FE10: Radiant Dawn Hacking Notes

[VincentASM]

Before I begin, I'm making the assumption that you have the FE10 disk image (aka ISO, ROM or whatever you want to call it) or know where to find one. Owning one is illegal, so I cannot tell you where to find it (Hint: use a search engine and common sense).

You will need a tool to compress/decompress LZ77. I recommend Batch-LZ77 (we used this for the FE12 translation patch and everything worked fine).

This topic might also be a useful reference (especially to show that the hacking, some of it at least, works).

Prologue 1: Viewing the Wii disk image

Okay, so you have FE10 on your PC. Now what? It's time to break the game apart and get the individual files out!

There are two options that you can take, although you may end up using both for different reasons.

1) WiiTools

This is sort of like GCTool for GameCube disk images and NDSTool for DS ROMs. It extracts all the files from a Wii disk image.

The version I used was v.2b. You'll need a recent version of libeay32.dll (OpenSSL Shared Library) and the vcredist_x86 (Visual C++ 2008 Codename Orcas redistributable) files installed to run them. If you don't know where to find these files, give me a shout. You'll also require an encryption key file, named ckey.bin, placed in the WiiTools directory.

Open up a command prompt and run WiiED. Then run WiiSO on the newly created files that WiiED made. The second step may take a very long time. If successful, all of the FE10 files will be extracted.

2) WiiScrubber

This is a tool used for removing garbage data, but also includes options for extracting and replacing individual files (the later versions anyway). Unlike WiiTools, you can't extract multiple files at once, but it's useful if you only want to extract one or two files. The replacing part is important if you want to play a hacked FE10.

I used version 1.2. Some of the earlier/later versions seem to have issues with replacing files.

Using WiiScrubber couldn't be easier. You don't need any extra files. Just open the .exe file and you'll be greated by a GUI that lets you do everything.

Prologue 2: Hex Editing basics

If you're familiar with using a hex editor, feel free to skip this step. It's kind of boring.

Anyway, I'm guessing most people are familiar with Nightmare modules when it comes to FE hacking. I never do any serious hacking so I don't really use them much, since all they do is speed up hacking. I have some Nightmare modules for FE10, but it wasn't feasible to make them for everything (plus I'm lazy).

So, it's time to get used to using a hex editor... I use WindHex, but there are tons of other hex editors that you could use.

Just open the file you want to edit with your hex editor.

You'll be greeted with a whole bunch of numbers and letters. Don't worry if you don't know what they all mean. Eventually you'll know what some of them mean and that's good enough.

Quick definitions

Byte:

See all those numbers and letters? Each pair of number/letters is a byte. When selecting with your cursor, the minimum you can select is typically a byte. Eg. 00 or 46 or 7F.

Hex:

Short for Hexadecimal. A numbering system that uses a base of 16 (i.e includes 16 unique symbols). Decimal numbers ("normal numbers" to most people) use a base of 10; they have 10 unique symbols: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9. Hex uses Decimal symbols, but adds 6 new symbols at the end: A, B, C, D, E, F. So when counting in hex, you'd go 5, 6, 7... as with decimal numbers, but when you reach 9 and continue counting, you'll go A, B, C... and so forth.

Hex editors display the values of the bytes in hex. You can convert between hex and decimal values by using the Windows Calculator (set to scientific mode). It might also be useful to memorise a few hex->dec values to save time.

Eg. Some Hex->Dec values

0A~10 14~20 1E~30 28~40 32~50 3C~60 46~70 50~80 5A~90

0F~15 19~25 23~35 2D~45 37~55 41~65 4B~75 55~85 5F~95

64~100

The maximum hex value for one byte (unsigned) is FF = 255.

If a byte value is signed, the max positive value is 7F = 127. Values from 80 are negative, starting at -127, and increment by +1 towards 0. FF in this case would be -1.

Address:

AKA Offset. The "location" of a byte in the data. It's equivalent to the number of bytes (from the very beginning) that it took to reach the target byte. So an address of 0x140 would have 140 (hex) = 320 bytes preceding it. The address is usually displayed by hex editors somewhere obvious.

Hopefully all that made some sense. If you're stuck with something, there are probably some better guides out there. Heck, I don't even consider this a proper guide. I suppose it's a kind of quick-start, just so you have an idea of what some of the things mean later on.

Prologue 3: Pointer basics

I'll mention these because they appear so many times in the game data.

If you see some a string of numbers that seem to comprise of 4 bytes, it's probably a pointer. Eg.

00 02 7F EB

As the name suggests, a pointer points to something else, in this game it's usually a label or a table (which may contain pointers).

To find out where the pointer is pointing, for most of the game files, simply convert the numbers into an address and add 20 in hex (if you're in a hex editor that displays 16 numbers in a row, you can just go to the address and press down on your keyboard twice).

Eg. 00 02 7F EB goes to the address 0x27FEB + 20(h) = 0x2800B

This trick doesn't work for every single file, mind you. Some files may also require you to first reverse the bytes like in the GBA/DS FE games before converting to an address.

Eg. 00 02 7F EB reversed becomes 00 EB 7F 02

Modifying pointers is usually more efficient than changing the labels/tables, especially if multiple pointers are aimed at them.

Chapter 1: Character data

What most people would probably want to edit.

This is stored in /FE10Data (uncompressed).

Note: Until Chapter 13 of this guide, FE10Data is the only file being edited.

Data starts at exactly 0x2C. Important characters stop at around 0x1BA0.
Minor bosses appear from 0x58B0 to 0x62E0.
Completely ends at around 0x9260, where Class data begins.

Character order (Internal names used)

Example, Ike's data:

02 00 0B 00 00 03 24 5E 00 03 03 5F 00 02 FA 34

00 02 A1 DE 00 02 B7 66 00 03 42 D6 00 03 32 8A

00 03 37 66 00 03 36 24 00 00 00 00 00 00 00 00

00 02 8C D0 00 02 8C DA 00 00 00 00 07 03 08 00

03 00 00 00 00 06 0F 01 0F 0C 0E 0C 05 00 00 41

37 0A 3C 23 1E 28 0F -- -- -- -- -- -- -- -- --

Broken down:

02 00 0B 00 - Unknown
00 03 24 5E Pointer -> PID_IKE - Person ID, determines who the character is
00 03 03 5F Pointer -> MPID_IKE
00 02 FA 34 Pointer -> MNPID_IKE
00 02 A1 DE Pointer -> FID_IKE - Face ID, determines portrait
00 02 B7 66 Pointer -> JID_BRAVE - Job ID, usually doesn't do anything
00 03 42 D6 Pointer -> tellius - Affinity
00 03 32 8A Pointer -> S----------- - Weapon ranks
00 03 37 66 Pointer -> SID_HERO - Skill ID, determines skills (can be a few or none)
00 03 36 24 Pointer -> SID_EQ_A - Skill ID, another skill
00 00 00 00 00 00 00 00 - Blank
00 02 8C D0 Pointer -> AID_LORD2
00 02 8C DA Pointer -> AID_LORD3
00 00 00 00 - Blank
07 03 08 00 03 - First number determines the Biorhythm type, fifth number determines the Authority stars, the rest are unknown
00 00 00 00 - Transform gauge gains/reductions (order: untransformed per turn, per battle, transformed per turn, per battle)
06 0F 01 0F 0C 0E 0C 05 00 00 - Stat additions (order: HP, STR, MAG, SKL, SPD, LCK, DEF, RES, CON, unknown [MOV?])
41 37 0A 3C 23 1E 28 0F - Growth rates (same order as above, minus CON and unknown)

Nightmare modules (for the original Nightmare anyway) are a bit of a pain to make since different characters have varying number of skills.

Other characters who are not important or minor bosses have more basic data. They don't have stat additions, growth rates of their own and some other attributes.

Chapter 2: Class data

Data starts at exactly 0x926C. Ends at around 0xDF40.

Class order (Sorry, more internal names)

Example, Hero data:

00 02 B7 66 00 02 F2 D1 00 03 4C B3 00 02 D8 3A

00 00 00 00 00 02 BE 97 00 00 00 00 00 00 00 00

00 02 8C D0 00 03 32 8A 00 03 32 8A 0C 01 01 00

00 03 01 15 00 07 1E 03 00 00 00 00 00 03 37 78

00 03 36 81 00 03 39 A1 00 00 00 00 00 03 33 18

32 1B 0A 1E 1E 1E 1A 0F 26 09 01 0D 0B 00 09 02

50 32 0A 46 28 1E 28 0F 00 00 00 00 00 00 00 00

Broken down:

00 02 B7 66 Pointer -> JID_BRAVE
00 02 F2 D1 Pointer -> MJID_BRAVE
00 03 4C B3 Pointer -> ﾌﾞﾚｲﾌ
00 02 D8 3A Pointer -> MH_J_BRAVE
00 00 00 00 - Blank
00 02 BE 97 Pointer -> JID_VANGUARD - What this class transforms/promotes to
00 00 00 00 00 00 00 00 - Blank
00 02 8C D0 Pointer -> AID_LORD2
00 03 32 8A Pointer -> S----------- - Base weapon ranks
00 03 32 8A Pointer -> S----------- - Max weapon ranks
0C 01 01 00 - Con, unknown [armour type?], Armour's Weight, unknown [mount type?]
00 03 01 15 - Mount's Weight, other three unknown
00 07 1E 03 - Movement type, Movement, Capacity, FOW Vision
00 00 00 00 - Blank
00 03 37 78 - SID_HIGHER - Skill ID, determines skills (usually a few of these)
00 03 36 81 - SID_EVENTCC - Another skill
00 03 39 A1 - SID_TACKLE - Ditto
00 00 00 00 - Blank
00 03 33 18 - Pointer -> SFXC_HUMAN
32 1B 0A 1E 1E 1E 1A 0F - Maximum stats
26 09 01 0D 0B 00 09 02 - Base stats
50 32 0A 46 28 1E 28 0F - Growth rates
00 00 00 00 00 00 00 00 - Blank

Chapter 3: Item data

Starts at exactly 0xDF44. Ends at around 0x12800

Item order

Example, Florete's data:

-- -- -- -- 00 02 AA A0 00 02 E7 18 00 02 CC E7

00 03 42 D0 00 03 42 D0 00 03 16 08 00 00 00 00

00 02 9A B8 00 00 00 00 00 10 00 C8 0E 5F 0F 05

2D 04 01 02 01 00 00 00 04 03 00 00 00 03 43 1B

00 03 41 6E 00 03 42 C8 -- -- -- -- -- -- -- --

Broken down:

00 02 AA A0 Pointer -> IID_FLORETE - Item ID, determines what item it is
00 02 E7 18 Pointer -> MIID_FLORETE
00 02 CC E7 Pointer -> MH_I_FLORETE
00 03 42 D0 Pointer -> sword - Determines weapon type (at Min range?)
00 03 42 D0 Pointer -> sword - Determines weapon type at Max range?
00 03 16 08 Pointer -> N - Weapon rank
00 00 00 00 - Blank
00 02 9A B8 Pointer -> EID_FLORETE
00 00 00 - Blank
00 00 10 - Unknown (third one could be Item icon)
00 C8 0E 5F 0F 05 2D 04 01 02 01 - Cost per use (first two bytes), Might, Accuracy, Critical, Weight, Uses, Weapon Exp, Min range, Max range, Unknown
00 00 00 - Blank
04 03 00 00 - Unknown
00 03 43 1B Pointer -> valuable - Additional attributes (can be a few or none)
00 03 41 6E Pointer -> eqB
00 03 42 C8 Pointer -> stormsw

Chapter 4: Skill data

Not sure if this is true for Item data, but Skill data happens to consist of uniform size blocks, which can only mean one thing - I'm not too lazy to make a Nightmare module for it! Bad news is that there doesn't seem to be much interesting to edit.

Skill Editor
Skill order (you need this to operate the above)

1
Skill Editor (FE10) - By VincentASM - V 0.1
0x12814
142
44
Skill_list.txt
NULL

SID Pointer
# Determines the Skill
0
4
HEXA
NULL

MSID Pointer
4
4
HEXA
NULL

MH_SKILL Pointer
# Probably something do with Help messages
8
4
HEXA
NULL

MH2_SKILL Pointer
12
4
HEXA
NULL

EID Pointer A
# Effect ID, related to battle/map animations?
16
4
HEXA
NULL

EID Pointer B
20
4
HEXA
NULL

IID Pointer
# What item teaches the Skill
24
4
HEXA
NULL

Skill ID?
28
1
NEHU
NULL

Unknown
29
1
NEHU
NULL

Capacity
30
1
NEDU
NULL

Skill Icon?
31
1
NEHU
NULL

Unknown
32
4
HEXA
NULL

SID Table Pointer
# The format for these table appears to be that the first number is the number of
# entries in the table (in hex). Eg. 01 means 2 entries, 00 means 1. The entries
# appear straight afterwards as pointers (separated by 00 00 00 00).
36
4
HEXA
NULL

SFXC Table Pointer
40
4
HEXA
NULL

Chapter 5: Support gain data

This one is slightly shakier than usual.

Support editor

1
Support Editor (FE10) - By VincentASM - V 0.1
0x146D4
1
16
NULL
NULL

# For definitions, please check this page:
# http://serenesforest.net/radiant-dawn/characters/supports/buddy-supports/
# Special thanks to Narga_Rocks

Max Support points for None
0
1
NEDU
NULL

Max Support points for C
1
1
NEDU
NULL

Max Support points for B
2
1
NEDU
NULL

Max Support points for A
3
1
NEDU
NULL

Default Chapter bonus
4
1
NEDS
NULL

Unknown
5
1
NEDS
NULL

Default bonus for Adjacent
6
1
NEDS
NULL

Default bonus for Carry
7
1
NEDS
NULL

Default bonus for Heal
8
1
NEDS
NULL

Default bonus for Shove
9
1
NEDS
NULL

Unknown
10
1
NEDS
NULL

Addition for 00 Type
11
1
NEDS
NULL

Addition for 01 Type
12
1
NEDS
NULL

Addition for 02 Type
13
1
NEDS
NULL

Addition for 03 Type
14
1
NEDS
NULL

Addition for 04 Type
15
1
NEDS
NULL

Chapter 6: Affinity data

Affects Buddy support bonuses. Hopefully.

Affinity editor
Affinity list (needed for the above to work)

1
Affinity Editor (FE10) - By VincentASM - V 0.1
0x146E8
9
12
Affinity_list.txt
NULL

Affinity Pointer
# Determines the Affinity, telius=Earth
0
4
HEXA
NULL

Might+
4
1
NEDU
NULL

Defence+
5
1
NEDU
NULL

Hit+
6
1
NEDU
NULL

Avoid+
7
1
NEDU
NULL

Chapter 7: Terrain data

Terrain bonuses and movement costs.

Terrain editor
Terrain list (as usual, needed for the above)

1
Terrain Editor (FE10) - By VincentASM - V 0.1
0x147DC
43
44
Terrain_list.txt
NULL

Ground Avoid+
0
1
NEDS
NULL

Ground Defence+
1
1
NEDS
NULL

Ground Resistance+
2
1
NEDS
NULL

Air Avoid+
3
1
NEDS
NULL

Air Defence+
4
1
NEDS
NULL

Air Resistance+
5
1
NEDS
NULL

Recover HP%
6
1
NEDS
NULL

# Probably something to do with special attributes, like healing adjacent users
Unknown
7
1
HEXA
NULL

EID Pointer
8
4
HEXA
NULL

SFX Pointer A
12
4
HEXA
NULL

SFX Pointer B
16
4
HEXA
NULL

# Class movement costs start here
# The info, in generalised form can be found on this page:
# http://serenesforest.net/radiant-dawn/classes/terrain-data/

Type 00 - Foot 1
20
1
NEDU
NULL

Type 01 - Foot 2
21
1
NEDU
NULL

Type 02 - None
22
1
NEDU
NULL

Type 03 - None
23
1
NEDU
NULL

Type 04 - Armor 1
24
1
NEDU
NULL

Type 05 - Armor 2
25
1
NEDU
NULL

Type 06 - Mage 1
26
1
NEDU
NULL

Type 07 - Mage 2
27
1
NEDU
NULL

Type 08 - Horse 1
28
1
NEDU
NULL

Type 09 - Horse 2
29
1
NEDU
NULL

Type 0A - Flying
30
1
NEDU
NULL

Type 0B - Thief 1
31
1
NEDU
NULL

Type 0C - Thief 2
32
1
NEDU
NULL

Type 0D - Bandit
33
1
NEDU
NULL

Type 0E - Beast 1
34
1
NEDU
NULL

Type 0F - Dragon 1
35
1
NEDU
NULL

Type 10 - Beast 2
36
1
NEDU
NULL

Type 11 - Dragon 2
37
1
NEDU
NULL

Type 12 - Civilian
38
1
NEDU
NULL

Type 13 - None
39
1
NEDU
NULL

Type 14 - None
40
1
NEDU
NULL

Type 15 - Heron (Rafiel)
41
1
NEDU
NULL

Type 16 - Black Knight
42
1
NEDU
NULL

Edited August 24, 2015 by VincentASM

[VincentASM]

The BBCode doesn't seem to like me so I'll continue here.

Chapter 8: Buddy support data

Data starts at exactly 0x1A2D4. It contains info on the Buddy support lists for characters (i.e which characters they can make Buddy relationships with and at what rate).

Order of buddy lists

See this page for info on Buddy support types and other stuff.

Eg. Ike's buddy list:

-- -- -- -- -- -- -- -- 00 03 24 5E 00 00 00 47

00 03 24 5E 00 02 00 00 00 03 22 C9 00 02 00 00

...

Broken down:

00 03 24 5E Pointer -> PID_IKE - Whose buddy list this is
00 00 00 47 - There are 47(hex) = 71(dec) entries in this table. There are 72 permanent playable characters, but one of them joins in the last chapter and can't support.
00 03 24 5E Pointer -> PID_IKE - First buddy (yeah, there's data for "yourself")
00 02 00 00 - Type 00 02 support
00 03 22 C9 Pointer -> PID_ENA - Next buddy
00 02 00 00 - Type 00 02 support
...
Continues for 69 more characters.

The order of buddies is always the same. In fact, it's also the same order as the order of buddy lists.

Chapter 9: Weapon triangle data

WTA editor
Weapon affinities (required for the editor to work)

1
Weapon Triangle Editor (FE10) - By VincentASM - V 0.1
0x27424
27
12
NULL
NULL

Type pointer A
0
4
NDHU
Affinities.txt

Type pointer B
4
4
NDHU
Affinities.txt

Might+
8
1
NEDS
NULL

Hit+
9
1
NEDS
NULL

Chapter 10: Biorhythm bonus data

Biorhythm editor
Biorhythm list (I should really put this and the editor in a zipped file or something...)

1
Biorhythm Editor (FE10) - By VincentASM - V 0.1
0x27608
5
12
Bio_list.txt
NULL

Biorhythm status?
0
4
HEXA
NULL

Hit+
4
1
NEDS
NULL

Avoid+
5
1
NEDS
NULL

Skill Activation+
7
1
NEDS
NULL

Hidden Item Find+
8
1
NEDS
NULL

Chapter 11: Bond support data

Starts at exactly 0x26EEC.

Eg. Beginning of the table.

-- -- -- -- -- -- -- -- -- -- -- -- 00 00 00 2E

00 03 24 5E 00 03 26 B1 01 0A 00 00 00 03 24 5E

...

Broken down:

00 00 00 2E - Determines the total number of entries, currently set to 46
00 03 24 5E Pointer -> PID_IKE - First character in the Bond support
00 03 26 B1 Pointer -> PID_MIST - Second character in the Bond support
01 - Unknown
10 - Boost to Critical/Dodge
00 00 - Blank
00 03 24 5E - Data for the next Bond support
...
Continues for 45 more character pairs

Chapter 12: Pacifist data

Determines which characters won't directly attack another.

Starts at exactly 0x27644.

See here for the whole list.

Eg. First part of the table.

-- -- -- -- 00 00 00 16 00 03 26 94 00 03 22 B2

00 00 00 00 00 03 24 E6 00 00 00 00 00 03 30 E7

...

Broken down:

00 00 00 16 - Determines the total number of entries, current set at 22.
00 03 26 94 Pointer -> PID_MICAIAH - Determines who the pacifist data is for
00 03 22 B2 Pointer -> PID_ELAICE - First character in Micaiah's data
00 00 00 00 - Blank, probably used to separate characters
00 03 24 E6 Pointer -> PID_JILL - Second character in Micaiah's data
00 00 00 00 - Blank
00 03 30 E7 Pointer -> PID_ZIHARK - Third character in Micaiah's data
...
Continues for several more characters

The next character's pacifist data begins each time there are eight 00's in a row.

The final character's pacifist data marks the end of the FE10Data file, not counting the footer.

Chapter 13: Not covered in FE10Data

Skipped Chapter Data and Group Data. The first one seems to include Map affinities, battle backgrounds, sky backgrounds and the like. It probably does not include stuff like starting classes and inventories, which you'd normally associate with chapter data. Group data, I'm guessing is to do with affiliations or something; I'll probably look it up when I'm bored.

Stuff I couldn't figure out:

Biorhythm Data - not the stat boosts. Maybe related to the actual sine waves? Here's the relevant data for it if anybody wants to try deciphering it.

-- -- -- -- -- -- -- -- 3F 80 00 00 3F 80 00 00

3F 80 00 00 00 00 00 00 3F C0 00 00 3F 80 00 00

3F 00 00 00 00 00 00 00 3F 00 00 00 3F 80 00 00

3F C0 00 00 00 00 00 00 40 00 00 00 3F 80 00 00

40 00 00 00 00 00 00 00 3F 80 00 00 3F 80 00 00

40 00 00 00 00 00 00 00 3F C0 00 00 3F 80 00 00

3F C0 00 00 00 00 00 00 3F 00 00 00 3F 80 00 00

3F 00 00 00 00 00 00 00 40 00 00 00 3F 80 00 00

3F 80 00 00 00 00 00 00

Game Data - No, I didn't name this. It's such a generic term that I have no clue what it could be related to. It appears in FE9 as well, but it's just as puzzling. Again, here's the relevant data.

-- -- -- -- 00 28 00 1C 00 0F 00 0F 00 1E 00 13

00 0A 00 05 00 64 00 64 00 64 00 64 00 64 00 64

00 64 00 64 00 05 00 05 00 05 00 00 00 05 00 05

00 05 00 00 00 0F 00 0A 00 0A 00 05 00 28 00 3C

00 28 00 1E 00 28 00 1E 00 14 00 0A 00 C8 00 C8

00 64 00 64 -- -- -- -- -- -- -- -- -- -- -- --

Edited August 24, 2015 by VincentASM

[VincentASM]

Chapter 14: Shop/forging data

Stored in the /Shop directory, in the separate shopitem_X.bin files, where X is:

n = Normal = ENG Easy
h = Hard = ENG Normal
m = Maniac = ENG Hard

The shopitem_X.bin files are mostly a whole bunch of pointers. Don't forget, you can easily make new pointers by going backwards from the label.

Eg. In shopitem_h.bin the label IID_BLIZZARD is found at 0xA9CF. Subtract 20 from it and it becomes the pointer that points to it, in this case 00 00 A9 AF. Such a pointer already exists at 0x2B98. Must be from the Part 3 Chapter 13 Bargains.

The order seems to be Armory (debug chapter, first chapter to last chapter), Vendor (same), Bargains (same) and Forge (same). At the very end is the Forging card data.

Individual items in the shops are separated by four 00's in a row. The shops appear to be terminated by eight 00's in a row.

Unlike in the FE10Data file, not every item appears here. There are a whole bunch though. To add more items, you need to replace the existing IID labels with your own. Make sure they're consistent with the ones found in the FE10Data file. Try not to go over the space you're given (unless you're happy with repairing pointers), but it's okay if the new label is shorter than the older one (just replace unneeded text with 00's).

It should be possible, although I've never tried it in FE9 and 10, to expand the file and add in new code or labels at the end. I tried this with FE11 and it seems to work fine for both the chapter you're editing and the next one (I coded my own Armory at the end of the Chapter 1 script file).

As for the Forging cards...

Forging Card Editor
List of Cards

1
Forging Card Editor (FE10) - By VincentASM - V 0.1
0xA8F0
12
12
Card_list.txt
NULL

# This editor is for the shopitem_n/h/m.bin files

Message Pointer
0
4
HEXA
NULL

Might+
4
1
NEDU
NULL

Accuracy+
5
1
NEDU
NULL

Critical+
6
1
NEDU
NULL

Coins+
7
1
NEDU
NULL

Obtain rate
8
1
NEDU
NULL

Note: This was tested in Hard = ENG Normal. It should work for the other two difficulty modes as well, since the data doesn't seem to have moved much.

Chapter 15: Army data

This is stored in the /zmap directory (aka battle maps), in the separate dispos_X.bin files found in the /bmapYYZZ directories where X is:

c = Common?
n = Normal = ENG Easy
h = Hard = ENG Normal

It seems Hard and Maniac (ENG Normal and Hard) share the same army data. Common is probably for pre-chapter stuff.

YY indicates the Part, i.e 01 to 04.
ZZ indicates the chapter, counting Prologues as 01 (so Chapter 2 would be 02).

There are also emapYYZZ directories for events and also directories for stuff like tutorials and testing.

In each dispos_X.bin file, the first character's data starts at around 0x28. Each character's data seems to fill a block of 104 bytes.

I haven't really looked into army data much, but this seems to be where you can alter starting classes, inventories, AI and other stuff.

Eg. Micaiah's data in /bmap0101/dispos_n.bin.

-- -- -- -- -- -- -- -- 0F A0 18 4C 00 00 03 C8

00 00 03 8D 06 11 0A 0B 01 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 04 63 00 00 03 49

00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 1B

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 1D

00 00 04 35 00 00 04 2A 00 00 03 9B 00 00 04 35

Broken down:

0F A0 18 4C - Unknown, possibly to do with unit colour?
00 00 03 C8 Pointer -> PID_MICAIAH - Who the character is
00 00 03 8D Pointer -> JID_LIGHTMAGE - Class
06 11 0A 0B - Starting and ending XY co-ordinates?
01 Unknown, one of these numbers has to be starting Level though, right?
...
00 00 04 63 Pointer -> invalid - Affinity? Not sure
00 00 03 49 Pointer -> IID_LIGHT - First weapon
...
00 00 03 1B Pointer -> IID_HERB - First item
...
00 00 04 1D Pointer -> SEQ_NOATTACK - AI?
00 00 04 35 Pointer -> SEQ_NOMOVE - This stuff is probably useless for playable characters
00 00 04 2A Pointer -> SEQ_NOHEAL
00 00 03 9B Pointer -> MTYPE_NORMAL - Movement type?
00 00 04 35 Pointer -> SEQ_NOMOVE - What, another one?

Chapter 16: Basic scripting

Stored in the X.cmb files in the /Scripts directory.

No, this isn't related to dialogue. It's to do with editing events in the game.

So, what's the point of editing events? Well, you can change what items are stored in villages and treasure chests, as well as the hidden treasures. In theory, if you're really good, you could probably code your own chapter.

I probably won't be able to figure out exactly how the events are called, but there are some key points that I can tell you.

Unless preceded by a 1D or 38 byte, pointers are byte-reversed and point exactly to the address. Eg. D4 03 00 00 points to 0x3D4 (03 and D4 swap places).

If there's a 1D or 38, the following two bytes are likely a non-reversed pointer. These pointers point to an address + 2C. So if you see something like 38 02 44, the 02 44 is a pointer that points to the address 0x270 (244 + 2C).

Final Chapter: Basic ripping

Time to end with something a little different. I'll explain how to view/use a bunch of files. Most of this stuff applies to FE9 as well, and to an extent FE11.

Here are some tools by Dark Twilkitri for decompressing TPL and CMS files. Place them in the same directory as the files you want to convert and double-click on the relevant program.

BIN

Usually identified by a .bin extension. Raw binary files with no compression. If the file you're looking at doesn't fall into the below filetypes, it's probably a binary file (I'm guessing).

CMS

Usually identified by a .cms extension (not to be confused with .cmb and .cmp). The very first byte seems to be a 10. These are files compressed using LZ77. Just use a LZ77 (de)compressor. The decompressed files could be anything.

TLP

Usually identified by a .tpl extension. The first four bytes are 00 20 AF 30. These seem to be compressed image files. You can decompress them using Dark Twilkitri's TLPCNV program. The decompressed files are usually bitmaps or DDS files.

DDS

Image files. Can be viewed with Thakis's ddsview program or the NVIDIA dds plug-in for photoshop.

M

Message files. You can open them with a text editor like Notepad.

THP

Movie files. You can view them with Thakis's thpplay program. I think the thp format is supported by some random movie players as well.

CMB

Uncompressed files. Try opening them with a text editor or hex editor.

BRSTRM

Music files. They are supported by recent versions of the in_cube plug-in for WinAMP. I seem to recall in_cube is now part of a larger videogame music plug-in.

BRSAR

Haven't really looked into this, but I'm guessing it's a file containing many sound files inside. Maybe sound effects? I don't know. Quickly Googling around, it looks like there are programs designed for these files.

PAK

Package files. The first few bytes reads "pack" in ASCII. Usually contains a bunch of random files. I don't know if any programs extract these files, but there is a cheap trick that I use. If you're looking for TPL files, for example, run a search for the TPL header (00 20 AF 30). Then dump everything from that point and onwards. Of course, you may want to determine where the packed file actually ends, but TLPCNV seems to do a good job handling the unwanted data most of the time.

CMP

Compressed package files. Basically a PAK file with LZ77 compression.

Epilogue

VincentASM - Serenes Forest Webmaster

"After completing his hacking notes for FE10, he went and did other things."

At this point, I believe I've shared everything I know about hacking FE10. I tend to think of myself as a bit of a hoarder, so I do feel a little odd about making this all public. At the end of the day, I suppose none of this stuff is really that complicated. However, hopefully it'll be of use to some people, and maybe one day FE9+ hacking will be more popular.

Credits

Dark Twilkitri

Teaching me how to hack FE9 and providing the tools for converting CMS and TPL files. His knowledge of FE is legendary. Er, but where is he?

Nintenlord and SandwichSage

Separately creating decent LZ77 de/compressors. I still remember when recompressing files to put them back into the game was a passing dream.

shadowofchaos

Introducing me to the wonders of WiiScrubber and for testing out the debug chapter. Ninian is cool too.

SwordsAreShiney

Providing me with the NA FE10 files and helping me to get WiiTools working (either the dll file was outdated or I installed the wrong vcredist_x86 files).

The cool people who made those cool programs

Not trying to sound disrespectful here. There are a bunch of people whose programs I've used, but I sadly don't have the time to figure out who they are.

Fin

Edited August 24, 2015 by VincentASM

[shadowofchaos]

Ok, A couple of months back there was topic about FE10 hex editing referenced here.

Using the files from Fire Emblem Radiant Dawn along with DT gba de-compressor the files that could edit the game were decompressed and allowed for data hacking of FE10. The catch is that there was no way at the time to re-compress the file. So I decided to make a compressor/de-compressor for the Nintendo Wii and specifically FE10 and FE9.

The compressor will allow you to decompress those *.cms files that are in FE9 and FE10, edit them, and then re-compress them.

Also, included are Nightmare modules for the FE10Data.tpl (which is the name of the de-compressed FE10Data.cms file). The modules are for character and class data.

Nintenlord also has a compressor/ de-compressor that works with FE10/FE9, but this one is a more exact with the compression algorithm as well as faster.

The FE10 Compressor

FE10 Character and Class Modules

Blazer had this for a while on FES... Nightmare modules that can be used by using Wiiscrubber to extract the files...

I got it working, but since I didn't want to burn a disc every time I used the nightmare modules, the most convenient way to use these modules is to use the USBLoader for the Wii...

Edited May 7, 2013 by shadowofchaos

[VincentASM]

Can you tell me how this USBLoader device/tool works?

I forgot to mention it here, but I haven't actually managed to get a hacked FE10 running (since I don't have a Wii and my PC is too old to run the newest emulators), so don't be surprised if I'm a bit behind in the times : P

I did manage to get a hacked FE9 running, so I'm assuming most of this stuff works.

[Aleph]

From what I understand, it starts a game from a separate media device connected to the Wii through a USB port, and the accompanying utilities with the system (a.k.a. "Google 'USB Loader' and download appropriate files) set the Wii's IOS upon loading of the game to one which will cause disc reads to request data from the USB port and not the disc drive, like usual.

i.e. you store the Wii games on your PC (illegal, derp) and yet, run them on your Wii (no emulation needed).

It's like, the more advanced systems get, the easier it is to find solutions to problems like yours (old PC & potentially incomplete emulators). The security isn't improving fast enough to keep up, so things are actually easier for modern hackers than they were for oldbies. I think.

At least, I hope so (lul, file systems). Would make me feel a few times more awesome.

[VincentASM]

Ooh, thanks. That sounds much more impressive than I expected ^^

I have to agree than modern hacking is pretty convenient. It's a shame that it hasn't caught on in the FE fandom though, but I guess there's less scope for customisation due to the usage of 3D models and stuff.

EDIT

Chapter 3 has been added. It might be a while until the next update, since I haven't properly messed around with Skills in this game yet.

Edited January 5, 2010 by VincentASM

[Crimson Red]

Nice additions and nice notes. Mind if I just put a link to this topic on FES? Maybe someone will pick up on it some time. I'd do it myself but it's just a bit too much work and not enough profit, personally.

Do tell if there are any compressions that you can't seem to crack or anything, I've rundown through every FE11 compression I could find and got programs to compress/decompress them. I still owe you for helping me way back when I hadn't the slightest clue on how to hack FE11... but see, ultimately giving me those programs (which no offense are mostly useless now, or at the least there are alternatives) helped me get started into hacking FE11... lol.

That aside Shadow mentioned the USBLoader as a way to actually playtest hacked games, although for many people it still wouldn't be too great of a thing. Also, as you said, Nightmare modules can only do so much, but at the least since DS and Wii data is all divided into nice file and folder structures NMM's aren't even needed that much...

Good luck with the rest of your hacking, your website, and everything else, Vincent!

[VincentASM]

Sure, go ahead ^^

Hmm, I can't really think of any FE9/10 files that can't be accessed someway or the other. If I can think of any, I'll give you a shout. There's probably the model files and some other misc. stuff, but I'm not really interested enough to look into them : P

I've also updated with Skill data. Not sure what the next chapter is going to be, I think I'll just go with the same order as the data is stored. I did notice that you might be able to edit the weapon triangle and Biorhythm data...

Edited January 6, 2010 by VincentASM

[shadowofchaos]

Hmm, I can't really think of any FE9/10 files that can't be accessed someway or the other. If I can think of any, I'll give you a shout. There's probably the model files and some other misc. stuff, but I'm not really interested enough to look into them : P

Unless you've got a lot of time on your hands, I don't think people will be looking at those... (Unlike the HUGE fanbase of Super Smash Bros. Brawl, in which Texture hacking as well as them getting started on model hacking is very big ._.)

[VincentASM]

Updated with some random stuff. I might actually get this thing finished soon.

Edited January 12, 2010 by VincentASM

[James Bond]

That's a splendid work Vincent, you managed to find out the pointers for skills and items and all that staff...I wonder how difficult would be to create nightmare modules for these though...

[Aleph]

Models are just clumps of vertices. Should be simple enough to translate between the output of a program like SketchUp or Blender and what the game uses. The intermediate format most likely being Wavefront OBJ. This turns out to be what's going on with SM64 hacking at the moment.

The idea of dumping FE 10 model data (read: opening a file from the ISO FS, lul), converting it to OBJ format (if it isn't that way already...lul, again) and loading that into, say, Blender (standardized formats ftw) to view/edit the model while at the same time gaining some concept of the appropriate dimensions of a typical model seems good.

Now if I could just construct terrifying sentences like that in Japanese and had the vocabulary to fill them with...

Edit: What I'm saying is, you're entirely right that the FE hacking community hasn't moved on, or rather, hacking communities in general (at least, many of us more experienced hackers) due to "less customization" arising from the apparent difficulty of editing things that are more complex than what we're used to. However, I and the others need to get over this and simply realize that it's not as complex as it appears (although my skills at drawing 3D models is likely limited >_>). I would, too, but I'm so busy cleaning up mistakes I made in the days of hacking consoles past to move forward...

Edited January 7, 2010 by Xeld

[nocturnal YL]

(Hmm. so I finally started some modding-related reply)

....Whoa. It doesn't seem to be as easy to find as locating binary data in the GBA games. For GBA / SNES, all I did was to use the character stats to find the data I need (usually starting stats / stat additions; they don't tenr to repeat) and directly change them.

Also, the weapon ranks are actually pointers this time? Sounds inconvenient...

Is there any chance to expand these data? i.e. introduce more classes, more names / descriptions / pre-defined weapon ranks / etc? (Ideally, I want to see everyone having their own class, since a lot of cases in FE10 have characters with growths not matching stat scaps)

To be honest, I have yet to get my hands on these stuff (don't even have the disc image at hand), but there is so much in FE10 I want to change that I'd like to look into these sort of data. (For example, the wrong weapon ranks in Sword General SP, and I want to even out the stat caps of each class. I also want to cut characterters like Dheg down a bit since I'm having trouble with his 50 Defense right now in my actual Wii playthorugh.)

Oh yeah. How to edit the characters' starting items?

[VincentASM]

....Whoa. It doesn't seem to be as easy to find as locating binary data in the GBA games. For GBA / SNES, all I did was to use the character stats to find the data I need (usually starting stats / stat additions; they don't tenr to repeat) and directly change them.

IMO, it's much easier to find and edit data. You can still search for character stat additions and growths like in the GBA games (that's how I started out when hacking FE9). Besides, don't the GBA games use pointers a lot too? Except, this time you can easily see where they lead to (the labels), which also lets you search for pointers based on addresses.

Eg. If I want to find Micaiah's character data, I could look up her growth rates. However I could instead use her Person ID label, PID_MICAIAH, which is located at address 0x37720 (I made this up), and convert it to a pointer that I can search: 00 03 77 00. This pointer is used for her character data, buddy and bond support data, as well as pacifist data (but you know character data appears first in the file).

Is there any chance to expand these data? i.e. introduce more classes, more names / descriptions / pre-defined weapon ranks / etc? (Ideally, I want to see everyone having their own class, since a lot of cases in FE10 have characters with growths not matching stat scaps)

You should be able to in theory, but I have a bad feeling that you'll be redirecting an impossible number of pointers, since you'll be changing the file size.

Predefined weapons won't work without rewriting the game code. You could add some more weapon rank labels, but that would require expanding the game.

Oh yeah. How to edit the characters' starting items?

That would be in army data like most other games ^^

Edited January 8, 2010 by VincentASM

[Aleph]

Aren't there utilities for Wii and DS games (that use file systems; I don't think all of them do) to extract the files to your own FS, as well as arrange it back together again? If the pointer issue results from changing a file's size, working with the file system properly should take care of that.

Also, note to self: the Wii's architecture is big endian (the Starlet might not be, but I got back into hacking Wii a week or so ago having forgotten that the PPC core was big endian and had to restart a variable search because of it).

Edited January 8, 2010 by Xeld

[Bryan]

Aren't there utilities for Wii and DS games (that use file systems; I don't think all of them do) to extract the files to your own FS, as well as arrange it back together again? If the pointer issue results from changing a file's size, working with the file system properly should take care of that.

Also, note to self: the Wii's architecture is big endian (the Starlet might not be, but I got back into hacking Wii a week or so ago having forgotten that the PPC core was big endian and had to restart a variable search because of it).

Sadly, I do not have the disk Image on my computer. I'm trying to use the disk and dump it onto my computer.

[Junkhead]

Hey, Vincent. I got the the FE10 ISO now...is this similiar as to when it comes to hacking the previous roms with Nightmare? Or do I actually need to have knowledge in something else?

[VincentASM]

The basics are the same as editing the other FE games, whether they're on NES, SNES or GBA.

You might want to get familiar with using a hex editor though, since Nightmare modules aren't always viable to make (for instance when data consists of different size blocks).

One main difference is that you can divide the disk image into its file system, so you can edit the individual files. That's a good thing since you don't really want to be opening a 4 GB file in an editor o__o

So instead of editing the whole disk image, you edit the important files like System.cms.

[Junkhead]

Before I knew all of this (Yesterday), I was looking at the ISO's properties on Dolphin, I realized you could extract different files.

I guess I should get that editor and try it later on, thank you :)

[VincentASM]

Added info on buddy supports and terrain (Chapters 7 and 8).

Just two more easy chapters to do and I'll be done with most of the FE10Data file.

Edited January 12, 2010 by VincentASM

[Aleph]

With the thing all busted into files, it should be pretty feasible to decompile the game, right? Someone ought to.

[VincentASM]

By decompile, do you mean extract all the files from the disk image? I'm not really good with technical terminology ^^;;;

[Aleph]

Haha, no. I'm saying that SINCE we can extract all the files form the disc image (which I've seen done with DS games and the like before), it should theoretically be easy to decompile the game.

As in, disassemble it in such a way that it could actually be assembled again, at which point the functions could start being rewritten in a higher level language and allow for complete reinvention of the game.

[VincentASM]

Aha, I see. I didn't think of that.

Although that reminds me of Japanese or Chinese hackers (I can't remember which) who compiled a MIDI to GBA format converter, probably based off leaked code from Nintendo (and IS?). Although they did a fine job, it didn't seem nearly as good the real thing. There was an ELF file in the leaked FE sound data that had all the songs from FE8 in GBA format compiled using Nintendo's own converter, sounding like in the actual game.

Basically I'm worried that us going backwards, trying to decompile the game, won't be the same or at least, exceedingly tricky. Of course, I'm not the one trying this, so maybe it's easier than I'm imagining ^^;;;

In any case, I added some more notes, up to Chapter 14.

Edited January 12, 2010 by VincentASM