KungFuFurby
Member
Level: 12
   
Posts: 1/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
I found the ending for the SNES game Mega Man's Soccer by hacking it. All I had to do was modify 20 10 D6 to 20 EE E0.
To access, enter the following codes (they work for either version):
81829BEE
81829CE0
Start the game. First, select Capcom Tournament, then select either one vs. CPU and select Start. Now sit back and relax. You will get the ending instead of the opening.
To find the opening and ending routines, I invented a music modifier. The music modifier is...
808BA8A9
808BA9xx
808BAA00
The range is 01-1A, 1C. 00 and 1B are silent. The game crashes after 1C.
Then, I backtracked and found calls to the desired routine. The music modifier was inside 20 A5 8B (the call to sub-routine 8BA5). There were multiple references to 20 A5 8B from a few routines. 22 1C BF 80 (a call to sub-routine 80BF1C) was the routine that I ultimately chose. I found the ending by looking for A9 18 00 22 1C BF 00 (the first hit was the one) and backtracking to the start of the routine, and the opening was found by searching for A9 1A 00 22 1C BF 80 and backtracking to the start of the routine.
View the Ending on YouTube!
No debugger was required whatsoever. All I used was a hex editor. |
KungFuFurby
Member
Level: 12
Posts: 2/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
I found another secret: the game has an animation test. First, here's the same ending code that plays even earlier (as a matter of fact, it's right on startup!):
8089FDxx
8089FExx
8089FFxx
Just fill in the blanks in order: EE E0 81 for the ending. The animation test is EC A7 82.
Also, I require it in order to view the animation test, which is in a completely different bank. Otherwise, you'd be doing a little bit of overwriting (it will still work, but you need to modify 20 into 22, and you'll have to overwrite one byte after that). I used a method to find a bunch of cutscenes (actually a bunch of in-game stuff), and Protoman is not one of them that uses this. The code that starts a very good chunk of the game cutscenes (and pretty much a lot of other stuff, as menus and in-game are also covered) is E2 20 A9 xx 48 AB C2 30. xx is 80, 81, or 82, mostly depending on the bank (in my case, I failed on all hits for that with xx = 80).
Here's all of them that I could get direct from the Capcom Logo using this method with the scene at Capcom Logo modifier:
B9 9E 81 - Member Select
37 A7 81 - Formation Selection
ED A8 81 - Field Select
89 AD 81 - Position Select
20 BB 81 - Supposed to be the Password, but the tune only barely plays before it switches to the default scene, the Title Screen.
E8 C0 81 - League
E2 C8 81 - Opponent Introduction
10 D6 81 - Opening
CF DA 81 - Protoman (plays over and over again)
A5 DB 81 - Cast Roll
15 E0 81 - Presented by Capcom
7F E3 81 - A random Main Menu. No idea. It's completely blank.
EE E0 81 - Ending
00 80 82 - Capcom Logo
2D 80 82 - In-Game
9E 84 82 - In-Game (again)
45 A0 82 - P.K.
EC A7 82 - Animation Test, of all the irony!
4C D1 82 - Game Over
Some of the values are not supposed to be used this early, so they either boot you back to the title screen or you'll just make the game go horribly wrong.
P.S.: I tried looking for B l a z e o n ' s (SNES) ending by using a reference for its apparent ending tune. In that case, I think the ending got wiped out, as I couldn't find that one. |
KungFuFurby
Member
Level: 12
Posts: 3/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
This is my list of unused music that other than the music being able to load and play, it's completely missing from the game altogether because commands to play the music are completely gone (either that or I don't quite know where to find it... if you do find an unused tune is indeed found in the ROM and it is used, let me know).
Battle Cars
Method of loading and playing back music: A call to subroutine 87EDB6 to initialize the entire sound, then a call to 87ACED to switch the music. Thus, there are two piece of code you can look for... they are 22 B6 ED 87 and 22 AC ED 87.
Range: 00-09
Missing tune ID: 09
References to tune IDs: All that's there is a big fat zero for a call to 87EDB6, and an array at 8080E4 that's used for all the calls to 87ACED. The contents of the array are...
00 01 08 07 04 05 06 02 03
There are no known references to tune 09 anywhere.
B l a z e o n (Japanese version used)
Method of loading and playing back music: A real-time check of 7E0E3Cxx (or 800E3Cxx). Thus, references to this variable are the ones to look for. I only found 8D 3C 0E for a reference.
Range: 01-08, 0B-0D
Missing tune ID: 04
References to tune IDs: I found direct hits for the following:
06
07
0B
0C (two hits)
0E
3D
4B
FF (five hits)
0C may be incremented once to play the alternative boss music if needed.
The stage ID is directly used to use an array to determine the starting music for that stage. The array, located at 95AE, contains 01, 08, 02, 03, 05.
There is a second array located at E6DA containing all 03s, 05s, and 00s.
There are no known references to tune ID 04 anywhere. This is how I determined the ending is probably gone from this game. |
KungFuFurby
Member
Level: 12
Posts: 4/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
I know what game it is that was cut from the SNES version. It was Whack a Clown. The music and sound effects still exist, and can be accessed via this code:
808094xx (bank)
80809Axx (play command)
80809Bxx (sub-tune)
Set the bank to 05. The play command should be set to 03 for the music, or 05 for the SFX.
This doesn't access all of the music in the entire game, but it does access whatever's left of Whack a Clown for the SNES. There are no references for bank 05 anywhere, meaning the game itself may have been wiped out, just like the ending for B l a z e o n for the SNES (either that... or never programmed).
By the way, the instruction manual is found at NintendoAge.com, and it does have credits on page 3. It is Don Goddard. There were two other programmers in addition to Don. |
KungFuFurby
Member
Level: 12
Posts: 5/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
Prime, the unreleased SNES version, has a level skip cheat code that I found. All you have to do is pause the game by pressing start, then press Y. You can also see the ending in this fashion, as well as a few cutscenes, although it's only a single screen ending with no credits.
By the way, here is my sound effect modifier that I used to get the test piece of music:
809BA7A9
809BA8xx
809BA9EA
I recommend just punching to cue the SFX.
Music is at 00. SFX is at 01-09. |
KungFuFurby
Member
Level: 12
Posts: 6/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
The SNES game that somehow managed to get... er... pixelated animated video backgrounds incoporated into the game.
I was hunting down a sound test that I had found via an array reference while attempting to determine if I had found unused music, and ran into a whole bunch of cheats in the process. All but one of them function properly. I posted this to GSCentral, but I thought you should receive them as well.
First, here are a list of variables that can be directly affected by the cheat (with starting values listed in parenthesis):
7E4260 ~ Master Cheat Enabler (00)
7E3812 ~ Smart Bomb Count (00, gets set to 02 on first level)
7E4200 ~ Stage ID (00)
7E425A ~ Continues (04)
7E482E -> 7E4834 ~ Secret Ending (00)
First, you need a non-zero Master Cheat Enabler value. So here's how you do it...
Master Code Enabler
At the Tomy Logo, on controller 2, hold A, B, X, Y until the Title Screen shows up. If done correctly, the Title Screen Logo will be red instead of blue. This must be done while the game is starting up.
Enter These Cheats Before Accessing the Main Menu:
For these cheats, wait until Silver Mare is just about done demonstrating his "Attacker" animation, then hold down the following buttons on controller 2 until the gameplay demonstration begins to activate a cheat (except for the smart bomb cheat, there is no immediate visible indicator you did the cheat correctly unless you're monitoring the variables on an emulator):
L ~ 25 Continues
R ~ 6 Smart Bombs (the cheat fails because the value is overwritten by a 2 when you start a game or when you loop around to a second gameplay demonstration... unless maybe you use the stage modifier cheat code?)
X ~ Secret Ending
The secret ending changes the ending after the collapse of Cheesering Tower. It is replaced by a one-screen text (with picture) saying that the Silver Mare was hevily damaaged.
A sound test can be found by pressing and holding L, R, and Start at either the Tomy Logo, the Title Screen or at the Silver Mare Demonstration screen. It contains three unused pieces of music. One of them is referenced one other time as music for an invalid stage ID.
Enter These Cheats When Setting Up for the Next Stage:
You can change which stage you are playing with this cheat code.
First, start a game, then select your weapons for the Silver Mare. After selecting Attacker or Defender, hold down the following buttons to access the following stage. If done correctly, you'll be playing that stage instead of the originally intended stage. If you tried to do it too late in between fading out and back in, the code will fail.
L + Start ~ G. Bowman Circuit
R + Start ~ Tiamat Gorge
Y + Start ~ Railways
X + Start ~ Underground
B + Start ~ Climbing Cheesering Tower
A + Start ~ Inside Cheesering Tower |
KungFuFurby
Member
Level: 12
Posts: 7/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
Allow me to show you how to play back the music, considering I found them in the first place. Here's my music modifier for both games (the codes work on both versions):
Activision Logo Music Modifier
808065xx
(this one was meant more for SPC dumping... heh...)
In-Game Music Modifier
7E0A1Fxx
The range for the US version, X-Kaliber 2097, is 00-01, 04-06, 0A-0E, 10, 13. 02-03, 07, 0F, 11 are wrong-sample duplicates starting at a different point in the song. 08-09, 12 is silence. 14 looks like a duplicate. There is no more music after 14. The unused music from Sword Maniac (except with X-Kaliber 2097's samples) is located at 0B-0E.
The range for the Japanese version, Sword Maniac is 00, 02-08, 0A-0E. 01, 09 is a mid-point duplicate. There is no more music after 0E. |
KungFuFurby
Member
Level: 12
Posts: 8/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
Originally posted by Foxhack
... I was using the sound test in the options of the US game.
7e002Dxx changes the value of the selected song. 07 and 08 load the only two songs I could find - two jingles that kept looping. The rest of the values I tried either crashed the game or loaded a song with bad samples. I'm not exactly sure if the songs I found used X-Kaliber's samples or not, I need to compare them both to be sure. I'll add your method to the article instead, if you don't mind.
Permission granted. By the way... I used that exact same trick a long time ago by using a sound test music modifier. I got a looping Game Over jingle, but once I actually invented a music modifier, I knew I had a bad version. It used X-Kaliber's samples (My instincts say Sword Maniac's sample pack was replaced in the process).
I have loads of other SNES music modifiers that I have used to find unused or unidentified music. I could go on and on as to what music I have found... |
KungFuFurby
Member
Level: 12
Posts: 9/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
I've been looking at Giraffe Soft/Kan's games lately by using a directory that can be scanned through in ASCII.
I found leftover data for Super Pachinko Taisen in The Shinri Game 2 through references with the ASCII text. The entire directory from Super Pachinko Taisen is in The Shinri Game 2. To me, if they still survive, that would mean unused graphics. There is at least one leftover reference in this fashion that survives, but it is questionable if the data has been overwritten.
Super Pachinko Taisen does have unused graphics due to a missing reference. DEBG/ASC04 appears to be used at the Title Screen. There is ASC16 in the directory right next to ASC04, and it is never referred to anywhere. DEBG, which to me stands for debug, is effectively gone on a technicality except for those two fonts, most likely due to memory constraints. |
KungFuFurby
Member
Level: 12
Posts: 10/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
I found the entire soundtrack for Mario no Super Picross inside Zenkoku Juudan Ultra Shinri Game. Just simply use these codes:
C08950A9
C08951xx
C0895ACE
The game will crash after the Visit logo, but that doesn't mean you can't record them. That's why we have SPC dumps.  |
KungFuFurby
Member
Level: 12
Posts: 11/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
Bebe's Kids also has secret pictures, and I was able to find the corresponding cheat to activate them (I call this cheat Team Gaijin Mode based off of the pictures):
At the Paramount Pictures logo, press Up, Down, X, R, A, Y, B, A, B, Y. For each button you press correctly, you will get more time at the logo to enter the rest of the code. If you enter all of it correctly, then the game will immediately start. The graphics affects the Title Screen, character selection screen, and ending. In the case of the ending, you lose the credits altogether and instead get a Team Gaijin logo (which I believe is the same one found on the Title Screen if you wait).
This also unlocks some in-game cheats. Just simply hold Select and press the following keys on the d-pad for the following effect:
Left ~ Clears all enemies. This works on the final boss, but it doesn't allow you to beat the game that way.
Down ~ Goes back a room. This isn't bug free: graphical glitches can occur, and the music can get temporarily muted. Going before the first room results in an instant Game Over and the cheat will be rendered null and void.
Up ~ Goes up a room. This isn't bug free: graphical glitches can occur, and the music can get temporarily muted. There are three rooms past the final boss (they are graphically glitched), and going past those three will make the game play the second level cutscene. The game then loops back to level 2. |
KungFuFurby
Member
Level: 12
Posts: 12/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
This is what hex editing does for me: it allows me to hunt down cheats if I get curious.
Boogerman for the SNES has three cheats that seem like they can be entered almost anywhere. The exception is when the game is paused. What's strange is that all three start with the exact same button combination (Up, down, left, right). Here are the cheats:
Up, down, left, right, L, L, L ~ Stage Select
Up, down, left, right, R, R, R ~ Full Restore
Up, down, left, right, down, down, B ~ Sound Test
The Full Restore cheat only works if you're playing the game (or, alternatively, during the opening). It doesn't give you an infinite amount of anything: it looks like it maxes out your health, mucous/gas meters and gives you an enhancement for both.
The Sound Test has a slight bug: Music Off instead plays Stupid Tune (which is music ID 00). Other than that, it's fully functional. I determined that Stupid Tune appears to play during "Ending 2" (which is found in the Stage Select cheat), which also contains a photo of I believe the developers waving.
Foreman For Real for the SNES has cheats in the form of passwords. There are four cheats. One of them is dynamic. Here are the passwords...
CR=DYTS
Takes you to the ending credits.
B0DG8
Seems to make it impossible for Player 1 to be knocked down during a fight.
CH00Z.?.?.?.
This code starts an exhibition fight with any two boxers you choose in one or two player mode. The question marks indicate parameters:
The first two accept B through X. These correspond to boxer IDs. Duplicates are allowed, and this is the only one that I can think of that allows for duplicates.
The last question mark takes a B for one player mode or a C for two-player mode.
C00LD00D
All this does is take you to the career mode ending screen, which is a single photo. |
KungFuFurby
Member
Level: 12
Posts: 13/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
| I decided to see if I can hunt them down myself. I will admit I'm not quite sure where the other two are, but I seem to have found the credits text for the first Ninja Gaiden in plain ASCII. Plus, I got a reference to the text in an array. So off I go to see if the cutscene still exists... if so, I'll provide the access method. |
KungFuFurby
Member
Level: 12
Posts: 14/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
So far, I have found a scene modifier, and even decided to check out the original NES version for myself since the code seems to have been mostly directly taken from the original, minus pointerse. So far, the comparison reveals that the scene itself was chopped and the credits are not in a separate scene, so I'm hunting down the individual musical hits to see what's going on. A code comparison helps me in this fashion, too, considering the NES's processor is simply a step backwards from the SNES. 
I have discovered the Ninja Gaiden staff roll theme exists in Ninja Gaiden Trilogy. To access, simply use the PAR code 81804318. All I had to do was compare and contrast to the original NES version. The key difference between this one and the one that is used is that this one is non-looping and ends after about a minute and a half.
Considering I have been doing comparisons (especially musically), I have determined that the unknown jingle that was found is also from the original Ninja Gaiden, and it is unused in the SNES version. Its corresponding NES version (at least the US version: I haven't checked the Japanese version yet) also appears to not use it to my knowledge, as any values that have been dummied out in the SNES version either play nothing or play SFX. I am hot on the staff roll's tail at the moment... now all I need to do is see if the cutscene data still exists. If so, I'll hack my way into the staff roll, probably via a pointer modifier.
...and via my secret music hunt, the results are in. The good news is that I was able to restore the staff roll for the original Ninja Gaiden with the SNES version. The bad news is that the cutscene code had to be implanted from the NES version because it got deleted... literally. Thankfully there's enough room for me to just simply copy the bytes. And with a little bit of code hacking to ensure that the ending plays, the staff roll is back up and running.
These come from the US version for both the NES and SNES versions. First, go to 2A604 in the SNES ROM (this is based off of a hex editor... 04 17 FF should be the three bytes preceding it). This is exactly where the staff roll would have gone. Now, go to 125CB in the NES ROM. Copy 21E (or 542) bytes and overwrite those bytes in the SNES ROM starting at 2A604.
Now, in the SNES ROM, replace all hits for AD 00 03 preceding where you implanted the cutscene code with A9 0B EA. If done correctly, when you start the game, you'll instantly get the ending with the staff roll.
Here is the result via YouTube. |
KungFuFurby
Member
Level: 12
Posts: 15/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
Assuming we're talking about the SNES version...
Well, I can tell you that there are four on GameFAQs listed as cheats. Well, there are more than four of them based off of what I have looked up in the codes... I have determined there are ten that either activate some cheat variable or does something else. However, the button codes are not in plain sight to my eyes, meaning there's an algorithm to crack open... the cheat variables are 7E204C through 7E205A. Setting them to FF FF (that's two bytes of FFs) activates a cheat. I have not determined what each one does yet...
The reason why that one cheat is visible in plain sight in hex code is because it is most likely practically given to the player as he completes the game with each character.
And I think I just made a discovery. All but one of the codes from the Genesis version work on the SNES version. Just replace C with Y. Here's the variable affected (if applicable) with each code:
YBB YYB YAB AAA BBY BAB (7E204E)
YBA AYB YYB AYA BAA YAA (7E2054)
BBB AAY ABY AYB YYY YAB (7E2056)
AYA YBB BYA AAY YBY AAA (7E204C)
BAA YYB AYA AYA AYA BAB (plays no SFX, but my guess is that it's valid)
YAY BBB YAA AYY BYA AAA (plays no SFX, but my guess is that it's valid)
BAY YBB ABB ABB ABB BAA (7E2050)
AAA AAY BYB ABY BAB YAB (7E2052)
AAY AYB BBY AAA YYB YAA (7E205A)
YYY AAY YYY AAB AYB ABB (not valid in SNES version)
So that's all but one of them. The missing code modifies 7E2058 and will give a result of zero for a cheat ID. |
KungFuFurby
Member
Level: 12
Posts: 16/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
| Actually, I haven't tested the codes yet to see what exactly they do in the SNES version... |
KungFuFurby
Member
Level: 12
Posts: 17/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
| Is that a password generator? I determined that sub_2A1974 is the one that fires away when a password is entered (I'm using a hex editor, but I know where the cheat checks occur because I know opcodes quite well), and thus is what I'm going for. It uses a few direct page variables and a lot of rotating and shifting to make the calculation... at least for a start. I'm analyzing that so I can crack the code and figure out how to trigger cheat ID zero (which stores a set of FFs to 7E2058). |
KungFuFurby
Member
Level: 12
Posts: 18/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
Does this spread over to the consoles as well... as in actual homebrew games that aren't hacks of other games (I have a few SNES games released past 2000 that I could probably name, although I actually don't have a lot, especially if they're not in the graphics department, for which I generally don't bother with)?
I think of N-Warp Daisakusen for the SNES, for which I have found both unused music (one of them only in an earlier version) and a debug mode (and I even have revision differences! I believe the credits sequence was both inaccessible and might even not be there at all in the earlier version). |
KungFuFurby
Member
Level: 12
Posts: 19/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
I'm working on that through the Title Screen (which does not use that particular array). I have the music part, but I'm hunting down what I suspect is a sample pack modifier at the moment.
It's probably the best case scenario for this particular game. |
KungFuFurby
Member
Level: 12
Posts: 20/25
EXP: 7825
For next: 96
Since: 08-10-11
Since last post: 8.3 years
Last activity: 2.6 years
|
|
That's easily done with a hex editor once I know what triggers the sound effects... the catch is that usually you have lots and lots of calls for sound effects.
In other news, I have a Title Screen music modifier ready. Here are the PAR codes for the US version:
Out of This World
Title Screen Music Modifier
Music ~ 80D990xx
Sample Pack ~ 80D462xx
The range for the music is 00-01, 03-05, 07, 09-0C, 0E. 02, 06, 08 are duplicates of 00. 0D is a duplicate of 0C. There is no more music after 0E.
The unused song is located at 05. |
