woofmute
Sonic Adventure DC Final - Debug Character Face Camera Button
updated
This prototype has been released today:
sega-dreamcast-info-games-preservation.com/en/seaman-e3-dreamcast-prototype-gdi-iso
hiddenpalace.org/Seaman_(May_5,_1999_prototype)
youtube is cutting the closing bracket off the hidden palace url for me. if the second link doesn't work, add the closing bracket to the end of it.
Sometimes a boss debug mode loads for the second boss but unfortunately it did not load this time.
I started researching the game's main loop and then RocketHorse found the flag being referenced every time the loop was called.
---
Debug Flag location (Set at boot with a cheat or modify 1ST_READ.BIN)
raw 0x000D70A2 set 00E5 to 01E5
ram 0x8C0E70A2 set 00E5 to 01E5
demul 0x2C0E70A2 set 00E5 to 01E5
Controller in Port A, Keyboard in Port B, Mouse in Port D.
Press the Insert key to display or hide Gindows debug.
Only the right click debug menu exists.
Right Click Menu -
System
Font
User [Undefined]
Var Editor
Console
Texture Viewer
Profiler
Console Commands
breaklevel breaklevel (-1 .. 2)
cd change directory
coloredit execute color edit window
danceman danceman [on/off]
dumpwin execute dump window
freecam freecam (port number)
gakkibito gakkibito [on/off]
help Help
loadform loadform (file name)
ls list directory
membernum membernum (0 .. MAX MEMBER)
palwin execute palette window
saveform saveform (file name)
varlist
varsearch
varset
Keys
F1
F2 Sound
F3
F4
F5 TaskMemory
F6 Console
F7 Render Info
F8 Texture Viewer
F9 Peripheral Info
F10
F11 Gindows transparency Off/On
F12 Performance
Print Screen
Scroll Lock Advance frames when paused
Pause Pauses game in levels
Insert Display/hide Gindows
Home Variable Editor
Delete
End
Page Up Scroll up console
Page Down Scroll down console
Arrow Keys Navigate menus
Enter Confirm selection
Escape Back out of selection
Ctrl+W dgDrawCallBackWindowInfo
Ctrl+T TaskDebug
Ctrl+P dgPrestreamWindowInfo
Ctrl+A dgAudioWindowInfoAll
Ctrl+S dgStreamWindowInfo
Ctrl+D dgCdbWindowInfo
Ctrl+F dgFileSystem
Ctrl+H DGSH
Ctrl+L Light
Ctrl+Z CamEdit
Ctrl+X Force (In CamEdit)
Ctrl+C Camera
Ctrl+V dgVblanktimerWindowInfo
Ctrl+B BupDebug
Ctrl+M dgMovieWindowCue
Ctrl+Enter A on controller 1 on main menu
Ctrl+Escape B on controller 1 on main menu
Ctrl+Arrows Directions on controller 1 on main menu
Ctrl+Delete To title and again to bios
Alt+W Wireframe
Alt+E ENESET EDITOR
Alt+R Current end of level score results display
Alt+O PathCtrl
Alt+P Player Info
Alt+A AudiRate
Alt+S Secret
Alt+F Select [Can type name for FormationEdit]
Alt+G Game info
Alt+K ClipDebug Main
Alt+L Poison Light
Alt+Z CamCtrl
Alt+C Level Counter
Alt+V Voice
Alt+B BupFlagDebug
Alt+M MusicMan
無変換 FreeCam in place
全候補 FreeCam targetting player
S3 Sets formationedit to a temp name
I am having trouble getting the fish to be visible on hardware, but on Flycast and Demul they have been showing up on my first attempts. I might just be very unlucky. The module is at least loading on hardware too though.
The method to trigger this was discovered by RocketHorse.
This debug tool is buried within all available builds of Rez that we have access to but it is not available by default. It is very very dense with commands and functions and not friendly to use as is. Hoping to never work on a Rez mod where I decide it would be good to need this.
More technical info:
If you force the game to run the function that loads passedit into the left click debug menu it will let you open the tool but it will not initialise it's heap properly. What this means is the tool is *very* unstable without further work, trying to read invalid data as pass data and crashing when attempting to access data from 0x00000000 or some other garbage pointer.
My current method to load this is to overwrite the pointer to the mainflow edit function with the pointer to init passedit into the gameflow menu. Remember that if you are using Cheat Engine and Demul 0x8C becomes 0x2C.
- The 4 byte pointer at ram 0x8C12DDA8 needs to be set to 8C0C9F9A.
When you click on mainflow edit now it will run passedit menu init, and then you can go back to the left click menu and click on passedit below mainflow edit.
It allocates itself to the end of the task heap and other debug commands and tasks will step on its heap and use it for their own work. To make it function on actual pass data I had to locate where the game loads the pass files and then copy across the first block of data which contained a listing of the pass data and the pointers to the actual data. If you put this into the heap that the tool is looking at it will populate the list properly and allow you to work with the data.
- 0x8C971700 is the location S05_ENM.PAS was allocated in the file heap during Area 5. You want to copy 0xFF bytes, down to just before the next 'HEAP' string.
- 0x8C941760 is the location passedit was using as its allocated task heap. Paste the 0xFF bytes of S05_ENM.PAS heap here.
This is still unstable because the data will be stepped on and overwritten with invalid data when you run the pass simulation command, or if you toggle the memory overrun check. When I run the pass simulation you can see that the list of pass entries is changed and it exposes the ram of the simulation task's work as strings and integers which looks cool but is invalid. You can fix this by pasting the correct 0xFF bytes back into the passedit heap.
I got this by hijacking the title module pointer, but it also required renaming the files for this animation to "Titile_model", as they are referenced misspelled in the title binary. There is currently no known method to run the title model module normally.
Pressing 0 on a Dreamcast keyboard will restart the animation.
A version with the crash can be found here: youtu.be/stje6NbQa-A
I got this by hijacking the title module pointer, but it also required renaming the files for this animation to "Titile_model", as they are referenced misspelled in the title binary. There is currently no known method to run the title model module normally. It crashes during the animation in demul and on an actual Dreamcast.
Pressing 0 on a Dreamcast keyboard will restart the animation.
A version recorded on Flycast without the crash can be found here: youtube.com/watch?v=bJ6LJ-o89Bg
00 No effect,
01 Fade to white,
02 Invert camera,
03 Screen buffer blur (Default effect),
04 Slide the render output from the top left over the screenbuffer screenshot,
05+ Crashes.
A video on this level select is here: youtube.com/watch?v=keIr_-7X0WE
The artist and track names are mostly placeholder in this build however.
Choosing a stage here will display the area login text unlike the normal level select in this build.
To access this, hijack the pointer for the 'areachoose.c' module, which is at 0x8c09a35a (0x2c in cheat engine with demul). If you change the value of the 4 bytes here to 8c104d78, you will go to this level select when you click play on the title screen.
I made a bonus video showing the login strings when forcing the other three stages in this build: youtube.com/watch?v=irulytlTD5o
boss boot debug displays a boss selection menu when the boss code is ran, and it will stay on this menu indefinitely until you select a boss and difficulty to load. all bosses from earth to eden are available, and there are three difficulties for each boss.
this is a throwaway video showing what the game looks like when running without the ability to fade to black when loading and initialising modules. it lags because i had ghidra running and flycast debugger through wsl and cheat engine and obs. sorry.
it loads fast but hopefully it is interesting enough despite this.
i also broke it (:
maybe. so some beginning loops need to also be LPW. but i have no idea why the sounds in boss are breaking atm... the ones that should cover multiple notes do not. same note always.
This shows several prototype enemy models, and their animations.
This shows several test models, a prototype area 1 enemy, and one of the prototype Rez player characters.
This video was recorded so I could reference which mute numbers the area 2 boss uses for each phase of the boss, because it does not progress 1 then 2 then 3 etc., its reuses some and seems to have not used one that I set - but this might have helped me discover a new flag in the KMD0 data for the midi track mute numbers.
Basically now I can tweak these to make the fight's music more engaging. And I can try different ways of sequencing one track so the boss loading lag is less noticable in the audio. Testing these has to be done within the boss fight itself because the Gindows debug system does not allow you to activate the mute numbers for it from the sound menu, and as demonstrated, bosses don't always use mute numbers in the same way as the actual level does.
In this version I have set up the mute numbers, so each layer of the level activates different tracks properly. Only two things seem broken, a pad is set up wrong in the midi or the soundbank, and one track of the midi needs its timing fixing, that track broke during conversion between two DAWs.
This placeholder shows concept art of the characters as they appear in the theme, until the end where a basic version of the 3D model closeups has been mostly implemented. Juliette appears twice, suggesting Bungalow's model for this was not ready.
Release here: en.sega-dreamcast-info-games-preservation.com/fur-fighters-release-prototype-document-dreamcast-iso-gdi
You can do this too using Demul and Cheat Engine!
Address to modify the game state - 2C187494.
Change this to 04 for free camera, press jump to place your character, then change this value back to 00 to resume playing.
Release here: en.sega-dreamcast-info-games-preservation.com/fur-fighters-release-prototype-document-dreamcast-iso-gdi
byte 0x1b in the game tweaks needs to be set from 01 to 00, you'll need to use metroid prime pak tools to extract the tweaks pak and find the one listed as containing game tweaks.
alternatively, this ar code should enable the debug stuff in the prerelease mp1 demo without needing to modify the tweak file:
0035ecfb 00000000
byte 0x1b in the game tweaks needs to be set from 01 to 00, you'll need to use metroid prime pak tools to extract the tweaks pak and find the one listed as containing game tweaks.
alternatively, this ar code should enable the debug stuff in the prerelease mp1 demo without needing to modify the tweak file:
0035ecfb 00000000
These are all of the actions Chaos 2 can do in the Autodemo.
Chaos 2's next action ID is at 0x8C6A4EA1 (0x2C6A4EA1 in demul with cheat engine)
00 Reset
01 Deactivated
02 Walk
03 Take Damage
04 Ball Form
05 Deactivated
06 Deactivated
07 Jump Back when Near Player
08 Sink
09 Rise
0A Enter Ball Form
0B Exit Ball Form
0C Goes to 0D
0D Punch
0E Ball Form
0F Sink and Create Large Ripples
10 Mini Ball Attack
11 Swing arm (To knock player back)
12 Deactivated
13+ Deactivated
Recorded through demul.
Chaos 2 apparently does have his punching attack, but I'm not sure how to activate it. Updated video coming when I figure this out or am told about it.
The textures for this battle are missing so the game is using garbage data.
Credit to SpeepsHighway and MainJP for discovering this.
For a look at Chaos 2's available actions, see the next video (youtube.com/watch?v=giCiBLVy8RQ).
Recorded through Demul.
During gameplay, this affects all characters, and they will stare at the camera.
The final version was built on 23/10/2000.
For more information, please visit the Fur Fighters wiki: http://furfighters.wikia.com/wiki/Fur_Fighters_PC#Debug_Builds
Differences include the working name of 'Vibes' for the title screen, different text in some menus, different music and enemy patterns. Some of these enemy patterns were reused for the Lost Area in the final version.
The music is Rez/Cowgirl and Born Slippy.NUXX, all by Underworld. The samples seem to be placeholder, and very few exist in the final.
The Debug Values menu seems to have had its options removed, using it will crash the game when you try to scroll through it.
The debug toggles seem to not work entirely, however everything else in the Cheat Menu and the Ini Values will take effect!
To access it, change the byte at address 0x8C192DB4 to 03.
If you pause the game before trying to do this, you will only get a dev version of the pause menu instead of the debug mode.
Here is a list of some values and their effects:
01 Pause menu
02 Pause menu
03 Debug menu/Dev pause menu
04 Free camera
05 Rotating camera (For "out of time" menu)
06 Invisible pause menu
07 Invisible pause menu
08 Player 1 wins! Rotating camera
09 Uncloseable pause menu
Here's the thread on AssemblerGames; http://www.assemblergames.com/forums/showthread.php?48715-Fur-Fighters-Hacking
The original Japanese version of SA running with the final PAL version's voice files.
Not shown in this video is that pressing X and Y on this title screen will open the level select.
The parts where the audio repeats are where I pause the cpu to actually edit the memory. I did not pause the cpu on the title screen, however.
This is referred to as "High Poly Viewer" within 1ST_READ.BIN.
It allows you to select from Sonic, Tails, Knuckles, Amy, Lumina, Illumina, and Void. You can then cycle through their animations, open or close their mouth (Using L and R) and edit the lighting. It hangs when you use the exit function, but codescape says it is still running. This might be a problem with having replaced TITLE.BIN.
Test_0 is interesting in that it uses Sega's Nindows debug system, which was the second debug system used in Rez, and the same debug system used in the Tower of Babel tech demo and the Scud Racer SDK sample from R2 of the Dreamcast SDK, the one made for the pci slot development system.
At the start I unplugged my DC keyboard from the 4th port to try and use my mouse. This removed the grid. My mouse wouldn't work on any port.
The model viewer can crash easily, the codescape debugger tells me it's a miss read error, so be careful what you try to view. Usually happens when you change the model id or texture id and it most likely can't find it when you press A.
To activate it, change the byte at address 8C28E08D from 05 to C5.
Codebreaker code:
0028E08D
000000C5
For Demul and Cheat Engine, that should be address 2C28E08D.
To enable this for yourself, you need to set the bytes at addresses 8C1954BC-F to FF. This unlocks all cheats, including the level select which is enabled by default once the bytes are set. Just press L on the main menu.
If you want to use Demul and Cheat Engine, the addresses would be 2C1954BC-F. This has been done with the PAL version, the values should be similar for any other versions.
Here's the thread on AssemblerGames; http://www.assemblergames.com/forums/showthread.php?48715-Fur-Fighters-Hacking
I crashed the game during the boss entry by trying to start the boss event.
I fell into this by accident on my first playthrough of the game. Sonic was running on his own at this point back and forth, and only started getting hurt and dying when I started recording it.
Debug mode code found by ConkerGuru, of the RWP forums.
http://www.therwp.com/forums/showthread.php?t=44977


