Scratchpad - Achilles.txt

Achilles' Scratchpad

- My random notes and codes for Melee hacking R&D, and for the 20XX Hack Pack. 
- started 2/6/15

/*
SUBLIME color coding edit

D:\Users\dowens\AppData\Roaming\Sublime Text 2\Packages\Assembly-Syntax-Definition-master\Assembly x86 AT&T.tmLanguage
*/
********************************
* Function Notes - Very Random *
********************************
- just add to this list whenever

8004cbc0   DataOffset_CheckIfOnDropThroughPlatform
           - input = r3 = internal data offset + 0x6F0 (1776)
             output = r3 = 0, then false

8006b82c - playerthink_physics
- input, r3 = external player data pointer

8008e5c4 - DI Trajectory Change
- input r3 = internal data offset
- after function, f6 = DI angle (radians)

8007d5d4 - DataOffset_Jumping_StoreAirBool_LoseJump_NoECBUpdate

80022C30   Angle_RetrieveGivenX&Y
inputs:
f1 = Y value
f2 = X value
(not sure if these matter)

output = f1 = degree (radians, 0 = right)
	I think output f6 or one of them is the float for degrees, instead of radians. maybe, unchecked.

*************************
* 20XX Stage File Names *
*************************

GrGb.hat	Great Bay Hacked
GrKg.hat	Kongo Jungle Hacked [no rock, logs, barrels]
GrSh.sat	Skyrule [Redux]
GrOy.hat	Yoshi's Island 64 Hacked [Milun]
GrOy.wat	WarioWare, Inc.

***************
* RTOC Values *
***************
-0x7658 = -1.00
-0x3C28 = -0.200
-0x778C = 0.0000
-0x7510 = 0.017453 (pi/180)
-0x76AC = 1.00
-0x3C30 = 2.00
-0x1764 = 4.00
-0x3C2c = 10.00

-0x7738 = 433000080000000 (lfd, "magic number")
-0x7740 = 0.003906 = hitbox radius/axis offset multiplier (multiplies subaction event hitbox)

-0x3d80 = 20000 = Home-Run Contest (HRC) collision extension amount (0x4DBC60)

-0x7ec8 = -50000 (TopN X-min before freezing game), see code line 8000e254
-0x7ec4 = 500000 (TopN X-max before freezing game)

**************
* r13 values *
**************

-0x4940 = player on-screen percents, how many are displayed (7 is four players that are scaled down)
-0x514C = pointer to 0x9fe0 in PlCo.dat (804d6554)
-0x5158 = pointer to stale move list multipliers
-0x51E4 = pointer to RAM collision link table
		1) take link number (r3)
		2) rlwinm r0,r3,3,0,28
		3) lwzx this result and pointer at -0x51e4
		4) result is a pointer to the stage file data for this link
 
	I think 8004dc90 find the new x/y coords for a player on a moving platform, 
	based on the collision link start and end loc currently standing on
	- 8005628c --> storing new collision point location
-0x51E8 = pointer to RAM collision data (some?)
-0x51EC = pointer to Coll_Data for current stage

-0x6c98 = DBLevel Flag
-0x6cb8 = Stage ID (804D49E8)

********************************
* Match/Character Data Structs *
********************************

804978a0 = event match

*********************************
* 20XX Custom Stage Flag Values *
*********************************
byte is @ 803fa2e5

Universal:
(00000001)
to
(00000007) = stage spawns (first 3 bits)

Battlefield:
(10) = water BG, set in stage init function
(40) = Custom Plats 1
(80) = Custom Plats 2
(C0) = Custom Plats 3

Pokemon Stadium:
(08) = water mode
(10) = rock mode
(20) = grass mode
(40) = fire mode
(80) = frozen, checked every frame on stadium

Final Destination
(40) = long stage floor (only for vanilla/textured final destination files, no model imports)
(80) = no background transitions

Brinstar
(80) = Disable rising lava

All-Star Rest
(80) = Disable portal from exiting stage

Corneria
(80) = Disable ships
(40) = Disable gun

Princess Peach's Castle
(80) = Disable Bullet Bill and switches

Mushroom Kingdom II
(80) = Disable Pidgit, Birdo, and Logs

Trophy Snag
(80) = Disable trophy drop

***************************
* Debug Menu Exits to CSS *
***************************
When exiting...
1a42f8 is executed.
	- stores r3=0 into 80479d31
	  - r3 is given 0 from 801b0a14
	- stores a 1 [byte] into 80479d3c

Then 1a4b60 is executed.
Then 1a43a0 is executed

041b0a14 38600002




Debug Menu Exits to Menus
- trying to find fix for CSS freezing
[Achilles]
Version -- DOL Offset ------ Hex to Replace ---------- ASM Code
1.02 ----- 0x801b0a14 --- 38600000 -> 38600001



	-==-


----------------------
**************************************************
* X/Y/Z Axis Pause Screen Translation w/ C-Stick *
**************************************************

PAUSE Camera Offsets:
80452f2c - [8bit] player the camera is focused on
80452f2d - [8bit] player who paused the game.

80452f7c = x pause camera translation
80452f80 = y pause camera translation
80452f84 = z pause camera translation

(p1)
4c1fd4 = x c-stick axis
4c1fd8 = y c-stick axis

(p3)
4c2060 = y axis

...so each player's c-stick axis is 0x44 away from one another!




inject @ 8002cb34
- function for storing pause camera offsets
-r29

# default code line
extsb r4,r0

#player number who paused game is in r0
lis r3,0x804c
ori r3,r3,0x1fac	# load P1 button input location
mulli r6,r0,0x44
add r3,r3,r6

#load dead zone (-0.28)
lwz	r6,-0x514c(r13)	# load PlCo.dat offset
lfs f17,0(r6)	# load 0.28
fneg f1,f17		# f1 is -0.28

C_STICK_Y:
#load c-stick y axis
lfs f15,0x2c(r3)
fcmpo cr0,f15,f1
ble- C_STICK_Y_GO
fcmpo cr0,f15,f17
blt- C_STICK_Y_END

C_STICK_Y_GO:
C_STICK_Y_CHECK_Z:
lwz	r6,0(r3)	# load current buttons
rlwinm. r6,r6,0,27,27	# (00000010)
beq-	C_STICK_Y_TRANSLATION
lfs f16,0x31C(r31)
fadd f16,f15,f16
stfs f16,0x31C(r31)
b	C_STICK_Y_END	# if Z trans, skip x trans

C_STICK_Y_TRANSLATION:
lfs f16,0x318(r31)
fadd f16,f15,f16
stfs f16,0x318(r31)

C_STICK_Y_END:

C_STICK_X:
#load c-stick x axis
lfs f15,0x28(r3)
fcmpo cr0,f15,f1
ble- C_STICK_X_GO
fcmpo cr0,f15,f17
blt- C_STICK_X_END

C_STICK_X_GO:
#load current x translation
lfs f16,0x314(r31)
fadd f16,f15,f16
stfs f16,0x314(r31)
C_STICK_X_END:

END:

--------------
Camera - Set Z dimension (?) to 0 on unpause
- otherwise unpausing after changing the z-axis translation makes camera weird
inject @ 801c5804 - lis r3,0x804a

lis r3,0x8045
li r4,0
stw	r4,0x2c84(r3)
lis r3,0x804a

************************
* Single Player Stages *
************************

Platform edges (default) are 18.800001 +- horizontal offset.
- 23.5 (0x41bc0000) is value if battlefield wasnt scaled down.



Strings: Horizontal - F92705
Size Mult: F92719




Pointer to platform link data
c17240

@458e88 pointer, the value at that address is
80c29700 (no items, reg)

c4094558

ccb7b0 - memory write bp
	- 342b4

Good Spawn:
X- 537 = 44064000
Y- 190 = 433e0000

207e34



Good Spawn Hyrule Maze:
X = -88 = 42b00000
Y = -226 = c3620000

+$Yoshi's never spawn on adventure
04207e68 60000000
$Adventure Mush never enters new stage state
04207e2c 3800FFFF
$Test No Yoshis on Adventure and no Link spawn
0416a4c8 4e800020


Hyrule Maze
16a4c8 branched into from 80016d084


Function 67c98 controls initializing spawn positions x/y coords into player and other character data offset related things
	-executed at beginning of match and after death, about to respawn

****************************************************
* Custom Spawn Points Function - 20XX Spawn Points *
****************************************************

**NEW 20XX Spawn Points
- updated 7/18/15
- need to add in legal stages under the NEUTRAL SPAWNS flag check
- first 3 bits of the custom stage flag refer to the spawn points (so a max of 7 spawns)
	- if first three bits = 0 then no custom spawns occur

- Nana and Popo spawn 10 meleemeters apart, offset 5 and -5 from xcoord spawn point


inject @ 67cf4
- r0 = 0xff at this point, will need to restore if written over
- r3 is good to use

lis	r3,0x8048
lbz	r3,-0x62D0(r3)	#load menu controller major
cmpwi	r3,0x1c		# is this training mode?
beq-	GO_SPAWN
lis	r15,0x801a
ori	r15,r15,0x4340	# load function: MenuController_CheckSinglePlayer
mtlr	r15
blrl
cmpwi	r3,1		# if in single player, skip all this
beq-	END

GO_SPAWN:
lis	r19,0x8040
lbz	r17,-0x5d1b(r19)# load custom stage flag (ex. hyrule stage number)
cmpwi	r17,0xff	# ff is flag for ignore spawns even if stage is in custom spawn list
beq-	END
rlwinm	r17,r17,0,29,31 # extract out custom spawn bits (first 3 bits)

lis	r16,0x8047
lwz	r15,-0x493C(r16)# load match frame count @ 8046b6c4
cmpwi	r15,0		# check if at beginning of match
bne- 	END


lhz	r15,-0x248A(r16)	# load stage ID from 8046DB76

##CUSTOM EXCEPTION FOR LAGLESS FOD###
#cmpwi	r15,2		# is stage fountain of dreams?
#bne-	CONTINUE_SPAWN
#lis	r18,0x801d
#lhz	r18,-0x4170(r18)
#cmpwi	r18,0x4800	# if lagless, no plat FoD is on
#bne-	CONTINUE_SPAWN
#li	r17,1		# make second custom spawn happen


CONTINUE_SPAWN:
lis	r18,0x8000
ori	r18,r18,0x4224 	# 8004224 = -0x8 from pointer table start

NEUTRAL_START_CHECK:
#neutral starts are first entries in spawn table
lwz	r19,-0x5C6C(r19)# load neutral spawn points flag
cmpwi	r19,0
bne-	POINTER_REPEAT
# if neutral start off...
cmpwi	r17,0		# are spawn bits present?
bne-	POINTER_REPEAT	# if so, make spawns happen
addi	r18,r18,0x30	# skip first 6 stages in list (legal stages, no pokemon)


POINTER_REPEAT:
lwzu	r19,8(r18)	# load custom spawn stage ID
cmpwi	r19,0		# if null, end check loop
beq-	END
cmpw	r19,r15		# compare current stage to custom spawn stage flag
bne-	POINTER_REPEAT


subi	r16,r16,0x4925	# get r16 to P1's spawn ID byte (8046b6db, players are 0xe apart)
lwz	r18,4(r18)	# load specific stage spawn custom offsets address	
mulli	r17,r17,0x20	# stage spawn values are 0x20 apart
add	r18,r18,r17	# get to this spawn

SPAWN_EXECUTE:
lbz	r15,0xc(r27)	# load player port number
lis	r17,0x8048
lbz	r17,-0x62D0(r17)#load menu controller major
cmpwi	r17,0x1c	# is this training mode?
beq-	SPAWN_EXECUTE_FOR_REAL
mulli	r17,r15,0xe	# spawn IDs are 0xE apart
lbzx	r15,r17,r16	# load spawn ID
cmpwi	r15,0xFF	# is default spawn point?
beq-	END		# skip if so, for safety
SPAWN_EXECUTE_FOR_REAL:
mulli	r16,r15,0x8	# player [custom] spawns are 0x8 apart (X & Y coord = 0x8 length)
add	r16,r16,r18

SPAWN_END:
FACING_DIRECTION:
lis	r18,0x3f80	# default face right
cmpwi	r15,1		# is this P2 spawn location?
beq-	FACE_LEFT
cmpwi	r15,2		# is this P3 spawn location?
bne-	END_FACING
FACE_LEFT:
lis	r18,0xbf80
END_FACING:
stw	r18,0x2c(r27)	#store facing direction


lfs	f0,0x2c(r27)	# load facing directio
lfs	f1,-0x10f0(r2)	# load float 5 (for ice climbers)
fmuls	f1,f1,f0
lwz	r18,0x4(r27)	# load internal char ID

lfs	f0,4(r16)	# load custom y coord spawn point
stfs	f0,0x10(sp)	# store custom y coord spawn point
lfs	f0,0(r16)	# load custom X coord spawn point
cmpwi	r18,0xa		# Popo?
bne-	NANA_CHECK
fadds	f0,f0,f1
NANA_CHECK:
cmpwi	r18,0xb		# Nana?
bne-	STORE_X
fneg	f1,f1
fadds	f0,f0,f1
STORE_X:
stfs	f0,0xc(sp)	# store custom X coord



END:
li	r0,0xff		# default register value at function start
lfs	f0,0xc(sp)	# default code line


***********************************************
* Neutral Start Spawn Points for Legal Stages *
***********************************************

Fountain of Dreams = 3fa600 in DOL (contains two, second is for no plats)
P1:
X = -41.25 = c2250000
Y = 21 = 41a80000

P2:
X = 41.25 = 42250000
Y = 27 = 41d80000

P3:
X = 60 = 42700000
Y = 5 = 40a00000

P4:
X = -60 = c2700000
Y = 5 = 40a00000


Pokemon Stadium
- none needed. spawns are good as long as P1&P4 are on a team

Yoshi's Story = 0x3fa640 in DOL
P1:
X = -42 = c2280000
Y = 27.453487 = 41dba0be

P2:
X = 42 = 42280000
Y = 28 = 41e00000

P3:
X = 42 = 42280000
Y = 5 = 40a00000

P4:
X = -42 = c2280000 
Y = 5 = 40a00000


Battlefield = 0x3fa5c0 in DOL (contains 2 spawns, second is for custom plats)
P1:
X = -38.799999 = c21b3333
Y = 35.200001 = 420ccccd

P2:
X = 38.799999 = 421b3333
Y = 35.200001 = 420ccccd

P3:
X = 38.799999 = 421b3333
Y = 5 = 40a00000

P4:
X = -38.799999 = c21b3333
Y = 5 = 40a00000


Dreamland 64 = 3fa580 in DOL (contains 2 spawns, second is for hacked DL)
P1:
X = -46.599998 = c23a6666
Y = 37.221500 = 4214e2d1

P2:
X = 47.389099 = 423d8e70
Y = 37.321503 = 42154938

P3:
X = 47.389099 = 423d8e70
Y = 5 = 40a00000

P4:
X = -46.599998 = c23a6666
Y = 5 = 40a00000


Final Destination = 0x3fa660 in DOL
P1:
X = -60 = c2700000
Y = 10 = 41200000

P2:
X = 60 = 42700000
Y = 10 = 41200000

P3:
X = 35 = 420c0000
Y = 10 = 41200000

P4:
X = -35 = c20c0000
Y = 10 = 41200000


Kongo Jungle 64 = 3fa560 in DOL
P1:
X = -58 = c2680000
Y = 7 = 40e00000

P2:
X = 58 = 42680000
Y = 7 = 40e00000

P3:
X = 21 = 41a80000
Y = 0 = 00000000

P4:
X = -21 = c1a80000
Y = 0 = 00000000

---------------------------------------

Hyrule Maze 20XX Spawn Points:
NOTE: These have changed after increasing the scale of the stage by 1.25

(0) TOP LEFT [reverse battlefield]

P1
X: -101 = c2ca0000 
Y: 96 = 42c00000

P2
X: -32 = c2000000
y: 96 = 42c00000

P3
X: -32 = c2000000
Y: 155 = 431b0000

P4
X: -101 = c2ca0000
Y: 155 = 431b0000

(1) BOT LEFT [angled down]

P1
X: -119 = c2ee0000
Y: -195 = c3430000

P2
X: -58 = c2680000
y: -195 = c3430000

P3
X: -54 = c2580000
Y: -226 = c3620000

P4
X: -123 = c2f60000
Y: -226 = c3620000


(2) BOT RIGHT [single mid platform]

P1
X: 467 = 43e98000
Y: -333 = c3a68000

P2
X: 534 = 44058000
y: -333 = c3a68000

P3
X: 548 = 44090000
Y: -333 = c3a68000

P4
X: 450 = 43e10000
Y: -333 = c3a68000


(3) MID BOT RIGHT [two flat platforms]

P1
X: 678 = 44298000
Y: -63 = c27c0000

P2
X: 745 = 443a4000
y: -63 = c27c0000

P3
X: 745 = 443a4000
Y: -95 = c2be0000

P4
X: 678 = 44298000
Y: -95 = c2be0000


(4) TOP BOT RIGHT [angled up]

P1
X: 567 = 440dc000
Y: 128 = 43000000

P2
X: 635 = 441ec000
y: 128 = 43000000

P3
X: 635 = 441ec000
Y: 96 = 42c00000

P4
X: 567 = 440dc000
Y: 96 = 42c00000


(5) TOP RIGHT [battlefield style]

P1
X: 526 = 44038000
Y: 269 = 43868000

P2
X: 594 = 44148000
y: 269 = 43868000

P3
X: 594 = 44148000
Y: 239 = 436f0000

P4
X: 526 = 44038000
Y: 239 = 436f0000



-----------------

Mushroom Kingdom Adventure 20XX Spawn Points

P1
X: 542 = 44078000
Y: 190 = 433e0000

P2
X: 608 = 44180000
Y: 190 = 433e0000

P3
X: 608 = 44180000
Y: 164 = 43240000

P4
X: 542 = 44078000
Y: 164 = 43240000


Camera Stuff:
camera left = -150 = c3160000
camera right = 150 = 43160000
camera top = 87.5 = 42af0000
camera bottom = -100 = c2c80000

Good Zoom value?: 43160000 = 150

left blastzone = -200 = c3480000
right blastzone = 200 = 43480000
Top Blastzone: 160 = 43200000
(inbetween battlefield and Yoshi's Story)
Bottom Blastzone: -160 = c3200000

inject @ 80207abc
- gets executed when Yoshi's are about to spawn

lis r15,0x8047
ori r15,r15,0x9d30
lbz r15,0(r15)
cmpwi r15,2
bne- END
lis r15,0x8049
ori r15,r15,0xe6c8
lis r16,0xc316 #camera left limit
stw r16,0(r15)
lis r16,0x4316 #camera right limit
stw r16,4(r15)
stw r16,0x34(r15) #zoom
lis r16,0x42af #camera upper limit
stw r16,8(r15)
lis r16,0xc2c8 #camera bottom limit
stw r16,0xc(r15)
lis r16,0x3d4c
stw r16,0x20(r15)
lis r16,0x3e20
stw r16,0x24(r15)
lis r16,0x3f80
stw r16,0x28(r15)
stw r16,0x2c(r15)
lis r16,0x3fa0
stw r16,0x30(r15) #camera speed
lis r16,0xc348 #left blastzone
stw r16,0x74(r15)
lis r16,0x4348 #right blastzone
stw r16,0x78(r15)
lis r16,0x4320 #top blastzone
stw r16,0x7c(r15)
lis r16,0xc320 #bottom blastzone
stw r16,0x80(r15)
END:
lwz r0,0xc(sp)



-------------------------
Random

209528 - gets executed when hyrule maze stage is switching. part of huge function

209018 comparison for starting stage transf?

P1
X: -119 = c2ee0000
Y: -196 = c3440000

----------------------------------
Hyrule Maze BlastZone Camera Fix
Inject @ 209020
- injected at function that gets executed when stage transf is happening


lis r15,0x8047
ori r15,r15,0x9d30
lbz r15,0(r15)
cmpwi r15,2
bne- END
lis r15,0x8049
ori r15,r15,0xe6c8
lis r16,0xc320 #camera left limit
stw r16,0(r15)
lis r16,0x4320 #camera right limit
stw r16,4(r15)
lis r16,0x42c8 #camera upper limit
stw r16,8(r15)
lis r16,0xc2a4 #camera bottom limit
stw r16,0xc(r15)
lis r16,0x3f80
stw r16,0x30(r15) #lower camera speed
lis r16,0xc360 #left blastzone
stw r16,0x74(r15)
lis r16,0x4360 #right blastzone
stw r16,0x78(r15)
lis r16,0x4324 #top blastzone
stw r16,0x7c(r15)
lis r16,0xc310 #bottom blastzone
stw r16,0x80(r15)
END:
subi r26,r29,189
------------------------------

Auto Restart Hyrule Maze if Necessary

inject @ 801a4164

#load match frame counter
lis r15,0x8046
ori r15,r15,0xb6c4
lwz r15,0(r15)
cmpwi r15,0
bne- END
lis r15,0x8048
lhz r15,0x0686(r15)

#is stage hyrule maze?
cmpwi r15,0x3f
bne- END
li r15,2
stb r15,3(r31)
END:
li r0,0

---------------------

Fix Hyrule Camera Jerk During Respawn
04167210 60000000
04167214 60000000

For DOL mod,

Inject @ 8016720C

#default code line
lfs f2,0x20(sp)
lis r15,0x8047
ori r15,r15,0x9d30
lbz r15,0(r15)
cmpwi r15,2
bne- END
#branch to 80167218
nop
END:
#branch back to 80167210
nop

Nah, nvm. Let's just put it in MnSlChr

****************************
* In-Game Random Function? *
****************************
8025fb50   Executed when opening a CPU slot (to get random character)

0x80380580
- r3 input is max random value (like 1+max)?
- r13 = 4db6a0
- outputs random value in r3, that is between 0x0000 and input r3 value


******************************
* Trophy Stage Custom Spawns *
******************************

P1
X = -44.904125 = c2339dd3
Y = -27.298401 = c1da6320

P2
X = 44.904125 = 42339dd3
Y = -27.298401 = c1da6320


P3
X = 44.904125 = 42339dd3
Y = -54.486713 = c259f265

P4
X = -44.904125 = c2339dd3
Y = -54.486713 = c259f265

******************************
* Pokemon No Transform Logic *
******************************

Function 801d4548 controls Pokemon stadium transformations.

Have it look at custom stage flag and if not zero, don't transform.

Inject @ 801d4548

lis r15,0x803f
ori r15,r15,0xa2e5
lbz r15,0(r15)
cmpwi r15,0
beq- END_NORMAL

NO_TRANSFORM:
blr

END_NORMAL:
mflr r0

*******************
* Invisible Items *
*******************

80268b48 - lwz r0,28(r1)
r31 open for use


li r31,0
cmpwi r3,0
beq- END
stw r31,0x1c(r3)
END:
lwz r0,28(r1)

-works.-

For 20XX, flag @ 3fa224 = invisible items


lis r31,0x803f
ori r31,r31,0xa224
lwz r31,0(r31)
cmpwi r31,0
beq- INVISIBLE_OFF
li r31,0
cmpwi r3,0
beq- INVISIBLE_OFF
stw r31,0x1c(r3)

INVISIBLE_OFF:
lwz r0,28(r1)

------------------

*********************************************
* No Single Player Spawns if in Multiplayer *
*********************************************

No Link/Yoshi Team Spawns - keeps these levels from freezing
0416a4c8 4e800020

Now, let's have it check the multiplayer yes/no bit and only "blr" if in multiplayer.

inject @ 8016a4c8

lis r15,0x8047
ori r15,r15,0x9d30
lbz r15,0(r15)
cmpwi r15,2
bne- END
blr
END:
#Default code line
mflr r0

Works.

******************************
* Doraki Edge Angle Limit *
******************************
(-94.09, -54.4985)
(-89.9821,-100)
Testing coords. Gives angle of 84.84 degrees.

Basically, 

--------------------
\ x)
 \
  \
   \
    \

if x > 85 degrees then Doraki will take effect.


******************
* Button Presses *
******************

P1 - 4c1fac
0x0 = all buttons being pressed
0x4 = buttons on last frames?
0x8 = new buttons pressed this frame, else 0

Each player is 0x44 apart!

XXXXYYYY

0xXXXX = analog joystick/c-stick -> digital values
-ignore for now, holding opposite cardinal directions cancel each other out?

0xYYYY -> what buttons are pressed?
	1000 ssss = START
	0200 ssss = B
	0100 ssss = A
	0800 ssss = Y
	0400 ssss = X
	0010 ssss = Z
	0040 ssss = L
	0020 ssss = R
	0008 ssss = D UP
	0004 ssss = D DOWN
	0001 ssss = D LEFT
	0002 ssss = D RIGHT

***************************
*Hitbox Interpolation 1.02*
***************************
Magus
0x6be8 (0xa008)
- gets executed when performing moves with collision bubbles enabled.

0400a008 80e3004c
0400a00c 80030050
0400a018 80030054



************************
* Forcing Human Inputs *
************************
ActionStateHandler
- function analysis

All Humans Hold Joystick Right
0406ae74 3c003f80
0406ae78 901f0620

Digital Buttons - can input at 0x6b02c
---------------


6adf8 - loads DBLevel Flag
- only executed for CPU
- if in Develop mode, branch to storing zero in c-stick axii



324f8
only executed if +221f contains (00000008)
  - check if CPUs contain this

	if so,
	load External player ID, multiply by 3, add to 803bcdc0
        load byte at +0x22
        compare to 0


8006af10 is where the analog Human and CPU only sections meet and continue. Analog data can be loaded here for forcing inputs to Human or CPU.

If only want to force CPU analog inputs, can load at 8006ae50.


8006af10 - begin dead zone comparisons
8006aff0 - end of dead zone checks. all analog values have been adjusted at this point.

8006b000 - begin CPU load digital button inputs

8006b008 - store CPU button inputs to data offset
****This is the ideal place to force CPU only actions****
(ones that can NEVER be executed by a human player)

8006b010 - begin HUMAN load digital button inputs

8006b02c - CPU and HUMAN digital button input sections meet here.
8006b02c - branch to check for single button mode

8006b070 - where code goes to if not in single button mode.

8006b070 - load digital buttons
8006b074 - is L/R being pressed?

8006b088 - storing 1.00 to analog trigger info if digital L/R is pressed

8006b098 - compares analog info to 0
8006b0bc - is Z being pressed?
8006b0d8 - load 0.35 into analog data


8006b540 - executed if instant A or Z is pressed
8006b690 - only executed if player's character cannot accept inputs (stamina lie dead, match start, etc.)


************
* Mem Copy *
************
memcpy
-modifies r3,r4,r5,r6

Example:

lis r4,0x8045
ori r4,r4,0xf000	#source
lis r3,0x817c
ori r3,r3,0x1000	#destination
li r5,0x4000		#size
lis r12,0x8000
ori r12,r12,0x31f4
mtctr r12
bctrl

*************************************
* Enable Frame Advance in All Modes *
*************************************

Enable Frame Advance in Regular Vs.
041a4dec 38000004
041a49bc 480000B0

Default hex lines are
1a4dec - 800d9368
1a49bc - 418200b0


Frame Advance Research---
Function: 801a4d34

801a4e98
If frame advance is ON,
80479d58
	+0x10 = 1
	+0x11 = 1


Alright. So when frame advancing with Z and controller data is being put from system into data offset (8006af10),
0x80479d68 = 01010001

otherwise, during normal play it = 00000000

--
Aside:
When frame advance paused:
0x80479d68 = 01010000

When paused:
0x80479d68 = 02020000

-----

Revisiting (5/13/16)

@ 80479d68
bytes within the word have various functions
0x00 = screen frozen state bitflags
	(00) = normal screen, not frozen
	(01) = Develop Mode frame advance frozen
	(02) = Paused
	(10) = GAME! (match end)
0x01 = screen frozen state of last frame?
0x02 = 0x01 means advance a frame during FrameAdvance frozen
0x03 = change state/go bit



Freeze (like Develop Mode): set to 0x01010001
Frame Advance: set to 0x01010100
Unfreeze: set to 0x00000001


8016baf4 - Buttons_START_InstantCheck
	- for Develop Mode Pause
8016bbb4 - Buttons_Z_InstantCheck
	- for Develop Mode Frame Advance

when in a match, these two function pointers can be seen at 80479d6c

Disable Frame Advance on Match Start
inject @ 8016baf4
- for first two frames
- Memory leak could occur with Save State code without doing this
- Other codes should probably be refactored rather than using this logic

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set sceneFrameCount, 0x80479d60

word_load r3,r3,sceneFrameCount
cmpwi r3,2
bge- END
li r3,0	# set instant start press to false
blr
END:
li r0,0	# default code line


*********************************
* SDR Active Debug Menu Changer *
*********************************

- needs to be executed every frame of game in debug menu
- look at character info select flag, multiply by 0x4, add to copy list pointer table, pull that address and use as source for copying 0x2f0 amount of data to 80F98A50

Inject @ 803039a8
(wParam modified debug menu control function)

#Pointer table start - 80F98DC0
lis r15,0x80f9
ori r15,r15,0x8dc0

#load character info flag - 803fa1b0
lis r14,0x803f
ori r14,r14,0xa1b0

lwz r14,0(r14)
mulli r14,r14,0x4

#Start debug menu copy
#save register values
mr r16,r3	
mr r17,r4	
mr r18,r5	
mr r19,r6	
mflr r21	
#source - load start of specific player's active menu start
lwzx r4,r14,r15

#if they don't have a menu, dont do anything
#eventually change this to the "NO CHANGES" menu
cmpwi r4,0
beq- REVERT_REG_BACK

#destination
lis r3,0x80F9
ori r3,r3,0x8a50

#size
li r5,0x2f0

#branch to memcopy
lis r12,0x8000	
ori r12,r12,0x31f4	
mtctr r12	
bctrl

REVERT_REG_BACK:	
mtlr r21	
mr r3,r16	
mr r4,r17	
mr r5, r18	
mr r6,r19	
 
#default code line
li r8,0


*********************
* ECB Toggle Tests *
********************
Develop Toggle Functions Branches
04225908 60000000
04225924 60000000
0422593c 60000000
04225954 60000000
0422596c 60000000
0422597c 60000000

04225988 60000000
04225998 60000000

In here
*The branch at this address controls R+D-Pad Down! and L+D-Pad Down
042259a4 60000000


042259bc 60000000
042259d4 60000000

-------------------

804D6B50 = ECB toggle value 

0422558c 38600000
042255a4 38000000

mflr r15
lis r16,0x8022
ori r16,r16,0x6e0c
mtctr r16
bctrl
mtlr r15
blr

---------------------


Investigating beginning of Player Think Function

32510 - checks if player is cpu ?? can load controller/button info here ??

------------------------------------------

************************************************************
* Attacks dealing less than 1% have no Hitlag or DIability *
************************************************************
From Magus

040771E0 60000000
040772A4 60000000
040781D4 60000000
04076A48 60000000
04076B9C 60000000
04077A1C 60000000
04077B70 60000000
04076D3C 60000000
040776FC 60000000


**************************************
* Hitbox Displays Do Not Interpolate *
**************************************
0400a008 80e3004c
0400a00c 80030050
0400a018 80030054

default hex lines:
a008 = 80e30058
a00c = 8003005c
a018 = 80030060


Disable Hitbox Displays (still enables hurtboxes)
04009f54 4e800020

-----------------

Disable Hurtbox Displays (still enables hitboxes)
040806f0 38000000

Disable Hurtbox Invinc/Intang
04080764 38000000

800805c8  DrawCharacters
	8056f0 - pulls the 	


80009f54  DisplayHitboxes
8000a244  DisplayHurtboxes
8000a584  DisplayInvincIntang
	- r24 = 1 = invincibility. = 2 = intangibility
a584?

+119e = byte, # of hurtboxes on character, modifiable to remove hurtboxes
stuff below this is hurtbox info!
	- like hurtbox scale/axis scale



Hitbox Display Colors!!!!
804d36a0 - red hitboxes [ff000080]
804d36a4 - purple grab boxes [ff00ff80]
804d36ac - yellow hurtboxes [ffff0080]
804d36b4 - green invincibility [00ff0080]
804d36bc - blue intangibility [0000ff80]
...more colors but idk what for.


Okay, okay. Can I make hitboxes different colors for different strengths?
Set breakpoint in DisplayHitboxes at 0x80009f6c.
	at this point,
	- r3+
	0x8 = int of hitbox damage
	0xc = float of hitbox damage
	0x1c = size?
        0x20 = int angle
        0x24 = int knockback growth
        0x2c = int base knockback

inject @ 80009f6c

lis r15,0x804d
li r17,0
lwz r16,0x8(r3)
mulli r16,0xa

stb r16,0x36a2(r15)

--------------------------

Advanced Collision Bubbles:
-Teal During Hitstun
-Orange hitlag
-drops opacity by 50% on last frame of either
- could add nontumble/tumble hitstun, I guess. If greater than or equal to 32 frames of hitstun, then it is tumble hitstun.

inject @ 8000a264 - mr r29,r5
- within function: CollisionBubble_HurtboxDisplay
- can use r29,r6,r0,r30

lis	r6,0x804d	# load first half of hurtbox color address
lis	r30,0xffff	# load default hurtbox color = yellow, 128 alpha
ori	r30,r30,0x0080
lwz	r29,0x227c(r27)	# check if in hitstun
rlwinm. r29,r29,0,6,6
beq-	HURTBUBBLE_CHANGE_END
lbz	r29,0x227a(r27)	# if contains (00000020) then in hitlag
cmpwi	r29,0
beq-	TEAL

ORANGE:
lis	r30,0xff80
ori	r30,r30,0x0080	# 0xff8000 = orange
lwz	r29,0x19bc(r27)	# load frames of hitlag left
b	LAST_FRAME_CHECK

TEAL:
lis	r30,0x00ff
ori	r30,r30,0xff80	# 0x00FFFF = teal
lwz	r29,0x23a0(r27)	# load frames of hitstun left

LAST_FRAME_CHECK:
lis	r0,0x3f80	# load float 1 into r0
cmpw	r29,r0		# one frame of hitlag/hitstun left?
bne-	HURTBUBBLE_CHANGE_END
subi	r30,r30,0x40	# cut opacity in half

HURTBUBBLE_CHANGE_END:
stw	r30,0x36ac(r6)
mr	r29,r5		# default code line

***************************
* Custom Hitbox ID Colors *
***************************

80009f60
- r25 = hitbox ID (0-indexed)

lwz	r0,0(r3)	# default code line, load hitbox active bool

cmpwi	r25,0
beq-	HITBOX_ZERO
cmpwi	r25,1
beq-	HITBOX_ONE
cmpwi	r25,2
beq-	HITBOX_TWO
HITBOX_THREE:
lis	r5,0xFF80
ori	r5,r5,0x0080	# FF8000 = Orange
b	COLOR_FINISH
HITBOX_ZERO:
lis	r5,0xFF00	
ori	r5,r5,0x0080	# FF0000 = Red
b	COLOR_FINISH
HITBOX_ONE:
lis	r5,0x00FF
ori	r5,r5,0x0080	# 00FF00 = Green
b	COLOR_FINISH
HITBOX_TWO:
lis	r5,0xFF00
ori	r5,r5,0xFF80	# FF00FF = Magenta
COLOR_FINISH:
stw	r5,-0x8000(r13)	# store color @804d36a0 = hitbox RGBA value
	

------

For 20XX 4.0

80009f60

lwz	r0,0(r3)	# default code line, load hitbox active bool

lis	r5,0x8040	# 803fa34c = debug menu toggle for hitbox color IDs
lwz	r5,-0x5CB4(r5)
cmpwi	r5,0
beq-	HITBOX_ZERO	# if ID Colors flag is OFF, then make them red (default)


cmpwi	r25,0
beq-	HITBOX_ZERO
cmpwi	r25,1
beq-	HITBOX_ONE
cmpwi	r25,2
beq-	HITBOX_TWO
HITBOX_THREE:
lis	r5,0xFF80	# FF8000 = Orange
b	COLOR_FINISH
HITBOX_ZERO:
lis	r5,0xFF00	# FF0000 = Red
b	COLOR_FINISH
HITBOX_ONE:
lis	r5,0x00FF	# 00FF00 = Green
b	COLOR_FINISH
HITBOX_TWO:
lis	r5,0xFF00
ori	r5,r5,0xFF00	# FF00FF = Magenta
COLOR_FINISH:
stw	r5,-0x8000(r13)	# store color @804d36a0 = hitbox RGBA value
lis r5,0x8040
lwz r5,-0x5CBC(r5)	# load custom hitbox opacity from Debug Menu
stb r5,-0x7FFD(r13)


**********************
More Walljump Research
**********************

8008169c    CheckWalljump


+0x884, precheck for instant walljumping (and maybe just walljumping in general)
	0x00000040 = no instant walljump (right side of Yoshis Island Hack)
        0x00000021 = instant walljump (left side of Yoshi's)

These values are 0 when hanging on edge and then get changed before hitting start of function

+2b8 (attribute) is accessed when dropping off ledge
- changing this attribute to anything greater than 1 disables walljumping for this character?


800453e8 this comparison. check r3 when dropping off both ledges

45468 only gets executed when leaving edge from right side of stage (??!!)

45cc8 - ori r0,r0,0x0020
45ccc - stw r0,0x134(r31)
stores 0x00000020 for causing instant walljump

-bottom of this function-

4561ec - ori r0,r0,0x1
461f0 - stw r0,0x134(r31)

what is -0x5214+ 0x4db6a0? I'm seeing this a lot.

----------------

*********************
* File Loading (?) *
*********************

800163d8   Involved with loading files into RAM, I think
80016204   Gets the string file name...


163f8 - bl ->0x80016204
16400 - bl ->0x8033796c (DVDConvertPathtoEntrynum)
		I think this function actually loads the file. NO.

800163d8 is branched into from 80016c64
-----------------------

0x8033796c (DVDConvertPathtoEntrynum)
input:
r3 = pointer to ASCII filename

output:
r3 = file entry num (int), = -1 if file doesn't exist

use as check for valid filename

***********
* usa.ini *
***********

within filesystem of NTSC game discs.

The game looks for this file upon boot and loads in Japanese if doesn't exist.

**********
* Random *
**********

8008dd90 - writing initial hitstun value?


8008fe60 - subtracts one from hitstun every frame

*************************************************
* Character Specific Data Offset Initialization *
*************************************************
Pointer Table based on Char ID
RAM - 803c11d8

***********************
* Nana/Secondary Char *
***********************

To dematerialize secondary player after death, have static player block +D equal to 01 (I think is default). Then have 0x2222 (0x2282 external) from data offset be 0x04.

Nana CPU AI Type (0x6) is rewritten to data offset after every death at code line 800a1060

****************
* Stamina Mode *
****************
c8e74 - executed when stamina gets to 0%.
	r3 = start of player data offset.
	has masterhand and crazy hand checks
167470 - check if in stamina mode
1b97c4 - end a stamina match?

dying in stamina mode-
351fc - executes branch link if 0x88+staticplayerblock = ffffffff

how to enter stamina red flash state?
try setting 0x2225 to 1. Or 221f?

*********************************
* Stamina Mode 0HP = DeadUp *
*********************************

inject @ 800c8cdc
- r3 = external data offset start

lwz	r4,0x2c(r3)	# load char entity data start
lwz	r4,4(r4)	# load internal char ID
cmpwi	r4,0x1b		# is master hand?
beq-	DEFAULT_BRANCH
cmpwi	r4,0x1c		# is crazy hand?
beq-	DEFAULT_BRANCH

DEADUP:
lis	r4,0x800d
ori	r4,r4,0x3e40	# 800d40b8 = AS_DeadUp
mtlr	r4
blrl
b END
DEFAULT_BRANCH:
lis	r4,0x800c
ori	r4,r4,0x8e74
mtlr	r4
blrl
END:


Might be better to just change this to DEFAULT_BRANCH if in a single player mode.


****************
Random Hitstun (?)
*****************

4D87A0 = float, 1
	= amount subtracted per frame from hitstun? (while being hit from missed tech only? Yes, I think so - 8009f20c)


Function:
8009f1e0   controls standing up after laying on ground for max time (only while facing down), and controls action states to enter into when getting hit while laying down (jabresets, for example).

*********************************
* CSS Default Get Button Inputs *
*********************************

CSS Dead Zone
(x^2 + y^2) < 200
where x and y are s8 byte values from -80 to +80. (joystick)


80263250 - lbz r0,-0x49AE(r13) # load byte at 804D6CF2
80263254 - cmplwi r0,0
80263258 - bne- 0x80263334
8026325c - rlwinm. r0,r7,0,19,19 #is player pressing Start?
80263260 - beq- 0x80263334  # branch if player is not pressing Start

Start to go to SSS Always Works on CSS
+$Start Works at CSS Always
04263258 60000000
0426326c 60000000

BUT, let's make a check so that it will only work when on the vs. mode css and at least 1 character is selected to avoid game freezes.

inject @ 80263254

#check if at vs mode CSS
lis r15,0x8047
ori r15,r15,0x9d30
lbz r15,0(r15)
cmpwi r15,2
bne- END

#make sure min 1 char is selected
lis r15,0x8043
ori r15,r15,0x2087
li r16,6
mtctr r16
REPEAT_CHECK_CHAR:
lbzu r16,8(r15)
cmpwi r16,0x21
bne- PASS_CHECK
bdnz+ REPEAT_CHECK_CHAR
b END
PASS_CHECK:
li r0,1
stb r0,-0x49a9(r13)
li r0,0

END:
cmplwi r0,0

*I ended up not using this code and combined it with the Rumble Menu Code.

------------

D-Pad Down Goes Back to Menu and initiates Rumble Screen flag
inject @ 80263250

lis r15,0x8047
ori r15,r15,0x9d30
lbz r15,0(r15)
cmpwi r15,2
bne- DEFAULT

#copy chars
li 15,80
mtctr r15
lis r16,0x8048
ori r16,r16,0x07b4
lis r17,0x8045
ori r17,r17,0xac4c
REPEAT:
lwzu r15,0x4(r16)
stwu r15,0x4(r17)
bdnz+ REPEAT

rlwinm. r0,r7,0,29,29
beq- DEFAULT
lis r15,0x803f
li r16,1
stb r16,0x0a47(r15)
li r16,2
stb r16,-0x49aa(r13)
DEFAULT:
lbz r0,-0x49ae(r13)

--------------------

Disable Current CSS Selections being overwritten when immediately exiting and returning

inject @ 801a5650

lis r15,0x803f
lbz r16,0x0a47(r15)
cmpwi r16,1
bne- END
li r16,0
stb r16,0x0a47(r15)
mr r5,r3
END:
lwzu r4,0x8(r5)



*****************************
* Fixed Camera Value Writes *
*****************************

Memory write at 0x80452C9c (holds camera depth)
- broke @ 8002df34

80452Ce0 is the depth max used for comparison


Static Values!
Camera
Starts @ 8049e6c8
0x5c = fixed camera, x-axis offset
0x60 = fixed camera, y-axis offset
0x64 = fixed camera, depth max
0x68 = fixed camera, zoom or something (8049e730)
0x6c = fixed camera, tilt about x-axis
0x70 = fixed camera, focus point x-axis


***************
* Event Match *
***************
line 0x24d964 - add r3,r3,r0
 - results of this is the event match to be loaded!

Next branch stores this number into 8045a6c0+0x535 = 8045ABF5


**********************
* Default Char Names *
**********************
The names that show for characters with no name tag chosen.

3d5034 - (Dr. Mario) pointer table to strings (probably the default names)
	- Yes, it is!
	- can I add Popo to this table? YES, just add a pointer to the string at the end.

***************************
* Some Button Input Stuff *
***************************
For P1,

Joystick info is halfword in 8046b10a

803775b8 - lhz r0,0(r25) #load button inputs from 8046b108
803775bc - stw r0,0(r26) #store button inputs to 804c1fac
803775c0 - lbz r0,2(r25) #load X joystick value
803775c4 - stb r0,0x18(r26) #store X joystick value to 804C1FC4
... branch link

Then, this info is read @ function 80376e90

80376e98 - lbz r0,0(r3) #load X joystick byte store from above
80376e9c - lbz r10,0(r4) # load y joystick byte

eventually these bytes get changed and stored in same location.

...branch link return

803776a0 - lbz r4,0x18(r26) #loads modified x joystick byte

..branch links to 803771d4 (?)
...branch link return
8037771c - stfs f0,0x0020(r26) #stores joystick x float to 804c1fac + 0x20


8037775c - stfs f0,0x0024(r26) #stores joystick y float to 804c1fac + 0x24

These take the bytes, extsb, then divide (normalize) by 0x50 before storing, it seems.

Joystick & Cstick = normalize to byte at 804c1f9e (0x50)
                    - so controller values are increments of 1/80
L/R Analog = normalize to byte at 804c1f9f (0x8C)

***************************************
* Red Metal & Reg Metal Ingame Checks *
***************************************

Function 800bf2b8

All Players Are Red Metal!
040bf33c 60000000

The red rrggbb value is pulled below this line. Can modify to whatever!
Color pulled @ 800bf368 - lwz r0,0x4(r6)

at this point, r31 = start of internal data offset

Test code to make sure two players can be different colors

inject @ 800bf368
lbz r15,0xc(r31)
cmpwi r15,1
bne- RED
lis r0,0x00ff
stw r0,0x4(r6)
b GREEN
RED:
lis r0,0xff00
stw r0,0x4(r6)
GREEN:
nop

Works. P1 is Red and P2 is Green.

Now, let's write the 20XX code.


#need a check so that this code only gets executed when it is only looking at colored metal, because this function gets when coloring other things on screen. 

lwz r14,-0x5118(r13)
cmpw r14,r27
beq- EXECUTE_METAL
lwz r0,0x4(r6)
b END

EXECUTE_METAL:
lis r14,0x803f
ori r16,r14,0xa454
lbz r15,0xc(r31)
mulli r17,r15,0x4
lwzx r16,r17,r16
cmpwi r16,1
bne- DEFAULT_METAL
ori r16,r14,0xa464
mulli r15,r15,0xc
add r16,r15,r16

#load custom color
lwz r15,0(r16)
stb r15,-0x4(sp)
lwz r15,4(r16)
stb r15,-0x3(sp)
lwz r15,8(r16)
stb r15,-0x2(sp)
li r15,0
stb r15,-0x1(sp)
lwz r0,-0x4(sp)
b END_METAL_FUNCTION

DEFAULT_METAL:
lis r0,0xFFFF
ori r0,r0,0xFF00

END_METAL_FUNCTION:
stw r0,0x4(r6)
END:

-------------------
Redo this, and combine everything.


-------------------
Okay, now the metal on/off controller.


inject @ 800bf338

#8000335c is location for metal toggles, 1 byte per player
lis r14,0x8000
ori r14,r14,0x335c
lbz r15,0xc(r31)	# load port number
#forget about players 5&6
cmpwi r15,0x4
bge- DEFAULT
lbzx r14,r14,r15
cmpwi r14,1
bne- DEFAULT

#nana check. we dont want her metal to stay playable
lwz r14,4(r31)
cmpwi r14,0xb
beq- DEFAULT

EXECUTE_METAL:
lwz r18,-0x5118(r13)
lwz r18,0xc(r18)
lis r14,0x803f
ori r16,r14,0xa454
lbz r15,0xc(r31)
mulli r17,r15,0x4
lwzx r16,r17,r16
cmpwi r16,1
bne- DEFAULT_METAL
ori r16,r14,0xa464
mulli r15,r15,0xc
add r16,r15,r16

#load custom color
lwz r15,0(r16)
stb r15,-0x4(sp)
lwz r15,4(r16)
stb r15,-0x3(sp)
lwz r15,8(r16)
stb r15,-0x2(sp)
li r15,0
stb r15,-0x1(sp)
lwz r0,-0x4(sp)
b END_METAL_FUNCTION

DEFAULT_METAL:
lis r0,0xFFFF
ori r0,r0,0xFF00

END_METAL_FUNCTION:
stw r0,4(r18)
#somthing blatantly false for line after injection point
cmpwi r18,0xff
b METAL_ON

DEFAULT:
#default code line
rlwinm. r0,r0,28,31,31

METAL_ON:
nop



Branching to METAL_ON will work because the next line the game sees is a beq-. In order to turn metal on, we want it to fail that check, which it will because the code just failed a beq- (seeing if the char is nana).
************************
* Rolling Equals Sleep *
************************

800992a8 AS_233/234_RollPlayerCheck

800c318c AS_129_DamageSong(FromJPuff)

Rolling Equals Sleep
040992a8 48029EE4

Works. Now I need to make it for humans only.

inject @ 800992a8

lbz r15,0x6c(r3)
lis r16,0x8045
ori r16,r16,0x3088
mulli r15,r15,0xe90
lwzx r15,r15,r16
cmpwi r15,0
bne- DEFAULT
lis r15,0x800c
ori r15,r15,0x318c
mtctr r15
bctr

DEFAULT:
mflr r0


Now, for 20XX, lets make it pull the debug menu flag.


inject @ 800992a8 - in AS_233/234_RollPlayerCheck
- r6,


lbz r6,0x6c(r3)
lis r12,0x8045
ori r12,r12,0x3088
mulli r6,r6,0xe90
lwzx r6,r6,r12
cmpwi r6,0
bne- DEFAULT
lis r6,0x803f
ori r6,r6,0xa384
lwz r6,0(r6)
cmpwi r6,0
beq- DEFAULT
lis r6,0x800c
ori r6,r6,0x318c
mtctr r6
bctr

DEFAULT:
mflr r0

C20992A8 00000009
89E3006C 3E008045
62103088 1DEF0E90
7DEF802E 2C0F0000
40820028 3DE0803F
61EFA384 81EF0000
2C0F0000 41820014
3DE0800C 61EF318C
7DE903A6 4E800420
7C0802A6 00000000

***************************
* CliffCatch Random Notes *
***************************

Don't grab edge if:

(internal offsets)
0x824 doesnt consist of 03000000
0x2228 doesnt consist of 00000020

dunno?

*************
* Debug Menu More Colors??? *
*****************************
Disabled Item Color = line 804d5a14

Line 803032ac seems to be storing the "Disabled menu item" color
Can I have it pull a byte flag from that line item to store a different color?
inject @ 803032ac

lwz r3,0x10(r30)
cmpwi r3,0xff
bne- DEFAULT
lis r0,0xFF00
ori r0,r0,0xFFFF
DEFAULT:
#default
stw r0,0x34(sp)

Well, it changes every disabled line item color on the page, not just a single one.

302628 branch links to 8037d970


**********************
* SSM File Switching *
**********************
DOESNT WORK. SSM files are cached in RAM after loading once? Weird.

- changing ___.ssm to ____.0sm
	- so changing a 0x73 to 0x30

C. Falcon - 3b8aec (003bbaec)
Dr. Mario - 003b8b04 (003bbb04)
Falco - 003b8b0e (003bbb0e)
Fox - 0042e924 (004d3904)
Ganondorf - 003b8bce (003bbbce)
Jigglypuff - 003b8baa (003bbbaa)
Link - 003b8b3d (003bbb3d)
Luigi - 003b8b4a (003bbb4a)
Marth - 003b8b61 (003bbb61)
Mewtwo - 003b8b6f (003bbb6f)
Pichu - 003b8b92 (003bbb92)


***************************
* Int to ASCII Conversion *
***************************
GetInt

#First Digit
- divide int by 0x10
	- if less than 10, add number to 0x30
	- if greater than or equal to 10,  add to 0x37

#Second Digit
- multiply division result by 0x10
- subtract from int
	- if less than 10, add number to 0x30
	- if greater than or equal to 10,  add to 0x37


**********************
* HPS File EntryPath *
**********************

803bb300 = /audio/__.hps
803bb380 = same. This gets copied to above.

Changes based on what file will be loaded.

Function
80023f28 = Music_HandleLoad

	r3 = songID?
	80023f80 = rlwinm r0,r3,2,029 (3fffffff)
	80023f84 = lwz r3,-0x7dcc(r13)
		#loads 7 and adds to 803bb300, 
		#7 is amt of characters for "/audio/"
! Disable this function to disable music.


8045bf11 (byte) = song currently being played/to play next during screen change
	- can change this while on a menu and next screen change the song will change!

Function 8015ecb0 loads this byte during screen change
8015ecbc = Music_MainMenuDecideRandom



Loading stage ID:
lwz r3,-0x6cb8(r13)





Function 801c28ac - I think determines what song to load when choosing stage
	- input r3 = stage ID
	- when choosing stage, branched into from 80225154

Function 801c24f8 - Music_AltDecide



Table in RAM starting @ 803e0140 = pointers to branch to different parts of the Music_AltStageDecide, based on what stage is 

Disable Alternate Stage Music
041C2804 48000020

(Default address value is 41820020)

Disable Alternate Menu Music
0415ed08 38000034

(Default address value is 38000036)

**************
* Menu Music *
**************

- Dan Salvato

8022e934: play music after pressing start
80023f28: play music function

8024b338: Exit sound test
8024b4a0: Play a new song in sound test

--8024b4d8--
lwzx r3,r28,r0
cmpwi r3,0
bne- 0x08
li r3,-1
lwz r4,-0x77c0(r13)
stb r3,0x1851(r4)
lis r4,-32698
ori r4,r4,40256
stw r3,92(r4)
cmpwi r3,0
bge- 0x08
li r3,0

--8022e934--
lis r4,0x8046
ori r4,r4,0x9d40
lwz r4,0x5c(r4)
cmpwi r4,0
beq END
bgt 0x8
li r4,0
lwz r5,-0x77c0(r13)
stb r4,0x1851(r5)
mr r3,r4

END:
lis r12,0x8002
ori r12,r12,0x3f28
mtctr r12
bctrl

***************
* Random Seed *
***************

804d5f90 = location of random seed (changes every frame of game)

To quickly get this location in a function,
lwz r5,-0x5710(r13)

Okay...
Now if I want to get a random number between 0 and 0xZZ (inclusive),

- make r3=0xZZ+1
- branch link to 0x80380580 (function modifies r3,r4,r5)
- after returning, r3 will be the random number between 0 and 0xZZ

----------

The C function for RNG in Melee is called fast_rand()

uint32_t g_seed
g_seed = (214013*g_seed+2531011);

************************************************
* CSS Button Activator to Custom Screen Change *
************************************************
**Use 803f0a46 as flag address (completely randomass address)
inject @ 80263254 - cmplwi r0,0
- 

#d-pad down pressed?
rlwinm. r15,r7,0,29,29
beq- END
lis r15,0x803f
li r16,2
#set debug screen flag value
stb r16,0x0a46(r15)
#go back to menu
stb r16,-0x49aa(r13)

#default code line, branches to here if not pressed
END:
cmplwi r0,0



inject @ 801a56b0 - li r3,1
- line before writing r3 to menu controller pending major
- Just quickly got this address from Jorgasms' code:
Leaving CSS Loads Debug Menu (1.02) [Jorgasms]
041a56b0 38600006


#default code line
#1 = Menu ID
li r3,1
lis r16,0x803f
lbz r15,0x0a46(r16)
cmpwi r15,0
beq- END_SECOND
li r15,0
stb r15,0x0a46(r16)
#6 = Debug Menu ID
li r3,6

END_SECOND:
nop

*************************
* Fox/Falco Laser Stuff *
*************************

Function for grounded laser fire is 800e6368
Aerial laser fire - 800e6740

Laser Speed:
800e6904 - lfs f2,0x14(r30) #load projectile speed
800e6908 - lwz r5,0x1c(r30) #load projectile ID
800e690c - addi r3,r30,0 #r3 is external data offset
800e6910 - addi r4,sp,60
800e6914 - bl 0x8029c6a4

Falco default = 5.0 = 40a00000
Fox default = 7.0

Hold Z while firing aerial laser for half speed
-inject @ 800e6908

lwz r5,0x65c(r29)
rlwinm. r5,r5,0,27,27
beq- END
lis r5,0x4000
stw r5,-0x8(sp)
lfs f15,-0x8(sp)
fdiv f2,f2,f15

END:
lwz r5,0x1c(r31)

**************************
* Multi-Man Melee Stuff  *
**************************

When starting 10-man melee match, function 8016b498 is hit. It loads the current menu controller major and then does a compare to see if it is a single player match (bool, r3 = 1).

This function branched into from 801c5878
- if vs mode, write -1 (FFFFFFFF) to 8049E6C8 +0x6e4

Function 80182510     MenuController_CheckMultiManMelee

Always Enable MultiManMelee Top Left Counter Image
04182534 6000000

Function above is branched into from 2fb29c

Find counter?
Is the counter @ 8046b90b, 8046b967, 8046b973, 80473597
Nope. None of those.


802fb300	bl 0x8016895c
If I nop this line, then the counter value is messed up

100 Man Melee
r3 = 80cb1bc0
r4 = 80bca650


80165e7c

**************************
* Custom Stock Icon Size *
**************************

code line 
802f9a28 - lwz r0,4(r22) #load stock icon height offset
802f9a2c - stw r3,0x38(r29)
802f9a30 - stw r0,0x3c(r29)

during testing,
r29 = 80cdc240

+0x2C = X scale
+0x30 = Y scale
+0x34 = Z scale


inject @ 802f9a28

#stock icon scale [float]
lis r0,0x3f59
ori r0,r0,0x999a
#store x scale
stw r0,0x2c(r29)
#store y scale
stw r0,0x30(r29)
#load stock icon height offset [float]
lis r0,0xc1b0
ori r0,r0,0x0000

Custom Stock Icon Scale and Y-Axis Offset
C22F9A28 00000004
3C003F59 6000999A
901D002C 901D0030
3C00C1B0 60000000
60000000 00000000

**************
* IASA Tests *
**************

8006b808   Branches to the IASA check of the current action state

For Jigglypuff aerial sing,

IASA function is 8013cc64 which is a blr...so how does she grab the edge??

Internal data offset 
+0x824 = idk something. it check for 01000000 in cliffcatch function, but executes cliffcatch regardless. Something about body orientation? idk


CliffcatchCheck function

checks word 0x824. rlwinm. to 03000000. skips grabbing ledge if check returns 0
Then checks byte 0x2228. rlwinm. to 00000020. bne- 0 to end

So with jigglypuff aerial singing, 
0x824 = 01000000
0x2223 = 01080400

I think 0x824 changes whether or not your edge grab boxes are in range of an edge

80081298 is cliffcatchcheck

800e3b14 is falcon's side-b interrupt function.

---------------------------

*************************************
* Custom Debug Menu Play Music Item *
*************************************
track preview, playlist preview

ORIGINAL_CODE:
#load 98, which will try to play testnz.hps (freezes game)
li r15,0x62
stw r15,-0x48e8(r13)

#load debug menu ID
lis r15,0x803f
ori r15,r15,0xa3cc
lwz r16,0(r15)
stw r16,-0x5e44(r13)
lis r15,0x803b
ori r15,r15,0xc308
CONVERT_DIRECT_ASCII:	#song ID comes in r16

cmpwi r16,0	#check if song id is 0x00 (which is no song)
bne- FIRST_DIGIT
li r16,1	#change to arbitrary 1 so game doesnt freeze

FIRST_DIGIT:	#first digit

li r17,0x10
divw r19,r16,r17
addi r18,r19,0x30
cmpwi r18,0x3a
blt- STORE_FIRST_DIGIT 
addi r18,r18,0x7

STORE_FIRST_DIGIT:
stb r18,0x6(sp)

SECOND_DIGIT:
mulli r19,r19,0x10
sub r19,r16,r19
addi r18,r19,0x30
cmpwi r18,0x3a
blt- STORE_SECOND_DIGIT
addi r18,r18,0x7

STORE_SECOND_DIGIT:
stb r18,0x7(sp)
lwz r18,0x4(sp)
#store new filename
sth r18,0(r15)

#branch to DebugMenu_PlayHPSFile
lis r18,0x802f
ori r18,r18,0xfbac
mtctr r18
bctr
-------------------

11/6/15 NEW CODE

#lis	r15,0x8040
#lwz	r16,-0x5C34(r15)	# load debug song flag from 803fa3cc
- r4 = pointer of this debug menu line item 


lwz	r17,0x10(r4)		# load flag address
lwz	r16,0(r17)		# load flag word (HPS ID)
cmpwi	r16,0
beq-	END
lis	r15,0x803f
ori	r15,r15,0xa3cc
stw	r16,0(r15)

lis r15,0x803b
ori r15,r15,0xc308
CONVERT_DIRECT_ASCII:	#song ID comes in r16

FIRST_DIGIT:	#first digit

li r17,0x10
divw r19,r16,r17
addi r18,r19,0x30
cmpwi r18,0x3a
blt- STORE_FIRST_DIGIT 
addi r18,r18,0x7

STORE_FIRST_DIGIT:
stb r18,0x6(sp)

SECOND_DIGIT:
mulli r19,r19,0x10
sub r19,r16,r19
addi r18,r19,0x30
cmpwi r18,0x3a
blt- STORE_SECOND_DIGIT
addi r18,r18,0x7

STORE_SECOND_DIGIT:
stb r18,0x7(sp)
lwz r18,0x4(sp)
sth r18,0(r15)	#store new filename

#load 98, which will try to play testnz.hps (freezes vanilla game)

CHECK_A_PRESS:
mflr	r15
lis	r18,0x8030
ori	r18,r18,0x3df8
cmpw	r18,r15
beq-	LOAD_MUSIC
END:
blr

LOAD_MUSIC:

li r3,0x62
lis r18,0x8002
ori r18,r18,0x3f28
mtctr r18
bctr		#branch to Music_HandleLoading

***************************************************************
* Debug Menu - Disable Button Press Functions During Item Scroll Left/Right *
******************************************************************

04303ca8 48000048	#right
04303d50 48000048	#left


**********************
* Random Hit Effects *
**********************

Elements:
00	Normal
01	Fire
02	Electric
03	Slash
04	Coin
05	Ice
06	Sleep
07	Sleep (long)
08	Bury (??, I think this is actually grab)
09	Bury
0A	Cape
0B	Empty (gray hitbox that doesn't connect)
0C	Disabled
0D	Darkness
0E	Screw Attack
0F	Poison/Flower
10	Nothing (no graphic on hit)


inject @ 800715ac - lbz r0,0xc(r3)

mr r14,r3
REPEAT_RNG:
li r3,16
lis r4,0x8038
ori r4,r4,0x0580
mtctr r4
bctrl
cmpwi r3,7
beq- REPEAT_RNG
cmpwi r3,8
beq- REPEAT_RNG
#store effect
stw r3,0x30(r30)
#store effect SFX
stw r3,0x3c(r30)
mr r3,r14


+0x1860 (internal) = attack element hitting you
+0x2071 (internal) = ?, 


Function
8008da4c    Controls applying fire,electric,ice, 
- inputs are r3=external player data offset, r4=element #, r5=1,2,or 3 (??)

8007da74 = calculate hitlag
- inputs are r3=?r4=action state ID (check for crouching), 
- output f1 = (double) integer frames of hitlag

0x1830 = staled damage from attack (float)
is +0x183c = staled damage from attack (long)

After storing frames of hitlag,

8008f030 - stfs f1,0x195c(r27)
8008f034 - li r3,1
8008f038 - lbz r0,0x221a(r27)
8008f03c - rlwimi r0,r3,5,26,26 (00000001)
8008f040 - stb r0,0x221a(r27)
...more

These lines are apparently only for...idk screw attack or weird elements?


8006d740 - stfs f0,0x195c(r30)
- storing 20 frames of hitlag, if calculated was higher.

Okay...so 

0x221A [byte]

rlwinm (00000020)
=hitlag hitting someone

rlwinm (00000030)
=hitlag being hit



Random Hit Elements 2.0
- this code allows grabs
inject @ 800715b0 - cmplwi r0,9
- storing hitbox element

#20XX
lis	r3,0x8048
lbz	r3,-0x62D0(r3)#load menu controller major
cmpwi	r3,0x2A	#is this fixed camera mode?
bne-	END


lwz r3,0x30(r30)	# load current attack element
cmpwi r3,0x8	# is this a grab?
beq- END	# if so, skip
mr r15,r0	# save register 0
REPEAT_RNG:
li r3,16	# 16 possible effects
lis r4,0x8038
ori r4,r4,0x0580	# load random function
mtctr r4
bctrl		# branch to random function
cmpwi r3,4	# is coin? 
beq- REPEAT_RNG
cmpwi r3,7	# is [long] sleep?
beq- REPEAT_RNG
cmpwi r3,8	# is grounded (?)? I think this is actually grab
beq- REPEAT_RNG
cmpwi r3,0xb	# is "Empty"
beq- REPEAT_RNG

#store effect
stw r3,0x30(r30)
mr r0,r15
END:
cmplwi r0,9




------------------------

********************
* Subaction Events *
********************

8007330c - beginning of subaction
80073424 - bl into function that blrl's into a function based on the event ID (in r4)


Is Function 72a5c - turn invisible?

3c06e8 - start of subaction event function pointers

To find a function for a subaction:
Take the command byte and divide by 4.

% If less than (decimal) 10,
-->
multiply by 4, add to 803b9840. Pointer at that address points to the subaction function


% If greater than or equal to (decimal) 10
-->
Subtract 10 (decimal).
Multiply by 4, convert back to hex, and add to 3c06e8.
Pointer at that address points to the subaction function.

------------------------------

80071028   SubactionEvent_0x28_GFXSpawn
8007121C   SubactionEvent_0x2C_HitboxMelee_StoreInfoToDataOffset
802790C0   SubactionEvent_0x2C_HitboxProjectile_StoreInfoToDataOffset
800717D8   SubactionEvent_0x40_HitboxRemove
80071820   SubactionEvent_0x4C_AutoCancel_Enable/Disable
80071950   SubactionEvent_0x5C_IASAEnable
80071A14   SubactionEvent_0x66_BodyStateChange_Character
80071A9C   SubactionEvent_0x70_BodyStateChange_Hurtbubble
80071D40   SubactionEvent_0x7C_CharacterModelModifiers(e.g. Link Sword)
80072A5C   SubactionEvent_0xB8_BodyAura (e.g. Hit by Fire)
80072BF4   SubactionEvent_0xCC_DamageSelf
80072E4C   SubactionEvent_0xDC_GFX&SFX
80073008   SubactionEvent_0xE0_SmashAttackHold

BUT



71fa0 - turn invisible from "9400000X" format

71950 - enable interrupt
72a5c - body aura
728f8 - "AC" 
73118 - "E8" command. Ganon Utilt
- loads last byte from word.
- loads .003906 into f7 (-0x7740 rtoc, 4d82a0) 
- loads first halfword from line after E8 command. (r6)
- loads second halfword+ from second line after e8 command. (r5=ffffffff)
??

71820 - "4C" = stop character in midair or something. research.


71d40 - "7C" function

7c080001 = link, sword in sheath
7c100001 = shield on back


811af0ac
----------------

Disable Hitbox Removal (stays for the entire animation after spawning)
040717ec 60000000


Self Damage Heals Instead
C2072C34 00000002
EC200828 FC200850
60000000 00000000

fsubs f1,f0,f1
fneg f1,f1

--------------------------

***************************
* Subaction Event Opcodes *
***************************

From Punkline 8/23/16

Control Events
00 - Stop Reading Subaction
04 - Synchronous Timer
08 - Asynchronous Timer
0C - Set Loop
10 - Execute Loop
14 - GoTo
18 - Return
1C - Subroutine
20 - (?)
24 - (?)

Player Events
28 - Create GFX
2C - Create Hitbox
30 - Adjust Hitbox Damage
34 - Adjust hitbox Size
38 - (?)
3C - Clear Specific Hitbox ID
40 - Clear All (of this player's) Hitboxes
44 - Create SFX
48 - Random Smash Sound
4C - Auto Cancel
50 - (?) (used in throws and direction reversals)
54 - (?)
58 - (?)
5C - Flag for IASA frames
60 - Flag for Projectile Spawn
64 - (?) (related to ground/air state)
68 - (?)
6C - Change All Hurtbox Status
70 - Change Single Hurtbox Status
74 - Enable flag for Jab Followup
78 - Toggle flag for Jab Followup
7C - Model Modification
80 - (?)
84 - (?)
88 - Throw
8C - Flag for Held Item Invisibility
90 - Flag for (equipped article?) Invisibility
94 - Flag for Player Invisibility
98 - Pseudo-random SFX (RNG from pool of 6)
9C - (?)
A0 - (?)
A4 - Animate Bodypart Model (change hands/eyes/expression)
A8 - (?)
AC - Controller Rumble
B0 - (?)
B4 - (?)
B8 - Set Body Aura
BC - (?)
C0 - (?)
C4 - Set Sword Trail Visibility
C8 - (?)
CC - Damage Self
D0 - Continuation Control
D4 - (?)
D8 - Footstep SFX + GFX
DC - Landing SFX + GFX
E0 - Start Smash Charge
E4?
E8?
EC?
F0?
F4?
F8?
FC?


***************************************
* Yellow Color Overlay on IASA Frames *
***************************************

Try
inject @ 80071960

stb r0,0x2218(r3)
stb r0,0x504(r3)
lis r0,0x437f
stw r0,0x4b8(r3)
stw r0,0x4bc(r3)
stw r0,0x4c4(r3)
li r0,0
stw r0,0x4c0(r3)
stw r0,0x4c8(r3)
stw r0,0x4cc(r3)
stw r0,0x4d0(r3)
stw r0,0x4d4(r3)

C2071960 00000007
98032218 98030504
3C00437F 900304B8
900304BC 900304C4
38000000 900304C0
900304C8 900304CC
900304D0 900304D4
60000000 00000000


**********************************
* Disable NameTag When Invisible *
**********************************

*need mewtwo airdodge and zelda/sheik sleep check
802fccac

rlwinm r0,r3,0,24,31
lbz r15,0(r31)
mulli r15,r15,0xe90
lis r16,0x8045
ori r16,r16,0x3130
lwzx r15,r15,r16
lbz r15,0x227e(r15)
rlwinm. r15,r15,0,24,24
beq- END
li r0,20
END:
nop

------------------

802fccf0   bl 80371f00   #restore name tag background box and colored arrow on player head

802fcd10   bl 80371d00   #make invisible name tag background box and colored arrow on player head

************************************************
* Automatically Scale Name Tag Shadow Box Size *
************************************************

802fcc44   NameTag_DisplayInGame

802fcce8 - lwz r3,0x10(r30)

at this point, r3+0x2c = float, x scale of backgound shadow box (and colored arrow pointing to player)

- proper scale would be (number of characters)/4, if (number of characters) is greater than 4.

Logic:
1) Pull player number, which I think I can do with
lbz r3,0(r31)

2) Branch to PlayerBlock_NameTagSlotLoad
3) Multiply that number by (space between each nametag)
4) Add to first name tag location

5) Now..count nametag length. I think I can make it work with Dan's name tag code and regular non-standard ASCII ones.

load 0x1 byte & update.
  - if zero, then end.
  - if less than 0x80, then add 1
  - else (it's normal..), so add 1 & update

6) compare size to 5
blt END

7) [float] tag length divided by [float] 4
8) store at x scale.

-----
Code...

8045D850  First Name Tag
- name tags are 0x1a4 away from each other

inject @ 802fcce8
 - lwz r3,0x10(r30)
---------------

#load function PlayerBlock_LoadSlotType
lis r3,0x8003
ori r3,r3,0x241c
mtlr r3
lbz r3,0(r31)	#load slot number
blrl	#get slot type
cmpwi	r3,0	# is something other than human?
bne-	END

NAMETAG_COLORING:
lis r6,0x803f
ori r6,r6,0xa2c8
lbz r5,0(r31)	# load slot number
mulli	r5,r5,0x10
sub	r5,r6,r5
lwz	r3,0(r5)	# is 20XX custom shield color on?
cmpwi	r3,0
beq-	NAMETAG_COLORING_END
li	r6,0	# struct counter (need to go through 2)
lwz	r3,0x10(r30)
lwz	r3,0x18(r3)

NAMETAG_BONE_LOOP:
lwz	r4,0x8(r3)	# load P1/P2/../CPU struct
lwz	r4,0xc(r4)	# load color struct start


NAMETAG_COLOR_LOOP_START:
lwz r7,-0x4(r5)
stb r7,4(r4)
lwz r7,-0x8(r5)
stb r7,5(r4)
lwz r7,-0xc(r5)
stb r7,6(r4)
NAMETAG_COLOR_LOOP_END:
addi	r6,r6,1
cmpwi	r6,1
bne-	NAMETAG_COLORING_END
lwz	r3,4(r3)	# load next color struct pointer start (arrow below nametag)
b	NAMETAG_BONE_LOOP
NAMETAG_COLORING_END:

NAMETAG_SCALING:

#load function PlayerBlock_LoadNameTagNumber
lis r3,0x8003
ori r3,r3,0x556c
mtlr r3
lbz r3,0(r31)	#load slot number
blrl	#get name tag number

rlwinm r0,r3,0,24,31
cmplwi r0,120	#ignore if no tag (120 = no tag)
beq- END

lis r3,0x8045
ori r3,r3,0xd84f	#-0x1 from first name tag
mulli r0,r0,0x1a4	# tags are 0x1a4 apart
add r3,r3,r0	#get to this name tag
li r4,0	#initialize tag length counter

COUNT_CHARACTER_LOOP:
lbzu r0,1(r3)
cmpwi r0,0
beq- CHARACTER_LOOP_END
addi r4,r4,1
cmpwi r0,0x80	#check if normal tag type or reg ASCII
blt- COUNT_CHARACTER_LOOP
#normal name tag type
lbzu r0,1(r3)
b COUNT_CHARACTER_LOOP

CHARACTER_LOOP_END:
cmpwi r4,5	# skip rescaling if less than 5 characters in length
blt- END

SCALE_SHADOW_BOX:
lfs f17,-0x1764(rtoc)	# float 4.0

CONVERT_INT_TO_FLOAT:
#r4 = input, f15 = output
lis r18,0x4330
lfd f16,-0x73a8(rtoc)
stw r18,-0x14(sp)
stw r4,-0x10(sp)
lfd f15,-0x14(sp)
fsubs f15,f15,f16
fdivs f15,f15,f17
lwz r3,0x10(r30)	#load pointer to object data
stfs f15,0x2c(r3)	#store new x scale

END:
lwz r3,0x10(r30)

************************
* Results Screen Poses *
************************

800bead4 - loads results screen pose ID and then pulls pointer from table and blrl's to it.

Table @ 803c6908

-----

Force Pose B Last Animation Frame
inject @ 800becd8

lfs f1,-0x71a8(rtoc)
040becd8 C0228E58


Hmmm, can't simply modify the f1 load value because it gets copied to f3 as well which must refer to some sort of animation speed value.


Inject @:
800bece0: VictoryPoseWinB
800bedb8: VictoryPoseWinY
800bef30: VictoryPoseWinX

fmr f3,f1
lis r14,0x4348
stw r14,-0x4(sp)
lfs f1,-0x4(sp)


Or maybe,

lfs f1,-0x71A8(rtoc) = C0228E58
lfs f3,-0x6de0(rtoc) = C0629220

Victory Pose Hold B
040becd8 C0228E58
040bece0 C0629220

Victory Pose Hold Y
040bedb0 C0228E58
040bedb8 C0629220

Victory Pose Hold X
040bef28 C0228E58
040bef30 C0629220



Fast Results Screen
- can press start to progress immediately.
- winning character begins at the end of win animation
040becd8 C0228E58
040bece0 C0629220
040bedb0 C0228E58
040bedb8 C0629220
040bef28 C0228E58
040bef30 C0629220
04179214 60000000

-----

**************************************************
* Results Screen - Hold Z for Clap Win Animation *
**************************************************

800befd4 is the function for clapping (losing)

inject @ 800bead4

#default, load win ID
lwz r4,8(r29)
cmpwi r4,3
bge- END
lis r3,0x804c
ori r3,r3,0x1fac
lbz r12,0x6c(r31)
mulli r12,r12,0x44
lwzx r12,r12,r3
rlwinm. r3,r12,0,27,27
beq- END

li r4,4
END:

C20BEAD4 00000006
809D0008 2C040003
40800024 3C60804C
60631FAC 899F006C
1D8C0044 7D8C182E
558306F7 41820008
38800004 00000000


***************
* Pausing...
***************
8016cae8

To pause,
8046b6a0...
+4, byte, has to be zero
+5, byte, has to not be zero (is this pause on/off byte?)
+24ca, byte, has to include (00000008)
-

+24cb, byte,
+24cc, byte, ??
+2508, word, is pointer for a blrl function

8016bdf0 does the Start compare

lbz r14,0x24ca(r29)
rlwinm. r14,r14,29,31,31
beq- NORMAL
lwz r0,0(r3)
andi. r3,r0,0x1160
cmpwi r3,0x1160
bne- NO_PAUSE
li r0,0x1000
b NORMAL
NO_PAUSE:
li r0,0

NORMAL:
rlwinm r0,r0,0,19,19




Disable Pause Off - not working
0416ca9c 60000000
0416caa8 60000000
0416cc1c 60000000
0416cc28 60000000
C216BDF0 00000007
3DC08045 61CEBF18
81CE0000 55CE05EF
40820020 80030000
70031160 2C031160
4082000C 38001000
48000008 38000000
540004E6 00000000


Function:
8016cbe8   Pause_PauseScreenCheckButtons

8016cd74 - li r0,10
8016cd78 - stb r0,4(r30) #store 10 frames of not being able to press start after unpausing


2fbbdc - pause byte check, a bunch of floats?


Official Documentation:

L+R+A+START to Pause Game when Pause is Disabled (1.02) [Achilles]
0416caa8 60000000
0416cc28 60000000
C216BDF0 00000006
89DD24CA 55CEEFFF
41820020 80030000
70031160 2C031160
4082000C 38001000
48000008 38000000
540004E6 00000000

[code]
Function
8016ca68   Pause_IngameCheckPauseOnOff
8016bc74   Pause_CheckButtonsToPause
8016cbe8   Pause_CheckButtonsToUnpause

#enable checking for pause even with Pause: Off
0416caa8 60000000

#enable checking for unpause even with Pause: Off
0416cc28 60000000

----------------------------------------------------------
ASM injection point: 8016bdf0
-	Line immediately after a player’s instant button presses are placed into r0.
-	This code line checks the instant button presses for the start button.


lbz r14,0x24ca(r29)    #load current match flag that includes if pause is on/off
rlwinm. r14,r14,29,31,31    #pull out the bit (00000008) and compare to 0
beq- NORMAL   #if pause is enabled, branch down to the default code line like normal

# if pause is disabled…
lwz r0,0(r3)   # load all button presses in this frame, instead of looking at instant buttons
andi. r3,r0,0x1160   # L+R+A+START button flags = 0x1160
cmpwi r3,0x1160
bne- NO_PAUSE   #if current buttons being pressed do not consist of L+R+A+START, don’t pause
li r0,0x1000   #load 0x1000 into register for button press check --> will pass start button check
b NORMAL
NO_PAUSE:
li r0,0   # load 0 into register for button press check --> will fail start button check
 
NORMAL:
rlwinm r0,r0,0,19,19   # default code line, pulls out start button bit (00001000)

------------------------

*****************
Random from 4/21/15

f0 = x velocity + [(air mobility A * xinput) + air mobility B]
f1 = x velocity
f2 = -(x velocity)
f3 = x input * max horizontal air mobility
f4 = horizontal air friction
f5 = 0

Holding Left/Right:



(air mobility A * xinput) + air mobility B



****************
* Jungle Japes *
****************

*Deleted from 20XX 4.0 12/6/15
	- code moved the MnSlChr main controller function


General
8039069c   DrawOnScreenTextures
- wow, interesting function.
----------------
|*Aside*
|
| Disable SSS Stage Name Textures
| 04259ed8 4e800020
|

Completely Disable the CSS (wut??)
042640a0 4e800020




80202d04   Line, blrl into stage update functions

803e5248 - start of Japes functions...

Remove Entire Main Stage/Platforms Textures (Collisions Stay)
04202be4 60000000

80202bcc   60000000 to disable water texture

80202c78   JungleJapes_DrawTextures
80202d9c   JungleJapes_InitializeWaterPull
80202dc8   JungleJapes_InitializeWater

80202fa4   JungleJapes_WaterShineControl(?)

80203004   JungleJapes_KongShadowInitializer

80203098   ???

802031a4   JungleJapes_InitializeKlapTrap
blr this to remove klaptraps




Texture..
Breakpoint @ 390680 function?
3901f0?

_____________

Jungle Japes Stage Hack

20XX control function
inject @ 80202bc8 - li r3,6

#load mnslmap value
lis r3,0x803f
lbz r3,0x0a20(r3)
#if on hack stage select
cmpwi r3,0x32
bne- DEFAULT_END
lis r15,0x4e80
ori r15,r15,0x0020
lis r3,0x8020
stw r15,0x2d9c(r3)
lis r3,0x8020
ori r3,r3,0x2bd0
mtctr r3
bctr

DEFAULT_END:
lis r15,0x7c08
ori r15,r15,0x02a6
lis r3,0x8020
stw r15,0x2d9c(r3)
li r3,6

C2202BC8 00000009
3C60803F 88630A20
2C030032 40820024
3DE04E80 61EF0020
3C608020 91E32D9C
3C608020 60632BD0
7C6903A6 4E800420
3DE07C08 61EF02A6
3C608020 91E32D9C
38600006 00000000

New Spawn Points
P1
X = -55
Y = 0


P2
X = 42.15
Y = 0

P3
X = 62.4
Y = 0

P4
X = -34.75
Y = 0


***********
* Camera *
**********

8016e8b4 - blrl to store camera type in MeleeStart
    - normal camera has pointer value of 0 so no branching occurs.
    - (Fixed camera = 80165290)



*********
Random
********

Function
8016b558   CountPlayersInMatch
- counts from playerblocks
- take no inputs, output is number of players in r3. 
- 2 players in match = 2, etc.

------------------------

80224dc8   input r3 = stage ID
compares stage ID to
59 = Mushroom Kingdom Adventure
63 = hyrule maze
66 = escape from brinstar
73 = fzero grand prix
76 = icicle mountain adventure

if neither of those, then output = 0

This function is executed during MatchStart, Death, 

MatchStart:
Code line 8016e340
- tells players to face right upon spawning, I think.
& code line 8016e4c4?



grGroundParam
+4c, word  if not 0, camera goes to fixed mode after unpausing
- function 801c5800



*********************
Dodgeball Game Mode *
*********************

80079494 - Projectile Hitboxes
branch to check the pokemon/warp star battle byte

800794a0 - lbz r0,0x138(r23)
- loads some sort of projectile ID type.
- if includes (00000080), then is able to hit opponents in pokemon/warp star battle



Test.

Only Pokeball Throws Damage
-set 46db6d byte to (00000020)

inject @ 800794a4

lis	r14,0x8048
lbz	r14,-0x62D0(r14)#load menu controller major
cmpwi	r14,0x2c	#is this single button mode?
bne-	END

lwz	r15,0x10(r24)	#load projectile type ID
cmpwi	r15,0x22	#is this hitbox a pokeball
bne-	NO_DAMAGE
addi	r0,r0,0x80	# make sure default line passes
b	END
NO_DAMAGE:
li	r0,0		# fail default line check	
END:
rlwinm. r0,r0,25,31,31 	# default code line


--------------
Allow Grabs Too
0406ca90 60000000

- this is kind of untested but I think it works.

Always Allow Grabs in Single Button Mode
inject @ 8006ca8c
- right after going checking to see if warp star battle enabled

lis	r14,0x8048
lbz	r14,-0x62D0(r14)#load menu controller major
cmpwi	r14,0x2c	#is this single button mode?
bne-	END
li	r3,0		# force FALSE for warp star
END:
cmpwi	r3,0		# default code line

--------
Always Report "Yes" for WarpStar/Pokemon Battle
0416b1d0 38600001

Always Report "Yes" in SingleButton Mode
inject@ 8016b1d0

rlwinm	r3,r3,27,31,31	# default code line
lis	r14,0x8048
lbz	r14,-0x62D0(r14)#load menu controller major
cmpwi	r14,0x2c	#is this single button mode?
bne-	END
li	r3,1		# report 'yes' in single button mode
END:


--------
Disable Pokemon Spawn
inject @ 80297dd8
- no pokemon comes out of pokeball, but animation stays

lis	r14,0x8048
lbz	r14,-0x62D0(r14)#load menu controller major
cmpwi	r14,0x2c	#is this single button mode?
beq-	NO_POKE_SPAWN
lis	r14,0x8040	# 803fa220
lwz	r14,-0x5DE0(r14)# load debug flag for empty pokeballs
cmpwi	r14,0
beq-	END_DEFAULT
NO_POKE_SPAWN:
blr
END_DEFAULT:
mflr r0
---------

This one destroys the pokeball 

lis	r4,0x8048
lbz	r4,-0x62D0(r4)#load menu controller major
cmpwi	r4,0x2c	#is this single button mode?
beq-	NO_POKE_SPAWN
lis	r4,0x8040	# 803fa220
lwz	r4,-0x5DE0(r4)# load debug flag for empty pokeballs
cmpwi	r4,0
beq-	END_DEFAULT
NO_POKE_SPAWN:

lis	r4,0x8026
ori	r4,r4,0xa8ec
mtctr	r4
bctr
END_DEFAULT:
mflr r0


**********************
* Fountain of Dreams *
**********************
It's in function 801cbe64!!!!
- disabling reflection, that is. But a bunch of other stuff as well.


801cbe8c - nop'ing takes away platform collisions!

801cbe9c - nop does ???
*801cbef4 - nop freezes game
801cbf54 - nop'ing does ???
801cbf84 - nop'ing does ???
801cbfe4 - nop'ing does ???
*801cbfec - nop'ing this branch freezes game

801cc00c - branches to control positioning of left plat water jet
801cc030 - nop this line for no left platform or left water jet, or it at least starts as nothing.

801cc064 - this branch does something with controlling the offset of the right platform water jet.

801cc088 - nop this line for no right platform or right water jet

So.. looks like function 801ccbdc controls creating platforms

Disable FoD Side Plats (and Water Jets)
041ccbdc 4e800020

Disable FoD Side Plats, Water Jets, and Lagless (?)
041cbe90 48000220


Disable Fountain Water Animation
- reflection still exists
041cbe9c 60000000


1ccdcc 480000b4
- disables reflections...hmm

Lagless FOD - Dan Salvato
041cbbd4 60000000 // disables some bg elements (colored circles, mist, light aura in top left)
041cbefc 48000028 // disables reflection layer
041cbf54 60000000 // disable background "dots" (stars?)
041cbf84 60000000 // 

******************
* On-Screen Text *
******************

Investigating the title screen text.
801a2188 does the comparison to show it or not

801a21d8 - lfs f1,-0x5034(rtoc)
 - controls the Y axis placement

041a1e34 4800035c
C226339C 00000003
3DC0801A 61CE1E20
7DC903A6 4E800421
8001001C 00000000


branch link to 1a1e20

lis r14,0x801a
ori r14,r14,0x1e20
mtctr r14
bctrl
lwz r0,0x1c(sp)

That was a fail.

Memory read on "Fox" default name tag text.
80324044

8025dbe4 - lbz r3,0xDD(r3)
- loads external ID of player.

8025dc00
- branches to make name text update
- r26 = text info pointer (necessary? see below)
- r5 = pointer to text
- r4 = 0
- r3 = pointer to 32-bit floats for text positioning

-game and watch is separate and done right above this section? ID 22. Maybe he has a different text stretch or something.

-if player is using a name tag, 8025db8c loads (!0) and then branches past the display default name lines.

803f0e8c = P1 text info pointer.
each player is then 0xc apart.
  0x00 = pointer to text position data
          0x00 = x position from screen middle
          0x04 = y position from screen middle. up is negative.
          0x08 = font size
          0x0c = x stretch

Test

inject @ 8025dc04

c1dc

lis r15,0x80bd
lwz r16,0x5c88(r15)
cmpwi r16,0
beq- END
lis r16,0
stw r16,0x5c88(r15)
li r3,0x17
lis r16,0x8025
ori r16,r16,0xdbe8
mtctr r16
bctr

END:
lis r15,0x80bd
lis r16,0xc1dc
stw r16,0x5c88(r15)
add r4,r30,r29


************
* Menu SFX *
************
common sfx

For the 80024030 function, r3
0 = back to menu sfx (menu backward)
1 = start on css/menu traverse (menu forward)
2 = close/open port
3 = css "error"
4 = magnifier damage
5 = pause
6 = snapshot, pretty cool
7 = alarm
8 = grab item
9 = drop item

***************
* GmPause.usd *
***************

Loaded during every match...
I just added 1mb to this file and the matches seem to load fine.
This could be big.
I could find a pointer to this pause screen info and then bctr into the end of it to have in-game functions that are only loaded into the RAM when needed (meaning when in a match).

-->
Load pointer @ bdaa00
+0x174c = offset 0x138c in GmPause.usd

Fuction 80016714

*********************************
* Ganons Sword Affects Gameplay *
*********************************
The end of the action state execute function in 1.00 is 8006a060.


1.00 code..
Inject @ 0x69AD8

lwz r3,0x4(r27)
cmpwi r3,25
bne- END

#check for sword
lhz r3,0x5f6(r27)
cmpwi r3,0
bne- END

cmpwi r0,46
bne- NEXT
li r0,108

NEXT:
cmpwi r0,55
bne- NEXT1
li r0,109

NEXT1:
cmpwi r0,62
bne- NEXT2
li r0,110

NEXT2:
cmpwi r0,52
bne- END
li r0,111

END:
stw r0,0x14(r27)


-Porting to 1.02-

inject @ 80069bfc
- uses r26 instead of r27




lwz r3,0x4(r26)
cmpwi r3,25
bne- END

#check for sword
lhz r3,0x5f6(r26)
cmpwi r3,0
bne- END

cmpwi r0,46
bne- NEXT
li r0,108

NEXT:
cmpwi r0,55
bne- NEXT1
li r0,109

NEXT1:
cmpwi r0,62
bne- NEXT2
li r0,110

NEXT2:
cmpwi r0,52
bne- END
li r0,111

END:
stw r0,0x14(r26)

-------------------

Back to this. Beam Sword Battle will be taking over Tiny Melee (ID 0x1D). Check for this before executing. Also, I want to have a toggle for Ganon's sword, like the original code.

inject @ 80069bfc

lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major

cmpwi	r3,0x1D		#is this tiny Melee (ID 0x1D?)
beq-	SWORD_INSTEAD

lwz	r3,0x4(r26)	# load internal player ID
cmpwi	r3,25		#is player Ganon?
bne-	END_SWORD

lis	r3,0x8040		# load debug flag for ganon sword
lwz	r3,-0x5D34(r3)
cmpwi	r3,0		# is OFF?
beq-	END_SWORD

lhz	r3,0x5f6(r26)	#check for sword
cmpwi	r3,0		
bne-	END_SWORD

SWORD_INSTEAD:

cmpwi	r0,46
bne-	NEXT
li	r0,108

NEXT:
cmpwi	r0,55
bne-	NEXT1
li	r0,109

NEXT1:
cmpwi	r0,62
bne-	NEXT2
li	r0,110

NEXT2:
cmpwi	r0,52
bne-	END_SWORD
li	r0,111

END_SWORD:
stw	r0,0x14(r26)	# default code line

**********************
* Constant Body Aura *
**********************

branch link to function 800bffd0
-r3 = internal player offset
r4 = aura ID (0x0b for short fire)
r5 = 0

Try this.

inject @ 8006cb7c
- at end of PlayerThink

mr r3,r31
li r4,0xb
lis r5,0x800b
ori r5,r5,0xffd0
mtctr r5
li r5,0
bctrl
lwz r0,0x1c(sp)

C206CB7C 00000005
7FE3FB78 3880000B
3CA0800B 60A5FFD0
7CA903A6 38A00000
4E800421 8001001C
60000000 00000000


Works!!!

****************************************
* External Character ID to Internal ID *
****************************************

To get from External ID to Internal ID,

1) multiply external ID by 3
2) add that number to 803bcdc0
3) add 0x20, load byte from this value


***********************************
* USB Screenshot function disables *
***********************************

So I found that function 8022887c controls checking for Y+Dpad Up in Develop Mode every frame. 

If pressed, it loads a 1 into 0x4d6b90. Then this value of 1 gets added to the total in 0x4d6b94. From what I could tell from memory read breakpointing these addreses, this button combination is used to take screenshots with a USB device and that counter address is used to know what # to name the picture.

So...we're never going to use this. I wonder how many functions I can disable relating to this feature and how many lines that could free up!


&&&& Checking for Button Presses &&&&&&
Function 8022887c only called at one place --> 801a4f84.
(I think this 801a... function gets called every frame on every screen of the game?)

nop the branch link.

801a4f84 --> 60000000
(1a1b64 in DOL)
---> Frees up 8022887c to 80228928.


&&&& Reading the counter addresses &&&&

Memory read 804d6b90
- breaks at 802289e4 [8022892c]
   - this function is branch linked into @ 801a5070

Memory read @ 804d6b94
- breaks at [80323cf4]

nop the branch link.

801a5070 --> 60000000
(1a1c50 in DOL)

Function [8022892c]
- branch links into 802289f8
   ! Function only gets called from [8022892c]

Function [802289f8]
- branch links into 80393a5c
  ! Function only gets called from [802289f8]


Function [80393a5c]
- No: 8032ec6c
- No: 8034c408
- branch links into 8032ed8c
   ! function only gets called from [80393a5c]
- branch links into 8032ef48
   ! Function only gets called from [80393a5c]
 *more
- branch links into 8032ee94
   ! function only gets called from [80393a5c] twice


Function [8032ef48]
- branch links into 8032f39c
  ! function only gets called from [8032ef48]

Function [8032f39c]
- branch links into 8032f468
  ! Function only gets called from [8032f39c]

Function [8032f468]
- branch links into 8032c848
 ! small function only gets called from 8032f468


Need to look into [

Now,
Function [8032f228]
- gets called by 8032ed8c, 8032ee94, 8032f468
- Disable all these, and I can disable 8032f228 as well.
- function 8032f390 gets called by this function. It's a three line function that I can disable as well. Writing 0 to -0x45c4(r13) so address may be free for a flag value as well.


Function [8032f0e4]
- gets called by 8032ed8c, 8032ee94, 8032f39c
- I'm disabling all these, so lets disable this function as well.

Function [8032dcb0]
- gets called by 8032f468, 8032f228, 8032f0e4. 
- I'm disabling these so lets disable this function as well.

Function [8032c880]
- gets called by 8032f468. So disable it.

Function [8032f020]
- gets called by 8032ed8c and 8032ee94.
- I'm disabling both of those, so disable this function as well.

Function [8032ef48]
- gets called by 80393a5c. So disable it.

Functions to Disable:
RAM (DOL)
8022887c (22545c)
8022892c
802289f8
8032c848 (329428)
8032c880
8032dcb0 (32a890)
8032ed8c (32b96c)
8032ee94
8032ef48
8032f020
8032f0e4
8032f228
8032f390
8032f39c
8032f468
80393a5c (39063c)

Note: Some of these above functions branch link into the Dolphin-default-named functions:
MCCWrite
MCCRead
etc.

Do we need these functions too??

Function 8015feb4 might be related and branches to a lot of codes in adjacent areas to those from above.

FINAL DOL MODS:

0x1a1b64 --> 60000000
0x1a1c50 --> 60000000


DOL areas to zero/use for any custom codes:
0x22545c up to and including 0x225643 [0x1e8 = 122 lines]
0x329428 up to and including 0x32963f [0x218 = 134 lines]
0x32a890 up to and including 0x32a99f [0x110 = 68 lines]
0x32b96c up to and including 0x32c207 [0x89c = 551 lines]
0x39063c up to and including 0x3907f3 [0x1b8 = 110 lines]

Total: Adds 985 available lines for new code.

Also, RAM addresses 804d6b90 & 804d6b94 are now free to use for flags or whatever you want.

***********************
* Projectile Spawning *
***********************
Projectile Spawning
BP @ 26bb68
Go back two blr's.
- Lines right before the branch should be loading projectile ID.
- does it always load into r6?

Link - Bomb Pull
800eb850   lwz r6,0x48(r31)

Link Pulls Pokeballs
040eb850 38C00022

inputs:
f1,r5,r3,r6=id,r4


r3 = external data offset start
r4 = place in stack (? idk)
r5 = 0x40 (?)
r6 = projectile ID
f1 = player facing direction

Then bl into 8029dd58

output is r3 = item_t
so store that into +0x1974


FalcoFox Shoot Pokeballs
0429c6a8 38C00022

Ice Climbers Ice Blocks
8011f564   li r5,0x6a



************************************
* Spawn Items Into a Player's Hand *
************************************

D-Pad Down Gives Player a Beam Sword
- need to add in a check for if they already have an item

inject @ 8006cb7c

lwz r3,0x65c(r31)
cmpwi r3,0x4
bne- END
lwz r3,0x1974(r31)
cmpwi r3,0
bne- END
lis r3,0x8029
ori r3,r3,0xdd58
mtctr r3
mr r3,r30
lis r4,0x8170
li r5,0x40
li r6,0xc
lfs f1,0x2c(r31)
bctrl
lis r4,0x8009
ori r4,r4,0x48a8
mtctr r4
mr r4,r3
mr r3,r30
bctrl
END:
lwz r0,0x1c(sp)


Doesn't work for every character...



Function 8a9f8 - checks for if A (instant) pressed. Decided action state
but only during certain action states. Like wait but not run.

From wParam...

DPad Down Drops an Item
04225774 480001D8
04225964 48000080
04225590 3C60804C
04225594 60601FAC
042255A8 3C60804C
042255AC 60631FAC

Item Selector
0449FAB0 000000xx




For Develop Mode, dpad down dropping items,
802264c4 is the controlling function. Also something at the end of this function for R+dpad up??


Try this.

inject @ 8006cb7c

lis r3,0x8022
ori r3,r3,0x64c4
mtctr r3
lbz r3,0xc(r31)
bctrl
lwz r0,0x1c(sp)

C206CB7C 00000004
3C608022 606364C4
7C6903A6 887F000C
4E800421 8001001C
60000000 00000000


80268b18  EntityItemSpawn
 
Use 804d6b90 as flag for entity structure for last item spawned
lwz _,-0x4b10(r13)

inject @ 80268b4c - lwz r31,0x14(sp)

stw r3,-0x4b10(r13)
lwz r31,0x14(sp)



C6D4B4-
cfafc0

Cheat Search
80bda5c4
80bda818 - holds newest item spawned entity struct start

both hold last item entity spawn struct

Now try this to make the d-pad down spawned item automatically be given to this player

**BEAM SWORD BATTLE**
- Use in conjunction with "sword action states even without items"
- Players always have a beam sword in hand, but game thinks they are not weilding any items. So can still pull bombs/turnips, etc.
-proof of concept is pressing dpad down to spawn beam sword 
 --> works even with items off!@!
inject @ 8006cb7c

lwz r3,0x65c(r31)
cmpwi r3,0x4
bne- END
lwz r3,0x1974(r31)
cmpwi r3,0
bne- END
lis r3,0x8026
ori r3,r3,0x8b18
mtctr r3
lis r3,0x8170
li r4,0xc
stw r30,0(r3)
stw r30,0x4(r3)
stw r4,0x8(r3)
lis r4,0x3f80
stw r4,0x38(r3)
lis r4,0x8000
stw r4,0x44(r3)
li r4,1
bctrl
lis r4,0x8009
ori r4,r4,0x48a8
mtctr r4
mr r4,r3
mr r3,r30
bctrl
li r3,0
stw r3,0x1974(r31)
END:
lwz r0,0x1c(sp)


------------

Spawn with Beam Swords
inject @ 800c6b90
- in function AS_324_EntryEnd
-r31 holds internal offset
-r30 holds r3 at this moment
- 228880 = 20XX offset for beam sword entity

Beam Sword Battle is replacing Tiny Melee (ID 0x1D)

#first check to enable this mode or not during gameplay
#if not, branch to END_SATURN_NOTHING
lis r29,0x8048
lbz r29,-0x62D0(r29)
#is this Tiny Melee (ID 0x1D?)
cmpwi r29,0x1D
bne- END

#load spawn item entity function
lis r3,0x8026
ori r3,r3,0x8b18
mtctr r3
#load 20XX offset for custom item entity
lis r3,0x8022
ori r3,r3,0x8880
#store beam sword
#incase I use it for other items ever
li r4,0xc
stw r4,0x8(r3)
li r4,1
bctrl
#load GiveItemToPlayer function
lis r4,0x8009
ori r4,r4,0x48a8
mtctr r4
mr r4,r3
mr r3,r30
bctrl
#remove item, but not destroying the entity
li r3,0
stw r3,0x1974(r31)
#default r4
lwz r4,-0x514c(r13)
mr r3,r30
END:
lwz r0,0x6c0(r4)


No. Do it at this injection point. Will work for Giga Bowser and everyone.
80069114
- setting up the character slot, right after specific character function blrl's.

#first check to enable this mode or not during gameplay
# if not, branch to END_SATURN_NOTHING
lis r3,0x8048
lbz r3,-0x62D0(r3)
#is this Tiny Melee (ID 0x1D?)
cmpwi r3,0x1D
bne- END
#load spawn item entity function
lis r3,0x8026
ori r3,r3,0x8b18
mtctr r3
#load 20XX offset for custom item entity
lis r3,0x8022
ori r3,r3,0x8880
#store beam sword
#incase I use it for other items ever
li r4,0xc
stw r4,0x8(r3)
li r4,1
bctrl
#load GiveItemToPlayer function
lis r4,0x8009
ori r4,r4,0x48a8
mtctr r4
mr r4,r3
mr r3,r31
bctrl
#remove item, but not destroying the entity
li r3,0
stw r3,0x1974(r30)
END:
lwz r28,0x2c(r31)

------------------------

9/5/15
Redo...again.

Inject @ 80069388 - mr	r3,r31
- this line is at the end of AllocateAndInitPlayer
r30 = internal data offset (so +0x60)
r31 = external data offset


lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major
cmpwi	r3,0x1D		# is this Tiny Melee (ID 0x1D?)
bne-	END
lwz	r3,0x4(r30)	# load internal char id
cmpwi	r3,0x1b		# is this master hand?
beq-	END
cmpwi	r3,0x1c		# is this crazy hand?
beq-	END
cmpwi	r3,0x20		# is this sandbag?
beq-	END

lis	r3,0x8026
ori	r3,r3,0x8b18	#load spawn item entity function
mtlr	r3
lis	r3,0x8022
ori	r3,r3,0x8880	#load 20XX offset for custom item entity

li	r4,0xc		#store beam sword
stw	r4,0x8(r3)	#incase I use it for other items ever
li	r4,1		
blrl

lis	r4,0x8009
ori	r4,r4,0x48a8	#load GiveItemToPlayer function
mtlr	r4
mr	r4,r3
mr	r3,r31
blrl

li	r3,0		
stw	r3,0x1974(r30)	#null item, but not destroying the entity
END:
mr	r3,r31		# default code line

-------------

Make Beam Sword Invisible If in Sleep
- also invisible if char is invisible

inject @ 8026eecc - mflr r0
- the function that apparently displays beam swords (and other items? idk) on screen
- r3 is external item data offset


lis	r5,0x8048
lbz	r5,-0x62D0(r5)# load menu controller major
cmpwi	r5,0x1D	# is this Tiny Melee (ID 0x1D?)
bne-	END
lwz r5,0x2c(r3)	# load item internal offset
lwz	r0,0x10(r5)	# load item ID
cmpwi	r0,0xc		# is this a beam sword?
bne-	END
lwz	r5,0x518(r5)	# load player_t owner
cmpwi	r5,0		# if null, END (idk...just in case)
beq-	END
lwz r5,0x2c(r5)	# load char internal offset
lwz	r0,0x10(r5)	# load char action state
cmpwi	r0,0xb		# is char in "Sleep"
beq-	INVISIBLE
lbz	r5,0x221e(r5)
rlwinm. r5,r5,0,24,24	# is char in action state invisibility?
beq-	END
INVISIBLE:
blr			# make item invisible
END:
mflr	r0

**************************
* Random Camera Research *
**************************

mem read bp @ 452cac

broke at 80029bc4

[8002b3d4]

blr'ed into from 8002f398!
- loads camera type, then uses as index and pulls from table at 803BCB18

and that function gets blr'ed into at 80390dfc


Disable Training Mode HUD
04189c20 60000000

c6874

****************************
* CSS Clickable Area Stuff *
****************************

Part of function CSS_BigFunctionMonitorInputsAndMore

Testing - 
P1 
r31 = 811665a0
+0xC  = cursor hand x-axis 
+0x10 = cursor hand y-axis

After clicking on a name tag
- code line 80263db8 is executed after SFX code
r31 = 116aa60 (pointer to this location @ 803f0e8c)
-0x44b0 to get to y-axis? No.

Actually, code line 80263db8 is executed every frame when the name tag box is open.

-------------
*IMPORTANT*
0x4a0bc0 are pointer to the hand cursor locations (like 811665a0 from above), each player 0x4 apart
- when on any CSS!
-------------

Cursor Moves off Name Tag Box After Name Tag is Selected
inject @ 80263db0
- can likely use r4,r0
- r28 = port number, i think

stb r0,0x1a(r31)
lis r4,0x804a
ori r4,r4,0x0bc0
mulli r0,r28,4
lwzx r4,r4,r0
lis r0,0xc1a8 #float -21
stw r0,0x10(r4)



code line
261a3c - doing comparisons for where player is clicking.
3f0e10 - x-axis limits for pressing HMN/cpu button?
3f0e34 - P2 x-axis left limit
3f0e38 - P2 x-axis right limit
-3508 rtoc (4dc4d8) = 1.575
-3500 rtoc (4dc4e0) = -2.2875
4dc4e8 = -2.2 = "snap-to" position after clicking HMN button

-0x49f0(r13) = 804807b0
Does this change based on what game mode I'm in?

Name Tag Box
- BP at menu sound after clicking to open box
- 802635cc


Clicking HMN Button when player is holding puck

80261a34 gets hit

Allow Port Closing When Player's Puck is Held
04261a18 60000000
04261a28 60000000

or 

04261a18 48000014
-------------------

Character Select Screen: HMN/CPU Button - Clickable Area Notes

v1.02 DOL offset (RAM offset)

Global:
0x435eb8 (4dc4d8) = y-axis top limit = 1.575
0x435ec0 (4dc4e0) = y-axis bottom limit = -2.2875
0x435ec8 (4dc4e8) = "snap-to" position after clicking HMN button = -2.2

Player Specific:
0x3ede10 (3f0e10) - P1 x-axis left limit = -35.599998
0x3ede14 (3f0e14) - P1 x-axis right limit = -28.6

0x3ede34 (3f0e34) - P2 x-axis left limit = -19.4
0x3ede38 (3f0e38) - P2 x-axis right limit = -13.4

0x3ede58 (3f0e58) - P3 x-axis left limit = -4.2
0x3ede5c (3f0e5c) - P3 x-axis right limit = 2.2

0x3ede7c (3f0e7c) - P4 x-axis left limit = 11
0x3ede80 (3f0e80) - P4 x-axis right limit = 17


Character Select Screen: Teams Color Button - Clickable Area Notes

Global:
0x435ed0 (4dc4f0) = y-axis top limit = -1.875
0x435ed8 (4dc4f8) = y-axis bottom limit = -2.3625

Player Specific:
0x3ede18 (3f0e18) - P1 x-axis left limit = -26.799999
0x3ede1c (3f0e1c) - P1 x-axis right limit = -21.0

0x3ede3c (3f0e3c) - P2 x-axis left limit = -11.4
0x3ede40 (3f0e40) - P2 x-axis right limit = -6.0

0x3ede60 (3f0e60) - P3 x-axis left limit = 3.5
0x3ede64 (3f0e64) - P3 x-axis right limit = 9.4

0x3ede84 (3f0e84) - P4 x-axis left limit = 19.0
0x3ede88 (3f0e88) - P4 x-axis right limit = 24.6

32-bit floating point numbers.


************************************
* Various CSS Player Info Location *
************************************
804807b2 - CSS Type Flag,
- controls the announcer voice, top left game type texture, and rules bar text.
- does NOT actually control the features of the game type.
  0x00 = VS Melee
  0x01 = Camera Mode
  0x02 = Stamina Mode
  0x03 = Super Sudden Death
  0x04 = Giant (801b8fbc = li r5,4)
  0x05 = Tiny (801b8dac = li r5,5)
  0x06 = Invisible (801ba310 = li r5,6)
  0x07 = Fixed Camera
  0x08 = Single Button (801ba110 = li r5,8)
  0x09 = Lightning (801ba708 = li r5,9)
  0x0a = Slo-mo (801ba510 = li r5,10)

804807b4 - pointer to ??

804807b8
- Every CSS "Current" Player Info Start

Super Sudden Death
8045ac50

Stamina Mode
8045b790

Tiny
8045b510

Invisible
8045aed0

Fixed Camera

Single Button
8045b290

Lightning
8045ba10
 
Slo-MO
8045b8d0

-----

Always Use Vs. Mode CSS Return Info
inject @ 801a5630
- can change the r31 CSS Type flag as well.

lis r4,0x8045
ori r4,r4,0xac50
addi r30,r4,0

C21A5630 00000002
3C808045 6084AC50
3BC40000 00000000





Part of Scene Function
801a40dc - lwz r3,4(r25)

loads the start of the CSS Info into r3

Vs. Melee
- loads 804807b0 from 3dd9b0

Giant Melee
-loads 80480530 from 803df0a0

Tiny Melee
-loads 80480530 from 803defc8

0x10 + menu controller = pointer for SceneFunction


80068914 - executed at start. Executed on death too?

8016d8ac - PlayerBlock_InitializeFromMatchTypeInfo
- r4 = start of this player's CSS info start

80480530 - Giant Melee CSS Info

**********************************************************
* Zelda / Sheik Transform at Beginning of Match (Hold A) *
**********************************************************

8016d97c - the line that loads Sheik instead of Zelda if holding A!!
- can use this as the perfect place to execute something if player is holding a button on match start.


***********************
* Special Melee Modes *
***********************

I think the specific functions for each mode (tiny, invis, giant) get executed at 801a5ab0. Vs. Melee doesn't get to this line because r30=0 (line 801a5a88)

801a58d4 is the blrl for lightning melee
- modify the two branches to always branch to disable most special melee modes.
- or just disable the specific functions.

-0x4d78(rtoc) = Slo-Mo mode float = 0.5
-0x4d70(rtoc) = Lightning Mode float = 1.25

801b8e50  TinyMelee_ModifyPlayerValues
801b9060  GiantMelee_ModifyPlayerValues
801ba3b4  InvisibleMelee_SetInvisibleFlag
801b8c5c  SuperSuddenDeath_Store300%Damage

Disable Lightning Melee
041ba7ac 4e800020

Disable Slo-Mo Melee
041ba5b4 4e800020

**********
* Damage *
**********

Random notes...

8006cc7c   Damage_Apply&UpdateOnScreenPercent
           f1 = damage to be added
           r3 = external data offset start (so the +0x60)

For NBA jam, multiply f1 by desired float.

8006d1ec


---
*******************
* GFX Spawn Tests *
*******************



8009f834 = produce GFX, I think
in the "DC" subscript event,
r3=internal data offset
r4=GFX ID
r5,r6,r7=0
r8= sp+32
r9=sp+20


Explosion GFX every frame
inject @ 8006cb7c

mr r3,r30
li r4,0x40f
li r5,0
li r6,0
lis r7,0x8009
ori r7,r7,0xf834
mtctr r7
li r7,0

bctrl
lwz r0,0x1c(sp)

...holy shit it works.


****************************************************
* Modified Subaction Event - Damage Self/Heal Self *
****************************************************
Modified Subaction Event - Damage Self or Heal Self (1.02) [Achilles]

CC00XXXX = damage self XXXX%
CC01XXXX = heal self XXXX%

# not needed anymore
#04072c14 A0840002
#04072c1c 60000000
#04072c20 60000000
#04072c18 60000000


inject @ 80072c14
- updated 1/29/17

lbz r5,1(r4)
lhz r4,2(r4)
lwz r3,0x2c(r3)
cmpwi r5,1
bne- DAMAGE_SELF
lis r5,0x8006
ori r5,r5,0xcf5c
mtlr r5
blrl
lis r5,0x8007
ori r5,r5,0x2c3c
mtlr r5
blr
DAMAGE_SELF:
lis r5,0x8007
ori r5,r5,0x2c24
mtlr r5
blr


***********************
* Only Monsters Spawn *
***********************

20XX:
3fa24c = Monster Spawn Toggle

inject @ 8026c83c - lbzx r0,r4,r3
- r0 = Item ID

lbzx	r0,r4,r3	# default code line, get item ID

lis	r3,0x803f
ori	r3,r3,0xa24c	# 20XX monster spawn check 
lwz	r3,0(r3)
cmpwi	r3,0
beq-	END


lis	r3,0x8047
ori	r3,r3,0x9d30	#load menu controller major
lbz	r3,0(r3)
#801a4340 = check r3 menu id for any single player mode
lis	r4,0x801a
ori	r4,r4,0x4340
mtlr	r4
mr	r4,r0		#save default item
blrl
mr	r0,r4		#restore default item
cmpwi	r3,1		#is in single player?
beq-	END
RANDOM_MONSTER:
lis	r3,0x8038
ori	r3,r3,0x0580	# RNG function
mtlr	r3
li	r3,4		#4 monster options
blrl
addi	r0,r3,0x2b	#add monster item ID offset

END:

***************
* CPU Teching *
***************

800986b0 Tech_L/RCheck&FrameWindowCheck
 
??  8009872c Interrupt_NeutralTech ??
- what to do with this?

8003241c PlayerBlock_SlotTypeLoad




inject @ 80098714 - li r3,0
- r31 = internal data offset

lis r3,0x8003
ori r3,r3,0x241c
mtlr r3
lbz r3,0xc(r31)
blrl
cmpwi r3,0
beq- NO_TECH
lis r3,0x8038
ori r3,r3,0x0580
mtlr r3
li r3,100
blrl

TWENTYXX:
#20XX flag @ 803fa19c
lis r4,0x803f
ori r4,r4,0xa19c
lwz r4,0(r4)
cmpwi r4,0
beq- NO_TECH
cmpw r3,r4
blt- TECH

NO_TECH:
li r3,0
b END

TECH:
li r3,1
END:
 


Hmm. I need to make a better code and put it at an injection point 2 functions before this one, I think.

******************
* Results Screen *
******************

No character models on results screen.
040be820 60000000

**************************************
* Stage Hacking - Finding Collision Link Flags in RAM *
**************************************


80054cec   StageFile_GroundIDTypeLoad

r31 = link ID

lwz r3,-0x51e4(r13)
rlwinm r0,r31,3,0,28 #multiply link by 8
lwzx r3,r3,r0
lhz r3,0xe(r3)

#r3 = 0x0000AABB
AA = ground ID type
BB = special flag (?)
     0x00 = normal
     0x01 = earth mountain (poke transform stage)
     0x02 = grass
     0x03 = earth
     0x04 = wood
     0x05 = wood (snowy/fourside moving plat/poke ground stage plats)
     0x06 = Great Fox / Peach Castle constant plats / trophy stage rails
     0x0A = water
     0x0C = UFO
     0x0E = snow mound
     0x0F = ice
     0x12 = checkered ground (green greens plats, yoshis island 64)
***********************
* 20XX Color Overlays *
***********************

How many color options?

1 - Black (000000)
2 -  Gray (808080)
3 - White (FFFFFF)
4 - Red (FF0000)
5 - Salmon (FA8072)
6 - Orange (FF8000)
7 - Khaki (F0E68C)
8 - Gold (FFD700)
9 - Yellow (FFFF00)
10 - Olivedrab (C0FF3E)
11 - Green (00FF00)
12 - Forest Green (228B22)
13 - Cyan (00FFFF)
14 - Aqua Marine (7fffd4)
15 - Steel Blue (4682B4)
16 - Blue (0000FF)
17 - Purple (800080)
18 - Magenta (FF00FF)
19 - Hot Pink (FF69B4)
20 - Pink (FFC0CB)
21 - Tan (D2B48C)
22 - Brown (964B00)

Debug Menus:

<COLOR OVERLAYS>
P1: ON/OFF
P2: ON/OFF
P3: ON/OFF
P4: ON/OFF

ACTION STATE OVERLAYS >

HITLAG (DEFENDER): NONE -> COLORS
HITSTUN: NONE -> COLORS

INVINCIBILITY:
INTANGIBILITY:

IASA ENABLED: 

ALPHA (TRANSPARENCY) VALUE: 0-255

ALPHA DROPS BY HALF DURING LAST FRAME OF
HITLAG, HISTUN, TIMED INVINC/INTANG AND
THESE HAVE PRIORITY OVER ACTION STATES.


------

PRESS Y+DPAD DOWN IN DEVELOP MODE
TO FIND ACTION STATE NAMES

--------------
Random aside...

Disable Hitstun White Flash Color OVerlay
inject @ 8008e21c
----------


for IASA color enable, needs to make color tint byte 0xcd!

----------------------

Try new injection point
800bf550 - 
- okay...after some testing, I realized that at this injection point, all I need to do is write to the RRGGBBAA line to have this color be displayed next frame.
That is really good news, and likely the source of the issues with the above attempt, that seemed to be one frame off or something like that.

COLOR TINT ON/OFF FLAGS (self defined):
0x80	normal on, don't check
0x82	turn color off, then check for overlays (things that could change in the middle of an action state)
0x83	skip 20XX overlay function completely, continue to apply color

***need to turn off 1,2,3 bits at end of function if 0x80 is not in use
** add a better check for specialfallland from not wavedash.

Char Data Offset +
0x505 = color to apply for the 0x83 type color tint flag
0x506 = last action state (for wavedash overlays)


#803fa494 = 20XX p1 color overlay on/off
lis	r20,0x803f
ori	r20,r20,0xa494
lbz	r31,0xc(r3)	#load port number
mulli	r31,r31,4
lwzx	r31,r20,r31
cmpwi	r31,0		#is color overlay for this player on?
beq-	END_END

INITIALIZE_IMPORTANT_REGS:
lwz	r15,0x10(r3)	#r15 = current action state of character
lis	r14,0x8032
ori	r14,r14,0xdcac	#r14 = 0x4 minus start of color table
lwz	r19,0x24(r20)	#r19 = alpha value, int

#check for 0x82 color flag which means to turn off, but still execute checks
lbz	r17,0x504(r3)
cmpwi	r17,0x82
bne-	SKIP_OVERLAY_CHECK
li	r17,0
stb	r17,0x504(r3)

SKIP_OVERLAY_CHECK:
cmpwi	r17,0x83
bne-	OVERLAY_START
mr	r18,r17
lbz	r31,0x505(r3)	# load last applied color enum
b	TURN_ON_COLOR_CUSTOM_FLAG

OVERLAY_START:


lwz	r31,0x221c(r3)	#check if in hitstun/hitlag
rlwinm.	r31,r31,0,6,6
beq-	IASA_CHECK
lbz	r31,0x221a(r3)	#if this byte equals zero, then in hitstun
cmpwi	r31,0
beq-	HITSTUN

HITLAG:
lwz	r31,0x10(r20)	#load debug color flag for hitlag
cmpwi	r31,0
beq-	IASA_CHECK


lwz r17,0x195c(r3)	#r17 holds frames of hitlag left, float
b FLOAT_LAST_FRAME_CHECK

HITSTUN:
lwz	r31,0x14(r20)
cmpwi	r31,0
beq-	IASA_CHECK

lwz	r17,0x2340(r3)	#r17 holds frames of hitstun left, float

FLOAT_LAST_FRAME_CHECK:
lis	r18,0x3f80
cmpw	r17,r18
beq-	DIVIDE_ALPHA_BY_TWO
b	TURN_ON_COLOR


IASA_CHECK:
lwz	r31,0x20(r20)	#load IASA debug color choice
cmpwi	r31,0		#if "NONE", then skip
beq-	IASA_CHECK_END
cmpwi	r15,0x2a	# landing?
beq-	IASA_CHECK_LANDING
cmpwi	r15,0x2c	# 0x2C = Attack11 (Jab1)
blt-	IASA_CHECK_END
cmpwi	r15,0x2f	# 0x2f = Attack100Start (rapid jab start)
blt-	IASA_CHECK_ATTACKS	# if between 0x2c, 0x2d, or 0x2e
cmpwi	r15,0x32
blt-	IASA_CHECK_END	# skip if in rapid jabs
cmpwi	r15,0x46	# 0x45 = AttackAirLw (Dair)
bge-	IASA_CHECK_END	#skip if not doing an attack
IASA_CHECK_ATTACKS:
lbz	r18,0x2218(r3)	#load flag that includes IASA
rlwinm. r18,r18,0,24,24	#(00000080) is IASA enabled
bne- IASA_GO
b	IASA_CHECK_END
IASA_CHECK_LANDING:
lfs	f15,0x894(r3)
lfs	f16,0x1f4(r3)
fcmpo	cr0,f15,f16
blt-	IASA_CHECK_END
IASA_GO:
li	r18,0x82
b 	TURN_ON_COLOR_CUSTOM_FLAG
IASA_CHECK_END:


AUTOCANCEL:
lwz	r31,0x1c(r20)	#load IASA debug color choice
cmpwi	r31,0		#if "NONE", then skip
beq-	AUTOCANCEL_END

# Game and Watch has special-move-esque AS ID's for nair,bair,uair
lwz	r18,4(r3)	# load internal char ID
cmpwi r18,0x18	# 0x18 = g&w internal ID
bne- AUTOCANCEL_GAMEWATCH_END
cmpwi	r15,0x15b	# 0x15b = nair, 0x15c = bair, 0x15d = uair
blt-	AUTOCANCEL_GAMEWATCH_END
cmpwi	r15,0x15d
ble- AUTOCANCEL_CHECK
AUTOCANCEL_GAMEWATCH_END:

cmpwi	r15,0x41	# 0x0041 = nair
blt-	AUTOCANCEL_END
cmpwi	r15,0x45	# 0x0045 = dair
bgt-	AUTOCANCEL_END	#skip if not doing an aerial
AUTOCANCEL_CHECK:
lwz	r18,0x2200(r3)	# load autocancel byte
cmpwi	r18,0
bne-	AUTOCANCEL_END
li	r18,0x82
b 	TURN_ON_COLOR_CUSTOM_FLAG
AUTOCANCEL_END:

MISSED_SMASH_TURN:
lwz	r31,0xA34(r20)	# 3faec8 = color overlays, missed smash turn
cmpwi	r31,0
beq-	MISSED_SMASH_TURN_END
cmpwi	r15,0x12	# in Turn?
bne-	MISSED_SMASH_TURN_END
lhz	r18,0x894(r3)	# load animation frame
cmpwi	r18,0x4000	# Turn frame 2?
bne-	MISSED_SMASH_TURN_END
lwz	r18,0x2348(r3)
cmpwi	r18,0		# 0 if not past 0.8 dash threshold on frame 2 of Turn
beq-	MISSED_SMASH_TURN_END		# skip if dash after slow turn will not activate if held (standing turn)

lwz	r18,0x2350(r3)
cmpwi	r18,0		# 0 if no slow turn delay (smash turn, but didn't dash)
beq-	MISSED_SMASH_TURN_END		# skip if pivot
stb	r31,0x505(r3)
li	r18,0x83
b 	TURN_ON_COLOR_CUSTOM_FLAG
MISSED_SMASH_TURN_END:

NANA_DESYNC:
lwz r31,-0x16C(r20) # 3fa328 = color overlay, Nana type desynced
cmpwi r31,0			# check if color overlay is set to none
beq-	NANA_DESYNC_END
lbz	r18,0x221f(r3)
rlwinm.	r18,r18,0,28,28	# (00000008) = secondary character (Nana)
beq-	NANA_DESYNC_END
lbz	r18,0x1b82(r3)
rlwinm.	r18,r18,0,31,31
bne-	NANA_DESYNC_END
li	r18,0x82
b 	TURN_ON_COLOR_CUSTOM_FLAG
NANA_DESYNC_END:

PERFECT_WAVEDASH:
cmpwi	r15,0x2B	#is character in LandingFallSpecial?
bne-	ACTION_STATE_CHECK
lbz	r18,0x506(r3)	# load "last action state"
cmpwi	r18,0x23	# was "last action state" FallSpecial?
beq-	ACTION_STATE_CHECK	# if so, this isn't a wavedash or waveland
lwz	r18,0x894(r3)	#load frame counter
cmpwi	r18,0		#is this the first frame of LandingFallSpecial?
bne-	ACTION_STATE_CHECK
li	r31,0xFF	# FF is flag for which color to apply
lbz	r18,0x680(r3)	#load digital L/R timer byte
cmpwi	r18,0		#perfect wavedash means 0
bne-	WAVEDASH_INPUT_WINDOW
lwz	r31,0x18(r20)	#load debug menu perfect wavedash timing color flag

WAVEDASH_INPUT_WINDOW:
lfs	f15,0x624(r3)	#load Y joystick value

lfs	f16,-0x1A8(r20)	# load y wavedash max
fcmpo	cr0,f15,f16
bgt-	END_WAVEDASH_COLOR
lfs	f16,-0x1AC(r20)	# load y wavedash min	
fcmpo	cr0,f15,f16
blt-	END_WAVEDASH_COLOR

lfs	f15,0x620(r3)	#load X joystick value
lfs	f16,0x30(r20)	# load x wavedash max
fcmpo	cr0,f15,f16
bgt-	CHECK_NEGATION
lfs	f16,0x34(r20)	# load x wavedash min	
fcmpo	cr0,f15,f16
blt-	CHECK_NEGATION
b	SUCCESSFUL_INPUT_RANGE

CHECK_NEGATION:
fneg	f16,f16
fcmpo	cr0,f15,f16
bgt-	END_WAVEDASH_COLOR
lfs	f16,0x30(r20)	# load x wavedash max
fneg	f16,f16
fcmpo	cr0,f15,f16
blt-	END_WAVEDASH_COLOR


SUCCESSFUL_INPUT_RANGE:
cmpwi	r31,0xFF	# is not perfectly timed?
beq-	WAVEDASH_INPUT_ONLY
lwz	r18,0x2c(r20)	#load debug menu wavedash input & timing color flag
cmpwi	r18,0		# is perfectly timed and input range "NONE"?
beq-	END_WAVEDASH_COLOR
lwz	r31,0x2c(r20)	# if its actually a color, then load it
b	END_WAVEDASH_COLOR
WAVEDASH_INPUT_ONLY:
lwz	r31,0x28(r20)	#load debug menu wavedash input color flag
	

END_WAVEDASH_COLOR:
cmpwi	r31,0xff
beq-	ACTION_STATE_CHECK
cmpwi	r31,0		#if "none", then skip
beq-	ACTION_STATE_CHECK
stb	r31,0x505(r3)
li	r18,0x83
b	TURN_ON_COLOR_CUSTOM_FLAG


ACTION_STATE_CHECK:
li	r31,0
lis	r18,0x803f
ori	r18,r18,0xadcc	# action state color flags -0x4

ACTION_STATE_LOOP:
addi	r31,r31,1	# color counter
lwzu	r17,4(r18)	# load action state flag into r17
cmpwi	r17,0		# no color is 0xffffffff flag value
blt-	ACTION_STATE_COMPARE

cmpw	r15,r17		# compare current action state to flag action state
beq-	TURN_ON_COLOR


ACTION_STATE_COMPARE:
cmpwi	r31,22		# 22 possible colors (for now..)
blt-	ACTION_STATE_LOOP
b	OVERLAY_END	#if no action state color to apply, end function

DIVIDE_ALPHA_BY_TWO:
li	r18,2		#load 2 to divide by
divw	r19,r19,r18	#divide alpha value by 2
li	r18,0x82	#0x82 flag means to turn off color next frame
b TURN_ON_COLOR_CUSTOM_FLAG

TURN_ON_COLOR:
li	r18,0x80
TURN_ON_COLOR_CUSTOM_FLAG:
stb	r18,0x504(r3)
mulli	r31,r31,4	#so...r31 = color to apply. 1=black
add	r14,r31,r14	#r14 now = address of color
lwz	r14,0(r14)
or	r14,r14,r19
stw	r14,0x4b4(r3)	#store RRGGBBAA value
li	r14,0
stw	r14,0x430(r3)	# disable any other body aura (aka use second color data)

OVERLAY_END:
stb	r15,0x506(r3)	# store this action state as "last action state"
lbz	r18,0x504(r3)	# load color tint byte
rlwinm.	r18,r18,0,24,24	# extract color tint on/off bit
bne-	END_END		# ignore next line if color is on
stb	r18,0x504(r3)	# store 0, remove all color bits
END_END:
addi	r30,r5,0	# default code line

-----------------------

What about a separate screen that lets you input a range for wavedash joystick values

<WAVEDASH COLOR OVERLAYS>

PERFECT TIMING ONLY:
PERFECT TIMING AND INPUT RANGE: 

CONTROLLER INPUT RANGE
X-MAX:
X-MIN:

Y-MAX:
Y-MIN: 

X = +-0.95 and Y = -0.2875 IS MAX DISTANCE 


-----------------------

Okay.. doing a memory read on the color tint byte.

Breaks @ 8009f7e0
Breaks @ 800bf6a4
Breaks @ 800bf8dc


Maybe try injecting at beginning of 800bf534 function. But I haven't checked if this gets hit every frame no matter what.






*****************************************************
* On-screen Action state and subaction state values *
*****************************************************

P1 % = P1 Action State ID
P2 % = P1 Subaction State ID

inject @ 8006ca78

lbz r14,0xc(r3)
cmpwi r14,0
bne- END
lis r14,0x8045
ori r14,r14,0x30e0
lwz r15,0x10(r3)
sth r15,0(r14)
lwz r15,0x14(r3)
sth r15,0xe90(r14)
END:
lbz r0,0x221f(r3)


So play a match with P1 as the character you want to know values for and P2 as standing human dummy or something, because you need his percent on-screen. 

Convert the on-screen percents to hexadecimal.

******************************
* Always Grab Items in Range *
******************************

Inject @ 800d71f4

li r0,8
sth r0,0x209c(r31)
lhz r0,0x209c(r31)


*************************************
* Mush Kingdom / Hyrule Maze Camera *
*************************************

208f70

blrl into at 390dfc
208f70 pulled from c510e0+0x14
 - so this is -0x3e68(r13), then +0x14

804d7838 holds this camera function pointer!


I think the camera entity is being used at the beginning of function 208f70.

Function 801c57a4 = load Player 1's data offset start
This is the function that Hyrule Maze (and Mush King!) use to follow Player 1!!!!

801c57a8 = li r3,0
# 0 = P1

I could have it keep going through data offsets until it find a player.

Alright. Let's make it always work.

inject @ 801c57a8

#load single player check function
lis r3,0x801a
ori r3,r3,0x4340
mtlr r3
lis r3,0x8047
ori r3,r3,0x9d30
lbz r3,0(r3)
blrl
cmpwi r3,0
beq- VERSUS
li r3,0
b END
VERSUS:
li r3,-1
REPEAT:
addi r3,r3,1
lis r15,0x8045
ori r15,r15,0x3130
mulli r14,r3,0xe90
lwzx r14,r14,r15
cmpwi r14,0
beq- REPEAT
END:

FREEZES GAME AFTER AWHILE....

Back to this.

lis r3,0x8047
ori r3,r3,0x9d30
lbz r3,0(r3)
cmpwi r3,2
beq- VERSUS
cmpwi r3,0x10
blt- NORMAL

NORMAL:
li r3,0
b END
VERSUS:
li r3,-1
REPEAT:
addi r3,r3,1
lis r4,0x8045
ori r4,r4,0x3130
mulli r0,r3,0xe90
lwzx r4,r4,r0
cmpwi r4,0
beq- REPEAT
END:

Idk.
I'm just going to hardswitch it at the CSS based on the first player with a character selected and leave it at that.


**********************
* Single Button Mode *
**********************

Sing Button Mode (madewokherd)

057E0074 88030002
057E0078 60000020
057E007C 98030002

lbz r0,2(r3)
ori r0,r0,32
stb r0,2(r3)

investigate?

Disable Single Button Mode
0416b108 38600000
- always report 0 [bool]

*************************************
* Random DI - Directional Influence *
*************************************

Alright, here's the plan.

0) Check if CPU
1) Pull a random byte (0 to 255), then normalize it with a value of 255. So the max value is 1.00
  ---> use this value as the hypotenuse of the angle created with the joystick X/Y values.

2) Branch to the RNG function and get a degree value between 0 and 359.

  --> Now, we have strength and direction that the joystick is pressed in.

3) Y joystick = sin(degree) * hypotenuse
4) X joystick = cos(degree) * hypotenuse

 Done.


BUT, I could have different types of CPU DI.
1) Random (like above)
2) Strong Random (hypotenuse always = 1)
3) Survival (pulling the angle of the attack that is hitting the opponent)




-----------
In the DI calc function,
0.017453 = PI/180

Can always get this value using
lfs f2,-0x7510(rtoc)

Nice.

#load a random byte
lbz r3,-0x570E(r13)
---------

inject @ 8008e5c4 - mr r31,r3
- r3 = internal data offset
- r31 is open as long as this is at the end

mr r31,r3
#load port number
lbz r15,0xc(r3)
lis r14,0x8045
ori r14,r14,0x3088
mulli r15,r15,0xe90
lwzx r15,r15,r14
#is player a human?
cmpwi r15,0
beq- END

#get angle
#get random number between 0-359, inclusive
lis r3,0x8038
ori r3,r3,0x0580
mtlr r3
#0.5 degree resolution (?)
li r3,720
blrl

#***debug
lis r15,0x8045
sth r3,0x30e0

#**

bl CONVERT_TO_FLOAT

#load 0.017453 (pi/180)
lfs f16,-0x7510(rtoc)
fmuls f17,f16,f15
#f17 = angle (radians)


#Random DI
#load a random byte
lbz r3,-0x570E(r13)
bl CONVERT_TO_FLOAT

#load 255
lis r15,0x437f
stw r15,-0x10(sp)
lfs f16,-0x10(sp)
#nomalize random byte
fdivs f15,f15,f16
#so f15 = hypotenuse

#******
#1.00 hypot everytime
lis r15,0x3f80
stw r15,-0x10(sp)
lfs f15,-0x10(sp)

#*****

fmr f1,f17
#load cosine function
lis r15,0x08032
ori r15,r15,0x6240
mtlr r15
blrl
fmuls f1,f1,f15
stfs f1,0x620(r31)

fmr f1,f17
#load sine function
lis r15,0x08032
ori r15,r15,0x63d4
mtlr r15
blrl
fmuls f1,f1,f15
stfs f1,0x624(r31) 

b END

CONVERT_TO_FLOAT:
#convert to float
#r3 = input, f15 = output
lis r18,0x4330
lfd f16,-0x73a8(rtoc)
stw r18,-0x14(sp)
stw r3,-0x10(sp)
lfd f15,-0x14(sp)
fsubs f15,f15,f16
blr


END:
mr r3,r31

********************************************
* Gameplay does not freeze when match ends *
********************************************

inject @ 801a4ea8

li r3,0
stw r3,0x10(r25)

C21A4EA8 00000002
38600000 90790010
60000000 00000000

Not a good code. Pause screen is messed up. It does work though.

***********************************
* Stamina Death Incurs DeadUpStar *
***********************************

0% Stamina Incurs DeadUpStar (1.02) [Achilles]
040C8CDC 4800B3DD

*************************
* Hot Mr. Saturn Potato *
*************************

Code originally by wParam

#In this mode, the rule is "If you are holding a mr. saturn when the
#seconds remaining in the match is a multiple of 5, you die.  If you
#are hit with a mr. saturn while not holding another item, you are
#forced to catch it and stunned for a second or so."


Part 1:
inject @ 802839BC - mflr r0

#first check to enable this mode or not during gameplay
#if not, branch to END_SATURN_NOTHING
lis r9,0x8048
lbz r9,-0x62D0(r9)
#is this invisible Melee (ID 0x11?)
cmpwi r9,0x11
bne- END_SATURN_NOTHING

HOT_SATURN_ENABLED:
#note:  r3 _MUST_ be preserved!
mflr r0
stw r0,4(r1)
stwu r1,-24(r1)
stmw r29,8(r1)

#8  is r29, subplayer_t of r30
#12 is r30, player_t
#16 is r31, item_t passed in
#20 is temp space for lfs

#r31 is the item passed in
mr r31,r3

lwz r5,44(r3) #r5 has sub_item_t
lwz r30, 0xCF4(r5) #r30 has target player
cmpwi r30, 0
beq- END_SATURN_HOOK  #if target == NULL, do nothing

lwz r29, 44(r30) #r29 has sub_player_t

#check if they already have an item
lwz r8, 0x1974(r29)
cmpwi r8, 0
bne- END_SATURN_HOOK

#ok.  They exist, and they don't have an item.
#Give them this one

#load GiveItemToPlayer and bl
lis r4,0x8009
ori r4,r4,0x48a8
mtlr r4
mr r4, r31
mr r3, r30
blrl

#load AS_129_DamageSong and bl
lis r4,0x800c
ori r4,r4,0x318c
mtlr r4
mr r3, r30
li r4, 1
blrl

lis r4, 0x4170  #15.. frames, I think
stw r4, 0x1A4C(r29)


END_SATURN_HOOK:
mr r3,r31
lmw r29,8(r1)
lwz r0,28(r1)
addi r1,r1,24
mtlr r0


END_SATURN_NOTHING:
mflr r0

(Not 20XX)
C22839BC 00000011
7C0802A6 90010004
9421FFE8 BFA10008
7C7F1B78 80A3002C
83C50CF4 2C1E0000
4182004C 83BE002C
811D1974 2C080000
4082003C 3C808009
608448A8 7C8803A6
7FE4FB78 7FC3F378
4E800021 3C80800C
6084318C 7C8803A6
7FC3F378 38800001
4E800021 3C804170
909D1A4C 7FE3FB78
BBA10008 8001001C
38210018 7C0803A6
7C0802A6 00000000

--------------------

Part 2 (frame chain)
inject @ 8006a360 - mflr r0

SATURNFRAMECHAIN:

#perform check to enable this mode
lis r6,0x8048
lbz r6,-0x62D0(r6)
#is this invisible Melee (ID 0x11?)
cmpwi r6,0x11
bne+ FRAME_CHAIN_DONE

SATURN_CHAIN_GO:

lwz r6, 44(r3) #sub player t
lwz r7, 0x1974(r6) #item held
cmpwi r7, 0
beq FRAME_CHAIN_DONE #if they don't have an item, abort

lwz r8, 44(r7) #subitem
lwz r8, 0x10(r8)
cmpwi r8, 7
bne FRAME_CHAIN_DONE  #if it isn't "mr. saturn", abort

#ok, now.  They're holding mr. saturn.
#first load the seconds.
#the item doesn't matter anymore.  
#If seconds % 5 = 0, we kill them, otherwise, act normally.

#lis r6, 0x8046
#	#ori r6, r6, 0xB6A0
#	#lwz r6, 0x28(r6) #r6 has seconds remaining.
#	#these next two instructions are equivalent to
# the previous 3.
 
lis r6, 0x8047
lwz r6, -0x4938(r6)
cmpwi r6, 0
beq FRAME_CHAIN_DONE 
#seconds = 0 means either end of match or no time limit

li r7, 5 #period of happening.

# if ((int)(seconds / period) * period == seconds, then 
#seconds must have been a multiple of period.
divw r8, r6, r7
mullw r9, r8, r7

cmpw r9, r6
bne FRAME_CHAIN_DONE 
#not equal, not a multiple of period, do nothing.

#ok.  So, they die.
#branch to AS_004_DeadUpStar
lis r9,0x800d
ori r9,r9,0x40b8
mtctr r9
bctr


FRAME_CHAIN_DONE:
mflr r0

(Not 20XX)
C206A360 0000000C
80C3002C 80E61974
2C070000 41820048
8107002C 81080010
2C080007 40820038
3CC08047 80C6B6C8
2C060000 41820028
38E00005 7D063BD6
7D2839D6 7C093000
40820014 3D20800D
612940B8 7D2903A6
4E800420 7C0802A6
60000000 00000000

*********************
* Random Hitbox R&D *
*********************

8000acfc  Hitbox_HurtbubbleCollisionCheck
- disable this function and hitboxes never collide with anything...players,items, etc..

r3 = opponent internal data offset start
r4 = 0x914 + internal data offset of this player

in function,

add 0x74 to r4


803C1154 = table of pointers, for special blrl functions for each character upon being setup! Internal IDs.


8014f6b8 = CharacterSetup_GigaBowser

Giga-Bowser Can Be Grabbed
0414f704 60000000

g-bowser, giga bowser

***********************
* Projectile Hitboxes *
***********************

Memory read breakpoint on Doc's Pills

Broke @ 8027951c [2790c0]

***************************
* Debug Action State Text *
***************************
Y+Dpad down toggle
Memory read bp on "Wait" ASCII (80BDD478 - Falco only on FD).
- breaks @ function 80325b04

80325b04  StringCharacterCount
          input: r3 = -1 from first ascii character
          output: r3=r4=stringlength (including the 00 end byte)

blr - 80324428 [324044]
r3 gets move to r24 = stringlength

1 is loaded into r0
r24 is moved to r18 = stringlength
0x20 = r0

blrl's into 323f80, @ line 803245e8
where
r3 = address in stack (4ee9c8)
r4 = starting address of string (actual first character)
r5 = string length (basically think like 1-indexed)
------
[323f80]
r3 moved to r30

Stack address:
0x8 is loaded into r3 (int 2)
0x4 is loaded into r6 (FFFFFFFF)

r3 added to r5. result in r0
- so 0x8 from stack is added to stringlength


r0 = 0x00 from stack address
r5 = string length
r4 = still, starting address of string


So it is making the string 302057616974 which is "0 Wait"
r3 = r0 + 2


302be4

r3 = pointer to screen placement stuff (804a200c)
   0x00 = short, X?
   0x02 = short, Y?
   0x04 = flags
   0x08 = x stretch (default 9)
   0x0c = y stretch (default 12)
   0x10 = null
   0x14 = 
   0xnext couple are floats.
   0x1c = rrggbbaa color

   lwz 0x28 is highest from this pointer
r4 = start of string
 
After this function,

8049fe18 and next lines =

804a200C
30002000
57006100
69007400

8049fe1c = beginning of first line
8049fe94 = beginning of second line

(so a pointer and then ASCII characters separated by zeroes)

memory read on this brings to 302468 [803022bc]

I think 8049fe1c and onward is like the entire text across the screen

function 30261c
4a1fd8 at -0x4888(r13) = 4D6E18

I did it!!! Text on screen in Master Mode
In Master Mode, write 4a1fd8 to 4D6E18. Then write string (each character separated by zero) to 8049fe1c 

Holy Shit. I can just keep going all the way down the screen.
-----------
But..the text data is not loaded in RAM until a Develop Mode game is played. Hmm...

-----------

2254b8
- loads DbCo.dat data.

********************************
* Container Explosion Research *
********************************

Might be line 8027cf8c for capsule item only

Disable Capsule Explosions
0427CF8C 48000018

#--------------------------
Barrel...
branch to random function at 80063990 after setting r3 to 8
I doubt it.

Branch to random function at 80288b20. This is it.

Disable Barrel Explosions
04288b28 60000000

Disable Rolling Barrels
04288b7c 480000c8


80288b00 is executed only when the barrel is breaking.


Disable Item Pickup
040947b0 48000050

#-------------------------
Box
Branch to random function at 80286368

Random number between 0 and 99 (so 100 options)
Get random number
compare to 30, if less than then no explosion.
compare to 50, if less than then no explosion.

Disable Box Explosions
0428639c 38600001

Capsule - 12.5% chance for explosion
Barrel, Box - 10% chance for explosion

*******************************
* Containers Spawn Containers *
*******************************
- Punkline
https://smashboards.com/threads/disable-container-spawn.441544/#post-21446920

inject @ 8026C784

ori r28,r4,0xe50
cmplw r3,r28
bne- 0x08
ori r3,r4,0xe34
mr r28,r3	# default code line

----

For 20XX

lis r28,0x8040
lwz r28,-0x5D04(r28)	# debug menu flag @ 3fa2fc
cmpwi r28,0
beq-	END
ori r28,r4,0xe50
cmplw r3,r28
bne- 0x08
ori r3,r4,0xe34
END:
mr r28,r3	# default code line



**********************
* Blastzone Wrapping *
**********************

It is imperative to manually adjust hitbox data, otherwise the hitboxes will be interpolated all the way to the other side of the stage and damage any opponents in the path.

------------
Right Blastzone:
inject @ 800d31e0


lis	r3,0x8022
ori	r3,r3,0x4b50 
mtlr	r3
blrl
lfs	f15,0xb0(r30)
fsubs	f15,f15,f1
stfs	f1,0xb0(r30)
stfs	f1,0x6F4(r30)
li	r3,4	
mtctr	r3
addi	r3,r30,0x828

HITBOX_LOOP:
lfsu	f1,0x138(r3)
fsubs	f1,f1,f15
stfs	f1,0(r3)
bdnz+	HITBOX_LOOP

lis	r3,0x800d
ori 	r3,r3,0x31a4
mtctr	r3
bctr

---------------------
Left Blastzone:
inject @ 800d3200

#right blastzone load
lis r3,0x8022
ori r3,r3,0x4b38 
mtlr r3
blrl
lfs f15,0xb0(r30)
fsubs f15,f1,f15
stfs f1,0xb0(r30)
stfs f1,0x6F4(r30)
li r3,4
mtctr r3
addi r3,r30,0x828

HITBOX_LOOP:
lfsu f1,0x138(r3)
fadds f1,f1,f15
stfs f1,0(r3)
bdnz+ HITBOX_LOOP

lis r3,0x800d
ori r3,r3,0x31a4
mtctr r3
bctr

-----------------

Top Blastzone:
inject @ 800d3220

#bottom blastzone load
lis r3,0x8022
ori r3,r3,0x4b80
mtlr r3
blrl
lfs f15,0xb4(r30)
fsubs f15,f15,f1
stfs f1,0xb4(r30)
stfs f1,0x6F8(r30)
li r3,4
mtctr r3
addi r3,r30,0x82c

HITBOX_LOOP:
lfsu f1,0x138(r3)
fsubs f1,f1,f15
stfs f1,0(r3)
bdnz+ HITBOX_LOOP

lis r3,0x800d
ori r3,r3,0x31a4
mtctr r3
bctr

---------------------
Bottom Blastzone:
inject @ 800d32e8

#top blastzone load
lis r3,0x8022
ori r3,r3,0x4b68 
mtlr r3
blrl
lfs f15,0xb4(r30)
fsubs f15,f1,f15
stfs f1,0xb4(r30)
stfs f1,0x6F8(r30)
li r3,4
mtctr r3
addi r3,r30,0x82c

HITBOX_LOOP:
lfsu f1,0x138(r3)
fadds f1,f1,f15
stfs f1,0(r3)
bdnz+ HITBOX_LOOP

lis r3,0x800d
ori r3,r3,0x31a4
mtctr r3
bctr

--------------

20XX 4.0 Blastzone Wrapping
- 3 options
	- NO
	- ON
	- STAMINA MODE ONLY


**Right Blastzone:
inject @ 800d31e0

lis	r3,0x801a	#check if in a single player mode
ori	r3,r3,0x4340	
mtlr	r3	
lis	r15,0x8048	# r15 = 80480000
lbz	r3,-0x62D0(r15)	#load menu controller major
blrl	
cmpwi r3,1	
beq-	NO_WRAP		#if in single player, don't wrap
lis	r3,0x8040
lwz	r3,-0x5E6C(r3)	# load blast wrap debug flag
cmpwi	r3,0
beq-	NO_WRAP
cmpwi	r3,1
beq-	WRAP
lbz	r3,-0x62D0(r15)	#load menu controller major
cmpwi	r3,0x1F		# is this stamina mode?
bne-	NO_WRAP

WRAP:

lis	r3,0x8022
ori	r3,r3,0x4b50 
mtlr	r3
blrl
lfs	f15,0xb0(r30)
fsubs	f15,f15,f1
stfs	f1,0xb0(r30)
stfs	f1,0x6F4(r30)
li	r3,4	
mtctr	r3
addi	r3,r30,0x828

HITBOX_LOOP:
lfsu	f1,0x138(r3)
fsubs	f1,f1,f15
stfs	f1,0(r3)
bdnz+	HITBOX_LOOP

lis	r3,0x800d
ori 	r3,r3,0x31a4
mtctr	r3
bctr

NO_WRAP:
mr	r3,r31

C20D31E0 00000013
3C60801A 60634340
7C6803A6 3DE08048
886F9D30 4E800021
2C030001 41820074
3C608040 8063A194
2C030000 41820064
2C030001 41820010
886F9D30 2C03001F
40820050 3C608022
60634B50 7C6803A6
4E800021 C1FE00B0
EDEF0828 D03E00B0
D03E06F4 38600004
7C6903A6 387E0828
C4230138 EC217828
D0230000 4200FFF4
3C60800D 606331A4
7C6903A6 4E800420
7FE3FB78 00000000



**Left Blastzone:
inject @ 800d3200

lis	r3,0x801a	#check if in a single player mode
ori	r3,r3,0x4340	
mtlr	r3	
lis	r15,0x8048	# r15 = 80480000
lbz	r3,-0x62D0(r15)	#load menu controller major
blrl	
cmpwi r3,1	
beq-	NO_WRAP		#if in single player, don't wrap
lis	r3,0x8040
lwz	r3,-0x5E6C(r3)	# load blast wrap debug flag
cmpwi	r3,0
beq-	NO_WRAP
cmpwi	r3,1
beq-	WRAP
lbz	r3,-0x62D0(r15)	#load menu controller major
cmpwi	r3,0x1F		# is this stamina mode?
bne-	NO_WRAP

WRAP:

#right blastzone load
lis r3,0x8022
ori r3,r3,0x4b38 
mtlr r3
blrl
lfs f15,0xb0(r30)
fsubs f15,f1,f15
stfs f1,0xb0(r30)
stfs f1,0x6F4(r30)
li r3,4
mtctr r3
addi r3,r30,0x828

HITBOX_LOOP:
lfsu f1,0x138(r3)
fadds f1,f1,f15
stfs f1,0(r3)
bdnz+ HITBOX_LOOP

lis r3,0x800d
ori r3,r3,0x31a4
mtctr r3
bctr

NO_WRAP:
mr	r3,r31

C20D3200 00000013
3C60801A 60634340
7C6803A6 3DE08048
886F9D30 4E800021
2C030001 41820074
3C608040 8063A194
2C030000 41820064
2C030001 41820010
886F9D30 2C03001F
40820050 3C608022
60634B38 7C6803A6
4E800021 C1FE00B0
EDE17828 D03E00B0
D03E06F4 38600004
7C6903A6 387E0828
C4230138 EC21782A
D0230000 4200FFF4
3C60800D 606331A4
7C6903A6 4E800420
7FE3FB78 00000000



**Top Blastzone:
inject @ 800d3220


lis	r3,0x801a	#check if in a single player mode
ori	r3,r3,0x4340	
mtlr	r3	
lis	r15,0x8048	# r15 = 80480000
lbz	r3,-0x62D0(r15)	#load menu controller major
blrl	
cmpwi r3,1	
beq-	NO_WRAP		#if in single player, don't wrap
lis	r3,0x8040
lwz	r3,-0x5E6C(r3)	# load blast wrap debug flag
cmpwi	r3,0
beq-	NO_WRAP
cmpwi	r3,1
beq-	WRAP
lbz	r3,-0x62D0(r15)	#load menu controller major
cmpwi	r3,0x1F		# is this stamina mode?
bne-	NO_WRAP

WRAP:


#bottom blastzone load
lis r3,0x8022
ori r3,r3,0x4b80
mtlr r3
blrl
lfs f15,0xb4(r30)
fsubs f15,f15,f1
stfs f1,0xb4(r30)
stfs f1,0x6F8(r30)
li r3,4
mtctr r3
addi r3,r30,0x82c

HITBOX_LOOP:
lfsu f1,0x138(r3)
fsubs f1,f1,f15
stfs f1,0(r3)
bdnz+ HITBOX_LOOP

lis r3,0x800d
ori r3,r3,0x31a4
mtctr r3
bctr

NO_WRAP:
lwz	r0,0xE0(r30)

C20D3220 00000013
3C60801A 60634340
7C6803A6 3DE08048
886F9D30 4E800021
2C030001 41820074
3C608040 8063A194
2C030000 41820064
2C030001 41820010
886F9D30 2C03001F
40820050 3C608022
60634B80 7C6803A6
4E800021 C1FE00B4
EDEF0828 D03E00B4
D03E06F8 38600004
7C6903A6 387E082C
C4230138 EC217828
D0230000 4200FFF4
3C60800D 606331A4
7C6903A6 4E800420
801E00E0 00000000


**Bottom Blastzone:
inject @ 800d32e8


lis	r3,0x801a	#check if in a single player mode
ori	r3,r3,0x4340	
mtlr	r3	
lis	r15,0x8048	# r15 = 80480000
lbz	r3,-0x62D0(r15)	#load menu controller major
blrl	
cmpwi r3,1	
beq-	NO_WRAP		#if in single player, don't wrap
lis	r3,0x8040
lwz	r3,-0x5E6C(r3)	# load blast wrap debug flag
cmpwi	r3,0
beq-	NO_WRAP
cmpwi	r3,1
beq-	WRAP
lbz	r3,-0x62D0(r15)	#load menu controller major
cmpwi	r3,0x1F		# is this stamina mode?
bne-	NO_WRAP

WRAP:

#top blastzone load
lis r3,0x8022
ori r3,r3,0x4b68 
mtlr r3
blrl
lfs f15,0xb4(r30)
fsubs f15,f1,f15
stfs f1,0xb4(r30)
stfs f1,0x6F8(r30)
li r3,4
mtctr r3
addi r3,r30,0x82c

HITBOX_LOOP:
lfsu f1,0x138(r3)
fadds f1,f1,f15
stfs f1,0(r3)
bdnz+ HITBOX_LOOP

lis r3,0x800d
ori r3,r3,0x31a4
mtctr r3
bctr

NO_WRAP:
mr	r3,r31

C20D32E8 00000013
3C60801A 60634340
7C6803A6 3DE08048
886F9D30 4E800021
2C030001 41820074
3C608040 8063A194
2C030000 41820064
2C030001 41820010
886F9D30 2C03001F
40820050 3C608022
60634B68 7C6803A6
4E800021 C1FE00B4
EDE17828 D03E00B4
D03E06F8 38600004
7C6903A6 387E082C
C4230138 EC21782A
D0230000 4200FFF4
3C60800D 606331A4
7C6903A6 4E800420
7FE3FB78 00000000


*****************
* Nana AI Level *
*****************

Affects Nana's AI decisions once separated from Popo.

Nana AI Level = Floor( Popo_Damage / 20)
- if result is greater than 9, it forces 9 for the AI level

Nana is always Lvl 9 AI
040B10FC 60000000

********************************************************************
* Disable Hyrule Maze Uncontrollable Character During Stage Change *
********************************************************************
Enable Control During Stage Change
04209090 60000000

***************************************************
* Percentages are Walljump Counters in Tiny Melee *
***************************************************

Disable Tiny Melee
041b8e50 4e800020


Put Walljump Counter into Player Percent
-inject @ 8006ca78

#load menu controller major
lis r16,0x8048
lbz r16,-0x62D0(r16)
#is this tiny melee?
cmpwi r16,0x1d
bne- END

#if in Tiny Melee..
#load walljump counter
lbz r16,0x1969(r3)

#load player number & get to player's onscreen percent
lis r14,0x8045
ori r14,r14,0x30e0
lbz r15,0xc(r3)
mulli r15,r15,0xe90
#store walljump number as percent
sthx r16,r14,r15
END:
#default code line
lbz r0,0x221f(r3)
------------------

C206CA78 00000006
3E008048 8A109D30
2C10001D 4082001C
8A031969 3DC08045
61CE30E0 89E3000C
1DEF0E90 7E0E7B2E
8803221F 00000000


******************************************
* D-Pad Down Reloads Yoshi's Story Music *
******************************************

Music_HandleLoading
r3 = 60 for yoshis 

inject @ 8006cb7c

lwz r3,0x668(r31)
cmpwi r3,0x4
bne- END
lis r3,0x8002
ori r3,r3,0x3f28
mtlr r3
li r3,0x60
blrl

END:
lwz r0,0x1c(sp)


*********************
* SD Remix - Mewtwo *
*********************
20XX Version
side-b goes into misfoot instead of tumble

inject @ 800907e8

#is PlMt.sat ??
lis r15,0x803d
lbz r15,0x0d85(r15)
cmpwi r15,0x73
bne- END_NORMAL
lwz r15,0x10(r31)
cmpwi r15,0x12f
blt- END_NORMAL
cmpwi r15,0x131
bge- END_NORMAL
MISSFOOT:
li r4,0xFB
b END
END_NORMAL:
li r4,38
END:

*******************
* Play SFX Easily *
*******************

80024030  SFX_PlayMenu/CommonSFX

804d6b94 can be word containing SFX ID to play (if != 0)
- this is free because of disabling the Develop USB Screenshot function
- I can see myself possibly using the first byte for something along the lines of timing before playing the sound effect. Idk. But I don't think there are any SFX IDs that are 4 bytes long.

inject @ 8002409c

rlwinm	r5,r5,0,24,31	# default code line
lwz	r9,-0x4B0C(r13)# load word at 804d6b94
rlwinm.	r9,r9,0,8,31	# extract out 3 rightmost bytes (SFX ID)
cmpwi	r9,0
beq-	END
mr	r3,r9		# r3 = SFX ID input
li	r9,0
stw	r9,-0x4B0C(r13)
END:


SO >>>> set the SFX ID and then blrl into 80174338, or a similar function.
80174338 = SFX_PlayMenuSound_Forward
		- no inputs, uses r3, etc.

----------------------------------

**********************************
* Play SFX At Specified Interval *
**********************************

Input = BPM = @ 804d6b94 (for testing)

3600 frames per minute
inject @ 8016cf38

lis r15,0x804d
lwz r16,0x6b94(r15)
li r15,3600
divw r15,r15,r16
lis r16,0x8047
lwz r16,-0x493C(r16)
cmpwi r16,0
beq- END
divw r3, r16, r15
mullw r17, r3, r15
cmpw r17, r16
bne- END

YES_MULTIPLE_OF:
#play menu forward sound
lis r3,0x8017
ori r3,r3,0x4338
mtlr r3
blrl

END:
lmw r27,0x1c(sp)
-------------

**********************
* RNG Function Tests *
**********************

I'm going to test it's randomness
Count 

inject @ 8006cb7c

lis r3,0x8038
ori r3,r3,0x0580
mtlr r3,
li r3,100
blrl
mulli r3,r3,4
lis r4,0x8057
lwzx r5,r4,r3
addi r5,r5,1
stwx r5,r4,r3

lwz r0,0x1c(sp)

*******************************************
* Action State / Subaction Table Pointers *
*******************************************
DOL        RAM
0x3bf800 (3c2800)
- table start

0x00	Subaction ID	Note: Subaction ID is NOT the same as action state ID.
0x04	Flags 1	
0x08	Flags 2	
0x0C	Function pointer - animation interrupt	Points to a function that defines what state is entered at the end of this one.
0x10	Function pointer - input interrupt	Points to the state's IASA function.
0x14	Function pointer - action physics	Points to the state's physics behavior per frame.
0x18	Function pointer - collision interrupt	Points to the state's function that defines what state to enter when platform collision changes.
0x1C	Function pointer - camera behavior	Points to a function related to camera behavior for the given state.
0x20	Start of next action state (Subaction ID)	

Animation interrupt blrl is @ 8006ab74


******************************
* Debug Menu Line Item exits *
******************************

801b0a8c: submenu exit
801b09f8: main menu exit

- need to set r3 to 1 before branching into these functions

lis r3,0x801b
ori r3,r3,0x0a8c
mtctr r3
li r3,0
bctr

----

Disable Debug Menu [Tournament Mode] from Going Anywhere
0422d634 48000010

Lock Debug Menu and Exit

lis r3,0x4800
ori r3,r3,0x0010
lis r4,0x8022
ori r4,r4,0xd634
stw r3,0(r4)
lis r3,0x801b
ori r3,r3,0x09f8
mtctr r3
li r3,0
bctr

************************************
* Enable Reverse Aerial Rush (RAR) *
************************************

Enable Reverse Aerial Rush (RAR)
- logic: switch facing direction if jumping out of TurnRun



inject @ 800c9ee8
- in the Interrupt_AS_TurnRun function
- after the check for jumping (r3=bool true/false)

cmpwi r3,0
beq- END
#load facing direction
lfs f0,0x8c(r30)
#switch facing direction
fneg f0,f0
#store facing direction
stfs f0,0x8c(r30)

END:


C20C9EE8 00000003
2C030000 41820010
C01E008C FC000050
D01E008C 00000000



***********
* Replays *
***********

8006b028 inject @


stw r0,0x65c(r31)

lis r15,0x8017
#load match frame count
lis r3,0x8047
lwz r3,-0x493C(r3)

mulli r3,r3,0x18
add r3,r15,r3

#load replay or save word
lis r15,0x8057
lwz r15,0(r15)
cmpwi r15,0
beq- SAVE
LOAD:
lwz r15,0(r3)
stw r15,0x620(r31)
lwz r15,0x4(r3)
stw r15,0x624(r31)
lwz r15,0x8(r3)
stw r15,0x638(r31)
lwz r15,0xc(r3)
stw r15,0x63c(r31)
lwz r15,0x10(r3)
stw r15,0x650(r31)
lwz r15,0x14(r3)
stw r15,0x65c(r31)
b END
SAVE:
lwz r15,0x620(r31)
stw r15,0(r3)
lwz r15,0x624(r31)
stw r15,0x4(r3)
lwz r15,0x638(r31)
stw r15,0x8(r3)
lwz r15,0x63c(r31)
stw r15,0xc(r3)
lwz r15,0x650(r31)
stw r15,0x10(r3)
lwz r15,0x65c(r31)
stw r15,0x14(r3)

END:



**************************
* Develop Mode CPU Stats *
**************************

inject @ 80392c2c - lfs f6,-15924(r13)

At this point, f1 to f6 are the float settings shown on screen!
Modify them to whatever.

-----
Font color addresses (0x1c apart). In ASCII...
40a4ba
---------

Decimal Places
40a4c3 (DOL 4074c3)
(first float), set this byte to 0x35 (ASCII = 5)
others..

 (DOL 4074d1) 33 --> 35

40a4df (DOL 04074df)
--> 3566205C 63303066 66303025 322E3566 205C6366 66303066 6625322E 3566205C 63666630 30666625 322E3566 20000000

---------
Size and Placement


3d55a5 (DOL 3d25a5)  35 --> 37
(3d36ed in 1.00)
- moves the frame counter to the right more
- can change this to ASCII (>40) ?? Need to experiment

40bfa0 (DOL 408fa0)
Set to 
C37A0000 C0000000 C1400000 440C0000

for placement underneath percents and increased readability [Magus]



PORTING MAGUS' HACK

Overwrite Item Text
---------------------------
(DOL 3e7898)
--> 546F702D 4E202020 20202000 45434220 546F7020 20202000 45434220 426F7474 6F6D2000 45434220 52696768 74202000 45434220 4C656674 20202000 46312043 68205665 6C6F6300 4632204B 42205665 6C6F6300 46332053 68205665 6C6F6300 546F7461 6C205665 6C6F6300 53797320 44697265 63746900 53797320 432D5374 69636B00 53797320 4C2F5220 20202000 43757220 44697265 63746900 50727620 44697265 63746900 43725072 20536869 656C6400

(DOL 3e7acc)
--> 546D7220 416E7920 53686400 546D7220 44696720 53686400 546D7220 4A756D70 20202000 546D7220 55702D42 20202000

(DOL 3e7b0c)
--> 446D672F 4869746C 61672000 48697453 746E2F47 72616200 53686965 6C645374 756E2000 53686420 48502F53 697A6500 546D7220 496E742F 496E7600 48422D30 20582F59 20202000 48422D30 205A2F53 697A6500 48422D31 20582F59 20202000 48422D31 205A2F53 697A6500 48422D32 20582F59 20202000 48422D32 205A2F53 697A6500 48422D33 20582F59 20202000 48422D33 205A2F53 697A6500


From Magus' Hack,
80427940 = 8032ed8c (DOL 032b96c)


****NEED INJECT****
.....................	  -Increment Player ID/CPU Stat View Toggle (801A4a30)- (DOL 1a1610)
lis	r12,0x8032
ori	r12,r12,0xed8c	# 8032ed8c
lbz	r10,0(r12)	# loads player ID to display stuff for
addi	r10,r10,1	# increment it
cmpwi	r10,5
blt+	0x8
li	r10,0		# reset ID to 0 if above 4
stb	r10,0(r12)	# update player ID
blt+	END		# skip disabling display if simply incrementing player ID

DISABLE:
lis	r12,0x8016	# stuff to run if cycled beyond player 4 and disabling CPU Stat display
ori	r12,r12,0x53c8	# 801653c8
mtlr	r12
blrl
li	r0,0
stw	r0,-0x4f78(r13)	# clear pointer

END:

----------
801A4a34 (DOL 1a1614):  38000000	li	r0,0		-> nop
801A4a3c (DOL 1a1618):  900DB088	stw	r0,-20344(r13)	-> nop


.....................	  -Load Player ID Instead of Frame Count (801A4bb8)- (DOL 1a1798)
801A4bb8:  3C608047	lis	r3,-32697	-> lis	r3,0x8032
801A4bbc:  38637D90	addi	r3,r3,32144	-> ori r3,r3,0xed8c	# 8032b96c
801A4bc0:  80630008	lwz	r3,8(r3)	-> lwz	r3,4(r3)	# loads player ID * 11111 (for readability)


***NEED INJECT****
.....................	  -Load Display Setting on Float Pair Change (Advance Right) (80226080)- (DOL 222c60)
cmpwi	r0,1		# r0 is new pokemon setting (controls floats slot if 1-3)
blt+	END
cmpwi	r0,3
bgt+	END

lis	r10,0x8032
ori	r10,r10,0xed93	# 8032ed93. settings address -0x1
lbzx	r9,r10,r0	# loads floats setting for the slot
stw	r9,0x60(r31)	# store it into item setting so the float description text updates

END:
stw	r0,0(r4)	# entry point (80226080). update pokemon setting after advancing Right


****NEED INJECT****
.....................	  -Load Display Setting on Float Pair Change (Advance Left) (802260b8)- (DOL 222c98)
cmpwi	r0,1		# r0 is new pokemon setting (controls floats slot if 1-3)
blt+	END
cmpwi	r0,3
bgt+	END

lis	r10,0x8032
ori	r10,r10,0xed93	# 80427947. settings address -0x1
lbzx	r9,r10,r0	# loads floats setting for the slot
stw	r9,0x60(r31)	# store it into item setting so the float description text updates

END:
stw	r0,0(r4)	# entry point (802260b8). update pokemon setting after advancing Left


***NEED INJECT***
.....................	  -Load Custom CPU Stat Floats (80392c2c RAM, 38f80c DOL)-
stwu	r1,-56(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack

lis	r31,0x8032
ori	r31,r31,0xed8c	# 8032ed8c
lbz	r30,0(r31)	# loads player ID to display stuff for
cmpwi	r30,1
blt-	RESET_ID
cmpwi	r30,4
ble+	SCALE_ID

RESET_ID:
li	r30,1		# set player ID to 1 if not 1-4

SCALE_ID:
stb	r30,0(r31)	# store player ID
mulli	r20,r30,11111	# scale up player id by 11111 (for on-screen readability)
stw	r20,4(r31)	# update player ID to display

DEFAULT_SETTINGS:
lwz	r20,8(r31)	# loads settings for displayed stuff
cmpwi	r20,0		# 0 if no settings defined yet
bne+	DEFAULT_COLORS
lis	r20,0x1419
ori	r20,r20,0x1D00	# 14191D00. TopN, Char Velocity, Directional Input (System)
stw	r20,8(r31)	# default settings for displayed stuff

DEFAULT_COLORS:
li	r20,0x3030	# 00003030 (- - 0 0)
li	r21,0x6666	# 00006666 (- - f f)
lis	r22,0x6666
ori	r22,r22,0x3030	# 66663030 (f f 0 0)
lis	r29,0x8040
ori	r29,r29,0xa49e	# 8040a49e. Font color data address -0x1C

sth	r21,0x1C(r29)	# f f      @ (float 1 Red)
sth	r21,0x20(r29)	# f f      @ (float 1 Blue)
sth	r21,0x2E(r29)	# f f      @ (float 2 Blue)

sth	r20,0x38(r29)	# 0 0      @(float 3 Red)
stw	r22,0x3A(r29)	# f f 0 0  @ (float 3 Green/Blue)
sth	r20,0x46(r29)	# 0 0      @ (float 4 Red)
stw	r22,0x48(r29)	# f f 0 0  @ (float 4 Green/Blue)

stw	r22,0x54(r29)	# f f 0 0  @ (float 5 Red/Green)
sth	r21,0x58(r29)	# f f      @ (float 5 Blue)
stw	r22,0x62(r29)	# f f 0 0  @ (float 6 Red/Green)
sth	r21,0x66(r29)	# f f      @ (float 6 Blue)

UPDATE_SETTING:
addi	r31,r31,7	# 8032ed93. settings address -0x1
lis	r28,0x8049
ori	r28,r28,0xFAB0	# 8049FAB0. Address of Debug Item/Pokemon Settings
lwz	r27,0x4(r28)	# loads Pokemon Setting

cmpwi	r27,1
blt+	FLOAT_PREP
cmpwi	r27,3
bgt+	FLOAT_PREP	# no float font highlight or updating floats setting if not slots 1-3
lwz	r24,0x0(r28)	# loads Item Setting
stbx	r24,r31,r27	# stores item setting as floats setting for the slot

HIGHLIGHT:
mulli	r23,r27,0x1C	# float pairs' color data 0x1C apart. 1st float in pair offset
addi	r24,r23,0xE	# 2nd float in pair offset

sthx	r21,r29,r23	# 1st float Red = f f
sthx	r21,r29,r24	# 2nd float Red = f f
addi	r23,r23,2	# moves 1st float offset to Green/Blue
addi	r24,r24,2	# moves 2nd float offset to Green/Blue
stwx	r22,r29,r23	# 1st float Green/Blue = f f 0 0
stwx	r22,r29,r24	# 2nd float Green/Blue = f f 0 0

FLOAT_PREP:
li	r20,0
stw	r20,0x18(r2)	# stores 0 for when loading null floats
mr	r26,r2		# initialize address to store floats during code's loop
li	r25,1		# initialize current float pair being worked on

GET_MAIN_INDEX:

lis r29,0x8045
ori r29,r29,0x22a0     #player pointers (p1) -0xe90
mulli	r21,r30,0xe90

lwzx	r29,r29,r21



LOOP_START:
cmpwi	r29,0
beq-	NULL_FLOATS	# go to use 0 for both floats in this pair if empty player slot
lbzx	r24,r31,r25	# loads setting for float pair being worked on
lwz	r23,0x70(r29)	# loads current action


cmpwi	r24,0x14	# 0x14 = TopN
beq-	TOPN
blt-	NULL_FLOATS	# load null floats if invalid setting on this float pair

cmpwi	r24,0x18
ble-	SCD		# 0x15 - 0x18 = SCD Top/Bottom/Right/Left

cmpwi	r24,0x1C
ble-	VELOCITIES	# 0x19 - 0x1C = Forces|Velocities

cmpwi	r24,0x1F
ble-	LIVE_INPUTS	# 0x1D - 0x1F = Live Controller Port Inputs

cmpwi	r24,0x22
ble-	CHAR_INPUTS	# 0x20 - 0x22 = Inputs Applied to Character

cmpwi	r24,0x2E
ble-	BUTTON_TIMERS	# 0x2B - 0x2E = Button Timers

#IDs jump from 2E to D0

cmpwi	r24,0xD0	# 0xD0 = Total Damage|Hitlag
beq-	DAMAGE_HITLAG

cmpwi	r24,0xD1	# 0xD1 = Hitstun|Grab Hold Time
beq-	HITSTUN_GRABTIME

cmpwi	r24,0xD2	# 0xD2 = Shield Stun (Actual|Calculated)
beq-	SHIELDSTUN

cmpwi	r24,0xD3	# 0xD3 = Shield Health|Size
beq-	SHIELD_HPSIZE

cmpwi	r24,0xD4	# 0xD4 = Timed Intangibility/Invincibility
beq-	TIMED_INTINV

cmpwi	r24,0xDC	# 0xD5 - 0xDC = Hitbox X/Y|Hitbox Z/Size
ble-	HITBOX
b	NULL_FLOATS	# load null floats if invalid setting on this float pair



TOPN:
cmpw	r25,r27
bne+	TOPN_ADDRESS	# skip input checks for TopN modification if TopN float pair not highlighted

TOPN_MODIFY:
subi	r21,r28,0xC2	# 8049f9ee. Controller port 1 debug held inputs -0x14
subi	r24,r28,0x72	# port 4's address for end of loop

TOPN_LOOP:
lhzu	r22,0x14(r21)	# loads next port's held inputs
li	r23,0x0104	# A and dpad-down buttons
andc.	r23,r22,r23
bne-	TOPN_LOOP_CHK	# skip if inputting anything besides A or dpad-down

lhz	r23,0x8(r21)	# loads press inputs
rlwinm. r23,r23,0,29,29	# check if dpad-down press
beq+	TOPN_LOOP_CHK	# skip if no dpad-down press

lfs	f1,0x18(r2)	# 0 for TopN X
lfs	f2,0x18(r2)	# 0 for TopN Y
rlwinm. r23,r22,0,23,23	# check if A button held
beq+	0x8
lfs	f2,-0x7e50(r2)	# loads 100 for TopN Y if holding A
stfs	f1,0x110(r29)	# update TopN X
stfs	f2,0x114(r29)	# update TopN Y
stfs	f1,0x754(r29)	# update TopN X
stfs	f2,0x758(r29)	# update TopN Y

TOPN_LOOP_CHK:
cmpw	r21,r24
blt+	TOPN_LOOP	# loop if not finished checking all controller ports


TOPN_ADDRESS:
addi	r22,r29,0x110	# Main Index + 0x110 = TopN X
b	COMMON_PAIR_4


SCD:
addi	r22,r29,0x7D4	# Main Index + 0x7D4 = SCD Top X
subi	r21,r24,0x15
b	COMMON_GROUP_8	# Top/Bottom/Right/Left are 0x8 bytes apart, and pairs 4 apart


VELOCITIES:
addi	r22,r29,0xE0	# Main Index + 0xE0 = F1 Char Velocity X
beq-	NET_VELOCITY	# 0x1C = Net Velocity
subi	r21,r24,0x19
mulli	r21,r21,0xC	# F1/F2/F3 forces float groups are 0xC bytes apart, and pairs 4 apart
b	COMMON_GROUP

NET_VELOCITY:
lfs	f1,0x0(r22)	# F1 Char Velocity X
lfs	f2,0x4(r22)	# F1 Char Velocity Y
lfs	f3,0xC(r22)	# F2 KB Velocity X
lfs	f4,0x10(r22)	# F2 KB Velocity Y
lfs	f5,0x18(r22)	# F3 Atk-Shd KB Velocity X
lfs	f6,0x1C(r22)	# F3 Atk-Shd KB Velocity Y
fadds	f1,f1,f3
fadds	f1,f1,f5	# total force X
fadds	f2,f2,f4
fadds	f2,f2,f6	# total force Y
b	LOOP_END


LIVE_INPUTS:
lis	r22,0x804c
ori	r22,r22,0x1f88	# 804c1f88. Controller port 1 inputs -0x44
mulli	r21,r30,0x44	# player ID * 0x44 (ports 0x44 apart)
add	r22,r22,r21
lbz	r21,0x21(r22)	# FF if empty controller port
cmpwi	r21,0xFF
beq-	NULL_FLOATS	# null floats if no controller plugged into port showing floats for
subi	r21,r24,0x1D
b	COMMON_GROUP_8	# Directional/C-Stick/LR inputs are 0x8 bytes apart, and pairs 4 apart


CHAR_INPUTS:
addi	r22,r29,0x680	# Main Index + 0x680 = Current Dir Input X
bne+	0x8		# skip if not 0x22 Curr/Prev Shield Input
addi	r22,r22,0x20	# shield input is 0x20 later than the usual 0x8 between groups
subi	r21,r24,0x20
b	COMMON_GROUP_8	# CurrDir/PrevDir/Shield inputs are 0x8 bytes apart, and pairs 4 apart


BUTTON_TIMERS:
subi	r21,r24,0x2B
add	r21,r29,r21	# Main Index + group offset
li	r22,0x6E3	# offset from main index 1st timer + 0x4 (0x2C timers are 4 apart)
cmpwi	r24,0x2C
ble-	LOAD_TIMERS
addi	r21,r21,0x4	# 2D-2E are 4 bytes after calculated group offset
li	r22,0x6E4	# offset from main index 1st timer + 0x5 (0x2D-2E timers are 5 apart)

LOAD_TIMERS:
lbzx	r23,r21,r22	# loads 2nd timer
lbz	r22,0x6DF(r21)	# loads 1st timer
bge+	0x8		# skip if 2C-2E
li	r23,0		# 2B has no 2nd timer. null
b	INT_TO_FLOAT	# convert the int timers into floats so they can be used



DAMAGE_HITLAG:
lfs	f1,0x1890(r29)	# loads Total Damage as 1st float
lfs	f2,0x19BC(r29)	# loads Hitlag as 2nd float
b	LOOP_END


HITSTUN_GRABTIME:
lfs	f1,0x18(r2)	# loads 0 for 1st float by default
lwz	r22,0x227C(r29)	# loads flags for things like hitstun
rlwinm. r21,r22,0,6,6	# check flag for in hitstun (-2------)
beq+	GRAB_TIME	# keep as 0 if not in hitstun
lfs	f1,0x23A0(r29)	# loads variable(?) that contains hitstun duration while in hitstun

GRAB_TIME:
lfs	f2,0x1AAC(r29)	# loads Grab Hold Time as 2nd float
b	LOOP_END


SHIELDSTUN:
cmpwi	r23,0xB5	# 0xB5 = GuardDamage
bne+	NULL_FLOATS	# null floats if not shield damage action

lfs	f1,0x8F4(r29)	# loads current animation frame
lfs	f2,0x8FC(r29)	# loads animation speed
lfs	f3,-28872(r2)	# . loads 20 (41A00000). GuardDamage animation length for all characters
lfs	f4,-29800(r2)	# 4d8578. loads 0.1 (3DCCCCCD). added to animation length for FSM calculations

fsubs	f1,f3,f1	# 20 - Current Frame = Animation Length Remaining
fdivs	f1,f1,f2	# (20 - Current Frame) / Speed = Actual Stun Time Remaining

fadds	f3,f3,f4	# 20 + 0.1
fdivs	f2,f3,f2	# (20 + 0.1) / Speed = Originally Calculated Stun Time
b	LOOP_END


SHIELD_HPSIZE:
lfs	f1,0x19F8(r29)	# loads Shield Health as 1st float

cmpwi	r23,0xB2	# 0xB2 = GuardOn
blt+	NULL_SECOND	# load 0 for 2nd float if not shield action
cmpwi	r23,0xB6	# 0xB6 = GuardReflect
bgt-	NULL_SECOND	# load 0 for 2nd float if not shield action

lwz	r21,0x1A20(r29)
lfs	f2,0x58(r21)	# loads Shield Collision Size as 2nd float
b	LOOP_END


TIMED_INTINV:
lwz	r22,0x19F0(r29)	# loads timed Intangibility
lwz	r23,0x19F4(r29)	# loads timed Invincibility
b	INT_TO_FLOAT	# convert the int timers into floats so they can be used


HITBOX:
addi	r22,r29,0x9C0	# Main Index + 0x9C0 = Hitbox-0 X
subi	r24,r24,0xD5	# setting remainder for hitbox setting group 0xD5 - 0xDC

li	r23,2
divw	r21,r24,r23	# each hitbox has 2 float pair settings associated with it
mulli	r21,r21,0x138	# hitboxes are 0x138 apart
add	r22,r22,r21	# address of X Offset of Hitbox being looked at

lwz	r21,-0x4C(r22)	# 0 = inactive hitbox ID, 2 = active no interp, 3 = active interp
cmpwi	r21,0
beq+	NULL_FLOATS	# null floats if hitbox ID not active

addi	r23,r22,0x4	# 2nd float is 4 bytes after 1st on Even hitbox settings
rlwinm. r21,r24,0,31,31	# check if Odd hitbox setting
beq+	COMMON_LOAD	# skip and load floats if Even hitbox setting
addi	r22,r22,0x8
subi	r23,r22,0x38	# Size (2nd float) is -0x38 from Z (1st), not +0x4
b	COMMON_LOAD	# load hitbox floats



COMMON_GROUP_8:
mulli	r21,r21,0x8	# groups of floats are 8 bytes apart

COMMON_GROUP:
add	r22,r22,r21	# adds group offset

COMMON_PAIR_4:
addi	r23,r22,0x4	# 2nd float 4 bytes after 1st

COMMON_LOAD:
lfs	f1,0x0(r22)
lfs	f2,0x0(r23)
b	LOOP_END


INT_TO_FLOAT:
lfd	f3,-29808(r2)	# 4d8570. loads magic double for int to float conversion
stfd	f3,0x20(r2)
stfd	f3,0x28(r2)
sth	r22,0x26(r2)	# 0x43300000800000xx. put 1st int at end of magic double
sth	r23,0x2E(r2)	# 2nd int
lfd	f1,0x20(r2)
lfd	f2,0x28(r2)
fsubs	f1,f1,f3	# subtract 0x4330000080000000 for converted int 1
fsubs	f2,f2,f3	# subtract 0x4330000080000000 for converted int 2
b	LOOP_END


NULL_FLOATS:
lfs	f1,0x18(r2)	# loads 0 for 1st float

NULL_SECOND:
lfs	f2,0x18(r2)	# loads 0 for 2nd float

LOOP_END:
stfs	f1,0x0(r26)	# store 1st float in pair at current pair's loading address
stfs	f2,0x4(r26)	# 2nd float
addi	r25,r25,1	# increment current float pair
addi	r26,r26,8	# update float storage address to next float pair slot
cmpwi	r25,3
ble+	LOOP_START	# loop for next float pair until all 3 are done

LOAD_FLOATS:
lfs	f1,0x0(r2)	# loads setting 1, float 1
lfs	f2,0x4(r2)	# loads setting 1, float 2
lfs	f3,0x8(r2)	# loads setting 2, float 1
lfs	f4,0xC(r2)	# loads setting 2, float 2
lfs	f5,0x10(r2)	# loads setting 3, float 1
lfs	f6,0x14(r2)	# loads setting 3, float 2

END:
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,56	# release the space



r20 = Temp Stuff | 0000FFFF
r21 = Temp Stuff
r22 = Temp Stuff |                  Common Load 1, Int to Float 1
r23 = Temp Stuff | Current Action | Common Load 2, Int to Float 2
r24 = Temp Stuff | Current Floats Setting for Functions
r25 = Current Floats Pair
r26 = Current Float Storage Address
r27 = Pokemon Setting
r28 = Address of Debug Item/Pokemon Settings and Debug Inputs
r29 = Font Color Data Address | Main Index for Player
r30 = Player ID
r31 = Display Settings Address | Display Settings Address + 0x7 (for indexed loading of settings)


C21A4A30 00000008
3D808032 618CED8C
894C0000 394A0001
2C0A0005 41A00008
39400000 994C0000
41A0001C 3D808016
618C53C8 7D8803A6
4E800021 38000000
900DB088 00000000


C2226080 00000005
2C000001 41A0001C
2C000003 41A10014
3D408032 614AED93
7D2A00AE 913F0060
90040000 00000000


C22260B8 00000005
2C000001 41A0001C
2C000003 41A10014
3D408032 614AED93
7D2A00AE 913F0060
90040000 00000000



C2392C2C 00000079
9421FFC8 BE810008
3FE08032 63FFED8C
8BDF0000 2C1E0001
4180000C 2C1E0004
40A10008 3BC00001
9BDF0000 1E9E2B67
929F0004 829F0008
2C140000 40A20010
3E801419 62941D00
929F0008 3A803030
3AA06666 3EC06666
62D63030 3FA08040
63BDA49E B2BD001C
B2BD0020 B2BD002E
B29D0038 92DD003A
B29D0046 92DD0048
92DD0054 B2BD0058
92DD0062 B2BD0066
3BFF0007 3F808049
639CFAB0 837C0004
2C1B0001 41A00034
2C1B0003 41A1002C
831C0000 7F1FD9AE
1EFB001C 3B17000E
7EBDBB2E 7EBDC32E
3AF70002 3B180002
7EDDB92E 7EDDC12E
3A800000 92820018
7C5A1378 3B200001
3FA08045 63BD22A0
1EBE0E90 7FBDA82E
2C1D0000 41820284
7F1FC8AE 82FD0070
2C180014 41820064
41800270 2C180018
408100B8 2C18001C
408100BC 2C18001F
408100F4 2C180022
40810110 2C18002E
4081011C 2C1800D0
41820144 2C1800D1
41820148 2C1800D2
4182015C 2C1800D3
41820180 2C1800D4
41820198 2C1800DC
4081019C 48000214
7C19D800 40A20054
3ABCFF3E 3B1CFF8E
A6D50014 3AE00104
7ED7B879 40820034
A2F50008 56F7077B
41A20028 C0220018
C0420018 56D705EF
41A20008 C04281B0
D03D0110 D05D0114
D03D0754 D05D0758
7C15C000 4180FFBC
3ADD0110 4800017C
3ADD07D4 3AB8FFEB
48000168 3ADD00E0
41820010 3AB8FFE7
1EB5000C 48000158
C0360000 C0560004
C076000C C0960010
C0B60018 C0D6001C
EC21182A EC21282A
EC42202A EC42302A
48000170 3EC0804C
62D61FA4 1EBE0044
7ED6AA14 8AB60021
2C1500FF 4182014C
3AB8FFE3 48000104
3ADD0680 40A20008
3AD60020 3AB8FFE0
480000F0 3AB8FFD5
7EBDAA14 3AC006E3
2C18002C 4081000C
3AB50004 3AC006E4
7EF5B0AE 8AD506DF
40A00008 3AE00000
480000D8 C03D1890
C05D19BC 480000FC
C0220018 82DD227C
56D5018D 41A20008
C03D23A0 C05D1AAC
480000E0 2C1700B5
40A200D0 C03D08F4
C05D08FC C0628F38
C0828B98 EC230828
EC211024 EC63202A
EC431024 480000B4
C03D19F8 2C1700B2
41A000A4 2C1700B6
4181009C 82BD1A20
C0550058 48000094
82DD19F0 82FD19F4
48000058 3ADD09C0
3B18FF2B 3AE00002
7EB8BBD6 1EB50138
7ED6AA14 82B6FFB4
2C150000 41A2005C
3AF60004 571507FF
41A2001C 3AD60008
3AF6FFC8 48000010
1EB50008 7ED6AA14
3AF60004 C0360000
C0570000 48000034
C8628B90 D8620020
D8620028 B2C20026
B2E2002E C8220020
C8420028 EC211828
EC421828 4800000C
C0220018 C0420018
D03A0000 D05A0004
3B390001 3B5A0008
2C190003 4081FD5C
C0220000 C0420004
C0620008 C082000C
C0A20010 C0C20014
BA810008 38210038
60000000 00000000





More Modifications


KEEP POKEMON FROM GOING PAST 3RD FLOAT
.....................	  -Load Display Setting on Float Pair Change (Advance Left) (802260b8)- (DOL 222c98)
cmpwi	r0,1		# r0 is new pokemon setting (controls floats slot if 1-3)
blt+	END
cmpwi	r0,4
blt+ CONTINUE
li r0,3
CONTINUE:
lis	r10,0x8032
ori	r10,r10,0xed93	# 80427947. settings address -0x1
lbzx	r9,r10,r0	# loads floats setting for the slot
stw	r9,0x60(r31)	# store it into item setting so the float description text updates

END:
stw	r0,0(r4)	# entry point (802260b8). update pokemon setting after advancing Left





USE DIFFERENT TEXT TYPE
- black background, red text

inject @ 802260FC (DOL 222cdc)

li r0,2
lis r3,0x804a
ori r3,r3,0x1fd8
stw r3,-0x4b68(r13)
li r15,0x190
stw r15,0(r3)   # store x/y position
lis r15,0x4128
stw r15,0x8(r3)  # store x stretch
lis r15,0x4190
stw r15,0xc(r3)  # store y stretch
li r15,0xff
stw r15,0x10(r3)  # store text background color
lis r15,0xff00
ori r15,r15,0x00ff
stw r15,0x14(r3)  # store text color
cmplwi r0,2    #default code line



Limit Item Selection
inject @ 80225fc0
- only gets executed for selections 0xD0 and onward

cmpwi	r0,0xD1	#
bgt-	END
DEFAULT:
stw	r0,0(r3)	# default code line
END:


**************************************
* Free Space Check - Tournament Mode *
**************************************

Function
801910e0....onward
80192938 - hitting OK to start tournament mode
801937c4
80194f30 - at the "choose a name and character" menu
801953c8 - highlighting different characters
8019610c - selecting OK to start tournament
801963b4 - (END: 1964a0)- enter tournament mode
8019a86c - pressing start to be ready for battle (19af4c end)

I have a feeling I can zero out all of this....will need to do more testing.

0x18dcc0 (1910e0 RAM)
0x197b2c (19af4c RAM)

****************************
* Ledge ReGrab Shenanigans *
****************************

8044164 - decide change ledgegrab byte

80046ec4

46e48


800439b0 - blrl into above function


800473cc
   - 800474a0 the line that sets r5 to 4 that will grab ledge

800471f8
   - 800472cc the line that sets r5 to 0 to not grab ledge

+2064 = ledge regrab byte (don't enter cliffcatch if > 0)
! 800822a4   CliffCatch_ChecktoEnter_CheckRegrabDisableByte

******************************
* ECB Bottom Update Research *
******************************

+0x88C (word) = Timer - Disable ECB Bottom Update 

**************************
* Smashville - Project M *
**************************

Trying to use BrawlBox to get stage data...

CamLimit0N - (-160,130)
CamLimit1N - (160, -50)

Dead0N - (-220,195)
Dead1N - (220,-115)

Rebirth - (0,70)

Spawn Points - (-50, -20, 20, 50)

Main Stage - (-70,70)

Moving Platform (I think...)
	Height: 25.987
	Left Max: -102.5
	Right Max: 105.73

	Starts at right position (105.73)
	- Frame 30: starts moving left
	- Frame 87: is is at 99.2
	- Frame 500: it is at (-90)
	- Frame 570: it is in left position (-102.5)
	- Frame 630: departs from -102.5
	- Frame 687: -96.05
	- Frame 1100: 93.00
	- Frame 1170: 105.73

So it is stationary at a side for 60 frames = 1 second

Platform might be 23 or so in size? idk.

I just realized I can move objects, but the character on them will not move....fuck.

*************************************
* Stage Character Body Shadow Color *
*************************************

pointer @ 4d6568

- add 0x10 to that pointer and you have the RRGGBBAA of the shadow color

80366ed0 is the code line that initially writes the color from the stage DAT file


#Vibrant Melee

inject @ 8037a7e4
lis r0,0xffff
ori r0,r0,0xffff
stw r0,0(r5)



405a48 = address of "shine" color over top of character
	- metallic objects, etc.

405aa8 = base color overlay of the character (FFFFFFFF is typical, I think)

memory read
broke @ 803616e0

r4 = address of color
r30 = start of color object (-0x10 from color)



c60b30
c48bc0

*********************************
* ECB nudge characters research *
*********************************

80c70180 - P1
80CB51A0 - P3


8006bd98
80342d54
800d3158
800843b4

Addition of X coordinate from nudging happens in function 8006b82c

8006b8c4	lfs	f0,4(r30)
			- r30 = internal offset + 0x8c



Disable Nudging
0406bcc4 60000000

That stores storing the nudge value into x coordinate. But how does it get there?

! Line 8007def8


Ok, so I could probably do this.

ONLY NUDGE TEAMMATES!

Inject @ 8007ddc8

lbz r15,0x61b(r30)
lbz r16,0x67b(r29)
cmpw r15,r16
beq- END
li r3,1

END:
cmpwi r3,0

C207DDC8 00000004
89FE061B 8A1D067B
7C0F8000 41820008
38600001 2C030000
60000000 00000000


For 20XX, Giant Melee (0x1E) is Dual 1v1 Mode


ONLY NUDGE TEAMMATES IN GIANT MELEE
- and when FF is off
Inject @ 8007ddc8

lis	r15,0x8048
lbz	r15,-0x62D0(r15)#load menu controller major
cmpwi	r15,0x1e	#is this mode giant melee?
bne-	END
lis	r15,0x8047
lbz	r15,-0x2497(r15) # load ingame FF
cmpwi	r15,1		# if FF on (if only two players left...)
beq-	END
lbz	r15,0x61b(r30)
lbz	r16,0x67b(r29)
cmpw	r15,r16
beq-	END
li	r3,1

END:
cmpwi	r3,0


***********************
* Ledge Grab Research *
***********************

Multiple Players Can Grab Edge
040812fc 60000000

Only Check If Teammates are on ledge
- for Dual 1v1
Inject @ 80082e74

lbz r15,0x67b(r28)
lbz r16,0x67b(r29)
cmpw r15,r16
beq- END
lis r15,0x8008
ori r15,r15,0x2ef4
mtctr r15
bctr
END:
cmplw r29,r28




For 20XX, Dual 1v1 = Giant Melee
- players on diff teams can grab same edge
- only when ff is off
Inject @ 80082e74

lis	r15,0x8048
lbz	r15,-0x62D0(r15)#load menu controller major
cmpwi	r15,0x1e	#is this mode giant melee?
bne-	END
lis	r15,0x8047
lbz	r15,-0x2497(r15) # load ingame FF
cmpwi	r15,1		# if FF on (if only two players left...)
beq-	END
lbz	r15,0x67b(r28)
lbz	r16,0x67b(r29)
cmpw	r15,r16
beq-	END
lis	r15,0x8008
ori	r15,r15,0x2ef4
mtctr	r15
bctr
END:
cmplw	r29,r28		#default code line

C2082E74 00000009
3DE08048 89EF9D30
2C0F001E 40820034
3DE08047 89EFDB69
2C0F0001 41820024
89FC067B 8A1D067B
7C0F8000 41820014
3DE08008 61EF2EF4
7DE903A6 4E800420
7C1DE040 00000000


****************************
* Dual 1v1 Overwrite Table *
****************************

Address  Default  Dual1v1  Null for readability
80078aa4 41820020 60000000
80078d10 41820044 60000000
802707a8 41820038 60000000
802707c0 40820020 60000000
802707cc 40820014 60000000
800792ec 40820014 60000000
800792cc 480f1e9d 88780020
800792d0 2c030000 2c0300ff
80078ac0 4182018c 4082018c
80078d50 418204e8 408204e8
800792fc 4182078c 4082078c
802707dc 418204d4 408204d4
00000000 00000000 00000000 00000000

(end with a null for the address)
8016e8a0 - r3=8046b6a0


li	r17,4		#table offset to default values
lis	r15,0x8048
lbz	r15,-0x62D0(r15)#load menu controller major
cmpwi	r15,0x1e	#is this mode giant melee?
bne-	TABLE_START
# In Dual 1v1 Mode (Giant Melee)
li	r17,0
stb	r17,0x24c9(r3)	# turn FF off
stb	r17,0x24D0(r3)	# turn Teams off
li	r17,8

TABLE_START:
lis	r15,0x803f	#-0xc from first table address
ori	r15,r15,0xdb64# 803fab64 in DOL
TABLE_LOOP:
lwzu	r16,0xc(r15)
cmpwi	r16,0
beq-	END
lwzx	r18,r15,r17
stw	r18,0(r16)
li	r18,0
icbi	r18,r16
sync
isync
b	TABLE_LOOP
END:
lwz	r12,0x2500(r3)	# default code line

----------------

Part 2:

INGAME: IF NUMBER OF PLAYERS LEFT = 2, SWITCH FF ON
Injection Code @ 8016c094


#20XX first portion

lis	r14,0x8048
lbz	r14,-0x62D0(r14)#load menu controller major
cmpwi	r14,0x1e	#is this mode giant melee?
bne-	DEFAULT


sub r0,r29,r31      # subtract number of dead players from total number of players
cmpwi r0,3           # if 3 or more alive, ignore custom code
bge- DEFAULT
li r0,1
lis r14,0x8047
stb r0,-0x2497(r14)      # turn ingame FF to on at 8046db69

DEFAULT:
subi r0,r29,1      #default line


************************************
* Shy Guy KO stuff for Flieskiller *
************************************
8004049c

800405f0 - branch to increment Shy Guy KO count in player block

	8027ce18


line 802d8f68 branches into all of this. I'm assuming this is OnHitShyGuy function.


	8026a328 = blrl into OnAttack for an item?

0xc9c = health?

0xc gets put into +0xdf8

when "dead", I think 0x24 = 2, 0x28 = FFFFFFFF

SHY GUY KO (BONUS) DOESN'T INCREMENT FOR HITTING AN ALREADY DEAD SHY GUY

inject @ 8003887c

cmpwi r24,0
beq- END_STORE
lwz r3,0x2c(r24)
lwz r3,0x24(r3)
cmpwi r3,2
beq- END


END_STORE:
stw r0,0x904(r4)

END:


************************
* Event Match Research *
************************

804978A0 - start of match info and player info for event match

For Event Matches CPUs, area after P1 is zero'd (8000c160).

801bab40 
	- has a bl into 8016795c, which I believe sets the default player data.

21030000
00ff0000
09007800
40000400
00000000
00000000
3f800000
3f800000
3f800000

Before branching into 8016795c
r3 = 80497900 = start of P1 player info
r4 = 80bda4d0 = Character info for this event match (start of P1)

8016795C  CSS/EventMatch_PlayerDataInitialize
!r3 is only input

801bab40  EventMatch_CopyDefinedPlayerInfo
	inputs:
	r3 = player info target start
	r4 = player info source (copied from)


for r4, format like

05010200
FF000400
00040100
00000000
3F800000
3F800000
3F800000

(notice it doesn't have the two lines of blanks like the target gets)


	- For event match 1 (non-user defined human player), branched into @ 801bb188


	- For CPU players (P2 at least..), line 801bb188...oh its the same


(this location below might move)
80bdc96c is a event match table with pointers to match info for the players/characters involved

---EVENT MATCH POINTERS---
	0x00  short  (0x20 multiplied by number of players in match)
			- this must be changed for more players!
	0x04  point  ?? to some floats before Match Info?
	0x08  point  match info start pointer
			----MATCH INFO----
			0x00  byte   timer, on-screen percents
					- if second bit is a 1, and first bit is 0, timer will count down
					- if second and first bit are both 1's, timer counts up
					- if both bits are zero, time is frozen
					03 = timer counts up
				    04 = 1 player
                    08 = 2 players
                    0C = 3 players
                    10 = 4 players
				    14 = 5 players
                    18 = 6 players
                    1C = 4 players (small stock scale)
				     20 = stock match (otherwise, time)
			0x01  byte   Match Flags
					10 = Warp stars/pokemon damage only
					80 = Event Match (??)
			0x02  byte   Teams Mode ON/OFF
			0x03  byte   item frequency
			0x06  short  stage ID
			0x08  word   timer, seconds
			0x0C	??
            0x10  word   item switch, word 1
            0x14  word   item switch, word 2
			0x18	??
			0x1C  float  universal damage ratio
			0x20  float  match speed
			0x24  float  screen shake
	0x14  point  P1 player info
        0x18  point  P2 player info
	0x1C  point  P3 player info
        0x20  point  P4 player info
	0x24  point  P5 player info
        0x28  point  P6 player info
	(if player is not in-game, these are null)


---PLAYER INFO--- (0x1C apart)
0x00	byte	character ID, external
0x01	byte	player type (HMN, CPU...MasterH & CrazyH use 0x04 here?)
0x02	byte	stocks (0xFF for time mode or something)
0x03	byte	costume number
0x04	byte	spawn point
0x05	byte	subcolor (01=light, 02=dark, 03=black, 04=gray)
0x06    byte    Team ID (idk if they are the normal values, but set all CPUs to 0x04 to be on same team, FF is off)
0x08	byte	Player Flags
		04 = stamina
		10 = invisible
		20 = metal stock icon
		40 = metal
		80 = use regular warp in portal
0x09	byte	CPU type
0x0A	byte	CPU level
0x0C	short	starting percent
0x0E	short	stamina HP
0x10	float	attack ratio
0x14	float	defense ratio
0x18	float	model scale ratio





GmEvent.dat holds all this info!!

0x24ec in GmEvent.dat = 00000060 (=00000080 as file offset) = first event match info pointer (first event match in table mentioned above)

The pointer to Event Match 2 is at 0x24f0,etc.







Back to function:
GmEvent.dat is loaded at beginning of 801bad70

801bada0	subi	r0,r5,2464	#get to beginning of ASCII "GmEvent.dat"
801bada4	subi	r5,r4,2452	#get to beginning of ASCII "sqEventInitDataLevelTbl"


80016c64 - FileLoad_GmEvent.dat
r3 = start of ASCII filename
r4 = r13 minus 19872 (-0x4da0) (?)
r5 = start of ASCII "sqEventInitDataLevelTbl
r6 = 0
(actually, I think a lot of fileloading functions reference this function)


After this happens,

-0x4da0(r13) = first entry of event match table


801bb12c  and next lines are storing 03 as player type for all six players. This means not in game.
801bb1ac	cmpwi 	r0,0x21	# 0x21 means player was chosen from menu


-8045abf2 = selection data from event match CSS (character/type/name tag)
-8045ABF5 = event match # selected/being played (0x00 = event match 1)



--------
In EventMatchControlAndThink,

when selecting a fixed character event match, 8024d978.

---------

Memory read on 8045abf5 (event match number) after the menu controller said "go",

breaks @ 801677f0 - lbz r3,-0x5108(r13)
- loading byte from 804D6598. The only thing in that function. probably not what I am looking for, but I wonder what that flag is for...

r28 = 1 (the event match I am testing on)

blr spits me out at function 801bbf04 [801bbea8]. This might be the function that controls going to a CSS for the event match or not.


SOOOOOO....

All I need to do to have event matches bring the user to the CSS is to have P1's character ID be 0x21 !!

[Gecko]
Choose Any Character for Any Event Match
041BBFB0 38000021
041BB1B0 60000000

	*freezes on console I think

Make Event Match 1 vs. 5 Luigis
- I modified the GmEvent.dat to already make it vs. a luigi.

inject @ 801BADC8
- r20 = start of GmEvent.dat event match pointers

EVENT_MATCH_ONE:
lwz	r3,0(r20)
li	r14,0xc0
sth	r14,0(r3)
lwz	r14,0x18(r3)
stw	r14,0x1c(r3)
stw	r14,0x20(r3)
stw	r14,0x24(r3)
stw	r14,0x28(r3)

DEFAULT:
mr	r3,r26

--------------------

So I started editing GmEvent.dat.
I can't seem to add characters to an event match without having the game freeze - but I CAN while manually editing the RAM after GmEvent.dat has been loaded.

I need to write a code to see if it works on console.


Event Match Stage Selection Additions
801baff0	lhz	r5,0x6(r5)
- let's make a stage ID flag that can choose between a random tourney legal stage
	STAGE ID FLAG:
	0x7FFF = random tournament legal stage

inject @ 801baff0
- note: this code lines loads the stage ID. I noticed in some later code that the stage ID is being loaded again, I think, so I'm going to modify the Stage ID and then re-store it just in case.


lhz	r0,0x6(r5)
cmpwi	r0,0x7FFF
bne-	RANDOM_LEGAL_END
stw	r3,-0x8(sp)
stw	r4,-0xc(sp)
stw	r5,-0x10(sp)
RANDOM_LEGAL:
lis	r3,0x8038
ori	r3,r3,0x0580	# 80380580 = RNG function
mtlr	r3
li	r3,6
blrl
cmpwi	r3,0
beq-	DREAMLAND	
cmpwi	r3,1
beq-	YOSHIS_STORY
cmpwi	r3,3
ble-	STAGE_ID_STORE	# 2 = FOD, 3 = Pokemon
cmpwi	r3,4
beq-	BATTLEFIELD
b	FINAL_DEST


DREAMLAND:
li	r3,0x1c
beq-	STAGE_ID_STORE
YOSHIS_STORY:
li	r3,0x8
beq-	STAGE_ID_STORE
BATTLEFIELD:
li	r3,0x1f
beq-	STAGE_ID_STORE
FINAL_DEST:
li	r3,0x20

STAGE_ID_STORE:
lwz	r5,-0x10(sp)
sth	r3,0x6(r5)	# store new stage ID


lwz	r3,-0x8(sp)
lwz	r4,-0xc(sp)
RANDOM_LEGAL_END:
DEFAULT:
li	r0,0		# this is what r0 was at start
lhz	r5,0x6(r5)






4d4b78...
1badc0

lwz	r20,-0x4da0(r13)

***********************************************************
* Research Freezing - X+Dpad Up at CSS in Develop Mode... *
***********************************************************

EDIT: The game is not actually freezing...press X+Dpad Up again and it will "unfreeze"...

Memory read on 804d4a08 at CSS -

Lines will look something like:

lwz r0,-0x6c98(r13)


Results:
801a4f78 - this one was nop'ed for disabling the Y+D-Pad Up USB Screenshot thing.

801a4ff4 - ??
801a4dec
---------------

801a4ff4 Research
	- only thing it does in DEVELOP Mode is bl into 8034bca0

	[8034BCA0]
	- only called by function 801a4d34
	- try disabling this function

		[8034BC04]
		- only called by function 8034BCA0

		[80348084]
		- only called by function 8034BCA0

		[8034804C]
		- only called by function 8034BCA0


********************************************
* PlCo.dat File Loading - SD Remix Changes *
********************************************

80067abc   FileLoad_PlCo.dat


Perform SD Remix Changes if SDR Character is Chosen

inject @ 80067af0 - stw r0,-0x514c(r13)
- r0 = 0x9fe0 in PlCo.dat at this point

DEFAULT:
stw	 r0,-0x514c(r13)

mr	r16,r0			# move PlCo pointer to r16
SD_REMIX_DK:	
lis	r14,0x803d	
lbz	r14,-0x4203(r14)	# 803cbdfd
cmpwi	r14,0x73		# is PlDk.sat ?
bne-	SD_REMIX_KIRBY	# if not, ignore and keep orig value
lis	r15,0x40c0	
stw	r15,0x600(r16)	
lis	r15,0x3f66	
ori	r15,r15,0x6666	
stw	r15,0x60c(r16)	
li	r15,1	
stw	r15,0x620(r16)	

	
SD_REMIX_KIRBY:	
lis	r14,0x803d	
lbz	r14,-0x5cf3(r14)	# 803ca30d
cmpwi	r14,0x73		# is PlKb.sat?
bne-	SHIELD_COLORS	# if not, ignore and keep orig value
lis	r14,0xcb18	
ori	r14,r14,0x9680	
stw	r14,0x3c8(r16)	


SHIELD_COLORS:
li	r14,4
mtctr	r14
lis	r14,0x803f
ori	r14,r14,0xa2d8	# -0x10 from P1 custom shield on/off
addi	r16,r16,0x2ED4	# get -0x4 from P1 shield color 
SHIELD_COLOR_LOOP:
addi	r16,r16,4		# get to this player's shield color
lwzu	r15,-0x10(r14)	# load custom shield on/off flag
cmpwi	r15,0
beq- SHIELD_COLOR_COMPARE
lwz 	r15,-4(r14)		# load Red value
stb	r15,0(r16)		# store Red value
lwz	r15,-8(r14)		# load Blue value
stb	r15,1(r16)		# store Blue value
lwz	r15,-0xc(r14)		# load Green value
stb	r15,2(r16)		# store Green value

SHIELD_COLOR_COMPARE:
bdnz+ SHIELD_COLOR_LOOP


END:

*********************************************************
* Stage Select Screen (SSS) - Photoshop Stage Name Text *
*********************************************************

My notes from a long ago..

"For stage name:
Utsaah, Bold Italic, Sz 50, Smooth
Transform -> scale height to 120%

Transform -> perspective, H = -3.58 degrees

**********************
* Stage File Loading *
**********************

@ 80018130

lwz	r4,0x10(r30)
lwz	r4,0x4(r4)

now r4 contains the pointer to the stage file info immediately after it was loaded in the RAM.

How do I know what file was loaded?

The word at...
lwz	r4,0x4(r30)

Battlefield = 1000019F
Final Destination = 100001AB

Actually...hmm. It looks like that halfword at the end is in reference to a file # within the ISO. So the different stage textures I am loading will have different IDs.


**************************
* Battlefield Area Table *
**************************

0x320e8 - Left limit = c2bb0000 = -93.5 --> -93.5*0.8 = 
0x320ec - bottom limit = c2680000 = -58
0x320f0 - right limit = 42bb0000 = 93.5
0x320f4 - upper limit = 42980000 = 76

Change to Blastzone limits and can put platforms anywhere!

But where are these "areas" located in RAM? This would be the optimal place to incur the change.

*************************************
* Battlefield Area Table  - RAM Mod *
*************************************
Stage patch code

Because of the 20XX Battlefield Custom Plats mod, I want to automatically modify the area table so that collision points will always work for any GrNBa.dat file without further modifications.

I'm going to use the file length as an indicator for if Battlefield was loaded or not.
Lets use an area table with coordinates -375, 375 


20XX STAGE FILE LOADING CODES
- Battlefield Area Table
- FD custom stage color

inject @ 80018130

lwz	r4,0x10(r30)
lwz	r4,0x4(r4)	# r4 now holds the address of the start of stage file info
lwz	r14,0(r4)	# load file length into r14

### BATTLEFIELD ###
BATTLEFIELD:
lis	r15,0x0006
ori	r15,r15,0xe64b	# load BF file length
cmpw	r14,r15
bne- 	FINAL_DESTINATION
lis	r14,0x0003
ori	r14,r14,0x20e8	# load file offset for BF area table
add	r14,r4,r14	# r14 holds start of BF area table

MODIFY_BF_AREA_TABLE:
lis	r15,0xc3bb
stw	r15,0(r14)
stw	r15,4(r14)
lis	r15,0x43bb
stw	r15,8(r14)
stw	r15,0xc(r14)
b	END
### FINAL DESTINATION ###
FINAL_DESTINATION:
lis	r15,0x0009
ori	r15,r15,0x5335	# load FD file length
cmpw	r14,r15
bne- 	POKEMON_STADIUM

FINAL_DESTINATION_LONG:
lis	r16,0x8040
lbz	r15,-0x5d1b(r16)# load custom stage flag
rlwinm. r15,r15,0,25,25	# (00000040)
beq-	FINAL_DESTINATION_LONG_END
lis r15,0x4040
li	r17,0
ori r16,r17,0xf488
stwx r15,r4,r16
ori r16,r17,0xf4cc
stwx r15,r4,r16
ori r16,r17,0xf4d0
stwx r15,r4,r16
ori r16,r17,0xf590
stwx r15,r4,r16
lis r16,0x0001
ori r16,r16,0x0088
stwx r15,r4,r16
lis r16,0x0001
ori r16,r16,0x0608
stwx r15,r4,r16
lis r15,0x4248
ori r16,r17,0xf4d8
stwx r15,r4,r16
lis r16,0x0005
ori r16,r16,0x1b90
stwx r17,r4,r16	# store 0 = r17
lis r17,0x0005
lis r15,0xc3aa
ori r15,r15,0x91ec
ori r16,r17,0x1f20
stwx r15,r4,r16
lis r15,0x43aa
ori r15,r15,0x91ec
ori r16,r17,0x1f60
stwx r15,r4,r16
lis r15,0xc3d0
ori r15,r15,0x91ec
ori r16,r17,0x1fa0
stwx r15,r4,r16
lis r15,0x43d0
ori r15,r15,0x91ec
ori r16,r17,0x1fe0
stwx r15,r4,r16
FINAL_DESTINATION_LONG_END:

CUSTOM_STAGE_COLOR:
lis	r15,0x8040
lwz	r14,-0x5C5C(r15)# 20XX custom fd color flag @ 803fa3a4
cmpwi	r14,0
beq- CUSTOM_STAGE_COLOR_END
lwz	r14,-0x5C60(r15)# load red
stb	r14,0x7974(r4)	# store red (sides)
stb	r14,0x7b84(r4)	# store red (top)
lwz	r14,-0x5C64(r15)# load green
stb	r14,0x7975(r4)	# store green (sides)
stb	r14,0x7b85(r4)	# store green (top)
lwz	r14,-0x5C68(r15)# load blue
stb	r14,0x7976(r4)	# store blue (sides)
stb	r14,0x7b86(r4)	# store blue (top)
CUSTOM_STAGE_COLOR_END:

b END

### POKEMON STADIUM ###
POKEMON_STADIUM:
lis	r15,0x0016
ori	r15,r15,0x4b20	# load PS.usd file length
cmpw	r14,r15
bne- 	END

lis	r16,0x8040
lbz	r15,-0x5d1b(r16)# load custom stage flag
rlwinm. r15,r15,0,25,28 # check for a fixed trans stage flag
beq-	END
lis	r15,0x0003
ori	r15,r15,0xdb88	# get to ItemData for PS
add	r4,r15,r4
li	r15,0
stw	r15,0(r4)	# store 0 to timer, Main Stage A
stw	r15,4(r4)	# store 0 to timer, Main Stage B
stw	r15,0x10(r4)	# store 0 to immediately trans
stw	r15,0x14(r4)	# store 0 to drop down/rise up
stw	r15,0x18(r4)	# store 0 to trans stay down timer

	
END:
lwz	r3,0x14(r30)	# default code line



**********************************************
* Automatically Restart Failed Event Matches *
**********************************************

inject @ 801bba38 - li r3,1
		- the 1 is the ID to go back to the Menus
		- change to 0x2B to restart the event match

li 	r3,1
lis	r4,0x8047
lbz	r4,-0x4955(r4)
cmpwi	r4,7
bne-	END
li	r3,0x2b
END:


************************
* MnSlChr File Loading *
************************

-0x49CC(r13) = +0x40 = pointer to start of MnExtAll.usd
-0x49D0(r13) = +0x40 = Pointer to start of MnSlChr.usd

File RAM Patch Locations:


MnSlChr.usd
Injection Point: 80266974
+0x40(r3) = pointer to start of MnSlChr.usd

MnExtAll.usd
Injection Point: 80266980
+0x40(r3) = pointer to start of MnSlChr.usd

MnSlChr.dat
Injection Point: 80266958
+0x40(r3) = pointer to start of MnSlChr.dat

MnExtAll.dat
Injection Point: 80266964
+0x40(r3) = pointer to start of MnSlChr.dat

*******************
* Spawn Point IDs *
*******************

	FF=default (use port number for spawn point)
	00=P1 spawn point
	01=P2 Spawn Point
	02=P3 Spawn Point
	03=P4 Spawn Point
	04=Spawn in middle of stage, on stage
	05=P1 Spawn Point + extra height
	06=P2 Spawn Point + extra height
	07&08=P3 Spawn Point + extra height
	09= P4 Spawn Point + extra height
	0A & Above = Spawn far offstage to the right
	0F = Spawn way off stage to the right

Code line that reads this is 8016e488.

Function that applies the spawn point location floats to player is 80224e64

For 20XX, I have code runnning at the CSS that changes players spawn points to have:

1v1 = player 1 & 2 spawn point location always

Teams = player 1 & 4 are a team, player 2 & 3 are the other team.

But, if NEUTRAL START is off in the debug menu, I need to have the tournament legal stages ignore:
1) the spawn point ID (so always make it 0xFF)
2) the 20XX custom spawns code


to address point 1,

inject @ 8016e47c
- r31 = 8046b6a0 at this point (match info start)

lis	r3,0x801a
ori	r3,r3,0x4340	# load function: MenuController_CheckSinglePlayer
mtlr	r3
lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major - function input
blrl

lbz	r0,0x3B(r30)	# default code line, load spawn ID for this player
cmpwi	r3,1		# if in single player, skip all this
beq-	END

lis	r4,0x8040

lwz	r3,-0x5C6C(r4)	#803fa394 = 20xx  neutral spawns debug flag
cmpwi	r3,0
bne-	END		# if not off, ignore code to make things default


lhz	r3,0x24d6(r31)	# load stage ID
cmpwi	r3,4		# is stage FoD (0x002) or Pokemon Stadium (0x003)?
blt-	DEFAULT_SPAWNS
cmpwi	r3,8		# is stage Yoshi's Story?
beq- 	DEFAULT_SPAWNS
cmpwi	r3,0x1c		# is stage DL64?
beq- 	DEFAULT_SPAWNS
cmpwi	r3,0x21
bge-	END		# if ID is >= 0x21, skip code
cmpwi	r3,0x1e		# if ID is not KJ64, BF, or FD, skip code
blt-	END

lbz	r3,-0x5d1b(r4)  #load custom spawns flag
rlwinm.	r3,r3,0,29,31 # extract out custom spawn bits (first 3 bits)
bne-	END
DEFAULT_SPAWNS:
li	r0,0xFF		# load default spawn ID

END:


*************************
* Pokemon Stadium Hacks *
*************************
pokemon internal entity offset
0xD8	word	stage trans timer
		- counts down during stages
		- counts up during mid-transform
0xDc	short	stage trans ID
			0x0003 = mid transforming
0xE4	point	stage entity external offset

801d4858

Line that writes the frames for a stadium transformation:
801d4fcc
In this testing, it transformed to Water stage, and wrote 0x0000065a

Look at these lines:

801d4f80	lwz	r3,-0x4d28(r13)
801d4f84	lwz	r28,0xc(r3)
801d4f88	lwz	r27,0x8(r3)
801d4f8c	cmpw	r28,r27
801d4f90	ble-	-> 0x801d4fb0
801d4f94	sub.	r3,r28,r27

----------------

FREEZE POKEMON STADIUM (via Custom Stage Flag)
- needs to be compatible with salty runback (which would kep the 0x80 for freezing)

inject @ 801d45f0

lis	r16,0x8040
lbz	r17,-0x5d1b(r16)# load custom stage flag (frozen PS)
rlwinm. r0,r17,0,24,24	# does flag include 0x80?
beq-	DEFAULT
rlwinm. r0,r17,0,25,28  # does flag include a fixed trans stage?
beq-	FREEZE

lis	r15,0x8047
lwz	r15,-0x493c(r15)# load match frame count
cmpwi	r15,0		# is this beginning of match?
beq-	DEFAULT


FREEZE:
li	r3,0xff

DEFAULT:
subi	r0,r3,1
END:

------------------

FIXED POKEMON TRANSFORMATION STAGE (via Custom Stage Flag)
Transform IDs:
0 = Fire Mode (tree)
1 = Grass Mode
2 = Rock Mode
3 = Water Mode (windmill)

inject @ 801d463c

lis	r4,0x8040
lbz	r5,-0x5d1b(r4)# load custom stage flag
rlwinm. r0,r5,0,25,25
beq-	GRASS
li	r3,0
b	END_AND_FREEZE
GRASS:
rlwinm. r0,r5,0,26,26
beq-	ROCK
li	r3,1
b	END_AND_FREEZE
ROCK:
rlwinm. r0,r5,0,27,27
beq-	WATER
li	r3,2
b	END_AND_FREEZE
WATER:
rlwinm. r0,r5,0,28,28
beq-	END_DEFAULT
li	r3,3

END_AND_FREEZE:
cmpwi	r5,0x80
bge-	END
addi	r5,r5,0x80
stb	r5,-0x5d1b(r4)	# store flag for no more transformations
b	END

END_DEFAULT:
lis	r5,0x8038
ori	r5,r5,0x0580
mtlr	r5
blrl			# default line, branch to random function

END:

-----------------------

Enable Transforming Immediately (instead of after "Go!")
inject @ 801d1538

lbz	r0,0xc4(r3)	# default code line

lis	r15,0x8047
lwz	r15,-0x493c(r15)# load match frame count
cmpwi	r15,0		# is this beginning of match?
bne-	END

lis	r15,0x8040
lbz	r15,-0x5d1b(r15)# load custom stage flag
rlwinm. r15,r15,0,25,28  # does flag include a fixed trans stage?
beq-	END

lis	r15,0x801d
ori	r15,r15,0x1544
mtctr	r15
bctr

END:

*************************
* Camera Mode Snapshots *
*************************


8001df6c  CameraMode_SnapshotSave
8001e058  CameraMode_SnapshotLoad_Initialize?

My hunch tells me r3=0=mem card slot A, r3=1=mem card slot B

Breakpoint @ 8001e034, right before branch into 8001bb48 which must do that saving.

r4 = pointer to filename
r5 = 803bacdc
	0x00 = length of screenshot data (3c259)
        0x04 = ?? (00000003)
	0x08 = pointer to start of screenshot data
	0x0C = ?? (FFFFFFFF)



SCREENSHOT LOADING
8001e058
	Inputs:
	r3=0 (maybe mem card A/B)
	r4= screenshot ID #(0, 1, 2, etc..)
		-newest saved is 0
-idk exactly what this function does. It doesn't completely load the screenshot data into RAM, but maybe intializes the filenames to be loaded or something.
---




Viewing Pictures
Screenshot data starts at 0xbecd60

12419C0
127DC19

spits out at 8025389c

Part of function 80257d78 (HUGE, this is the end)
- all 4 screenshots get loaded before the end of this function

mnsnap.c


8025329C    CameraMode_SnapshotLoad_HighLevel
- this function gets repeatedly executed until the snapshot data is fully loaded. Not sure if it's only loading pieces at a time....?

BUT, once it gets to line 802532c8, the data is fully loaded to becd60.

!!!! This function loads data to the pointer specified at 803bace4 !!!!

4a0a10 +0x144 = 4A0B54
the word (int) at this address is how many pictures left to load at this time.

4a0b58 = how many have loaded (?)



----
Function 80019cb0 = Memory card something



8001bd34 MemoryCard_LoadData (from wParam)
		r3  : 00000000  0 = slot A, 1 = slot B
		r4  : 803BAC5C  "SuperSmashBros01..."
		r5  : 803BAB74  directs the thing on what to save.
		r6  : 80433334  [the strings that go in the file] appears to be all
		r7  : 80BE7CE0  points to the picture data
		r8  : 80BEACE0  i believe this is the icon
		r9  : 8043331C  points to just before strings in r6
		r10 : 8001CC30  if (r3==0)return; *(80433318+8) = 2; (OnComplete() function)
		r11 : 00000000 

r3: 0
r4: Pointer to internal file name (SuperSmashBros0110290334)
r5: Pointer to data table containing what data to copy (803bab74)
r6: Pointer to some flag?
Returns 0 to r3 if the file exists, and 1 if it doesn't exist.

8001be30	MemoryCard_SaveData

outputs:
r3 = 0xb = failed? or file doesn't exist


Memory card saving
TO SAVE A FILE OF ANY DATA OF ANY SIZE:

1)
803BAC5C: change the internal filename 

2)
803BAB74: change to

00000000
00000003
00000000
XXXXXXXX = size in bytes to save
00000000
YYYYYYYY = pointer to start location
FFFFFFFF


Loading is basically the same way...make sure the pointer is to where you want to load to.

---------------

Other Memory Card Functions

8001ba44	MemoryCard_DeleteGameData
r3 = 0 for slot A, 1 for slot B
r4 = 3bac5c (Pointer to internal file name (SuperSmashBros0110290334))
r5 = 8043331c (right before default file strings?)

outputs:
r3 = 0 = Successful
r3 = 4 = File doesn't exist
r3 = 0xF = No card inserted


-------

8001d164	MemoryCard_BannerIconImage_LoadtoRAM
- r3 (input) = 0

Afterwards,
lis r8,0x8043
lwz r8,0x3374(r8)
lwz r9,0xc(r8)	# r9 holds pointer to icon image
lwz r8,0(r8)	# r8 holds pointer to banner image

-------------

Trying to write a test function for saving on Coming Soon screen
- Works!

inject @ 801a0bd0

cmpwi r0,0x1000	# was Start pressed to exit the Coming Soon screen?
beq-	DEFAULT

lwz r3,-0x4fb0(r13)	# load IfComSn.dat table
lwz r3,0x40(r3)	# get to start of IfComSn.dat file
lwz	r4,0(r3)	# load file length
lis r5,0x0006
ori r5,r5,0x0861	# first word of the custom IfComSn.dat for memory cards is 00060861
cmpw r5,r4
bne-	DEFAULT

lis r3,0x8043
lwz r4,0x33cc(r3)	# load memory card slot A insertion flag
lwz r5,0x33d0(r3)	# load memory card slot B insertion flag

B_BUTTON:
cmpwi r0,0x0200	# B button pressed?
bne-	A_BUTTON
cmpwi r5,0
beq-	FAILURE
b 	MEMDATA_EXECUTE

A_BUTTON:
cmpwi r4,0
beq-	FAILURE

MEMDATA_EXECUTE:
PING_SOUND:
lis r3,0x8038
ori r3,r3,0xcff4
mtlr r3
li r3,223
li r4,254
li r5,128
li r6,20
li r7,3
blrl

INIT_MEM_CARDS:
lis r3,0x8030
ori r3,r3,0x1634	# vanilla Debug Menu "Init" memory card function
mtlr r3
blrl

DELETE_MEMCARD_DATA:
# need to pull A or B button press
bl MEMCARD_SLOT_GET

lis r4,0x8001
ori r4,r4,0xba44	# MemoryCard_DeleteGameData
mtlr r4

DELETE_MEMCARD_DATA_CONTINUE:
lis r5,0x0005
ori r5,r5,0x165c	# "SuperSmashBros0110290334" internal memory card filename
lwz r4,-0x4fb0(r13)	# load IfComSn.dat table
lwz r4,0x40(r4)	# get to RAM start of IfComSn.dat file
add r4,r4,r5

lis r5,0x8043
ori r5,r5,0x331c

blrl	# Goto MemoryCard_DeleteGameData
cmpwi r3,0	# was the delete successful?
beq-	MEMCARD_CREATE
cmpwi r3,4	# does the file not exist?
bne-	FAILURE	# will branch to failure if memcard is not inserted (r3 = 0xF)

MEMCARD_CREATE:
lwz r10,-0x4fb0(r13)	# load IfComSn.dat table
lwz r10,0x40(r10)	# get to RAM start of IfComSn.dat file
lis r9,0x0005		# r9 holds 0x00050000
ori r9,r9,0x157c	# start of IfComSn memcard file save table
add r9,r9,r10

SAVEDATA_LOOP:
lwzu r8,0xc(r9)
add r8,r8,r10
stw r8,0(r9)
lwz r8,4(r9)
cmpwi r8,-1
bne-	SAVEDATA_LOOP

bl MEMCARD_SLOT_GET


lis r4,0x8001
ori r4,r4,0xbc18
mtlr r4
lis r9,0x0005		# r9 holds 0x00050000
ori r4,r9,0x165c	# "SuperSmashBros0110290334" internal memory card filename
add r4,r4,r10

ori r5,r9,0x1574	# "SuperSmashBros0110290334" internal memory card filename
add r5,r5,r10

ori r6,r9,0x1560	# "SuperSmashBros0110290334" internal memory card filename
add r6,r6,r10

ori r7,r9,0x161c	# "SuperSmashBros0110290334" internal memory card filename
add r7,r7,r10

lis r8,0x8043
lwz r8,0x3374(r8)
lwz r9,0xc(r8)	# r9 holds pointer to icon image
lwz r8,0(r8)	# r8 holds pointer to banner image
lis r10,0x8043
ori r10,r10,0x331c
blrl
cmpwi r3,0
bne-	FAILURE

SUCCESS:
lis r3, 0x0007
ori r3, r3, 0xc85e	# SUCCESS sfx ID
li r4, 0x00fe
li r5, 0x0080
li r6, 0x0000
li r7, 0x0007
lis r12, 0x8038
ori r12, r12, 0xcff4  # Function 8038cff4
mtctr r12
bctrl
b	DEFAULT
FAILURE:
lis r3,0x8002
ori r3,r3,0x4030	# SFX_Menu/CommonSound
mtlr r3
li r3,3	# error sound
blrl

li r3, 0x0148	# sad crowd gasping noise
li r4, 0x00fe
li r5, 0x0080
li r6, 0x0000
li r7, 0x0007
lis r12, 0x8038
ori r12, r12, 0xcff4  # Function 8038cff4
mtctr r12
bctrl
b	DEFAULT

#---
MEMCARD_SLOT_GET:
SLOT_A_DEFAULT:
li r3,0
lis r4,0x8048
lwz r4,-0x6304(r4)	# load all player's instant buttons from 80479cfc
rlwinm. r0,r4,0,23,23 # (00000100) A button
bne-	DELETE_MEMCARD_DATA_CONTINUE
SLOT_B:
li r3,1
blr
#---

DEFAULT:
lwz	r3,-0x4fa8(r13) #default

-----------------------------------------------
SFX

9c48 = failure, not loaded on main menu
	fe
	80
	0
	7
	12
148

9c43 = game over, not loaded on main menu
7c852 = defeated



SUCCESS:
lis r3, 0x0007
ori r3, r3, 0xc85e
li r4, 0x00fe
li r5, 0x0080
li r6, 0x0000
li r7, 0x0007
lis r12, 0x8038
ori r12, r12, 0xcff4  # Function 8038cff4
mtctr r12
bctrl

------------------------------

IfComSnMEM_TEMPLATE Offsets:

803BAC5C = 0x0005148c
803BAB74 = 0x000513a4
803bab60 = 0x00051390
80433334 = 0x0005144c


IfComSnMEM_TEMPLATEafterReloc Offsets:

803BAC5C = 0x0005165c
803BAB74 = 0x00051574
803bab60 = 0x00051560
80433334 = 0x0005161c


To get the start of the IfComSn.dat file data within the RAM,
lwz r3,-0x4fb0(r13)
lwz r3,0x40(r3)


------------------

The below doesn't work.

lis r3,0x8001
ori r3,r3,0xba44
mtlr r3
li r3,1
lis r4,0x803b
ori r4,r4,0xac5c
lis r5,0x8043
ori r5,r5,0x331c
blrl

lis r3,0x8001
ori r3,r3,0xd164
mtlr	r3
li r3,0
blrl

lis r3,0x8001
ori r3,r3,0xbc18
mtlr r3
li r3,1
lis r4,0x803b
ori r4,r4,0xac5c
lis r5,0x803b
ori r5,r5,0xab74
lis r6,0x803b
ori r6,r6,0xab60
lis r7,0x8043
ori r7,r7,0x3334
lis r8,0x8043
lwz r8,0x3374(r8)
lwz r9,0xc(r8)	# r9 holds pointer to icon image
lwz r8,0(r8)	# r8 holds pointer to banner image
lis r10,0x8043
ori r10,r10,0x331c
blrl

lwz	r3,0x4fa8(r13) #default

*******************************
* Memory Card Insertion Flags *
*******************************

804333cc = Memory Card Slot A
804333d0 = Memory Card Slot B

0x00000000 = no memory card inserted
0x00000001 = memory card is inserted


20XXTE v2A Copy 20XXTE File
ASM is around 817f662c

******************************************
* Start Button Hold Frame Count (Global) *
******************************************

Flags will be at 804d6b90 (I can use this word because I nop'ed the USB develop function)

inject @ 803775bc

stw	r0,0(r26)
rlwinm.	r0,r0,0,19,19
li	r4,0
subi	r5,r13,0x4b10
beq-	END
lbzx	r4,r5,r24
addi	r4,r4,1
END:
stbx	r4,r5,r24

-------------------

Hold Start to Force Through Results Screen
801795a4 or line close by


inject @ 801795b8

subi	r5,r13,0x4b11
li	r4,4
mtctr	r4

REPEAT:
lbzu	r4,1(r5)
cmpwi	r4,0x78
blt-	END_SCREEN_ADVANCE
lis	r4,0x8048
stw	r5,-0x629c(r4)

END_SCREEN_ADVANCE:	
bdnz+	REPEAT
END:
stw	r0,8(r31)		#add default line

---------------------

Hold Start to Force SSS

inject @ 80262614

DISABLE_IN_SINGLE_PLAYER:
lis	r3,0x801a
ori	r3,r3,0x4340	# load function: MenuController_CheckSinglePlayer
mtlr	r3
lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major - function input
blrl
cmpwi	r3,1		# if in single player, skip all this
beq-	END


#make sure at least 1 char is chosen
lis	r3,0x8043
ori	r3,r3,0x2087
li	r4,6
mtctr	r4
li	r5,0
REPEAT_CHECK_CHAR:
lbzu	r4,8(r3)
cmpwi	r4,0x21
beq-	GOTO_REPEAT
addi	r5,r5,1
GOTO_REPEAT:
bdnz+ 	REPEAT_CHECK_CHAR

cmpwi	r5,0	# are 0 chars chosen?
beq-	END	# go to end if no chars chosen

HOLD_START_CHECK:
subi	r5,r13,0x4b11	# go to custom flags for holding start
li	r4,4
mtctr	r4		# 4 players

REPEAT:
lbzu	r4,1(r5)
cmpwi	r4,60		# is player holding start for 60 frames
blt-	END_SCREEN_ADVANCE
FORCE_SSS_CHECKS:

lis	r4,0x8046
lbz	r4,-0x40EE(r4)	# load selected match type
cmpwi	r4,1		# is this stock mode?
bne-	LOAD_SSS

li	r3,0
stb	r3,0(r5)	# make start timer 0
lis	r3,0x8002
ori	r3,r3,0x4030
mtlr	r3
li	r3,3		# load CSS error
blrl
b	END

LOAD_SSS:
li	r3,1
stb	r3,-0x49aa(r13)
b	END


END_SCREEN_ADVANCE:	

bdnz+	REPEAT
END:
lmw	r19,0xb4(sp)		#add default line


***********************************
* Warioware, Inc Stage Dimensions *
***********************************

CamLimit0N (-110, 110)
CamLimit1N (110, -28)

Dead0N (-170, 185)
Dead1N (170,-104)

Player1 (-45.36, 36.49852)
Player2 (50,36.49852)
Player3 (-25,11.58187)
Player4 ((25,11.582,0)

Rebirth (0,85)

--------
Platform Objects
Left, Bottom
(-56.47013, 36.499)
(-18.53013, 36.499)

Left, Top 
(-56.124, 60.839)
(-33.723, 60.839)

Right, Bottom
(21.633, 36.499)
(59.573, 36.499)

Right, Top 
(37.16, 60.839)
(59.561, 60.839)

------------
Main Stage

Left Ledge (-56.81498, 11.582)
Right Ledge (59.649, 11.582)


27.2, 54.4

*****************
* Pokemon Spawn *
*****************

80269ae0 - is this blrl only for pokeballs? I think so..

Disable Pokemon Spawn
04297e04 60000000

original hex is 4bfe2d61

*********************
* Mushroom Stacking *
*********************
branch link into from
800d1f98 (poison)
800d15fc (super)


lis	r3,0x8040
lwz	r3,-0x5DD4(r3)	#3fa22c = 20xx flag for mush stack
cmpwi	r3,0
bne-	0x8
stb	r0,0x2220(r31)
blr	


eh, lets just set those two lines to "nop" when toggle is turned.


************************
* Walljumping....again *
************************
8008183c	lbz	r3,0x210c(r31)	#load wallride count
80081854	lfs	f0,0x768(r4)	#load 130 from PlCo

#and then do not walljump if wallride frame count is greater

1316520

Disable Doraki Insta-Walljump
inject @ 8008183c

lbz	r3,0x210c(r31)
lwz	r4,0x2064(r31)
cmpwi	r4,0x19
ble-	END
li	r3,0x85		#load something greater than 130
END:


This successfully disables insta-walljumps but you still cannot scar jump because the wallride byte gets set back to 0xFE

800817fc	lfs	f2,0xc8(r31)	#load x frame delta

Enable Scar Jump on long 90 degree walls

80081828

fcmpo	cr0,f1,f0
bgt-	END
lbz	r3,0x210c(r31)
cmpwi	r3,0xfe
bne-	END
li	r3,0
stb	r3,0x210c(r31)
stfs	f31,0x2110(r31)
END:
fcmpo	cr0,f1,f0
--------------

Can I combine both of these into one?

inject @ 8008183c


fcmpo	cr0,f1,f0	# compare x coord frame delta, etc
bgt-	END		# if less than, check to reset wallride timer to allow walljumping
lbz	r3,0x210c(r31)	# load wallride timer
cmpwi	r3,0xfe		#
bne-	END
li	r4,0
stb	r4,0x210c(r31)	# store 0 into wallride timer
stfs	f31,0x2110(r31)
END:
lbz	r3,0x210c(r31)	# load wallride timer
lwz	r4,0x2064(r31)	# load ledge regrab disable timer
cmpwi	r4,0x1c		# dont walljump for first two frames after letting go
ble-	ENDTWO
li	r3,0xfe		#load something greater than 130
ENDTWO:


OKAY!!!
- what if I made my own stage file collision link flags
- use flags in the same location as the floor type, but for walls

00 = default
01 = disable walljump
02 = enable walljump anytime character is in contact with the wall
	- aka enable scarjumping on 90 degree long walls
04 = disable walljump during first 2 frames of fall from ledge
	- aka disable insta-walljump (Doraki)



inject @ 8008183c
- in function Interrupt_Walljump

lbz	r3,0x856(r31)	# load right wall type ID
lfs	f15,-0x7654(rtoc)#load 1.00
fcmpo	cr0,f15,f31
beq-	WALL_CONTINUE	# check if character in contact w/ right wall
WALL_ON_LEFT:
lbz	r3,0x86a(r31)	# load left wall type ID
WALL_CONTINUE:
cmpwi	r3,0		# is wall flag 0?
beq-	END		# if so, skip to default code line
rlwinm. r0,r3,0,31,31	# load first bit
bne-	DISABLE_WALLJUMP
rlwinm. r0,r3,0,30,30	# load second bit
beq-	CHECK_LEDGE_REGRAB
fcmpo	cr0,f1,f0	# compare x coord frame delta, etc
bgt-	END		# if less than, check to reset wallride timer to allow walljumping
lbz	r4,0x210c(r31)	# load wallride timer
cmpwi	r4,0xfe		# 
bne-	END
li	r4,0
stb	r4,0x210c(r31)	# store 0 into wallride timer
stfs	f31,0x2110(r31) # store -1 or 1 (whichever  side wall is on)

CHECK_LEDGE_REGRAB:
rlwinm. r0,r3,0,29,29	# load third bit
bne-	END
lwz	r4,0x2064(r31)	# load ledge regrab disable timer
cmpwi	r4,0x1a		# dont walljump for first four frames after letting go
ble-	END


DISABLE_WALLJUMP:
li	r3,0xFE		# load 254 as wallride timer to not walljump
b	END_END

END:
lbz	r3,0x210c(r31)	# load wallride timer
END_END:

C208183C 0000000E
887F0856 C1E289AC
FC0FF840 41820008
887F086A 2C030000
41820050 546007FF
40820040 546007BD
41820024 FC010040
4181001C 889F210C
2C0400FE 40820010
38800000 989F210C
D3FF2110 5460077B
41820018 809F2064
2C04001A 4081000C
386000FE 48000008
887F210C 00000000


-------------------
12/8/15 - updated
- needed to make an exception for Mario's Up-B [walljump, tech] otherwise,the code changes the timing for the technique and makes it much easier


lwz	r3,0x4(r31)	#load internal char ID
cmpwi	r3,0		# is Mario?
bne-	CONTINUE
lwz	r3,0x10(r31)	#load action state
cmpwi	r3,0x15c	# up-b?
beq-	END

CONTINUE:

lbz r3,2134(r31)
lfs f15,-30292(r2)
fcmpo cr0,f15,f31
beq- 0x08
lbz r3,2154(r31)
cmpwi r3,0
beq- 0x50
rlwinm. r0,r3,0,31,31
bne- 0x40
rlwinm. r0,r3,0,30,30
beq- 0x24
fcmpo cr0,f1,f0
bgt- 0x1C
lbz r4,8460(r31)
cmpwi r4,254
bne- 0x10
li r4,0
stb r4,8460(r31)
stfs f31,8464(r31)
rlwinm. r0,r3,0,29,29
beq- 0x18
lwz r4,8292(r31)
cmpwi r4,26
ble- 0x0C
li r3,254
b 0x08
END:
lbz r3,8460(r31)



*************************************
* Reduce Dream Land 64 Music Volume *
*************************************
- Dan Salvato

inject @ 80023FFC

li r4,127	# default code line, 127 volume
lwz r5,44(r1)	# load HPS ID
cmpwi r5,58	# is Dreamland?
bne- 0x08
li r4,96	# reduce volume

C2023FFC 00000003
3880007F 80A1002C
2C05003A 40820008
38800060 00000000



*******************
* HomeRun Contest *
*******************

80180af4 - load P2 offset that is used for the on-screen distance counter

8021ea30 - count P2 distance, I think
- branched into from 8021d738

80180cfc	cmpwi r0,60
- untested, but I think this is the min distance required to start the distance counter.

80180f70 - comparison for if distance is greater than 9999.9, I think. (to set it as max of 9999.9)

P2 Live Input DI's for Sanbag
8008e5c8 - in DI trajec function

lfs	f1,-0x750c(rtoc)
lwz	r4,0x4(r31)
cmpwi	r4,0x20		# is player sandbag
bne-	END
lis	r15,0x804c
lwz	r4,0x2010(r15)	# load P2 system live X
stw	r4,0x620(r31)
lwz	r4,0x2014(r15)	# load P2 system live Y
stw	r4,0x624(r31)
END:

------------

801b9ab0 li r5,10	# 10 second timer for HRC


************************************
* Yoshi Aerial Jump - Random Notes *
************************************

800cbfac
- loads float @ 0x8 from start of special move offsets
- stores it at 0x18b4 in data offset (super armor resistance?)

loads float at 0x4 (0.3), then negates it. multiplies facing direction by x control stick value.

**********************************
* No DI on Uthrow for Prince Abu *
**********************************

8008e5cc
lwz	r15,0x10(r3)
cmpwi	r15,0x5A
bne-	END
lbz	r15,0xc(r3)
cmpwi	r15,1
bne-	END
li	r15,0
stw	r15,0x620(r3)
stw	r15,0x624(r3)
END:
lfs	f3,0x620(r3)

******************************************
* Fall Instead of Warp In at Match Start *
******************************************

In AllocateAndInitPlayer

8006932C	bl (0x800357c8)
		output = 1 = use "Entry"
		output = 0 = "Fall"
80069330	cmpwi	r3,0

Giga-Bowser requires "Fall" or else the game freezes.


Always Fall Instead of Warp
04069334 48000010

Bowser and Sandbag Fall Instead of Warp Entry
inject @ 80069328
	- AllocateAndInitPlayer function

lwz r3,4(r30)	# load internal char ID
cmpwi r3,0x1f	# Giga-Bowser?
beq- FALL
cmpwi r3,0x20	# Sandbag?
bne- WARP
FALL:
lis r3,0x8006	# branch back to inject function, and enter Fall
ori r3,r3,0x9350
mtlr r3
blrl
WARP:
lbz r3,0xc(r30)	# default code line, load port number



*********************
* Memory Card Again *
*********************
Disable memory card saving
80433320 = if set to 00000004, then memory card saving seems to be disabled



8001a4cc  MemoryCard_FindFiles (as defined by wParam)

Line 8001a548 might be checking to see a memory card is even in use?

Filename is 20 bytes long, padded with zeros.


3b2b20 is doing weird stuff w/ mem card data. Maybe encrypting?

3b2fe8 -> bl to 0x803b2e04....maybe encrypting as well?


*803b2ff8	stb	r3,0(r31)
- storing "encrypted" bytes RAM, these bytes are the ones located at 0x2040 in the .gci memory card file.
	- 0x2060 is character unlock bits start

*************************************
* D Pad Down for Entry Action State *
*************************************

Testing

inject @ 6b80c

lwz	r3,0x2c(r30)
lwz	r0,0x668(r3)
cmpwi	r0,0x4
bne-	END
LOOP:
lwz	r3,0x2c(r30)
lwz	r0,0x10(r3)
cmpwi	r0,0xb
beq-	COMPARE

li	r0,0
stw	r0,0x80(r3)
stw	r0,0x84(r3)
stw	r0,0xec(r3)
stw	r0,0xb0(r3)
stw	r0,0x6f4(r3)
lis	r0,0x4200
stw	r0,0xb4(r3)
stw	r0,0x6f8(r3)
lwz	r0,4(r3)
cmpwi	r0,0xb
beq-	COMPARE
lwz	r12,0x1a58(r3)
cmpwi	r12,0
beq-	CONTINUE
mr	r3,r12
li	r12,0
stw	r12,0x1aac(r3)
lis	r12,0x800d
ori	r12,r12,0xb908
mtlr	r12
blrl

CONTINUE:
mr	r3,r30
lis	r12,0x800c
ori	r12,r12,0x61b0
mtlr	r12
blrl
COMPARE:
lwz	r3,0x8(r30)
cmpwi	r3,0
beq-	END
mr	r30,r3
b LOOP	
END:
lwz	r0,0x7c(sp)

-------------------

D-Pad Down to Rebirth Test

lwz	r3,0x2c(r30)
lwz	r0,0x668(r3)
cmpwi	r0,0x4
bne-	END
LOOP:
lwz	r3,0x2c(r30)


lwz	r12,0x1a58(r3)
cmpwi	r12,0
beq-	CONTINUE
mr	r3,r12
li	r12,0
stw	r12,0x1aac(r3)
lis	r12,0x800d
ori	r12,r12,0xb908
mtlr	r12
blrl

CONTINUE:
mr	r3,r30
lis	r12,0x800b
ori	r12,r12,0xfd9c	#sleep
mtlr	r12
blrl

mr	r3,r30
lis	r12,0x800d
ori	r12,r12,0x4ff4	#rebirth
mtlr	r12
blrl
COMPARE:
lwz	r3,0x8(r30)
cmpwi	r3,0
beq-	END
mr	r30,r3
b LOOP	
END:
lwz	r0,0x7c(sp)

--------------

*************************
* Chess Melee Revisited *
*************************

----------------------

NEW! (4/10/16)
Freeze All Players Upon Death

inject @ 8003dfdc - lwz r0,0x1c(sp)
- injected upon any death, after placing char in death action state
- executed before subtracting a stock loss
- can use r3,r4,r5
- r31 = port of dying player

INTERNAL_OFFSET_LOAD:	# 20XX 4.06 bug fix
lwz	r30,0x10(sp)	# load entity start of player dying
lwz r31,0(r30)
rlwinm. r31,r31,0,0,0	# check if this is a pointer
bne- INTERNAL_OFFSET_LOAD_END
lwz	r30,0x2c(r30)
INTERNAL_OFFSET_LOAD_END:

#20XX Check
lis	r31,0x8048
lbz	r31,-0x62D0(r31)# load menu controller major
cmpwi	r31,0x10	# is this super sudden death (chess Melee)
bne-	DEFAULT

li	r3,0
lbz	r0,0x2219(r30)
rlwimi	r0,r3,0,31,31 #= (00000001)
rlwimi	r0,r3,1,30,30 #= (00000002)
rlwimi	r0,r3,2,29,29 #= (00000004)
stb	r0,0x2219(r30)	# unfreeze this char (incase two deaths on same frame)

NANA_CHECK:
lbz	r4,0x221f(r30)
rlwinm. r4,r4,29,31,31	# (00000008) = secondary char
bne-	DEFAULT
lwz	r3,-0x3e74(r13)
lwz	r3,0x20(r3) 	# should get you the first player who was created

FREEZE_LOOP_START:
lwz	r4,0x2c(r3)	# load internal data offset
#cmpwi	r4,r30	# don't freeze player who is dying
#beq-	COMPARE
lwz	r5,0x10(r4)	# load action state
cmpwi	r5,0xd
blt-	COMPARE	# if rebirthing, dying, sleep...don't freeze

li	r5,7
stb	r5,0x2219(r4)	# freeze char

COMPARE:
lwz	r3,8(r3)	# load next player entity pointer
cmpwi	r3,0	# is this the last player?
bne-	FREEZE_LOOP_START


CHECK_STOCK_MODE:
lis	r3,0x8016
ori	r3,r3,0xb094	# load function to check if Stock mode
mtlr	r3
blrl
cmpwi	r3,0
beq-	END_CHESS

CHECK_ZERO_LIVES:	# if player dying is on last stock, rebirth all immediately
lbz	r31,0xc(r30)	#load port number
mulli	r31,r31,0xe90
lis	r4,0x8045
ori	r4,r4,0x310e	# player 1 stock address
lbzx	r4,r4,r31
cmpwi	r4,1		# does this player have 1 life remaining? (about to be zero)
bgt-	END_CHESS
lis	r4,0x8000
ori	r4,r4,0x3d40	# rebirth all players
mtlr	r4
blrl
END_CHESS:			

DEFAULT:
lwz r0,0x1c(sp)	# default code line



-------------------
All Players Rebirth Upon Any Char Rebirthing
NEW (4/11/16)

inject @ 80032144 - mr r3,r30
- within function to cause rebirths
- does not get executed if a secondary character dies!
- player that died has already been rebirthed (if main char death, secondary as is already rebirthed as well)

lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major
cmpwi	r3,0x10		# is this super sudden death (chess Melee)
bne-	END
REBIRTH:
lis	r3,0x8000
ori	r3,r3,0x3d40	# custom rebirth all function start
mtlr	r3
blrl

END:
mr	r3,r30


*****************************************
* Rebirth All Players - Custom Function *
*****************************************

Rebirth All Players - Custom Function
- does not affect players currently in a death or Rebirth or Sleep action state
- no function inputs
- branch link into this function
- saves and restores r20-r31
- uses and overwrites r3 and probs other inputs registers 
- save r3, etc. to forward stack space before branching into this function if needed.



NEW (4/11/16)

Rebirth All Players

FUNCTION_START:
mflr	r0
stw	r0,-4(r1)
stwu	r1,-60(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack

GET_FIRST_CREATED_PLAYER:
lwz	r3,-0x3e74(r13)
lwz	r30,0x20(r3) 	# should get you the first player who was created

LOOP_START:		# come here with r30 = entity struct start
lwz	r4,0x2c(r30)	# load internal offset
lwz	r20,0x10(r4)	# load action state
cmpwi	r20,0xD		# is char dying or in sleep/rebirth?
blt-	COMPARE

GRAB_CHECK:		# so char models dont "stick"
mr	r3,r30
lwz	r20,0x1A58(r4)	# is player in some grab state?
cmpwi	r20,0
beq-	CONTINUE

lbz	r21,0x221B(r4)
andi.	r21,r21,0x4
beq-	THIS_PLAYER_BEING_GRABBED

mr	r3,r20
THIS_PLAYER_BEING_GRABBED:
li	r20,0
lwz	r21,0x2c(r3)
stw	r20,0x1a4c(r21)	# store zero to breakout counter
lis	r20,0x800d
ori	r20,r20,0xb908
mtlr	r20
blrl

CONTINUE:
mr	r3,r30
lis	r20,0x800d
ori	r20,r20,0x331c	# Death_RemoveItems(and GFX)
mtlr	r20
blrl

mr	r3,r30
lis	r20,0x800b
ori	r20,r20,0xfd9c	#sleep
mtlr	r20
blrl

mr	r3,r30
lis	r20,0x800d
ori	r20,r20,0x4ff4	#rebirth
mtlr	r20
blrl
COMPARE:
lwz	r30,0x8(r30)
cmpwi	r30,0
bne-	LOOP_START


END:
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,60	# release the space
lwz	r0,-4(r1)
mtlr	r0
blr

-------------------

10/30/16
This one works too and doesn't need any checks for grabs

mflr	r0
stw	r0,-4(r1)
stwu	r1,-60(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack

GET_FIRST_CREATED_PLAYER:
lwz	r3,-0x3e74(r13)
lwz	r30,0x20(r3) 	# should get you the first player who was created

LOOP_START:		# come here with r30 = entity struct start
lwz	r4,0x2c(r30)	# load internal offset
lwz	r20,0x10(r4)	# load action state
cmpwi	r20,0xD		# is char dying or in sleep/rebirth?
blt-	COMPARE


mr	r3,r30
lis	r20,0x800d
ori	r20,r20,0x4f24	#sleep
mtlr	r20
li r4,1
blrl
lwz r3,0x2c(r30)
lis	r20,0x8007
ori	r20,r20,0xed2c	#sleep
mtlr	r20
blrl

lwz r3,0x2c(r30)
lbz r4,0x221f(r3)
lbz r3,0xc(r3)
rlwinm r4,r4,29,31,31
lis	r20,0x8016
ori	r20,r20,0x7320	#DeathAfterSleep (needed for rebirth to be normal)
mtlr	r20
blrl


mr	r3,r30
lis	r20,0x800d
ori	r20,r20,0x4ff4	#rebirth
mtlr	r20
blrl
COMPARE:
lwz	r30,0x8(r30)
cmpwi	r30,0
bne-	LOOP_START


END:
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,60	# release the space
lwz	r0,-4(r1)
mtlr	r0
blr

******************
* Dual 1v1 Stuff *
******************

Dual 1v1 New Portion
Part 2:

INGAME: IF NUMBER OF PLAYERS LEFT = 2, SWITCH FF ON
Injection Code @ 8016c094


#20XX first portion

lis	r14,0x8048
lbz	r14,-0x62D0(r14)#load menu controller major
cmpwi	r14,0x1e	#is this mode giant melee?
bne-	DEFAULT


sub	r0,r29,r31      # subtract number of dead players from total number of players
cmpwi	r0,3           # if 3 or more alive, ignore custom code
bge- DEFAULT
lis	r14,0x8047
lbz	r0,-0x2497(r14) # load ingame FF
cmpwi	r0,1		# if already ran through below code, skip
beq-	DEFAULT
li	r0,1
stb	r0,-0x2497(r14) # turn ingame FF to on at 8046db69

li	r30,0		# player index
li	r15,0xFF	# flag to know to store Team ID here or r16
li	r20,0xFF	# flag to know to store Player ID here or r16
lis	r22,0x8045
ori	r22,r22,0x310e	# P1 stock location
TEAM_ID_LOOP:
mulli	r4,r30,0xe90
lbzx	r3,r4,r22
cmpwi	r3,0		# 0 stock remaining?
beq-	COMPARE		# only care about characters not dead
add	r3,r4,r22
lwz	r3,-0x86(r3)	# load slot type
cmpwi	r3,3
beq-	COMPARE

cmpwi	r20,0xff
bne-	STORE_SECOND_PLAYER_ID
mr	r20,r30
b	GOTO_TEAMID
STORE_SECOND_PLAYER_ID:
mr	r21,r30

GOTO_TEAMID:

add	r3,r4,r22
lbz	r3,-0x47(r3)	# load Team ID

cmpwi	r15,0xFF
bne-	TEAM_TWO
mr	r15,r3		# r15 = Team ID of first alive player
b 	COMPARE
TEAM_TWO:
mr	r16,r3		# r16 = Team ID of second alive player


COMPARE:
addi	r30,r30,1	# add 1 to player index
cmpwi	r30,6		# gone through all players?
blt-	TEAM_ID_LOOP

cmpw	r15,r16		# compare Team IDs of alive players
beq-	DEFAULT		# if they are equal, ignore rebirthing

#remaining characters on different teams...Rebirth them!
#use custom rebirth function and set stocks based on debug menu item

lis	r15,0x8000
ori	r15,r15,0x3d40	# custom rebirth function start
mtlr	r15
blrl

lis	r15,0x8040
lwz	r15,-0x5C70(r15)# load Dual 1v1 stock flag
cmpwi	r15,0		# 0 is do not modify stocks
beq-	DEFAULT

mulli	r20,r20,0xe90
mulli	r21,r21,0xe90
stbx	r15,r20,r22
stbx	r15,r21,r22


DEFAULT:
subi r0,r29,1      #default line


*********************************
* Debug Menu Line Item Research *
*********************************

Doing research on the actual functions that look at the debug menu items

8030304c	lwz	r0,0(r29)	# load debug menu item type


Modify Default Length of Debug Menu Floating Point Values
0x430a57 (4d5a37 RAM) --- 32 (2 dec places) -> 35 (5 dec places)

that was fast....

DISABLE DEFAULT 

**************************
* Analog Shield Research *
**************************

0x8c = 140 = increment

This is correct.
The game pulls the L/R analog byte, gives it a max limit of 0x8C = 140, and divides the result by 140. So the resolution of the L/R slider (1/140), in reference to what the game reads, is much higher than the joystick (1/80).
1.00 is hard shield.
L/R analog dead zone is anything less than or equal to 0.30 = 42/140.

**************************************
* Debug Menu Floating Point Research *
**************************************

80303e84	blrl
- this gets executed when hitting B on a line item that contains a function
- it blrl's into that specified function

Disable B Button Function Presses
04303e70 48000048

0x4d5a34 (RAM), specifically 4d5a37, is the C code that says how many decimal places to display with a Debug Menu floating point number. Default is 2.
	- although, it works in most of my menus and not all of them...

Function 80324044. Input (r5) should be a pointer to the C code

**********************************
* 20XX Disable Vanilla GFX/Auras *
**********************************
NOTE: Not in the 20XX hack pack anymore

800bffd0 ApplyBodyAura


lis	r6,0x803f
ori	r6,r6,0xa494	# 20xx P1 color overlay on/off
lwz	r7,-0x1a4(r6)	# 3fa2f0 = vanilla overlays on/off flag
cmpwi	r7,0
beq-	END
lbz	r7,0xc(r3)	# load port number
mulli	r7,r7,0x4
lwzx	r7,r7,r6	# load this player's color flag
cmpwi	r7,1
beqlr
END:
mflr	r0

****************
* SdStRoll.dat *
****************

0x11e7d

= Characters©Nintendo/HAL Laboratory, Inc./

but also further down in file a couple times...

*********************************
* Debug Menu Line Item Research *
*********************************

80301e08	DebugMenu_CreditsGameStart

0x05 = Results Screen (cannot press start)
0x08 = "Coming Soon" screen (600x480 _9 texture)
0x09 = Continue? Screen
0x0A = challenger approaching
0x0B = Results screen (can press start)
0x0C = Plays intro video
0x0D = Memory Card overwrite confirmation
0x0E = credits shooting game start

***********************************
* Coming Soon (Debug Menu Screen) *
***********************************

IfComSn.dat
(there is also a .usd but I don't think it is used)
RAM offset for filename text start: 803da488

Texture Offsets

WALLPAPER:
0x700


COMING:
0x4b020 to 0x51020 (doesn't include this byte)

SOON:
0x46e20


IfComSn.dat

For 20XX, the new debug menu line item will be

00000001 80301e08 XXXXXXXX 00000000
00000000 000000YY 000000ZZ 00000000

YY = screen ID
ZZ = ASCII byte for IfComS_.dat

------------------

When viewing the Coming Soon texture, it's file contents are loaded to 80bdcaa0.


***************************
* Debug Menu Line Tracker *
***************************

Main Menu Line Tracker
- bring the active line back to the menu that was previously opened
- inject every frame in debug menu
- 3bce10 in MnSlChr currently.

3fa3dc = flag values
XXYY0000

XX = Main menu line tracker
(00000040) = do not update
(00000080) = click A
- will automatically go to saved line item if not contain 40

YY = Submenu line item tracker
(00000040) = go to that line item next time
(00000080) = click A


inject @ 3039a8
lis	r14,0x80bd
ori	r14,r14,0xcd40
lwz	r15,0x8(r14)
lis	r16,0x803f
ori	r16,r16,0xa4e0
cmpw	r15,r16
bne-	NOT_MAIN_MENU

MAIN_MENU:

lbz	r15,-0x104(r16) #grab line item from previously opened menu 
rlwinm.	r8,r15,0,25,25	# contain (00000040)?
bne-	SKIP
rlwinm	r8,r15,0,26,31	# load line bytes (0000003f)
stb	r8,0(r14)
rlwinm.	r8,r15,0,24,24	# contain (00000080)?
beq-	CONTINUE
li	r15,0x0100	# load A button
lis	r8,0x804c
stw	r15,0x20c4(r8)	# store A button to P1
CONTINUE:
li	r15,0x40
stb	r15,-0x104(r16)
b	SKIP

NOT_MAIN_MENU:
lwz r15,0x18(r14)
cmpwi r15,0
bne- SUB_SUBMENU

lbz	r15,-0x103(r16) # load secondary line item
rlwinm.	r8,r15,0,25,25	# contain (00000040)?
beq-	REG_NOT_MAIN
rlwinm	r8,r15,0,26,31	# load line bytes (0000003f)
stb	r8,0(r14)
rlwinm.	r8,r15,0,24,24	# contain (00000080)?
beq-	CONTINUE
li	r15,0x0100	# load A button
lis	r8,0x804c
stw	r15,0x20c4(r8)	# store A button to P1
CONTINUE:
REG_NOT_MAIN:
lbz	r8,0(r14)	# load current line number
stb	r8,-0x103(r16)	# store current line number
b END

SUB_SUBMENU:
mr r14,r15
lbz	r15,-0x102(r16) # load 3rd line item
rlwinm.	r8,r15,0,25,25	# contain (00000040)?
beq-	BUTTON_PRESS_END
rlwinm	r8,r15,0,26,31	# load line bytes (0000003f)
stb	r8,0(r14)
rlwinm.	r8,r15,0,24,24	# contain (00000080)?
beq-	BUTTON_PRESS_END
li	r15,0x0100	# load A button
lis	r8,0x804c
stw	r15,0x20c4(r8)	# store A button to P1
BUTTON_PRESS_END:
lbz	r8,0(r14)	# load current line number
stb	r8,-0x102(r16)	# store current line number
b END

END:
SKIP:
# default line
li r8,0


*************************************************
* "Coming Soon" and other Debug Menu Subscreens *
*************************************************

80301e08	function start
- r4 = start of this debug menu line item data
		this address should also be stored at -0x4858(r13)
For 20XX

inject @ 80301e24
li	r3,1
lis	r4,0x8040
lbz	r0,-0x5C24(r4)	# load main menu line item
rlwimi	r0,r3,7,24,24	# add (00000080)
stb	r0,-0x5C24(r4)	# flag to go to line item and press A
lbz	r0,-0x5C23(r4)	# load main menu line item
rlwimi r0,r3,6,25,25	# add (00000040)
stb	r0,-0x5C23(r4)	# 
lis	r3,0x80bd
ori	r3,r3,0xcd40
lwz r3,0x18(r3)
cmpwi r3,0
beq- SUBMENU_END
li r3,1
rlwimi	r0,r3,7,24,24	# add (00000080)
stb	r0,-0x5C23(r4)	# flag to go to line item
lbz	r0,-0x5C22(r4)	# load main menu line item
rlwimi r0,r3,6,25,25	# add (00000040)
stb	r0,-0x5C22(r4)	# 
SUBMENU_END:
lwz	r3,-0x4858(r13)	# load start of current line item
lwz	r3,0x18(r3)	# load ASCII halfword to store to Coming Soon
lis	r4,0x803e
sth	r3,-0x5B73(r4)	# store ASCII halfword

lwz	r4,-0x4858(r13)	# load start of current line item
lwz	r3,0x14(r4)	# load menu ID to progress to

********************************************
* USmash Interrupt During Interrupt_AS_Run *
********************************************

8008c830 Interrupt_UpSmash

r3 = external data offset start

8008ca888

lis	r3,0x8008
ori	r3,r3,0xc830
mtlr	r3
mr	r3,r30
blrl
cmpwi	r3,0
lis	r3,0x800c
ori	r3,r3,0xa944
mtctr	r3
beq-	END
bctr
END:
mr	r3,r30

*****************************************************
* Brinstar Escape - Stop Camera from Focusing on P1 *
*****************************************************

0420b42c 4e800020

-------

Brinstar Escape - Disable P1 Focus/Screen Rumble outside of Adventure Mode
inject @ 8020b42c

lis	r4,0x8048
lbz	r4,-0x62D0(r4)# load menu controller major
cmpwi	r4,0x4		# is this adventure mode?
beq-	DEFAULT

REG_CAMERA:
blr	# skip this function

DEFAULT:
mflr r0

************************************************************
* Home Run Contest (HRC) - Stop Camera from Focusing on P2 *
************************************************************

Home Run Contest (HRC) - Stop Camera from Focusing on P2
0421d680 4e800020




Home Run Contest - Disable P2 Camera Focus and Update Camera Values for VS Mode
- inject @ 8021d680 - mflr r0
- beginning of HRC_Camera_P2Focus

lis	r4,0x8048
lbz	r4,-0x62D0(r4)# load menu controller major
cmpwi	r4,0x20		# is this homerun contest?
beq-	DEFAULT

ADJUST_CAMERA_VALUES:
lis	r4,0x8049
ori	r4,r4,0xe6c8	# load stage info start
lis	r5,0xc120	# -10.00
stw	r5,0x1c(r4)	# -10 vertical tilt
li	r5,0
stw	r5,0x20(r4)	#  0 tilt about y axis
lis	r5,0x3dcc
ori	r5,r5,0xcccd	# 0.1 tilt about x axis
stw	r5,0x24(r4)	#  
lis	r5,0x3fc0
stw	r5,0x28(r4)
stw	r5,0x2c(r4)
stw	r5,0x30(r4)
	
REG_CAMERA:
blr	# skip this function

DEFAULT:
mflr r0

*************************
* CPU Teching Revisited *
*************************

80090184
- function contains branches to interrupts for tech roll and neutral tech

20XX 4.0... I need to make options (%'s) for all the tech options.

The order the game checks is
1) Tech roll left/right
2) Tech in place


***TECH FORWARD / BACKWARD
80098948 - cmpwi r3,0
- in function Interrupt_TechRoll (right after checking L/R byte)

lwz	r17,0x4(r31)	# load internal char ID
cmpwi	r17,0x20	# sandbag?
beq-	END
cmpwi	r17,0xb		# Nana?
beq-	END

lis	r17,0x8040
lwz	r15,-0x51D8(r17)# load debug flag @ 3fae28
cmpwi	r15,0		# is custom CPU tech % off?
beq-	END

lbz	r15,0xc(r31)	# load port ID
mulli	r15,r15,0xe90
lis	r16,0x8045
ori	r16,r16,0x3088	# P1 port type
lwzx	r15,r15,r16
cmpwi	r15,0		# is player human?
beq-	END

TECH_ROLL_FORWARD:	# Action state: 200
lis	r3,0x8038
ori	r3,r3,0x0580	# load random function
mtlr	r3
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51D4(r17)# load tech forward %
cmpw	r3,r15		# compare RNG value to tech %
bgt-	TECH_ROLL_BACKWARD

lis	r3,0x8009
ori	r3,r3,0x8998
mtctr	r3
bctr

TECH_ROLL_BACKWARD:	# Action state: 201
lis	r3,0x8038
ori	r3,r3,0x0580	# load random function
mtlr	r3
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51D0(r17)# load tech backward %
cmpw	r3,r15		# compare RNG value to tech %
bgt-	TECH_END

lis	r3,0x8009
ori	r3,r3,0x89a0
mtctr	r3
bctr

TECH_END:
lis	r3,0x8009
ori	r3,r3,0x89b8
mtctr	r3
bctr			# branch to "failed to tech roll"

END:
cmpwi	r3,0

----------------

**NEUTRAL TECH (TECH IN PLACE)
inject @ 80098754 - lbz	r3,0x680(r31)

lwz	r17,0x4(r31)	# load internal char ID
cmpwi	r17,0x20	# sandbag?
beq-	END
cmpwi	r17,0xb		# Nana?
beq-	END

lis	r17,0x8040
lwz	r15,-0x51D8(r17)# load debug flag @ 3fae28
cmpwi	r15,0		# is custom CPU tech % off?
beq-	END

lbz	r15,0xc(r31)	# load port ID
mulli	r15,r15,0xe90
lis	r16,0x8045
ori	r16,r16,0x3088	# P1 port type
lwzx	r15,r15,r16
cmpwi	r15,0		# is player human?
beq-	END

TECH_IN_PLACE:
lis	r3,0x8038
ori	r3,r3,0x0580	# load random function
mtlr	r3
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51CC(r17)# load tech in place %
cmpw	r3,r15		# compare RNG value to tech %
bgt-	NO_TECH_IN_PLACE

lis	r3,0x8009
ori	r3,r3,0x87a4	# execute tech in place
mtctr	r3
bctr

NO_TECH_IN_PLACE:
lis	r3,0x8009
ori	r3,r3,0x87b4	# do not tech in place
mtctr	r3
bctr

END:
lbz	r3,0x680(r31)



***********************************
* Action State Hack - Dan Salvato *
***********************************
- I am going to modify this to only look for a halfword ID rather than full word.
- keeps other bytes available for flags

load at line 8006B808


lhz r31,0x22(r24)
cmpwi r31,0
bne 0xC
blrl
b 0x30
cmpwi r31,0
bgt 0x10
mtlr r31
blrl
b 0x1C
mr r4,r31
lis r31, 0x8008
ori r31,r31,0xCFAC
mtlr r31
blrl
li r31,0
sth r31,0x22(r24)
stw r31,0x24(r24)



PART 2

Load at line 800693AC

mflr r0
lwz r14,0x24(r3)
cmpwi r14,0
beq 0x10
lfs f1,0x24(r3)
li r14,0
stw r14,0x24(r3)

**********************
* On-Screen Percents *
**********************
damage display, HUD percent
802f6508
- deals with creating on screen huds for each player

-0x4940(r13) = number of  percents to show

Can nop lines at the beginning to make percents show for all players even when not in-game!!

***********************************
* CSS B Press Holding Cursor Puck *
***********************************

8025fe44 - lbz r0,0x70(r3)
- loads last selected player to bring the cursor back to them.

Check to Make Sure Player is Available before Returning Puck

inject @ 8025fe50 - bge- 0x8026007c
- this line disables bringing the puck back to any char with an external ID greater than or equal to 0x1A (Master Hand)
- r4 = char last select (external ID)
	- can't be anything greater than 
- r30 = 3f0a48
So...let's change this to work for any character, but just check to make sure that they are available as selectable in the first place (since I know how to change that)

addi	r3,r30,0xc1	# get to 3f0b09
li	r6,0

CHAR_CHECK_LOOP:
addi	r6,r6,1
cmpwi	r6,25
beq-	CHAR_NOT_AVAILABLE
lbzu	r8,0x1c(r3)
cmpw	r8,r4
beq-	END
b	CHAR_CHECK_LOOP


CHAR_NOT_AVAILABLE:
lis	r3,0x8026
ori	r3,r3,0x007c
mtctr	r3
bctr

END:


*****************
* Announcer SFX *
*****************

Add in fighting wire frame announcments

1) nop RAM address 80168c6c

2)

inject @ 80168c70

cmpwi	r3,0x21
bge-	NO_SOUND
cmpwi	r3,0x20
beq-	POPO
cmpwi	r3,0x1f
beq-	SANDBAG
cmpwi	r3,0x1e
beq-	CRAZYHAND
cmpwi	r3,0x1b
beq-	WIREFRAME
cmpwi	r3,0x1c
bne-	DEFAULT

WIREFRAME:
lis	r3,0x0007
ori	r3,r3,0xc833	# "fighting wire frames"
PLAY:
lis	r4,0x8016
ori	r4,r4,0x8c90
mtctr	r4
bctr

POPO:
lis	r3,0x0007
ori	r3,r3,0xc83b	# "ice climbers"
b	PLAY

SANDBAG:
li	r3,0x7531	# "home-run contest"
b	PLAY

CRAZYHAND:
lis	r3,0x0007
ori	r3,r3,0xc849	# "masterhand" sfx
b	PLAY

NO_SOUND:
lis	r4,0x8016
ori	r4,r4,0x8e44	# branch to end of function
mtctr	r4
bctr

DEFAULT:
lis	r4,0x803d	# default code line

****************************************
* D-Pad Down for Rumble Options at CSS *
****************************************
inject@
80263250
- r7 = all player's instant button inputs or'ed together


RUMBLE:
lis	r4,0x8040
lwz	r4,-0x5D04(r4)	# load debug flag for d-pad rumble
cmpwi	r4,0		# is flag OFF?
beq-	DEFAULT


lis	r4,0x8048
lbz	r4,-0x62D0(r4)# load menu controller major
cmpwi	r4,0x2		# is this vs Melee?
bne-	DEFAULT

rlwinm. r0,r7,0,29,29	#d-pad down pressed?
beq-	DEFAULT
lis	r4,0x803f
li	r3,1
stb	r3,0x0a47(r4)	#set rumble screen flag value

li	r3,2
stb	r3,-0x49aa(r13)	#go back to menu

DEFAULT:
lbz	r0,-0x49ae(r13)	# default code line

----->

Old MCM code:


D-Pad Down at CSS for Rumble Options
- only works at Melee Vs. CSS
[Achilles]
Version -- DOL Offset ------ Hex to Replace ---------- ASM Code
1.02 ----- 0x80263250 --- 880DB652 -> Branch

3C808040 8084A2FC
2C040000 41820030
3C808048 88849D30
2C040002 40820020
54E0077B 41820018
3C80803F 38600001
98640A47 38600002
986DB656 880DB652
48000000


1.02 ----- 0x8022D594 --- 7C0802A6 -> Branch

3C80803F 88840A47
2C040001 40820014
3C808022 6084D104
7C8903A6 4E800420
7C0802A6 48000000


1.02 ----- 0x8022D134 --- 907C000C -> Branch

3FE0803F 889F0A47
2C040001 40820010
38800002 989F0A47
38600210 907C000C
48000000


1.02 ----- 0x8022D104 --- 7C0802A6 -> Branch

3C80803F 88840A47
2C040002 40820014
3C808022 6084D594
7C8903A6 4E800420
7C0802A6 48000000


1.02 ----- 0x8022D5B8 --- 907D000C -> Branch

3FE0803F 889F0A47
2C040002 40820010
38800000 989F0A47
38600210 907D000C
48000000




	-==-

------------


Pressing the NTSC/PAL icon on CSS Loads Rumble Screen
inject @ 80261a3c
- specifically for 20XX 4.06+
- D-Pad Down was changed to showing the analog inputs

Y:
lfs	f1,0x10(r31)	# load cursor Y
lis	r5,0x41b2	# load 22.25
stw	r5,0x20(r2)
lfs	f0,0x20(r2)
fcmpo	cr0,f1,f0
blt-	END

X:
lfs	f1,0xc(r31)	# load cursor X
lis	r5,0xc1a4	# load -20.5
stw	r5,0x20(r2)
lfs	f0,0x20(r2)
fcmpo	cr0,f1,f0
bgt-	END
lis	r5,0xc1cc	# load -25.5
stw	r5,0x20(r2)
lfs	f0,0x20(r2)
fcmpo	cr0,f1,f0
blt-	END
GOTO_RUMBLE:
lis	r5,0x8048
lbz	r5,-0x62D0(r5)# load menu controller major
cmpwi	r5,0x2		# is this vs Melee?
bne-	END

lis	r5,0x803f
li	r3,1
stb	r3,0x0a47(r5)	#set rumble screen flag value

li	r3,2
stb	r3,-0x49aa(r13)	#go back to menu

END:
lfs f1,0xc(r31)	# default line

*****************
* Getup Options *
*****************

Frame Perfect Options

inject @ 80097de0 - mr r3,r31

lwz	r15,0x64(r31)	# load internal ID
cmpwi	r15,0xb		# is this nana?
beq-	END
cmpwi	r15,0x20	# is Sandbag?
beq-	END

lis	r17,0x8040
lwz	r15,-0x51C8(r17)# load debug flag @ 3fae28
cmpwi	r15,0		# is custom CPU getup off?
beq-	END

lbz	r15,0x6c(r31)	# load port ID
mulli	r15,r15,0xe90
lis	r16,0x8045
ori	r16,r16,0x3088	# P1 port type
lwzx	r15,r15,r16
cmpwi	r15,0		# is player human?
beq-	END

GETUP_CHECK_FRAME_PERFECT:

lis	r14,0x8038
ori	r14,r14,0x0580	# load random function
mtlr	r14
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51C4(r17)# load frame perfect % chance
cmpw	r3,r15		# compare RNG value to tech %
bgt-	NO_FRAME_PERFECT

EXECUTE_FRAME_PERFECT:
STANDUP: #############
mtlr	r14		# load random function
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51BC(r17) # load standup % chance
cmpw	r3,r15		# compare RNG value to tech %
bgt-	GETUP_ROLL_FORWARD
lwz	r15,0x70(r31)	# load action state
cmpwi	r15,0xb7	# is downboundu?
bne-	0xc
li	r15,0xb8
stw	r15,0x70(r31)	# store downwaitU as action state
#so that downstandu happens (based on the checks)

lis	r15,0x8000	# load L/R button press
stw	r15,0x6c8(r31)	# store L/R button press
lis	r15,0x8009
ori	r15,r15,0x80bc	# load Interrupt_DownStandU/D
mtlr	r15
mr	r3,r31
blrl
b	END_EXECUTE_FP_ACTION_STATE

GETUP_ROLL_FORWARD: #############
mtlr	r14		# load random function
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51B8(r17) # load getup roll F % chance
cmpw	r3,r15		# compare RNG value to tech %
bgt-	GETUP_ROLL_BACKWARD

lwz	r15,0x8c(r31)	# load facing direction
stw	r15,0x680(r31)	# store direction as x-axis joystick
GOTO_ROLL_INTERRUPT:
lis	r15,0x8009
ori	r15,r15,0x8214	# load Interrupt_DownBack/ForwardU/D
mtlr	r15
mr	r3,r31
blrl
b	END_EXECUTE_FP_ACTION_STATE

GETUP_ROLL_BACKWARD: #############
mtlr	r14		# load random function
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51B4(r17) # load getup roll B % chance
cmpw	r3,r15		# compare RNG value to tech %
bgt-	GETUP_ATTACK

lfs	f1,0x8c(r31)	# load facing direction
fneg	f1,f1		# negate facing direction
stfs	f1,0x680(r31)	# store as x-axis joystick input
b	GOTO_ROLL_INTERRUPT

GETUP_ATTACK: #############
mtlr	r14		# load random function
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51B0(r17) # load getup attack % chance
cmpw	r3,r15		# compare RNG value to tech %
bgt-	NO_FRAME_PERFECT

li	r15,0
stb	r15,0x6dd(r31)	# store 0 as frames since last B press
lis	r15,0x8009
ori	r15,r15,0x8400	# load Interrupt_DownAttackU/D_FromDownBound
mtlr	r15
mr	r3,r31
blrl
b	END_EXECUTE_FP_ACTION_STATE





END_EXECUTE_FP_ACTION_STATE:
lis	r3,0x8009
ori	r3,r3,0x7e08
mtctr	r3
li	r3,1
bctr


NO_FRAME_PERFECT:
mtlr	r14		# load random function again
lwz	r3,-0x51C0(r17) # load laydown wait max frame count
blrl			# retrieve random value for lay count
stb	r3,0x20(r31)	# store lay count byte in Data offset byte
lis	r3,0x8009
ori	r3,r3,0x7e00	
mtctr	r3
bctr			# execute DownBoundWait


END:
mr	r3,r31

---------------------

DOWNBOUNDWAIT functions
- 220 frames is max time for DownWaitU/D
- 80097fdc subtracts one every frame

inject @ 8009803c

mr	r31,r3		# default code line

lwz	r15,0x64(r31)	# load internal ID
cmpwi	r15,0xb		# is this nana?
beq-	END
cmpwi	r15,0x20	# is Sandbag?
beq-	END

lis	r17,0x8040
lwz	r15,-0x51C8(r17)# load debug flag @ 3fae28
cmpwi	r15,0		# is custom CPU getup off?
beq-	END

lbz	r15,0x6c(r31)	# load port ID
mulli	r15,r15,0xe90
lis	r16,0x8045
ori	r16,r16,0x3088	# P1 port type
lwzx	r15,r15,r16
cmpwi	r15,0		# is player human?
beq-	END

lbz	r15,0x20(r31)	# load custom lay flag
cmpwi	r15,0
bgt-	NO_GETUP_ACTION

STANDUP: #############
lis	r14,0x8038
ori	r14,r14,0x0580	# load random function
mtlr	r14		# load random function
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51BC(r17) # load standup % chance
cmpw	r3,r15		# compare RNG value to tech %
bgt-	GETUP_ROLL_FORWARD

lis	r15,0x8000	# load L/R button press
stw	r15,0x6c8(r31)	# store L/R button press
lis	r15,0x8009
ori	r15,r15,0x80bc	# load Interrupt_DownStandU/D
mtlr	r15
mr	r3,r31
blrl
b	END_EXECUTE_ACTION_STATE


GETUP_ROLL_FORWARD: #############
mtlr	r14		# load random function
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51B8(r17) # load getup roll F % chance
cmpw	r3,r15		# compare RNG value to tech %
bgt-	GETUP_ROLL_BACKWARD

lwz	r15,0x8c(r31)	# load facing direction
stw	r15,0x680(r31)	# store direction as x-axis joystick
GOTO_ROLL_INTERRUPT:
lis	r15,0x8009
ori	r15,r15,0x8214	# load Interrupt_DownBack/ForwardU/D
mtlr	r15
mr	r3,r31
blrl
b	END_EXECUTE_ACTION_STATE

GETUP_ROLL_BACKWARD: #############
mtlr	r14		# load random function
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51B4(r17) # load getup roll B % chance
cmpw	r3,r15		# compare RNG value to tech %
bgt-	GETUP_ATTACK

lfs	f1,0x8c(r31)	# load facing direction
fneg	f1,f1		# negate facing direction
stfs	f1,0x680(r31)	# store as x-axis joystick input
b	GOTO_ROLL_INTERRUPT


GETUP_ATTACK:
mtlr	r14		# load random function
li	r3,100		# 100 possible values
blrl
addi	r3,r3,1
lwz	r15,-0x51B0(r17) # load standup % chance
cmpw	r3,r15		# compare RNG value to tech %
bgt-	NO_ACTION

li	r15,0x0200	# load B button press
stw	r15,0x6c8(r31)	# store B button press
lis	r15,0x8009
ori	r15,r15,0x84d4	# load Interrupt_DownStandU/D
mtlr	r15
mr	r3,r31
blrl

END_EXECUTE_ACTION_STATE:
lis	r3,0x8009
ori	r3,r3,0x8068
mtctr	r3
li	r3,1
bctr


NO_GETUP_ACTION:
subi	r15,r15,1
stb	r15,0x20(r31)
NO_ACTION:
lis	r3,0x8009
ori	r3,r3,0x8068
mtctr	r3
li	r3,0
bctr

END:
mr	r3,r31		# restore r3

**********************************
* Memory Card File Name Research *
**********************************

MemoryCard_DoLoadData

8001caf4...


what writes 00000002 to 80433320?

00000002 = no game data for this current file name, so ask to overwrite current data at next read

00000004 = disable saving


When exiting CSS with a diff file name,

8001a564 branches to strcopy, copying the new file name to 433030 area
8001a568


blr back into 8001bea0


Function _CARDcomparefilename
	- comparing file name at 80433031 (new) with filename at 80bde489 (old)

	- output, r3=0= not match

blr back into 80357610

----------------------


How does GALE01 get tied to a memory card file name??

First Test:
When saving, GALE01 exists at: (BP around 803b3008 - after encryption)
80bdc480 (point to this @ 4a8bbc)
80bde480

These locations may not be static, though.

****************************
* C Falcon Down B Textures *
****************************
SDR Falcon, Disable Falcon Kick Textures 


040e3eac 4e800020


inject @ 800e3eac
- r3 = external data offset start

lwz	r5,0x2c(r3)	# load internal data offset
lwz	r4,0x4(r5)	# load internal char id
cmpwi	r4,2		# is this C. Falcon? (Ganon shares code)
bne-	END
lwz	r4,0x10(r5)	# load Action state ID
cmpwi r4,0x165	# grounded down-b state only
bne-	END

lis	r4,0x803c
lbz	r4,0x759d(r4)	# load PlCa._at
cmpwi	r4,0x73
bne-	END

blr	#skip this function if SD Remix
END:
mflr	r0

**************************
* Collision Physics blrl *
**************************

8006c3a4 - line to blrl into Collision Physics function for action state


********************************
* C. Falcon / Ganon SDR Side-B *
********************************
800cc730 = AS_Fall
80096900 = AS_FallSpecial

inject @ 
800e39d0 - aerial side-b miss
800e3aec - aerial side-b hit
800e3cd0 - side-b off edge


lwz	r4,0x2c(r3)	# load internal data offset
lwz	r4,4(r4)	# load internal char ID
cmpwi	r4,2		# is C Falc?
beq-	FALCON
GANON:
lis	r4,0x803d
lbz	r4,0x2cdd(r4)	# load PlGn._at
cmpwi	r4,0x73
bne-	FALLSPECIAL
b	FALL

FALCON:
lis	r4,0x803c
lbz	r4,0x759d(r4)	# load PlCa._at
cmpwi	r4,0x73
bne-	FALLSPECIAL
FALL:
lis	r4,0x800c
ori	r4,r4,0xc730
b	END_END

FALLSPECIAL:
lis	r4,0x8009
ori	r4,r4,0x6900
END_END:
mtlr	r4
blrl

**********************************************************************
* C. Falcon SDR - Escape (Airdodge) Interrupt During UpA SpecialFall *
**********************************************************************

inject @ 800e4f2c - bl 0x80096900

lis	r6,0x8009
ori	r6,r6,0x6900
mtlr	r6
li	r6,0
blrl		# put char in SpecialFall, default code line
lwz r3,0x2c(r30)	# load internal data offset
lwz	r4,0x4(r3)	# load internal char ID
cmpwi	r4,2		# is C Falc?
bne-	END
lis	r4,0x803c
lbz	r4,0x759d(r4)	# load PlCa._at
cmpwi	r4,0x73		#	PlCa.sat?
bne-	END
#SDR c. falcon
lis	r4,0x8009
ori	r4,r4,0x9a58	# load Interrupt_Escape
stw	r4,0x219C(r3)	# store as new interrupt function
END:



Add airdodge interrupt to Falcon Up-B
-  needs tested

inject @ 800e4f58	- lwz	r31,0x2c(r3)

lwz r4,0x2c(r3)	# load internal char offset
lwz	r31,0x4(r4)	# load internal char ID
cmpwi	r31,2		# is C Falc?
bne-	END
lis	r31,0x803c
lbz	r31,0x759d(r31)	# load PlCa._at
cmpwi	r31,0x73	# PlCa.sat?
bne-	END

lis	r31,0x8009
ori	r31,r31,0x9a58	# 80099a58 = Interrupt_EscapeAir
mtlr	r31
mr	r31,r3
blrl
cmpwi	r3,1
bne-	CONTINUE
lis	r3,0x800e
ori	r3,r3,0x4fc8	# branch to end of this function
mtctr	r3
bctr

CONTINUE:
mr	r3,r31

END:
lwz	r31,0x2c(r3)



**************************
* Enable Alternate Music *
**************************

041644E8 38600001
041648F4 38600001
04164B14 38600001

I think they have other effects of unlocking all characters and stages, I kind of forget. They report back a boolean true for having these things unlocked to allow for alternate music to be an option.


**************
* On Boot... *
**************
OnBoot()

After memory card data has been loaded.

inject @ 801bfa28 - lwz	r0,0x1c(sp)


.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

### need to copy memory card contents to debug menu flags!
# check to overwrite current memory card data
lis	r3,0x803f
ori	r3,r3,0xa154	# start of 20XX flags
lis	r4,0x8046
ori	r4,r4,0x9b94

########### only for 4.06 --> 4.07 transition --> no memory card overwriting
lhz r6,6(r4)
cmpwi r6,0x3036	# '06'
bne- VERSION_CHECK_END
lhz r5,6(r3)
cmpwi r5,0x3037	# '07'
bne- VERSION_CHECK_END
# Yes, this is 4.06 to 4.07 first boot
sth r5,6(r4)		# update mem card name to 4.07
b MEMORY_CARD_SAVE
VERSION_CHECK_END:
############## ~end 4.06 --> 4.07

lwz	r5,4(r3)	# load second word of DOL data
lwz	r6,4(r4)	# load second word of mem card data
cmpw	r6,r5
bne-	END_MEM_CARD
# UPDATE: 11/12/16
	# - below commented out code was for when I was saving the main Debug Menu
	# structure to the memory card. The code in the MnSlChr file was updated
	# to no longer do so, and this code was updated as well. 

#I am copying the main Debug Menu for some stupid reason, so
# I need to not load it from previous mem card data
# I can disable saving it to mem card in the future for more flag room 
#lis	r5,0x8000
#ori	r5,r5,0x31f4
#mtctr	r5
#li	r5,0x37c		#size to get to Debug Menu
#li	r5,0x1554		#size of flags chunk
#bctrl

#lis	r3,0x803f
#ori	r3,r3,0xa840	# after Debug Menu
#lis	r4,0x8046
#ori	r4,r4,0xa280	# mem card after Debug Menu

#lis	r5,0x8000
#ori	r5,r5,0x31f4
#mtctr	r5
#li	r5,0xe68	#size from end of Debug menu to flags end
#bctrl

MEMORY_CARD_SAVE:
li r5,0x1558
subi r3,r3,4
subi r4,r4,4

MEM_CARD_REPEAT:
MEM_CARD_SKIP_DEBUGMENU:
lis r6,0x803f
ori r6,r6,0xa4cc
cmpw r3,r6
blt- MEM_CARD_SKIP_DEBUGMENU_END
lis r6,0x803f
ori r6,r6,0xa848
cmpw r3,r6
bge- MEM_CARD_SKIP_DEBUGMENU_END
MEM_CARD_SKIP:
addi r3,r3,4

b MEM_CARD_REPEAT
MEM_CARD_SKIP_DEBUGMENU_END:

MEM_CARD_REPEAT_CONTINUE:
lwzu r6,4(r4) # load data from memory card
stwu r6,4(r3) # restore data from memory card to RAM flags
subi r5,r5,4
cmpwi r5,0
bne- MEM_CARD_REPEAT





END_MEM_CARD:
# DbLevel = Master Mode
li r3,0
stw r3,-0x6c98(r13)

# MnSlChr Texture
.set DebugMenu.MnSlChrTexture, 0x803faf70
.set MnSlChrASCII, 0x803f115c
word_load r3,r3,DebugMenu.MnSlChrTexture
addi r3,r3,0x30	# don't go above 9 for now...
byte_store r3,r4,MnSlChrASCII

## SdMenu & SdSlChr._at##
lis	r3,0x8040
lbz	r3,-0x5D1C(r3)	# load current hacked stage byte
lis	r4,0x803f
stb	r3,-0x3A39(r4)	# SdMenu._at @ 803ec5c7
stb	r3,0x11ac(r4)	# SdSlChr._at @ 803f11ac


### Unlock Features ###
lis	r3,0x8017
ori	r3,r3,0x2898
mtlr	r3
blrl

### All Trophies ###
#lis	r3,0x8045
#ori	r3,r3,0xc393
#li	r4,0x125	# 293 trophies
#sth	r4,-0x3(r3)
#li	r4,0x94
#mtctr	r4
#li	r4,0x6363
#TROPHY_LOOP:
#sthu	r4,2(r3)
#bdnz+	TROPHY_LOOP


### PAL Mode ###
MODE_INIT:
li r6,0x64	# ASCII 'd' (.dat extension)
lis	r3,0x8040
lwz	r3,-0x5D00(r3)	# load PAL mode flag
cmpwi	r3,0
beq-	MODE_INIT_CONTINUE
#PAL Mode is on...
li	r6,0x70		# ASCII 'p' (.pat extension)
MODE_INIT_CONTINUE:
.set playerFiles, 0x803c1f40
.set playerFiles_plus4, playerFiles + 4
.set playerFiles_minus8, playerFiles - 8
adr_load r3,playerFiles_minus8

CHAR_LOOP:
lwzu	r5,8(r3)	# load player file offset
lhz	r4,0x2(r5)	# load 2 letter char designation
cmpwi	r4,0x4d68	# is this MasterHand?
beq-	MODE_INIT_END
stb	r6,0x5(r5)	# make .pat or .dat
b	CHAR_LOOP
MODE_INIT_END:

COSTUME_INIT:	# set alt costumes off
.set costumeTable, 0x803D51A0
li r3,0	# player counter, external ID



COSTUME_INIT_LOOP:
.set characterIDtable, 0x803bcde0
adr_load r5,characterIDtable
mulli r6,r3,3
add r5,r5,r6
lbz r6,0(r5)
lbz r7,1(r5)	# secondary char
cmpwi r6,0x1b
bge- COSTUME_INIT_COMPARE
COSTUME_INIT_SECONDARY_CHAR:

adr_load r4,costumeTable
mulli r5,r3,4
lbzx r4,r4,r5	# r4 = number of costumes for this player
COSTUME_INIT_LOOP_COSTUME:

adr_load r5,playerFiles_plus4
mulli r6,r6,8
lwzx r5,r5,r6	# r5 = player costume ASCII stuff
COSTUME_INIT_FIND_COSTUME:
lbzu r6,1(r5)
cmpwi r6,0x2e	# check for period, '.'
bne- COSTUME_INIT_FIND_COSTUME
li r6,0x64	# 'd' for .dat

#red falcon check
cmpwi r3,0	# captain falcon?
bne- COSTUME_INIT_RED_FALCON_FALSE
cmpwi r4,4	# red falcon?
bne- COSTUME_INIT_RED_FALCON_FALSE
COSTUME_INIT_RED_FALCON_TRUE:
stb r6,-1(r5)
b COSTUME_INIT_RED_FALCON_END
COSTUME_INIT_RED_FALCON_FALSE:
stb r6,1(r5)
COSTUME_INIT_RED_FALCON_END:

subi r4,r4,1
cmpwi r4,0
bne- COSTUME_INIT_FIND_COSTUME
cmpwi r7,0xff
beq- COSTUME_INIT_SECONDARY_CHECK_END
mr r6,r7
li r7,0xff
b COSTUME_INIT_SECONDARY_CHAR

COSTUME_INIT_SECONDARY_CHECK_END:
COSTUME_INIT_COMPARE:
addi r3,r3,1
cmpwi r3,3	# disable for G&W --> no alt costumes
beq- COSTUME_INIT_COMPARE
cmpwi r3,0x20
blt- COSTUME_INIT_LOOP

METAL_FLAGS:
.set metal_20XX, 0x8000335c
li r4,0
word_store r4,r3,metal_20XX

FORCE_TEAM_MODE:
# force team mode as default for Tag Team Melee (Slo-Mo Melee) and Dual 1v1 (Giant Melee)
lis r3,0x8046
li r4,1	# Teams mode ON
stb r4,-0x49A0(r3)	# Dual 1v1
stb r4,-0x4720(r3)	# Tag Team Melee

END:
lwz	r0,0x1c(sp)

************
* PAL Mode *
************



TOGGLE PAL/NTSC MODE >

-------
<PAL/NTSC DEFAULT CHARACTERS>

CURRENT MODE : NTSC/PAL  !!!! string @ 80005084 in RAM !!!

EXECUTE VERSION CHANGE >

D-PAD RIGHT ON CSS TOGGLES OPPOSITE VERSION CHARACTER

NTSC = 4e545343
PAL = 50414c00

write this word @ 80005093

---------
Debug Menu Function


### PAL Mode ###

mflr	r0
stw	r0,0x4(sp)
stwu	sp,-0x8(sp)

lis	r3,0x8017
ori	r3,r3,0x4338
mtlr	r3
blrl

lis	r18,0x4e54
ori	r18,r18,0x5343	# "NTSC"
li	r17,0		# 0 = NTSC Mode
li	r16,0x64	# load "d" (NTSC)

lis	r15,0x8040
lwz	r15,-0x5D00(r15)# load PAL mode flag
cmpwi	r15,0
bne-	SWITCH
lis	r18,0x5041
ori	r18,r18,0x4c20	# "PAL "
li	r17,1		# 1 = PAL Mode
li	r16,0x70	# load "p" (PAL)

SWITCH:	
lis	r15,0x8000
stw	r18,0x5093(r15)	# store "NTSC" or "PAL"
lis	r15,0x8040
stw	r17,-0x5D00(r15)# store NTSC/PAL Mode flag @ 3fa300

	
lis	r15,0x803c
ori	r15,r15,0x1f38	# -0x8 from first player file pointer

CHAR_LOOP:
lwzu	r17,8(r15)	# load player file offset
lhz	r18,0x2(r17)	# load 2 letter char designation
cmpwi	r18,0x4d68	# is this MasterHand?
beq-	DISABLE_SDR_CHANGES
stb	r16,0x5(r17)	# make .pat or .dat
b	CHAR_LOOP

##### DISABLE SDR CHANGES
DISABLE_SDR_CHANGES:
	
li	r15,0

SDR_END:
li	r17,4		# 4 means use "default" code line values
lis	r16,0x80f9	
ori 	r16,r16,0x5af0	# start of SD Remix external ID Code Pointers
mulli	r18,r15,4	# multiply external ID by 4 to jump to pointer for that character
lwzx	r16,r16,r18	# load pointer to SDR codes for this char	
cmpwi	r16,0	
beq-	ALL_CHAR_COMPARE	
	
SDR_REPEAT:	
lwzu	r18,0x10(r16)	# load address of code
cmpwi	r18,0		# if end of code list for this character
beq-	ALL_CHAR_COMPARE	
lwzx 	r14,r17,r16	
stw	r14,0(r18)	
b	SDR_REPEAT	

ALL_CHAR_COMPARE:
addi	r15,r15,1
cmpwi	r15,0x20
bne-	SDR_END

END:
lwz	r0,0xc(sp)
addi	sp,sp,8
mtlr	r0
blr


***********************************
* Pause Camera Translation Limits *
***********************************

8002c730

****************************
* DAT File Object Research *
****************************

memory read breakpoint on the "flags" portion of a data object

80370c14 [80370bec]

loads flag word
rlwinm.	r0,r0,0,19,19 (00001000)

	if doesn't contain,
	load word at 0x8 (child bone struct offset) and compares to 0.



8000b804
- something with copying bone structures to a new place
- executed on BF match start (when I found this) 

**************************
* Bone Structure Shadows *
**************************

80361778	GX_PixelProc_Struct
8036e8ac	GX_Mesh_Struct
8035f418	GX_Text_Struct
	8035ec34	--> copying Text struct into RAM text struct
803606f0	GX_Text_Struct_flags
80363a64	GX_Color_Struct_Process? (the one pointed to by Material)

struct Material (Mobj) {
	0x00	point	*class name
	0x04	word	rendermode flags
	0x08	point	*Texture
	0x0C	point	*Color
	0x10	point	*Renderdesc
	0x14	point	*PEDesc	(pixel processing)

}

struct Texture {
	0x00	word	unknown00
	0x04	Texture*	next
	0x08	word	GXTexMapID
	0x0C	word	GXTexGenSrc
	// 0x10	float	//rotation[3]
	// 0x14	float	
	// 0x18	float	
	// float	scale[3]
	// float	translation[3]
	0x34	wrap_s
	0x38	wrap_t
	0x3C	byte	scales
	0x3D	byte	scalet
	0x40	word	flags
					(0000000f) = texture matrix flags
					(00000100) = 
					(000001f0) = 
					(000f0000) = 
					(01000000) = 
	0x44	float	unknown44
	0x48	word	magfilter (see GXTexFilter)
	0x4C	Image*	image struct pointer
	0x50	TLUT*	TLUT (palette) struct pointer
	0x54	LOD*	LOD struct pointer
	0x58	ColorLance*	lancecolor
}

struct Image {
	0x00	*data	image data pointer, 32b aligned
	0x04	hword	width, px
	0x06	hword	height, px
	0x08	word	image format (ref GXTexFmt)
	0x0C 	word	mipmap GXBool
						True = texture is mipmap, use trilinear filtering
	0x10	float	minLOD (minimum level of detail)
	0x14	float	maxLOD (maximum level of detail)
} HSD_ImageDesc;

struct TLUT {	// (Palette)
	0x00	pointer	TLUT data
	0x04	word	format	(ref GXTlutFmt)
	0x08	word	name	(ref GXTlut)
	0x0C	half	n_entries	(number of colors)
	0x0E	half	padding
} HSD_Tlut;

struct LOD {
	0x00	word	minfilter (ref GXTexFilter)
	0x04	float	LOD bias
	0x08	byte	bias clamp GXBool
	0x09	byte	edge LOD GXBool
	0x0A	half	padding
	0x0C	word	max anisotropy (ref GXAnisotropy)
} HSD_TexLODDesc;

struct Lance Color {
	0x1C	word	flags
					(c0000000) = low bits disables this struct?
}

Bone Structure Flags
(00000080) = enable color struct (if not and material struct IS set for color struct, it will cause flickering)
(00010000) = enable specular lighting (shininess)

Material Structure Flag
(40000000) = enable color struct transparency
(04000000) = cast character shadow on material
(00000002) = enable mesh color nodes
(00000004) = enable color struct (Diffusion and Ambience), incompatible with mesh color group
(00000008) = enable specular lighting (shininess)

Texture Structure Flags 

0x08	XF TexGen InputForm (maybe?)
	00000000 = AB11
	00000001 = ABC1
0x0C	GXTexGenSrc (BrawlBox XF TexGen Coordinates)
	00000000 = Geometry
	00000001 = Normals
	00000004 = TexCoord0
	00000005 = TexCoord1
	...
0x40
	(00010000) = disable color group (I think...)
	(00040000) = texture enable
	(00020000) = invert color group colors
	(00080000) = invert texture colors

Blend Modes
- pointer to structure is at 0x14 in Material Structure
https://smashboards.com/threads/changing-blend-modes-for-2-5d-textures.431234/#post-20903851

Blend Equations:
	0x01 = add
	0x02 = subtract
	0x03 = reverse subtract
	0x04 = min
	0x05 = max

Memory read breakpoints..

8036318c	loads the flag and then or's it with 0x00001000


803638f0	rlwinm. r0,r0,0,5,5 (04000000)
& below...

80363924	rlwinm. r0,r0,0,19,19 (00001000)

803632ec	rlwinm. r0,r0,0,30,30 (00000002)

803634bc	rlwinm. r0,r0,0,29,29 (00000004)

803635dc	rlwinm. r0,r0,0,28,28 (00000008)

8035e0f8	rlwinm	r3,r4,0,1,2 (60000000)
			then compare to 0x40000000

80363a84	rlwinm. r0,r31,0,28,28 (00000008)
			if contains, then load 0x10 (shininess?) in color struct

80363a9c	rlwinm.	r0,r31,0,5,5 (04000000)

80363ad4	rlwinm.	r0,r31,0,19,19 (00001000)

For character shadows, "nop" line 80363aa8 and everything will have shadows cast on them

8035f6b4 is the function that applies the shadow I believe!
	8035f770 - nop this and no shadows show, but everything else looks okay --> seems to just be incrementing a counter

BLR function 80362518 and no shadows cast, load that counter from previous
"nop" 3407ac stw r0,0(r4) and no shadows cast

HOW TO EASILY TELL WHICH MODELS HAVE THE SHADOW FLAG:
"nop" line 80362578 and all the shown models do not have the shadow flag

-----------
"lbshadow.c" ASCII is @ 3ba0d8 in RAM

8000f864 - beginning of code to create a character shadow


How to find the cast shadow struct 
Tags: shadow cast, shadow structure
8000f488 --> (bl) and then go to 80366d88. r3 is the pointer to the shadow struct


How to find the stage element specular lighting struct (XYZ) position
After breaking at 80018130, set BP at 8037d300 and r4 will hold the location in the DAT file.
	- This gets called multiple times after so maybe more light structs
-----
Really weird character shadowing (super saiyan lookin)
nop 80361980

--------

Function
80361a64	r30 = material struct, f1 = shininess from color struct

80363a24	main material struct parse per frame function?

*********************
* Develop Mode Text *
*********************

Develop mode on-screen text

802269c0 - this function controls the action state text logic (Y+Dpad Down)

80302d4c   DisplayText
r3 = pointer to text data struct start
r4 = pointer to ASCII string (can combine with character identifiers) 
r5 = pointer to first variable string (%s) or int (%d)
r6 = pointer to second variable string (%s) or int (%d)
etc.
f1 = first floating point (%xx.xf)


-----------------

Text_CreateDataTable
inputs:
r3 = ?? normally 6 or 7(byte @ 0x24 of created struct table)
r4 = x-offset (halfword)
r5 = y-offset (halfword)
r6 = max character width of menu (byte)
r7 = max rows (byte)
r8 = pointer, location of ASCII to display on screen

outputs:
r3 = pointer, text data table struct offset

-----------------

Text Data Struct
- check out function 3022
------------
0x00   short   x offset (0=screenleft)
0x02   short   y offset (0=screentop)
0x04   byte    max character width of menu
0x05   byte    max rows
0x06   byte    current character count cursor point (left to right)
0x07   byte    current row cursor point (top to bottom)
0x08   float   width of menu (stretch)
0x0C   float   height of menu (stretch)
0x10   word    background color (box behind letters)
0x14   word    text color
0x24   byte    ?? (usually 0x6 or 0x7)
0x25   byte    text boldness (line size, r3 input to 
0x26   byte     (00000000) = show text and background
		(10) = ?? haven't tried, but saw in code
		(40) = hide background
		(80) = hide text
0x27   byte    text color hue change? 0x00 to 0x03
0x28   point   location of ASCII to display on screen
0x2C   point   previous text structure
0x30   point   next text structure


On-Screen Text Function:

80302638 is the bl to the function that actually shows the text
	r3 = pointer to text struct
8030263C: lwz r31,0x30(r31)	# load the next text struct to display

*********************************************
* Develop Mode - Action State Frame Counter *
*********************************************

How to get pointer to any action state string
(80226a4c), action state ASCII
- I'm sure the Develop Mode files need to be loaded in RAM, DbCo

lwz	r6,0x10(r28) # load action state
cmpwi r6,341
bge-	NO_ACTION_STATE_NAME # special attack or something
rlwinm r0,r6,2,0,29 #(3fffffff)
lwz	r4,-0x4b78(r13)	# load pointer to start of action state ASCII table
lwzx r6,r4,r0


Develop Mode - Y+D-Pad Down Frame Counter uses 5 Digits
044d4adc 2530372e
044d4ae0 35660000
04226b04 38800037

**************************************
* Custom Develop Mode On-Screen Text *
**************************************

80003ACC	Pointer to Text Structure start
80003AD0	Frame count to display on-screen
80003AD4	Pointer to text ASCII start for currently displayed	

************************
* Pause Screen Toggles *
************************
pause toggles
Toggletype onscreen text

IN-GAME TOGGLES
20XX: OFF
DEVELOP: OFF

Custom Text Data @ 80003acc
- 0x34 = ASCII start


inject @ 8016cd7c - lwz	r0,0x3c(sp)


lis	r6,0x804c
ori	r6,r6,0x1fac
li	r5,0		# initialize player counter

PLAYER_LOOP:
mulli	r7,r5,0x44	# players are 0x44 apart
add	r7,r7,r6	# get to this player's button data

### D-PAD UP to Reload Music
lwz	r0,8(r7)	# load instant buttons
cmpwi	r0,8		# d-pad up being pressed?
bne-	CODETYPES
lwz	r0,0(r7)	# load buttons this frame
cmpwi	r0,8		# d-pad up and only d-pad up
bne-	CODETYPES

lis	r3,0x8002
ori	r3,r3,0x3f28	# Music_HandLoading function
mtlr	r3
lis	r3,0x804a
lwz	r3,-0x18A0(r3)	# load Music ID playing @ 49e760	
blrl			# reload this music
b END

## TOGGLE CODE TYPES
CODETYPES:
lwz	r0,8(r7)	# load instant buttons
cmpwi	r0,2		# d-pad right being pressed?
bne-	COMPARE
lwz	r0,0(r7)	# load buttons this frame
cmpwi	r0,2		# d-pad right and only d-pad up
bne-	COMPARE

DISPLAY:

lis	r4,0x8000
lwz	r5,0x36fc(r4)	# load current text ASCII start

lis	r6,0x8000
ori	r6,r6,0x3acc	# load text struct start for Ingame toggles
cmpw	r5,r6		# was there on current timer struct?
bne-	ACTUALLY_DISPLAY	# if no custom text, 

###
CHANGE_TOGGLES:

lis	r6,0x8040
lwz	r4,-0x5C28(r6)	# load 20XX in-game toggles flag
mulli	r4,r4,2		# shift left one bit
lwz	r5,-0x6c98(r13)	# load Develop Mode flag
rlwinm	r5,r5,30,31,31	# load Develop Mode bit
add	r5,r5,r4	# place 20XX and develop bit side-by-side
cmpwi	r5,3
blt-	0x8
li	r5,-1
addi	r5,r5,1

#20XX TOGGLE FLAG CHECK
li	r7,0x4646	# r7 = ASCII "FF" for OFF
rlwinm.	r4,r5,31,31,31	# load new 20XX toggle flag
stw	r4,-0x5C28(r6)	# store new 20XX in-game toggles flag
beq-	XX_FLAG_END
li	r7,0x4e20	# r7 = ASCII "N " for ON

XX_FLAG_END:
lis	r4,0x8000
sth	r7,0x3b16(r4)	# store 20XX flag ASCII

#DEVELOP MODE FLAG CHECK
li	r7,0x4646	# r7 = ASCII "FF" for OFF
rlwinm.	r4,r5,0,31,31	# load new develop toggle flag
mulli	r4,r4,4		# shift bit appropriately
stw	r4,-0x6c98(r13)	# store new develop toggles flag
beq-	DEVELOP_FLAG_END
li	r7,0x4e20	# r7 = ASCII "N " for ON

DEVELOP_FLAG_END:
lis	r4,0x8000
sth	r7,0x3b28(r4)	# store Develop flag ASCII


ACTUALLY_DISPLAY:
lis r3,0x8000
lis r4,0x0003	# text struct 3
ori r4,r4,0x0078	# 120 frame timer
stw r4,0x36cc(r3)
ori r4,r3,0x3acc
stw r4,0x36d0(r3)
ori r4,r3,0x3b00
stw r4,0x36d4(r3)
b END

COMPARE:
addi	r5,r5,1		# increment player counter
cmpwi	r5,4		# looped through all players?
blt-	PLAYER_LOOP

END:
lwz	r0,0x3c(sp)	# default code line



********************************
* Text Sctruct Disappear Timer *
*********************************
* Every Frame Function, Master? *
*********************************
per frame function, oneveryframe(), on every frame

ON-SCREEN TEXT:

If wanting to display text on a timer, display the text on screen and then write:

// 80003acc = pointer to custom text struct start
// 80003ad0 = word, frames to display on-screen for
// 		*set to 8000XXXX when wanting to initially display text
// 80003ad4 = pointer to ASCII start for currently displayed text

In-Game Debug Menu Struct
ZZXXYYAA BBBBBBBB CCCCCCCC DDDDDDDD
EEEEEEEE FFFFFFFF GGGGGGGG HHHHHHHH
IIIIIIII JJJJJJJJ KKKKKKKK LLLLLLLL

ZZ = max char width
XX = max rows
YY = bitflag (ON/OFF) mask if not zero
A = line item type
B = function to run for A press
C = ASCII
D = Enum string pointer
E = Debug flag
F = min
G = max
H = increment value

I = x/y offset
J = text color
K = text highlight color?
	0x7f7f7f7f = no line highlighting
L = bg color






inject @ 802259e4 - lwz	r0,0x2c(sp)
Every in-game frame, paused or unpaused or DEVELOP frozen
# need to clear out 20XX CPU flags on match start
.set TEXTSTRUCT_LOC, 0x800036e0 # custom text struct start
.set TEXTSTRUCT_SIZE, 8
.set TEXTSTRUCT_PTR, 4
.set BUTTONS_ADR, 0x804c1fac

.macro  ADR_LOAD reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  ADR_BLRL reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack
### SFX
lwz	r3,-0x4B0C(r13)	# load SFX ID to play @ 804D6B94 (custom 20XX flag)
cmpwi	r3,0
beq-	END_SFX
ADR_BLRL r3, 0x80174338
END_SFX:

DISABLE_BONUS_TEXT_STRUCT:
# in this function so that any text struct using special ASCII from 804a209a struct wont show twice
lis r4,0x804a
li r5,0xc0	# hide text and bg
stb r5,0x209a(r4)
DISABLE_BONUS_TEXT_STRUCT_END:

li r31,0	# player counter
IN_GAME_TOGGLES_LOOP:

lwz r3,-0x6c98(r13)
cmpwi r3,3
blt- DEVELOP_MODE_END
DEVELOP_CAMERA:	# take this outside of in-game toggles loop?
# camera loc data is @ 80453040 to 8045305c in RAM
# will save to 803faf28 in mem card data
mr r3,r31
bl BUTTONS_CURRENT
rlwinm. r3,r3,0,22,22	# holding B?
beq-	DEVELOP_CAMERA_END
mr r3,r31
bl BUTTONS_INSTANT
li r4,0x1c	# bytes of cam data to save/load
ADR_LOAD r5,0x803faf24
ADR_LOAD r6,0x8045303c
rlwinm. r0,r3,0,29,29	# instant d-pad down?
bne-	DEVELOP_CAMERA_LOAD
rlwinm. r0,r3,0,28,28	# instant d-pad up?
beq-	DEVELOP_CAMERA_END
DEVELOP_CAMERA_SAVE:
lwzu r3,4(r6)
stwu r3,4(r5)
subi r4,r4,4
cmpwi r4,0
bne- DEVELOP_CAMERA_SAVE
li r3,6	# snapshot SFX
ADR_BLRL r4,0x80024030	# Play SFX common
b DEVELOP_CAMERA_END
DEVELOP_CAMERA_LOAD:
lwzu r3,4(r5)
stwu r3,4(r6)
subi r4,r4,4
cmpwi r4,0
bne- DEVELOP_CAMERA_LOAD
DEVELOP_CAMERA_END:
DEVELOP_MODE_END:

IN_GAME_20XX_TOGGLES:
lis r3,0x8040
lwz r3,-0x5C28(r3)	# load 20XX in-game toggles flag
cmpwi r3,0
beq-	IN_GAME_20XX_TOGGLES_END

INFINITE_SHIELDS:
mr r3,r31
bl BUTTONS_CURRENT
rlwinm. r0,r3,0,20,20	# holding Y? --> skip (A+Y+Down will = lightning melee)
bne-	INFINITE_SHIELD_END
rlwinm. r3,r3,0,23,23	# holding A?
beq-	INFINITE_SHIELD_END
mr r3,r31
bl BUTTONS_INSTANT
rlwinm. r3,r3,0,29,29	# instant d-pad down?
beq-	INFINITE_SHIELD_END
INFINITE_SHIELD_GO:
lwz r3,-0x514c(r13)	# load PlCo.dat offset 0x9fe0
# use depletion rate as a toggle indicator
lwz r4,0x278(r3)
cmpwi r4,0
beq-	INFINITE_SHIELD_DEFAULT
INFINITE_SHIELD_INFINITE:
li r4,0
stw r4,0x278(r3)	# 0 depletion rate
stw r4,0x284(r3)	# disable shield damage (?)
lis r4,0x4700		# very high regen rate
stw r4,0x27C(r3)	# very high regen rate
li r3,1	# Menu Forward SFX
ADR_BLRL r4,0x80024030	# Play SFX common
b INFINITE_SHIELD_END
INFINITE_SHIELD_DEFAULT:
ADR_LOAD r4,0x3e0f5c29
stw r4,0x278(r3)
ADR_LOAD r4,0x3d8f5c29
stw r4,0x27c(r3)
lis r4,0x3f80
stw r4,0x284(r3)
li r3,0	# Menu backward SFX
ADR_BLRL r4,0x80024030	# Play SFX common
INFINITE_SHIELD_END:

INVINCIBLE:
mr r3,r31
bl BUTTONS_CURRENT
rlwinm. r3,r3,0,23,23	# holding A?
beq-	INVINCIBLE_END
mr r3,r31
bl BUTTONS_INSTANT
rlwinm. r3,r3,0,28,28	# instant d-pad up?
beq-	INVINCIBLE_END
INVINCIBLE_CHECK:
ADR_LOAD r3,0x804530d8	# P1 defense ratio player block loc
ADR_LOAD r4,0x803fbae8	# P1 defense ratio 20XX player flag RAM loc
li r5,0

INVINCIBLE_CHECK_LOOP:
mulli r8,r5,0xe90
lwzx r6,r3,r8
mulli r8,r5,0x3c
lwzx r7,r4,r8
cmpw r6,r7
bne- INVINCIBLE_CHECK_MAKE_DEFAULT
addi r5,r5,1
cmpwi r5,6
bne+ INVINCIBLE_CHECK_LOOP
INVINCIBLE_CHECK_MAKE_INVINCIBLE:
li r5,0

INVINCIBLE_CHECK_MAKE_INVINCIBLE_LOOP:
li r4,0
mulli r8,r5,0xe90
stwx r4,r3,r8
addi r5,r5,1
cmpwi r5,6
bne+ INVINCIBLE_CHECK_MAKE_INVINCIBLE_LOOP

li r3,1	# Menu Forward SFX
ADR_BLRL r4,0x80024030	# Play SFX common
b INVINCIBLE_END
INVINCIBLE_CHECK_MAKE_DEFAULT:
li r5,0
INVINCIBLE_CHECK_MAKE_DEFAULT_LOOP:
mulli r8,r5,0x3c
lwzx r6,r4,r8
mulli r8,r5,0xe90
stwx r6,r3,r8
addi r5,r5,1
cmpwi r5,6
bne+ INVINCIBLE_CHECK_MAKE_DEFAULT_LOOP
li r3,0	# Menu backward SFX
ADR_BLRL r4,0x80024030	# Play SFX common
INVINCIBLE_END:

TE_INPUT_DISPLAY:
.set TE_DISPLAY_ID, 2
.set TE_STRUCT_LOC, 0x803fc290 # 803fc290 is location of input display text structs (!!!!!)
mr r3,r31
bl BUTTONS_CURRENT
rlwinm. r3,r3,0,20,20	# holding Y?
beq-	TE_INPUT_DISPLAY_END
mr r3,r31
bl BUTTONS_INSTANT
rlwinm. r3,r3,0,31,31	# instant d-pad left?
beq-	TE_INPUT_DISPLAY_END
# add in TE input display background?
bl TE_INPUT_DISPLAY_FLAG
mflr r3
lwz r4,0(r3)	# load flag
li r5,0	# off as default
cmpwi r4,1
beq- TE_INPUT_FLAG_STORE
li r5,1
TE_INPUT_FLAG_STORE:
stw r5,0(r3)
b TE_INPUT_DISPLAY_END

TE_INPUT_DISPLAY_FLAG:
blrl
.long 0x00000000	# flag here, persists across matches

TE_INPUT_DISPLAY_END:
TE_INPUT_FLAG_CHECK:
bl TE_INPUT_DISPLAY_FLAG
mflr r3
lwz r4,0(r3)	# load flag
li r3,TE_DISPLAY_ID
cmpwi r4,0	
beq- TE_INPUT_DISPLAY_DISPLAY_GO	# use r4 = 0 as input
ADR_LOAD r4,TE_STRUCT_LOC
TE_INPUT_DISPLAY_DISPLAY_GO:
bl STRUCT_POINTER_STORE


REPLAY_MENU_DISPLAY:
.set REPLAY_DISPLAY_ID, 4
.set MENU_LOC, 0x803fce80	# replay "debug" menu location
.set REPLAY_TEXTSTRUCT, 0x80003b30

.set replay_mf.start, 0x80003b70	# mf stands for menu flags
.set replay_mf.struct, 0	# offset in replay mf struct
.set replay_mf.line_current, 4
.set replay_mf.player, 5
.set replay_mf.fakeflags, 6	# pointed to when replay data flags not in use (this should always be 0)
.set replay_mf.currentframe, 8
.set replay_mf.endframe, 0xc

.set ingame_menu.bitflag, 2
.set ingame_menu.type, 3
.set ingame_menu.flag, 0x10
.set ingame_menu.min, 0x14
.set ingame_menu.max, 0x18
.set ingame_menu.increment, 0x1c
.set ingame_menu.fg, 0x24
.set ingame_menu.fg_highlight, 0x28
.set ingame_menu.bg, 0x2c
.set ingame_menu.size, 0x30

.set replay_lineitem.player, 0
.set replay_lineitem.controlled, 2
.set replay_lineitem.type, 3
.set replay_lineitem.cputype, 4
.set replay_lineitem.cputype20XX, 5
.set replay_lineitem.replaystate, 8
.set replay_lineitem.currentframe, 9
.set replay_lineitem.endframe, 10
.set replay_lineitem.loop, 11
.set replay_lineitem.autoloadstate, 12
.set replay_lineitem.sfx, 13
.set replay_lineitem.randomhold, 14
.set replay_lineitem.trigger, 15

.set dataoffset_replaystate, 0xf


# 80003b70 :	AAAAAAAA BBCC____
# A = Offset to replay debug menu style struct
# B = Current line item
# C = Player number to display

mr r3,r31
bl BUTTONS_CURRENT
cmpwi r3,4	# pressing only d-pad down?
bne-	REPLAY_MENU_DISPLAY_END
mr r3,r31
bl BUTTONS_INSTANT
rlwinm. r3,r3,0,29,29	# instant d-pad down?
beq-	REPLAY_MENU_DISPLAY_END
REPLAY_MENU_DISPLAY_GO:

li r3,REPLAY_DISPLAY_ID
ADR_LOAD r4, REPLAY_TEXTSTRUCT
bl STRUCT_TOGGLE
cmpwi r3,0	# was replay text struct nulled?
beq- REPLAY_MENU_DISPLAY_END
REPLAY_MENU_INIT:
# check that the player is valid
.set playerblock_loaddataoffset, 0x80034110

REPLAY_MENU_INIT_PLAYER:
ADR_LOAD r4,replay_mf.start
lbz r3,replay_mf.player(r4)

ADR_BLRL r4, playerblock_loaddataoffset
cmpwi r3,0
bne- REPLAY_MENU_INIT_PLAYER_END
lwz	r3,-0x3e74(r13)
lwz	r3,0x20(r3) 	# external data offset of first created character
lwz r3,0x2c(r3)	# internal data offset of first created character
lbz r3,0xc(r3)	# load port number
ADR_LOAD r4,replay_mf.start
stb r3,replay_mf.player(r4)
REPLAY_MENU_INIT_PLAYER_END:
#REPLAY_MENU_INIT_MENULINE:
REPLAY_MENU_DISPLAY_END:


REPLAY_MENU_CONTROL:
li r3,REPLAY_DISPLAY_ID
bl STRUCT_PTR_GET
cmpwi r3,0
beq-	REPLAY_MENU_CONTROL_END

REPLAY_MENU_CONTROL_MOVEUP:
mr r3,r31
bl BUTTONS_INSTANT
rlwinm. r3,r3,0,15,15	# instant joystick up?
beq- REPLAY_MENU_CONTROL_MOVEUP_END
ADR_LOAD r4,replay_mf.start
lbz r3,replay_mf.line_current(r4)
lwz r5,replay_mf.struct(r4)
mr r6,r3
REPLAY_MENU_CONTROL_MOVEUP_LOOP:
cmpwi r6,0
beq- REPLAY_MENU_CONTROL_MOVEUP_END
subi r6,r6,1
mulli r7,r6,ingame_menu.size
add	r7,r7,r5
lbz r8,ingame_menu.type(r7)
cmpwi r8,0
beq- REPLAY_MENU_CONTROL_MOVEUP_LOOP
ADR_LOAD r8,0x7F7F7F7F	# skip highlighting line if highlight color is 7f7f7f7f
lwz r9,ingame_menu.fg_highlight(r7)
cmpw r9,r8
beq- REPLAY_MENU_CONTROL_MOVEUP_LOOP
stb r6,replay_mf.line_current(r4)
REPLAY_MENU_CONTROL_MOVEUP_END:

REPLAY_MENU_CONTROL_MOVEDOWN:
mr r3,r31
bl BUTTONS_INSTANT
rlwinm. r3,r3,0,14,14	# instant joystick down?
beq- REPLAY_MENU_CONTROL_MOVEDOWN_END
ADR_LOAD r4,replay_mf.start
lbz r3,replay_mf.line_current(r4)
lwz r5,replay_mf.struct(r4)
mr r6,r3
REPLAY_MENU_CONTROL_MOVEDOWN_LOOP:
addi r6,r6,1
mulli r7,r6,ingame_menu.size
add	r7,r7,r5
lbz r8,ingame_menu.type(r7)
cmpwi r8,0
beq- REPLAY_MENU_CONTROL_MOVEDOWN_LOOP
cmpwi r8,9	# end of menu, do not move anywhere (could loop to top...)
beq- REPLAY_MENU_CONTROL_MOVEDOWN_END
ADR_LOAD r8,0x7F7F7F7F	# skip highlighting line if highlight color is 7f7f7f7f
lwz r9,ingame_menu.fg_highlight(r7)
cmpw r9,r8
beq- REPLAY_MENU_CONTROL_MOVEDOWN_LOOP
stb r6,replay_mf.line_current(r4)
REPLAY_MENU_CONTROL_MOVEDOWN_END:

# CUSTOM REGISTERS
# r31 = current port to pull joystick info from
# r30 = internal data offset
# r29 = spawn # for this char (0-indexed)
# r28 = total players (1-indexed)
# r27 = replay_mf.start
# r26 = replay_mf.struct (debug menu struct start)
# r25 = debug menu struct for current line
# r24 = debug menu line item counter
# r23 = replay index, this char

ADR_LOAD r4,replay_mf.start
lbz r3,replay_mf.player(r4)
ADR_BLRL r4, playerblock_loaddataoffset
mr r30,r3
# update player count bytes
bl PLAYER_COUNT
mr r29,r3
bl PLAYER_COUNT_TOTAL
mr r28,r3
lwz r30,0x2c(r30)	# make r30 internal offset

REPLAY_MENU_UPDATE_FLAG_LOCS:
ADR_LOAD r27,replay_mf.start
lwz r26,replay_mf.struct(r27)	# load debug menu location (line item 0)
li r24,0	# line item counter

REPLAY_MENU_UPDATE_FLAG_LOCS_LOOP:
mulli r3,r24,ingame_menu.size
add	r25,r26,r3	# get to current line item

lbz	r3,ingame_menu.type(r25)
cmpwi r3,9		# 9 means end of menu
beq- REPLAY_MENU_UPDATE_FLAG_LOCS_END

REPLAY_MENU_PLAYER_LR:
cmpwi r24,replay_lineitem.player
bne- REPLAY_MENU_PLAYER_END
mr r3,r31
bl BUTTONS_INSTANT
#lwz r4,0(r30)	# load external data offset
lwz r5,ingame_menu.flag(r25)	
lbz r5,0(r5)	# load current player
ADR_LOAD r6,0x80453080
rlwinm.	r7,r3,0,26,26	# check R
bne- REPLAY_MENU_PLAYER_INC
rlwinm.	r7,r3,0,25,25	# check L
bne- REPLAY_MENU_PLAYER_DEC

REPLAY_MENU_PLAYER:
cmpwi r24,replay_lineitem.player
bne- REPLAY_MENU_PLAYER_END
lbz r3,replay_mf.line_current(r27)
cmpw r3,r24
bne- REPLAY_MENU_PLAYER_END
mr r3,r31
bl BUTTONS_INSTANT

lwz r5,ingame_menu.flag(r25)	
lbz r5,0(r5)	# load current player
ADR_LOAD r6,0x80453080

rlwinm. r7,r3,0,12,12	# check joystick right
bne- REPLAY_MENU_PLAYER_INC
rlwinm. r7,r3,0,13,13
beq- REPLAY_MENU_PLAYER_END
REPLAY_MENU_PLAYER_DEC:
cmpwi r5,0
beq- REPLAY_MENU_PLAYER_END	# can't go lower than P1
subi r5,r5,1
mulli r7,r5,0xe90
add r7,r7,r6
lwz r7,0x8(r7)
cmpwi r7,3
beq- REPLAY_MENU_PLAYER_DEC
b REPLAY_MENU_PLAYER_STORE
REPLAY_MENU_PLAYER_INC:
cmpwi r5,5
beq- REPLAY_MENU_PLAYER_END	# can't go higher than P6
addi r5,r5,1
mulli r7,r5,0xe90
add r7,r7,r6
lwz r7,0x8(r7)
cmpwi r7,3	# is player not in match?
beq- REPLAY_MENU_PLAYER_INC
REPLAY_MENU_PLAYER_STORE:
lwz r6,ingame_menu.flag(r25)	
stb r5,0(r6)	# store new player
b REPLAY_MENU_CONTROL_END
REPLAY_MENU_PLAYER_END:

REPLAY_MENU_CONTROLLED_BY:
cmpwi r24,replay_lineitem.controlled
bne- REPLAY_MENU_CONTROLLED_BY_END
addi r3,r30,0x618	# internal +0x618 = controlled by, byte
stw r3,ingame_menu.flag(r25)
b REPLAY_MENU_INCDEC_BYTE
REPLAY_MENU_CONTROLLED_BY_END:

REPLAY_MENU_TYPE:
cmpwi r24,replay_lineitem.type
bne- REPLAY_MENU_TYPE_END
lis r7,0x8045
ori r7,r7,0x308b
lbz r8,0xc(r30)
mulli r8,r8,0xe90
add r7,r7,r8
stw r7,ingame_menu.flag(r25)
b REPLAY_MENU_INCDEC_BYTE
REPLAY_MENU_TYPE_END:

REPLAY_MENU_CPU_TYPE:
cmpwi r24,replay_lineitem.cputype
bne- REPLAY_MENU_CPU_TYPE_END
addi r7,r30,0x1a97	# internal +0x1a94 = cpu ai type, word
stw r7,ingame_menu.flag(r25)
# modify CPU type in PlayerBlock so it doesn't reset to default on death
# what about Nana??
lbz r3,0(r7)	# load current CPU type
lis r7,0x8045
ori r7,r7,0x30ca
lbz r8,0xc(r30)
mulli r8,r8,0xe90
add r7,r7,r8
stb r3,0(r7)
b REPLAY_MENU_INCDEC_BYTE
REPLAY_MENU_CPU_TYPE_END:

REPLAY_MENU_CPU_TYPE_20XX:
cmpwi r24,replay_lineitem.cputype20XX
bne- REPLAY_MENU_CPU_TYPE_20XX_END
#addi r7,r30,0xd	# internal +0xd = [custom] 20XX "non-ai" type
.set CPUTYPE_20XX, 0x80003374
ADR_LOAD r8,CPUTYPE_20XX
lbz r7,0xc(r30)
add r7,r8,r7
stw r7,ingame_menu.flag(r25)
b REPLAY_MENU_INCDEC_BYTE
REPLAY_MENU_CPU_TYPE_20XX_END:

REPLAY_MENU_REPLAY_STATE:
cmpwi r24,replay_lineitem.replaystate
bne- REPLAY_MENU_REPLAY_STATE_END
addi r7,r30,dataoffset_replaystate
stw r7,ingame_menu.flag(r25)
b REPLAY_MENU_INCDEC_BYTE
REPLAY_MENU_REPLAY_STATE_END:

.set replay_index.size, 0xc
.set replay_index.framestart, 0x00
.set replay_index.frameend, 0x04	# this is the total number of frames
.set replay_index.dataptr, 0x08

lwz r23,-0x4330(r13) # get arenahi
addi r3,r29,1	# make [this] player count 1-indexed
mulli r3,r3,replay_index.size	# each player has REPLAY_INDEX bytes associated with their frame index data (!!!!)
sub r23,r23,r3	# r23 is now start of this character's replay frame index info


REPLAY_MENU_CURRENT_FRAME:
cmpwi r24,replay_lineitem.currentframe
beq- REPLAY_MENU_CURRENT_FRAME_CONTINUE
cmpwi r24,replay_lineitem.endframe
bne- REPLAY_MENU_CURRENT_FRAME_END
REPLAY_MENU_CURRENT_FRAME_CONTINUE:
lis r3,0x8047
lwz	r3,-0x493C(r3)	# load match frame count
addi r3,r3,0x7B	# 7B frames before match counter begins
cmpwi r3,0x7B	# if match frame count was zero
bne- REPLAY_MENU_FRAME_COUNT_CONTINUE
lis r3,0x8048
lwz	r3,-0x62a0(r3)# load scene frame count
REPLAY_MENU_FRAME_COUNT_CONTINUE:
lwz r4,	replay_index.framestart(r23)
sub r3,r3,r4
stw r3, replay_mf.currentframe(r27)
lwz r3, replay_index.frameend(r23)	# load replay index end frame
rlwinm r3,r3,0,8,31 #(ignore first byte)
subi r3,r3,1
stw r3, replay_mf.endframe(r27)
lwz r3,replay_index.dataptr(r23)	# load replay index pointer to current data
cmpwi r3,0
beq- REPLAY_MENU_CURRENT_FRAME_RED
REPLAY_MENU_CURRENT_FRAME_ORANGE:
ADR_LOAD r3,0xFF8000FF
b REPLAY_MENU_CURRENT_FRAME_COLOR
REPLAY_MENU_CURRENT_FRAME_RED:
ADR_LOAD r3,0xFF0000FF
REPLAY_MENU_CURRENT_FRAME_COLOR:
stw r3,ingame_menu.fg(r25)
REPLAY_MENU_CURRENT_FRAME_END:

REPLAY_MENU_FLAGS:
cmpwi r24,replay_lineitem.loop
beq- REPLAY_MENU_FLAGS_CONTINUE
cmpwi r24,replay_lineitem.autoloadstate
beq- REPLAY_MENU_FLAGS_CONTINUE
cmpwi r24,replay_lineitem.sfx
beq- REPLAY_MENU_FLAGS_CONTINUE
cmpwi r24,replay_lineitem.randomhold
beq- REPLAY_MENU_FLAGS_CONTINUE
cmpwi r24,replay_lineitem.trigger
bne- REPLAY_MENU_FLAGS_END
REPLAY_MENU_FLAGS_CONTINUE:
addi r3,r27,replay_mf.fakeflags
stw r3,ingame_menu.flag(r25)	# set debug menu flag to null location
lwz r3,replay_index.dataptr(r23)	# load replay index pointer to current data
cmpwi r3,0	# if null, skip possibility of changing flags
beq- REPLAY_MENU_FLAGS_END
stw r3,ingame_menu.flag(r25)	# set debug menu flag loc to replay data start
# add another line here if replay flags are ever not at offset 0x00 in replay data
b REPLAY_MENU_INCDEC_BYTE
REPLAY_MENU_FLAGS_END:

b REPLAY_MENU_UPDATE_FLAG_LOCS_LOOP_INCREMENT

REPLAY_MENU_INCDEC_BYTE:
lbz r3,replay_mf.line_current(r27)
cmpw r3,r24
bne- REPLAY_MENU_INCDEC_BYTE_END
mr r3,r31
bl BUTTONS_INSTANT	# r3 = buttons
lwz r4,ingame_menu.flag(r25)
lbz r4, 0(r4)
lbz r5,ingame_menu.bitflag(r25)
cmpwi r5,0
beq- REPLAY_MENU_INCDEC_BYTE_BITFLAG_END
and r6,r5,r4
rlwinm. r7,r3,0,12,12	# check joystick right
bne- REPLAY_MENU_INCDEC_BYTE_BITFLAG_INC
rlwinm. r7,r3,0,13,13
beq- REPLAY_MENU_INCDEC_BYTE_END
REPLAY_MENU_INCDEC_BYTE_BITFLAG_DEC:
cmpwi r6,0	# is bit already off?
beq-	REPLAY_MENU_INCDEC_BYTE_END
sub		r3,r4,r5
b	REPLAY_MENU_INCDEC_BYTE_STORE
REPLAY_MENU_INCDEC_BYTE_BITFLAG_INC:
cmpwi r6,0	# is bit already high?
bne- REPLAY_MENU_INCDEC_BYTE_END
add	r3,r4,r5
b	REPLAY_MENU_INCDEC_BYTE_STORE

REPLAY_MENU_INCDEC_BYTE_BITFLAG_END:
lfs f1,ingame_menu.increment(r25)
fctiwz f1,f1
stfd f1,0(r2)
lwz r5,4(r2)	# load increment int
rlwinm. r7,r3,0,12,12	# check joystick right
bne- REPLAY_MENU_INCDEC_BYTE_INC
rlwinm. r7,r3,0,13,13
beq- REPLAY_MENU_INCDEC_BYTE_END
REPLAY_MENU_INCDEC_BYTE_DEC:
lfs f1,ingame_menu.min(r25)
fctiwz f1,f1
stfd f1,0(r2)
lwz r6,4(r2)	# load min int

REPLAY_MENU_INCDEC_BYTE_DEC_REPLAY_STATE:
#!! bastard code, loop for replay state
cmpw r4,r6	# if at min already
bne- REPLAY_MENU_INCDEC_BYTE_DEC_REPLAY_STATE_END
cmpwi r24, replay_lineitem.replaystate
bne- REPLAY_MENU_INCDEC_BYTE_DEC_REPLAY_STATE_END
lfs f1,ingame_menu.max(r25)
fctiwz f1,f1
stfd f1,0(r2)
lwz r4,4(r2)	# load max int
REPLAY_MENU_INCDEC_BYTE_DEC_REPLAY_STATE_END:

sub r7,r4,r5
cmpw r7,r6
blt- REPLAY_MENU_INCDEC_BYTE_END
mr r3,r7
b REPLAY_MENU_INCDEC_BYTE_STORE
#REPLAY_MENU_INCDEC_BYTE_DEC_LOOP_CHECK:


REPLAY_MENU_INCDEC_BYTE_INC:
lfs f1,ingame_menu.max(r25)
fctiwz f1,f1
stfd f1,0(r2)
lwz r6,4(r2)	# load max int

REPLAY_MENU_INCDEC_BYTE_INC_REPLAY_STATE:
#!! bastard code, loop for replay state
subi r7,r6,1
cmpw r4,r7	# if at max already
bne- REPLAY_MENU_INCDEC_BYTE_INC_REPLAY_STATE_END
cmpwi r24, replay_lineitem.replaystate
bne- REPLAY_MENU_INCDEC_BYTE_INC_REPLAY_STATE_END
lfs f1,ingame_menu.min(r25)
fctiwz f1,f1
stfd f1,0(r2)
lwz r3,4(r2)	# load min int
b REPLAY_MENU_INCDEC_BYTE_STORE
REPLAY_MENU_INCDEC_BYTE_INC_REPLAY_STATE_END:

add r7,r4,r5
cmpw r7,r6
bge- REPLAY_MENU_INCDEC_BYTE_END
mr r3,r7

REPLAY_MENU_INCDEC_BYTE_STORE:
lwz r4,ingame_menu.flag(r25)
stb r3,0(r4)
REPLAY_MENU_INCDEC_BYTE_END:

REPLAY_MENU_UPDATE_FLAG_LOCS_LOOP_INCREMENT:
addi r24,r24,1
b REPLAY_MENU_UPDATE_FLAG_LOCS_LOOP

REPLAY_MENU_UPDATE_FLAG_LOCS_END:
REPLAY_MENU_CONTROL_END:

IN_GAME_20XX_TOGGLES_END:
IN_GAME_TOGGLES_COMPARE:
addi r31,r31,1
cmpwi r31,4	# gone through all four controller inputs?
bne-	IN_GAME_TOGGLES_LOOP
IN_GAME_TOGGLES_END:
b	END
#--------------
#-- Subfunctions ---
#---------------
DEBUG_MENU_LINE_COUNT:	# input: r3 = debug menu start
li r4,0
DEBUG_MENU_LINE_COUNT_LOOP:
mulli r4,r4,ingame_menu.size
add r5,r4,r3
lbz	r5,ingame_menu.type(r5)
cmpwi r5,9
beq- DEBUG_MENU_LINE_COUNT_END
addi r4,r4,1
DEBUG_MENU_LINE_COUNT_END:
blr

#-----------------
BUTTONS_INSTANT:
mulli r5,r3,0x44 # button offsets are 0x44 apart
ADR_LOAD r4, BUTTONS_ADR
add	r4,r4,r5
lwz	r3,8(r4)	# load instant buttons
blr

#-----------------
BUTTONS_CURRENT:
mulli r5,r3,0x44 # button offsets are 0x44 apart
ADR_LOAD r4, BUTTONS_ADR
add	r4,r4,r5
lwz	r3,0(r4)	# load current buttons
blr

#------------------
# Inputs: r3 = text struct ID, r4 = ptr to set to if not equal to already
# Outputs: r3 = 0 if nulled the address, else not zero
STRUCT_TOGGLE:
ADR_LOAD r5,TEXTSTRUCT_LOC
mulli r3,r3,TEXTSTRUCT_SIZE
add r3,r5,r3
lwz r5,TEXTSTRUCT_PTR(r3)	# 800036f4 is (custom text 0x2) input display (!!!)
cmpw r4,r5
li r5,0
beq- STRUCT_TOGGLE_STORE	# if already on, turn off
mr r5,r4
STRUCT_TOGGLE_STORE:
stw r5,TEXTSTRUCT_PTR(r3)
STRUCT_TOGGLE_END:
mr r3,r5
blr
#---------------

STRUCT_POINTER_STORE:
# Inputs: r3 = text struct ID, r4 = ptr to set to or null
ADR_LOAD r5,TEXTSTRUCT_LOC
mulli r3,r3,TEXTSTRUCT_SIZE
add r3,r5,r3
stw r4,TEXTSTRUCT_PTR(r3)
blr
#----------------------------
# Input: r3 = text struct ID
STRUCT_PTR_GET:
ADR_LOAD r4,TEXTSTRUCT_LOC
mulli r3,r3,TEXTSTRUCT_SIZE
add r3,r4,r3
lwz r3,TEXTSTRUCT_PTR(r3)
blr

#--------------------------
PLAYER_COUNT_TOTAL:
# no inputs
# output r3 = total number of characters in match (1-indexed)
lwz	r3,-0x3e74(r13)
lwz	r4,0x20(r3) 	# get external data offset of first spawned player
li r3,0
PLAYER_COUNT_TOTAL_LOOP:
addi	r3,r3,1	# increment player counter
lwz	r4,8(r4)	# load next player external data pointer
cmpwi r4,0
bne- PLAYER_COUNT_TOTAL_LOOP
PLAYER_COUNT_TOTAL_END:
blr
#------------------

PLAYER_COUNT:
# r3 = external data offset
# output r3 = char spawn number (0-indexed)
lwz	r4,-0x3e74(r13)
lwz	r5,0x20(r4) 	# should get you the first player who was created, external data offset
li r4,0
PLAYER_COUNT_LOOP:
cmpw r5,r3
beq-	PLAYER_COUNT_END
addi	r4,r4,1	# increment player counter
lwz	r5,8(r5)	# load next player external data pointer
b PLAYER_COUNT_LOOP
PLAYER_COUNT_END:
mr r3,r4
blr
#------------------

END:
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
lwz	r0,0x2c(sp)	# default code line




Old inject point @ 8016cf38 - lmw r27,0x1c(sp)
Every Frame, Paused or Unpaused, but not while DEVELOP frame advance frozen


***********************
* "4248" Color Format *
***********************

breakpoint @ 80363188
- r4 holds offset of 4248 color struct start


***********************
* Hold Start to Pause *
***********************

only when pause is disabled...

Enable Unpausing With Pause OFF
0416cc28 60000000


Hold Start to Pause with Pause OFF

branch to 8016cad8

inject @ 8016caa4

rlwinm.	r0,r0,29,31,31
beq-	DEFAULT_PAUSE

li	r14,0
subi	r12,r13,0x4b10

PAUSE_LOOP:
lbzx	r15,r12,r14	# load start hold counter
cmpwi	r15,0x5A	# holding for 1.5 secs?
bne-	PAUSE_COMPARE

mr	r31,r14

lis	r12,0x8016
ori	r12,r12,0xcad8
mtctr	r12
bctr

PAUSE_COMPARE:
addi	r14,r14,1
cmpwi	r14,4
blt-	

NO_PAUSE:
lis	r12,0x8016
ori	r12,r12,0xcbcc
mtctr	r12
bctr


DEFAULT_PAUSE:
lis	r12,0x8016
ori	r12,r12,0xcaac
mtctr	r12
bctr



-----


****************
* Camera Types *
****************

Function 80227484 controls making the camera free move in Develop Mode when hitting c-stick. It also controls camera changes caused by pressing d-pad up.

***********
* NBA Jam *
***********
800032c8	byte	P1 kills on current stock
800032c9	byte	P2 kills
etc.

Damage Percent Multipliers
inject @ 8006cc8c - fmr f31,f1
- r3 = internal data offset of player getting hit

NBA_JAM_DAMAGE_MULT:
fmr	f31,f1	# default code line, move damage to apply
lis	r15,0x8048
lbz	r15,-0x62D0(r15)# load menu controller major
cmpwi	r15,0x13	# is this tiny Melee?
bne-	END
lwz	r4,0x18c4(r3) # load slot of player hitting this char
cmpwi	r4,6		# is this self damage?
beq-	END
lis	r15,0x8000
ori	r15,r15,0x32c8	# load NBA Jam flags stock kill flags address
lbzx	r4,r4,r15	# load stock kills for playing doing damage
cmpwi	r4,0
beq-	END
cmpwi	r4,4
blt-	0x8
li	r4,3
mulli	r16,r4,4	# make each value a word
addi	r15,r15,8	# get to start of damage mult flags values
lfsx	f1,r16,r15
fmuls	f31,f31,f1	# multiply damage to apply by NBA jam value

NBA_JAM_DAMAGE_ELEMENT:
#r4 = stock kills for person doing damage

lwz	r15,0x1860(r3)	# load element taken from this damage
cmpwi	r15,0		# is element normal?
beq-	FIRE_CHECK
cmpwi	r15,3		# is element slash?
bne-	END

FIRE_CHECK:
cmpwi	r4,3
bge-	DARKNESS
cmpwi	r4,2
beq-	FIRE
cmpwi	r4,1
bne-	END
#heating up
lbz	r16,-0x570E(r13)# load random byte
cmpwi	r16,0xa0	# is greater than or equal 0xa0
blt-	END
lwz	r16,0x183c(r3)	# load damage being dealt (int)
cmpwi	r16,0xa		# is damage being done 10 or more?
bge-	FIRE_ELEMENT_GO
b	END
FIRE:
lwz	r16,0x183c(r3)	# load damage being dealt (int)
cmpwi	r16,0x5		# is damage being done 5 or more?
blt-	END
FIRE_ELEMENT_GO:
li	r16,1
b	ELEMENT_END

DARKNESS:
lwz	r16,0x183c(r3)	# load damage being dealt (int)
cmpwi	r16,0x5		# is damage being done 5 or more?
blt-	END
li	r16,1		# load fire as default
lbz	r15,-0x570E(r13)# load random byte
cmpwi	r15,0xa0	# is greater than or equal 0xa0
blt-	ELEMENT_END	# if less than, do fire not darkness
li	r16,13		# apply darkness element

ELEMENT_END:
stw	r16,0x1860(r3)	# store as element from last damage

END:

--------

Update Stock Kill Count Upon Death
- do not receive fire level up if killed a teammate

inject @ 800d34c4 - lwz r0,0x2c(sp)
- in Death_RemoveItems
- r31 contains internal data offset

lis	r15,0x8048
lbz	r15,-0x62D0(r15)# load menu controller major
cmpwi	r15,0x13	# is this tiny Melee?
bne-	END
lwz	r0,4(r31)	# load internal char ID
cmpwi	r0,0xb		# is char Nana?
beq-	END
lis	r15,0x8000
ori	r15,r15,0x32c8	# load NBA Jam flags stock kill flags address
lbz	r17,0xc(r31)	# load slot of this player
lbz	r18,0x61b(r31)	# load Team ID for dying player
li	r16,0
stbx	r16,r17,r15	# zero out this player's stock kills

lwz	r17,0x18c4(r31)	# load slot of player who last hit this char
cmpwi	r17,6
beq-	END
lis	r19,0x8016
ori	r19,r19,0xb168	# load check Teams Mode function
mtlr	r19
blrl
cmpwi	r3,0
beq-	CONTINUE
TEAMS:
lwz	r19,0x1868(r31)
lbz	r19,0x67b(r19)	# load Team of player that killed this player
cmpw	r19,r18		# players on same team?
bne-	CONTINUE

lbzx	r16,r17,r15
cmpwi	r16,0
beq-	END
subi	r16,r16,1	# decrement kill count
stbx	r16,r17,r15	# store kill count
b	END

CONTINUE:
lbzx	r16,r17,r15
cmpwi	r16,3		# does this player already have 3 kills?
bge-	END
addi	r16,r16,1	# increment kill count
stbx	r16,r17,r15	# store kill count
TROPHY_SFX:
cmpwi	r16,2
bne-	END
li	r16,0xaa	# new tropy sfx id
stw	r16,-0x4B0C(r13)
lis	r16,0x8017
ori	r16,r16,0x4338
mtlr	r16
blrl

END:
lwz	r0,0x2c(sp)	# default code line

------------

Fire and Darkness Body Aura

inject @ 8006cb7c - lwz r0,0x1c(sp)
- at end of PlayerThink
- r30 = external data offset
- r31 = internal data offset

lwz	r15,0x4(r31)	# load internal char ID
cmpwi	r15,0xb		# is this char Nana?
beq-	END

lis	r15,0x8048
lbz	r15,-0x62D0(r15)# load menu controller major
cmpwi	r15,0x13	# is this tiny Melee?
bne-	END

lis	r16,0x8047
lwz	r16,-0x493C(r16)	# load match frame count into r16
cmpwi	r16,0
beq-	END_RESET_KILLS

lis	r3,0x8000
ori	r3,r3,0x32c8	# load NBA Jam kills flag location
lbz	r4,0xc(r31)	# load port number for this player
lbzx	r4,r3,r4	# load kills for this player
cmpwi	r4,2
blt-	END
cmpwi	r4,2
beq-	FIRE
DARKNESS:
li	r15,9
divw	r3, r16, r15
mullw	r17, r3, r15
cmpw	r17, r16
bne-	FIRE
li	r4,0x23		# darkness body aura
b	APPLY_AURA

FIRE:
li	r15,7
divw	r3, r16, r15
mullw	r17, r3, r15
cmpw	r17, r16
bne-	END
li	r4,0xb		# fire body aura

APPLY_AURA:		# r4 needs to be aura ID
mr	r3,r31
lis	r5,0x800b
ori	r5,r5,0xffd0
mtlr	r5
li	r5,0
blrl
li	r3,0
stw	r3,0x430(r31)
b	END

END_RESET_KILLS:
li	r3,0
lis	r4,0x8000
stw	r3,0x32c8(r4)	# store 0 kills to NBA Jam flags stock kill flags address
stw	r3,0x32cc(r4)

END:
lwz r0,0x1c(sp)		# default code line





Body Aura Function

Internal Data Offset +0x408 = r3
	- load word at +0x28 = body aura currently applied??
	- multiply aura to apply *0x8

store body aura ID to 0x28
store 0 (some input) to 0x4

for fire (0xb ID), store 80c55994 to 0x8(r3)

store 0 to 0x0(r3)
store 0 to 0xc(r3)

byte @ 0x7C load


c57684 - aura table
80c557b4


800bf8d0
80014080

-------------

Fire Damage on Grab
- if both players are on fire or darkness-fire, then no damage to either
- if grabber is on fire, but grabbed is not, then then grabbed is damaged
- if grabber is not on fire, but grabbed is, then grabber is damaged

4% damage dealt if on fire
6% damage dealt if on darkness-fire

inject @ 800da298 - lwz	r0,0x24(sp)
- in catchwait function
- r31 = internal data offset for playing doing grab

lis	r15,0x8048
lbz	r15,-0x62D0(r15)# load menu controller major
cmpwi	r15,0x13	# is this tiny Melee?
bne-	END

CHECK_TO_DAMAGE_GRABBED:
lis	r15,0x8000
ori	r15,r15,0x32c8	# load NBA Jam kills flag location
lbz	r4,0xc(r31)	# load port number for this player
lbzx	r6,r15,r4	# load kills for this player
cmpwi	r6,2		# is on fire?
blt-	CHECK_TO_DAMAGE_GRABBER
lwz	r3,0x1a58(r31)	# load player being grabbed
lwz	r3,0x2c(r3)
lbz	r4,0xc(r3)	# load port number for this player
lbzx	r4,r15,r4	# load kills for this player
cmpwi	r4,2		# is grabbed player on fire?
bge-	END

APPLY_DAMAGE_AND_FIRE:
lis	r4,0x4080	# load 4 as default (fire)
cmpwi	r6,3
blt-	STORE_DAMAGE
lis	r4,0x40c0	# load 6 for darkness-fire
STORE_DAMAGE:	
stw	r4,0x1838(r3)	# store fire as element type

APPLY_AURA:		# r3 needs to be player pointer
li	r4,0xb		# fire body aura
lis	r5,0x800b
ori	r5,r5,0xffd0
mtlr	r5
li	r5,0
blrl
b	END

CHECK_TO_DAMAGE_GRABBER:
lwz	r3,0x1a58(r31)	# load player being grabbed
lwz	r3,0x2c(r3)
lbz	r4,0xc(r3)	# load port number for this player
lbzx	r6,r15,r4	# load kills for this player
cmpwi	r6,2		# is grabbed player on fire?
blt-	END
mr	r3,r31
b 	APPLY_DAMAGE_AND_FIRE

END:
lwz	r0,0x24(sp)

********************************************************
* Grabbing edge resets "player who last hit this char" *
********************************************************

I am going to make this only work in tiny melee (NBA Jam) for safety.

80081388 - lwz r3,0x2c(r3)
-r31 can use

lwz	r3,0x2c(r3)	# default code line
lis	r31,0x8048
lbz	r31,-0x62D0(r31)# load menu controller major
cmpwi	r31,0x13	# is this tiny Melee?
bne-	END
li	r31,6		
stw	r31,0x18c4(r3)	# store self damage as last person
li	r31,-1
stw	r31,0x18c8(r3)	# store something else, idk
END:

***********************************************
* Jump Out of Techs for Aerros on Smashboards *
***********************************************


inject @ 800caed0 = Interrupt_Jump_Grounded
- function input = r3 = external data offset pointer

lwz	r0,0x70(r3)	# load current action state
cmpwi	r0,0xc7		# 0xC7 = passive (neutral tech)
blt-	END_DEFAULT
cmpwi	r0,0xc9		# 0xC9 = passivestandb (back roll tech)
bgt-	END_DEFAULT
lfs	f1,-0x20b0(r2)	# load 20 (float) from table of contents
lfs	f2,0x448(r3)	# load action state frame count
fcmpo	cr0,f2,f1	# is current frame count greater than or equal to 20?
bge-	END_DEFAULT
blr			# if not, skip jump interrupt function

END_DEFAULT:
mflr	r0	# default code line


*******************************************************
* Character Specific Functions On Action State Change *
*******************************************************

blrl at 800c017c

- things like DK, checking to see if his giant punch is fully charged to apply the white flash - smoke puff aura overlay. 

**********************
* Hitstun Multiplier *
**********************

f1 = 1.7071068286895752
f2 = 0.7071067690849304 = 1/rad2

output
f1 = 1.1780972480773926

************
* V-Cancel *
************

NEW TECH???

8008dedc

v-canceling

20XX SFX on Successful V-cancel
-  debug flag at 3fae54

lis r3,0x8040
lwz r3,-0x51AC(r3)
cmpwi r3,0
beq- END

lis r3,-32745
ori r3,r3,17208
mtlr r3
blrl
END:
lwz r3,-20812(r13)

------------

Hitstun groups (frames):

0) 0 hitstun
1) less than 10




Damage&Hitstun
r3 = external data offset

2) between 10 and 21

sets r30 to group number
3) 32 and greater
	= makes character go into tumble

*****************
* 

RAM 803c1cac
- internal char ID table
- blrl functions
- executed immediately after making the screen rumble...(why?) 

Falcon, Samus, Game N Watch

************************************
* Zankyou Battlefield Model Import *
************************************

001e1700 = bottom sky texture

1ef0e0 = sky image data startma


0x001ef064 = bone flags for BG


0x1b06e0 = image structure for left platform stone text


001b1ce4 = bone for left plat
		001b11f8 = object data
0x1cbec0 = bone for right plat
		1cb3b8 = object data
0x1cf8a0 = bone for top plat
		1cedb8 = object data
0x000aedc0 = bone for main stage

map_head
+28

801c6228 - map_head apply shadows


12fba00


14AC180 - left plat color struct
----------------------

NEW BATTELEFIELD IMPORT!
- with color node support

Background Bone
001e20c0

Main Stage Bone
000a6e20

Left Plat
1a9a20

Right Plat
1c3900
	-object data = 0x001c2df8

Top Plat
001c6fe0



*********************
* DAT File Research *
*********************

load pointer block offset

add 1 to counter (total root structure counter?)

load DAT file start +0x20




function:
801c6330 - get to map_head start for map_head (0x8 table) index item (r3)



multiply root node number, r3, by 52=0x34 = map_head root point offset

compare root node number to table value of node count


801c1ef4	lbz	r0,0x10(r29)
801c1ef8	rlwinm	r0,r0,26,31,31 (00000040)
801c1efc	cmpwli	r0,1
		bne-


801c1f24	addi	r29,r29,20
801c1f28	addi	r30,r30,1	#count number of "function chunks" for a stage (20 in length, before Gr__.dat ASCII in DOL)
801c1f2c	bdnz+	0x801c1ef4

load	0x1C in bone structure


RAM - 0x3dfedc
Table for Internal Stage ID pointers

STAGE DATA (immediately following stage ASII in RAM)

0x00	word	Internal Stage ID
0x04	point	Start of Stage Function Chunks

**************************
* MnSlChr CSS CSP Frames *
**************************
Closed ports
MnSlChr.usd

0.0625 translation = 1 pixel! (I think)


0035a3c8 = P1 top right
0035a408 = P1 bottom left

0035a508 = P2 top right
0035a548 = P2 bottom left

0035a7c8 = P3 top right
0035a808 = P3 bottom left

0035a9c8 = P4 top right
0035aa08 = P4 bottom right

********************
* Ness YoYo Glitch *
********************
80116264	lwz	r0,0x2344(r31)
80116268	cmpwi	r0,0
8011626c	bne-	0x80116280


8011627c	bl	0x80008434	#writes 1 to hitbox
80116280	mr	r3,r30


Then

00000002 is stored to the Hitbox [0] active bool
8007addc	stw	r0,0(r31)

	[8007ae80]

What does 8000b1cc do?


Hit someone with yoyo and a counter of inital vaue 0x1e is stored in 0x2344.

********************************
* Shuall Notes on the DOL file *
********************************
Dol headers

You could just get these from hex dumping it but here's a dump of the header from melee's (1.02) dol file , if it's helpful. I'm assuming the 3420 might be related to the first text section's addr? Don't really know where 3420 comes from.
Text sections hold code, data holds data, the bss is like a scratch pad for the running binary, and entry is the code entry point.
Code:
name  |      off     addr     size
text0 |      100 80003100     2420
text1 |     2520 80005940   3b0c20
data0 |   3b3140 80005520      1a0
data1 |   3b32e0 800056c0      280
data2 |   3b3560 803b6560       20
data3 |   3b3580 803b6580       20
data4 |   3b35a0 803b65a0     25c0
data5 |   3b5b60 803b8b60    77e80
data6 |   42d9e0 804d2980     2d00
data7 |   4306e0 804d6cc0     7220
bss   |          804309e0    a62c9
entry |          8000522c


**************************************
* RAM/DOL Table - Character Costumes *
**************************************
Internal Character IDs


First Table entry = 3c0ec0
table entry length = 0x8

0x00 = ?
0x04 = byte, number of costumes for this char (1-indexed)


***************************************
* RAM/DOL Table - Char Init Functions *
***************************************

Upon AllocateAndInit or Rebirth or VictoryPose_Decide

RAM - 803C11D8
- indexed by internal char ID



*********************************************
* Knockback Formula - Stamina Mode Research *
*********************************************

3c0cb0 in RAM --> some ASCII for "damage log"?

80079b68	lbz	r0,0x2225(r3)
	rlwinm.	r0,r0,0,31,31 (00000001)	# is 

80079AB0	Damage_KnockbackCalculate
	Inputs
	f1 = global damage ratio
	f2 = attack ratio
	f3 = defense ratio
	f4 = weight

	r5 = int, hitbox damage

knockback has a max value of 2500

stamina mode knockback does not affect attacks with weight dependent set knockback

stamina mode knockback uses the same equation as normal knockback, but with fixed total damage values:
	= 50 if dead and laying on ground
	= 20 at all other times



1) 
f0 = 0.01
f6 = Weight * 0.01

2) Load damage pre-attack
3) convert to integer

r0 = current damage pre-attack, int
f7 = 2.0
f0 = 1.0 (-0x76f4(rtoc))
f4 = 2.0 * (weight * 0.01)
f0 = 1.0 + (weight * 0.01)

r7 = knockback growth, int

f6 = [2.0 * (weight * 0.01)] / [1.0 + (weight * 0.01)]

r0 = knockback base

f5 = current player damage pre-attack, rounded down
f4 = damage applied from attack, staled

f7 = 2.0 - [2.0 * (weight * 0.01)] / [1.0 + (weight * 0.01)]
f12 = attack damage staled + floor(current damage)
f0 = attack damage unstaled
-80079c00-

f5 = 0.05 (0x114 + PlCo)

f4 = attack damage unstaled * [attack damage staled + floor(current damage)]
f9 = knockback growth
f11 = 0.01
f5 = 0.05 * {attack damage unstaled * [attack damage staled + floor(current damage)]}

f6 = 0.1 (0x110 + PlCo)
f8 = 1.4 (0x11c + PlCo)

f9 = 0.01 * knockback growth

f4 = 18.0 (0x120 + PlCo)
f5 = {0.05 * {attack damage unstaled * [attack damage staled + floor(current damage)]}} + [attack damage staled + floor(current damage)] * 0.1
f0 = base knockback
f5 = {{0.05 * {attack damage unstaled * [attack damage staled + floor(current damage)]}} + [attack damage staled + floor(current damage)] * 0.1} * {2.0 - [2.0 * (weight * 0.01)] / [1.0 + (weight * 0.01)]}
f4 = {1.4 * {{{0.05 * {attack damage unstaled * [attack damage staled + floor(current damage)]}} + [attack damage staled + floor(current damage)] * 0.1} * {2.0 - [2.0 * (weight * 0.01)] / [1.0 + (weight * 0.01)]}}} + 18

+++++++++++++++++

f0, knockback[regular] = {(0.01 * knockback growth) * {{1.4 * {{{0.05 * {attack damage unstaled * [attack damage staled + floor(current damage)]}} + [attack damage staled + floor(current damage)] * 0.1} * {2.0 - [2.0 * (weight * 0.01)] / [1.0 + (weight * 0.01)]}}} + 18} + base knockback} * VicimDefenseRatio * AttackerOffenseRatio * GlobalDamageRatio 

+++++++++++++++++

Function: 8008d930 - Damage_KnockbackAdjust_CC,ChargingSmash,Metal

If victim in Squat or SquatWait, knockback *= 0.66666
If victim in DamageIce, knockback *= 0.25
If victim is charging a smash attack, knockback *= 1.2
Model scaling (e.g. Tiny/Giant Melee) will scale knockback in some manner.


knockback_resistance = max(knockback_resistance_permanent, knockback_resistance_actionstate)

If victim has Metal Box item applied, knockback_resistance += 30.
knockback -= knockback_resistance.

If knockback <= 0, knockback = 0.

------------

The only non-zero values seen for knockback_resistance_permanent are 5.0 for Nana and 20.0 for Giga-Bowser.

An example of knockback_resistance_actionstate is a value of 120.0 applied to Yoshi during JumpAerialF. This resistance value is set to 0 at the beginning of every action state change, and modified afterward for a specific action state, if applicable (Yoshi - JumpAerialF).

**************
* Damage Log *
**************

80459278

0x00	word	?? different values calc knockback at diff code line
0x04	word	Attack ID

****************************
* Number of Respawn Points *
****************************

Set in stage initialization functions.
Stage Info (8049e6c8) +0x8C (byte)
	- if contains (00000008), then each player has a specific spawn point

---
If single spawn point, then uses the P1 respawn point, and if that is zero, it uses the camera x/y position (I think on this last one)



Mario Target Stage
- dying and respawning

r3=4
801c2e00 - lwz r0,0x280(r4) -> load respawn point

	eventually gets down to
	801c2ea8	bl 0x80224bf8

[80224e38]
[80167638]



801c36d8 stores the respawn bone pointer into StageInfo


[6:52:52 PM] Dane Owens: map_head
[6:53:28 PM] Dane Owens: +0x00 = pointer to start of bones for blastzones, camera, spawn points, etc
[6:53:39 PM] Dane Owens: +0x08 = number of entries (0-indexed)
[6:54:26 PM] Dane Owens: I'm assuming +0x04 is a pointer
[6:54:32 PM] Dane Owens: to 0x20 in the DAT file
[6:55:06 PM] Dane Owens: so let's say
+0x04 = pointer to bone ID entry table

[6:55:22 PM] Dane Owens: BONE ID ENTRY TABLE
[6:56:10 PM] Dane Owens: 0x00 (half) = bone entry number
0x02 (half) = bone entry type ID

To summarize

map_head:
	0x00 = pointer to stage info bones
			0x00 = pointer to parent bone of stage info bones (blastzones, spawn points, etc.)
			0x04 = pointer to Bone ID Entry Table
				0x00 (half) = bone entry number
				0x02 (half) = bone entry type ID
			0x08 = (word) Bone ID Entry Table Entry Count (1-indexed)
	0x04 = unsigned, number of stage info tables (structs that 0x00 points to)? (1-indexed)
	0x08 = pointer, ??
	0x0C = unsigned, counter for previous
	0x10 = pointer, ??
	0x14 = unsigned, counter for previous
	0x18 = pointer, lighting entries
		This points to a table of entries 0x08 in length each. 
			- 0x00 is a pointer to a lighting struct
			- 0x04 byte, is a flag. Important bits seem to be 0x20, 0x40, 0x80
	0x1C = unsigned, counter for previous
	0x20 = pointer, ??
	0x24 = unsigned, counter for previous
	0x28 = pointer, start of table of material structs pointers to automatically apply shadows to during stage loading.
		0x00 = pointer to material struct 1 to enable char shadow
		0x04 (if applicable) = pointer to material struct 2 to enable char shadow
		etc..
	0x2c = unsigned, number of material struct points in table (1-indexed)


Character Body Shadow Lighting
0x00 = ?? (null?)
0x04 = ?? (null?)
0x08 = half, light type ID of some sort (e.g. 0x0004, 0x000d)
		(0004) = body shadow lighting
		(000D) = stage light
0x0C = RGBA lighting (0xFFFFFF = vibrant white light)
0x10 = pointer, stage light source position (for the 0x000D stage light ID only)
		0x00 = null, ??
		0x04 = float, position A
		0x08 = float, position B
		0x0c = float, position C

Bone Entry Type ID:		# I think there are type IDs for targets and monster spawns as well
0x00 = P1 spawn point
0x01 = P2 spawn point
0x02 = P3 spawn point
0x03 = P4 spawn point
0x04 = P1 respawn point
0x05 = P2 respawn point
0x06 = P3 respawn point
0x07 = P4 respawn point

0x7F = Item 0 spawn point
0x80 = Item 1 spawn point
0x81 = Item 2 spawn point
0x82 = Item 3 spawn point
0x83 = Item 4 spawn point
0x84 = Item 5 spawn point
0x85 = Item 6 spawn point
0x86 = Item 7 spawn point
0x87 = Item 8 spawn point
0x88 = Item 9 spawn point
0x89 = Item 10 spawn point
0x8A = Item 11 spawn point
0x8B = Item 12 spawn point
0x8C = Item 13 spawn point
0x8D = Item 14 spawn point
0x8E = Item 15 spawn point
0x8F = Item 16 spawn point
0x90 = Item 17 spawn point
0x91 = Item 18 spawn point

0x92 = Item 19 spawn point?
0x93 = Item 20 spawn point?

0x94 = Blastzone/cam offset addition
0x95 = Camera limit, left-top
0x96 = Camera limit, right-bottom
0x97 = Blastzone, left-top
0x98 = Blastzone, right-bottom

Final Destination Bone Types

0 = Parent bone, affects everything
1 = blastzonetop/bot offset
2 = camera left, top
3 = camera right, bottom
4 = blastzone left, top
5 = blastzone right, bottom
6 = item 0
7 = item 1
8 = item 2
9 = item 3
a = item 4
b = item 5
c = item 6
d = item 7
e = P1 spawn point
f = P2 spawn point
10 = P3 spawn point
11 = P4 spawn point
12 = P1 respawn point
13 = P2 respawn point
14 = P3 respawn point
15 = P4 respawn point

-----------------------

map_head (Final D)
the pointer to 0xAC

Each struct is 0x34 apart


------------------------
map_plit
0x00 = pointer to body shadow color pointer
	0x00 = pointer to body shadow color struct (0x0004 ID)
		0x0C = RGBA
0x04 = pointer to ambient light color pointer
	0x00 = pointer to ambient light color struct (0x000D ID)
		0x0C = RGBA
... traverses till it hits a null, idk if the previous are always in that order


map_plit

- load map_plit+0x00 = map_plit(1)
- load map_plit(1)+0x00 = r4
- load map_head+0x1c

compare r4 offset to pointers in map_head plit table (map_head + 0x18)



load map_plit0x00
load that0x00
load that again 0x04
load that again again 0x00

Functions 801c2114 (above) and 80011af4 (unknown use, I think creates the RAM structs)



*******************************
* Single Player Video Loading *
*******************************

801aa7c4 - menu controller "go" function to bring up movie
- not sure if this function gets executed elsewhere

Disable Congratulation Movies
inject @ 801aa7d0
- executed during credits shooting game
- skips movie and goes to the MTH picture

lis	r15,0x8048
lbz	r14,-0x62D0(r15)	# load menu major
cmpwi	r14,0x18		# is in single player ending?
bge-	END
cmpwi	r14,0x15
blt-	END
li	r14,2
stb	r14,-0x62CD(r15)	# write to menu minor to skip video
END:
lwz	r0,-0x4e8c(r13)		# default code line


801a41d0 - storing menu minor of 

--------

1/13/17
NEW CODE

inject @ 801aa7d0
- Disables MTH and THP 1p ending files from being loaded.
- executed during credits shooting game
- Code causes a transition from credits screen back to the CSS for the 1P Mode.

lis	r3,0x8047
ori	r3,r3,0x9d30

lbz	r0,0(r3)	# load menu major
cmpwi	r0,0x18		# is in single player ending?
bge-	END
cmpwi	r0,0x15
blt-	END

lbz	r0,0x2(r3)	# load current single player mode
stb	r0,1(r3)	# store as menu major to load
li	r0,1
stb	r0,0xc(r3)	# set byte to "go" to load the pending menu major

END:
lwz	r0,-0x4e8c(r13)		# default code line


***********************
* Disable Wavedashing *
***********************
For Aerros on Smashboards
Inject @ 80099d70


lwz	r4,0x70(r3)
cmpwi	r4,0xec
bne	END
li	r4,0
stw	r4,0x0xe4(r3)
blr
END:
mflr r0

***************************************
* Zankyou Model Import - Kalos League *
***************************************


Kalos BG stuff
Bone structs @ 1b0560

BG window outlines
Bone structs @ 1dae20

BG faint white glow
bone struct @ 1db8a0

Main Stage Top
Bone structs @ 58bc0

*************************************************
* Zankyou Model Import - Wario Ware , Warioware *
*************************************************

Orange part of top platforms 
material struct = 0x3e144

40238 = object struct 1
40578 = object struct 2

0x40518 = object struct for top right platform grey outlines
0x3dc04 = material struct for all grey platform outlines

Pink part of bottom platforms
material struct = 0x3e204

Green part of platforms
material struct = 0x3e084

Grey Background Color
0x7e524 = 4f4f4fff

Item 0 spawn x/y
00039f10



Brawl Wario Ware Item Spawns
(56,100) (-52,100) (37,80) (-33,80) (-33,55) (-56,55)

*********************
* Magnifier Bubbles *
*********************


Function 802fbbdc controls displaying the magnifier bubble


Disable Magnifier Bubbles
042fbdc0 4800059c


80086b90

store at 802fbd14
load back at 802fc36c

Following codes don't work...

2fbd14
addi	r23,r26,20
lis	r15,0xc500
lis	r16,0x8049
ori	r16,r16,0xe6c8
stw	r15,0(r16)




2fc36c
lfs	f1,0x54(sp)
lis	r15,0xc32a
lis	r16,0x8049
ori	r16,r16,0xe6c8
stw	r15,0(r16)


800296bc also only gets executed when in a bubble?


From Dan Salvato:
Fixed Magnifier Bubbles in Widescreen
044ddb38 c3a87778
044ddb3c 43a87778
044ddb40 43d50000

*****************************
* Animated Collision Points *
*****************************

For Fourside...moving collision points are always at same height

Test Coll Points
C2055FA0 00000003
3DE041E0 91E1FFF4
C001FFF4 D0040014
60000000 00000000
C2056294 00000003
3DE041E0 91E1FFF4
C001FFF4 D01A000C
60000000 00000000

********************************************
* Zankyou Model Import - Battlefield Wii U *
********************************************
0x0000e5b8	ALDYakuAll
0x0001e2c0	GrdTargetBack00_CMPR_image
0x000140a0	GrdTargetClinkGround0_CMPR_image
0x00011c20	GrdTargetClinkLeaf0_CMPR_image
0x0000f420	GrdTargetClinkWall0_CMPR_image
0x000160a0	GrdTargetClinkWall3_CMPR_image
0x0001c2c0	GrdTargetClinkWall4_CMPR_image
0x0001a2c0	GrdTargetClinkWall5_CMPR_image
0x000120a0	GrdTargetClinkWood0_CMPR_image
0x00011420	GrdTargetClinkWood1_CMPR_image
0x0001f198	coll_data
0x0000e4b4	grGroundParam
0x0000e590	itemdata
0x0000019c	map_head
0x0000f120	map_plit
0x0001ee88	quake_model_set
0x0000e598	yakumono_param
0x000a6320	model2411t
0x000ae380	model3232t
0x000b63e0	model1745t
0x000be440	model2033t
0x000bf4a0	model2549t
0x000c7500	model2147t
0x000c7d60	model2066t
0x000c85c0	model3234t
0x000d0620	model2141t
0x000d1680	model2415t
0x000d96e0	model2529t
0x000e1740	model2087t
0x000e57a0	model2417t
0x000e9800	model2089t
0x000f1860	model2090t
0x0010a3a0	model1439t
0x0010ac00	model1438t
0x0010b4e0	model2026t
0x0013fdc0	model3151t
0x00143e20	model2523t
0x0014b740	model1640t
0x0014bfa0	model1809t
0x00154dc0	model2416t


0000f108 = RGBA body shadow color

12d7760

0x6dcdc = material flags for brown/purple spiral on main stage
0x6dd9c = wood floor main stage
0x6de5c = gravel
0x6df1c = blue lights coming up from stage
0x6dfdc = grey ground textures, rock-to-grass light color
0x6e09c = material flags for orange lights on main stage
0x6e15c = ??
0x6e21c = ??
0x123f9c = material flags for orange lights on platform


1345bbc down from here

material flag area
104008 - main stage walk area, band of rock behind char (okay?)
14a470
001526ec - dirt, others

********************************************
* Zankyou Model Import - Hyrule 64 (GrTPe) *
********************************************

0x0000f4d0	ALDYakuAll
0x00010320	GrdTPeachFloor00_RGBA8_image
0x0002c320	GrdTPeachFloor00b_RGBA8_image
0x00050320	GrdTPeachRelief01b_RGBA8_image
0x00070320	GrdTPeachRelief02b_RGBA8_image
0x0001c320	GrdTPeachRelief02c_RGBA8_image
0x00030320	GrdTPeachRelief04b_RGBA8_image
0x00048320	GrdTPeachRelief05b_RGBA8_image
0x00014320	GrdTPeachRelief05c_RGBA8_image
0x00060320	GrdTPeachRelief07b_RGBA8_image
0x00040320	GrdTPeachRelief08b_RGBA8_image
0x00080320	GrdTargetBack00_CMPR_image
0x00081120	coll_data
0x0000f3cc	grGroundParam
0x0000f4a8	itemdata
0x000001b8	map_head
0x00010020	map_plit
0x00080ee8	quake_model_set
0x0000f4b0	yakumono_param
0x00096920	model9t
0x00098980	model2t
0x000991e0	model15t
0x000a1240	model7t
0x000a92a0	model709t
0x000b9300	model673t
0x000c1360	model12t
0x000c33c0	model712t
0x000cb420	model706t
0x000cd480	model10t
0x000cf4e0	model11t
0x000d1540	model714t
0x000d35a0	model671t
0x000db600	model711t
0x000eb660	model710t
0x0010b780	model19t
0x0010d4e0	model20t
0x00190940	model17t
0x001989a0	model713t


00010008 = RGBA body shadow color


1261D00
Hyrule64AchModFix[GrTPe].hat

********************************
* Stage Select Cursor Position *
********************************

While on SSS,
80bda810 = pointer
newpointer = pointer +0x28

newpointer + 0x38 = cursor x position [float]
newpointer + 0x3c = cursor y position [float]

******************
* Stage Striking *
******************

Injection point:
	@8025a3bc
	lfs	f1, -0x3618 (rtoc)	c022c9e8
	(1 of 2 scenarios where it breaks after reading the current cursors(804d6cac) content)
	this line gets executed once per frame on the SSS when the loading cycle hasn´t been initiated yet

---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------
the code:

	li r15,1		#counter which players turn ( 1-4 )

#load cursor position if first frame after change
lis	r16,0x8000
lwz	r21,0x3304(r16)	# load cursor x position to 80003304
lwz	r22,0x3308(r16)	# load cursor y position to 80003308
cmpwi	r21,0
bne-	CURSOR_GO
cmpwi	r22,0
beq-	START

CURSOR_GO:
#lwz	r19,0x38(r31)
#cmpw	r19,r21
#bne-	KEEP_STORING
#lwz	r19,0x3c(r31)
#cmpw	r19,r22
#beq-	STOP_STORING

KEEP_STORING:
#stw	r21,0x38(r31)	# load cursor x position
#stw	r22,0x3c(r31)	# load cursor y position
stw	r21,0x1c(sp)	# load cursor x position
stw	r22,0x20(sp)	# load cursor y position
#b	START

STOP_STORING:
li	r21,0
stw	r21,0x3304(r16)
stw	r21,0x3308(r16)


	START:
	lis r16, 0x8046		#aim at p1 input-c
	ori r16,r16, 0xb0fc

	mulli r17,r15,0xc 


	lwzx r17,r17,r16		#load input of current player



DPAD_CHECKS:

lis r21,0x803f
ori r21,r21,0xa2e4
lbz r22,0(r21)
cmpwi r22,0x34
beq- DPAD_UP
DPAD_DOWN:
rlwinm. r16,r17,0,13,13
beq- DPAD_UP_CHECK
addi r22,r22,1
b LOAD_CSS


DPAD_UP_CHECK:
cmpwi r22,0x31
beq- REG_STAGE_STRIKE
DPAD_UP:
rlwinm. r16,r17,0,12,12
beq- REG_STAGE_STRIKE
subi r22,r22,1

LOAD_CSS:
#store current cursor position
stb r22,0x3(r21)

lis	r16,0x8000
lwz	r21,0x38(r31)	# load cursor x position
stw	r21,0x3304(r16)	# store cursor x position to 80003304
lwz	r21,0x3c(r31)	# load cursor x position
stw	r21,0x3308(r16)	# store cursor x position to 80003304

lis r21,0x8047
ori r21,r21,0x9d64
stw r22,0(r21)

#experimental, play item SFX (same one from SDR)
li r3,0xdb	# SFX ID
stw	r3,-0x4B0C(r13)	# load SFX ID to play @ 804D6B94 (custom 20XX flag)
lis	r3,0x8017
ori	r3,r3,0x4338
mtlr	r3
blrl

b END_END



REG_STAGE_STRIKE:
	 #check: "x" pressed?
	rlwinm. r16,r17,0,5,5		#is X pressed?
	beq- Y_PRESS_CHECK			#no--> go to "check: "y" pressed?" 
	li r17,1			#mode(r17)=lock single
	b SETTINGS				#go to "setting"

	 #check: "y" pressed?
	Y_PRESS_CHECK:
	rlwinm. r16,r17,0,4,4		#is y pressed?
	beq- Z_PRESS_CHECK			#no--> go to "check: "z" pressed?" 
	li r17,2			#mode(r17)=lock not allowed in random
	b SETTINGS				#go to "setting"

	 #check: "z" pressed?
	Z_PRESS_CHECK:
	rlwinm. r16,r17,0,11,11		#is z pressed?
	beq- COMPARE			#no--> go to "next player and again" 
	li r17,3			#mode(r17)=unlock all
					#go to "settings" (happens on it´s own)

#settings
	SETTINGS:	
			
	lis r21,0x803f		#@first visual lock start point
	ori r21,r21,0x06d0
			
	lis r22,0x804d		#@cursor
	ori r22,r22,0x6cae

	li r20,0
	li r19,0		#to write in memory later

	li r18,0		#internal counter (00-1c)

#locking
	 #single mode
	cmpwi r17,1		#is it in single lock mode?
	bne- UNLOCK_ALL_CHECK
				#read cursor	(overwrite the internal counter)
	lbz r18,0(r22)
	cmpwi r18,0x1c		#smaller than 1d = cursor is on stage
	bgt-	COMPARE		#-->"next player and again"
	b ACTUAL_LOCKING		#go to "actual locking"

	 #multi mode(unlock all)
	UNLOCK_ALL_CHECK:
	cmpwi r17,3		#is it in unlock all mode?
	bne- LOCK_RANDOM_SELECTION		#no-->"lock via random selection"
	li r20, 0x3f
	li r19, 0x02
	b ACTUAL_LOCKING			#go to "actual locking"

	#lock via random selection
	LOCK_RANDOM_SELECTION:		
	mulli r16,r18,0x1c	#load how many bits does the "random setting" need to be shifted right
	add r16,r16,r21
	lbz r23,0xA(r16)	#how many to shift right??

	lis r16,0x8045		#where random settings are saved
	ori r16,r16, 0xc388
	lwz r16,0(r16)
	srw r16,r16,r23		#shift right

				#check, is stage legal or not? set r19 & r20 accordingly
	rlwinm. r16,r16,0,31,31	#stage allowed or not?
	beq- ZERO			
	li r19, 2			
	li r20, 0x3f			#yes--> set r19 & r20 to unlock
	b ACTUAL_LOCKING
	ZERO:				#go to "actual locking"
	li r19, 0			
	li r20, 0			#no--> set r19 & r20 to lock

#actual locking
	ACTUAL_LOCKING:
	mulli r16,r18,0x1c
	
	lwzx r16,r16,r21	#load starting point of stage

###
	li	r23,0
	cmpwi	r19,2
	bne-	INVISIBLE_END
	lis	r23,0x0008
	ori	r23,r23,0x0008
	cmpwi	r18,0x16
	blt-	INVISIBLE_END
	lis	r23,0x2000
	ori	r23,r23,0x0008
	INVISIBLE_END:
	stw	r23,0x14(r16)	

####



	mulli r16,r18,0x1c	#load starting point of stage
	addi r16,r16,0x08	#+0x8 offset for locking point
	stbx r19,r16,r21

	li r16,0x1e		#clear out cursor
	stb r16,0(r22)

	cmpwi	r17,1		#jumps out when in "single lock" mode
	beq- COMPARE		#-->addi r15,r15,1

	addi r18,r18,1		#repeat until all stages have been set
	cmpwi r18, 0x1d
	blt- UNLOCK_ALL_CHECK		#-->"locking"/cmpwi r17,3

#next player and again
	COMPARE:
	addi r15,r15,1		#repeat 3 times for player 2-4
	cmpwi r15, 5
	blt- START		#-->lis r16, 0x8046

	END_END:
	lfs	f1, -0x3618 (rtoc)	#was there before



------------------------

Striked Stages Cannot be Randomly Selected

inject @ 80259B68 - lwzx r0,r31,r0

lwzx	r30,r31,r4

cmpwi r30,0	# this will be 0 if "RANDOM" stage select is ON
beq- END
lis r5,0x8040
ori r5,r5,0x6708	# make sure the struct is initialized
lwz r6,0(r30)
cmpw r6,r5
bne- END
lhz	r30,0x14(r30)
cmpwi r30,0
bne-	END
lis r30,0x8025
ori r30,r30,0x9b8c
mtlr r30
blr
END:
lwzx	r0,r31,r0	# default code line

-----------


Striked Stages Cannot be Randomly Selected (Pt2)
- actually more like part 1 though...
- ensures the "already chosen" flag at SSS_stage struct +0x4 gets reset back to 0 if necessary
	- fixes bug in 4.06 with striking down to a single stage, then randomly selecting it twice in a row and the second time going to Peach's Castle 

inject @ 80259B68 - lwz r0,4(r28)
lwz r3,0(r28)	# load JObj pointer
cmpwi r3,0	# this will be 0 if "RANDOM" stage select is ON
beq- END
lis r5,0x8040
ori r5,r5,0x6708	# make sure the struct is initialized
lwz r4,0(r3)
cmpw r4,r5
bne- END
lhz	r4,0x14(r3)
cmpwi r4,0
bne-	END
lis r3,0x8025
ori r3,r3,0x9a38
mtlr r3
blr
END:
lwz r0,4(r28)	# default code line


*****************************
* 20XX Debug Menu RAM Check *
*****************************
- make sure 20XX debug menu contents are in RAM before attempting to load Debug Menu

There needs to be a check in place to make sure my custom data in MnSlChr.usd is loaded in the RAM before the game tries to enter the Debug Menu.

The check is kind of arbitrary, but let's check for ASCII "43617074" at 80F903B0 (3a3c90 in MnSlChr).

Just note that if I ever modify the contents around of the 20XX data in MnSlChr, then I may need to adjust this.

inject @ 8022D638

li	r0,6		# load debug menu
lis	r14,0x80f9
lwz	r15,0x3b0(r14)	# load word at 80f903b0
lis	r14,0x4361	#
ori	r14,r14,0x7074	# ASCII "Capt"
cmpw	r14,r15
beq-	END
li	r0,2		# load vs mode (loads MnSlChr screen)
END:

*****************************************************
* Play Custom Debug Menu HPS if Entering Debug Menu *
*****************************************************

0x7fff is the ID for 00.hps

inject @ 8022D63c

stb	r0,0(r3)	# default code line, store menu id
cmpwi	r0,6	# storing Debug Menu ID?
bne-	END
lis	r3,0x8002
ori	r3,r3,0x3f28
mtlr	r3
li	r3,0x7fff	# custom Debug Menu HPS ID
blrl
END:

*********************************************
* Disable Language Switch (English/Japanese *
*********************************************

0422d1e4 48000154

*****************************
* PAL/NTSC Mode CSS Texture *
******************************
* MnSlChr.usd Patch Function *
******************************

Texture offset in MnSlChr.usd = 0x4baa0 (0xea0 in size, _0 texture 104x72)

3bdb80

so I'm nearly 100% certain that MnSlChr file info is always loaded into the same RAM location.

The PAL texture offset is at 003bdb90 in 20XXMnSlChr.usd

inject @ 80266974


PAL_NTSC_TEXTURE_CONTROLLER:
stw	r3,-0x49d0(r13)	# default code line
lis	r3,0x8040
lwz	r3,-0x5D00(r3)	# load PAL mode toggle
cmpwi	r3,0
beq-	END_TEXTURE
PAL_TEXTURE_CHANGE:

lis	r3,0x8000
ori	r3,r3,0x31f4
mtctr	r3

lis	r4,0x80fa
ori	r4,r4,0xa2b0	#source
lis	r3,0x80c3
ori	r3,r3,0x81c0	#destination
li	r5,0xea0		#size
bctrl

END_TEXTURE:
CUSTOM_CSS_COLORS:
lis	r3,0x803f
ori	r3,r3,0xae58
lwz	r4,0(r3)	# load custom CSS color toggle @ 3fae58
cmpwi	r4,0
beq-	END_CUSTOM_CSS_COLORS
# if 20XX debug menu flag is ON

BACKGROUND_COLOR:
lis	r4,0x80be
ori	r4,r4,0xd06b	#80bed06c is bg color offset
bl	COLOR_LOOP:

TOPFRAME_COLOR:
lis	r4,0x80f3
ori	r4,r4,0x572b	#80f3572c is top frame color offset
bl	COLOR_LOOP:

BOTFRAME_COLOR:
lis	r4,0x80f3
ori	r4,r4,0x55ab	#80f3572c is top frame color offset
bl	COLOR_LOOP:

RULEFRAME_COLOR:
lis	r4,0x80f3
ori	r4,r4,0x566b	#80f3572c is top frame color offset
bl	COLOR_LOOP:

b	END_CUSTOM_CSS_COLORS

COLOR_LOOP:
li	r5,3		# 3 colors, RED GREEN BLUE
mtctr	r5		# move to count register
COLOR_LOOP_LOOP:
lwzu	r5,4(r3)	# load color then store it and update register
stbu	r5,1(r4)
bdnz+	COLOR_LOOP_LOOP
blr



END_CUSTOM_CSS_COLORS:


*******************************
* Disable Archive Movies Menu *
*******************************

0422cf04 480001e0

**********************************************
* Debug Menu - Disable Start Button Function *
**********************************************

For 20XX 4.0, I noticed that pressing start while two submenus deep would load the results screen with C.Falcon --> game becomes softlocked.

Debug Menu - Disable Start Button Functions
04303af8 4800008c

****************************
* Forbidden Smash DI (SDI) *
****************************

Forbidden Smash DI is applied to TopN, but then gets reverted back to original value at 
80084950




*************************************
* 20XX Custom CPU Byte Action Flags *
*************************************
Flags to be handled by cpu button inputs

Internal data offset + 0x21 (byte)

00 = Nothing
01 = Fresh out of hitstun
02 = wavedash forward
03 = wavedash backward
04 = wavedash down
05 = fox/falco laser (also set by AS_FOX/FALCO_NeutralB)


Notes:
Fox Side-B travels 83.74 meleemeters
	- can grab ledge at x-coord +95.00
Falco Side-B travels 77.08 meleemeters
	- can grab ledge at ledge x-coord +90.00
Ledges:
FD - (-85.56

01 = OUT OF HITSTUN

inject @ 8008fe60 - stfs f0,0x2340(r29)
- not used anymore. This is only executed for tumble hitstun

stfs	f0,0x2340(r29)	# default code line, store hitstun
lwz	r3,0x2340(r29)	# load hitstun
cmpwi	r3,0		# compare to 0
bne-	END
li	r3,1		# 0x01 = fresh out of hitstun flag
stb	r3,-0x3f(r29)	# store custom cpu input flag
END:



CPU INPUTS

inject @ 8006b008 - store CPU button inputs to data offset

### Push Back Stack

lwz	r4,0x4(r31)	# load internal char ID
cmpwi	r4,0xb		# Nana?
beq-	END_END
cmpwi	r4,0x20		# extra char? (master hand, sandbag, giga, etc.)
bge-	END_END
		
stwu	sp,-0xD0(sp)
stmw	r15,0x6C(sp)
stw	r3,0xB0(sp)	# store default button inputs
# can also store from B4 to CC, inclusive
	#B4 = word to float convert register
# keep r31 = internal data offset

lbz	r4,-0x3f(r31)	# load custom cpu input flag

cmpwi	r4,4
beq-	WAVEDASH_CHECK
cmpwi	r4,3
beq-	WAVEDASH_CHECK
cmpwi	r4,2
beq-	WAVEDASH_CHECK
cmpwi	r4,1
beq-	HITSTUN_END
cmpwi	r4,0
beq-	FRAME_CHECK_EVERY


###########
# Wavedash Down #
############
WAVEDASH_CHECK:
lwz	r3,0x10(r31)	# load action state
cmpwi	r3,0x19
beq-	WAVEDASH_GO
cmpwi	r3,0x1A
beq-	WAVEDASH_GO
cmpwi	r3,0x18		# kneebend?
beq-	END
b	END_AND_CLEAR_FLAG
WAVEDASH_GO:
cmpwi	r4,4
beq-	WAVEDASH_DOWN_AIRDODGE
cmpwi	r4,3
beq-	WAVEDASH_AWAY_AIRDODGE
cmpwi	r4,2
beq-	WAVEDASH_FORWARD_AIRDODGE
WAVEDASH_DOWN_AIRDODGE:
lis	r3,0
lis	r4,0xbf80
b	WAVEDASH_GO_END

WAVEDASH_AWAY_AIRDODGE:
lis	r3,0xbf73
ori	r3,r3,0x3333
bl	MULT_FLOAT_BY_FACING
lis	r4,0xbe93
ori	r4,r4,0x3333
b	WAVEDASH_GO_END

WAVEDASH_FORWARD_AIRDODGE:
lis	r3,0x3f73
ori	r3,r3,0x3333
bl	MULT_FLOAT_BY_FACING
lis	r4,0xbe93
ori	r4,r4,0x3333
b	WAVEDASH_GO_END

WAVEDASH_GO_END:
stw	r3,0x620(r31)
stw	r4,0x624(r31)
bl	BUTTONS_L
b	END_AND_CLEAR_FLAG

##############################
# First Frame Out of Hitstun #
##############################
HITSTUN_END:

b DOWN_B_BUTTON

bl	SPACIE_CHECK
cmpwi	r3,0
beq-	END_SPACIE_HITSTUN_CHECK

bl	SPACIE_SHINE_CHECK
cmpwi	r3,1
beq-	DOWN_B_BUTTON
END_SPACIE_HITSTUN_CHECK:

#above does nothing right now

DOWN_B_BUTTON:
li	r4,0
stw	r4,0x620(r31)
lis	r4,0xbf80
stw	r4,0x624(r31)

li	r3,0
ori	r3,r3,0x0200
bl	BUTTONS_STORE
b	END_AND_CLEAR_FLAG


###################
FRAME_CHECK_EVERY:
###################


	##############
	HITSTUN_CHECK:
	##############
lwz	r4,0x221c(r31)	# check if in hitstun
rlwinm. r4,r4,0,6,6
beq-	HITSTUN_CHECK_END
lbz	r4,0x221a(r31)	# if contains (00000020) then in hitlag
cmpwi	r4,0
bne-	HITLAG

lwz	r4,0x2340(r31)
lis	r5,0x3f80	# load float 1
cmpw	r4,r5
bne-	HITSTUN_CHECK_END
li	r4,1		# 0x01 = fresh out of hitstun flag
stb	r4,-0x3f(r31)	# store custom cpu input flag
b	END
HITSTUN_CHECK_END:



	########
	SPACIE_ONLY_FRAMECHECKS:
	########

bl	SPACIE_CHECK
cmpwi	r3,0
beq-	SPACIE_FRAMECHECK_END

lwz	r3,0x10(r31)	# load action state
cmpwi	r3,0x169	# grounded actionable shine state?
bne-	END_SHINE_GROUNDED_CHECK

JUMP_FROMSHINE:
li	r3,0
stw	r3,0x620(r31)	# 0 x joystick
stw	r3,0x624(r31)	# 0 y joystick
bl	BUTTONS_X
bl	GROUNDTYPE_RETRIEVE
cmpwi	r3,0
beq-	WAVEDASH_AWAY_FORWARD
bl	WAVEDASH_DOWN_FLAGSET
b	END
WAVEDASH_AWAY_FORWARD:
lbz	r3,-0x570E(r13)# load random byte
cmpwi	r3,0x40
blt-	END
cmpwi	r3,0x5f
bgt-	WAVEDASH_TOWARD
WAVEDASH_BACK:
bl	WAVEDASH_BACK_FLAGSET
b	END
WAVEDASH_TOWARD:
bl	WAVEDASH_FORWARD_FLAGSET
b	END
END_SHINE_GROUNDED_CHECK:


bl	SPACIE_SHINE_CHECK
cmpwi	r3,0
beq-	SPACIE_FRAMECHECK_END
lwz	r3,0x10(r31)
cmpwi	r3,0xe
bne-	END
SHINE:
b	DOWN_B_BUTTON

SPACIE_FRAMECHECK_END:
b	END

##########
HITLAG:
li	r4,0
stb	r4,-0x3f(r31)	# reset action flag when getting hit
b	END

################
# Subfunctions #
################

GROUNDTYPE_RETRIEVE:
mflr	r0
stw	r0,0x4(sp)
stwu	sp,-0x8(sp)
addi	r3,r31,0x6f0
lwz	r3,0x14c(r3)
lis	r4,0x8005
ori	r4,r4,0x4cec	# StageFile_GroundIDTypeLoad
mtlr	r4
blrl
rlwinm	r3,r3,0,22,23
lwz	r0,0xc(sp)
addi	sp,sp,8
mtlr	r0
blr

#------------------
HITBOX_ACTIVE_CHECK_LASTHIT:
# checks if hitboxes are active for player who last hit this player
# input r31 = internal data offset
# output r3 = number of active hitboxes (1-indexed)

li	r6,0		# initialize active hitbox counter
lwz	r3,0x18c4(r31)	# load slot of player last hit by
cmpwi	r3,6
bge-	HITBOX_ACTIVE_END
lwz	r3,0x1868(r31)	# load external player damage from source
cmpwi	r3,0
beq-	HITBOX_ACTIVE_END
lwz	r3,0x2c(r3)	# get to internal
addi	r3,r3,0x914	# get to first hitbox structure
li	r4,0		# initialize counter
HITBOX_ACTIVE_LOOP:
mulli	r4,r4,0x138	# hitbox structures are 0x138 apart
lwzx	r5,r4,r3
cmpwi	r5,0
beq-	NOT_ACTIVE
addi	r6,r6,1
NOT_ACTIVE:
addi	r4,r4,1
cmpwi	r4,4
blt-	HITBOX_ACTIVE_LOOP
HITBOX_ACTIVE_END:
mr	r3,r6
blr
#------------------

DAMAGE_SOURCE_LOAD:
#- loads internal data offset or damaging player
lwz	r4,0x18c4(r31)	# load player slot who last damaged this player
cmpwi	r4,6
bge-	DAMAGE_SOURCE_END_FALSE
lis	r3,0x8045
ori	r3,r3,0x3130	# P1 external data offset
mulli	r4,r4,0xe90	# multiply by player block offsets
add	r4,r4,r3	# get to this player's external offset
lwz	r3,0(r4)	# load external offset
cmpwi	r3,0		# just in case
beq-	DAMAGE_SOURCE_END_FALSE
lwz	r5,0x70(r3)	# load action state
cmpwi	r5,0xb		# Sleep action state?
bne-	CONTINUE_DAMAGE_SOURCE
lwz	r3,0x4(r4)	# load secondary char
cmpwi	r3,0
beq-	DAMAGE_SOURCE_END_FALSE
CONTINUE_DAMAGE_SOURCE:

lwz	r3,0x2c(r3)	# load internal last damage player
b	DAMAGE_SOURCE_END
DAMAGE_SOURCE_END_FALSE:
li	r3,0
DAMAGE_SOURCE_END:
blr
#-----------------
MULT_FLOAT_BY_FACING:
stw	r3,0xb4(sp)
lfs	f15,0xb4(sp)
lfs	f16,0x2c(r31)
fmuls	f15,f15,f16
stfs	f15,0xb4(sp)
blr

#-----------------
WAVEDASH_FORWARD_FLAGSET:
li	r4,2
stb	r4,-0x3f(r31)
blr

#-----------------
WAVEDASH_BACK_FLAGSET:
li	r4,3
stb	r4,-0x3f(r31)
blr

#-----------------
WAVEDASH_DOWN_FLAGSET:
li	r4,4
stb	r4,-0x3f(r31)
blr

#-----------------
BUTTONS_STORE:
# - r3 comes in as buttons
stw	r3,0xB0(sp)	# overwrite default button presses
blr

#------------------
BUTTONS_L:
li	r3,0
ori	r3,r3,0x0040
stw	r3,0xB0(sp)	# overwrite default button presses
blr

#-----------------
BUTTONS_X:
li	r3,0
ori	r3,r3,0x0400
stw	r3,0xB0(sp)	# overwrite default button presses
blr

#------------------
SPACIE_CHECK:
# check if CPU is Fox or Falco
li	r3,0
lwz	r4,0x4(r31)	# load internal char ID
cmpwi	r4,1
beq-	SPACIE_TRUE
cmpwi	r4,0x16
bne-	SPACIE_CHECK_END
SPACIE_TRUE:
li	r3,1		# this char is a spacie
SPACIE_CHECK_END:
blr
#------------------

SPACIE_SHINE_CHECK:
# fox shine has radius 8, falco shine has radius 6
mflr	r0
stw	r0,0x4(sp)
bl	DAMAGE_SOURCE_LOAD
cmpwi	r3,0
beq-	SPACIE_SHINE_CHECK_END_FALSE
mr	r4,r3
lfs	f15,0xB0(r31)	# load CPU's x-coord TopN
lfs	f16,0xB0(r4)	# load Human's (assuming) x-coord
bl	WITHIN_RADIUS_CHECK
cmpwi	r3,0		
beq-	SPACIE_SHINE_CHECK_END_FALSE
lfs	f15,0xB4(r31)	# load CPU's y-coord TopN
lfs	f16,0xB4(r4)	# load Human's (assuming) y-coord
bl	WITHIN_RADIUS_CHECK
cmpwi	r3,0
beq-	SPACIE_SHINE_CHECK_END_FALSE
b	SPACIE_SHINE_CHECK_END_TRUE

WITHIN_RADIUS_CHECK:
# - r4 is not used

li	r3,0
lis	r6,0x4100	# load 8.00 - Fox
#lwz	r5,4(r31)	# load internal char ID
#cmpwi	r5,1
#beq-	RADIUS_GO
#lis	r6,0x40c0	# load 6.00 - Falco
RADIUS_GO:
stw	r6,0xB4(sp)	# store radius float
lfs	f17,0xB4(sp)	# load radius in FP register
fsubs	f15,f15,f16	# subtract CPU coord from Human coord
fabs	f15,f15		# get absolute value
fcmpo	cr0,f15,f17	# compare coord distance to radius
bgt-	RADIUS_CHECK_END
li	r3,1
RADIUS_CHECK_END:
blr



SPACIE_SHINE_CHECK_END_TRUE:
li	r3,1
b	SPACIE_SHINE_CHECK_END
SPACIE_SHINE_CHECK_END_FALSE:
li	r3,0
SPACIE_SHINE_CHECK_END:
lwz	r0,0x4(sp)
mtlr	r0
blr	

#####################
END_AND_CLEAR_FLAG:
#####################
li	r4,0
stb	r4,-0x3f(r31)

	
END:

## Restore Stack
lmw	r15,0x6c(sp)	# restore registers
lwz	r3,0xB0(sp)	# load button inputs
addi	sp,sp,0xD0	# restore stack position
END_END:
stw	r3,0x65c(r31)	# default code line, store button inputs

*****************
* 20XX Smash DI *
*****************
20XX SDI

SMASH DI: VANILLA, NONE, RANDOM, TOWARD, AWAY, UP, DOWN
SMASH DI PERCENT CHANCE:
CALCULATED ONCE PER FRAME OF HITLAG


inject @ 8008e510 - lfs f2,0x624(r3)	# load joystick Y
- in Damage_SmashDI_Check&Apply
-r4, r5 open
- f3=x joystick, f2 = y joystick

CODE_START:
lfs	f2,0x624(r3)	# default code line, load joystick Y

lbz	r5,0xc(r3)	# load port number
lis	r4,0x8045	
ori	r4,r4,0x3088	# load P1 player block type index
mulli	r5,r5,0xe90	# players are 0xe90 apart
lwzx	r5,r5,r4	# load this player's type
cmpwi	r5,0		# is this player a human?
beq-	END_VANILLA

lwz	r4,0x1A94(r3)	# load CPU AI Type
cmpwi r4,5		# manual type?
beq-	END_VANILLA

lis	r4,0x8040
lwz	r5,-0x5174(r4)	# load smash DI type, debug flag, @ 803fae8c
cmpwi	r5,0		# is SDI type vanilla? 
beq-	END_VANILLA

subi	sp,sp,0xc	# move stack back
stw	r3,0x8(sp)	#store r3 in stack

cmpwi	r5,1		# is SDI type None?
beq-	NULL_JOYSTICKS

# if code gets to this point, an SDI option is chosen

lis	r3,0x8038
ori	r3,r3,0x0580	# load random function
mtlr	r3
li	r3,100
blrl
addi	r3,r3,1
lis	r4,0x8040
lwz	r5,-0x5170(r4)	# load smash DI chance, debug flag, @ 803fae90
cmpw	r3,r5
bgt-	NULL_JOYSTICKS

### EXECUTE SMASH DI
# r4 = 0x8040
lwz	r3,0x8(sp)	# pop r3 in stack	
li	r5,0
stb	r5,0x670(r3)	# store 0 into x joystick hold count
#stb	r5,0x671(r3)	# store 0 into y joystick hold count, only 0x670 should be necessary
lwz	r5,-0x5174(r4)	# load smash DI type, debug flag, @ 803fae8c

cmpwi	r5,2		# is SDI type Random?
beq-	RANDOM_SDI
cmpwi	r5,3		# is SDI type Towards?
beq-	TOWARDS
cmpwi	r5,4
beq-	AWAY
cmpwi	r5,5
beq-	UP
		#r5 = 6
DOWN:
lfs	f3,0x18(r2)	# loads 0 for x joystick
lis r5,0xbf80
stw r5,0(r2)
lfs f2,0(r2)
b	END

UP:
lfs	f3,0x18(r2)	# loads 0 for x joystick
lis r5,0x3f80
stw r5,0(r2)
lfs f2,0(r2)
b	END

AWAY:
lfs	f3,0x1844(r3)	# load damage direction
fneg	f3,f3
b	NULL_Y_JOYSTICK

TOWARDS:
lfs	f3,0x1844(r3)	# load damage direction
b	NULL_Y_JOYSTICK	

RANDOM_SDI:
#get random number between 0-359, inclusive
lis 	3,0x8038
ori	r3,r3,0x0580	# load random function
mtlr	r3
li	r3,360		#1 degree resolution (?)
blrl


bl CONVERT_TO_FLOAT


lfs	f16,-0x7510(rtoc)	#load 0.017453 (pi/180)
fmuls	f17,f16,f15		#f17 = angle (radians)


#joystick analog
#******
#1.00 hypotenuse everytime
lfs f15,-0x76ac(rtoc)
# I could change this from 1.00 to anywhere above the min 
#*****

fmr	f1,f17
lis	r15,0x8032
ori	r15,r15,0x6240	#load cosine function
mtlr	r15
blrl
fmuls	f31,f1,f15	# store as new x joystick

fmr	f1,f17
lis	r15,0x8032
ori	r15,r15,0x63d4	#load sine function
mtlr	r15
blrl
fmuls	f2,f1,f15	# store as new x joystick
fmr	f3,f31
b END

CONVERT_TO_FLOAT:
#convert to float
#r3 = input, f15 = output
lis	r18,0x4330
lfd	f16,-0x73a8(rtoc)
stw	r18,-0x14(sp)
stw	r3,-0x10(sp)
lfd	f15,-0x14(sp)
fsubs	f15,f15,f16
blr


NULL_JOYSTICKS:
lfs	f3,0x18(r2)	# loads 0 for x joystick
NULL_Y_JOYSTICK:
lfs	f2,0x18(r2)	# loads 0 for y joystick

END:
lwz	r3,0x8(sp)	# pop r3 in stack
addi	sp,sp,0xc	# move stack forward

END_VANILLA:


************************************
* 20XX 4.0 1P Mode Freeze Research *
************************************

Seems like no "multi-man" spawns are working correctly. 

In Classic Mode, simply no enemies show up and you are forced to lose all your lives or let the time run out.

8046b698 = the byte that the "SpawnAdventure Mode" function looks at.

vanilla = 40
20XX 4.0 = 00

problem!

it is writing 00 at 8016a300, 8016a30c

Shortly before these lines, it is doing an rlwimi with r14. I'm assuming some custom code modifies r14 at some point and is messing up the value. Need to go deeper.

Yeah, if when it writes 00, I change it to 40, then the multi-man chars spawn. Need to figure out where r14 gets messed up.

Nope, it's the value in r25.
This comes from 8017d394 - stw r0,0x28(sp)
This r0 comes from 8017d36c - rlwinm r0,r16,0,24,31

8017ce70 - addi r16,r7,0
- in both vanilla and 20XX, this loads 1 into r16 which is good! Now something below is overwriting it. This is when things get tricky with writing custom code using registers, because it looks like r14 to r23 are all important from here on out within this [bigish] function.

FOUND IT!
The blrl at 8017cf80, that blrl's into the "get item frequency" function for this game mode.

My code for 1P Item Frequencies.


New Codes (Just single them out):

Classic Mode:
inject @ 8017eb5c
- make r3 the item frequency
- can use r0,r4, r6(I think)



CLASSIC_MODE:
lis r4,0x8040
lwz r4,-0x5D98(r4)	# 3fa268 = Classic Mode freq debug flag
cmpwi r4,0
beq- END_DEFAULT
cmpwi r4,1
beq- NO_ITEMS
subi r3,r4,2
b END
NO_ITEMS:
li r3,0xFF
b END
END_DEFAULT:
lbz r3,0(r3)
END:


ADVENTURE_MODE:
lis r4,0x8040
lwz r4,-0x5D9C(r4)	# 3fa264 = Adventure Mode freq debug flag
cmpwi r4,0
beq- END_DEFAULT
cmpwi r4,1
beq- NO_ITEMS
subi r3,r4,2
b END
NO_ITEMS:
li r3,0xFF
b END
END_DEFAULT:
lbz r3,0(r3)
END:


ALL_STAR_MODE:
lis r4,0x8040
lwz r4,-0x5DA0(r4)	# 3fa260 = All-star Mode freq debug flag
cmpwi r4,0
beq- END_DEFAULT
cmpwi r4,1
beq- NO_ITEMS
subi r3,r4,2
b END
NO_ITEMS:
li r3,0xFF
b END
END_DEFAULT:
lbz r3,0(r3)
END:



--------

Still some freezing at G&W All Star Match

Break at InfiniteLoop
LR = 80345a5C
LR = 803707a0

***********************
* Message Box Display *
***********************
Dialogue Boxes

801aee6c
r3 = Yes/No availability?
		0 = no Yes/No boxes
r4 = int, text index to display
		0x12 = "The memory card could not be formatted"
r5 = int, number of text rows

inject @ 1AEE70

lis r6,0x817C
lwz r7,-0x10(r6)
cmpwi r7,0
beq- DEFAULT
li r3,0
stw r3,-0x10(r6)
mr r4,r7
lwz r5,-0xc(r6)
DEFAULT:
cmpwi r3,1




043a63a0 60000000

inject @ 803a63a4 - stw r0,0x5c(r31) (storing pointer to text data)
cmpwi r4,0
bge- 0x0C
stw r4,92(r31)
b 0x0C
lwzx r0,r3,r0	# default code line @ 803a63a0
stw r0,92(r31)
nop

^^^^
Above code: If you set r4 input to 801aee6c function, as the memory address, 8036a63a4 will see it.


DAN SALVATO
Hook Dialog: 20XX Settings
Inject @ 1A1CA0 - TitleScreen_Think


lis r3,0x8046
ori r3,r3,0x9d40
lbz r4,8(r3)
cmpwi r4,0
bne- END:
li r4,1
stb r4,8(r3)
lis r3,0x8043
ori r3,r3,0x331c
stw r4,0(r3)
lis r3,0x817c
lis r4,0x817c
ori r4,r4,0x0138
stw r4,-0x10(r3)
li r4,6
stw r4,-0xc(r3)
END:
li r3,1

***********************
* Skip Results Screen *
***********************

Skip Results Screen (v1.02) [Dan Salvato]
041b15cc 38800000

@ 1a5b00 - addi r27,r4,0
- r27,r28 available


#check for extra chars that freeze game at results screen
lis	r28,0x8045
ori	r28,r28,0x21f8	# 0xe90 from 80453084 - P1 slot type
li	r30,0

CHAR_CHECK_LOOP:

lwzu	r27,0xe90(r28)	# load slot type
cmpwi	r27,3
beq-	LAST_PLAYER_CHECK
addi	r30,r30,1	# increment active players
lwz	r27,-0x4(r28)	# load 	external char ID
cmpwi	r27,0x1a	# master hand or another extra char?
bge-	SKIP

LAST_PLAYER_CHECK:

lis	r27,0x8045
ori	r27,r27,0x7958	# P6 slot type ID
cmpw	r27,r28		# gone through all six players?
bne-	CHAR_CHECK_LOOP

cmpwi	r30,5		# 5 or more active players?
bge-	SKIP


DEBUG_FLAG:
lis	r28,0x8040
lwz	r28,-0x5C2C(r28)# load skip results screen debug flag (3fa3d4)
cmpwi	r28,0		# is skip results screen off?
beq-	DEFAULT


SKIP:
#Do not add stars if not in Stock Mode
#check if in Stock Mode
lis	r31,0x8046
ori	r31,r31,0xb6a0
lbz	r27,0x24c8(r31)
rlwinm	r27,r27,27,29,31
subfic	r27,r27,1
cntlzw	r27,r27
rlwinm	r31,r27,27,5,31
cmpwi	r31,0		# r30=0=no, 1=yes
beq-	SKIP_FINAL



li	r31,0xff	# register flag for no ragequit star, 0xff means not a ragequit 
lis	r27,0x8045
lwz	r28,0x2c6c(r27)	# load current camera type
cmpwi	r28,1		# is current camera type pause (ragequit)?
bne-	SKIP_STARS
lbz	r31,0x2f2d(r27) # load player who paused
addi	r31,r31,1	# get to this code's player increment type (1-index)
cmpwi	r31,0x5
blt-	SKIP_STARS
li	r31,0xff

SKIP_STARS:
#modify stars as games won
#4D6730 = kO star count (1 byte per player)
#804D65A8 = placements during/after match (1 byte per player)
li	r27,0		# initialize player counter
PLACEMENT_LOOP:
addi	r27,r27,1		# increment player counter
cmpwi	r27,5		# gone through all four players?
beq-	SKIP_FINAL
lis	r28,0x804d
ori	r28,r28,0x65a7	# player placements address minus 1
lbzx	r28,r28,r27
cmpwi	r28,0		# is placement 0 = first place?
bne-	PLACEMENT_LOOP

cmpw	r27,r31		# did this player ragequit?
beq-	PLACEMENT_LOOP

mulli	r30,r27,0xe90
lis	r28,0x8045
ori	r28,r28,0x21f8	# 0xe90 from 80453088 = P1 type
lwzx	r28,r28,r30
cmpwi	r28,3		# is player not in game?
beq-	PLACEMENT_LOOP

ADD_STARS:
lis	r28,0x804d
ori	r28,r28,0x672f	# load KO stars address minus 1
lbzx	r30,r28,r27	# load KO stars for this player
cmpwi	r30,0xff		# 255 stars already?
beq-	PLACEMENT_LOOP
addi	r30,r30,1		# add 1 to star count
stbx	r30,r28,r27	# store new star count
b	PLACEMENT_LOOP

SKIP_FINAL:
li	r27,0		# CSS ID instead of Results Screen (0x4)
b	END

DEFAULT:
#li	r27,4		# default code line, Results Screen ID
li	r27,0		# new default code line, always skip results and load CSS ID
END:


-------------

This function above is branched into from 801a4144

Leaving:

Vs Mode
801b15d4 - li r5,3

Super Sudden Death
801b8ca8 - li r5,3

Tiny Melee
801b8eb4 = li r5,3


...I think I need to change the above injection to right at the beginning of function 801a5af0. Modify r4 at this point from 4 to 0 to skip the results screen.

*******************
* Force Match End *
*******************
Hold Start
inject @ 16cda8 - mr r31,r3

lbz	r0,-0x4b10(r13)
cmpwi	r0,180
blt-	DEFAULT
li	r0,1
lis	r31,0x8046
ori	r31,r31,0xb6a0
stb	r0,0(r31)


DEFAULT:
mr	r31,r3

*****************
* 20XX TE Notes *
*****************
version 1a

3fc800 = replay menu debug menu data start

SAVE TO MEMORY CARD
	Function Start: 80192100

LOAD FROM MEMORY CARD
	Function Start: 80192500

DELETE FROM MEMORY CARD
	Function Start: 80192280

PLAY REPLAY
	Function Start: 802ffea4


Input Display
Flag @ 80469db8

If ON, writes 803fd000 to 804d6e18
Rectangle Data is at 803fd000 to 803fd8f0

Code to control showing inputs:

Inject @ 8006ad48
ASM at 817c2878

*************************
* 20XX TE Input Display *
*************************
20xxte input display
As of now, the 20XX TE Input Display Text Structs start @ 803fc290 (003f9290 DOL)
#Inject @ 8006ad48 - rlwinm. r0,r0,27,31,31
inject @ 8006b80c # new injection line, at end of controller input function
- text structs are only shown for active human players
- future: remove Z if in frame advance?
	- change injection point to after replays if I ever implement replays

- From v.2b



.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.set inputDisplay.customText, 0x800036f4 # 800036f4 is (custom text 0x2) input display (!!!)
.set inputDisplay.debugFlag, 0x803faf44
.set inputDisplay.loc, 0x803fc290

word_load r3,r3,inputDisplay.customText
cmpwi r3,0	# if null, skip
beq- END

adr_load r3,inputDisplay.loc
mr r5,r3
STRUCT_LOOP:
li r4,0xc0	# disable display of all structs
stb r4,0x26(r3)
lwz r3,0x30(r3)
cmpwi r3,0
bne- STRUCT_LOOP
STRUCT_LOOP_END:

PLAYER_COUNT:
lwz	r3,-0x3e74(r13)
lwz	r3,0x20(r3) 	# should get you the first player who was created, external data offset

PLAYER_LOOP:
lwz r3,0x2c(r3)

lbz r12,0xc(r3)	# load port number
mulli r12,r12,0xe90
lis r4,0x8045
ori r4,r4,0x3088	# P1 player type
lwzx r4,r4,r12	# load this player's type
cmpwi r4,0	# check if human
bne- STRUCT_APPEAR_COMPARE

lbz r12,0x618(r3)	# load player control index (used to be port id @ 0xc)
cmpwi r12,4	# check if P5 or greater (just for safety)
bge- STRUCT_APPEAR_COMPARE

mulli r4,r12,0x23c
add r4,r4,r5
li r6,0

STRUCT_APPEAR_LOOP:
li r12,0x80	# hide text, show bg rectangle
stb r12,0x26(r4)
addi r6,r6,1
addi r4,r4,0x34
cmpwi r6,11
blt+ STRUCT_APPEAR_LOOP

STRUCT_APPEAR_COMPARE:
lwz r3,0(r3)	# load external data offset
lwz r3,8(r3)	# load next spawned player
cmpwi r3,0		# check if this is last spawned player
bne- PLAYER_LOOP

lbz r12,0x618(r31)	# load player control index (used to be port id @ 0xc)
cmpwi r12,4
bge-	END

lis r4,0x804c
ori r4,r4,0x21cc
mulli r5,r12,0x44
add r4,r4,r5

mulli r5,r12,0x23c
adr_load r3,inputDisplay.loc
add r3,r3,r5

mr r8,r3
li r6,0

LOOP1:

lwz r7,0x18(r8)
stw r7,0x10(r8)
lwz r7,0x1c(r8)
stw r7,0(r8)	# store original X and Y offset

# Debug Menu Y-Padding
lhz r7,2(r8)	# load original Y-offset
word_load r9,r9,inputDisplay.debugFlag
add r7,r7,r9
sth r7,2(r8)

addi r6,r6,1
addi r8,r8,0x34
cmpwi r6,11
blt+ LOOP1

li r7,-1
lbz r6,0x1c(r4)
cmpwi r6,0x80
blt- 0x08
li r6,127
li r9,128
add r9,r9,r6
stb r9,0x14b(r3)
stb r9,0x148(r3)
lbz r6,0x1d(r4)
cmpwi r6,128
blt- 0x08
li r6,127
li r9,128
add r9,r9,r6
stb r9,279(r3)
stb r9,276(r3)
lwz r6,0(r4)
rlwinm. r9,r6,0,23,23 # (00000100)
beq- 0x08
stw r7,16(r3)
rlwinm. r9,r6,0,22,22 # (00000200)
beq- 0x08
stw r7,68(r3)
rlwinm. r9,r6,0,21,21 # (00000400)
beq- 0x08
stw r7,120(r3)
rlwinm. r9,r6,0,20,20 # (00000800)
beq- 0x08
stw r7,172(r3)
rlwinm. r9,r6,0,27,27 # (00000010)
beq- Z_END
lis r9,0x8048
lbz	r9,-0x6298(r9)
rlwinm. r9,r9,0,31,31 #(00000001)	in frame advance?
bne- Z_END
stw r7,224(r3)
Z_END:
rlwinm. r9,r6,0,26,26 # (00000020)
beq- 0x08
stw r7,276(r3)
rlwinm. r9,r6,0,25,25 # (00000040)
beq- 0x08
stw r7,328(r3)
li r9,6
lbz r7,0x18(r4)
extsb r7,r7
divw r7,r7,r9
lhz r8,416(r3)
extsh r8,r8
add r8,r8,r7
sth r8,416(r3)
lbz r7,0x19(r4)
extsb r7,r7
neg r7,r7
divw r7,r7,r9
lhz r8,418(r3)
extsh r8,r8
add r8,r8,r7
sth r8,418(r3)
lbz r7,0x1a(r4)
extsb r7,r7
divw r7,r7,r9
lhz r8,520(r3)
extsh r8,r8
add r8,r8,r7
sth r8,520(r3)
lbz r7,0x1b(r4)
extsb r7,r7
neg r7,r7
divw r7,r7,r9
lhz r8,522(r3)
extsh r8,r8
add r8,r8,r7
sth r8,522(r3)

END:
#rlwinm. r0,r0,27,31,31	# old default code line
lwz r0,0x7c(sp)

**************************************
* 20XX 4.05+ Memory Card Name Change *
**************************************
003b7c5c (DOL)

Super Smash Bros. Melee

"Game Data" --> "20XX Data"

"SuperSmashBros011029" --> "XXperSmashBros011029"

(I think 20XXTE was using XuperSmashBros011029)

****************************
* v1.00 Item Freeze Glitch *
****************************

Turnip Freeze Glitch

1.00
ThrowItem = 802699F4

Turnip Entity - 80d65380 (80D66100)

Reg Throwing
r3 = 803f1f90
r12 = 802bc0cc


Regular Turnip:
Y velocity gets updated at line 80271538
802714d8
	802bc19c
		blrl @ 802684f0 [802684b4] - some checks here
			blrl @ 8038ef38


Frozen Turnip - Y velocity does not get updated

FOUND IT!
internal item offset + 0xDC9 [byte]
	- if this includes 0x40, then item is in "frozen" mode.
	- now, just to find what causes this.

AND	0xDC8 [byte], must include 01 or after hitting an oppenent, the frozen turnip will return to normal.


Memory read on 0xDC9 byte
	- 0xDC8 and 0xDC9 get read and written every frame at 80268a78 ish


	- when getting frozen, 0x4c (+0x40) gets written at 802693a8 (1.02 = 8026A6D4)


Alright. When getting hit, before setting 0xDC9 to (+0x40), 0xDC8 is set to 0x10. This causes line 80269374 to get executed and onward. This equivalent code line in 1.02 never gets executed. So what sets 0xDC8 to 0x10??? Might just be the key.

Memory read/write on 0xDC8 after frame advancing to the Peach Up+B frame.

80268100 sets it to 0.


8026a408 writes 10 to 80d66ec8


	8011ce04 --> bl 0x8026a3f8
   1.02:8011d424 --> bl 0x8026b724



1.02 executes this code line similarly. But 0x00 is written back into 0xDC8 at 8026b76c.

  1.00: 8011ced8 --> bl 0x8026a410
  1.02: 8011a564 --> bl 0x8026b73c

Now, the problem lies at a check at the beginning of this function. 

1.00: 8011ceb8 --> lwz r3,0x223c(r31) --> r3 = 0
1.02: 8011d544 --> lwz r3,0x223c(r31) --> r3 = 80d688e0 = turnip entity

1.00: r31 = c6e060 (+223c = C7029C)
1.02: r31 = c716e0 (+223c = C7391C)



1.02: 8011d480 writes 0x80d688e0 to 0x223c(r31)





1.02
Turnip Entity - 80d688e0  (80d6a560)


Enable Item Freeze Glitch (1.02)

0426b748 4D820020
0426b758 4e800020

*********************
* SFX on AutoCancel *
*********************

Using the OnEveryFrame SFX function

inject @ 8008d60c - lwz r5,0x2c(r3)  #

lwz r5,0x2c(r3)	# default code line
lwz	r6,0x2200(r5)	#load autocancel word
cmpwi	r6,0
bne-	END
lis	r6,0x8040
lwz	r6,-0x515C(r6)	# load SFX on AutoCancel flag
cmpwi	r6,0
beq-	END
li	r6,0xb4
stw	r6,-0x4B0C(r13)#store SFX ID to play @ 804D6B94 (custom 20XX flag)
END:


************************
* Disable Fixed Camera *
************************
8002f8f4   CameraInfo_Type_Fixed_Store

Function 801c5800 gets executed at Match Start and during Pause/Unpause to change the camera type accordingly.


Disable Fixed Camera for Fixed Camera Mode
04165290 4e800020

inject @ 80165290

.set CameraInfo, 0x80452c68
.set CameraInfo.Type, 4
.set CameraType.Default, 0
.set CameraType.Fixed, 4
.set StageInfo, 0x8049e6c8
.set StageInfo.grGroundParam, 0x6b0
.set StageInfo.grGroundParam_off, StageInfo + StageInfo.grGroundParam
.set grGroundParam.FixedCamera, 0x4C

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

adr_load r4, CameraInfo
word_load r3,r3,StageInfo.grGroundParam_off
lwz r3,grGroundParam.FixedCamera(r3)
cmpwi r3,0
beq+ CAMERA_DEFAULT
CAMERA_FIXED:
li r3, CameraType.Fixed
b CAMERA_STORE
CAMERA_DEFAULT:
li r3, CameraType.Default
CAMERA_STORE:
stw r3,CameraInfo.Type(r4)

END:
blr	# skip always setting fixed camera

*********************
* Disable HUD Stuff *
*********************

Disable Player HUD
042f6508 4e800020

Disable Timer HUD
042F446C 4e800020

*************
* Timer HUD *
*************

4a1078 is always some pointer related to the timer I think. 0 if no timer on screen.

802f3414 Timer_GetRAMBoneStructure

Default Timer Location:
X: 0
Y: 17.65
Z: 0



####
To Enable/Disable Timer Display (simply making it appear/disappear):
- assuming it has been created and initialized

1) load pointer at 804a10a4
2) load word at pointer+0xC --> loads timer RAM bone structure
3) load flag word/byte at 0x14
	- 0x20000000 = display
	- 0x00000000 = hide
#####

For 20XX 4.0, I am going to always enable the timer to load in RAM so that it will always be available. Then I can manually hide/display it as necessary. 

Always Load Timer
042f4498 4800001c


inject @ 802f47f4 - stw r29,0(r31)
- r27 and onward are free
- r28 is the bone structure start for the timer, always I think

stw	r29,0(r31)	# default code line
lis	r29,0x8040
lwz	r30,-0x5150(r29)# load timer scale
stw	r30,0x2c(r28)	# store x scale
stw	r30,0x30(r28)	# store y scale
stw	r30,0x34(r28)	# store z scale
lwz	r30,-0x514c(r29)# load timer x-offset debug menu
stw	r30,0x38(r28)	# store x offset
lwz	r30,-0x5148(r29)# load timer y-offset debug menu
stw	r30,0x3c(r28)	# store y offset

lwz	r30,-0x5C74(r29)# load combo count as timer flag
cmpwi	r30,1
beq-	DISPLAY

DISPLAY_OR_HIDE:
lis	r29,0x8046
ori	r29,r29,0xdb68	# MatchInfo Start
lbz	r30,1(r29)
rlwinm.	r30,r30,25,31,31 #(00000080)
bne-	DISPLAY
lbz	r30,0(r29)
rlwinm.	r30,r30,31,31,31 #(00000002)
bne-	DISPLAY

HIDE:
li	r30,0
b	DISPLAY_OR_HIDE_END
DISPLAY:
li	r30,0x20
DISPLAY_OR_HIDE_END:
stb	r30,0x14(r28)	# store bone struct flag byte

END:



TIMER SCALE : FABB45
TIMER X-OFFSET : FABB53
TIMER Y-OFFSET : FABB64
DEFAULT : (0,17.7) FABB75

*****************************
* Unrestricted Pause Camera *
*****************************

12/7/15
Made a DOL mod for this a long time ago that I need to change. It breaks the ZOOOM camera in training mode (camera type 0x1). It makes it WAY too zoomed in.



Unrestricted Pause Camera
[achilles]
Version ---- DOL Offset ------ Hex to Replace ---------- ASM Code
1.02 ------- 0x221804 ---- C0230040 -> 39E00000 ---- lfs f1,0x40(r3) -> li r15,0
------------ 0x02C190 ---- D03F02F8 -> 91FF02F8 ---- stfs f1,0x2F8(r31) -> stw r15,0x2F8(r31)
------------ 0x221824 ---- C0230048 -> 3DE04700 ---- lfs f1,0x48(r3) -> lis r15,0x4700
------------ 0x02C19C ---- D03F02FC -> 91FF02FC ---- stfs f1,0x2FC(r31) -> stw r15,0x2FC(r31)
------------ 0x22183C ---- EC210032 -> 3DE04700 ---- fmuls f1,f1,f0 -> lis r15,0x4700
------------ 0x02C16C ---- D03F02E8 -> 91FF02E8 ---- stfs f1,0x2E8(r31) -> stw r15,0x2E8(r31)
------------ 0x221854 ---- EC210032 -> 3DE04700 ---- fmuls f1,f1,f0 -> lis r15,0x4700
------------ 0x02C174 ---- D03F02EC -> 91FF02EC ---- stfs f1,0x2EC(r31) -> stw r15,0x2EC(r31)
------------ 0x22186C ---- EC210032 -> 3DE04700 ---- fmuls f1,f1,f0 -> lis r15,0x4700
------------ 0x02C184 ---- D03F02F4 -> 91FF02F4 ---- stfs f1,0x2F4(r31) -> stw r15,0x2F4(r31)
------------ 0x221884 ---- EC210032 -> 3DE04700 ---- fmuls f1,f1,f0 -> lis r15,0x4700
------------ 0x02C17C ---- D03F02F0 -> 91FF02F0 ---- stfs f1,0x2F0(r31) -> stw r15,0x2F0(r31)


This DOL is storing (offset from 80452c68)

0x2e8 = 47000000
0x2ec = 47000000
0x2f0 = 47000000
0x2f4 = 47000000
0x2f8 = 00000000
0x2fc = 47000000

inject @ 8002f5bc

lis	r3,0x8048
lbz	r3,-0x6298(r3)	# load screen freeze byte
rlwinm. r3,r3,0,30,30 # check for 02 = paused
beq-	END_DEFAULT	
lis	r3,0x8048
lbz	r3,-0x62D0(r3)	#load menu controller major
cmpwi	r3,0x1c		# is this training mode?
beq-	END_DEFAULT
li	r3,0
stw	r3,0x2f8(r31)
lis	r3,0x4700
stw	r3,0x2e8(r31)
stw	r3,0x2ec(r31)
stw	r3,0x2f0(r31)
stw	r3,0x2f4(r31)
stw	r3,0x2fc(r31)
lis	r3,0x8003
b	END_END

END_DEFAULT:
lis	r3,0x8003
stfs f1,764(r31)
END_END:

****************
* MnSlMap Text *
****************
tags: stage select screen text font, sss text, sss font

Top Serif Text

Font: Palatino Linotype, Bold
Size: 18

Big Stage Name
Font: A-OTF Folk H
Size: 31 (gets transformed into 40.72?)
W: 100%
H: 128%

H: -13 degrees

***********************************
* Zelda/Sheik Transform Functions *
***********************************

8013aee0 - Zelda, Grounded Down+B

	branched into from 800d6908 - in Interrupt_Down+B_Grounded

80114160 - Sheik, Grounded Down+B


80 - Zelda, Aerial Down+B
	branched into from 8009672c



DISABLE TRANSFORMATIONS
Aerial Down+B:

inject @ 80096728 - addi r3,r30,0
- r30 = external player data offset

lis	r3,0x8045
ori	r3,r3,0x3088	# P1 player type
lwz	r5,0x2c(r30)	# load internal char data offset
lbz	r4,0xc(r5)	# load player number
mulli	r4,r4,0xe90	# player blocks are 0xe90 apart
lwzx	r4,r4,r3	# load player type
cmpwi	r4,0		# is player human?
beq-	END
#player is a CPU
lwz	r4,0x1a94(r5)	# load CPU type
cmpwi	r4,5		# is CPU "Manual" AI?
beq-	END

lwz	r4,4(r5)	# load internal char ID
cmpwi	r4,0x13		# if Zelda
beq-	NO_TRANS_BRANCH
cmpwi	r4,0x7		# if Sheik
bne-	END

NO_TRANS_BRANCH:
lis	r3,0x8009
ori	r3,r3,0x68b0	# end of function
mtctr	r3
li	r3,0		# 0 function return bool
bctr

END:
addi	r3,r30,0






Grounded Down+B
inject @ 800d68d8 - lwz r4,0x4(r5)
- r5 = internal player data offset

lis	r12,0x8045
ori	r12,r12,0x3088	# P1 player type
lbz	r4,0xc(r5)	# load player number
mulli	r4,r4,0xe90	# player blocks are 0xe90 apart
lwzx	r4,r4,r12	# load player type
cmpwi	r4,0		# is player human?
beq-	END
#player is a CPU
lwz	r4,0x1a94(r5)	# load CPU type
cmpwi	r4,5		# is CPU "Manual" AI?
beq-	END

lwz	r4,0x4(r5)	# load internal char ID
cmpwi	r4,0x13		# if Zelda
beq-	NO_TRANS_BRANCH
cmpwi	r4,0x7		# if Sheik
bne-	END

NO_TRANS_BRANCH:
lis	r3,0x800d
ori	r3,r3,0x6918	# end of function
mtctr	r3
li	r3,0		# 0 function return bool
bctr

END:
lwz	r4,0x4(r5)	# load internal char ID

*************************
* Debug Menu Freeze Bug *
*************************

For the millionth time...

1a4fa4
	fails @ 1a5054 - bl 0x803761c0

		fails  803761f4 - bl 0x 8034f314
			fails @ 8034f338 - bl  0x8034ba14
				fails 8034badc - bl0x8034b02c


gets to 8034b164, then when I step, it branches to 0x300 and never makes it back to 8034b168

****************************
* GO! Texture, Match Start *
****************************

Breakpoint at Bone showing function: 80370bec then going back a few functions

802f6f78 - bl 0x80370e44
- a little farther down

Disable Match Start/End Textures
- Ready, Go, Game, etc.
042F6FAC 60000000

************
* CSS Data *
************

-0x49f0(r13) = current CSS data start? (e.g. 804807b0)
-0x49ab(r13) = number of CSS players (like 1P modes = 1, Vs = 4)
-0x49b0(r13) = current player in a 1P CSS screen (0-indexed, 0xFF in vs mode)

*********************
* Impossible Cancel *
*********************

Cancel moves with l/r analog or digital instant press
- cancels by setting the current animation speed to 1000, ending it next frame.

inject @ 8006b844 - mr r28,r3
- in PlayerThink_Physics (of some sort) function, every frame per player
- at this point, r3 = external char data offset pointer


lwz	r28,0x6c8(r3)	# load instant buttons
rlwinm.	r31,r28,0,0,0	# check for (80000000) = l/r analog or dig
beq-	END
rlwinm.	r31,r28,0,27,27
bne-	END
lfs	f1,-0x179C(r2)	# load 1000 from table of contents, function input
lis	r31,0x8006
ori	r31,r31,0xf190	# 8006f190 = FrameSpeedChange, f1=newframespeed 
mtlr	r31
mr	r31,r3		# save r3 (r31 gets stored to stack in 8006f190)
blrl			
mr	r3,r31		# restore r3

END:
mr r28,r3		# default code line

************************
* Fastfalling Research *
************************

when fastfalling, +(0x08), byte, gets written to internal offset +0x221a
	- code line 8007d584

- Player cannot fastfall is self induced Y-veloc, +0x84, is greater than or equal to 0
- Joystick y-axis must be less than -0.66250. 
- cardinal direction change to -y-axis must have occurred within last 4 frames

Interrupt_Fastfall_CheckToExecute    8007d528
	- input r3 = internal data offset




*******************************
* ShortHop / FullHop Research *
*******************************

write shorthop self induced velocity @ 800cb19c
write fullhop self induced velocity @ 800cb19c

******************************
* Player Entity Spawn / Call *
******************************

player entity, data offset, first data offset, first player offset

retrieve first external data offset, first external data offset, first data offset
RETRIEVE_FIRST_EXTERNAL_DATA_OFFSET:
lwz	r3,-0x3e74(r13)
lwz	r29,0x20(r3) 	# should get you the first player who was created

then, they are all daisy chained together with 0x8 from external offset

--------

r3 = grabbing player internal +0x914

**************************
* Combo Counter Research *
**************************

(while doing Fox's down-air)
0002, second hit, is being stored to +0x2090 @ 80076410

0001 written @ 800763e0


800763C0   ComboCount_Logic

combo counter uses the "player getting comboed" pointer at 0x2094 to tell whether or not to extend the combo or reset it.

Need to look into what causes 0x2094 to be reset to 0.

0 written to 0x2094 @ 80076520

800764dc  ComboCount_HitstunCheckForDamagedPlayer
80076528  ComboCount_TopNModifyForLargeCombos
		- this function 


When combo counter is 5 or greater, your character starts being pushed backwards very slightly, by -0.025 every frame. If the combo is 13 or more, it's -0.07 every frame backwards.

Let's rewrite the Combo Count as Timer code


3fa38c = 20XX combo count as timer debug flag (word)

Flag

XXXXZZZZ YYYYYYY

XXXX = combo count value
ZZZZ = flags
YYYYYYYY = frame count at time of last hit + 90


inject @ 8007651c	li	r0,0
- increments combo counter (20XX timer only) for grabs

lwz	r0,0x10(r3)	# load action state
cmpwi	r0,0xDF		# CapturePulledHi?
blt-	END
cmpwi	r0,0x
cmpwi	r0,0xE4		# CapturePullLow?
bgt-	END
COMBOCOUNT_GRAB:
lis	r12,0x8000
lhz	r5,0x3330(r12)	# load combo count of hitter
addi	r5,r5,1
sth	r5,0x3330(r12)	# store new combo count into flag
lis	r5,0x8048	# 80479d60 = true frame count
lwz	r5,-0x62A0(r5)	# load scene frame count
addi	r5,r5,90	# 90 frames (second and a half)
stw	r5,0x3334(r12)	# store new combo count timer
END:
li	r0,0		# default code line

-------

injection line 1: 80040f84 - sth r0,0(r5)
at this point, r0 equals the combo count value
only gets executed when someone is [about to be] hit!

lis	r4,0x8000
sth	r0,0x3330(r4)
lis	r15,0x8047	# match frame count
lwz	r15,-0x493C(r15)
addi	r15,r15,60	# 60 frames (second)
stw	r15,0x3334(r4)	# store new combo count timer
END:
sth	r0,0(r5)




8016cde4 - lwz	r3,0x24(r31)

lis	r3,0x8040
lwz	r3,-0x5C74(r3)	# load combo counter debug flag
cmpwi	r3,0
beq-	END

#li	r5,0
lis	r3,0x8047
#sth	r5,-0x4934(r3)	# store 0 to subseconds (and freeze timer)

lbz	r5,-0x2498(r3)
li	r6,0
rlwimi	r5,r6,1,30,30 	# = (00000002)
li	r6,1
rlwimi	r5,r6,0,31,31	# = (00000001)
stb	r5,-0x2498(r3)


lis	r3,0x8000
lis	r5,0x8046	# match frame count
ori	r5,r5,0xb6c4
lwz	r5,0(r5)
cmpwi	r5,0
beq-	ZERO

lwz	r4,0x3334(r3)	# load flag frame count
cmpw	r4,r5
beq-	ZERO
lhz	r4,0x3330(r3)	# load combo count value
lis	r5,0x8047
stw	r4,-0x4938(r5)	# store as seconds left
b	END	

ZERO:
li	r5,0
lis	r4,0x8047
stw	r5,-0x4938(r4)	# store as seconds left
li	r6,0x3c		#0x003c milliseconds or whatev =0
sth	r6,-0x4934(r4)

MATCH_START:
stw	r5,0x3330(r3)	# zero custom combo count flags
stw	r5,0x3334(r3)
stw	r5,0x3338(r3)
stw	r5,0x333c(r3)

END:
lwz	r3,0x24(r31)





************************************
* Fox/Falco Corneria Special Taunt *
************************************

Taunt
lwz	r0,0x668(r30)
rlwinm.	r0,r0,0,28,28
beq-

Corneria Taunt Instead of Regular Taunt (from Wait action state)

040e59f0 4800000C
040e59fc 801E0668
040e5a00 54000739
040e5a04 4182006C
040e5a08 48000048

-----

Interrupt

Special Taunt, first and second half
800e5c38 - blr

Fox
frame 109 is last

Falco
frame 114 is last



Special Taunt
Action state 370 (spin) = 0 to 24
Action state 372 = 0 to 283 is kneeling, 284 starts standing, 306 is last frame
Action state 374 = 0 to 64


-----------


Modify Special Taunt Length to Match Normal Taunt Length
inject @ 800e5c18
- 110 frames for Fox
- 115 frames for Falco

cmpwi r4,0x176 # Special AppealR End
beq-	END
cmpwi r4,0x177 # Special AppealL End
beq-	END
lwz	r6,0x2c(r3)
lwz	r6,4(r6)	# load internal char ID
cmpwi	r6,1	# Fox?
beq-	FOX
FALCO:
lis r6,0x438d
b	NEW_FRAME
FOX:
lis r6,0x438f
ori r6,r6,0x8000
NEW_FRAME:	# bring new frame number to f1
stw r6,0(r2)
lfs f1,0(r2)
END:
li r6,0	# default code line

----------

Inject @ 800debd0 - mflr r0

lwz r4,0x2c(r3)
lwz	r4,4(r4)	# load internal char ID
cmpwi r4,1
beq-	SPECIAL_TAUNT_CHOOSE
cmpwi r4,0x16
bne-	END
SPECIAL_TAUNT_CHOOSE:
lbz	r4,-0x570E(r13)# load random byte
cmpwi r4,0x80
bge-	END

SPECIAL_TAUNT:
lis r4,0x800e
ori r4,r4,0x5a90
mtctr r4
bctr

END:
mflr r0

***************************************
* Custom Subaction - Projectile Spawn *
***************************************

F4FFZZAA XXXXYYYY X1X1Y1Y1 JJJJPPPP

F4 = subaction command byte (always keep as 0xF4)
FF = flag for custom function (always keep as 0xFF)
ZZ = Flags
	00 = launch item
	01 = give item to player
AA = Article ID
XXXX = X offset from player TopN
YYYY = Y offset from player TopN
VVVV = X velocity
ZZZZ = Y velocity
SSSS = model scale
TTTT = time to expire




8007320c seems to be an "empty" subaction of length 0x10

0xF4 = subaction code = controlling function 8007168c

Inject @ 8007168c
- r3 = external data offset
- r4 = data offset subaction timer offset

DEFAULT_FUNCTION:
lwz	r3,0x8(r4)
addi	r0,r3,4
stw	r0,0x8(r4)
blr

--------------------------------
NEW_SUBACTION_FUNCTION:

lwz	r5,0x8(r4)	# load current subaction RAM location
lbz	r5,1(r5)	# load second byte
cmpwi	r5,0xff		# 0xFF is flag for custom function
bne-	DEFAULT		# In case this function is used in vanilla

mflr	r0
stw	r0,0x4(sp)
subi	sp,sp,0x80	# push back stack
stw	r31,0x6c(sp)
stfd	f30,0x70(sp)
stfd	f31,0x78(sp)

UPDATE_SUBACTION_TIMER:
lwz	r5,0x8(r4)	# load current subaction location
stw	r5,0x68(sp)	# store this location in stack
addi	r6,r5,0x10	# custom subaction event is 0x10 in length
stw	r6,0x8(r4)	# store new subaction location


mr	r5,sp
subi	r5,r5,4
li	r6,0
li	r7,0
ZERO_LOOP:		# zero the entity struct in stack
stwu	r6,4(r5)
addi	r7,r7,4
cmpwi	r7,0x64
bne-	ZERO_LOOP

stw	r3,0x8(sp)	# store player pointer at entity (0x00)
stw	r3,0xc(sp)	# store player pointer at entity (0x04)
lwz	r3,0x2c(r3)	# r3 now holds internal data offset
lwz	r4,0x2c(r3)	# load facing direction
stw	r4,0x40(sp)	# store facing direction at entity (0x38)

lwz	r5,0x68(sp)	# load subaction location

#########
ITEM_HELD_CHECK:	# check only if giving item to player
lbz	r4,0x2(r5)	# load flags
rlwinm.	r4,r4,0,31,31	# does contain 01?
beq-	END_ITEM_HELD_CHECK
lwz	r4,0x1974(r3)	# load item held
cmpwi	r4,0
bne-	FINISH		# if not zero, then holding another item
END_ITEM_HELD_CHECK:
########

lbz	r4,0x3(r5)	# load item ID
stw	r4,0x10(sp)	# store item ID at entity (0x08)

lhz	r4,0x4(r5)	# load x-coord offset from TOPN
sth	r4,0x18(sp)	# this is free to use, set to 0 by SpawnEnt
lfs	f30,0x18(sp)	# load x-coord offset
lfs	f31,0x2c(r3)	# load facing direction
fmul	f30,f31,f30	# multiply facing direction by offset
lfs	f31,0xb0(r3)	# load TopN x-coord
fadd	f30,f30,f31
stfs	f30,0x1c(sp)	# store item x-coord at entity (0x14)
stfs	f30,0x28(sp)	# store item x-coord at entity (0x20)

lhz	r4,0x6(r5)	# load y-coord offset from TOPN
sth	r4,0x18(sp)	# this is free to use, set to 0 by SpawnEnt
lfs	f30,0x18(sp)	# load y-coord offset
lfs	f31,0xb4(r3)	# load TopN y-coord
fadd	f30,f30,f31
stfs	f30,0x20(sp)	# store item y-coord at entity (0x18)
stfs	f30,0x2c(sp)	# store item y-coord at entity (0x24)

lhz	r4,0x8(r5)	# load x-veloc
sth	r4,0x18(sp)
lfs	f30,0x18(sp)
lfs	f31,0x2c(r3)	# load facing direction
fmul	f30,f31,f30	# multiply facing direction by offset
stfs	f30,0x34(sp)	# store x velocity

lhz	r4,0xa(r5)	# load y-veloc
sth	r4,0x18(sp)
lfs	f30,0x18(sp)
stfs	f30,0x38(sp)	# store y velocity


lis	r3,0x8026
ori	r3,r3,0x8b18	# load EntityItemSpawn
mtlr	r3
mr	r3,sp
addi	r3,r3,8
blrl
lwz	r3,0x2c(r3)	# load item internal offset
lwz	r4,0x68(sp)	# load subaction location
lhz	r5,0xc(r4)	# load model scale
sth	r5,0x18(sp)
lwz	r5,0x18(sp)
stw	r5,0x38(r3)	# store model scale


lbz	r5,0x2(r4)	# load flags
rlwinm.	r5,r5,0,31,31	# does contain 01?
beq-	TIME_TO_EXPIRE
lis	r5,0x8009
ori	r5,r5,0x48a8	# load GiveItemToPlayer function
mtlr	r5
lwz	r4,0x4(r3)	# load item entity start
lwz	r3,0x518(r3)	# load item owner
blrl	
b	FINISH

TIME_TO_EXPIRE:
lhz	r5,0xe(r4)	# time to expire
sth	r5,0x18(sp)
lwz	r5,0x18(sp)
stw	r5,0xd44(r3)	# store time to expire
TIME_TO_EXPIRE_END:


FINISH:
lwz	r31,0x6c(sp)
lfd	f30,0x70(sp)
lfd	f31,0x78(sp)
addi	sp,sp,0x80
lwz	r0,4(sp)
mtlr	r0
blr			# end new function

DEFAULT:
lwz r3,8(r4)		# default code line

*******************************************************
* Custom Subaction Event - Character Data Struct Mods *
*******************************************************
0xF8 = subaction code = controlling function 800716f8


DEFAULT FUNCTION: (not sure if this is ever executed in vanilla Melee)
lwz	r3,0x8(r4)
addi	r0,r3,4
stw	r0,0x8(r4)
blr


Inject @ 800716f8
- r3 = external data offset
- r4 = data offset subaction timer offset

FLAGS

CCXXYYYY MMNNBBBB PPPPPPPP

XX = byte, FF flag
YYYY = half, length of this subaction

MM
	00 = byte
	01 = halfword
	02 = word
	03 = float (word)

NN
	00 = direct overwrite
	01 = AND
	02 = OR
	03 = add
	04 = subtract
	05 = multiply
	06 = divide
	(80) = multiply new value by facing direction

BBBB = char data offset

--------------------------------
NEW_SUBACTION_FUNCTION:

lwz	r5,0x8(r4)	# load current subaction RAM location
lbz	r6,1(r5)
cmpwi	r6,0xFF
bne-	DEFAULT
mflr	r6
stw	r6,-0xc(sp)

lwz	r3,0x2c(r3)	# r3 = internal data offset
lhz	r6,2(r5)
add	r7,r6,r5
stw	r7,8(r4)	# store new subaction location
#r4 is now open

subi	r6,r6,4		# subtract custom subaction header length
li	r9,8		# data offset mods are 0x8 in length
divw	r4,r6,r9	# r4 = counter, how many custom mods to apply
addi	r5,r5,4		# get to first mod data

LOOP:
lbz	r6,0(r5)	# load overwrite type
lbz	r7,1(r5)	# load mod type
lhz	r8,2(r5)	# load char data offset value
lwz	r9,4(r5)	# load new value 

cmpwi	r6,0
beq-	BYTE
cmpwi	r6,1
beq-	HALF
cmpwi	r6,2
beq-	WORD
cmpwi	r6,3
beq-	FLOAT

BYTE:
lbzx	r12,r3,r8
bl	COMMON_OPERATIONS
BYTE_TYPE_END:
stbx	r9,r3,r8
b	COMPARE

HALF:
lhzx	r12,r3,r8
bl	COMMON_OPERATIONS
HALF_TYPE_END:
sthx	r9,r3,r8
b	COMPARE

WORD:
lwzx	r12,r3,r8
bl	COMMON_OPERATIONS
WORD_TYPE_END:
stwx	r9,r3,r8
b	COMPARE

FLOAT:
lfs	f1,4(r5)	# f1 = new value
rlwinm. r9,r7,25,31,31
beq-	FLOAT_CONTINUE
lfs	f0,0x2c(r3)	# load facing direction
fmul	f1,f0,f1	# multiply new value by facing direction
subi	r7,r7,0x80	# take out the (80) flag

FLOAT_CONTINUE:
add	r9,r3,r8
lfs	f0,0(r9)	# f0 = default value

cmpwi	r7,0
beq-	FLOAT_TYPE_END
cmpwi	r7,3
blt-	COMPARE
beq-	FLOAT_ADD
cmpwi	r7,4
beq-	FLOAT_SUBTRACT
cmpwi	r7,5
beq-	FLOAT_MULTIPLY
cmpwi	r7,6
beq-	FLOAT_DIVIDE

FLOAT_ADD:
fadd	f1,f1,f0
b	FLOAT_TYPE_END

FLOAT_SUBTRACT:
fsub	f1,f0,f1
b	FLOAT_TYPE_END

FLOAT_MULTIPLY:
fmul	f1,f1,f0
b	FLOAT_TYPE_END

FLOAT_DIVIDE:
fdivs	f1,f0,f1

FLOAT_TYPE_END:
stfs	f1,0(r9)
b	COMPARE


#------------
#SUBFUNCTION for byte,half, & word
COMMON_OPERATIONS:
cmpwi	r7,0
beqlr
cmpwi	r7,1
beq-	BYTE_AND
cmpwi	r7,2
beq-	BYTE_OR
cmpwi	r7,3
beq-	BYTE_ADD
cmpwi	r7,4
beq-	BYTE_SUBTRACT
cmpwi	r7,5
beq-	BYTE_MULTIPLY
cmpwi	r7,6
beq-	BYTE_DIVIDE

BYTE_AND:
and	r9,r9,r12
blr

BYTE_OR:
or	r9,r9,r12
blr

BYTE_ADD:
add	r9,r9,r12
blr

BYTE_SUBTRACT:
sub	r9,r12,r9
blr

BYTE_MULTIPLY:
mullw	r9,r12,r9
blr

BYTE_DIVIDE:
divw	r9,r12,r9
blr
#------------------

COMPARE:
addi	r5,r5,8
subi	r4,r4,1
cmpwi	r4,0
bgt-	LOOP
lwz	r6,-0xc(sp)
mtlr	r6
blr

DEFAULT:
lwz	r3,0x8(r4)

*****************
* Score Display *
*****************
When flipping the Score Display byte in the menu, the byte that changes from 00 to 01 is at 8045bf1b.


show score display in all modes. One checks if Score display is at ON, the other checks if it's time mode (both branches out if any of them are false)
04167f78 60000000
04167f84 60000000

height of score display
044ddc28 41300000


Stock mode and Bonus mode uses the same Score Display as Time mode, and the Time mode number uses the coins instead of the score with the C2 below.
0416597c 480000CC


Flieskiller
score display loads number coins
inject @ 80165A64

lis r17,0x8046
ori r17,r17,0xb6a0
lbz r17,0(r17)
cmpwi r17,0
bne- 0x14
lis r17,0x8045
ori r17,r17,0x3110
li r16,0xE90
b 0x10
lis r17,0x804A
ori r17,r17,0x13CC
li r16,0x50
mr r19,r26
cmpwi r19,0
beq- END
subi r19,r19,1
add r17,r17,r16
b 0xFFFFFFF0
END:
lwz r0,0(r17)
lis r17,0x8016
ori r17,r17,0x5aa4
mtctr r17
bctr






8045ac5b is the score display byte when starting a match

*************************
* Gamecube Reset Button *
*************************

reset button goes to debug menu
041a4258 38600006

****************************
* New 20XX Widescreen Code *
****************************
- just a modification of Dan's code
- flag to not use fullscreen shader is at 80003324 (word, default 0)
- 3fa3d0 = 20XX widescreen debug menu option



Part 1:
inject @ 80021abc - li	r3,6

lis	r3,0x8040
lwz	r3,-0x5C30(r3)	# load widescreen debug flag
cmpwi	r3,0		# is widescreen off?
beq-	END
li	r3,1
lis	r4,0x8000
stw	r3,0x3324(r4)	# store shader flag @ 80003324
END:
li	r3,6



Part 2:
inject @ 36A4A8 - lfs f1,0x34(r31)
- r0,r3,r5,r6 open

lfs	f1,0x34(r31)	# default code line

lis	r3,0x8040
lwz	r5,-0x5C30(r3)	# load widescreen debug flag
cmpwi	r5,0		# is widescreen off?
beq-	END
lis	r3,0x8000
lwz	r0,0x3324(r3)
cmpwi	r0,1
beq-	END_ZERO_FLAG

WIDESCREEN_OPTIONS:
cmpwi	r5,4
beq-	MONITOR_STANDARD
cmpwi	r5,3
beq-	DOLPHIN_WIDESCREEN
cmpwi	r5,2
beq-	MONITOR_WIDESCREEN
STANDARD_WIDESCREEN:
lis	r0,0x4080
lis	r3,0x4040
b	WIDESCREEN_APPLY

DOLPHIN_WIDESCREEN: # (true [advanced])
lis	r0,0x42b8
lis	r3,0x427c
b	WIDESCREEN_APPLY

MONITOR_WIDESCREEN:
lis	r0,0x4438
lis	r3,0x440e
b	WIDESCREEN_APPLY

MONITOR_STANDARD:
lis	r0,0x41b8
lis	r3,0x41a8

WIDESCREEN_APPLY:
# inputs are r0 (x),r3 (y)	
stw	r0,0x30(sp)
stw	r3,0x34(sp)
lfs	f0,0x30(sp)
fmuls	f1,f1,f0
lfs	f0,0x34(sp)
fdivs	f1,f1,f0

END_ZERO_FLAG:
li	r0,0
lis	r3,0x8000
stw	r0,0x3324(r3)	# store shader flag @ 80003324
END:
cmplwi	r30,0

--------------

3/23/17 - gamemasterplc
fix widescreen flash
043BB05C 3EB00000

************************
* Custom Event Matches *
************************
Event Match HiScores (the match frame count)
Event Match 1: 8045c130
Event Match 2: 8045c134

Event Match Text is in SdMenu.usd
- For event match text, a single 0x03 means Return [down a line].


Custom Event Match Flags @ 80003324, 80003328, 8000332C

#############################
Event Match 1 - Trouble Puff
- Up Throw, Up Air combo JPuff 50 times as Fox

8008ff58 - lbz	r0,0x221c(r4)
- in Interrupt_AS_DamageFlyTop

lbz	r0,0x221c(r4)
rlwinm. r5,r0,31,31,31	# is char in hitstun?
bne-	HITSTUN_END

lis	r5,0x8048
lbz	r5,-0x62D0(r5)	# load menu controller major
cmpwi	r5,0x2b		# is this an event match?
bne-	HITSTUN_END
lis	r5,0x8046
lbz	r5,-0x540B(r5)
cmpwi	r5,0		# is this event match 1?
bne-	HITSTUN_END
lbz	r5,0xc(r4)	# load player number
mulli	r5,r5,0xe90	# multiply by playerblock offsets
lis	r6,0x8045
ori	r6,r6,0x3088	# P1 player type
lwzx	r5,r5,r6
cmpwi	r5,0		# is this player a human?
beq-	HITSTUN_END
EVENT_MATCH_ONE:
DOWN_B:
li	r5,0
stw	r5,0x620(r4)	# store 0 x-joystick
ori	r5,r5,0x0200
stw	r5,0x668(r4)	# store B into instant buttons
lis	r5,0xbf80	# load float -1
stw	r5,0x624(r4)	# store -1 y-joystick

HITSTUN_END:


C208ff58 0000000D
8804221C 5405FFFF
40820058 3CA08048
88A59D30 2C05002B
40820048 3CA08046
88A5ABF5 2C050000
40820038 88A4000C
1CA50E90 3CC08045
60C63088 7CA5302E
2C050000 4182001C
38A00000 90A40620
60A50200 90A40668
3CA0BF80 90A40624
60000000 00000000

###########################
/*
Event Match 2 - Survivor

SURVIVOR
- Stay Alive for 8 mins

- Bomb Rain
- Poison Mushrooms (make them do 25% damage, and maybe stun for a sec?) 
- 2x shield depletion rate
- Stamina, 999HP
- Gain 0.5% every frame on ledge
- Disable screen rumble

*/
Function 800d1e80	Items_PoisonMushroom_TouchedPlayer

inject @ 800d1e9c	mr r3,r31
- r3 available for use

lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major
cmpwi	r3,0x2b		# is this an event match?
bne-	DEFAULT
lis	r3,0x8046
lbz	r3,-0x540B(r3)
cmpwi	r3,1		# is this event match 2?
bne-	DEFAULT
lwz	r3,0xe0(r31)	# load ground/air state
cmpwi	r3,0		# on ground?
beq-	GROUND_SLEEP
lis	r3,0x8009
ori	r3,r3,0x0780	# 80090780 is DamageFall (tumble) function
mtlr	r3
mr	r3,r30
blrl
b	CUSTOM_END
GROUND_SLEEP:
lis	r3,0x800c
ori	r3,r3,0x318c	# DamageSong
mtlr	r3
mr	r3,r30
li	r4,1
blrl
lis	r3,0x3f80  	# 1 frame of sleep
stw	r3,0x1A4C(r31)
CUSTOM_END:
lis	r3,0x41c8	# float 25 (damage) for touching poison mush
stw	r3,0x1838(r31)	# add 25 damage next frame
li	r3,1
stw	r3,0x2010(r31)
lis	r3,0x800d
ori	r3,r3,0x1f54
mtctr	r3
bctr
DEFAULT:
mr	r3,r31

C20d1e9c 00000012
3C608048 88639D30
2C03002B 40820078
3C608046 8863ABF5
2C030001 40820068
807F00E0 2C030000
4182001C 3C608009
60630780 7C6803A6
7FC3F378 4E800021
48000024 3C60800C
6063318C 7C6803A6
7FC3F378 38800001
4E800021 3C603F80
907F1A4C 3C6041C8
907F1838 38600001
907F2010 3C60800D
60631F54 7C6903A6
4E800420 7FE3FB78
60000000 00000000


----------------------
###################
Event Match 3 - Barrel Buster

Disable Item Pickup
inject @ 800947ac - cmplwi r0,0
- can use r3

lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major
cmpwi	r3,0x2b		# is this an event match?
bne-	DEFAULT
lis	r3,0x8046
lbz	r3,-0x540B(r3)
cmpwi	r3,2		# is this event match 3?
bne-	DEFAULT
lis	r3,0x8009
ori	r3,r3,0x4800	# jump to end of function
mtctr	r3
bctr
DEFAULT:
cmplwi r0,0

C20947AC 00000007
3C608048 88639D30
2C03002B 40820024
3C608046 8863ABF5
2C030002 40820014
3C608009 60634800
7C6903A6 4E800420
28000000 00000000


-----------------
Disable Rolling Barrels

inject @ 80288b78 - cmpwi r3,0
- can use r4, I believe

lis	r4,0x8048
lbz	r4,-0x62D0(r4)	# load menu controller major
cmpwi	r4,0x2b		# is this an event match?
bne-	DEFAULT
lis	r4,0x8046
lbz	r4,-0x540B(r4)
cmpwi	r4,2		# is this event match 3?
bne-	DEFAULT
lis	r4,0x8028
ori	r4,r4,0x8c44	# jump to end of function
mtctr	r4
bctr
DEFAULT:
cmpwi r3,0

C2288B78 00000007
3C808048 88849D30
2C04002B 40820024
3C808046 8884ABF5
2C040002 40820014
3C808028 60848C44
7C8903A6 4E800420
2C030000 00000000


-----------------

Max Items on Stage
# new code, uses Debug Menu flag and also checks for event match 3
inject @ 8026787c

lis	r3,0x8040
lwz	r0,-0x5D90(r3)	# 3fa270 = Max Items on Stage debug flag
#----- event match specifics below
lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major
cmpwi	r3,0x2b		# is this an event match?
bne-	DEFAULT
lis	r3,0x8046
lbz	r3,-0x540B(r3)
cmpwi	r3,2		# is this event match 3?
bne-	DEFAULT
li	r0,4	# max 4 items on stage for event match 3

DEFAULT:
lwz	r3,0x84(r5)	# line before it, restore r3

C226787C 00000007
3C608040 8003A270
3C608048 88639D30
2C03002B 40820018
3C608046 8863ABF5
2C030002 40820008
38000004 80650084
60000000 00000000


----------------

Disable Barrel Explode and Count Number of Barrel Busts
- 80003304 will be the event match 3 flag for number of barrel busts
inject @ 80288b18 - lwz r30,0(r28)

lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major
cmpwi	r3,0x2b		# is this an event match?
bne-	DEFAULT
lis	r3,0x8046
lbz	r3,-0x540B(r3)
cmpwi	r3,2		# is this event match 3?
bne-	DEFAULT
# event match 3 custom function
lis	r3,0x8000
lwz	r30,0x3304(r3)	# 80003304 is event match 3 flag
addi r30,r30,1	# add 1 barrel bust
stw	r30,0x3304(r3)	# store new barrel bust number
lis	r3,0x8028
ori	r3,r3,0x8b40	# 80288b40 is the "no barrel explosion" continue
mtctr	r3
bctr

DEFAULT:
lwz r30,0(r28)

C2288B18 00000009
3C608048 88639D30
2C03002B 40820034
3C608046 8863ABF5
2C030002 40820024
3C608000 83C33304
3BDE0001 93C33304
3C608028 60638B40
7C6903A6 4E800420
83DC0000 00000000

--------------------
##########################
EventMatch_EveryFrameThink
802259e8
- don't use r0 unless I manually save it

lis	r5,0x8048
lbz	r5,-0x62D0(r5)	# load menu controller major
cmpwi	r5,0x2b		# is this an event match?
bne-	EVENT_MATCH_END
ZERO_EVENT_FLAGS_FIRST_FRAME:
lis	r5,0x8048	# 80479d60 = true frame count
lwz	r5,-0x62A0(r5)	# load scene frame count
cmpwi	r5,0
bne-	END_ZERO_FLAGS
li	r4,0
lis	r5,0x8000
stw	r4,0x3304(r5)
stw	r4,0x3308(r5)
stw	r4,0x330C(r5)	# custom flags
END_ZERO_FLAGS:

lis	r5,0x8046
lbz	r5,-0x540B(r5)	# load event match number
cmpwi	r5,0		# is this event match 1?
beq-	EVENT_MATCH_ONE
cmpwi	r5,1
beq-	EVENT_MATCH_TWO
cmpwi	r5,2
beq-	EVENT_MATCH_THREE
b	EVENT_MATCH_END

### EVENT MATCH 1 ####
EVENT_MATCH_ONE:
lis	r3,0x8000
lwz	r3,0x3304(r3)
cmpwi	r3,25		# end condition, 25 uthrow uairs
blt-	EVENT_ONE_CONTINUE
EVENT_ONE_END:
lis	r4,0x8046
ori	r4,r4,0xdb68
li	r3,0x2a		# (00000020) is stock match
stb	r3,0(r4)	# make this match a stock match

li	r4,1
lis	r3,0x8045
stb	r4,0x310e(r3)	# make P1 stocks 1

li	r4,0
lis	r3,0x8045
stb	r4,0x3f9e(r3)	# make P2 stocks 0 to end match
b	EVENT_MATCH_END

EVENT_ONE_CONTINUE:
lis	r3,0x8000
lwz	r4,0x3304(r3)
lis	r5,0x8045
sth	r4,0x30e0(r5)	# store successful u-throw u-airs to P1 %

lis	r4,0x8045
lwz	r4,0x3fc0(r4)	# load P2 external data pointer
lwz	r4,0x2c(r4)	# load P2 internal data pointer

lbz	r5,0x221a(r4)
rlwinm. r5,r5,27,31,31	# is char in hitlag?
beq-	HITLAG_END_ONE
HITLAG_TRUE_ONE:
lis	r3,0x8000
lwz	r5,0x3308(r3)	# 
cmpwi	r5,1		# is flag set?
bne-	HITLAG_END_ONE
lis	r4,0x8045
lwz	r4,0x3130(r4)	# load P1 external data pointer
lwz	r4,0x2c(r4)	# load P1 internal data pointer
lwz	r5,0x10(r4)	# load P1 action state
cmpwi	r5,0x44		# uair?
bne-	FLAG_RESET

lhz	r5,0x894(r4)	# load frame count
li	r6,0x4120	# 10
cmpw	r5,r6
blt-	HITLAG_END_ONE
	# successful u-throw, u-air
lis	r3,0x8000
lwz	r5,0x3304(r3)	# load uthrow, uair total
addi	r5,r5,1		# add one to uthrow, uair total
stw	r5,0x3304(r3)	# store back
b	FLAG_RESET

HITLAG_END_ONE:
lis	r4,0x8045
lwz	r4,0x3fc0(r4)	# load P2 external data pointer
lwz	r4,0x2c(r4)	# load P2 internal data pointer
lbz	r5,0x221c(r4)
rlwinm. r5,r5,31,31,31	# is char in hitstun?
beq-	HITSTUN_CHECK_END
b	FLAG_RESET_END


HITSTUN_CHECK_END:
lis	r3,0x8000
lwz	r4,0x3308(r3)	# 
cmpwi	r4,1
bne-	FLAG_RESET_END
FLAG_RESET:
li	r4,0
stw	r4,0x3308(r3)
FLAG_RESET_END:



U_THROW_CHECK:
lis	r3,0x8045
lwz	r3,0x3130(r3)	# load P1 data pointer
lwz	r4,0x2c(r3)
lwz	r4,0x10(r4)	# load P1 action state
cmpwi	r4,0xDD		# ThrowHi? (uthrow)
bne-	UTHROW_END
lwz	r4,8(r3)	# load P2 external data pointer
lwz	r4,0x2c(r4)	# load P2 internal data pointer
lwz	r5,0x10(r4)	# load P2 action state
cmpwi	r5,0x5A		# DamageFlyTop?
bne-	UTHROW_END
lbz	r4,0x221c(r4)
rlwinm. r4,r4,31,31,31	# is char in hitstun?
beq-	UTHROW_END
lis	r3,0x8000
li	r4,1
stw	r4,0x3308(r3)	# 1 flag @ 80003308 means P2 thrown
UTHROW_END:

b EVENT_MATCH_END


################
EVENT_MATCH_TWO:
################
# Event Match 2 is Survivor

lwz	r3,-0x514c(r13)	# load PlCo.dat pointer
lis	r4,0x3e8f
ori	r4,r4,0x5c29	# load float 0.28
stw	r4,0x278(r3)	# store 0.28 as depletion rate (2x)
li	r3,1
lis	r4,0x8046
ori	r4,r4,0xdb6e
stb	r3,0(r4)	# turn bomb rain on

lis	r3,0x8045
lwz	r3,0x3fc0(r3)	# load P2 external pointer
lwz	r3,0x2c(r3)	# load P2 internal pointer
lhz	r4,0xc0(r3)	# load Y coord prev frame
cmpwi	r4,0x41d8
beq-	EVENT_TWO_INVISIBLE
lis	r4,0x41d8
stw	r4,0xb4(r3)	# store y coord for stage middle
stw	r4,0x6F8(r3)
b	EVENT_TWO_INVISIBLE_END
EVENT_TWO_INVISIBLE:
li	r4,0x10
stb	r4,0x221f(r3)	# make player invisible and intangible
EVENT_TWO_INVISIBLE_END:

EVENT_TWO_EDGE_CHECK:
lis	r3,0x8045
lwz	r3,0x3130(r3)	# load P1 external data pointer
lwz	r3,0x2c(r3)	# load P1 internal data pointer

lis	r4,0x42b4	# load float 90, give damage if xcoord +-
stw	r4,-0xc(sp)
lfs	f15,-0xc(sp)
lfs	f16,0xb0(r3)	# load TopN x-coord
fcmpo	cr0,f16,f15
bge-	TWO_ADD_SMALL_DAMAGE
fneg	f15,f15
fcmpo	cr0,f16,f15
ble-	TWO_ADD_SMALL_DAMAGE


lwz	r4,0x10(r3)	# load action state
cmpwi	r4,0xfc		# 0xFC = CliffCatch
beq-	TWO_ADD_SMALL_DAMAGE
cmpwi	r4,0xfd		# 0xFD = CliffWait
bne-	EVENT_TWO_EDGE_END
TWO_ADD_SMALL_DAMAGE:
lis	r4,0x3f00	# float 0.5
stw	r4,0x1838(r3)	# add damage to player next frame
EVENT_TWO_EDGE_END:

EVENT_TWO_DASH_AERIAL_CHECK:
lhz	r4,0x894(r3)	# load animation frame
cmpwi	r4,0x3f80	# frame 1?
bne-	EVENT_TWO_DASH_AERIAL_CHECK_END
lwz	r4,0x10(r3)		# load action state
cmpwi	r4,0x14	# Dash?
beq-	EVENT_TWO_DASH_AERIAL_HEAL
cmpwi	r4,0x41
blt-	EVENT_TWO_DASH_AERIAL_CHECK_END
cmpwi	r4,0x45
bgt-	EVENT_TWO_DASH_AERIAL_CHECK_END
EVENT_TWO_DASH_AERIAL_HEAL:
lis	r4,0xbdcc
ori	r4,r4,0xcccd	# float -0.1
stw	r4,0x1838(r3)	# add damage to player next frame
EVENT_TWO_DASH_AERIAL_CHECK_END:

EVENT_TWO_TIMER_CHECK:
lis	r5,0x8047
lwz	r5,-0x493C(r5)	# load match frame count
cmpwi	r5,18000	# 5 mins?
blt-	EVENT_TWO_TIMER_END

EVENT_TWO_FINISH:
li	r4,0
lis	r3,0x8045
stb	r4,0x3f9e(r3)	# make P2 stocks 0 to end match
b	EVENT_MATCH_END
EVENT_TWO_TIMER_END:
b	EVENT_MATCH_END

##############
EVENT_MATCH_THREE:
##############
# Event Match 3 = Barrel Buster
# Event Match 3 high score: 8045c138
lis	r3,0x8000
lwz	r4,0x3304(r3)	# load number of barrels busted
lis	r5,0x8045
sth	r4,0x30e0(r5)	# store successful barrels busted to P1 %

mulli	r4,r4,60	# 60 frames per second, each barrel is one second
ori	r5,r5,0xc138
lwz	r3,0(r5)	# load current high score
cmpw	r3,r4
bgt-	EVENT_MATCH_THREE_END
stw	r4,0(r5)	# store new high score
lis r5,0x8047
stw r4,-0x493C(r5)	# store high score as match frame count
EVENT_MATCH_THREE_END:
b	EVENT_MATCH_END



EVENT_MATCH_END:
lwz	r31,0x24(sp)	# default code line

*********************
* Scene Frame Count *
*********************
80479d60 = *true* scene frame count

1a4fd8 - controlling function lines

*****************************
* Texture Research - Random *
*****************************

e8490 - shine (first frames) texture I think
e8414 - shine (rest)

040E8490 60000000
040E8414 60000000

e71ec - up-b

Fox Up-B Uses Shine Graphic Instead of Fire Charge
040e71e8 38600488

**************************
* All-Star Mode Research *
**************************

8021f130	li r3,8	# Item ID 8 = heart

can change to tomato (ID 0x9) and it seems to work just fine.

byte @ 80470787 is the current difficulty of the 1P mode (byte controlled by CSS toggle)

00 = Very Easy
04 = Very Hard

Maxim Tomatoes instead of Hearts for Very Hard All-Star
inject @ 8021f130

lis	r3,0x8047
lbz	r3,0x0787(r3)
cmpwi	r3,4
bne-	END_DEFAULT
li	r3,9
b	END

END_DEFAULT:
li	r3,8
END:

EDIT - this doesn't really work. Maxim Tomatoes show up, but they still heal 999%



Hearts only Heal 100% for Very Hard All-Star

inject @ 8026b4c0 - lwz r3,0xdd4(r3)
lis	r4,0x8048
lbz	r4,-0x62D0(r4)	# load menu controller major
cmpwi	r4,0x5	# All-star mode?
bne-	DEFAULT
lis	r4,0x8047
lbz	r4,0x0787(r4)
cmpwi	r4,4
bne-	DEFAULT
li r3,100	# Heart heals 100% in all-star (instead of 999)
b	END

DEFAULT:
lwz r3,0xdd4(r3)
END:


*************************
* Stage Select Research *
*************************

Trying to do a little research on how the game knows when a stage is being highlighted

Current highlighted stage byte ID @ 804d6cae

When moving cursor over a new stage, line 8025a530 stores the new ID.

DOL SSS Data:
0x3f06d0 = RAM, start of SSS icon data structs

0x00	pointer		Bone Struct Offset (this address is modified when the SSS is loaded)
0x04	null?
0x08	byte		Unlock status
						02 = unlocked like a normal stage
						01 = locked but the player can still place the cursor on it (like the ??? stages in the beginning)
						00 = locked + doesn't do anything when the player places the cursor on it (like locked special/past stages)
0x09	byte		icon/model/text preview id (needs some exploring)
0x0A	byte		random ID (I think like an SSS ID)
0x0B	byte		Stage ID
0x0C	float		Stage select x-axis wideness (+- center point of stage icon)
0x10	float		Stage select y-axis wideness (+- center point of stage icon)
0x14	float		Blinking red select box, x-axis width multiplier
0x18	float		Blinking red select box, y-axis height multiplier


-----------
Change Princess Peach's Castle SSS Select Area
- does not change placement of icon or red blinker
inject @ 8025a4e8

cmpwi	r30,0
bne-	DEFAULT
lis	r3,0xc1a0
stw	r3,0x10(sp)		# x-axis value = -20
li	r3,0
stw	r3,0x14(sp)		# y-axis value = 0

DEFAULT:
lfs	f2,0x10(sp)
-------------

8025a53c	cmpwi	r30,30	# max 30 selectable icons on the SSS, parsing data structs above

*************************************
* Slot Who Last Damaged This Player *
*************************************

Internal data offset +0x18c4 (word)
6 = self-damage, aka no-one

When dying, this is reset to 6 @ 80067e8c - stw	r31,0x18c4(r27)

------
Don't reset for CPUs on Death
inject @ 80067e8c
- r31 = 6
= r30 = FFFFFFFF

lis	r31,0x8046
ori	r31,r31,0xb6c4
lwz	r31,0(r31)		# load match frame count
cmpwi	r31,0
beq-	END_DEFAULT
lbz	r31,0xc(r27)	# load player port
lis	r30,0x8045
ori	r30,r30,0x3088	# P1 player type
mulli	r31,r31,0xe90	# multiply by player block offsets
lwzx	r31,r31,r30	# get to this player's player type
cmpwi	r31,0	# is this player human?
beq-	END_DEFAULT
b	DEFAULT

END_DEFAULT:
li	r31,6
stw	r31,0x18c4(r27)
DEFAULT:
li	r31,6
lis	r30,0xffff
ori	r30,r30,0xffff


*******************************************************************
* Target Test - Always 10 targets remaining with Targets Disabled *
*******************************************************************

For 20XX 4.0, otherwise, when a player ragequits the game will think they got a new high score.

Inject @ 801c1de4 - lis r5,0x804a

lis	r5,0x8040
lwz	r5,-0x5d84(r5)
cmpwi	r5,0
beq-	END
lis	r5,0x8049
ori	r5,r5,0xe6c8	# stage info offset start
li	r0,10	# store 10 targets left
sth	r0,0x6d4(r5)
sth	r0,0x6d2(r5)
stw	r0,0(r3)	# store to stack
stw	r0,0(r4)	# store to stack
blr
END:
lis r5,0x804a

******************************
* Fox/Falco Recovery Research *
******************************

Firefox max length from ledge

Fox: 107
Falco: 84

Aerial Jumps (TopN Y height)
Fox: 40
Falco: 41


Falco: can grab battlefield ledge w/ sideb at -13.4 TopN y
Fox: seems to be -12 and higher

SideB max length to grab ledge (TopN to stage edge coord)
Fox: 93
Falco: 87


Side B Platform Cancels
Fox:
	Pokemon Stadium: hold away when see frame 5 of jump, side-b when see frame 12

*********************
* BGM Music Changes *
*********************

4d3884 = current BGM level
	- can change anytime
	- 00 to 7f

4d388c = current sound level

Floats (0.0 to 1.0) - modified by develop mode X+D-Pad Left
- function 80025064
804d38c4 = -0x7ddc(r13) = BGM
804d38c8 = -0x7dd8(r13) = SFX

****************************************
* Disable Menu Controller Dead Windows *
****************************************

04229668 48000024

***********************************
* Smash DI (SDI) Formula Research *
***********************************

If
(xjoy * xjoy) + (yjoy * yjoy) < (0.7 * 0.7)
Then apply no Smash DI

If cardinal direction change has occured in last 4 frames for either cardinal direction, then apply smash DI. Else, don't.

--------

- Applying Smash DI -

Set frames since last cardinal direction change for x & y to 254 frames.
TopN x change = xjoy * 6.0
TopN y change = yjoy * 6.0

---------

PlCo.dat offsets
0xa490   0.7 = minimum smash DI threshold formula number
0xa494    4 = cardinal direction change for Smash DI (greater than or equal to is false)
0xa498    6 = smash DI x/y coord movement normalization (joystick value multiplied by this)

------------

SDI code in C

struct char_data {
	...
	float	joystick_x_thisframe
	float	joystick_x_lastframe
	float	joystick_y_thisframe
	float	joystick_y_lastframe
	uint8_t	joystick_x_hold_count
	uint8_t	joystick_y_hold_count
	...
};

/* executed 60 times per second */
void PAD_check_cardinal_hold (struct char_data	*characterZ)
{
	float	joystick_cardinal_min = 0.25;	/* for some reason, even though min actual input is 0.2875 */

	if (fabs(characterZ->joystick_x_thisframe) >= joystick_cardinal_min){

		/* check positive x*/
		if ((characterZ->joystick_x_thisframe) >= joystick_cardinal_min){
			if ((characterZ->joystick_x_lastframe) >= joystick_cardinal_min){
				characterZ->joystick_x_hold_count++;
				if (characterZ->joystick_x_hold_count > 254)
					characterZ->joystick_x_hold_count = 254;
			}
			else
				characterZ->joystick_x_hold_count = 0;
		}
		/* check negative*/
		else{
			if ((characterZ->joystick_x_lastframe) <= fneg(joystick_cardinal_min)){
				characterZ->joystick_x_hold_count++;
				if (characterZ->joystick_x_hold_count > 254)
					characterZ->joystick_x_hold_count = 254;
			}
			else
				characterZ->joystick_x_hold_count = 0;
		}
	}
	else
		characterZ->joystick_x_hold_count = 254;

	... /* do the same for joystick-y */
}

/*********************************************/

/* executed once per frame of hitlag */
void SDI (struct char_data	*characterZ)
{
	float SDI_threshold = 0.7;
	float SDI_movement = 6.0;

	if (pow(characterZ->joystick_x_thisframe,2) + pow(characterZ->joystick_y_thisframe,2) >= pow(SDI_threshold, 2)){
		if (characterZ->joystick_x_hold_count < 4 | characterZ->joystick_y_hold_count < 4){
			characterZ->joystick_x_hold_count = 254;
			characterZ->joystick_y_hold_count = 254;
			characterZ->TopN_x += characterZ->joystick_x_thisframe * SDI_movement;
			characterZ->TopN_y += characterZ->joystick_y_thisframe * SDI_movement;
		}
	}

}




********************************************
* Falcon - Invicible Ledge Drop and Regrab *
********************************************

Fall from edge and hold down to fastfall.

Latest Jump:
- when see frame 8, jump

- when seeing frame 7 or 8 and jumping, do not fastfall after reaching climax
- jumping on any other frame, can fastfall


Ganon

min jump frame is seeing frame 2
max jump frame is seeing frame 8
- never fastfall with Ganon


Marth
let go of edge
hold down until see frame 2
jump and hold in
once |stage edge| - |TopNx| > (3 for marth, 5 for falcon), wavedash back with both sticks at -0.7 (away for x)
if in landingfallspecial or escapeair, do nothing
if in Fall press down if not fastfalling. If fastfalling, end
		(check to aerialjumpF as well?)


****************************
*  Collision Link Research *
****************************

Dynamically pulling collision link data

80051d0c - use this logic!


lwz r3,-0x51ec(r13)
lwz	r4,0xc(r3)

I think, r4 now equals the number of collision links for this stage (1-indexed)


**** Collision Edge Searcher *****

COLL_EDGE_SEARCH:
li	r4,0	# r4 is counter
li	r15,0	# r15 is # of edges found
lwz	r18,-0x51e8(r13)
COLL_EDGE_SEARCH_LOOP:
lwz	r3,-0x51e4(r13)
rlwinm	r0,r4,3,0,28
lwzx	r3,r3,r0
lhz	r0,0xe(r3)
rlwinm	r0,r0,24,30,31
cmpwi	r0,2	# is this a stage edge?
bne-	COLL_EDGE_SEARCH_COMPARE
addi	r15,r15,1	# increment edge counter

lhz	r16,0(r3)
lhz	r17,2(r3)
mulli	r16,r16,24
mulli	r17,r17,24
add	r16,r16,r18
lfs	f15,0x8(r16)	# load coll link x coord, pt # 1
add	r17,r17,r18
lfs	f16,0x8(r17)	# load coll link x coord, pt # 2

lis	r19,0x8049
ori	r19,r19,0xe6c8
lfs	f17,0x10(r19)	# load camera center-x

fsub	f15,f15,f17	# find furthest pt from cam center
fabs	f15,f15
fsub	f16,f16,f17
fabs	f16,f16
fcmpo	cr0,f15,f16
bgt-	COLL_EDGE_SEARCH_POINT_ONE
COLL_EDGE_SEARCH_POINT_TWO:
lfs	f15,0x8(r17)
lfs	f16,0xc(r17)
b	COLL_EDGE_SEARCH_DETERMINE_SIDE

COLL_EDGE_SEARCH_POINT_ONE:
lfs	f15,0x8(r16)
lfs	f16,0xc(r16)

COLL_EDGE_SEARCH_DETERMINE_SIDE:
fcmpo	cr0,f15,f17
bgt-	COLL_EDGE_SEARCH_RIGHT
COLL_EDGE_SEARCH_LEFT:
fmr	f27,f15
fmr	f26,f16
b	COLL_EDGE_SEARCH_SUCCESS_END

COLL_EDGE_SEARCH_RIGHT:
fmr	f29,f15
fmr	f28,f16

COLL_EDGE_SEARCH_SUCCESS_END:
cmpwi	r15,2	# end if found second edge
beq-	COLL_EDGE_SEARCH_END

COLL_EDGE_SEARCH_COMPARE:
addi	r4,r4,1
lwz	r3,-0x51ec(r13)
lwz	r3,0xc(r3)	# load number of collision links
cmpw	r4,r3
blt-	COLL_EDGE_SEARCH_LOOP

COLL_EDGE_SEARCH_END:


******************************************
* On-Screen Percents - Always 6 Percents *
******************************************
20xx frame counter, always display 6 percents, six percents

8016e9a8 - load byte with flags for how many percents to display


Trying to figure out how the game reads the on-screen percents. (and not from the player block)

So like line 802f54fc [802f523c]

804A10C8 - P1 on-screen percent data

each player is 100 (decimal) apart
	0x08	byte	player's percent to show
	0x0A	half	percent to show
	0x0C	half	percent shown (copied) (?)
	0x0E	byte	last amount of percent added


***********************
* Shield Regeneration *
***********************

Logic around code line 8006d250

***************************************
* Animation Research (PlAj.dat files) *
***************************************

80016264 is reading the ASCII "Pl__Aj.dat"

Placing the filename at 80432058

800179bc - load character ID? and then load files, at least Pl__Aj idk...



- stored at 8037a3ec (this line stores x-value)
	- this function does some math for models I think



-0x3428


Function 800083c4


Function 8000b1cc
r3 = bone structure start
r4 = ?? (can be simply 0)
r5 = start of x/y/z coordinate position (pointer to x)

********************************
* No Rapid Jabs for CPU Falcon *
********************************

inject @ 800d6b8c

lwz r6,0x2c(r3)	# load internal data offset start

lwz	r4,0x1A94(r6)	# load CPU AI Type
cmpwi r4,5		# manual type?
beq-	END

lbz	r4,0xc(r6)	# load port number
mulli r4,r4,0xe90
lis r5,0x8045
ori r5,r5,0x3088	# P1 player type
lwzx r5,r5,r4
cmpwi r5,1
bne- END
lwz r4,0x4(r6)	# load internal char ID
cmpwi r4,2	# Captain Falcon?
bne- END

NEW_END:
blr

END:
mflr r0

********************
* Disable Tap Jump *
********************

Per player basis for 20XX 4.0
Debug Flags: 
3fa378 = p4 tap jump*
3fa374 = p3 tap jump*
3fa370 = p2 tap jump*
3fa36c = P1 tap jump*

Disable Grounded Tap Jump
inject@ 800cb4e0
- in AS_024_Kneebend

lis r5,0x803f
ori r5,r5,0xa36c	# Debug Menu tap jump flags start
lwz	r6,0x2c(r3)	# load internal data offset	
lbz r6,0xc(r6)	# load port number
mulli r6,r6,0x4	# multiply by offset value
lwzx r6,r6,r5
cmpwi r6,1	# Disable tap jump flag on?
bne- END
cmpwi r4,1	# was kneebend executed by tap jump?
bne- END
blr	# skip function
END:
mflr r0	# default code line


#------------

No Aerial Jump
inject @ 800cb984
- in Interrupt_AerialJump

lis r3,0x803f
ori r3,r3,0xa36c	# Debug Menu tap jump flags start
lbz r5,0xc(r30)	# load port number
mulli r5,r5,0x4	# multiply by debug flag offset
lwzx r3,r3,r5	# load flag value
cmpwi r3,1
bne- JUMP
NO_JUMP:	
lwz r5,-0x514c(r13)	# default code line
lis	r3,0x800c
ori	r3,r3,0xb9ac
mtctr	r3
bctr	# jump to 800cb9ac, the checking for x/y button to jump
JUMP:
lwz r5,-0x514c(r13)	# default code line

********************************************
* DK Donkey Kong Does Not Lose Giant Punch *
********************************************

In NTSC and not PAL, DK loses any giant punch charge when hit out of Up-B

Donkey Kong - Giant Punch cannot be lost during Up+B
[VietGeek]
Version ── DOL Offset ────── Hex to Replace ────────── ASM Code
1.00 ────── 0x10C18C ──── 9004222C -> 60000000 ──── (stw r0,8748(r4) -> nop)
1.01 ────── 0x10C470 ──── 9004222C -> 60000000 ──── (stw r0,8748(r4) -> nop)
1.02 ────── 0x10C6E4 ──── 9004222C -> 60000000 ──── (stw r0,8748(r4) -> nop)
PAL ─────── 0x10CE98 ──── 9004222C -> 60000000 ──── (stw r0,8748(r4) -> nop)


PAL DK does not lose giant punch charge when hit out of Up-B
- 20XX 4.0 PAL chars (.pat)
inject @ 8010fb04

lis	r5,0x803d
lbz	r5,-0x4203(r5)	# load PlDk._at from 803cbdfd
cmpwi	r5,0x64	# ASCII "d" (.dat)?
bne-	END	# skip resetting DK punch if PAL
DEFAULT:
stw	r0,0x222c(r4)	# default, set charge to 0
END:

***********************************
* Flash Blue on Missed Smash Turn *
***********************************

Original code by Magus:
http://smashboards.com/threads/melee-gecko-codes-guide-and-discussion.327311/page-40#post-20457804


CHECK_IF_SLOW:
lhz	r8,0x448(r30)	# animation frame
cmpwi	r8,0x4000	# frame 2 of Turn
bne-	END		# skip code if not frame 2 of Turn action

lwz	r8,0x23A8(r30)
cmpwi	r8,0		# 0 if not past 0.8 dash threshold on frame 2 of Turn
beq-	END		# skip if dash after slow turn will not activate if held (standing turn)

lwz	r8,0x23B0(r30)
cmpwi	r8,0		# 0 if no slow turn delay (smash turn, but didn't dash)
beq-	END		# skip if pivot

ENABLE_OVERLAY:
lis	r7,0x42C0	# 42C00000 (96)
lis	r8,0x437F	# 437F0000 (255)
li	r9,0		# 00000000 (0)
stw	r7,0x518(r30)	# Red = 96
stw	r7,0x51C(r30)	# Green = 96
stw	r8,0x520(r30)	# Blue = 255
stw	r9,0x528(r30)	# Red Transition = 0
stw	r9,0x52C(r30)	# Green Transition = 0
stw	r9,0x530(r30)	# Blue Transition = 0

lis	r7,-0x3E00	# C2000000 (-32)
lis	r8,-0x3D80	# C2800000 (-64)
li	r9,0x91		# flag to enable flash overlay
lis	r10,0x6060
ori	r10,r10,0xFFE0	# 6060FFE0. Initial RGBA
stw	r7,0x524(r30)	# Alpha = -32
stw	r8,0x534(r30)	# Alpha Transition = -64
stb	r9,0x564(r30)	# enable flash overlay
stw	r10,0x514(r30)	# Initial RGBA = 96/96/255/224

END:
lwz	r0,9048(r31)	# entry point (800C9B48)

*******************************************
* Adventure Mode Spawns (Mid-game Spawns) *
*******************************************

Disable for Vs/Training Mode

inject @ 8016a4e0

subi	r31,r3,19320	# default code line

lis	r3,0x801a
ori	r3,r3,0x4340	# 
mtlr	r3
lis	r3,0x8048
lbz	r3,-0x62D0(r3)	# load menu controller major
cmpwi	r3,0x1c
beq-	NO_SPAWNS
blrl
cmpwi	r3,1
beq-	DEFAULT
NO_SPAWNS:
lis	r3,0x8016
ori	r3,r3,0xa914
mtctr	r3
bctr


DEFAULT:

*********************************************
* CSS - Selecting characters file load info *
*********************************************

80018294 gets executed when selecting or deselecting a char


80432090



When selecting a char or unselecting
803238c8 outputs a 1, which means to reload new files

*****************
* Stage Loading *
*****************

Code line 8025bbb8 - stw r0,0xc(r3)
Stage ID is written to 80432088 before loading the stage file


All-Star Mode:
801b5580 - stw r0,4(r27)

All-Star Mode Stage Loading Table:
803debe8

801b61cc - stw r0,0(r29) - store the stage load table word for all-star sequence
- executed when selecting All-Star Mode from Menu.

801b5580 - stw r0,4(r27)

801b55c8

--------------


801c06b8
- r3 input = internal stage ID
- indexes into table for getting to the stage name ASCII location
	(801c06e8) loads pointer to start of filename

External Stage ID to Internal Stage ID:
- r3 = external stage ID
- see function 802251b4

mulli r4,r3,12
lis r3,0x803e
ori r3,r3,0x9960
lwzx	r3,r3,r4	# r3 now equals internal stage ID


****************************
* Memory Allocation  Table *
****************************

From Dan Salvato

OVERFLOWCHECK:
lis r3,0x8170	#input storage area, check if memory past this line is already allocated
subi r3,r3,0x800
lis r6,0x8043
ori r6,r6,0x18ac

LOOP2NEXT:
addi r6,r6,12
lwz r9,0(r6)
lwz r7,4(r6)
lwz r8,0x8(r6)
cmpwi r9,0
bne LOOP2
cmpwi r7,0
bne LOOP2
cmpwi r8,0
bne LOOP2
b END

LOOP2:
#Check for memory overflow
add r8,r8,r7
lbz r7,4(r6)
cmpwi r7,0
beq LOOP2NEXT
cmpw r8,r3
blt LOOP2NEXT

OVERFLOW:
lis r3,0x8000	# yes, memory is already allocated past this region
li r4,0
stw r4,0x2840(r3)
stw r4,0x2844(r3)
b END

END:
lwz r0,0x1c(sp)

--------------------

My own research:

Table is static up until 80431930 (pointer) and onward?


Function 80014fc8 stores these values

Table Breakdown Points:

804318b0
80431edc = pointer to next table entry to use? (can't be zero or game freezes)



lbmemory.c = [ASCII] @ 803ba2c0
inputs:
r3 = 80431f18
r4 = 00000044 (maybe space required for next chunk?)

Maybe....
80431f18 = 000000000
80431f1c = RAM allocation point start
80431f20 = FST location start at end of RAM
80431f24 = pointer, to RAM allocation table begin
	0x00 = pointer to next memory allocation
	0x04 = memory address start location
	0x08 = memory address amount to allocate

Continue to load pointers until you see a null.

load +0x04 and +0x08 and add these two. That should net the end address.


80431f18, loads pointer at +0xc
--------------

Adventure Mode is weird....

432024
in Adventure, this is -1


Can I just load word @ 80431f94 to get the RAM free space start??



1261aa0


6e4 + 4318b0


BP at 80015d94
VS Mode: r31 = 4
	multiply ID by 28, add 80431FA0, then add 0x10
	- pointer to table is at +0x4 from this point


80432220 --> load byte at 0x2 for ID

---
ADV

432000 range
431ef4 -->

431ee4 is like an allocation table index?
800150b8	stores the "next" table address


-----------

Zero unallocated RAM on match start:

Zero_AreaLength: 8000c160
r3 = location start
r4 = length

inject @ 8016cf38 - lmw r27,0x1c(sp)


lis	r5,0x8048	# 80479d60 = true frame count
lwz	r5,-0x62A0(r5)	# load scene frame count
cmpwi	r5,0		# only execute on first frame
bne-	UNALLOC_END

GET_FREE_RAM_START:
li r3,0	# will be the end of allocation
lis r6,0x8043
ori r6,r6,0x18ac

LOOP2NEXT:
addi r6,r6,12
lwz r9,0(r6)
lwz r7,4(r6)
lwz r8,0x8(r6)
cmpwi r9,0
bne LOOP2
cmpwi r7,0
bne LOOP2
cmpwi r8,0
bne LOOP2
b END

LOOP2:
#Check for memory overflow
add r8,r8,r7
lbz r7,4(r6)
cmpwi r7,0		# a check if bit0 is low might be better?
beq LOOP2NEXT
cmplw r8,r3		# compare unsigned
blt LOOP2NEXT
mr r3,r8	# move new largest end allocation to r3
b LOOP2NEXT
END:

UNALLOC_ZERO:
lwz r4,-0x4330(r13)	# OSGetArenaHi
sub	r4,r4,r3
lis	r5,0x8000
ori	r5,r5,0xc160	# load zero_arealength
mtlr	r5
blrl		# zero the unallocated RAM space
UNALLOC_END:	
lmw r27,0x1c(sp)


// OLD CODE --> FROZE FOR ADVENTURE MODE
// lis	r5,0x8048	# 80479d60 = true frame count
// lwz	r5,-0x62A0(r5)	# load scene frame count
// cmpwi	r5,0		# only execute on first frame
// bne-	UNALLOC_END

// GET_FREE_RAM_START:
// lis	r3,0x8043
// lwz r3,0x2024(r3) # load pointer to large memory allocation table, I think
// lwz	r4,8(r3)	# load FST location
// lwz	r5,0xc(r3)	# load pointer

// POINTER_LOOP:
// lwz	r6,0(r5)	# load next allocation pointer
// cmpwi	r6,0	# at end?
// beq-	POINTER_END
// mr	r5,r6
// b	POINTER_LOOP

// POINTER_END:
// lwz	r6,0x4(r5)
// lwz	r7,0x8(r5)
// add	r3,r6,r7
// # r3 = point, free RAM start / r4 = point, RAM FST table start
// # r6 = RAM free start + header

// UNALLOC_ZERO:
// sub	r4,r4,r3
// lis	r5,0x8000
// ori	r5,r5,0xc160	# load zero_arealength
// mtlr	r5
// blrl		# zero the unallocated RAM space
// UNALLOC_END:	
// lmw r27,0x1c(sp)

*******************
* ArenaHi ArenaLo *
*******************

803444c8	OSGetArenaHi
803444d8	OSSetArenaHi

803444d0	OSGetArenaLo
803444e0	OSSetArenaLo

If wanting to modify ArenaHi, likely inject at 803430e4

*************************
* 20XX 4.06 Save States *
*************************
20xx save states

inject @ 802259ec - lwz r30,0x20(sp)
- in the DevelopMode Toggles Function
	- executed once per frame always in-game, even in DevelopMode Frozen
	- disable during pause (so d-pad left/right is freed up for pause toggles)

- 0x23C8 in length of data for each saved char
	0x2384: char offset data info
	0x4: camera track flag
	0x8: external data offset custom flags (@ 0x20 and 0x24)
	0x4: displayed damage
	0x4: main/secondary char in use flags (Zelda/Sheik)
	0x4: SDs/stocks remaining
	0x2C: stale move list

- 5/13/16 Started, but was unstable
- 10/7/16 Started using the functions involved in training mode reset
- 3/21/17 Massive lightbulb illuminated regarding mem allocation and user defined save state toggle tables. Rewrote much of the beginning to accomodate.


.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.set ss_nAllocatedChars, 0x800037cc	# byte
.set ss_tableStart, 0x800037e0
.set ss_table.length, 0x10	# per table entry
.set ss_tableStart_oneIndexed, ss_tableStart - ss_table.length
.set ss_table.saveConstant, 0
.set ss_table.saveInstant, 2
.set ss_table.loadConstant, 4
.set ss_table.loadInstant, 6
.set ss_table.ramStart, 8

.set buttons.adr, 0x804c1fac

# ss = savestate
.set ss_header.len, 0x90
.set ss_header.savedBool, 0x00	# byte
.set ss_header.auto, 0x01	# byte, 1 = auto load or save state
.set ss_header.frameAdvance, 0x02	# byte
# add more header constants

.set ss_dataoffset.len, 0x2384 # data offset length
.set ss_charsave.len, 0x23C8 # total
.set ss_totalLen, ss_header.len + ss_charsave.len	# total amount of bytes per char

.set _HSD_MemAlloc, 0x8037f1e4	# r3 input = number of bytes to allocate
.set sceneFrameCount, 0x80479d60
.set matchFrameCount, 0x8046B6C4
.set timerHUD, 0x8046B6C8
.set screenState, 0x80479D68

.set _20XXToggleFlag, 0x803FA3D8
.set ss_timerDebugFlag, 0x803faf48	# whether or not to load timer
.set Debug.autoSaveState, 0x803faf4c


.set stack.size,0xc
.set stack.ss_current, 0x8

CODE_START:
subi	sp,sp,stack.size

SAVE_STATE_FIRST_FRAME:
word_load r5,r5,sceneFrameCount	# load scene frame count
cmpwi	r5,0		# only execute on first frame
bne+	SAVE_STATE_FIRST_FRAME_END
# if on first frame of match, reset nAllocatedChars to 0
li r3,0	# 0 characters allocated
byte_store r3,r4,ss_nAllocatedChars
SAVE_STATE_FIRST_FRAME_END:

SAVE_STATE_CHECK_EXISTENCE:
bl	SAVE_STATE_TOTAL_COUNT
cmpwi 	r3,0	# 0 save states? --> skip everything
beq- END_END

SAVE_STATE_20XX_TOGGLES:
word_load r5,r5,_20XXToggleFlag
cmpwi r5,0	# skip if in-game toggles are off
beq-	END_END

# if 20XX toggles are enabled
SAVE_STATE_ALLOC:
byte_load r3,r4,ss_nAllocatedChars
cmpwi r3,0	# are zero chars allocated?
bne+ SAVE_STATE_ALLOC_END
SAVE_STATE_ALLOC_GO:
bl	SAVE_STATE_TOTAL_COUNT
mr r31,r3
SAVE_STATE_ALLOC_LOOP:
bl PLAYER_COUNT_TOTAL
byte_store r3,r4, ss_nAllocatedChars	# store the amt of characters the save states will be allocated for

mulli	r3,r3,ss_totalLen	# r3 = bytes per char * number of chars
adr_blrl r12,_HSD_MemAlloc	# r3 out = pointer to allocated memory
adr_load	r4,ss_tableStart_oneIndexed
mulli	r5,r31,ss_table.length
add	r4,r4,r5
stw	r3,ss_table.ramStart(r4)
# save state RAM loc initialization
# could calloc this area, but not necessary for time being
li r4,0
stb	r4,ss_header.savedBool(r3)	# init save exists bool to false
stb	r4,ss_header.auto(r3)	# init auto bool to false
# could init here to an auto-save feature instead?
#
subi	r31,r31,1
cmpwi	r31,0
bne-	SAVE_STATE_ALLOC_LOOP
SAVE_STATE_ALLOC_END:

SAVE_STATE_PAUSE_CHECK:
byte_load r6,r6,screenState
rlwinm. r6,r6,0,30,30 # check (02) = paused
bne- END_END # skip save states if paused

SAVE_STATE_MATCH_START_CHECK:	# makes unable to save state while warping in/character being unable to move
word_load r6,r6,matchFrameCount
cmpwi r6,0	# make sure 0 is okay with auto save state, this could be changed
beq-	END_END

bl	SAVE_STATE_TOTAL_COUNT
cmpwi r3,0
beq-	END_END
mr	r31,r3	# r31 = number of save states to check

BUTTON_CHECK_START:
li r30,0	# player counter
BUTTON_CHECK_LOOP:
mr	r3,r30
bl BUTTONS_CURRENT_INSTANT	# r3 = constant/current, r4 = instant
adr_load	r5,ss_tableStart_oneIndexed
mulli	r6,r31,ss_table.length
add	r5,r5,r6	# r5 is the start of this save state table index
lwz r6,ss_table.ramStart(r5)
stw	r6,stack.ss_current(sp)	# store the current save state loc to stack

SAVE_STATE_AUTO_LOAD:	# save occurence flag of 2 equals auto load
lbz  r7,ss_header.auto(r6) # load auto load flag
cmpwi r7,1	# 1 = auto load
beq- LOAD
SAVE_STATE_AUTO_SAVE:	# debug menu option to auto save state

cmpwi r31,1	# on the first save state? [major]
bne- SAVE_STATE_AUTO_SAVE_END
word_load r7,r7,Debug.autoSaveState
cmpwi r7,0
beq- SAVE_STATE_AUTO_SAVE_END
word_load r7,r7,matchFrameCount
cmpwi r7,1	# make sure 0 is okay with auto save state, this could be changed
blt-	SAVE_STATE_AUTO_SAVE_END
lbz  r7,ss_header.savedBool(r6) # check if save has already been issued
cmpwi r7,0	# if false, no ss
beq- SAVE_NO_SFX
SAVE_STATE_AUTO_SAVE_END:

BUTTON_CHECK_SAVE:
lhz	r6,ss_table.saveConstant(r5)	# load save button constant combo
#and	r7,r3,r6
cmpw	r3,r6
bne-	BUTTON_CHECK_SAVE_END
lhz	r6,ss_table.saveInstant(r5)	# load save button instant combo
#and	r7,r4,r6
cmpw	r4,r6
beq-	SAVE
BUTTON_CHECK_SAVE_END:
BUTTON_CHECK_LOAD:
lhz	r6,ss_table.loadConstant(r5)	# load button constant combo
#and	r7,r3,r6
cmpw	r3,r6
bne-	BUTTON_CHECK_LOAD_END
lhz	r6,ss_table.loadInstant(r5)	# load button instant combo
#and	r7,r4,r6
cmpw	r4,r6
beq-	LOAD
BUTTON_CHECK_LOAD_END:
BUTTON_CHECK_CONTINUE:
addi r30,r30,1
cmpwi r30,4		# just checked P4?
bne-	BUTTON_CHECK_LOOP	# branch to end of save state function
BUTTON_CHECK_END:
subi r31,r31,1	# decrement number of save states
cmpwi	r31,0
bne-	BUTTON_CHECK_START
SAVE_STATE_LOOP_END:
b 	END_END

LOAD:
LOAD_CHECK_CHAR_ALLOC:
bl PLAYER_COUNT_TOTAL
byte_load r4,r4, ss_nAllocatedChars	# store the amt of characters the save states will be allocated for
cmpw	r3,r4
bne- END_SAVE_STATE_ERROR
LOAD_HEADER_SAVED:
lwz r3,stack.ss_current(sp)
lbz	r4,ss_header.savedBool(r3)	# flag for knowing that a save state has been issued this match
cmpwi r4,0	# if no save state has been saved, skip
beq-	END_SAVE_STATE_ERROR
LOAD_HEADER_AUTO_NULL:	# null out the auto flag
li r5,0
stb	r5,ss_header.auto(r3)
LOAD_HEADER_CONTINUE:

LOAD_HEADER_FRAME_COUNTS:
lwz	r4,4(r3) # load match frame count

LOAD_HEADER_FRAME_ADVANCE:
byte_load r5,r5,screenState
rlwinm. r5,r5,0,31,31	# check if currently in frame advance
bne- LOAD_HEADER_FRAME_ADVANCE_TRUE
LOAD_HEADER_FRAME_ADVANCE_FALSE:
lbz r5,ss_header.frameAdvance(r3)	# load frame advance flag at header
b LOAD_HEADER_FRAME_ADVANCE_END
LOAD_HEADER_FRAME_ADVANCE_TRUE:
li r5,0	# default is to not add any frames
lbz r6,ss_header.frameAdvance(r3)	# load frame advance flag at header
cmpwi r6,1	# don't add frames if save state and load state are in frame advance
beq- LOAD_HEADER_FRAME_ADVANCE_END
li r5,-1	# subtract a frame for save state not in frame advance, but load state is
LOAD_HEADER_FRAME_ADVANCE_END:
add r4,r4,r5	# save state occured during frame advance, add a frame

word_store r4,r6,matchFrameCount

addi r3,r3,4	# skip along data

word_load r4,r4,ss_timerDebugFlag
cmpwi r4,0
bne- LOAD_HEADER_TIMER
addi r3,r3,8	# skip along data
b LOAD_HEADER_TIMER_END_END
LOAD_HEADER_TIMER:	# r5 is still the frame subtraction value
lwzu	r4,4(r3)	# load seconds left in match
lhzu	r6,4(r3)	# load matchframecount % 60
add	r6,r6,r5	# add frame subtraction to second frame count
cmpwi r6, -1
bne- LOAD_HEADER_TIMER_END
li r6,0x3b	# 59
addi	r4,r4,1
LOAD_HEADER_TIMER_END:
adr_load r7,timerHUD
stw	r4,0(r7)
sth	r6,4(r7)
LOAD_HEADER_TIMER_END_END:

LOAD_HEADER_CAMERA:
lis r4,0x8045
ori r4,r4,0x2c70
li r5,0x80
LOAD_HEADER_CAMERA_LOOP:
lwzu r6,4(r3)
stwu r6,4(r4)
subi r5,r5,4
cmpwi r5,0
bne-	LOAD_HEADER_CAMERA_LOOP

lwz	r3,-0x3e74(r13)
lwz	r3,0x20(r3) 	# should get you the first player who was created, external data offset

LOAD_START:
# Below 3 function blrls are from function 80087140 that resets P1 in Training Mode
# the only subfunction from 80087140 not included, is the one to put char in Wait/Fall
lis r31,0x800d
ori r31,r31,0x4f24	# put char in Sleep, sparkle GFX, DestroyItem
mtlr r31
mr	r31,r3	# save external to r31
li r4,1
blrl
lis r3,0x8007
ori r3,r3,0xed2c	# 
mtlr r3
lwz	r3,0x2c(r31)	# load internal offset as input
blrl
lis r3,0x8006
ori r3,r3,0x8354	# 
mtlr r3
mr r3,r31	# load external offset as input
blrl


lwz r6,stack.ss_current(sp)
addi r6,r6,ss_header.len


lwz	r3,0x2c(r31)	# load internal data offset
bl PLAYER_COUNT
mulli	r5,r5,ss_charsave.len	# saved data length per character (!!!!!)
add	r6,r5,r6	# get to saved data for this character

lwz	r4,0xb0(r6)	# load TopN-X coord
stw	r4,0xb0(r3)	# store TopN-X coord
lwz	r4,0xb4(r6)	# load TopN-Y coord
stw	r4,0xb4(r3)	# save TopN-Y coord
lwz	r4,0xb8(r6)	# load TopN-Z coord
stw	r4,0xb8(r3)	# save TopN-Z coord
lwz	r4,0x2c(r6)	# load saved facing direction
stw	r4,0x2c(r3)	# store save facing direction
lwz	r4,0xE0(r6)	# load air/ground bool
stw	r4,0xE0(r3)	# store air/ground bool
lfs	f1,0x894(r6)
lfs f2,0x89c(r6)
lfs f3,0x8a4(r6)
mr	r3,r31
lwz r4,0x10(r6)	# load save action state
li	r5,0		# these are specific action state flags...unfortunately. Not sure what they do.
lis r6, 0x8006
ori r6,r6,0x93ac	# branch to ActionStateChange
mtlr r6
li r6,0
blrl

lwz r6,stack.ss_current(sp)
addi r6,r6,ss_header.len

lwz	r3,0x2c(r31)	# load internal of current player
bl	PLAYER_COUNT
mulli	r5,r5,ss_charsave.len	# saved data length per character (!!!!!)
add	r6,r5,r6	# get to saved data for this character

subi	r6,r6,4
subi	r3,r3,4
li	r7,0	# 

LOAD_LOOP:	# copy all char data
cmpwi r7,0xc
bne- LOAD_LOOP_CONTINUE1
lhz	r5,0xd(r6)	# skip port number byte, save next two custom flags, skip replay state flag @ 0xf
sth r5,0xd(r3)
b LOAD_LOOP_SKIP

LOAD_LOOP_CONTINUE1:
cmpwi r7,0x560
blt- LOAD_LOOP_CONTINUE
cmpwi r7,0x610	# skip loading 0x560 to 0x610. Causes freezes sometimes. Model relating pointers/flags
blt- LOAD_LOOP_SKIP
LOAD_LOOP_CONTINUE:
cmpwi r7,0x618	# skip loading player control index/costume/subcolor/team ID
beq- LOAD_LOOP_SKIP
cmpwi r7,0x1974	# don't load previous held item
beq- LOAD_LOOP_SKIP
cmpwi r7,0x21fc	# don't load the collision bubble flag
beq- LOAD_LOOP_SKIP

lwzu	r5,4(r6)
stwu	r5,4(r3)
b LOAD_LOOP_CHECK
LOAD_LOOP_SKIP:
addi r6,r6,4
addi r3,r3,4
LOAD_LOOP_CHECK:
cmpwi	r7,ss_dataoffset.len	# char data length (!!)
beq-	LOAD_LOOP_END
addi	r7,r7,4	# load words at a time
b	LOAD_LOOP

LOAD_LOOP_END:
subi	r6,r6,4	# get to -0x4 from saved stale list start
lwz	r3,0x2c(r31) # load internal offset

LOAD_CAMERA_TRACK_FLAG:
lwz r7,0x890(r3) # load camera data pointer
lwzu r4,4(r6)	# load camera track flag
stw r4,8(r7)	# store camera track flag

LOAD_CUSTOM_FLAGS:
lwzu r4,4(r6)	# load camera track flag
stw	r4,0x20(r31)	# restore flags @ external +0x20
lwzu r4,4(r6)	# load camera track flag
stw	r4,0x24(r31)	# restore flags @ external +0x24

LOAD_STALE_LIST:
lbz	r4,0xc(r3)	# load slot ID
mulli r4,r4,0xe90	# player slot offsets
lis r5,0x8045
ori r5,r5,0x3138	# -0x4 from P1 stale move list data
add r4,r4,r5	# get to this player's stale move list

lwzu	r5,4(r6)	# load saved displayed damage
stw	r5,-0x58(r4)	# restore saved displayed damage
lwzu	r5,4(r6)	# load saved main/secondary char
stw	r5,-0xAC(r4)	# restore saved main/secondary char
lwzu	r5,4(r6)	# load saved SDs/stocks
stw	r5,-0x2C(r4)	# restore saved SDs/stocks

li r5,0	# stale move counter

LOAD_STALE_LOOP:
lwzu	r7,4(r6)	# load stale move list data
stwu	r7,4(r4)	# store stale move list data
addi	r5,r5,1
cmpwi	r5,11	# 10 stale moves + stale move table index
bne-	LOAD_STALE_LOOP

lwz	r3,8(r31)	# load next character, external
cmpwi	r3,0	# no more players on-screen?
bne-	LOAD_START

RELOAD_PERCENT_HUDS:	# I should eventually put this in the loop above...maybe. With check for ignoring secondary chars?
li r31,0	# init player counter
RELOAD_PERCENT_HUDS_LOOP:
.set P1Static, 0x80453080
adr_load r7,P1Static
mulli r5,r31,0xe90
add	r7,r7,r5	# r7 = static player block for this character
lwz	r3,8(r7)
cmpwi r3,3	# is char not in match?
beq- RELOAD_PERCENT_CONTINUE

LOAD_STATE_RANDOM_DAMAGE:
.set HSD_Randi, 0x80380580
.set DebugMenu.LoadStateRandDamageMin, 0x803fa31c
.set DebugMenu.LoadStateRandDamageMax, 0x803fa288
.set DebugMenu.LoadStateRandDamage, 0x803faf6c

word_load r3,r3, DebugMenu.LoadStateRandDamage
cmpwi r3,0
beq- LOAD_STATE_RANDOM_DAMAGE_END
li r8,0
word_load r3,r3, DebugMenu.LoadStateRandDamageMin
word_load r4,r4, DebugMenu.LoadStateRandDamageMax
cmpw r4,r3
ble- LOAD_STATE_RANDOM_DAMAGE_RAND
li r8,1
sub r3,r4,r3
addi r3,r3,1	# inclusive
LOAD_STATE_RANDOM_DAMAGE_RAND:
adr_blrl r4, HSD_Randi
cmpwi r8,0
beq- LOAD_STATE_RANDOM_DAMAGE_STORE
word_load r4,r4, DebugMenu.LoadStateRandDamageMin
add r3,r3,r4
LOAD_STATE_RANDOM_DAMAGE_STORE:
sth r3,0x60(r7)
INT_TO_FLOAT:
lfd	f3,-0x7470(r2)	# 4d8570. loads magic double for int to float conversion
stfd	f3,0x20(r2)
sth	r3,0x26(r2)	# 0x43300000800000xx. put 1st int at end of magic double
lfd	f1,0x20(r2)
fsubs	f1,f1,f3	# subtract 0x4330000080000000 for converted int 1
lwz r4,0xb0(r7)
lwz r4,0x2c(r4)
stfs f1,0x1830(r4)
lwz r4,0xb4(r7)
cmpwi r4,0
beq- LOAD_STATE_RANDOM_DAMAGE_END
lwz r4,0x2c(r4)
stfs f1,0x1830(r4)
LOAD_STATE_RANDOM_DAMAGE_END:


lis r3,0x804a
ori r3,r3,0x10c8
mulli r4,r31,100
add	r4,r4,r3	# get to this player's HUD info
.set MatchInfo_StockModeCheck, 0x8016b094
adr_blrl r12, MatchInfo_StockModeCheck	# modifies r3 and r0
cmpwi r3,0	# if not stock mode
beq- RELOAD_PERCENT_HUDS_NOT_STOCK
RELOAD_PERCENT_HUDS_STOCK:
# r7 is still P1 static block location
lbz r5,0x8e(r7)	# load stocks left
cmpwi r5,0
bne- RELOAD_PERCENT_HUDS_NOT_STOCK
li r5,0x80	# remove percent
stb r5,0x10(r4)
b RELOAD_PERCENT_CONTINUE
RELOAD_PERCENT_HUDS_NOT_STOCK:
lbz	r5,0x10(r4)
rlwinm. r5,r5,0,24,24	# (00000080), is player HUD percent gone?
beq- RELOAD_PERCENT_CONTINUE
REMAKE_PERCENT:
.set HUD_PlayerCreate_Prefunction, 0x802f6e1c
mr r3,r31
# remake player HUD percent
adr_blrl r4, HUD_PlayerCreate_Prefunction
RELOAD_PERCENT_CONTINUE:
addi r31,r31,1
cmpwi r31,6
bne-	RELOAD_PERCENT_HUDS_LOOP
RELOAD_PERCENT_HUDS_END:

b	END_SAVE_STATE

#-------------------
SAVE_NO_SFX:
bl PLAYER_ACTION_STATE_CHECK	# check for problematic save action states
cmpwi r3,1	# if problematic true
beq- END_END
SAVE_NO_SFX_CHECK_CHAR_ALLOC:
bl PLAYER_COUNT_TOTAL
byte_load r4,r4, ss_nAllocatedChars	# store the amt of characters the save states will be allocated for
cmpw	r3,r4
bne- END_END
b SAVE_GO

SAVE:
bl PLAYER_ACTION_STATE_CHECK	# check for problematic save action states
cmpwi r3,1	# if problematic true
beq- END_SAVE_STATE_ERROR
SAVE_CHECK_CHAR_ALLOC:
bl PLAYER_COUNT_TOTAL
byte_load r4,r4, ss_nAllocatedChars	# store the amt of characters the save states will be allocated for
cmpw	r3,r4
bne- END_SAVE_STATE_ERROR
SAVE_SFX:
lis r3,0x804d
li r4,0x5C	# play SFX ID 0x5C
stw	r4,0x6b94(r3)	# store SFX ID to the custom OnEveryFrame SFX to play check address

SAVE_GO:
SAVE_HEADER:
lwz r3,stack.ss_current(sp)
li r4,1
stb	r4,ss_header.savedBool(r3)	# flag for knowing that a save state has been issued this match

SAVE_HEADER_FRAME_ADVANCE:
lis r5,0x8048
lbz r5,-0x6298(r5)
rlwinm r5,r5,0,31,31
stb r5,ss_header.frameAdvance(r3)	# store frame advance bit at header + 0x8

SAVE_HEADER_FRAME_COUNTS:
lis r5,0x8047
lwz r4,-0x493C(r5)	# load match frame count
stwu	r4,4(r3)


SAVE_HEADER_TIMER_HUD:
adr_load r4, timerHUD
lwz r5,0(r4)	# load seconds left in match
stwu r5,4(r3)
lwz r5,4(r4)	# load matchframecount % 60 [first halfword], second half word is technically free
stwu r5,4(r3)

SAVE_HEADER_CAMERA:
lis r4,0x8045
ori r4,r4,0x2c70
li r5,0x80
SAVE_HEADER_CAMERA_LOOP:
lwzu r6,4(r4)
stwu r6,4(r3)
subi r5,r5,4
cmpwi r5,0
bne-	SAVE_HEADER_CAMERA_LOOP

lwz r6,stack.ss_current(sp)
addi r6,r6,ss_header.len


lwz	r3,-0x3e74(r13)
lwz	r31,0x20(r3) 	# should get you the first player who was created, external data offset

SAVE_START:
lwz	r3,0x2c(r31)	# load internal of first player

mr	r4,r3
subi	r4,r4,1
subi	r6,r6,1
li	r7,ss_dataoffset.len	# data offset length to save
subi r7,r7,1	# this whole loop is coded poorly
SAVE_LOOP:
lbzu	r5,1(r4)
stbu	r5,1(r6)
cmpwi	r7,0
beq-	SAVE_LOOP_END
subi	r7,r7,1
b	SAVE_LOOP
SAVE_LOOP_END:
subi	r6,r6,3	# get to -0x4 from next free word

SAVE_CAMERA_TRACK_FLAG:
lwz r7,0x890(r3) # load camera data pointer
lwz r7,8(r7)	# load camera track flag
stwu r7,4(r6)

SAVE_CUSTOM_FLAGS:
lwz	r7,0x20(r31)	# load 0x20 from external data offset
stwu r7,4(r6)
lwz	r7,0x24(r31)	# load 0x24 from external data offset
stwu r7,4(r6)

SAVE_STALE_LIST:

lbz	r4,0xc(r3)	# load slot ID
mulli r4,r4,0xe90	# player slot offsets
lis r5,0x8045
ori r5,r5,0x3138	# -0x4 from P1 stale move list data
add r4,r4,r5	# get to this player's stale move list

lwz	r5,-0x58(r4)	# load displayed damage
stwu	r5,4(r6)	# save displayed damage
lwz r5,-0xAC(r4)	# load main/secondary char in use flags
stwu	r5,4(r6)		# save main/secondary char in use flags
lwz r5,-0x2C(r4)	# load SDs/stocks
stwu	r5,4(r6)		# save SDs/stocks


li r5,0

SAVE_STALE_LOOP:
lwzu	r7,4(r4)	# load stale move list data
stwu	r7,4(r6)	# store stale move list data
addi	r5,r5,1
cmpwi	r5,11
bne-	SAVE_STALE_LOOP

addi	r6,r6,4

lwz	r31,8(r31)	# load next character from external offset
cmpwi	r31,0	# no more players on-screen?
bne-	SAVE_START

END_SAVE_STATE:
b	END_END

END_SAVE_STATE_ERROR:
lis r3,0x804d
li r4,0xaf	# play SFX ID 0xaf = error
stw	r4,0x6b94(r3)	# store SFX ID to the custom OnEveryFrame SFX to play check address
b	END_END

#--------------------

PLAYER_COUNT:	# r31 needs to be external char offset
# output r5 = char spawn number (0-indexed)
lwz	r5,-0x3e74(r13)
lwz	r7,0x20(r5) 	# should get you the first player who was created, external data offset
li r5,0
PLAYER_COUNT_LOOP:
cmpw r7,r31
beq-	PLAYER_COUNT_END
addi	r5,r5,1
lwz	r7,8(r7)	# load next player pointer
b PLAYER_COUNT_LOOP
PLAYER_COUNT_END:
blr
#--------------------------
PLAYER_COUNT_TOTAL:
# no inputs
# output r3 = total number of characters in match (1-indexed)
lwz	r3,-0x3e74(r13)
lwz	r4,0x20(r3) 	# get external data offset of first spawned player
li r3,0
PLAYER_COUNT_TOTAL_LOOP:
addi	r3,r3,1	# increment player counter
lwz	r4,8(r4)	# load next player external data pointer
cmpwi r4,0
bne- PLAYER_COUNT_TOTAL_LOOP
PLAYER_COUNT_TOTAL_END:
blr
#------------------

SAVE_STATE_TOTAL_COUNT:
li r3,0
adr_load r4,ss_tableStart_oneIndexed
SAVE_STATE_TOTAL_COUNT_LOOP:
lwzu	r5,ss_table.length(r4)
cmpwi	r5,0
beq-	SAVE_STATE_TOTAL_COUNT_END
addi	r3,r3,1
b	SAVE_STATE_TOTAL_COUNT_LOOP
SAVE_STATE_TOTAL_COUNT_END:
blr
#------------------

BUTTONS_CURRENT_INSTANT:
mulli r5,r3,0x44 # button offsets are 0x44 apart
adr_load r4, buttons.adr
add	r4,r4,r5
lhz	r3,2(r4)	# load current buttons (exclude joystick)
lhz	r4,0xa(r4)	# load instant buttons (exclude joystick)
xor r3,r3,r4	# current buttons do not include instants
blr

#-----------------

PLAYER_ACTION_STATE_CHECK:
# no inputs
# loop through all players and check for bad action states
# could make this a .long list
lwz	r3,-0x3e74(r13)
lwz	r4,0x20(r3) 	# get external data offset of first spawned player
li r3,1	# set bad action state as true by default
PLAYER_ACTION_STATE_LOOP:
lwz r4,0x2c(r4)	# load internal
lwz r5,0x10(r4)	# load action state

PLAYER_ACTION_STATE_CHARACTER_START:
lwz	r6,4(r4)	# load internal char ID
PLAYER_ACTION_STATE_LOOP_SAMUS:
cmpwi r6,0xd	# Samus
bne- PLAYER_ACTION_STATE_LOOP_SAMUS_END
lwz r6,0x223c(r4)	# load grapple entity pointer
cmpwi r6,0
bne- PLAYER_ACTION_STATE_END
b PLAYER_ACTION_STATE_CHARACTER_END
PLAYER_ACTION_STATE_LOOP_SAMUS_END:
PLAYER_ACTION_STATE_LOOP_LINK:
cmpwi r6,6	# Link
beq- PLAYER_ACTION_STATE_LOOP_LINK_EXECUTE
cmpwi r6,0x14	# young link
bne- PLAYER_ACTION_STATE_LOOP_LINK_END
PLAYER_ACTION_STATE_LOOP_LINK_EXECUTE:
lwz r6,0x2238(r4)	# grapple entity pointer
cmpwi r6,0
bne- PLAYER_ACTION_STATE_END
b PLAYER_ACTION_STATE_CHARACTER_END
PLAYER_ACTION_STATE_LOOP_LINK_END:

PLAYER_ACTION_STATE_CHARACTER_END:
cmpwi r5,0xc	# Rebirth
beq-	PLAYER_ACTION_STATE_END
cmpwi r5,0xd	# RebirthWait
beq-	PLAYER_ACTION_STATE_END
cmpwi r5,0x142	# Entry
beq-	PLAYER_ACTION_STATE_END
cmpwi r5,0x143	# EntryStart
beq-	PLAYER_ACTION_STATE_END
cmpwi r5,0x144	# EntryEnd
beq-	PLAYER_ACTION_STATE_END
lwz r4,0(r4)	# load external
lwz	r4,8(r4)	# load next player external data pointer
cmpwi r4,0
bne- PLAYER_ACTION_STATE_LOOP
PLAYER_ACTION_STATE_FALSE:
li r3,0
PLAYER_ACTION_STATE_END:
blr
#------------------


END_END:
addi	sp,sp,stack.size
# previous three lines, for safety (other injected code at those lines)
lwz r0,44(r1)
lwz r31,36(r1) 
lwz r30,32(r1) # default code line
----------

Troubleshooting

Differences:
0x598 pointer
0x5A8


********************
* SSBM AI Research *
********************

vanilla AI game functions

From Dan Salvato

Functions that read CPU AI type:
800a2074: check for AI type 5 (manual control)
800b2b18: Disabling this causes the CPU to walk back to their spot and do nothing
800ae0d8: check for AI type 14 (Hide 'n' Sheik?) Giant function
800b7440: check for AI type 16 (air). Triggers every frame when AI is on ground
800ace50: check for AI type 11 (Bomb-Fest). Makes them use downB

------------------------------------------------

800b2790: Main AI function, branches to different functions based on in-game conditions
	800b281c: Approach opponent
	800b2828: Main type (close-range attacks)
		800b65ac: Get the pointer of the character we're targeting
		800b65e0: Check if his action flag is 02 (if it is, roll away)
		800b6790: We are in the middle of an attack
		800b67d0: Back is facing opponent
	800b2834: Far away, shoot lasers
	800b2904: Knockdown
	800b2934: Grabbed opponent
	800b291c: Dodging an attack? When hitbox is nearby or intersecting (inc. projectiles)
	800b2a1c: Grab struggle


800b6de8: Choose whether or not to throw


800b3930: Function that turns commands into inputs?

*********************
* Name Tag Coloring *
*********************
802fcce8 breakpoint


d1409c

YESSSS

I found the color location for a nametag (the arrow that points to the nametag)...kind of

CPU color struct data looks like:

808080FF
7F7F7FFF   <--- place color here
FFFFFFFF
3F7FBE77
42480000



also found at d14de0 (!!!! this is for the "CP" color), d158a0, d15a80, d15f60, d16780, d16a80



RAM Root struct +0xc = pointer to color struct 


r30 = d143c0
	d14460 = +0x10(r30) = nametag bone

nametag bone:
0xc = d143c0
0x18 = d14080


take 0x18 pointer, then pointer to a couple child structs 

0x00 = general RAM pointer/flag
0x04 = pointer to next child struct
0x08 = pointer to bone data
		0x0c = pointer to color struct (set color at 0x4)
0x0c = pointer to ...?


Bone order is "CP"/"P1", colored arrow pointing to P1, then shadowbox (given a transparency of 0 if no nametag is used)

****************************************
* Extra Chars Have No X/Y Alt Costumes *
****************************************
Extra Characters have No X/Y Alt Costumes
inject @ 802600d8

addi r5,r3,948
lbz r0,0xe(r5)
mulli	r0,r0,28
add	r5,r31,r0
lbz	r5,0xdd(r5)	# load char ID
cmpwi	r5,0x1a
blt-	DEFAULT
NO_COSTUMES:
lis	r5,0x8026
ori	r5,r5,0x028c
mtctr	r5
bctr

DEFAULT:
rlwinm.	r0,r4,0,21,21

************************************
* THP Movie File Function Research *
************************************

_THPHuffDecodeDCTCompY (labeled by Dolphin)
80334880

__THPHuffDecodeDCTCompX_assumption
blr @ 80335c54

803313c8
	80332e80


8001ef5c
	8032fdb8
		803312f4

8032fdb8 is also called by 8001faa0. I think 8001faa0 is for MTH files.


Stack Trace (while How to Play is playing):
80332e7c
803313c8
8001ef5c
8001f67c <--- I think this begins a THP movie play function
80390ed0 (big general function)

Stack Trace (while movie [opening] is playing):
80331468
80331338
8001ef5c
8001f67c <--- I think this begins a THP movie play function
80390ed0 (big general function)



Hmm... let's go out on a limb and try using the following spaces in MCM
RAM: (8032fdb8, 80335c54) // can probably do 80335c58 but idk..safety
DOL: (0x32C998, 0x332834)

NOTE: doing the above requires MTH and THP file reading to be disabled.

**************************
* MasterHand / CrazyHand *
**************************

Controlling_Functions:

MasterHand
80150894

CrazyHand
80156ad8

Human MasterHand Controlled by Selected Port
041508B8 80C4065C


Human CrazyHand Controlled by Selected Port
04156AFC 8006065C


Disable CrazyHand D-pad Up+B Attack (freezes game)
04156ce0 4800006c

******************************
* Dopplegangers (CPU Clones) *
******************************

Injected @ 0x31bcc
- In SetupPlayerSlot right after AllocateAndInitPlayer

stw r3,0xB0(r30)	# default code line
lwz	r3,0x2c(r3)	# load internal offset
lwz	r4,4(r3)	# load internal char ID
cmpwi	r4,0x7	# Sheik
beq-	END
cmpwi	r4,0xa	# Popo
beq-	END
cmpwi	r4,0xb	# Nana
beq-	END
cmpwi	r4,0x13	# Zelda
beq-	END

lis	r4,0x8048
lbz	r4,-0x62D0(r4)	#load menu controller major
cmpwi	r4,0x5
beq-	CPU_CLONE_ALL_STAR_CHECK
mr	r3,r4
lis	r4,0x801a
ori	r4,r4,0x4340	# load function: MenuController_CheckSinglePlayer
mtlr	r4
blrl
cmpwi	r3,1		# if in single player, skip all this
beq-	END
CPU_CLONE_VS:

lwz	r3,0xB0(r30)
lwz	r3,0x2c(r3)	# load internal offset
lbz	r3,0xc(r3)
mulli	r3,r3,4

lis	r4,0x803f
ori	r4,r4,0xbaa0	# = address of P1 clone flag

lwzx	r3,r4,r3
cmpwi	r3,0
beq-	END
b	CLONE_GO

CPU_CLONE_ALL_STAR_CHECK:
lwz	r4,8(r3)	# load spawn number
cmpwi	r4,1
bne-	END
lis	r3,0x8040
lwz	r3,-0x512C(r3)
cmpwi	r3,0
beq-	END

CLONE_GO:
li	r4,1
lbz	r0,0xac(r30)	# load multispawn flag
rlwimi	r0,r4,5,26,26	# turn on (00000020)
stb	r0,0xac(r30)
li	r0,2
stb	r0,0x46(r30)	# store sub color (dark)

lwz	r3,0xB0(r30)
lwz	r3,0x2c(r3)	# load internal offset
lbz	r0,0x2222(r3)
li	r4,1
rlwimi	r0,r4,2,29,29
stb	r0,0x2222(r3)	# store flag to make secondary disappear upon death

li r3,128	# was 128 for cpu (nana), 42 for human
stb r3,0x2A(sp)

lis	r3,0x8006
ori	r3,r3,0x8e98
mtlr	r3
addi r3,sp,36
blrl
stw r3,0xB4(r30)
lwz	r3,0x2c(r3)
#li	r4,2
#stb	r4,0x61a(r3)	# store sub color (dark)

lis	r4,0x8048
lbz	r4,-0x62D0(r4)	#load menu controller major
cmpwi	r4,0x5
beq-	CPU_CLONE_GO_ALLSTAR_END
CPU_CLONE_GO_VS_END:
# modifying the CPU AI is accomplished in the 20XX main AI code. 
b	END

CPU_CLONE_GO_ALLSTAR_END:
lis	r4,0x8040
lwz	r4,-0x512C(r4)	# 3faed4 = All-Star clone controlled by
subi	r4,r4,1
stb	r4,0x618(r3)	# store controller index
li	r4,5
stw	r4,0x1a94(r3)	# store CPU type manual
END:


***************************
* DOL/RAM Character Table *
***************************
primary/secondary character loading

3bcde0 (RAM)...player table...hmm
designates how characters spawn with other characters (popo/nana and zelda/sheik)

Each table entry is 0x02 in length
0x00 = internal char ID, primary
0x01 = internal char ID, secondary
		0xFF for no secondary char
0x02 = "Sleep" flag
		0x00 = no "sleep" for secondary char
		0x01 = secondary char is set to "Sleep" action state at match start (e.g. Zelda/Sheik)

***********************
* RANDOM Stage Select *
***********************

RANDOM Stage Select Option uses 20XX 4.0 Stage Swap Logic

Inject @ 8025b878 - lbz r0,0(r3)
- relies upon stage swap injection point of 8025bb40

subi	r12,r3,0xb
mr	r3,r4
mr	r4,r12
lis	r12,0x8025
ori	r12,r12,0xbb40	# lbz r0,0xb(r4)
mtctr	r12
bctr

C225B878 00000004
3983FFF5 7C832378
7D846378 3D808025
618CBB40 7D8903A6
4E800420 00000000

****************
* CSS Research *
****************

Returning to CSS, extra characters get reset...

80264eec

lis r17,-32730
ori r17,r17,20244
mtlr r17
li r17,15
blr


8025dbe4 is updating the CSP nametag font

80260c30 branches into CursorHighlightUpdateCSPInfo when hovering over CSP

--> backtracking
802608f4 - lbz r0,0x5(r31) - load something from CSP player RAM info (probably a "state")

CSS Selection Entity Data
0x00	pointer	to entity struct start
0x04	byte	token ID (p1 = 0)
0x05	byte	flag
	00 = below char select icons, in CSP zone
	01 = cursor is grabbed, hovering over icons
	02 = character is chosen
	03 = ??

0x06	byte	flag
	00 = last selected token was human
	01 = last selected token was CPU
0x0C	float	x-position


Load pointer @ 4d781c to entity struct start (from above)
0x10 = pointer to next CSS token
0x2c = start of CSS selection entity data


---------------
Experimenting....

Marth is Sheik Nametag

8025dbe4 - lbz r3,0xdd(r3)


lbz r3,0xdd(r3)
cmpwi r3,0x9
bne-	END
li r3,0x13
END:




P1 Name is based on selected char data:
3f0a48 + 0x444 + 0xc*port

80262614
- same injection point as another CSS code (hold start to force load SSS)

lis	r26,0x803f
ori	r26,r26,0x0a48
addi	r26,r26,0x444
lis r3,0x8016
ori r3,r3,0x0980
mtlr	r3

lis r3,0x8048
lbz r3,0x0820(r3)
blrl
lwz	r4,0(r26)
addi	r5,r3,0
crclr	6,6
lwz	r3,0(r4)
lis	r4,0x803a
ori	r4,r4,0x70a0
mtlr	r4
li	r4,0
blrl


DEFAULT:
lmw r19,180(r1)

---------------

Re-Initialize CSP Text on CSS Load

Inject @ 8025f0c0 - cmpw	r31,r0
- r3,r4 good to use

cmpw	r31,r0
blt-	DEFAULT
lis	r4,0x8000
lwz	r3,0x3350(r4)
cmpwi	r3,1
beq-	ZERO_FLAG_END
li r3,1
stw	r3,0x3350(r4)
li r31,0
b DEFAULT

ZERO_FLAG_END:
li r3,0
stw	r3,0x3350(r4)
DEFAULT:
cmpw r31,r0


---------------
Load Selected Char ID Text Instead if Normal char
inject @ 8025dbe4


lis r4,0x8000
lwz	r4,0x3350(r4)
cmpwi r4,0
beq-	DEFAULT


lwz r4,-0x49f0(r13)	# load CSS data start
addi r4,r4,112	# get to P1 char
lbzx r3,r4,r29
b	END
DEFAULT:
lbz	r3,0xdd(r3)
END:

--------------------

Selected Extra Chars Don't Reset on CSS load If Unavailable

Inject @ 80264eec - li r4,26

add r4,r0,r3
lbz r4,1(r4)
cmpwi r4,3
beq-	DEFAULT
lbzx r4,r3,r0	# load external char ID
cmpwi	r4,0x12
beq-	SHEIK_ZELDA_CSP
cmpwi	r4,0x13
beq-	SHEIK_ZELDA_CSP

cmpwi	r4,0
beq-	FALCON_CSP
cmpwi	r4,0x1b
beq-	FALCON_CSP

cmpwi	r4,0xc
beq-	PEACH_CSP
cmpwi	r4,0x1c
beq-	PEACH_CSP

cmpwi	r4,0x5
beq-	BOWSER_CSP
cmpwi	r4,0x1d
beq-	BOWSER_CSP

cmpwi	r4,0xe
beq-	ICE_CLIMBERS_CSP
cmpwi	r4,0x20
beq-	ICE_CLIMBERS_CSP

cmpwi	r4,0x18
beq-	PICHU_CSP
cmpwi	r4,0x1a
beq-	PICHU_CSP

cmpwi	r4,0xd
beq-	PIKACHU_CSP
cmpwi	r4,0x1e
beq-	PIKACHU_CSP

BOWSER_CSP:
li r17,0x3
b	SKIP_CHAR_RESET

PEACH_CSP:
li r17,0x4
b	SKIP_CHAR_RESET

FALCON_CSP:
li r17,0x7
b	SKIP_CHAR_RESET

SHEIK_ZELDA_CSP:
li r17,0xf
b	SKIP_CHAR_RESET

ICE_CLIMBERS_CSP:
li r17,0xc
b	SKIP_CHAR_RESET

PICHU_CSP:
li r17,0x12
b	SKIP_CHAR_RESET

PIKACHU_CSP:
li r17,0x13
b	SKIP_CHAR_RESET

SKIP_CHAR_RESET:
lis r4,0x8026
ori r4,r4,0x4f14
mtlr	r4
blr

DEFAULT:
li r4,26



****************************************
* Match Start - Hold Button Executions *
****************************************
Hold z to disable 20XX in-game toggles
8016d97c - rlwinm. r0,r0,0,23,23

Z_BUTTON_CHECK_MODE:	# don't allow Z-button to disable codes in 1P modes (except training)
lis	r3,0x8048
lbz	r3,-0x62D0(r3)	#load menu controller major
cmpwi	r3,0x1c		# is this training mode?
beq-	Z_BUTTON_GO
lis	r4,0x801a
ori	r4,r4,0x4340	# load function: MenuController_CheckSinglePlayer
mtlr	r4
mr	r4,r0	# store default button presses
blrl
mr	r0,r4	# restore default button presses
cmpwi	r3,1		# if in single player, skip all this
beq-	Z_BUTTON_END
Z_BUTTON_GO:

Z_BUTTON:	# disable in-game toggles
rlwinm. r3,r0,0,27,27	# (00000010) Z button?
beq-	Z_BUTTON_END
Z_BUTTON_DISABLE_20XX_TOGGLES:
li r3,0
lis	r4,0x8040
stw	r3,-0x5C28(r4)	# store 20XX in-game toggles flag off
lis r3,0x8000
lis r4,0x0003	# text struct 3
ori r4,r4,0x003c	# 60 frame timer
stw r4,0x36cc(r3)
ori r4,r3,0x3acc
stw r4,0x36d0(r3)
ori r4,r3,0x3b00
stw r4,0x36d4(r3)

Z_BUTTON_END:

INGAME_TOGGLES_SET_ASCII_DEFAULTS:
li r4,0x4646	# "FF" for OFF
lis	r3,0x8040
lwz	r3,-0x5C28(r3)	# load 20XX in-game toggles flag
cmpwi r3,0
beq- INGAME_TOGGLES_20XX_STORE
li r4,0x4e20	# "N " for ON
INGAME_TOGGLES_20XX_STORE:
lis r5,0x8000
sth r4,0x3b16(r5)

li r4,0x4646	# "FF" for OFF
lis r3,0x804d
lwz r3,0x4a08(r3)
rlwinm. r3,r3,30,31,31	# load Develop Mode bit
beq- INGAME_TOGGLES_DEVELOP_STORE
li r4,0x4e20	# "N " for ON
INGAME_TOGGLES_DEVELOP_STORE:
lis r5,0x8000
sth r4,0x3b28(r5)

DEFAULT:
rlwinm. r0,r0,0,23,23	# default code line (holding A?)

--------------------


OLD -->

#20XX TOGGLE FLAG CHECK
li	r3,0x4646	# r7 = ASCII "FF" for OFF
lis	r4,0x8000
sth	r3,0x3b22(r4)	# store 20XX flag ASCII

lis	r3,0x8000
ori	r4,r3,0x3ad8	# text struct start
stw	r4,0x3acc(r3)	# store custom text struct start
ori	r4,r3,0x003c	# 60 frames to display text
stw	r4,0x3ad0(r3)	
ori	r4,r3,0x3b0c	# ASCII start
stw	r4,0x3ad4(r3)	# store ASCII start into flags


******************************
* DreamLand - Disable Whispy *
******************************
Disable Dream Land wind
This code disables Whispy and the flowers from blowing

04211408 480007f0

**********************
* Z to Restart Match *
**********************

1a3a80 function

P1 - 4c20bc
0x00
0x08
0x0C

when all equal the same, the press is registered

8046b6a0 +0x3 = 0
and
1a36a0 - pulls the 0x8 and 0xc word from 80479c30

*********************************************
* Increased Joystick DeadZone on Debug Menu *
*********************************************

hooking into wParam's "all players control" code

3039bc	- add r9,r4,r5
- r9 is now at 0x00 of controller data
	- need to modify 0x00 (this frame) and 0x08 (instant)
	- 0x20 is x-float, 0x24 is y float

first halfword of 0x00:
0001 = joystick up
0002 = joystick down
0004 = joystick left
0008 = joystick right

can use r3,r0
----------

set r3 to 1
then
rlwimi	r0,r3,0,31,31 = (00000001)
rlwimi	r0,r3,1,30,30 = (00000002)
rlwimi	r0,r3,2,29,29 = (00000004)
rlwimi	r0,r3,3,28,28 = (00000008)

---------

Create 0.8 DeadZone Square

add r9,r4,r5	# default code line
lis	r3,0x3f4c
ori	r3,r3,0xcccd	# load 0.8
stw	r3,0x20(r2)
lfs	f15,0x20(r2)	# load 0.8 int fpr
lfs	f16,0x20(r9)	# load joystick X float
fabs	f16,f16
fcmpo	cr0,f16,f15
bge-	XJOY_END
REMOVE_XJOY:
li r3,0
lbz	r0,1(r9)
rlwimi	r0,r3,2,29,29
rlwimi	r0,r3,3,28,28
stb r0,1(r9)
lbz	r0,9(r9)
rlwimi	r0,r3,2,29,29
rlwimi	r0,r3,3,28,28
stb r0,9(r9)
XJOY_END:

lfs	f16,0x24(r9)	# load joystick Y float
fabs	f16,f16
fcmpo	cr0,f16,f15
bge-	YJOY_END
REMOVE_YJOY:
li r3,0
lbz	r0,1(r9)
rlwimi	r0,r3,0,31,31
rlwimi	r0,r3,1,30,30
stb r0,1(r9)
lbz	r0,9(r9)
rlwimi	r0,r3,0,31,31
rlwimi	r0,r3,1,30,30
stb r0,9(r9)
YJOY_END:

END:

------------

Debug Menu - Disable L/R from switching item left/right

04303c74 38030000	# R
04303d1c 38030000	# L

****************************************
* Freeze Character During Action State *
****************************************
For UnclePunch

inject @ 8016cda0

lwz	r15,-0x3e74(r13)
lwz	r15,0x20(r15) 	# should get you the first player who was created

PLAYER_FREEZE_LOOP:
lwz	r15,0x2c(r15)	# load internal offset
lwz	r16,0x10(r15)	# load action state
cmpwi	r16,0x42
bne-	PLAYER_FREEZE_LOOP_END
lhz	r16,0x894(r15)	# load first half of action state frame float
cmpwi	r16,0x4080
bne-	PLAYER_FREEZE_LOOP_END
FREEZE:
li r16,7
stb	r16,0x2219(r15)	# freeze

PLAYER_FREEZE_LOOP_END:
lwz	r15,0(r15)	# load char entity start
lwz	r15,8(r15)	# load next char
cmpwi	r15,0	# no more chars?
bne-	PLAYER_FREEZE_LOOP

stwu	sp,-0x30(sp)	# default code line

********************************************
* Classic Mode - VS Screen Character Poses *
********************************************

80186ea8 - stores word @ 8047369C
80186eac - stores word @ 804736A0

write the Classic Data

broke @ 80186634


80185dd8 reads P2's external char ID

UnclePunch - screenshots of chars on left side
http://imgur.com/a/iP9cm

*******************************
* Charge Smash Attack Formula *
*******************************

{[((frames of charge)/(max frames of charge))*(1.3671 - 1)] + 1} * BaseDamage

*************************************
* Synchronous / Asynchronous Timers *
*************************************

In Player files regarding subaction data...
Synch being with respect to the previous timer event (synch 12 means wait 12 frames before advancing in the script).
Asynch is with respect to the beginning of the script (asynch 20 means wait until 20 total frames have passed since script start).

************************
* Throw Release Points *
************************
Magus

http://smashboards.com/threads/official-ask-anyone-frame-things-thread.313889/page-30#post-20924852

***********************
* Roy - Enable Sheath *
***********************

inject @ 80074abc
- end of function that sets some model view flags

li r3,0	# default code line
lwz	r6,0x4(r4)	# load internal char ID
cmpwi r6,0x1a	# Roy?
bne-	END
stb r3,0x5f9(r4)	# store 0x00 instead of 0xFF to flag byte corresponding to sheath model
END:

*****************************
* Metal Cavern HD - Zankyou *
*****************************

Model import analysis

object @ 0x000f7a18 is the object struct offset for stage crystals

****************************************
* Controller Input Timing Modification *
****************************************

- Dan Salvato

C21A4DA0 00000003
901C0000 3D808001
618C95FC 7D8903A6
4E800421 00000000
08402cc4 004e0400
20020004 00000000
04019860 4bfffd9d

The first four lines synchronize the software poll with the game engine,
the next two lines double the hardware polling rate,
and the last line removes the function that creates a separate thread for the software poll

0xcc006430 controls the polling rate.

--------------

The C2 injection code from above
inject @ 801a4da0
stw r0,0(r28)
lis r12,0x8001
ori r12,r12,0x95fc
mtctr r12
bctrl

-------------

402ca0 - NTSC TV Format polling struct start
402cd0 - PAL TV Format polling struct start

each word line in the struct represent...time?...stuff for the different SISetSampling rate input variable (0x0 to 0xb).
0x00	half	SIPOLL|X|
0x02	byte	SIPOLL|Y|

 
SISetXY: x is out of range of 8 <= x <= 1023
	y is out of range 0 <= y <=255


PAD POLL SYNCED TO GAME ENGINE :
SMASH TURN - 2 FRAME WINDOW :

PAD POLL SAMPLING RATE (MSECS) : 
DEFAULT = 11. MISLEADING - ACTUAL SAMPLE RATE DIFFERS

402ca0
402ccc

OSAlarm 0x432a40
a4cb8 = 675000

8001960c

lis r4,0x8037
ori r4,r4,0x69fc
mtlr r4
li r3,0
blrl
lis r4,0x8037
ori r4,r4,0x69fc
mtlr r4
li r3,0
blrl





************************
* Kongo Jungle (Melee) *
************************

Disable stage/log tilting
041d5594 60000000

Disable Klaptraps and floating logs
041d55a8 60000000

**************************
* CPU - Disable Taunting *
**************************

inject @ 800de9d8
- beginning of Interrupt_Taunt

for 20XX

lis r4,0x8040
lwz r4,-0x5C78(r4) # load Frame Counter flag
cmpwi r4,1	# if ON, skip taunting
beq- NO_TAUNT
lwz	r4,0x2c(r3)	# load internal char offset
lbz r5,0xc(r4)	# load port number
mulli r5,r5,0xe90	# multiply by player block offset
lis r6,0x8045
ori r6,r6,0x308b
lbzx r6,r6,r5	# load player type
cmpwi r6,0	# if human, taunt
beq-	TAUNT
# player is a CPU
lwz	r6,0x1a94(r4)	# load CPU type
cmpwi	r6,5	# if Manual, skip
beq-	TAUNT

NO_TAUNT:
li r3,0
blr
TAUNT:
mflr r0

****************************
* D-Pad Down Gives Starman *
****************************

inject @ 8006cb7c

lwz r3,0x668(r31)
cmpwi r3,0x4
bne- END
lis r3,0x8007
ori r3,r3,0xb7fc
mtlr r3
mr	r3,r31	# r3 = internal offset
li r4,0x258	# 258 frames of invincibility
blrl

END:
lwz r0,0x1c(sp)

******************
* L-Cancel Flash *
******************

For 20XX

L-Cancel Codes
- CPU always l-cancel
- flash red on unsuccessful l-cancel (flag set logic)
- flash white on successful l-cancel (flag set logic)
- l-cancel success percent beginning logic

inject @ 8008d698 -cmpw r5,r0
- this code was just adapted from the old one
	- now using internal char (entity) struct pointers
	- added in the check for manual cpu type

lwz	r19,0x2c(r3)	# load internal char pointer
lbz r16,0xc(r19)	#r16 holds player number	
mulli r14,r16,0xe90		
lis r15,0x8045		
ori r15,r15,0x3088		
lwzx r17,r15,r14		
cmpwi r17,0		#CPU equals 1, HMN equals 0
beq- HUMAN_CONTINUE		#maybe add in an "if human but an action toggle is on, then always cancel"

lwz	r18,0x1a94(r19)	# load CPU type
cmpwi	r18,5	# Manual type?
beq-	HUMAN_CONTINUE
li r5,0	#CPUs always L-Cancel	
		
HUMAN_CONTINUE:		
mulli r16,r16,-0x4		
lis r18,0x803F		
ori r18,r18,0xA1f8	#FLASH WHITE SUCCESSFUL L debug menu toggle	
cmpwi r17,1	#if computer, skip the no hard l cancel part	
beq- RED_OR_WHITE_CHECK		
NO_CANCEL_HARD:		
lwzx r17,r18,r16		
cmpwi r17,1		
bne- RED_OR_WHITE_CHECK		
lbz r17,0x680(r19)		
cmpw r17,r0		
blt- 0x8		
b RED_OR_WHITE_CHECK		
mr r17,r0		
addi r5,r17,1	#I can't just do addi r5,r0,1??	
		
RED_OR_WHITE_CHECK:		
addi r18,r18,0x1d0		
cmpw r5,r0		
bge- RED_SET_FLAG		
lwzx r18,r18,r16		
cmpwi r18,1		
bne- END		
li r15,0xFF		
stb r15,0x504(r19)		
b END		
RED_SET_FLAG:		
subi r18,r18,0x1c0		
lwzx r18,r18,r16		
cmpwi r18,1		
bne- END		
li r15,0xFE		
stb r15,0x504(r19)		
END:		
RESULTS_LCANCEL_PERCENT:		
lbz r14,0xc(r19)		
mulli r14,r14,0xE90		
lis r15,0x8045		
ori r15,r15,0x3da4		
		
cmpw r5,r0		
bge- NO_L_CANCEL		
b CANCEL_END		
		
NO_L_CANCEL:		
addi r15,r15,2		
		
CANCEL_END:		
lhzx r16,r15,r14		
addi r16,r16,1		
sthx r16,r15,r14		

---------------------

Part 2: Initiating the color
load @ line 800C0148

addi r3,r31,0x0488	# default code line
lbz r15,0x0504(r31)
lis r16,0x437F
li r17,0
cmpwi r15,0xFF
beq- WHITE
cmpwi r15,0xFE
bne- END

RED:
stw r17,0x04bC(r31)
stw r17,0x04c0(r31)
b COLOR_END

WHITE:
stw r16,0x04bC(r31)
stw r16,0x04c0(r31)

COLOR_END:
stw r17,0x04c8(r31)
stw r17,0x04cC(r31)
stw r17,0x04d0(r31)
stw r16,0x04b8(r31)
lis r15,0xC200
stw r15,0x04c4(r31)
li r15,0x91
stb r15,0x0504(r31)
lis r15,0xC280
stw r15,0x04d4(r31)
lis r15,0x800C
ori r15,r15,0x0150
mtctr r15
bctr
END:
nop

***********************************
* SDR Frame Speed Modifier Engine *
***********************************
FSM engine
- original code by Magus

For 20XX
7/11/16
- updated the 

(1.02) 20XX
injected @ 80073338
- r27 = start of external player data offset
- r30 = start of internal player data offset

/*lwz r29,0x4(r30)	#r15 holds internal char ID
mulli r29,r29,8	
lis r31,0x803c	
ori r31,r31,0x1f40	
lwzx r31,r31,r29	#r14 holds start of Player's file locations
lbz r31,0x5(r31)	
cmpwi r31,0x73	
bne- END	#if not an SDR char, branch to end
*/

mr r3,r27
lbz r31,0xc(r30) # load player ID number
lis r29,0x8045
ori r29,r29,0x3084
mulli r31,r31,0xE90
add r31,r29,r31
lwz r4,0(r31)
lbz r31,8(r31)	# load primary char or alt char in use flag (01 = alt) 
cmpwi r4,0x13	# match started as Sheik?
beq- 0x1C
cmpwi r4,0x12	# match started as Zelda?
bne+ 0x20
cmpwi r31,1
bne+ 0x18
li r4,0x13
b 0x10
cmpwi r31,1
bne+ 0x08
li r4,0x12
lfs f1,0x894(r30)
fctiwz f1,f1
stfd f1,0(r2)
lwz r5,4(r2)
lwz r6,0x10(r30)
lwz r7,0x14(r30)
ori r7,r7,0x8000

lwz r29,0x4(r30)	#r15 holds internal char ID
mulli r29,r29,8	
lis r31,0x803c	
ori r31,r31,0x1f40	
lwzx r31,r31,r29	#r14 holds start of Player's file locations
lbz r31,0x5(r31)	
cmpwi r31,0x73	# SDR char?
beq- SDR	#
cmpwi r31,0x70	# PAL char?
bne-	END
PAL:
lis r31,0x8032
ori r31,r31,0xEE98
b FSM_LIST_READ
SDR:
lis r31,0x8000
ori r31,r31,0x49c8

FSM_LIST_READ:
lwzu r29,8(r31)
cmpwi r29,0		# is entry null?
beq- END
rlwinm r28,r29,8,24,31
cmpwi r28,0xFF
beq- 0x14
cmpw r28,r4
beq- 0x0C
bgt- 0x48
b 0xFFFFFFDC
rlwinm r28,r29,16,24,31
cmpw r28,r5
bgt- 0xFFFFFFD0
rlwinm r28,r29,0,16,31
cmpw r28,r6
beq- 0x0C
cmpw r28,r7
bne+ 0xFFFFFFBC
lwz r28,4(r31)
cmpwi r28,-1
beq- 0x18
lfs f1,4(r31)
lis r31,0x8006
ori r31,r31,0xF190
mtlr r31
blrl
END:
lmw r27,20(r1) # default code line

*************************
* Magus Physics Display *
*************************

Load Custom CPU Stat Floats (80392c2c, 38f80c DOL)-
- 7/12/16, updated to use char internal entity data pointers instead of external

Custom Registers:
r20 = Temp Stuff | 0000FFFF
r21 = Temp Stuff
r22 = Temp Stuff |                  Common Load 1, Int to Float 1
r23 = Temp Stuff | Current Action | Common Load 2, Int to Float 2
r24 = Temp Stuff | Current Floats Setting for Functions
r25 = Current Floats Pair
r26 = Current Float Storage Address
r27 = Pokemon Setting
r28 = Address of Debug Item/Pokemon Settings and Debug Inputs
r29 = Font Color Data Address | Main Index for Player
r30 = Player ID
r31 = Display Settings Address | Display Settings Address + 0x7 (for indexed loading of settings)


-------------
.macro  gpr_save
stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack
.endm

.macro  gpr_restore
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
.endm

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

gpr_save

#new additions
stw	r3,56(r1)
stw	r4,60(r1)

lis	r31,0x8032
ori	r31,r31,0xed8c	# 8032ed8c
lbz	r30,0(r31)	# loads player ID to display stuff for
cmpwi	r30,1
blt-	RESET_ID
cmpwi	r30,4
ble+	SCALE_ID

RESET_ID:
li	r30,1		# set player ID to 1 if not 1-4

SCALE_ID:
stb	r30,0(r31)	# store player ID
mulli	r20,r30,11111	# scale up player id by 11111 (for on-screen readability)
stw	r20,4(r31)	# update player ID to display

DEFAULT_SETTINGS:
lwz	r20,8(r31)	# loads settings for displayed stuff
cmpwi	r20,0		# 0 if no settings defined yet
bne+	DEFAULT_COLORS
lis	r20,0x0006
ori	r20,r20,0x0A00	# 00060A00. TopN, Char Velocity, Directional Input (System)
stw	r20,8(r31)	# default settings for displayed stuff

DEFAULT_COLORS:
li	r20,0x3030	# 00003030 (- - 0 0)
li	r21,0x6666	# 00006666 (- - f f)
lis	r22,0x6666
ori	r22,r22,0x3030	# 66663030 (f f 0 0)
lis	r29,0x8040
ori	r29,r29,0xa49e	# 8040a49e. Font color data address -0x1C

sth	r21,0x1C(r29)	# f f      @ (float 1 Red)
sth	r21,0x20(r29)	# f f      @ (float 1 Blue)
sth	r21,0x2E(r29)	# f f      @ (float 2 Blue)

sth	r20,0x38(r29)	# 0 0      @(float 3 Red)
stw	r22,0x3A(r29)	# f f 0 0  @ (float 3 Green/Blue)
sth	r20,0x46(r29)	# 0 0      @ (float 4 Red)
stw	r22,0x48(r29)	# f f 0 0  @ (float 4 Green/Blue)

stw	r22,0x54(r29)	# f f 0 0  @ (float 5 Red/Green)
sth	r21,0x58(r29)	# f f      @ (float 5 Blue)
stw	r22,0x62(r29)	# f f 0 0  @ (float 6 Red/Green)
sth	r21,0x66(r29)	# f f      @ (float 6 Blue)

UPDATE_SETTING:
addi	r31,r31,7	# 8032ed93. settings address -0x1
lis	r28,0x8049
ori	r28,r28,0xFAB0	# 8049FAB0. Address of Debug Item/Pokemon Settings
lwz	r27,0x4(r28)	# loads Pokemon Setting

cmpwi	r27,1
blt+	FLOAT_PREP
cmpwi	r27,3
bgt+	FLOAT_PREP	# no float font highlight or updating floats setting if not slots 1-3
lwz	r24,0x0(r28)	# loads Item Setting
stbx	r24,r31,r27	# stores item setting as floats setting for the slot

HIGHLIGHT:
mulli	r23,r27,0x1C	# float pairs' color data 0x1C apart. 1st float in pair offset
addi	r24,r23,0xE	# 2nd float in pair offset

sthx	r21,r29,r23	# 1st float Red = f f
sthx	r21,r29,r24	# 2nd float Red = f f
addi	r23,r23,2	# moves 1st float offset to Green/Blue
addi	r24,r24,2	# moves 2nd float offset to Green/Blue
stwx	r22,r29,r23	# 1st float Green/Blue = f f 0 0
stwx	r22,r29,r24	# 2nd float Green/Blue = f f 0 0

FLOAT_PREP:
li	r20,0
stw	r20,0x18(r2)	# stores 0 for when loading null floats
mr	r26,r2		# initialize address to store floats during code's loop
li	r25,1		# initialize current float pair being worked on

GET_MAIN_INDEX:

lis r29,0x8045
ori r29,r29,0x22a0     #player pointers (p1) -0xe90
mulli	r21,r30,0xe90

lwzx	r29,r29,r21	# load external data pointer for player

cmpwi r29,0
beq-	NULL_FLOATS
lwz	r29,0x2c(r29)	# load internal data pointer

LOOP_START:
cmpwi	r29,0
beq-	NULL_FLOATS	# go to use 0 for both floats in this pair if empty player slot
lbzx	r24,r31,r25	# loads setting for float pair being worked on
lwz	r23,0x10(r29)	# loads current action


cmpwi	r24,0x00	# 0x00 = TopN
beq-	TOPN

cmpwi	r24,0x4
ble-	SCD		# 0x1 - 0x4 = SCD Top/Bottom/Right/Left

cmpwi	r24,0x5		# 0x05 = TIMER - ECB Bottom Update
beq-	ECB_TIMER

cmpwi	r24,0x09
ble-	VELOCITIES	# 0x06 - 0x09 = Forces|Velocities

cmpwi	r24,0x0C
ble-	LIVE_INPUTS	# 0x0A - 0x0C = Live Controller Port Inputs

cmpwi	r24,0x0F
ble-	CHAR_INPUTS	# 0x0D - 0x0F = Inputs Applied to Character

cmpwi	r24,0x13
ble-	BUTTON_TIMERS	# 0x10 - 0x13 = Button Timers

cmpwi	r24,0x14	# 0x14 = Total Damage|Grab Hold Time
beq-	DAMAGE_GRABTIME

cmpwi	r24,0x15	# 0x15 = Hitlag|Hitstun|
beq-	HITLAG_HITSTUN

cmpwi	r24,0x16	# 0x16 = DI Trajectory Angle Change
beq-	DI_TRAJECTORY

cmpwi	r24,0x17	# 0x17 = Shield Stun (Actual|Calculated)
beq-	SHIELDSTUN

cmpwi	r24,0x18	# 0x18 = Shield Health|Size
beq-	SHIELD_HPSIZE

cmpwi	r24,0x19	# 0x19 = Shield Tilt Offset | Angle
beq-	SHIELD_TILT

cmpwi	r24,0x1A	# 0x1A = Timed Intangibility/Invincibility
beq-	TIMED_INTINV

cmpwi	r24,0x22	# 0x1B - 0x22 = Hitbox X/Y|Hitbox Z/Size
ble-	HITBOX

#IDs jump from 0x22 to 0x2B

cmpwi	r24,0x2B	# 0x2B = jumps|walljumps used
beq-	JUMP_WALLJUMP	

cmpwi	r24,0x2C	# 0x2C = special move pseudo jump
beq-	PSEUDO_JUMP

cmpwi	r24,0x2D	# 0x2D = Timer - Ledge Regrab Disable
beq-	LEDGE_REGRAB

cmpwi 	r24,0x2E	# 0x2E = Blastzone Top|Bottom
beq-	BLASTZONE_TOP

#IDs jump from 2E to D0

cmpwi 	r24,0xD0	# 0x2E = Blastzone Left|Right
beq-	BLASTZONE_SIDES

cmpwi	r24,0xD1
beq-	ACTION_STATE	# 0xD1 = subaction / action state ID

cmpwi	r24,0xD2
beq-	TOPN		# 0xD2 = frame stopwatch

cmpwi	r24,0xD3
beq-	JAB_INFO
b	NULL_FLOATS	# load null floats if invalid setting on this float pair

JAB_INFO:
lwz	r22,0x1a54(r29)	# load rapid jab A counter
lfs	f1,0x196c(r29)	# load link window frames left
fctiwz f1,f1		# convert float to int
stfd f1,0x20(r2)
lwz r23,0x24(r2)	# load int
b	INT_TO_FLOAT

TOPN:
cmpw	r25,r27
bne+	TOPN_ADDRESS	# skip input checks for TopN modification if TopN float pair not highlighted

TOPN_MODIFY:
subi	r21,r28,0xC2	# 8049f9ee. Controller port 1 debug held inputs -0x14
subi	r24,r28,0x72	# port 4's address for end of loop

TOPN_LOOP:
lhzu	r22,0x14(r21)	# loads next port's held inputs
li	r23,0x0104	# A and dpad-down buttons
andc.	r23,r22,r23
bne-	TOPN_LOOP_CHK	# skip if inputting anything besides A or dpad-down

lhz	r23,0x8(r21)	# loads press inputs
rlwinm. r23,r23,0,29,29	# check if dpad-down press
beq+	TOPN_LOOP_CHK	# skip if no dpad-down press

CHECK_IF_STOPWATCH:
lbzx	r4,r31,r25
cmpwi	r4,0xD2		#is this frame stopwatch?
bne-	TOPN_ZERO

lis	r3,0x8047
lwz	r3,-0x493C(r3)	# load match frame count
lis	r23,0x8033
lwz	r4,-0x1178(r23)# load last zero-out frame
sub	r4,r3,r4
stw	r3,-0x1178(r23) # store new zero-out frame
rlwinm. r3,r22,0,23,23	# check if A button held
beq+	TOPN_LOOP_CHK
stw	r4,-0x1174(r23)# set as last stopwatch value

b	TOPN_LOOP_CHK

TOPN_ZERO:
lfs	f1,0x18(r2)	# 0 for TopN X
lfs	f2,0x18(r2)	# 0 for TopN Y
rlwinm. r23,r22,0,23,23	# check if A button held
beq+	0x8
lfs	f2,-0x7e50(r2)	# loads 100 for TopN Y if holding A
stfs	f1,0xB0(r29)	# update TopN X
stfs	f2,0xB4(r29)	# update TopN Y
stfs	f1,0x6F4(r29)	# update TopN X
stfs	f2,0x6F8(r29)	# update TopN Y

TOPN_LOOP_CHK:
cmpw	r21,r24
blt+	TOPN_LOOP	# loop if not finished checking all controller ports


TOPN_ADDRESS:
lbzx	r22,r31,r25
cmpwi	r22,0xD2	#is this frame stopwatch?
beq-	STOPWATCH

addi	r22,r29,0xB0	# Main Index + 0x110 = TopN X
b	COMMON_PAIR_4


SCD:
addi	r22,r29,0x774	# Main Index + 0x7D4 = SCD Top X
subi	r21,r24,0x1
b	COMMON_GROUP_8	# Top/Bottom/Right/Left are 0x8 bytes apart, and pairs 4 apart

ECB_TIMER:
lwz	r22,0x88C(r29)	# load ECB bottom update disable timer
li	r23,0		# make second float 0
b	INT_TO_FLOAT	# convert the int timers into floats so they can be used

VELOCITIES:
addi	r22,r29,0x80	# Main Index + 0xE0 = F1 Char Velocity X
beq-	NET_VELOCITY	# 0x09 = Net Velocity
subi	r21,r24,0x06
mulli	r21,r21,0xC	# F1/F2/F3 forces float groups are 0xC bytes apart, and pairs 4 apart
b	COMMON_GROUP

NET_VELOCITY:
lfs	f1,0x0(r22)	# F1 Char Velocity X
lfs	f2,0x4(r22)	# F1 Char Velocity Y
lfs	f3,0xC(r22)	# F2 KB Velocity X
lfs	f4,0x10(r22)	# F2 KB Velocity Y
lfs	f5,0x18(r22)	# F3 Atk-Shd KB Velocity X
lfs	f6,0x1C(r22)	# F3 Atk-Shd KB Velocity Y
fadds	f1,f1,f3
fadds	f1,f1,f5	# total force X
fadds	f2,f2,f4
fadds	f2,f2,f6	# total force Y
b	LOOP_END


LIVE_INPUTS:
lis	r22,0x804c
ori	r22,r22,0x1f88	# 804c1f88. Controller port 1 inputs -0x44
mulli	r21,r30,0x44	# player ID * 0x44 (ports 0x44 apart)
add	r22,r22,r21
lbz	r21,0x21(r22)	# FF if empty controller port
cmpwi	r21,0xFF
beq-	NULL_FLOATS	# null floats if no controller plugged into port showing floats for
subi	r21,r24,0x0A
b	COMMON_GROUP_8	# Directional/C-Stick/LR inputs are 0x8 bytes apart, and pairs 4 apart


CHAR_INPUTS:
addi	r22,r29,0x620	# Main Index + 0x680 = Current Dir Input X
bne+	0x8		# skip if not 0x0F Curr/Prev Shield Input
addi	r22,r22,0x20	# shield input is 0x20 later than the usual 0x8 between groups
subi	r21,r24,0x0D
b	COMMON_GROUP_8	# CurrDir/PrevDir/Shield inputs are 0x8 bytes apart, and pairs 4 apart


BUTTON_TIMERS:
subi	r21,r24,0x10
add	r21,r29,r21	# Main Index + group offset
li	r22,0x683	# offset from main index 1st timer + 0x4 (0x11 timers are 4 apart)
cmpwi	r24,0x11
ble-	LOAD_TIMERS
addi	r21,r21,0x4	# 12-13 are 4 bytes after calculated group offset
li	r22,0x684	# offset from main index 1st timer + 0x5 (0x12-13 timers are 5 apart)

LOAD_TIMERS:
lbzx	r23,r21,r22	# loads 2nd timer
lbz	r22,0x67F(r21)	# loads 1st timer
bge+	0x8		# skip if 12-13
li	r23,0		# 10 has no 2nd timer. null
b	INT_TO_FLOAT	# convert the int timers into floats so they can be used



DAMAGE_GRABTIME:
lfs	f1,0x1830(r29)	# loads Total Damage as 1st float
lfs	f2,0x1A4C(r29)	# loads Grab Hold Time as 2nd float
b	LOOP_END


HITLAG_HITSTUN:
lfs	f2,0x18(r2)	# loads 0 for 1st float by default
lwz	r22,0x221C(r29)	# loads flags for things like hitstun
rlwinm. r21,r22,0,6,6	# check flag for in hitstun (-2------)
beq+	HITLAG		# keep as 0 if not in hitstun
lfs	f2,0x2340(r29)	# loads variable(?) that contains hitstun duration while in hitstun

HITLAG:
lfs	f1,0x195C(r29)	# loads Hitlag as 1st float
b	LOOP_END

DI_TRAJECTORY:
.set atan2, 0x80022c30
.set Damage_DI_Trajectory, 0x8008e5a4
.set Button.loc, 0x804c1f88
.set Button.spacing, 0x44
lwz	r22,0x221C(r29)	# loads flags for things like hitstun
rlwinm. r21,r22,0,6,6	# check flag for in hitstun (-2------)
beq+	NULL_FLOATS	# keep both floats if not in hitstun
HITLAG_CHECK:
lbz 	r22,0x221a(r29)	# check for if in hitlag
cmpwi 	r22,0
beq- NULL_FLOATS

.set DI_stack.size, 0x30
.set DI_stack.xjoy, 0x8
.set DI_stack.yjoy, 0xc
.set DI_stack.KBxvel, 0x10
.set DI_stack.KByvel, 0x14
.set DI_stack.floatfirst, 0x18
.set DI_stack.floatsec, 0x1c

.set DI_stack.float11, 0x20
.set DI_stack.float12, 0x24
.set DI_stack.float21, 0x28
.set DI_stack.float22, 0x2c
# don't need to do 3rd float pair, at worst DI angle change is the 3rd pair
subi sp,sp,DI_stack.size

lwz r22,0x620(r29)
stw	r22,DI_stack.xjoy(sp)
lwz r22,0x624(r29)
stw	r22,DI_stack.yjoy(sp)
lwz r22,0x8c(r29)
stw	r22,DI_stack.KBxvel(sp)
lwz r22,0x90(r29)
stw	r22,DI_stack.KByvel(sp)
lwz	r22,0x0(r2)	# loads setting 1, float 1
stw	r22,DI_stack.float11(sp)
lwz	r22,0x4(r2)	# loads setting 1, float 2
stw	r22,DI_stack.float12(sp)
lwz	r22,0x8(r2)	# loads setting 2, float 1
stw	r22,DI_stack.float21(sp)
lwz	r22,0xC(r2)	# loads setting 2, float 2
stw	r22,DI_stack.float22(sp)

lfs	f1,0x90(r29)	# load Y kb veloc
lfs	f2,0x8c(r29)	# load X kb veloc
bl ATAN2_DEGREES	# get default trajectory
stfs f1,DI_stack.floatfirst(sp)

adr_load r22,Button.loc
mulli	r21,r30,Button.spacing	# player ID * 0x44 (ports 0x44 apart)
add	r22,r22,r21	# get to this player's inputs

NEW_JOYSTICKS:
lfs	f1,0(r22)	# load live x joystick input
bl DEAD_ZONE_CHECK
stfs	f1,0x620(r29)	# store new x joystick input
lfs	f1,4(r22)	# load live y joystick input
bl DEAD_ZONE_CHECK
stfs	f1,0x624(r29)	# store new y joystick input

NEW_KNOCKBACK_VELOC:
mr	r3,r29	# function input r3 = internal data offset
gpr_save
adr_blrl r12, Damage_DI_Trajectory	# updates velocities for new trajectory
gpr_restore
lfs	f1,0x90(r29)	# load Y kb veloc
lfs	f2,0x8c(r29)	# load X kb veloc
bl ATAN2_DEGREES	# get new trajectory
fmr f2,f1	# move new trajectory to second float
lfs	f1,DI_stack.floatfirst(sp)	# first float is default trajectory

lwz r22,DI_stack.xjoy(sp)
stw	r22,0x620(r29)
lwz r22,DI_stack.yjoy(sp)
stw	r22,0x624(r29)
lwz r22,DI_stack.KBxvel(sp)
stw	r22,0x8c(r29)
lwz r22,DI_stack.KByvel(sp)
stw	r22,0x90(r29)
lwz	r22,DI_stack.float11(sp)
stw	r22,0x0(r2)	# loads setting 1, float 1
lwz	r22,DI_stack.float12(sp)
stw	r22,0x4(r2)	# loads setting 1, float 2
lwz	r22,DI_stack.float21(sp)
stw	r22,0x8(r2)	# loads setting 2, float 1
lwz	r22,DI_stack.float22(sp)
stw	r22,0xC(r2)	# loads setting 2, float 2

addi sp,sp,DI_stack.size
b LOOP_END

ATAN2_DEGREES:	# f1 and f2 inputs
mflr r0
stw	r0,4(sp)
stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack

adr_blrl r12,atan2
lfs	f2,-0x7510(r2)	# load pi/180
fres	f2, f2		# make it 180/pi
fmul	f1,f1,f2	# convert radians to degrees

lwz r0,68(r1)
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
mtlr r0
blr

DEAD_ZONE_CHECK:	# input = f1 = x/y joystick value
lfs	f2,0x18(r2)	# load 0
fcmpo	cr0,f1,f2	
bge-	0xc
fneg	f3,f1		# if joystick value is negative, make positive
b	0x8
fmr	f3,f1
lwz	r23,-0x514c(r13)	# load PlCo.dat offset
lfs	f2,0(r23)	# load 0.28000
fcmpo 	cr0,f3,f2
cror	2,0,2
bne-	0x8
lfs	f1,0x18(r2)	# load 0 for joystick value if less than |.28000|
blr
#---------------

SHIELDSTUN:
cmpwi	r23,0xB5	# 0xB5 = GuardDamage
bne+	NULL_FLOATS	# null floats if not shield damage action

lfs	f1,0x894(r29)	# loads current animation frame
lfs	f2,0x89C(r29)	# loads animation speed
lfs	f3,-28872(r2)	# . loads 20 (41A00000). GuardDamage animation length for all characters
lfs	f4,-29800(r2)	# 4d8578. loads 0.1 (3DCCCCCD). added to animation length for FSM calculations

fsubs	f1,f3,f1	# 20 - Current Frame = Animation Length Remaining
fdivs	f1,f1,f2	# (20 - Current Frame) / Speed = Actual Stun Time Remaining

fadds	f3,f3,f4	# 20 + 0.1
fdivs	f2,f3,f2	# (20 + 0.1) / Speed = Originally Calculated Stun Time
b	LOOP_END


SHIELD_HPSIZE:
lfs	f1,0x1998(r29)	# loads Shield Health as 1st float

cmpwi	r23,0xB2	# 0xB2 = GuardOn
blt+	NULL_SECOND	# load 0 for 2nd float if not shield action
cmpwi	r23,0xB6	# 0xB6 = GuardReflect
bgt-	NULL_SECOND	# load 0 for 2nd float if not shield action

lwz	r21,0x19c0(r29)
lfs	f2,0x58(r21)	# loads Shield Collision Size as 2nd float
b	LOOP_END


SHIELD_TILT:
cmpwi	r23,0xB2	# 0xB2 = GuardOn
blt+	NULL_FLOATS	# load 0 for 2nd float if not shield action
cmpwi	r23,0xB6	# 0xB6 = GuardReflect
bgt-	NULL_FLOATS	# load 0 for 2nd float if not shield action

lfs	f1,0x2344(r29)	# load shield tilt offset for 1st float
lfs	f2,0x2348(r29)	# load shield tilt angle for 2nd float
b	LOOP_END


TIMED_INTINV:
lwz	r22,0x1990(r29)	# loads timed Intangibility
lwz	r23,0x1994(r29)	# loads timed Invincibility
b	INT_TO_FLOAT	# convert the int timers into floats so they can be used


HITBOX:
addi	r22,r29,0x960	# Main Index + 0x9C0 = Hitbox-0 X
subi	r24,r24,0x1B	# setting remainder for hitbox setting group 0x1B - 0x22

li	r23,2
divw	r21,r24,r23	# each hitbox has 2 float pair settings associated with it
mulli	r21,r21,0x138	# hitboxes are 0x138 apart
add	r22,r22,r21	# address of X Offset of Hitbox being looked at

lwz	r21,-0x4C(r22)	# 0 = inactive hitbox ID, 2 = active no interp, 3 = active interp
cmpwi	r21,0
beq+	NULL_FLOATS	# null floats if hitbox ID not active

addi	r23,r22,0x4	# 2nd float is 4 bytes after 1st on Even hitbox settings
rlwinm. r21,r24,0,31,31	# check if Odd hitbox setting
beq+	COMMON_LOAD	# skip and load floats if Even hitbox setting
addi	r22,r22,0x8
subi	r23,r22,0x38	# Size (2nd float) is -0x38 from Z (1st), not +0x4
b	COMMON_LOAD	# load hitbox floats


JUMP_WALLJUMP:
lbz	r22,0x1968(r29)	# load jump number
lbz	r23,0x1969(r29)	# load walljump number
b	INT_TO_FLOAT


PSEUDO_JUMP:
li	r22,0
li	r23,0
lwz	r3,0x4(r29)	# load internal char ID

cmpwi	r3,0x12
beq-	LUIGI_MARTH_ROY_FLAG
cmpwi	r3,0x15
beq-	MARIO_DOC_FLAGS
cmpwi	r3,0x1A
beq-	LUIGI_MARTH_ROY_FLAG

cmpwi	r3,0x9		# is player Peach?
bne-	NEXT_CHAR
lfs	f1,0x2230(r29)	# load float frames left
lwz	r23,0x2240(r29)	# load toad float
cmpwi	r23,1
bne-	NULL_SECOND
lfs	f2,-0x76AC(r2)
b	LOOP_END


NEXT_CHAR:
cmpwi	 r3,0		# is player Mario?
bne-	NEXT_CHAR2
MARIO_DOC_FLAGS:
lwz	r22,0x2234(r29)	# load tornado charge
lwz	r23,0x2238(r29)	# cape float charge?
b INT_TO_FLOAT


NEXT_CHAR2:
cmpwi	r3,0x11		# is player Luigi?
bne- 	NEXT_CHAR3
LUIGI_MARTH_ROY_FLAG:
lwz	r22,0x222C(r29)	# load tornado charge (marth side-b)
b 	INT_TO_FLOAT



NEXT_CHAR3:
cmpwi	r3,0x10		# is player Mewtwo?
bne-	NEXT_CHAR4
lwz	r22,0x223C(r29)	# load side-b float charge
lwz	r23,0x2234(r29)	# load charge shot value, just cause
b	INT_TO_FLOAT

NEXT_CHAR4:
cmpwi	r3,0x18		# is player G&W?
bne- 	NEXT_CHAR5
lwz	r22,0x2234(r29)	# load some flag
b	INT_TO_FLOAT

NEXT_CHAR5:
cmpwi	r3,0x4		# is player Kirby?
bne-	INT_TO_FLOAT
lwz	r22,0x22f8(r29)	# load ?? flag
lwz	r23,0x22f0(r29)	# load ?? flag
#another flag at 0x2290+0x60?
b	INT_TO_FLOAT

#-----------


LEDGE_REGRAB:
lwz 	r22,0x2064(r29)	# load ledge regrab disable timer
li 	r23,0		# load 0 for second
b 	INT_TO_FLOAT


BLASTZONE_TOP:
lis	r3,0x804A
subi	r3,r3,6456	# load 8049E6C8 - StageInfo start
lfs	f0,0x14(r3)	# load x camera offset
lfs	f1,0x7C(r3)	# load blastzone top
fadds	f1,f1,f0	# add offset to blastzone top for true
lfs	f2,0x80(r3)	# load blastzone bottom
fadds	f2,f2,f0	# add offset to blastzone bottom for true
b	LOOP_END


BLASTZONE_SIDES:
lis	r3,0x804A
subi	r3,r3,6456	# load 8049E6C8 - StageInfo start
lfs	f0,0x10(r3)	# load x camera offset
lfs	f1,0x74(r3)	# load blastzone left
fadds	f1,f1,f0	# add offset to blastzone left for true
lfs	f2,0x78(r3)	# load blastzone right
fadds	f2,f2,f0	# add offset to blastzone right for true
b	LOOP_END


ACTION_STATE:
#r23 =  action state from previous code line
lwz	r22,0x14(r29)	# load subaction ID
b	INT_TO_FLOAT

STOPWATCH:
#32ba68 (32EE88 RAM) = frames count on last "zero-out"
#32ba6c (32EE8c RAM) = last stopwatch value
lis	r3,0x8047
lwz	r3,-0x493C(r3)	# load match frame count
lis	r23,0x8033
lwz	r22,-0x1178(r23)# load last zero-out frame
sub	r22,r3,r22
cmpwi	r22,0
bge-	0xc
li	r22,0
stw	r22,-0x1178(r23)# initialize zero-out frame
lwz	r23,-0x1174(r23)# second int is last stopwatch value
b	INT_TO_FLOAT



COMMON_GROUP_8:
mulli	r21,r21,0x8	# groups of floats are 8 bytes apart

COMMON_GROUP:
add	r22,r22,r21	# adds group offset

COMMON_PAIR_4:
addi	r23,r22,0x4	# 2nd float 4 bytes after 1st

COMMON_LOAD:
lfs	f1,0x0(r22)
lfs	f2,0x0(r23)
b	LOOP_END


INT_TO_FLOAT:
lfd	f3,-0x7470(r2)	# 4d8570. loads magic double for int to float conversion
stfd	f3,0x20(r2)
stfd	f3,0x28(r2)
sth	r22,0x26(r2)	# 0x43300000800000xx. put 1st int at end of magic double
sth	r23,0x2E(r2)	# 2nd int
lfd	f1,0x20(r2)
lfd	f2,0x28(r2)
fsubs	f1,f1,f3	# subtract 0x4330000080000000 for converted int 1
fsubs	f2,f2,f3	# subtract 0x4330000080000000 for converted int 2
b	LOOP_END


NULL_FLOATS:
lfs	f1,0x18(r2)	# loads 0 for 1st float

NULL_SECOND:
lfs	f2,0x18(r2)	# loads 0 for 2nd float

LOOP_END:
stfs	f1,0x0(r26)	# store 1st float in pair at current pair's loading address
stfs	f2,0x4(r26)	# 2nd float
addi	r25,r25,1	# increment current float pair
addi	r26,r26,8	# update float storage address to next float pair slot
cmpwi	r25,3
ble+	LOOP_START	# loop for next float pair until all 3 are done

LOAD_FLOATS:
lfs	f1,0x0(r2)	# loads setting 1, float 1
lfs	f2,0x4(r2)	# loads setting 1, float 2
lfs	f3,0x8(r2)	# loads setting 2, float 1
lfs	f4,0xC(r2)	# loads setting 2, float 2
lfs	f5,0x10(r2)	# loads setting 3, float 1
lfs	f6,0x14(r2)	# loads setting 3, float 2

END:
#new
lwz	r3,56(r1)
lwz	r4,60(r1)
gpr_restore





**********************
* Boot to Name Entry *
**********************

Boot to Menu
041BFA20 38600001

inject @ 8022db3c
Main Menu
- global power on is 0x7b
- r30 open

lis r30,0x803f
lwz r4,0x799d(r30) # 803f799d is arbitrary flag 
cmpwi r4,0
bne- DEFAULT

#Press A on VS Menu
li r4,1
stw r4,0x799d(r30)
li r3,0x10
sth r4,2(r28)

DEFAULT:
stw r3,0xc(r28)

C222DB3C 00000005
3FC0803F 809E799D
2C040000 40820014
38800001 909E799D
38600010 B09C0002
907C000C 00000000

-----------

inject @ 22d5bc
- VS Mode Menu

lis r30,0x803f
lwz r4,0x799d(r30)
cmpwi r4,1
bne- DEFAULT

#Press A on VS Menu
li r4,4
stw r4,0x799d(r30)
li r3,0x10
sth r4,2(r29)
stw r3,0xc(r29)

DEFAULT:
li r30,0

C222D5BC 00000006
3FC0803F 809E799D
2C040001 40820018
38800004 909E799D
38600010 B09D0002
907D000C 3BC00000
60000000 00000000

******************************
* Main Menu Texture Elements *
******************************

"nop"ing branches to the TextureInitialization function
8022e654 removes blue color
8022e870 removes some bg elements - maybegood

80229e34 removes blue frame elements
8022b474 removes menu choice textures
803a5b84 removes text in bottom frame

**********
*

80230ba4 - this bl shows the "NONE" time limit text....wait...no it doesn't?? wtf


lbz r0,0xA(r31) # this is loading the "screen" ID

***************
* SFX Loading *
***************
Loading SFX, Load SFX

80433994 above and below seems to be a table, where each word designates a file flag
- if word =0xffffffff then the file is not loaded into RAM

**************************************
* Firefox - Press Z to Bombout Early *
**************************************

800e76d8 - interrupt for Fox/Falco firefox

- default code line is "blr", so it returns immediately and does nothing.



lwz r3,0x2c(r3)
lwz r4,0x668(r3)
rlwinm. r0,r4,0,23,23
beq-	END
rlwinm. r0,r4,0,25,27
beq-	END
BOMB_OUT:
li r0,0
stw r0,0x2348(r3)

END:
blr

C20E76D8 00000005
8063002C 80830668
548005EF 41820014
54800677 4182000C
38000000 90032348
4E800020 00000000


For 20XX SDR Fox/Falco:

EJECT_ONLY_FOR_SDR:
lwz r3,0x2c(r3)	# load internal data offset
lwz r4,4(r3) # load internal char ID
cmpwi r4,1
beq-	FOX
FALCO: #003d1cad
lis r4,0x803d
lbz r4,0x1cad(r4) # load PlFc._at
cmpwi r4,0x73	# PlFc.sat? (SDR)
beq-	EJECT_CHECK
b	END
FOX: # 003c7bed
lis r4,0x803c
lbz r4,0x7bed(r4) # load PlFx._at
cmpwi r4,0x73	# PlFx.sat? (SDR)
bne-	END
EJECT_CHECK:
lwz r4,0x668(r3)
rlwinm. r0,r4,0,23,23
beq-	END
rlwinm. r0,r4,0,25,27
beq-	END
EJECT:
li r0,0
stw r0,0x2348(r3)	# store 0 to frames of Up-B travel left

END:
blr


*****************
* walljump Flag *
*****************

The vanilla walljump flag is hardcoded in ASM for each character, and set during an init function at match start.
This code allows a flag to be set in the Pl__.dat files to enable walljumping.

Vanilla Flag (char offset data)
	0x2224  byte   Flags
		(00000001) = walljumping enabled



inject @ 800816b8 - lwz r31,0x2c(r3)
- in Interrupt_Walljump

lwz	r31,0x2c(r3)	# load internal data offset, default code line
lis r3,0x8008		# first half of possible branches
lhz	r6,0x25a(r31)	# load second half of x-delta char attribute
cmpwi r6,1			# 3F000001 = character can walljump
beq-	CONTINUE_WALLJUMP_CHECK
cmpwi r6,2			# 3F000002 = character cannot walljump
bne-	END
NO_WALLJUMP:
ori r3,r3,0x1918
b	GO

CONTINUE_WALLJUMP_CHECK:
ori r3,r3,0x16c8
GO:
mtlr	r3
blr
END:

***************************************************
* Final Destination Background Transition Disable *
***************************************************

Disable FD Bg Transitions
0421aae4 60000000

For 20XX there is a Debug Menu flag and lets add a custom stage flag (00000080) as well.

inject @ 8021aae0

lis r3,0x8040
lwz	r4,-0x5DE4(r3)	# load disable FD background trans flag
cmpwi r4,1	# is disabled?
beq-	SKIP	
lbz	r4,-0x5D1B(r3) 	# load custom stage flag
rlwinm. r4,r4,0,24,24	# (00000080)?
beq-	END

SKIP:
lis r3,0x8021
ori r3,r3,0xaae8	# skip over screen trans function
mtlr r3
blr

END:
mr r3,r30	# default code line


*****************************
* Cursor Puck - Extra Chars *
*****************************
CSS cursor puck
8025db70 - add r4,r30,r0
before this is executed...
r4 = pointer to RAM cursor info

lbz r_,0x5(r4) - gets the player who has control of puck, 1-indexed

4a0bc0 - 

**********************
* Coin Mode Research *
**********************

Bug in 20XX where only P1 and P3 are able to pick up coins

I'm guessing the branch link at line 80007b78 check if the player is colliding with a coin

Okay...so the bug is with the Magus Physics Display Code with the (3) DOL [word] overwrites starting at 801a4bb8 (RAM) 

1a4bc0

For 20XX,

20XX Magus Physics Display - Coin Mode Bug Fix
 inject @ 80165334

lis	r3,0x8033
lwz	r3,-0x1270(r3)
END:

****************************************
* Battlefield Rainbow Water Background *
****************************************
inject @ 80219d18
- battlefield init function

lis	r14,0x803f
ori	r14,r14,0xa310	# 803fa310 is BF water bg debug menu toggle
lbz 	r17,-0x2b(r14)	#load current custom stage flag @ 803fa2e5 (00000010 = water background for battlefield
lwz	r15,0(r14)
cmpwi	r15,0		#is water bg flag off?
beq-	NO_WATER_BG


li	r3,0
rlwimi 	r17,r3,0,27,27	# disregard previous water background flag

cmpwi	r15,1		#is water bg flag always on?
beq- 	EXECUTE_WATER

RANDOM_WATER_BG:
lbz	r16,-0x570D(r13)#load random value (804d5f93)
cmpwi 	r16,127		#if less than 127 (0x7f), execute water ~50% (?)
bge- 	NO_WATER_BG

EXECUTE_WATER:
addi	r17,r17,0x10
stb	r17,-0x2b(r14)	#store water bg flag for customs

lis	r16,0x8021
ori	r16,r16,0x9d0c
mtctr	r16
bctr

NO_WATER_BG:
stb	r17,-0x2b(r14)

END:
li	r3,3		#default code line

*******************
* Object Blending *
*******************

Pointer @ 0x14 in Material Structure

*******************
* Mesh Attribute  *
*******************

Last CP_Type entry seems to be 
000000FF 00000002 00000000 00000004 00000000 00000000

Mesh Data Information by Revel8n
https://smashboards.com/threads/melee-dat-format.292603/#post-11762893

************
* BrawlBox *
************

fog index?
0 = 00000004 material flag
-1 = 00000002 material flag


TEV = Texture Environment

************************
* Display List OpCodes *
************************

// Display list opcodes:

#define GX_NOP                      0x00
#define GX_DRAW_QUADS               0x80
#define GX_DRAW_TRIANGLES           0x90
#define GX_DRAW_TRIANGLE_STRIP      0x98
#define GX_DRAW_TRIANGLE_FAN        0xA0
#define GX_DRAW_LINES               0xA8
#define GX_DRAW_LINE_STRIP          0xB0
#define GX_DRAW_POINTS              0xB8

#define GX_LOAD_BP_REG              0x61
#define GX_LOAD_CP_REG              0x08
#define GX_LOAD_XF_REG              0x10
#define GX_LOAD_INDX_A              0x20
#define GX_LOAD_INDX_B              0x28
#define GX_LOAD_INDX_C              0x30
#define GX_LOAD_INDX_D              0x38

#define GX_CMD_CALL_DL              0x40
#define GX_CMD_INVL_VC              0x48

#define GX_OPCODE_MASK              0xF8
#define GX_VAT_MASK                 0x07

DisplayList
(arbitrary example)

98007B0315031501a6...


98007B	# 0x98 = primitive flag - tristrips, 0x007B = index count (how many groups of vertex points are following, 1-indexed)
0316 0315 01a6 # Vertex 1 (0316 = vertex index, 0315 = normal index, 01a6 = uv index)

In the above example, the vertex attributes are 16 bits each. These could also be 8 bits.
But, how to determine if an attribute uses 8 or 16 bit data length?

I wonder if this is automatically calculated based on the total attribute count for the specific object.
- As an example, if total vertices is less than 256, then use an 8 bit index in the displaylist. This makes sense to me, but idk if true.
---> !! looks like it is true. At least for the few brawl stage imports I have looked at.

--------------

Mesh Structure Unknown Flag Research (0xC of mesh struct)
Mesh Structure = PObj
0x1000 Something with Influence Matrix Array Offset
0x2000 Something with Influence Matrix Array Offset
0x4000 = Mesh Cull_Outside
0x8000 = Mesh Cull_Inside


ShapeSet

0x00	half	flags
				(0001) = SHAPESET_AVERAGE
				(0002) = SHAPESET_ADDITIVE
0x02	half	nb_shape
0x04	word	nb_vertex_index
0x08	point	vertex_desc
0x0C	point	vertex_idx_list	/* array */
0x10	word	nb_normal_index
0x14	point	normal_desc
0x18	word	normal_idx_list /* array */
0x1C	point	blend.bp /* array of floats of size (nb_shape * sizeof(float)) */
0x20	float	blend.bl


#define HSD_DEFAULT_MAX_SHAPE_VERTICES 2000
#define HSD_DEFAULT_MAX_SHAPE_NORMALS 2000


Culling option in BrawlBox is found under the "Materials" folder

*****************************************
* CPU Type - Nana, C. Falc/Ganon Freeze *
*****************************************

I noticed that doing Falcon/Warlock Kick with synced Ganon and C. Falc causes the game to freeze.

assert() is branched into from function 8027163c

its line 8006c9b0 the blrl

Disable Synced Nana Special Action State Functions
040b0bbc 4800001c



Nana CPU Type Down-B Freeze Fix for Other Chars
inject @ 800b0bac - li r0,1	# default code line


li r0,0	# default to skip IC specific code
lwz	r5,4(r3)
cmpwi	r5,0xb	# is Nana
bne-	END
li r0,1	# set flag for special Nana stuff
END:

*********************
* Nana Desynch Flag *
*********************

Red Color Overlay for Desynced Nana CPU Type
inject @ 800BF550 (same location as the 20XX overlay code)
lbz	r31,0x504(r3)
cmpwi	r31,0x82
bne-	SKIP_OVERLAY_CHECK
li	r31,0
stb	r31,0x504(r3)
SKIP_OVERLAY_CHECK:
lbz	r31,0x221f(r3)
rlwinm.	r31,r31,0,28,28
beq-	END
lbz	r31,0x1b82(r3)
rlwinm.	r31,r31,0,31,31
bne-	END
li r31,0x82
stb	r31,0x504(r3)
li r31,0
stw	r31,0x430(r3)
lis r31,0xff00
ori r31,r31,0x00ff
stw	r31,0x4b4(r3)

END:
addi	r30,r5,0	# default code line

********************************************
* Change Facing Direction Mid Action State *
********************************************
Modify facing direction, character facing direction

Look at Marth's Up-B interrupt for clues.

The code that changes his facing direction and updates the model starts @ 80138600

**********************
* Throwing Functions *
**********************

800dd398 is the function that causes ThrowB, but action state is a parameter, not hardcoded

bl at 800dd36c comes with the param, I believe. This function chooses throw state
- can I just modify r4 at this line??

800dd1e4 - Interrupt_ThrowF/B/Hi/Lw

---
Nana Always FThrows
inject @ 800dd368 - addi r4,r30,0
- r31 = internal offset

DEFAULT:
addi r4,r30,0

lwz	r30,4(r31)	# load internal char ID
cmpwi	r30,0xb	# is Nana?
bne-	END
li r4, 0xdb	#fthrow

END:

-------------

Nana Always _Throws 20XX Debug Menu Option
- flag @ 3fa32c
0 = Default
1 = Forward
2 = Back
3 = Up
4 = Down

inject @ 800dd368 - addi r4,r30,0
- r31 = internal offset
- r4 (after default line) = throw action state

DEFAULT:
addi r4,r30,0	# default code line
lwz	r30,4(r31)	# load internal char ID
cmpwi	r30,0xb	# is Nana?
bne-	END
lis	r30,0x8040
lwz	r30,-0x5CD4(r30)
cmpwi	r30,0	# is default option selected?
beq-	END
li r4,0xda	# 1 minus fthrow
add	r4,r4,r30	# debug options are in order of action state
END:


***********************************
* More Develop Mode Text Research *
***********************************
80324338
- where a %f character conversion spits you out

80324348: bl 0x80324674

80324674 - actually creates the string from the floating point number I think.
	- f1 input = the floating point number
	r4 = struct in stack
		+0x08 = int width, probably
		+0x0C = int number of decimal places
803246dc
- overwrites the f1 value with something from f31

********************************
* CSS Analog Controller Floats *
********************************
0A character drops down to the start of the next line
(@ 4d4ac0 - used for the Y+D-Pad Down Action State info)
\n = 0A in hex

Each special ASCII data is 0x2C in length (1 per char)
- can I just use bdcd80?
- well, I could always use dataspace in MnSlChr...

JX: %7.4fJY: %7.4f



For doing floating point numbers, it is essential to do a crset
803779a0 - 
crset 6,6 = 4cc63242

---------------
Testing CSS Controller Structs
FAD0B4 = text struct
FAD0E8 = ascii
FAD100 = special ascii

804d6e18

inject @ 80262f08

lis r3,0x8030
ori r3,r3,0x2d4c
mtlr r3

lis r3,0x80fa
ori r3,r3,0xd0b4
lis r4,0x804d
ori r4,r4,0x6e18
stw r3,0(r4)


li r4,0
sth r4,6(r3) # reset cursor
lis r4,0x804c
ori r4,r4,0x1fac

lfs f1,0x20(r4)
lfs f2,0x24(r4)
lfs f3,0x28(r4)
lfs f4,0x2c(r4)
lfs f5,0x30(r4)
lfs f6,0x34(r4)

lis r4,0x80fa
ori r4,r4,0xd190

li r5,0x7fff # really should be 4cc63242
blrl


lmw r23,0x34(sp)	# default
--------------------------

before branching to the DisplayText function


Custom Text Struct: (layer above vanilla on-screen text)
text struct @ 80FD71c0

inject @ 302640

cmplwi	r31,0
bne-	END
lis r31,0x80fd
ori r31,r31,0x71c0
#b	STRUCT_CHECK
STRUCT_LOOP:
lis r3,0x8030
ori r3,r3,0x22bc
mtlr	r3
mr	r3,r31
blrl
lwz	r31,0x30(r31)

cmpwi	r31,0
bne-	STRUCT_LOOP

END:

------


Custom Text Struct (layer underneath vanilla on-screen text)

inject @ 302620

lis r31,0x803f
ori r31,r31,0xc290 # custom struct start
lis r3,0x8037
ori r3,r3,0xd970
mtlr r3
li r3,0
blrl
lis r3,0x8030
ori r3,r3,0x2164
mtlr r3
blrl

STRUCT_LOOP:
lis r3,0x8030
ori r3,r3,0x22bc
mtlr	r3
mr	r3,r31
blrl
lwz	r31,0x30(r31)

cmpwi	r31,0
bne-	STRUCT_LOOP
b END


END:
lis r31,0x8030
ori r31,r31,0x2640
mtlr r31
lwz r31,-0x4888(r13)	# default code line
blr


***********************************
* Develop Mode Text Custom Engine *
***********************************
text engine

800036e0 to 80003798 will be the field for custom text displays
- every entry should be monitored every frame everywhere,
- as of now, each custom text will have a specific entry address (could kind of be a bitch in the future...idk)

Each entry is 0x8 in length
0x00	half	flags
		(8000) = do not delete text on scene change
0x02	half	timer
		- decremented per frame
		- if going from 1 to 0, remove text struct from screen
0x04	point	text struct begin

Special Text Flags - begins at 80036cc
	- should really only be used by when ASCII with no identifiers is to be shown
0x00	half	text struct number
0x02	half	timer to apply
0x04	point	text struct to show
0x08	point	ASCII to show

---------------------------
Text Structure Definitions
ID	Text Struct Location	Description

0x00	80fad0b4	CSS analog floats
0x01	--	(saving for 20XX TE Input Display Backgrounds?)
0x02	803fc290	20XX TE Input Display
0x03	varying		Various on-screen notifications
						- in-game toggles
0x04	in-game [debug] menu
----------------------------
Remove Text Structs from Screen on Scene Change
inject @ 803020e4
	- where the vanilla text structs are removed on scene change
	- r0 = 0

li r3,0x17	# 0x17 text struct entries fit between 800036e0 and 80003798
mtctr r3
lis r3,0x8000
ori r3,r3,0x36e0
subi r3,r3,8	# each entry is 8 in length
LOOP:
lwzu r4,8(r3)
rlwinm. r4,r4,0,0,0	# pull first bit of word
bne-	COMPARE	# if high, don't remove text
stw	r0,0(r3)	# null the flags/timer
stw	r0,4(r3)	# null the pointer to text struct
COMPARE:
bdnz+ LOOP
DEFAULT:
stw r0,-0x4888(r13)	# default code line

302d4c - developmode_textdisplay
- r31 saved to stack

#------------------------------

CSS - Remove Analog Display on Screen Change
- ex. going to Rules Menu/Name Entry

80266c08
if loaded r0 does not equal 0, not on main CSS I think

inject @ 80266c08

lbz r0,-0x49aa(r13)	# default code line
cmpwi r0,0
beq-	END
lis r3,0x8000
ori r3,r3,0x36e0
li r4,0
stw r4,0(r3)
lwz	r5,4(r3)	# load text struct
stw r4,4(r3)
cmpwi r5,0
beq-	END

li r4,0xc0	# hide text and bg
LOOP:

stb r4,0x26(r5)
lwz r5,0x30(r5)
cmpwi r5,0
bne-	LOOP
END:

#------------------------------
Custom Text Struct Engine
(layer underneath vanilla on-screen text)

inject @ 80302620


.macro adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.set origin, 0x804a89b0
.set p2, 0x804C1FF8

CUSTOM_TEXT_STRUCT_ENGINE:
# two default functions that need to be ran through first
lis r3,0x8037
ori r3,r3,0xd970
mtlr r3
li r3,0
blrl
lis r3,0x8030
ori r3,r3,0x2164
mtlr r3
blrl

CUSTOM_TEXT_STRUCT_SPECIAL_FLAGS:
lis r3,0x8000
lwz r4,0x36d0(r3)	# load special flag text struct for handling ASCII creation in this func
cmpwi r4,0
beq-	CUSTOM_TEXT_STRUCT_SPECIAL_FLAGS_END
lhz r5,0x36cc(r3)	# load struct number
mulli r5,r5,8	# structs are 8 in size
addi	r5,r5,0x36e0	# custom text structs start
or	r5,r3,r5	# r5 now equals the location for this flagged text struct

stw r4,4(r5)	# store text struct to eventually show
lhz	r4,0x36ce(r3)	# load timer
sth	r4,2(r5)	# store timer

lis r4,0x8030
ori r4,r4,0x2bb0	# zero special ASCII area function
mtlr r4
lwz r3,0x36d0(r3)	# load text struct
blrl
lis	r3,0x8030
ori	r3,r3,0x2d4c	# on-screen text ASCII create
mtlr	r3
lis r3,0x8000
lwz r4,0x36d4(r3)
lwz r3,0x36d0(r3)
li r5,0
sth	r5,6(r3)	# reset cursors to 0
blrl
CUSTOM_TEXT_STRUCT_SPECIAL_FLAGS_NULL:
li r3,0
lis r4,0x8000
stw r3,0x36cc(r4)
stw r3,0x36d0(r4)
stw r3,0x36d4(r4)
CUSTOM_TEXT_STRUCT_SPECIAL_FLAGS_END:

CUSTOM_STRUCT_AREA:
li r31,0	# struct counter

CUSTOM_STRUCT_AREA_LOOP:
lis r4,0x8000
ori r4,r4,0x36e0 # custom struct start
mulli r3,r31,0x8	# structs are 0x8 in length
add r4,r3,r4	# get to this struct
lwz r3,4(r4)	# load struct pointer
cmpwi r3,0	# is text struct pointer null?
beq-	CUSTOM_STRUCT_AREA_COMPARE
CUSTOM_STRUCT_AREA_TIMER:
lhz	r5,2(r4)	# load int timer
cmpwi r5,0
beq-	CUSTOM_STRUCT_AREA_TIMER_END
subi r5,r5,1	# decrement timer
sth r5,2(r4)	# store new timer value
cmpwi r5,0
bne-	CUSTOM_STRUCT_AREA_TIMER_END
CUSTOM_STRUCT_AREA_TIMER_NULL:	# going from 1 to 0
stw r5,4(r4)	# null text struct pointer
b CUSTOM_STRUCT_AREA_COMPARE
CUSTOM_STRUCT_AREA_TIMER_END:
CUSTOM_STRUCT_LOGIC:	# r3 = first text struct

#**************
CUSTOM_STRUCT_CSS_ANALOG:
#***************
cmpwi r31,0		# struct 0 = CSS Analog Floats
bne- CUSTOM_STRUCT_CSS_ANALOG_END
subi sp,sp,0xc	# push back stack
stw r31,8(sp)	# store current struct number on stack

li r31,0
CUSTOM_STRUCT_CSS_ANALOG_LOOP:
subi sp,sp,0xc	# push back stack
stw r3,8(sp)	# store current struct on stack

li r4,0
sth r4,6(r3) # reset cursor

adr_load r5,origin
mulli r4,r31,0xc
add r5,r5,r4
lbz r6,3(r5)
extsb r6,r6
lbz r5,2(r5)
extsb r5,r5
bl ORIGIN_TEXT
mflr r7
lis r4,0x8030
ori r4,r4,0x2d4c
mtlr r4
mr r4,r7
blrl
lwz r3,8(sp)
b ORIGIN_TEXT_END
ANALOG_FLOAT_TEXT:
blrl
.asciz "JX: %7.4fJY: %7.4f\nCX: %7.4fCY: %7.4f\nL: %8.6fR: %8.6f"
.balign 4
ORIGIN_TEXT:
blrl
.asciz "X:%3d Y:%3d\n"
.balign 4
ORIGIN_TEXT_END:

lis r4,0x804c
ori r4,r4,0x1fac
mulli r5,r31,0x44
add r4,r4,r5	# get to this player's button inputs
lfs f1,0x20(r4)
lfs f2,0x24(r4)
lfs f3,0x28(r4)
lfs f4,0x2c(r4)
lfs f5,0x30(r4)
lfs f6,0x34(r4)

bl ANALOG_FLOAT_TEXT
mflr r7
lis r4,0x8030
ori r4,r4,0x2d4c
mtlr r4
mr r4,r7
#lis r4,0x80fa
#ori r4,r4,0xd190	# ASCII string location (3c0a70 in MnSlChr)

.long 0x4cc63242 # crset 6,6
blrl

lis r3,0x8030
ori r3,r3,0x22bc	# r24 and up is saved to stack
mtlr	r3

lwz r3,8(sp)	# load current struct from stack
addi sp,sp,0xc	# pop stack
mr r30,r3
blrl	# show text struct
addi r31,r31,1	# increment port number

lwz r3,0x30(r30) # load next text struct
cmpwi r3,0
bne- CUSTOM_STRUCT_CSS_ANALOG_LOOP

lwz r31,8(sp)	# load current struct number from stack
addi sp,sp,0xc	# pop back stack
b CUSTOM_STRUCT_AREA_COMPARE
CUSTOM_STRUCT_CSS_ANALOG_END:

#------------------------------
# CUSTOM_STRUCT_INGAME_MENU
# - uses the 
CUSTOM_STRUCT_INGAME_MENU:
cmpwi r31,4
bne- CUSTOM_STRUCT_INGAME_MENU_END
subi sp,sp,0xc	# push back stack
stw r31,8(sp)	# store current struct number on stack

li r31,0	# debug style line counter

CUSTOM_STRUCT_INGAME_MENU_DEBUG_LOOP:
subi sp,sp,0xc	# push back stack
stw r3,8(sp)	# store current struct on stack

lis r4,0x8030
ori r4,r4,0x2bb0	# zero special ASCII area function
mtlr r4
blrl
lwz r3,8(sp)

lis r6,0x8000
lwz r4,0x3b70(r6)	# load Debug Menu struct pointer
lbz	r6,0x3b74(r6)	# load line highlight
mulli r5,r31,0x30	# each debug menu struct is 0x30 in length
add r4,r4,r5		# get to this debug menu struct
lbz r5,0x3(r4)		# load menu type
cmpwi r5,9			# is menu type "finished"
beq-	CUSTOM_STRUCT_INGAME_MENU_CLEANUP



li r7,0
sth r7,6(r3) # reset cursor
lwz r7,0x24(r4)	# load text color
cmpw r6,r31	# does current line highlight = this struct line?
bne- TEXT_COLOR_STORE
lwz r7,0x28(r4)	# load highlight text color
TEXT_COLOR_STORE:
stw r7,0x14(r3)	# store text color
lwz r6,0x2c(r4)	# load bg color
stw r6,0x10(r3) # store bg color
lhz r6,0(r4)	# load max char width/rows
sth	r6,4(r3)	# store max char width/rows
lwz r6,0x20(r4)	# load x/y offset
stw r6,0(r3)	# store x/y offset

MENU_TYPE_LABEL:
cmpwi r5,0
beq- CUSTOM_STRUCT_INGAME_MENU_DEBUG_DISPLAY

MENU_TYPE_STRING_ENUM: #(byte)
cmpwi r5,2
bne-	MENU_TYPE_STRING_ENUM_END
lwz r5,0x10(r4)
lbz r5,0(r5)

#check the bitflag mask flag
lbz r6,2(r4)	# load bitflag mask
cmpwi r6,0
beq-	MENU_TYPE_STRING_ENUM_CONTINUE
and. r5,r6,r5
beq- MENU_TYPE_STRING_ENUM_CONTINUE
li r5,1		# mask bit is high

MENU_TYPE_STRING_ENUM_CONTINUE:
mulli r5,r5,4	# string enums are pointers, 4 bytes in size
lwz	r6,0xc(r4)	# load string enum pointer start
lwzx	r5,r5,r6
b	CUSTOM_STRUCT_INGAME_MENU_DEBUG_DISPLAY
MENU_TYPE_STRING_ENUM_END:

MENU_TYPE_WORD:
cmpwi r5,3
bne-	MENU_TYPE_WORD_END
lwz r5,0x10(r4)
lwz r5,0(r5)
b	CUSTOM_STRUCT_INGAME_MENU_DEBUG_DISPLAY
MENU_TYPE_WORD_END:

MENU_TYPE_HALF:
cmpwi r5,4
bne-	MENU_TYPE_HALF_END
lwz r5,0x10(r4)
lhz r5,0(r5)
b	CUSTOM_STRUCT_INGAME_MENU_DEBUG_DISPLAY
MENU_TYPE_HALF_END:

MENU_TYPE_BYTE:
cmpwi r5,5
bne-	MENU_TYPE_BYTE_END
# can add bitflag mask check if necessary
lwz r5,0x10(r4)
lbz r5,0(r5)
b	CUSTOM_STRUCT_INGAME_MENU_DEBUG_DISPLAY
MENU_TYPE_BYTE_END:

MENU_TYPE_FLOAT:
cmpwi r5,8	# menu type 8 = float
bne- MENU_TYPE_FLOAT_END
lwz r5,0x10(r4)
lfs f1,0(r5)	# load float from debug struct item flag pointer
b	CUSTOM_STRUCT_INGAME_MENU_DEBUG_DISPLAY_FLOAT
MENU_TYPE_FLOAT_END:
b CUSTOM_STRUCT_AREA_COMPARE

CUSTOM_STRUCT_INGAME_MENU_DEBUG_DISPLAY_FLOAT:
.long 0x4cc63242 # crset 6,6
CUSTOM_STRUCT_INGAME_MENU_DEBUG_DISPLAY:

lwz r4,0x8(r4)	# load ASCII location from Debug Struct

lis r12,0x8030
ori r12,r12,0x2d4c	# function to create special ASCII
mtlr r12
blrl

lis r3,0x8030
ori r3,r3,0x22bc	# r24 and up is saved to stack
mtlr	r3

lwz r3,8(sp)	# load current struct from stack
addi sp,sp,0xc	# pop stack
mr r30,r3
blrl	# show text struct
addi r31,r31,1	# increment debug menu struct line item counter
mr r3,r30
b CUSTOM_STRUCT_INGAME_MENU_DEBUG_LOOP	# branch back up

CUSTOM_STRUCT_INGAME_MENU_DEBUG_LOOP_END:
lwz r31,8(sp)	# load current struct number from stack
addi sp,sp,0xc	# pop back stack
b CUSTOM_STRUCT_AREA_COMPARE
CUSTOM_STRUCT_INGAME_MENU_CLEANUP:
lwz r3,8(sp)	# load current struct from stack
addi sp,sp,0xc	# pop stack
lwz r31,8(sp)	# load current struct number from stack
addi sp,sp,0xc	# pop back stack
b CUSTOM_STRUCT_AREA_COMPARE
CUSTOM_STRUCT_INGAME_MENU_END:
#------------------------------

CUSTOM_STRUCT_DEFAULT:	# default action is to loop through all structs and display
li r4,0
CUSTOM_STRUCT_DBLEVEL:
#DbLevel in-game pause menu check
lis r5,0x8000
ori r5,r5,0x3acc
cmpw r5,r3
bne- CUSTOM_STRUCT_DBLEVEL_END
lis r4,0x8000
ori r4,r4,0x3b00	# location of ASCII
CUSTOM_STRUCT_DBLEVEL_END:
bl	STRUCT_LOOP_FUNCTION

CUSTOM_STRUCT_AREA_COMPARE:
addi r31,r31,1
cmpwi r31,0x17	# 0x17 custom structs currently at this RAM location
bne- CUSTOM_STRUCT_AREA_LOOP
CUSTOM_STRUCT_AREA_END:
b	END

STRUCT_LOOP_FUNCTION:
mflr r0
stw r0,4(sp)
stwu sp,-0x20(sp)
stw r31,0x1c(sp)
stw r30,0x18(sp)
stw r4,0x14(sp)
STRUCT_LOOP:
mr r31,r3

#####
lwz r4,0x14(sp)
cmpwi r4,0
beq- STRUCT_LOOP_DISPLAY
li r5,0
sth r5,6(r3) # reset cursor
#####lwz r4,0x28(r3)

lis r12,0x8030
ori r12,r12,0x2d4c	# function to create special ASCII
mtlr r12
blrl
####
STRUCT_LOOP_DISPLAY:
lis r12,0x8030
ori r12,r12,0x22bc	# r24 and up is saved to stack
mtlr	r12
mr r3,r31
blrl
mr r3,r31
lwz r12,0x28(r3)
cmpwi r12,0
beq- STRUCT_LOOP_ZERO_SPECIAL_END
lis r12,0x8030
ori r12,r12,0x2bb0	# zero special ASCII
mtlr r12
blrl
STRUCT_LOOP_ZERO_SPECIAL_END:
lwz	r3,0x30(r31)	# load next struct
cmpwi	r3,0
bne-	STRUCT_LOOP
STRUCT_LOOP_FUNCTION_END:
lwz r0,0x24(sp)
lwz r31,0x1c(sp)
lwz r30,0x18(sp)
addi sp,sp,32
mtlr r0
blr


END:
lis r31,0x8030
ori r31,r31,0x2640
mtlr r31
lwz r31,-0x4888(r13)	# default code line
blr



***********************
* Training Mode Reset *
***********************

80087140
- investigate
- executed when resetting in Training Mode
- can I use this for save states?

Investigating save state freezes

80069d18 is the function that fails


80085d7c is the assert

****************************************
* Disable Camera Tracking on Character *
****************************************

Disable character camera tracking
Disable Camera Tracking
li r4,1
lwz r3,0x890(r31) # r31 is internal char offset
stw r4,0x8(r3)

(ex. @ 800bfd68 - putting Zelda/Sheik to sleep and disabling camera tracking)

**********************
* On-Screen Percents *
**********************

802f5b48
- this function reads the playerblock current damage
	stores into the on-screen percent structures

On-Screen Percent Data Structs (0x64 apart, I believe)
P1: 804A10C8

if byte @ +0x10 includes (80), then the player's percent is removed from screen currently

*****************
* Item Stealing *
*****************
- originally by wParam, ripped from Crazy Mod

Injected at - 800da214
	- In the function to execute "CatchWait"

lwz r4,0x2c(r30)
lwz r8,0x1a58(r4)
cmpwi r8,0
beq- END
lwz r9,0x1974(r4)
cmpwi r9,0
bne- END
lwz r9,0x065C(r4)
andi. r9,r9,0x0200
cmpwi r9,0x0200
bne- END
lwz r5,0x2c(r8)
lwz r31,0x1974(r5)
cmpwi r31,0
beq- END

bl THROW_ITEM
addi sp,sp,0x40

lis r3,0x8009
ori r3,r3,0x48a8 # make player grab item
mtlr r3
mr r3,r30
mr r4,r31
blrl
b END

THROW_ITEM:
mflr r0
subi sp,sp,0x40

lis r3,0x8026
ori r3,r3,0xad24
mtctr r3

lis r3,0x3f80
stw r3,0(r2)
lfs f1,0(r2)
addi r4,sp,24
addi r5,sp,36
mr r3,r31
li r6,1
bctr

END:
lwz r31,0x2c(r30)
lis r3,0x800E	# default code line
-------------------------------------

Item Steal in Interrupt_CatchWait
	- press B anytime in CatchWait to steal item

inject @ 800da3b8

lis r9,0x803f
ori r8,r9,0xa278
lwz r8,0(r8)
cmpwi r8,0
beq- END

lwz r8,0x1a58(r31)
cmpwi r8,0
beq- END
lwz r9,0x1974(r31)
cmpwi r9,0
bne- END
lwz r9,0x065C(r31)
andi. r9,r9,0x0200
cmpwi r9,0x0200
bne- END
lwz r5,0x2c(r8)
lwz r31,0x1974(r5)
cmpwi r31,0
beq- END


bl THROW_ITEM
addi sp,sp,0x40

lis r3,0x8009
ori r3,r3,0x48a8 # make player grab item
mtlr r3
mr r3,r30
mr r4,r31
blrl
b END

THROW_ITEM:
mflr r0
subi sp,sp,0x40

lis r3,0x8026
ori r3,r3,0xad24
mtctr r3

lis r3,0x3f80
stw r3,0(r2)
lfs f1,0(r2)
addi r4,sp,24
addi r5,sp,36
mr r3,r31
li r6,1
bctr

END:
lwz r0,0x1c(sp)

**********************************
* D-Pad Down for Warp In (Entry) *
**********************************
inject @ 8006cb7c

lwz r3,0x668(r31)
cmpwi r3,0x4
bne- END
lwz r4,4(r31)
cmpwi r4,0xb	# don't for Nana
beq- END
lis r3,0x800c
ori r3,r3,0x61b0
mtlr r3
lwz r3,0(r31)
blrl

END:
lwz r0,0x1c(sp)

******************
* Tag Team Melee *
******************

Make Chars Fall at match
80069334
48000010

inject @ 80069330

lis	r4,0x8048
lbz	r4,-0x62D0(r4)# load menu controller major
cmpwi	r4,0x12	# is this slo-mo Melee?
bne-	END
lis	r4,0x8006
ori r4,r4,0x9344
mtlr r4
blr

END:
cmpwi r3,0
-------

Zelda/Sheik Copy Tag Team Flags during Transformation
inject @ 8007f0d8 - stw r0,0xd0(r29)

stw r0,0xd0(r29)
lwz r0,0x21fc(r31)
stw r0,0x21fc(r29)
lbz r0,0x618(r31)	# load controlled by index
stb r0,0x618(r29)
-------

Tag Team Melee - Main Code
inject @ 0x802259f0 - lwz r29,0x1c(sp)

Unique situations to address:
- match start --> sleep one of the players on a team
- player dying and losing last stock, but teammate still has stocks --> need to rebirth them or something
- stock steal --> make player not respawn on platform
- timeouts for tagging out

# check special mode
lis	r5,0x8048
lbz	r5,-0x62D0(r5)# load menu controller major
cmpwi	r5,0x12	# is this slo-mo Melee?
bne-	DEFAULT

lis r5,0x8016
ori r5,r5,0xb168
mtlr r5
blrl
cmpwi r3,0	# if not Teams mode, then skip
beq- DEFAULT

lis	r5,0x8048	# 80479d60 = true frame count
lwz	r5,-0x62A0(r5)	# load scene frame count
cmpwi	r5,0		# only execute on first frame
bne-	FIRST_FRAME_END
lwz	r3,-0x3e74(r13)
lwz	r3,0x20(r3) 	# should get you the first player who was created
FIRST_FRAME_SLEEP:
mr r31,r3
lwz r4,0x2c(r3)	# load internal
li r5,0
sth r5,0x21fe(r4)	# zero out the flags

lwz r5,0x10(r4)	# load action state
cmpwi r5,0xb	# in sleep?
beq-	FIRST_FRAME_SLEEP_COMPARE
li r5,0
stb r5,0x21fd(r4)	# zero out the flags

lbz r3,0xc(r4)
mr r30,r4	# save this char data offset
bl TAG_TEAM_GET_TEAMMATE
cmpwi r3,0
beq-	FIRST_FRAME_SLEEP_COMPARE
# found teammate, r3 = external data offset, r4 = port ID
lwz r4,0x2c(r3)
lwz r5,0x10(r4)
cmpwi r5,0xb
beq-	FIRST_FRAME_SLEEP_COMPARE
TEAMMATE_CPU_CHECK:
lbz r6,0xc(r4)
mulli r6,r6,0xe90
lis r5,0x8045
ori r5,r5,0x3088	# P1 slot type
lwzx r0,r6,r5	# load slot type of this player
cmpwi r0,0
beq+ TEAMMATE_CPU_CHECK_END	# if teammate is human, skip
# if teammate is CPU
TEAMMATE_CPU_PRIMARY_CPU:
lbz r0,0xc(r30)
mulli r7,r0,0xe90
lwzx r0,r7,r5
cmpwi r0,1
beq- TEAMMATE_CPU_CHECK_END
TEAMMATE_CPU_PRIMARY_CPU_END:
li r0,0		
stwx r0,r6,r5	# set type as human ID
lbz r5,0x618(r30)	# get primary teammate controller index
stb r5,0x618(r4)	# store as primary teammate controller index
TEAMMATE_CPU_CHECK_END:
bl TAG_TEAM_SLEEP_START

FIRST_FRAME_SLEEP_COMPARE:
lwz r3,8(r31)
cmpwi r3,0
bne-	FIRST_FRAME_SLEEP
FIRST_FRAME_END:

FIRST_MATCH_FRAME:
lis r3,0x8047
lwz r3,-0x493C(r3)
cmpwi r3,0	# if match frame count hasn't started, ignore code
beq-	DEFAULT
FIRST_MATCH_FRAME_END:

PAUSED:
lis	r6,0x8048
lbz	r6,-0x6298(r6)	# load screen freeze byte
rlwinm. r6,r6,0,30,30 # check (02) = paused
bne- DEFAULT # skip if paused
PAUSED_END:

ZERO_STOCKS_CHECK:
lis	r3,0x8016
ori	r3,r3,0xb094	# load function to check if Stock mode
mtlr	r3
blrl
cmpwi	r3,0
beq-	ZERO_STOCKS_CHECK_END

li r30,0
ZERO_STOCKS_CHECK_LOOP:
lis r3,0x8003
ori r3,r3,0x3bd8	# Playerblock stocks left
mtlr r3
mr r3,r30
blrl
cmpwi r3,0
bne-	ZERO_STOCKS_CHECK_CONTINUE

mr r3,r30
lis r4,0x8003
ori r4,r4,0x4110	# PlayerBlock_LoadDataOffset
mtlr r4
blrl
cmpwi r3,0
beq-	ZERO_STOCKS_CHECK_CONTINUE
lwz r3,0x2c(r3)
li r4,0
sth r4,0x21fe(r3)	# disable cooldown flag if zero stocks, 


mr r3,r30
bl	TAG_TEAM_GET_TEAMMATE
cmpwi r3,0
beq-	ZERO_STOCKS_CHECK_CONTINUE


ZERO_STOCKS_REBIRTH:
mr r31,r3
lwz r4,0x2c(r3)

lbz r6,0x21fd(r4)
cmpwi r6,1
bne- ZERO_STOCKS_REBIRTH_END

lbz r3,0xc(r4)
bl RELOAD_PERCENT

lwz r4,0x2c(r31)
li r6,0
stb r6,0x21fd(r4)
li r6,0x384	# 15 second cooldown
sth r6,0x21fe(r4)


lis r6,0x800c
ori r6,r6,0x61b0	# AS_Entry
mtlr 	r6

lis r6,0x804a
lwz r6,-0x16A8(r6) # load P1 respawn point
# can this ever be 0?
lwz r7,0x38(r6)
stw r7,0xb0(r4)
stw r7,0x6f4(r4)
lwz r7,0x3c(r6)
stw r7,0xb4(r4)
stw r7,0x6f8(r4)
li r7,1
stw r7,0xe0(r4)

# give timed intangibility
li r6,2	# 2 = intangible
stw r6,0x198c(r4)
li r6,0x4b	# 75 frames of intangibility
stw r6,0x1990(r4)


# camera tracking
li r6,0	# enable camera tracking
lwz r7,0x890(r4)
stw r6,0x8(r7)

lwz r3,0(r4)
blrl
lwz	r3,0x2c(r31)	# load internal offset as input
lbz r4,0x2222(r3)
rlwinm. r4,r4,30,31,31 #(00000004)
beq-	ZERO_STOCKS_REBIRTH_END
lbz r3,0xc(r3)
mulli r3,r3,0xe90
lis r4,0x8045
ori r4,r4,0x3134 #P1 secondary player
lwzx r3,r4,r3 # load secondary player external offset
b	ZERO_STOCKS_REBIRTH
ZERO_STOCKS_REBIRTH_END:

ZERO_STOCKS_CHECK_CONTINUE:
addi r30,r30,1
cmpwi r30,4
bne-	ZERO_STOCKS_CHECK_LOOP

ZERO_STOCKS_CHECK_END:

STOCK_STEAL_REBIRTH:
lwz	r3,-0x3e74(r13)
lwz	r3,0x20(r3) 	# should get you the first player who was created
STOCK_STEAL_REBIRTH_LOOP:
mr r31,r3
lwz r4,0x2c(r3)	# load internal
lwz r5,0x10(r4)	# load action state ID
cmpwi r5,0xc	# in Rebirth?
bne-	STOCK_STEAL_REBIRTH_COMPARE
lbz r3,0xc(r4)
bl TAG_TEAM_GET_TEAMMATE
cmpwi r3,0
beq-	STOCK_STEAL_REBIRTH_COMPARE
lwz r4,0x2c(r3)	# load internal of teammate
lbz r5,0x21fd(r4)	# load tag team sleep flag
cmpwi r5,1
beq-	STOCK_STEAL_REBIRTH_COMPARE
li r5,1
sth r5,0x21fe(r4)	# make percent reappear next frame
#lhz r3,0x21fe(r4)	# trying to make percents appear if player steals stock after 15 secs have elapsed
#cmpwi r3,0
#bne- STOCK_STEAL_REBIRTH_PERCENT_CONTINUE
#lwz r3,0x2c(r31)
#lbz r3,0xc(r3)
#bl RELOAD_PERCENT
#STOCK_STEAL_REBIRTH_PERCENT_CONTINUE:
mr r3,r31
bl TAG_TEAM_SLEEP_START
STOCK_STEAL_REBIRTH_COMPARE:
lwz r3,8(r31)
cmpwi r3,0
bne-	STOCK_STEAL_REBIRTH_LOOP
STOCK_STEAL_REBIRTH_END:

li r31,0
COOLDOWN_TIMER_LOOP:
mr r3,r31
lis r4,0x8003
ori r4,r4,0x4110	# PlayerBlock_LoadDataOffset
mtlr r4
blrl
cmpwi r3,0
beq- COOLDOWN_TIMER_COMPARE
lwz r4,0x2c(r3)
lhz r5,0x21fe(r4)	# load timer flags
cmpwi r5,0
beq-	COOLDOWN_TIMER_COMPARE
subi r5,r5,1
sth r5,0x21fe(r4)

cmpwi r5,0	# if subtracted from 1 to 0
bne- COOLDOWN_TIMER_COMPARE

mr r3,r31
bl TAG_TEAM_GET_TEAMMATE
cmpwi r3,0
beq- COOLDOWN_TIMER_COMPARE
# cooldown is over
lwz r3,0x2c(r3)
lbz r3,0xc(r3)
bl RELOAD_PERCENT
li r3,0x100
stw	r3,-0x4B0C(r13)

COOLDOWN_TIMER_COMPARE:
addi r31,r31,1
cmpwi r31,4
bne- COOLDOWN_TIMER_LOOP
COOLDOWN_TIMER_END:


li r31,0
BUTTON_CHECK_LOOP:
lis r3,0x8003
ori r3,r3,0x4110	# PlayerBlock_LoadDataOffset
mtlr r3
mr r3,r31
blrl
cmpwi r3,0
beq- BUTTON_CHECK_COMPARE
lwz r3,0x2c(r3)
lwz r4,0x10(r3)	# load action state
cmpwi r4,0xb	# if this player's char is in sleep, skip
# really, the above line should branch into a "Validate Action State" function
beq- BUTTON_CHECK_COMPARE
lbz r3,0x618(r3)
bl BUTTON_CHECK
cmpwi r3,4	# d-pad down
beq-	TAG_TEAM
BUTTON_CHECK_COMPARE:
addi r31,r31,1
cmpwi r31,4
beq- DEFAULT
b BUTTON_CHECK_LOOP


#-----------------
BUTTON_CHECK:
mulli r5,r3,0x44 # button offsets are 0x44 apart
lis r4,0x804c
ori r4,r4,0x1fac
add	r4,r4,r5
lhz	r5,2(r4)	# load buttons this frame (excluding analog sticks)
lhz	r3,0xa(r4)	# load instant buttons (excluding analog sticks)
cmpw r3,r5
beq-	BUTTON_CHECK_END
BUTTON_CHECK_FALSE:
li r3,0
BUTTON_CHECK_END:
blr
#------------------

TAG_TEAM: # r3 is player who pressed d-pad down
mr r3,r31
mr r30,r3

lis r4,0x8003
ori r4,r4,0x4110	# PlayerBlock_LoadDataOffset
mtlr r4
blrl
cmpwi r3,0
beq-	TAG_TEAM_END
mr r31,r3
lwz r4,0x2c(r3)	# load internal

lhz r5,0x21fe(r4)	# if cooldown has not elapsed
cmpwi r5,0
bne-	TAG_TEAM_END

lwz r5,0x10(r4)	# load action state
cmpwi r5,0xe
blt-	TAG_TEAM_END
cmpwi r5,0x18
blt-	TAG_TEAM_ENTRY_CONTINUE	# neutral grounded states
cmpwi r5,0x27
blt-	TAG_TEAM_END
cmpwi r5,0x2c
blt-	TAG_TEAM_ENTRY_CONTINUE	# landings/squats
cmpwi r5,0x46
blt-	TAG_TEAM_END
cmpwi r5,0x4b
blt-	TAG_TEAM_ENTRY_CONTINUE	# aerial attack landings
cmpwi r5,0xF5	# ledgeteeter
beq-	TAG_TEAM_ENTRY_CONTINUE
cmpwi r5,0xF6	# ledgeteeterwait
beq-	TAG_TEAM_ENTRY_CONTINUE
b TAG_TEAM_END

TAG_TEAM_ENTRY_CONTINUE:
lbz r3,0xc(r4)
bl TAG_TEAM_GET_TEAMMATE
cmpwi r3,0
beq-	TAG_TEAM_END
TAG_TEAM_ENTRY:
lwz r4,0x2c(r3)
lwz r5,0x2c(r31)

lbz r6,0x21fd(r4)
cmpwi r6,1
bne- TAG_TEAM_ENTRY_END
li r6,0
stb r6,0x21fd(r4)
li r6,0x384	# 15 second cooldown
sth r6,0x21fe(r4)

lwz r6,0x2c(r5)
stw r6,0x2c(r4)
lwz r6,0xb0(r5)
stw r6,0xb0(r4)
lwz r6,0xb4(r5)
stw r6,0xb4(r4)
lwz r6,0xb8(r5)
stw r6,0xb8(r4)
lwz r6,0xe0(r5)
stw r6,0xe0(r4)
lwz r6,0x6f4(r5)
stw r6,0x6f4(r4)
lwz r6,0x6f8(r5)
stw r6,0x6f8(r4)
lwz r6,0x83c(r5)
stw r6,0x83c(r4) # ground ID last on

#velocities
lwz r6,0x80(r5)
stw r6,0x80(r4)
lwz r6,0x84(r5)
stw r6,0x84(r4)
lwz r6,0x8c(r5)
stw r6,0x8c(r4)
lwz r6,0x90(r5)
stw r6,0x90(r4)
lwz r6,0x98(r5)
stw r6,0x98(r4)
lwz r6,0x9c(r5)
stw r6,0x9c(r4)
lwz r6,0xec(r5)
stw r6,0xec(r4)

# give timed intangibility
li r6,2	# 2 = intangible
stw r6,0x198c(r4)
li r6,0x4b	# 75 frames of intangibility
stw r6,0x1990(r4)

# camera tracking
li r6,0	# enable camera tracking
lwz r7,0x890(r4)
stw r6,0x8(r7)

# r3 = external for Entry player
mr r30,r3
lis r6,0x800c
ori r6,r6,0x61b0	# AS_Entry
mtlr 	r6
blrl

lwz	r3,0x2c(r30)	# load internal offset as input
lbz r3,0xc(r3)
bl RELOAD_PERCENT


lwz	r3,0x2c(r30)	# load internal offset as input
lbz r4,0x2222(r3)
rlwinm. r4,r4,30,31,31 #(00000004)
beq-	TAG_TEAM_ENTRY_END
lbz r3,0xc(r3)
mulli r3,r3,0xe90
lis r4,0x8045
ori r4,r4,0x3134 #P1 secondary player
lwzx r3,r4,r3 # load secondary player external offset
b TAG_TEAM_ENTRY
TAG_TEAM_ENTRY_END:

mr	r3,r31
bl TAG_TEAM_SLEEP_START

b DEFAULT

TAG_TEAM_SLEEP_START:
mflr r0
stw r0,0x4(sp)
stwu sp,-0x18(sp)
stw r31,0x14(sp)
stw r30,0x10(sp)
TAG_TEAM_SLEEP:
mr	r31,r3
lis r6,0x800d
ori r6,r6,0x4f24	# put char in Sleep, sparkle GFX, DestroyItem
mtlr r6
li r4,0	# no sparkle gfx
blrl
lis r3,0x8007
ori r3,r3,0xed2c	# 
mtlr r3
lwz	r3,0x2c(r31)	# load internal offset as input
#li r6,1	# 1 = disable camera tracking for char being put to sleep
#lwz r4,0x890(r3)
#stw r6,0x8(r4)
#li r6,2
#stw r6,0x1988(r3)	# make player intangible
blrl
lwz	r3,0x2c(r31)	# load internal offset as input

li r4,1
stb r4,0x21fd(r3)	# flag to know intentional sleep
li r6,0	# remove cooldown timer
sth r6,0x21fe(r3)

PERCENT_HIDE:
lis	r5,0x8048	# 80479d60 = true frame count
lwz	r5,-0x62A0(r5)	# load scene frame count
cmpwi	r5,0		# skip hiding percents on first frame
beq-	PERCENT_HIDE_END
lbz r5,0xc(r3)
mulli r5,r5,100
lis r4,0x804a
ori r4,r4,0x10c8
add r4,r4,r5
li r5,0x80
stb r5,0x10(r4)	# hide Percent HUD
PERCENT_HIDE_END:

lbz r4,0x2222(r3)
rlwinm. r4,r4,30,31,31 #(00000004)
beq-	TAG_TEAM_SLEEP_NO_SECONDARY
lbz r3,0xc(r3)
mulli r3,r3,0xe90
lis r4,0x8045
ori r4,r4,0x3134 #P1 secondary player
lwzx r3,r4,r3 # load secondary player external offset
lwz r4,0x2c(r3) # load seconary internal
lwz r5,0x10(r4)	# load action state
cmpwi r5,0xe
blt- TAG_TEAM_SLEEP_NO_SECONDARY

b	TAG_TEAM_SLEEP
TAG_TEAM_SLEEP_NO_SECONDARY:

BLR_END:
lwz r0,0x1c(sp)
lwz r31,0x14(sp)
lwz r30,0x10(sp)
addi sp,sp,24
mtlr r0
blr
#---------------

RELOAD_PERCENT: # if necessary, r3 = port number
mflr r0
stw r0,0x4(sp)
stwu sp,-0x18(sp)
stw r31,0x14(sp)
stw r30,0x10(sp)

lis r5,0x804a
ori r5,r5,0x10c8
mulli r4,r3,100
add	r4,r4,r5
lbz	r4,0x10(r4)
rlwinm. r4,r4,0,24,24	# (00000080), is player HUD percent gone?
beq- RELOAD_PERCENT_CONTINUE
# r3 is player number
lis r4,0x802f
ori r4,r4,0x6e1c	# remake player HUD percent
mtlr r4
blrl
RELOAD_PERCENT_CONTINUE:
b BLR_END	# branch to function end

#------
TAG_TEAM_GET_TEAMMATE:	#r3 = port number of player
li r5,0	# r5 will be port number counter for teammate

TAG_TEAM_GET_TEAMMATE_LOOP:
lis r4,0x8045
ori r4,r4,0x3080	# load P1 playerblock start
cmpw r5,r3	
beq-	TAG_TEAM_GET_TEAMMATE_LOOP_COMPARE

mulli r7,r5,0xe90
mulli r6,r3,0xe90
add	r6,r6,r4 # r6 is playerblock of this player
add r7,r7,r4	# r7 is playerblock of loop player
lwz r4,0x8(r7)
cmpwi r4,3	# player not in match?
beq-	TAG_TEAM_GET_TEAMMATE_LOOP_COMPARE
lbz r4,0x47(r6)
lbz r6,0x47(r7)
cmpw	r6,r4	# team IDs not the same?
bne-	TAG_TEAM_GET_TEAMMATE_LOOP_COMPARE
TAG_TEAM_GET_TEAMMATE_CHECK_STOCK_MODE:
lis r6,0x8047
lbz r6,-0x2498(r6)
rlwinm r6,r6,27,29,31
subfic r6,r6,1
cntlzw r6,r6
rlwinm r6,r6,27,5,31
cmpwi r6,0	# 0 means not stock mode
beq-	TAG_TEAM_GET_TEAMMATE_CONTINUE
TAG_TEAM_GET_TEAMMATE_CHECK_STOCKS:
lbz	r6,0x8e(r7) # load stocks left
cmpwi r6,0
beq-	TAG_TEAM_FALSE
TAG_TEAM_GET_TEAMMATE_CONTINUE:
lbz	r6,0xc(r7)
mulli r6,r6,4
addi r6,r6,0xb0
lwzx r3,r6,r7	# r3 = external offset of teammate
mr	r4,r5	# r4 = port number 
b TAG_TEAM_GET_TEAMMATE_END


TAG_TEAM_GET_TEAMMATE_LOOP_COMPARE:
addi r5,r5,1
cmpwi r5,4	# gone through all 4 ports?
bne- TAG_TEAM_GET_TEAMMATE_LOOP

TAG_TEAM_FALSE:
li r3,0
li r4,0
TAG_TEAM_GET_TEAMMATE_END:
blr

TAG_TEAM_END:

DEFAULT:
lwz r0,44(r1)
lwz r31,36(r1) 
lwz r30,32(r1) # previous code line
lwz r29,0x1c(sp)

*************************
* Disable Brinstar Lava *
*************************

Disable Rising Lava on Brinstar
(1.02) [Zauron]
041D99E0 4E800020

For 20XX 4.06+, make the custom stage flag control this.

lis r5,0x8040
lbz r5,-0x5d1b(r5) # load custom stage flag
rlwinm. r5,r5,0,24,24 # (00000080)
beq- DEFAULT
DISABLE_LAVA:
blr
DEFAULT:
mflr r0



***************************
* Disable All-Star Portal *
***************************

8021f474
- use r4

lis r4,0x8040
lbz r4,-0x5d1b(r4) # load custom stage flag
rlwinm. r4,r4,0,24,24 # (00000080)
beq- DEFAULT
DISABLE_PORTAL:
blr
DEFAULT:
mflr r0

***************************************************
* Corneria - Disable Ship Spawn and Great Fox Gun *
***************************************************

Disable Great Fox's Gun (starts out dead) on Corneria
(1.02) [Zauron]
041E1390 40800430

Disable Ship Spawn on Corneria
(1.02) [Zauron]
041DDA48 60000000


Disable Ship Spawn
inject @ 801dce1c

lis r3,0x8040
lbz r3,-0x5d1b(r3) # load custom stage flag
rlwinm. r3,r3,0,24,24 # (00000080)
beq- DEFAULT
DISABLE_PORTAL:
blr
DEFAULT:
mflr r0




Disable Great Fox Gun
inject @ 801e138c

lis r3,0x8040
lbz r3,-0x5d1b(r3) # load custom stage flag
rlwinm. r3,r3,0,25,25 # (00000040)
beq- DEFAULT
DISABLE_PORTAL:
lis r3,0x801e
ori r3,r3,0x17c0
mtlr r3
blr	# destroy gun

DEFAULT:
cmpwi r0,0

*************************************************************
* Princess Peach's Castle - Disable Bullet Bill and Switchs *
*************************************************************

Disable Bullet Bill and Switchs
inject @ 801CD8A8

lis r4,0x8040
lbz r4,-0x5d1b(r4) # load custom stage flag
rlwinm. r4,r4,0,24,24 # (00000080)
beq- DEFAULT
DISABLE_PEACH_HAZARDS:
blr
DEFAULT:
mflr r0

*****************************************************
* Mushroom Kingdom II - Disable Pidgit, Logs, Birdo *
*****************************************************

inject @ 801fcd80

lis r5,0x8040
lbz r5,-0x5d1b(r5) # load custom stage flag
rlwinm. r5,r5,0,24,24 # (00000080)
beq- DEFAULT
DISABLE_PIDGET_ETC:
lis r5,0x801f
ori r5,r5,0xcda4
mtlr r5
blr	# 

DEFAULT:
li r5,4

**************************************
* Trophy Stage - Disable Trophy Drop *
**************************************

042199fc 60000000

inject @ 802199fc

lis r7,0x8040
lbz r7,-0x5d1b(r7) # load custom stage flag
rlwinm. r7,r7,0,24,24 # (00000080)
bne- END
DEFAULT:
lis r7,0x802f
ori r7,r7,0x2094	# trophy drop function
mtlr r7
blrl
END:

****************
* Reload Music *
****************

D-Pad Up to reload music at match start
- will re-randomize song for 20XX if applicable for the stage

inject around 8006b720
- executed when controller inputs are removed from character
- check to make sure match frame count is zero.
- d-pad up is 0x8 bit

inject @ 8006b6a0

lis	r3,0x8047
lwz	r3,-0x493C(r3)# load match frame count @ 8046b6c4
cmpwi	r3,0		# check if at beginning of match
bne- 	END
lwz	r3,0x668(r31)	# load instant buttons
rlwinm. r3,r3,0,28,28
beq-	END
RELOAD_MUSIC:
lis r3,0x8002
ori r3,r3,0x3f28	# play HPS file function
mtlr r3
lis r3,0x804a
lwz r3,-0x18A0(r3)	# load HPS ID from 8049e760
blrl

END:
lfs f0,0x620(r31)	# default code line

******************
* Develop Camera *
******************

80227904
is this function executed every frame when develop is active? looks at c-stick

Develop Camera location data is from 80453040 to 8045305c (not including 8045305c)
802275e8 is executed to change to develop camera when hitting c-stick


D-Pad Down to Enable Develop Mode Camera
inject @ 8006CB7C

lis r3,0x8045
lwz r4,0x2c6c(r3)
cmpwi r4,8	# is camera mode develop camera?
bne- DPAD

lwz r3,0x2c68(r3)	# load camera entity
li r4,0	# P1 only
lis r5,0x8022
ori r5,r5,0x7904	# load main function to control develop camera
mtlr r5
blrl


DPAD:
lwz r3,0x668(r31)
cmpwi r3,0x4	# d-pad down?
bne- END

lis r3,0x8003	# initialize position of develop camera
ori r3,r3,0x006c
mtlr r3
blrl

lis r3,0x8045
li r4,8
stw r4,0x2c6c(r3)	# store develop mode camera, wouldn't be needed if
# above I didn't remove develop mode camera storing in above function


END:
lwz r0,0x1c(sp)

------------

040300a4 38000008	# reverts overwrite by me for disabling camera
042275f4 57E0077B
C2227538 00000004
578307BF 40820014
3C608022 606375F4
7C6803A6 4E800020
8062C348 00000000
C206AE94 00000002
3C608045 80632C6C
2C030007 00000000


D-Pad Down used for Develop Camera Mode Toggling
- instead of D-Pad Up
042275f4 57E0077B

C-Stick + D-Pad Left/Right for Develop Camera enabling
- instead of just c-stick
inject @ 80227538

rlwinm. r3,r28,0,30,31	# D-Pad left or right?
bne-	DEVELOP_CAMERA
lis r3,0x8022
ori r3,r3,0x75f4	# skip activating Develop Camera
mtlr r3
blr
DEVELOP_CAMERA:
lwz r3,-0x3cb8(rtoc)	# default code line

C2227538 00000004
578307BF 40820014
3C608022 606375F4
7C6803A6 4E800020
8062C348 00000000


Disable C-Stick when using Develop Camera
- also enables c-stick in Develop Mode
inject @ 8006ae94

lis r3,0x8045
lwz r3,0x2c6c(r3)
cmpwi r3,7
# next line is bge- (SKIP C_STICK)
C206AE94 00000002
3C608045 80632C6C
2C030007 00000000


-----------------

Allow Develop Camera to be toggle with X held
042276b0 73800860

Disable C-Stick from toggling Develop Camera
- can still toggle Develop Cam with the [default] D-Pad Up toggle
042274e0 48000114

Add Fixed Camera to Develop Mode Camera Toggles
- and change the button toggle from d-pad up to X+Left
inject @ 2275f4 - rlwinm.	r0,r31,0,28,28	# check for D-Pad Up


rlwinm.	r0,r28,0,21,21	# constant X button?
bne- CONTINUE
li r31,0	# remove all instant buttons, with no X
CONTINUE:
rlwinm.	r0,r31,0,31,31	# check for D-Pad left
beq- END
lis r3,0x8045
lwz r4,0x2c6c(r3)	# load camera type
cmpwi r4,7
beq- FIXED
cmpwi r4,4
bne-	DEFAULT
li r4,7		# set camera type as P1 fixed, --> will set to regular 
stw r4,0x2c6c(r3) 
b DEFAULT	
FIXED:
li r4,4
stw r4,0x2c6c(r3) 

END:
lis r3,0x8045
lwz r4,0x2c6c(r3)	# load camera type
cmpwi r4,4
bne-	DEFAULT
lis r3,0x8022
ori r3,r3,0x775c
mtlr	r3
blr	# skip some Develop specific stuff in Fixed Camera mode

DEFAULT:
rlwinm.	r0,r31,0,31,31	# check for D-Pad Left
#rlwinm.	r0,r31,0,28,28	# check for D-Pad Up

-----------------


1) revert original mod to disable develop camera
040300a4 38000008	# reverts overwrite by me for disabling camera




Develop Camera - Hold B Button as well for zoom/pan
8022799c - lwz r4,0(r4)

lwz r4,0(r4)	# default code line
rlwinm. r0,r4,0,22,22	# holding B?
bne- END
# not holding B
lis r3,0x8022
ori r3,r3,0x79d0
mtlr r3
blr
END:


Develop P1 Camera - Hold B Button as well for zoom/pan
8022789c - rlwinm. r0,r31,0,31,31	# dpad left?

rlwinm. r0,r31,0,22,22	# holding B?
bne- END
# not holding B
lfs f30,-0x3ca4(r2)	# null out any inputs from c-stick
lfs f31,-0x3ca4(r2)
addi r4,r3,0
lis r3,0x8022
ori r3,r3,0x78d4
mtlr r3
blr
END:
rlwinm. r0,r31,0,31,31	# default code line
****************************
* Develop Mode Bonuses Won *
****************************

802291a0: Checks for B+D-Pad Left to show bonuses won text

Bonuses Won text struct is at 804a2074

Disable Bonuses Won
042291a0 4e800020


80226730:	DevelopMode_PlayerInfoText_B+DPadDown
Player info text struct at 804a1fd8
	--> special ASCII struct @ 49facc



**********************************************
* Z Button Buffer on CSS to go to Debug Menu *
**********************************************
Hold Z to force Debug Menu
CSS code looking at Z button for all players on first frame of CSS is in MnSlChr code

1b0a14 - debug menu exit


lis	r4,0x803f
lbz	r3,0x0a47(r4)	# load rumble/css exit flag
cmpwi	r3,3
blt-	DEFAULT
li	r5,0
stb	r5,0x0a47(r4)	# disable debug menu exit flag
subi	r3,r3,1
b	END

DEFAULT:
li r3,1	# default [modified] code line, go to Main Menu from CSS exit

END:





801a56b0 - exiting CSS

lis	r3,0x803f
lbz	r3,0x0a47(r3)	# load rumble/css exit flag
cmpwi	r3,3
blt-	DEFAULT
lis	r3,0x8002
ori	r3,r3,0x3f28	# play music
mtlr	r3
li	r3,0x7fff	# custom Debug Menu HPS ID
blrl
li	r3,6	# debug menu
b	END

DEFAULT:
li r3,1

END:

***********
* Replays *
***********
replay engine

General Replay Header
- does not include other match characteristics (stage, char IDs, etc.)
- length = 0x8 * number of characters

0x00	word	replay frame start (scene frame count)
0x04	word	replay frame index
0x08	ptr		last loaded/saved replay data (for the ingame menu)


0x00	byte	Flags
		(01) = Frame Advance (remove Z button)
		(02) = Loop frame --> restart replay, but don't actually load state
		(04) = Auto load Save State --> set a byte (0x02) @ first frame of free RAM monitored by save state func
		(08) = Play SFX
		(10) = Random Wait
		(20) = Trigger

0x01	byte	L/R analog
0x02	half	Buttons
0x04	byte	jX
0x05	byte	jY
0x06	byte	cX
0x07	byte	cY
0x08	word	RNG seed

NOTE: replay data will be stored backwards in RAM for safety

--------
...strings...

"secondary chars????"

PLAYER :
-------------------------
CONTROLLED BY :
TYPE : HUMAN, CPU, DISABLED
CPU TYPE :
20XX CPU TYPE : DEFAULT, SHIELD - HOLD, SHIELD - OOS, STAND

<REPLAY INFO>
REPLAY STATE : NONE, RECORDING, PLAYBACK
#FRAME:
LOOP:
AUTO LOAD STATE:
SFX: 




REPLAY DEBUG MENU
<POP-UP LOCATION>
X :
Y :

SFX TYPE : 
SAVE/LOAD RANDOM SEED :


----------

Loop frame issues:

If replay_start_frame is set to current_frame on loop bool high,
	- load state -->  replay_start_frame is now behind current frame, no action will occur
		- because there is no reference in the index that looping is occuring

inject @ 8006af10 - lfs f1,0x620(r31) # load x joystick float
- executed for CPUs and Humans
- for humans, r3 at this point = joystick structure start (804c1fac locations)
- r31 = internal data offset pointer
- r30 = external data offset pointer
At this injection location, I need to store everything but buttons directly in the internal offset (r31)
For buttons:
Human - 0x00 (r3)
CPU - 0x1a88 (word?...)

inject @ 8006af10
# r31 = internal data offset
# r30 = external data offset
# r29 = start of this character's replay frame index info
# r28 = start of all replay data (frame 0, char 0)
# r27 = replay data start index for this character (char number * REPLAY_DATA)
# r26 = replay data length, all players one frame
# r25 = joystick start for this [human] character
# r24 = 


.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

# save state constants
.set ss_nAllocatedChars, 0x800037cc	# byte
.set ss_tableStart, 0x800037e0
.set ss_table.length, 0x10	# per table entry
.set ss_tableStart_oneIndexed, ss_tableStart - ss_table.length
.set ss_table.saveConstant, 0
.set ss_table.saveInstant, 2
.set ss_table.loadConstant, 4
.set ss_table.loadInstant, 6
.set ss_table.ramStart, 8
# ss = savestate
.set ss_header.len, 0x90
.set ss_header.savedBool, 0x00	# byte
.set ss_header.auto, 0x01	# byte, 1 = auto load or save state
.set ss_header.frameAdvance, 0x02	# byte
# add more header constants

.set buttons.adr, 0x804c1fac


.set ss_dataoffset.len, 0x2384 # data offset length
.set ss_charsave.len, 0x23C8 # total
.set ss_totalLen, ss_header.len + ss_charsave.len	# total amount of bytes per char

.set _HSD_MemAlloc, 0x8037f1e4	# r3 input = number of bytes to allocate
.set sceneFrameCount, 0x80479d60
.set matchFrameCount, 0x8046B6C4
.set timerHUD, 0x8046B6C8
.set screenState, 0x80479D68

.set _20XXToggleFlag, 0x803FA3D8
.set ss_timerDebugFlag, 0x803faf88	# whether or not to load timer

.set replay_index.size, 0xc
.set replay_index.framestart, 0x00
.set replay_index.frameend, 0x04	# this is the total number of frames
.set replay_index.dataptr, 0x08

.set REPLAY_DATA, 0x10	# (!!!) length of one replay data per character per frame
.set FLAGS, 0
.set LR_ANALOG, 1
.set BUTTONS, 2
.set jX, 4
.set jY, 5
.set cX, 6
.set cY, 7
.set RNG,	8
.set AS, 0xc
.set AS_FRAME, 0xe

REPLAY_START:
stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack

ZERO_FLAGS:
lis	r20,0x8048	# 80479d60 = true frame count
lwz	r21,-0x62A0(r20)	# load scene frame count
cmpwi	r21,0	# is first frame of match?
bne-	ZERO_FLAGS_END
stb	r21,0xd(r31)	
sth	r21,0xe(r31)	# zero the bytes following the port number
# I should really only be zeroing the replay state byte at 0xf, other are CPU flags
ZERO_FLAGS_END:

mr r25,r3	# for humans, move joystick start to r25

bl GET_FREE_RAM_START
mr	r29,r4	# r20 = FST info location (end of available RAM)
bl	PLAYER_COUNT_TOTAL	# 1-indexed
mulli r4,r3,replay_index.size	# each player has REPLAY_INDEX bytes associated with their frame index data (!!!!)
sub r28,r29,r4	# r28 is end of frame indexes
mulli r26,r3,REPLAY_DATA	# (so get total data for one frame)
sub r28,r28,r26	# r28 is now start of all replay data (frame 0)

lwz r3,0(r31)	# load external data pointer into r3 (this should already be in r30, though)
bl	PLAYER_COUNT	# character count of this character, 0-indexed
mulli r27,r3,REPLAY_DATA	# replay data start index for this character
addi r4,r3,1	# make 1-indexed
mulli r4,r4,replay_index.size	# each player has REPLAY_INDEX bytes associated with their frame index data (!!!!)
sub r29,r29,r4	# r29 is now start of this character's replay frame index info

li r20,0
stw r20,replay_index.dataptr(r29) # null out the replay index data pointer (default)

lis r20,0x8047
lwz	r20,-0x493C(r20)	# load match frame count
addi r20,r20,0x7B	# 7B frames before match counter begins
cmpwi r20,0x7B	# if match frame count was zero
bne- REPLAY_FRAME_COUNT_CONTINUE
lis r20,0x8048
lwz	r20,-0x62a0(r20)# load scene frame count
REPLAY_FIRST_FRAME_CHECKS:
cmpwi r20,0
bne- REPLAY_FIRST_FRAME_CHECKS_END
stw r20,replay_index.framestart(r29)
stw r20,replay_index.frameend(r29)
.set DebugMenu.AutoReplaySave, 0x803faf54
word_load r21,r21,DebugMenu.AutoReplaySave
cmpwi r21,1
bne- REPLAY_FIRST_FRAME_CHECKS_END
stb r21,0xf(r31)
REPLAY_FIRST_FRAME_CHECKS_END:
REPLAY_FRAME_COUNT_CONTINUE:	
lwz r21,replay_index.framestart(r29)	# load replay frame start
lwz	r22,replay_index.frameend(r29)	# load replay frame end index
rlwinm r22,r22,0,8,31	# remove first byte from end index (loop flag)

lbz r23,0xf(r31)	# load custom replay state byte in player data struct
cmpwi r23,1	# 1 = saving, 2 = loading
beq- REPLAY_SAVE
cmpwi r23,0
beq- END

REPLAY_LOAD:
REPLAY_LOAD_LOWER:
cmpw	r20,r21	# check if match frame count is lower than replay start
bge-	REPLAY_LOAD_LOWER_END
lbz	r23,4(r29)
rlwinm. r24,r23,0,24,24	# check for (80) = in middle of looping
beq-	REPLAY_LOAD_END	# if not looping (loading a state while looping), do nothing
#... so was in middle of looping, reset replay frame start to current
li r24,0
rlwimi	r23,r24,7,24,24	# (00000080), remove looping flag
stb r23,4(r29)
mr r21,r20
stw r21,0(r29)	# store new frame start

REPLAY_LOAD_LOWER_END:
add	r23,r22,r21	# load end of replay frame
cmpw	r20,r23	# check if current match frame is larger than replay end
bge-	REPLAY_LOAD_END

REPLAY_TRIGGER_CHECK:
bl GET_TO_REPLAY_DATA
lbz r3,FLAGS(r24)
rlwinm. r3,r3,0,26,26	# 00000020
beq- REPLAY_TRIGGER_CHECK_END
lhz r3,AS(r24)
lwz r4,0x10(r31)
cmpw r3,r4
bne- REPLAY_TRIGGER_BACK_ONE
lhz r3,AS_FRAME(r24)
lhz r4,0x894(r31)
cmpw r3,r4
beq- REPLAY_LOAD_BACK_FRAMES_END
REPLAY_TRIGGER_BACK_ONE:
li r3,0x80
stb r3,4(r29)	# force looping??
addi r21,r21,1
stw r21,0(r29)
b REPLAY_LOAD_BACK_FRAMES_END
REPLAY_TRIGGER_CHECK_END:

REPLAY_HITLAG_CHECK:
# check Debug Menu flag first
lis r3,0x8040
lwz r3,-0x5CE8(r3)	# 803fa318 debug menu flag
cmpwi r3,0
beq-	REPLAY_HITLAG_CHECK_END
lbz r3,0x221a(r31)	# load player flags
rlwinm. r3,r3,27,31,31 # (00000020) check for hitlag
beq-	REPLAY_HITLAG_CHECK_END
lbz	r3,4(r29)
rlwinm. r3,r3,0,24,24	# check for (80) = in middle of looping
beq-	REPLAY_HITLAG_CHECK_END
addi r21,r21,1
stw r21,0(r29)
b REPLAY_LOAD_BACK_FRAMES_END
REPLAY_HITLAG_CHECK_END:

REPLAY_LOAD_CONTINUE:
bl GET_TO_REPLAY_DATA
REPLAY_RANDOM_WAIT:
lbz r3,FLAGS(r24)	#
rlwinm. r3,r3,0,27,27 #(00000010) = random wait
beq-	REPLAY_RANDOM_WAIT_END
#lbz	r3,4(r29)
#rlwinm. r3,r3,0,24,24	# check for (80) = in middle of looping
#beq-	REPLAY_RANDOM_WAIT_END
lis r3,0x8032
ori r3,r3,0x57c4	# rand
mtlr r3
blrl
.set DebugMenu.ReplayRandomWait, 0x803faf58
word_load r4,r4,DebugMenu.ReplayRandomWait
cmpwi r4,100
beq- REPLAY_RANDOM_WAIT_END
mulli r4,r4,327	# 0 - 0x7fff in r3
cmpw r3,r4
blt- REPLAY_RANDOM_WAIT_END
li r3,0x80
stb r3,4(r29)	# force looping??
addi r21,r21,1
stw r21,0(r29)
REPLAY_RANDOM_WAIT_END:

REPLAY_LOAD_BACK_FRAMES_END:
bl GET_TO_REPLAY_DATA

REPLAY_LOAD_SFX:
lbz r3,FLAGS(r24)	#
rlwinm. r3,r3,0,28,28 #(00000008) = play SFX
beq-	REPLAY_LOAD_SFX_END
# play common SFX, from Debug Flag @ 803fa314
lis r3,0x8002
ori r3,r3,0x4030
mtlr r3
lis r3,0x8040
lwz r3,-0x5CEC(r3)
stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack
blrl
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
REPLAY_LOAD_SFX_END:

REPLAY_LOAD_AUTO_LOAD_STATE_CHECK:
lbz r3,FLAGS(r24)	#
rlwinm. r3,r3,0,29,29 #(00000004) = auto load state
beq-	REPLAY_LOAD_AUTO_LOAD_STATE_END
adr_load r3,ss_tableStart
lwz	r3,ss_table.ramStart(r3)	# save state 0 [major] RAM pointer
cmpwi r3,0		# check for no RAM pointer? safety
beq- REPLAY_LOAD_AUTO_LOAD_STATE_END
lbz r4,ss_header.savedBool(r3)	# has a save state occurred yet?
cmpwi r4,0	# if not, skip
beq- REPLAY_LOAD_AUTO_LOAD_STATE_END
li r4,1	# auto load
stb r4,ss_header.auto(r3)	# store auto load flag
REPLAY_LOAD_AUTO_LOAD_STATE_END:

REPLAY_LOAD_LOOP_CHECK:
lbz r3,FLAGS(r24)	#
rlwinm.	r3,r3,0,30,30	# check for (00000002) = loop frame
beq-	REPLAY_LOAD_LOOP_CHECK_END
lbz r23,4(r29)
ori	r23,r23,0x80	# set loop flag
stb	r23,4(r29)		# store loop flag

stw r20,0(r29)	# store current frame as replay start
mr r24,r28	# move 0-frame replay frame as current load location
add	r24,r24,r27	# get to replay data this frame for this character
REPLAY_LOAD_LOOP_CHECK_END:

REPLAY_LOAD_RNG:	# maybe make this a toggle?
lwz r23,RNG(r24)	# load RNG seed
stw r23,-0x5710(r13)

REPLAY_LOAD_FRAME_ADVANCE:
lhz	r23,BUTTONS(r24)
lbz r3,FLAGS(r24)	#
rlwinm. r3,r3,0,31,31 #(00000001) = input captured with frame advance
beq-	REPLAY_LOAD_FRAME_ADVANCE_END
li	r4,0		# if input was captured with frame advance...
rlwimi	r23,r4,0,27,27	# disable Z button bit
REPLAY_LOAD_FRAME_ADVANCE_END:	# r23 = button input right now

bl HUMAN_OR_CPU
cmpwi r3,0
beq- REPLAY_LOAD_HUMAN

REPLAY_LOAD_CPU:
sth	r23,0x1a8a(r31)	# store buttons into internal cpu data
lbz	r3,LR_ANALOG(r24)
stb	r3,0x1a90(r31)	# store into CPU L
lwz	r3,jX(r24)
stw	r3,0x1a8c(r31)	# store joystick and cstick

lis r3,0x800a
ori r3,r3,0x1904	# 800a1904 = CPU_LAnalog_Convert
mtlr r3
mr r3,r31
blrl
stfs f1,0x650(r31)

lis r3,0x800a
ori r3,r3,0x1994	# 800a1994 = CPU_Cstick_Xaxis
mtlr r3
mr r3,r31
blrl
stfs f1,0x638(r31)

lis r3,0x800a
ori r3,r3,0x1a24	# 800a1a24 = CPU_Cstick_Yaxis
mtlr r3
mr r3,r31
blrl
stfs f1,0x63c(r31)

lis r3,0x800a
ori r3,r3,0x17e4	# 800a17e4 = CPU_Joystick_Xaxis
mtlr r3
mr r3,r31
blrl
stfs f1,0x620(r31)

lis r3,0x800a
ori r3,r3,0x1874	# 800a1874 = CPU_Cstick_Yaxis
mtlr r3
mr r3,r31
blrl
stfs f1,0x624(r31)

b	REPLAY_LOAD_END_UPDATE_PTR

REPLAY_LOAD_HUMAN:
# store controller byte data back into system input for TE display
sth	r23,2(r25)	# store buttons into "system" input
li r3,0
stb r3,0x1d(r25)	# null R analog byte

lbz	r3,LR_ANALOG(r24)
stb r3,0x1c(r25)	# store L analog byte
extsb	r3,r3
bl TRIGGER_I2F
stfs f1,0x650(r31)	# store L/R analog
lbz	r3,jX(r24)
stb r3,0x18(r25)	# store jX analog byte
extsb	r3,r3
bl JOYSTICK_I2F
stfs f1,0x620(r31)	# store x joystick
lbz	r3,jY(r24)
stb r3,0x19(r25)	# store jX analog byte
extsb	r3,r3
bl JOYSTICK_I2F
stfs f1,0x624(r31)	# store y joystick
lbz	r3,cX(r24)
stb r3,0x1a(r25)	# store cX analog byte
extsb	r3,r3
bl JOYSTICK_I2F
stfs f1,0x638(r31)	# store x c-stick
lbz	r3,cY(r24)
stb r3,0x1b(r25)	# store cY analog byte
extsb	r3,r3
bl JOYSTICK_I2F
stfs f1,0x63c(r31)	# store y c-stick

REPLAY_LOAD_END_UPDATE_PTR:
stw r24,replay_index.dataptr(r29)

li r3,0
lis r4,0x8048
stb	r3,-0x6298(r4)	# store 0 to frame advance...so Z inputs get honored
# needs supplemental code for restoring frame advance flag to default

REPLAY_LOAD_END:
b	END

REPLAY_SAVE:
cmpw	r20,r21	# if current frame is less than replay start index --> reset
blt-	REPLAY_SAVE_RESET_INDEX
#lwz	r22,4(r29)	# load scene frame index
add	r23,r22,r21	# add replay start to replay frame index
cmpw	r20,r23	# replay should be for this current frame or appending to prior frame, else something went wrong
#ble-	REPLAY_SAVE_RESET_INDEX_END
bgt-	REPLAY_SAVE_RESET_INDEX
beq-	REPLAY_SAVE_RESET_INDEX_END # hmm...this line
# match frame number is less than replay end --> reset index to this frame (appending)
sub r22,r20,r21 # subtract current frame from 
b REPLAY_SAVE_RESET_INDEX_END
REPLAY_SAVE_RESET_INDEX:
stw r20,0(r29)	# store current scene frame as new index start
li r22,0
REPLAY_SAVE_RESET_INDEX_END:


REPLAY_SAVE_CONTINUE:	# r22 is still frame index
mullw	r23,r22,r26	# multiply frame index by total per frame
sub	r24,r28,r23	# get to replay data this frame
add	r24,r24,r27	# get to replay data this frame for this character

REPLAY_VALIDATE_POSITION:
bl GET_FREE_RAM_START
cmpw r24,r3		# skip saving if it would override Save State data
ble- END	# report somewhere if this occurs?

# r22 still equals frame index
#lbz r23,4(r29)	# load flag byte
addi r22,r22,1	# increment frame index
stw r22,4(r29)	# store new frame index
#stb	r23,4(r29)	# store flag byte, maybe take this away....?


lis r23,0x8048
lbz	r23,-0x6298(r23)
rlwinm r23,r23,0,31,31 #(00000001)
stb r23,FLAGS(r24)	#
lwz r23,-0x5710(r13)	# load RNG seed
stw r23,RNG(r24)

lwz r3,0x10(r31)
sth r3,AS(r24)
lhz r3,0x894(r31)
sth r3,AS_FRAME(r24)

bl HUMAN_OR_CPU
cmpwi r3,0
beq- REPLAY_SAVE_DATA_HUMAN

REPLAY_SAVE_DATA_CPU:
lbz r3,0x1a90(r31)	# load analog L
lbz r4,0x1a91(r31)	# load analog R
cmpw r3,r4
bge-	REPLAY_SAVE_DATA_CPU_TRIGGER
mr r3,r4
REPLAY_SAVE_DATA_CPU_TRIGGER:	# take larger of the two analog values
stb	r3,LR_ANALOG(r24)
lhz r23,0x1a8a(r31)	# load buttons
sth	r23,BUTTONS(r24)
lwz r23,0x1a8c(r31)	# load joystick and cstick
stw	r23,jX(r24)
b REPLAY_SAVE_END

REPLAY_SAVE_DATA_HUMAN:
lfs f1,0x650(r31)	# load L/R analog chosen
bl	TRIGGER_F2I
stb	r3,LR_ANALOG(r24)
lhz r23,2(r25)	# load buttons
sth	r23,BUTTONS(r24)
lwz r23,0x18(r25)	# load joystick and cstick
stw	r23,jX(r24)

REPLAY_SAVE_END:
stw r24,replay_index.dataptr(r29)
b END

#############
# FUNCTIONS #
#############
GET_TO_REPLAY_DATA:
sub	r22,r20,r21
mullw	r23,r22,r26	# multiply frame index by total per frame
sub	r24,r28,r23	# get to replay data this frame
add	r24,r24,r27	# get to replay data this frame for this character
blr


HUMAN_OR_CPU:
mflr r0
stw r0,4(sp)
stwu sp,-0x8(sp)
lis r3,0x800a
ori r3,r3,0x2040	# CPU or Human check
mtlr r3
mr r3,r31
stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack
blrl
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
lwz r0,0xc(sp)
addi sp,sp,8
mtlr r0
blr

INT_TO_FLOAT:	# r3 input = int, output = f2 = float
xoris	r3,r3,0x8000
lis	r4,0x4330
lfd	f3,-0x7470(rtoc)	# load magic number
stw	r4,0(r2)
stw	r3,4(r2)
lfd	f2,0(r2)
fsubs	f2,f2,f3	#
blr


TRIGGER_F2I:	# input f1 = analog L/R float
mflr r0
stw r0,4(sp)
stwu sp,-0x8(sp)
lis	r3,0x804c	# 804c1f9e joystick and cstick
lbz	r3,0x1f9f(r3)	# load L/R analog normalization byte
bl INT_TO_FLOAT	# get analog resolution as float (can I just force it to be 140 instead of loading byte?)
#lis r3,0x430c	# float 140.0
#stw r3,0(r2)
#lfs f2,0(r2)	# load float 140.0 into fpr
fmuls	f1,f1,f2	# multiply resolution by normalization
fctiwz f1,f1
stfd f1,0(r2)
lwz r3,4(r2)	# load int
lwz r0,0xc(sp)
addi sp,sp,8
mtlr r0
blr

TRIGGER_I2F:	# input r3 = player's L/R analog byte, output f1 = analog L/R float
mflr r0
stw r0,4(sp)
stwu sp,-0x8(sp)
bl INT_TO_FLOAT	# get analog input as float (can I just force it to be 140 instead of loading byte?)
fmr	f31,f2	# f31 = player's input
lis	r3,0x804c	# 804c1f9f analog l/r resolution byte
lbz	r3,0x1f9f(r3)	# load L/R analog normalization byte
bl	INT_TO_FLOAT	# get analog resolution as float (can I just force it to be 140 instead of loading byte?)
fdivs	f1,f31,f2
lwz r0,0xc(sp)
addi sp,sp,8
mtlr r0
blr

JOYSTICK_I2F:	# input r3 = player's L/R analog byte, output f1 = analog L/R float
mflr r0
stw r0,4(sp)
stwu sp,-0x8(sp)
bl INT_TO_FLOAT	# get analog input as float (can I just force it to be 140 instead of loading byte?)
fmr	f31,f2	# f31 = player's input
lis	r3,0x804c	# 804c1f9e joystick and cstick resolution byte
lbz	r3,0x1f9e(r3)	# load joystick analog normalization byte
bl	INT_TO_FLOAT	# get analog resolution as float (can I just force it to be 140 instead of loading byte?)
fdivs	f1,f31,f2
lwz r0,0xc(sp)
addi sp,sp,8
mtlr r0
blr

PLAYER_COUNT_TOTAL:
# no inputs
# output r3 = total number of characters in match (1-indexed)
lwz	r3,-0x3e74(r13)
lwz	r4,0x20(r3) 	# get external data offset of first spawned player
li r5,0
PLAYER_COUNT_TOTAL_LOOP:
addi	r5,r5,1	# increment player counter
lwz	r4,8(r4)	# load next player external data pointer
cmpwi r4,0
bne- PLAYER_COUNT_TOTAL_LOOP
PLAYER_COUNT_TOTAL_END:
mr r3,r5
blr
#------------------

PLAYER_COUNT:
# r3 = external data offset
# output r3 = char spawn number (0-indexed)
lwz	r4,-0x3e74(r13)
lwz	r5,0x20(r4) 	# should get you the first player who was created, external data offset
li r4,0
PLAYER_COUNT_LOOP:
cmpw r5,r3
beq-	PLAYER_COUNT_END
addi	r4,r4,1	# increment player counter
lwz	r5,8(r5)	# load next player external data pointer
b PLAYER_COUNT_LOOP
PLAYER_COUNT_END:
mr r3,r4
blr
#------------------

GET_FREE_RAM_START: # new version, hopefully not problematic. Old version is
# commented in the Save State function
li r3,0	# will be the end of allocation
lis r6,0x8043
ori r6,r6,0x18ac

LOOP2NEXT:
addi r6,r6,12
lwz r9,0(r6)
lwz r7,4(r6)
lwz r8,0x8(r6)
cmpwi r9,0
bne LOOP2
cmpwi r7,0
bne LOOP2
cmpwi r8,0
bne LOOP2
b GET_FREE_RAM_START_END

LOOP2:
add r8,r8,r7
lbz r7,4(r6)
cmpwi r7,0		# a check if bit0 is low might be better?
beq LOOP2NEXT
cmplw r8,r3		# compare unsigned
blt LOOP2NEXT
mr r3,r8	# move new largest end allocation to r3
b LOOP2NEXT
GET_FREE_RAM_START_END:
lwz r4,-0x4330(r13)	# OSGetArenaHi
blr
#----------------------

END:
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space

lfs	f1,0x620(r31)	# load x joystick float, default code line @ 8006af10


**************************

Supplemental Replay Codes
- the following save and load the player's system button inputs
8006ad18 - stwu -0x78(sp)


stwu	sp,-0xc8(sp)

lwz r7,0x2c(r3)
lbz r7,0x618(r7)
mulli r7,r7,0x44
lis r8,0x804c
addi r8,r8,8652
add r7,r7,r8

stw r7,0x7c(sp)
lis r8,0x8048
lwz	r8,-0x6298(r8)	# load flags for frame advance, etc. (really just first byte)
stw r8,0x80(sp)
li r8,0
addi r9,sp,0x84

BUTTON_SAVE_LOOP:
lwzx	r10,r8,r7
stwx	r10,r8,r9

addi r8,r8,4
cmpwi r8,0x44
bne- BUTTON_SAVE_LOOP

END:


------------------


inject @ 8006b820	addi sp,sp,120	# 120 = 0x78

lwz r7,0x7c(sp)

lwz r9,0x80(sp)
lis r8,0x8048
stw	r9,-0x6298(r8)	# load flags for frame advance, etc. (really just first byte)

li r8,0
addi r9,sp,0x84

BUTTON_SAVE_LOOP:
lwzx	r10,r8,r9
stwx	r10,r8,r7

addi r8,r8,4
cmpwi r8,0x44
bne- BUTTON_SAVE_LOOP

END:
lwz r0,0xcc(sp)
addi sp,sp,200




********************
* Game Engine Loop *
********************

80390cfc	
once per frame of scene

Game Engine Loop?

*****************
* Grab Research *
*****************

6% = damage threshold for player to break out of grab on hit
See line 8008ee18

*****************
* Throw Bug Fix *
*****************
inject @ 8008e250


li r6,0 # default code line
lwz r8,0x2c(r24)
lwz r7,0x18c4(r8)
lbz r9,0xc(r8)
cmpw r9,r7
blt- DEFAULT
lwz r7,0x10(r8)
cmpwi r7,0xef
blt- DEFAULT
cmpwi r7,0xf3
bgt- DEFAULT
lis r7,0x3f80
stw r7,0(r2)
lfs f4,0(r2)
lfs f5,0x2340(r8)
fadd	f4,f4,f5
stfs f4,0x2340(r8)


lis r7,0x8006
ori r7,r7,0x93ac
mtlr r7
blrl
lis r7,0x8008
ori r7,r7,0xe260
mtlr r7
blr


DEFAULT:

*****************
* Forward Tilts *
*****************

Ftilts, f-tilts

downangle ftilt - lower than -17 degrees

PlCo - 0x9fe0 +
0x9c is 17 degrees
0xa0 is 10 degrees
0xa4 is -10 degrees
0xa8 is -17 degrees

*********************
* Off-Camera Damage *
*********************

Offscreen damage, bubble damage, offcamera damage

8006a8c8

Bubble 

802fc998	Player_OffCamera_FlagCheck


Disable OffScreen Bubbles (everything...bubble and arrows)
042fb948	4800026c


*********************************
* Hitstun Action State research *
*********************************

8008e118 area

f29 = launch angle
r30 might equal knockback group (31+ hitstun, etc.)
8008e134
	30% chance to go into DamageFlyRoll (0x240)

(0x234) = 1.2217304706573486 = 70 degrees
0x238 = 1.919862151145935 = 110 degrees
0x23c = 0x64 = 100
0x240 = 0.30

DAMAGEFLY ACTION STATE SELECTION

if (70 < attack angle < 110)
	DamageFlyTop

else if (player.damage >= 100){
	if (rand_0_to_1_float() < 0.3)
		DamageFlyRoll 
}

else
		DamageFlyHi/N/Lw // Flinch Animation (flinch from 0=low , 1=mid , 2=high) (Toomai spreadsheet- "zone")

*********************
* Simple Stage Geom *
*********************

Force Simple Background and Stage Geometry [Punkline]
04028d64 60000010
0405a2e8 60000000

FORCE SIMPLE GEOMETRY :


inject @ 80028d64
- executed on match start

lis r6,0x8040
lwz r6,-0x5DE8(r6)
cmpwi r6,0
beq- DEFAULT
ori r0,r0,16
b END
DEFAULT:
rlwimi r0,r30,4,27,27
END:



inject @ 8005A2E8 - bl <800590f4>

lis r3,0x8040
lwz r3,-0x5DE8(r3)
cmpwi r3,0
beq- DEFAULT
lwz r3,-0x6c98(r13)	# load DBLevel
cmpwi r3,0	# is this master mode?
beq- END
DEFAULT:
lis r3,0x8005
ori r3,r3,0x90f4
mtlr r3
blrl
END:

************************
* Develop Mode Toggles *
************************

develop toggles

Disable Y+D-Pad Left/Right Toggles
04226d44 480000a4

above code disables
- Y+D-Pad Left = Super Mushroom Apply
- Y+D-Pad Right = Restore to default size (?)
- Y+A+D-Pad Left = Poison Mushroom Apply
- Y+A+D-Pad Right = ???? (function 800d237c)


Disable B+D-Pad Right Toggle (what does this do???)
04225a70 48000088

Disable D-Pad Down Item Spawn
04226300 480001ac


80229290 - A+Up and B+Up ???

Disable A+Up and B+Up
0422926c 48000324

Develop Mode Lightning Melee Toggle
- change from A+Right to A+Down
04228800 5460077B

Develop Mode Lightning Melee Toggle
- change from A+Right to A+Y+Right
inject @ 802287f0
rlwinm.	r0,r3,0,23,23	# default code line, pressing A?
beq-	NO_INPUT
rlwinm.	r0,r3,0,20,20	# pressing y?
bne-	END
NO_INPUT:
lis r3,0x8022
ori r3,r3,0x880c
mtlr r3
blr
END:

Disable X+D-Pad Left Music/SFX toggle
- disables the bl in the main InGameTogglesMost function
04225924 60000000

Disable B+Down Player Info Toggle (CPU/AI lvl, damage ratios etc)
04226758 48000058

****************
* File Loading *
****************

gamemasterplc - Today at 8:53 PM
I figured out which function you call to load a dat file.
The function is at 0x800163D8 with r3 being the filename pointer without the extension, and r4 being the filename buffer.
It outputs r3 as the pointer to the file

It however uses r5 as a sort of sub-file to load from the DAT

********************************
* Fizzi Smash.gg Stats - EXI B *
********************************

https://github.com/JLaferri/HardwareEnhancedMelee/blob/master/ASM/MatchDataExtraction.asm

#**************************************************************************
#                      Inject at address 8006C0D8
# Unsure what the inject target function does exactly but I do know it ends up calling the
# stock subtraction instructions. It is called once per frame per character. It is also
# called during the score screen
#***************************************************************************

#replaced code line is executed at the end

#***************************************************************************
#                   subroutine: writeStats
#  description: writes stats to EXI port on each frame
#***************************************************************************
#create stack frame and store link register
# !!! New inject address is 8006C0D4
#mflr r0
#stw r0, 0x4(r1)
lis r26,0x8000
lwz r26,0x3364(r26)	# EXI Debug Menu flag @ 80003364 (0 as default on bootup as specified by DOL)
cmpwi r26,0
beq+ GECKO_END

stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack

#check if there are 3 or more players
lis r3,0x8016
ori r3,r3,0xB558 # load CountPlayers function
mtlr r3
blrl
cmpwi r3,3 # 3 or more players in match?
bge- CLEANUP # skip all this if so

#an input to this function is r5, r5 is the pointer of the player currently being considered + 0x60
#skip everything if pointer is not equal to the last players pointer
#the goal of this is to make the update only happen once per frame after the last character update
li r30, 3 #load last player number first
LAST_PLAYER_CHECK:
lis r3, 0x8045
ori r3, r3, 0x3130
mulli r4, r30, 0xE90 #compute address of this player's pointer
add r3, r3, r4
lwz r3, 0x0(r3)
cmpwi r3,0
bne LAST_PLAYER_FOUND #loop through until we find last player in game

subi r30,r30,1 #decrement player id
cmpwi r30,1
bge LAST_PLAYER_CHECK #iterate until potential last player candidates have been checked

LAST_PLAYER_FOUND:
addi r3, r3, 0x60
cmpw r3,r5
bne CLEANUP #if last valid player found does not equal player being considered, skip

#check if in single player mode, and ignore code if so
lis r3,0x801A # load SinglePlayer_Check function
ori r3,r3,0x4340 
mtlr r3 
lis r3,0x8048 
lbz r3,-0x62D0(r3) #load menu controller major
blrl 
cmpwi r3,1 # is this single player mode? 
beq- CLEANUP # if in single player, ignore everything

#check frame count
lis r3,0x8047
lwz r3,-0x493C(r3) # load match frame count
lis r4,0x8048 #check scene controller frame count to make sure it is zero as well (only want to trigger OnStart on very first frame of match)
lwz r4,-0x62A8(r4) # load scene controller frame count

#check scene controller first, if zero it's either start or end of match
cmpwi r4,0
bne PRE_UPDATE_CHECKS

#Here the scene controller is equal to zero, either trigger OnStart or OnEnd
cmpwi r3,0
bne ON_END_EVENT #if match frame count is greater than zero, this is the results screen

#------------- ON_START_EVENT -------------
bl startExiTransfer #indicate transfer start

li r3, 0x37
bl sendByteExi #send OnMatchStart event code

lis r31, 0x8045
ori r31, r31, 0xAC4C

lhz r3, 0x1A(r31) #stage ID half word
bl sendHalfExi

li r30, 0 #load player count

MP_WRITE_PLAYER:
#load character pointer for this player
lis r3, 0x8045
ori r3, r3, 0x3130
mulli r4, r30, 0xE90
add r3, r3, r4
lwz r3, 0x0(r3)

#skip this player if not in game
cmpwi r3, 0
beq MP_INCREMENT

#start writing data
mr r3, r30 #send character port ID
bl sendByteExi

#get start address for this player
lis r31, 0x8045
ori r31, r31, 0xAC4C
mulli r4, r30, 0x24
add r31, r31, r4

lbz r3, 0x6C(r31) #character ID
bl sendByteExi
lbz r3, 0x6D(r31) #player type
bl sendByteExi
lbz r3, 0x6F(r31) #costume ID
bl sendByteExi

MP_INCREMENT:
addi r30, r30, 1
cmpwi r30, 4
blt MP_WRITE_PLAYER

bl endExiTransfer #stop transfer
b CLEANUP

ON_END_EVENT:
#------------- ON_END_EVENT -------------
bl startExiTransfer #indicate transfer start

li r3, 0x39
bl sendByteExi #send OnMatchEnd event code

#check byte that will tell us whether the game was won by stock loss or by ragequit
lis r3, 0x8047
lbz r3, -0x4960(r3)
bl sendByteExi #send win condition byte. this byte will be 0 on ragequit, 3 on win by stock loss

bl endExiTransfer #stop transfer
b CLEANUP

#----------- FRAME_UPDATE_CHECKS -----------
PRE_UPDATE_CHECKS:
#check if we are on game frame zero (countdown freeze time), if so, skip update
cmpwi r3,0
beq CLEANUP

#check if we are in results screen, if so, skip update
lis r3, 0x8045
lbz r3, 0x30C9(r3) #this global address exists for all players and appears to be = 1 when in game and = 0 when in results screen
cmpwi r3, 0
beq CLEANUP

#------------- FRAME_UPDATE -------------
bl startExiTransfer #indicate transfer start

li r3, 0x38
bl sendByteExi #send OnFrameUpdate event code

lis r3,0x8047
lwz r3,-0x493C(r3) #load match frame count
bl sendWordExi

lis r3,0x804D
lwz r3,0x5F90(r3) #load random seed
bl sendWordExi

li r30, 0 #load player count

FU_WRITE_PLAYER:
#load character pointer for this player
lis r3, 0x8045
ori r3, r3, 0x3080
mulli r4, r30, 0xE90
add r29, r3, r4 #load static player memory address into r29
lbz r3,0xc(r29)
rlwinm r3,r3,2,0,29
add	r4,r29,r3
lwz r31,0xb0(r4)
cmpwi r31,0
beq FU_INCREMENT

FU_WRITE_CHAR_BLOCK:
lwz r31,0x2c(r31)	# load internal data offset

lwz r3,0x4(r31) #load internal char ID
bl sendByteExi
lwz r3,0x10(r31) #load action state ID
bl sendHalfExi
lwz r3,0xb0(r31) #load Top-N X coord
bl sendWordExi
lwz r3,0xb4(r31) #load Top-N Y coord
bl sendWordExi
lwz r3,0x620(r31) #load Joystick X axis
bl sendWordExi
lwz r3,0x624(r31) #load Joystick Y axis
bl sendWordExi
lwz r3,0x638(r31) #load c-stick X axis
bl sendWordExi
lwz r3,0x63c(r31) #load c-stick Y axis
bl sendWordExi
lwz r3,0x650(r31) #load analog trigger input
bl sendWordExi
lwz r3,0x65c(r31) #load buttons pressed this frame
bl sendWordExi
lwz r3,0x1830(r31) #load current damage
bl sendWordExi
lwz r3,0x1998(r31) #load shield size
bl sendWordExi
lwz r3,0x208c(r31) #load last attack landed
bl sendByteExi
lhz r3,0x2090(r31) #load combo count
bl sendByteExi
lwz r3,0x18C4(r31) #load player who last hit this player
bl sendByteExi

lbz r3,0x8E(r29) # load stocks remaining
bl sendByteExi

#get raw controller inputs
lis r31, 0x804C
ori r31, r31, 0x1FAC
mulli r3, r30, 0x44
add r31, r31, r3

lhz r3, 0x2(r31) #load constant button presses
bl sendHalfExi
lwz r3,0x30(r31) #load l analog trigger
bl sendWordExi
lwz r3,0x34(r31) #load r analog trigger
bl sendWordExi

FU_INCREMENT:
addi r30, r30, 1
cmpwi r30, 4
blt FU_WRITE_PLAYER

bl endExiTransfer #stop transfer

CLEANUP:
#restore registers and sp
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
b GECKO_END

#***************************************************************************
#                  subroutine: startExiTransfer
#  description: prepares port B exi to be written to
#***************************************************************************
startExiTransfer:
lis r11, 0xCC00 #top bytes of address of EXI registers

#disable read/write protection on memory pages
lhz r10, 0x4010(r11)
ori r10, r10, 0xFF
sth r10, 0x4010(r11) # disable MP3 memory protection

#set up EXI
li r10, 0xB0 #bit pattern to set clock to 8 MHz and enable CS for device 0
stw r10, 0x6814(r11) #start transfer, write to parameter register

blr

#***************************************************************************
#                    subroutine: sendByteExi
#  description: sends one byte over port B exi
#  inputs: r3 byte to send
#  outputs: r3 received byte
#***************************************************************************
sendByteExi:
lis r11, 0xCC00 #top bytes of address of EXI registers
li r10, 0x9 #bit pattern to write to control register to write one byte

#write value in r3 to EXI
slwi r3, r3, 24 #the byte to send has to be left shifted
stw r3, 0x6824(r11) #store current byte into transfer register
stw r10, 0x6820(r11) #write to control register to begin transfer

#wait until byte has been transferred
EXI_CHECK_RECEIVE_WAIT:                
lwz r10, 0x6820(r11)
andi. r10, r10, 1
bne EXI_CHECK_RECEIVE_WAIT

#read values from transfer register to r3 for output
lwz r3, 0x6824(r11) #read from transfer register
srwi r3, r3, 24 #shift byte to the right of the register

blr

#***************************************************************************
#                    subroutine: sendHalfExi
#  description: sends two bytes over port B exi
#  inputs: r3 bytes to send
#  outputs: r3 received bytes
#***************************************************************************
sendHalfExi:
lis r11, 0xCC00 #top bytes of address of EXI registers
li r10, 0x19 #bit pattern to write to control register to write one byte

#write value in r3 to EXI
slwi r3, r3, 16 #the bytes to send have to be left shifted
stw r3, 0x6824(r11) #store bytes into transfer register
stw r10, 0x6820(r11) #write to control register to begin transfer

#wait until byte has been transferred
EXI_CHECK_RECEIVE_WAIT_HALF:                
lwz r10, 0x6820(r11)
andi. r10, r10, 1
bne EXI_CHECK_RECEIVE_WAIT_HALF

#read values from transfer register to r3 for output
lwz r3, 0x6824(r11) #read from transfer register
srwi r3, r3, 16 #shift byte to the right of the register

blr

#***************************************************************************
#                    subroutine: sendWordExi
#  description: sends one word over port B exi
#  inputs: r3 word to send
#  outputs: r3 received word
#***************************************************************************
sendWordExi:
lis r11, 0xCC00 #top bytes of address of EXI registers
li r10, 0x39 #bit pattern to write to control register to write four bytes

#write value in r3 to EXI
stw r3, 0x6824(r11) #store current bytes into transfer register
stw r10, 0x6820(r11) #write to control register to begin transfer

#wait until byte has been transferred
EXI_CHECK_RECEIVE_WAIT_WORD:                
lwz r10, 0x6820(r11)
andi. r10, r10, 1
bne EXI_CHECK_RECEIVE_WAIT_WORD

#read values from transfer register to r3 for output
lwz r3, 0x6824(r11) #read from transfer register

blr

#***************************************************************************
#                  subroutine: endExiTransfer
#  description: stops port B writes
#***************************************************************************
endExiTransfer:
lis r11, 0xCC00 #top bytes of address of EXI registers

li r10, 0
stw r10, 0x6814(r11) #write 0 to the parameter register

blr

GECKO_END:
lmw r26,0x68(sp) #execute replaced code line

***********************
* Killer7 Source Code *
***********************

whattttt

30 FPS is defined in
"I:\Gamecube ISOS\Killer7 GameCube Source Code\killer7\killer7\Src\Wat\WK7Define.h"


-------

HSD_VISetBlack
- does this literally turn the screen black? Executed on screen change

Assembly Functions

OLDNAME			REALNAME
Stage_ColorBodyShadowToCharacter = 
ButtonPresses_ConvertRawInput = HSD_PadRenewMasterStatus

Melee's MObjLoad doesn't include calls to SetToon and SetGradation?


I think pobj is the mesh struct?

-----------------

  Project:  Dolphin OS Multi channel communication API
  File:     mcc.h

MCCSetChannelEventMask
- function @ 8032dcb0
- I had this function marked as "free space" because it was
	interacting with some sort of USB device.

Can I remove all the MCC functions from the game????
file:///D:/GameCube/NINTENDO%20GameCube%20SDK%201.0/man/a-z.html#M


mcc.c functions:

8032c74c 00000084 8032c74c 0 callbackEventStream
8032c7d0 00000078 8032c7d0 0 MCCStreamOpen
8032c848 00000038 8032c848 0 MCCStreamClose
8032c880 000001e0 8032c880 0 MCCStreamWrite
8032ca60 0000011c 8032ca60 0 LoadChannelInfo
8032cb7c 00000104 8032cb7c 0 FlushChannelInfo
8032cc80 00000008 8032cc80 0 SetChannelInfoDirty
8032cc88 000000b8 8032cc88 0 MakeMemoryMap
8032cd40 00000100 8032cd40 0 SearchFreeBlocks
8032cdb0 00000090 8032cdb0 0 zz_032cdb0_
8032ce40 00000108 8032ce40 0 NotifyCompulsorily
8032cf48 00000090 8032cf48 0 WaitAMinute
8032cfd8 00000288 8032cfd8 0 MailboxCheck
8032d260 00000020 8032d260 0 MCCExiCallback
8032d280 0000001c 8032d280 0 MCCTxCallback
8032d29c 0000001c 8032d29c 0 MCCRxCallback
8032d2b8 00000330 8032d2b8 0 mccInitializeCheck
8032d5e8 000002a4 8032d5e8 0 MCCInit
8032d88c 000000c8 8032d88c 0 MCCExit
8032d954 00000058 8032d954 0 MCCEnumDevices
8032d9ac 00000090 8032d9ac 0 MCCGetFreeBlocks
8032da3c 00000008 8032da3c 0 MCCGetLastError
8032da44 000000d0 8032da44 0 MCCGetChannelInfo
8032db14 000000c0 8032db14 0 MCCGetConnectionStatus
8032dbd4 000000dc 8032dbd4 0 MCCNotify
8032dcb0 00000110 8032dcb0 0 MCCSetChannelEventMask
8032dd70 00000050 8032dd70 0 zz_032dd70_
8032ddc0 0000021c 8032ddc0 0 MCCOpen
8032dfdc 000001dc 8032dfdc 0 MCCClose
8032e1b8 0000034c 8032e1b8 0 MCCRead
8032e504 00000364 8032e504 0 MCCWrite
8032e868 0000021c 8032e868 0 MCCCheckAsyncDone

*******************
* PAD Sample Rate *
*******************

4D740C = 0x0000000b	# default

input into the SISetSamplingRate function

**************************
* Dolphin Map in IDA Pro *
**************************

https://smashboards.com/threads/melee-animation-model-workshop.433432/#post-21081262

****************
* Reset Switch *
****************

804C1FA3 - byte
- write something greater than zero to this address to reset the game
- HSD_PadGetResetSwitch

8046b0f4 - anything but zero to this word to reset the game on next scene change
*********************
* Gecko Codehandler *
*********************

condehandleronly.bin

From Dan Salvato on Discord about lines changed:
It's at 0x60
3de0817f 61ef4000
I think that's normally pointing to 800018a8
3de08000 61ef18a8
Like that


*******************
* 20XX Stage Swap *
*******************

Stage swap data starts @ 803FBC80 in RAM (0x3f8c80 DOL)
- each stage entry is 0x30 in length
- order is external stage ID

AAAAAAAA AAAAAAAA CCCCCCCC DDDDDDDD
EEEEEEEE FFFFFFFF GGGGGGGG HHHHHHHH
IIIIIIII JJJJJJJJ KKKKKKKK LLLLLLLL

MnSlMap means the order is MnSlMap.1sd, .2sd, .3sd, .4sd.

A = stage name text (for human reading purposes)
C = stage swap ID (external), MnSlMap bytes
D = custom stage flags, MnSlMap bytes, gets sent to 803fa2e5
E-H = byte overwrite RAM pointer, MnSlMap words
I = byte overwrite value, MnSlMap bytes
J-L = random byte overwrite values (max 4), MnSlMap words (.2sd to .4sd)

Stage Swap
Inject @ 8025bb40

# r20 = location to store new external stage ID
# r21 = external stage ID
# r22 = stage swap table entry start for this stage ID
# r23 = 20XX SSS number (.1sd = 0, .2sd = 1, etc.)

#-----
# Texture:
# r24 = Debug Menu texture flag

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.macro  gpr_save
stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack
.endm

.macro  gpr_restore
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
.endm


.set swap_t.len, 0x30	# swap table index entry length
.set swap_t.loc, 0x803fbc20	# RAM loc for first entry (but first two external IDs unused)
.set swap_t.externalID, 0x8	# external ID swapping
.set swap_t.flag, 0xc	# custom stage flag
.set swap_t.overwrite_pointers, 0x10
.set swap_t.overwrite_byte, 0x20

.set mnslmap.number, 0x803f0a20
.set custom_stage_flag, 0x803fa2e5
.set debug.vs_target, 0x803FA280	# debug menu flag for 20XX VS Target Test

gpr_save

SWAP_START:
mr r20,r3	# original ASM line after this inject is "sth r0,0x1e(r3)"
lbz	r21,0xb(r4)	# default code line - load external stage ID

mulli	r23,r21,swap_t.len
adr_load r22, swap_t.loc
add	r22,r22,r23	# r22 = start of this stage's swap data

byte_load r23, r23, mnslmap.number	#load SSS number from location of MnSlMap.?at
subi	r23,r23,0x31	# convert from ASCII 1-indexed to 0-indexed,
#r23 holds MnSlMap number (1=default)
# MnSlMap.1at = 0, MnSlMap.2at = 1, etc.

addi	r24,r23, swap_t.flag	# add value to get to the custom stage flag byte
lbzx	r24,r24,r22	# load stage flag byte

byte_store r24,r25, custom_stage_flag	# store custom stage flag

addi	r24,r23,swap_t.externalID	# add value to get to stage swap byte
lbzx	r24,r24,r22	# load stage swap byte
cmpwi 	r24,0	# if swap external ID = 0, skip
beq+	SWAP_END

mr	r21,r24	# set as new external stage ID to load

SWAP_DEBUG_TARGET:
cmpwi	r21,0x1a	#Change 0x1a to Debug Target
bne+	SWAP_DEBUG_TARGET_END
word_load r21,r24,debug.vs_target	
addi	r21,r21,0x21
b	SWAP_END
SWAP_DEBUG_TARGET_END:

AERIAL_ARENA:	# note: additional coding is necessary to load aerial arena
cmpwi	r21,0x15	#Change Akaneia to Aerial Arena
bne+	AERIAL_ARENA_END
li	r21,0
AERIAL_ARENA_END:

SWAP_END:

SWAP_BYTE_OVERWRITE:
mulli	r24,r23,0x4	# multiply SSS number by 0x4 (for word length indexing)
addi	r24,r24,swap_t.overwrite_pointers

lwzx	r24,r22,r24	# r24 holds 8-bit overwrite address
cmpwi	r24,0
beq-	SWAP_BYTE_OVERWRITE_END
addi	r25,r23,swap_t.overwrite_byte	# load 8-bit overwrite
lbzx	r25,r25,r22	# load stage overwrite byte
cmpwi	r25,0
beq-	SWAP_BYTE_OVERWRITE_END		# skip writing byte if = 0
cmpwi	r25,0xFF	# FF = flag for using random bytes
bne-	SWAP_BYTE_OVERWRITE_GO

# r24 = pointer to overwrite address

COUNT_RANDOM_BYTES:
cmpwi	r23,0		# no random for MnSlMap.1at
beq-	SWAP_BYTE_OVERWRITE_END
li	r3,0
li	r25,4		# 4 possible random bytes
mtctr	r25
mulli	r25,r23,0x4
addi	r25,r25,swap_t.overwrite_byte	# stage swap table entry offset
	

COUNT_RANDOM_REPEAT:
lbzx	r26,r25,r22
cmpwi	r26,0
beq-	REPEAT_END
addi	r3,r3,1
REPEAT_COMPARE:
addi	r25,r25,1
bdnz+	COUNT_RANDOM_REPEAT

REPEAT_END:		#r3 = number of random bytes
RNG:
adr_blrl r4, 0x80380580

mulli	r25,r23,0x4	# multiply SSS by 0x4 for word indexing
addi	r26,r3,swap_t.overwrite_byte
addi	r26,r26,r25
lbzx	r25,r26,r22	# load random selected overwrite byte

SWAP_BYTE_OVERWRITE_GO:
mr r3,r24
bl BYTE_OVERWRITE_SAVE
stb	r25,0(r24)	# store new overwrite byte
#lis	r26,0x8040
#stw	r24,-0x3DA0(r26)# store stage swap undo flag address
#lbz	r27,0(r24)	# load current byte at address
#stb	r27,-0x3D9C(r26)# store current byte at flag address
#stb	r25,0(r24)	# store new overwrite byte
b END	# skip texture filename changing if byte swapping
SWAP_BYTE_OVERWRITE_END:

TEXTURE_SWAP:
# r20 = location to store new external stage ID
# r21 = external stage ID
# r22 = stage swap table entry start for this stage ID
# r23 = 20XX SSS number (.1sd = 0, .2sd = 1, etc.)

#-----
# Texture:
# r24 = filename string pointer
# r25 = Debug Menu texture flag

mulli r4,r21,12
lis r3,0x803e
ori r3,r3,0x9960
lwzx	r3,r3,r4	# r3 now equals internal stage ID
lis r4,0x803e
subi r4,r4,292
rlwinm r3,r3,2,0,29
lwzx r24,r3,r4	# r24 = pointer to external stage data
lwz	r24,8(r24)	# r24 = pointer to filename ascii
cmpwi r24,0
beq- TEXTURE_SWAP_END

# check for advanced texture hack here based on SSS page?

.set texture.bf, 0x803fa1e8
.set texture.fd, 0x803fa1e4
.set texture.ys, 0x803fa1e0
.set texture.fod, 0x803fa1dc
.set texture.dl, 0x803fa1d8
.set texture.ps, 0x803fa1d4

li r25,0xff	# flag for no Debug Menu texture available
TEXTURE_SWAP_FOD:
cmpwi r21,0x2	# 0x02 = Fountain of Dreams
bne+	TEXTURE_SWAP_FOD_END
word_load r25,r25, texture.fod
TEXTURE_SWAP_FOD_END:
TEXTURE_SWAP_PS:
cmpwi r21,0x3	# 0x03 = Pokemon Stadium
bne+	TEXTURE_SWAP_PS_END
word_load r25,r25, texture.ps
TEXTURE_SWAP_PS_END:
TEXTURE_SWAP_YS:
cmpwi r21,0x8	# 0x08 = Yoshi's Story
bne+	TEXTURE_SWAP_YS_END
word_load r25,r25, texture.ys
TEXTURE_SWAP_YS_END:
TEXTURE_SWAP_DL:
cmpwi r21,0x1c	# 0x1c = Dream Land 64
bne+	TEXTURE_SWAP_DL_END
word_load r25,r25, texture.dl
TEXTURE_SWAP_DL_END:
TEXTURE_SWAP_BF:
cmpwi r21,0x1f	# 0x1f = Battlefield
bne+	TEXTURE_SWAP_BF_END
word_load r25,r25, texture.bf
TEXTURE_SWAP_BF_END:
TEXTURE_SWAP_FD:
cmpwi r21,0x20	# 0x20 = Final Destination
bne+	TEXTURE_SWAP_FD_END
word_load r25,r25, texture.fd
TEXTURE_SWAP_FD_END:

li r31,0	# texture swap counter
cmpwi r25,0xff	# if not 0xFF, then debug menu word flag has been loaded
bne+ TEXTURE_SWAP_GO
b TEXTURE_SWAP_END

TEXTURE_SWAP_GO:
.set texture.random, 0xf	# last in Debug Menu list
mr r26,r25		# r26 = copy of debug menu selection
cmpwi r25,texture.random	# check if random
blt-	TEXTURE_SWAP_SAVE
TEXTURE_SWAP_RANDOM:
li r3,texture.random
adr_blrl r4, 0x80380580
mr r25,r3

TEXTURE_SWAP_SAVE:
CONVERT_TO_ASCII:
cmpwi r25,0xa
bge- CONVERT_TO_ASCII_LETTER
addi r25,r25,0x30
b CONVERT_TO_ASCII_END
CONVERT_TO_ASCII_LETTER:
addi r25,r25,0x37	# 0x41 ASCII = 0xA
CONVERT_TO_ASCII_END:
mr r3,r24	# move ASCII string start to r3
li r4,0x2e	# ASCII "."
.set strchr, 0x80325878
adr_blrl r5, strchr
cmpwi r3,0
bne+ TEXTURE_SWAP_NAME_CHANGE_FOUND
# if "." is not found in filename, change 5th character (/GrP_)
addi r3,r24,4
b TEXTURE_SWAP_NAME_CHANGE_END
TEXTURE_SWAP_NAME_CHANGE_FOUND:
addi r3,r3,1	# store filename byte after period
TEXTURE_SWAP_NAME_CHANGE_END:

addi r31,r31,1	# increment texture swap counter
cmpwi r31,1	# first pass through?
bne- BYTE_OVERWRITE_FIRST_END
bl BYTE_OVERWRITE_SAVE	# save the original overwrite byte
BYTE_OVERWRITE_FIRST_END:
stb r25,0(r3)

VALIDATE_FILENAME:
# Pokemon Stadium ending needs to be added for the check?? Shit
.set filename_copy, 0x80016204	# r3 input = pointer to filename
.set DVDConvertPathToEntrynum, 0x8033796c
mr r3,r24	# move ASCII filename start pointer to r3
gpr_save
adr_blrl r4, filename_copy
adr_blrl r4, DVDConvertPathToEntrynum
gpr_restore
cmpwi r3,-1	# -1 = file doesn't exist
bne- TEXTURE_SWAP_END
cmpwi r26,texture.random	# is RANDOM selected?
blt- TEXTURE_SWAP_DEFAULT
# random was selected, add in a check for certain # of tries?
b TEXTURE_SWAP_RANDOM

TEXTURE_SWAP_DEFAULT:	# specifically selected Debug Menu is false, then load default
li r25,0
b TEXTURE_SWAP_GO	# branch back up with 0 (DEFAULT) selection

TEXTURE_SWAP_END:
b END

BYTE_OVERWRITE_SAVE:
#.set swap_undo.address, 0x803fc260
#.set swap_undo.byte,
# input r3 = pointer to byte overwrite loc
lis	r5,0x8040
stw	r3,-0x3DA0(r5)# store stage swap undo flag address
lbz	r6,0(r3)	# load current byte at address
stb	r6,-0x3D9C(r5)# store current byte at flag address
blr

END:
sth r21,0x1e(r20)	# store external stage ID
adr_load r20, 0x8025bb48	# skip over next code line
mtlr r20

gpr_restore

blr


***********************************
* Target Test Stage Load Research *
***********************************

490960 - CSS Selection Data
(P1)
+0x73
80432084 - low level CSS character selection
	YL	23, next = 15

-------
Stage Select Locs
(bytes)
8043208b
804320df
8046db77
80490ab7
804d49e8




801a4e80


80266bc4	- target test

80266c00	- pressing start on Target Test




801b65a0 writes external stage ID to 80490ab6 (half)
804909d0 holds P1 last selected player --> what character is select to load
- need to search for last select player on CSS, around 80432088 should show currently highlighted


803d5168 - RAM Table
	- External character ID to External Target Test Stage ID
	Entries (0x2 in size):
	0x00 = External Target Test ID
	0x01 = External Character ID

Function 801647f8 converts External character ID to External Target Test ID
	- r3 input = External Character ID

1a36a0 - load instant button inputs (r3 = 4 for all players...from button struct at 80479cf0)
	0x04 = held,
		A = 0x00000100



-0x49aa(r13) # =  4D6CF6 set this byte to 1 to load stage

80266cbc
--------------

Target Test [Pause] Retry Reloads Current Stage
- no longer loads stage based on the selected character
- allows for mismatched Target retries
Inject @ 801b65a0 - sth r3,0xe(r30)

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set menuController_minor, 0x80479d34
.set targetTest_last, 0x80432088
.set TargetTest_flags_stageID, 0x8000336d

byte_load r4,r4,menuController_minor
cmpwi r4,1	# 1 = in a match...so "retrying"
bne- INITIAL
RETRY:
word_load r3,r3,targetTest_last
b END
INITIAL:
byte_load r4,r4,TargetTest_flags_stageID
cmpwi r4,0
beq- END
mr r3,r4
END:
sth r3,0xe(r30)

-----------

inject @ 80266a08

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm


.set buttons_held_all, 0x80479cf4
.set menuController_major, 0x80479d30
.set TargetTest_flags_A_Hold, 0x8000336c
.set TargetTest_flags_stageID, 0x8000336d
.set CSS_char_structs, 0x803f0b24
.set CSS_char_structs.len, 0x1c
.set CSS_cursor_pointer, 0x804a0bc0
.set CSS_selection, 0x8043208c

byte_load r3,r3,menuController_major
cmpwi r3,0xf	# 0xf = Target Test
bne- END_ZERO_HOLD
word_load r3,r3,CSS_selection
cmpwi r3,0x1a	# 
bge- END_ZERO_HOLD
word_load r3,r3,buttons_held_all
rlwinm. r3,r3,0,23,23	# holding A?
beq- END_ZERO_HOLD
byte_load r3,r4,TargetTest_flags_A_Hold
addi r3,r3,1
byte_store r3,r4, TargetTest_flags_A_Hold
cmpwi r3,90	# second and a half
blt- END_ZERO_FLAG
# if holding A for a second and a half
li r5,0	# char struct counter
adr_load	r4, CSS_char_structs

SELECTABLE_LOOP:
mulli r6,r5,CSS_char_structs.len
add r6,r6,r4	# get to this char struct
SELECTABLE_X:
word_load r3,r3,CSS_cursor_pointer
lfs f1,0xc(r3)	# load cursor X
adr_load r7,0x402CCCCD
stw r7,0(r2)
lfs f2,0(r2)
fadd f1,f1,f2

lfs f2,0xc(r6)	# load min X selectable
fcmpo cr0,f1,f2
blt- SELECTABLE_COMPARE
lfs f2,0x10(r6)	# load max X selectable
fcmpo cr0,f1,f2
bgt- SELECTABLE_COMPARE
SELECTABLE_Y:
lfs f1,0x10(r3)	# load cursor Y
lis r7,0x4000
stw r7,0(r2)
lfs f2,0(r2)
fsub f1,f1,f2
lfs f2,0x14(r6)	# load max Y selectable
fcmpo cr0,f1,f2
bgt- SELECTABLE_COMPARE
lfs f2,0x18(r6)	# load min Y selectable
fcmpo cr0,f1,f2
blt- SELECTABLE_COMPARE
FOUND_HOVERING:
li r3,1
stb r3,-0x49aa(r13) # =  4D6CF6 set this byte to 1 to initiate stage load

lbz r3,1(r6)	# load external char ID
adr_blrl r4, 0x801647f8
byte_store r3,r4,TargetTest_flags_stageID
b	END

SELECTABLE_COMPARE:
addi r5,r5,1
cmpwi r5,25
bne- SELECTABLE_LOOP

END_ZERO_HOLD:
li r3,0
byte_store r3,r4,TargetTest_flags_A_Hold
END_ZERO_FLAG:
li r3,0
byte_store r3,r4,TargetTest_flags_stageID
END:
lis r4,0x804a
addi	r31,r4,3008

****************
* Mario Down-B *
****************

Textures a displayed from calls @:

aerial
800e226c

grounded
800e2140


*****************************************
* Marth and Roy Sword Swing File Colors *
*****************************************
Fire emblem sword swing colors
# https://smashboards.com/threads/new-costume-dependent-sword-colors-code-for-marth.432680/#post-21678621

inject @ 8013651c

# ifdef 20XX
.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set DebugMenu.FESwordSwings, 0x803fa2d8
START:
word_load r4,r4,DebugMenu.FESwordSwings
cmpwi r4,0
beq- END
# endif

lwz r4,-0x1EDC(r5)    # internal offset +5D4
lwz r4,0x68(r4)        # load image header offset in costume file
lis r6,0x0002
ori r6,r6,0xbfb4    # load offset to end of costume file - Marth
lwz r3, -0x24AC(r5)     # load CHID
cmpwi r3,0x12    # Marth?
beq+ OFFSET_END
lis r6,0x0002
ori r6,r6,0x5448    # load offset to end of costume file - Roy
OFFSET_END:
add r4,r4,r6
lbz r3, -0x1e97(r5)     # load costume ID
cmpwi r3,0    # 
bne+ BLUE_END
subi r4,r4,4    # Blue Marth costume file is 4 bytes smaller than others
BLUE_END:

lis r6,0x5352
ori r6,r6,0x4742    # "SRGB"
lwz r3,0(r4)        # load ASCII identifier
cmpw r3,r6    # does identifier = "SRGB"
bne- END

# Punkline logic
subi r5,r5,0x10
lbz r3, 4(r4)   # r3 = 1st byte
stb r3, 0(r5)   # store As
lwz r3, 5(r4)
stw r3, 1(r5)   # store Ae R1G1B1
lwz r3, 9(r4)
srwi r3, r3, 8
stw r3, 5(r5)   # store 00 R2G2B2

END:
blr

****************
* Line Drawing *
****************

background color being set @ 80030230

bg color could be implemented here, I believe

Blastzone colors: ffffc0 (255,255,192)
	-0x78a0(rtoc)	# code line 8005a3e0

Camera Limit colors: 80c0c0 (128,192,192)
Character camera box colors: 4040ff (64,64,255)

Always Draw above mentioned boxes

inject @ 800304c8

lis r3,0x8005
ori r3,r3,0xa340	# the draw cam boxes function
mtlr r3
blrl

END:
lis r3,0x8036
ori r3,r3,0x8608
mtlr r3
blrl

---


Always Draw Collision Links
- collision links overlaid on stage
C20304C8 00000005
3C608005 60639e60
7C6803A6 4E800021
3C608036 60638608
7C6803A6 4E800021
60000000 00000000


0x4d80e8 = 25.0 = collision link +z width coord
0x4d80ec = -25.0 = collision link -z width coord

803120e4 is an example of a line primitive

80391a04 --> this function sets up a line primitive
inputs r3 = line/pt width
f1/f2 = x/y coords?

timer
struct {
	half	nVertices
	byte	line width
	//byte	z mode??
	word    timer (match frame count to stop drawing)
	word	color
	pointer vertice_data

}

PRE-DI:	# magenta
00001800
00000000
FF00FFFF
00000000

POST-DI:	# teal
00001000
00000000
00FFFFFF
00000000
----

Initial Test --> Draw vertical line from P1 up

inject @ 800304c8

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.set HSD_CObjGetCurrent, 0x8036a288
.set HSD_LObjSetupInit, 0x80365f28
.set GXSetCullMode, 0x8033d350
.set GXClearVtxDesc, 0x8033c3c8
.set GXSetVtxDesc, 0x8033bf00
.set GXSetVtxAttrFmt, 0x8033c414
.set HSD_CObjGetViewingMtx, 0x803695f0
.set GXSetCurrentMtx, 0x80341510
.set GXLoadPosMtxImm, 0x80341494
.set UnkFunc, 0x80058acc
.set GXSetZMode, 0x80340dc0
.set GXSetLineWidth, 0x8033d240
.set GXBegin, 0x8033d0dc
.set HSD_StateInvalidate, 0x80361fc4

#mflr r0
#stw	r0,4(sp)

stwu	sp,-0xd8(sp)
stfd	f31,0xd0(sp)
stfd	f30,0xc8(sp)
stfd	f29,0xc0(sp)
stfd	f28,0xb8(sp)
stw	r31,0xb4(sp)
stw	r30,0xb0(sp)

adr_blrl r12, HSD_CObjGetCurrent
adr_blrl r12, HSD_LObjSetupInit
li	r3,0
adr_blrl r12, GXSetCullMode
adr_blrl r12, GXClearVtxDesc
li	r3,9
li	r4,1
adr_blrl r12, GXSetVtxDesc
li	r3,0
li	r4,9
li	r5,1
li	r6,4
li	r7,0
adr_blrl r12, GXSetVtxAttrFmt
adr_blrl r12, HSD_CObjGetCurrent
addi	r4,sp,124
adr_blrl r12, HSD_CObjGetViewingMtx
li	r3,0
adr_blrl r12, GXSetCurrentMtx
addi	r3,sp,124
li	r4,0
adr_blrl r12, GXLoadPosMtxImm
lwz r4,-0x789c(r2)	# loads FFFFFF80 (?)
lwz	r0,-0x78a0(r2)	# loads color
addi	r3,sp,44
stw	r4,0x40(sp)
stw	r0,0x2c(sp)
adr_blrl r12, UnkFunc
li	r3,1
li	r4,3
li	r5,0
adr_blrl r12, GXSetZMode
li	r3,16
li	r4,0
adr_blrl r12, GXSetLineWidth
li	r3,0xa8
li	r4,0
li	r5,2
adr_blrl r12, GXBegin
lfs	f0,-0x7990(r2)	# 0
lis	r31,0xcc01

lis r3,0x8045
lwz r3,0x3130(r3)
lfs	f1,0x110(r3)
lfs f2,0x114(r3)

stfs	f1,-0x8000(r31)
stfs	f2,-0x8000(r31)
stfs	f0,-0x8000(r31)

lis	r4,0x43fa
stw	r4,0(r2)
lfs	f2,0(r2)

stfs	f1,-0x8000(r31)
stfs	f2,-0x8000(r31)
stfs	f0,-0x8000(r31)

li r3,-1
adr_blrl r12, HSD_StateInvalidate
#lwz	r0,0xdc(sp)
lfd	f31,0xd0(sp)
lfd	f30,0xc8(sp)
lfd	f29,0xc0(sp)
lfd	f28,0xb8(sp)
lwz	r31,0xb4(sp)
lwz	r30,0xb0(sp)
addi	sp,sp,216

#mtlr	r0
#blr


END:
lis r12,0x8036
ori r12,r12,0x8608
mtlr r12
blrl

----------

DI Draw

inject @ 800304c8

.macro  gpr_save
stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack
.endm

.macro  gpr_restore
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
.endm

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.set HSD_CObjGetCurrent, 0x8036a288
.set HSD_LObjSetupInit, 0x80365f28
.set GXSetCullMode, 0x8033d350
.set GXClearVtxDesc, 0x8033c3c8
.set GXSetVtxDesc, 0x8033bf00
.set GXSetVtxAttrFmt, 0x8033c414
.set HSD_CObjGetViewingMtx, 0x803695f0
.set GXSetCurrentMtx, 0x80341510
.set GXLoadPosMtxImm, 0x80341494
.set UnkFunc, 0x80058acc
.set GXSetZMode, 0x80340dc0
.set GXSetLineWidth, 0x8033d240
.set GXBegin, 0x8033d0dc
.set HSD_StateInvalidate, 0x80361fc4

.set DIStruct.loc, 0x800034f0

.set DIStruct.structlen, 0x14
.set DIStruct.StackLoc, 0xdc

.set DIStruct.nVertices, 0x0
.set DIStruct.index, 0x1
.set DIStruct.LineWidth, 0x2
.set DIStruct.DeathFlag, 0x3
.set DIStruct.FrameTimer, 0x4
.set DIStruct.Color, 0x8
.set DIStruct.VertDataPtr, 0xc
.set DIStruct.CreationFrame, 0x10

.set DIStruct.SDI_vertlength, 0x8
.set DIStruct.SDI_maxverts, 25
.set DIStruct.SDItotalbytes, DIStruct.SDI_vertlength * DIStruct.SDI_maxverts

.set DIStruct.ASDI_vertlength, 0x8
.set DIStruct.ASDI_maxverts, 2
.set DIStruct.ASDItotalbytes, DIStruct.ASDI_vertlength * DIStruct.ASDI_maxverts

.set DIStruct.DI_vertlength, 0x8
.set DIStruct.DI_maxverts, 254
.set DIStruct.DItotalbytes, DIStruct.DI_vertlength * DIStruct.DI_maxverts

.set DIStruct.SDI, 0
.set DIStruct.ASDI, 1
.set DIStruct.PreDI, 2
.set DIStruct.PostDI, 3

.set _HSD_MemAlloc, 0x8037f1e4	# r3 input = number of bytes to allocate
.set sceneFrameCount, 0x80479d60
.set matchFrameCount, 0x8046B6C4

.set _20XXToggleFlag, 0x803FA3D8
.set DebugMenu.DiDrawPostHitstun, 0x803faf50

START:
gpr_save
FIRST_FRAME:
word_load r3,r3,sceneFrameCount
cmpwi r3,1
bne- FIRST_FRAME_END
adr_load r3,DIStruct.loc
FIRST_FRAME_NULL_LOOP:
lwz r4,0(r3)	# load first word of DI Struct, if 0 --> end of DI struct
cmpwi r4,0
beq-	FIRST_FRAME_END
li r4,0
stw	r4,DIStruct.VertDataPtr(r3)
stb	r4,DIStruct.nVertices(r3)
addi r3,r3,DIStruct.structlen
b FIRST_FRAME_NULL_LOOP
FIRST_FRAME_END:

word_load r3,r3, _20XXToggleFlag
cmpwi r3,0
beq- END_20XX_OFF

ALLOC_ENSURE:
li r31,0	# 4 DI structs right now - SDI, ASDI, PRE-DI, POST-DI

ALLOC_ENSURE_LOOP:
adr_load r3,DIStruct.loc
mulli r4,r31,DIStruct.structlen
add	r4,r4,r3
lwz	r3,DIStruct.VertDataPtr(r4)
cmpwi r3,0
bne- ALLOC_ENSURE_COMPARE
cmpwi r31,0
bne- ALLOC_SDI_END
li r3,DIStruct.SDItotalbytes
b ALLOC_ENSURE_GO
ALLOC_SDI_END:
cmpwi r31,1
bne- ALLOC_ASDI_END
li r3,DIStruct.ASDItotalbytes
b ALLOC_ENSURE_GO
ALLOC_ASDI_END:
# default to TDI
li r3,DIStruct.DItotalbytes

ALLOC_ENSURE_GO:
adr_blrl r12,_HSD_MemAlloc
adr_load r5,DIStruct.loc
mulli r4,r31,DIStruct.structlen
add	r4,r4,r5
stw	r3,DIStruct.VertDataPtr(r4)

ALLOC_ENSURE_COMPARE:
addi r31,r31,1
cmpwi r31,4
blt- ALLOC_ENSURE_LOOP
ALLOC_ENSURE_END:


li r31,0
BUTTONS_LOOP:
mr r3,r31
bl BUTTONS_CURRENT_INSTANT
cmpwi r3,0x0800	# holding Y?
bne- BUTTONS_LOOP_COMPARE
cmpwi r4,0x0002	# instant d-pad right?
bne- BUTTONS_LOOP_COMPARE
TOGGLE:
bl TOGGLE_FLAG
mflr r3
li r5,0	# default off
lwz r4,0(r3)	# load current toggle
cmpwi r4,1
beq- TOGGLE_STORE
li r5,0xad	# menu forward SFX
stw	r5,-0x4B0C(r13)	# store SFX ID to play @ 804D6B94 (custom 20XX flag)
li r5,1
TOGGLE_STORE:
stw r5,0(r3)
b BUTTONS_LOOP_END
BUTTONS_LOOP_COMPARE:
addi r31,r31,1
cmpwi r31,4
bne- BUTTONS_LOOP
BUTTONS_LOOP_END:

bl TOGGLE_FLAG
mflr r3
lwz r3,0(r3)
cmpwi r3,0
beq- DI_DRAW_END

li r31,0
DI_DRAW_LOOP:
adr_load r3,DIStruct.loc
mulli r4,r31,DIStruct.structlen
add	r3,r4,r3
lbz	r4,DIStruct.nVertices(r3)
cmpwi r4,0
beq-	DI_DRAW_COMPARE
DRAW_COUNTER:	# check to stop drawing
lwz	r5,DIStruct.FrameTimer(r3)
word_load r4,r4,DebugMenu.DiDrawPostHitstun
cmpwi r4,-1
beq- DRAW_COUNTER_END
add	r5,r5,r4	# add frametimer to post hitstun draw frame count
word_load r4,r4,matchFrameCount
cmpw	r4,r5	# is match frame count >= (timer end + post hitstun frames)
blt-	DRAW_COUNTER_END
DRAW_NULL:
li r4,0
stb r4,DIStruct.nVertices(r3)
b DI_DRAW_COMPARE
DRAW_COUNTER_END:

word_load r4,r4,matchFrameCount
lwz	r5,DIStruct.CreationFrame(r3)
cmpw	r4,r5	# if matchFrameCount < CreationFrameCount --> null
blt- DRAW_NULL

DRAW_COUNTER_SDI:	# SDI is on a per frame basis
cmpwi r31,DIStruct.SDI
bne+ DRAW_COUNTER_SDI_END
# r4 = matchframecount, r5 = creationframe
# when matchframecount = creationframecount, SDI nvertices = 2,index 1
sub	r4,r4,r5	# r4 = matchframecount - creationframecount
addi r4,r4,1
lbz	r5,DIStruct.index(r3)
cmpw r4,r5
bge- DRAW_COUNTER_SDI_END
stb r4,DIStruct.index(r3)
addi r4,r4,1
stb r4,DIStruct.nVertices(r3)
DRAW_COUNTER_SDI_END:


DI_SHOW:
bl	DRAW_DI	# draw pre DI
DI_DRAW_COMPARE:
addi r31,r31,1
cmpwi r31,4
blt- DI_DRAW_LOOP
DI_DRAW_END:
b END


DRAW_DI:	# inputs, r3 = pointer to DI draw struct
mflr r0
stw	r0,4(sp)

#stwu	sp,-0xd8(sp)
stwu	sp,-0xdc(sp)

stw	r3,DIStruct.StackLoc(sp)	# store DI draw struct pointer to stack

stfd	f31,0xd0(sp)
stfd	f30,0xc8(sp)
stfd	f29,0xc0(sp)
stfd	f28,0xb8(sp)
stw	r31,0xb4(sp)
stw	r30,0xb0(sp)

adr_blrl r12, HSD_CObjGetCurrent
adr_blrl r12, HSD_LObjSetupInit
li	r3,0
adr_blrl r12, GXSetCullMode
adr_blrl r12, GXClearVtxDesc
li	r3,9
li	r4,1
adr_blrl r12, GXSetVtxDesc
li	r3,0
li	r4,9
li	r5,1
li	r6,4
li	r7,0
adr_blrl r12, GXSetVtxAttrFmt
adr_blrl r12, HSD_CObjGetCurrent
addi	r4,sp,124
adr_blrl r12, HSD_CObjGetViewingMtx
li	r3,0
adr_blrl r12, GXSetCurrentMtx
addi	r3,sp,124
li	r4,0
adr_blrl r12, GXLoadPosMtxImm
lwz r4,-0x789c(r2)	# loads FFFFFF80 (?)
#lwz	r0,-0x78a0(r2)	# loads real color
lwz	r3,DIStruct.StackLoc(sp)	# load DI draw struct pointer from stack
lwz r0,DIStruct.Color(r3)

####
lbz r3,DIStruct.DeathFlag(r3)
cmpwi r3,0
beq- DEATH_COLOR_END
lis r3,0xff00
ori	r0,r3,0x0000
DEATH_COLOR_END:

addi	r3,sp,44
stw	r4,0x40(sp)
stw	r0,0x2c(sp)
adr_blrl r12, UnkFunc
li	r3,1
li	r4,3
li	r5,0
adr_blrl r12, GXSetZMode
lwz	r3,DIStruct.StackLoc(sp)	# load DI draw struct pointer from stack
lbz r3,DIStruct.LineWidth(r3)
#li	r3,16
li	r4,0
adr_blrl r12, GXSetLineWidth
li	r3,0xb0 # linestrip primitive
li	r4,0
lwz	r5,DIStruct.StackLoc(sp)	# load DI draw struct pointer from stack
lbz r5,DIStruct.nVertices(r5)
adr_blrl r12, GXBegin

lwz	r3,DIStruct.StackLoc(sp)	# load DI draw struct pointer from stack
lbz r4,DIStruct.nVertices(r3)
mtctr r4

lwz r3,DIStruct.VertDataPtr(r3)

subi r3,r3,0x8
VERTICE_LOOP:
addi r3,r3,0x8
lfs f1,0(r3)
lfs f2,4(r3)

lis	r31,0xcc01
stfs	f1,-0x8000(r31)
stfs	f2,-0x8000(r31)
lfs		f0,-0x778c(r2)	# load 0
stfs	f0,-0x8000(r31)	# store Z-axis
bdnz+	VERTICE_LOOP

li r3,-1
adr_blrl r12, HSD_StateInvalidate
lwz	r0,0xe0(sp)
lfd	f31,0xd0(sp)
lfd	f30,0xc8(sp)
lfd	f29,0xc0(sp)
lfd	f28,0xb8(sp)
lwz	r31,0xb4(sp)
lwz	r30,0xb0(sp)
addi	sp,sp,0xdc

mtlr	r0
blr

#------------------

BUTTONS_CURRENT_INSTANT:
.set buttons.adr, 0x804c1fac
mulli r5,r3,0x44 # button offsets are 0x44 apart
adr_load r4, buttons.adr
add	r4,r4,r5
lhz	r3,2(r4)	# load current buttons (exclude joystick)
lhz	r4,0xa(r4)	# load instant buttons (exclude joystick)
xor r3,r3,r4	# current buttons do not include instants
blr

#-----------------
TOGGLE_FLAG:
blrl
.long 0x00000000

#---------------

END_20XX_OFF:
bl TOGGLE_FLAG
mflr r3
li r4,0
stw r4,0(r3)

END:
gpr_restore
lis r12,0x8036
ori r12,r12,0x8608
mtlr r12
blrl





-----------

TopN Location Prediction - Pre-DI (No DI)

inject @ 8008e5c4 - mr r31,r3

.macro  gpr_save
stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack
.endm

.macro  gpr_restore
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
.endm

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm


.set atan2, 0x80022c30
.set cos, 0x80326240
.set sin, 0x803263d4

.set AngleCos, 0x8
.set AngleSin, 0xc
.set CHARxVel, 0x10
.set CHARyVel, 0x14
.set KBxVel, 0x18
.set KByVel, 0x1C
.set TopNx, 0x20
.set TopNy, 0x24
.set RegStore,0x28


.set DIStruct.StackLoc, 0xdc

.set DIStruct.nVertices, 0x0
.set DIStruct.index, 0x1
.set DIStruct.LineWidth, 0x2
.set DIStruct.DeathFlag, 0x3
.set DIStruct.FrameTimer, 0x4
.set DIStruct.Color, 0x8
.set DIStruct.VertDataPtr, 0xc
.set DIStruct.CreationFrame, 0x10

.set DIStruct.SDI, 0
.set DIStruct.ASDI, 1
.set DIStruct.PreDI, 2
.set DIStruct.PostDI, 3

.set DIStruct.PreDI.Loc, DIStruct.PreDI * DIStruct.structlen + DIStruct.loc
.set DIStruct.PostDI.Loc, DIStruct.PostDI * DIStruct.structlen + DIStruct.loc

.set DIStruct.DI_maxverts, 254

.set DIStruct.loc, 0x800034f0
.set DIStruct.structlen, 0x14

.set DIStruct.PreDI_offset, DIStruct.structlen * DIStruct.PreDI
.set matchFrameCount, 0x8046B6C4

.set _20XXToggleFlag, 0x803FA3D8

START:
gpr_save
mr r31,r3	# default code line

word_load r3,r3,_20XXToggleFlag
cmpwi r3,0
beq-	END

adr_load r4,DIStruct.PreDI.Loc
lwz	r3,DIStruct.VertDataPtr(r4)
cmpwi r3,0	# has vert data memory been allocated?
beq-	END

lwz r3,0xe0(r31)	# load air/ground flag
cmpwi r3,0	# skip if on ground
beq- END

stwu	sp,-0xd8(sp)

lwz	r3,0xb0(r31)
stw	r3,TopNx(sp)
lwz	r3,0xb4(r31)
stw	r3,TopNy(sp)

lwz	r3,0x80(r31)
stw	r3,CHARxVel(sp)
lwz	r3,0x84(r31)
stw	r3,CHARyVel(sp)

lfs	f1,0x90(r31)
stfs f1, KByVel(sp)
lfs f2,0x8c(r31)
stfs f2, KBxVel(sp)
adr_blrl r12, atan2
# f1 holds angle
fmr f31,f1
adr_blrl r12, cos
stfs f1,AngleCos(sp)
fmr	f1,f31
adr_blrl r12, sin
stfs f1,AngleSin(sp)


lfs f1,0x2340(r31)	# load (float) frames of hitstun left
fctiwz f1,f1	# convert float to int
stfd f1,0(r2)
lwz r30,4(r2)	# load (int) frames of hitstun remaining
HITSTUN_CHECK_NONE:
cmpwi r30,1
bgt- HITSTUN_CHECK_NONE_END
adr_load r4,DIStruct.PreDI.Loc
li r30,0
stb r30,DIStruct.nVertices(r4)
b END_CLEANUP
HITSTUN_CHECK_NONE_END:

subi	r30,r30,1

THROW_PRIORITY_CHECK:
lwz r3,-0x3e68(r13)
cmpwi r3,0
beq- THROW_PRIORITY_END
lwz r3,0x10(r3)
lwz r4,0(r31)
cmpw r3,r4
beq+ THROW_PRIORITY_END
lwz r3,0x2c(r3)
lbz r4,0xc(r3)
lbz r5,0xc(r31)
cmpw r5,r4
bgt-  THROW_PRIORITY_END
THROW_PRIORITY_SUBTRACT:
addi r30,r30,1	# subtract one frame for port priority
THROW_PRIORITY_END:


CHECK_MAX:
cmpwi r30,DIStruct.DI_maxverts - 1
blt- CHECK_MAX_END
li r30, DIStruct.DI_maxverts - 1
CHECK_MAX_END:
mtctr	r30


adr_load r4,DIStruct.PreDI.Loc

li r3,0
stb r3,DIStruct.DeathFlag(r4)	# set Deathflag to false

mr r3,r30
addi r3,r3,1
stb r3,DIStruct.nVertices(r4)	# store nVertices

word_load r3,r3,matchFrameCount	# load match frame count
stw r3,DIStruct.CreationFrame(r4)
add	r3,r3,r30	# add frames of hitstun to match frame count
#subi	r3,r3,1
# !! Add Debug Menu option to hold frame count here
stw	r3,DIStruct.FrameTimer(r4)

lwz	r4,DIStruct.VertDataPtr(r4)

lwz	r3,TopNx(sp)
stw	r3,0(r4)
lwz	r3,TopNy(sp)
stw	r3,4(r4)

li r30,1
LOOP:
lwz	r3,-0x514c(r13)	# PlCo.dat pointer

lfs f1,KBxVel(sp)
fmuls	f2,f1,f1
lfs f1,KByVel(sp)
fmadds	f3,f1,f1,f2
lfs	f2,0x204(r3)	# load 0.051
fcmpo cr0,f3,f2
bge- KB_VEL_CHECK_END
li r4,0
stw r4,KBxVel(sp)
stw r4,KByVel(sp)
b KB_VEL_END
KB_VEL_CHECK_END:

# KB X Velocity
lfs f1,AngleCos(sp)
#lwz	r3,-0x514c(r13)
lfs f0,KBxVel(sp)
lfs	f2,0x204(r3)	# load 0.051
fnmsubs	f0,f2,f1,f0
stfs f0,KBxVel(sp)

# KB Y Velocity
lfs f1,AngleSin(sp)
#lwz	r3,-0x514c(r13)
lfs f0,KByVel(sp)
lfs	f2,0x204(r3)	# load 0.051
fnmsubs	f0,f2,f1,f0
stfs f0,KByVel(sp)
KB_VEL_END:

# Char Y velocity
lfs	f1,CHARyVel(sp)
lfs	f2,0x16c(r31)	# load gravity --> positive quant
fsub f1,f1,f2
lfs f2,0x170(r31)	# load terminal velocity --> positive quant
fneg f2,f2			# make terminal velocity negative
fcmpo cr0,f1,f2
bge- STORE_CHARY
fmr	f1,f2	# move terminal to new chary vel
STORE_CHARY:
stfs f1,CHARyVel(sp)

# Char X? Does this exist when getting hit?

lfs	f1,TopNx(sp)
lfs f0,KBxVel(sp)
fadd	f1,f1,f0
lfs f0,CHARxVel(sp)
fadd	f1,f1,f0
stfs	f1,TopNx(sp)

lfs	f1,TopNy(sp)
lfs f0,KByVel(sp)
fadd	f1,f1,f0
lfs f0,CHARyVel(sp)
fadd	f1,f1,f0
stfs	f1,TopNy(sp)


adr_load r4,DIStruct.PreDI.Loc
lwz	r4,DIStruct.VertDataPtr(r4)
mulli	r5,r30,0x8
add	r4,r5,r4
lfs	f1,TopNx(sp)
stfs	f1,0(r4)
lfs	f1,TopNy(sp)
stfs	f1,4(r4)

########
# Death Check
.set BlastzoneRight, 0x80224b38
.set BlastzoneLeft, 0x80224b50
.set BlastzoneTop, 0x80224b68
.set BlastzoneBot, 0x80224b80

adr_blrl r12, BlastzoneRight
lfs f0,TopNx(sp)
fcmpo cr0,f0,f1
bgt- DEATH_CONFIRM
adr_blrl r12, BlastzoneLeft
lfs f0,TopNx(sp)
fcmpo cr0,f0,f1
blt- DEATH_CONFIRM
adr_blrl r12, BlastzoneBot
lfs f0,TopNy(sp)
fcmpo cr0,f0,f1
blt- DEATH_CONFIRM
adr_blrl r12, BlastzoneTop
lfs f0,TopNy(sp)
fcmpo cr0,f0,f1
ble- DEATH_CHECK_END
lwz	r3,-0x514c(r13)
lfs f0,0x4f0(r3)
lfs f1,KByVel(sp)
fcmpo cr0,f1,f0
ble- DEATH_CHECK_END

DEATH_CONFIRM:
li r3,1
adr_load r4,DIStruct.PreDI.Loc
stb	r3,DIStruct.DeathFlag(r4)
DEATH_CHECK_END:

addi r30,r30,1
bdnz+ LOOP


END_CLEANUP:
addi	sp,sp,216
END:
#gpr_restore
#mr r3,r31
mr r3,r31	# 4/20/17 fix for viewing in Magus physics
gpr_restore
mr r31,r3

---------------

--> POST-DI <--
// Note: 

inject @ 8008e6f0 - lwz	r0,0x5c(sp)

.macro  gpr_save
stwu	r1,-64(r1)	# make space for 12 registers
stmw	r20,8(r1)	# push r20-r31 onto the stack
.endm

.macro  gpr_restore
lmw	r20,8(r1)	# pop r20-r31 off the stack
addi	r1,r1,64	# release the space
.endm

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm


.set atan2, 0x80022c30
.set cos, 0x80326240
.set sin, 0x803263d4

.set AngleCos, 0x8
.set AngleSin, 0xc
.set CHARxVel, 0x10
.set CHARyVel, 0x14
.set KBxVel, 0x18
.set KByVel, 0x1C
.set TopNx, 0x20
.set TopNy, 0x24
.set RegStore,0x28

.set DIStruct.structlen, 0x14
.set DIStruct.StackLoc, 0xdc

.set DIStruct.nVertices, 0x0
.set DIStruct.index, 0x1
.set DIStruct.LineWidth, 0x2
.set DIStruct.DeathFlag, 0x3
.set DIStruct.FrameTimer, 0x4
.set DIStruct.Color, 0x8
.set DIStruct.VertDataPtr, 0xc
.set DIStruct.CreationFrame, 0x10

.set DIStruct.SDI, 0
.set DIStruct.ASDI, 1
.set DIStruct.PreDI, 2
.set DIStruct.PostDI, 3

.set DIStruct.PreDI.Loc, DIStruct.PreDI * DIStruct.structlen + DIStruct.loc
.set DIStruct.PostDI.Loc, DIStruct.PostDI * DIStruct.structlen + DIStruct.loc

.set DIStruct.DI_maxverts, 254

.set DIStruct.loc, 0x800034f0
.set DIStruct.structlen, 0x10

.set DIStruct.PostDI_offset, DIStruct.structlen * DIStruct.PostDI
.set matchFrameCount, 0x8046B6C4

.set _20XXToggleFlag, 0x803FA3D8

START:
gpr_save
word_load r3,r3,_20XXToggleFlag
cmpwi r3,0
beq-	END

adr_load r4,DIStruct.PostDI.Loc
lwz	r3,DIStruct.VertDataPtr(r4)
cmpwi r3,0	# has vert data memory been allocated?
beq-	END

lwz r3,0xe0(r31)	# load air/ground flag
cmpwi r3,0	# skip if on ground
beq- END
stwu	sp,-0xd8(sp)

lwz	r3,0xb0(r31)
stw	r3,TopNx(sp)
lwz	r3,0xb4(r31)
stw	r3,TopNy(sp)

lwz	r3,0x80(r31)
stw	r3,CHARxVel(sp)
lwz	r3,0x84(r31)
stw	r3,CHARyVel(sp)

lfs	f1,0x90(r31)
stfs f1, KByVel(sp)
lfs f2,0x8c(r31)
stfs f2, KBxVel(sp)
adr_blrl r12, atan2
# f1 holds angle
fmr f31,f1
adr_blrl r12, cos
stfs f1,AngleCos(sp)
fmr	f1,f31
adr_blrl r12, sin
stfs f1,AngleSin(sp)


lfs f1,0x2340(r31)	# load (float) frames of hitstun left
fctiwz f1,f1	# convert float to int
stfd f1,0(r2)
lwz r30,4(r2)	# load (int) frames of hitstun remaining
HITSTUN_CHECK_NONE:
cmpwi r30,1
bgt- HITSTUN_CHECK_NONE_END
adr_load r4,DIStruct.PostDI.Loc
li r30,0
stb r30,DIStruct.nVertices(r4)
b END_CLEANUP
HITSTUN_CHECK_NONE_END:
subi	r30,r30,1

THROW_PRIORITY_CHECK:
lwz r3,-0x3e68(r13)
cmpwi r3,0
beq- THROW_PRIORITY_END
lwz r3,0x10(r3)
lwz r4,0(r31)
cmpw r3,r4
beq+ THROW_PRIORITY_END
lwz r3,0x2c(r3)
lbz r4,0xc(r3)
lbz r5,0xc(r31)
cmpw r5,r4
bgt-  THROW_PRIORITY_END
THROW_PRIORITY_SUBTRACT:
addi r30,r30,1	# subtract one frame for port priority
THROW_PRIORITY_END:


CHECK_MAX:
cmpwi r30,DIStruct.DI_maxverts - 1
blt- CHECK_MAX_END
li r30, DIStruct.DI_maxverts - 1
CHECK_MAX_END:

mtctr	r30


adr_load r4,DIStruct.PostDI.Loc
li r3,0
stb r3,DIStruct.DeathFlag(r4)	# set Deathflag to false

mr r3,r30
addi r3,r3,1
stb r3,DIStruct.nVertices(r4)	# store nVertices

word_load r3,r3,matchFrameCount	# load match frame count
stw r3,DIStruct.CreationFrame(r4)
add	r3,r3,r30	# add frames of hitstun to match frame count
stw	r3,DIStruct.FrameTimer(r4)

lwz	r4,DIStruct.VertDataPtr(r4)

lwz	r3,TopNx(sp)
stw	r3,0(r4)
lwz	r3,TopNy(sp)
stw	r3,4(r4)

li r30,1
LOOP:
lwz	r3,-0x514c(r13)	# PlCo.dat pointer

lfs f1,KBxVel(sp)
fmuls	f2,f1,f1
lfs f1,KByVel(sp)
fmadds	f3,f1,f1,f2
lfs	f2,0x204(r3)	# load 0.051
fcmpo cr0,f3,f2
bge- KB_VEL_CHECK_END
li r4,0
stw r4,KBxVel(sp)
stw r4,KByVel(sp)
b KB_VEL_END
KB_VEL_CHECK_END:

# KB X Velocity
lfs f1,AngleCos(sp)
#lwz	r3,-0x514c(r13)
lfs f0,KBxVel(sp)
lfs	f2,0x204(r3)	# load 0.051
fnmsubs	f0,f2,f1,f0
stfs f0,KBxVel(sp)

# KB Y Velocity
lfs f1,AngleSin(sp)
#lwz	r3,-0x514c(r13)
lfs f0,KByVel(sp)
lfs	f2,0x204(r3)	# load 0.051
fnmsubs	f0,f2,f1,f0
stfs f0,KByVel(sp)
KB_VEL_END:

# Char Y velocity
lfs	f1,CHARyVel(sp)
lfs	f2,0x16c(r31)	# load gravity --> positive quant
fsub f1,f1,f2
lfs f2,0x170(r31)	# load terminal velocity --> positive quant
fneg f2,f2			# make terminal velocity negative
fcmpo cr0,f1,f2
bge- STORE_CHARY
fmr	f1,f2	# move terminal to new chary vel
STORE_CHARY:
stfs f1,CHARyVel(sp)

# Char X? Does this exist when getting hit?

lfs	f1,TopNx(sp)
lfs f0,KBxVel(sp)
fadd	f1,f1,f0
lfs f0,CHARxVel(sp)
fadd	f1,f1,f0
stfs	f1,TopNx(sp)

lfs	f1,TopNy(sp)
lfs f0,KByVel(sp)
fadd	f1,f1,f0
lfs f0,CHARyVel(sp)
fadd	f1,f1,f0
stfs	f1,TopNy(sp)


adr_load r4,DIStruct.PostDI.Loc
lwz	r4,DIStruct.VertDataPtr(r4)
mulli	r5,r30,0x8
add	r4,r5,r4
lfs	f1,TopNx(sp)
stfs	f1,0(r4)
lfs	f1,TopNy(sp)
stfs	f1,4(r4)


########
# Death Check
.set BlastzoneRight, 0x80224b38
.set BlastzoneLeft, 0x80224b50
.set BlastzoneTop, 0x80224b68
.set BlastzoneBot, 0x80224b80

adr_blrl r12, BlastzoneRight
lfs f0,TopNx(sp)
fcmpo cr0,f0,f1
bgt- DEATH_CONFIRM
adr_blrl r12, BlastzoneLeft
lfs f0,TopNx(sp)
fcmpo cr0,f0,f1
blt- DEATH_CONFIRM
adr_blrl r12, BlastzoneBot
lfs f0,TopNy(sp)
fcmpo cr0,f0,f1
blt- DEATH_CONFIRM
adr_blrl r12, BlastzoneTop
lfs f0,TopNy(sp)
fcmpo cr0,f0,f1
ble- DEATH_CHECK_END
lwz	r3,-0x514c(r13)
lfs f0,0x4f0(r3)
lfs f1,KByVel(sp)
fcmpo cr0,f1,f0
ble- DEATH_CHECK_END

DEATH_CONFIRM:
li r3,1
adr_load r4,DIStruct.PostDI.Loc
stb	r3,DIStruct.DeathFlag(r4)
DEATH_CHECK_END:

addi r30,r30,1
bdnz+ LOOP

END_CLEANUP:
addi	sp,sp,216
END:
gpr_restore
lwz	r0,0x5c(sp)	# default code line


----------------


Smash DI

inject @ 8008e500 - lbz r0,0x221a(r3)

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm




.set DIStruct.SDIloc, 0x800034f0
.set DIStruct.structlen, 0x14

.set DIStruct.nVertices, 0x0

.set DIStruct.index, 0x1

.set DIStruct.LineWidth, 0x2
.set DIStruct.DeathFlag, 0x3
.set DIStruct.FrameTimer, 0x4
.set DIStruct.Color, 0x8
.set DIStruct.VertDataPtr, 0xc
.set DIStruct.CreationFrame, 0x10

.set DIStruct.vertlength, 0x8
.set DIStruct.maxSDIverts, 25
.set DIStruct.totalbytes, DIStruct.vertlength * DIStruct.maxSDIverts

.set _HSD_MemAlloc, 0x8037f1e4	# r3 input = number of bytes to allocate
.set sceneFrameCount, 0x80479d60
.set matchFrameCount, 0x8046B6C4
.set timerHUD, 0x8046B6C8
.set screenState, 0x80479D68

.set _20XXToggleFlag, 0x803FA3D8
.set stackpos, 8


stwu	sp,-0xc(sp)
stw	r3,stackpos(sp)
lbz r0,0x221a(r3)
rlwinm. r0,r0,27,31,31
beq- END

word_load r3,r3,_20XXToggleFlag
cmpwi r3,0
beq-	END

adr_load r4,DIStruct.SDIloc
lwz	r3,DIStruct.VertDataPtr(r4)
cmpwi r3,0	# has vert data memory been allocated?
beq-	END
SDI_ALLOC_END:

lwz r3,stackpos(sp)	# load internal data struct
lfs f1,0x2340(r3)	# load (float) frames of hitstun left
fctiwz f1,f1	# convert float to int
stfd f1,0(r2)
lwz r5,4(r2)	# load (int) frames of hitstun remaining
lfs f1,0x195c(r3)	# load (float) frames of hitlag left
fctiwz f1,f1	# convert float to int
stfd f1,0(r2)
lwz r6,4(r2)	# load (int) frames of hitlag remaining
add	r5,r6,r5	# total hitstun + hitlag
#lbz r6,DIStruct.index(r4)
#add	r5,r5,r6

subi	r5,r5,1	# !!! subtraction
SDI_INDEX_RESET:	#r4 = SDI struct start
word_load r6,r6,matchFrameCount
add	r5,r5,r6

lwz r6,DIStruct.FrameTimer(r4)
stw r5,DIStruct.FrameTimer(r4)	# store new frame timer
cmpw	r5,r6
beq- SDI_INDEX_RESET_END

SDI_INDEX_RESET_GO:
li r5,0
stb r5,DIStruct.index(r4)
stb r5,DIStruct.nVertices(r4)
word_load r5,r5,matchFrameCount
stw r5,DIStruct.CreationFrame(r4)
SDI_INDEX_RESET_END:

SDI_TOPN_STORE:
lwz	r5,DIStruct.VertDataPtr(r4)
lbz	r6,DIStruct.index(r4)
cmpwi r6,DIStruct.maxSDIverts - 1
bge- END
mulli r6,r6,DIStruct.vertlength
add	r5,r5,r6	# r5 = location for this vert data
lwz	r6,0xb0(r3)
stw	r6,0(r5)	# store TopN_x
lwz r6,0xb4(r3)
stw r6,4(r5)	# store TopN_y

lbz r6,DIStruct.index(r4)
cmpwi r6,0
bne- SDI_INDEX_ZERO_END
lbz r6,DIStruct.nVertices(r4)
addi r6,r6,1	# increment vertice count
stb r6,DIStruct.nVertices(r4)
SDI_INDEX_ZERO_END:
lbz r6,DIStruct.index(r4)
addi r6,r6,1	# increment index
stb r6,DIStruct.index(r4)

END:
lwz	r3,stackpos(sp)
addi	sp,sp,0xc
lbz r0,0x221a(r3)	# default code line

--------------------

POST-SDI

inject @ 8008e594 - lwz r0,0xc(sp)
- r31 = internal data offset


.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.set DIStruct.SDIloc, 0x800034f0
.set DIStruct.structlen, 0x14

.set DIStruct.nVertices, 0x0

.set DIStruct.index, 0x1

.set DIStruct.LineWidth, 0x2
.set DIStruct.DeathFlag, 0x3
.set DIStruct.FrameTimer, 0x4
.set DIStruct.Color, 0x8
.set DIStruct.VertDataPtr, 0xc
.set DIStruct.CreationFrame, 0x10

.set DIStruct.vertlength, 0x8
.set DIStruct.maxSDIverts, 25
.set DIStruct.totalbytes, DIStruct.vertlength * DIStruct.maxSDIverts

.set _HSD_MemAlloc, 0x8037f1e4	# r3 input = number of bytes to allocate
.set sceneFrameCount, 0x80479d60
.set matchFrameCount, 0x8046B6C4
.set timerHUD, 0x8046B6C8
.set screenState, 0x80479D68

.set _20XXToggleFlag, 0x803FA3D8
.set stackpos, 8

lbz r0,0x221a(r31)
rlwinm. r0,r0,27,31,31
beq- END

word_load r3,r3,_20XXToggleFlag
cmpwi r3,0
beq-	END

adr_load r3,DIStruct.SDIloc
lwz r4,DIStruct.VertDataPtr(r3)
cmpwi r4,0
beq- END

lbz r4,DIStruct.nVertices(r3)
cmpwi r4,DIStruct.maxSDIverts - 1	# don't go past the max
bge- END
addi r4,r4,1	# increment nVertices
stb r4,DIStruct.nVertices(r3)
lbz r4,DIStruct.index(r3)
mulli r4,r4,DIStruct.vertlength
lwz r5,DIStruct.VertDataPtr(r3)
add	r4,r4,r5	# get to this index data

lwz	r5,0xb0(r31)
stw	r5,0(r4)	# store TopN_x
lwz r5,0xb4(r31)
stw r5,4(r4)	# store TopN_y

END:
lwz r0,0xc(sp)	# default code line

-----------

Pre-ASDI
inject @ 8008e738 - lwz r3,-0x514c(r13)


.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.set DIStruct.SDI, 0
.set DIStruct.ASDI, 1
.set DIStruct.PreDI, 2
.set DIStruct.PostDI, 3

.set DIStruct.loc, 0x800034f0
.set DIStruct.structlen, 0x14

.set DIStruct.ASDI.Loc, DIStruct.structlen * DIStruct.ASDI + DIStruct.loc

.set DIStruct.nVertices, 0x0

.set DIStruct.index, 0x1

.set DIStruct.LineWidth, 0x2
.set DIStruct.DeathFlag, 0x3
.set DIStruct.FrameTimer, 0x4
.set DIStruct.Color, 0x8
.set DIStruct.VertDataPtr, 0xc
.set DIStruct.CreationFrame, 0x10

.set sceneFrameCount, 0x80479d60
.set matchFrameCount, 0x8046B6C4

.set _20XXToggleFlag, 0x803FA3D8

START:
word_load r3,r3,_20XXToggleFlag
cmpwi r3,0
beq-	END

adr_load r3,DIStruct.ASDI.Loc
lwz	r4,DIStruct.VertDataPtr(r3)
cmpwi r4,0	# has vert data memory been allocated?
beq-	END

word_load r5,r5,matchFrameCount
stw r5,DIStruct.CreationFrame(r3)

li r5,2
stb r5,DIStruct.nVertices(r3)

lwz r5,0xb0(r31)
stw r5,0(r4)
lwz r5,0xb4(r31)
stw r5,4(r4)

lfs f1,0x2340(r31)	# load (float) frames of hitstun left
fctiwz f1,f1	# convert float to int
stfd f1,0(r2)
lwz r4,4(r2)	# load (int) frames of hitstun remaining
subi r4,r4,1
word_load r5,r5,matchFrameCount
add	r4,r4,r5
stw	r4,DIStruct.FrameTimer(r3)

END:
lwz r3,-0x514c(r13)

------------

Post-ASDI

inject @ 8008e7f4 - lwz r0,0x2344(r31)


.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.set DIStruct.SDI, 0
.set DIStruct.ASDI, 1
.set DIStruct.PreDI, 2
.set DIStruct.PostDI, 3

.set DIStruct.loc, 0x800034f0
.set DIStruct.structlen, 0x14

.set DIStruct.ASDI.Loc, DIStruct.structlen * DIStruct.ASDI + DIStruct.loc

.set DIStruct.nVertices, 0x0

.set DIStruct.index, 0x1

.set DIStruct.LineWidth, 0x2
.set DIStruct.DeathFlag, 0x3
.set DIStruct.FrameTimer, 0x4
.set DIStruct.Color, 0x8
.set DIStruct.VertDataPtr, 0xc
.set DIStruct.CreationFrame, 0x10

.set sceneFrameCount, 0x80479d60
.set matchFrameCount, 0x8046B6C4

.set _20XXToggleFlag, 0x803FA3D8

START:
word_load r3,r3,_20XXToggleFlag
cmpwi r3,0
beq-	END

adr_load r3,DIStruct.ASDI.Loc
lwz	r4,DIStruct.VertDataPtr(r3)
cmpwi r4,0	# has vert data memory been allocated?
beq-	END

lwz r5,0xb0(r31)
stw r5,8(r4)
lwz r5,0xb4(r31)
stw r5,0xc(r4)

END:
lwz r0,0x2344(r31)	# default code line


----------------------

DI Draw Port Priority Fix Testing

DI Trajectory
when thrown
lr = 800de83c
r30 = external player who is throwing...not sure if this is always true
r31 = 


thrower is in throw animation

0x1198 holds external data offset
0x234c

for Falcon,
0x1848




4D7838 = -0x3e68(r13)
+0x10 = external of current playerthink function pass

lwz r3,-0x3e68(r13)
lwz r3,0x10(r3)
lwz r4,0(r31)
cmpw r3,r4
beq+ THROW_PRIORITY_END
lwz r3,0x2c(r3)
lbz r4,0xc(r3)
lbz r5,0xc(r31)
cmpw r5,r4
bgt-  THROW_PRIORITY_END
THROW_PRIORITY_SUBTRACT:
addi r30,r30,1	# subtract one frame for port priority
THROW_PRIORITY_END:

------------
Game and Watch

UAIR
0414bccc 38800044
0414bcdc 90850010
0414bce0 4bf4191d

********************************
* Luigi - Fireball Land Cancel *
********************************

041428E8 4BF40290

branches into Fox's (and Falco's?) laser interrupt function instead

********************
* Samus - Extender *
********************

Function that checks for extender button combo is 802b805c

20XX PAL Samus cannot use extender
inject @ 802b8110

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm


byte_load r29,r29,0x803ce515	# PlSs._at
cmpwi r29,0x70	# ASCII 'p'
bne-	END
# if PAL (.pat), write 0 to extender combo
li r0,0	# write 0 to button combo
stb r0,0x2240(r28)
END:
lwz r0,0x10(r28)

-------------

Samus Bomb Jump Cancelling Grapple

interrupt into bomb jump action state (0x156)
Call into ActionStateChange occurs at 80128bd8
--> 801289f8
--> 802b54cc
--> 80269ae0

(PAL) 02B5B9C for one of those above functions

In PAL, the word at internal struct + 0x2070 looks like

00240464

while doing aerial grapple

In NTSC it is 00200000

It looks like the (00040000) is specifically what is allowing the bomb jump grapple cancel


Functions setting the 0x2070 word for Samus

1.02 - 800895e0
PAL - 80089c98


Disable bomb jump grapple cancel (1.02)
- changes the flags for the grapple action state (loaded at line 80069b68, 6a250 PAL)
043ce4d4 00240464



--
PAL Samus (.pat) - Disable Bomb Jump Grapple Cancel


inject @ 80069b68 - lwz r4,4(r25)
- in ActionStateChange function
- loading flags for the action state that is to be loaded

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.set Samus.AS.311, 0x803ce4d0

byte_load r4,r4,0x803ce515	# PlSs._at
cmpwi r4,0x70	# ASCII 'p'
bne-	END
# if PAL (.pat)

adr_load r4,Samus.AS.311
cmpw	r4,r25	# loading flags for aerial grapple?
bne-	END

# load PAL flags instead of NTSC
lis r4,0x0024
ori r4,r4,0x0464
b END_END

END:
lwz r4,4(r25)	# default code line
END_END:

**********************
* Reload Memory Card *
**********************


20XX reset

801a36a0 - load all players instant button inputs?

X+A at CSS to Reset 20XX
inject @ 80266d5c for CSS
inject @ 80303fc0 for Debug Menu

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.set Buttons.HeldAll, 0x80479cf4
.set HSD_PadReset, 0x804C1FA3
.set MemoryCard.Insertion, 0x80433320

.set MnSlChr.20XXDefaults, 0x3e2010	# location in MnSlChr.usd
.set MnSlChr.RAMoffset, 0x80bec720
.set MnSlChr.20XXDefaults_RAM, MnSlChr.20XXDefaults + MnSlChr.RAMoffset


.set Defaults.DebugMenu_start, 0x370	# start of debug menu within the flags (ignore this)
.set DebugMenu.Length, 0x35c # includes a little extra
.set Defaults.TotalFlagLength, 0x1aec

.set Defaults.FlagsFirstSet, Defaults.DebugMenu_start
.set Defaults.FlagsSecondSet, Defaults.TotalFlagLength - Defaults.DebugMenu_start - DebugMenu.Length
.set Defaults.FlagsSecondSetStart, MnSlChr.20XXDefaults_RAM + Defaults.DebugMenu_start + DebugMenu.Length

.set RAM.20XXFlags, 0x803fa174
.set RAM.20XXFlagsSecond, RAM.20XXFlags + Defaults.DebugMenu_start + DebugMenu.Length

.set memcpy, 0x800031f4

START:
bl COUNTER
mflr r4
lwz r5,0(r4)	# load counter
word_load r3,r3,Buttons.HeldAll
andi. r3,r3,0x500	# X+A
cmpwi r3,0x500
bne- ZERO
addi r5,r5,1
b COUNTER_STORE
ZERO:
li r5,0
COUNTER_STORE:
stw r5,0(r4)

RESET_20XX:
cmpwi r5,180	# 3 seconds
blt- RESET_20XX_END
li r5,0
stw r5,0(r4)	# reset counter
li r5,1	# reset the game
byte_store r5,r4,HSD_PadReset
li r5,4	# disable memory card saving
word_store r5,r4,MemoryCard.Insertion

# restore 20XX default flag values, located in MnSlChr.usd
# first set of flags
adr_load r3, RAM.20XXFlags
adr_load r4, MnSlChr.20XXDefaults_RAM
li r5,Defaults.DebugMenu_start	# copy bytes up to Debug Menu start
adr_blrl r12,memcpy

# second set of flags
adr_load r3, RAM.20XXFlagsSecond
adr_load r4, Defaults.FlagsSecondSetStart
li r5,Defaults.FlagsSecondSet	# copy rest of bytes
adr_blrl r12,memcpy

RESET_20XX_END:
b END
COUNTER:	# portable counter
blrl
.long 0x00000000

END:
lwz r0,0x1c(sp)

******************************************
* Character Data Struct Custom Flag Init *
******************************************
flag init, custom flag init

Character Data Init Flags

inject @ 80068eec - lis r4,0x8046


li r4,0
# r31 = external data offset
stw	r4,0x20(r31)
stw	r4,0x24(r31)

# 0xd and 0xe are CPU flags
stb r4,0xd(r3)
sth r4,0xe(r3)	#
stb r4,0x21fd(r3) # tag team sleep flag
sth r4,0x21fe(r3)	# tag team cooldown counter flags


lis r4,0x8046	# default code line


---------------
Calloc Character Data Structs
- note: this can change things like Luigi's tornado being charged/uncharged under certain match loading circumstances due to garbage values being used initially in vanilla 

inject @ 80068eec - lis r4,0x8046

.set CharData.Length, 0x23ec

mr	r30,r3
li r4,0
stw	r4,0x20(r31)
stw	r4,0x24(r31)

li r4,CharData.Length

lis	r5,0x8000
ori	r5,r5,0xc160	# load zero_arealength
mtlr	r5
blrl		# 


mr	r3,r30
lis r4,0x8046

-----------------

80085b40 HSD_ObjAlloc for internal offset +0x59c, 0x5a0


***********************
* No Contest Research *
***********************

8016cf4c NoContestOrRetry

For a no contest, it looks like 8046b6a0 + 0x8 (byte), gets 0x7 stored to it

*****************
* Salty Runback *
*****************

salty runback, endless friendlies flag
- add check for if already re-loading match (sudden death), skip

inject @ line 801A4160 - stb r0,3(r31)
- 3/31/17 - I noticed this code line gets executed when pressing B on the SSS to return to CSS
- r31 = 80479d30 (menu controller)


.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.set MenuController_CheckSinglePlayer, 0x801a4340

lbz r3,3(r31)	# load menu minor
stb r0,3(r31)	# default code line
cmpwi r3,2	# already in match?
bne- END	# skip all this code if not at end of a match
MATCH_END:

INGAME_TOGGLES_MAX_PERCENT_RESET:
# reset max damage percent to 999 on Match End
lis r3,0x4479
ori r3,r3,0xc000	# load (float) 999.0
stw	r3,-0x7750(r2)	# store to 804d8290
INGAME_TOGGLES_MAX_PERCENT_RESET_END:

lbz r0,3(r31)	# load default stored menu minor
cmpwi r0,2	# if already restarting match
beq- END

SALTY_RUNBACK_START:
SINGLE_PLAYER_CHECK:
lbz r3,0(r31)	# load menu major ID
adr_blrl r4, MenuController_CheckSinglePlayer
cmpwi r3,1
beq- SALTY_RUNBACK_END

li r6,0
SALTY_START:
mr r3,r6
bl BUTTONS_CURRENT
andi. r3,r3,0x0300
cmpwi r3,0x0300
bne- SALTY_COMPARE
SALTY_EXECUTE:
li r0,2
stb r0,3(r31)
b END
SALTY_COMPARE:
addi r6,r6,1
cmpwi r6,4
blt- SALTY_START
SALTY_RUNBACK_END:

STAGE_SWAP_OVERWRITE:	# stage swap engine overwrite byte
lis r3,0x8040
lwz r4,-0x3DA0(r3)
cmpwi r4,0
beq- STAGE_SWAP_OVERWRITE_END
lbz r5,-0x3D9C(r3)
stb r5,0(r4)

li r4,0
stw r4,-0x3DA0(r3)	# 803fc260, stage swap overwrite address
stb r4,-0x3D9C(r3)	# 803fc264, stageswap overwrite byte
stb r4,-0x5D1B(r3)	# 803fa2e5, remove custom stage flag
STAGE_SWAP_OVERWRITE_END:

ENDLESS_FRIENDLIES_CHECK:
.set DebugToggle.EndlessFriendlies, 0x803fa350
.set DebugFlag.EndlessFriendlies, 0x803fa2e7
.set MatchInfo.Winner, 0x8046b6a8	# haven't confirmed this is match winner

lbz r3,0(r31)	# load menu major ID
adr_blrl r4, MenuController_CheckSinglePlayer
cmpwi r3,1
beq- END

ENDLESS_NEXT_ONLY:	# A+Y to execute endless friendlies but just one game
li r6,0
ENDLESS_NEXT_ONLY_LOOP:
mr r3,r6
bl BUTTONS_CURRENT
andi. r3,r3,0x0900	# A+Y
cmpwi r3,0x0900
bne- ENDLESS_NEXT_ONLY_COMPARE
ENDLESS_NEXT_ONLY_EXECUTE:
li r3,0xfe
b ENDLESS_FRIENDLIES_FLAG_STORE
ENDLESS_NEXT_ONLY_COMPARE:
addi r6,r6,1
cmpwi r6,4
blt- ENDLESS_NEXT_ONLY_LOOP

word_load r3,r3,DebugToggle.EndlessFriendlies
cmpwi r3,0
beq-	END

byte_load r3,r3,MatchInfo.Winner
cmpwi r3,7
beq- RAGE
ENDLESS_FRIENDLIES_EXECUTE:
li r3,0xFF	# goes to next game because of additional code that gets executed at CSS
b ENDLESS_FRIENDLIES_FLAG_STORE
RAGE:
li r3,0
ENDLESS_FRIENDLIES_FLAG_STORE:
byte_store r3,r4,DebugFlag.EndlessFriendlies
b END

BUTTONS_CURRENT:
.set Buttons.Loc, 0x804c1fac
mulli r5,r3,0x44 # button offsets are 0x44 apart
adr_load r4, Buttons.Loc
add	r4,r4,r5
lwz	r3,0(r4)	# load current buttons
blr

END:


******************************************
* Endless Friendlies RANDOM Stage Select *
******************************************

inject @ 80167fe0 - cmplwi r0,1


.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set DebugToggle.EndlessFriendlies, 0x803fa350
.set DebugFlag.EndlessFriendlies, 0x803fa2e7

adr_load r4,DebugFlag.EndlessFriendlies
word_load r5,r5,DebugToggle.EndlessFriendlies
cmpwi r5,1
beq-	RANDOM_STAGE_GO
lbz r5,0(r4)
cmpwi r5,0xfd
blt- END

RANDOM_STAGE_GO:
li r0,0
stb r0,0(r4)
li r0,1	# RANDOM stage select
END:
cmplwi r0,1	# default code line

********************************
* System Font - Shine Insignia *
********************************

Shine insignia by DRGN will replace the character that is a [vertically centered] period (0x8145)
	--> too lazy to look up actual name right now

Move ampersand (0x8195) to second page (the "x button" English switch page)

Image to replace with shine is at 0x426d40 in DOL

*******************************************************************
* Pause Screen - Enable Pause for all characters using port index *
*******************************************************************

0416be2c 60000000

*******************************
* Always Draw Collision Links *
*******************************

inject @ 8003049c

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.set Debug.AlwaysDrawCollLinks, 0x803fa214
.set EcbCollLinkDraw, 0x8005a2dc
.set CollLinkDraw, 0x80059e60

cmpwi r3,0	# default code line
beq-	CONSTANT_COLL_LINK_DISPLAY
adr_blrl r12,EcbCollLinkDraw
b END
CONSTANT_COLL_LINK_DISPLAY:
word_load r3,r3,Debug.AlwaysDrawCollLinks
cmpwi r3,0
beq- END
COLL_LINK_DISPLAY:
adr_blrl r12,CollLinkDraw

END:

****************
* Phantom Hits *
****************

7bf24 is writing damage to 0x1838
- I think this function only gets ran during a phantom hit, but haven't truly confirmed.
- branched into from 8006d354

0x189c = 5.0?
	- hitlag remaining?

6d344 = check if knockback = 0 (after last frame of hitlag)

Damage_knockbackcalculate seems to function normally

8007a164 cmpwi r21,0 --> true

*****************************************
* Debug Menu Mysterious Freeze....again *
*****************************************

This time, with Dolphin 5.0

invalid read from 0x00000026, PC = 80302af0
stack:
303ef4
390cfc
1a4d34

tried to load r3 (pointer) from (r31) bddd40 + 0x4


bddd40 + 0x4 = pointer to TextDataTable, I believe
bddd40 + 0xc = pointer to start of rgb color viewer debug menu struct


80304090 stores to null TextDataTable which causes the problem.

80303868 extend signing the byte of a pointer??? why

Possible fix:
0430287c 48000008

***************
* Smash Turns *
***************

Smash turn [flags] instead of tilt turn
040c98ac 480003c8
040c9b5c 2C030000

https://smashboards.com/threads/melee-gecko-codes-guide-and-discussion.327311/page-40#post-20457804

Smash Turns Have a 2 Frame Input Window 2.0 (v1.02) [Magus]
C20C9B4C 00000008
A11F03E8 2C084000
4082002C 811F2348
2C080000 41820020
811F2340 2C080001
41820014 C01F002C
FC000050 D01F002C
38000001 2C000000
60000000 00000000

-----

For 20XX:

Inject @ 800C9B4C - cmpwi r0,0

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set DebugMenu.SmashTurn, 0x803fa210	# 20XX debug menu flag location

DEBUG_CHECK:
word_load r8,DebugMenu.SmashTurn
cmpwi r8,0
beq+ END

CHECK_IF_SLOW:
lhz	r8,0x3E8(r31)	# animation frame
cmpwi	r8,0x4000	# frame 2 of Turn
bne-	END		# skip code if not frame 2 of Turn action

lwz	r8,0x2348(r31)
cmpwi	r8,0		# 0 if no 2 frame smash input beyond 0.8 dash threshold
beq-	END		# skip if no dash input by frame 2

lwz	r8,0x2340(r31)
cmpwi	r8,1		# 1 if change of direction has already completed (empty smash turn)
beq-	END		# skip if smash turn
# Nana fix
lbz r8,0x221f(r31)
rlwinm. r8,r8,0,28,28
beq- CHANGE_DIRECTION

lwz r8,0x1a94(r31)
cmpwi r8,6
beq- CHANGE_DIRECTION_END

CHANGE_DIRECTION:
lfs	f0,0x2C(r31)	# loads character direction
fneg	f0,f0
stfs	f0,0x2C(r31)	# changes character direction, completing the turn
CHANGE_DIRECTION_END:
li	r0,1		# 1 if able to dash out of turn on this frame to allow Dash change action

END:
cmpwi	r0,0		# entry point (800C9B4C). check flag for turn complete and can dash this frame


------------

Testing....Ice Climbers Fix

CHECK_IF_SLOW:
lhz	r8,0x3E8(r31)	# animation frame
cmpwi	r8,0x4000	# frame 2 of Turn
bne-	END		# skip code if not frame 2 of Turn action

lwz	r8,0x2348(r31)
cmpwi	r8,0		# 0 if no 2 frame smash input beyond 0.8 dash threshold
beq-	END		# skip if no dash input by frame 2

lwz	r8,0x2340(r31)
cmpwi	r8,1		# 1 if change of direction has already completed (empty smash turn)
beq-	END		# skip if smash turn

lbz r8,0x221f(r31)
rlwinm. r8,r8,0,28,28
beq- CHANGE_DIRECTION

lwz r8,0x1a94(r31)
cmpwi r8,6
beq- CHANGE_DIRECTION_END

CHANGE_DIRECTION:
lfs	f0,0x2C(r31)	# loads character direction
fneg	f0,f0
stfs	f0,0x2C(r31)	# changes character direction, completing the turn
CHANGE_DIRECTION_END:
li	r0,1		# 1 if able to dash out of turn on this frame to allow Dash change action

END:
cmpwi	r0,0		# entry point (800C9B4C). check flag for turn complete and can dash this frame



****************************
* Title Screen Transitions *
****************************

No Automatic Start Screen Transition
041a1c58 38000000

-801a1c5c
-the line that compares the title screen frame count length to 600 (10 secs) and does an automatic screen transition when the criteria is met.
-the above code force loads a value of 0 to the register (r0) that is used in the comparison

********************************
* DK - Always Full Giant Punch *
********************************

For 20XX,

inject @ 8010d988 - cmpw r5,r0

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set DebugMenu.DKPunch, 0x803fa2d0

word_load r4,r4,DebugMenu.DKPunch
cmpwi r4,0
beq+ DEFAULT
stw r0,0x222c(r3)
mr r5,r0

DEFAULT:
cmpw r5,r0

**************************
* Luigi - Always Misfire *
**************************

inject @ 80142af8

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set DebugMenu.LuigiMisfire, 0x803fa2d4

word_load r3,r3,DebugMenu.LuigiMisfire
cmpwi r3,0
beq+ DEFAULT
li r0,1
b	END

DEFAULT:
li r0,0
END:

***********************************
* Samus - Always Full Charge Shot *
***********************************

inject @ 80128660 - fcmpu	cr0,f1,f0

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set DebugMenu.SamusChargeShot, 0x803fa2dc

word_load r4,r4,DebugMenu.SamusChargeShot
cmpwi r4,0
beq+ DEFAULT
fctiwz f1,f0
stfd f1,0x18(sp)
lwz r4,0x1c(sp)
stw r4,0x2230(r3)

fmr f1,f0

DEFAULT:
fcmpu	cr0,f1,f0

**********************************
* Sheik - Needles Always Charged *
**********************************

inject @ 801101dc - lwz r0,0x222c(r3)

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set DebugMenu.SheikNeedles, 0x803faf60

word_load r4,r4,DebugMenu.SheikNeedles
cmpwi r4,0
beq+ DEFAULT
li r0,6
stw r0,0x222c(r3)

DEFAULT:
lwz r0,0x222c(r3)

***********************************
* Mewtwo - Always Full Shadowball *
***********************************

inject @ 80144f90 - fcmpu	cr0,f1,f0

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.set DebugMenu.MewtwoShadowball, 0x803faf64

word_load r4,r4,DebugMenu.MewtwoShadowball
cmpwi r4,0
beq+ DEFAULT
fctiwz f1,f0
stfd f1,0x18(sp)
lwz r4,0x1c(sp)
stw r4,0x2234(r3)

fmr f1,f0

DEFAULT:
fcmpu	cr0,f1,f0

***********************
* Peach - Turnip Pull *
***********************

0x3a50 in PlPe.dat = 0x80 = 128 = 1/128 percent chance to pull an item rather than turnip
- reference code line 8011d084 (internal_data + 0x2D4 -> + 0x14)

inject @ 8011d07c - li r31,99

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  adr_blr reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blr
.endm


.set DebugMenu.PeachPull, 0x803faf68
.set DEFAULT, 0
.set SATURN, 9
.set BOMB, 0xa
.set SWORD, 0xb
.set RANDOM_DEFAULT, 0xc
.set RANDOM_ALL, 0xd
.set HSD_Randi, 0x80380580

li r31,0x63	# turnip, default code line

word_load r4,r4,DebugMenu.PeachPull
cmpwi r4, DEFAULT
beq+ END

cmpwi r4,SATURN
blt- END_SKIP_ITEMS
li r31,7
beq- END_SKIP_ITEMS
li r31,6
cmpwi r4, BOMB
beq- END_SKIP_ITEMS
li r31,0xc
cmpwi r4, SWORD
beq- END_SKIP_ITEMS
cmpwi r4, RANDOM_DEFAULT
beq- GOTO_ITEM
RANDOM_ITEMS:
li r3,35
adr_blrl r4,HSD_Randi
cmpwi r3,0x1c	# hammer, never runs out
beq- TURNIP
cmpwi r3,0x1a	# big mushroom
beq- TURNIP
cmpwi r3,0x1b	# poison mushroom
bne- RANDOM_ITEM_END
TURNIP:
li r3,0x63
RANDOM_ITEM_END:
mr r31,r3
b END_SKIP_ITEMS
GOTO_ITEM:
adr_blr r4,0x8011d094

END_SKIP_ITEMS:
adr_blr r4,0x8011d0a0
END:

--------------

Turnip Type Decide
inject @ 802bd570 - stw r3,0xdd8(r26)

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.macro  adr_blr reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blr
.endm


.set DebugMenu.PeachPull, 0x803faf68
.set DEFAULT, 0
.set SATURN, 9
.set BOMB, 0xa
.set SWORD, 0xb
.set RANDOM_DEFAULT, 0xc
.set RANDOM_ALL, 0xd
.set HSD_Randi, 0x80380580

word_load r4,r4,DebugMenu.PeachPull
cmpwi r4, DEFAULT
beq+ END
cmpwi r4, SATURN
bge- END
subi r3,r4,1

END:
stw r3,0xdd8(r26)

********************
* Grapple Research *
********************

pointer to grapple entity
802bac80 --> checking for 0x223c pointer Samus grapple
802a7af0 --> 0x2238 for Link/y. link

**********************
* Knockback Stacking *
**********************
float velX_kb;
float velY_kb;
// character.frames_since_last_hit normally = -1
if (character.frames_since_last_hit < 10){
	character.velX_kb = velX_kb;
	character.velY_kb = velY_kb;
} 
else {
	float temp_velX = character.velX_kb * velX_kb;
	if (temp_velX < 0)
		character.velX_kb += velX_kb;
	else{
		temp_velX = (character.velX_kb >= 0) ? character.velX_kb : -character.velX_kb;
		float temp2_velX = (velX_kb >= 0) ? velX_kb : -velX_kb;
		character.velX_kb = (temp2_velX <= temp_velX) ? character.velX_kb : velX_kb;
	}

	float temp_velY = character.velY_kb * velY_kb;
	if (temp_velY < 0)
		character.velY_kb += velY_kb;
	else{
		temp_velY = (character.velY_kb >= 0) ? character.velY_kb : -character.velY_kb;
		float temp2_velY = (velY_kb >= 0) ? velY_kb : -velY_kb;
		character.velY_kb = (temp2_velY <= temp_velY) ? character.velY_kb : velY_kb;
	}
}

-------------------

// function @ 0x8008dc0c
// f1 = velX_kb = knockback x-velocity from current attack
// f2 = velY_kb = knockback y-velocity from current attack
void Damage_KBVel_StackStore(Character* character, float velX_kb, float velY_kb)
{
	if (character->frames_since_last_hit < 10){
		character->velX_kb = velX_kb;
		character->velY_kb = velY_kb;
	} 
	else {
		if (character->velX_kb * velX_kb < 0)	// if x-velocities are opposite
			character->velX_kb += velX_kb;
		else
			character->velX_kb = (fabsf(character->velX_kb) >= fabsf(velX_kb)) ? character->velX_kb : velX_kb;

		if (character->velY_kb * velY_kb < 0)	// if y-velocities are opposite
			character->velY_kb += velY_kb;
		else
			character->velY_kb = (fabsf(character->velY_kb) >= fabsf(velY_kb)) ? character->velY_kb : velY_kb;
	}
}

**********************
* Netplay Kill Music *
**********************
OLD CODE
$Netplay Safe Kill Music [Dan Salvato, Summate]
040249a4 38600001

*************
* OS Clocks *
*************

0x800000f8 = 162000000 = OS_BUS_CLOCK
0x800000fc = 486000000 = OS_CORE_CLOCK

OS_TIMER_CLOCK = (OS_BUS_CLOCK/4) = 40500000

// Default Configuration
#ifndef OS_CORE_CLOCK
#define OS_CORE_CLOCK       486000000u
#endif
#ifndef OS_BUS_CLOCK
#define OS_BUS_CLOCK        162000000u
#endif
#ifndef OS_TIMER_CLOCK
#define OS_TIMER_CLOCK      (OS_BUS_CLOCK/4)
#endif

#define OSTicksToCycles( ticks )        (((ticks) * ((OS_CORE_CLOCK * 2) / OS_TIMER_CLOCK)) / 2)
#define OSTicksToSeconds( ticks )       ((ticks) / OS_TIMER_CLOCK)
#define OSTicksToMilliseconds( ticks )  ((ticks) / (OS_TIMER_CLOCK / 1000))
#define OSTicksToMicroseconds( ticks )  (((ticks) * 8) / (OS_TIMER_CLOCK / 125000))
#define OSTicksToNanoseconds( ticks )   (((ticks) * 8000) / (OS_TIMER_CLOCK / 125000))
#define OSSecondsToTicks( sec )         ((sec)  * OS_TIMER_CLOCK)
#define OSMillisecondsToTicks( msec )   ((msec) * (OS_TIMER_CLOCK / 1000))
#define OSMicrosecondsToTicks( usec )   (((usec) * (OS_TIMER_CLOCK / 125000)) / 8)
#define OSNanosecondsToTicks( nsec )    (((nsec) * (OS_TIMER_CLOCK / 125000)) / 8000)

#define OSDiffTick(tick1, tick0)        ((s32) (tick1) - (s32) (tick0))


---------------
80375C34 = PostRetraceCallback, function

Zero SISetSamplingRate
0434ddc8 3B800000

80402ca0 - NTSC sampling rate table


OSTime Period = 0x80432a5c

0xa4cb8

800195fc


804c1f5c --> pointer to function run after each vertical retrace
	- 804c0980 (+0x15dc)
	--> default function pointer is to 8015fda0 (blank blr function)

Set @ 8015ffb8 in main()

Set PADRead() etc. as post-vertical retrace interrupt
0415ffb8 3C808001
0415ffbc 608395FC




Modified Controller Port Sampling (1.02) [Achilles]
04019860 60000000	* Disable the default software poll periodic timer creation
0434ddc8 3B800000	* Sets 0 as the SISetSamplingRate input --> allows game to get the latest controller status when PADRead() is called just after each vertical retrace interrupt
0415ffb8 3C808001	* Sets the default software poll timer interrupt handler as the user post vertical retrace callback
0415ffbc 608395FC

Pre-Retrace Controller Port Sampling
inject @ 80019860

lis r3,0x8001
ori r3,r3,0x95fc
mtlr r3
lis r4,0x804c
stw r3,0x1f58(r4)
blrl

C2019860 00000004
3C608001 606395FC
7C6803A6 3C80804C
90641F58 4E800021
60000000 00000000




80376bac - noping this byte store causes the game to no longer render frames
	= PadRawQueueCount


804c1e40
804c1de0 = GXRenderModeObj address start (VIConfigure input pointer)


&xfb0 = 0x804f0c00 (from 0x804c0948)
&xfb1 = 0x80586c00 (from 0x804c094c)

video.c
804c1d80 = HSD_VIStatus *vi

#define HSD_VI_XFB_DISPLAY 7
#define HSD_VI_EFB_FREE 0

_p
0x00	GXRenderModeObj start
0x00	word	viTVmode
0x04	half	
0x3C	word	current.vi.black
0x54	byte	current.chg_flag
0x1D8	point	pre_cb			// pre retrace callback
0x1DC	point	post_cb			// post retrace callback
0x1E0	word	drawdone.waiting
0x1E4	word	drawdone.arg
0x1E8	point	drawdone.cb		// GXDrawDoneCallback

803768d4

804c1f58

// default GXRenderModeObj for NTSC Melee
GXRenderModeObj GXNtsc480Int = 
{
    VI_TVMODE_NTSC_INT,     // viDisplayMode
    640,             // fbWidth
    480,             // efbHeight
    480,             // xfbHeight
    (VI_MAX_WIDTH_NTSC - 640)/2,        // viXOrigin
    (VI_MAX_HEIGHT_NTSC - 480)/2,       // viYOrigin
    640,             // viWidth
    480,             // viHeight
    VI_XFBMODE_DF,   // xFBmode
    GX_FALSE,        // field_rendering
    GX_FALSE,        // aa

    // sample points arranged in increasing Y order
     6,  6,  6,  6,  6,  6,  // pix 0, 3 sample points, 1/12 units, 4 bits each
     6,  6,  6,  6,  6,  6,  // pix 1
     6,  6,  6,  6,  6,  6,  // pix 2
     6,  6,  6,  6,  6,  6,  // pix 3

    // vertical filter[7], 1/64 units, 6 bits each
     0,         // line n-1
     0,         // line n-1
    21,         // line n
    22,         // line n
    21,         // line n
     0,         // line n+1
     0          // line n+1
};

****************
* HSD_PadClamp *
****************

127 * 80 / 179.605 (when x & y joystick = 1.0 = 0x7f)

***********************
* PAD Origin Research *
***********************

804A89B0
2,3,4,5

0x2	byte	x-joystick
0x3	byte	y-joystick
0x4	byte	x-cstick
0x5	byte	y-cstick

0 stored to 0xA
if positive, subtract

Read in SPEC2_MakeStatus, in PADRead

output (r4, not really output...void) --> buffer for origin offsets

if x-joy = 0x10 = 16

SW = -0.7,-0.7
SE = 0.65, -0.75



Silver controller
X: 0.025
Y: 0.1

My controller
X; 0.0875
Y: 0.0875

P2 D-Pad adjusts P1 pad origin (at CSS)
- simple test
Inject @ 80263250

.macro adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.set origin, 0x804a89b0
.set p2, 0x804C1FF8

adr_load r17,origin
word_load r15,r15,p2
rlwinm. r16,r15,0,31,31
beq- DPAD_LEFT_END
lbz r18,2(r17)
extsb r18,r18
subi r18,r18,1
stb r18,2(r17)
b END
DPAD_LEFT_END:
rlwinm. r16,r15,0,30,30
beq- DPAD_RIGHT_END
lbz r18,2(r17)
extsb r18,r18
addi r18,r18,1
stb r18,2(r17)
b END
DPAD_RIGHT_END:
rlwinm. r16,r15,0,29,29
beq- DPAD_DOWN_END
lbz r18,3(r17)
extsb r18,r18
subi r18,r18,1
stb r18,3(r17)
b END
DPAD_DOWN_END:
rlwinm. r16,r15,0,28,28
beq- DPAD_UP_END
lbz r18,3(r17)
extsb r18,r18
addi r18,r18,1
stb r18,3(r17)
b END
DPAD_UP_END:

END:
lbz r0,-0x49ae(r13)





----------------
L: 0.000000
X:-20 Y:-30

.long 0x4cc63242

X:%3d Y:%3d
583a25336420593a253364

.asciz "X:%3d Y:%3d\n"
.balign 4

Testing
- stack overflowing 80302d4c

8040a67c

.macro adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  byte_load reg1, reg2, address
lis \reg2, \address @ha
lbz \reg1,\address @l (\reg2)
.endm

.macro  byte_store reg1, reg2, address
lis \reg2, \address @ha
stb \reg1,\address @l (\reg2)
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  word_store reg1, reg2, address
lis \reg2, \address @ha
stw \reg1,\address @l (\reg2)
.endm

.set origin, 0x804a89b0
.set p2, 0x804C1FF8

adr_load r5,origin
mulli r4,r31,0xc
add r5,r5,r4
lbz r6,3(r5)
lbz r5,2(r5)
bl TEXT
mflr r7
lis r4,0x8030
ori r4,r4,0x2d4c
mtlr r4
mr r4,r7

b END

TEXT:
blrl
.long 0x583a2533
.long 0x6420593a
.long 0x2533644a

.long 0x583a2025
.long 0x372e3466
.long 0x4a593a20
.long 0x25372e34
.long 0x660a4358
.long 0x3a202537
.long 0x2e346643
.long 0x593a2025
.long 0x372e3466
.long 0x0a4c3a20
.long 0x25382e36
.long 0x66523a20
.long 0x25382e36
.long 0x66000000
END:

****************
* Console Type *
****************

u32 consoleType @ 8000002c

= 00000003 on my hacked Wii
= 10000006 on Dolphin

#define OS_CONSOLE_RETAIL4          0x00000004
#define OS_CONSOLE_RETAIL3          0x00000003
#define OS_CONSOLE_RETAIL2          0x00000002
#define OS_CONSOLE_RETAIL1          0x00000001
#define OS_CONSOLE_DEVHW4           0x10000007
#define OS_CONSOLE_DEVHW3           0x10000006
#define OS_CONSOLE_DEVHW2           0x10000005
#define OS_CONSOLE_DEVHW1           0x10000004
#define OS_CONSOLE_MINNOW           0x10000003
#define OS_CONSOLE_ARTHUR           0x10000002
#define OS_CONSOLE_PC_EMULATOR      0x10000001
#define OS_CONSOLE_EMULATOR         0x10000000
#define OS_CONSOLE_DEVELOPMENT      0x10000000  // bit mask

u32     OSGetConsoleType( void );


--------

Lagless FoD

inject @ 801cbb90

.macro overwriteEntry adr, orig, noLag
.long \adr
.long \orig
.long \noLag
.endm

.macro  word_load reg1, reg2, address
lis \reg2, \address @ha
lwz \reg1,\address @l (\reg2)
.endm

.macro  adr_load reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
.endm

.macro  adr_blrl reg, address
lis \reg, \address @h
ori \reg,\reg,\address @l
mtlr \reg
blrl
.endm

.set tableEnd, 0
.set tableEntryLength, 0xc
.set tableOrig, 4
.set tableNoLag, 8

.set DebugMenu.FoD, 0x803fa3ac
.set OSBootInfo.consoleType, 0x8000002c

stwu sp,-0x8(sp)

word_load r3,r3,DebugMenu.FoD
cmpwi r3,0
beq- ORIG
cmpwi r3,1
beq- NO_LAG

word_load r3,r3,OSBootInfo.consoleType
rlwinm. r3,r3,0,3,3	# 0x10000000 --> no lag on Dolphin
bne- NO_LAG

li r4,0
li r6,0
lis r3,0x8045
ori r3,r3,0x3088

PLAYER_LOOP:
mulli r5,r4,0xe90
lwzx r5,r5,r3
cmpwi r5,3
beq+ PLAYER_LOOP_CONTINUE
addi r6,r6,1
PLAYER_LOOP_CONTINUE:
addi r4,r4,1
cmpwi r4,6
bne+ PLAYER_LOOP
cmpwi r6,3	# 3 players or more = lagless
blt+ ORIG
NO_LAG:
# add shadow render flag to "frozen" water ground
# note: The hardcoded subtraction offset could cause problems if
# structure of the FoD file internals were moved
.set StageInfo.GrGroundParam, 0x8049ED78
word_load r6,r6,StageInfo.GrGroundParam
adr_load r5,0x0002ae44
sub r5,r6,r5
lbz r6,0(r5)
ori r6,r6,4	# add shadow render flag
stb r6,0(r5)

li r5,tableNoLag
b CONTINUE
ORIG:
li r5,tableOrig
CONTINUE:

bl TABLE
mflr r3
subi r3,r3,tableEntryLength
LOOP:
lwzu r4,tableEntryLength(r3)
cmpwi r4,tableEnd
beq- END
STORE:
lwzx r6,r5,r3
stw r6,0(r4)
li r0,0
icbi r0,r4
sync
isync
b LOOP

TABLE:
blrl
overwriteEntry 0x801cc8ac, 0xec0007fa, 0xfc000028
overwriteEntry 0x801cbe9c, 0x4bffc29d, 0x60000000
overwriteEntry 0x801cbef0, 0x80840030, 0x60000000
overwriteEntry 0x801cbf54, 0x48000bc5, 0x60000000
overwriteEntry 0x80390838, 0x4bfffe05, 0x60000000
overwriteEntry 0x801cd250, 0x48174f81, 0x60000000
overwriteEntry 0x801ccdcc, 0x387f01d4, 0x480000b4
.long tableEnd

END: