Saves 0003-0010: Before the Beginning

I was forced to read some email before making the first save, but not all of it. New diff: read the final email.

.hack//Infection reading email

Diff the files, ignore the time being different, and there’s a change in only a single byte: 0x23A4 changes from 02 to 04. Hmm. This’ll have to wait until I’ve got more emails, I think. Incidentally, that’s a lonely number in a sea of zeros. Probably this region will be filled in as events happen—maybe it’s a region for flags like reading email and news items. Speaking of news, why not check out that?

.hack//Infection reading news

Read the top news item, diff the saves… another single byte change. 0x2864 changes from 0x01 to 0x03.

Read the second news item, diff the saves… one byte, again. 0x2865 changes from 0x01 to 0x03.

Now, I’m not superstitious, but I think I’m seeing a pattern, here. Have a look at this region of the file:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00002860  FF FF FF FF 03 03 01 01 00 00 00 00 00 00 00 00  ÿÿÿÿ............
00002870  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00002880  00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00  ................
00002890  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000028A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000028B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000028C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000028D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000028E0  00 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01  ................
000028F0  01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00  ................
00002900  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00002910  00 00 00 00 01 01 01 01 00 00 00 00 00 00 00 00  ................

Above, it’s all 0xFF for a while, and below, it’s all 0x00 for a while. Reading news items flipped a bit on 0x2864 and 0x2865. I’ve got three unread news items left, and 0x2866 and 0x2867 are both 0x01, but I was hoping for three in a row. However, 0x2889 is also 0x01, and it’s pretty nearby, so my guess is that reading these three news items will switch all three of those to 0x03. Time for some testing…

Yep! The three bytes I predicted changed, in order, when reading the news items. My guess is that 0x01 means the news item is visible, and 0x03 means it’s been read. Probably the bytes between these are for other news items.

What else is there to explore? The Desktop Image can be changed, here, so let’s check that. Changing from Orange Blossom to Red Eye to Blue Moon causes 0x2236 to change from 0x31 to 0x32 to 0x33, respectively.

That’s pretty much all there is to be seen, before actually logging in to The World and starting the game proper. About 0.2% done mapping the save file. Isn’t it rewarding?

Written by Tracy Poff on Wed 28 August 2013.