Modifying speed of players in Zoinky's hacked Blitz 2000 version

[blitzmaster5000]

I've been back to trying to figure out how to modify player speeds. I will post addresses with variables and necessary info that I find that works. I'm doing all this using cheat engine and nemu64 to try and find out what addresses write to what.

QB speed (behind line of scrimmage)

802D386C --> float gives a value of varying magnitude when moving left or right (faster speeds = larger values); moving left the value is negative, moving right value is positive. Vertical motion does not affect it, therefore there must be another address related to the vertical speed.

When the QB is moving laterally (left or right), this value is written to from 802f7fd4. Therefore, I think that it is this address that would need to be changed (probably a multiplier to scale the speed of QB up).

Fortunately there are a few math commands above it (at least I think, based on my very naive understanding of assembly language), so I was able to do a quick and dirty multiplier. directly above this line is:

802F7FD0 MUL.S F0,F20,F0 (the actual memory value is 4600A002)

I assumed this was doing some sort of math function to determine the lateral speed of the QB. right above this address is 802F7FCC, which is NOP. I took the same exact memory 4600A002 and replaced that NOP (which is just 00000000) and it increased the lateral QB speed 2-fold. i.e. It did indeed act as a "multiplier". However, I noticed that the value only changes when you hold turbo.

So the original addresses will look like this:

802F7FCC NOP
802F7FD0 MUL.S F0, F20, F0
802F7FD4 SWC1 F0, 0x0014 (S0) <--- this is what does the actual writing to QB lateral speed

whereas the quick modification would look like:

802F7FCC MUL.S F0, F20, F0
802F7FD0 MUL.S F0, F20, F0
802F7FD4 SWC1 F0, 0x0014 (S0)

and once again, the actual array of bytes to do the MUL.S F0, F20, F0 command is 4600A002.


I then just scrolled up the address list and looked for the next SWC1 command. It was located at 802F7B0. Once again, above it was yet another MUL.S command (although not directly above it; it was 3 addresses up) with a NOP address as above it. I did the same thing here replacing:

802F7FA0 NOP
802F7FA4 MUL.S F0,F20,F0
802F7FB0 SWC1 F0, 0x000C (S0)

with:

802F7FA0 MUL.S F0,F20,F0
802F7FA4 MUL.S F0,F20,F0
802F7FB0 SWC1 F0, 0x000C (S0)

which resulted in the QB vertical speed to increase with turbo! So it seems these two commands can at least affect the speed of the QB with turbo.

The way I'm changing the speed is pretty rough. Ideally, it would be better to be able to tune the "multiplier" so that it's not so fast - with these hacks on, the QB speed is even higher than in Blitz 2001. I think if it was just a  bit slower it would be better. Problem is, I don't know how to multiply a random constant (which I assume in the above case would be what ever is stored in F20) to the SWC1 value.

I will post more as I go along. Hopefully this makes sense, I'm thinking about taking screen shots to help illustrate  the process I'm using so if others are interested then they can take a stab at it too.

[blitzmaster5000]

Actually I just realized something... I'm fairly certain every player has a different address writing to their speeds. That means we could technically modify each individual player to have different top speeds. So that means we could have the RB or top WRs slightly faster than the others. Only thing is these values would not be specific to each team (falcons, texans, etc), but rather specific to player 1, 2 etc.


Jake: Do you know how the team stats affect the overall gameplay? For instance, if a team has full bars for rushing, does it make the RB for that team slightly faster? I have no clue how those stats play a part of the gameplay. If they do, then that could help tailor the speeds of specific RBs or WRs to each team, rather than just having all RBs or WRs have slightly faster speeds.

[jaker3]

Funny that you bring up team stats, they actually don't really affect the overall game play.

Here is a quote from Zoinkity on how it works:

  Somewhat surprising is that the game doesn't use the majority of the team stats displayed.  The values for linemen and defense are never used outside of displaying the bars, although they roughly correspond to the ratio of heavy versus light guys.  Passing and running are only used by the simulate feature.  Of all the team stats, only special teams is used in-game as a multiplier for punts and field goal attempts.

I think it would be a cool idea to maybe use the rushing stat/value in the equation for how fast a player moves behind the line of scrimmage, along with WR speed, ect...

As for having a speed based on per player I love the idea but I'm not sure how it would be done without modifying how Zoinkity has setup the player data tables, along with all the code that references the player data table. 

For reference:
Old/Original Format:
Size: 4          (float) scale
Size: 4           size
Size: 4           skin color
Size: 4           number
Size: 4           luck
Size:  0x10   last name
Size:  0x10   first name

New Format (Zonkity's hack):
Size: 4          (float) scale
Size: 1           size
Size: 1           skin color
Size: 1           number
Size: 1           luck
Size:  0x10   last name
Size:  0x10   first name (He removed first names since they are not used)

So yeah pretty much we would have to expand the player data table or maybe shrink the size of the last name or something... Other ideas would be trying to throw player's "Luck stat" into the mix, which is really the only unique stat per player.

More info on that from Zoinkity:

The game uses a lot of "die rolling" to determine pass completion, interference, tackling, etc.  The luck value only applies to receivers, and it's a modifier for the success of these rolls.  If you try to tackle a receiver this value is read, if they shoulder a guy this value is read, etc.  Oddly, it's the receiver's luck that's checked when the ball is passed to them, not the guy who threw it.  So, as strange as it may seem, somebody trying to intercept the ball during a pass will be less successful if the guy you're passing it to is "lucky", despite how crummy the passer was.

I will see if I can get a hold of Zoinkity and ask if he can check this thread out for any insight he has on how plausible this is. along with if he can point us in the right direction, hes probably the smartest guy I've talked to about these kind of things so if anyone can help it would be him ha-ha.

[blitzmaster5000]

Thanks for the info. I would like to try something more simple for now - just get QB to have an increased speed. What program do you use to modify the ROM? I know where to find all of these addresses related to player speeds using the memory debugger in Nemu64, but I'm not sure how to actually edit the ROM itself. If you could fill me in on some tools to use that would be awesome.

One other question related to that: lets say I find the address related to writing to the speed of the QB. Can I simply add in some code right above it to modify the speed? Can you just inject code into the rom at will? This is where my lack of knowledge for hacking is really holding me back.

[jaker3]

I'd imagine this would require an ASM hack, not very knowledgeable but here is a tutorial made for mario kart:
http://orbitaldecay.com/N64/Lesson4/Lesson4-images.html

there is a few others located here:
http://orbitaldecay.com/N64/index.html

[blitzmaster5000]

Hey Jaker,

Yes, I've seen those. In fact those are the tutorials (which are excellent) I used to initially figure out how to find the low gravity hack. They're good, but unfortunately the part where I need the most help (adding multiple changes to the assembly) is where it ends.

On the other hand, I recently found these other hacking tools: http://memoryhacking.com/

I was reading into the features, and one of them is the ability to "inject code", which I'm fairly certain is exactly what I would be needing to do for these speed/player movement modifications. It states,

 "Memory Hacking Software allows you to inject code into the target process more easily than you could with any other software. All you must supply is the address where you want to take control and the actual code you want to be executed. Memory Hacking Software   will find a code cave for you, compile your ASM into machine code, add JMP's to the code cave and back to the original code, and it adds the instructions being overwritten by the initial JMP to your code cave. This allows you to focus on exactly what you want to do: inject code. It even gives you a preview of your code cave so you know exactly what it is doing."

So if this works as easily as it sounds, this could be perfect for what we want to do. I already have most of the addresses for player speeds, now I just need to add some code to modify those values (add a multiplier). I will be playing around with this and will let you know what I find.

[blitzmaster5000]

Hey Jaker, I have been working more on trying to figure out how to "hardcode" the ROM with different player speeds. I wasn't able to figure out how to use LemAsm to actually do it (I couldn't find the right address), so I posted over at romhacking.net. Well guess who responded to my question? Zoinkity! His response was way over my head, but I think I was able to use what he said to find the correct address using LemAsm. Anyway, if this first trial works for modifying the lateral QB speed, I think we could start to easily modify the other player position speeds too. Once I get some results I will fill you in.

Here's the question thread in case you're curious:
http://www.romhacking.net/forum/index.php/topic,21160.0.html

[blitzmaster5000]

I just tried doing the search in LemAsm using the strategy he suggested, and it worked! Here's the process to modify QB lateral speed:

1. Find address that correlates to speed (using cheat engine)
2. Find address that writes to this (using memory viewer in Nemu), which is 802f7fd4
3. Use the memory values of this address to do a search in a hex viewer; I actually did a search for the address right above it, but it led me to the same place (values are: E6 00 00 14 8E 83 0B 2C)
4. In LemAsm, this yields the address in the ROM of 0009C020 with the exact same opcodes as the commands tool does in Nemu!

To do a quick test, I turned the NOP command 2 lines up to MUL.S F0, F20, F0, which acts as a multiplier to the lateral speed, saved the ROM, and now have a very fast QB in the back field! The trick now is to try and find out how to add a multiplier that is a specific value versus an arbitrary one. I don't know what values are in F0 or F20, but if we can load a different value into one of those registers, I think we could easily adjust the player speed at will.

Edit: I should also mention that this modifier makes any player in the back field have faster lateral movement, not just the QB. So if you lateral the ball to the RB, as long as he's in the backfield he will have faster movement as well.

[jaker3]

Awesome! Good work Blitzmaster! I'll have to start digging into this myself.

[blitzmaster5000]

Hey Jaker,

I have been in contact with Zoinkity the last few days and he's definitely helped me understand how the player speeds are being written. I couldn't believe the understanding he had of the game (and assembly in general). It was truly impressive!

Anyway, basically he explained that there are constants being used as multipliers (similar to what I was saying previously) that you can change. By default, the lateral QB speed multiplier is ~1.6. I changed it to be 2.1 and he moves quicker, much closer to the speed in 2001 (still a bit too fast I think - I will try and find the exact value in 2001 that way it's the same). I think we can easily modify any player speed now. Just have to find that specific players addresses and then change the multiplier value.

[blitzmaster5000]

I was playing around with player speeds this morning and happened upon a pretty funny hack... Giant mode!

[blitzmaster5000]

I finally figured out how to modify the non-ball handling players (anyone besides the guy w/ the ball behind LOS). You can edit that value, and it scales everyone equally. It makes the overall feel of the game just a bit faster. Combining this with the modified QB speed should make it so you can get the perfectly balanced gameplay. I'm going to try and find the speeds in 2001 of non-ball handlers, and then fix zoinkity's hacked version to be the same.

Here are the addresses that need to be modified (new values are what I changed it to in my game):

up/downfield speed all players: changed to be slightly faster.
address      command            hex rep      notes

OLD VALUES
802F702C    LUI AT 0x3FB9         3C013FB9      player speed ~ 1.35 (w/ turbo ~1.65)
802F7030      ORI AT, AT, 0x999A   3421999A   
802F7040      NOP

NEW VALUES
802F702C    LUI AT 0x3F85         3C013F8C   player speed ~ 1.45 (w/ turbo ~1.7)
802F7030      ORI AT, AT, 0x999A   3421999A   
802F7040      MUL.S, F20, F20, F0   4600A502   this multiplier acts on all players equally

You can change the value at 802F702C to be anything really, like 3FDD and it makes the NPCs ultra fast.

[jaker3]

Great work, for sure would be fun to make the game for fast paced. Thinking anything could be done to have a certain speed per player? Also for the giant mode hack there is actually a height modifier with the payer data, I haven't added it to the roster editor but you can make the players pretty big haha.

[blitzmaster5000]

So initially I thought that there was a different address writing to each player, however as of right now it looks like there only 2 things writing different speeds - one to the ball handler behind LOS, and one for all the other players. On the other hand, I think there's more to the story as the defensive players are slightly faster than the offensive ones (not including ball handler behind LOS), which is why even if you throw a bomb to a WR the defense can still catch him. If they were identical speeds, obviously the offensive player would never be able to be caught if he catches it further down the field.

But to answer your question about each individual player having specific speeds - I think it could be done because each player has it's own address correlating to their speed. The problem is, it's essentially the same address doing all the writing, just different constants here and there modifying the speeds. If we just add a multiplier to the speed at the end of what is being written to it, then yes, we should in theory be able to do a specific one for each individual player. I'm just thinking about how to do this. If we could add some jumps where each address has it's own multiplier, it maybe possible. Only thing here is that I would be worried about starting to write over other necessary registers that may be used in other parts of the code.

In any case, I made a table with all the values in 2001 & 2000 for comparison. As you can see, the speed of the QB is quite a bit faster in 2001 (2.08 versus only 1.65

[blitzmaster5000]

I Figured out how to modify "dolphin" tackles. It's interesting - the speed of the tackler is written to by different constants (setting the speed of the tackler) depending on 1) if he is "locked on" to a target and 2) how close he is to the target. You can also modify the angle of attack - meaning you can make the tackler take a sharp angle when hitting the opponent, sending the tackler way up into the air. I also found out how to make "dive-bombing tacklers" where the tacklers rise up to a given point very quickly and then tackle  from the sky. They're all pretty useless hacks because they kind of break the gameplay, but it's pretty funny to watch nonetheless. Here's some footage of it:

https://www.youtube.com/watch?v=chQ8sX7O3DU

I also found the function that modifies many of the special move's x-y speed. So for instance if you spin, you spin much further in the direction of the spin; if you get 'dumptrucked', it sends you flying 20 feet behind the guy dumping you over your back. I am wondering if you could modify each of these individually versus scaling everything.