No Enemy for FF4 After Years Pal

Started by Patedj, May 13, 2011, 04:01:17 PM

Previous topic - Next topic

James0x57



Patedj

#31
I'm going to do another search, I'm going tocompare the towns options vs the dungeons. I'm thinking that this will allow me to control the enounter()

Exit town/dungeon as flying sea ship can land only land on land. in Palom's quest it appears as a black hole which can land anywhere. My hypothesis is that the contraption type is contingent to the quest. Nonetheless it works. Do not reembark it though...
040746BC 40810008

Quote from: James0x57 on May 20, 2011, 02:35:48 PM
ohh haha
O0

Edit: Button conditioned
281FB3DA 00000C00
040746BC 40810008
CC000000 00000000
040746BC 40800008
E0000000 80008000
You can pm me, I've got time for your troubles.

Patedj

#32
I did it!! I think anyone testing my codes??

no enemy encounters!!
04544C9C 00000000

what a journey...

Edit: Button Conditioned
281FB3DA yyyyxxxx
04544C9C 00000000
CC000000 00000000
04544C9C 00000008
E0000000 80008000
You can pm me, I've got time for your troubles.

James0x57



dcx2

#34
I'm glad you got your no encounters code.  Sometimes it just takes some stumbling around.  One thing you should be cautious of is trying to make a step log or all frames based on the wrong read or write breakpoint.  Don't just settle for the *first* hit on a read or write breakpoint; always check for additional hits.  Especially in RPGs, the same value can be read in three or four different places, and you might want that third hit instead of the first.

----

Quote from: Patedj on May 19, 2011, 04:15:30 PM
8006B628:  807F0F00   lwz   r3,3840(r31)   r3 = 804D8060   r31 = 805428E0   [805437E0] = 00000004
or this one. They offer different music.
8006B68C:  801F0E90   lwz   r0,3728(r31)   r0 = 00000000   r31 = 805428E0   [80543770] = 00000000
This is the music selector. Let's test it out.

I'm thinking of doing this to it but it crashes...

[spoiler]stwu r1,-16(r1)
stw r14,8(r1)
mr r17,r3
lis r15, 0x801F
ori r15,r15,0xB3DA
li r16, 1024
cmpw r15,r16
beq COMPARE
bl END

COMPARE:
cmpw r17,3
bgt ZERO
b ADD

ZERO:
li r17,0
b END

ADD:
li r14,1
add r17,r17,r14
mr r3,r17

END:
lwz r14,8(r1)
addi r1,r1,16
[/spoiler]
0406B628 38600004
0=normal
1=Flying ship
2=Whale
3=Flying ship
4=chocobo
+=same things again

0406B68C 3800000x
0=normal map exploration
1=moon walk
2=underground walk
3=ceremonial
+=ceremonial

Wow, I'm not even sure where to start.  I'll give you credit for the attempted roller.  Here are notes on what needs fixed.

[spoiler]stwu r1,-16(r1)   # this only allocates 16 bytes, you need 80
stw r14,8(r1)   # this should be stmw, otherwise this won't store r14-r31, but just r14
mr r17,r3    # r3 has not been loaded yet
lis r15, 0x801F
ori r15,r15,0xB3DA  # where is the lhz that loads the current buttons?
li r16, 1024    # you should use hex notation; 0x400 means more than 1024
cmpw r15,r16    # this should be "cmpwi r15,0x400"; cmpw is two regs, cmpwi is reg and immediate
beq COMPARE
bl END     # should be b, not bl!!  could easily cause a crash

COMPARE:
cmpw r17,3   # should be cmpwi.  this will be interpreted as cmpw r17,r3
bgt ZERO
b ADD

ZERO:
li r17,0
b END   # will skip over mr r3,r17

ADD:
li r14,1
add r17,r17,r14  # can use addi instead
mr r3,r17

END:
lwz r14,8(r1)   # should be lmw
addi r1,r1,16   # should be 80

# where is your original instruction?!
[/spoiler]

I've modified your code a bit.  This assumes the hook 8006B628:  807F0F00   lwz   r3,3840(r31).  It also assumes that you found the "real" buttons, which have "button deltas" just after them.

[spoiler]
lwz r3,3840(r31)   # run original instruction BEFORE the code
stwu r1,-80(r1)   # create a stack frame
stmw r14,8(r1)   # push r14-r31 onto the stack
lis r15, 0x801F   # load r15 with button activator address
ori r15,r15,0xB3DA

# we only want to roll once per button press.
# however if we use 0(r15), we will roll once per frame while the button is held
# if 801FB3DA is the *real* buttons, then 801FB3DE is the deltas.
# deltas are only 1 for a single frame immediately after a button is pressed

lhz r15,4(r15)   # get button delta values
cmpwi r15,0x400   # was B pressed? (you might want to make this 2 or more buttons to activate)
bne- _END   # if B and only B is not pressed, do nothing

addi r3,r3,1   # increment current music
cmpwi r3,4   # are we <= 4?
ble- _STORE  # if yes, go to store
li r3,0          # prevent "falling off the right"

_STORE:
stw r3,3840(r31)   # update the currently selected music.

_END:
lmw r14,8(r1)   # pop r14-r31 off the stack
addi r1,r1,80    # destroy the stack frame
[/spoiler]

Patedj

Thanks James, thanks dcx2.
wow that coding was full of errors lol. That'll teach me for doing coding late at night/early in the morning lol.

For some reason it's not working right... I'll figure it out when it's not 442 in the morning... micro sleep .. ok awesome!
You can pm me, I've got time for your troubles.

dcx2

I can see a few instances where it might not work right, depending on how the code executes.  Can you explain what's not working?

Patedj

#37
It's not adding anything when the condition is on.

Edit:
I've done more tries and found that it simply doesn't change. It resets itself to 0. I can trigger it if I
lis r15, 0x801F 
ori r15,r15,0xB3DA
lhz r15,0(r15) 
but it'll reset itself right away.
You can pm me, I've got time for your troubles.

Patedj

#38
I think that's why I skipped the lwz in my attempt. I just wanted the register to transfer instead of loading.

The register is already loaded so I'm thinking I should find what stores 805437E0 and change that.

Here it is
8006BE20:  38000000   li   r0,0
8006BE24:  90160F00   stw   r0,3840(r22)

I'm thinking I can simply inject here. 8006BE20:  38000000   li   r0,0

With

stwu r1,-80(r1)  
stmw r14,8(r1)  
lis r15, 0x801F  
ori r15,r15,0xB3DA
lhz r15,0(r15)  
cmpwi r15,0x400  
bne- _END  
addi r0,r0,1
cmpwi r0,4  
ble- _END
li r0,0  

_END:

lmw r14,8(r1)  
addi r1,r1,80


Edit: The same thing happens... I'm now thinking that a combination of the two will work. So something like...
You can pm me, I've got time for your troubles.

Patedj

#39
stwu r1,-80(r1)  
stmw r14,8(r1)  
lis r15, 0x801F  
ori r15,r15,0xB3DA
lhz r15,0(r15)  
cmpwi r15,0x400  
bne- _END  
addi r0,r0,1
cmpwi r0,4
ble- _STORE
li r0,0

_STORE:
stw r0,0(r3)
lis r16,0x8006
ori r16,r16,0xB628
stw r3,0(r16)
#I'm not sure how to do this... I'm thinking of changing the addresses command as li r3,0(r0)  or something in the like so that the r3 that is loaded at 8006B628 is = to the r0.


_END:

lmw r14,8(r1)  
addi r1,r1,80


But this crashed the game at

[spoiler]80001E40:  7D4802A6   mflr   r10
80001E44:  7C6903A6   mtctr   r3
80001E48:  39C00000   li   r14,0
80001E4C:  7C6C70AE   lbzx   r3,r12,r14
80001E50:  4800001D   bl   0x80001e6c
80001E54:  4182FFF8   beq+   0x80001e4c
80001E58:  39CE0001   addi   r14,r14,1
80001E5C:  4200FFF0   bdnz+   0x80001e4c
80001E60:  7D4803A6   mtlr   r10
80001E64:  4E800020   blr   
[/spoiler] Which I think is a stage loader...

my conclusion... I'm working backwards... I'll write the code at 8006B628 instead and lwz r3 first then right r3 to r0 t0 8006BE20 and that'll do it for sure!
You can pm me, I've got time for your troubles.

Patedj

#40
lwz r3,3840(r31)
stwu r1,-80(r1)  
stmw r14,8(r1)  
lis r15, 0x801F  
ori r15,r15,0xB3DA
lhz r15,0(r15)  
cmpwi r15,0x400  
bne- _END  
addi r3,r3,1
cmpwi r3,4
ble- _STORE
li r3,0

_STORE:
stw r3,3840(r31)
lis r16,0x8006
ori r16,r16,0xBE20
b r16 #does this work?
lwz r0,0(r3)
_END:

lmw r14,8(r1)  
addi r1,r1,80

It crashes here[spoiler]800B4CC0:  90830198   stw   r4,408(r3)
800B4CC4:  90A30004   stw   r5,4(r3)
800B4CC8:  39600000   li   r11,0
800B4CCC:  616B9032   ori   r11,r11,36914
800B4CD0:  9163019C   stw   r11,412(r3)
800B4CD4:  38000000   li   r0,0
800B4CD8:  90030080   stw   r0,128(r3)
800B4CDC:  9003008C   stw   r0,140(r3)
800B4CE0:  90430008   stw   r2,8(r3)
800B4CE4:  91A30034   stw   r13,52(r3)
800B4CE8:  9003000C   stw   r0,12(r3)
800B4CEC:  90030010   stw   r0,16(r3)
800B4CF0:  90030014   stw   r0,20(r3)
800B4CF4:  90030018   stw   r0,24(r3)
800B4CF8:  9003001C   stw   r0,28(r3)
800B4CFC:  90030020   stw   r0,32(r3)
800B4D00:  90030024   stw   r0,36(r3)
800B4D04:  90030028   stw   r0,40(r3)
800B4D08:  9003002C   stw   r0,44(r3)
800B4D0C:  90030030   stw   r0,48(r3)
800B4D10:  90030038   stw   r0,56(r3)
800B4D14:  9003003C   stw   r0,60(r3)
800B4D18:  90030040   stw   r0,64(r3)
800B4D1C:  90030044   stw   r0,68(r3)
800B4D20:  90030048   stw   r0,72(r3)
800B4D24:  9003004C   stw   r0,76(r3)
800B4D28:  90030050   stw   r0,80(r3)
800B4D2C:  90030054   stw   r0,84(r3)
800B4D30:  90030058   stw   r0,88(r3)
800B4D34:  9003005C   stw   r0,92(r3)
800B4D38:  90030060   stw   r0,96(r3)
800B4D3C:  90030064   stw   r0,100(r3)
800B4D40:  90030068   stw   r0,104(r3)
800B4D44:  9003006C   stw   r0,108(r3)
800B4D48:  90030070   stw   r0,112(r3)
800B4D4C:  90030074   stw   r0,116(r3)
800B4D50:  90030078   stw   r0,120(r3)
800B4D54:  9003007C   stw   r0,124(r3)
800B4D58:  900301A4   stw   r0,420(r3)
800B4D5C:  900301A8   stw   r0,424(r3)
800B4D60:  900301AC   stw   r0,428(r3)
800B4D64:  900301B0   stw   r0,432(r3)
800B4D68:  900301B4   stw   r0,436(r3)
800B4D6C:  900301B8   stw   r0,440(r3)
800B4D70:  900301BC   stw   r0,444(r3)
800B4D74:  900301C0   stw   r0,448(r3)
800B4D78:  4BFFFF24   b   0x800b4c9c
800B4D7C:  9421FD10   stwu   r1,-752(r1)
800B4D80:  7C0802A6   mflr   r0
800B4D84:  900102F4   stw   r0,756(r1)
800B4D88:  396102F0   addi   r11,r1,752
800B4D8C:  4801FBF1   bl   0x800d497c
800B4D90:  3F80801D   lis   r28,-32739
800B4D94:  7C7E1B78   mr   r30,r3
800B4D98:  3B9CD590   subi   r28,r28,10864
800B4D9C:  7FC4F378   mr   r4,r30
800B4DA0:  387C0000   addi   r3,r28,0
800B4DA4:  4CC63182   crclr   6,6
800B4DA8:  48000301   bl   0x800b50a8
800B4DAC:  7FDAF378   mr   r26,r30
800B4DB0:  3B200000   li   r25,0
800B4DB4:  811A0040   lwz   r8,64(r26)
800B4DB8:  7F24CB78   mr   r4,r25
800B4DBC:  80BA0000   lwz   r5,0(r26)
800B4DC0:  387C0048   addi   r3,r28,72
800B4DC4:  7D094378   mr   r9,r8
800B4DC8:  38F90010   addi   r7,r25,16
800B4DCC:  7CA62B78   mr   r6,r5
800B4DD0:  4CC63182   crclr   6,6
800B4DD4:  480002D5   bl   0x800b50a8
800B4DD8:  3B390001   addi   r25,r25,1
800B4DDC:  3B5A0004   addi   r26,r26,4
800B4DE0:  28190010   cmplwi   r25,16
800B4DE4:  4180FFD0   blt+   0x800b4db4
800B4DE8:  809E0084   lwz   r4,132(r30)
800B4DEC:  387C0078   addi   r3,r28,120
800B4DF0:  80BE0080   lwz   r5,128(r30)
800B4DF4:  4CC63182   crclr   6,6
800B4DF8:  480002B1   bl   0x800b50a8
800B4DFC:  809E0198   lwz   r4,408(r30)
800B4E00:  387C00A8   addi   r3,r28,168
800B4E04:  80BE019C   lwz   r5,412(r30)
800B4E08:  4CC63182   crclr   6,6
800B4E0C:  4800029D   bl   0x800b50a8
800B4E10:  387C00D8   addi   r3,r28,216
800B4E14:  4CC63182   crclr   6,6
800B4E18:  48000291   bl   0x800b50a8
800B4E1C:  7FDAF378   mr   r26,r30
800B4E20:  3B200000   li   r25,0
800B4E24:  80BA01A4   lwz   r5,420(r26)
800B4E28:  7F24CB78   mr   r4,r25
800B4E2C:  80FA01B4   lwz   r7,436(r26)
800B4E30:  387C00EC   addi   r3,r28,236
800B4E34:  38D90004   addi   r6,r25,4
800B4E38:  4CC63182   crclr   6,6
800B4E3C:  4800026D   bl   0x800b50a8
800B4E40:  3B390001   addi   r25,r25,1
800B4E44:  3B5A0004   addi   r26,r26,4
800B4E48:  28190004   cmplwi   r25,4
800B4E4C:  4180FFD8   blt+   0x800b4e24
800B4E50:  A01E01A2   lhz   r0,418(r30)
800B4E54:  540007FF   rlwinm.   r0,r0,0,31,31
800B4E58:  41820118   beq-   0x800b4f70
800B4E5C:  48003FB5   bl   0x800b8e10
800B4E60:  3CC08000   lis   r6,-32768
800B4E64:  38A00000   li   r5,0
800B4E68:  836600D4   lwz   r27,212(r6)
800B4E6C:  38810008   addi   r4,r1,8
800B4E70:  7C7F1B78   mr   r31,r3
800B4E74:  B0A101A8   sth   r5,424(r1)
800B4E78:  B0A101AA   sth   r5,426(r1)
800B4E7C:  800600D8   lwz   r0,216(r6)
800B4E80:  7C040040   cmplw   r4,r0
800B4E84:  40820008   bne-   0x800b4e8c
800B4E88:  90A600D8   stw   r5,216(r6)
800B4E8C:  38610008   addi   r3,r1,8
800B4E90:  4BFFFBE5   bl   0x800b4a74
800B4E94:  387C0110   addi   r3,r28,272
800B4E98:  4CC63182   crclr   6,6
800B4E9C:  4800020D   bl   0x800b50a8
800B4EA0:  7FDAF378   mr   r26,r30
800B4EA4:  3B200000   li   r25,0
800B4EA8:  C83A0098   lfd   f1,152(r26)
800B4EAC:  4801F9B1   bl   0x800d485c
800B4EB0:  C83A0090   lfd   f1,144(r26)
800B4EB4:  7C7D1B78   mr   r29,r3
800B4EB8:  4801F9A5   bl   0x800d485c
800B4EBC:  7C651B78   mr   r5,r3
800B4EC0:  7F24CB78   mr   r4,r25
800B4EC4:  7FA7EB78   mr   r7,r29
800B4EC8:  387C0124   addi   r3,r28,292
800B4ECC:  38D90001   addi   r6,r25,1
800B4ED0:  4CC63182   crclr   6,6
800B4ED4:  480001D5   bl   0x800b50a8
800B4ED8:  3B390002   addi   r25,r25,2
800B4EDC:  3B5A0010   addi   r26,r26,16
800B4EE0:  28190020   cmplwi   r25,32
800B4EE4:  4180FFC4   blt+   0x800b4ea8
800B4EE8:  387C0140   addi   r3,r28,320
800B4EEC:  4CC63182   crclr   6,6
800B4EF0:  480001B9   bl   0x800b50a8
800B4EF4:  7FDAF378   mr   r26,r30
800B4EF8:  3B200000   li   r25,0
800B4EFC:  C83A01D0   lfd   f1,464(r26)
800B4F00:  4801F95D   bl   0x800d485c
800B4F04:  C83A01C8   lfd   f1,456(r26)
800B4F08:  7C7D1B78   mr   r29,r3
800B4F0C:  4801F951   bl   0x800d485c
800B4F10:  7C651B78   mr   r5,r3
800B4F14:  7F24CB78   mr   r4,r25
800B4F18:  7FA7EB78   mr   r7,r29
800B4F1C:  387C0154   addi   r3,r28,340
800B4F20:  38D90001   addi   r6,r25,1
800B4F24:  4CC63182   crclr   6,6
800B4F28:  48000181   bl   0x800b50a8
800B4F2C:  3B390002   addi   r25,r25,2
800B4F30:  3B5A0010   addi   r26,r26,16
800B4F34:  28190020   cmplwi   r25,32
800B4F38:  4180FFC4   blt+   0x800b4efc
800B4F3C:  38A00000   li   r5,0
800B4F40:  3C608000   lis   r3,-32768
800B4F44:  B0A101A8   sth   r5,424(r1)
800B4F48:  38810008   addi   r4,r1,8
800B4F4C:  B0A101AA   sth   r5,426(r1)
800B4F50:  800300D8   lwz   r0,216(r3)
800B4F54:  7C040040   cmplw   r4,r0
800B4F58:  40820008   bne-   0x800b4f60
800B4F5C:  90A300D8   stw   r5,216(r3)
800B4F60:  7F63DB78   mr   r3,r27
800B4F64:  4BFFFB11   bl   0x800b4a74
800B4F68:  7FE3FB78   mr   r3,r31
800B4F6C:  48003ECD   bl   0x800b8e38
800B4F70:  387C0174   addi   r3,r28,372
800B4F74:  4CC63182   crclr   6,6
800B4F78:  48000131   bl   0x800b50a8
800B4F7C:  833E0004   lwz   r25,4(r30)
800B4F80:  3B400000   li   r26,0
800B4F84:  48000020   b   0x800b4fa4
800B4F88:  80B90000   lwz   r5,0(r25)
800B4F8C:  7F24CB78   mr   r4,r25
800B4F90:  80D90004   lwz   r6,4(r25)
800B4F94:  387C019C   addi   r3,r28,412
800B4F98:  4CC63182   crclr   6,6
800B4F9C:  4800010D   bl   0x800b50a8
800B4FA0:  83390000   lwz   r25,0(r25)
800B4FA4:  2C190000   cmpwi   r25,0
800B4FA8:  4182001C   beq-   0x800b4fc4
800B4FAC:  3C190001   addis   r0,r25,1
800B4FB0:  2800FFFF   cmplwi   r0,65535
800B4FB4:  41820010   beq-   0x800b4fc4
800B4FB8:  281A0010   cmplwi   r26,16
800B4FBC:  3B5A0001   addi   r26,r26,1
800B4FC0:  4180FFC8   blt+   0x800b4f88
800B4FC4:  396102F0   addi   r11,r1,752
800B4FC8:  4801FA01   bl   0x800d49c8
800B4FCC:  800102F4   lwz   r0,756(r1)
800B4FD0:  7C0803A6   mtlr   r0
800B4FD4:  382102F0   addi   r1,r1,752
800B4FD8:  4E800020   blr   
[/spoiler]
with these registers [spoiler] CR:84000488  XER:20000000  CTR:800DBE34 DSIS:04000000
DAR:7C651B78 SRR0:800B4F88 SRR1:00000032   LR:800B4FA0
  r0:7C661B78   r1:802BA388   r2:802B2020   r3:FFFFFFFF
  r4:FFFFFFFF   r5:12900000   r6:801E09B0   r7:00000000
  r8:0000000C   r9:0000000C  r10:00000000  r11:802BA390
r12:800DBE34  r13:802B0C80  r14:00020000  r15:00000400
r16:8006BE20  r17:000001C8  r18:00000000  r19:0000000C
r20:801FAF80  r21:00000000  r22:801FE200  r23:0000000C
r24:8020E7B0  r25:7C651B78  r26:00000005  r27:8020EB58
r28:801CD590  r29:FFFFFFFF  r30:8020EB58  r31:00000000

  f0:00000000   f1:38000001   f2:FFC00000   f3:4F800000
  f4:4F000000   f5:00000000   f6:00000000   f7:59800004
  f8:00000000   f9:00000000  f10:BF7FFFFE  f11:3B888889
f12:3B4CCCCD  f13:00000000  f14:00000000  f15:00000000
f16:00000000  f17:00000000  f18:00000000  f19:00000000
f20:00000000  f21:00000000  f22:00000000  f23:00000000
f24:00000000  f25:00000000  f26:3FAF286C  f27:3F800000
f28:3F99999A  f29:59800000  f30:3F000000  f31:59800004[/spoiler]
You can pm me, I've got time for your troubles.

dcx2

That's the code handler's transmit function that you crashed in.

b r16 will not work.  Only the CTR register can be an operand for a branch.

I think I understand why your roller isn't working.  That breakpoint is probably only executed when music changes.  I was under the impression it's always being changed.

You can try a normal WiiRD code type roller.

4E000004 00000000 # put address of hack into po
0406B628 38600000 # the hack
281FB3DA 00000400 # if button activator
A8000000 00000001 # if counter == 1 (makes it change once per press)
90010005 00000000 # gr5 = po
86010005 00000001 # [gr5] = [gr5] + 1
38000002 00000005 # if [po+2] == 5 (the immediate part of 38600000)
12000002 00000000 # [po+2] = 0
E0000000 80008000 # terminate 28, A8, and 38 if codes; reset po

Patedj

#42
I was just about to thanks!

Works like a charm!

Music changes to ships version.
4E000004 00000000
0406B628 38600000
281FB3DA 00000400
A8000000 00000001
90010005 00000000
86010005 00000001
38000002 00000005
12000002 00000000
E0000000 80008000

And

Music Changes to other walking versions ie:ceremonial, underground,etc
4E000004 00000000
0406B68C 38000000
281FB3DA 00000400
A8000000 00000001
90010005 00000000
86010005 00000001
38000002 00000005
12000002 00000000
E0000000 80008000
You can pm me, I've got time for your troubles.

Patedj

#43
The r4 seems to be directly linked to the choice of music hear and it even triggers in town.

[spoiler]80066AB0:  38040001   addi   r0,r4,1
80066AB4:  28000042   cmplwi   r0,66
80066AB8:  4D810020   bgtlr-   
[/spoiler]

LR 8006B6AC

[spoiler]8006B4A8:  9421FFE0   stwu   r1,-32(r1)
8006B4AC:  7C0802A6   mflr   r0
8006B4B0:  90010024   stw   r0,36(r1)
8006B4B4:  93E1001C   stw   r31,28(r1)
8006B4B8:  7C7F1B78   mr   r31,r3
8006B4BC:  93C10018   stw   r30,24(r1)
8006B4C0:  80030F54   lwz   r0,3924(r3)
8006B4C4:  2C000000   cmpwi   r0,0
8006B4C8:  4182023C   beq-   0x8006b704
8006B4CC:  48000389   bl   0x8006b854
8006B4D0:  2C030000   cmpwi   r3,0
8006B4D4:  4082000C   bne-   0x8006b4e0
8006B4D8:  38600000   li   r3,0
8006B4DC:  4800022C   b   0x8006b708
8006B4E0:  801F0E84   lwz   r0,3716(r31)
8006B4E4:  3BC00000   li   r30,0
8006B4E8:  93DF14C0   stw   r30,5312(r31)
8006B4EC:  540001CF   rlwinm.   r0,r0,0,7,7
8006B4F0:  41820110   beq-   0x8006b600
8006B4F4:  809F0E90   lwz   r4,3728(r31)
8006B4F8:  7FE3FB78   mr   r3,r31
8006B4FC:  4800AA65   bl   0x80075f60
8006B500:  93C10008   stw   r30,8(r1)
8006B504:  7FE3FB78   mr   r3,r31
8006B508:  38800001   li   r4,1
8006B50C:  38E00014   li   r7,20
8006B510:  A8BF0FF4   lha   r5,4084(r31)
8006B514:  39000000   li   r8,0
8006B518:  A8DF0FF6   lha   r6,4086(r31)
8006B51C:  39200000   li   r9,0
8006B520:  39400000   li   r10,0
8006B524:  48008FF9   bl   0x8007451c
8006B528:  7FE3FB78   mr   r3,r31
8006B52C:  38800014   li   r4,20
8006B530:  4BFFEC25   bl   0x8006a154
8006B534:  2C030000   cmpwi   r3,0
8006B538:  4082000C   bne-   0x8006b544
8006B53C:  38600000   li   r3,0
8006B540:  480001C8   b   0x8006b708
8006B544:  A81F0FFE   lha   r0,4094(r31)
8006B548:  38600001   li   r3,1
8006B54C:  907F128C   stw   r3,4748(r31)
8006B550:  2C000001   cmpwi   r0,1
8006B554:  4082000C   bne-   0x8006b560
8006B558:  60600002   ori   r0,r3,2
8006B55C:  901F128C   stw   r0,4748(r31)
8006B560:  80DF0000   lwz   r6,0(r31)
8006B564:  7FE3FB78   mr   r3,r31
8006B568:  38800001   li   r4,1
8006B56C:  3CA60002   addis   r5,r6,2
8006B570:  8005B2C0   lwz   r0,-19776(r5)
8006B574:  1C000030   mulli   r0,r0,48
8006B578:  7CA50214   add   r5,r5,r0
8006B57C:  8005B2EC   lwz   r0,-19732(r5)
8006B580:  1C00026C   mulli   r0,r0,620
8006B584:  7CC60214   add   r6,r6,r0
8006B588:  80A61A98   lwz   r5,6808(r6)
8006B58C:  80C61A9C   lwz   r6,6812(r6)
8006B590:  4800865D   bl   0x80073bec
8006B594:  A89F0FFE   lha   r4,4094(r31)
8006B598:  7FE3FB78   mr   r3,r31
8006B59C:  A8BF0FF4   lha   r5,4084(r31)
8006B5A0:  A8DF0FF6   lha   r6,4086(r31)
8006B5A4:  A8FF0FF8   lha   r7,4088(r31)
8006B5A8:  A91F0FFA   lha   r8,4090(r31)
8006B5AC:  A93F0FFC   lha   r9,4092(r31)
8006B5B0:  480090A9   bl   0x80074658
8006B5B4:  A89F0FF4   lha   r4,4084(r31)
8006B5B8:  7FE3FB78   mr   r3,r31
8006B5BC:  A81F0FF6   lha   r0,4086(r31)
8006B5C0:  909F1234   stw   r4,4660(r31)
8006B5C4:  809F0E90   lwz   r4,3728(r31)
8006B5C8:  901F1238   stw   r0,4664(r31)
8006B5CC:  4BFFF669   bl   0x8006ac34
8006B5D0:  807F0E84   lwz   r3,3716(r31)
8006B5D4:  38A00000   li   r5,0
8006B5D8:  801F0E8C   lwz   r0,3724(r31)
8006B5DC:  5464020C   rlwinm   r4,r3,0,8,6
8006B5E0:  807F0000   lwz   r3,0(r31)
8006B5E4:  60001000   ori   r0,r0,4096
8006B5E8:  909F0E84   stw   r4,3716(r31)
8006B5EC:  901F0E8C   stw   r0,3724(r31)
8006B5F0:  808304BC   lwz   r4,1212(r3)
8006B5F4:  38840005   addi   r4,r4,5
8006B5F8:  4BFDA5D5   bl   0x80045bcc
8006B5FC:  480000DC   b   0x8006b6d8
8006B600:  7FE3FB78   mr   r3,r31
8006B604:  48000605   bl   0x8006bc08
8006B608:  801F0E8C   lwz   r0,3724(r31)
8006B60C:  38A00000   li   r5,0
8006B610:  807F0000   lwz   r3,0(r31)
8006B614:  54000146   rlwinm   r0,r0,0,5,3
8006B618:  901F0E8C   stw   r0,3724(r31)
8006B61C:  808304BC   lwz   r4,1212(r3)
8006B620:  38840005   addi   r4,r4,5
8006B624:  4BFDA5A9   bl   0x80045bcc
8006B628:  807F0F00   lwz   r3,3840(r31)
8006B62C:  546007FF   rlwinm.   r0,r3,0,31,31
8006B630:  4182001C   beq-   0x8006b64c
8006B634:  807F0000   lwz   r3,0(r31)
8006B638:  3880001D   li   r4,29
8006B63C:  3C630002   addis   r3,r3,2
8006B640:  3863DE08   subi   r3,r3,8696
8006B644:  4BFFB46D   bl   0x80066ab0
8006B648:  48000064   b   0x8006b6ac
8006B64C:  546007BD   rlwinm.   r0,r3,0,30,30
8006B650:  4182001C   beq-   0x8006b66c
8006B654:  807F0000   lwz   r3,0(r31)
8006B658:  38800028   li   r4,40
8006B65C:  3C630002   addis   r3,r3,2
8006B660:  3863DE08   subi   r3,r3,8696
8006B664:  4BFFB44D   bl   0x80066ab0
8006B668:  48000044   b   0x8006b6ac
8006B66C:  5460077B   rlwinm.   r0,r3,0,29,29
8006B670:  4182001C   beq-   0x8006b68c
8006B674:  807F0000   lwz   r3,0(r31)
8006B678:  3880000A   li   r4,10
8006B67C:  3C630002   addis   r3,r3,2
8006B680:  3863DE08   subi   r3,r3,8696
8006B684:  4BFFB42D   bl   0x80066ab0
8006B688:  48000024   b   0x8006b6ac
8006B68C:  38000001   li   r0,1
8006B690:  80BF0000   lwz   r5,0(r31)
8006B694:  7C7F0214   add   r3,r31,r0
8006B698:  888319DC   lbz   r4,6620(r3)
8006B69C:  3C650002   addis   r3,r5,2
8006B6A0:  3863DE08   subi   r3,r3,8696
8006B6A4:  7C840774   extsb   r4,r4
8006B6A8:  4BFFB409   bl   0x80066ab0
8006B6AC:  801F0EF0   lwz   r0,3824(r31)

8006B6B0:  38600000   li   r3,0
8006B6B4:  907F0F00   stw   r3,3840(r31)
8006B6B8:  540006B5   rlwinm.   r0,r0,0,26,26
8006B6BC:  4182001C   beq-   0x8006b6d8
8006B6C0:  801F0EA4   lwz   r0,3748(r31)
8006B6C4:  1C000060   mulli   r0,r0,96
8006B6C8:  7C7F0214   add   r3,r31,r0
8006B6CC:  8003122C   lwz   r0,4652(r3)
8006B6D0:  540007FA   rlwinm   r0,r0,0,31,29
8006B6D4:  9003122C   stw   r0,4652(r3)
8006B6D8:  801F0E8C   lwz   r0,3724(r31)
8006B6DC:  7FE3FB78   mr   r3,r31
8006B6E0:  54000354   rlwinm   r0,r0,0,13,10
8006B6E4:  901F0E8C   stw   r0,3724(r31)
8006B6E8:  4BFFE4DD   bl   0x80069bc4
8006B6EC:  38600000   li   r3,0
8006B6F0:  38000001   li   r0,1
8006B6F4:  907F0F54   stw   r3,3924(r31)
8006B6F8:  38600000   li   r3,0
8006B6FC:  901F0E80   stw   r0,3712(r31)
8006B700:  48000008   b   0x8006b708
8006B704:  38600001   li   r3,1
8006B708:  80010024   lwz   r0,36(r1)
8006B70C:  83E1001C   lwz   r31,28(r1)
8006B710:  83C10018   lwz   r30,24(r1)
8006B714:  7C0803A6   mtlr   r0
8006B718:  38210020   addi   r1,r1,32
8006B71C:  4E800020   blr   
[/spoiler]
You can pm me, I've got time for your troubles.

Patedj

#44
I'm thinking to stop 8006B698:  888319DC   lbz   r4,6620(r3) ( it doesn't load in towns)
and changing it to

lbz   r4,6620(r3)
stwu r1,-80(r1)
stmw r14,8(r1)  
lis r15, 0x801F
ori r15,r15,0xB3DA

lhz r15,4(r15)  
cmpwi r15,0x400  
bne- _END

addi r4,r4,1  
cmpwi r4,66  
ble- _STORE
li r4,0          

_STORE:
stb   r4,6620(r3)

_END:
lmw r14,8(r1)  
addi r1,r1,80  

but in normal wiird code type
You can pm me, I've got time for your troubles.