DoA3 modding

[mopafo3971]

I guess I'll post mods here if I'll feel like it.

DISCLAIMER: all my works are CC0, you can share them without giving me any credit, you even to say that you are the author.

Story short - in DoA2Ultimate I removed all sfd video files, and the game just skips them. But in DoA3 if you remove the video, the game gets stuck at a black screen every time it tries to play a video that doesn't exist, and will continue only after you press a button. So I created a patch that will skip all DoA3 video.
You can make the game less bloated by deleting unneeded sfd video files. The only files that should be left are:
Default.xbe
dsstdfx.bin
bgm.afs
loadfile.afs
voice.afs

650MB on the disk. 350MB compressed.

DoA3_patch1

MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.

www.mediafire.com

 

[mopafo3971]

DoA 3.2
- No video
- Ein and Random unlocked by default, including the story mode.

It's troublesome to make patches for all 3 versions of DOA3. So I have some questions for you:
- What version of DoA 3 do you usually play ?
- Do you have DoA 3.2 ?
- Are you playing it ?
- Do you care about these patches, like should I make separate patches for 'NO VIDEO' and for 'EIN STORY', or is the all in one ok for you?

I discovered that 'Cheat Engine' has a simple debugger that works with CXBX. It's a bit clunky but you can set break points and follow the code. This is big.

 

[Matt Ponton]

-What version of DOA3 do you usually play?
3++, which is based of 3.1.
- Do you have 3.2?
Yes.
- Are you playing it?
Not often, just for checking emulator compatibility.
- Do you care about these patches, like should I make separate patches for 'NO VIDEO' and for 'EIN STORY', or is the all in one ok for you?
I'm interested in seeing what mods you come up with, but these two particular mods don't really interest me. Ein being in story mode is has me inquisitive over what happens when you select him (Does he just have 8 random fights then fights Genra but no ending movie?), outside of that I probably wouldn't play as him.

I would be interested in knowing more about the Cheat Engine debugger stuff. Also a boost if we're able to find out how to fix the audio issues with the stage sound effect corruption.

 

[mopafo3971]

(Does he just have 8 random fights then fights Genra but no ending movie?), outside of that I probably wouldn't play as him.

8 absolutely random fights, no cutscenes, no Genra. The initial intent was to swap the Random slot with Genra, Chen or Tengu, but Genra and Chen don't support input, Chen is invisible, and Tengu is not even converted to doa3

I would be interested in knowing more about the Cheat Engine debugger stuff. Also a boost if we're able to find out how to fix the audio issues with the stage sound effect corruption.

Sorry for the mess bellow...

First you install IDA disassembler, and disassemble the 'default.xbe', After that you'll want to apply xbox flirt signatures to recognize more decompiled functions(https://www.ngemu.com/threads/cxbx-correctness-fixes-branch.151240/page-4#post-2302769).
Basically IDA will give you a glimpse of what the source code looks like.
'View -> Open subviews -> Strings' to see all the strings IDA could recognize, double click to go to the string's location id data. Blue text is where this string is used, double click to go there. If you're in code section, press F5 to see c-like code.

Because CXBX is practically converting xbe to exe, and is keeping the original memory mapping, one could theoretically use a debugger like OllyDbg, but CXBX itself is acting as a kind of debugger, this is confusing the third party debuggers and they will not work with cxbx. Cheat engine though has an wannabe debugger that works, working in parallel with IDA could be a thing. Having cheating functionality is even better.

Cheat Engine has problems identifying the process in the memory, so a bat file or a shortcut with a command line like this one should be used:

"E:\CXBX\cxbxr-ldr.exe" /load "E:\doa3\Default.xbe"

and in CheatEngine go File -> Open Process -> cxbx-reloaded.

In the character select screen, I select a character and search with the cheat functionality for this character index(kasumi=5,zac=0,tina=1...)(with the value type set to byte), when the amount of found addresses is narrowed enough, I select the Random slot and see that two found addresses are set to 0xFF, I double click to add them to the other table, then right click on one and select "Browse this memory region". Then I can right click on the byte in the lower part of the window with green text, and choose "Data Breakpoint -> Break on write", select another character, and the breakpoint will occur. Now I look in the upper part of the window, with the code. Hardware Breakpoints are managed by the CPU and stopped after they happen, that means that the instruction above the stop is the one that has rewritten the memory. Right click on the instruction -> 'Goto Address', copy the address and paste it in IDA(press G in IDA), then press F5, and try to understand how the new value got there, with enough luck I could find the table in memory with the data describing all character slots, go with the address of that table back to cheat engine and change the first slot that belongs to kasumy to every other unplayable character and see whats going on. The list of characters from the character select screen in doa2u was suspiciously long, I checked and funny enough, it contains Cristie,BradWong and Hayate. At least we have Hitomi.

 

[Gultigargar]

Chen is invisible

This might be fix-able. Chen's .cat file is weird, certain pointers at the start of his file don't have the "right" addresses. This .cat file fixes that. It works when you use it as a custom outfit for other characters, it might also work with the random slot mod.

 

[mopafo3971]

This might be fix-able. Chen's .cat file is weird, certain pointers at the start of his file don't have the "right" addresses. This .cat file fixes that.

Yes, I remember these from when I was converting them to doao. A lot of cat files with a broken header.

It works when you use it as a custom outfit for other characters, it might also work with the random slot mod.

Is there a way to play as Chen or Genra? I mean to control them with the gamepad.

 

[Matt Ponton]

Is there a way to play as Chen or Genra? I mean to control them with the gamepad.

Yes, used to be a video or two of playing Genra and his movelist, but videos were deleted by YT for reasons.

Sorry for the mess bellow...

Hm, I don't have access to IDA Pro. I do have Ghidra though.

Also, you can connect to the cxbxr-ldr.exe from the Processes tab of the Process menu in CE.

 

[mopafo3971]

Yes, used to be a video or two of playing Genra and his movelist, but videos were deleted by YT for reasons.

So it's doable then.

Hm, I don't have access to IDA Pro. I do have Ghidra though.

There is a free version of IDA, which should be fine.

Also, you can connect to the cxbxr-ldr.exe from the Processes tab of the Process menu in CE.

You're actually right.

As for the cxbx save files. Transferring save files between cxbx instances should be fine. The limitation is only related to transferring savefiles between an actual xbox and cxbx.

And you mentioned that you play 3++. Do you have to watch the fbi warning every time you start the game?

 

[Matt Ponton]

There is a free version of IDA, which should be fine.

Sadly it says it doesn't support XBE. I've been trying to see if I can use Ghidra but can't attach it to something like CXBX-R atm.

As for the cxbx save files. Transferring save files between cxbx instances should be fine. The limitation is only related to transferring savefiles between an actual xbox and cxbx.

Last I've attempted, any time you move the save files from their location to another instance even if it's one cxbx-r version to the next, i've gotten corrupted saves. But now adays i just update the program files around the designated location so they'll reference the same location.

Do you have to watch the fbi warning every time you start the game?

3++ is the Japanese version of the game, so it's a single page that's up for a few seconds that we've replaced to saying it's a fan mod and it shouldn't be resold for profit. Yes I watch it each time since it's not a bother, and for some reason with CXBX-R any time I boot the game on its second or more boot I have to mash Start to get to the Tecmo logo otherwise the application will hang. Resets every time the PC is restarted, then it will work for first boot again. Happens for me regardless of doa3 version though.

 

[mopafo3971]

Sadly it says it doesn't support XBE.

Free torrent edition could be an option then. It's not stealing if it's for science.

I've been trying to see if I can use Ghidra but can't attach it to something like CXBX-R atm.

GitHub - XboxDev/ghidra-xbe: Xbox Executable Format (XBE) Loader Extension for Ghidra SRE framework

Xbox Executable Format (XBE) Loader Extension for Ghidra SRE framework - XboxDev/ghidra-xbe

github.com

3++ is the Japanese version of the game, so it's a single page that's up for a few seconds that we've replaced to saying it's a fan mod and it shouldn't be resold for profit. Yes I watch it each time since it's not a bother, and for some reason with CXBX-R any time I boot the game on its second or more boot I have to mash Start to get to the Tecmo logo otherwise the application will hang. Resets every time the PC is restarted, then it will work for first boot again. Happens for me regardless of doa3 version though.

3++ doesn't start for me in cxbx. Just a black screen and a 100% loaded cpu core.

 

[Matt Ponton]

Free torrent edition could be an option then. It's not stealing if it's for science.

Sadly so many free editions I'm not sure which ones to trust.

GitHub - mborgerson/ghidra-xbe: Xbox Executable Format (XBE) Loader Extension for Ghidra SR

Yes, I have that. It allows for you to analyze the XBE format. He also provides Header files you have to use a Make script to run to use properly as well. However, none of it allows for Ghidra to attach to an active process for CXBX-R.

3++ doesn't start for me in cxbx. Just a black screen and a 100% loaded cpu core.

That's strange considering it works fine for everyone else I've worked with it.

 

[mopafo3971]

Edit the xbe file for your game in a hex editor to improve your game experience.

DEAD OR ALIVE 3.0 NTSC-US (default.xbe)

Skip the federal warning:                          - go to address 0x012313, and set 09 to 03
Set the tecmo logo display time to 0:              - go to address 0x0733C5, and set A8 to 00 
No intro and ending videos:                        - go to address 0x071EB0, and set 0F to C3 
Unlock all costumes in new game:                   - go to address 0x011545, and set 02 to 09
Use all 7 extra skins loaded from the save folder: - go to address 0x0B8172, and set 7D to EB
Unlock Ein and add to story mode:                  - go to address 0x0B7D18, and set 74 15 to EB 09

DEAD OR ALIVE 3.1 NTSC-JP (default.xbe)

Skip the federal warning:                          - go to address 0x011188, and set 09 to 03
Skip the tecmo logo:                               - go to address 0x07A486, and set 7E to EB 
No intro and ending videos:                        - go to address 0x07AD80, and set 0F to C3 
Unlock all costumes in new game:                   - go to address 0x0108E5, and set 02 to 09
Use all 7 extra skins loaded from the save folder: - go to address 0x0BD7ED, and set 7D to EB
Unlock Ein and add to story mode:                  - go to address 0x0BD9E4, and set 74 2C to EB 09

DEAD OR ALIVE 3.2 PAL-EU (default.xbe)

Skip the tecmo logo:                               - go to address 0x07A5E6, and set 7E to EB 
No intro and ending videos:                        - go to address 0x07AEE0, and set 0F to C3
Unlock all costumes in new game:                   - go to address 0x010905, and set 02 to 09
Use all 7 extra skins loaded from the save folder: - go to address 0x0BD88D, and set 7D to EB
Unlock Ein and add to story mode:                  - go to address 0x0BDA84, and set 74 2C to EB 09

DEAD OR ALIVE 3 booster pack (doa3b.xbe) (https://www.freestepdodge.com/threads/doa3-beta-in-the-wild-apparently.8758/post-411504)

Show all characters* except Ein :      - go to address 0x0B4148, and set 5E to 00 
Swap brocken Random with a fighter**:  - go to address 0x26F7BA, and set FF to 03-Ein,11-Tengu,12-Genra
*not playable (yet)
**check the full DOA3 list of characters in the next post

DEAD OR ALIVE Xtreme Beach Volleyball NTSC-EN/JP (default.xbe)
Skip the federal warning:              - go to address 0x094F56, and set 75 12 to EB 19

 

[mopafo3971]

Full DOA3 list of characters:

00 Zac   ZACK
01 Tin   TINA ARMSTRONG
02 Jan   JANN LEE
03 Kte   EIN
04 Ryu   RYU HAYABUSA
05 Kas   KASUMI
06 Gen   GEN FU
07 Hik   HELENA
08 Bay   LEON
09 Bas   BASS ARMSTRONG
0a Hak - HAKKYOKU-KEN
0b Nin   HAYATE
0c Lei   LEIFANG
0d Aya   AYANE
0e Kor   HITOMI
0f One - K-1
10 Pro - PRO WRESTLER
11 Tng + TENGU
12 BNi + GENRA
13 Sui   BRAD WONG
14 Gok   CHRISTIE
15 Tek - TEKONDO
16 Dem - DEMI HUMAN
17 Chi + CHIN
18 Sam   BAYMAN

Found in wazaaa's folder my old notes on doa skeletons, a note says that doax shares the same list as doa3. And guess what, lisa is on position 0xf, she is the K-1 kickboxer. She was late for doa3, but in time for the jiggling-boobies island. And on position 0xa in doax is prarie-dog, was he supposed to be a secret boss in doa3? The ultimate hakkyokuken fighter, and the greatest mastermind behind all genra's actions? We'll never know.

 

[mopafo3971]

The idea to bring back the canceled characters to the game appeals to me. I looked into the function that loads costumes from the save folder, the function checks if it's genra or tengu and skips them, also tengu's three letters name is changed to three spaces ' '. I disabled the filtering and changed tengu's name back to 'tng'. Put costumes named 'tng00.cat/xpr', tng01, bni00, bni01 in the save folder. Changed the characters in character selection screen to tengu, genra, and other unplayable characters. Tengu and Genra loaded their costumes from the save folder. Tengu doesn't have a input lock, that means that he can be swapped with genra or chen, with a skeleton swap, mot-bin swap, and xpr-cat costumes added to the save folder. Then the bin-mot files should be eddited with new moves to make him fully playable. Or maybe a totally new character could be created.

 

[Matt Ponton]

Yeah, I noticed the IDs for costume slots. that harddrive slots seem to start from 64 (DEC) until reaching 9 costumes. It'd be nice if we could somehow break beyond 9 costume limit, and the character limit. Gulti and I have had ideas of bringing in DOAD characters into DOA3 like Kokoro, Eliot, etc.

 

[mopafo3971]

Yeah, I noticed the IDs for costume slots. that harddrive slots seem to start from 64 (DEC) until reaching 9 costumes. It'd be nice if we could somehow break beyond 9 costume limit, and the character limit. Gulti and I have had ideas of bringing in DOAD characters into DOA3 like Kokoro, Eliot, etc.

There is a not very pleasant way to squeeze a few more costume slots. The game has lists of embedded costumes per character, then it has a list saying how many costumes are in each costume slot, but of course you can only see the first costume in the slot. Anyway I can add some costumes like hitomi with a scuba diving mask, but again, you can select these only when you know about them

Also I was trying to disable all loading screens and videos to speedup the loading process, and found an interesting thing, if you go to cxbx -> Settings -> Config eeprom, and set the 'xbox region' to 'rest of the world', the game on startup will show a 'Microsoft' splash screen.

 

[Matt Ponton]

Also I was trying to disable all loading screens and videos to speedup the loading process, and found an interesting thing, if you go to cxbx -> Settings -> Config eeprom, and set the 'xbox region' to 'rest of the world', the game on startup will show a 'Microsoft' splash screen.

Ah, that's how to get that screen. interesting.

 

[Matt Ponton]

3++ doesn't start for me in cxbx. Just a black screen and a 100% loaded cpu core.

This is most likely you running into the weird issue where the app will freeze when it should be loading the Team NINJA logo, typically right after the TECMO logo appears. If you're skipping all those load screens you'd be running directly into the crash screen. The way we get by it is by mashing Start on boot until the Team NINJA video starts playing. It's an issue CXBX has with DOA3, and we only can guess it has something to do with the harddrive caching the afs files.

 

[mopafo3971]

This is most likely you running into the weird issue where the app will freeze when it should be loading the Team NINJA logo, typically right after the TECMO logo appears. If you're skipping all those load screens you'd be running directly into the crash screen. The way we get by it is by mashing Start on boot until the Team NINJA video starts playing. It's an issue CXBX has with DOA3, and we only can guess it has something to do with the harddrive caching the afs files.

Actually it was my fault. The game was lacking the dsstdfx.bin file, I added it and it works now.

 

[Matt Ponton]

Interestingly, the Korean version of DOA3 uses the 54430001 title ID like NTSC-M and NTSC-J. However, it seems to have the balance fixes/changes/updates as 3.2 (PAL).