[LandonRay]

TESTING INSTRUCTIONS:

(Current patch modified through disc 1)

1. Have a clean FFIX ISO.
2. Download the latest patch of FF9 Unleashed.
3. Download PPF O MATIC (Windows) or PPF O MATIC (Mac).
4. Use PPF O MATIC to apply the appropriate .ppf patch to the appropriate disc of FFIX. Each disc requires a different patch. Use patch FFIXUvx.x.xD1 for disc 1.
5. Leave technical feedback in this forum.

Primarily, I'm looking for mistakes in the Scene File (Directory 05). Unaltered Formation Blocks, glitches produced by code alterations, and the like.

[LandonRay]

Root Directory – 2334F0

Scene Files

Disc 1
918FED0 – 93C1830

Disc 2
CFB4150 – D22BB90

Disc 3
EDF36C0 – F09A260

Disc 4
8E44660 – 9090660

[LandonRay]

I should start at the beginning (keep in mind there isn't a lot that I've found as I have only been working on this for a week and a half).

Open your [.iso, .bin, .img] file and inside you'll find a large file named FF9.IMG. All of the data I'm working with is stored in there.

The first thing to note is that all of the data is stored in 800h (2048 bytes) sectors. The first sector of the file is the Root Directory. It reads as follows...

46 46 39 20 06 00 00 00 0F 00 00 00 01 00 00 00
02 00 00 00 15 00 00 00 01 00 00 00 11 00 00 00
02 00 00 00 22 00 00 00 02 00 00 00 B4 02 00 00
02 00 00 00 13 00 00 00 03 00 00 00 8D 0C 00 00
02 00 00 00 0F 00 00 00 04 00 00 00 84 0D 00 00
02 00 00 00 DE 00 00 00 05 00 00 00 0B 10 00 00
02 00 00 00 51 01 00 00 06 00 00 00 AA F9 00 00
02 00 00 00 97 00 00 00 08 00 00 00 7C FD 00 00
02 00 00 00 65 00 00 00 09 00 00 00 32 3D 01 00
02 00 00 00 55 00 00 00 0A 00 00 00 BA 54 01 00
02 00 00 00 37 00 00 00 0B 00 00 00 B8 56 01 00
02 00 00 00 2A 00 00 00 0C 00 00 00 F6 72 01 00
02 00 00 00 AB 01 00 00 0D 00 00 00 42 79 01 00
02 00 00 00 02 00 00 00 0F 00 00 00 CD D9 01 00
03 00 00 00 FF 01 00 00 10 00 00 00 9B EF 01 00
04 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00

The rest of the sector is padded with 46 46 39 20 (I have no clue why).

I'm not sure what the first line or last two lines are for, but the lines that start 02 00 00 00 are for each primary directory. Each line is broken into four groups of four bytes each (as is to be expected in 32-bit coding). The second group (starting with the fifth byte in each line) gives the number of sub-directories in the directory. The 3rd group (starting with the ninth byte in each line) points to the sector with more information about a particular directory. The 4th group (starting with the thirteenth byte in each line) points to the beginning of each directory.

Edit: I'll be transferring all of this to direct editing of my .bin, as I don't feel like constantly repacking it for testing purposes.

I'll post up more later.

[LandonRay]

Alright, for directly editing my .bin…

The Root Directory is located at 2334F0. The first thing to note is the padding-ish stuff at the start of each sector it looks like…

00 FF FF FF FF FF FF FF FF FF FF 00 00 15 06 02
00 00 08 00 00 00 08 00

00 15 06 is the label for the sector.

In the .bin, sectors are 930h (2352 bytes). So the first sector looks like…

00 FF FF FF FF FF FF FF FF FF FF 00 00 15 06 02
00 00 08 00 00 00 08 00 46 46 39 20 06 00 00 00
0F 00 00 00 01 00 00 00 02 00 00 00 15 00 00 00
01 00 00 00 11 00 00 00 02 00 00 00 22 00 00 00
02 00 00 00 B4 02 00 00 02 00 00 00 13 00 00 00
03 00 00 00 8D 0C 00 00 02 00 00 00 0F 00 00 00
04 00 00 00 84 0D 00 00 02 00 00 00 DE 00 00 00
05 00 00 00 0B 10 00 00 02 00 00 00 51 01 00 00
06 00 00 00 AA F9 00 00 02 00 00 00 97 00 00 00
08 00 00 00 7C FD 00 00 02 00 00 00 65 00 00 00
09 00 00 00 32 3D 01 00 02 00 00 00 55 00 00 00
0A 00 00 00 BA 54 01 00 02 00 00 00 37 00 00 00
0B 00 00 00 B8 56 01 00 02 00 00 00 2A 00 00 00
0C 00 00 00 F6 72 01 00 02 00 00 00 AB 01 00 00
0D 00 00 00 42 79 01 00 02 00 00 00 02 00 00 00
0F 00 00 00 CD D9 01 00 03 00 00 00 FF 01 00 00
10 00 00 00 9B EF 01 00 04 00 00 00 00 00 00 00
11 00 00 00 00 00 00 00

The rest is padded with 46 46 39 20.

Also, note that there is a lot of extra data at the end of each sector.

Next, I'll explain locating and altering enemy statistical data.

Edit: Keep in mind that while the structure of each disc is the same, the pointers and a lot of the data stored on the disc will be different. Also, this data pertains to disc one.

[LandonRay]

Directory 05 is for the scene file. Like FFVII, FFIX stores enemy data in blocks within the scene file (which I still think is a bad idea, but whatever...). In the Root Directory, the line for Directory 05 looks like...

02 00 00 00 51 01 00 00 06 00 00 00 AA F9 00 00

This means it has 151h (337 in decimal) sub-directories (or in this case, blocks of the scene file). A list of sub-directories and there location is available 6 sectors from the Root Directory (this is denoted by 06 00 00 00). In fact, there are so many sub-directories that the list takes up two sectors. AA F9 00 00 is the sector where the scene file starts. I'll explain how to locate it later. First, jump six sectors to 236C10. You will see...

00 FF FF FF FF FF FF FF FF FF FF 00 00 15 12 02
00 00 08 00 00 00 08 00 04 00 00 00 AA F9 00 00
05 00 00 00 AD F9 00 00 06 00 00 00 AF F9 00 00
07 00 00 00 B1 F9 00 00 08 00 00 00 B4 F9 00 00
0B 00 00 00 B7 F9 00 00 0C 00 00 00 BB F9 00 00
0D 00 00 00 BD F9 00 00 0E 00 00 00 BF F9 00 00
14 00 00 00 C2 F9 00 00 15 00 00 00 C4 F9 00 00
16 00 00 00 C8 F9 00 00 17 00 00 00 CB F9 00 00
So on and so forth.

After the padding there are four bytes for some form of increment identifier for the specific scene block, then four byte pointers denoting the start of that scene block. Now the correct way to use these pointers is to convert them to decimal, multiply them by the number of bytes in a sector, add that to the address of the Root Directory (in decimal), then convert it back to hexadecimal. That will give you the offset.

For example:

AA F9 00 00 is read as F9AA. In decimal it equals 63914. Multiple 63914 by 2352 (because I'm using the .bin). This equals 150,325,728. In the .bin the Root Directory is located at 2334F0. Convert that to decimal, which is 2,307,312, and add it to 150,325,728. This equals 152,633,040. Convert that to hexadecimal, which is 918FED0. That is the start of directory 05 and Final Fantasy IX's scene file.

But in all honesty, using the directory to locate enemy stats is a horribly slow way to go. I'll explain a much faster way to do it tomorrow.

[Archael]

This is the first progress I see related to FF9 hacking on the net

If I am wrong please correct me, but this is very exciting

[Angel]

Just consider me a cheerleader.

LandonRay for president of the Final Fantasy IX world.

[Abaddon]

Amazing! We believe in you!

[LandonRay]

Some people have used the directories to locate graphical information (which isn't hard, as it seems like the majority of the file is graphical information, just pick a random address and it most likely that you're look at some form of model, texture, or animation). But I haven't found any data online relating to the scene file or kernel. Also, I believe some text work has been done on the game, translations and the like.

[LandonRay]

Thank you all! And with that, I go to bed.

[Stann]

You modders scare the hell out of me. But also seem to impress me at the same time.

*looks at a large wall of random numbers*

Well... keep doing your thing man. If you make any progress, I'll try playing this game again. I wonder if it'd be possible to add some decent characters as well...

[LandonRay]

The short answer is that it's impossible to add characters to the game. The long answer is... well, long. Too long to write out, unfortunately.

[LandonRay]

The first thing to know when looking for enemy stats is how the stats are formated. This is the basic structure…

HP – 2 Bytes
MP – 2 Bytes
Gil – 2 Bytes
EXP – 2 Bytes
(Jump – 21h)
Speed – 1 Byte
Strength – 1 Byte
Magic – 1 Byte
(Jump – 0Dh)
Defense – 1 Byte
Evasion – 1 Byte
Magic Defense – 1 Byte
Magic Evasion – 1 Byte

There are more stats in there, but that should be enough to locate an enemy. You’ll need a hex editor capable of seaches containing variables, and you’ll need to know the stats of the enemy you’re looking for.

I’ll explain this by way of a Fang.

Fang stats:

HP – 68 (44 00)
MP – 170 (AA 00)
Gil – 90 (5A 00)
EXP – 23 (17 00)
Speed – 19 (13)
Strength – 8 (08)
Magic – 8 (08)
Defense – 10 (0A)
Evasion – 2 (02)
Magic Defense – 10 (0A)
Magic Evasion – 3 (03)

So you’re search would look like…

44 00 AA 00 5A 00 17 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 13 08 08 0A xx xx xx xx xx xx xx xx xx xx xx 0A 02 0A 03

Where xx equals a variable byte.

Note that there are three times in the file where this code occurs…

91CCA04
92A408C
92A6528

This is because the Fang appears in three scene blocks, and it has to be coded into each scene block where it is used.

Edit: Note that HP is two bytes or 16-bit. This is the main problem posed to difficulty modding of FFIX. I believe my initial reaction to seeing this was something like, "What the fuck?! 16-bit HP in a PSX Final Fantasy game! God damn stupid piece of shit!" Expletives continued for quite some time. Anyways, it means that maximum enemy HP is 65535.

[Archael]

Quote

Anyways, it means that maximum enemy HP is 65535.

I believe it's the same in Tactics

[LandonRay]

Yeah, I should have said numbered PSX Final Fantasy game. FFVII's HP cap is around 16,000,000. FFVIII's HP cap is around 3,000,000. FFIX's HP cap is 65,535. As the game stands now, it's a bit of a problem considering all of the defense penetrating attacks that can easily hit 9999 damage. Steiner's Shock isn't defense penetrating, but the attack power multiplier is so high that it should be able to break through max defense and still hit max damage. That's why I need to find the kernel.

Edit: My plan is to decrease the attack power of Steiner's weapons, weaken defense penetrating attacks so that they will hit for around 3000 damage late in the game, and focus on increasing boss defense and magic defense instead of HP. Also, weakening the characters overall would be very useful too.

Edit 2: The point is, as of now I can increase the difficulty of FFIX noticeably. However, late in the game, fights would become very short and very bloody (for both sides).

If you want, I could go ahead and make a stat mod devoid of kernel changes, then alter the kernel for later versions.

Actually, that sounds rather appealing right now. I think I'll do that.

[zombero]

I support this concept. It takes a brave soul to hack games with little to no documentation.

[LandonRay]

Thank you, Zombero. Actually, if I start re-coding enemies now, I might still have the kernel located and decoded before the first major release.

[LandonRay]

And the 16-bit HP problem is only temporary. Once I decode the AI, I should be able to use it for a workaround. Variable based HP looping, multiple forms through the AI and formations, or something like that. It depends on what the AI can do.

[Angel]

I love waking up and just seeing how this is going. How this site spoils me so...

[LandonRay]

Then I shall try to post an update every morning for you.

The Quest for the Elusive Kernel...

Given that the directory locations seem to be prioritized by intrinsic value to the operation of the game, then data is stored in sub-directories which are setup in linear order, it is safe to assume that basic system files are stored in Directory 00. System files would include the kernel.

Directory 00 starts immediately after the last list of sub-directories.

Directory 00 starts at 23D120 and runs to 3C0AB0. I’m assuming it is divided into 21 sub-directories. Here is a list of their locations…

00 – 23D120

01 – 23DA50

02 – 267900

03 – 2D4170

04 – 3097E0

05 – 3186C0

06 – 31D970

07 – 32E3E0

08 – 33E520

09 – 34F8C0

0A – 353910

0B – 35B9B0

0C – 36A890

0D – 36E8E0

0E – 37F350

0F – 3873F0

10 – 38F490

11 – 39FF00

12 – 3A0830

13 – 3B49C0

There should be one more sub-directory in there somewhere.

Edit: That list isn't quite right, I'll fix it later.

Edit 2: I screwed something up horribly in there. Regardless, I'm going to run through the sections and try to track down the kernel as quickly as I can.