Topic: Off-Screen Mapping

[Eggz]

Now I know it might be a bit late in asking since I've already managed to complete a significant part of my current project without it, but I've been getting curious lately about some of those "walking through walls" cheats that some of you use for your mapping to get to the areas off the screen.



What I'm referring to is how to get the images in the areas off the current game screen, areas you can't reach but show up as ugly blank spots when assembling the map pieces afterwards. My current method of mapping consists of turning off the sprite layers, taking screenshots of the current screen, assembling the pieces, and moving on to the next area, rinse and repeat, and finally assemble all the pieces. But the downside to that is that it leaves unsightly empty areas afterwards.



Now I tend to be a tad anal-retentive about leaving something so obviously unfinished like that, so my current mapping techniques lead me to use the Clone Brush option and, using the objects given on that particular map, fill in, create or edit those areas so as to have a finished-looking map to submit. (Have a look at my various attempts on my maps here.)



Now, I don't know how to go into the emulator and rip out the original game maps intact, and no "Walk Through Walls" type of cheats exist for my particular game. What I'm curious about is whether those codes are game-specific (I know I read somewhere that either marioman of Maxim had such codes for one of the games they were mapping), or whether they are Emulator specific (I use Snes9XW).



Also, what do you all think of my current way of getting around this problem (map editing)? I've tried asking for input there in the Maps In Progress thread for my project, but I haven't gotten much response. I've been wanting to bounce the idea off those of you who do this more often (and better) than I.

---

This looks like a job for Science!

[dammit9x]

1) Use an emulator with memory viewing and editing features.



2) Find the places in memory that determine the camera position. You need a "cheat search" function to do this.



3) Use patch codes or a memory-poke function to change those addresses to make the camera move exactly one screen at a time. Take a shot of each screen. (Try to also use other codes to hide the character sprite and freeze background animations.)



4) Use a utility like imagemagick to append individual screens horizontally into rows, then append rows vertically to make the whole map.



Do not attempt to stitch random screens together unless you have a tool like Maxim used for Micro Machines.

[Eggz]

And what sort of emulator would you suggest for that? And the fact that I stated that I don't know how to crack roms and read their memory in the first place, let alone determine what sets the camera position, without any tips as to how to do this points to a rather large problem with your advice.

---

This looks like a job for Science!

[Maxim]

A typical debugging emulator will have a memory viewing window. Get the emulator in a state where you can control the camera x/y (eg. for Sonic, I could press the jump button or run around) and then trawl through looking for numbers that seem to correspond to the motion (eg. they change exactly when the camera moves and seem to move the same way). There's your memory location.



What to do with that is another question entirely. You might be able to make a hack code to override the value, but that doesn't necessarily work (in my experience, it fails more often than it works).



Walk through walls hacks are generally game-specific. They're generally quite long because they're actually code patches.



I tend to try to hack if possible, then switch over to filling in the blanks where it seems to make sense. Hacking is hard, there is (generally) no generic solution.

[JonLeung]

Way back in the day I raved about a program called BGMapper, though I think I only used that remotely extensively when mapping A Link To The Past.



BGMapper was an external program that loaded up ZSNES save state files, and allowed you to view the map data in memory at the time of the save.  It would load up large square chunks, allowing me to see the very northeast corner of the map (I wasn't sure if there was that small tree there) as well as the odd separation in the northeast up on Death Mountain.



That was a specific program, and it was DOS-based, but it worked for what I needed at the time.  Sites like zophar.net probably still have that and other utilities.

[TerraEsperZ]

The essential tool for me is Visualboy Advance's Map Viewer which, as Maxim stated, allows you to view the content of the four map layers in memory. It has helped me so much that I now find all the other emulators deficient for not having something similar.



I think there was a version of FCEUltra with extra debugging options that allowed you to see a similar map but for the NES but I haven't tried it enough to know it's true usability.



What I'm really interested in are hacks/cheat codes that would allow you to move either the camera or the player's character wherever you want to. I don't know if one of those is easier than the others, but judging from what you said regarding your Sonic SMS maps, I'd assume it would be easier to move the main character than the camera.



Incidently, for the past few weeks, I've been trying to track down/contact someone named Nitsuja  who's responsible, among other things, for creating a lot of incredible speedrun videos over at tasvideos.org, and, the part that interests me, made a hacked version of VBA that allowed him to move around the maps in all three Sonic Advance games, with which he created maps for all the stages which are posted at www.soniccenter.org (but sadly, he reduced them entirely too much in size; getting the full size maps from him would me awesome).



Anyway Maxim, since you seem to be one of the kings of hacking here, do you have any practical example on how to make such a camera hack/cheat that we simpletons would understand?



---

"With the first link, the chain is forged. The first speech censored, the first thought forbidden, the first freedom denied, chains us all irrevocably." [...] The first time any man's freedom is trodden on, we're all damaged. - Captain Jean-Luc Picard



Current projects: Sonic CD (Sega CD), Mega Man V (GB), Mega Man Zero (GBA), Battletoads (NES)

[Maxim]

I'd say, it's very very hard in almost all cases. When I hacked SMS Sonic 1 I was very lucky - it does use a RAM-based camera position that is somewhat independent of other factors and that made it fairly easy. I've spent hours trying to do the same to Sonic 2 and failed.



The Sonic games are a special case because, unusually for the SMS, they store the entire level uncompressed in RAM (which takes half the memory). Most games instead load the level from an efficient (usually compressed) ROM storage as the player moves around, and thus an independent camera hack won't work. You'd have to make a similar hack that gives 4-way no-clipping control of the main character that the camera, and level loading, uses. That's likely to be more work than a camera hack, mainly to get past all the code devoted to stopping your character walking through walls, dying, falling due to gravity, or whatever else applies in the game in question.



So overall, for a simpleton such as you the answer is: you can't do it. But maybe you can find the memory location, pass that on to a suitable hacker, and hope (s)he can make it work. Finding candidates is easy (described above, watch memory and look for it), testing can help (learn how to make RAM-hack codes for the system/emulator in question* and see if they at least fix the camera) and after that, it's a matter of time and luck whether a true hack can come of it.



The problem is, sometimes the value you find is the result of a calculation rather than the input to it. Changing just that part will result in some screwy incorrect result. Tracking it back to the underlying source might be possible, but often the underlying values are non-intuitive or hidden the other side of thousands of lines of assembly with a hundred branches you have to traverse backwards. Which is very hard work.



* eg. for Sega 8-bit systems, address AAAA data DD, the code is 00AAAADD. For Mega Drive, it's something like 00AAAAAADDDD. But for others it's often obfuscated and hard to reverse; just hope the emulator has an address:data type cheat mechanism.

[dammit9x]

Eggz, here is an example of how to do step 2 for snes9x.



STEP2A

Get to an area where you can control the camera and position it somewhere in the middle. Save. Open "Search for new cheats" and pick 2 byte (that's a guess) and unsigned. Then click Reset to set the reference point and clear the window.



Move right until the camera moves slightly. Go back to the search. We assume that rightward is an increase in camera X-position so choose "greater than" and "previous value." Then click Search.



Clear the window and move the camera again, this time to the left. Go back and choose "less than" and do another search.



Go back and move a bit, but in a way that doesn't move the X-coordinate of the camera. Go to the search and pick "equal to" and search again. Each time a search is made the list shrinks.



In this way, keep adjusting the camera and commanding the search to filter the memory addresses according to what you know the camera is doing. If the whole list disappears, you gave an inconsistent instruction so start over.



You should eventually get a list of a dozen or so addresses holding similar or identical data. Now to find out which one truly determines the position. (The others are mirrors.)



STEP2B

Go down the list doing this: Click an entry and click "Add cheat." Set the "New Value" to zero. Make sure the cheat is ticked in "Cheat Entry and Editor" and that "Apply cheats" is ticked. Play the game a bit and see if the camera is forced all the way to the left (or right).



Nothing happened, or something weird happened? This one was a fake. Deactivate or remove the cheat you just added, reload the save and try again with the next in the list. There may be more than one relevant address because the snes has multiple graphics layers. In that case you will need to find all of them. (Hide individual layers with keys 1-5 to help you distinguish them.)



After you've done all that, do step 2a and 2b again for the Y-coordinate. They should be very near the ones you isolated. (Tip: for Y coordinates, downward, not up, is usually the positive direction.)



Let me know when you've gotten this far and I'll help with steps 3 and 4.

[Maxim]

I find it a lot easier to find the values using a memory viewer than a cheat finder, but then again I tend to be working with a system with only 8KB of RAM...

[DarkWolf]

I remember back when I was using an earlier version of Windows I had a program that would find cheats for PC games.  Of course, these programs don't work in newer versions, but I remember being able to use it on emulators.



I have a Win 9x machine (the one I used to help out with Wolf 3d and Blake Stone).  I should try it again some day.

[TerraEsperZ]

By the way Maxim, I assume that you use Meka as your Sega Master System emulator of choice (I wonder why ) but does it allow you to do relative memory search like Damnit9x described above?



---

"With the first link, the chain is forged. The first speech censored, the first thought forbidden, the first freedom denied, chains us all irrevocably." [...] The first time any man's freedom is trodden on, we're all damaged. - Captain Jean-Luc Picard



Current projects: Sonic CD (Sega CD), Mega Man V (GB), Mega Man Zero (GBA), Battletoads (NES)

[Maxim]

You can get programs to do that in XP. They just have to use ReadProcessMemory instead of reading arbitrary addresses.

[TerraEsperZ]

Really!? I don't know why, but I always assumed that a program's allocated memory wasn't easily accessible by anything else. Do you have any to recommend, and can they also "patch" a memory location even though it's reserved, thus acting like a universal Game Genie?



---

"With the first link, the chain is forged. The first speech censored, the first thought forbidden, the first freedom denied, chains us all irrevocably." [...] The first time any man's freedom is trodden on, we're all damaged. - Captain Jean-Luc Picard



Current projects: Sonic CD (Sega CD), Mega Man V (GB), Mega Man Zero (GBA), Battletoads (NES)

[dammit9x]

TEZ, try this:



http://www.memoryhacking.com/



It's only for win32 though.



But where is Eggz?

[DarkWolf]

I figured there was a way to do it since trainers still exist, but the last time I looked there was no generic cheat finder that worked in XP.  I suppose I should look again.