View Full Version : Metroid zero mission

03-13-2005, 06:48 PM
Guess Who I found :)

<P ID="signature"></P>

C:ServerxampphtdocszopharoldwwwthreadsattachmentsM ZM_01.png

03-13-2005, 08:37 PM
> Guess Who I found :)

Seen it http://board.acmlm.org/thread.php?id=5950before</a> ;)

<P ID="signature"><div align="center"><font size=2>http://dan.panicus.orgDan's Space</a></font></div></P>

The 9th Sage
03-13-2005, 10:14 PM
> Guess Who I found :)

Heh, nice. <img src=smilies/laff.gif> I wouldn't have expected to see Crocomire pop up in that game. Now we need someone to do a full hack of it. :)

<P ID="signature">;http://www.xanga.com/ZeldaDDhttp://i.xanga.com/ZeldaDD/Neko_Supreme.GIF

Launch all Neko for Great Justice!</a></P>

03-13-2005, 10:46 PM
> Heh, nice. I wouldn't have expected to see Crocomire pop
> up in that game. Now we need someone to do a full hack of
> it. :)

Jiggly already put him in the game and fought him -- although I don't think he released the hack.

<P ID="signature"></P>

03-13-2005, 11:14 PM
He didn't release a hack, but he did post the data for it (also seen in above thread link).
================================================== ===

Metroid Zero Mission ROM hacking data

By Jigglysaint

60C64A - beginning of the level data. First room in Brinstar(starting room) First few bytes

are the size of the room. The first 2 bytes control the size, but the third is unknown.

Each section of level data for the room has the same 3 bytes that begin the data. Following

this is the different level data pieces. First comes the clip data, or what part the player

interacts with. There are 2 formats: The first is 2 bytes, the first of which is always 80

+, is a simple RLE. The first byte tells how many times to repeat the contents of the second

byte. The second byte is what you interact with. 10, for example, is a solid block.
The second format is different, a bit. The first byte is how many blocks, like the first,

except the value is from 00 to 7f. Now, what follows is a one block per space format, which

means that if the first byte is 05, then the following data would look like this: 10 10 00 00


Certainly destroyable blocks do not come back, and also any block that acts like an upgrade

pickup(missles, for example). Some common values worth noting are 5B and 6B, the former being

a power bomb block that does not return, while the latter does return when you switch rooms.

5A and 6A, the former being a speed block that does not respawn, but does return when you

switch rooms, while the latter(I like saying latter for some reason ) respawns quickly.

Regular item pickups are from 5C to 5F. 5C is an energy tank, 5D is a missle tank, 5E is a

super missle pickup, and 5F are power bombs. 6C to 6F are hidden tanks.

The graphics work in the same manner, with the first 3 bytes being the size of the data in the

room, and the remainder being the same format as with the clip bytes. Some graphics to note

are 48 to 4B, which are item graphics. Of course if you combine an item graphic with the

right item clip byte, you get an item. 40 to 47 are the various special block tiles, without

being covered.

After this is what I noticed were a bunch of 00's, 01's and stuff. This data is what tileset

each graphic uses. This means you can grab tiles from more than just 256, by changing these

bytes. I haven't worked with it much, but it seems that one byte = one piece of data. So one

01 would cover an 8c 00(no graphic), or an array.

After, if present, would be the various layer data. I haven't worked much with other layers,

but the data should be there. Last, is sprite data, which is just a series of 3 bytes, each

being one sprite. The first 2 bytes are the postion, and the third is the object in the index

to use.

Room Header data:

340AD4 - room header of the starting room

Well first of all is a byte that determins what graphic is used for the room. Following that

seems to be controls for the various layers. I've managed to turn off some layers before, but

I am unsure how it works. After this are the various level data pointers. After this are

sprite pointers(apparently 2, one for normal and 1 for hard mode). After the sprite data is a

byte that is the enemy index for the room. This tells the game what objects are in the room.

A few indexes I have found are: 2F. 30. 4F These are for the 3 unknown items and their

blocks. The last one is the plasma beam while the first is the gravity suit. Also are

04(long beam), 10 to some byte or another(most item and location statues), and 4B(Crocomire).

It looks as if the byte after the enemy index might be some sort of switch or somthing that

makes those changes to the enemies thoughout the game. More testing is needed, however.
After this is one more pointer untested. After is the location of the room on the map, and

then data that relates to extra layers that affect you(like water and acid), after is the

music data. That's the end of it there.

Door Data:

The first byte seems to determine whether or not the door acts like a door, or another kind of

room transition. It also seems to control if the door displays an intro(like for an area).

The second byte I don't know exactly what it does yet.

The third and 4th byte are the x positions of both where the door is located(in terms of

shootability), and where it lets you off after you go though it(from the other side) After

that is door index that's used. Changing it will make you go to different doors and warps

around the reigon. After that is where on the screen the door drops you off, and the last one

seems to be the y postion, but doesn't really seem used much.

On second though, it looks as if the second byte is the room number. Because of how the game

does its map and stuff, it's quite possible that there are only 256 rooms in the entire game.

Of course that seems a tad unlikely, but you never know.

3459c4 - item pickup data. 4 entries for each difficulty level.

03-14-2005, 06:53 AM
All right, been messing around with it for about 3 hours now, can't quite figure it out...Is, say, a missle tank supposed to appear as 805C in the room coordinates, or am I mixing up protocols entirely on that?

(on a random side note, does anyone know where to find something to fix the checksum on GBA ROMs?)

<P ID="signature"></P>

03-15-2005, 01:59 AM
> Guess Who I found :)
OMFG HAX!!!Q You are t3h ban!

<P ID="signature">PUNJ!

03-18-2005, 03:05 AM
I might as well post the notes I made while hacking the game.
(All this Rom Read stuff was a hack I made to VBA, that would tell me anytime an address in rom was read that was not read before).

Rom Read: 0875faa8 = *0833e608 (door does not work if changed (no crash though!))
Rom Read: 0805f760 = *0805f7ea
Rom Read: 0875fac4 = *08340ad4 (will crash if changed)
Rom Read: 0808f2c8 = *0822C238 (will reset if changed)
Rom Read: 08345d6c = *0805c4c1
Rom Read: 0805c4e4 = *0805c4fc
Rom Read: 0805c4e8 = *0805c502
Rom Read: 08345fd8 = *08345F60
Rom Read: 0875fd7c = *0805BD59
Rom Read: 0808cf6c = *08002461
Rom Read: 0805c4ec = *0805c52c
Rom Read: 0805c4f0 = *0805c5A0
Rom Read: 0805c4f4
Rom Read: 0805c4f8
Rom Read: 0800c4dc = *0800c4f8
Rom Read: 08238b68
Rom Read: 08238b6c
Rom Read: 08238b70
Rom Read: 08345890
Rom Read: 08345894
Rom Read: 08345898
Rom Read: 0834589c
Rom Read: 083458a0
Rom Read: 08345870
Rom Read: 08345878
Rom Read: 08345874
Rom Read: 08345880
Rom Read: 0834587c
Rom Read: 083458c0
Rom Read: 083458bc
Rom Read: 083458b8
Rom Read: 083458ac
Rom Read: 083458a8
Rom Read: 08345884
Rom Read: 08345888
Rom Read: 0834588c
Rom Read: 083458a4
Rom Read: 08340b10 - actual data
Rom Read: 08340b14
Rom Read: 08340b18
Rom Read: 08340b1c
Rom Read: 08340b20
Rom Read: 08340b24
Rom Read: 08340b28
Rom Read: 08340b2c
Rom Read: 08340b30
Rom Read: 08340b34
Rom Read: 08340b38
Rom Read: 08340b3c
Rom Read: 08340b40
Rom Read: 08340b44
Rom Read: 08340b48
Rom Read: 0875fd28
Rom Read: 0875fae4
Rom Read: 0875fae8
Rom Read: 083458b4
Rom Read: 083458b0
Rom Read: 0833e07c
Rom Read: 0833e080
Rom Read: 0833e084
Rom Read: 0833e088
Rom Read: 0833e08c
Rom Read: 085e2974
Rom Read: 085f4200
Rom Read: 08617b08
Rom Read: 083458d0
Rom Read: 083458cc
Rom Read: 083458e0
Rom Read: 083458dc
Rom Read: 083458d8
Rom Read: 083458d4
Rom Read: 08055684
Rom Read: 080557dc
Rom Read: 083458c4
Rom Read: 08058d50
Rom Read: 08345868
Rom Read: 0834586c
Rom Read: 0875fde0
Rom Read: 0835f994
Rom Read: 0835f99c
Rom Read: 0835f9c4
Rom Read: 0835f9cc
Rom Read: 0835f9d4
Rom Read: 0835fa3c
Rom Read: 0835fa44
Rom Read: 0835fa4c
Rom Read: 0835f94c
Rom Read: 0835f944
Rom Read: 0875f33c
Rom Read: 0875ec00
Rom Read: 082c4194
Rom Read: 0875eef8
Rom Read: 0875ec10
Rom Read: 082cbb6c
Rom Read: 0875ef08
Rom Read: 0875ec34
Rom Read: 082cca8c
Rom Read: 0875ef2c
Rom Read: 0875ecf0
Rom Read: 082dd820
Rom Read: 0875efe8
Rom Read: 0875ed34
Rom Read: 082e7c54
Rom Read: 0875f02c
Rom Read: 0835fbf8
Rom Read: 08017270
Rom Read: 0875e90c
Rom Read: 0875e918
Rom Read: 0801bf64
Rom Read: 080598e0
Rom Read: 0800c4e0
Rom Read: 08345d64
Rom Read: 0805cd54
Rom Read: 0805cd58
Rom Read: 0805cd5c
Rom Read: 0805cd60
Rom Read: 0808cf74
Rom Read: 0808cf78
Rom Read: 08186758
Rom Read: 0808cf8c
Rom Read: 0808cf90
Rom Read: 08186760
Rom Read: 0818675c
Rom Read: 0805cd68
Rom Read: 0805cd6c
Rom Read: 0801bf84
Rom Read: 0805e7e0
Rom Read: 0808fb28
Rom Read: 0820dbb0
Rom Read: 0820dbb4
Rom Read: 0820dbb8
Rom Read: 0801bf88

0833E608 - ?
0805F7EA - Crash if first short is changed (this room only)
08340ad4 - ?
0822C238 - ?
0805c4c1 - crash mostly
08345F60 - lookup table?
08002461 - Affects music
08340B10 – RoomData format
08340B18 = *0860d384
0860d384 – Shadow layer (hidden unless samas enters).
08340B1C = *0860cef6
08340B20 = *0860CEBB
08340B24 = *0860cd7e
08340b28 = *08617B04
08340B30 = *0860D36C
0860cd7e = Action Layer
0860D36C = enemy location (y,x)
0860D36E = enemy id in table
repeat these three bytes until FFFFFF

RoomData format (e.g. 08340B10)
0 – Tile set
8-B – ptr to Shadow layer(area that is sometimes hidden) (Format RoomTiles) (e.g. 0860D384)
C-F – ptr to Front layer (stuff that appears in front of sprites)
10-13 – ptr (Format RoomTiles)
14-17 – ptr to Action layer (stuff that sprites interacted with) (Format RoomTiles)(e.g. 0860cd7e)
18-1b – ptr to Background layer (unknown format)
20 – 23 – ptr to enemies (normal) (Format RoomItems)
24 – Normal/Easy enemy set
28 – ptr to enemies (hard) (Format RoomItems)
2C – Hard enemy set
35 – X location on map
36 – Y location on map
3A – Music for room
Format RoomTiles:
0 – width
1 – height
2-? – format (1 is format RoomTiles_A)

Format RoomTiles_A:
int i = 0
while room is not filed
u8 num = array
bool fill = num>>7
num &= 0x80
u8 tileId = array[i++]
fill next num tiles with tileId
for (u8 j = 0 to num)
fill next tile with array[i++]
end for
end if
end while

Format RoomItems:
int i = 0
while next three values is not FF
int y = array[i++]
int x = array[i++]
int tileId = array[i++]
placeEnemy(x,y, table[tileId])
end while

Tile set 8 (layer Front):
00 = transparent
If upper nibble is < 4 and lower nibble is >= 6 then type is door:
1st bit: direction 0 is facing left, 1 is facing right
2-4 bits: color:
6 = gray
8 = blue
A = red
C = green
E = yellow
5-6: segment:
00 = top
10 = mid top
20 = mid bottom
30 = bottom
40-47: destroyable blocks
40 = fallthough block
41 = bomb-destroyable
42 = speed-destroyable
43 = missle-destroyable
44 = powerbomb-destroyable
45 = screw-destroyable
46 = gun-destroyable
47 = supermissle-destroyable (black?)
48-4F :power ups
48 = missle tank
49 = engery tank
4A = powerbomb tank
4B = supermissle tank
4C-4F = unused
50-6F: walls
70-8F: decorations in walls
90-9F:more walls

Tile set(Action Layer)
10 = solid
11 = slant(big) - right to left up
12 = slant(big) - left to right up
13 = slant(small) - right to left up
14 = slant(small) - left to right up
15 = slant - right to left up
16 = slant - left to right up
17 = solid to monsters, but passthough for samas
18 = solid

50 = quad gun-destroyable(upper left)
51 = quad gun-destroyable(upper right)
52 = gun-destroyable
53 = quad gun-destroyable(upper left)
54 = quad gun-destroyable(upper right)
55 = gun-destroyable
56 = fallthough block
57 = bomb-destroyable
58 = missle-destroyable
59 = supermissle-destroyable
5A = speed-destroyable
5B = powerbomb-destroyable
5C = engery tank
5D = missle tank
5E = super missle tank
5F = power bomb tank
60 = quad gun-destroyable(lower left)
61 = quad gun-destroyable(lower right)
62 = gun-destroyable
63 = quad gun-destroyable(upper left)
64 = quad gun-destroyable(upper right)
66 = delayed fallthough block
67 = double(quad?) bomb destroyable
68 = missle-destroyable
69 = ect...
70 = bomb destroyable
71 = bomb destroyable(chain?)
72 = bomb destroyable(chain?)
73 = bomb destroyable(chain?)
74 = bomb destroyable(big chain?)
75 = bomb destroyable(big chain?)

For those of you who have read this mess (or scrolled down to the bottom) change value (834B34 or 34B34 in rom to 65 to have some fun, same area as screen shot). I can't seem to remember the id for what his name though.<P ID="edit"><FONT class="small">[i]Edited by subanark on 03/17/05 10:22 PM.</FONT></P>