11 March 2016 - Forum Rules

Main Menu

(Solved) Playstation Reverse Engineering Help

Started by ponlork, October 03, 2020, 08:50:30 AM

Previous topic - Next topic


Hello, I'm in the process of modding NBA Jam T.E. for the PS1. I'm able to replace the assets however I would like to improve the game by fixing some errors.

Here's a screenshot of one of the errors:

Notice Clyde the Glide Drexler on the bottom left? When players are knocked to the floor from this particular angle, the game uses the top head sprite and it looks rather unsightly. There are 15 unique head sprites in the game, however one is unused. I would like to swap out this head sprite with an unused head sprite in the game.

It sounds simple enough but the problem is there are two instances when the top head sprite is called upon so if I was to simply replace the head sprite it'll also affect this other animation where the top head is used properly:

Here's a screenshot of the sprite sheet used for the heads:

Using No$PSX I was able to locate the addresses for where the head data is stored. Head sprite number 6 at address 80068234 is unused. I'm able to change the values around so I can swap head data. I'm not very experienced in programming but I assume these are just number values rather than code where the value of 0 is the first head in the sprite sheet and then every +400 will be a new head from the sprite sheet.

I've also located the RAM address for the Player 1 head. The ram address is 80084424 and the hex code for the top head sprite is 5c 1b 0b 80. The hex code changes everytime the player switches, so like for the front face view the hex is 5c f3 0b 80.

I used PCSXTrace to do a trace log of the Assembly instructions. I don't know anything about Assembly but by simply looking at the log, it appears that it calls the first address of the head data at 80068220, then adds the value of 38 so that it'll equal 8006258 which is the top head sprite.

Scrolling up a little further I see a possible address for when the value is called. At address 80021e64 the instruction is add sp,38h.

The problem is when I try to change that value to any number the game will freeze. I've even tried to change it before the Match up screen is shown and it locks up.

I'm pretty sure this has something to do with it because I've also done a tracelog using a different head sprite and sure enough the value + 80068220 = the correct head sprite.

Sadly the princess is probably in another castle. I'm thinking maybe I have to alter the main code function somewhere so that I'll have it point to a different address in the ram or maybe even possibly writing new code? All this is a little too advanced for me, I was really hoping I could just simply modify a few values but it seems like the game uses some complex math to tie the body and head together as well as the sprite scaling feature.

I've also looked into the No$PSX Vram viewer. I stepped through the game one frame at a time until the top head sprite shows and then it produces the line CputoVram 16x32:

Each head sprite is 32x32, not sure why it's 16x32. I'm guessing it has something to do with 8bit and 16bit.

These screenshots I didn't have to produce the animation to find this data. This one is for the Body animation.

and this is for the head sprite:

After my fail attempts at using a PSX Debugger, I tried installing Ghidra along with the ghidra_psx_ldr plugin. This screenshot is of address 80021e64 where it shows the add sp, 38h:

This section here calls for the head data, I'm just unsure how the values are being passed through. I tried modifying some of the values, like where the decompiler says r7+5, when I changed the 5 to a different number the heads do change but it messes up all the angles

And that's where I'm at right now. If anyone can give me tips, clues, ideas, I sure could use it. Although I failed at solving this problem I did gain about a week of experience using Ghidra and I'm eager to apply some of these techniques on another PSX project I'm working on.

Oh and another idea I had was to search for unused animations in the game so that I could possibly swap it out with the floored frame and sure enough I did find two unused frames that I've never seen before. The problem is the body and head data are still tied together so this idea won't work.

I take it these were meant for the side line dunk? I've never even seen this before not even in the Arcade version. I plan to restore these frames later but first I really want to fix this current error.

I read this article on porting NBA Jam to the PS1 and it mentions that they wrote code into the PSX scratch pad. So maybe the code could be stored in there?

edit: i forgot the attach the PCSX Tracelog, darn it. Can't attach once posted. well here's a link to it:


I can't help you that much but I think you should get some knowledge about graphics on PSX, are you trying to change the RAM or the binary image?

The code could be switching heads using polygon lines, as the articles tell something like that, delivering the output on execution. These are faster than dumping sprites on screen.


Quote from: tvtoon on October 10, 2020, 07:32:44 PM
I can't help you that much but I think you should get some knowledge about graphics on PSX, are you trying to change the RAM or the binary image?

The code could be switching heads using polygon lines, as the articles tell something like that, delivering the output on execution. These are faster than dumping sprites on screen.

it's okay i figured it out. the solution was very simple, only had to change one value. the problem was the file that contain the info wasn't in the exe rather it was in a separate bin file that contain the body animation. the body sprites were compressed in a RNC container, i had ripped the body sprites before but i didnt know it contained additional code following the .rnc files.

i was trying to locate it in ram and then trace the function to binary or whatever that is where we can modify the game permanently. PC location or something. sorry i'm very new to this stuff.

anyway now i'm stuck on a new problem that i'm not very confident i can figure out. Basically when players do a monster dunk, it will send opponents tumbling to the floor when attempting to block. This effect was in the Genesis port but it's absent in the psx, Saturn, and Snes Ports.

It is still in there but its only activated  when players are doing layups. In the arcade it's activated during dunks not layups. I swear it's like acclaim got shit backwards.

Here's a clip showing the error:

If I can fix this I'll be extremely happy and i'll be releasing a improvement patch