hacking on the Tim Burton's The Nightmare Before Christmas GBA game.
I can see a lot of plaintext in the ROM, but some of it is obscured. I think it's some kind of basic compression.
hacking on the Tim Burton's The Nightmare Before Christmas GBA game.
I can see a lot of plaintext in the ROM, but some of it is obscured. I think it's some kind of basic compression.
no, it can't be compression, it takes more bytes. And removing it breaks the textbox.
whatever. I don't have to understand it to extract the font.
apparently I do, my injections are inconsistent?
main slowdown at the current moment: I forgot how to type an Ă
(it's compose, u, shift+A)
sometimes while editing a font, I get the strangest feeling, it's like I'm being watched
got the font. Maybe I need to get some backgrounds before I release it.
I think this map alone means this game is technically a Metroidvania
I got a controller out and I'm playing it again.
Cheat #1: 62E, set to 10, for max health
oh fuck me there's more than one map
STOP HAVING MORE MAPS
@foone Wait, you type these injections by hand? You do this so often, I'd figured you would have a "textInjections.txt" file filled with every character you might ever want to extract
@Canageek I do the injections automatically, but often that gives me the letters in a different order than I expect, so I have to map them back to unicode. thus the typing of special characters
ugh. this game doesn't seem to have any walkthroughs, I'd have to watch longplays.
and this game is longer than I thought. I might need to cheat flagrantly
@silentium thanks!
@foone not sure how helpful this is to you, but I found https://web.archive.org/web/20201230132118/http://forum.tnbc.eu/pumpkinking/walkthrough via the GameFAQs boards
So @silentium pointed me at an old walkthrough on the wayback machine, so I'm continuing.
I got the next weapon, and it's so crap that I've reached Ghidra O'Clock just to see if I can make this gun better
@silentium my theory: figure out where enemy health is in ram, set a watch on it, find out what code changes it, then use ghidra to understand that code, then patch the gun to do way more damage
My final problem with this generator could be solved by just shutting up and beating the game manually, but unfortunately, my brain thinks reverse engineering GBA games is more fun than playing them
so I'm gonna reverse engineer it more so I don't have to play it as much
arg. the addresses in the BizHawk ram watch system are segmented, and the addresses in the debugger are not!
it's like 16-bit DOS all over again!
so I gotta figure out which domain I'm in and then look up the memory map to figure out what the linear address is
unfortunately that's exactly what I'm doing.
fortunately this is trivial if you're using any segment other than the "combined WRAM" pseudo-segment, which does terrible merging of RAM segments to make cheats easier.
okay the enemy health is in IWRAM, at offset 5850h.
And according to GBATEK, the memory address for IWRAM is...
nonexistent! there's no such thing as IWRAM!
at least according to GBATEK.
SEE, the GBA has two main rams: on-chip and on-board.
but what you call these two are... inconsistent.
BizHawk uses IWRAM and EWRAM, as does corrupt.wiki.
GBATEK says "WRAM - On-chip Work RAM" and "WRAM - On-board Work RAM".
mGBA internally calls them "iwram" and "wram".
so whatever. iwram aka WRAM - On-chip Work RAM is at 0x03000000.
so 0x03005850 is the address I need to watch.
080B5AEA writes it. BINGO
wee, dynamic code flow! they're passing jumps around in objects. that's no fun
@gsuberland yikes! that doesn't sound... fast? optimal? it sounds like a bad idea just on general principles
@foone you just reminded me of the time I tried to reverse engineer Steinberg Wavelab to extract realtime playback data from it, only to discover that they use a really weird event driven programming system where every event causes pretty much every object involved in that event to be reallocated at a new address, making it impossible to form a static pointer chain. if this was an intentional act of copy protection I am impressed.
@foone I mean wavelab itself is a bad idea, I cannot count how many times I used to have it eat people's projects in the radio studios
@gsuberland
IWRAM:62F is the current weapon. You can set it to values of weapons you don't have, and it'll let you fire them
weapons:
1: frog gun
2: bat boomerang
3: pumpkin bomb
4: become fireguy
other values seem to just do nothing when you press fire.
dang it. I tried to go to a locked area so I could test my new fancy warping-hacks, but it turns out that was were I was supposed to go in the first place.
I entered a boss fight, tried to cheat its health, then gave up and tried to beat it normally. failed.
then realized I accidentally succeeded at cheating its health, and I had made it invulnerable by mistake.
whoops
"Go to the right. The path will be blocked by Pumpkin Blocks. Since you can't proceed, go back to..."
NOT SO FAST, WALKTHROUGH. I can cheat to Pumpkin Bombs, so let's break some sequences!
oh god this map scrolls.
@foone Isn't this easier done with Cheat Engine?
@jernej__s cheat engine would tell me when my emulator changes the RAM, not when the game inside the emulator changes RAM
@glyph I haven't either. I wouldn't really recommend it, personally. The combat is boring
@foone you’re really making me want to play this and I have never even seen the movie
076萌SNS is a social network, courtesy of 076. It runs on GNU social, version 2.0.2-beta0, available under the GNU Affero General Public License.
All 076萌SNS content and data are available under the Creative Commons Attribution 3.0 license.