Rez Hacking

I'm still pretty impressed by the fruity loops import of the tracks

 

Those were very fun to make. I made a better one of Area5, which I plan to make a video of as I have the time.

 

Well. I've been messing around with disassembling the binaries in the beta... Hoping to find some way to invoke the PassEditor, but no luck yet. Saying that, I know absolutely nothing of Assembly. Jumping in the deep end, but at least it looks interesting to have a clearer view of the binary, one that isn't entirely hexidecimal.

Does anyone else have any interest in hacking this game still? I've seen people doing similar things to what I've done in the past, in terms of replacing the beta music and such... Simple things. But I've not seen anyone delve beyond that.

Even though we have a beta to mess around with. With a development binary.

Anyway, to add to what I've discovered, you can press the P key at the level select to unlock all levels.

The NODA debug mode allows you to spawn different enemies, but it only works in Area4 from what I've tested... Feel free to prove me wrong.

If you press L + R on the first controller while in free camera mode (F8), you can increase the camera speed. If you double tap any button on the first controller, you move at double speed while holding the second tap down.

And here's a segment from the 1ST_READ;

Bolded the points of interest.

From what I gather, this is the part that determines what console you're using (Dev, retail, etc), the region, and then sets the start flags accordingly. Most of this relates to the pins on a dev kit, but still applies to a retail kit. Though only because the console flags should all be 0 for the mass production unit.

I'd thought that perhaps the start flags may aid in being able to use the pass editor... But I really don't know. And perhaps it's irrelevant. Still, interesting nonetheless...

 

All these years later, I'm still devastated that Sega/UGA couldn't finalise the intended deal with Warp Records to include Aphex Twin's music in Rez - wasn't Come To Daddy meant to have been the soundtrack for its second area? I realise this was definitely planned, but to my knowledge no build with this particular song implemented has surfaced (yet)...

 

Well, the beta we do have seems to have been just before that music was abandoned. The area select uses it for Area 2, and a texture in the system folder has Aphex Twin listed. As well as Extra, by Ken Ishii for Area 3, though that was placeholder for Creation The State of Art. Area 4 uses Music Response by the Chemical Brothers in the level select too.

 

I'm sorry for the double post, but I've got some images I'd like to share...






These are all beta. The first two are seen here, while that last one is the beta version of the giant missile firing enemy from Area1.
Does anyone feel like reverse engineering the Rez .NB format? It's a Ninja model container format variant...

 

Interesting read I didn't think REZ's audio sequencing was that complex thanks for sharing blaarg.

 

I realize it's been a long time. I think I've gotten pretty much all of the possible commands and available features of this beta documented.
I've had no luck finding the level editor.

I'm planning on remaking my FL Studio videos with finished songs and better quality.

 

For debug mode in the final version (pal) you need to change the byte at address 8C28E08D from 05 to C5.



For Demul and Cheat Engine, that should be address 2C28E08D.

 

I've been following your work for quite some time now, impressive every time! Great discovery regarding the debug menu in the retail version of the game! Have you managed to find any hidden things in the final code?

 

Cool stuff!

 

I've not looked into it in the same depth I've looked into the beta, currently, though there is certainly some extra content to the debug system. The console window doesn't output all the information it would output in the beta version and lots of text strings no longer get printed to the screen, there might be a bit to set to enable this so I'll have to look again. Even if text strings have been removed from the code, data the console window would output still gets written into memory, so that at least should be possible to enable again. The level editor is still referenced in the data along with text strings for it's commands, but it isn't something that can be activated from the debug menu.

There is a file called WIRE.BIN which is missing from the final and not implemented in the beta, but it does exist in the PS2 version.

 

Thanks for making such an extensive video, loving the no clip camera also

 

I want newsed it for french DC-lover but i don't understand. Can you explain ?
You change the byte on the cdi ?

Thanks

 

I think the Cheat Engine code is for Action Replay / Gameshark. Don't know about the first code..

 

well done!
this game have really interesting debug mode, is it enabled automatically then run on DevBOX ?

btw, http://tcrf.net/ is good place to post such info about games, like debug modes, secrets, unused resources, etc.

 

The first code is a ram address, the second is the ram address when you're playing the game in Demul and using Cheat Engine on it. I'm going to look into making a code that can be run with codebreaker.

The debug mode is always disabled, a byte in the system flags would get set to C5 in the beta and that would run the debug mode. This doesn't happen by default in the final version, though doing the same thing manually will enable it. It will work on retail units as well as dev units, though I'll need to make it a codebreaker code for retail units.

 

OK, thanks for explanation.
actually this is "flags dword" at c28e08c in RAM, besides 0x00c000 I've seen at least checking of few MSB bits (for 0x000003 and 0x000004), and as I see in game code some bits OR-ed by game, so thats why I asked about is it enabled on DevBox.
Need to examine game ram dump in IDA Pro to verify, is there any way to enable debug mode by entering some code or smth.

 

Use Cheat Engine with Demul, then load the Rez cheat table from this .zip file. I've included some notes on some value locations, nothing too extensive.

I can't test this, but this is a codebreaker code for debug mode in Rez, please let me know if this works if anybody has time to test it.
0028E08D
000000C5