Hack it to Bits

One guy's adventures in video game and program hacking.

*

A blog of my various adventures in video game hacking, as the page title suggests.

view:  full / summary

Adventures in Video Game Hacking - ANNOUNCEMENT

Posted by Hack on April 4, 2012 at 4:05 AM Comments comments (0)

First of all, I guess I should tell all of my readers (If there are any, that is...*foreveralone*) why I didn't update recently.

Put simply, I accidentally deleted part two of the Debug Menu exploration and didn't feel like redoing the whole damn thing all over again.

I'll update real soon, I promise.

And it won't necessarily be about Pokemon, either. ;)

In fact, it's probably going to be the game in the right image on the header. See if you can figure out what it is.

   TTFN,

          RCTM

Adventures in Video Game Hacking - Pokemon Mystery Dungeon: Explorers of Darkness - The Debug Menu - Part 1

Posted by Hack on March 13, 2012 at 3:55 AM Comments comments (0)

Okay, I just found some awesome stuff tucked away in PMD Darkness.


First of all, this is the AR code:

0202a09c a3a01000

94000130 fe7f0000

0202a09c e3a01008

D0000000 00000000

Hold R and scroll down to the last visible option. Then, scroll down one more. Your cursor should be pointing on an invisible option; press A now.

(It should be noted that the menu background plays a factor here; if the background is of Chatot and the Guildmaster in the Guildmaster's Quarters, you're good. Anything else, go in the "Exploration Record" subsection and hold down X. Then, scroll down to the invisible option, which should cause the cursor to jump to the bottom fourth of the screen. Press A.)

Note that the above code only works on Darkness, and may bring unpleasant results if used on Time or Sky, due to differences in coding.

You should be at a menu that looks something like this:

Now we're going to explore each and every menu. Be warned, this may drag on for a half-dozen parts or more.

Dungeon Debug Play:

No matter what your team size is, this option will always inform you that there is no room for "the guest exploration team's" (implying a friend's temporarily imported team that, obviously, doesn't exist, or is merely a set of placeholder mons for debug purposes...that is what these menus are about, after all.) Sunkern, and a subsequent similar remark about a Cacturne.

And...then it sends you to the "Ice Aegis Cave" dungeon. For some reason.

Also, it named my Infernape "Rayquaza" and my team "???," as if it hadn't been founded yet or something. Don't know what the heck that's all about, and what it names the first Pokemon changes each time you select DDP.

The recruit rate for every wild Pokemon is locked at 100%, too. Which would be nice, if Unown weren't completely useless or I actually got to keep them after this weirdness was over.

Speaking of weirdness...

I tried it again, just for laughs and...the layout was the exact same as last time. Even the traps (Poison Spike, by the way), enemy spawn points, down to the exact letter of the Unown and the spawn time. Freaky.

Actually, that's not the weirdness I was talking about:


This is.

Yeah, it spawns you in the wall, and it always shows that tutorial message...

Wait, that wording only existed in the original Tiny Woods tutorial stage! :o

Anyway, moving past this message automatically end the level, dumps you out at the menu...

And deleted any Unown you may have recruited.

Told you so.

Also, when scrolling back down to the debug menu, it shows you the last bit of text that was displayed.

In this case:

"Ice

Aegis Cave."

Yep. Apparently, that floor indicator that shows up between stairwells is actual text, not an image or something. I believe it's Comic Sans, though I'm not certain.

Ground Debug Play:

Here's where it gets interesting. Really, really interesting.

This selection dumps you out at...

Holy petaflops, it's the Treasure Town from Red/Blue Rescue Team. Complete with NPCs like Lombre, Persian, the original Kecleon brothers, and Snubull (Erm...Granbull, actually.).


Oh, and this universe's Kanghaskhan is a complete d*ck. :/

Nintendo had one weird sense of humor, though it was probably to distract them from the utter monotony of game programming.

Also, notice how the hero and partner are both Bulbasaur?

Those aren't Bulbasaur, those are a placeholder (No, not Arceus, though he does have all eighteen slots to himself unlike in Sky. No-plate form, standard plate forms, plus the universally unused "Normal Plate" and "??? Plate.") called "reserve_22." More about those "reserve_" species in my Sky hack journey; for now, let's focus on Darkness.

Now, trying to access these through an Action Replay and..."normal," considering what we're doing now...gameplay will just make Sky freeze (I know I'm back to talking about the third game, but I'm going somewhere with this), probably due to safeguards against the "reserve_" species outside the debug mode.

Of course, we're in debug mode now, so that isn't a problem...But it's irrelevant at the moment, and I'll return to the subject at a later date.

Anyway, let's return to the focus of this post.

Jaunting around the rest of fake-Treasure Town, I notice a Makuhita just sitting there making his idle animation.

I go up and talk to him.

"Makuhita:An event will be activated.

Which one would you like to see?"

:roll: Why, all of them, of course. First, uh...could you tell me what these "events" are?

Okay, this guy lists a menu:

  • ACTING_TEST (Plays various crowd animations of specific, story-critical scenes.)
    • M01A01A: Oh god the screen is flashing black what did I do wrong-oh, it's just an unidentified speaker saying "It sounds like the natural disasters were interfering with our ability to evolve" (Which, by the way, is a verbatim quote from R/B Lombre.) "I think the timing's right. I should think about evolving..."
  • STATION_TEST:
    • STATION_01: A Magnemite that says "Gritty hard" (and no, there wasn't a period at the end)...yeah, this just keeps getting weirder and weirder.
    • STATION_02: A Jumpluff that says "Soft & flufy" (...Well, at least they used a ampersand)
    • REMOVE_01 & REMOVE_02: Two separate commands; they do exactly what they say.
    • STATION_M01A02_0: Slams the screen to black, revealing...
    • AH! Where did you all come from?! Sadly, they're all completely mute. Minus Lombre, who isn't affected by this STATION command.
  • SOUND_TEST: ...Do I really have to explain this in depth?
  • DUNGEON_OPEN: I didn't really mention this before, but; you see that northern pathway, the one that would normally lead to Whiscash Pond? That leads to a programmable dungeon entry portal, done so through this command. ALL_CLOSE removes all dungeons, ALL_SCENARIO unlocks all dungeons and gives them story flags, ALL_RANDOM  unlocks all dungeons without their story flags, TYPE 1 unlocks only Drenched Bluff and gives it a story flag, D006B_SCENARIO does...nothing, apparently. Could be a dummied out R/B dungeon, though.

Anyway, it's getting pretty late (2:30 AM PDST). I'll post the rest of this tomorrow; TTFN.

Adventures in Video Game Hacking - Pokemon Mystery Dungeon: Explorers of Sky, Part 1

Posted by Hack on March 12, 2012 at 7:25 PM Comments comments (0)

Okay, so I know I haven't updated the site in ages.

But I'm trying something in a little different direction now: A blog, in which I will post my experiences in game hacking, and even some hexadecimal and/or three-digit charts for you hex-editers and Action Replay users out there who may want to explore these games yourself.

Let's start, shall we? The first post in this series focuses on various "hidden" Pokemon in the second set of Mystery Dungeon games (Specifically, Explorers of Sky. Keep in mind that not all items in Sky are available in Time/Darkness, and vice-versa, so results aren't 100% guaranteed if you're using either of those games.)

Firstly, the Hero modifier code:

122B515800000XXX

And the Partner modifier code:

122B51C000000XXX

(Where 'XXX' is the three-digit number of the desired Pokemon)

The three-digit slots from 001 to 217 are only male versions of each Pokemon (Where gender is applicable), where 000 is null data (literally; outside of dungeons, 000's species is shown as "_null") that will crash the game when you attempt to load it in a dungeon. The only truly interesting thing about 000 is that is copies the sprite of the Pokemon in the "Leader" slot (As it can't be shown in dungeons, this will always be the Hero.)

The female versons of each pokemon (again, where applicable) start at 259 and end at 470 (And for whatever reason, another "_null" placeholder exists at 258. Essentially, there are two sets of every single species of Pokemon, excluding the space between 217 and 258.)

Keep in mind that the numbering is not entirely "linear"; it goes something like this: 000-009, 00A-00F, 010-019, 01A-01F. Technically, that's oversimplifying it, but it's pretty easy to figure out after a bit of experimentation. (An emulator is recommended here, as I have not experimented on the volatility of some hidden species on an actual game cartridge.)

Anything beyond 481 is either a Substitute (Decoy doll), or junk data, so we won't explore past that until I have a little more free time.

Now that we've gotten past the dry, technical stuff, let's get on to the experimentation bits.

Everything from 219 to 227 is a placeholder, known by the game as ???????????? (or, Twelve Question Marks.)

Now, this wouldn't normally be that interesting, but let's level him up to 100 and check his moveset at the Electivire Shop.

Hmm...it learns Earth Power at level 20. Wow, that pretty early, I wonder...why...

Hold on...there's only one Pokemon that learns Earth Power that early...

Arceus.

Yes, you heard me right, there exist a whole nine placeholders for Arceus (Not eighteen, which would imply that half of His placeholders were cut to make room for Special Episode and cutscene Pokemon data, which I'll get to in a moment) in the depths of PMD SKY's Pokemon data.

And yes, it does learn Judgment. And it works perfectly, despite its name and description being "$$$," and even has the (assumedly, as it looks a lot like it does in the main games) proper animations.

So you can have a Bulbasaur that has Arceus's moveset. Awesome, am I right?

Okay, now let's look at some other...interesting...hidden Pokemon, starting with Special Episode 2, "Igglybuff's Wish."

23F: "Mama" (Actual species name. This is probably the Wigglytuff from the beginning of the episode; in this case, Igglybuff's mother.)

Here's where it gets disturbing.

243: ...Just...just, look.

Seriously, what is that?! Some mutant offspring of a Ditto and a Sentret? Is this what every result of Ditto breeding is?! Some sick, twisted, (possibly mentally handicapped), half-breed abomination?

Ah Nintendo, you and your sick sense of humor.

Join me again for the second half of this PMD Sky Hacking Adventure, because my wrists are getting tired and I have homework to do.


Rss_feed

Bulletin

Yet another major site reconstruction has been implemented at 2 AM PST on April 4.