the cutting room mirror

Harry Potter and the Goblet of Fire (PlayStation 2, Xbox, GameCube, Windows)

PSP-specific#

Below are findings specific to the US (ULUS10032) PSP release of the game. Similar counterparts may or may not exist on other platforms.

Remnants of cut "Prefects' bathroom" level#

Unlike other releases of the game, the PSP version does not include the "Prefects' bathroom" level.1 It is skipped entirely in the level progression. The level may have been removed for performance reasons, though the exact reason is unknown.

Level strings#

Once the game has started, and at least by the time the main menu is loaded, the names of all normally accessible levels are referenced multiple times in RAM. Each level generally appears in both its first-time and re-entrant forms, for example:

lvl_003_DragonWoods
lvl_003_DragonWoods_ReEntrant

lvl_006_Herbology
lvl_006_Herbology_ReEntrant

The following strings are also present:

lvl_005_PrefectsBathroom
lvl_005_PrefectsBathroom_ReEntrant

However, each of these appears only once in RAM, unlike the strings for levels that are still fully implemented. This suggests that most of the PSP-specific implementation for the level had already been removed.

Force-loading the cut level#

The function beginning at 0x089F031C is executed when a level begins loading. At entry, register a1 initially corresponds to the selected level ID.

Some observed values are:

0x09 - Forbidden Forest (first-time "Escape" sequence)
0x0A - Forbidden Forest (ReEntrant)
0x0B - Triwizard Task 1: the Dragon (from menu)

0x0C - <<crash/blank screen>> (originally PrefectsBathroom)
0x0D - <<crash/blank screen>> (originally PrefectsBathroom_ReEntrant)

0x0E - Herbology (first time)
0x0F - Herbology (ReEntrant)

If execution is paused at 0x089F031C and a1 is changed to 0x0C or 0x0D, the game proceeds to a blank screen and softlocks.

The placement of these two unused IDs between the Dragon and Herbology entries, together with the surviving level-name strings, indicates that "Prefects' bathroom" still occupied its original slot in the PSP level table even though its playable implementation had been removed. This suggests the level was cut relatively late during preparation of the PSP release.

Further information on the PSP release levels of the game is available.2

Developer command system#

The PSP executable retains a substantial developer command system which is still initialized and called by the retail startup code.

The main startup command dispatcher is located at 088D3EF8. Positional command-line arguments are passed to the command handler at 088D3E84, with the source name Command Line. If no positional commands were supplied, the dispatcher checks for a StartLevel option. When present, it constructs the following command:

LevelManager.LoadLevelFolder %s

The dispatcher is called from the main PSP initialization routine at 08806014, so this is functional code rather than an unused string table.

Several other development-oriented startup switches are also still parsed, however, it is unknown how to legitimately pass commands to the release of the game and not modify RAM directly. audiostats enables an audio statistics flag, audiodebug enables an audio debugging flag, and aptdebug changes the APT/Flash frontend debugging callbacks.

showfps is another leftover startup option. During initialization at 088D4C08, the game checks for showfps and stores the result in the byte at 08CCEC78:

byte 0x08CCEC78 = CommandLineHasOption("showfps");

However, 08CCEC78 is never read afterwards in the PSP executable; its only meaningful code reference is this write during initialization. As a result, showfps has no effect in the retail PSP build and appears to be a remnant of an FPS display which was disconnected or removed.

RAM address

Purpose

088D3EF8

Startup developer-command dispatcher

088D3E84

Handler used for command-line commands

08CB9317

Startup-mode flag which gates the command dispatcher

08CCEC78

Result of the unused showfps startup option; written but never read

The byte at 08CB9317 is initialized to zero. If it is nonzero, 088D3EF8 immediately returns without processing developer commands. The startup code sets it to 1 only for a special three-argument mode where the second argument is parsed as a MAC address. Consequently, setting this byte to 1 does not enable debugging; it disables the useful command-line path.

Registered developer commands#

Numerous developer/cheat command groups are still registered by the PSP executable.

Registry

Registration routine

Notable commands/options

LevelManager

089EFAE4

LoadLevelFolder, LoadSavedLevelFolder, LoadSaveGame, UnlockAll

SharedInventory

089A44C8

SetBeans, UnlockAll

CardManager

08A07A78

SetCard, ListCards, SetCardOwned, SetCardAvailable, SetAllCardsOwned, SetAllCardsAvailable, MasterTheMagic

ModelRender

088FC3EC

LOD override, untextured rendering, mipmap controls and lighting modes Normal, UnLit and Xray

ProfileRender / LayerProfiler

08904F74

Audio/Game/Render/Kernel CPU profiling, render display-list profiling, layer profiling, histogram, budgets and layer names

Audio

08945078

EnableDbgChan, ShowPathfinderEvents, ClearLog, ShowMixer and other mixer/reverb debugging displays

These registrations indicate that much of the original development console survived in the PSP executable instead of merely leaving behind command-name strings.

Unused developer behaviours#

Several explicitly development-oriented behaviours are also still registered with the game's object/factory system:

Behaviour

Registration routine

DebuggingModifier

089C44E8

FPSCamera

089C4F4C

StartupLevelSelector

089C56DC

PadComboEventSender

089C70E4

StartupLevelSelector is particularly noteworthy given the FrontEnd_LevelSelect_Debug level referenced by the level dictionary. PadComboEventSender also suggests that development functions could be connected to controller combinations through game data. No hard-coded PSP button combination which directly opens a debug menu has yet been identified.

Debug text renderer#

This needs some investigation.
Discuss ideas and findings on the talk page.
Specifically: Check the game's .str archives for instances or configuration data files for references to StartupLevelSelector, DebuggingModifier, FPSCamera, or PadComboEventSender in the game's data files. This may reveal how this unused functionality was originally meant to be accessed.

The executable also retains code for creating and displaying text through DebugRenderModule. One relevant global is located at 08CEE958 and is initialized to 0. Debug-render creation code at 088F6450 and 088F68E4 executes only while this byte is zero.

Thus, 08CEE958 is another inverted-looking debug flag: changing it from 0 to 1 suppresses the debug renderer rather than enabling it. The renderer itself has not been compiled out; content still needs to be submitted to it by another debugging system.

Debug Functions#

show_debug#

GobletofFire_ShowDebug.png

Show_debug appears to be a debug display related to created and destroyed lights.

Release

Action Replay code

GameCube (USA)

044B95F4 01000000

Unused Text#

RWS_GlobalFolder.LEVELDICTIONARY#

This needs some investigation.
Discuss ideas and findings on the talk page.
Specifically: Check all releases of the game to see if more test levels were accidentally included.

The level dictionary contains references to several test levels and their .str filenames.

FrontEnd_LevelSelect_Debug
2
Level Assets
{DE46C9F9-2439-4F1C-822E-95E20A926F7F}
Localised Level Assets
{C79B6EA7-B3AE-432D-9395-BC29732795CE}
lvl_wizard_card_test
1
Level Assets
{0CE9A036-3B0A-4A03-BC89-83076C6A61F5}
Name_lvl_test
1
Level Assets
{C6C34804-88B6-42A9-A14E-B825B2386D70}
PatrickSteele_lvl_test
1
Level Assets
{313891EA-3CFF-484A-B631-E820E0F7DEF1}
IainBell_lvl_test
2
Level Assets
{CE65C667-0F21-43FD-9CA9-F3225144BC62}
Localised Level Assets
{6E5A3E22-0BDF-48FC-AD76-5377CC38ABA5}
CiaraWillis_lvl_test
1
Level Assets
{F6E56604-D74C-44BA-BC59-AC22CD93B2E0}
NickT_lvl_test
1
Level Assets
{AA4DD17C-C565-482A-A8AF-C06726301637}
MichaelW_lvl_test
1
Level Assets
{0A51C2CF-8188-4C43-8FCE-1FC8C484402B}
WorldArt_Voldemort
1
Voldemort_Level Assets
{7AE56B2A-1C29-4E11-A78B-C48775D2CA69}
Leigh_lvl_test
1
Level Assets
{310D654F-C227-4F3E-8A9D-A31B4989C5FD}
Jeremy_lvl_test
1
Level Assets
{8E46C06A-4A5D-40F2-85D2-306B4DD63E11}
Chip_lvl_test
1
Level Assets
{50B293DF-F7AB-4C5C-A223-2A887C486C41}
WorldArt_DADA
2
DADA_Level Assets
{5F581329-3C32-45DE-89A4-F89A9EFC5F50}
Level Assets
{8AB19C2F-7E65-46FD-BBCE-D7DD6D98EDE9}

DIR Files#

Each .str archive contains a .DIR file that seems to have been generated whenever it was being built. It consists of paths and file sizes for raw assets as well as the build output. The game itself reads files based on a generated hash for filenames, which seems to make these unused.

{0CAD9A98-5219-40B3-9700-2361995C6DEF}.str#

Z:\gof_game\rws\GobletofFire\Build Output\Xbox\{0CAD9A98-5219-40B3-9700-2361995C6DEF}\ShaderCore\ZONE_lvl_003_05.xpm
Z:\gof_game\gamedata\art\world\levels\lvl_003_dragon_woods\maya\ZONE_lvl_003_05.ea3
295196
5144222
Z:\gof_game\rws\GobletofFire\Build Output\Xbox\{0CAD9A98-5219-40B3-9700-2361995C6DEF}\ShaderCore\TEXTURES\aw4_tx_gr_dense_forest_mm.xsh
z:\gof_game\art\world\gentex\groundcover_gr\aw4_tx_gr_dense_forest_mm.tga
44084
196652
Z:\gof_game\rws\GobletofFire\Build Output\Xbox\{0CAD9A98-5219-40B3-9700-2361995C6DEF}\ShaderCore\TEXTURES\terrain_sec_05_lm.xsh
Z:\gof_game\rws\GobletofFire\Build Output\LIGHTMAPS\_XBOX\{0CAD9A98-5219-40B3-9700-2361995C6DEF}\terrain_sec_05_lm.tga
44068
4194322

Placeholder String#

Each game file containing a text bank has this single placeholder string that was not removed.

<something for COMC>

GOF.DDF#

Present only in the GameCube release is a disc definition file.

[Input]
DvdRoot="D:\dev\burn_output\ngc"
[DiskID]
GameName=GH4E
Company=69
DiskNumber=0
GameVersion=0
Streaming=1
StreamingBufSize=0
DiskInfo="Goblet Of Fire"
TotalDisk=1
[LbaAlign]
[Layout]
1="movies.big",1
1="music.big",2
1="*.big",3
[BI2]
CountryCode=us

ELF Executable#

Also only in the GameCube release is a 200MB ELF executable with debug symbols named gof_f.elf. It appears to be the retail executable, as the MD5 hash matches with main.dol after stripping the symbols and converting it to a dol file.

References#


  1. https://harrypotter.fandom.com/wiki/Harry_Potter_and_the_Goblet_of_Fire_(video_game)↩︎
  2. https://github.com/TAbdiukov/PPSSPP-patches/blob/master/guides/Datasets/HP-GoF-Levels.md↩︎