Shadow of the Colossus - Potential Debug

The download for the prototype in question has already been posted quite a while ago here (Edit: The downloads in that topic no longer work, so here's a new one), but I'd like to revisit it, as I believe it contains a yet to be discovered debug menu. Considering how feature-rich the recently discovered ICO debug menu is, the prospect of cracking this is really tantalizing to me. The contents of the CD are:

The TOOLS folder is what interests me, as all the files in it are clearly debug related. DBGCORE.XFF makes references to all of the TOOL files in the folder, as well as several other ones that are absent from the disk (SHTTOOL.XFF, SCRATOOL.XFF, COLTOOL.XFF, WINDTOOL.XFF, and CAMTOOL.XFF).

I took a look around to see if any of these were actually being loaded into the game. The initialize loader grabs SIO2MAN.IRX, DBCMAN.IRX, SIO2D.IRX, USBD.IRX, PL2303.IRX, and then boots up STARTUP.XFF. STARTUP then calls KERNEL.XFF, which loads LIBSD.IRX, SG2IOPM1.IRX, MC2_D.IRX, MANAGER.XFF, GAMECORE.XFF, and NICO.DAT. So as far as I can tell, none of those debug files are ever being loaded.

I made an attempt to mess around with things to try to force those files in. I modified KERNEL.XFF to load DBGCORE.XFF in place of GAMECORE.XFF, and then I modifed DBGCORE to load GAMECORE.XFF & DBGMGR.XFF in place of two of the absent files. However, this just caused the game to black screen right after the loader finished.

I tried the same thing again, this time replacing MANAGER.XFF with DBGCORE.XFF, and having DBGCORE load MANAGER. However, I got this:



Obviously MANAGER.XFF failed to load. So it looks like those modules in DBGCORE.XFF aren't actually being loaded. My theory is there's likely some trigger event that has to happen first before it invokes the procedure to load the modules (probably opening/initializing the debug menu or something). However, I'm not knowledgeable enough to be able to proceed beyond this point...

 

I did some picking with this prototype a while back. Try messing with the 2nd controller: https://www.youtube.com/watch?v=mNxVkX7Fn_o

 

i saw this prototype/debug build was released on epforums, someone can reupload it, please?
on epforums links are down and uploader is not responding

 

I'll upload it, wait a few minutes.
upd:
https://mega.co.nz/#!k8tVXSYA!18XSKPdpqcWknpZlkm_6JKHUclmo5_seZGzmWTVLI8c

 

Is that the version I released in 2009 or another one?

 

All you need to know about this build can be found here:

http://nomads-sotc-blog.blogspot.com.au/2013/01/pre-release-preview-version.html

 

Oh Unclejun,

Didn't realize it was you until I had already posted! I left a message for you on the Unseen64 forums a few months back... but I guess you have not been there in a while. Yeah, Einstein is talking about the Preview version you released.

 

Are you the Youtube guy? He have discovered the inverted controls (in 2014) and he is blaming about, what the fuck.

Worst video i've seen this week so far.

 

iso image is corrupted

 

Now, many years after the Shadow of the Colossus Preview version was first 'discovered' ... its debug capabilities are finally accessible.

Much of the debug code, present on the disk can now be used. There are some tools that don't work - they cause the game to crash.

It is best for one to see it for themselves:
Open the disk and rename "GAMECORE.XFF" to "GAMECOR.XFF", then place the "GAMECORE.XFF" from the attached archive in the same directory on the disk.
This file also works on the OPM, PSU and US versions of the game (all the files from the Preview version, not present in these versions need to be added).

Because most strings are in Japanese, in the attached archive there is a file containing their English translations. The translations are terrible - some are completely wrong, but for now I won't be fixing them. To apply them to an iso image of the disk, use the "modIso.exe" program from the attached file:
Place the iso file, SotC_Pv_str_patch.txt and modIso.exe in the same folder, them execute: ' modIso "nameOfTheIsoFile.iso" SotC_Pv_str_patch.txt '.

Once in-game, (or in the intro) hold left arrow on the D-pad and press Select.

To control the mouse cursor either connect a USB mouse to the PS2 or hold R1 on pad 1 and move the cursor with the left analog stick on pad 2. While the cursor it visible, on pad 1: circle = left mouse button, triangle = right, R3 = middle.
R1+R2+R1+R2 reloads the game.
If text is not visible (only when the game is loaded on a PS2), use the D-pad left arrow + Select combination while the game starts (before intro), to cause it to crash and reload. After that, text should be visible. (The "invisible text bug" proved very difficult to solve, so this workaround is necessary.)
For more button functions, see the attached file.


I don't take any responsibility for anything that may happen from using these programs. I can only guarantee that they run correctly in the conditions they were last tested and that they do not contain code intentionally meant to harm anything.

Although it may not look like that, it took a lot of time and effort to get things in the current state. Many tools were either not called, or had were missing entire functions, that had to be created.
The "Debug Root Menu", the "Player to camera" option, the address in "Memory Dump" and the text in "Debug Print" are not from the original game (the latter two are just examples).

 

Awesome, thanks for your work!
Is the keyboard of any use in the debug menu?
How long did it take you? Any places where you documented your progress?

 

Most of the functions for keyboard and mouse are present - in fact all, but the initialization functions. So I had to add the code that loads the IRX modules, binds to the IOP RPC server and set-up the RPC clent thread. Keyboard and mouse are both fully functional (not all are supported, though), but keyboard is never used (when a key is pressed the data in the keyboard structure changes accordingly, but nothing reads it). There are a string and a numbers input dialogues, and that is the most keyboard might have once been used for. There is no internal 'terminal', as far as I know.
Up to now it has been around three months (quite a while).
Besides here I haven't written anywhere else about this and don't plan to do so.
I expected questions about the network, PL2303 or the "Error screen".
The functions necessary to set-up network connection are present, and if modules are loaded and a configuration is present, the PS2 can be ping-ed. However nothing uses the network functions.
The PL2303 driver was most likely only used for printing (input functions are missing) debug messages (PL2303 is a Prolific USB - Serial adapter). It gets completely initialized, so it should be fully functional, but nothing uses its printing functions.
The "Error debug screen", on error, outputs the message "... or 'source s' to debugging and tracing". I was really curious about what "source s" was, but it turned-out that "source" is just a command for DECI2 dsedb - to run a script named "s" on the development PC.
The XFF file in the archive is a normal ELF, compiled with the homebrew PS2SDK, but converted to XFF format with a converter, coded by me.

 

I think the "source s" message meaning had been figured before, I can't quite remember.
I have the PL2303 adapter and you are right, nothing gets outputted through it.
When/how did you learn about the Preview version's existence? Just curious!
I need to get a PS2 out of storage to try all this stuff.

 

"I need to get a xxx out of storage to try all this stuff" - story of my life ha ha!

Thanks @wisi for your work on this

 

I'll be testing this on my PS3 soon to see if it can utilize the USB components.

Edit - I'm having difficulties patching after renaming and placing the new file into the ISO. It returns an error for each address that should be written. When it did work it was without using the newly supplied file, but it crashed on boot (to the crash handler).

I also noticed the small file size of the new file that is supposed to be used. It's 60 some kilobytes and not 1.9 megabytes like the one in the ISO already. Is there something I'm dong wrong here? Is it specifically for the patch or?

Edit 2 - got it working.
1) Extract the game data from the original preview build (or retail). Rename "GAMECORE.XFF" to "GAMECOR.XFF".
2) Add the supplied one from wisi to the newly extracted folder.
3) Load up ImgBurn and create image from files. Save as ISO and name as you feel
4) Burn ISO or load with PCSX2 or your PS3.

I'll upload the pre-fixed rom soon. I didnt use the patch fix for it because it gave me trouble. That and I need it for TCRF reasons

LINK TO THE ISO WITH NEW FILES WORKING

Spoiler

https://mega.nz/#!go4VTTYa!-6OP4s8uGuMwG155IoVQ4YOFhmfp21zIX2lbwK42B6E

Pictures since we all love those.

Spoiler

 

Have you thought about catching some gameplay on video and uploading it?

 

Yes. I was going to but i did something and locked the camera in place and couldnt unlock it so I was stuck.
Cutscenes and teleporting to places wouldnt help unlock it.

 

Depending on the Camera mode, the camera is controlled with the first or the second controller or some combination of both. Mostly all necessary information is in the "Usage.txt" file in the archive.
(Controller 1: D-pad Left + Select opens the Debug menu.)

 

I didnt have a second controller in when I did it, so clearly I did something with just the first.

I'll experiment more and see if I can do it again.

 

It was quite unexpected, actually: One afternoon I was listening to some music from ICO, when I noticed some Youtube videos about an ICO debug menu. I had no idea that such existed prior to that, and because ICO was (and still is) the last game I played and liked a lot (which happens very rarely), naturally, I was interested. It was no later than the evening of the same day, that I tried the ICO debug menu for myself. I couldn't believe how many options it had. So I expected to find the same debug functionality already uncovered in SotC. After quite a lot of searching, I was disappointed to find-out that there simply wasn't one already enabled. And sooner than I knew, I was exploring SotC, looking for answers to the mysteries lying among its code - in the Preview version. I found-out about the Preview version from the topics in this forum.
As I had never done anything like that before, work went slowly at first. Then, some time later, I finally figured-out how the modules (XFF) were loaded, how symbol names were assigned to symbols and so on, and managed to make cheat codes, which enabled the first debug tools I found. Loading the debug modules required quite a few cheat-codes and making more complex modifications was difficult, so I planned to attempt to make an XFF module, that would link to the game. This finally happened, when I was trying to get MAPTOOL to work, which used missing symbols. Because it is loaded dynamically, it always ends-up at a different memory location, so the only decent way to add the missing functions, was to actually add an XFF that contains them.
Once the ELF to XFF converter was complete, adding code to the game became quite easy.

@unclejun Do you have any idea where the Preview version came from? What was it actually used for?
I noticed, from the photo, that it was a DVD-R disk, which (AFAIK) couldn't possibly contain the PS2 protection wobble, meaning that it could not work on a normal (CEX) nor a TEST PS2, but only on a TOOL. In the photo, a TEST PS3 is visible, so perhaps it can read non-protected PS2 disks?
The code mentions "Preview Environment" (but in Japanese, so I'm not certain if that is the correct translation), in strings like "People of the Preview environment, please run 'make nico'" (paraphrased), which would be printed in case of an error (for example version mismatch). I am very keen to know what exactly was the purpose of the Preview version.