Welcome Guest [Log In] [Register]
BN6 Shop Hacking Notes
Topic Started: Feb 6 2010, 05:44 PM (1,614 Views)
Spikeman
No Avatar
TREZian
Someone PMed me saying my old tutorial on shop hacking got taken down. Unfortunately I don't have the tutorial saved on my PC so the most I can offer are my notes. I don't entirely remember what everything does so you'll have to figure things out based on my notes. If I explore this further I'll post a better explanation (or maybe an editor).

Code:
 
=========================
Shop hacking
=========================

2011C38 - Zenny value in shop

8046F16 item price loading
2019A00 where shop data is stored
this data loaded from another spot in ram, which is loaded at startup
8047B88 sub that loads shops

8046B98 - start of shops data
+00 = 00 = zenny, 01 = bugfrags, 02 = chip order (only ones you have)
+04 = address of seller data, graphics and text (is LZ)
+08 = items offset
+0C = number of items in shop

20032C8 = start of item data, shops load from offsets of this
8047DA0 = items in ROM

Item data each is 8 bytes

010170 00FF001900

First byte = item type

00 = nothing (?)
01 = key item
02 = chip
03 = program

Second byte = how many times you can get it, FF = infinite
Must be FF for chips

Third byte specifies which item

Key items of note:

01FF44 = WWWID
01FF45 = Taiyou no kagi (Solar Key!!)
01FF80 = Start of subchips
01FF87 = This+ = freeze

Fourth byte always = 00 (?)

Bytes 5 and 6 = Chip code for chips
Color for programs
FF for other things
Must be the same as stored in ROM

Last two bytes = price
Will be multiplied by 100 if zennys
Guides I've posted: Chip Trader modding Guide

Check out Mega Man Battle Network Online, my MMBN site!
Profile
Quote
 
brianuuu
Member Avatar
SF Noise Spriter
I would like to see in video, its a bit hard to understand.
Edited by brianuuu, Feb 7 2010, 03:47 PM.
Posted ImagePosted ImagePosted Image
Posted Image
Profile
Quote
 
timaeus222
Member Avatar
The Tech Guy
Thanks very much! I shall save this too.
~Timaeus~
Web Designer, Music Composer

"There's so much water under the bridge that the bridge is gone." ~ DarkeSword of OC ReMix

My Technical Services || MPCR Home Page || My Best Game Mods || Music YT Channel || Gaming YT Channel || My Guides || My Challenges
Posted Image
Posted Image
Profile
Quote
 
MegaRockEXE
Member Avatar
BN Guides Author

Awesome. It was a shame this guide disappeared. I really wanted to get a screenshot of the subchip set item in the shop.
I can't figure out how to actually edit the shop inventory. What you labeled as "seller graphics" is really just the message files that loads for that shop.
Edited by MegaRockEXE, Feb 7 2010, 02:13 PM.
The Rockman EXE Zone | YouTube
Profile
Quote
 
Nemomon
Member Avatar
Die-hard Kemco fan

That user, who PMed You was correct. We were a target of attack, and we lost almost 80 topics with comments. 90% of them were hacking guides/notes.
Posted Image Posted Image
Profile
Quote
 
timaeus222
Member Avatar
The Tech Guy
Yeah. It really was a shame "he" had to do it, just because he was mad.

I never did understand shop hacking. Maybe I can now, with my increased experience.

And wow, your name is really creative! Nemominator :D

EDIT
Oh! I get this now!

020032C8
08047DA0

the RAM is a copy of the ROM. And you have to change both so they match exactly when you do so, and the change is made. The only thing I question is how to make it permanent, because for some reason, only the RAM changes make it work.

When you change the ROM, the shop is blank. But when you add to it, changing the RAM also, the change works.

When you change the RAM, the shop is blank. But when you add to it, changing the ROM also, the change works.
Edited by timaeus222, Feb 7 2010, 05:52 PM.
~Timaeus~
Web Designer, Music Composer

"There's so much water under the bridge that the bridge is gone." ~ DarkeSword of OC ReMix

My Technical Services || MPCR Home Page || My Best Game Mods || Music YT Channel || Gaming YT Channel || My Guides || My Challenges
Posted Image
Posted Image
Profile
Quote
 
Spikeman
No Avatar
TREZian
timaeus222
Feb 7 2010, 05:34 PM
Oh! I get this now!

020032C8
08047DA0

the RAM is a copy of the ROM. And you have to change both so they match exactly when you do so, and the change is made. The only thing I question is how to make it permanent, because for some reason, only the RAM changes make it work.

When you change the ROM, the shop is blank. But when you add to it, changing the RAM also, the change works.

When you change the RAM, the shop is blank. But when you add to it, changing the ROM also, the change works.
Thanks, honestly my notes were pretty unclear so I'm glad someone else figured it out. :LOL:

020032C8 is where all the shop item data is stored in RAM, this address doesn't change.
08047DA0 is where the Central 2 shop item data is stored in the ROM, this address is different for each shop

08047DA0 will be copied to 020032C8

I'm not sure exactly when that occurs, but it could be when you walk into Central 2, which would explain why you're getting blank stuff. My usual goal is to just change stuff in the ROM, since whatever is in the RAM ultimately depends on the ROM. If you just change the ROM and you're getting blank stuff in the shop the only reason is you are using a savestate. Try closing/opening the shop, walking in and out of the area, jacking in/out; one of those will work.


The other part of the shop data is this stuff:

Code:
 
8046B98 - start of shops data
+00 = 00 = zenny, 01 = bugfrags, 02 = chip order (only ones you have)
+04 = address of seller data, graphics and text (is LZ)
+08 = items offset
+0C = number of items in shop


Each 16 bytes here is the data for each shop, the first 16 are the shop in Central 2.

The first byte (8046B98) determines what kind of shop it is: 00 = zenny, 01 = bugfrags, 02 = chip order

The address+4 (8046B9C) is the address of the seller data: 87F0DA0
This includes the graphics (mugshot I think) and text for the shop, this is LZ77 compressed

The address+8 (8046BA0) is the offset to the items data: in this case it's 0000 so the address of the items data is 8047DA0+0000 = 8047DA0

The address+C (8046BA4) is the number of items in the shop: in this case, 8



Make sense now?
Guides I've posted: Chip Trader modding Guide

Check out Mega Man Battle Network Online, my MMBN site!
Profile
Quote
 
MegaRockEXE
Member Avatar
BN Guides Author

No, no. The seller data is the seller's message file. The messages all call the mugshot of the seller. If I knew more about the shop message scripts, it would be possible to add an entirely new shop message file at the end of the rom. Porting a shop message file from BN5 would be VERY possible.
The Rockman EXE Zone | YouTube
Profile
Quote
 
Spikeman
No Avatar
TREZian
You're right, there doesn't seem to be any graphics there. I could look into the format of the files a bit more, but it's probably just text with a bunch of control codes. I know from some of my BN3 hacking work that A LOT of stuff is done through text. I was investigating how mystery data was stored and found that what items you get from the BMD is actually set in the message "Megaman got ___ from the mystery data" and that that text is stored with the graphics for that area. BN6 might do things a bit differently, but I think the text engine is probably pretty similar. I'll look into it soon.

Edit: Megarock are you interested in my BN3 mystery data notes? They are my personal notes so it's not explained very well and it's not complete, but maybe you could use them.

Also, is there some sort of ROM or RAM map you guys have made for BN6? If not it'd be great to compile all the knowledge in one place.
Edited by Spikeman, Feb 7 2010, 10:12 PM.
Guides I've posted: Chip Trader modding Guide

Check out Mega Man Battle Network Online, my MMBN site!
Profile
Quote
 
MegaRockEXE
Member Avatar
BN Guides Author

You can PM me the notes you have. I know BN3 has debug commands, you know.
Unfortunately, there is no ROM map but I do have an idea on what the map should look like. I've posted notes too and that can be used to map it.
The Rockman EXE Zone | YouTube
Profile
Quote
 
timaeus222
Member Avatar
The Tech Guy
Spikeman
Feb 7 2010, 06:57 PM
timaeus222
Feb 7 2010, 05:34 PM
Oh! I get this now!

020032C8
08047DA0

the RAM is a copy of the ROM. And you have to change both so they match exactly when you do so, and the change is made. The only thing I question is how to make it permanent, because for some reason, only the RAM changes make it work.

When you change the ROM, the shop is blank. But when you add to it, changing the RAM also, the change works.

When you change the RAM, the shop is blank. But when you add to it, changing the ROM also, the change works.
Thanks, honestly my notes were pretty unclear so I'm glad someone else figured it out. :LOL:

020032C8 is where all the shop item data is stored in RAM, this address doesn't change.
08047DA0 is where the Central 2 shop item data is stored in the ROM, this address is different for each shop

08047DA0 will be copied to 020032C8

I'm not sure exactly when that occurs, but it could be when you walk into Central 2, which would explain why you're getting blank stuff. My usual goal is to just change stuff in the ROM, since whatever is in the RAM ultimately depends on the ROM. If you just change the ROM and you're getting blank stuff in the shop the only reason is you are using a savestate. Try closing/opening the shop, walking in and out of the area, jacking in/out; one of those will work.

Make sense now?
YES! It worked! Strangely, the RAM only changed when I made the change permanent. But now, I permanently changed an item. Such a good thing that this isn't temporary =)

The only troubling thing is that whoever uses savestates when playing my patch might get a blank shop, or no change at all for when I change a price(which is basically what I am doing; DarkSword L, from 4600 to 9000 Zennys).
Edited by timaeus222, Feb 7 2010, 11:48 PM.
~Timaeus~
Web Designer, Music Composer

"There's so much water under the bridge that the bridge is gone." ~ DarkeSword of OC ReMix

My Technical Services || MPCR Home Page || My Best Game Mods || Music YT Channel || Gaming YT Channel || My Guides || My Challenges
Posted Image
Posted Image
Profile
Quote
 
MegaRockEXE
Member Avatar
BN Guides Author

When I tried changing something in the rom and restarting the game, the shop froze.
The Rockman EXE Zone | YouTube
Profile
Quote
 
timaeus222
Member Avatar
The Tech Guy
What exactly did you change? I get this, so I can help.
~Timaeus~
Web Designer, Music Composer

"There's so much water under the bridge that the bridge is gone." ~ DarkeSword of OC ReMix

My Technical Services || MPCR Home Page || My Best Game Mods || Music YT Channel || Gaming YT Channel || My Guides || My Challenges
Posted Image
Posted Image
Profile
Quote
 
Spikeman
No Avatar
TREZian
timaeus222
Feb 7 2010, 11:42 PM
The only troubling thing is that whoever uses savestates when playing my patch might get a blank shop, or no change at all for when I change a price(which is basically what I am doing; DarkSword L, from 4600 to 9000 Zennys).
This only happens if they make a savestate in the shop right? Either way, it wouldn't be that difficult to fix their savestate (you could provide a RAM dump and just have them load it right after loading the savestate).

Megarock: What exactly did you change? Was it an unmodified ROM?

Edit: Also these addresses are for Falzar in case that wasn't clear.
Edited by Spikeman, Feb 8 2010, 01:11 AM.
Guides I've posted: Chip Trader modding Guide

Check out Mega Man Battle Network Online, my MMBN site!
Profile
Quote
 
timaeus222
Member Avatar
The Tech Guy
Spikeman
Feb 8 2010, 01:11 AM
timaeus222
Feb 7 2010, 11:42 PM
The only troubling thing is that whoever uses savestates when playing my patch might get a blank shop, or no change at all for when I change a price(which is basically what I am doing; DarkSword L, from 4600 to 9000 Zennys).
This only happens if they make a savestate in the shop right? Either way, it wouldn't be that difficult to fix their savestate (you could provide a RAM dump and just have them load it right after loading the savestate).



Oh, ok. Well, then it should work just fine :)
Edited by timaeus222, Feb 9 2010, 10:36 PM.
~Timaeus~
Web Designer, Music Composer

"There's so much water under the bridge that the bridge is gone." ~ DarkeSword of OC ReMix

My Technical Services || MPCR Home Page || My Best Game Mods || Music YT Channel || Gaming YT Channel || My Guides || My Challenges
Posted Image
Posted Image
Profile
Quote
 
Mgamerz
Member Avatar
The ShoutBox King

Didn't this use to be an old guide? I remember using a guide to hack Central 2's shop for some HPMEM's, except I killed the rom instead.
I run a Mass Effect 3 modding site named ME3Tweaks.com that details how to mod ME3 as well as showcasing mods for the multiplayer aspect of the game. I also developed a mod manager utility as well as an online mod creation tool named ModMaker.
Profile
Quote
 
louman7777777
Member Avatar
Newb
Spikeman
Feb 6 2010, 05:44 PM
Someone PMed me saying my old tutorial on shop hacking got taken down.
^
Profile
Quote
 
Mgamerz
Member Avatar
The ShoutBox King

Yeah alot of guides died.
Mainly the original BN6 hacking guide :(
We had so much info in there
I run a Mass Effect 3 modding site named ME3Tweaks.com that details how to mod ME3 as well as showcasing mods for the multiplayer aspect of the game. I also developed a mod manager utility as well as an online mod creation tool named ModMaker.
Profile
Quote
 
louman7777777
Member Avatar
Newb
it was an attack by some serenadeDS person right?


well, the guides may be delted, but the veteran hackers are not, so no matter how many guides get delted, they can always be rewritten! :D
Profile
Quote
 
timaeus222
Member Avatar
The Tech Guy
When you said the fourth byte is always 00, it isn't. When you edit chips, it can be used as a 16-bit change, like 2B 01 is possible to look at as 012B.
~Timaeus~
Web Designer, Music Composer

"There's so much water under the bridge that the bridge is gone." ~ DarkeSword of OC ReMix

My Technical Services || MPCR Home Page || My Best Game Mods || Music YT Channel || Gaming YT Channel || My Guides || My Challenges
Posted Image
Posted Image
Profile
Quote
 
1 user reading this topic (1 Guest and 0 Anonymous)
« Previous Topic · Guides & Research · Next Topic »