Ok, so I did the analysis on the JP ROM. The two cheat checks are right next to each other:
ROM:000109AA loc_109AA: ; CODE XREF: ROM:000108F6j
ROM:000109AA cmpi.l #$20001207,d5
ROM:000109B0 beq.w loc_109F0
ROM:000109B4 cmpi.l #$20000001,d5
ROM:000109BA beq.w loc_109C2
ROM:000109BE bra.w loc_109DC
This is a separate cheat check from the one I posted about before, which resembles cheat checks in other Hertz games.
The only difference between the two targets is that the former sets word $FFFF36 to $8000 while the later sets word $FFFF36 to 0. What does this mean for the game? Well there are three places that check this high bit (and one that checks the whole word):
- $1C2A, which checks it but does nothing (beq.w to the next instruction, which is a bra.w); this check is right at the end of the Sega logo code
- $68A8, which is what loads the options screen script, and by extension the extra options
- $7804, which does the pause check (A+B+C+Start in your original post, and actually it's just C+Start)
- $7C94, which checks the entire word (not just this one bit), and adds "HERTZ CORP." to the ending right after the "Printed by SEGA ENTERPRISES,LTD." credit with the cheat code on
So my best guess is that the latter code either disables the effect of the former code or did something different at one point.
The Dorago Quest screen is screen mode $8. There is no direct jump into it; the code you pasted works by manually forcing the main menu jump table index to an unused index 3 that executes a rts back into the main loop, which moves to the next screen mode, and the title screen is screen mode $4 (screen modes are in increments of $4). I can provide a number of "cleaner" ways to get in. The Data Loading option crashes because it deliberately jumps to noncode (at ROM address $80000, which is all $FF padding byes, which will raise a line 1111 emulator exception which causes the game to hang) after loading the graphics (I remember seeing this ages ago when I first tried disassembling OutRun 2019 but had no clue what was going on because I didn't know about this screen).
As for that other cheat code thing I found earlier, I determined that most of the code points that lead from that function do not use the value. I'm still looking through the last one, which appears to be the main game itself, so I have a very good feeling it is not used after all. I won't continue bothering with this one for now, but if anyone cares in the JP ROM it's the function that starts at $238A, and it appears to be the code that drives both the options menu and the Dorago Quest screen menu (the actual title screen's menu is done by separate code).
I'm going to check everything else against the US and EU ROMs before making a page. Thanks again for everything!
|