ROM Hack Zelda Spirit Tracks - Using AP patch and D-pad patch at the same time

[Deleted User]

Has anyone managed to do this or know of any way to do it? I'm trying to run Spirit Tracks from my flash cart with the Dpad patch applied. I've tried applying the AP patch and then the D-pad patch to a ROM (and vice-versa) and it causes the game to not boot. I've also tried applying the AP patch to a rom and then building the D-pad patch from source using that rom (https://github.com/StraDaMa/Legend-of-Zelda-Spirit-Tracks-D-Pad-Patch) but that also results in the game not booting.

I have gotten the D-pad patch to work by booting the game using TWLoader on my 3DS with a legit DS cart inserted, but the game lags sometimes with TWLoader, plus I like to leave my flashcart in my 3DS for my DS games and not worry about cartridges.


For anyone interested:
Dpad patch
https://gbatemp.net/threads/legend-of-zelda-spirit-track-d-pad-patch.374773/

AP patch
https://gbatemp.net/threads/ap-patch-preservation.477536/

 

[FAST6191]

Two main scenarios.

1) The two different patches presumably both work on the binary but their respective rebuilds are not compatible with each other
2) The two different binary patches conflict in some manner.

2) is unlikely here; AP tends to be a matter of disabling it by overwriting the checks/forcing them to come back good which is typically done in place for the DS*, adding functionality to use the Dpad will tend to involve adding things. 2) happens more when you have two things trying to add extra functionality and using the same extra space for their expanded code, or two things handling the same concept (say text handling for the more common scenario) and thus conflicting.

*as far as I know there are no challenges like the Banjo Tooie thing for the N64. That is getting off topic though.



Best bet here is do the ap patch. Rip it apart with ndstool and grab the changed files (presumably arm9.bin and maybe some overlays but check -- any number of file compare tools will do, and if not then zip them all up and compare CRC32 values in their respective windows)

Do the dpad patch on a clean ROM. Rip it apart with ndstool (or equivalent) and have a look to see what changed (probably the ARM9 again but maybe the ARM7 as well).

If it is just the ARM9.bin files that are changed you will need a way to merge both changes. I don't know if compression will get involved here, if it is then decompress as well (crystaltile2 lies a lot about detecting compression, Cue's DS compressors should handle things here -- https://www.romhacking.net/utilities/826/ ) and recompress after the fact. Remember DS binaries use BLZ format rather than the more common DS BIOS formats (aka type 10 or type 11 LZ) but again Cue's tools have you covered.

Here I would then make an IPS (you want a nice dumb format, not something that tries to be smart like xdelta unless you want to force it to ignore source verification/checking) to patch the original (but decompressed if necessary) ARM9 into the decompressed AP patched ARM9.

Take this IPS and apply it to the (decompressed if necessary) ARM9.bin of the dpad patched ROM. As the AP patching and dpad patching should not interact for this then all is good. Recompress if necessary. Repeat for any overlays that also changed for the AP patch.

Finally rebuild the dpad patched ROM with this combined ARM9.bin file. Hopefully that should get you what you want. Personally I would suggest just getting a flash cart but if you want to use the compatibility layers then play it how you will.

Option 2. Apparently Spirit Tracks was released prior to my copy of the Wood RPG source code being bundled so the patches for it are still in there. If push comes to shove we can figure out where the patches need to be and insert them manually on top of the dpad stuff.

"//BKIE: 4527 - Legend of Zelda, The - Spirit Tracks (USA) (En,Fr,Es) {0x4a484b42,0x0200ef6c,0x02000bc0},
//BKIP: 4544 - Legend of Zelda, The - Spirit Tracks (Europe) (En,Fr,De,Es,It) {0x4a374d42,0x0200cd34,0x02000340},

If memory serves the way wood RPG did its patches was essentially use the cheat functionality to patch the binary in memory. I am guessing those are the addresses and payloads. You will need a decompressed binary, and to be aware of where it lands in memory (ndsts will tell you that http://www.no-intro.org/tools.htm ) to make sure it lands where it needs to land. If those are the whole AP patch thing for this game (possible -- 2009 was still fairly sane for AP) then even better.

 

[Deleted User]

Two main scenarios.

1) The two different patches presumably both work on the binary but their respective rebuilds are not compatible with each other
2) The two different binary patches conflict in some manner.

2) is unlikely here; AP tends to be a matter of disabling it by overwriting the checks/forcing them to come back good which is typically done in place for the DS*, adding functionality to use the Dpad will tend to involve adding things. 2) happens more when you have two things trying to add extra functionality and using the same extra space for their expanded code, or two things handling the same concept (say text handling for the more common scenario) and thus conflicting.

*as far as I know there are no challenges like the Banjo Tooie thing for the N64. That is getting off topic though.



Best bet here is do the ap patch. Rip it apart with ndstool and grab the changed files (presumably arm9.bin and maybe some overlays but check -- any number of file compare tools will do, and if not then zip them all up and compare CRC32 values in their respective windows)

Do the dpad patch on a clean ROM. Rip it apart with ndstool (or equivalent) and have a look to see what changed (probably the ARM9 again but maybe the ARM7 as well).

If it is just the ARM9.bin files that are changed you will need a way to merge both changes. I don't know if compression will get involved here, if it is then decompress as well (crystaltile2 lies a lot about detecting compression, Cue's DS compressors should handle things here -- https://www.romhacking.net/utilities/826/ ) and recompress after the fact. Remember DS binaries use BLZ format rather than the more common DS BIOS formats (aka type 10 or type 11 LZ) but again Cue's tools have you covered.

Here I would then make an IPS (you want a nice dumb format, not something that tries to be smart like xdelta unless you want to force it to ignore source verification/checking) to patch the original (but decompressed if necessary) ARM9 into the decompressed AP patched ARM9.

Take this IPS and apply it to the (decompressed if necessary) ARM9.bin of the dpad patched ROM. As the AP patching and dpad patching should not interact for this then all is good. Recompress if necessary. Repeat for any overlays that also changed for the AP patch.

Finally rebuild the dpad patched ROM with this combined ARM9.bin file. Hopefully that should get you what you want. Personally I would suggest just getting a flash cart but if you want to use the compatibility layers then play it how you will.

Option 2. Apparently Spirit Tracks was released prior to my copy of the Wood RPG source code being bundled so the patches for it are still in there. If push comes to shove we can figure out where the patches need to be and insert them manually on top of the dpad stuff.


If memory serves the way wood RPG did its patches was essentially use the cheat functionality to patch the binary in memory. I am guessing those are the addresses and payloads. You will need a decompressed binary, and to be aware of where it lands in memory (ndsts will tell you that http://www.no-intro.org/tools.htm ) to make sure it lands where it needs to land. If those are the whole AP patch thing for this game (possible -- 2009 was still fairly sane for AP) then even better.

Thanks for your reply!

Ok, so the only files the AP patch modifies are arm9.bin and header.bin

Cue's BLZ decompresser says the arm9.bin file is not compressed so I went ahead and created the IPS patch like you said. The game boots and goes to the title and lets me create a new save file, but as soon as the intro cinematic ends it crashes. Upon further examination of the original, dpad patched, and AP patched arm9.bin files, it appears that there's several places where all three files differ

The AP patch does insert a custom screen as soon as the game starts (it says "XENOPHOBIA") that requires a button press before the nintendo logo and title screen play, so there's more going on in the arm9.bin then just AP patching. Do you think it's worth trying to remove the added screen and button press from the patch? Maybe that's causing issues with overwriting things with the IPS patch.

 

[FAST6191]

If the AP patch adds an intro then that could well, indeed probably will, change matters -- recall the part about adding things to the game and using the same space...
While I knew there were intros I did not know they were that common on the DS.

In that case if there is a no intro version of the patch do that.

While the above quoted section might be it for the NA and EU version of the game you might as well have my copy of woodrpg. Can't remember what file specifically the patch was in (for the quote above I had everything in one file as I did not have a good grep program available last night/this morning) but probably in the arm9 sources directory and one of the patches files. The 4 character things at the start of those are the parts of the ROM serial if that helps.

If it really came down to it then you could possibly redo the intro to avoid the issues or defeat the anti piracy yourself (could go from scratch, or more likely figure out what is related to the intro and what is related to the anti piracy protection from the existing stuff) but let us not go there right now.

 

[Deleted User]

If the AP patch adds an intro then that could well, indeed probably will, change matters -- recall the part about adding things to the game and using the same space...
While I knew there were intros I did not know they were that common on the DS.

In that case if there is a no intro version of the patch do that.

While the above quoted section might be it for the NA and EU version of the game you might as well have my copy of woodrpg. Can't remember what file specifically the patch was in (for the quote above I had everything in one file as I did not have a good grep program available last night/this morning) but probably in the arm9 sources directory and one of the patches files. The 4 character things at the start of those are the parts of the ROM serial if that helps.

If it really came down to it then you could possibly redo the intro to avoid the issues or defeat the anti piracy yourself (could go from scratch, or more likely figure out what is related to the intro and what is related to the anti piracy protection from the existing stuff) but let us not go there right now.

So I was able to use this tool on the clean rom, which gave me the exact addresses in the arm9.bin file that need to be changed to patch out the AP. I manually edited the values in the dpad patch's arm9.bin so I could be sure it wasn't overwriting anything and it seems to work perfectly now! Thanks for your help!


I'll contact the dpad patch's creator and see if he wants this included in his patch, otherwise I'll post a patch here for anyone who wants it.


In the meantime, if anyone is interested here are the values to change in arm9.bin after applying the dpad patch:

00000010: 0B A0 1B 93 33 2F AF B4 24 CD AB A3 09 57 A0 93 → 1C 00 9F E5 00 10 90 E5 18 20 9F E5 02 00 51 E1
00000020: 41 58 96 E0 37 27 E0 DE A2 FD B2 0E D2 10 E8 FA → 9E 10 A0 03 08 10 C0 05 AD 10 A0 03 C4 10 C0 05
00000030: 97 6F 80 1C 7C FE 54 EA 33 77 B2 AA → 1E FF 2F E1 84 0A 0C 02 00 D7 09 E0
000009F8: 1E FF 2F E1 → 84 FD FF EA

 

[LPW00]

In the meantime, if anyone is interested here are the values to change in arm9.bin after applying the dpad patch:

00000010: 0B A0 1B 93 33 2F AF B4 24 CD AB A3 09 57 A0 93 → 1C 00 9F E5 00 10 90 E5 18 20 9F E5 02 00 51 E1
00000020: 41 58 96 E0 37 27 E0 DE A2 FD B2 0E D2 10 E8 FA → 9E 10 A0 03 08 10 C0 05 AD 10 A0 03 C4 10 C0 05
00000030: 97 6F 80 1C 7C FE 54 EA 33 77 B2 AA → 1E FF 2F E1 84 0A 0C 02 00 D7 09 E0
000009F8: 1E FF 2F E1 → 84 FD FF EA

I don't quite get how to do this... As there is no update on the dpad patch's github, i guess contacting the creator didn't work out? Could u please upload the patch?

 

[FAST6191]

I don't quite get how to do this... As there is no update on the dpad patch's github, i guess contacting the creator didn't work out? Could u please upload the patch?

The patch creator might make a separate patch one day but by and large most ROM hackers don't take out anti piracy as part of their hacks.

Still that was described above looks to be a simple replace this with that type setup, and prior to that it was also noted that the patch collection on https://gbatemp.net/threads/repack-...ild-1215-includes-cmp-and-ap-database.477193/ did the deed.

Anyway
Get a hex editor. We tend to suggest https://mh-nexus.de/en/hxd/ if you don't have one you already like.

The bulk of the window when the file is opened will be taken up by three main things. On the left in most hex editors is the location in the file. In the middle is the data of the file itself and on the right is the data if you convert it to text of various formats (usually ASCII but can be others).

At 00000010 in the ARM9.bin of the file. This means go to 10 in the file (will be very near the start)
At that point you should see some data "0BA0 1B93 332F AFB4 24CD ABA3 0957 A093"
1C 00 9F E5 00 10 90 E5 18 20 9F E5 02 00 51 E1
Highlight that part in the middle section. Paste over it the following 1C009FE5001090E518209FE5020051E1

Repeat for the other three sections.
20h then change to 9E10A0030810C005AD10A003C410C005

30h then change to 1EFF2FE1840A0C0200D709E0

9F8 then change to 84FDFFEA

9F8 will probably not be on the start of the line so make sure to navigate to it (if the line starts 9F0 then count along 8), presumably you will then be seeing 1EFF 2FE1 at that point and can get ready to overwrite it.

 

[LPW00]

At 00000010 in the ARM8.bin of the file

I don't even know how to get to the arm8.bin... And that ds-scene tool would be very handy, if i could get it to run...

 

[FAST6191]

I don't even know how to get to the arm8.bin...

That was supposed to say arm9.bin. My bad.

When you pull apart a DS game (any number tools do this -- ndstool which has frontends in dsbuff and dslazy, crystaltile2, ndsts, tinke) it will almost always have a file called arm9.bin which is the part of the program that runs on the main DS CPU. In this case you should be able to pull it out, do the editing and insert it back in again, but if you want to do a full unpack and rebuild then that also works.

 

[LPW00]

Okay, I got it. Thx, @joesteve1914 and @FAST6191.

 

[t1op]

So I was able to use this tool on the clean rom, which gave me the exact addresses in the arm9.bin file that need to be changed to patch out the AP. I manually edited the values in the dpad patch's arm9.bin so I could be sure it wasn't overwriting anything and it seems to work perfectly now! Thanks for your help!


I'll contact the dpad patch's creator and see if he wants this included in his patch, otherwise I'll post a patch here for anyone who wants it.


In the meantime, if anyone is interested here are the values to change in arm9.bin after applying the dpad patch:

00000010: 0B A0 1B 93 33 2F AF B4 24 CD AB A3 09 57 A0 93 → 1C 00 9F E5 00 10 90 E5 18 20 9F E5 02 00 51 E1
00000020: 41 58 96 E0 37 27 E0 DE A2 FD B2 0E D2 10 E8 FA → 9E 10 A0 03 08 10 C0 05 AD 10 A0 03 C4 10 C0 05
00000030: 97 6F 80 1C 7C FE 54 EA 33 77 B2 AA → 1E FF 2F E1 84 0A 0C 02 00 D7 09 E0
000009F8: 1E FF 2F E1 → 84 FD FF EA

I assume you didn't hear back from the Dpad creator. Would you be willing to post a modified patch here? My nephew wants to play the game with a dpad on his DSI. Is it possible to incorporate the AP and DPAD patches into a single patch? Either way, if you save me from having to apply AP then Dpad patches, take the rom apart, hex edit it, then put it back together, that would be awesome! (That is the right procedure, I gather.)

 

[shunkazami37]

I assume you didn't hear back from the Dpad creator. Would you be willing to post a modified patch here? My nephew wants to play the game with a dpad on his DSI. Is it possible to incorporate the AP and DPAD patches into a single patch? Either way, if you save me from having to apply AP then Dpad patches, take the rom apart, hex edit it, then put it back together, that would be awesome! (That is the right procedure, I gather.)

Sorry for bumping this old thread but here is the file for AP + Dpad if you still want it