xboxscene.org forums

Author Topic: Soul Caliber 2 Hacking  (Read 89 times)

TheOneNoOne

  • Archived User
  • Newbie
  • *
  • Posts: 18
Soul Caliber 2 Hacking
« on: August 27, 2003, 02:47:00 PM »

That is my goal.  I have no clue where to start, but check http://www.ninjahack...p?showtopic=403.

That's a topic about SCII hacking and a user seems to have deciphered some of the files.

I don't have the game yet either, but soon!
Logged

plight

  • Archived User
  • Newbie
  • *
  • Posts: 5
Soul Caliber 2 Hacking
« Reply #1 on: August 27, 2003, 04:12:00 PM »

Ok just got a copy from Blockbuster, maybe ill return it maybe i wont... hehe.

Anywhoo im going to give it a shot.  Ive only very little knowledge about this stuff so im just gonna fuck around with it.  Ive learned a shitload about hex from all the hex tuts ive read, not all necessarily related to halo.  Very scientific eh?  laugh.gif
Logged

pkScary

  • Archived User
  • Newbie
  • *
  • Posts: 18
Soul Caliber 2 Hacking
« Reply #2 on: August 27, 2003, 09:30:00 PM »

I encourage Soul Calibur 2 hackers to check out the thread TheOneNoOne pointed out,  http://www.ninjahack...p?showtopic=403 .  I have been updating it for hours and it has a lot of info, so you might wanna take a look before you try something already accomplished.
Logged

pkScary

  • Archived User
  • Newbie
  • *
  • Posts: 18
Soul Caliber 2 Hacking
« Reply #3 on: August 28, 2003, 10:00:00 AM »

Anyone that's interested in hacking Soul Calibur 2 please come to irc.freenode.net (same server #halo is on) and join #soulcalibur2  (yes, with a *U*, that is the correct spelling)
Logged

Liquid Oxygen

  • Archived User
  • Full Member
  • *
  • Posts: 187
Soul Caliber 2 Hacking
« Reply #4 on: August 28, 2003, 11:11:00 AM »

Whats the server name?
Logged

Liquid Oxygen

  • Archived User
  • Full Member
  • *
  • Posts: 187
Soul Caliber 2 Hacking
« Reply #5 on: August 28, 2003, 11:18:00 AM »

Cool thx.  Maybe ill stop by in the near future.
Logged

pkScary

  • Archived User
  • Newbie
  • *
  • Posts: 18
Soul Caliber 2 Hacking
« Reply #6 on: August 28, 2003, 11:34:00 AM »

CODE
Soul Calibur 2 NTSC Examination for the Xbox   
by pkScary, AbstractMonkey, pkAbstract
cyberhoby, pk_mode, AbstractSL, scary_pk, AbstraktZero
and last but not least - pks.               (Note - I will see a psychologist for
identity crisis after writing this)

1)   Name string examples -

#1#P#0   Note - I strongly beleive P is the "Player 1" variable
#1HOBB#0
#1LANBARDY#0
#1VERAL#0
(note - HOBB is an Assassin that one encounters in Weapon Master Mode)
tentative possible explanation -

# indicates the start and end of a string
1 indicates the beginning of color
0 indicates the end of color

Further speculation reveals the possibility that 0 is the default text color, and 1 is
the modified text color.  

2)   Presence of at what appears to be the end of a Weapon
Master mode passage.  It is followed by *two*  periods

3)   File Size Comparison of Versions
                             PS2                       Xbox
root.olk              688,748 KB              677,572 KB
movie.afs          168,432 KB           428,842 KB  (Due to higher res. req.?)
bgm.afs          233,832 KB               234,032 KB

4)   Extra Files

The NTSC version of Soul Calibur 2 for Xbox (henceforth known as SC2X)
contains one more file than the PAL version, "Default.unpatched".  Whether this
was added by a release crew or Namco it is TBD.  Could this be meant for
future patches including skins or possibly even levels?!

5)   Soul Calibur 2 for Playstation 2/Xbox Comparison

Soul Calibur 2 for PS2 (henceforth known as SC2P) has 14 *more* files than
the Xbox version (and 15 distinct ones) -

  root
1) FLISTD.TXT         1 KB
2) SLUS_206.43      3,807 KB   (Seems to be SC2Ps "Default.xbe" equivalent)
------------------------The following is considered DVD filler---------------------

3) PAD_0.DAT         1,048,576 KB
4) PAD_1.DAT         1,048,576 KB
5) PAD_2.DAT         1,048,576 KB
----------------------------------------Filler End------------------------------------------
  IRX
6) CRI_ADXI.IRX          109  KB    (ADX File Driver?)
7) IOPRP250.IMG         259  KB    (File Management/Reset Sequence?)
8) LIBSD.IRX                28  KB      (Sound Device Library?)
9) MCMAN.IRX              89  KB      (Data/Memory card management?)
10) MCSERV.IRX          8  KB        (Specified Data Management Variant?)
11) MTAPMAN.IRX        11  KB      (Multitap manager?)
12) NUSOUND.IRX      71  KB       (Manages sound volume/various nuances?)
13) PADMAN.IRX          44  KB      (Control pad manager?)
14) SDRDRV.IRX          8  KB        
15) SIO2MAN.IRX         7  KB        

It also contains the shortcut "SYSTEM", at 1 KB.  Its origin is unknown.

It is thought that these act like "Default.xbe"

6)   It was a longshot

When attempting to replace the "root.olk" from SC2X with that of SC2Ps, a
message comes up that states "SOUL CALIBUR 2 game data loaded.", which
shortly after dissapears, and then the screen turns black.

7)   Exclusive Characters

Strings containing the words "Link", "Spawn", and "Heihachi" can be found in
both SC2X and SC2P's respective "root.olk".  However, the fact that the SC2X
and SC2P versions of "root.olk" differ in size doesn't support the theory of one
global "root.olk". Nevertheless, the file size difference could be attributed

8)   Getting the root.olk from SC2P working with SC2X

A hypothetical but probable solution could be first of all, deleting SC2X save
game information from the Xbox's hard drive.  Then one would have to go about
disabling a CRC checksum in the "Default.xbe", because the PS2 version is
bigger (as stated earlier in Section 3).

9)   BGM.AFS SC2P and SC2X Comparison

SC2P BGM.AFS OFFSETS/FILE NAME DUMP (courtesy of MiteeXPR) -
Number of Files              76

Offset(Hex)   Size(Hex)     FileName

80000         55F656        gbgm001.adx
5DF800        13D800        gbgm002.adx
71D000        7CE000        gbgm003.adx
EEB000        2C09A         gbgm006_2.adx
F17800        392FA         gbgm006_3.adx
F51000        2CD66         gbgm006_4.adx
F7E000        3ADB2         gbgm006_9.adx
FB9000        47EF2         gbgm009.adx
1001000       3EB26         gbgm00a.adx
1040000       1C15F2        gbgm011.adx
1201800       1CB012        gbgm012.adx
13CD000       1B5F22        gbgm013.adx
1583000       1A81A6        gbgm014.adx
172B800       991B5A        gbgm015.adx
20BD800       1773EA        gbgm016.adx
2235000       ED2FA         gbgm017.adx
2322800       274000        gbgm018.adx
2596800       28C800        gbgm019.adx
2823000       35EDCA        gbgm021.adx
2B82000       3294F6        gbgm022.adx
2EAB800       6F2000        gbgm023.adx
359D800       40C000        gbgm024.adx
39A9800       6476A         gbgm041.adx
3A0E000       27AFE         gbgm042.adx
3A36000       4D016         gbgm043.adx
3A83800       38F2E         gbgm044.adx
3ABC800       3538E         gbgm045.adx
3AF2000       62F000        sbgm001.adx
4121000       5A6800        sbgm002.adx
46C7800       49A000        sbgm003.adx
4B61800       4BA000        sbgm004.adx
501B800       5D2800        sbgm005.adx
55EE000       4D8800        sbgm006.adx
5AC6800       5DA000        sbgm007.adx
60A0800       3FA800        sbgm008.adx
649B000       5EB800        sbgm009.adx
6A86800       777000        sbgm00a.adx
71FD800       4D0800        sbgm00b.adx
76CE000       C9F36         sbgm00b_1.adx
7798000       405000        sbgm00b_2.adx
7B9D000       40E000        sbgm00b_3.adx
7FAB000       571000        sbgm00c.adx
851C000       563800        sbgm00d.adx
8A7F800       5A3000        sbgm00e.adx
9022800       14E000        sbgm00f_1.adx
9170800       288800        sbgm00f_2.adx
93F9000       25F800        sbgm00f_3.adx
9658800       258800        sbgm00f_4.adx
98B1000       23F000        sbgm00f_5.adx
9AF0000       267000        sbgm00f_6.adx
9D57000       1A3800        sbgm010_1.adx
9EFA800       267800        sbgm010_2.adx
A162000       229800        sbgm010_3.adx
A38B800       1F7800        sbgm010_4.adx
A583000       199800        sbgm010_5.adx
A71C800       48F800        sbgm011.adx
ABAC000       40D000        sbgm013.adx
AFB9000       45E000        sbgm014.adx
B417000       1A616         gbgm007_p.adx
B431800       2B0800        gbgm031.adx
B6E2000       7CE000        gbgm032.adx
BEB0000       41F52         gbgm046.adx
BEF2000       4F2AE         gbgm047.adx
BF41800       42102         gbgm048.adx
BF84000       4F482         gbgm049.adx
BFD3800       34DA6         gbgm04b.adx
C008800       768F6         gbgm04c.adx
C07F800       9B0FA         gbgm04d_1.adx
C11B000       8729A         gbgm04d_2.adx
C1A2800       A8BEE         gbgm04e.adx
C24B800       10C6866       gbgm004.adx
D312800       13CBA2        gbgm033.adx
D44F800       D2AFE         gbgm034.adx
D522800       50C46         gbgm00b.adx
D573800       AC2800        gbgm025.adx
E036000       423000        gbgm026.adx

SC2X BGM.AFS OFFSETS/FILE NAME DUMP (courtesy of MiteeXPR) -
Number of Files              76

Offset(Hex)   Size(Hex)     FileName

80000         55F656        gbgm001.adx
5DF800        13D800        gbgm002.adx
71D000        7CE000        gbgm003.adx
EEB000        2C09A         gbgm006_2.adx
F17800        392FA         gbgm006_3.adx
F51000        2CD66         gbgm006_4.adx
F7E000        3ADB2         gbgm006_9.adx
FB9000        47EF2         gbgm009.adx
1001000       3EB26         gbgm00a.adx
1040000       1C15F2        gbgm011.adx
1201800       1CB012        gbgm012.adx
13CD000       1B5F22        gbgm013.adx
1583000       1A81A6        gbgm014.adx
172B800       991B5A        gbgm015.adx
20BD800       1773EA        gbgm016.adx
2235000       ED2FA         gbgm017.adx
2322800       274000        gbgm018.adx
2596800       28C800        gbgm019.adx
2823000       35EDCA        gbgm021.adx
2B82000       3294F6        gbgm022.adx
2EAB800       6F2000        gbgm023.adx
359D800       40C000        gbgm024.adx
39A9800       6476A         gbgm041.adx
3A0E000       27AFE         gbgm042.adx
3A36000       4D016         gbgm043.adx
3A83800       38F2E         gbgm044.adx
3ABC800       3538E         gbgm045.adx
3AF2000       62F000        sbgm001.adx
4121000       5A6800        sbgm002.adx
46C7800       49A000        sbgm003.adx
4B61800       4BA000        sbgm004.adx
501B800       5D2800        sbgm005.adx
55EE000       4D8800        sbgm006.adx
5AC6800       5DA000        sbgm007.adx
60A0800       3FA800        sbgm008.adx
649B000       5EB800        sbgm009.adx
6A86800       777000        sbgm00a.adx
71FD800       4D0800        sbgm00b.adx
76CE000       C9F36         sbgm00b_1.adx
7798000       405000        sbgm00b_2.adx
7B9D000       40E000        sbgm00b_3.adx
7FAB000       571000        sbgm00c.adx
851C000       563800        sbgm00d.adx
8A7F800       5A3000        sbgm00e.adx
9022800       14E000        sbgm00f_1.adx
9170800       288800        sbgm00f_2.adx
93F9000       25F800        sbgm00f_3.adx
9658800       258800        sbgm00f_4.adx
98B1000       23F000        sbgm00f_5.adx
9AF0000       267000        sbgm00f_6.adx
9D57000       1A3800        sbgm010_1.adx
9EFA800       267800        sbgm010_2.adx
A162000       229800        sbgm010_3.adx
A38B800       1F7800        sbgm010_4.adx
A583000       199800        sbgm010_5.adx
A71C800       48F800        sbgm011.adx
ABAC000       40D000        sbgm013.adx
AFB9000       45E000        sbgm014.adx
B417000       4C7A6         gbgm007_x.adx
B463800       2B0800        gbgm031.adx
B714000       7CE000        gbgm032.adx
BEE2000       41F52         gbgm046.adx
BF24000       4F2AE         gbgm047.adx
BF73800       42102         gbgm048.adx
BFB6000       4F482         gbgm049.adx
C005800       34DA6         gbgm04b.adx
C03A800       768F6         gbgm04c.adx
C0B1800       9B0FA         gbgm04d_1.adx
C14D000       8729A         gbgm04d_2.adx
C1D4800       A8BEE         gbgm04e.adx
C27D800       10C6866       gbgm004.adx
D344800       13CBA2        gbgm033.adx
D481800       D2AFE         gbgm034.adx
D554800       50C46         gbgm00b.adx
D5A5800       AC2800        gbgm025.adx
E068000       423000        gbgm026.adx

Reviewers stated that SC2X has superior audio to SC2P, it is suspected that
this claim is not as much supported by the file sizes (only some of SC2Xs files
are bigger) but by the Dolby Digital Surround Sound support.

10)   MOVIE.AFS SC2P and SC2X Comparison

SC2P MOVIE.AFS OFFSETS/FILE NAME DUMP (courtesy of MiteeXPR) -
Number of Files              3

Offset(Hex)   Size(Hex)     FileName

800           92CC000       AFS        À,  È,  È£  Ð  (w
92CC800       A3C800        
9D09000       772800        

SC2X MOVIE.AFS OFFSETS/FILE NAME DUMP (courtesy of MiteeXPR) -
Number of Files              3

Offset(Hex)   Size(Hex)     FileName

800           17FA8800      AFS        ˆú ú À P h*
17FA9000      107C000      
19025000      12A6800      

11)   Xbox Save File Folder Structure

---------Disclaimer - Save data size may vary, and probably will---------------


/E/TDATA/4e4d0003/
Currently no data

/E/UDATA/4e4d0003/
SaveImage.xbx        4 KB
TitleImage.xbx        10 KB
TitleMeta.xbx          66 Bytes

/E/UDATA/4e4d0003/69D87B1B76E8/    (Believed to be PAL version folder)
SaveMeta.xbx        28 Bytes
sc2_0.dat               16 KB
sc2_1.dat               16 KB

/E/UDATA/4e4d0003/903C2ED2E2B9/    (Believed to be NTSC version folder)
SaveMeta.xbx        34 Bytes
sc2_0.dat               16 KB
sc2_1.dat               16 KB

12)   Move Data

The following offset could be either for a move tutorial mode, or the actually
game data for moves itself.  The game *seems* to use the numpad direction
system -

A - HORIZONTAL HIT?
B - VERTICAL?
G - GUARD?

     upper left;diag /  upper right;diag

                    7      8      9

              <   4       5      6   >                           (5=no movement)

                   1       2      3   

     lower left;diag  /  lower right;diag









00001000 - BEGINNING OF MOVE SECTION? HEADER IS OLNK

1
00005f20
0000cfe0

2
00011a30
00017b60

3
0001f160
00026ff0

4
0002eba0
00036410

5
00041480
0004ac40

5
000510d0
00057780

6
0005d710
00064ae0

7
0006c0f0
00073a60

8
0007bd80
000838f0

9
00091590
0009b800

10
000a5760
000ae8f0

11
000b5c90
000bce40

12
000c3280
000c9c10

13
000d5d60
000de9a0

14
000e5cc0  
000ed0d0

15
000f46f0  
000fbb90

16
00101040
001074f0

17
0010ebc0
001161b0

18
0011cd50
00124060

19
00129960
0012fe00

20
00134ca0
0013b430

21
00140190

00145c90  -- PATTERN BROKEN?! -- (data of this fashion not seen previously)

0014b580  -PATTERN RE-ESTABLISHED?!
00150d20  -New pattern forming

00155a00
0015b1a0

0015c800  TOTALLY NEW DATA; HEADER IS "OLNK". Pattern Ends.

13)   SC2 Character List

1) Ivy
2) Yun Sung
3) Cassandra
4) Astaroth
5) Kilik
6) Voldo
7) Talim
8) Raphael
9) Yoshimitsu
10) Cervantes
11) Seung Mina
12) Lizardman
13) Assassin
14) Berserker
15) Taki
16) Maxi
17) Nightmare
18) Xianghua
19) Mitsurugi
20) Spawn
21) Link
22) Heihachi
23) Charade
24) Necrid
25) Sophitia

0015f000   "VXT" File Header. Image format?! DXT is an established image format

00187a90

1b6e5c20 - SWING.

1b6f9090  - Cutscene data? Subtitles seem to be what the overwhelming majority of
this data is.  Periods seem to control when the current text on screen is removed and
new text is displayed.  Stuff in parenthesis like (Attack 1) and (Breath 2) seem to be
animation/sound triggers.  "Fine!  Master, I will do this!"

1ba8a900  - Another excerpt of root.olk that is believed to be a cutscene. It contains
the following distinct actions -  (x being a variable)

(Attack x)
(Damage x)
(Death Cry)  --  Only one?

the 1b6f9090 cutscene is followed by data with the header "mmx".  1ba8a900 follows suit.
the header "mmx" does not necessarily have to be after cutscene data.  There are many
instances where it is not.  And note, *it* is commonly followed by the string "XHD"

.....Xbox Hard Drive???  Does the game save after a cutscene, or "destined battle"?

Examples -
02d74800
02d7b800
02d85000
02f2b000

012b8410 - 012b9970   Has pretty much all game mode related strings, and then
012ba020-012bc700 finishes up with strings that pretty much make up the whole *core*
of the game, and it includes some default settings that seem to be pretty easily edited.

012bcfd0-012c0ef0  Has weapon names and descriptions.  Could be great fun to edit!!

012c1100-012c1780  Strings for practice mode, learning moves and such

012c1b90-012c2b00  More setting, default, and game mode strings

012c2be0  Weapon master map strings

012e2c70  Gamecube version crap

012c3560  Weapon Master mode stuff

is a variable for your current wins.  Probably implemented in Vs. Mode
%s   is a varible for your current stage
<1P2P>  has some correlation with the "Start" button. Possibly plays the "New challenger" theme
 is a variable for your current chapter
%d   is a variable for gold winnings, which stage is selected, and current chapter
 has some correlation with winning. Possibly plays the victory theme.
#S  is another variable for "Start"
{%s}   is a variable for a stage, probably for the more recently unlocked one
$m   Button designation?
$s    Controlled by $m, displays an icon of a button?



05bbb060  -  "HEy?" over and over again for a really long time.  Just for fun :)

1059e130  - Start of alphanumeric list

1af7da20   -  "Buki"? Some type of animation?  Followed by mmx and XHD  1-9

02d72960  -  Character ending texts

The hex before an mmx header is very often -

35 00 00 00 ff 8e 20 21 80 2a 96 00 21 80 8a 0a
89 f3 8f 80 80 80 80 00 08 08 08 08 08 09 00 00

The mmx header can be immediately followed by -
00 2b 03 00
00 c4 03 00
80 77 03 00
40 ea 03 00
c0 9d 03 00
80 77 03 00
80 10 04 00
20 9d 03 00
c0 04 03 00
c0 c3 03 00
80 6b 03 00
a0 43 03 00
e0 6f 03 00
20 d3 03 00
80 a1 02 00

there are probably more, this is just the amount I've gotten so far.  I believe that the
hex immediately following mmx designates its file type


oe94e4f0  -  Start of funky words...later on A-SPEC, CONSTANT, and
                    AMBIENT can be found

Discovery of VMX file header.  No idea what it is, but whatever it is - it's pretty big.  
Sometimes it's preceeded by 2 lines of hex.

1eca8980   -  Strings of character's sayings.  "Shatter!"
Logged