Posts for welcotar

Post subject: thanks for this!
Experienced Forum User
Joined: 1/31/2015
Posts: 14
Oh hey congrats, it's nice to see an optimized movie finally up. :-) This game was very rewarding for me to study. It was the first game I got working in my first emulator ages ago, and I spent many months disassembling it. For all its bugs, it's full of brilliant stuff and still fun to play. It was awesome to post on tasvideos and find other people who were not only interested in a stack overflow in a 30 year old game, but who then worked to come up with creative exploits and perfect them like this. Perhaps we will randomly encounter each other again sometime. :-)
Experienced Forum User
Joined: 1/31/2015
Posts: 14
TheAxeMan wrote:
Very interesting. I wonder if there is some way to hack it to turn off random encounters. Another idea I had was triggering the ending by triggering the fight vs Chaos. If you make it so that Chaos comes up in a random fight it won't go to the credits afterwards. But if you hack Garland as an npc into Coneria and talk to him then it works. Only thing is there is a flag for the first two times you talk to him. Each time is actually a separate npc entry that disappears after talking. Then again, maybe you can just trigger the 'fight Chaos for the win' event. If this is possible then I think the fastest way to win would be to use the MUTE spell. The fight would be long but possibly still the fastest way to get to the credits.
In case you hadn't seen, Gyre cleverly figured out a way to do the NPC hack, which is way faster than the credit warp: http://www.twitch.tv/gyre_/c/6175077 Combined with his fear technique, this is now seeming pretty optimal... unless we're totally missing a one-trip hack? I would love to be surprised. :-) Edit: I think the codes Gyre's used are ad56a3b0/aa4c8593 and adaa83b0/4ca090. I'm about ready to be done with FF1 and move on to other projects, maybe another classic RPG.
Experienced Forum User
Joined: 1/31/2015
Posts: 14
Fortranm wrote:
Is it possible to jump to the ending of FFII from FFI in Final Fantasy I & II?
Hrm, maybe. My quick read is that FF1+2's boot code comes from FF1, it just calls into an extra menu in bank 6 (probably originally debug code) at the last step. Choosing FF2 copies a little program onto the zero page which programs the mapper to swap banks 10-1f and jumps to boot FF2. So what you'd have to do is select banks 10-1f, then figure out where in FF2 to jump. That'd take a dozen or so instructions, which might be tricky... a TAS might be able to do it with a little loop to copy them from the joypad or something. It might make more sense to just go look at FF2 instead. I would not be surprised if it has a similar glitch to the one in FF1.
Experienced Forum User
Joined: 1/31/2015
Posts: 14
Yes, this is all the J version. The same bug exists in the NA version, but because of the smaller alphabet the character set doesn't include jumps and addresses are entirely in ROM, so you can't really write memory and it's pretty guaranteed to softlock. It might still be possible to do something in ice cave or ordeals pillar maze by jumping into some other controlled memory, but I haven't found anything.
Post subject: credit warp!
Experienced Forum User
Joined: 1/31/2015
Posts: 14
Ok, after a very long day I've got a credit warp together. Interestingly though I'm not sure if it'll be faster than Gyre's RTA strats. I've checked all the steps but haven't optimized it. 1. New game, buy some heals and save at inn so you have 10G left. 2. Use 4ca9a6 to underflow gold. 3. Buy up to exactly 58 heals.* 4. Get yourself to a house shop and buy exactly 76 houses.* 5. Underflow your pure potion count to 255 using a2719ab0/984c5ab3. 6. Go fight some imps and have all your characters drink ineffectually until you have exactly 201 pures.* 7. Run 4c59a6. * I did this using a hex editor after I verified the method worked. Not sure how long it actually takes. The key insight was that the bytes at a659 happen to be JSR $6038, even though the program there groups the bytes differently. That's the house, heal and pure potion count which we control. So we can write a little program to jump to the credits roll with the potion count, then jump to the JSR to it.
Experienced Forum User
Joined: 1/31/2015
Posts: 14
Gyre wrote:
ad56a3b0/aa4c8593 sets the level of the second character to 102 (effectively 103 for morale calculations) which guarantees everything but bosses who have about a 2/3rds chance to run. Should be easy to manipulate without costing much time. I'd like to make it higher but loading accumulator values over $7F sets the N flag which leads to a crash down the line.
a2a698b0/8a4c8593 will set the third character's level to 166 (just need an extra op in there to clear the N flag). Edit: Oh, sorry, that won't help you, because the morale calculation wraps and 2*166 mod 256 == 76. I'll see if we can bump it up more, though.[/b]
Experienced Forum User
Joined: 1/31/2015
Posts: 14
Gyre wrote:
I've been doing glitched runs this week and got it down to a 59 minute RTA today. I think a TAS with the same approach would be less than 40 minutes. I do some slow safety strats for RTA that are unnecessary with minor manipulation.
Cool, exciting to see some RTA strats. :-) The fear/run thing is hilarious.
Gyre wrote:
I haven't found a way to skip or directly acquire the Key yet. Closest I've got is to use 4caf93 to get the medicine and take that to Elfland. Would save quite a bit of time to avoid that trip.
Oh, the key (しんぴのかぎ) is just inventory, so you can get it just like an orb by glitching it into your save file, with e.g. ae74c2b0/a84c90ab.
Gyre wrote:
Here's the basic route I have in mind: - Glitch 4 orbs. ad7e72b0/aa4c90ab ad9a71b0/aa4c90ab ad4d71b0/aa4c90ab ad80c3b0/aa4c90ab - Glitch medicine. 4caf93 - Glitch level of second character. ad56a3b0/aa4c8593 - Move second character to party lead. - Walk to ToF and trigger Garland fleeing. Warp back and get the lute and bridge. - Walk to Pravoka and trigger pirates fleeing. Get the boat. - Sail to Elfland and get the Key. - Sail home and walk to ToF. - Walk through ToF triggering all bosses to flee. As much as possible you want to manipulate enemies to surprise you and bosses/unrunnable encounters to go first in the turn order. If you can kill off your other party members without losing time, that might turn a profit with a reduced number of commands to input.
This sounds pretty good. I still have only been able to wrong warp to the current floor, but am hoping to find a warp into tofr to avoid some of the walking. Credit warp is going to be really hard but I still think there's a chance with so much control.
Experienced Forum User
Joined: 1/31/2015
Posts: 14
TheAxeMan wrote:
Which stats can you alter? Most of them are worthless. What you really need is an instant kill ability. Either the Bane sword or instakill spells like BANE or RUB with MP to use them. Hacked level or experience on a black mage could work, just need to reach Melmond for BANE.
It's easy to learn BANE (which is called クラウダ in J). To teach the first player, use
a8 a5 4c b0 / a8 4c b9 a3
To get MP to cast it, you can just corrupt the save like for the orbs, e.g.
ae 56 c2 b0 / a8 4c a2 ab
This sets num L5 casts to 7 (which is at $6300 + char offset (use 0 for first slot) + #24). It doesn't really have to be a mage. You might also need to set offset #2c to also set max casts, I'm too sleepy to test it right now.[/code]
Experienced Forum User
Joined: 1/31/2015
Posts: 14
Inzult wrote:
using this name
4c 91 99
will jump to something related to switching the party order and fill a bunch of stats and weapon/armor slots with garbage, mostly 0's. would it be possible to use a 2 line name, similar to the way you can edit the saves, to fill the stats with some other nonzero garbage?
That address puts you in the party reorder menu without loading the patterns or setting up the temporary ram for it (you can use the normal buttons to move garbage sprites around). When you push B to exit, it copies stats to $6c00-6dff then copies back the character at offset $301 to base+#$0, $309 to base+#$40, $311 to base+#80 and $319 to base+#c0. Those $3xx offsets should be 0,40,80,c0 in some order but are not set here, so it copies junk. Haven't been able to put that to use, though. You might be able to get it to copy ffs or something by turning off cartridge ram in the mapper. Jumping into menus is a cool idea, though. You can also run the party name menu, so could potentially input more instructions that way without resetting. But it crashes after entering the P1 name due to the same stack corruption bug we're exploiting, so you need to fix S, land somewhere safe, branch and then jump... not much room left. Another thing I'll look into this weekend sometime is jumping to the warp proc. 9a 4c 56 af just happens to work (and warps you to the current floor). But we might be able to manipulate the stack bytes it's touching to warp to some other floor.
Post subject: re: mystic key
Experienced Forum User
Joined: 1/31/2015
Posts: 14
Haha, I forgot about that---there are two types of door tiles, mk and non-mk, and from a certain point maps use mk doors. On my end I've been looking for a credit warp or faster warp to chaos still. Nothing has panned out yet. Some ideas - The msb of the return address on the stack is already #c9, which is the page with the end credits jsr. If we could just set $112 to the correct low byte and get to an rts, we'd be set. Or we could txs and then rti. I'm just a little over budget on instructions for doing this, though, and haven't been able to get more. - Write the credit warp code one byte at a time into non-volatile ram, then somehow jump into it. This is tricky because not a lot of non-clobbered ram is in range. Setting both the index and the data in the couple instructions we get is hard. And then jumping into that RAM is an unsolved problem. - Instead of getting all the orbs, we could make the map loading code return us to a floor in tofr, perhaps using warp or something. Might be faster.
Experienced Forum User
Joined: 1/31/2015
Posts: 14
I managed to get the earth orb with save corruption!* It should be pretty trivial to extend the method to get all 4 orbs or whatever else. It feels like a credit warp may be in reach now, too, but I still haven't found it... The new trick is that you can set things up to execute two names as code, which gives enough breathing room to do more stuff. If you just set the last byte of P2 name to BCS or BCC, and set P4's class right, you can land in P4's name after P2's. So you can choose:
; p2 name:
LDA $abs  ; load pretty much any value from a 16-bit rom addr
BCS          ; next byte after name is +$15
; brief trip through lala land then we land in p4 name
; provided we choose p4 class 04
; p4 name:
TAX          ; index the desired byte of save state
JMP $ab90  ; jump into save loop
So for example, you can start the game normally and save to get a clean file. Then reset, and start a new game. Choose the names
ad 80 c3 b0
and
aa 4c 90 ab
to modify the save file to have the earth orb. You can then reset and do it again to get whatever else. Note though that you should work up from lower numbered inventory addresses, to avoid overwriting WRAM with the ROM values on subsequent saves. (*If we want to avoid save corruption, you can also just hide the NPCs for the fiends and have a walkathon---I tested hiding lich etc. Is it preferred to avoid save corruption? I'm not sure what all is allowed.)
Experienced Forum User
Joined: 1/31/2015
Posts: 14
TheAxeMan wrote:
This is very cool! Could it be possible to execute multiple hacks by resetting and starting a new party? Or by changing your party's order and doing another loop?
Just switching party order won't do it; the only time when the game writes the name to this page is in the party selector menu. But, yep, you can save, reset, enter a new second character name, reset, then load your save and execute a new hack. Assuming the RAM doesn't get flipped during the time when you reset, the game doesn't actually clear it. I've experimented a bit more with jumping into the save game loop, too. Since we only control 4 bytes, we're pretty limited in the values we can prepare for the A and X registers, so can't really manipulate much of interest in the save RAM. That'd work 100% on console but it seems like resetting is the best way to do it for now.
TheAxeMan wrote:
About various skips, Ice Cave skip would have some issues. Ice Cave is the best place to get the gold you need to buy the bottle. Plus it has the flame sword that ends up being the best equippable weapon for the normal TAS.
It turns out you can get as many xcalburs as you want by jumping into the give xcalbur routine, exiting the castle, then going back in for another trip. This might be interesting for gold and/or for arming a party of fighters/knights.
TheAxeMan wrote:
Skipping orbs would be more valuable. If we can skip them all we just need to figure out how to beat the final dungeon. Earth Orb would probably be the biggest gain to skip since you could completely ignore Earth Cave.
Sadly I still haven't been able to get any orbs.
TheAxeMan wrote:
If the question is how to beat the final dungeon if we can go straight to it, white mages might be most useful. All the bosses have magic and so if they get muted there is a chance to do nothing. To get a quick kill we would need to grind quite a bit to get level 5 magic for BANE. It might be better to just do the Sky Palace and get the sky orb. As far as game flags, some other ideas: -There is a flag for learning Lefeinish. If we set that we can go to Sky Palace without visiting Sea Shrine. Still need the waterfall but that is easy.
You can pretty easily get the chime, or short circuit the magic key trading quest.
TheAxeMan wrote:
-We could go straight from ship to airship by combining airship flag with canal and Earth Orb or canoe.
It should be possible to get airship + canoe, sure.
TheAxeMan wrote:
If I could only skip one thing I might pick Earth orb over air orb. Earth Cave is loooong. My first thoughts for four flags would be Earth Orb, Water Orb, Lefeinish, canoe. You could head straight to Ice Cave after getting the ship, then get the airship. Need to hit the waterfall and Lefein before entering Mirage Tower. Get bane sword and light the remaining orbs. Now final dungeon will be easy. A more direct approach would be to light all the orbs. Pick a fighter and three white mages. Head to the peninsula of power and grind on zombulls. Then use mute to beat the final dungeon. Black mages could get BANE but it would be tricky to grind them up efficiently. Fighting is slow. Edit: Yeah, definitely Earth Cave if it's just one skip. Looking through my run, that would save about 12 minutes. At first glance air orb might skip more but unfortunately it skips the most important weapon.
The reason orbs are tricky is that they are on the $ce00 page, and are given as a side-effect of walking onto an altar tile. There doesn't seem to be a way to get there directly given the character set, though I'm not 100% certain it's impossible yet. Something new I've been considering is whether it might be possible to break the mapper to return into the bank with the end credits code (bank #d) or another bank. I was investigating some more the effect of character classes on the hacks: fighter (00) causes BRK => nope thief (01) ok bb (02) causes STP => nope rm (03) Interesting Mapper Behavior => nope (if no reset) wm (04) ok bm (05) ok Interesting Mapper Behavior: With 2nd player == RM, we execute 03 00 which is a read-modify-write op to ($00,X) = $10 -> $B549 this causes two writes to $b549 with bit 7 = 0 the first has bit 0 = 1, the next has bit 0 = 1 mmc1 sreg = 01xxx pattern loading code tries to select bank #9, actually selects #5 mmc1 sreg = 01 (00101) then return selects bank #e, actually selects #9 mmc1 sreg = 01 (11001) so later when we bank switch to #e, we end up in #9 instead. So by partly reprogramming the mapper, we might be able to access some code in other banks. Kind of a long shot but it's something I hadn't considered before. I love this game, it's so full of bugs and somehow it still keeps going. :-)
Experienced Forum User
Joined: 1/31/2015
Posts: 14
Bobo the King wrote:
    1) I'd very much like to see the disassembled ROM! PM me or post it publicly. 2) If you happen to know, what is stored in address range $294-$2D9? I'll research it myself in the meantime, but so far I'm stumped. 3) What happens if you climb the stairs, say, another 70 times? Since 256 and 7 are coprime, maybe we have some leeway as to where the stack corruption takes us. I'm not very good with assembly language and it's hard for me to interpret what you've written, so I'm exploring that very slowly. 4) The glitch actually sets the program counter to $30A and it eventually increments to $312. What is in the $30A-$311 range? In my latest test, the first three instructions were garbage ($80) but the instruction at $310 happened to be $01 00 corresponding to ORA ($00, X). If as many as 8 more bytes can be directly manipulated, I'm confident we can get arbitrary code execution to work.
    1) Replied off-list. Anyone else who is interested please PM me. 2) The $200 page mirrors the NES sprite OAM. There are lots of places where it is cleared and rebuilt, so in general I think that range will only be used when there are lots of NPCs as in the circle of sages. So sadly probably not controllable at any of the exploit points. 3) The easiest way to experiment with this is to set an execute breakpoint on RAM in fceux (say <$8000), walk up and down the stairs N times, try opening/closing the menu and see where you land. Apart from the $300 page, I've ended up in the spell list, but that's not much easier to control. 4) The $300 page is used as temporary storage space for the various menu programs in bank E. Each one uses it slightly differently. $01 is the starting class of the second player character (thief) in the party picker menu. Selecting that class is the easiest way to get safely past that instruction and make the shop program not crash; but I think anything that will make A 0-7 after the jump should work, and it should be possible to avoid the terrible thief.
Bobo the King wrote:
Edit: Here's a quick update to report on what I thought was a promising lead. I discovered that a flag at $62CA dictates whether the black orb is present in the Temple of Fiends. I cheated it to 0 (corresponding to it being gone) and the tile is not traversible. I suppose you really do need the four orbs shining to step forward through the altar. Oh well. Of the other skips we might reasonably execute, I'm wondering whether it would be better to get the early airship (it may depend where it shows up) or skip the air orb, which would also obsolete the Waterfall, Leffein, and parts of the Sea Shrine and the return to Melmond.
For a no-reset run, since we basically only get 1-2 instructions, I think we'd just pick whatever would save the most time. The airship starts out parked where it normally appears in the desert. Only bank E and F are likely accessible here, so it's not too huge a set of possibilities. Lots of the "OA*" labels in bank E are accessible (though note that the J addresses are slightly different.) For a save corruption route with resets, an interesting possibility would be to start the game normally, save at the inn, reset and start a new game with exploit code that jumps into the save game copy loop with a bogus value for the current index. We can do this repeatedly to tweak the save RAM on cart. That way it should be possible to do a lot more crazy stuff. I've put the player in the middle of the ocean that way as a proof of concept. ;-) I agree NA looks pretty hopeless but someone clever might work something out. Meanwhile J is definitely broken so I'll focus on that I think.
Post subject: stair glitch, large skips
Experienced Forum User
Joined: 1/31/2015
Posts: 14
http://youtu.be/TRANAM0udLk A stack corruption bug lets you run the second character's name as machine code. The bug exists in both the NA and J releases, but is easier to exploit in the J release due to the extra characters (including $4c for JMP). Things that I've tested: ice cave skip (early airship), early class change, early xcalbur, save file hacking (by jumping into the save routine with controlled offsets). I have not yet managed to get a credit warp to work because the character set is just short of including the address you'd need. I have a complete, thoroughly commented NA disassembly if anyone is interested in exploring more. J is almost identical except for some minor message printing changes. Details: The game implements stairs in a funny way. Stair tiles can either be "push" tiles that call the dungeon subroutine with a new map and start location, pushing the current position onto the hardware subroutine stack; or "pop" tiles which return from the current invocation of the dungeon subroutine to go back. Two "pop" tiles in the same connected region of a map both go to the same place. This is useful to make all tiles on the edges of towns return to the world map, but doesn't work well in buildings. If there were two separate staircases landing in the same hallway, you'd expect walking down the left one to take you to the left, even if you happened to walk up the right before. So most maps are simple trees, segmented into regions with at most one "pop". But some maps have cycles of warps, like the column maze in ordeals 2 and the ice cave L2->L3 holes. Also, coneria castle uses a push warp from L1->L2 and from L2->L1---otherwise when you warped there from ToF after saving the princess, the stairs down from L2 would go back to ToF not L1. (In these cases you can't pop to go back to the world map, so there's a limited third type of warp tile which looks up and sets one of 16 world positions, jumps just before the main loop and resets the stack pointer. This is why you always end up on the right of coneria castle when leaving even if you entered from the left.) 7 bytes are pushed onto the stack per push warp. The 6502 can only address 256 bytes of stack. So if there's any path with more than 256/7 push warps, the stack pointer will wrap around and start overwriting old stack entries. This could result in corruption if the nested dungeon subroutine calls tried to return, so the game is careful to ensure they don't. Repeatable pop warps after a cycle of pushes are avoided by design. The warp spell also effectively returns from the dungeon subroutine, but only if the stack pointer is below ef. This should make it impossible to return to corrupted stack. Alas for cleverness, the menu message printing subroutine at de36 needs some extra memory so it writes directly to the low part of the stack. To expand certain message placeholders, the subroutine invokes e03e to save its current position in its original message format string, calls itself with a different message, and then calls e04e to resume parsing the original string. e03e dumps the current message pointer and bank into 110, 111 and 112, on the stack. So doing a series of push warps and then entering the menu can cause corruption. The easiest way to exploit this is to walk up and down the coneria stairs 70 times and then enter the menu. If all goes well, on exiting the menu your payload runs, then you get dumped into a glitch shop. You can safely exit la la land by walking out of the castle because of how the stack gets reset when you do that. Note entering the menu again is not a good idea even though my demo video does so to demonstrate the class change. It's also very easy to soft lock. A simple lua script:
-- this is a sloppy little script to walk up and down the coneria castle stairs
-- a number of times and then enter the menu screen
emu.speedmode('maximum')

trips = 70

function walkToY(desty)
  while true do
    y = memory.readbyte(0x2a)
    if y == desty then
      break
    elseif y == 0 or y > desty then
      -- on the world map screen initially y is 0, since this y variable is
      -- only used for inside maps. we need to go up initially to get into
      -- the castle.
      joypad.write(1, {up=true});
    else
      joypad.write(1, {down=true});
    end;
    emu.frameadvance();
  end;
end; 

function press(button, n)
  mask = {}
  for i=1,n do
    emu.frameadvance()
    mask[button] = false
    joypad.write(1, mask)
    emu.frameadvance()
    mask[button] = true 
    joypad.write(1, mask)
  end;
  emu.frameadvance()
end;

-- hard boot
emu.poweron()

-- get through prophecy
press("A", 21);
-- enter whatever for character 1
press("A", 9);
-- use default thief for character 2
--press("right", 3);
press("A", 1);
-- enter a magical name
-- 8a 8b 8c 8d 8e 48 49 4a 4b 4c
-- 8f 90 91 92 93 4d 4e 4f 50 51
-- 94 95 96 97 98 52 53 54 55 56
-- 99 9a 9b 9c 9d 57 58 59 5a 5b
-- 9e 9f a0 a1 a2 70 71 72 73 74
-- a3 a4 a5 a6 a7 7d 7e 7f 7c b9
-- a8 a9 aa ab ac 80 81 82 83 84
-- b0 b1 b2 b3 b4 85 86 87 88 89
-- ad ae af b5 b6 c2 c4 c5 c3 ff

-- some examples:
-- 4c ae 95: class change
-- 4c 84 b2: give airship
press("right", 9);
press("A", 1);
press("down", 8);
press("right", 2);
press("A", 1);
press("up", 6);
press("A", 6);
-- select character 3
press("right", 8);
press("A", 12);
-- character 4
press("A", 15);

-- walk up to two tiles before stairs.
walkToY(13);

-- take trips flights of stairs
for i=1,trips do
  -- the stairs are at y=11 on both the ground floor and the second floor.
  -- first walk to one square away, then walk onto the stairs, then walk off.
  walkToY(12);
  walkToY(11);
  walkToY(12);
end;

-- enter the menu screen
for i=1,15 do
  emu.frameadvance();
end;
joypad.write(1, {start=true});

-- exit the menu screen and glitch shop
for i=1,25 do
  emu.frameadvance();
end;
press("B", 100);

-- show menu for fun
for i=1,25 do
  emu.frameadvance();
end;
joypad.write(1, {start=true});

while true do
  emu.frameadvance();
end;