News: 11 March 2016 - Forum Rules
Current Moderators - DarkSol, KingMike, MathOnNapkins, Azkadellia, Danke

Author Topic: Hacking Castlevania Aria of Sorrow  (Read 7452 times)

Sup_vic

  • Jr. Member
  • **
  • Posts: 22
    • View Profile
Hacking Castlevania Aria of Sorrow
« on: January 20, 2013, 09:02:25 pm »
I'm new here, but I've being messing around with AoS for a long time now, but I've tried everything I found about decompressing the game's graphics and nothing seems to work for me. I tried using one of the decompilers and it gave me an error message, I tried using the same decompiler on a Zelda game and it worked. So I guess AoS graphics are compiled in a different way. I tried other things that I don't even remember exactly now to tell you, but I'm completely lost. I really want to decompile this graphics. Do you guys know something about it or maybe can tell me something that might help me to do it?

Spikeman

  • Hero Member
  • *****
  • Posts: 1063
  • *unce unce unce*
    • View Profile
    • None at the moment, check out my Last.fm page instead?
Re: Hacking Castlevania Aria of Sorrow
« Reply #1 on: January 21, 2013, 02:37:19 am »
Can you be a little more specific? What exact graphics are you looking to edit?

And what "decompiler" did you try? Typically you would use a decompiler to try and understand the game's code, and not anything to do with the graphics. It sounds like you may be trying to use some tools meant for the Nintendo DS on this game. Unfortunately, the tools that can unpack a DS game (and sometimes give direct access to the graphics) will not work on the GBA. The GBA is just one flat file - the code and data (including graphics data) are mixed together in whatever order the developers saw fit.

So how do you find the graphics so you can edit them? A few methods:

1) Open the ROM in a tile editor (I prefer Tile Molester), and just scroll through until you see something that looks like graphics. If the graphics are uncompressed you can almost always find them this way.

2) Use a debugger (I prefer No$GBA), set a breakpoint on the graphics in VRAM, trace backwards until you find where in the game the graphics are loaded from. The upside of this is that you can also figure out how the graphics are stored. The downside is it is quite involved and requires (basic) ASM knowledge.

3) If the graphics are compressed, 99% of GBA games use the built in LZ77 compression. There are some ways you can scan the ROM for LZ compressed data. The easiest I know of is this tool: http://www.romhacking.net/utilities/362/. Also, I think you can use some version of VBA (perhaps VBA-SDL-H?) to log SWI calls - this will log everytime the game decompresses something, and you can just run those addresses through a LZ decompressor (there are several of them in the utilities section of this site) and see which ones are you graphics.

4) You can use ROM corruption techniques. There are a few corrupters in the utilities section; I like the one dwedit made the best (I think it's just called ROM Corrupter). I can give some more detailed guidance if you want. The downside of corruption is, you will find where the graphics are, but not necessarily be able to decompress/edit them. So corruption is best used if you have _some_ debugging skills as a bit of help getting finding the data.

Anyways, if you have some small thing you need help finding, post something specific and maybe I could help you out.
Open Source Hacking Projects: Guru Logic Champ, Telefang 2, (Want more? Check out my GitHub!)

Sup_vic

  • Jr. Member
  • **
  • Posts: 22
    • View Profile
Re: Hacking Castlevania Aria of Sorrow
« Reply #2 on: January 21, 2013, 10:29:58 am »
I'll try to be more specific. I'm trying to get the graphics that I'm not able to see using tile editors. You can see the weapons, the items, some bosses, the souls and also the main character, but you can't see the backgrounds, the intro, the enemies... I wanted to get them out of the game and then edit them and put them back. But thanks a lot because you already helped me a little. Unfortunately that was the program I tried to use (UNLZGBA). If I open Zelda's rom it will work normally. If I select the AoS rom he gives me an error message, I think he also gives me that error for Harmony of Dissonance, but I'm not sure. I know I can see the graphics and get their log through VBA, which is nice, but I don't know what to do next and it seems harder then just getting all the graphics out using unlzgba.

About the error, it will be hard for me to tell you which error it is because I'm brazilian, so it's in portuguese, but I can try and translate it.
Here it is:
Oh wait, nevermind. When I tried opening the rom it started to load some graphics. But when I clicked ok it stopped. So I scanned through the uncompressed data and all the tilesets where black! It's strange because Zelda's tilesets showed up when I loaded it's rom... Why AoS graphics show up as a black image?

I know it might be asking too much, but could you take a look at it and see if the problem is only in my pc? Just try and scan an AoS rom with UNLZGBA.

Spikeman

  • Hero Member
  • *****
  • Posts: 1063
  • *unce unce unce*
    • View Profile
    • None at the moment, check out my Last.fm page instead?
Re: Hacking Castlevania Aria of Sorrow
« Reply #3 on: January 21, 2013, 06:41:38 pm »
I tried looking at the ROM in UNLZGBA, without much luck. It looks like it's not finding the palettes, which is why everything is appearing black, but you can just press the "use black/white" button to see what the graphics appear as. And with that enabled everything I saw looked like garbage, not anything you're looking for.

Just took a quick look in a debugger, and my suspicion is confirmed, almost everything is LZ compressed. I just confirmed this with Soma's portrait, which is located at 5C41E0. I used GBADecmp to dump the data, and viewed it in Tile Molester, and it's definitely his portrait.

So I'm not sure about using VBA to log the addresses, or why UNLZGBA is failing, but if you have a debugger (I prefer No$GBA, but the debug version isn't free... you may be able to find it by searching though), you can set a breakpoint on 803B9C0, and look at the address in r1. This is called almost everytime data is decompressed, but if that doesn't work, set a bp on 80D813C, which is the actual SWI instruction (for some reason I had problems with No$GBA crashing if I bp'd this address though), it seems to be used for every decompression in the game.

Anyways, I may be able to help you figure out a few things (like how to find enemy tilesets) - I've been interested in hacking AoS in the past, but don't have a ton of time to commit to it, so if you could pick one thing I can help you figure it out.

edit: Just did a bit more debugging, looking into finding enemy tilesets. Unfortunately, it looks the game hardcodes the addresses of each enemy tileset. This means there is no easy way to just extract all the enemy graphics at once.

Just for fun though, here's a couple I found: (all are lz77 compressed)
 81CBF8C - zombie
 81F422C - bat
« Last Edit: January 22, 2013, 05:47:29 am by Spikeman »
Open Source Hacking Projects: Guru Logic Champ, Telefang 2, (Want more? Check out my GitHub!)

Sup_vic

  • Jr. Member
  • **
  • Posts: 22
    • View Profile
Re: Hacking Castlevania Aria of Sorrow
« Reply #4 on: January 22, 2013, 10:11:12 am »
Cool! You found Soma's face, that's nice!
I tried using GBADecmp but it gave me a comdlg32.ocx error. I downloaded the file and it worked. So I tried to see the bat tile set but to no avail. I tried the zombie and it also didn't work. When I tried the Soma one, it worked. So I don't know why, but when I tried the two enemies it gives me this error: Run-time error '9': Subscript out of range.
Any idea of what that means? I'll try to do what you told me about getting the data adress of some enemies.

Spikeman

  • Hero Member
  • *****
  • Posts: 1063
  • *unce unce unce*
    • View Profile
    • None at the moment, check out my Last.fm page instead?
Re: Hacking Castlevania Aria of Sorrow
« Reply #5 on: January 22, 2013, 11:41:26 pm »
That's my fault, I didn't give you the right addresses. Those addresses are for the enemy data, and the pointer to the tileset graphics is that address + 4. So for example, [81CBF8C+4] = 860B5E8. So if you try dumping 60B5E8 with GBADecmp it should work fine.

Here's what I got. (I dumped the palette from VBA so it would display right.)



Also, this mixup made me realize that the enemy data is organized in such a way that it may be easy to just go through and find all the addresses. What is hardcoded is the pointer to the enemy data, not the actual pointer to the tileset. ;D

For example, look at the ROM in a hex editor around 0x1CBF90 (the ptr to the zombie tileset) - it looks like there's another address every 8 bytes. For example, the next one is 860BA68, which if you dump, it is totally graphics of another enemy (whichever one is a girl who kicks you). :)

Maybe I'll write a quick tool to iterate through all of these. First I should figure out how the palettes are stored though.
Open Source Hacking Projects: Guru Logic Champ, Telefang 2, (Want more? Check out my GitHub!)

Sup_vic

  • Jr. Member
  • **
  • Posts: 22
    • View Profile
Re: Hacking Castlevania Aria of Sorrow
« Reply #6 on: January 23, 2013, 12:25:27 pm »
Oh man... I'm trying to learn how to work with these programs now. It's amazing that you got the zombie and its palette out of the game, I tried that for so much time! Ok, so I have two questions for you.
1 - Why  [81CBF8C+4] = 860B5E8?
2 - How do I get the palette for the enemies in VBA and import it to tile molester?
I think I got the palette in VBA, it's a .pal file, right? But I don't know how to select it on tile molester.
Also, do you have any idea why I can't scroll the pixels with + and - ? They are a little scrambled.

Spikeman

  • Hero Member
  • *****
  • Posts: 1063
  • *unce unce unce*
    • View Profile
    • None at the moment, check out my Last.fm page instead?
Re: Hacking Castlevania Aria of Sorrow
« Reply #7 on: January 23, 2013, 08:40:10 pm »
1. That's just how the game happens to do things. The addresses I gave are the values of r0 when the code at 8039F0C is ran. (This is the code that loads graphics, and I think it's for more than just enemies.) This code uses the value at [r0+4] as a pointer when it copies the graphics. Here's some values I wrote down, these are the value that r0 was when I set a breakpoint on 8039F0C, and enter a new room.

   81CBF44
   81F422C   bat
   81CBE0C
   81CBE5C
   81CBF8C   zombie

Haven't checked what the other ones are yet.

2. Yeah, in VBA you just go to the palettes window and save the OBJ palette. It's actually kind of tricky to get them to load in Tile Molester. You need to edit the tmspec.xml file to add these two bits:

Code: [Select]
        <directcolor id="RIFF" bpp="32" rmask="FF000000" gmask="00FF0000" bmask="0000FF00">
            <description>32bpp RGB (Windows Palette)</description>
        </directcolor>

Code: [Select]
<palettefilter extensions="pal" colorformat="RIFF" size="256" offset="24" endianness="big">
            <description>Windows Palette (*.pal)</description>
</palettefilter>

Just paste those in near the other "<directcolor>" and "<palettefilter>" listings, then you should be able to import the palette in the palette menu, and use the arrows to scroll through and select the right one. And yeah, to scroll the pixels you have to use a little more trickery (really wish there was an alternative to Tile Molester, but nothing compares).  In one of the menus you'll see Canvas Size, set the number of rows to the amount of rows it looks like (there's just an extra few pixels at the beginning) - for the Zombie graphics I think it was 4. Then you should be able to scroll it.
Open Source Hacking Projects: Guru Logic Champ, Telefang 2, (Want more? Check out my GitHub!)

Sup_vic

  • Jr. Member
  • **
  • Posts: 22
    • View Profile
Re: Hacking Castlevania Aria of Sorrow
« Reply #8 on: June 11, 2014, 09:16:22 pm »
Hey, I'm back. Took me a good year, but now I'm back in the game. So I started trying to find the best way to find and edit the textures that I want. I'll give you an example: I wanna change the zombie. Ok, what do I do exactly to find his code line so I can decompress it? I tried using no$gba debugger version but I'll need some help with it...