Link to video
Forgot to share this here, I did this just before the new year coz I had a rotten cold. Cutting 7s from the previous TAS using an optimised version of the console world record strat - which itself has been around for years but has never been TASed coz GE TASing.
As ever the most up-to-date IL TAS list can be found on the-elite boards.
I've also made the planning spreadsheet for a hypothetical full run TAS (which won't happen) public, which might be of interest. Henrik's full 00a run came in at 25:29 total time, the current sum of the ILs is 24:38 and without any major break on Control the target time for a new full TAS would be sub 24 i.e. 23:59
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
I've recently done a couple of TASes for Silvereye which is a 2015 romhack. The first on ''depot'' is meant to pick up a key from upstairs but instead sets up a aztec-mainframe-glass style lure to open the locked door during the protect segment.
Link to video
The second just skips going a long way out of the way two pick up two keys by luring a guard instead. It relies on Goldeneye's wacky routing which first decides which 'sets' the guard will go through, then plots a route within these. The guard is less than 20m away but decides to run around the whole map.
Link to video
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
As part of TASpap, a Goldeneye hoard that just released, I decided to TAS Dizzy Dinghies 17.00 which was brought up by one of our top players Irie, who has the record and - at the time - TAS tie of 17.03 .
I was in isolation for covid so it didn't really stand a chance >:)
I reversed all the movement code and the collision to make a pyplot which could take an input file and plot the course. I'll clean it and upload it tomorrow sometime because it is good fun, and I only TASed courses 1 & 2, and 2 isn't very strong. I was very impressed at how rich the movement gets, since I originally set out to get a truely optimal time but it gets very complicated very quickly. Sure enough though, keeping the lines tight from the get go I got 17.00 on my first completion.
The Mythical course 1 17.00Course 2 21.90 (2 frames cut iirc)
I also discovered a TAS-only trick which I've called Rapid Fire Drifting or RFD after Mariokart wii's Rapid Fire Hop. There is a separate speed cap and sorta "acceleration" value, and by pressing / releasing A on alternate frames you can maintain 98% speed cap while suppressing the acceleration. This lets you go into epic drifts, and is probably genuinely useful in the hairpins on courses 1 & 2. I didn't actually make use of it in any of my TASes, except in a skit for the hoard where Tony Hawk aka Mario does a 900 on course 1 :D
Do see my post over on the Goldeneye board. Pic of the 17.00:
Code will follow sometime
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
As part of TASpap, a Goldeneye hoard that just released, I decided to TAS Dizzy Dinghies 17.00 which was brought up by one of our top players Irie, who has the record and - at the time - TAS tie of 17.03 .
I was in isolation for covid so it didn't really stand a chance >:)
I reversed all the movement code and the collision to make a pyplot which could take an input file and plot the course. I'll clean it and upload it tomorrow sometime because it is good fun, and I only TASed courses 1 & 2, and 2 isn't very strong. I was very impressed at how rich the movement gets, since I originally set out to get a truely optimal time but it gets very complicated very quickly. Sure enough though, keeping the lines tight from the get go I got 17.00 on my first completion.
The Mythical course 1 17.00Course 2 21.90 (2 frames cut iirc)
I also discovered a TAS-only trick which I've called Rapid Fire Drifting or RFD after Mariokart wii's Rapid Fire Hop. There is a separate speed cap and sorta "acceleration" value, and by pressing / releasing A on alternate frames you can maintain 98% speed cap while suppressing the acceleration. This lets you go into epic drifts, and is probably genuinely useful in the hairpins on courses 1 & 2. I didn't actually make use of it in any of my TASes, except in a skit for the hoard where Tony Hawk aka Mario does a 900 on course 1 :D
Do see my post over on the Goldeneye board. Pic of the 17.00:
Code will follow sometime
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
As part of TASpap, a Goldeneye hoard that just released, I decided to TAS Dizzy Dinghies 17.00 which was brought up by one of our top players Irie, who has the record and - at the time - TAS tie of 17.03 .
I was in isolation for covid so it didn't really stand a chance >:)
I reversed all the movement code and the collision to make a pyplot which could take an input file and plot the course. I'll clean it and upload it tomorrow sometime because it is good fun, and I only TASed courses 1 & 2, and 2 isn't very strong. I was very impressed at how rich the movement gets, since I originally set out to get a truely optimal time but it gets very complicated very quickly. Sure enough though, keeping the lines tight from the get go I got 17.00 on my first completion.
The Mythical course 1 17.00Course 2 21.90 (2 frames cut iirc)
I also discovered a TAS-only trick which I've called Rapid Fire Drifting or RFD after Mariokart wii's Rapid Fire Hop. There is a separate speed cap and sorta "acceleration" value, and by pressing / releasing A on alternate frames you can maintain 98% speed cap while suppressing the acceleration. This lets you go into epic drifts, and is probably genuinely useful in the hairpins on courses 1 & 2. I didn't actually make use of it in any of my TASes, except in a skit for the hoard where Tony Hawk aka Mario does a 900 on course 1 :D
Do see my post over on the Goldeneye board. Pic of the 17.00:
Code will follow sometime
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
Was able to catch the end of the stream just in time to see the new Dam TASes. Incredible strat, seemingly so simple yet unintuitive. Great work once again.
Thanks, I guess it was a good thing it was delayed lol.
To my TASpap TASes summary post. Firstly those who aren't aware there was a new bit of tech which I found back in April, but was also found independently by a 60fps runner acadie in October 2020. This went public earlier in August but I've just released TASes for Bunker 2 (which is really broken by it):
B2 A 0:19B2 SA 0:32B2 00A 0:36
Then I worked on "A from above" on Caverns SA - a strat which is known about on 00A but seemed impossible on SA because you need to keep an extra scientist alive. This is 1 second off the console record on agent, and cut 11s from the previous TAS (that TAS was ancient though, I don't even have the vid for it)
Caverns SA 1:02
The big new (TAS) strat is called the "piggyback" on Dam and is pretty bizarre. For some reason when you go into the ending the normal rules about when you can shoot things are bent slightly (my theory is it's some hack to help the cinematic views during the ending cinema). This means that from out in free-fall you can shoot the 4th cam which is otherwise way out of the way. We're very familiar with shooting during the opening cutscenes so I knew the same would work in the ending, but I had to arrange for a guard to go off the edge to prop me up.
Dam SA 1:00
It's also a pleasure to introduce SeanJohn who is new to Goldeneye TASing but still managed a very impressive 1:34 on 00A, which cuts 12s from the previous TAS by Henrik:
Dam 00A 1:34
There were also some misc TASes that I made along the way which I'll post here for anyone who is more interested.
B2 0:20 using the "outer route"
Frigate SA 0:50 (not the TAS record) which I made developing the Reverse Pipe Warp strategy. I put quite some time into developing it but benched it as just too impractical, and we ended up finding a much nicer and clearly superior strat. There's also a video of it with a map
Finally the Original Dam SA 1:03 TAS using the new strat. The ending involves the guard seeing us but we're almost on top of him so he keeps firing upwards, and we don't lose our seat.
Post-unhoard the plans are a bit up in the air but there is talk of either a full SA run by Sean or a full 00A TAS by the both of us. As ever I'd be keen for more people to get involved so feel free to dm me on discord :)
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
Was able to catch the end of the stream just in time to see the new Dam TASes. Incredible strat, seemingly so simple yet unintuitive. Great work once again.
Thanks, I guess it was a good thing it was delayed lol.
To my TASpap TASes summary post. Firstly those who aren't aware there was a new bit of tech which I found back in April, but was also found independently by a 60fps runner acadie in October 2020. This went public earlier in August but I've just released TASes for Bunker 2 (which is really broken by it):
B2 A 0:19B2 SA 0:32B2 00A 0:36
Then I worked on "A from above" on Caverns SA - a strat which is known about on 00A but seemed impossible on SA because you need to keep an extra scientist alive. This is 1 second off the console record on agent, and cut 11s from the previous TAS (that TAS was ancient though, I don't even have the vid for it)
Caverns SA 1:02
The big new (TAS) strat is called the "piggyback" on Dam and is pretty bizarre. For some reason when you go into the ending the normal rules about when you can shoot things are bent slightly (my theory is it's some hack to help the cinematic views during the ending cinema). This means that from out in free-fall you can shoot the 4th cam which is otherwise way out of the way. We're very familiar with shooting during the opening cutscenes so I knew the same would work in the ending, but I had to arrange for a guard to go off the edge to prop me up.
Dam SA 1:00
It's also a pleasure to introduce SeanJohn who is new to Goldeneye TASing but still managed a very impressive 1:34 on 00A, which cuts 12s from the previous TAS by Henrik:
Dam 00A 1:34
There were also some misc TASes that I made along the way which I'll post here for anyone who is more interested.
B2 0:20 using the "outer route"
Frigate SA 0:50 (not the TAS record) which I made developing the Reverse Pipe Warp strategy. I put quite some time into developing it but benched it as just too impractical, and we ended up finding a much nicer and clearly superior strat. There's also a video of it with a map
Finally the Original Dam SA 1:03 TAS using the new strat. The ending involves the guard seeing us but we're almost on top of him so he keeps firing upwards, and we don't lose our seat.
Post-unhoard the plans are a bit up in the air but there is talk of either a full SA run by Sean or a full 00A TAS by the both of us. As ever I'd be keen for more people to get involved so feel free to dm me on discord :)
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
A goldeneye hoard called 'TASpap' is releasing in just under 2 days time (10pm Saturday UK) and the name is kinda misleading but nonetheless I do have at least one IL TAS in it :)
On https://www.twitch.tv/TheEliteGaming
Runtime ~ 1 hour
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
For the curious I've looked into the tech behind this and posted about it over on the-elite boards.
Essentially the guard needs to be in a pretty precise position after 7 frames of spinning.
The full set up injuring the arm needs 1 in 10 raw RNG luck (1 in 3 for the animation and 3 in 10 for the door) plus the correct lag but is otherwise humanly doable. There's already a 1 in 6 chance for best Doak position and a 'good Trev' is effectively RNG though saves < 1 second.
It may come to console yet :)
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
Thanks :D ! It's not impossible that it could come to console but I've not got a list of players clamouring to try it lol.
And yes TAS uses different strats for the first 9 levels - it's not until statue that it uses normal strats (that's how boring statue is lol). The 2nd half will use a lot more console strats.
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
Looking into some more out there ideas in the full 00A run planning and after exhausting more impractical avenues I stumbled on this gem. Due to the mismatch between the clipping and the navigation graph, this door can be opened by a single guard on the near side.
Link to video
Everything works out really sweetly, with the lab just close enough to hide in (this TAS makes it by ~2 game frames). I didn't have the energy to fight for a good trev though, which would potentially save just over a second to give 43. Full comments in the youtube description.
I was in favour of sitting on this for the full 00A TAS, or at least a 10/20 WIP but there is some (semi small) potential for console. I'd still urge some caution / patience on that, as I have no more news :)
It seems likely that this will be the last big find bar a control OOB but you never know. It would be fitting as my last find since the very first thing I tried to find in the game was a keycard skip at the start of facility.
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
I do have a small update on that :)
Another guy is potentially joining the very small (and hence prestigious) group of 'active' GE 'TASers' and is particularly keen to work on a full run rather than just ILs.
The strats and knowledge of mechanics are in a reasonably good place now across the board so we'll probably TAS a few more individual levels and then fill in some holes (particularly around boosts) and we might be able to make a start.
So perhaps I'll have to bring the ETA down from 2030 ;)
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
Good prediction that
49 should be pretty comfy using 2.3 on the back of this run. I thought the hostages would complete in good time but I was surprised how early I was able to get objective <a> up.
My main time loss was backstrafing to kill the guard by the pipes to prevent him from slowing the final hostage. This loses at least 0.5s, and I lost further 1/10ths preserving hostage pace shortly after. Fixing this with a lure and using 2.3 to skip a pause would easily make 48 or even 47 pace possible from Bond's perspective, but the hostage's wouldn't tolerate any issues.
I streamed some of this but I sat down for a long sesh today offline to do most of it. I'll at least make some 'critique' of this TAS at some point, but hopefully some kind of tute. I will TAS sub-50 at some point but not for a while.
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
I'll be streaming the making of another TAS this weekend.. and it's back on the boat! Using a new strat illegally imported from the UK I should get 51 (the current record is 53). I'll only be using control style 1.2 so 50 or even 49 should be possible with 2.3 on top. I think I'll probably start early afternoon EST this Saturday. Maybe sooner but you won't have missed much by then ;)
https://www.twitch.tv/whiteted_strats
As before I'll be talking about TASing technique and w/e as I go along. Any questions are welcome.
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
ah thanks, it assumes it's an internal link :)
Surface 2 00a 1:08 is now complete, cutting just 1s.
I forgot that I needed to be in control style 1.X to be able to lean a grenade, so I fell back on my backup backup plan of just throwing the grenade while running up a hill. 1:06 or :05 would be possible with an r-lean to launch the grenade from a better line.
I streamed most of the making of this on twitch:
Part 1Part 2
Part 3 I did offline :)
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
I've finished the first version of my checkpointing script, which I'll be demoing in this TAS tutorial.
https://github.com/whiteted-strats/TT_savestates
The user script describes a series of checkpoints relating to Bond's progress. Best splits are automatically saved to named savestates, and optionally also to a slot. The movement related splits are interpolated, so are more precise than just to the frame.
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
I've compiled TAS times [Updated 2020]
as an updated but less sexy version of https://ge-tas.webs.com/
I'm working on some tools & an outline for an epic TAS video tutorial now. The N64 TASing scene on the whole seems very healthy, so it shouldn't be too much of a reach to get some Goldeneye activity.
My broad outline atm is something like:
Setting up Bizhawk on a fresh machine
Various TAS tools (i.e. lua scripts). In particular I'm writing a new one to support important checkpoints and automatically savestate if you get there in record time.
Use of the setup editor
Reading the game scripts
A pretty exhaustive list of mechanics / tricks
All existing strats from 1000 ft
Review a TAS or 2
TAS something short but interesting very fast - probably frigate agent 1.2
When I say epic I just mean long :)
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
Offering a $250 bounty to a N64 Goldeneye 007 00 Agent run that:
1. Is 53 sec faster than Wyster & Scaredsim 2011 from levels Dam to Cradle only.
...
However, I reduced this amount (66 seconds) by 20% to 53 sec because the new Surface 1 strat could be an outlier compared to what is possible in the other levels. Since I’m a layperson when it comes to TAS’ing Goldeneye N64, I reserve the right to reduce the 53 sec even further in the future (depending upon the circumstances)
I would exercise that right and reduce the 53 quite significantly if I were you :P
S1 is a complete outlier because it is a significant rerouting. Frigate is the closest thing and despite a big rerouting there's not much time cut. The current TAS has aged for sure but it is very impressive, and leaves little room for anything significant on most levels. I put some thoughts on the-elite forums a while ago, estimating over 30 seconds, but that's assuming that some ideas that I have can be realised.
35s from the IGT would still be an outrageous cut.
As for making a tutorial video that is a very good idea to which I'll give some thought. I'm probably the most active and I'm not even a TASer. The nice thing is that a newcomer could sweep all of SA.
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
No problem, well done for making your way to the end of it ;)
The body part HUD lua is on my github now. If you want to run it then you also need Wyster's /Data library linked in the readme (though looking at it now it's only for 1 thing). I tried it on 2.4.1 and the bug is still present so expect it to crash pretty quickly.
I watched your Armored Core TAS - very impressive :) , for sure only in the vault because of all the mission skips. The enemy models look to be of a similar complexity to GE's guards, though maybe with no movement of the head / neck? Atleast if you want to include the limbs as well then it looks like it won't be easier than GE.
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
Can you share a general overview of your strategy for finding the hitbox data? I don't mean like a detailed breakdown or anything (unless you really want to).
I had the idea of writing a wallhack in Lua to make TASing easier, and the part of the process that I figure would just be horrendously tedious and difficult would be figuring out where hitbox data is stored (and what format it might even be in), so that a bounding box could be drawn around the enemy.
Great minds eh :)
For sure I can share. I'm a big fan of making paper notes which I number before they leave my desk so it's kinda documented. My method was pretty haphazard tbh because it's the first major bit of reversing I've done on a game, but I've definitely come out of the other side with something more definitive. Also bear in mind that I got pretty lucky.
Starting out I had some knowledge of the standard bits of memory courtesy of Wyster which I've extended slightly in my travels, and I'd done some reversing for a mod that I made recently. Crucially I had already made & improved & debugged & remembered-that-lua-is-one-based-for a lua HUD. My plan was to find some kind of boxes and throw it in this to make sense of it.
Getting started
Unfortunately my 'in' isn't so documented because it was doing reversing in ghidra, so we have to do a little speculation. In the-elite (Goldeneye speedrunning) people call me a TASer but it's not so much actual TASes that I make (until now) but just exploring strategy ideas using emulator. At the end of last year I was fleshing out an old strategy idea which I won't excite you with (TAS here, heartbreaker here). It relies on random shot spread to actually hit the hostage, so I looked into that.
I had a neat (though no doubt unoriginal) idea for this. I dumped the rom in virtual memory from Project64, and found all calls to the RNG (I already knew the address from Wyster, so Project64's debugger found the update function). Then I wrote some assembly code to look the RNG's return address up in a table of values at a specific address. If it found a match then it returned the non-random value from the table, else it returned the generated random value. Coupled with a lua script, this lets you take something observable and random (gun spread) and binary search for where it calls the RNG. I quickly found that it made 2 pairs of calls for x and y spread. This debunked my hope that playing in wide/cinema would widen your gun spread.
Back on topic though, this gave me a starting point - I had found the code which generated a random shot, so the code for testing collisions shouldn't have been too far away. Bear in mind that I'm by no means an expert at reversing, and I've pretty much only used Ghidra against Goldeneye, so I won't lecture you. The decompiler is very impressive imo, and with 0 effort the output can still be really good. One thing I always bear in mind is not to have too much confidence on the signatures that it gives functions, unless you've gone and looked at it. I just focused on the control flow, and at 7f03b15c there's a function which calls the 'makeRandomShot' function at +0x48, and has 2 main loops near the bottom. Highly suspicious :)
In summary: Hook RNG -> Find shot code
Project64 scripts
From here I started 'hitbox_chasing.js', a Project64 script to hook some of these calls and just shout to say that they'd run. I found a function that ran once for each guard that the shot passed near to.. lower .. a function with a jump table .. lower .. and bingo a function which was clearly doing vectory shit and returning a boolean. The main thing which I'd been following was the shot direction vector. The script was really useful for verifying my reversing, and I found it a really good companion because you might have been looking at various values to do with the leg, but then in 5 seconds you can get those same values printed out for the head instead. Or a different guard. I could shoot a guard in the left forearm and it would say I've hit hitbox #10, and describe a box which is long and thin.
This function took 4 things:
- some origin offset, always (0,0,0) [Perhaps guards also use this to shoot :) ]
- shot direction vector
- hit box data
- hit box matrix
So looking at this function, I could parse the hitbox data. It is just Body part #, X min, X max, Y min, Y max, Z min, Z max. But I still needed to be able to find the matrix.
I went back and I tried to piece together what was going on. The Project64 scripting was useful again, but really I was going in the wrong direction.
Basically these hitboxes are linked from '0xA-type' 'skeleton objects'. The skeleton objects live in a binary tree structure with backlinks. I realised that they had up to 3 pointers but I was thrown off because the backpointers usually go back many steps, rather than just to the parent. If I had just looked at a sibling of the vectory function, I'd have seen code walking up the skeleton looking for a matrix (on a 0x2-type skeleton object normally). My thinking was that at some point I'd have to look back up the call stack and trace my parameters, but the much clearer code was down low. I gave up and went to sleep :)
Sunday
The next day I was feeling kinda low because we're in corona lockdown and my corona project seemed a bit stuck. I think I must have put a breakpoint on reading these 3 pointers and I was blessed by finding an amazing function at 7f06f0d0. It literally walks the skeleton, following the pointer at 0x14 until it sees a nullptr, then stepping back on 0x8 and looking for 0xC. I did some skeleton-walking myself, and found that type 0xA signified hitboxes. So I just had to see how it got hold of the skeleton root.
Then I noticed it came from a familiar value (the 'model data pointer') that I'd seen in the long stack of calls earlier. I suddenly realised that this is actually kinda familiar, and I knew how to find it from Wyster's "GuardData". The sibling function that I mentioned explained how to find the matrix within a list linked off of this model data pointer.
Finishing up
So profit. I had the hitboxes, but with 2 issues:
(a) The memory that the matrices are written to is reused even before the next frame is drawn
(b) The matrices were for the view projection, whereas I also wanted their global coordinates
(a) has been 'solved' using lua to hook the end of some matrix multiplication code, looking for writes to guards' matrix lists. Currently I'm getting a crash but the code does work for a little while before it runs out of memory.
(b) To get them locally I could use the matrix that my HUD uses, but I've always known that to be a bit of a hack - my HUD lags if you spin fast, and sometimes hops about a bit. My bot is going to use this for godlike aiming so it needs to be good. Instead I noticed that the 15 hitboxes didn't use consecutive indices in the matrix list. I just tried multiplying by the inverse of the unused matrices at [16], [13], [9] and [4], and really liked the look of [4]. It's effect was to fix the centre of the gut hitbox, and the direction that the guard was facing (though his animation might still spin or whatever). I was very fortunate that I could correct both of these. The guard's point position is readable from the GuardData and coincides with the center of the 'gut hitbox', and I just happened to have found guards' facing angles in memory a while back.
The result shows guard's hitboxes 2 in-game frames ahead of where the guards are visually, which is pretty neat. As a bonus it reveals the view matrix, which I can use on the shot direction if I like.. or track down more reliably in memory.
To come back to lua my worst error was hooking the matrix multiply function, because a 1 was written by the delay slot in the bottom right of this 16 cell square matrix. Not to worry, I'll just do this myself in lua:
Ms[offset][3][3] = 1.0
...
The end.
I don't mean like a detailed breakdown or anything (unless you really want to).
It's been nice even just for myself to piece this together and look at my mistakes. Hopefully it's useful for you, and at the very least you can see that I got pretty lucky (with a little help from persistence).
I'll upload my code once the events.onmemoryexecute is working properly so I can check it's bug free :)
whiteted#2289 on discord
Goldeneye 00a TAS due to be completed circa 2030
Code will follow sometime
The full set up injuring the arm needs 1 in 10 raw RNG luck (1 in 3 for the animation and 3 in 10 for the door) plus the correct lag but is otherwise humanly doable. There's already a 1 in 6 chance for best Doak position and a 'good Trev' is effectively RNG though saves < 1 second.
It may come to console yet :)
Great minds eh :)
For sure I can share. I'm a big fan of making paper notes which I number before they leave my desk so it's kinda documented. My method was pretty haphazard tbh because it's the first major bit of reversing I've done on a game, but I've definitely come out of the other side with something more definitive. Also bear in mind that I got pretty lucky.
Starting out I had some knowledge of the standard bits of memory courtesy of Wyster which I've extended slightly in my travels, and I'd done some reversing for a mod that I made recently. Crucially I had already made & improved & debugged & remembered-that-lua-is-one-based-for a lua HUD. My plan was to find some kind of boxes and throw it in this to make sense of it.
Getting started
Unfortunately my 'in' isn't so documented because it was doing reversing in ghidra, so we have to do a little speculation. In the-elite (Goldeneye speedrunning) people call me a TASer but it's not so much actual TASes that I make (until now) but just exploring strategy ideas using emulator. At the end of last year I was fleshing out an old strategy idea which I won't excite you with (TAS here, heartbreaker here). It relies on random shot spread to actually hit the hostage, so I looked into that.
I had a neat (though no doubt unoriginal) idea for this. I dumped the rom in virtual memory from Project64, and found all calls to the RNG (I already knew the address from Wyster, so Project64's debugger found the update function). Then I wrote some assembly code to look the RNG's return address up in a table of values at a specific address. If it found a match then it returned the non-random value from the table, else it returned the generated random value. Coupled with a lua script, this lets you take something observable and random (gun spread) and binary search for where it calls the RNG. I quickly found that it made 2 pairs of calls for x and y spread. This debunked my hope that playing in wide/cinema would widen your gun spread.
Back on topic though, this gave me a starting point - I had found the code which generated a random shot, so the code for testing collisions shouldn't have been too far away. Bear in mind that I'm by no means an expert at reversing, and I've pretty much only used Ghidra against Goldeneye, so I won't lecture you. The decompiler is very impressive imo, and with 0 effort the output can still be really good. One thing I always bear in mind is not to have too much confidence on the signatures that it gives functions, unless you've gone and looked at it. I just focused on the control flow, and at 7f03b15c there's a function which calls the 'makeRandomShot' function at +0x48, and has 2 main loops near the bottom. Highly suspicious :)
In summary: Hook RNG -> Find shot code
Project64 scripts
From here I started 'hitbox_chasing.js', a Project64 script to hook some of these calls and just shout to say that they'd run. I found a function that ran once for each guard that the shot passed near to.. lower .. a function with a jump table .. lower .. and bingo a function which was clearly doing vectory shit and returning a boolean. The main thing which I'd been following was the shot direction vector. The script was really useful for verifying my reversing, and I found it a really good companion because you might have been looking at various values to do with the leg, but then in 5 seconds you can get those same values printed out for the head instead. Or a different guard. I could shoot a guard in the left forearm and it would say I've hit hitbox #10, and describe a box which is long and thin.
This function took 4 things:
- some origin offset, always (0,0,0) [Perhaps guards also use this to shoot :) ]
- shot direction vector
- hit box data
- hit box matrix
So looking at this function, I could parse the hitbox data. It is just Body part #, X min, X max, Y min, Y max, Z min, Z max. But I still needed to be able to find the matrix.
I went back and I tried to piece together what was going on. The Project64 scripting was useful again, but really I was going in the wrong direction.
Basically these hitboxes are linked from '0xA-type' 'skeleton objects'. The skeleton objects live in a binary tree structure with backlinks. I realised that they had up to 3 pointers but I was thrown off because the backpointers usually go back many steps, rather than just to the parent. If I had just looked at a sibling of the vectory function, I'd have seen code walking up the skeleton looking for a matrix (on a 0x2-type skeleton object normally). My thinking was that at some point I'd have to look back up the call stack and trace my parameters, but the much clearer code was down low. I gave up and went to sleep :)
Sunday
The next day I was feeling kinda low because we're in corona lockdown and my corona project seemed a bit stuck. I think I must have put a breakpoint on reading these 3 pointers and I was blessed by finding an amazing function at 7f06f0d0. It literally walks the skeleton, following the pointer at 0x14 until it sees a nullptr, then stepping back on 0x8 and looking for 0xC. I did some skeleton-walking myself, and found that type 0xA signified hitboxes. So I just had to see how it got hold of the skeleton root.
Then I noticed it came from a familiar value (the 'model data pointer') that I'd seen in the long stack of calls earlier. I suddenly realised that this is actually kinda familiar, and I knew how to find it from Wyster's "GuardData". The sibling function that I mentioned explained how to find the matrix within a list linked off of this model data pointer.
Finishing up
So profit. I had the hitboxes, but with 2 issues:
(a) The memory that the matrices are written to is reused even before the next frame is drawn
(b) The matrices were for the view projection, whereas I also wanted their global coordinates
(a) has been 'solved' using lua to hook the end of some matrix multiplication code, looking for writes to guards' matrix lists. Currently I'm getting a crash but the code does work for a little while before it runs out of memory.
(b) To get them locally I could use the matrix that my HUD uses, but I've always known that to be a bit of a hack - my HUD lags if you spin fast, and sometimes hops about a bit. My bot is going to use this for godlike aiming so it needs to be good. Instead I noticed that the 15 hitboxes didn't use consecutive indices in the matrix list. I just tried multiplying by the inverse of the unused matrices at [16], [13], [9] and [4], and really liked the look of [4]. It's effect was to fix the centre of the gut hitbox, and the direction that the guard was facing (though his animation might still spin or whatever). I was very fortunate that I could correct both of these. The guard's point position is readable from the GuardData and coincides with the center of the 'gut hitbox', and I just happened to have found guards' facing angles in memory a while back.
The result shows guard's hitboxes 2 in-game frames ahead of where the guards are visually, which is pretty neat. As a bonus it reveals the view matrix, which I can use on the shot direction if I like.. or track down more reliably in memory.
To come back to lua my worst error was hooking the matrix multiply function, because a 1 was written by the delay slot in the bottom right of this 16 cell square matrix. Not to worry, I'll just do this myself in lua:
