Actions

SCHG

Sonic Heroes/EXE Editing

From Sonic Retro

Revision as of 07:26, 14 February 2017 by Crazy Muzzarino (talk | contribs) (Known Offsets)
SCHG: Sonic Heroes
Main Article
Mechanic Editing

DOL Editing
EXE Editing
Music Pointers
Object Parameter Data
Relocatable Editing (PC)
File Offsets

Model Editing
Collision Format
Model Format
Level Editing

Camera Editing
Event Editing
ID list
Indirect Editing
Light Editing
Level List
Object Editing
Object Porting
Spline Editing
Texture Animation Editing
Visibility Editing

Particle Editing
Particle Editing
Sound Editing
Music List

Sound Editing
Voices

SCHG How-Tos

Custom Object Material Effect Tutorial
Level Editing Tutorial


The main EXE of the PC game is Tsonic_win.exe. The EXE is little endian. The pointer key is 0x400000; to find where a pointer points to, you must subtract that from its value.

Start/End Positions

Start Positions

List of single player start positions begins at 0x3C2FC8. Each level array has the first 4 bytes setting the level number at the first byte and five 0x1C entries for the four teams and Super Hard (although the Super Hard entry seems to be ignored, it uses Team Sonic's instead). Note that the level IDs used are not the same ones as the level and object lists, they are the ones used in RAM, for example Seaside Hill is 02

Start position entry:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset Type Description
0x00 Float X Position
0x04 Float Y Position
0x08 Float Z Position
0x0C Word Pitch (direction)
0x14 Byte Mode
00: Normal
01: Running
02: Rail
0x18 Word Hold time
Time spent running

Ending Positions

List of ending positions begins at 0x3C45B8. These are the places where each team does their victory animation and the results are displayed, after the mission is finished. Each level array has the first 4 bytes setting the level number at the first byte and five 0x14 entries for the four teams and Super Hard. This section has data for single player and multiplayer modes.

End position entry:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset Type Description
0x00 Float X Position
0x04 Float Y Position
0x08 Float Z Position
0x0C Word Camera pitch
Angle from which the characters are seen
0x0E Word ? (Always FF FF)
0x10 Long Null

Multiplayer Positions

List of multiplayer start positions begins at 0x3C5E18, after the ending positions. This section has data for the Team Battles and each multiplayer level. The entries are the same as single player start positions, but only have two position entries instead of 5, for the first and second players.

List of multiplayer "bragging" positions begins at 0x3C6380, after the multiplayer start positions. These are the positions where each team makes a comment to the other one, before the multiplayer match starts. This section only has data for each multiplayer level, not the Team Battles. The entries follow the same format as single player ending positions, with five entries.

Splines (incomplete)

Splines set path data for autoloops, rails and probably other path data. The arrays for each level are located in various different places in the EXE. What is known is that each level has a list of pointers. Each pointer points to a spline header, which is defined below. Each spline header points to its list of vertices.

A search reveals there are apparently 62 autoloops and 1075 rails in the entire game. It's possible that some paths are made of multiple splines though.

Grand Metropolis pointer list starts at 0x4B5B60. There are 12 pointers in it. It's not known what points to this list yet. The headers for the splines themselves are just before this pointer list.

Header entry:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset Type Description
0x00 Word Always 01 00
0x02 Word Number of vertices
0x04 Float Total length of spline
0x08 Pointer (Long) Pointer to first vertex of spline
0x0C Pointer (Long) Type of spline
0x433970 (Autoloop)
0x4343F0 (Rail)

Point entry:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset Type Description
0x00 Long Unknown flags (speed?)
0x04 Float Distance to next point
Last one is 0
0x08 Float X Position
0x0C Float Y Position
0x10 Float Z Position


Material Functions

Material Opcodes

A number of code sections contain additional materials/graphic codes rendered via Renderware engine that provides special effects to an object such as Espio's invisibility. Function entry:

Regular Material function:

6A 00 6A 00
Offset Type Description
0x00 and 0x02 Byte Always 6A
0x01 Byte Material value
0x03 Byte Material function type

4 Byte Material function:

68 00000000
Offset Type Description
0x00 Byte Always 68
0x01 4 Bytes Material value

A list of material types are implemented in the EXE.

Material type parameters Alternative Material type parameters Hexadecimal type Description Parameters Call Address Alternative Call Address Example(s) Notes
01 Byte Null 00 0024C9B0 (EXE)
0064C9B0 (RAM)
6A 00 6A 01 Values upon "00" will crash the game.
06 Byte Z-buffer testing 00 = Disabled
01 = Enabled
0024C9B0 (EXE)
0064C9B0 (RAM)
6A 00 6A 06
07 Byte Shading 00 = rwSHADEMODEFLAT
01 = rwSHADEMODEGOURAUD
0024C9B0 (EXE)
0064C9B0 (RAM)
6A 02 6A 07
08 Byte Z-buffer writing 00 = Disabled
01 = Enabled
0024C9B0 (EXE)
0064C9B0 (RAM)
6A 01 6A 08
09 Byte Texture filtering 01 = rwFILTERNEAREST
02 = rwFILTERLINEAR
03 = rwFILTERMIPNEAREST
04 = rwFILTERMIPLINEAR
05 = rwFILTERLINEARMIPNEAREST
06 = rwFILTERLINEARMIPLINEAR
0024C9B0 (EXE)
0064C9B0 (RAM)
6A 02 6A 09
0A & 0B 13 & 14 Byte Source Blend
Destination Blend
01 = rwBLENDZERO
02 = rwBLENDONE
03 = rwBLENDSRCCOLOR
04 = rwBLENDINVSRCCOLOR
05 = rwBLENDSRCALPHA
06 = rwBLENDINVSRCALPHA
07 = rwBLENDDESTALPHA
08 = rwBLENDINVDESTALPHA
09 = rwBLENDDESTCOLOR
0A = rwBLENDINVDESTCOLOR
0B = rwBLENDSRCALPHASAT
0024C9B0 (EXE)
0064C9B0 (RAM)
00247980 (EXE)
00647980 (RAM)
6A 05 6A 0A
6A 06 6A 0B

6A 05 6A 13
6A 06 6A 14
Models that are completely opaque will not be able to use the intended alpha blending.

To make models use different alpha blending modes, change the byte in offset 0x248B1C from 74 to EB.
0C 1B Byte Vertex Alpha Enabling 00 = Disabled
01 = Enabled
0024C9B0 (EXE)
0064C9B0 (RAM)
00247980 (EXE)
00647980 (RAM)
6A 01 6A 0C
0E Byte Fog 00 = Disabled
01 = Enabled
0024C9B0 (EXE)
0064C9B0 (RAM)
6A 00 6A 0E
14 16 Byte Cull Mode 01 = None
02 = Back
03 = Front
0024C9B0 (EXE)
0064C9B0 (RAM)
00247980 (EXE)
00647980 (RAM)
6A 02 6A 14
6A 02 6A 16
18 Byte Alpha Testing Reference 4 Byte Range: 00000000-FF000000 00247980 (EXE)
00647980 (RAM)
68 C8000000 6A 18
19 Byte Alpha Testing 01 = rwALPHATESTFUNCTIONNEVER
02 = rwALPHATESTFUNCTIONLESS
03 = rwALPHATESTFUNCTIONEQUAL
04 = rwALPHATESTFUNCTIONLESSEQUAL
05 = rwALPHATESTFUNCTIONGREATER
06 = rwALPHATESTFUNCTIONNOTEQUAL
07 = rwALPHATESTFUNCTIONGREATEREQUAL
08 = rwALPHATESTFUNCTIONALWAYS
00247980 (EXE)
00647980 (RAM)
6A 08 6A 19
AB000000 4 Bytes Blend Equation 01 = Add
02 = Subtract
03 = Reverse Subtract
04 = Min
05 = Max
00247980 (EXE)
00647980 (RAM)
6A 01 68 AB000000

Known Offsets

A list shows offsets for special material effects that were discovered in the EXE.

Offsets RAM Offsets Materials Default Parameter Values Applies on Notes
0001BA94
0001BA9E
0001BAA9
0001BAB3
0001BACC
0001BAD5
0001BAD9
0001BAE3
0041BA94
0041BA9E
0041BAA9
0041BAB3
0041BACC
0041BAD5
0041BAD9
0041BAE3
Z-testing
Z-writing
Fog Enabling
Culling
Source Blend #1
Destination Blend #1
Source Blend #2
Destination Blend #2
00
00
00
01
02
06
05
02
Warp Effects
0001E0A1
0001E0AD
0001E0B6
0001E0BF
0001E0C8
0001E0D1
0001E0DA
0001E0E3
0001E0EC
0001E0F8
0041E0A1
0041E0AD
0041E0B6
0041E0BF
0041E0C8
0041E0D1
0041E0DA
0041E0E3
0041E0EC
0041E0F8
Z-testing
Z-writing
Fog Enabling
Culling
Vertex Alpha Enabling
Source Blend
Destination Blend
Null Material
Shade Mode
Texture Filtering
00
01
00
01
01
05
06
00
02
02
Main HUD interface
0005A007
0005A010
0005A019
0005A022
0045A007
0045A010
0045A019
0045A022
Source Blend
Destination Blend
Culling
Fog
05
02
01
00
Triple Spring Rays
0006C369
0006C372
0006C37B
0006C384
0046C369
0046C372
0046C37B
0046C384
Source Blend
Destination Blend
Culling
Fog
05
02
01
00
Checkpoint Rays
000720A1
000720AA
000720B3
004720A1
004720AA
004720B3
Source Blend
Destination Blend
Culling
05
02
01
Flower Rays
00076404
0007640D
00076416
00476404
0047640D
00476416
Source Blend
Destination Blend
Culling
02
06
01
Hint Ring Question Mark
00078361
0007836A
00078373
0007838B
00478361
0047836A
00478373
0047838B
Source Blend
Destination Blend
Culling #1
Culling #2
05
06
03
02
Popped Item Balloon
0007C04C
0007C055
0007C05E
0047C04C
0047C055
0047C05E
Source Blend
Destination Blend
Fog Enabling
02
02
00
Lasers
0008AC09
0008AC12
0008AC1B
0048AC09
0048AC12
0048AC1B
Source Blend
Destination Blend
Culling
05
02
01
Fading Target Switch
0008F265
0008F26E
0008F277
0008F280
0008F289
0008F29C
0008F2A5
0048F265
0048F26E
0048F277
0048F280
0048F289
0048F29C
0048F2A5
Vertex Alpha Enabling
Fog Enabling
Z-writing
Source Blend #1
Destination Blend #1
Source Blend #2
Destination Blend #2
01
00
00
05
02
05
06
Lens Flares
0009656C
00096575
0049656C
00496575
Source Blend
Destination Blend
05
02
Fading Hermit Crab
000C516C
000C5175
004C516C
004C5175
Source Blend
Destination Blend
05
02
Fading Casino Chip
000C3D66
000C3D6F
000C3D7B
000C3D84
000C3D8D
000C3D96
004C3D66
004C3D6F
004C3D7B
004C3D84
004C3D8D
004C3D96
Z-writing
Z-testing
Shade Mode
Texture filtering
Vertex Alpha Enabling
Culling
00
00
02
02
01
01
Casino Slot Interface
000FEE13
000FEE1C
000FEE25
004FEE13
004FEE1C
004FEE25
Source Blend
Destination Blend
Culling
02
02
01
Mystic Mansion Lights
00103401
00103409
00103412
00503401
00503409
00503412
Source Blend
Destination Blend
Culling
02
02
01
Teleporter Switch Glowing Symbols
00107BE4
00107BED
00107BF6
00507BE4
00507BED
00507BF6
Source Blend
Destination Blend
Culling
05
02
01
Thunder lightening with skulls
001D2B99
001D2BA2
001D2BAE
001D2BB7
001D2BC0
005D2B99
005D2BA2
005D2BAE
005D2BB7
005D2BC0
Source Blend
Destination Blend
Culling
Vertex Alpha Enabling
Fog Enabling
05
02
02
01
00
Espio's Invisibility
006387B4
006387BD
006387C6
006387CF
006387B4
006387BD
006387C6
006387CF
Source Blend
Destination Blend
Culling
Fog Enabling
05
02
01
00
Light Streak Effects
002396AD
002396B6
002396BF
002396CB
002396D4
002396DD
006396AD
006396B6
006396BF
006396CB
006396D4
006396DD
Source Blend
Destination Blend
Culling
Null Material
Vertex Alpha Enabling
Fog Enabling
05
02
01
00
01
00
Character Trail Effects

Material Flags

Somewhat like BSPs with identifiers stored in .ONE files, objects have their own material flags stored in the code. Objects that use material flags provide a rendering effect through the main rendering code sections when applied to an object after it appears. Examples of objects that use material flags are Energy paths and HEXAeco Signboards. Note that not all objects use material flags separately for each model loaded in the level.

Flag offset pointer entry:

00 72 00 00 00
Offset Type Description
0x00 Byte Pointer flag
0x01 4 bytes Always 72 00 00 00

Flag entry:

00 00 00 00 00 00 00 00 00
Offset Type Description
0x01 Byte Flag

A list of identifier flags for objects are the following pointer and regular bytes:
Flag pointer:

Flag Identifier Description Notes
54  ?? Invisible geometry Usually used if the object set has individual material flags stored somewhere in the EXE and RAM.
58 DN Sky model material
5C O Reflective material
60 OS Reflective floor material
64 ON Regular material
68 ONS Regular floor material
6C ONW Regular material without culling
70 ONWS Regular floor material without culling
74 P Alpha testing with reflective material
78 PS Alpha testing with reflective floor material
7C PN Alpha testing material
80 PNS Alpha testing floor material
84 PNW Alpha testing material without culling
88 PNWS Alpha testing floor material without culling
8C DA Alpha sky material
90 AF Alpha reflective material
94 AFS Alpha reflective floor material
98 AFN Alpha material
9C AFNS Alpha floor material
A0 K Additive alpha material
A4 KW Additive alpha material without culling
A8 A Alpha reflective material
AC AS Alpha reflective floor material
B0 AN Alpha material
B4 ANS Alpha floor material

Individual flag ids:

Flag Identifier Description Notes
00  ?? Usually used if the object set has individual material flags stored somewhere in the EXE and RAM.
01 DN Sky model material
02 O Reflective material
03 OS Reflective floor material
04 ON Regular material
05 ONS Regular floor material
06 ONW Regular material without culling
07 ONWS Regular floor material without culling
08 P Alpha testing with reflective material
09 PS Alpha testing with reflective floor material
0A PN Alpha testing material
0B PNS Alpha testing floor material
0C PNW Alpha testing material without culling
0D PNWS Alpha testing floor material without culling
0E DA Alpha sky material
0F AF Alpha reflective material
10 AFS Alpha reflective floor material
11 AFN Alpha material
12 AFNS Alpha floor material
13 K Additive alpha material
14 KW Additive alpha material without culling
15 A Alpha reflective material
16 AS Alpha reflective floor material
17 AN Alpha material
18 ANS Alpha floor material

Known Offsets

A list below shows offsets found so far in the EXE for certain parts of the codes that apply material flags to objects.

Object Offset(s) RAM Offsets Models Default byte values Flag Type(s) Notes
Arrow Light Sign Pads 000B0659
000B0AB8
004B0659
004B0AB8
Pad
Arrow Light
64
A0
Pointer
Barrier 001822CF 005822CF Barrier Effect A4 Pointer
Bingo Number Chips 003F1228
003F1238
003F1248
003F1258
003F1268
003F1278
003F1288
003F1298
003F12A8
003F12B8
003F12C8
003F12D8
003F12E8
007F12F8
003F1308
003F1318
003F1328
003F1338
003F1348
007F1228
007F1238
007F1248
007F1258
007F1268
007F1278
007F1288
007F1298
007F12A8
007F12B8
007F12C8
007F12D8
007F12E8
007F12F8
007F1308
007F1318
007F1328
007F1338
007F1348
Yellow Chip
Number 1
Orange Chip
Number 2
Red Chip
Number 3
Mint Chip
Number 4
Lime Chip
Number 5
Aqua Chip
Number 6
Magenta Chip
Number 7
Blue Chip
Number 8
Purple Chip
Number 9
Broken Pieces
11
04
11
04
11
04
11
04
11
04
11
04
11
04
11
04
11
04
04
Byte ID
Butterflies 000DD88C
000DD8BE
004DD88C
004DD8BE
Butterflies 7C
7C
Pointer
Energy Blocker for Road 004B3938
004B3968
004B3978
004B3988
004B3998
004B39A8
008B3938
008B3968
008B3978
008B3988
008B3998
004B39A8
Pumper Base
Left Pumper
Right Pumper
Flashing Light
Laser Fence
Broken Pieces
04
04
04
13
13
04
Byte ID
Energy Lava 003E63C4
003E63DC
007E63C4
007E63DC
Lava
Lava Gradient
04
13
Byte ID
Energy Path Objects 00172D46
00572DA1
00173279
0017330B
0017399A
00572D46
00572DA1
00573279
0057330B
0057399A
Energy Fill
Energy
Energy Path Activator
Energy Path
Lights
64
64
A0
A0
A4
Pointer
Fireball Light Spots 003E5CEC 007E5CEC Fireball Spot 13 Byte ID
Fireworks 000B4AC3 004B4AC3 Firework Effects 14 Byte opcode Not used in the game.
Frogs 00468A20
00468A44
00868A20
00868A44
Green Frog
Black Frog
04
04
Byte ID
Grand Metropolis Clouds 001769FD 005769FD Clouds 0E Byte Opcode
Hang Castle Clouds 000F77A5 004F77A5 Clouds A4 Pointer
HEXAeco Signboard 004B446C
004B4484
004B449C
008B446C
008B4484
008B449C
Frame
Sign Layer #1
Sign Layer #2
04
14
14
Byte ID
Mystic Mansion Pocket Dimension Sphere 00104EEA 00504EEA Pocket Dimension Sphere A4 Pointer
Power Plant Clouds 000A6B0E 004A6B0E Clouds 0F Byte opcode Value is one value up from 0E in this offset and decremented by the opcode after this one resulting the byte "0E" after loading.
You will need to add the material flag id by 01 for your desired material effect (Example:if the byte is 15, it will become 14 before the level loading finishes.)
Rail Canyon Rails 000D5A4A
000D5B39
004D5A4A
004D5B39
Changable Rails A0 Pointer
Seaside Hill Flags 0009543A
0009547C
0049543A
0049547C
Flag Pole
Flag
64
7C
Pointer
Teleporter Switch 00102D62
00103D38
00502D62
00503D38
Switch Ball
Switch Pad/Inactive Switch
60
60
Pointer


Sonic Community Hacking Guide
General
SonED2 Manual | Subroutine Equivalency List
Game-Specific
Sonic the Hedgehog (16-bit) | Sonic the Hedgehog (8-bit) | Sonic CD (prototype 510) | Sonic CD | Sonic CD (PC) | Sonic CD (2011) | Sonic 2 (Simon Wai prototype) | Sonic 2 (16-bit) | Sonic 2 (Master System) | Sonic 3 | Sonic 3 & Knuckles | Chaotix | Sonic Jam | Sonic Jam 6 | Sonic Adventure | Sonic Adventure DX: Director's Cut | Sonic Adventure DX: PC | Sonic Adventure (2010) | Sonic Adventure 2 | Sonic Adventure 2: Battle | Sonic Adventure 2 (PC) | Sonic Heroes | Sonic Riders | Sonic the Hedgehog (2006) | Sonic & Sega All-Stars Racing | Sonic Unleashed (Xbox 360/PS3) | Sonic Colours | Sonic Generations | Sonic Forces
Technical information
Sonic Eraser | Sonic 2 (Nick Arcade prototype) | Sonic CD (prototype; 1992-12-04) | Dr. Robotnik's Mean Bean Machine | Sonic Triple Trouble | Tails Adventures | Sonic Crackers | Sonic 3D: Flickies' Island | Sonic & Knuckles Collection | Sonic R | Sonic Shuffle | Sonic Advance | Sonic Advance 3 | Sonic Battle | Shadow the Hedgehog | Sonic Rush | Sonic Classic Collection | Sonic Free Riders | Sonic Lost World
Legacy Guides
The Nemesis Hacking Guides The Esrael Hacking Guides
ROM: Sonic 1 | Sonic 2 | Sonic 2 Beta | Sonic 3

Savestate: Sonic 1 | Sonic 2 Beta/Final | Sonic 3

Sonic 1 (English / Portuguese) | Sonic 2 Beta (English / Portuguese) | Sonic 2 and Knuckles (English / Portuguese)
Move to Sega Retro
Number Systems (or scrap) | Assembly Hacking Guide | 68000 Instruction Set | 68000 ASM-to-Hex Code Reference | SMPS Music Hacking Guide | Mega Drive technical information