Extending the demo: Tales of Destiny II & Tales of Phantasia (PlayStation)
Exploring more prerelease demo builds
As we have seen in previous editions, 1990s demo discs often have extra stuff on them. Developers typically limited what you can see and do in demos by adding superficial restrictions to their game’s code, rather than carefully stripping every unnecessary bit out of content from it.
Last week, we looked at how the developers of Tales of Destiny left some cool debug functionality in the prerelease demos of that game. This week, we’re going to examine the other prerelease demos in the Tales of games for PlayStation.
You can get the patches described below from GitHub:
Tales of Destiny II (a.k.a. Tales of Eternia)
Before we check out the demo version of this game, let’s see what the retail version does at startup:
Like every PlayStation game, it runs the program indicated by the
SYSTEM.CNFfile. For the NTSC-U version, that’s SLUS_013.55.That program’s header has a pointer to an initialization function, which is where execution starts. That initialization function hands off control to another function (at
80022a00in the NTSC-U version), which does more setup.One of the setup functions checks the CD file system for two files: SLPM_805.86 and DEBUG.TXT.
Neither of those two files are present on retail discs, so the checks fail. What happens if we add them? If SLPM_805.86 is available, the game starts calling itself PREVIEW EDITION.
If that file isn’t available, but DEBUG.TXT is, something different happens: a build date appears in the top-left corner of the title screen. Furthermore, the main menu gets a new Debug item.
Selecting the Debug item takes you to a special area with several characters. You can talk to them to activate various game features – see TCRF for details.
OK, that’s the retail version. What about the prerelease demo? Do these file tricks work on it? Well, no. SLPM_805.86 is actually the name of the executable for the demo version of the game – it’s already on the disc. And the demo version doesn’t check for DEBUG.TXT at all.
All is not lost, however. The game records whether the special files were present at startup by setting bits on a 2-byte “debug flags” field:
SLPM_805.86: The value gets OR-ed with
0x08000.DEBUG.TXT: The value gets OR-ed with
0x0002.
The demo version of the game interprets this field the same way the retail version does. Clearing the preview file’s bit removes the demo restrictions. Setting the debug file’s bit gives us the debug features:
According to the build strings, the demo version is from Sep 15 2000. The Japanese retail version is from Oct 29 2000. The demo doesn’t seem to be missing much – it’s got the same set of files as the final version, save for one of the FMVs.
My patch clears the preview bit and sets the debug bit. With it applied, you can use the debug menu (press Start in the debug area) to warp to arbitrary locations, bypassing the usual demo restrictions. You can also walk through walls and obstacles by holding Square. Leave a comment if you find anything interesting!
Tales of Phantasia
Whenever you change screens in this game’s preview version, the function at 80011dd8 executes. With my variable names added, Ghidra’s decompilation of it looks like this:
void set_game_mode_80011dd8(int param_1)
{
if (game_mode_8006cf18 != param_1) {
last_game_mode_8006cf1c = game_mode_8006cf18;
}
game_mode_8006cf18 = param_1;
return;
}That is, it sets the “game mode” address to a value specified by the caller (it also saves the last value). When you go to the main menu, the value is 0x03; when you go to the option screen, the value is 0x07; etc.
By changing the values that the callers pass in, we can jump to arbitrary screens. Changing the main menu’s New Game item to use screen 0x0a takes us into this game’s debug area. It looks different from Tales of Eternia’s, but the idea is the same – interacting with each character in the scene activates a different game function.
Unlike Tales of Eternia, getting to this room doesn’t activate debug controls. Those are controlled by the one byte value at 80098e70. The game is actually overwriting this with zero on every frame (in the function at 8001db98).
That’s easy to fix – we can change the function to write a one instead. The s3 register has that value already loaded, so the MIPS instruction becomes:
8001dbe8 sb s3,-0x7190(v0)This gives us the ability to walk through walls and out of bounds by holding Square.
It also enables a hidden debug item in the menu during battles:
My patch makes the changes described above. As above, leave a comment if you find something cool! This disc is from 1998-10-09, a few weeks prior to the final version (1998-11-21).
Outro
Thanks for reading! For more on demo discs, check out the latest Hidden Palace Podcast episode. I lead a discussion about the various things I’ve found while sifting through the PlayStation library:
There will be more Rings of Saturn soon. Subscribe to get new editions delivered directly to your email.
