banker pointer conversation

IndexticToday at 9:06 PM
what's all this talk about pal gamecube now

faschToday at 9:16 PM
long story short, there is a potential way to manipulate memory without overwriting graphics pointers which would crash the game
pal gamecube (spanish) just happens to have a nice low index to work for that

IndexticToday at 9:17 PM
so this is non-debug menu, then?

faschToday at 9:17 PM
yes
the debug menu method overwrites these graphics pointers, which is what causes the crashes when hovering over sword in the inventory. And causes the crash when you close the debug menu

ImbuedToday at 9:17 PM
does it just so happen to write good values to the 2 graphics pointers or does it somehow completely avoid writing to them at all? if the latter, I have no idea how that would work

faschToday at 9:18 PM
latter
the science discord has the theory
its builds upon the theory for the current method with the graphics buffer stuff
index overflow into the instruction counter manipulation into graphics buffer manipulation
im probably not sounding like i make any sense to anyone

ImbuedToday at 9:21 PM
I heard something about
Bank Withdraw/Deposit Digit Position related
 pointing to stuff (which i notice comes before both of the graphics pointers)
is that involved at all

faschToday at 9:21 PM
so the game draws each printed character in memory
one after another
but the bank needs to know where these characters are drawn when you manipulate them
so that address is an offset into the graphics buffer
graphics_buffer_base + offset + column*0x80
is where it draws the character
cause each character is 128 bytes

ImbuedToday at 9:24 PM
what is the graphics buffer exactly? also where is it in memory in relation to Buffer B/how can you find it in memory?

faschToday at 9:24 PM
its before buffer A in memory
3EF190 i think
is the start

ImbuedToday at 9:25 PM
US?

faschToday at 9:25 PM
yes
graphics buffer is just
the raw pixel data
of the printed characters
rgba5551 i think

ImbuedToday at 9:26 PM
by "column" i assume you mean
Bank Rupee Column Selected

faschToday at 9:26 PM
yes

ImbuedToday at 9:27 PM
do you know how many bytes the graphics buffer is?
approx

faschToday at 9:27 PM
3c00 maybe
thats 15360 bytes

ImbuedToday at 9:28 PM
I see

faschToday at 9:28 PM
i think

ImbuedToday at 9:28 PM
yea 15360

faschToday at 9:28 PM
i mean, i think thats how large it is
lol

ImbuedToday at 9:28 PM
lol ic

faschToday at 9:28 PM
theres multiple buffers

ImbuedToday at 9:32 PM
so what is the relation between the 128-byte characters that are drawn in the graphics buffer with the 1 byte characters (2 byte on jp) that are displayed in textboxes?

faschToday at 9:32 PM
128 bytes is the raw pixel data
of what makes the image

ImbuedToday at 9:32 PM
ah I see

faschToday at 9:32 PM
where as the 1 byte (2 in J) is just the "ASCII" equivalent

ImbuedToday at 9:35 PM
so how does drawing the characters work in relation to text being processed? like I get that we can manipulate this graphics buffer offset, but I'm not really sure what kind of memory is getting written in the graphics buffer or how that works

faschToday at 9:35 PM
so this is post-message being printed
So think about the banker text
you can manipulate the numbers.. and on screen you can visually see the number's image change
the game needs to know based on those addresses, where in the graphics buffer, what to change to make it that new number's image

LinkCrismonrunsToday at 9:37 PM
Is it possible Other locations can be possible to do Debug menu at to

ImbuedToday at 9:40 PM
so how graphics_buffer_base + offset + column*0x80 says where to draw the character, but how does the game know what image to draw?

faschToday at 9:41 PM
so the normal values for bank are 0-9
(the ascii equivalent values, not the actual numbers)
and i'm not sure where exactly the character data is stored
but it just pulls the 128 bytes from there
but those are constants
they will always be the same
theres only one way to draw a '9' on the screen

ImbuedToday at 9:45 PM
I see, so the main take away is that we're pulling 128 bytes from somewhere and overwriting the first 128 bytes we see based on the offset, and is the idea with the manipulation to get an offset big enough so that we're copying these 128 bytes somewhere outside of the graphics buffer (idk if drawing them in the wrong spot of the graphics buffer causes any issues) to change the value of some unrelated addresses that are favorable to overwrite?

faschToday at 9:45 PM
yes

ImbuedToday at 9:45 PM
and I guess we have 10 options for what the 128 bytes can be since only 0-9

faschToday at 9:45 PM
yep
and the offset can be misaligned
cause normally its every 0x80 bytes
but you could in theory overwrite it to something like 0x00000001
instead of ending in 0x00, 0x80, 0x100, 0x180, 0x200, etc.

ImbuedToday at 9:47 PM
I see, so can get like an overlap in the groups of 128 bytes (though not entirely sure what the implications of that can be)
since i assume we mostly care about stuff outside of the graphics buffer

faschToday at 9:48 PM
yeah
if it was shifted in the graphics buffer itself
the image would be shifted if it was shifted by a multiple of 2 bytes
mostly you'll just get garbled displayed characters

ImbuedToday at 9:53 PM
all right, so in practice, if trying to use this, I assume we want some terminator character sometime after overwriting the banker column + offset, but before the first graphics pointer and then I guess hope it overwrites the offset to something big enough that it reaches far forward into useful places of memory

faschToday at 9:53 PM
yep

ImbuedToday at 9:53 PM
okay cool, this all makes sense than I think
actually
I forget if I asked this already
but how do we know which of the 10 digits it'll write?

faschToday at 9:56 PM
it snaps to the nearest number
when you press the control stick to change the number
i think?
it might not snap

ImbuedToday at 9:57 PM
I think I'm missing a detail
so like

SeedBornToday at 9:57 PM
You talk to the banker, Imbued

ImbuedToday at 9:57 PM
ah

faschToday at 9:57 PM
well it would be like talking to the banker
but its a message from song of soaring

SeedBornToday at 9:58 PM
Oh I see
What would happen if you talked to the banker after

faschToday at 9:58 PM
values would be reset i'm sure

ImbuedToday at 9:58 PM
wait, so SoS would bring up the text where we can scroll?

faschToday at 9:58 PM
yes

ImbuedToday at 9:59 PM
not obvious to me why that would get brought up instead of the "soar to ..." or what that actually means

faschToday at 9:59 PM
ok so
first it does the index overflow with the destination string
then it does the overflow with the instruction counter stuff
in the instruction counter stuff is the values to manipulate the column + offset
and a control code that activates the  text for the banker stuff

ImbuedToday at 10:00 PM
ah

faschToday at 10:01 PM
So the message gets done printing
and now you have control in the textbox
at which point you just use the control stick to change the values, which in turn change the graphics buffer values

SeedBornToday at 10:02 PM
Oh I see, that's what the control code is for

ImbuedToday at 10:02 PM
confused which control code it is though... I see F0 which does
Print: Total Rupees in Bank
 and CE which does
Print: Total Rupees in Bank or Won by Betting
doesn't sound like either of these would involve scrolls

faschToday at 10:03 PM
the display prompt ones
CC

ImbuedToday at 10:03 PM
oh lol
ctrl + f "bank" was insufficient

faschToday at 10:04 PM
im not sure if the others work, but they might

ImbuedToday at 10:04 PM
so I assume the first 3*128 bytes get occupied with 3 0's?
and then after that, every time I scroll, the next 128 bytes get overwritten with the next number I scroll to?

faschToday at 10:05 PM
yes

ImbuedToday at 10:05 PM
wow

faschToday at 10:05 PM
its not the next 128 bytes
its the same 128 bytes that was containing the graphics data for the 0

ImbuedToday at 10:05 PM
oh

faschToday at 10:05 PM
if you had 0 0 0
and changed it to 1 0 0
you overwrite that initial 0 to 1
so thats in column 0

ImbuedToday at 10:06 PM
I see, so basically I just have 3*128 bytes that I can change

faschToday at 10:06 PM
graphics_buffer_base + offset + 0 * 0x80
so it changes what was at graphics_buffer_base + offset
yes but
remember you can manipulate the column address
you have way more than 3 columns

ImbuedToday at 10:07 PM
ah

faschToday at 10:07 PM
-32768 to 32767

ImbuedToday at 10:07 PM
ok so
suppose I set it so that the column I have selected is column 8, for example (also I assume from left to right the columns are numbered 0, 1, 2 and that I start on column 2 by default in normal gameplay), then would I be able to scroll to the left to hit column 7 and column 6? or does it not quite work this way?

faschToday at 10:09 PM
thats right
you can go towards 0
but not further away

ImbuedToday at 10:10 PM
by I only have access to 3 slots at a time, right?
they just might be shifted
columns I should call them I guess

faschToday at 10:10 PM
if you start at column 8
you can go down to column 0

ImbuedToday at 10:10 PM
oh wow

faschToday at 10:10 PM
but when you reach column 2

ImbuedToday at 10:10 PM
I was thinking I'd only have 8, 7, and 6

faschToday at 10:10 PM
you're stuck in that 3 range
0 1 and 2

ImbuedToday at 10:10 PM
ah
so I can go from 7 to 8?

faschToday at 10:11 PM
i should rephrase
if you are above 2

ImbuedToday at 10:11 PM
but not 2 to 3

faschToday at 10:11 PM
you can only go down

ImbuedToday at 10:11 PM
ah
makes sense

faschToday at 10:11 PM
and if you are below 0, you can only go up

ImbuedToday at 10:11 PM
ah
ok cool
and I guess if I wanted to check for myself what the values of the 128 bytes are for each digit, I could probably easily do that just by going to the banker and looking at the addresses we just discussed
so I think that's all the necessary info right there just discussed
thanks

faschToday at 10:14 PM
np