<- 12
^^
vv
List results:
Search options:
Use \ before commas in usernames
Ah, alright.
Here are the function addresses and lengths:
The ones with three exclamation marks are the ones that do culling.
Code:
Multi-Game Demo Disc Version 7 (USA):
crashed

Prime 1 Beta:
802a2cc0 00000060 802a2cc0 0 !!!CFrustumPlanes::PointInFrustumPlanes() 
802a2d20 0000006c 802a2d20 0 !!!CFrustumPlanes::SphereInFrustumPlanes()
802a2d8c 00000048 802a2d8c 0 !!!CFrustumPlanes::BoxInFrustumPlanes(overload)
802a2dd4 00000084 802a2dd4 0 !!!CFrustumPlanes::BoxInFrustumPlanes(Box)
802a2e58 00000404 802a2e58 0 !CFrustumPlanes::CFrustumPlanesBeta(Transform)

Prime 1 NTSC:
80344fcc 00000060 80344fcc 0 !!!CFrustumPlanes::PointInFrustumPlanes() 
8034502c 0000006c 8034502c 0 !!!CFrustumPlanes::SphereInFrustumPlanes()
80345098 000000f0 80345098 0 !CFrustumPlanes::Unknown()
80345188 00000048 80345188 0 !!!CFrustumPlanes::BoxInFrustumPlanes(overload)
803451d0 00000084 803451d0 0 !!!CFrustumPlanes::BoxInFrustumPlanes(Box)
80345254 0000045c 80345254 0 !CFrustumPlanes::CFrustumPlanes(Transform)

Prime 1 PAL:
8032d7a0 00000060 8032d7a0 0 !!!CFrustumPlanes::PointInFrustumPlanes() 
8032d800 0000006c 8032d800 0 !!!CFrustumPlanes::SphereInFrustumPlanes()
8032d86c 000000f0 8032d86c 0 !CFrustumPlanes::Unknown()
8032d95c 00000048 8032d95c 0 !!!CFrustumPlanes::BoxInFrustumPlanes(overload)
8032d9a4 00000084 8032d9a4 0 !!!CFrustumPlanes::BoxInFrustumPlanes(Box)
8032da28 0000045c 8032da28 0 !CFrustumPlanes::CFrustumPlanes(Transform)

Prime 2 NTSC:
80302298 00000060 80302298 0 !!!CFrustumPlanes::PointInFrustumPlanes2
803022f8 0000006c 803022f8 0 !!!CFrustumPlanes::SphereInFrustumPlanes
80302364 000000ec 80302364 0 !CFrustumPlanes::Unknown2
80302450 00000048 80302450 0 !!!CFrustumPlanes::BoxInFrustumPlanes
80302498 00000080 80302498 0 !!!CFrustumPlanes::BoxInFrustumPlanes2
80302518 00000428 80302518 0 !CFrustumPlanes::CFrustumPlanes2

Prime 2 PAL:
8030270c 00000060 8030270c 0 !!!CFrustumPlanes::PointInFrustumPlanes2()
8030276c 0000006c 8030276c 0 !!!CFrustumPlanes::SphereInFrustumPlanes()
803027d8 000000ec 803027d8 0 !CFrustumPlanes::Unknown2()
803028c4 00000048 803028c4 0 !!!CFrustumPlanes::BoxInFrustumPlanes(overload)
8030290c 00000080 8030290c 0 !!!CFrustumPlanes::BoxInFrustumPlanes2(Box)
8030298c 00000428 8030298c 0 !CFrustumPlanes::CFrustumPlanes2(Transform)

Prime 3 PAL:
Can't find the functions yet

Prime 1 New Play Control Japan:
Can't find the functions yet

Prime Trilogy PAL:
Can't find the functions yet

Metroid Other M:
Can't find the functions yet

Donkey Kong Country Returns:
Can't find the functions yet

Sorry I didn't have any luck with the Wii versions yet. I guess there's a change in how they do culling.
Did you check all four of Trilogy's dols? It has one for the front end and then another three for Prime 1/2/3. Also, Other M isn't developed by Retro and has very little in common with the Prime games. Not surprised you can't find that one.
I only bothered to check two of them. I figured if I didn't find anything in the new play control or Prime 3 or one of the games in trilogy then I wasn't going to find anything in the other 2 games in Trilogy.
Edit history:
aminemo: 2014-12-15 05:11:46 pm
aminemo: 2014-12-15 05:10:50 pm
Inside the dol of the metroid prime 3 beta demo there is something like a map aera
a can read distincly the name of a lot of functions

https://code.google.com/p/dolphin-emu/source/detail?r=b62cac2ca93006c3deae1b4406588ec218d1d0ba
http://www.theisozone.com/downloads/gamecube/gamecube-isos/metroid-prime-3-beta-e3/
those are just strings printed out by the debugger, it's nothing like a map file. It's not really helpful.
Edit history:
aminemo: 2014-12-15 09:05:34 pm
aminemo: 2014-12-15 09:05:34 pm
aminemo: 2014-12-15 09:05:34 pm
aminemo: 2014-12-15 09:05:34 pm
aminemo: 2014-12-15 09:05:34 pm
aminemo: 2014-12-15 08:45:53 pm
aminemo: 2014-12-15 08:41:02 pm
aminemo: 2014-12-15 08:37:13 pm
aminemo: 2014-12-15 08:37:12 pm
aminemo: 2014-12-15 08:37:12 pm
If I download the GC dev kit do you think that it can be somewhat useful in the job?
I wander if those beta demo cannot be reverse engeniered using a dev kit?
Sorry for my naive question I am not expert at all.....
Edit history:
Antidote: 2014-12-16 02:52:15 pm
The GC devkit is darn near useless for stuff like that, It's only helped us confirm a tiny fraction of what we were already pretty much 100% certain on (GX display lists come to mind)
has anyone tried automating the process of mapping the demo disc symbol table to the 0-00 one automatically, using software? that seems like it might be a worthwhile project.

I'd look at it myself but unfortunately I'm a moderator on this forum which means there are certain things I can't really do (i.e. pirating the mp1 demo).
Edit history:
aminemo: 2014-12-16 11:19:21 pm
aminemo: 2014-12-16 11:18:36 pm
aminemo: 2014-12-16 11:13:32 pm
aminemo: 2014-12-16 11:11:14 pm
Thanks to your help the culling is removed now from all the metroid GC games and the mp1 and 3 demo
We still need help for the new play controls mp1 mp2 MP3 and trilogy
Anyone had find something useful on mp1 new play control or from mp1 from  the trilogy?
Why it is so hard to deals with this wii versions of the games?
Can we managed something from the mp  3 demo to mp Corruption Wii?
Or from the mp1 game cube to mp1 Wii ?
I mean are the GC and Wii versions very different ...they don't use same functions ?
I ask this because the Wii basically seem to be a GC with much memory.
Quote from DJGrenola:
has anyone tried automating the process of mapping the demo disc symbol table to the 0-00 one automatically, using software? that seems like it might be a worthwhile project.

I'd look at it myself but unfortunately I'm a moderator on this forum which means there are certain things I can't really do (i.e. pirating the mp1 demo).


It would be a fun, though arduous, task. One that would be helped using megazigs tools. He has a utility that makes images that help search for functions in a dol, it uses a hash algorithm to make them. And I think he wrote an ida plugin for it. It's available on github https://github.com/Megazig/WiiTools
Edit history:
Aruki: 2014-12-17 07:13:32 am
2EyeGuy mentioned on the Oculus forum that Dolphin has a feature to recognize functions by code, even if they're located at different addresses between different games/versions. I dunno how you'd do that with this since we don't have a valid map file for the demo to give to Dolphin and I don't know if there's a way to export one of the correct format from ida, though.
Edit history:
DJGrenola: 2014-12-17 03:19:27 pm
DJGrenola: 2014-12-17 03:18:44 pm
the reason I mention it is that it's currently difficult to do much meaningful work on the retail DOLs because of the lack of a symbol table. it would be nice to get to a point where you don't have to go downloading the demo in order to play with the DOL, because ripping your own retail copy (while still somewhat grey from a legal standpoint) is clearly in some sense more legal than downloading the kiosk demo would be.

now, I may have missed something crucial, but this was the approach I was thinking of:

- take RAM dumps from dolphin while running a copy of firstly the demo, and then 0-00;
- parse the MAP file from the demo, and use it to look up (in the demo RAM dump) the actual machine code bytes making up each listed function;
- search for that machine code sequence in the 0-00 RAM dump image and store the address(es) at which it is found along with the original function name from the demo MAP;
- repeat for all functions listed in the MAP.

this could be improved in a lot of ways, from the perspectives of both speed and accuracy. you would probably need some heuristics because some of the code would change between versions (different locations of variables, called functions etc). results would not be perfect but you might get most of the function addresses this way. it might also provide some interesting insight into which functions were removed or modified between demo and retail.
Edit history:
aminemo: 2014-12-17 03:22:29 pm
aminemo: 2014-12-17 03:21:23 pm
aminemo: 2014-12-17 03:20:53 pm
Ok but is it possible to that with the wii version "mp corution, new paly control, ect...." beacause the dev kit is different not sure they use the same set of functions as the demo.
Also keep in mind that since the demo is a debug build there may be some extra instructions, as it's unoptimized.
Edit history:
Aruki: 2014-12-31 07:19:30 pm
Aruki: 2014-12-31 07:08:27 pm
Quote from DJGrenola:
the reason I mention it is that it's currently difficult to do much meaningful work on the retail DOLs because of the lack of a symbol table. it would be nice to get to a point where you don't have to go downloading the demo in order to play with the DOL, because ripping your own retail copy (while still somewhat grey from a legal standpoint) is clearly in some sense more legal than downloading the kiosk demo would be.


Maybe it's just me, but I don't really see the issue with pirating a 10+-year-old demo (not even a full game) that was never sold to the public. Copyright infringement is only problematic legally when the copyright holder cares about it. Nintendo never made any money off of the demo, and they aren't losing potential sales of the full game over it - in fact, the demo is supposed to be played for free to sell more copies of the final - so I seriously doubt they do care. In this case, it's not really reasonable to expect that you could get your own legitimate disc copy of the demo, because it was never sold to the public, so there probably aren't very many discs floating around. The demo also contains a lot of useful/interesting information so I don't really think it's reasonable to say we shouldn't look at it without actually tracking down a disc.

Also occasionally a single prototype version of a game leaks out somewhere (like the Prime 3 WIP E3 demo); someone in the community buys the copy, dumps it out, and everyone gets a chance to take a look at what's inside it. If piracy was always 100% bad then nobody would be allowed to look at it aside from the one guy who actually bought the copy, even though there's no other known copies and no legal way to obtain one. If you think that's the way things should be, then I completely disagree. I totally get having a problem with pirating full retail games, but when it comes to things like this I think reasonable exceptions can be made.

Just my two cents.
Prime 2 NTSC:
80302298 00000060 80302298 0 !!!CFrustumPlanes::PointInFrustumPlanes2
803022f8 0000006c 803022f8 0 !!!CFrustumPlanes::SphereInFrustumPlanes
80302364 000000ec 80302364 0 !CFrustumPlanes::Unknown2
80302450 00000048 80302450 0 !!!CFrustumPlanes::BoxInFrustumPlanes
80302498 00000080 80302498 0 !!!CFrustumPlanes::BoxInFrustumPlanes2
80302518 00000428 80302518 0 !CFrustumPlanes::CFrustumPlanes2

Sorry to gravedig, but is there anyway to set these so it stops the frustum culling in Mp2 like the AR code for Metroid Prime 1?
Yeah, the AR code for each should be posted.

Here are the locations in the Echoes Bonus Disk (the extraced GCM):
802b7d4c 00000060 802b7d4c 0 !!!CFrustumPlanes::PointInFrustumPlanes2
802b7dac 0000006c 802b7dac 0 !!!CFrustumPlanes::SphereInFrustumPlanes
802b7e18 000000ec 802b7e18 0 !CFrustumPlanes::Unknown2
802b7f04 00000048 802b7f04 0 !!!CFrustumPlanes::BoxInFrustumPlanes
802b7f4c 00000080 802b7f4c 0 !!!CFrustumPlanes::BoxInFrustumPlanes2
802b7fcc 00000428 802b7fcc 0 !CFrustumPlanes::CFrustumPlanes2

BTW, this work might help us understand what is going on (graphically) with the lightshow bug.  What does it look like under Oculus?  With a fixed scene (i.e. no controller input) the camera can be moved to more positions than each eye.  Research idea: take a modified Dolphin (starting from the Oculus modifications) and move the camera around to see what the lightshow bug is doing.

Quote from DJGrenola:
has anyone tried automating the process of mapping the demo disc symbol table to the 0-00 one automatically, using software? that seems like it might be a worthwhile project.

I'd look at it myself but unfortunately I'm a moderator on this forum which means there are certain things I can't really do (i.e. pirating the mp1 demo).

I own all the US IMGDD's (7, 8, and 9) and you are free to borrow any of them (as they are all the same) for research purposes if you'd like.  One nice thing about the Prime games is that the file factories are in the same order (and their addresses are given in some early code) and one can expect that all reoccuring functions show up in the same order.  (In particular, linear interpolation of addresses gives a good start for where to look if you already know where a function is in one dol.)  Some functions added/removed or their sizes changed, as you might expect.  So automated mapping, with a little bit of hand tweeking, should be quite straightforward.
Quote from SkippyJr:
BTW, this work might help us understand what is going on (graphically) with the lightshow bug.  What does it look like under Oculus?  With a fixed scene (i.e. no controller input) the camera can be moved to more positions than each eye.  Research idea: take a modified Dolphin (starting from the Oculus modifications) and move the camera around to see what the lightshow bug is doing.

Light show isn't emulated in Dolphin; it just gives a black screen instead.
Quote from SkippyJr:
Yeah, the AR code for each should be posted.

Here are the locations in the Echoes Bonus Disk (the extraced GCM):
802b7d4c 00000060 802b7d4c 0 !!!CFrustumPlanes::PointInFrustumPlanes2
802b7dac 0000006c 802b7dac 0 !!!CFrustumPlanes::SphereInFrustumPlanes
802b7e18 000000ec 802b7e18 0 !CFrustumPlanes::Unknown2
802b7f04 00000048 802b7f04 0 !!!CFrustumPlanes::BoxInFrustumPlanes
802b7f4c 00000080 802b7f4c 0 !!!CFrustumPlanes::BoxInFrustumPlanes2
802b7fcc 00000428 802b7fcc 0 !CFrustumPlanes::CFrustumPlanes2

BTW, this work might help us understand what is going on (graphically) with the lightshow bug.  What does it look like under Oculus?  With a fixed scene (i.e. no controller input) the camera can be moved to more positions than each eye.  Research idea: take a modified Dolphin (starting from the Oculus modifications) and move the camera around to see what the lightshow bug is doing.

Quote from DJGrenola:
has anyone tried automating the process of mapping the demo disc symbol table to the 0-00 one automatically, using software? that seems like it might be a worthwhile project.

I'd look at it myself but unfortunately I'm a moderator on this forum which means there are certain things I can't really do (i.e. pirating the mp1 demo).

I own all the US IMGDD's (7, 8, and 9) and you are free to borrow any of them (as they are all the same) for research purposes if you'd like.  One nice thing about the Prime games is that the file factories are in the same order (and their addresses are given in some early code) and one can expect that all reoccuring functions show up in the same order.  (In particular, linear interpolation of addresses gives a good start for where to look if you already know where a function is in one dol.)  Some functions added/removed or their sizes changed, as you might expect.  So automated mapping, with a little bit of hand tweeking, should be quite straightforward.


Wait what? I'm sorry but I only saw the one for Metroid Prime 1. Am I dumb?
Also question: how would lightshow look differently without embedded frame buffer being set to RAM? I understand that it drastically affects how things work in Mp2 so I would be interested to see
Edit history:
SkippyJr: 2015-04-06 11:42:38 pm
Quote from Baby Sheegoth:
Wait what? I'm sorry but I only saw the one for Metroid Prime 1. Am I dumb?
Sorry about the wording.  I was agreeing with you!

Thankfully this Action Replay code is a simple one and can be easily modified for all.  It uses the 0XXXXXXX YYYYYYYY form which patches in the instruction YYYYYYYY into memory location XXXXXXX + 0x7c000000.  The two instructions are "li r3, 1" and "blr" at the start of the function BoxInFrustumPlanes(Box) / BoxInFrustumPlanes2, making it immediately return the value 1.

Prime:
Code:
Demo:
042A2DD4 38600001
042A2DD8 4E800020

NTSC 0-00 and 0-02:
043451D0 38600001
043451D4 4E800020

PAL:
0432D9A4 38600001
0432D9A8 4E800020

Echoes:
Code:
Bonus disc:
042B7f4C 38600001
042B7f50 4E800020

NTSC:
043451D0 38600001
043451D4 4E800020

PAL:
0430290C 38600001
0430290C 4E800020


But they apparently have done a whole lot more.

Metroid Prime:
$Disable Culling of Terrain Outside Camera View
043451D0 38600001
043451D4 4E800020
$Disable Culling of Special Functions Outside Camera View
04344FCC 38600001
04344FD0 4E800020
$Disable Culling of Wallcrawler Swarms Outside Camera View
0434502C 38600001
04345030 4E800020
$Disable Culling of Particles Outside Camera View
04345188 38600001
0434518C 4E800020
$Disable Culling of Unknown Outside Camera View
04345098 38600001
0434509C 4E800020

Metroid Prime 2:
$Disable Culling of Terrain Outside Camera View
04302498 38600001
0430249C 4E800020
$Disable Culling of Special Functions Outside Camera View
04302298 38600001
0430229C 4E800020
$Disable Culling of Wallcrawler Swarms Outside Camera View
043022f8 38600001
043022fC 4E800020
$Disable Culling of Particles Outside Camera View
04302450 38600001
04302454 4E800020
$Disable Culling of Unknown Outside Camera View
04302364 38600001
04302368 4E800020