Hacking Understanding and changing Snes VC RPX settings

the_randomizer

The Temp's official fox whisperer
OP
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
So, with the advent of Loadiine being an extremely useful and versatile app for the Wii U homebrew scene, it got me to thinking on what could be done with Virtual Console games, notably with DS games as there are config files that increase their internal resolution. Now, the thing that bothered me the most about the Wii U VC is that GBA games have filtering, DS games have filtering, as do NES, but not Snes for one reason or another. Some may debate that they like the unfiltered pixels and that's fine, but in my case (well and others' too), they tend to be painful at 1080p. With that being said, Snes RPX files surely have to store the emulator settings in there for filtering and/or the aspect ratio. What I need help with is figuring out where to look, which offsets to scan and search and if this is even remotely possible to change.

@ShadowOne333 suggested that I use a hex editor to see what can be found and I've been doing so for the past bit, trying to find out where to begin my search. I know to some this may seem odd or trivial, but if anything, I want to be able to learn a bit of hacking on my own by figuring out RPX files work, and thank you for your time ^_^

I don't want to give up on figuring out a way to do this, not now, because I feel like I'm so close to figuring it out :P


UPDATE 5/11/2016

Disclaimer:
You will need the Wii U SDK, but I can't give it out, so please get that on your own!!

Guide to doing this, as quoted from @shutterbug2000, so a huge thanks to him for Snes VC hacking :D

quoted from @shutterbug2000,

Here's a basic guide:
Code:
Run rpl2elf on the dumped .rpx.
Open the elf in a hex editor and search for 392003563860(hex)
Replace the 0356 part with 0280
Search again for 043838E0078090(hex) and replace the 0438 with 01E0 and the 0780 with 0280
Convert back to rpx by running in the sdk tools folder:
set CAFE_ROOT=../../../
makerpl64 -f -z8 -old -s name.elf
Copy back to sd card and run with loadiine.
Done![

How to inject Snes/NES ROMs into RPX files

You will need the following programs:

1 - rpx2elf: located in this thread here https://gbatemp.net/threads/tutorial-how-to-decompress-and-repack-rpx-rpl-files.399934/
2 - makerpl64: This is included with the Wii U Cafe SDK, I cannot provide this as it is copyrighted, so I trust people to get this on their own.
3 - Titledumper/DDD: For extracting Virtual Console games over a network to your PC
http://gbatemp.net/threads/ddd-wiiu-title-dumper.418492/
4 - HxD or any free hex editor program of your choice, the process is the same :P For this tutorial I will be using HxD as it's easy to start up and quick for searching for ROM swapping.
https://mh-nexus.de/en/hxd/

I should note that while ELF/RPX injection is higher compatability than RAM injection methods, not all games are going to work with perfect emulation, some games like Chrono Trigger has a minor visual bug where the screen flickers whenever you enter a battle and enter commands.

Open up .RPX with the hex editor, along with the ROM you wish to inject it with, for example, WUP-JANE.elf (which is the NTSC version of Kirby's Dream Land 3), and then another ROM to match up, use for comparison to find the offsets in the RPX file. So you should have three tabs.

- Go to the first line of the ROM file, the ROM I injected earlier was Power Rangers The Movie, the beginning of this game will contain the offset 78D818FB.

- Go back to the Kirby tab, you'll need the Kirby Dream Land 3 ROM open as well, this will tell you where to inject Power Rangers into the ELF file (and thus can be used as a template for others).

- Once you match up the Kirby ROM with the Kirby ELF, you highlight it at the first ROM offset within said RPX file as they both should match up. We will now specify how much to highlight in the RPX file.

- Kirby's Dream Land 3 is 4 MB in length, so you will need to highlight the entire ROMs code.

Starting offset: 00FCB080
Length of selection: 4 MB or 400000 or until the beginning and the end match up to the separate ROM file. Now, we go back to the Power Rangers ROM, highlight all the ROM code, copy.

- Now, in the WUP-JANE.elf paste-write to replace the Kirby's Dream Land 3 code, it will look red, this is normal, after you've injected Power Rangers's code into WUP-JANE.elf, save and exit.

Once you're done swapping out the code from one game into the Elf file:

Follow the normal conversion process to converting ELF to RPX. Place it in an appropriate game folder with code and content folders as any other Loadiine game :P

Hopefully I did a decent job explaining it, I don't know, but if you have any concerns or questions, let me know :P :D


Another update 5-15-16

Retroinject method to injecting ROMs in to Snes and NES games,

Found a guide on Reddit where it shows there's an injection method using a command-line program posted here

https://www.reddit.com/r/WiiUHacks/comments/4igfgz/injecting_roms_into_vc_games/

To quote

1) open the command prompt and run rpl2elf like this: rpl2elf mahgaem.rpx mahgaem.elf

2) run RetroInject.exe like this: retroinject mahgaem.elf verygud.smc coolfile.elf

3) open up your cafe_sdk (also, make sure the path doesn't contain spaces), and run cafex_env.bat that should make a command prompt appear.

4) the makerpl64 utility should be in your path now. run it like: makerpl64 -z9 -f -s -old coolfile.elf

5) now you have coolfile.rpx

6) enjoy

use snesROMUtil.exe to make sure that the size of base rom is greater or equal to injected rom, and that they are both lorom/hirom.

Essentially, the same as replacing ROMs as we had done before, and you still will need the Wii U SDK tools for all this, and I won't be providing them, but this will make it a lot easier to test injections :P


Update as of 10/13/16

An excellent find from user @AlanLC for resizing or rather, forcing the Snes and NES aspect ratios to
scale better than the default settings! :D

Perfect Pixel NES SNES

Run rpl2elf on the dumped .rpx.
Open the elf in a hex editor Search for 043838E0078090(hex) and replace the 0780 with 095F (NES)

Open the elf in a hex editor Search for 043838E0078090(hex) and replace the 0780 with 08C0 (SNES)

Convert back to rpx by running in the sdk tools folder:
set CAFE_ROOT=../../../
makerpl64 -f -z8 -old -s name.elf

Copy back to sd card and run with loadiine.
Done!





 
Last edited by the_randomizer,

ShadowOne333

QVID PRO QVO
Editorial Team
Joined
Jan 17, 2013
Messages
12,177
Trophies
2
XP
33,542
Country
Mexico
I say whatever information any user could provide is useful.
The same gos for NES and GBA settings, as those are the ones that cannot be changed at the moment.

Mostly, I would like to see a way to modify the aspect ratio and force it to full screen, and also a way to correct the gamma of the video output, since the colour of the VC titles is darker than in the original console.

The settings for the emulator must be stored inside the main RPX file of each VC title.
Like WUP-XXXX.rpx, where XXXX is the title ID of the VC title.

We can try reverse engineering the RPX via a Hex editor, or we can try to decompile it by using something like IDA Pro or something similar.
 
  • Like
Reactions: the_randomizer

the_randomizer

The Temp's official fox whisperer
OP
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
I say whatever information any user could provide is useful.
The same gos for NES and GBA settings, as those are the ones that cannot be changed at the moment.

Mostly, I would like to see a way to modify the aspect ratio and force it to full screen, and also a way to correct the gamma of the video output, since the colour of the VC titles is darker than in the original console.

The settings for the emulator must be stored inside the main RPX file of each VC title.
Like WUP-XXXX.rpx, where XXXX is the title ID of the VC title.

We can try reverse engineering the RPX via a Hex editor, or we can try to decompile it by using something like IDA Pro or something similar.

I'll be using HxD in the mean time looking at the different offsets/addresses, bytes, etc to see what I can find. I wish I could find a way to decompile, and it's obvious that Nintendo uses universal settings for all Snes games, at least as far as one can tell.
The gamma needs correcting and I really do hope more people look into this and gain interest.
 

asper

Well-Known Member
Member
Joined
May 14, 2010
Messages
942
Trophies
1
XP
2,030
Country
United States
1st of all you need to convert/decompress your rpx in elf; from here you can start debugging the executable ;)

Then you can try to find the memory offset in which the byte is stored using pyGecko changing it inside the console game while "harvesting" the memory in search of changed bytes.
 
Last edited by asper,
  • Like
Reactions: the_randomizer

the_randomizer

The Temp's official fox whisperer
OP
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
1st of all you need to convert/decompress your rpx in elf; from here you can start debugging the executable ;)

Now, uh, how would we go about doing that, if we may ask? Is there a tutorial on doing so? And I found a the IDA freeware and it shows a lot of info. Would we be able to find the information we need to change gamma, resolution, filtering once it's an elf file?

Any info on how to do this will be of great help.
 
Last edited by the_randomizer,

asper

Well-Known Member
Member
Joined
May 14, 2010
Messages
942
Trophies
1
XP
2,030
Country
United States
WiiU SDK and related tools. They are copyrighted so... use your google-fu :)
Hint: Cafe_SDK-2.12.13

The command to use is: rpl2elf filename.rpx filename.elf
but 1st you need to set the correct environment in your Win system otherwise the command will not be recognized.
 
Last edited by asper,

the_randomizer

The Temp's official fox whisperer
OP
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
WiiU SDK and related tools. They are copyrighted so... use your google-fu :)
Hint: Cafe_SDK-2.12.13

No worries, I totally understand, they won't be linked them here, but once converted, do we use a hex editor to find and change the values? Then we change it back to .RPX format? :P

I really hope we can figure it out.
 
Last edited by the_randomizer,

asper

Well-Known Member
Member
Joined
May 14, 2010
Messages
942
Trophies
1
XP
2,030
Country
United States
Yeah but to look for a specific setting value you need to know what to search so 2 ways:
1 - IDA (in that way you will create a "patch" to change this option - you need to know asm code)
2 - Memory search with pyGecko (in that way you will produce a "cheat" to activate/deactivate the option - you only need to search in memory without knowing so much asm)
 

the_randomizer

The Temp's official fox whisperer
OP
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
Yeah but to look for a specific setting value you need to know what to search so 2 ways:
1 - IDA (in that way you will create a "patch" to change this option - you need to know asm code)
2 - Memory search with pyGecko (in that way you will produce a "cheat" to activate/deactivate the option - you only need to search in memory without knowing so much asm)

Oh man....not cool, because I don't know assembly at all, wouldn't looking at them with HxD be pretty much the same thing as PyGecko? To be honest I never used that app before. I'd much rather the results be permanent and not a cheat code per se, but that's just me.
 

the_randomizer

The Temp's official fox whisperer
OP
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
Hey it's cool.
We could keep trying to find whatever we can and maybe someone might climb up and try to figure this out.

I converted the RPX to ELF and found some interesting strings that have GX2 commands that seem to include TV size Aux color buffer, and what seem to be filters, all starting off offset 0000001C, 00000010, etc, having quite an extensive list.

http://i.imgur.com/255IHie.png
 
  • Like
Reactions: ShadowOne333

ShadowOne333

QVID PRO QVO
Editorial Team
Joined
Jan 17, 2013
Messages
12,177
Trophies
2
XP
33,542
Country
Mexico
I converted the RPX to ELF and found some interesting strings that have GX2 commands that seem to include TV size Aux color buffer, and what seem to be filters, all starting off offset 0000001C, 00000010, etc, having quite an extensive list.

http://i.imgur.com/255IHie.png
YES!
Now we are getting somewhere. :D

Now we got what seems to be the offsets for the instructions the emulators uses to set certain parameteres for the games.
If someone good enough with ARM could help out, that'd be awesome. Maybe some of the devs in the Wi U community could help here since they are somewhat familiar with those instructions.

@the_randomizer could you stretch the little window in the lower right (The one with the GX2 commands) a little bit so that we can see the full address?
That'd be helpful. Also, I think mentioning what game is this, as well as the full filename of the original RPX file as well as its checksum if someone wants to try it out.

My guess is that the functions we should focus on should bbe GX2CalcTvSize, GX2CalcSurfaceSizeAndAlignment and GX2CalcDRCSize if we want to try to change the video output aspect ratio..
IIRC DRC is what the configuration.json file from the DS VC titles use to reference the Gamepad, so that one might be important to change the size of the aspect ratio in the Gamepad. Could you double check if the configuration.json file of a DS VC dump has DRC and the resolution set to 854x480?
 
Last edited by ShadowOne333,
  • Like
Reactions: the_randomizer

ShadowOne333

QVID PRO QVO
Editorial Team
Joined
Jan 17, 2013
Messages
12,177
Trophies
2
XP
33,542
Country
Mexico
If you could find a way to get fullscreen or bilinear filter, I will marry you.
Don't forget gamma correction. :P
If we can find the address to change the gamma correction, we could choose which GBA games enable it and which don't.
THat would make up for a lot of GBA games that had over saturated colours to compensate for the original GBA's unlit screen. :D

Oh god the possibilities!
 

the_randomizer

The Temp's official fox whisperer
OP
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
Don't forget gamma correction. :P
If we can find the address to change the gamma correction, we could choose which GBA games enable it and which don't.
THat would make up for a lot of GBA games that had over saturated colours to compensate for the original GBA's unlit screen. :D

Oh god the possibilities!


Found some more offsets and their strings, which I hope are correct :P GX2 commands are located between



Code:
GX2CalcTVSize
Segment: 017FF84B
Line: 211216 of 211646
Length: 000000E


GX2CalcTVAspectRatio
Segment: 017FF9D4
Line: 211267
Length: 0000001A


GX2CalcTVScanMode
Segment: 017FF9EE
Line: 211268
Length: 00000017


GX2InitSamplerXYFilter (possible filtering)
Segment: 017FFAA4
Line: 211277
Length: 00000017


GX2InitSamplerZMFilter (possible filtering)
Segment: 017FFABB
Line: 211278
Length: 00000017


GX2GetDebugOptions (Debug option menu?)
Segment: 017FFB6D
Line: 211287
Length: 00000014


GX2SetTVGamma
Segment: 017FFF1B
Line: 211335
Length: 0000000E

017FF97E and end at 01800006

Suffice to say, this are only some of the GX2 functions located at these addresses, I can look for mode and list them as I dive deeper into the code :P
 
Last edited by the_randomizer,
  • Like
Reactions: VinsCool

VinsCool

Persona Secretiva Felineus
Global Moderator
Joined
Jan 7, 2014
Messages
14,600
Trophies
4
Location
Another World
Website
www.gbatemp.net
XP
25,207
Country
Canada
Found some more offsets and their strings, which I hope are correct :P GX2 commands are located between



Code:
GX2CalcTVSize
Segment: 017FF84B
Line: 211216 of 211646
Length: 000000E


GX2CalcTVAspectRatio
Segment: 017FF9D4
Line: 211267
Length: 0000001A


GX2CalcTVScanMode
Segment: 017FF9EE
Line: 211268
Length: 00000017


GX2InitSamplerXYFilter (possible filtering)
Segment: 017FFAA4
Line: 211277
Length: 00000017


GX2InitSamplerZMFilter (possible filtering)
Segment: 017FFABB
Line: 211278
Length: 00000017


GX2GetDebugOptions (Debug option menu?)
Segment: 017FFB6D
Line: 211287
Length: 00000014


GX2SetTVGamma
Segment: 017FFF1B
Line: 211335
Length: 0000000E

017FF97E and end at 01800006
omg nice!
 

ShadowOne333

QVID PRO QVO
Editorial Team
Joined
Jan 17, 2013
Messages
12,177
Trophies
2
XP
33,542
Country
Mexico
Gonna look into the converted elf file more with IDA pro, find out and list other important GX2 functions and their locations :D
Code:
GX2CalcTVSize
Segment:017FF84B
Line:211216 of 211646
Length:000000E

GX2CalcTVAspectRatio
Segment:017FF9D4
Line:211267
Length:0000001A

GX2CalcTVScanMode
Segment:017FF9EE
Line:211268
Length:00000017

GX2InitSamplerXYFilter (possible filtering)
Segment:017FFAA4
Line:211277
Length:00000017

GX2InitSamplerZMFilter (possible filtering)
Segment:017FFABB
Line:211278
Length:00000017

GX2SetTVGamma
Segment:017FFF1B
Line:211335
Length:0000000E

Those are the most important ones for what we want to accomplish, which is change aspect ratio, bilinear filtering and OH SHIT SET TV GAMMA!
Wel at least we now know for sure that's the one for gamma correction haha.

Can I ask you to include any line you find related to DRC too?

--------------------- MERGED ---------------------------

One other thing, I'd be interesting to do the following:
Let's say you have this:
Code:
GX2SetTVGamma
Segment:017FFF1B
Line:211335
Length:0000000E

Open up the ELF file in a HEX editor and go to the exact offset where IDA says the Gamma line starts, then go to that offset and start counting bytes until you hit the lenght of the line which is 0E for SetTvGamma. Check what else is there after you get to the last byte when you reach the 0E.
Another way to do it would be to copy the entire HEX data from the offset where GX2SetTvGamma starts and up to where the next line starts, that might give us an idea of what value the code is putting for that line. For example, let's say TvGamma starts at 0x001C and the next line starts at 0x002E, copy everything in between to make sure what get everything that involves the line of SetTvGamma.
Are you following me?
 
Last edited by ShadowOne333,

the_randomizer

The Temp's official fox whisperer
OP
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
Code:
GX2CalcTVSize
Segment:017FF84B
Line:211216 of 211646
Length:000000E

GX2CalcTVAspectRatio
Segment:017FF9D4
Line:211267
Length:0000001A

GX2CalcTVScanMode
Segment:017FF9EE
Line:211268
Length:00000017

GX2InitSamplerXYFilter (possible filtering)
Segment:017FFAA4
Line:211277
Length:00000017

GX2InitSamplerZMFilter (possible filtering)
Segment:017FFABB
Line:211278
Length:00000017

GX2SetTVGamma
Segment:017FFF1B
Line:211335
Length:0000000E

Those are the most important ones for what we want to accomplish, which is change aspect ratio, bilinear filtering and OH SHIT SET TV GAMMA!
Wel at least we now know for sure that's the one for gamma correction haha.

Can I ask you to include any line you find related to DRC too?


Yeah, I just got your edited messaged, opened up IDA just now, and I'll find out more functions, and great catch with that GX2 function ^_^

Code:
GX2CalcDRCSize
Segment: 071FF7EA
Line: 221242
Length: 0000000F

GX2SurfaceSizeAndAlignment
Segment: 017FF82C
Line: 221245
Length: 0000001F


GX2CalcTVSize
Segment: 017FF84B
Line: 211246
Length: 000000E


Here ya go with those other functions ^_^ :D



Edit: Got your ninja edit, looking now
 
  • Like
Reactions: VinsCool

Site & Scene News

Popular threads in this forum

Recent Content

General chit-chat
Help Users
  • No one is chatting at the moment.
    Xdqwerty @ Xdqwerty: good night