A Technical Guide to Arbitrary Code Execution (NewGame+)

# A Technical Guide to Arbitrary Code Execution

### Castlevania: Order of Ecclesia

- Arbitrary Code Execution works on European releases of the game
- Addresses mentioned in this guide come from the European DS version

---

## Definitions

### Statistics

```
typedef struct Resources
{
    uint16_t hp_current;
    uint16_t hp_passive;
    uint16_t mp_current;
    uint16_t mp_passive;
    uint16_t heart_current;
    uint16_t heart_passive;
}
Resources;

[0x021078d0] struct Resources resources;
```

```
typedef struct Sleeve
{
    uint16_t left;
    uint16_t right;
    uint16_t back;
    uint16_t union;
    uint16_t body;
    uint16_t head;
    uint16_t legs;
    uint16_t ring_1;
    uint16_t ring_2;
}
Sleeve;

[0x021078dc] struct Sleeve sleeve_current;
[0x021078ee] struct Sleeve sleeve_a;
[0x02107900] struct Sleeve sleeve_b;
[0x02107912] struct Sleeve sleeve_c;
```

```
typedef struct Attribute_Points
{
    uint16_t strike;
    uint16_t slash;
    uint16_t flame;
    uint16_t ice;
    uint16_t thunder;
    uint16_t light;
    uint16_t darkness;
}
Attribute_Points;

[0x02107938] struct Attribute_Points attribute_points;
```

### Map data

```
typedef struct Coordinates
{
    uint8_t x;
    uint8_t y;
}
Coordinates;
```

```
typedef struct Pins
{
    struct Coordinates pin_1;
    struct Coordinates pin_2;
    struct Coordinates pin_3;
    struct Coordinates pin_4;
    struct Coordinates pin_5;
}
Pins;
```

```
+----------------------+----------+----------+
|                      |   Area   |   Pins   |
+----------------------+----------+----------+
| Dracula's Castle     | 02107760 | 02107ceb |
| Wygol Village        | 021077de | 02107cf5 |
| Ecclesia             | 021077e2 | 02107cff |
| Training Hall        | 021077e6 | 02107d09 |
+----------------------+----------+----------+
| Ruvas Forest         | 021077f6 | 02107d13 |
| Argila Swamp         | 021077fe | 02107d1d |
| Kalidus Channel      | 02107804 | 02107d27 |
| Somnus Reef          | 02107824 | 02107d31 |
+----------------------+----------+----------+
| Minera Prison Island | 02107838 | 02107d3b |
| Lighthouse           | 0210784e | 02107d45 |
| Tymeo Mountains      | 02107856 | 02107d4f |
| Tristis Pass         | 02107870 | 02107d59 |
+----------------------+----------+----------+
| Large Cavern         | 02107886 | 02107d63 |
| Giant's Dwelling     | 02107890 | 02107d6d |
| Mystery Manor        | 0210789a | 02107d77 |
| Misty Forest Road    | 021078a2 | 02107d81 |
+----------------------+----------+----------+
| Oblivion Ridge       | 021078aa | 02107d8b |
| Skeleton Cave        | 021078b2 | 02107d95 |
| Monastery            | 021078ba | 02107d9f |
| Boss Rush            | 021076c6 | 02107da9 |
+----------------------+----------+----------+
```

### Miscellaneous

```
#define CASTLE_LAST_ROOM        0x022af1a0

[0x020d7e0e] uint16_t           dracula_hp_passive;
[0x021078dc] struct Sleeve      sleeve_current;
[0x021079e8] uint2_t			castle_unlock_flag;
[0x02107dac] uint8_t            character;
[0x021dd658] uint8_t            map_selection;
[0x0221fd20] struct Undefined * castle_entrance_reference;
[0x022b7216] struct Undefined   boss_rush_teleporter_dest;
```

---

## General rules

### Map completion

- **0b00** is used for unvisited areas
- **0b01** is used for areas visited in another playthrough
- **0b11** is used for areas visited in the current playthrough

### Coordinates

- X coordinates range from **0x0C** to **0xF4**
- Y coordinates range from **0x0C** to **0xB4**

---

## NewGame+ run

### Map completion

- Visit the **Monastery** as follows

```
                +---+---+---+---+
                |   |   | X | X |
                +---+   +---+---+---+---+---+---+---+---+---+---+
                |   |   |                           |   |       |
                +---+---+---+---+---+---+---+---+---+   +---+---+
                                                    | X |
        +---+---+---+       +---+---+---+---+       +   +
        | X   X | X |       |       | X   X |       | X |
+---+---+       +   +---+---+---+---+       +---+---+   +
|       |       | X | X   X   X   X | X   X | X   X | X |
+---+---+---+---+   +---+---+---+---+---+---+---+---+---+
                | X |
            +---+   +---+---+---+---+---+---+
            |   | X | X   X   X | X |       |
            +---+---+---+---+---+   +---+---+
                                | X |
                                +   +
                                | X |
        +---+---+---+---+---+---+   +---+---+---+
        | X | X | X   X   X   X | X |       |   |
        +---+---+---+---+---+---+---+---+---+---+
```

- The following ARM code is written at **0x021078B8**

```
+---------------------------+-------------+
| SUBEQS r0, r0, r5, ASR r5 | 00 50 05 55 |
| SUBPLS r0, r5, r0         | 50 55 00 00 |
| LDRBPL r5, [r5, -#401]    | 55 55 54 01 |
| LDRBPL r0, [r5, -#554]    | 55 55 05 54 |
| ANDEQ  r0, r0, r1         | 00 00 00 01 |
+---------------------------+-------------+
```

### Attribute points

- Set **attribute_points->strike** to **49165**
- Set **attribute_points->slash** to **57759**
- Set **attribute_points->fire** to **238**
- Set **attribute_points->ice** to **64255**
- Absorbing the glyph during the tutorial raises **all** attribute points
- The following ARM code is written at **0x02107938**

```
+--------------+-------------+
| MOV r12, LR  | e1 a0 c0 0e |
| BLX 02107d02 | fb 00 00 ef |
+--------------+-------------+
```

### Map pins

- Set pins from **Ecclesia** to **Tristis Pass** as follows
- The following Thumb code is written at **0x02107D02**

```
+--------------------+------+---------------------+
| PUSH {r1-r3}       | b40e | 10110 100 00001110  |
+--------------------+------+---------------------+
| LDR  r2, [PC, #54] | 4a15 | 01001 010 00010101  |
| ASR  r2, r2, #4    | 1112 | 00010 00100 010 010 |
| LDR  r3, [PC, #54] | 4b15 | 01001 011 00010101  |
| ASR  r3, r3, #4    | 111b | 00010 00100 011 011 |
| ADD  r2, r3, r2    | 189a | 0001100 010 011 010 |
| LDR  r2, [r2, #0]  | 6812 | 01101 00000 010 010 |
| ASR  r1, r3, #18   | 1619 | 00010 11000 011 001 |
| CMP  r1, r2        | 4291 | 01000 01010 010 001 |
| BNE  02107d34      | d10e | 11010 001 00001110  |
+--------------------+------+---------------------+
| LDR  r2, [PC, #4c] | 4a13 | 01001 010 00010011  |
| ASR  r2, r2, #5    | 1152 | 00010 00101 010 010 |
| STRH r1, [r2, #4]  | 8091 | 10000 00010 010 001 |
+--------------------+------+---------------------+
| LDR  r2, [PC, #48] | 4a12 | 01001 010 00010010  |
| ASR  r2, r2, #5    | 1152 | 00010 00101 010 010 |
| MOV  r3, #31       | 2331 | 00100 003 00110001  |
| STRH r3, [r2, #0]	 | 8013 | 10000 00000 010 011 |
+--------------------+------+---------------------+
| LDR  r2, [PC, #44] | 4a11 | 01001 010 00010001  |
| ASR  r2, r2, #5    | 1152 | 00010 00101 010 010 |
| STRB r1, [r2, #0]  | 7011 | 01110 00000 010 001 |
+--------------------+------+---------------------+
| LDR  r2, [PC, #44] | 4a11 | 01001 010 00010001  |
| ASR  r2, r2, #4    | 1112 | 00010 00100 010 010 |
| LDR  r3, [PC, #44] | 4b11 | 01001 011 00010001  |
| ASR  r3, r3, #4    | 111b | 00010 00100 011 011 |
| STR  r3, [r2, #0]  | 6013 | 01100 00000 010 011 |
+--------------------+------+---------------------+
| LDR  r2, [PC, #40] | 4a10 | 01001 010 00010000  |
| ASR  r2, r2, #5    | 1152 | 00010 00101 010 010 |
| ADD  r2, r2, #2    | 1c92 | 0001110 010 010 010 |
| STRH r1, [r2, #0]  | 8011 | 10000 00000 010 001 |
| STRH r1, [r2, #2]  | 8051 | 10000 00001 010 001 |
| ASR  r3, r1, #1e	 | 178b | 00010 11110 001 011 |
| STRH r3, [r2, #4]  | 8093 | 10000 00010 010 011 |
+--------------------+------+---------------------+
| LDR  r3, [PC, #38] | 4b0e | 01001 011 00001110  |
| LDR  r2, [PC, #38] | 4a0e | 01001 010 00001110  |
| ADD  r3, r3, r2    | 189b | 0001100 010 011 011 |
| LDR  r2, [PC, #38] | 4a0e | 01001 010 00001110  |
| ASR  r2, r2, #4    | 1112 | 00010 00100 010 010 |
| STR  r3, [r2, #0]  | 6013 | 01100 00000 010 011 |
+--------------------+------+---------------------+
| LDR  r2, [PC, #38] | 4a0e | 01001 010 00001110  |
| ASR  r2, r2, #5    | 1152 | 00010 00101 010 010 |
| ADD  r3, r1, #2    | 1c8b | 0001110 010 001 011 |
| STR  r3, [r2, #0]  | 6013 | 01100 00000 010 011 |
+--------------------+------+---------------------+
| POP  {r1-r3}       | bc0e | 10111 100 00001110  |
| BX   r12           | 4760 | 00100 11101 100 000 |
+--------------------+------+---------------------+
```

- Set pins from **Tristis Pass** to **Oblivion Ridge** as follows
- The following ARM code is written at **0x02107D5C**

```
+-----------------+-------------+
| ADDR 0x0cb40c0c | 0c b4 0c 0c |
| ADDR 0x15295980 | 15 29 59 80 |
+-----------------+-------------+
| ADDR 0x41afc140 | 41 af c1 40 |
+-----------------+-------------+
| ADDR 0x420f1b80 | 42 0f 1b 80 |
+-----------------+-------------+
| ADDR 0x420fb580 | 42 0f b5 80 |
+-----------------+-------------+
| ADDR 0x221fd20c | 22 1f d2 0c |
+-----------------+-------------+
| ADDR 0x22af1a0c | 22 af 1a 0c |
+-----------------+-------------+
| ADDR 0x456e4280 | 45 6e 42 80 |
+-----------------+-------------+
| ADDR 0x0cb40c0c | 0c b4 0c 0c |
| ADDR 0xdd4d9387 | dd 4d 93 87 |
+-----------------+-------------+
| ADDR 0x209fae40 | 20 9f ae 40 |
+-----------------+-------------+
| ADDR 0x420f3d0c | 42 0f 3d 0c |
+-----------------+-------------+
```

- Set **pins_boss_rush->pin_1->x** to **0x58**
- Instruction **0x020452C8** now branches to **0x021078B8**

A Technical Guide to Arbitrary Code Execution (Standard)

# A Technical Guide to Arbitrary Code Execution

### Castlevania: Order of Ecclesia

- Arbitrary Code Execution works on European releases of the game
- Addresses mentioned in this guide come from the European DS version

---

## Definitions

### Filename

```
[0x02107cb6] uint8_t filename[8];
```

### Map data

```
typedef struct Coordinates
{
    uint8_t x;
    uint8_t y;
}
Coordinates;
```

```
typedef struct Pins
{
    struct Coordinates pin_1;
    struct Coordinates pin_2;
    struct Coordinates pin_3;
    struct Coordinates pin_4;
    struct Coordinates pin_5;
}
Pins;
```

```
+----------------------+----------+----------+
|                      |   Area   |   Pins   |
+----------------------+----------+----------+
| Dracula's Castle     | 02107760 | 02107ceb |
| Wygol Village        | 021077de | 02107cf5 |
| Ecclesia             | 021077e2 | 02107cff |
| Training Hall        | 021077e6 | 02107d09 |
+----------------------+----------+----------+
| Ruvas Forest         | 021077f6 | 02107d13 |
| Argila Swamp         | 021077fe | 02107d1d |
| Kalidus Channel      | 02107804 | 02107d27 |
| Somnus Reef          | 02107824 | 02107d31 |
+----------------------+----------+----------+
| Minera Prison Island | 02107838 | 02107d3b |
| Lighthouse           | 0210784e | 02107d45 |
| Tymeo Mountains      | 02107856 | 02107d4f |
| Tristis Pass         | 02107870 | 02107d59 |
+----------------------+----------+----------+
| Large Cavern         | 02107886 | 02107d63 |
| Giant's Dwelling     | 02107890 | 02107d6d |
| Mystery Manor        | 0210789a | 02107d77 |
| Misty Forest Road    | 021078a2 | 02107d81 |
+----------------------+----------+----------+
| Oblivion Ridge       | 021078aa | 02107d8b |
| Skeleton Cave        | 021078b2 | 02107d95 |
| Monastery            | 021078ba | 02107d9f |
| Boss Rush            | 021076c6 | 02107da9 |
+----------------------+----------+----------+
```

### Boss Rush records

```
typedef struct Record_Boss_Rush
{
    uint8_t  name[8];
    uint32_t time;
    uint32_t character;
}
Record_Boss_Rush;

[0x021dd484] struct Record_Boss_Rush records_boss_rush[6];
```

### Practice records

```
typedef struct Record_Practice
{
    uint8_t  name[8];
    uint32_t score;
}
Record_Practice;

[0x021dd4e4] struct Record_Practice records_practice[9];
[0x021dd550] struct Record_Practice records_wireless[9];
[0x021dd5bc] struct Record_Practice records_wfc_race[9];
```

### Miscellaneous

```
#define CASTLE_LAST_ROOM        0x022af1a0

[0x020d7e0e] uint16_t           dracula_hp_passive;
[0x021079e8] uint2_t            castle_unlock_flag;
[0x02107dac] uint8_t            character;
[0x0221fd20] struct Undefined * castle_entrance_reference;
[0x022b7216] struct Undefined   boss_rush_teleporter_dest;
```

---

## General rules

### Map completion

- **0b00** is used for unvisited areas
- **0b01** is used for areas visited in another playthrough
- **0b11** is used for areas visited in the current playthrough

### Names

- Characters range from **0x00** to **0x2C**

### Coordinates

- X coordinates range from **0x0C** to **0xF4**
- Y coordinates range from **0x0C** to **0xB4**

---

## Standard run

### Filename

- Set **filename** to **"\_\_BM-G\_\_"**
- The following ARM code is written at **0x02107CB8**

```
+-------------------------+-------------+
| EORNE r1, r8, #000d0000 | 12 28 18 0d |
+-------------------------+-------------+
```

### Ecclesia pins

- Set **pins_ecclesia** as follows

```
+-----------+-----------+-----------+-----------+-----------+
|   Pin 1   |   Pin 2   |   Pin 3   |   Pin 4   |   Pin 5   |
+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+
| x?? | y62 | x1c | y81 | x12 | y24 | xf0 | y81 | x12 | y?? |
+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+
```

- The following ARM code is written at **0x02107D00**

```
+-------------------------+-------------+
| ADDNE r1, r1, #00006200 | 12 81 1c 62 |
| ADDNE PC, r1, #00000024 | 12 81 f0 24 |
+-------------------------+-------------+
```

### Boss Rush pins

- Set **pins_boss_rush->pin_1->x** in **[ 0x53 ; 0x58 ]**
- Instruction **0x020452C8** now branches into **[ 0x021077E4 ; 0x021078B8 ]**

### Boss Rush records

- Set **records_boss_rush** as follows

```
+--------------------------------+--------------------------------+
|            Course 1            |            Course 2            |
+----------+----------+----------+----------+----------+----------+
|   Name   |   Time   |  Player  |   Name   |   Time   |  Player  |
+----------+----------+----------+----------+----------+----------+
| DEZEF_UF | 04:58:67 |  Shanoa  | E*GMMQMM | 05:50:03 |  Shanoa  |
+----------+----------+----------+----------+----------+----------+
| _X3V808R | 05:00:67 |  Shanoa  | 0UPMM__M | 14:47:47 |  Shanoa  |
+----------+----------+----------+----------+----------+----------+
| 8M_U____ | 06:15:63 |  Shanoa  | MM_M_MP& | 14:55:57 |  Shanoa  |
+----------+----------+----------+----------+----------+----------+
```

- The following ARM code is written at **0x021DD484**

```
+------------------+-------------+
| EORNE r2, r5, PC | 10 25 20 0f |
| BXNE  r2         | 11 20 00 12 |
+------------------+-------------+
```

- The following Thumb code is written at **0x021DD48C**

```
+-------------------+------+---------------------+
| MOV  r0, r0       | 4600 | 01000 11000 000 000 |
+-------------------+------+---------------------+
| MOV  r3, #0       | 2300 | 00100 011 00000000  |
| MOV  r1, #4       | 2104 | 00100 001 00000100  |
| LSL  r1, r1, #4   | 0109 | 00000 00100 001 001 |
| ADD  r1, r1, #4   | 1d09 | 0001110 100 001 001 |
| MOV  r0, PC       | 4678 | 01000 11001 111 000 |
+-------------------+------+---------------------+
| ADD  r1, r1, r0   | 1809 | 0001100 000 001 001 |
| MOV  r0, #0       | 2000 | 00100 000 00000000  |
| LSL  r0, r0, #0   | 0000 | 00000 00000 000 000 |
| LSL  r0, r0, #0   | 0000 | 00000 00000 000 000 |
| LDR  r2, [r1, r0] | 580a | 0101100 000 001 010 |
+-------------------+------+---------------------+
| LSR  r0, r2, #c   | 0b10 | 00001 01100 010 000 |
| ADD  r2, r2, r0   | 1812 | 0001100 000 010 010 |
| ADD  r0, r3, #0   | 1c18 | 0001110 000 011 000 |
| ADD  r0, r3, r0   | 1818 | 0001100 000 011 000 |
| STRH r2, [r1, r0] | 520a | 0101001 000 001 010 |
+-------------------+------+---------------------+
| MOV  r0, #1       | 2001 | 00100 000 00001100  |
| ADD  r3, r3, r0   | 181b | 0001100 000 011 011 |
| LSL  r0, r3, #0   | 0018 | 00000 00000 011 000 |
| ADD  r0, r0, r0   | 1800 | 0001100 000 000 000 |
| BEQ  021dd4d0     | d000 | 11010 000 00000000  |
+-------------------+------+---------------------+
| ADD  r0, r3, r0   | 1818 | 0001100 000 011 000 |
| ADD  r0, r0, r0   | 1800 | 0001100 000 000 000 |
| ADD  r0, r0, r0   | 1800 | 0001100 000 000 000 |
| CMP  r3, #1b      | 2b1b | 00101 011 00011011  |
| BNE  021dd4ac     | d1e6 | 11010 001 11101011  |
+-------------------+------+---------------------+
```

### Practice records

- Set **records_practice**, **records_wfc_race** and **records_wireless** as follows

```
+----------+--------------------+--------------------+--------------------+
|          |      Course 1      |      Course 2      |      Course 3      |
+----------+------+------+------+------+------+------+------+------+------+
| Practice | 79_5 | 4__7 | 7935 | 2__5 | 7975 | 4__7 | 79A5 | 9*35 | 1__7 |
+----------+------+------+------+------+------+------+------+------+------+
| WFC Race | 78C6 | _10_ | AB96 | _10_ | _B1D | 011_ | 3106 | *11_ | _09D |
+----------+------+------+------+------+------+------+------+------+------+
| Wireless | 7*_5 | 4_37 | 4_35 | 7*A7 | 8D_0 | 7__7 | _663 | CC_6 | B1__ |
+----------+------+------+------+------+------+------+------+------+------+
```

- The following Thumb code is written at **0x021DD4E4** once converted

```
+--------------------+------+---------------------+
| LDR  r0, [r1, #20] | 6a08 | 01101 01000 001 000 |
| STRH r5, [r0, #0]  | 8005 | 10000 00000 000 101 |
+--------------------+------+---------------------+
| LDR  r0, [r1, #24] | 6a48 | 01101 01001 001 000 |
| STR  r3, [r0, #0]  | 6003 | 01100 00000 000 011 |
+--------------------+------+---------------------+
| LDR  r0, [r1, #28] | 6a88 | 01101 01010 001 000 |
| STRH r5, [r0, #0]  | 8005 | 10000 00000 000 101 |
+--------------------+------+---------------------+
| LDR  r0, [r1, #2c] | 6ac8 | 01101 01011 001 000 |
| LDR  r2, [r1, #34] | 6b4a | 01101 01101 001 010 |
| STRH r2, [r0, #0]  | 8002 | 10000 00000 000 010 |
+--------------------+------+---------------------+
| LDR  r0, [r1, #30] | 6b08 | 01101 01100 001 000 |
| STRH r5, [r0, #2]  | 8045 | 10000 00001 000 101 |
| STR  r5, [r0, #4]  | 6045 | 01100 00001 000 101 |
+--------------------+------+---------------------+
| LDRH r0, [r1, #1e] | 8bc8 | 10001 01111 001 000 |
| SUB  r1, r1, #4    | 1f09 | 0001111 100 001 001 |
| STRH r0, [r1, #0]  | 8008 | 10000 00000 001 000 |
+--------------------+------+---------------------+
| BX   LR            | 4770 | 01000 11101 110 000 |
+--------------------+------+---------------------+
| ADDR 0x____7e0e    | 7e0e | 0111 1110 0000 1110 |
| ADDR 0x020d____    | 020d | 0000 0010 0000 1101 |
+--------------------+------+---------------------+
| ADDR 0x____79e8    | 79e8 | 0111 1001 1110 1000 |
| ADDR 0x0210____    | 0210 | 0000 0010 0001 0000 |
+--------------------+------+---------------------+
| ADDR 0x____7dac    | 7dac | 0111 1101 1010 1100 |
| ADDR 0x0210____    | 0210 | 0000 0010 0001 0000 |
+--------------------+------+---------------------+
| ADDR 0x____fd20    | fd20 | 1111 1101 0010 0000 |
| ADDR 0x0221____    | 0221 | 0000 0010 0010 0001 |
+--------------------+------+---------------------+
| ADDR 0x____7214    | 7214 | 0111 0010 0001 0100 |
| ADDR 0x022b____    | 022b | 0000 0010 0010 1011 |
+--------------------+------+---------------------+
| ADDR 0x____f1a0    | f1a0 | 1111 0001 1010 0000 |
+--------------------+------+---------------------+
```

A Technical Guide to Open World Pin

# A Technical Guide to Open World Pin

### Castlevania: Order of Ecclesia

- Open World Pin works on Japanese and American releases of the game
- Addresses mentioned in this guide come from the Japanese DS version

---

## Definitions

### Cutscene-related

```
typedef struct Cutscene_Related
{
    [+0x034] uint32_t cutscene_flags;
    [+0x49d] uint8_t  unknown_49d;
}
Cutscene_Related;

[0x02106a74] struct Cutscene_Related cutscene_related;
```

### Inventory

```
typedef struct Inventory
{
    [+0x034] uint32_t unlocked_areas_low;
    [+0x038] uint32_t unlocked_areas_high;
    [+0x048] uint32_t unknown_048;
    [+0x052] uint8_t  confodere;
    [+0x055] uint8_t  secare;
    [+0x05c] uint8_t  vol_macir;
    [+0x05e] uint8_t  arcus;
    [+0x068] uint8_t  vol_culter;
    [+0x06c] uint8_t  melio_scutum;
    [+0x06d] uint8_t  redire;
    [+0x06e] uint8_t  cubus;
    [+0x06f] uint8_t  torpor;
    [+0x074] uint8_t  grando;
    [+0x075] uint8_t  vol_grando;
    [+0x082] uint8_t  dominus_hatred;
    [+0x084] uint8_t  arma_felix_one;
    [+0x085] uint8_t  arma_felix_two;
    [+0x140] uint8_t  gold_plate;
    [+0x141] uint8_t  platinum_plate;
    [+0x142] uint8_t  mirror_cuirass;
    [+0x143] uint8_t  heart_cuirass;
}
Inventory;

[0x021071b4] struct Inventory inventory;
```

### Screen-related

```
typedef struct Screen_Related
{
    [+0x034] uint32_t screen_x;
    [+0x038] uint32_t screen_y;
}
Screen_Related;

[0x02108120] struct Screen_Related screen_related;
```

### Character-related

```
typedef struct Character_Related
{
    [+0x30] uint32_t character_x;
    [+0x34] uint32_t character_y;
}
Character_Related;

[0x02110640] struct Character_Related character_related;
```

### Function_02239980

```
void function_02239980 (void)
{
    [+0x00c] EBFFD4D7 - BL 0222ecf0
    [+0x018] CA000007 - BGT 022399bc
    [+0x068] 0A000037 - BEQ 02239acc
    [+0x158] 021071B4 - ADDR 021071b4
}

[0x02239980] void function_02239980 (void);
```

### Unknown

```
typedef struct Unknown
{
    [+0x048] uint16_t field_048;
    [+0x04a] uint16_t field_04a;
    [+0x052] uint8_t  field_052;
    [+0x055] uint8_t  field_055;
    [+0x05c] uint8_t  field_05c;
    [+0x05e] uint8_t  field_05e;
    [+0x068] uint8_t  field_068;
    [+0x06c] uint32_t field_06c;
    [+0x074] uint16_t field_074;
    [+0x082] uint8_t  field_082;
    [+0x084] uint8_t  field_084;
    [+0x085] uint8_t  field_085;
    [+0x140] uint32_t field_140;
}
Unknown;
```

---

## Effects

### Requirements

- **(inventory->gold_plate & (1 << 1))**
- **(pin_1->x == 0x65)**

### Unconditional Effects

- **inventory->melio_scutum = 0;**
- **inventory->redire = 0;**
- **inventory->cubus = 0;**
- **inventory->torpor = 0;**
- **inventory->dominus_hatred = 0xd4;**

### Conditional Effects

- **if (inventory->confodere && !inventory->vol_macir)**
  - **{inventory->arcus = 0;}**
- **if (inventory->confodere != inventory->secare)**
  - **{inventory->secare = inventory->confodere;}**

### Variable Effects

- **unlocked_areas_low = character_x;**
- **unlocked_areas_high = character_y - 0x20000;**

---

## Assembly

### Tree

```
[0x02239980]
|
|---[0x0222ecf0]
|   |
|   |---[0x0222f258]
|       |
|       |---[0x020aba38]
|           |
|           |---[0x020abde4]
|
|---[0x0222f0e4]
|   |
|   |---[...]
|   |
|   |---[...]
|
|---[0x0222f4dc]
|
|---[0x0222ee04]
    |
    |---[0x0208c880]
    |
    |---[0x0223217c]
        |
        |---[0x02092dc0]
        |
        |---[0x02092dc0]
```

### Func_02239980

```
STMDB SP!, {r3-r5, LR}
MOV r4, r0                  // r4 = r0;
LDR r5, [r4, #158]          // r5 = ((uin32_t *)func_02239980)[0x56];
BL 0222ecf0                 // func_0222ecf0();
LDRB r0, [r4, #d]           // r0 = ((uin8_t *)func_02239980)[0xd];
                            // r0 = 0xd4;
CMP r0, #2                  // if (r0 > 2)
BGT 022399bc                // { goto label_022399bc; }
|
label_022399bc:
CMP r0, #ff                 // if (r0 == ff)
BEQ 02239aa4                // { goto label_02239aa4; }
B 02239acc                  // else { goto label_02239acc; }
LDRSH r1, [r4, #6a]         // r1 = ((int16_t *)func_02239980)[0x35];
                            // r1 = 0x0a00;
LDR r0, [02239ad8]          // r0 = 0x021071b4;
MOV r2, #1                  // r2 = 1;
ADD r3, r1, #1              // r3 = r1 + 1;
MOV r1, r3, ASR #5          // r1 = r3 >> 5;
LDR r0, [r0, r1, LSL #2]    // r0 = ((Unknown *)inventory)->field_140;
                            // r0 = inventory->gold_plate << 0;
                            // r0 += inventory->platinum_plate << 8;
                            // r0 += inventory->mirror_cuirass << 16;
                            // r0 += inventory->heart_cuirass << 24;
AND r1, r3, #1f             // r1 = r3 & 0x1f;
TST r0, r2, LSL r1          // if (r0 & (r2 << r1))
BEQ 02239acc                // { goto label_02239acc; }
MOV r0, r4                  // r0 = r4;
BL 0222f0e4                 // func_0222f0e4();
MOV r0, r4                  // r0 = r4;
BL 0222f4dc                 // func_0222f4dc();
LDRSH r0, [r4, #1a]         // r0 = ((int16_t *)func_02239980)[0xd];
                            // r1 = 0x0037;
ADD r0, r0, #1              // r0 = r0 + 1;
STRH r0, [r4, #1a]          // ((int16_t *)func_02239980)[0xd] = r0:
LDRSH r0, [r4, #1a]         // r0 = ((int16_t *)func_02239980)[0xd];
CMP r0, #10                 // if (r0 != 0x10)
BNE 02239acc                // { goto label_02239acc; }
|
label_02239acc:
MOV r0, r4                  // r0 = r4;
BL 0222ee04                 // func_0222ee04();
LDMIA SP!, {r3-r5, PC}
```

### Func_0222ECF0

```
STMDB SP!, {r3-r5, LR}
MOV r5, r0                  // r5 = r0;
LDR r4, [r5, #158]          // r4 = ((uin32_t *)func_02239980)[0x56];
MOV r1, #0                  // r1 = 0;
STR r1, [r4, #6c]           // ((Unknown *)inventory)->field_06c = 0;
                            // inventory->melio_scutum = 0;
                            // inventory->redire = 0;
                            // inventory->cubus = 0;
                            // inventory->torpor = 0;
BL 0222f258                 // func_0222f258();
CMP r0, #0                  // if (r0 == 0)
LDMIAEQ SP!, {r3-r5, PC}    // { return; }
LDRB r0, [r4, #85]          // r0 = ((Unknown *)inventory)->field_085;
                            // r0 = inventory->arma_felix_two;
CMP r0, #0                  // if (r0 == 0)
BEQ 0222ed90                // { goto label_0222ed90; }
|
label_0222ed90:
LDRB r0, [r4, #84]          // r0 = ((Unknown *)inventory)->field_084;
                            // r0 = inventory->arma_felix_one;
CMP r0, #1                  // if (r0 != 1)
LDMIANE SP!, {r3-r5, PC}    // { return; }
```

### Func_0222F258

```
STMDB SP!, {r3-r5, LR}
LDR r4, [r0, #158]      // r4 = ((uin32_t *)func_02239980)[0x56];
MOV r5, #0              // r5 = 0;
BL 020aba38             // func_020aba38();
CMP r0, #0              // if (r0 != 0)
LDRH r0, [r4, #74]      // r0 = ((Unknown *)inventory)->field_074;
                        // r0 = r0 + inventory->grando << 0;
                        // r0 += inventory->vol_grando << 8;
MOVNE r5, #1            // { r5 = 1; }
CMP r0, #15             // if ( (r0 == 0x15)
CMPNE r0, #1a           // || (r0 == 0x1a)
CMPNE r0, #25           // || (r0 == 0x25) )
MOVEQ r5, #1            // { r5 = 1; }
MOV r0, r5              // r0 = r5;
LDMIA SP!, {r3-r5, PC}
```

### Func_020ABA38

```
STMDB SP!, {r4, LR}
MOV r4, #0              // r4 = 0;
label_020aba40:
MOV r0, r4              // r0 = r4;
BL 020abde4             // func_020abde4();
CMP r0, #0              // if (r0 != 0)
MOVNE r0, #1            // { r0 = 1;
LDMIANE SP!, {r4, PC}   // return; }
ADD r4, r4, #1          // r4 = r4 + 1;
CMP r4, #3              // if (r4 < 3)
BLT 020aba40            // { goto label_020aba40; }
MOV r0, #0              // r0 = 0;
LDMIA SP!, {r4, PC}
```

### Func_020ABDE4

```
LDR r1, [020abe00]  // r1 = 0x021dcc7c;
ADD r2, r0, #3      // r2 = r0 + 3;
LDR r1, [r1, #4]    // r1 = file_flags;
MOV r0, #1          // r0 = 1;
TST r1, r0, LSL r2  // if (r1 & (r0 << r2))
MOVEQ r0, #0        // { r0 = 0; }
BX LR
```

### Func_0222F0E4

```
STMDB SP!, {r3, LR}
LDR r0, [0222f11c]      // r0 = 0x02106a74;
LDR r1, [r0, #34]       // r1 = 
ORR r1, r1, #80000001   // r1 = r1 | 0x80000001;
ORR r1, r1, #80         // r1 = r1 | 0x80;
STR r1, [r0, #34]       // cutscene_related->cutscene_flags = r1;
BL 0205ad40             // func_0205ad40();
MOV r0, #0              // r0 = 0;
MOV r1, r0              // r1 = r0;
BL 0205e8dc             // func_0205e8dc();
LDR r0, [0222f11c]      // r0 = 0x02106a74;
MOV r1, #0              // r1 = 0;
STRB r1, [r0, #49d]     // cutscene_related->unknown_49d = r1;
LDMIA SP!, {r3, PC}
```

### Func_0222F4DC

```
LDR r1, [0222f504]  // r1 = 0x02106a74;
LDR r2, [r0, #158]  // r2 = ((uin32_t *)func_02239980)[0x56];
LDR r0, [r1, #c8]   // r0 = 0x02110640;
LDR r0, [r0, #30]   // r0 = character_related->character_x;
STR r0, [r2, #34]   // ((Screen_Related *)inventory)->screen_x = r0;
                    // inventory->unlocked_areas_low = r0;
LDR r0, [r1, #c8]   // r0 = 0x02110640;
LDR r0, [r0, #34]   // r0 = character_related->character_y;
SUB r0, r0, #20000  // r0 = r0 - 0x20000;
STR r0, [r2, #38]   // ((Screen_Related *)inventory)->screen_y = r0;
                    // inventory->unlocked_areas_high = r0;
BX LR
```

### Func_0222EE04

```
STMDB SP!, {r3-r6, LR}
SUB SP, SP, #c
MOV r5, r0              // r5 = r0;
LDRB r0, [r5, #d]       // r0 = ((uin8_t *)func_02239980)[0x0d];
LDR r4, [r5, #158]      // r4 = ((uin32_t *)func_02239980)[0x56];
STRB r0, [r4, #82]      // ((Unknown *)inventory)->field_082 = r0;
                        // inventory->dominus_hatred = r0;
LDRB r0, [r4, #68]      // r0 = ((Unknown *)inventory)->field_068;
                        // r0 = inventory->vol_cutler;
CMP r0, #1              // if (r0 != 1)
BNE 0222ee70            // { goto label_0222ee70; }
|
label_0222ee70:
CMP r0, #3              // if (r0 != 3)
BNE 0222eebc            // { goto label_0222eebc; }
|
label_0222eebc:
LDR r1, [0222ef80]      // r1 = 0x02106a74;
LDR r0, [0222ef84]      // r0 = 0x80000040;
LDR r1, [r1, #34]       // r0 = cutscene_related->cutscene_flags;
TST r1, r0              // if (r1 & r0)
BEQ 0222ef44            // { goto label_0222ef44; }
|
label_0222ef44:
BL 0208c880             // func_0208c880();
CMP r0, #4              // if (r0 != 4)
BNE 0222ef64            // { goto label_0222ef64; }
|
label_0222ef64:
MOV r0, r5              // r0 = r5;
BL 0223217c             // func_0223217c();
LDRSH r0, [r5, #18]     // r0 = ((int16_t *)func_02239980)[0xc]:
ADD r0, r0, #1          // r0 = r0 + 1;
STRH r0, [r5, #18]      // ((int16_t *)func_02239980)[0xc] = r0
ADD SP, SP, #c
LDMIA SP!, {r3-r6, PC}
```

### Func_0208C880

```
LDR r0, [0208c88c]  // r0 = 0x020f4028;
LDR r0, [r0, #10]   // r0 = top_screen_index;
BX LR
```

### Func_0223217C

```
STMDB SP!, {r3-r11, LR}
MOV r9, r0                  // r9 = r0;
LDR r5, [r9, #158]          // r5 = ((uin32_t *)func_02239980)[0x56];
LDRH r0, [r5, #48]          // r0 = ((Unknown *)inventory)->field_048;
BL 02092dc0                 // func_02092dc0();
LDRB r0, [r5, #5c]          // r0 = ((Unknown *)inventory)->field_05c;
                            // r0 = inventory->vol_macir;
MOV r6, #0                  // r6 = 0;
CMP r0, #0                  // if (r0 != 0)
MOVNE r0, r6                // { r0 = r6;
LDMIANE SP!, {r3-r11, PC}   // return; }
LDRB r0, [r5, #52]          // r0 = ((Unknown *)inventory)->field_052;
                            // r0 = inventory->confodere;
CMP r0, #0                  // if (r0 == 0)
MOVEQ r0, r6                // { r0 = r6;
LDMIAEQ SP!, {r3-r11, PC}   // return; }
STRB r6, [r5, #5e]          // ((Unknown *)inventory)->field_05e = r6;
                            // inventory->arcus = r6;
LDRH r0, [r5, #48]          // r0 = ((Unknown *)inventory)->field_048;
BL 02092dc0                 // func_02092dc0();
LDRB r1, [r5, #52]          // r1 = ((Unknown *)inventory)->field_052;
                            // r1 = inventory->confodere;
LDRH r2, [r5, #4a]          // r2 = ((Unknown *)inventory)->field_04a;
ADD r4, r0, #2              // r4 = r0 + 2;
CMP r1, #7                  // if (r1 < 7)
ADD r7, r4, r2, LSL #1      // r7 = r4 + (r2 << 1);
ADDLS PC, PC, r1, LSL #2    // { switch r1 {} }
B 02232758                  // goto label_02232758;
|
label_02232758:
LDRB r1, [r5, #52]          // r1 = ((Unknown *)inventory)->field_052;
                            // r1 = inventory->confodere;
LDRB r0, [r5, #55]          // r0 = ((Unknown *)inventory)->field_055;
                            // r0 = inventory->secare;
CMP r1, r0                  // if (r1 != r0)
STRBNE r1, [r5, #55]        // ((Unknown *)inventory)->field_055 = r1;
                            // { inventory->secare = r1; }
MOV r0, r6                  // r0 = r6;
LDMIA SP!, {r3-r11, PC}
```

### Func_02092DC0

```
STMDB SP!, {r3, LR}
LDR r1, [02092de0]          // r1 = 0x00007fff
CMP r0, r1                  // if (r0 != r1)
LDRNE r1, [02092de4]        // { r1 = 0x021fdda0;
LDRNE r0, [r1, r0, LSL #2]  // r0 = 0x021dd804;
LDMIANE SP!, {r3, PC}       // return; }
```

Dominus save data information

Dominus save files are stored in "<Steam-folder>\\userdata\\<user-id>\\2369900\\remote\\"

Every file (except for data_008_0000.bin) stores data for a single savestate on a single game. They are all named like "data_01**G**_00**SS**.bin", where "**G**" and "**SS**" are replaced by game IDs and savestate slot IDs respectively.

**G** game IDs:

- 2 = Dawn of Sorrow
- 4 = Portrait of Ruin
- 6 = Order of Ecclesia
- 8 = Haunted Castle (JP)

**SS** savestate slot IDs:

- 00-09 are savestate slots 1-10 respectively
- 10-13 are the autosave savestates (marked with a star icon at the top of the savestates list) for each release region of the game. It updates whenever you use a save point ingame.

So for example, a file called "data_016_0008.bin" stores a savestate for Order of Ecclesia (**G** = 6) in slot #9 (**SS** = 08)

data_008_0000.bin is a special file storing Global settings, Other + Control Settings for every game, active SaveRAM for every game, and probably unlocked modes too. It's recommended to ignore this file and share savestates instead.

Downpatching Guide 1.0 and 1.03

(Template of this guide copy-pasted from the Ritual of the Night speedrunning page)

To downpatch to Version 1.0...

- Turn off Steam Cloud. To do that, right click the game on **Steam —> Properties —> Uncheck "Keep games saves in the Steam Cloud"** (Very 1st tab). This can avoid Steam replacing your save files and ruining everything.
- Turn off auto updates when lauching the game. To do that, right click the game on **Steam —> Properties —> Updates**. You need **"Always keep this game updated"** on and **NOT** "Only update this game when I launch it".
- Press Windows key+R to open the run command, and type in: **steam://nav/console**
- Type this into the Steam console: **download_depot 2369900 2369901 3697199310595088523**
- After the download is complete, the Steam console will tell you its location. Copy-paste these files to somewhere convenient.
- Next, right click the game on **Steam —> Manage—> Browse local files** to find the 1.001 files. Simply replace these files with the 1.0 files.

To downpatch to Version 1.03...

- Follow the same steps but enter this instead in the Steam Console: **download_depot 2369900 2369901 788411065935778033**

Ecclesia Guide Website (WIP)

I'm developing a guide website for this game that goes over all the main categories.  

It's a big work in progress right now,  but it has a basic movement page and a guide for NMC

https://spherekuribob.github.io/Monastery/index.html



Name	Autor
A Technical Guide to Arbitrary Code Execution (NewGame+)	Priestess_Emilia 1 year ago
A Technical Guide to Arbitrary Code Execution (Standard)	Priestess_Emilia 11 months ago
A Technical Guide to Open World Pin	Priestess_Emilia 3 months ago
Dominus save data information	halgorithm 1 year ago
Downpatching Guide 1.0 and 1.03	Lonely 1 year ago
Ecclesia Guide Website (WIP)	Ishu_ 1 year ago