[ShadowOne333]

Good day community.

This is the deal.

I've been trying lately to hack the RAM names that appear in the credits sequence for EarthBound.
The names that appear here are the ones you input at the very beginning of the game, like Ness, Paula, Jeff, Poo and King.

However, there are certain Credits that combine both RAM names and normal text.
Those are Paula's mom, Paula's dad and Poo's Master.

What I want to do with those three is modify the RAM text call (Paula) and just leave 's mom, 's dad and 's Master.
These are the addresses where that bare text is found in the ROM:

Code: [Select]

    Bare text addresses:
    0xC4E796 (0×04E996) = " ’s dad"
    0xC4E79D (0×04E99D) = " ’s mom"
    0xC4E7A4 (0×04E9A4) = " ’s Master"

    Pointers:
    0xC4E915 (0×04EB15) = [A9 96 E7 85 12 A9 C4 00 85 14]
    Text it points to = " ’s dad"

    0xC4E9B7 (0×04EBB7) = [A9 9D E7 85 12 A9 C4 00 85 14]
    text it points to = " ’s mom"

    0xC4EA60 (0×04EC60) = [A9 A4 E7 85 12 A9 C4 00 85 14]
    Text it points to = " ’s Master"
As for the RAM address, all of the names are written in $7E1E60 right before the Credits sequence begins and after you have talked to Ness' mom at the end of the game.

Here's a save state for Snes9x Debugger, if you want to test the breakpoint out or perhaps get some other useful information:
http://www.bwass.org/bucket/EarthBound Credits Save State.rar

When the credits begin, ALL of the RAM stored names (Ness, Paula, Jeff, Poo, King, Paula’s dad, Paula’s mom and Poo’s Master IN THAT EXACT ORDER) appear in that very same address and then the address stays at “Poo’s Master” once the credits start rolling. You can check it out by decreasing the speed in Snes9x Debugger with "-" when the screen starts to fade to black just before the credits. You will see that each one of those names start appearing in order at $7E1E60 (RAM).

With that we can try to trace what ASM code loads such RAM addresses and then stores them somewhere else.

The main names are grabbed from the following RAM addresses:

Ness = $7E99CE
Paula = $7E9A2D
Jeff = $7E9A8C
Poo = $7E9AEB

(King is there too but it's not important for the end result).

So, I set a breakpoint at $7E1E60 and I got the following output in the Debugger:
NOTE: You must set the Write Breakpoint AFTER you talk to Ness' mom!

Code: [Select]

$C2/D3B9 84 1E       STY $1E    [$00:1E60]   A:0240 X:AE20 Y:ADE0 P:eNvmxdIzc
$C2/D481 86 1E       STX $1E    [$00:1E60]   A:0000 X:AE4B Y:0061 P:eNvmxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
$C0/8F1B 97 0E       STA [$0E],y[$7E:1E60]   A:0000 X:0010 Y:0000 P:envMxdIZc
$C0/8F1B 97 0E       STA [$0E],y[$7E:1E60]   A:0000 X:0010 Y:0000 P:envMxdIZc
$C0/8F1B 97 0E       STA [$0E],y[$7E:1E60]   A:0000 X:0010 Y:0000 P:envMxdIZc
(I don't understand the STX, STY nor STA_x/y variants, nor what does $1E and $0E mean for that.)

So, the desired result is the following:

• Remove POO from "Poo's Master" to leave only 's Master, that way I want rename it to something else without having the RAM name appear in there.
• Move the position of PAULA in Paula's mom and Paula's dad. What I want here is to make 's dad and 's mom appear BEFORE the name for translation purposes (same thing could apply to Poo's Master in this regard).

I've been scratching my head over this for the past month and can't figure out a way to do so.

Can anyone please give some insight/a hand for this?
It'll be GREATLY appreciated!

[henke37]

Earthbound has a known scripting system. Have you considered that it might be involved in this?

[ShadowOne333]

Earthbound has a known scripting system. Have you considered that it might be involved in this?

What do you mean by "scripting system"?
Are you talking about CCScript?

if that's it, then yeah I am aware of the software and it doesn't include anything related to this, which is why I am trying to figure it out outside of CoilSnake/CCScript.

Unless you meant something else

[henke37]

CCScript is just a tool that can edit the scripting. It probably has omissions in the supported commands.

[ShadowOne333]

CCScript is just a tool that can edit the scripting. It probably has omissions in the supported commands.

Not that I know of.
If that was the case then the guys over at Starmen.net would have told me by now.

[ShadowOne333]

Bumping this to see if someone with some ASM knowledge can help me out on this.
I am really hitting a wall here... badly. :/

[justin3009]

So, I set a breakpoint at $7E1E60 and I got the following output in the Debugger:
NOTE: You must set the Write Breakpoint AFTER you talk to Ness' mom!

Code: [Select]

$C2/D3B9 84 1E       STY $1E    [$00:1E60]   A:0240 X:AE20 Y:ADE0 P:eNvmxdIzc
$C2/D481 86 1E       STX $1E    [$00:1E60]   A:0000 X:AE4B Y:0061 P:eNvmxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
$C0/8F1B 97 0E       STA [$0E],y[$7E:1E60]   A:0000 X:0010 Y:0000 P:envMxdIZc
(I don't understand the STX, STY nor STA_x/y variants, nor what does $1E and $0E mean for that.)

The 'STY/STX variants you see are storing as 'Direct Page' as the site I use calls it.  What that does is store a value to the current RAM location that's essentially setup to be used.  Kind of hard to explain it, but basically the base RAM address they're using is 1E42 from what I can gather.  When it does 'STY $1E' it's adding 1E to the current base RAM and then storing it to that location, which ends up being 1E60.

Also as a heads up, those ROM addresses are completely different, but they store to the same location.

The 97 0E (STA) you see is using quite a few values:

1. Whatever, I think, is at 7E:1E52-7E:1E54 is the '0E' portion.  That's basically grabbing the location to STORE to from RAM itself. 

2. The 'y' is the counter essentially.  So if it was 01, it'd store to 7E:1E61 in this case, if 02, 7E:1E62 etc..

3. It then grabs what's in A and stores it into the RAM address that's listed.

I'm sorry if this comes off as really hard to understand, I'm pretty terrible with trying to type them out in a comprehensible manner, but hopefully any bit of this helps out.

[KingMike]

Direct Page is the D register. So STY $1E means to store Y at address (D + 1E), in the bank specified by the DB register I think. While D is not shown in that trace log (I'm guessing whoever traced that used the option to turn off "less important" information ), I'll assume D is $1E42.

On the 6502, it was called Zero Page because it was fixed to 0, so (logically) writing STA $1E would write to address $001E.
65816 allowed the programmer to alter the base address of the Zero Page (from 0 to any 16-bit value) and was renamed Direct Page.

STA $0000,x means to store to address (X + 0000), again in the current bank. So I'll assume DB is 7E (since it's not shown).

STA [$0E],y is an indexing mode where it means that address $0E (see direct page stuff above for determining actual address) contains a 3-byte address that is the start of a data block, and write to index Y.
So to calculate, look at $0E-10, and add Y to whatever the result is to get the address to write to.
Note [ ] indicates LONG (3-byte) addressing mode. ( ) is used to indicate SHORT (2-bytes, thus current DB bank only) addressing mode.

[ShadowOne333]

I found something rather interesting.

Sometimes, the names are not written in 7E1E60, but rather 7E1E4D instead.
It seems to be at random, but it always prints either in $1E4D or $1E60.

It might have something to do with using a Save State or something, I don't really know, but at least the Breakpoint still gives the same results.

Here's a little more detailed Breakpoint.
Note that the Breakpoint is still set for Write Only.

Code: [Select]

$C2/D3B9 84 1E       STY $1E    [$00:1E60]   A:0240 X:AE20 Y:ADE0 P:eNvmxdIzc
$C2/D481 86 1E       STX $1E    [$00:1E60]   A:0000 X:AE4B Y:0061 P:eNvmxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
$C0/8EF4 97 0E       STA [$0E],y[$7E:1E60]   A:007E X:1E70 Y:0000 P:envMxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
(Prints NESS)

$C0/8EF4 97 0E       STA [$0E],y[$7E:1E60]   A:0080 X:1E70 Y:0000 P:eNvMxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
(Prints PAULA)

$C0/8EF4 97 0E       STA [$0E],y[$7E:1E60]   A:007A X:1E70 Y:0000 P:envMxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
(Prints JEFF)

$C0/8EF4 97 0E       STA [$0E],y[$7E:1E60]   A:0080 X:1E70 Y:0000 P:eNvMxdIzc
$C0/8F0C 9D 00 00    STA $0000,x[$7E:1E60]   A:0000 X:1E60 Y:0007 P:envmxdIzc
(Prints POO)

$C0/8EF4 97 0E       STA [$0E],y[$7E:1E4D]   A:007B X:1E5D Y:0000 P:envMxdIzc
$C0/8F1B 97 0E       STA [$0E],y[$7E:1E4D]   A:0000 X:0010 Y:0000 P:envMxdIZc
(Prints KING)

$C0/8EF4 97 0E       STA [$0E],y[$7E:1E4D]   A:0080 X:0010 Y:0000 P:eNvMxdIzc
$C0/8F1B 97 0E       STA [$0E],y[$7E:1E4D]   A:0000 X:0010 Y:0000 P:envMxdIZc
$C0/8EF4 97 0E       STA [$0E],y[$7E:1E4D]   A:0080 X:0010 Y:0000 P:eNvMxdIzc
$C0/8F1B 97 0E       STA [$0E],y[$7E:1E4D]   A:0000 X:0010 Y:0000 P:envMxdIZc
$C0/8EF4 97 0E       STA [$0E],y[$7E:1E4D]   A:0080 X:0010 Y:0000 P:eNvMxdIzc

The last five opcodes print Paula's mom, Paula's dad and Poo's master, although I'm not sure which one of the 5 prints which one because the breakpoint jumps straight into Poo's master.

And here's the TBL file I've been using with Snes9x Debugger alongside Show HEX -> RAM viewer:

Code: [Select]

50=
51=!
52="
53=-
54=$
55=%
57='
58=(
59=)
5A=*
5B=+
5C=,
5D=-
5E=.
5F=/
60=0
61=1
62=2
63=3
64=4
65=5
66=6
67=7
68=8
69=9
6A=:
6B=;
6C="
6D==
6E="
6F=?
70=@
71=A
72=B
73=C
74=D
75=E
76=F
77=G
78=H
79=I
7A=J
7B=K
7C=L
7D=M
7E=N
7F=O
80=P
81=Q
82=R
83=S
84=T
85=U
86=V
87=W
88=X
89=Y
8A=Z
90=
91=a
92=b
93=c
94=d
95=e
96=f
97=g
98=h
99=i
9A=j
9B=k
9C=l
9D=m
9E=n
9F=o
A0=p
A1=q
A2=r
A3=s
A4=t
A5=u
A6=v
A7=w
A8=x
A9=y
AA=z
AB=[
AD=[
AE=~
@KingMike, @justin3009:
How can I enable more detailed information for the Debugger/Breakpoint so that I can show the D register in Snes9X Debugger?
Or how can I give you guys a more detailed dissasemble of that particular part to know exactly how it is writting the names in RAM?

PD: I have updated the link to download the Save State through ZeBucket!
I noticed the link wasn't really working without having to sign in to Slack, so yeah, sorry
The Save State is for Snes9x Debugger.