Quick Update:
I will now be updating this thread with my progress.
I actually destroyed my DC's mobo while working on this.
I got contacted by LanDC regarding some new methods to pull this mod off.
Pretty much what is going on is:
I was working on a series of modifications to the Road to Amihama scene to create a test environment that will allow someone to ride a bicycle.
I attempted to replace the model of the motorcycle with Wang's bike from Ajiichi and replace the motion data with the tidbits of motion data that exists on the disc, for the bicycle.
I am doing this on the Japanese release of Shenmue 1. I am also comparing it to the BETA release from ShenDream to see if it is possible on there too.
The motion data is incomplete so a hybrid data must be created via hex editor to make a drivable bike.
I created the hybrid motion data by pretty much overwriting blocks of hex with the complete blocks from the bike data.
When loading the scene, the game crashes. I believe this to be some sort of hash check that doesn't add up or my hex skills suck, or my thoughts are incomplete about how the motion data instruction set works.
The breakdown for this mod goes like this, I will make this as simple as possible. A lot more detail is involved in the mod itself:
I am using LanDCs old mod combined with some methods from Kakuzawa to make the Road to Amihama walkable.
I hacked the map to also attempt to load the scripts needed to start the motorcycle scene.
^^ This is done by replacing some SCENE items with the SCENE for the motorcycle section, very half assed hack.
I swapped the model for the motorcycle with the bicycle. This is possible due to the mod that makes the road walkable. It constitutes a sector of RAM to load parts of dobuita, including the bike.
I then swap the memory addresses for the motorcycle with Wang's bike in hopes to begin the chainload sequence that will make the game engine look for the bike motion data (in our case the hybrid hacked motion data).
In best case scenario, the bicycle would load and Ryo will treat it like the motorcycle (on terms of engine level handling) but ride it like a bicycle.
The problem that occurs is that, it seems that the DC has a cluster of protected memory that the game loads information into. The bike model, or at least some pointer for it, exists in protected memory.
Since the memory swappage happens within usermode space, the game locks up since a kernel panic happens when usermode authenticated users try to escalate to system to mess with protected memory space.
To get around this, I used an existing but mostly unknown method to half crash the processor to get the kernel to write to protected memory [thanks Team Utopia for that one!]. This involves poking the mobo with a probe with the correct current, very similar to glitching the RAM on the PS3 to grab lv0 keys. Due to this process, getting this to work on NULLDC or DEMUL is slim to none.
I destroyed my USA Dreamcast doing this but I did get the exploit to work! Unfortunately, it worked for a second and then the fire came
. Unfortunately, Shenmue won't run on my Dev unit's hard drive.
So anywho,
When I wrote this on the Shenmue500k page, I got contacted by LanDC. I am now working with him on getting this mod completed, one task at a time.
He may be on to a new method to get this to work, but its by a long shot.
I will report what we find as long as it doesn't destroy any more Dreamcasts.
Luckily, I have 3 more!
I am looking forward to finishing this mod.
James