Master Sword Pedestal Shenanigans

[giadrosich]

Is there any way possible to put the Pedestal inside temples and have Link go forward and back in time this way? I don't have a clue what causes the actual travel to the past/future. This is probably way out of reach what the game or me can accomplish, but I think this could be an interesting feature.

 

[mzxrules]

The problem is that the Master Sword places you at one entrance for pulling/dropping it (or maybe it's two; one for pulling, one for dropping). You can't just freely plop it in any dungeon and be able to return to it after pulling or dropping it.

[Three_Pendants]

Without massive ASM hacking to change the function of the Master Sword, yes. That is the real issue there. We know that the Master Sword has at least two (maybe three exits) programmed into it. One is the Ganondorf in the Sacred Realm scene when you first pull the sword. Second is a Child Temple of Time object set and the Third is the Adult Temple of Time object set. But there may be something else going on under the hood as well.

[Xylaphone]

have you considered adding unlock able exits in the temple of time that work similar to the way shires in the skyrim dawn guard? after you get to a shrine a portal opens in it to allow you to travel to the other already visited way shrines; so you could have hidden doors in each temple that allow you to go to the temple of time to switch time periods way faster, I know it's probably annoying to add exits from each temple to the temple of time though.

 

http://elderscrolls.wikia.com/wiki/Wayshrines_(Dawnguard)

[Strati]

I've been studying the Master Sword code these last days and translated the code into something a bit more understandable.

There's a lot of notes that may or not make sense. 

Here it is:

http://depositfiles.org/files/y0nauhzpm

 

WARNING: A good deal of addresses and values may work only by determined conditions.

 

To Do: Find the external function for adding the MS to the inventory and search deeper into the exit routine to get how the child / adult changing works exactly.

I think that idea to implement the variable => entrance could be done, I am just not so sure about how to handle the age switch.

Edited March 24, 2013 by Strati

[giadrosich]

I wish I could understand what you've shown, so I'll just say awesome.

[Three_Pendants]

I've been studying the Master Sword code these last days and translated the code into something a bit more understandable.

There's a lot of notes that may or not make sense. 

Here it is:

http://depositfiles.org/files/ff1b0zk2a

 

WARNING: A good deal of addresses and values may work only by determined conditions.

 

To Do: Find the external function for adding the MS to the inventory and search deeper into the exit routine to get how the child / adult changing works exactly.

I think that idea to implement the variable => entrance could be done, I am just not so sure about how to handle the age switch.

I've done a bit of research on the Master Sword as well. The first time trip does not immediately change you into an adult. It is after the Ganondorf cutscene that the game switches that variable from 0-1 how it works beyond that is not known to me.

 

In my topic of http://www.the-gcn.com/topic/1867-zelda-oot-how-to-choose-which-items-quest-equipment-or-otherwise-you-wish-to-obtain-from-most-npcs/

 

I have the method of deciding what item the game is giving you, where it goes, and what will be plastered on the B Button. Here are my notes on the matter..

 

Here's the information on how to manipulate the Master Sword to what you will...

 

As above there is some value of 12000F0 that I have not located plus 7034 which is the pointer to the Master Sword/Fire Medallion at 127124. I would ideally point the Master Sword away to another 00000002 (by using 12000F0) to another 00000002 value) to free up the Fire Medallion spot. So say you wanted to continue being Kid Link after picking up the Master Sword and wanted to use that nifty Kid Link Master Sword model.. So you would change the pointer of 7034 to 703C which is the Broken Giant's Knife 

 

From there you then change 85084 from 35D80002 (Location of Master Sword Icon) to 35D80003 Which will force change the Equipped Sword to the 3rd Value which is reserved for the Biggoron's Sword/Giant's Knife/Broken Giant's Knife

.

So in steps...

 

Step 1. Go to 8506C and change 240C003C (Master Sword) to 240C0055 (Broken Giant's Knife (except not really) for B Button when Sword is Drawn

Step 2. Go to 84FE8 and change 8DAD7034 (00000002/Master Sword) to 8DAD703C (00000008/Broken Giant's Knife)

Step 3. Go to 85084 and change 35D80002 (Master Sword) to 35D80003 (Giant's Knife/Biggoron Sword/Broken Giant Knife cursor location)

 

And there you have it! By following those three steps you will make the game think that you legitimately have that item, no weird codes involved. Hopefully it will be of use to modders who really want to throw the player for a loop

[Strati]

Thank you, Three Pendants. I actually was reading this topic earlier, but haven't looked yet into the MS aquisition code.

My major concern now is finding how to retrieve the actor variable value. The spawn actor has it as an argument in T2, but it is soon overwritten without being read.

The stupid reasoning is that it's used somewhere earlier in the code, but it still doesn't explain why the function receives it.

I thought of retrieving the address directly from the map data, but I think that would require a big control over actor indexes and offsets if we were to implement a function that runs from different maps.

By the way, I have a maybe n00b question on that:

Is there any way we can find where virtual addresses will be? Or at least a reference address, maybe a table with pointers?

[Jason777]

You can find the actor variable 0x1C bytes away from the start of the RAM actor (it's sometimes referred to as the "actor panel"). The address of RAM actor can be acquired by the return value of the ActorSpawn function. Here's how I would bascially grab the variable...

 

// Wherever you found the routine// that spawns the desired actor...JAL 0x80031F50 // call to ActorSpawn function// address to RAM actor is now in V0// place this anywhere before V0 is overwritten// or where you can keep track of the RAM ActorLHU AT, 0x1C (V0) // (*(u16*)(RAM_ACT + 0x1C))// Now hook into your custom code// Read the variable in AT

I was actually thinking about what you guys were wanting to do. I propose that we could deal with the hack like this...

 

Whenever you pull the mastersword, if it has a variable other than the default variable used in the temple of time, spawn an exit as if Linkfell out of the scene (you respawn at the last used entrance in the map) and load as adult link/child link (hold R to switch to adult link GS code, anyone?). You would do an XOR (or NOT) operation on the Young Link flag to make that change, I believe. The only thing is that I'm not sure how object sets would work.

 

Also, Strati, I've been taking look at your disassembly... holy cow. Nice work!

[Strati]

Done!

 

http://depositfiles.org/files/5n62gq8dh

 

 

You must change the MS variable to the exit number you want (check the exit table). That includes the Temple of Time itself, because I was too tired to do the extra "IF x = FFFF, branch out".

If everything goes right, I'll fix that soon.

 

 

That will put you at an entrance, so the idea would be to add an entry point in front of the pedestal. Still, it will be as you just entered, without the animation when you arrive from time travel.

It's far from be the ideal solution, but for now it will do.

 

Jason, thanks to your info I found that one of those numbers that kept appearing within the actor actually stood for the start of file, actor table address.

By the way, I updated the disassembled MS document, so it's slightly less confusing.

[Three_Pendants]

Well done Strati! I'll look over these notes a bit later. Great work on figuring out the Master Sword!

[giadrosich]

So what does this mean for time travel anywhere?

[Jason777]

Excellent job, Strati! I'll be looking at the changes you made in the actor file to understand what you did. Any chance that you'll release the source?

 

giadrosich, you can basically implement those puzzle designs where you were hoping to use both Young and Adult Link All you would need to do is apply Strati's patch (make a backup ROM incase the patch interferes with other fhings!), place the Master Sword actor where you want, and then specify the exit to return to in the variable.

 

http://wiki.spinout182.com/index.php?title=Debug_ROM:_Exit_List_%28alternate%29

[Strati]

Updated that post above with an updated patch.

 

Now if you leave the variable as it is (default FFFF) it will work normally. I'll also fixed a small problem that made the game glitch with child Link.

 

Messing with the Master Sword: The Story

 

After investigating the cutscene exits, thanks to the wiki I could find the address of the redirection table. Both cutscenes pointed to entry 8. At first I thought there were separate tables for child cutscenes and adult ones, but after breakpointing I found out the obvious - they point to the same table, thus, the same function.

 

I used a breakpoint in a JAL to the Spawn Area function and backtracked the values until I identified the address where the scene entrance offset is kept. From there, I needed to figure out how to access the actor's variable.

 

With the hint from Jason, I went to work into the first patch.

My first problem was to find empty space so I could write the new code. Near the end of the file, there were 3 instances of the same ascii data, which were accessed by the draw method. After a brief test, I confirmed I could overwrite the repeated data without breaking the game. That gave me the space for around 8 instructions to work with - more than enough.

 

9601001C    lhu    at = (s0 + 0x1C)   //s0 is the virtual address start3C198006    lui    t9 = 8006273955AE    addiu  t9 + 55AE          //RAM address for the entrance offsetAF210000    sh     *(t9) = at03E00008    jr     ra

The hard part - that ended being very easy - was to find a breach in the normal code where I could insert the JAL to the new function. My luck was to find one right at the actor loading part so the extra code would run just once instead of each iteration of the main loop.

OLD CODE                                   NEW CODE26050150 addiu    a1 = s0 + 0x150          0C22F112   //JAL to my code55C00003 bnel     if t6 = 0 go to Label 0  26050150   //addiu in delay slot8C4F1360 lw       t7 = *(t6)               15C00003   //bne replaces the bnelAE000134 sw       *(s0 + 0x134) = 0        8C4F1360   //lw in delay slot8C4F1360 lw       t7 = *(t6)               AE000134   //swLabel 0

After struggling a bit to learn how to write MIPS in hex code and calculating the JAL offsets, I went to test it. It failed heavily - my new JAL wasn't realocated to reflect the virtual address, so the code was thrown in a blank range of the memory, bringing the game to a crawl.

 

Eventually, I found the info I needed in the Actor page from the wiki: The last lines of the actor code hold an array for instructions that need the offsets they'll work with adjusted.

There I found just the space I needed, a word worth of 00s at the end of the array. Instead of writing the entry fix for my JAL at the end, I "pushed" the code over those 00s and wrote the entry where it would be given the natural order.

 

Tested the game, adult Link pulled the sword, child Link appeared at the Deku Tree. Ok, It works, I'm tired, gonna post the patch...

 

Patch 2:

 

So, the deal was if you don't mess with the MS variable, it should work normally, not take you back to the Title Screen. With a few free spaces left from before I added the test and branch instructions, relocated the JAL target for a few lines above and tested it with child Link.

FINAL CODE9601001C  lhu     at = (s0 + 0x1C)   //s0 is the virtual address start3419FFFF  ori     t9 = R0 OR 0xFFFF  //t9 = FFFF13210003  beq     at,t9; (PC + 16)   //if at = FFFF, branch to jr3C198006  lui     t9 = 8006          //delay slot273955AE  addiu   t9 + 55AE          //address for the entrance offsetAF210000  sh      *(t9) = at03E00008  jr      ra

The game slowed to a crawl, just like before. It came to me I never tested the first patch as a child and went back to see if the game was crashing without the new additions to the code. It did crash.

 

After some thinking, I found out my mistake: When I added that entry to the relocation array, I counted 21 entries, just as the header said. Forgot the basic rule that arrays start counting from 0, so the last instruction I pushed to the place of those 00s wasn't being parsed to the virtual address and sending the game to a derelict area of the RAM where NOPs are kings.

 

Finally, 21 becomes a 22 and that settles the score.

[giadrosich]

I'm a little confused by changing the variable thing, does that mean for example if I put the MS into the Deku Tree as a kid, and then change the variable to 4102 it'll work?

 

EDIT: I keep getting a crash even with the updated patch too. I just kept the variable as FFFF as well.

[Strati]

Almost that. The value you want for Deku Tree is 0000.

 

You'll find the list says:

0000 Child: Day : Entrance 00 : 0000 Deku Tree0001 Child: Night : Entrance 00 : 0000 Deku Tree0002 Adult: Day : Entrance 00 : 0000 Deku Tree0003 Adult: Night : Entrance 00 : 0000 Deku Tree

But you don't need to consider time and age, just take first value.

 

Example: Ice Cavern, values 88 to 8C

 

These codes obey a pattern:

0088 Child: Day0089 Child: Night008A Adult: Day008B Adult: Night008C Cutscene --> has age predetermined

As I said, take the first value, 88.

Let's say you just arrived from the future, nighttime. So, you should appear as child by night.

How it works internally:

The game takes the 0088 value you put into the variable and adds another value according to the new situation:

0088 = 0088 + 0 >> Child: Day0089 = 0088 + 1 >> Child: Night008A = 0088 + 2 >> Adult: Day008B = 0088 + 3 >> Adult: Night

In this case it would be +1, but you shouldn't worry because the game handles that change on its own.

 

Possible reasons why it's not working:

1) It's interferring with another change you made, so the ideal proof test would be trying it into an clean rom;

2) The ROM I used to make the patch is different from yours. I don't know how to identify that, though.

3) I haven't tested it outside of the Temple of Time.

[Strati]

Sorry for double-posting. It's for a good reason though.

 

I had to fix yet another thing in the patch - blame my lack of attention. Hopefully now, it will work as it should.

 

If it still doesn't work for you, giadrosich, tell me and I'll post the all the places for Hex editing, step by step.

 

Lastly, I've been testing with a custom map and unfortunately, the sword grabbing/dropping animation is relative to the 0,0,0 coordinate of the map, so wherever the sword is, Link will appear grabbing a air-made sword near the 0,0,0 spot.

With much luck, those positions are relative to rooms, but most probably it's for the whole scene/collision map.

[Jason777]

Updated that post above with an updated patch.

After struggling a bit to learn how to write MIPS in hex code and calculating the JAL offsets, I went to test it. It failed heavily - my new JAL wasn't realocated to reflect the virtual address, so the code was thrown in a blank range of the memory, bringing the game to a crawl.

There are much easier ways than trying to write assembly in hex code by hand and applying them to actors http://64.vg/dr/node/75

 

The only thing that you would need in order to recompile the actor is a mips-gcc environment set up... there's a WIP (I say WIP because it is incomplete; I have no idea when I'll get the motivation to come back to it) tutorial I made on how to do that here: http://www.the-gcn.com/tutorials/article/4-ootmm-hacking-with-c-and-asm/

 

nOVL, the program used to create actors from MIPS ELF binaries generated by GCC, is already in the download given by the tutorial.