MrCheeze | Ocarina of Time - Arbitrary Function Calls in Lost Woods as Adult. @MrCheeze | Uploaded October 2020 | Updated October 2024, 3 days ago.
This is exactly the same principle as my previous video about calling arbitrary existing game functions (youtube.com/watch?v=e-KrKn5D59w), but a new setup. Like the other one, this setup is for NTSC 1.2, but instead of taking place in kokiri forest as child and using deku nuts, it takes place in lost woods as adult and uses bombs, song of storms, and a strength upgrade. Also, instead of being determined by filename, the function that you call is determined by your controller 1 inputs. Nothing revolutionary but there might be some niche applications for this.
The steps needed to do this are as follows:
- Play on NTSC 1.2, and be adult with the items mentioned above.
- Spawn in Lost Woods from the zora river entrance.
- Mido Skip without hookshot (hookshot is an actor and affects heap manip)
- Follow the heap manip as shown so that the overlay for En_Weather_Tag loads at 801ED120. This will make it so that the instructions "lw $t9, 0xDE60($at); jr $t9" appears at 801ED17C. For the rest of the heap manip, we need nothing else to load at this address, so that this code is kept stale on the heap.
- Continue to follow the heap manip to load the bush at 801EA880 as I do, and SRM with it.
- Angle setup for D17C.
- Go back into the northeast room and drop. If everything was done correctly, we will have corrupted a Bombiwa's draw pointer to point at 801ED17C, where the code mentioned earlier is still sitting stale on the heap. The moment we look near the rock, the code will run. The effect of running that code, given the existing value of the $at register, will be this: "Load function pointer from 8011DE60, jump execution to function pointer." And as it happens, address 8011DE60 is the controller 1 input.
- Press buttons on the controller and put the joystick in a unit-exact position to create a pointer to the function you want to run. In my case, the function I chose to demonstrate with was at 80079EE4, which is a function related to updating your B and C buttons from using a bottle. When called in this way, it always has the effect of placing a fairy bottle on the B button, and giving you RBA.
- Walk so that you can see the bombiwa, and then depending on your situation you might want to get away from it again so that it stops running code based on your controller inputs. Alternatively, in a TAS context, it is be viable to keep varying the controller input so that you could call many different functions, if more are useful.
A few of the functions that can be called (nonexhaustive list obviously):
1.0 1.2
8006F804 8006FE64 change equips as if travelling through time (BA function)
8006FAD0 80070130 give [broken?] giant's knife
80071B7C ???????? RBA function direct (doesn't work)
800721A0 80072858 give/take hearts
800721CC 80072884 give/take rupees
800738E8 80073FA0 trade sequence timer
80079854 80079EE4 RBA function indirect (works)
80081130 80081760 edit equipment
80081188 800817B8 try to delete equipment but crashes
80081294 800818C4 edit upgrades
8008FFC0 80090610 load empty save
800900EC 8009073C load title screen save
This is exactly the same principle as my previous video about calling arbitrary existing game functions (youtube.com/watch?v=e-KrKn5D59w), but a new setup. Like the other one, this setup is for NTSC 1.2, but instead of taking place in kokiri forest as child and using deku nuts, it takes place in lost woods as adult and uses bombs, song of storms, and a strength upgrade. Also, instead of being determined by filename, the function that you call is determined by your controller 1 inputs. Nothing revolutionary but there might be some niche applications for this.
The steps needed to do this are as follows:
- Play on NTSC 1.2, and be adult with the items mentioned above.
- Spawn in Lost Woods from the zora river entrance.
- Mido Skip without hookshot (hookshot is an actor and affects heap manip)
- Follow the heap manip as shown so that the overlay for En_Weather_Tag loads at 801ED120. This will make it so that the instructions "lw $t9, 0xDE60($at); jr $t9" appears at 801ED17C. For the rest of the heap manip, we need nothing else to load at this address, so that this code is kept stale on the heap.
- Continue to follow the heap manip to load the bush at 801EA880 as I do, and SRM with it.
- Angle setup for D17C.
- Go back into the northeast room and drop. If everything was done correctly, we will have corrupted a Bombiwa's draw pointer to point at 801ED17C, where the code mentioned earlier is still sitting stale on the heap. The moment we look near the rock, the code will run. The effect of running that code, given the existing value of the $at register, will be this: "Load function pointer from 8011DE60, jump execution to function pointer." And as it happens, address 8011DE60 is the controller 1 input.
- Press buttons on the controller and put the joystick in a unit-exact position to create a pointer to the function you want to run. In my case, the function I chose to demonstrate with was at 80079EE4, which is a function related to updating your B and C buttons from using a bottle. When called in this way, it always has the effect of placing a fairy bottle on the B button, and giving you RBA.
- Walk so that you can see the bombiwa, and then depending on your situation you might want to get away from it again so that it stops running code based on your controller inputs. Alternatively, in a TAS context, it is be viable to keep varying the controller input so that you could call many different functions, if more are useful.
A few of the functions that can be called (nonexhaustive list obviously):
1.0 1.2
8006F804 8006FE64 change equips as if travelling through time (BA function)
8006FAD0 80070130 give [broken?] giant's knife
80071B7C ???????? RBA function direct (doesn't work)
800721A0 80072858 give/take hearts
800721CC 80072884 give/take rupees
800738E8 80073FA0 trade sequence timer
80079854 80079EE4 RBA function indirect (works)
80081130 80081760 edit equipment
80081188 800817B8 try to delete equipment but crashes
80081294 800818C4 edit upgrades
8008FFC0 80090610 load empty save
800900EC 8009073C load title screen save
