Star Wars: Battlefront II (PlayStation Portable)

Star Wars: Battlefront II is shrunken down to PSP form for handheld wars in the stars, quite competently at that.

The PSP version retains several development features in its executable, including automated multiplayer testing, network simulation, demo-build settings, and a multiplayer administration system.

The addresses below are runtime addresses.

Development Build Flags#

Final Build#

A byte at 0x08C64F8C determines whether the game identifies itself to the shell as a final build.

During shell initialization at 0x08AD0140, a non-zero value causes the following Lua global to be created:

gFinalBuild = true

The retail value is 01. Setting the byte to 00 before shell initialization prevents gFinalBuild from being created, selecting the executable's non-final-build path.

Demo Build#

Several nearby bytes control demo-related Lua globals.

0x08C64F8D

Enables gDemoBuild. Retail value: 00.

Enabling it also creates gDemoHasMP.

0x08C64F8E

Enables gNoNewProfiles. Retail value: 00.

0x08C64F8F

Enables a controller-change restriction. Retail value: 00.

0x08C64F90

Enables gXBox_DVDDemo. Retail value: 01.

0x08C64F91

Enables gE3Demo. Retail value: 01.

0x08C64F92

Controls gDemoHost. Retail value: 00.

0x08C64F95

Enables gDemoHasSplitscreen. Retail value: 00.

The Xbox DVD demo and splitscreen flags are leftovers from the game's shared codebase.

Unused Command-Line Arguments#

The game still contains a command-line parser at 0x08815C0C. Startup code at 0x08ACFF78 passes argc and argv to it.

Arguments may begin with /, -, or +. Most names are identified by a lowercase FNV-1a hash rather than direct string comparisons.

Needless to say, PSP games do not normally accept command-line arguments. As such, these arguments either have to be fed directly in RAM, or their effects need to be activated through memory editing.

Network Simulation#

Four options enable an artificial network-condition simulator:

/bandwidth
/latency
/loss
/jitter

Using any of them enables the simulator through 0x08C4DCB8.

Their values are stored at:

0x08C4DCBC - bandwidth
0x08C4DCC0 - latency
0x08C4DCC4 - packet loss
0x08C4DCC8 - jitter

The network code actively uses these settings. Function 0x08A847B8 applies latency and jitter, while 0x08A84C5C handles simulated packet loss.

AutoNet#

The option:

/autonet

enables an automated multiplayer testing mode.

Its enable byte is at 0x08C505B4, with the selected mode stored starting at 0x08C505B5.

Function 0x08AAD5B4 recognizes:

Host
Client
Dedicated

AutoNet then uses 0x08AB3710 to navigate the multiplayer menus automatically. It generates normal menu inputs such as:

Input_Accept
Input_Back
Input_GeneralUp
Input_GeneralDown
Input_GeneralRight

It also recognizes screens including:

ifs_mp_autonet
ifs_mp_createopts
ifs_mp_createoptsds
ifs_mp_lobbyds
ifs_mp_sessionlist

Automatic Map List#

AutoNet supports up to 32 map entries.

The entry count is stored at 0x08C505DC, while the list begins at 0x08DE3E38. Function 0x08AAC124 adds entries.

If no map has been supplied, AutoNet adds:

hot1i
250
250

and continues through the multiplayer setup.

ADMIN Commands#

The executable contains a multiplayer administration system with its main parser at:

0x08A81974

Commands begin with:

/ADMIN

The prefix is checked at 0x08A80B1C.

Login#

The system supports:

/ADMIN /login <password>

The password is stored starting at 0x08C4D1C9 and can be set at startup with:

/adminpw <password>

The startup parser limits it to 15 characters.

Successful authentication returns:

logged in

Network Interface#

Function 0x08A81574 handles a network message identified by J. Its text is converted to UTF-16 and passed to the admin parser at 0x08A81974, after which the response is sent back over the network.

The parser also has a trusted internal mode. A non-zero third argument bypasses the normal login check.

Retained Commands#

The command dispatcher at 0x08A809C8 contains 18 command IDs.

Wait for Late Moves#

Command 0 controls whether the host waits for late network moves.

host will wait for late moves
host will not wait for late moves

Drop Map#

Command 1 removes a map from the rotation.

map dropped

Split Updates#

Command 2 enables or disables split network updates.

List Players#

Command 3 lists connected players.

List Maps#

Command 4 lists the current map rotation.

Boot Player#

Command 5 boots a player by ID.

booted player %d (%s)

Add Map#

Command 6 adds a map to the rotation and accepts two additional numeric values.

map added

Set Next Map#

Command 7 selects the next map.

next map set

Lag Version#

Command 8 changes the network lag-handling version.

host will use lag version %d

End Match#

Command 9 ends the current match.

ended

Drop Lag Jumps#

Command 10 enables or disables the "drop lag jumps" setting.

Network Status#

Command 11 prints several network settings.

waitlate(%d) lagversion(%d) splitupdate(%d)

Quit#

Command 13 exits the game or server.

quitting

Bandwidth#

Command 14 reads or changes the bandwidth limit. Accepted values range from 33 to 3071.

setting bandwidth to %d kbps
bandwidth: used(%d) limit(%d)

Automatic Bandwidth Detection#

Command 15 starts a bandwidth test by setting 0x08C4D1C8.

Function 0x08A81180 handles the test and reports:

detected and set bandwidth %d kbps

Network Window Size#

Command 16 reads or changes the network window size. Values from 1 to 5 are accepted.

setting window size to %d
window size %d

Change Password#

Command 17 changes the administrator password.

Negated Commands#

Some boolean ADMIN commands support a /no form. This is used by the late-move, split-update, and drop-lag-jump controls.

Other Development Arguments#

No AI#

/noai

Sets the flag at 0x08C2AFE4, which is referenced by gameplay code at 0x08A063E4.

No Render#

/norender

Sets the flag at 0x08C5062C and also disables movie playback.

Recording and Playback#

Both options use the mode variable at 0x08C4F280.

/record

sets it to 1, while:

/playback

sets it to 2.

Profile#

/profile

sets the byte at 0x08C24A1C.

Fixed Rate#

/fixedrate

stores a floating-point value at 0x08C50630.