Ratchet and Clank Future: A Crack In Time
- Scope
- Cause
- Prerequisites
- Overview
- First Planet (Kreeli Comet Room)
- Second Planet(Planet Quantos) and Onwards
- Environment
These instructions provide limited work arounds in avoiding / defeating the soft lock associated with missing textures in the Time fixing mini-games ๐ป(External, wiki) (Planet Room) minigames within the Clank Subconcious levels of the Great Clock ๐ป(External, wiki).
When emulating Ratchet & Clank Future: A Crack In Time on RPCS3 some textures do not render, these include lasers, fire, and most notably the time anomolies within the Time fixing mini-game.
- Cheat Engine ๐ป(External)
โ Caution Installer contains bloatware โ
Select Skip All in installer to avoid bloatware
- First Planet
- Locating the memory address ๐บ (Youtube)
- Skipping the Planet ๐บ (Youtube)
- Second Planet+
- Locating the memory address ๐บ (Youtube)
- Modifying the assembly code ๐บ (Youtube)
First Planet
- Locating the memory address: < 2 minutes
- Skipping level: < 1 minute
Second Planet+
- Locating the memory address: **~ 5 minutes**
- Locating the assembly code: < 1 minute
- Modifying the assembly code: < 2 minutes
- Beating mini-game: < 10 seconds
In addition to the inability to see the anomolies on the planet - the Kreeli Comet room is intended to be a tutorial planet to introduce you to the concept of the minigame.
The way it does this is by limiting the number of features, bonuses, and challenges and gradually introducing them with every planet you successfully complete.
This is a problem becuase without extensive work we have no way to track the number of anomolies, their position, or anything else to complete the minigame.
The only work around for this section of Clank's Subconcious is to trigger an area cutscene to skip the planet all together.
To trigger the cutscene we have to travel to the large rotating ring to the left of the planet minigame. We will do so by temporarily giving Clank infinite helicopter jumps to fly over to the large spinning ring.
- Locate the memory address that
currentJumpCount
is stored. - Freeze the value at the memory address to
0
Characteristics:
currentJumpCount
is stored as abyte
currentJumpCount
has a default value of0
and a maximum value of3
0
represents a grounded state1
represents one helicopter jump has been used2
represents two helicopter jumps have been used3
represents no additional helicopter jumps remain
Using the provided characteristics find the memory address associated with Clank's Helicopter jump (currentJumpCount
).
Locating the memory address ๐บ (Youtube)
I found it was best to locate the addresses by jumping to the max(3
) and searching for 3
(byte
) as my initial value - as all others provided too many results. I followed the pattern 3
-> 1
-> 3
-> 1
-> 3
-> 2
and so on until only 2 memory addresses were left in my search.
For me the addresses for currentJumpCount
were
&346F94AB1 &446F94AB1
Skipping the Planet ๐บ (Youtube)
Freezing either address's value to 0
will provide infinite helicopter flight.
After skipping the tutorial planet(Kreeli Comet) all other planets have Bombs, which will allow us to actually complete all of the planets.
Bombs, when detonated, repair any anomolies that they hit with their explosions. We can not see the anomolies, so therefore, we can use bombs to beat the mini-game for us.
Only a limited number of bombs can spawn until the current ones are destroyed. For this work around we are going to make unlimited bombs spawn, and multiply the number of bombs that spawn at once.
- Locate the memory address where
bombCount
is stored - Modify the assembly code to enable unlimited bombs to spawn
- Modify the assembly code to increase the number of bombs that spawn
Characteristics Scope:
These characteristics are specifically for the first wave of Planet Quantos (the first planet after the cutscene following the infinite helicopter skip). The modifications that we apply using Planet Quantos will automatically apply to all other planets.
Characteristics:
bombCount
is stored abyte
bombCount
is controlled by a*pointer
and freezing it's value has no benefit- It's default value is
0
and has a maximum value of3
0
represents no bombs are present3
represents 3 bombs are present
In order to locate the addresses use the provided characteristics. Begin Planet Quantos, wait for the 3 initial bombs to spawn, destroy any number of them, and restart the planet afterwwards in order to narrow down the addresses.
Locating the memory address ๐บ (Youtube)
For me the addresses for bombCount
were
&346F974B7 &446F974B7
- Locate the address of
bombCount
(see above) - Use
Find out what writes to this address
to locate the assembly that modifiesbombCount
- Change the assembly to prevent incrementing
bombCount
- Change the assembly to allow many bombs to spawn at the start of a wave and subsequently instantly beating every wave
Use Find out what writes to this address
to locate the assembly that modifies bombCount
. This should provide you with a list of two instructions that change bombCount
.
โ Do not use the Replace
button on the Find out what writes to this address
form. โ
The instruction we want to modify should end with #####03AE
, the instruction for me was 163E203AE
but it is likely to be different for you.
If you can't determine the instruction by name you want to look for the one that looks similar to:
movebe [rax+rbx+00000134],ecx
Click on the instruction to select it. Click the Show disassembler
on the right-hand side of the form to view the assembly code for the instruction.
Look for the line
#####090 ... inc rcx
This line is reponsible for incrementing bombCount
. Right click this line and select Replace with code that does nothing
. To allow infinite bombs to spawn on the planet.
Modifying the assembly code ๐บ (Youtube)
Return back to the same assembly code and look for the line
#####048 ... inc [rbp+000000F8]
Double-click the line and in the Single-line assembler
box that pops up enter the following line to replace the original.
add [rbp+000000F8], 16
This replacement will allow you to instantly win every wave. You can increase the number from 16
if you don't instantly win every wave on all planets, but 16 worked best in my testing.
Modifying the assembly code ๐บ (Youtube)
Once these two modifications have been made all planets will be won automatically. These changes will reset when the game is restarted.
These environment details are provided for purely academic purposes to allow replication of my findings on similar hardware. The environment specs listed here are unlikely to change the result or steps significantly.
- AMD Ryzen 3800X
- 32GB DDR4
- GTX 1060
- Windows 10 x64 AME
- RPCS3 0.0.16-12408-aaa20c04 Alpha
- RAMDisk
- RPCS3 is running in a 4096MB RAMDisk with a junctioned save directory for persistent gamestates
- Game Source Files are on 512GB NVME m.2 SSD
- Cheat Engine is on the same 512GB NVME m.2 SSD