaos Gates/Treasure Chests?
(Seems to have a different subset from monsters)- Not True. Each byte seems to hold a different function. Enemies normally function under 20 00 00 00, so it's little surprise that would be the case here.

00 - Investigate
01 - Talk (Weapon Shop)
02 - Talk (Elf's Haven)
03 - Talk (Weapon Shop)
04 - Talk (Item Shop)
05 - Talk (Weapon Shop)
06 - Talk (Item Shop)
07 - Talk (Weapon Shop)
08 - Talk (Magic Shop)
09 - Talk (Weapon Shop)
0A - Talk (Magic Shop)
0B - Talk (Weapon Shop)
0C - Talk (Magic Shop)
0D - Talk (Weapon Shop)
0E - Talk (Magic Shop)
0F - Talk (Weapon Shop)
10 - Talk (Recorder)
11 - Talk (Weapon Shop)
12 - Talk (Elf's Haven) seems to repeat.
-----
1F - Talk (Weapon Shop)
20 - Investigate (Chaos Gate)
-----
40 - Investigate (Treasure Chest)
----------
60 - Investigate (Chaos Gate)
-------
80 - Investigate (Trapped Chest, without Fortune Wire)
-------
A0 - Investigate (Chaos Gate)
-------
C0 - Investigate (Blue Chest, fortune wired)
-------
---------------------------------------

00 - Destroy/Symbol Subset?

01 - Water Elemental Field?
02 - Invalid Field?
03 - Water Elemental Field?
04 - Symbol? (NOTHING!)
05 - Water Elemental Field?
06 - Invalid Field?
07 - Water Elemental Field?
08 - Data Drain Item 1?
(Seems to repeat the main 3 above)
----
0C - Symbol? (NOTHING!)
---
10 - Gott Treasure 
11 - Water Elemental Field?
12 - Symbol (NOTHING!)
------
18 - Data Drain Item 1
----
1C - Symbol (NOTHING!)
----
20 - Time it took to reach Gott Statue for Hero of Zeit
21 - Water Elemental Field?
----
30 - Gott Treasure
31 - Water Elemental Field
-----
40 - Monsieur/Grandpa
-----
50 - Gott Treasure
---
60 - Zeit Timing
----
70 - Gott Treasure
----
80 - Virus Core E. Skeith's Data Drain Item? 
----
90 - Gott Treasure
----
A0 - Zeit Timing
----
C0 - Monsieur/Grandpa
---
E0 - Zeit Timing
---

-------------------------------------

00 - Grunty Raising

01 - Feeding Baby Grunty
02 - Trading with a Grunty
03 - As above.
04 - Just talking.
05 - As above.
----
08 - Camera jumps to underneath the Mac Anu Bridge and the shopkeeper takes the role of Grunty Breeder.

09 - As above.
---
11 - Rinse and repeat, starting from Grunty Raising
-----------------------------------------\
00 00 00 00 - Possibly NPC Identifcation number?
00 00 00 00 - ???
00 00 00 00 - ???
00 00 34 43 - ???
00 00 C8 42 - ???
20 19 63 00 - Weapon Shop help text.
00 00 00 00 - ???
01 00 00 00 - ???
50 5A 50 00 - ???
01 00 00 00 - ???
D0 09 A6 00 - ???
90 F3 37 01 - ???
00 00 00 00 - ???
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0B 00 00 00 - ???
98 0C 6B 00 - ???

And the aforementioned NPC list...

Code: Select all

00 - Weapon Shop
01 - Elf's Haven
02 - Item Shop
03 - Magic Shop
04 - Recorder
05 - Nothing (Weapon Shop)
06 - Same as above (Elf's Haven)
07 - Same as above (Item Shop)
08 - Same as above (Magic Shop)
09 - Same as above (Recorder)
0A - Same as above (Grunt Shop)
0B - Same as above (Weapon Shop)
0C - Same as above (Elf's Haven)
0D - Same as above (Item Shop)
0E - Same as above (Magic Shop)
0F - Same as above (Recorder)
10 - Same as above (Grunt Shop)
11 - (Weapon Shop)
12 - (Elf's Haven)
13 - (Item Shop)
14 - (Magic Shop)
15 - (Recorder)
16 - (Grunt Shop)
17 - (Weapon Shop)
18 - (Elf's Haven)
19 - (Item Shop)
1A - (Magic Shop)
1B - (Recorder) 
1C - (Grunt Shop)
1D - Administrator
1E - Wing
1F - Macky
20 - NOVA
21 - Sachiko
22 - Neja
23 - Heavy
24 - Benaki
25 - Hayate
26 - Task
27 - Hinata
28 - A-Kichi
29 - Cleama
2A - Grid
2B - Quess
2C - Nekoski
2D - Gyokuro
2E - Osugi
2F - Acerola
30 - Borscht
31 - M-78
32 - Yuckey
33 - Nijukata
34 - Hirami
35 - Henako
36 - BIG
37 - Yuji
38 - Cima
39 - Koji
3A - Crest
3B - Mayunosuke
3C - Mutsuki
3D - Oburozukiyo
3E - Bell
3F - Cossack Leader
40 - Alue
41 - Alpha Ichigoro
42 - Alicia
43 - Stare
44 - Flare
45 - Fool
46 - Teria
47 - Waffle
48 - Cyan
49 - Panta
4A - Jutah
4B - Annri
4C - Benoit
4D - John
4E - Macino
4F - Tim
50 - Edajima (?)
51 - Slayer (?)
52 - Apeiron 
53 - Bob (Orca's friend.)
54 - Erick (You meet him when you first go to the area where you get Mistral)
55 - Linda (Orca's friend)
56 - Meg (Alph's friend)
57 - Heril (one of Gardenia's groupies)
58 - Moeri (Gardenia groupie)
59 - Meria (Gardenia groupie)
5A - Yunore (Gardenia Groupie)
5B - Morgan (?)
5C - Nece (?)
5D - Sasaki (?)
5E - Q (One of the Vagrant AI's that come out after Innis is defeated?)
5F - Melon (Vagrant AI?)
60 - Justice (One of the two reprimanding Marlo)
61 - Peace (Marlo reprimander) 
62 - Anne (Trading quest)
63 - Bate (Trading Quest)
64 - Catherine (Trading Quest)
65 - Dick (Trading Quest)
66 - Tartarga (Netslum AI)
67 - Culhwh (Netslum AI)
68 - Spiritas (Netslum AI)
69 - Thea (Netslum AI)
6A - Dorin (Netslum AI)
6B - Sconk (Netslum AI)
6C - Toru (?)
6D - Tsutomu (?)
6E - Kida (?)
6F - Akai (?)
70 - Aoyama (?)
71 - Hybnos (?)
72 - Pina (?)
73 - Aqua Marine (Selling Quest?)
74 - Taro (Selling Quest?)
75 - Jiro (Selling Quest?)
76 - Hanako (?)
77 - JJ (Selling Quest?)
78 - Sieg
79 - Kaz
7A - Tsukune (Vagrant AI after Innis)
7B - Martini (Vagrant AI after Innis)
7C - Anchovy (Vagrant AI after Innis)
7D - Pancetta (Vagrant AI after Innis)
7E - 2112 (Vagrant AI after Innis)
7F - Sanche (Vagrant AI after Innis) 
80 - Marlo (What...?)
81 - Sanjuro (These must be before their quests are complete, I guess)
82 - Nuke Usagimaru
83 - Balmung (They must have made an NPC model for each party member)
84 - Moonstone
85 - Wiseman
86 - Elk
87 - Mistral 
88 - Aura
89 - Aura with hands
8A - Sheraton (Vagrant AI)
8B - Plaird (Vagrant AI)
8C - Jinn (Vagrant AI)
8D - Johnny (And unlike the majority of NPC's past the normal ones he functions like a normal NPC)
8E - Sal 
8F - Lottel 
90 - Suzie
91 - Noble Grunty 
92 - Iron Grunty
93 - Poison Grunty 
94 - Bony Grunty
95 - Snakey Grunty
96 - Aqua Grunty 
97 - Milky Grunty
98 - Rocker Grunty
99 - Woody Grunty
9A - Little Grunty (When you speak to it the screen goes black in Mac Anu, then you'll appear under the bridge)
9B - Little Grunty (Again?)
9C - (Grunty the Kid)
9D - (Grunty the Kid) (Larger?)
9E - NPC (Theta Shopkeeper)
9F - (Tsukasa)
A0 - Mimiru 
A1 - Bear
A2 - (Subaru)
A3 - Crim
A4 - (Silver Knight)
A5 - (BT)
A6 - (Sora)
A7 - A-20 
A8 - Piros (A bit of a leap, don't you think?)
A9 - Natsume 
AA - Rachel 
AB - Gardenia 
AC - Terajima Ryoko
AD - BlackRose
AE - Helba

I hope that is *some* help, but these notes are very messy, even for me. But if you wanted to try it out it is all right there.

Slip · Post by **Slip** » Sat Jul 25, 2015 7:59 pm

Xu Yuan wrote:Hmm, I have in my notes its part of a "sequence of events" so... I guess i had considered 0100 to be a valid event instruction, but that's only when it's at the start of an event to continue the "Chain". That it is set to FFFF to imply "no condition" is reasonable, it may mean that it doesn't need to adhere to the event chain.

I think back in the day I went through the tutorial menus, there are a lot of Debug strings and a mention of a Debug mode, just no luck actually finding it, it's worth another look though.

That... hmm, let me think... or look through my notes rather.

Ah, here we are... if I didn't post them it's because they're a complete mess...

Code: Select all

Follows the list of NPC's above.
NPCTbl

619460 - Each NPC is 70 Bytes (112) in size

NPC Data?
Weapon Shop

78 0C 6B 00 - Name Pointer
88 0C 6B 00 - Model Pointer
NPC Functionality
00 - PC Functions?
00 - Investigate
01 - Talk (inside the stats)
02 - Talk (at the bottom of stats, can also Talk/Trade/Gift)
---------------
08 - Talk (only the Talk command, which spits out garbage)
09 - As above, except it shows their HP/SP
-----
1F - Spits out text you can't close.
20 - Treats NPC as enemy, with HP, et al? (Can't take any of their HP it seems though)

21 - Shows their SP as well as their HP, but still treats them as a foe. Unused functionality of being able to see the enemies SP?
-----
2F - Game still seems to treat him as an enemy, but he only talks now.
30 - Same as 1F
31 - Same as 1F 
(Seems to repeat)



01 Shops/Chaos Gates/Treasure Chests?
(Seems to have a different subset from monsters)- Not True. Each byte seems to hold a different function. Enemies normally function under 20 00 00 00, so it's little surprise that would be the case here.

00 - Investigate
01 - Talk (Weapon Shop)
02 - Talk (Elf's Haven)
03 - Talk (Weapon Shop)
04 - Talk (Item Shop)
05 - Talk (Weapon Shop)
06 - Talk (Item Shop)
07 - Talk (Weapon Shop)
08 - Talk (Magic Shop)
09 - Talk (Weapon Shop)
0A - Talk (Magic Shop)
0B - Talk (Weapon Shop)
0C - Talk (Magic Shop)
0D - Talk (Weapon Shop)
0E - Talk (Magic Shop)
0F - Talk (Weapon Shop)
10 - Talk (Recorder)
11 - Talk (Weapon Shop)
12 - Talk (Elf's Haven) seems to repeat.
-----
1F - Talk (Weapon Shop)
20 - Investigate (Chaos Gate)
-----
40 - Investigate (Treasure Chest)
----------
60 - Investigate (Chaos Gate)
-------
80 - Investigate (Trapped Chest, without Fortune Wire)
-------
A0 - Investigate (Chaos Gate)
-------
C0 - Investigate (Blue Chest, fortune wired)
-------
---------------------------------------

00 - Destroy/Symbol Subset?

01 - Water Elemental Field?
02 - Invalid Field?
03 - Water Elemental Field?
04 - Symbol? (NOTHING!)
05 - Water Elemental Field?
06 - Invalid Field?
07 - Water Elemental Field?
08 - Data Drain Item 1?
(Seems to repeat the main 3 above)
----
0C - Symbol? (NOTHING!)
---
10 - Gott Treasure 
11 - Water Elemental Field?
12 - Symbol (NOTHING!)
------
18 - Data Drain Item 1
----
1C - Symbol (NOTHING!)
----
20 - Time it took to reach Gott Statue for Hero of Zeit
21 - Water Elemental Field?
----
30 - Gott Treasure
31 - Water Elemental Field
-----
40 - Monsieur/Grandpa
-----
50 - Gott Treasure
---
60 - Zeit Timing
----
70 - Gott Treasure
----
80 - Virus Core E. Skeith's Data Drain Item? 
----
90 - Gott Treasure
----
A0 - Zeit Timing
----
C0 - Monsieur/Grandpa
---
E0 - Zeit Timing
---

-------------------------------------

00 - Grunty Raising

01 - Feeding Baby Grunty
02 - Trading with a Grunty
03 - As above.
04 - Just talking.
05 - As above.
----
08 - Camera jumps to underneath the Mac Anu Bridge and the shopkeeper takes the role of Grunty Breeder.

09 - As above.
---
11 - Rinse and repeat, starting from Grunty Raising
-----------------------------------------\
00 00 00 00 - Possibly NPC Identifcation number?
00 00 00 00 - ???
00 00 00 00 - ???
00 00 34 43 - ???
00 00 C8 42 - ???
20 19 63 00 - Weapon Shop help text.
00 00 00 00 - ???
01 00 00 00 - ???
50 5A 50 00 - ???
01 00 00 00 - ???
D0 09 A6 00 - ???
90 F3 37 01 - ???
00 00 00 00 - ???
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0B 00 00 00 - ???
98 0C 6B 00 - ???

And the aforementioned NPC list...

Code: Select all

00 - Weapon Shop
01 - Elf's Haven
02 - Item Shop
03 - Magic Shop
04 - Recorder
05 - Nothing (Weapon Shop)
06 - Same as above (Elf's Haven)
07 - Same as above (Item Shop)
08 - Same as above (Magic Shop)
09 - Same as above (Recorder)
0A - Same as above (Grunt Shop)
0B - Same as above (Weapon Shop)
0C - Same as above (Elf's Haven)
0D - Same as above (Item Shop)
0E - Same as above (Magic Shop)
0F - Same as above (Recorder)
10 - Same as above (Grunt Shop)
11 - (Weapon Shop)
12 - (Elf's Haven)
13 - (Item Shop)
14 - (Magic Shop)
15 - (Recorder)
16 - (Grunt Shop)
17 - (Weapon Shop)
18 - (Elf's Haven)
19 - (Item Shop)
1A - (Magic Shop)
1B - (Recorder) 
1C - (Grunt Shop)
1D - Administrator
1E - Wing
1F - Macky
20 - NOVA
21 - Sachiko
22 - Neja
23 - Heavy
24 - Benaki
25 - Hayate
26 - Task
27 - Hinata
28 - A-Kichi
29 - Cleama
2A - Grid
2B - Quess
2C - Nekoski
2D - Gyokuro
2E - Osugi
2F - Acerola
30 - Borscht
31 - M-78
32 - Yuckey
33 - Nijukata
34 - Hirami
35 - Henako
36 - BIG
37 - Yuji
38 - Cima
39 - Koji
3A - Crest
3B - Mayunosuke
3C - Mutsuki
3D - Oburozukiyo
3E - Bell
3F - Cossack Leader
40 - Alue
41 - Alpha Ichigoro
42 - Alicia
43 - Stare
44 - Flare
45 - Fool
46 - Teria
47 - Waffle
48 - Cyan
49 - Panta
4A - Jutah
4B - Annri
4C - Benoit
4D - John
4E - Macino
4F - Tim
50 - Edajima (?)
51 - Slayer (?)
52 - Apeiron 
53 - Bob (Orca's friend.)
54 - Erick (You meet him when you first go to the area where you get Mistral)
55 - Linda (Orca's friend)
56 - Meg (Alph's friend)
57 - Heril (one of Gardenia's groupies)
58 - Moeri (Gardenia groupie)
59 - Meria (Gardenia groupie)
5A - Yunore (Gardenia Groupie)
5B - Morgan (?)
5C - Nece (?)
5D - Sasaki (?)
5E - Q (One of the Vagrant AI's that come out after Innis is defeated?)
5F - Melon (Vagrant AI?)
60 - Justice (One of the two reprimanding Marlo)
61 - Peace (Marlo reprimander) 
62 - Anne (Trading quest)
63 - Bate (Trading Quest)
64 - Catherine (Trading Quest)
65 - Dick (Trading Quest)
66 - Tartarga (Netslum AI)
67 - Culhwh (Netslum AI)
68 - Spiritas (Netslum AI)
69 - Thea (Netslum AI)
6A - Dorin (Netslum AI)
6B - Sconk (Netslum AI)
6C - Toru (?)
6D - Tsutomu (?)
6E - Kida (?)
6F - Akai (?)
70 - Aoyama (?)
71 - Hybnos (?)
72 - Pina (?)
73 - Aqua Marine (Selling Quest?)
74 - Taro (Selling Quest?)
75 - Jiro (Selling Quest?)
76 - Hanako (?)
77 - JJ (Selling Quest?)
78 - Sieg
79 - Kaz
7A - Tsukune (Vagrant AI after Innis)
7B - Martini (Vagrant AI after Innis)
7C - Anchovy (Vagrant AI after Innis)
7D - Pancetta (Vagrant AI after Innis)
7E - 2112 (Vagrant AI after Innis)
7F - Sanche (Vagrant AI after Innis) 
80 - Marlo (What...?)
81 - Sanjuro (These must be before their quests are complete, I guess)
82 - Nuke Usagimaru
83 - Balmung (They must have made an NPC model for each party member)
84 - Moonstone
85 - Wiseman
86 - Elk
87 - Mistral 
88 - Aura
89 - Aura with hands
8A - Sheraton (Vagrant AI)
8B - Plaird (Vagrant AI)
8C - Jinn (Vagrant AI)
8D - Johnny (And unlike the majority of NPC's past the normal ones he functions like a normal NPC)
8E - Sal 
8F - Lottel 
90 - Suzie
91 - Noble Grunty 
92 - Iron Grunty
93 - Poison Grunty 
94 - Bony Grunty
95 - Snakey Grunty
96 - Aqua Grunty 
97 - Milky Grunty
98 - Rocker Grunty
99 - Woody Grunty
9A - Little Grunty (When you speak to it the screen goes black in Mac Anu, then you'll appear under the bridge)
9B - Little Grunty (Again?)
9C - (Grunty the Kid)
9D - (Grunty the Kid) (Larger?)
9E - NPC (Theta Shopkeeper)
9F - (Tsukasa)
A0 - Mimiru 
A1 - Bear
A2 - (Subaru)
A3 - Crim
A4 - (Silver Knight)
A5 - (BT)
A6 - (Sora)
A7 - A-20 
A8 - Piros (A bit of a leap, don't you think?)
A9 - Natsume 
AA - Rachel 
AB - Gardenia 
AC - Terajima Ryoko
AD - BlackRose
AE - Helba

I hope that is *some* help, but these notes are very messy, even for me. But if you wanted to try it out it is all right there.

Thank you for the data, I should be able to extract a wealthy database out of the NPCs now thanks to the AoB information and the amount of actors specified.

Also, you may have found something rather interesting about monster data by reading the NPC data. Perhaps monsters *are* NPCs, in which case it would be possible to Fight blackrose. The only difference in the equation is that NPCs and Monsters are loaded differently; however, you found some evidence they are ran under the same parameters.

"20 - Treats NPC as enemy, with HP, et al? (Can't take any of their HP it seems though)

21 - Shows their SP as well as their HP, but still treats them as a foe. Unused functionality of being able to see the enemies SP?"
Likely, 21 is for Party Members, 20 is for Enemies.
Meaning, they are probably loaded in the same area as Monsters are. So if you can isolate the monster data in RAM (which is dynamic) (one method of doing so is by watching HP values of monsters), you might be able to find a copy of BlackRose in there, or possibly Kite, and switch them into a Monster.

Might be a fun experiment.

Also, I just ran a program, and I'm now painstakingly extracting all of the global events (I overwrote so much event data that it overlapped into BlackRose's introduction, and the strangest thing happened)

Basically, if an event becomes large enough, it will overlap into the next event. And guess what happened? When I warped in for the first time, I saw the Blackrose cutscene, then it reloaded the map and then I got the Orca tutorial immediately afterwards.

Maybe there is some weird way cutscenes are loaded or prioritized?

Edit:

Code: Select all

Events:
				00 - Open Menu (Town)
				01 - Open Menu (Area)
				02 - Open Menu (No Gate Out option)
				03 - Chat Menu
				04 - Skills Menu
				05 - Items Menu
				06 - Key Items Menu
				07 - Discard Menu
				08 - Status Menu
				09 - Party Menu
				0A - Gate Out (Can crash game.)
				0B - Log Out (Can crash game.)
				0C - Start Menu
				0D - Controller Settings
				0E - Vibration Setting
				0F - Screen Adjust
				10 - Volume Settings
				11 - Return to Title Screen
				12 - Run Demo during Data Drain
				13 - Voiceover
				14 - Subtitles
				15 - ???
				16 - ???
				17 - ???
				18 - ???
				19 - ?
				1A - ?
				1B - ?
				1C - Randomly combine to form keyword.
				1D - You now have !
				1E - Discard Item for ___ ? Give up ?
				1F - ?
				20 - "You now have The Hanged Man!" Rank 1 Chest.
				21 - "You now have Fortune Wire!" Rank 1 Trapped Chest.
				22 - ?
				23 - ? Opens some menu that doesn't display and freezes the game.
				24 - "Received effects of !"
				25 - "You now have Virus Core A! It is added to Key Items."
				26 - "You now have Mountain Helm!" - Gott Statue Chest.
				27 - "Current time: 00:16:17. Outside the Ranking" + "You now have Speed Charm!"
				28 - "This spring has a strange feel. Maybe I should throw in a weapon or a piece of armor."
				29 - Give Spring of Myst Menu
				2A - Throw in Confirmation Menu
				2B - "You now have Golden Egg!"
				2C - ?
				2D - ?
				2E - ?
				2F - ?
				
				30 - ?
				31 - Menu with Log Out option.
				32 - Give Menu.
				33 - Sell Menu.
				34 - Buy Menu.
				35 - Save Menu.
				36 - Inventory - Kite
				37 - Inventory?
				38 - ?
				39 - Warp Menu
				3A - Gate Menu
				3B - Word List
				3C - No area codes are registered.
				3D - No servers have been registered.
				3E - Gate Hacking
				3F - Status?
				40 - Equipment?
				41 - No target in range. - Strange behavior happens during debug after this point.
				42 - Data Drain.
				43 - No target in range.
				44 - Data Drain
				45 - There are no members to join your party.
				46 - You cannot use this command unless in a party.
				47 - You cannot use this command unless in a party.
				48 - ???
				49 - No target in range. ???
				4A - Unknown Event, causes game freeze.
				4B - Select "Party"
				4C - Select "Add"
				4D - Select "Orca"
				4E - Select "Add"
				4F - Select "Orca"
				50 - Select - Some weird behavior happens past this point, making it hard to test.

After a while the events start causing weird behavior and inconsistencies.

dothackers.net

Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)

Re: Hacking .hack//Infection (How to make Skeith spawn anywhere)