Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- US Index 57 Notes
- Buffer A starts at 0x3FCE10
- Length Table Start 0x1D07C4
- Message Table Start 0x1D0714
- -------------
- Soar Cursor Index = 57
- Length Offset = 2*57 = 114
- Message Offset = 16*57 = 912
- Soar Location Length = 0x00FF = 255
- Soar Location Message is the 255 bytes (1 byte per US character) starting at 0x1D0714 + 912 = 0x1D0AA4
- The first 9 bytes of Buffer B are occupied by "Soar to ", so bytes 192 and 193 of Soar Location Message overwrite Text Instruction Counter
- 0x1D0AA4 + 191 = 0x1D0B63, so Text Instruction Counter gets overwritten by the 2 bytes starting at 0x1D0B63
- The 2 bytes at 0x1D0B63 have value 0xF880 = 63616
- Start reading from (Start of Buffer A) + 1 + (Text Instruction Counter) = 0x3FCE10 + 1 + 63616 = 0x40C691
- Start writing to (Start of Buffer B) + 9 + 255 = 0x3FD34C + 9 + 255 = 0x3FD454
- ---
- The block of memory starting at 0x40C691 can be manipulated by doing a lot of things in SCT, such as having bombs or chus explode, playing isot, etc. The way these values change seems to depend on a lot of variables. With more information on how manipulating this block of memory works, there is a good chance that a setup for getting debug menu could be found.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
