Final Fantasy VII Field Script Debugger: Difference between revisions
| Revision as of 14:36, 2 November 2026 RemmyLee (FF7 file pages and captions: short labels in the manual's form; the dates and rooms stay in Source and the text) | Revision as of 15:10, 2 November 2026 RemmyLee (Final Fantasy VII debugger: list 1A at 213 lines, the sprites in 17 unreferenced areas, and the run of lists 1A and 1B on a SCPH-5501 through the StationX cartridge) | ||
| Line 43: | Line 43: | ||
|  |  | ||
| − | The text draw routine at 800D9C04h draws at most 344 character sprites in one frame, whereas the four windows together need about 400. Consequently, when window 1 is filled as well, the text is cut off: in the StationX emulator, window 5 stopped partway through its author line. The field pointer routine at 800BC438h, which tests the Select button, is called only from 800BA7A8h, and the code that it calls at 800BC4D4h is therefore unused once that call is changed. A routine placed at 800BC4D4h fills window 1 for the party leader and then draws the windows, and a second one at 800BC538h skips spaces and extends the sprite buffers, so that the four windows need only 357 sprites. With both routines in place, a SCPH-5501 showed all four windows on 1 November 2026 in room MDS5_2, and window 1 read CTRL:CLOUD.[^bench][^run2] | + | The text draw routine at 800D9C04h draws at most 344 character sprites in one frame, whereas the four windows together need about 400. Consequently, when window 1 is filled as well, the text is cut off: in the StationX emulator, window 5 stopped partway through its author line. The field pointer routine at 800BC438h, which tests the Select button, is called only from 800BA7A8h, and the code that it calls at 800BC4D4h is therefore unused once that call is changed. |
| + | A routine placed at 800BC4D4h fills window 1 for the party leader and then draws the windows. A second routine at 800BC538h draws no sprite for a space and places each sprite beyond the 344th in one of 17 areas of memory: the rest of the field pointer code, three routines of FIELD.BIN and 13 routines of the main program. No call, jump, pointer word or address load in the main program or in the field, battle, world, menu and minigame modules refers to these areas, and they can therefore hold sprites. The four windows need at most 455 sprites, when window 3 shows its argument rows, and the areas give each of the two sprite buffers room for at least 127 sprites beyond the 344th. With an earlier version of the routines, a SCPH-5501 showed all four windows on 1 November 2026 in room MDS5_2, and window 1 read CTRL:CLOUD.[^d1][^bench][^run2] | ||
| + | |||
|  |  | ||
| ## GameShark Codes | ## GameShark Codes | ||
| − | The debugger can be shown with either of two GameShark codes. List 1, of 22 lines, shows windows 3, 4 and 5, and lists 1A and 1B, of 132 and 24 lines, show all four windows. The buttons that both codes read at 8009AC5Ch are shown below. While either code is on, Select no longer shows the field pointer, because the frame call at 800BA7A8h no longer goes to the pointer routine.[^bench][^d1] | + | The debugger can be shown with either of two GameShark codes. List 1, of 22 lines, shows windows 3, 4 and 5, and lists 1A and 1B, of 213 and 24 lines, show all four windows. The buttons that both codes read at 8009AC5Ch are shown below. While either code is on, Select no longer shows the field pointer, because the frame call at 800BA7A8h no longer goes to the pointer routine.[^bench][^d1] |
| Table: Debugger buttons | Table: Debugger buttons | ||
| Line 94: | Line 96: | ||
| ### Lists 1A and 1B | ### Lists 1A and 1B | ||
| − | List 1A writes the two routines described under Operation into the field pointer code, changes the sprite limit test at 800D9C98h and the sprite store at 800D9E84h, and then changes the frame call at 800BA7A8h to jal 800BC4D4h. Each line of list 1A writes one halfword that differs from FIELD.BIN, and list 1A therefore has 132 lines. List 1B changes the retail frame call to a nop and contains the same window and button lines as list 1. Because list 1A writes only while the frame call is a nop, the routines are written in the frame after list 1B removes the retail call, and list 1A must therefore be entered as the first of the two cheats. After a return from battle, which reloads FIELD.BIN, the two lists repeat these steps.[^bench][^d1] | + | List 1A writes the two routines described under Operation into the field pointer code, changes the sprite limit test at 800D9C98h and the sprite store at 800D9E84h, and then changes the frame call at 800BA7A8h to jal 800BC4D4h. Each line of list 1A writes one halfword that differs from FIELD.BIN, and list 1A therefore has 213 lines. List 1B changes the retail frame call to a nop and contains the same window and button lines as list 1. Because list 1A writes only while the frame call is a nop, the routines are written in the frame after list 1B removes the retail call, and list 1A must therefore be entered as the first of the two cheats. After a return from battle, which reloads FIELD.BIN, the two lists repeat these steps.[^bench][^d1] |
| − | In the StationX emulator on 1 November 2026, the two lists were run by a program that reads and writes memory in the same way as the bench cart's cheat engine. All four windows appeared in room MDS5_2: window 1 showed CTRL:CLOUD, window 5 showed AUTHR:AKIYAMA and EVENT:MDS5_2 with all five rows, window 4 showed ACTOR:SAVEL0 and window 3 showed WORD:RET.[^w1] | + | On 2 November 2026 the two lists were run on a SCPH-5501 by the cheat engine of the StationX cartridge, which accepts up to 255 lines in one code. With a saved game in room MDS5_2, Select + L2 showed all four windows: window 1 read CTRL:CLOUD, window 5 read AUTHR:AKIYAMA with its five rows, window 4 read ACTOR:SAVELO and window 3 read WORD:RET with its five argument rows. After Select + L1 each R2 advanced the actor window, from DIRECTR to CLOUD and then to EARITH, and Select + R2 hid the windows until Select + L2 showed them again.[^run3] |
| − |  | + |  |
| List 1A: | List 1A: | ||
| Line 162: | Line 164: | ||
| 800BC54C 0000 | 800BC54C 0000 | ||
| 800BC54E 9141 | 800BC54E 9141 | ||
| − | 800BC554 001B | + | 800BC554 001E |
| 800BC556 1020 | 800BC556 1020 | ||
| 800BC558 0000 | 800BC558 0000 | ||
| Line 170: | Line 172: | ||
| 800BC560 0008 | 800BC560 0008 | ||
| 800BC562 256B | 800BC562 256B | ||
| − | 800BC564 0179 | + | 800BC564 0158 |
| 800BC566 2841 | 800BC566 2841 | ||
| − | 800BC568 0016 | + | 800BC568 0017 |
| − | 800BC56A 1020 | + | 800BC56A 1420 |
| − | 800BC56C 0158 | + | 800BC56C 800E |
| − | 800BC56E 2841 | + | 800BC56E 3C03 |
| − | 800BC570 0012 | + | 800BC570 1024 |
| − | 800BC572 1420 | + | 800BC572 8463 |
| − | 800BC574 800E | + | 800BC574 800C |
| − | 800BC576 3C03 | + | 800BC576 3C04 |
| − | 800BC578 1024 | + | 800BC578 C5D8 |
| − | 800BC57A 8463 | + | 800BC57A 2484 |
| − | 800BC57C 2900 | + | 800BC57C 0002 |
| − | 800BC57E 0002 | + | 800BC57E 1060 |
| − | 800BC580 0005 | + | 800BC580 0000 |
| − | 800BC582 1460 | + | 800BC582 0000 |
| − | 800BC584 0000 | + | 800BC584 0048 |
| − | 800BC586 0000 | + | 800BC586 2484 |
| − | 800BC588 800C | + | 800BC588 0000 |
| − | 800BC58A 3C0E | + | 800BC58A 8C85 |
| − | 800BC58C B050 | + | 800BC58C 0004 |
| − | 800BC58E 25CE | + | 800BC58E 8C8E |
| − | 800BC590 0005 | + | 800BC590 000F |
| − | 800BC592 1000 | + | 800BC592 10A0 |
| − | 800BC594 2821 | + | 800BC594 082A |
| − | 800BC596 00AE | + | 800BC596 0045 |
| − | 800BC598 800C | + | 800BC598 FFFB |
| − | 800BC59A 3C0E | + | 800BC59A 1020 |
| − | 800BC59C 9CE0 | + | 800BC59C 0008 |
| − | 800BC59E 25CE | + | 800BC59E 2484 |
| − | 800BC5A0 2821 | + | 800BC5A0 2900 |
| − | 800BC5A2 00AE | + | 800BC5A2 0002 |
| − | 800BC5A4 1580 | + | 800BC5A4 2821 |
| − | 800BC5A6 24A5 | + | 800BC5A6 00AE |
| − | 800BC5A8 0300 | + | 800BC5A8 0002 |
| − | 800BC5AA 3C03 | + | 800BC5AA 1060 |
| 800BC5AC 0000 | 800BC5AC 0000 | ||
| − | 800BC5AE ACA3 | + | 800BC5AE 0000 |
| − | 800BC5B0 7580 | + | 800BC5B0 EA80 |
| − | 800BC5B2 3C03 | + | 800BC5B2 25CE |
| − | 800BC5B4 8080 | + | 800BC5B4 0300 |
| − | 800BC5B6 3463 | + | 800BC5B6 3C03 |
| − | 800BC5B8 0004 | + | 800BC5B8 0000 |
| 800BC5BA ACA3 | 800BC5BA ACA3 | ||
| − | 800BC5BC 6729 | + | 800BC5BC 7580 |
| − | 800BC5BE 0803 | + | 800BC5BE 3C03 |
| − | 800BC5C0 0000 | + | 800BC5C0 8080 |
| − | 800BC5C2 0000 | + | 800BC5C2 3463 |
| − | 800BC5C4 67BD | + | 800BC5C4 0004 |
| − | 800BC5C6 0803 | + | 800BC5C6 ACA3 |
| − | 800BC5C8 0000 | + | 800BC5C8 6729 |
| − | 800BC5CA 0000 | + | 800BC5CA 0803 |
| + | 800BC5CC 0000 | ||
| + | 800BC5CE 0000 | ||
| + | 800BC5D0 67BD | ||
| + | 800BC5D2 0803 | ||
| + | 800BC5D4 0000 | ||
| + | 800BC5D6 0000 | ||
| + | 800BC5D8 0190 | ||
| + | 800BC5DA 0000 | ||
| + | 800BC5DC B0F0 | ||
| + | 800BC5DE 800B | ||
| + | 800BC5E0 01B2 | ||
| + | 800BC5E2 0000 | ||
| + | 800BC5E4 51D0 | ||
| + | 800BC5E6 8004 | ||
| + | 800BC5E8 01C6 | ||
| + | 800BC5EA 0000 | ||
| + | 800BC5EC 4B2C | ||
| + | 800BC5EE 8004 | ||
| + | 800BC5F0 01D7 | ||
| + | 800BC5F2 0000 | ||
| + | 800BC5F4 8E14 | ||
| + | 800BC5F6 8003 | ||
| + | 800BC5F8 01E2 | ||
| + | 800BC5FA 0000 | ||
| + | 800BC5FC 4BEC | ||
| + | 800BC5FE 8003 | ||
| + | 800BC600 01EA | ||
| + | 800BC602 0000 | ||
| + | 800BC604 5EF0 | ||
| + | 800BC606 8003 | ||
| + | 800BC608 01F0 | ||
| + | 800BC60A 0000 | ||
| + | 800BC60C 0138 | ||
| + | 800BC60E 8004 | ||
| + | 800BC610 01F6 | ||
| + | 800BC612 0000 | ||
| + | 800BC614 1FDC | ||
| + | 800BC616 8003 | ||
| + | 800BC618 0000 | ||
| + | 800BC61A 0000 | ||
| + | 800BC61C 0000 | ||
| + | 800BC61E 0000 | ||
| + | 800BC620 0167 | ||
| + | 800BC622 0000 | ||
| + | 800BC624 6C14 | ||
| + | 800BC626 800D | ||
| + | 800BC628 0179 | ||
| + | 800BC62A 0000 | ||
| + | 800BC62C 898C | ||
| + | 800BC62E 800D | ||
| + | 800BC630 017C | ||
| + | 800BC632 0000 | ||
| + | 800BC634 8C60 | ||
| + | 800BC636 800D | ||
| + | 800BC638 01B3 | ||
| + | 800BC63A 0000 | ||
| + | 800BC63C 9F2C | ||
| + | 800BC63E 8003 | ||
| + | 800BC640 01C6 | ||
| + | 800BC642 0000 | ||
| + | 800BC644 BA3C | ||
| + | 800BC646 8001 | ||
| + | 800BC648 01D5 | ||
| + | 800BC64A 0000 | ||
| + | 800BC64C 98DC | ||
| + | 800BC64E 8003 | ||
| + | 800BC650 01E0 | ||
| + | 800BC652 0000 | ||
| + | 800BC654 B670 | ||
| + | 800BC656 8001 | ||
| + | 800BC658 01EA | ||
| + | 800BC65A 0000 | ||
| + | 800BC65C 81EC | ||
| + | 800BC65E 8003 | ||
| + | 800BC660 01F0 | ||
| + | 800BC662 0000 | ||
| + | 800BC664 190C | ||
| + | 800BC666 8004 | ||
| + | 800BC668 0000 | ||
| + | 800BC66A 0000 | ||
| + | 800BC66E 0000 | ||
| 800D9C98 F14E | 800D9C98 F14E | ||
| 800D9C9A 0802 | 800D9C9A 0802 | ||
| Line 273: | Line 356: | ||
| [^run2]: psx.wiki bench, SCPH-5501, 1 November 2026, 17:57, room MDS5_2: photograph of the four debugger windows on screen. | [^run2]: psx.wiki bench, SCPH-5501, 1 November 2026, 17:57, room MDS5_2: photograph of the four debugger windows on screen. | ||
| [^sx]: StationX emulator run, 1 November 2026: the list through the bench cart's cheat engine, with screen captures and memory dumps. | [^sx]: StationX emulator run, 1 November 2026: the list through the bench cart's cheat engine, with screen captures and memory dumps. | ||
| − | [^w1]: StationX emulator run, 1 November 2026, 19:50: lists 1A and 1B through a program that applies codes as the bench cart's cheat engine does, with screen captures. | + | [^run3]: psx.wiki bench, SCPH-5501, 2 November 2026, 09:50, room MDS5_2: lists 1A and 1B through the cheat engine of the StationX cartridge, build 7a20b1f-dirty-6AE89E7A, with photographs of the screen. |