GBA Character Pathing

[Vykan_12]

I'm working on a VBA lua script where given a character's currently traced path, it computes how many RNs are burned from moving the cursor in any direction (up, down, left, right), with the idea of expanding this lookup to several moves in order to deterministically find the shortest number of moves required to burn a certain amount of RNs.

The problem is I'm missing some memory address information that could be of help, and haven't been able to determine it myself through RAM search or reading the docs in the OP. Here's what I need in a nutshell:

- Need to know the character's current movement path (ex/ 1 up, 1 right, 1 right). This is critical.

- When a character is selected (IE cursor is placed on them and press A), need to know the character's class and movement range

- Probably need to know the type of every tile in the unit's movement radius

In terms of the character's movement path, I figure a character has up to 15 movement with boots. Since there's up to 4 possible moves per space, that means 4^15 (or 2^30) combinations. Only a 4 byte value can fit this (since 2^32 > 2^30).

My naive approach to this 4 byte value would be something like 1000 | 0100 | 0100 | 0000 | ... where each pair of 4 represents up, right, down, left as booleans per move.

So for example 2U1R would be 1000 1000 0100 then a bunch of 0s, which would be 2180 in decimal when disregarding the trailing zeros, or 2,285,895,680 if accounting for zeros.

The problem is I'm not finding any addresses that adhere to this type of behavior, which makes me think I'm making a wrong assumption. Of course none of this matters if such an address (or addresses) has been found already.

Any help with this would be immensely appreciated. The script I'm developing would be a massive breakthrough for GBA FE speedrunning and TASing.

[Tequila]

This isn't the right place (since what you're asking isn't related to EA), but your assumption is incorrect. There's a movement struct beginning at (FE8) 203A990, as follows according to my notes:

+29: cursor coordinate x (only when character is selected)
+2A: cursor coordinate y
+2B: total movement
+2C: how long the pathing arrow is at the moment(actually, how many squares you're moving)
+2D: 203A9BD: x coords of squares being passed through (beginning with the square you're currently on)
+41: 203A9D1: y coords of squares being passed through (beginning with the square you're currently on)
+55: 203A9E5: seems to be a counter of how movement cost can be used. The byte before this has maximum movement

So if you begin at (0,0), 203A9BD will be 0 and 203A9D1 will be 0. If you move 1 square to the right, then 203A9BE will be 1 and 203A9D2 will 0. And so on. The way the data is organized is the reason that the pathing arrow breaks after around 18-19 squares; the last square's x coordinate overwrites the first square's y coordinate.

I don't know offhand where the FE7 one is, if that's what you're interested in, but it should be nearby and follow more or less the same pattern. Hope this helps!

[Vykan_12]

Awesome, thank you very much!

Would you also happen to know how to distinguish FE6, 7 & 8 through a lua script? I'm thinking there must be a way of comparing their checksums or some other ROM header information. With this I'd be able to use the same script for all 3 games.

Edited January 8, 2017 by Vykan_12

[Espinosa]

I dunno if this is the thread to ask, but does anybody know why VBA-rerecording crashes on my new desktop PC whenever I try to record AVI? I haven't been able to record anything on my new PC, though regular versions of VBA work. It's the reason why I don't attempt anything in the GBA games nowadays.

[Eliwan]

Awesome, thank you very much!

Would you also happen to know how to distinguish FE6, 7 & 8 through a lua script? I'm thinking there must be a way of comparing their checksums or some other ROM header information. With this I'd be able to use the same script for all 3 games.

Can't you just check some particular bytes in the ROM against a predefined set of bytes?

If you could; at A0 through B2, the following string exists:

JP FE6; "FIREEMBLEM6.AFEJ01–" == "46 49 52 45 45 4D 42 4C 45 4D 36 00 41 46 45 4A 30 31 96"

US FE7; "FIREEMBLEME.AE7E01–" == "46 49 52 45 45 4D 42 4C 45 4D 45 00 41 45 37 45 30 31 96"

US FE8; "FIREEMBLEM2EBE8E01–" == "46 49 52 45 45 4D 42 4C 45 4D 32 45 42 45 38 45 30 31 96"

Is... that not a suitable way to check which ROM you're working on?

(what are the limitations of a lua script in this instance then)

Edited January 8, 2017 by Bedimal Eliwan

[Vykan_12]

Can't you just check some particular bytes in the ROM against a predefined set of bytes?

If you could; at A0 through B2, the following string exists:

JP FE6; "FIREEMBLEM6.AFEJ01–" == "46 49 52 45 45 4D 42 4C 45 4D 36 00 41 46 45 4A 30 31 96"

US FE7; "FIREEMBLEME.AE7E01–" == "46 49 52 45 45 4D 42 4C 45 4D 45 00 41 45 37 45 30 31 96"

US FE8; "FIREEMBLEM2EBE8E01–" == "46 49 52 45 45 4D 42 4C 45 4D 32 45 42 45 38 45 30 31 96"

Is... that not a suitable way to check which ROM you're working on?

(what are the limitations of a lua script in this instance then)

I can't find the info you listed through RAM search, where exactly is A0 through B2?

I found this through googling http://z15.invisionfree.com/TalesRPG/ar/t5.htm that lists it at CF0D82 and CFA290 but again, no idea where that is via RAM search.

The address ranges I can find are the following:

00000000-00003FFF

02000000-0203FFFF

03000000-03007FFF

04000000-040003FF

05000000-050003FF

06000000-0601FFFF

07000000-070003FF

0E000000-0E00FFFF

When I search for 46 as a one byte hex value, I can't find a value next to it with value 49 for example.

I dunno if this is the thread to ask, but does anybody know why VBA-rerecording crashes on my new desktop PC whenever I try to record AVI? I haven't been able to record anything on my new PC, though regular versions of VBA work. It's the reason why I don't attempt anything in the GBA games nowadays.

I've never had issues with this. Which version are you using? There's a list of versions on TASVideos here: http://tasvideos.org/EmulatorResources/VBA.html

The one that speedrunners agreed to use is vba-v24m-svn-r440a

[Tequila]

A0-B2 in the rom, not in ram.

[Zane Avernathy]

The string Wan's talking about is in the ROM's header.

When viewing an address in an emulator, you'll probably see the address with the hardware offset added, so it'd be 0x080000A0.

You might take interest in this: http://problemkaputt.de/gbatek.htm#gbamemorymap

[Espinosa]

I've never had issues with this. Which version are you using? There's a list of versions on TASVideos here: http://tasvideos.org/EmulatorResources/VBA.html

The one that speedrunners agreed to use is vba-v24m-svn-r440a

I'm using the same version that recorded fine before buying a new PC. I'd tried several other versions at the same time I'd tried figuring out what the problem was. There was a thread on the forums about it a year ago, and I didn't get anything close to a solution then either.

I just tried the version you pointed towards, and the result is the same - crashes when I try to record AVI.

Google brings up absolutely nothing, and I have no idea whom I'd need to contact who would have any idea about this (the modding community? no clue).

[Vykan_12]

The string Wan's talking about is in the ROM's header.

When viewing an address in an emulator, you'll probably see the address with the hardware offset added, so it'd be 0x080000A0.

You might take interest in this: http://problemkaputt.de/gbatek.htm#gbamemorymap

Checked 0x080000A0 in memory viewer and found exactly what I needed. Fortunately, lua's memory.readbyte(0x080000A0) works as intended with ROM values. You guys are awesome!

Would you happen to know where I could find raw dissassembly data for FE6-8? There are a couple other memory addresses (such as one that acts as a boolean for when a character's selected or not, found 0x202BEE8 but not sure) that I'd like to find, and don't want to be posting a new question here each time.

[eclipse]

Alright, this is now its own topic. TC, feel free to change the title if I got the subject wrong.

[CT075]

if you're looking for static disassembly, i'm not actually sure we have any - zahlman attempted a few years ago but I'm not sure if he got anywhere.

if disassembly+debugging is fine with you, you can try VBA's diassembly viewer or no$debugger if you need something more powerful

[Tequila]

Checked 0x080000A0 in memory viewer and found exactly what I needed. Fortunately, lua's memory.readbyte(0x080000A0) works as intended with ROM values. You guys are awesome!

Would you happen to know where I could find raw dissassembly data for FE6-8? There are a couple other memory addresses (such as one that acts as a boolean for when a character's selected or not, found 0x202BEE8 but not sure) that I'd like to find, and don't want to be posting a new question here each time.

202BEE8 isn't a bool; it's the turn status word for the third deployment slot, of which the first bit is, coincidentally, whether the unit is selected, according to this. Just remove the first number of the address and go to it in your memory viewer.

This, while slightly inaccurate, gives you a more in-depth explanation than the codebreaker code page; the first 0x48 bytes of the battle struct are essentially identical to the character data described in the codebreaker page.

I'm not entirely sure what you mean by static disassembly, however.