May 18, 2024, 07:42:11 AM

Author Topic: External playbook editor  (Read 51699 times)

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
External playbook editor
« on: May 15, 2016, 12:40:38 PM »
Jake had mentioned making an external playbook editor a while back. Initially I thought this would be nearly impossible as Zoinkity had mentioned custom plays is quite difficult. However, I have been able to find out how the game (specifically Blitz 2000 Zoinkity hacked version) saves custom plays on the memory pak. I can also view how different player position, route, action (juking,blocking, etc) affects the block of code for each play. Therefore, I think it would most definitely be possible to create an external playbook editor, it's just a matter of mapping all of the addresses with their respective functions. I will be posting updates here.

Jake - I don't have the skills for doing a stand alone c# program like you have made for the other hacking tools, so maybe we could collaborate on this one. It would be awesome to create plays using mouse + keyboard versus the way in the game as is.

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
Re: External playbook editor
« Reply #1 on: May 15, 2016, 08:21:49 PM »
Below are some notes about how the editor works, and how each play holds the data. If you turn on the memory pak in either nemu or P64, it generates a *.mpk file. This file contains all of the code for your custom plays. My plays start around 0x31D0 and are added sequentially as I make more (up to 9 total for each playbook).

Code: [Select]
//notes
field size lateral x = 0x01 - 0x27 and vertical y = 0x01 - 0x2B //is a 26 X 42 matrix)
total play size is always 273 bits
plays added in-line, defensive plays come after offensive ones
all players - 3 linemen, qb and WRs have 8 total addresses, only WRs matter for their routes
//end notes

//RECIEVER CODE BELOW//
list of actions / hex values for recieves
juke 0x01
spin 0x02
block 0x88
turbo 0x10
wave 0x20
delay 0x40
delete 0x00
done 0x80

reciever x - y coordinates and actions - around 0x002CA704 in memory
reciever 1  - from 0xAC to 0xC8

0xAC AA BB CC DD //AA = starting X; BB = starting Y; CC = ?; DD =
0xB0 AA BB CC DD //AA = NODE 1 X; BB = NODE 1 Y; CC = ?; DD = NODE 1 ACTION
0xB4 AA BB CC DD //node 2
0xB8 AA BB CC DD //node 3
0xBC AA BB CC DD //NODE 4
0XC0 AA BB CC DD //NODE 5
0XC4 AA BB CC DD //NODE 6
0xC8 AA BB CC DD //NODE 7

reciever 2  - from 0xCC to 0xE8

reciever 3  - from 0xEC to 0x108

//end reciever code//
//QB CODE BELOW//
QB position 0x002CA680 and 0x002CA6E4

0x28 21 00 04 AA //AA = 01 regular; 03 shotgun
0x8C 14 AA 00 80 //AA = 07 regular; 05 shotgun

//end QB code//
// LINEMEN CODE BELOW //

linemen list of actions / hex values - CC values below

block 08
block left 10
block right 20
AA values 01 - 27 // player position; from farthest left to right. position constraints determined by neighboring players
BB values 08 // no changes - always on LOS


lineman 1 0x002CA684
0x2C AA BB 00 80 //AA = x; BB = y;
0x30 AA BB CC 00 //AA = x; BB = y; CC = ACTION

lineman 2 0x002CA6A4
0x4C AA BB 00 80 //AA = x; BB = y
0x50 AA BB CC 00 //AA = x; BB = y; CC = ACTION

lineman 3 0x002CA6C4
0x6C AA BB 00 80 //AA = x; BB = y
0x50 AA BB CC 00 //AA = x; BB = y; CC = ACTION
« Last Edit: May 15, 2016, 08:24:28 PM by blitzmaster5000 »

jaker3

  • Administrator
  • Sr. Member
  • *****
  • Posts: 333
    • View Profile
Re: External playbook editor
« Reply #2 on: May 15, 2016, 09:14:00 PM »
Hey Blitzmaster,

I'd for sure be interested in helping develop the GUI for this! I'll look more into this this week and start to scrap something together. I'll probably follow up a little more on it tomorrow also (heading to bed).

Super pumped!
« Last Edit: May 16, 2016, 11:11:11 AM by jaker3 »

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
Re: External playbook editor
« Reply #3 on: May 16, 2016, 08:45:05 PM »
Awesome! I also found where the game stores the custom playbook users can save. At the very end of the playbook (near address 0x4524) are values that correspond to the 3 pages of default plays that can be swapped around. This is also where the custom audibles are stored.

Code: [Select]
// CUSTOM PLAYBOOK play list and hex codes //
//PAGE 1
SWITCH UP 0x00
CRUISIN' 0x01
HURRICANE 0x02
ZIG ZAG 0x03
SPIDER LEGS 0x04
MONKEY 0x05
SLIP SLIDE 0x06
QB POST 0x07
QUICK DISH 0x08
//PAGE 2
UPPER CUT 0x09
DA BOMB 0x0A
HAIL MARY 0x0B
TURMOIL 0x0C
BACK SPLIT 0x0D
SUBZERO 0x0E
DAWG HOOK 0x0F
UTB DEEP 0x10
X SLANT 0x11
//PAGE 3
BLIZZARD 0x12
CRISS X 0x13
UP THE GUT 0x14
SCREEN RT 0x15
SUPER FLY 0x16
MIDDLE PICK 0x17
SWEEP RT 0x18
REVERSE ZIP 0x19
HB BLOCK 0x1A
//PAGE 4 - NON DEFAULTS
OPTION LT 0x1B
LEG BREAK 0x1C
DOG DAY 0x1D
SPLIT ENDS 0x1E
CRUEL DANCE 0x1F
COUNT IT 0x20
JUKE BOX 0x21
ZONE BANE 0x22
WHAT THE... 0x23
//PAGE 5 - NON DEFAULTS
2 REVERSE 0x24
MEAT HOOK 0x25
HOOK IT UP 0x26
CLUBBIN 0x27
DIPPIN 0x28
FROM BEHIND 0x29
STREAKER 0x2A
CAN OPENER 0x2B
PIN WHEEL 0x2C
//DEFENSIVE PLAYLIST
SAFE COVER 0x00
GOAL LINE 0x01
2 MAN BLTZ 0x02
MED. ZONE 0x03
SUICIDE 0x04
DEEP ZONE 0x05
1 MAN BLTZ 0x06
NEAR ZONE 0x07
ZONE BLTZ 0x08
G. STANCE 0x09
COVER 3 0x0A
SHORTSTOP 0x0B
DOG CATCHER 0x0C
ARROW 0x0D
COVER DEEP 0x0E
MANZONE 0x0F
DEEP RUSH 0x10
COVER FLAT 0x11

// AUDIBLES
last 6 values correspond to the 3 offensive and defensive audibles

from 0x454A - 0x454f

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
Re: External playbook editor
« Reply #4 on: May 17, 2016, 08:48:03 AM »
Next I'm going to see if I can find the actual data for the default plays (QB POST, DA BOMB, etc) in the rom. I'm interested to see if these plays have similar data to the custom plays. Then, I'm going to see if I can find the default plays in 2001 and extract the data, as a friend wanted some of those plays incorporated.

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
Re: External playbook editor
« Reply #5 on: May 17, 2016, 05:43:15 PM »
I also found out that the maximum upfield values can be increased beyond what it allows. I'm not sure what the max value is, but it looks like you could draw up plays going beyond the ~30 yard limit in the default play editor. We should be able to use a larger field in our custom editor.

jaker3

  • Administrator
  • Sr. Member
  • *****
  • Posts: 333
    • View Profile
Re: External playbook editor
« Reply #6 on: May 18, 2016, 08:07:23 AM »
For in game play locations you might be able to take a look at some of zoinkity's notes, I know that he did find the location for them. I'm at work so i can take a look at his notes in his patch .zip right now but here are some he shared with me a year or two back in a PM

Quote
0xDAB74   80336B24   pointers to offensive play data
0xDAC28   80336BD8   pointers to offensive play names
0xDACDC   80336C8C   pointers
0xDAD00   80336CB0   pointers
0xDAE70   80336E20   team offensive playlists; 0x1B ea.
0xDB1BC   8033716C   team defensive playlists; 9 ea.
0xDB2D0   80337280   table of "l_*" entries for playlist and other smaller cases
0xDB34C   803372FC

Also a few questions for you.

For the X,Y where is the line of scrimmage located?
Do you happen to know the X,Y coordinates that make up that red bounding box on the play editor?
Does the play editor snap to a grid or can the coordinates be essentially anything?
Can we include more then the defiend amount of jukes, spins, ect.. or are we limited to 3?

Working on the UI currently, hopefully can upload some screen shots in a few weeks.

« Last Edit: May 18, 2016, 08:14:09 AM by jaker3 »

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
Re: External playbook editor
« Reply #7 on: May 18, 2016, 03:54:29 PM »
Yea I saw that note that Zoinkity had left about the pointers to team plays and what not. I seem to remember this address:
0xDAE70   80336E20   team offensive playlists; 0x1B ea.

had some very odd looking code.. so I may have been unknowingly looking at the actual play data.

The line of scrimmage going across the y-axis is at 0A. No x-axis for it, as it goes straight across the whole field.

Here are the hex values for the red exclusion box.


I think the play editor does indeed snap to a grid, in the sense that each x,y interval is 01 apart from its nearest neighbor. I think we could create the field to have the same total amount of x,y values as the playbook editor. It's a 26 wide x 42 tall field, so as long as the editor has the same amount of intervals as this, we can easily correlate them to the hex values. Actually, if we wanted, we could have the y-axis longer if we wanted, as you can actually increase this value beyond what the in-game editor allows you to do. So if you wanted to make a "da bomb" or "hail mary" type play where the WRs keep going, you could do so.

Just checked if we can add multiple actions at the various nodes - yes you can! I edited my play so that WR1 and WR2 have about 6 spins each and tested the play. They did all the actions I specified! So it looks like we can remove that limit for the various actions if we want to. Here's a screen shot of the editor showing all the spins in a row.
« Last Edit: May 18, 2016, 05:52:37 PM by blitzmaster5000 »

jaker3

  • Administrator
  • Sr. Member
  • *****
  • Posts: 333
    • View Profile
Re: External playbook editor
« Reply #8 on: May 19, 2016, 09:59:10 AM »
awesome work! I think that would be everything we really need to know... Yeah it looks to be on a grid system since the X,Y cords are spaced farther then a pixel apart.

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
Re: External playbook editor
« Reply #9 on: May 19, 2016, 06:17:07 PM »
Here are some more details about how the game saves the files.

It seems Nemu64 and Project64 save the .mpk files differently. Nemu64 has only 0x7ff0 addresses, while the P64 one has 0x40000. I think it has to do with the way each emulator generates the .MPK. Nemu only creates the addresses for 1 memory pak, even when I tried turning on a memory pak for the other controllers, but it kept only allowing me to save at the same addresses (thereby only allowing for 4 possible different playbooks). Project64 on the other hand allows you to have up to 4 different memory paks with 4 different playbooks in each, giving 16 total playbooks. I think this is all somewhat irrelevant beyond the development stage as most people probably only use Project64 - Nemu is just better for debugging and whatnot. Fortunately, you can generate a P64 .MPK - it is always in the save folder of the P64 directory with the same name as the header; for example, the header I use is blitz2k (most likely the same for anyone using Zoinkity's hacked version), so the file is blitz2k.mpk. On the other hand, Nemu will dump the mpk in whatever directory the ROM is in and the name of it is the name of the actual ROM file.

Also fortunate is the fact that both P64 and Nemu64 start the first playbook at the same address, 0x31D8. Each subsequent playbook (for memory pak 1) is located at the following:

Code: [Select]
1st playbook mempak1 at 0x31D8 ends at 0x454C
2nd playbook mempak1 at 0x4550 ends at 0x58c4
3rd playbook mempak1 at 0x58C8 ends at 0x6C3C
4th playbook mempak1 at 0x6C40 ends at 0x7FB4

They are all the same sized file too. So what I think we can do is generate a dummy *.mpk file with blank plays that one could import into the custom editor, edit plays, and then write back to this file. That way we know exactly  the contents of the starting file (such as header data - a bit more about that below).

We could post a template .mpk file here for people to use. I will see how the other memory paks save into the .mpk file in P64 - I did make a second playbook and the header information is different from the 1st one, which is another reason why having the template file would be convenient as we can load up all these values into the .mpk and then only edit the play data.
« Last Edit: May 19, 2016, 06:19:18 PM by blitzmaster5000 »

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
Re: External playbook editor
« Reply #10 on: May 20, 2016, 09:38:57 AM »
I also realized something that will be an issue: Because all of the memory paks are located on the same .mpk file, if different people make plays on different .mpk files, we will have to make a "combine data/playbooks" tool that compiles multiple .mpk files into 1.

So for example, If I made a bunch of plays in the first memory pak and then a friend made a bunch of plays on the 2nd memory pak, we will have to have these two files combined in order for both players to be able to access their files. This also means if 2 people make their plays in the same memory pak, say memory pak 2, then one player won't be able to save theirs as it would save to the same addresses.

We could resolve this by having the program prompt the user saying there are multiple playbooks on the same memory pak, and allow the user to say "move xx playbook to memory pak 2" (or whatever memory pak doesn't have data curently stored) and then just dump the data into the second memory pak. It would just have to check the data prior to writing to make sure it doesn't overwrite the other plays.

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
Re: External playbook editor
« Reply #11 on: May 20, 2016, 05:07:52 PM »
So the bits Zoinkity found are pointers to plays for each teams playbook, not the actual data. I had the cheat "use team plays" and then changed all the plays for the first team (I assumed it was Arizona which I was right) to be the same. It resulted in the following:



So I know what plays these correspond to (based on the table I posted above), just need to find where the actual data is.

jaker3

  • Administrator
  • Sr. Member
  • *****
  • Posts: 333
    • View Profile
Re: External playbook editor
« Reply #12 on: May 23, 2016, 08:32:30 AM »
Just to clarify, are the pointers for the entire playbook or is there a list of pointers per team which make up a playbook?  So were you able to take a playbook and point each play to switch up? 

blitzmaster5000

  • Full Member
  • ***
  • Posts: 150
    • View Profile
Re: External playbook editor
« Reply #13 on: May 23, 2016, 01:28:45 PM »
There is a pointer for each play for each teams playbook. So each team probably has ~36 plays (3 offensive pages + 1 defensive page with 9 plays each), with each play having it's own pointer, giving 36 total points (and possibly 3 more for the audibles, assuming the same format as the custom playbooks you can make in the editor).

So in my example, I just wrote over the values that corresponded to all the Cardinals plays with 0x00, which corresponds to the play Switch Up. I'm still trying to figure out where the actual play data is for these default ones.

jaker3

  • Administrator
  • Sr. Member
  • *****
  • Posts: 333
    • View Profile
Re: External playbook editor
« Reply #14 on: May 24, 2016, 02:40:03 PM »
You have the coordinates of the QB, WRs, and linemen? pretty close to being able to publish some code to github.


Edit: Also the dimensions for the field you posted, 26 X 42 is that decimal or hex? the gird shows 40 squares for width?
« Last Edit: May 24, 2016, 02:56:10 PM by jaker3 »