I finally found the pointer table for the bad endings. Turns out, the formula for the address was no different from the story table. But, I was trying to find it based off the start of the string. After fully understanding the structure of the opcodes embedded in the strings, I realized the address that the pointer would reference was actually the first opcode at the start of the string. Then, it became easy to find. The first bad ending starts with a 0x01 at 0xEC. Knowing this, I was able to use the old formula from the story pointer calculations.
0x9C000 + 0xEC = 0x9C0EC
0x9C0EC << 1 = 0xC0EC
LittleEndian(0xC0EC) = 0xECC0
That code is found near the beginning of the file, before the ending strings instead of after them as was the case for the story files, at address 0x50. I tested this out with VBinDiff and was able to easily change all the Taiyo endings to Batsu's ending. The wrong character appears in the video (still don't know how that's controlled, and frankly, for my purposes I don't care), but the text was all Batsu's. I didn't pay attention to what audio was played (it's all Japanese anyway, so it doesn't really matter much), but I would guess it was the original ending's audio. But this is a pretty big breakthrough.
Another key I realized for discovering pointer tables in this game is that the pointer values are always delimited with 0x0980 for some reason. I have no idea why, but so far all the pointer tables I have found have been this way. So if you can find a lot of 0x0980 codes separated by 2 byte values, there's a good chance those 2 byte values are actually pointers.
I've already written an inserter for the bad endings, and it seems to work, with the little testing I've done. This video here is a sample of the result.
| Process | Progress |
|---|---|
| Translation | 20% |
| Proof reading | 0% |
| Insertion | 10% |
| Testing | 0% |
Comments
Post a Comment