PWT Download Tournaments

[Kaphotics]

Download PWTE 2.1 by Prof.9

==

So far there have been 4 download tournaments and one secret relic tournament locked away in the ROM; I might as well explain where it's at and how most of the important stuff is stored. I spent a little bit of time figuring out enough to get meaningful data out like text and teams, nothing more than that... so here's what I've found so far.

PWT download events are set into the save file in the latter half along with all of the other downloadable content like mystery gifts. The tournament region is 0x7A000-0x7DFFF, for 0x1400 bytes for each tournament * 3 tournaments. By just looking at a downloaded tournament, it's hard to visually see the general structure via a hex viewer because it doesn't display Japanese characters... for visual help, you can use /a/2/5/8 from B2/W2's files, as this was their hard-coded test tournament that has a bit of English text (and wasn't removed for retail release).

0xA-0x54: Tournament Name
~afterwards, there's text for describing the tournament

PKMs are set up to be as compact as possible, skipping nonessential stuff kinda like battle pkms. 52 bytes per PKM (0x34), one after another to make 6.

Structure of PWT-DLC PKMs:
0x0-0x1: Species
0x2-0x17: 11 character namefield (after names, they are usually 0xFFFF aka terminators, not characters)
0x18-0x19: Held Item
0x1A: Shiny Flag (00 or 01) ~ unconfirmed, hasn't been used except for the ROM tournament
0x1B: Ability
0x1C: HP EV
0x1D: ATK EV
0x1E: DEF EV
0x1F: SPE EV
0x20: SPA EV
0x21: SPD EV
0x22-0x23: Move 1
0x24-0x25: Move 2
0x26-0x27: Move 3
0x28-0x29: Move 4
0x2A: gender? ~ unconfirmed. may just be bitflags for stuff
0x2B: Nature
0x2C-0x2F: IVs (stored same way as pkms)
0x30: ??? always 0. might be secondary sparkle like N's
0x31: Ball
0x32: Current Level
0x33: Happiness

0x270: Start of Trainer 1
PKM1: 0x274-0x2A7
PKM2: 0x2A8-0x2DB
PKM3: 0x2DC-0x30F
PKM4: 0x310-0x343
PKM5: 0x344-0x377
PKM6: 0x378-0x3AB
0x3AC-0x3C1 - Trainer Name ~ not sure on the lengths of these
0x3CC-0x3DD - Trainer Class ~ as I haven't seen longer name/classes

Trainer win messages or something afterwards, didn't care enough to determine how they worked.

Next trainer:
0x650: start of trainer 2
0x654: pkm data....

0x3E0 between each trainer block, always 4 trainer blocks
(0x270, 0x650, 0xA30, 0xE10)

0x1400 next tournament... repeats...
0x1670 trainer 1...
0x1A50 trainer 2...

etc.

that's all I know, however there's certain bytes somewhere which make the game use other stuff in the ROM instead of the programmed PKMs or trainer name/class. I just wanted to get the important team sets out so I didn't bother figuring out the entire structure.

===

resources~


Excel Parser ~ paste in tabulated data strings into the proper cells. PKM related lookup tables from Bulbapedia & pkmcodedepo and character tables from here.
Ripped Tournament from the region I mentioned above (7A000-7BFFF). "PWT Download" for the file extension naming
example results from parsing stuff & (rom example)

[tommyhtc]

I found out recently that nintendo offers downloadble tournaments..
so I figure we could make our own tournaments..

this is a very good find and I really hope you can manage to develop a tool to edit tournaments,
or even better, find a way to create PWT files for people to share..

that would be awesome

[Prof. 9]

I was able to change the name of the new English tournament (before it was reissued) through save hacking:

Haven't done anything else yet, but I'll probably look into this some more.

Here are my notes:

SAVE OFFSET: 0x7A000
Size: 0x1314 (?)

CHECKSUMS:
0x1210: CRC-16 CCITT of 0x0000-0x1210 (0x1210)
0x1216: CRC-16 CCITT of 0x0000-0x1214 (0x1214)
0x1300: CRC-16 CCITT of 0x0000-0x1214 (0x1214)
0x1312: CRC-16 CCITT of 0x1300-0x1304 (0x0004)

Basically the tournament data has a checksum, then there is a checksum of the tournament data plus the checksum, stored in two places, and finally there's a checksum of THAT checksum.

[Poryhack]

Very interesting stuff.

[Prof. 9]

Got tournament injection and removal working:



Here's how it's done:

Step 1: Copy tournament block
Just write the whole tournament block (0x1314 bytes) to 0x7A000, 0x7B400 or 0x7C800. Make sure all checksums are valid!
See my previous post for notes on this.

Step 2: Set in block index
The block index is located at 0x19400 and 0x3F400. The game uses this to keep track of which extra storage blocks are used. To enable a tournament block after you've inserted it, write 0xC21E to 0x52, 0x54 or 0x56, and take the 32-bit value at 0x1304 in the tournament block and write it to 0xA0, 0xA4 or 0xA8. Afterwards, fix this checksum:
0xB0: CRC-16 CCITT of 0x00-0xB0 (0xB0)

Step 3: Update checksum list
The checksum list is located at 0x25F00 and 0x4BF00. The game uses this to check for corrupted blocks. Basically, take the checksum for the block index from step 2 and write it to 0x36. Finally, fix this last checksum:
0xA2: CRC-16 CCITT of 0x00-0x94 (0x94)

I've been working on a program to modify tournaments. At the moment, it can import and extract tournaments from a save file, as well as dump and load the raw tournament data (i.e. the first 0x1210 bytes of a tournament file); it will take care of all checksumming and stuff automatically. This should simplify tinkering with and experimenting on the data. It's still very much a work in progress, so there's not much to see yet. Source is included (but it's not the neatest thing I've ever written), and you'll need the .NET Framework 2.0 to run it. Hasn't been thoroughly tested, so use at your own risk, I guess.

http://www.mediafire.com/?8xh1eu37aiceb3x

So, time to start collecting those tournament files?

EDIT: Fixed step 2.

[Kaphotics]

２０１２にほんだいひょうにちょうせん - 2012 Japanese Video Games Championship (parse output)
チャンピオン　ワタルにちょうせん！ - Challenge the Champion, Lance! (parse output)
しゅうけつ！ジムリーダー！ - Gathered! Gym Leader!
でんせつの　ローテーションバトル！ - The Legendary Rotation Battle!

I don't have "The Battle of Legendary Pokémon!" which started Sep 14th.

[Prof. 9]

This seems to be the basic memory layout:

Tournament (0x1210 bytes):
0x0000: Tournament settings (0x274 bytes)
0x0274: Trainer 1 (0x3E0 bytes)
0x0654: Trainer 2 (0x3E0 bytes)
0x0A34: Trainer 3 (0x3E0 bytes)
0x0E14: Trainer 4 (0x3E0 bytes)
0x11F4: ??? (0x1C bytes)

Trainer data (0x3E0 bytes):
0x000: Pokémon 1 (0x34 bytes)
0x034: Pokémon 2 (0x34 bytes)
0x068: Pokémon 3 (0x34 bytes)
0x09C: Pokémon 4 (0x34 bytes)
0x0D0: Pokémon 5 (0x34 bytes)
0x104: Pokémon 6 (0x34 bytes)
0x138: Trainer settings (0x2A8 bytes)

A bunch of tournament settings that I figured out the meaning of:
0x000 = ?
0x001 = ?
0x002 = ?
0x003 = ?
0x004 = ?
0x005 = ?
0x006 = ?
0x007 = ?
0x008 = ?
0x009 = ?
0x00A = Tournament Name (37 characters)
0x054 = Tournament Description (75 characters)
0x0EA = Battle Rules (111 characters)
0x1C8 = Minimum amount of Pokémon required
0x1C9 = Maximum amount of Pokémon allowed (also the amount the opponent will use)
0x1CA = Allowed Level (8-bit)
0x1CB = Level style (0x00 = normal, 0x01 = minimum, 0x02 = maximum, 0x03 = scale down, 0x04 = set, 0x05 = scale up)
0x1CC = Maximum total party level (16-bit)
0x1CE = Allow duplicate Pokémon (1 bit)
0x1CF = Allow duplicate items (1 bit)
0x1D0 = Banned Pokémon (656 bits, 1 bit per species)
0x222 = Banned Items (608 bits, 1 bit per item)
0x26E = ?
0x26F = Battle Type (2 bits) (Single Battle, Double Battle, Triple Battle, Rotation Battle)
0x270 = Use World Champion battle music instead of PWT Finals battle music (1 bit)
0x271 = Allowed Type (8-bit) (if 0x11, all types are allowed)
0x272 = Banned Move (single 16-bit value; only 1 move can be banned (Sky Drop?)?)

Surprising amount of rules you can make with this. 0x26E seems to be always 0 and 0x00-0x09 I can't get any breaks from, so I have no idea what they do.

EDIT: rectified a typo: level style 0x05 should be scale up, not set.

[Kyogre1]

Interesting, please let us know when you find out more.

[Kaphotics]

first trainer settings, offsets after the pkm data; trainer data starts at 0x0000

0x138-0x157 - Trainer Name (0x20 bytes)
0x158-0x183 - Trainer Class (0x2C bytes)
0x184-0x217 - Trainer Intro (0x94 bytes)		~ close each entry with 00 F0 01 BE 00 00 then pad with FF
0x218-0x2AB - Trainer OnDefeat (0x94 bytes)		~ ^.. might be "wait for A button press to continue"
0x2AC-0x33F - Trainer OnVictory (0x94 bytes)		~ ^
0x340-0x3D3 - Trainer Extra? (0x94 bytes)		~ ^
0x3D4-0x3DF - Flag Settings

note: 0xFFFE (FE FF) stands for line break

You can do editing of the tournament in the RAM if you choose so. Upon accessing the PWT Tournament menu, t_download_save.c brings up the tournament; the data for the tournament begins at (english offsets)

Bot Tournament: 0x02293BE8 w2 / 0x02293BC8 b2
Mid Tournament: 0x02294E28 w2 / 0x02294E08 b2
Top Tournament: 0x02296068 w2 / 0x02296048 b2

0x1240 gap between tournaments positions, because there's stuff right before the data itself (t_download_save.c)


That way you can make changes on the fly instead of editing the save file each time you want to tinker with an unknown byte. With that said, there has to be a setting to choose what sprites to use (would special music be set too for the Region Leaders?), and if trainers tend to use certain combinations for their team. There's 4 slots for trainers and data, there has to be a flag that signifies either a trainer or PKM isn't used. Also, the whole "rigging" of the tournament for opponents.

[Kyogre1]

There must be a flag which determines if the game displays the texts from the downloaded data or something from the ROM.
Also, in some tournaments it's completely random which trainer is the final opponent and sometimes it's always the same person (in the WCS one for example).

[PortalDark]

could it be possible to emulate a PWT server to make a custom tournament downloadable?

[Kyogre1]

No, it's protected by SSL.

[PortalDark]

No, it's protected by SSL.

damn, why after the gts exploit, they find funny to secure any kind fo connection*sarcasm*

[Pingouin7]

damn, why after the gts exploit, they find funny to secure any kind fo connection*sarcasm*

GTS exploit was working in Gen IV, then they find it funny to not fix the exploit when releasing Gen V.

[PortalDark]

GTS exploit was working in Gen IV, then they find it funny to not fix the exploit when releasing Gen V.

it could be cool if you could emulate the server for many stuff(i dont really care DW as it is fun the way it is, but PWT is another story)
i think that if in Gen VI they dont fix it its because they find it funny