Sonic and Sega Retro Message Board: evilhamwizard - Viewing Profile - Sonic and Sega Retro Message Board

Jump to content

Hey there, Guest!  (Log In · Register) Help

Group:
Researcher: Researcher
Active Posts:
1247 (0.27 per day)
Most Active In:
General Sonic Discussion (602 posts)
Joined:
16-June 04
Profile Views:
23273
Last Active:
User is offline Yesterday, 09:44 PM
Currently:
Offline

My Information

Age:
Age Unknown
Birthday:
Birthday Unknown
Gender:
Male Male

Contact Information

E-mail:
Click here to e-mail me

Previous Fields

National Flag:
None
Wiki edits:
109

Latest Visitors

Topics I've Started

  1. The Terminator (Beta) for Sega CD

    19 November 2016 - 12:05 AM

    A long time a go I could've sworn that a bin/cue of this was floating around the internet. There are some signs that it existed at some point and I believe it actually came from PACHUKA back in the day. I've been trying to locate it for a while now but I was wondering if maybe anyone from around that time still had a copy of it? I know it's a bit of a stretch, but maybe there's a chance someone still has it somewhere.

    The prototype apparently had debug enabled and a few unfinished levels. The last I've heard of it was when Pach still owned CulT (around the time of his Amazing Spiderman prototype write up) but I haven't heard anything about it since. It'd be neat to find it since we have almost every leaked Sega CD prototype up until this point, except for that one.
  2. Sonic Jam unused objects

    16 August 2016 - 05:17 PM

    Wasn't sure either to post this in some other thread as it's quite small.

    I figured out some things about objects in Sonic Jam. The game uses a set file for the stage layout just like Sonic Adventure that's fixed at 0x8000 bytes. Each object in the set file is 0xF bytes long. I don't know much about the other values, but I do know that the second byte in each entry is the object ID. The other bytes are more than likely X/Y/Z coordinates and rotation data, probably not single precision floating point (as far as I know).

    Like Sonic Adventure, there is a resemblance to the object table used in stages that's stored in the Sonic World binary (MUSEUM.MUS, anything with a .MUS extension is for Sonic World/Museum). The binary file contains the code and some other data for the Sonic World, the menus, challenges, etc. This file has a base address of 06040000.

    In the US version, there is a table that exists at 0605EF34 in MUSEUM.MUS that contains a series of data related to objects as part of this structure:

    00000000 ObjListEntry struc ; (sizeof=0x20)
    00000000 LoadingSub: .data.l ? ; offset
    00000004 Unk_A: .data.b ?
    00000005 Unk_B: .data.b ?
    00000006 Unk_C: .data.b ?
    00000007 Unk_D: .data.b ?
    00000008 Obj_Name: .data.b 8 dup(?) ; string©
    00000010 PtrTable: .data.l ? ; offset
    00000014 DataPtr1: .data.l ? ; offset
    00000018 DataPtr2: .data.l ? ; offset
    0000001C DataPtr3: .data.l ? ; offset
    00000020 ObjListEntry ends

    "LoadingSub", is the main subroutine for the object. Each entry in the table only makes reference to one location for code. The four Unk byte entries I have no idea. Possibly parameters of some kind? "Obj_Name" is a hardcoded string containing the name of the object (fixed to 8 bytes long, with the 8th byte being a terminator). This is unlike Sonic Adventure, which references the name of an object by pointer, rather than listing it directly as part of the struct. "TblPtr" always points to a small list of pointers that point to other subsets of pointers, maybe this is referencing some kind of model data? The three DataPtrs contain some misc data which can be sometimes null'd out depending on the object, so what they point to I have no idea either.

    The most interesting thing are the objects that are available in the game. Here's a list:
    00 - RING
    01 - CARD
    02 - DOOR
    03 - WACOLLI
    04 - BXCOLLI
    05 - SOUND
    06 - HISTORY
    07 - MOVIE
    08 - CHARA
    09 - GALLERY
    0a - EXIT
    0b - YASHI
    0c - KI01
    0d - TOTEM
    0e - TOTEM2
    0f - ENCOLLI
    10 - BARU
    11 - -------
    12 - F_IWA
    13 - CHECK
    14 - CHECK2
    15 - BANE
    16 - H_SONIC
    17 - H_EGG
    18 - H_DAIZA
    19 - -------
    1a - MONITA
    1b - POL1
    1c - POL2
    1d - ARCH
    1e - -------
    1f - -------
    20 - SIBU
    21 - SOUN_IN
    22 - GALL_IN
    23 - HIST_IN
    24 - CHAR_IN
    25 - MOVE_IN
    26 - FLICKYB
    27 - FLICKYG
    28 - FLICKYP
    29 - FLICKYR
    2a - FLICKYY
    2b - MONKEY
    2c - KAMOME
    2d - SIBU2
    2e - HAPPA

    Some of these are self-explanatory. There are three unused objects that aren't completely null, and they are:

    2b - MONKEY:
    Posted Image
    A monkey that walks in place. You can walk through it and he does nothing else. Probably meant to be in a tree.

    2c - KAMOME:
    Posted Image
    A seagull that just sits in place. Probably meant to be in the sky. You can walk through it too.

    2e - HAPPA:
    *no image*
    This object is strange as the pointers for the data are null'd out but the loading subroutine is still referenced. No idea what it's meant to do.

    The impression I get is that most of the unused objects here were probably going to be added to Sonic World but they ran out of time to implement them. In the early demo build featured in some Saturn demo discs, there are still a ton of objects that aren't referenced at all that would be eventually added into the game (such as the Flickies, etc).

    That's all I have for now, but I'll keep poking around to see if there's more.

    PS: Coincidentally, every version of Sonic Jam has symbol/assembly trash compiled into some random parts of SPRDATA.MUS, _DAT0999.bin, and _DAT1499.bin. They all seem to be a mix of raw art asm output and symbols for Sonic 3/K.
  3. Mega CD's initial announcement and debut?

    05 March 2016 - 09:07 PM

    Hey all just a quick question.

    What information do we know about the Mega CD's initial announcement in Japan? All I could find was that it was announced formerly at the Tokyo Toy Fair in 1991 (around the summer time, so probably June/July). Does anyone have any magazine/media clippings from that event?

    (also as a side note, does anyone have any media specifically for sega's overall software showcasing at that event specifically? I know we have a list on the wiki but there definitely had to have been more there)
  4. World of Illusion Prototype stuff

    07 December 2015 - 03:10 AM

    A few months a go, I actually did some hacking of the World of Illusion Starring Mickey Mouse and Donald Duck prototype for the Megadrive and found some really neat things. This was around the time GoldS from TCRF wrote up a fantastic article on the prototype, documenting as many things as he could. I found some things myself that I mentioned on the Talk page that are definitely worth a mention. :)/>/>

    As much as I loved this game, I'm not too crazy to try and disassemble it completely like I did with Castle of Illusion. But I wanted to mention the things I found here and the page that GoldS wrote up because this was a great prototype for it's day.

    First let me show you the first thing I found that also happens to be my favorite discovery of the bunch:

    Loading the subroutine at $1448 before the next main game loop while in a level will cause a "coming soon" screen to display (the "coming soon" graphic was found before but not the fantastic drawing in the background!):
    Posted Image
    Trying to load this up during any other part of the game will cause it to load improperly, so this was definitely shown immediately after completing a level at some point (probably at CES).

    Loading the subroutine at $3C82 before the next main game loop while in a level will cause a "Work in progress" screen to display:
    Posted Image
    This will reset the game and load the next unused thing.

    Loading the subroutine at $1C70 before the next main game loop while at the title screen will load up an unused demo mode (used in the final, but disabled in the proto). The most interesting thing about this mode is that it covers 1-1, 1-D, 1-M, 2-1, 3-1, 4-1. You can press start at each demo to go to the next one. When you reach 4-1, it'll go back to the Sega screen when you press start. The only demo that kind of matches with the level layout in the game is 1-1, everything else doesn't seem to match.

    Loading the subroutine at $3F5E before the next game loop at any time will display this:
    Posted Image
    It says something like "Now, let's go Donald!" (thanks franz for translating :*).

    There are three other subroutines that are unused in the game's game mode array but I don't know where they're called or what they do besides alter the game slightly.
    1.) 155A - more use in game it seems. Camera stops moving on one plane, main player sprite is partially garbled, hud disappears. Doesn't seem to load anything into VRAM.
    2.) 1CE0 - doesn't seem to do anything in game but will cause the game to run in a NOP'd loop if loaded elsewhere
    3.) 3CF2 - does something similar to 155A...
    I went through the entire game and did an active disassembly with Exodus as thoroughly as I could and managed to make a pretty good guess on what's used and what isn't. I think I managed to pretty much load up every used object and stage in the game, so any address 'predicted' by Exodus is probably unused objects and other stuff.

    I probably wont look at this game too much since I'm working on some other projects at the moment, but I'll probably return to this sometime in the future.
  5. Castle of Illusion (J) crap

    02 November 2015 - 01:03 AM

    A few things on this game.

    (All of these are based on the Japanese release. I did most of this stuff with the help of Exodus and IDA Pro)

    1.) Art
    This game uses lots of Nemesis compression. The only thing that isn't compressed as far as I can tell is Mickey's player sprite (cutscene Mickey tiles are compressed). The game also uses Enigma compression too, but I'm not entirely sure what it could be using it for. It doesn't seem to be using it for any graphics, maybe related to tile mapping. It isn't used very often. Nemesis is usually used for graphics, but I've seen archives for tile/stage mappings too. I played through the entire game and documented every used Nemesis archive in the game. I compiled a list of the location ranges of each archive (note, names are kinda ambiguous and are kinda wrong, but it'll give you a good idea of what they might be).

    Quote

    ##This is the from-to data ranges that are loaded by the Nem_Process_Compressed_Data in CoI J
    --Opening Cinematic and title screen--
    14600-147DD - Opening Text
    4C9C6-4CBEB - Opening Tree BG
    4DFBC-4F029 - Opening Landscape BG
    4D32C-4DFBB - Opening FG
    50246-50B8F - Opening Scared Mickey&Minnie
    50B90-518E0 - Opening Dancing Mickey&Minnie
    4FAD0-50245 - Opening Mizrabel
    4F940-4FACF - Opening Mickey Runs
    6D020-6D4B1 - Japanese Text
    4A756-4A8FF - Opening Mickey Turns
    4A900-4AA53 - Opening Mapping Maybe
    **from here on things are load directly into ram**
    4F708-4F93F - Level Complete Mickey
    4BD7E-4C057 - Title Screen Japanese subtitle
    4C058-4C195 - Title Screen Copyright
    4C196-4C23B - Title Screen Press Start Button
    4C23C-4C457 - Title Screen Mickey Mouse
    4C458-4C9C5 - Title Screen Logo
    4CBEC-4D32B - Title Screen BG

    --Copyright Screen--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD

    --Sound Test--
    14A80-151A3 - HUD
    147DE-14A7F - Sound Test Text
    5FD70-60681 - Sound Test Mickey?
    60682-607E9 - Sound Test Wood Bar 1
    607EA-6093D - Sound Test Wood Bar 2
    6093E-60B3B - Sound Test Wood Frame 1?
    60B3C-60D6B - Sound Test Wood Frame 2?

    --Outside Castle--
    147DE-14A7F - Sound Test Text
    672F2-67F53 - Outside Castle foreground
    67F54-6821F - castle walls
    6709C-672F1 - monk?
    5B8BC-5BEA5 - toy soldier
    151A4-153C9 - Enemy Explode
    6D020-6D4B1 - Japanese Text
    4AB6C-4AC89 - mickey outside
    4AC8A-4AD51 - outside castle mapping?

    --Inside Castle (Before Round 1 - Forest)--
    35454-35759 - inside castle mapping?
    33200-33A1F - castle tiles 1? (inside forest door?)
    34AAA-35257 - castle tiles 2? (outside castle)
    35454-35759 - castle tiles 3? (opened door?)
    147DE-14A7F - Sound Test Text
    35258-35453 - castle tiles 4? (stairs)
    35B24-365C7 - castle tiles 5? (interior?)
    21560-21B55 - mickey (inside castle sprites)
    14A80-151A3 - HUD
    6D020-6D4B1 - Japanese Text
    6D4B2-6D53B - "NORMAL"

    --Stage 1-1 (Normal and Practice)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6A396-6A55B - swing and leaf platform VRAM $6000
    5EBB8-5EDA3 - Red Mushroom Enemy (VRAM $7800)
    5EDA4-5F225 - Tree Enemy VRAM $7B40 or $7B60 not sure where it starts in vram)
    5E88E-5EBB7 - Rose Enemy
    5ADBC-5AED3 - Bird Enemy VRAM $8780 in 8x16
    5A4F2-5A90B - giant red apple?
    5AED4-5B1E3 - Spider Enemy VRAM $9740 8x16
    22E0E-2375B - loaded in ram it seems...
    3670C-3767D - forest 1-1 tiles 1 (foreground)?
    386AA-3944B - forest 1-1 tiles 2 (background)?
    39CA8-39D89 - loaded in ram? mapping?
    6DC3C-6DE03 - mapping (loaded in vram) (actual data starting point might be 6DC3A because of pointer)

    --Stage 1-2 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6A396-6A55B - swing and leaf platform VRAM $6000
    5EBB8-5EDA3 - Red Mushroom Enemy (VRAM $7800)
    5EDA4-5F225 - Tree Enemy VRAM $7B40 or $7B60 not sure where it starts in vram)
    5E88E-5EBB7 - Rose Enemy
    5ADBC-5AED3 - Bird Enemy VRAM $8780 in 8x16
    5A4F2-5A90B - giant red apple?
    5AED4-5B1E3 - Spider Enemy VRAM $9740 8x16
    24344-257AD - loaded in ram it seems...
    3670C-3767D - forest 1-1 tiles 1 (foreground)?
    386AA-3944B - forest 1-1 tiles 2 (background)?
    39CA8-39D89 - loaded in ram? mapping?
    6E282-6E34B - mapping (loaded in vram)? (might be 6E280)

    --Stage 1-3 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6A396-6A55B - swing and leaf platform VRAM $6000
    5AED4-5B1E3 - Spider Enemy VRAM $9740 8x16
    5ADBC-5AED3 - Bird Enemy VRAM $8780 in 8x16
    3944C-39CA7 - forest 1-3 tiles (background)? (VRAM $4000 8x16)
    37B30-37D99 - spider web (forest 1-3 tiles (foreground))
    6E06C-6E27F - 1-3 mapping loaded in vram (might be 6E06A)

    --Stage 1-4 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6A396-6A55B - swing and leaf platform VRAM $6000
    5EBB8-5EDA3 - Red Mushroom Enemy (VRAM $7800)
    5E5EC-5E88D - bat
    5A90C-5ADBB - ghost enemy
    5F8C4-5FA5D - warning sign
    3670C-3767D - forest 1-1 tiles 1 (foreground)?
    386AA-3944B - forest 1-1 tiles 2 (background)?
    3767E-37B2F - forest 1-3 tree (background)
    6DE06-6E069 - forest 1-4 map (loaded in vram, address might be 6DE04)

    --Stage 1-Boss (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6A396-6A55B - swing and leaf platform VRAM $6000
    53D06-54613 - Stage 1 Boss (includes acorns and head)
    37D9A-386A9 - Stage 1 Boss Tree (part of scenery)
    3670C-3767D - forest 1-1 tiles 1 (foreground)?
    386AA-3944B - forest 1-1 tiles 2 (background)?
    39CA8-39D89 - loaded in ram? mapping for tiles?

    --Game Over--
    7D6FE-7E8B7 - Game Over/Level Complete tiles ($6000 in VRAM)
    7E8B8-7FA2B - Mickey 1 (mostly for Game Over screen)
    4F708-4F93F - Mickey 2 (victory pose? for level complete)
    147DE-14A7F - Sound Test Text
    6D020-6D4B1 - Japanese Text

    --Level Complete--
    14A80-151A3 - HUD
    7D6FE-7E8B7 - Game Over/Level Complete tiles ($6000 in VRAM)
    7E8B8-7FA2B - Mickey 1 (mostly for Game Over screen)
    4F708-4F93F - Mickey 2 (victory pose? for level complete)
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    147DE-14A7F - Sound Test Text
    6D020-6D4B1 - Japanese Text
    147DE-14A7F - Sound Test Text **loaded again for the results page

    --Stage 2-1 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6A55C-6AB9F - toy land level objects (objects? I see the key in here)
    5B8BC-5BEA5 - toy soldier
    5C938-5CBB1 - toy plane
    5C5A8-5C937 - jack in the box enemy
    5A90C-5ADBB - ghost enemy (wtf?! enemy isnt supposed to be here, so this is unused)
    3ADF2-3B377 - loaded in ram it seems...
    3B378-3B527 - loaded in ram too...maybe for when the level turns into a slope?
    39D8A-3AA8F - toy land tiles 1 (foreground)?
    3AA90-3ADF1 - toy land tiles 2 (background)?
    3B528-3B8B9 - toy land tiles 3 (jello?)
    6E34E-6E6D3 - toy land 2-1 mapping (loaded in vram) (might actually be at 6E34C because of the pointer)

    --Stage 2-2 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6A55C-6AB9F - toy land level objects (objects? I see the key in here)
    5B8BC-5BEA5 - toy soldier
    5C938-5CBB1 - toy plane
    5C5A8-5C937 - jack in the box enemy
    5BEA6-5C5A7 - clown enemy
    5B1E4-5B3C9 - tricycle
    3ADF2-3B377 - loaded in ram it seems...
    39D8A-3AA8F - toy land tiles 1 (foreground)?
    3AA90-3ADF1 - toy land tiles 2 (background)?
    3B528-3B8B9 - toy land tiles 3 (jello?)
    6E6D6-6E875 - toy land 2-2 mapping (loaded in vram) (might actually be at 6E6D4 because of pointer)

    --Stage 2-3 (Practice)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6A55C-6AB9F - toy land level objects (objects? I see the key in here)
    5B8BC-5BEA5 - toy soldier
    5C938-5CBB1 - toy plane
    5BEA6-5C5A7 - clown enemy
    5B1E4-5B3C9 - tricycle
    3ADF2-3B377 - loaded in ram it seems...
    39D8A-3AA8F - toy land tiles 1 (foreground)?
    3AA90-3ADF1 - toy land tiles 2 (background)?
    3B528-3B8B9 - toy land tiles 3 (jello?)
    6E878-6EAEF - toy land 2-3 mapping (loaded in vram) (might actually be at 6E876 because of pointer)

    --Stage 2-Boss (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6A55C-6AB9F - toy land level objects (objects? I see the key in here)
    54614-55231 - Stage 2 Boss - Punching Clown
    39D8A-3AA8F - toy land tiles 1 (foreground)?
    3AA90-3ADF1 - toy land tiles 2 (background)?
    3B528-3B8B9 - toy land tiles 3 (jello?)
    3ADF2-3B377 - loaded in ram it seems...

    --Stage 3-1 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6C93E-6CB05 - stage 3-1 objects (water/splash)
    6ABA0-6B265 - geyser and bridge
    5B3CA-5B8BB - bone fish
    5E5EC-5E88D - bat
    5EBB8-5EDA3 - Red Mushroom Enemy
    3670C-3767D - Forest FG (it recolors it with a different pal)
    3B8BA-3C06D - 3-1 underwater BG?
    3C84C-3D1E5 - 3-1 sky (this might be the bg)
    3E37C-3EC59 - loaded in ram it seems...
    29E10-2B37D - 3-1 map tile layout (for the entire stage), prolly compressed because its huge, loaded into ram
    6EAF2-6EE1D - stage 3-1 (practice?) mapping (loaded in vram) (might be 6EAF0 because of pointer)

    --Stage 3-1 (Practice)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6C93E-6CB05 - stage 3-1 objects (water/splash)
    6ABA0-6B265 - geyser and bridge
    5B3CA-5B8BB - bone fish
    5E5EC-5E88D - bat
    5EBB8-5EDA3 - Red Mushroom Enemy
    3670C-3767D - Forest FG (it recolors it with a different pal)
    3B8BA-3C06D - 3-1 underwater BG?
    3C84C-3D1E5 - 3-1 sky (this might be the bg)
    3E37C-3EC59 - loaded in ram it seems...
    29E10-2B37D - 3-1 map tile layout (for the entire stage), prolly compressed because its huge, loaded into ram
    6EAF2-6EE1D - stage 3-1 (practice?) mapping (loaded in vram) (might be 6EAF0 because of pointer)

    --Practice Mode Ending (technically still inside castle)--
    6D020-6D4B1 - Japanese Text
    33A20-34AA9 - ending castle tile 1
    34AAA-35257 - castle tiles 2? (outside castle)
    3575A-35B23 - rainbow bridge?
    6BFCE-6C93D - minnie?
    4FAD0-50245 - mizrabel
    64E0A-655BD - mickey?
    6D4B2-6D53B - "NORMAL"

    --Stage 3-2 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6ABA0-6B265 - geyser and bridge
    5B3CA-5B8BB - bone fish
    5E5EC-5E88D - bat
    59DEC-5A4F1 - waterfall
    3C06E-3C84B - stage 3-2 forground
    3D1E6-3D937 - stage 3-2 background
    2B37E-2D18B - loaded in ram it seems...
    6EE20-6EFE1 - stage 3-2 mapping loaded in vram

    --Stage 3-3 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6ABA0-6B265 - geyser and bridge
    5B3CA-5B8BB - bone fish
    5E5EC-5E88D - bat
    59DEC-5A4F1 - waterfall
    3C06E-3C84B - stage 3-2 forground
    3D938-3DF15 - stage 3-3 background?
    3DF16-3E37B - water current
    6EFE4-6F0EB - stage 3-3 mapping (loaded in vram)

    --Stage 3-Boss - Lizard guy--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    530CA-53D05 - Stage 3 Boss - Lizard guy
    3C06E-3C84B - stage 3-2 forground
    3D1E6-3D937 - stage 3-2 background

    --Stage 4-1 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6C93E-6CB05 - stage 3-1 objects (water/splash)
    6B266-6B74F - stage 4-1 objects
    5C938-5CBB1 - toy plane
    5F226-5F431 - book worm enemy
    5F432-5F527 - letter A enemy
    5A4F2-5A90B - giant red apple?
    59C18-59DEB - stomping book
    42B1C-43235 - loaded in ram it seems...
    3EC5A-405B5 - stage 4-1 forground
    6F0EE-6F1B1 - stage 4-1 mapping (loaded in vram)

    --Stage 4-2 Candy Land (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6C93E-6CB05 - stage 3-1 objects (water/splash)
    6B750-6BFCD - stage 4-2 platforms? $6400 VRAM 8x16
    5F754-5F8C3 - swedish fish enemy
    405B6-40CCB - 4-2 candy land fg? $2180?
    40CCC-41775 - 4-2 candy land bg? $4000
    43BD2-43E6D - 4-2 candy land layer 2 bg building VRAM $5040 8x16
    41776-41A09 - loaded in ram it seems...
    6F42E-6F6AB - stage 4-2 mapping (loaded in vram)

    --Stage 4-1 - return from 4-2 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6C93E-6CB05 - stage 3-1 objects (water/splash)
    6B266-6B74F - stage 4-1 objects
    5C938-5CBB1 - toy plane
    5F226-5F431 - book worm enemy
    5F432-5F527 - letter A enemy
    5A4F2-5A90B - giant red apple?
    59C18-59DEB - stomping book
    42B1C-43235 - loaded in ram it seems...
    3EC5A-405B5 - stage 4-1 forground
    6F1B4-6F42B - stage 4-2 mapping AFTER coming back from 4-2 (when you get the green rainbow gem)

    --Stage 4-1-t1 - First tea cup you encounter (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6C93E-6CB05 - stage 3-1 objects (water/splash)
    5F754-5F8C3 - swedish fish enemy
    5F528-5F753 - sugar cube?
    4324E-43635 - tea world tiles?
    43236-4324D - loaded into ram it seems...
    6F78A-6F8BD - 4-1-t1 mapping loaded into vram

    --Stage 4-1 - return from 4-1-t1 (Normal)--
    --same as 4-1 return from 4-2--

    --Stage 4-1-t2 - Second tea cup you encounter after big apple (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6C93E-6CB05 - stage 3-1 objects (water/splash)
    5F754-5F8C3 - swedish fish enemy
    5F528-5F753 - sugar cube?
    4324E-43635 - tea world tiles?
    43236-4324D - loaded into ram it seems...
    6F6AE-6F787 - 4-1-t2 mapping loaded into vram

    --Stage 4-1-t2 - Unused?! (Normal)--
    --same as 4-1-t1 though, but it leaves you off at a different location when you finish (puts you after the second tea cup), 4-1-4 in the stage select... :(/>/>/>/>/>/>/>/>/>--

    --Stage 4-1-B Boss - Liquorice Dragon (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6C93E-6CB05 - stage 3-1 objects (water/splash)
    6B750-6BFCD - stage 4-2 platforms? $6400 VRAM 8x16
    55918-56665 - liquorice dragon boss
    405B6-40CCB - 4-2 candy land fg? $2180?
    40CCC-41775 - 4-2 candy land bg? $4000
    43BD2-43E6D - 4-2 candy land layer 2 bg building VRAM $5040 8x16
    41776-41A09 - loaded in ram it seems...

    --Stage 5-1 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    154A8-15815 - stage 5-1 objects?
    5E5EC-5E88D - bat
    59300-598F1 - big rolling boulder $7380 in VRAM 8x16
    5DFBA-5E5EB - knight enemy
    5DC0C-5DFB9 - big bubble
    59AC2-59C17 - walk on platform
    5FA5E-5FD6F - suit of armor
    2FD94-31023 - loaded in ram it seems...
    43E6E-44C03 - stage 5-1 fg
    44C04-45DA1 - stage 5-1 bg
    45DA2-45E45 - no idea, I think it went into ram
    6F8C0-6FC81 - 5-1 mapping loaded into vram

    --Stage 5-2 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    6C93E-6CB05 - stage 3-1 objects (water/splash)
    5B3CA-5B8BB - bone fish
    43E6E-44C03 - stage 5-1 fg
    44C04-45DA1 - stage 5-1 bg
    45DA2-45E45 - no idea, I think it went into ram
    6FF34-6FFFF - 5-2 mapping loaded into vram

    --Stage 5-3 (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    15816-16C7F - stage 5-3 objects
    5E5EC-5E88D - bat
    598F2-59AC1 - compresser
    45E46-47813 - stage 5-3 fg?
    47814-47B07 - stage 5-3 bg?
    47B08-484BD - loaded in ram it seems...
    6FC84-6FF31 - stage 5-3 tile map? (might be 6FC82 instead)


    --Stage 5-Boss - Man (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    15816-16C7F - stage 5-3 objects
    56666-56A8F - Boss Man ? torso
    56A90-56FFB - Boss Man ? head
    56FFC-57909 - Boss Man ? attack
    5790A-57B6B - Boss Man ? hit
    45E46-47813 - stage 5-3 fg?
    47814-47B07 - stage 5-3 bg?
    47B08-484BD - loaded in ram it seems...

    --Cutscene - before the fight (Normal)--
    --same as practice ending--

    --Final Boss (Normal)--
    147DE-14A7F - Sound Test Text
    14A80-151A3 - HUD
    151A4-153C9 - Enemy Explode
    6CB06-6CD05 - rainbow gem shimmer and a ball?
    6CD06-6CDF9 - gem/item (apple) (forest collectables)
    51E12-527C5 - Boss - Mizrabel $6000 8x16
    518E0-51A75 - mizrabel p2 $7E80
    51A76-51E11 - minnie? $8200
    52A14-530C9 - mizrabel p3? $8840
    527C6-52A13 - I think these are her ghosts for sure $9B40
    484BE-48F4B - final boss stage fg?
    48F4C-4982D - final boss stage bg (clouds)
    51E12-527C5 - final stage map loaded in vram <--mistake?
    61CDA-61F5B - loaded in ram it seems...chibi mizrabel?
    6144A-615F1 - loaded in ram it seems...gem's magic?

    --Ending Cutscene Part 1 - Mizrabels Back to Normal--
    61CDA-61F5B - loaded in vram it seems...chibi mizrabel?
    626AA-62CB3 - chibi mizrabel p2? $5700
    6328A-6395B - mickey and minnie p1? $6100-6D80?
    655BE-6596D - mickey and minnie p2? $6E00-7380?
    64E0A-655BD - mickey and minnie p3 $73c0-
    6395C-63BF1 - mickey and minnie p4 $8280

    --Ending Cutscene Part 2 - Castle Escape--
    6596E-661DB - ending cutscene bg p1 $2D80-4060 8x8
    661DC-66303 - ending cutscene bg p2 $4080-41C0 8x8
    646C2-64E09 - $5180-5cc0 mickey and minnie 8x16
    6222A-626A9 - $5D00-6680 flying chibi mizrabel 8x16
    4C9C6-4CBEB - $61C0-7680 mizrabel flies off p1 8x16
    4CBEC-4D32B - $66c0-7180 title screen fg? 8x16
    61F5C-62229 - $7000-7740 mizrabel flies off p2? 8x16
    62CB4-63289 - $7780-8180 minnie kisses mickey? 8x16
    63BF2-646C1 - mickey faints
    151A4-153C9 - enemy explode
    147DE-14A7F - Sound Test Text
    615F2-617D7 - ending fireworks
    34AAA-35257 - castle tiles 2? (outside castle)
    4AFE4-4B081 - mickey something $9740-9b00
    4B082-4B1DD - ending p1 map loaded in vram
    4C9C6-4CBEB - ending p2 map loaded in vram
    50B90-518E0 - Opening Dancing Mickey&Minnie loaded in ram
    4DFBC-4F029 - Opening Landscape BG loaded in ram
    4D32C-4DFBB - Opening FG loaded in ram

    --Ending Cutscene Part 3 - Landing--
    4A756-4A8FF - Opening Mickey Turns
    4AA54-4AB6B - part 3 map in vram?

    --Staff Credits--
    4A756-4A8FF - Opening Mickey Turns

    --Curtain Close and The End--
    4F02A-4F157 - back of head 1
    61200-61449 - back of head 2
    617D8-61B6D - curtain top
    61B6E-61CD9 - "the end"
    4AED2-4AFE3 - curtain map in vram?
    4F02A-4F157 - back of head 1


    There are a few interesting things I noticed. For some reason, the first Toyland stage loads the ghosts from the third Forest stage even though they aren't used (could be wrong though). Also, every tea cup stage in the game loads those swedish fish enemies, even though there's no way they can jump out of the water.

    There are only two unused Nemesis archives in the entire ROM. The first is located at $49900, and appears to be "Mickey Mouse" in big multi colored text:
    Posted Image

    The second at $4AD52 appears to be maybe some kind of mapping data (perhaps for this art):
    Posted Image

    2.) Level Select and No Clip remnants
    One thing that always made me curious about this game was it's lack of in game cheat codes. I investigated all the rumored cheat codes that were floating around for the game, and while all of them are false, there is evidence that they exist or used to exist in the game.

    The first thing was a level select. The only instance of a level select code existing was in an issue of Hobby Consolas detailing a cheat if you press all the buttons on the title screen. This implies that upon pressing start at the title screen, you should see the results immediately after. There are no special game screens for a stage select nor were there any subroutines around the title screen routines that were unused. However, upon looking at the sound test I found unused code at $A02C that directly manipulated the current stage variable in RAM:

    ROM:0000A02C GM_SoundTest_StageSelect:               ; Unused! Seems to be loaded within the sound test?
    ROM:0000A02C                 move.b  (RAM_CurrentPressedButton+1).w,d5
    ROM:0000A030                 move.w  (RAM_CurrentStageID).w,d0 ; Move Data from Source to Destination
    ROM:0000A034                 btst    #6,d5           ; Test a Bit
    ROM:0000A038                 beq.s   loc_A044        ; Branch if Equal
    ROM:0000A03A                 subq.w  #1,d0           ; Subtract Quick
    ROM:0000A03C                 bpl.s   loc_A054        ; Branch if Plus
    ROM:0000A03E                 move.w  #$1B,d0         ; Move Data from Source to Destination
    ROM:0000A042                 bra.s   loc_A054        ; Branch Always
    ROM:0000A044 ; ---------------------------------------------------------------------------
    ROM:0000A044
    ROM:0000A044 loc_A044:                               ; CODE XREF: GM_SoundTestLoop+42j
    ROM:0000A044                 btst    #4,d5           ; Test a Bit
    ROM:0000A048                 beq.s   loc_A054        ; Branch if Equal
    ROM:0000A04A                 addq.w  #1,d0           ; Add Quick
    ROM:0000A04C                 cmpi.w  #$1B,d0         ; Compare Immediate
    ROM:0000A050                 ble.s   loc_A054        ; Branch if Less or Equal
    ROM:0000A052                 moveq   #0,d0           ; Move Quick
    ROM:0000A054
    ROM:0000A054 loc_A054:                               ; CODE XREF: GM_SoundTestLoop+46j
    ROM:0000A054                                         ; GM_SoundTestLoop+4Cj ...
    ROM:0000A054                 move.w  d0,(RAM_CurrentStageID).w ; Move Data from Source to Destination
    ROM:0000A058                 lea     (vdp_data_port).l,a2 ; Load Effective Address
    ROM:0000A05E                 move.l  #$4B0C0003,(vdp_control_port).l ; Move Data from Source to Destination
    ROM:0000A068                 mulu.w  #3,d0           ; Unsigned Multiply
    ROM:0000A06C                 lea     Array_StageSelectValues,a1 ; Load Effective Address
    ROM:0000A070                 adda.w  d0,a1           ; Add Address
    ROM:0000A072                 moveq   #0,d1           ; Move Quick
    ROM:0000A074                 move.b  (a1)+,d1        ; Move Data from Source to Destination
    ROM:0000A076                 move.w  d1,(a2)         ; Move Data from Source to Destination
    ROM:0000A078                 move.w  #$3A,(a2) ; ':' ; Move Data from Source to Destination
    ROM:0000A07C                 move.b  (a1)+,d1        ; Move Data from Source to Destination
    ROM:0000A07E                 move.w  d1,(a2)         ; Move Data from Source to Destination
    ROM:0000A080                 move.w  #$3A,(a2) ; ':' ; Move Data from Source to Destination
    ROM:0000A084                 move.b  (a1)+,d1        ; Move Data from Source to Destination
    ROM:0000A086                 move.w  d1,(a2)         ; Move Data from Source to Destination
    ROM:0000A088                 rts                     ; Return from Subroutine
    ROM:0000A08A ; ---------------------------------------------------------------------------
    
    


    The only thing preventing this code from running is a single ret before the first line. NOP it out and the code runs fine:
    Posted Image

    You can access it yourself with the following Game Genie codes:
    Game Genie codes:
    RGST-A6XN (UE)
    RGTA-A6VL (J)

    The "No Clip" cheat wasn't so lucky. Traditionally, the code was always rumored to work when the game is paused. So I found the subroutine for pausing the game, and noticed a bunch of NOPs where calls for button checks and such would probably be:

    ROM:00009808 ; =============== S U B R O U T I N E =======================================
    ROM:00009808
    ROM:00009808
    ROM:00009808 PauseGame:                              ; CODE XREF: GM_StageLoop+34p
    ROM:00009808                 move.w  #$100,(z80_bus_request).l ; Move Data from Source to Destination
    ROM:00009810                 nop                     ; No Operation
    ROM:00009812                 nop                     ; No Operation
    ROM:00009814                 nop                     ; No Operation
    ROM:00009816                 nop                     ; No Operation
    ROM:00009818                 tst.b   (RAM_EnablePauseFlag).w ; 1 = true, 0 = false
    ROM:0000981C                 bne.s   loc_9834        ; Branch if Not Equal
    ROM:0000981E                 move.b  #$80,(byte_A01C12).l ; Move Data from Source to Destination
    ROM:00009826                 nop                     ; No Operation
    ROM:00009828                 nop                     ; No Operation
    ROM:0000982A                 move.b  #0,(byte_A01C13).l ; Move Data from Source to Destination
    ROM:00009832                 bra.s   end             ; Branch Always
    ROM:00009834 ; ---------------------------------------------------------------------------
    ROM:00009834
    ROM:00009834 loc_9834:                               ; CODE XREF: PauseGame+14j
    ROM:00009834                 move.b  #$C1,(byte_A01C0A).l ; Move Data from Source to Destination
    ROM:0000983C                 nop                     ; No Operation
    ROM:0000983E                 nop                     ; No Operation
    ROM:00009840                 move.b  #1,(byte_A01C13).l ; Move Data from Source to Destination
    ROM:00009848
    ROM:00009848 end:                                    ; CODE XREF: PauseGame+2Aj
    ROM:00009848                 move.w  #0,(z80_bus_request).l ; Move Data from Source to Destination
    ROM:00009850                 rts                     ; Return from Subroutine
    ROM:00009850 ; End of function PauseGame
    ROM:00009850
    
    


    I looked everywhere for code that might enable No Clip but I haven't found anything yet. I would suspect it would be common with the player code, but I can't seem to find any unused branches or sections of code that do anything close to what the mode is supposed to do. I'll have to keep searching for it.

    3.) Objects
    This game keeps the main subroutine code for each object (including the player) in a huge table of pointers. The main subroutine, depending on what the object is, will first load the address of a "move" table filled with offsets to functions for certain object actions and then jump to it depending on the object's current condition in game. If it's an enemy, it'll include an additional branch that will check if the enemy has been hit by Mickey's butt, a projectile, or by a rainbow gem. There are some pointers that are never touched which seems to hint at unused objects. Here are a list of pointers for the objects that seem to be unused (excluding duplicates and null'd subroutines);

    Quote

    00001D78 dc.w sub_6E74 ; Predicted (Code target predicted at 0x6E74)
    00001D94 dc.w sub_7188 ; Predicted (Code target predicted at 0x7188)
    00001DFE dc.w sub_227E ; Predicted (Code target predicted at 0x227E)
    00001E00 dc.w sub_2736 ; Predicted (Code target predicted at 0x2736)
    00001E02 dc.w loc_28DE+2 ; Predicted (Code target predicted at 0x28E0)
    00001E04 dc.w sub_2C04 ; Predicted (Code target predicted at 0x2C04)
    00001E06 dc.w loc_2EDC+4 ; Predicted (Code target predicted at 0x2EE0)
    00001E08 dc.w sub_302E ; Predicted (Code target predicted at 0x302E)
    00001E0E dc.w loc_21EC+2 ; Predicted (Code target predicted at 0x21EE)
    00001EAE dc.w sub_7592 ; Predicted (Code target predicted at 0x7592)
    ROM:00001F32 dc.l UnusedTestObject1 ; Predicted (Code target predicted at 0x11E3C)
    ROM:00001F36 dc.l UnusedTestObject2 ; Predicted (Code target predicted at 0x11E6A)


    I haven't bothered to load all of them yet, but I found some odd ones. The last two objects in this list are kinda interesting:
    Posted Image

    The object itself can't be destroyed, has no collision, and does literally nothing. The second unused object in the list is a 1:1 copy of the first object. The object uses the first few tiles from VRAM to build the object (which in a stage the tiles are always the same because the tiles being used are always loaded in the same place).

    4.) Other odds and ends
    Some other neat things I've noticed while digging through this game. I'll arrange it in a small sublist to make it kinda easier to read:
    • Much like how Labyrinth Zone in Sonic 1 was originally meant to be the second Zone but was changed because it was deemed a bit too difficult for a second stage, Castle of Illusion had a similar dilemma. The second substage in the Forest level (the one with the big rolling Apple) was originally supposed to be the third substage. The original second substage was actually supposed to be what is now the forth substage (the one with the ghosts). The decision to swap the stages is made evident in the level order in the level select, pointers for the stage in various tables, and even the first few seconds of the song of the stage (boost the tempo of the beginning of the song and you'll notice it's actually the normal Forest theme but with different sounding instruments). This was probably changed due to the platform difficulty presented. I'd imagine it was probably too difficult to balance Mickey's butt stomps on ghosts without having played a traditional platforming challenge that can be found in the third substage first.
    • Speaking of stages, there were originally supposed to be three tea cup stages for the Library stage but got dropped down to two. I can't seem to find data for that missing stage, but in the level select, the level actually points to 4-1-t1. What's odd, however, is that upon completing the tea cup stage - you get sent back to the Library in mid air a little after where the second tea cup warp is supposed to be. The unused exit can be found in the stage select under 4-1-4.
    • Here's a silly oversight that I saw while disassembling the game. Some backstory first - the game features a 100% z80 sound driver. The game passes off the sound id of the music/sfx it wants to play to $F40E and calls a 68k function to play the sound (79F86). The code itself works as intended, but there's a small catch. Music usually takes precedent over sound effects in game, so sound effects will really only play all the way out unless you don't change the music right away. This becomes a problem in one instance in the game where one sound goes completely unheard even though it's used. When you collect the key in the first substage in the Toyland world (that changes all the platforms to slopes), there's actually supposed to be a sound that plays. They have the code to play the sound, and it get's executed as it should. But after returning from the function that initiates the playback for the sound, the game will pass and call ANOTHER instance for playback for the song that plays when Mickey runs down the slope. Because music takes precedence over sound effects, this accidentally cancels out the sound that's supposed to play. Here's the code that does it:
      ROM:0000083E                 move.b  #$C3,(RAM_CurrentSoundID).w ; play "key got" sfx
      ROM:00000844                 jsr     PlaySound       ; Jump to Subroutine
      ROM:0000084A                 move.b  #$93,(RAM_CurrentSoundID).w ; play "mickey runs down slope" music
      ROM:00000850                 jsr     PlaySound       ; Jump to Subroutine
      
      

      At first maybe switching the ID's around would fix the problem, but you can't play both at the same time like this. The second call to PlaySound has to occur later somehow for the sound to play all the way out.
    • It looks like the developers had a major issue with the ROM size restrictions for this game. Besides the fact that this game has a lot of compressed data, it also has a lot of the programming for certain game modes/screens toward the end of the rom. It seems that they had planned ahead to dedicate certain ROM regions for code and art (with liberal use of padding data), but when they had to add screens that were obviously programmed late, like the game over/ending screens, they probably couldn't fit what they wanted in the area of the rom they had already dedicated for code. From the looks of things, they used whatever free space they had in that artificial code segment they made and made certain "game mode" subroutines in their game mode/screen table dedicated to simply jumping to the actual function code that starts at the end of the rom. To illustrate my point, look at the game mode table here and notice how many of them are _j, or "jumping" subroutines:
      ROM:000003D8 GM_Array:       dc.w GM_Init            ; 00
      ROM:000003DA                 dc.w GM_SegaLoop_j      ; 02
      ROM:000003DC                 dc.w GM_OpeningInit     ; 04
      ROM:000003DE                 dc.w GM_OpeningLoop     ; 06
      ROM:000003E0                 dc.w GM_InitSoundTest   ; 08
      ROM:000003E2                 dc.w GM_SoundTestLoop   ; 0A
      ROM:000003E4                 dc.w GM_StageInit       ; 0C
      ROM:000003E6                 dc.w GM_StageLoop       ; 0E
      ROM:000003E8                 dc.w GM_StageInverter   ; 10
      ROM:000003EA                 dc.w GM_TitleLoop       ; 12
      ROM:000003EC                 dc.w GM_EndingInit      ; 14
      ROM:000003EE                 dc.w GM_Ending          ; 16
      ROM:000003F0                 dc.w GM_GameOverInit_j  ; 18
      ROM:000003F2                 dc.w GM_GameOverLoop_j  ; 1A
      ROM:000003F4                 dc.w GM_CopyrightInit_j ; 1C
      ROM:000003F6                 dc.w GM_CopyrightLoop_j ; 1E
      ROM:000003F8                 dc.w GM_InitCastleLoop_j ; 20
      ROM:000003FA                 dc.w GM_CastleLoop_j    ; 22
      ROM:000003FC                 dc.w GM_StageClearInit_j ; 24
      ROM:000003FE                 dc.w GM_StageClearLoop_j ; 26
      ROM:00000400                 dc.w GM_OutsideCastle   ; 28
      ROM:00000402                 dc.w sub_A286           ; 2A
      ROM:00000404                 dc.w GM_CastleEscapeInit ; 2C
      ROM:00000406                 dc.w GM_CastleEscapeLoop ; 2E
      
      


    5.) Some RAM locations:
    Just a few locations I found, not nearly all of them though...

    Quote

    RAM_Start 00FF0000
    RAM_ObjectSpace FFFFD400
    RAM_PlayerXCoord FFFFDC10
    RAM_PlayerYCoord FFFFDC14
    RAM_CurrentMickeyAnmFrameIndex FFFFDC30
    RAM_DemoKeyBuffer FFFFE000
    RAM_PlayerScore FFFFF22C
    RAM_CurrentGM FFFFF300
    RAM_OpeningTimer FFFFF304
    RAM_CurrentPressedButton FFFFF308
    RAM_CurrentHeldButton FFFFF310
    RAM_PlayerCounter FFFFF316
    RAM_SegaLogoAnmCounter FFFFF318
    RAM_JumpTblIndex FFFFF31A
    RAM_SegaLoopTimer FFFFF31C
    RAM_SegaLogoAnmTimer FFFFF31E
    RAM_ItemsCount FFFFF320
    RAM_PowerCount FFFFF322
    RAM_TriesCount FFFFF324
    RAM_DemoFrameCount FFFFF326
    RAM_CopyrightScreenTimer FFFFF32E
    RAM_FadeOutFlag FFFFF340
    RAM_PlayerXCoord_0 FFFFF342
    RAM_PlayerYCoord_0 FFFFF344
    RAM_TitleScreenTimer FFFFF348
    RAM_CurrentDemoPlaybackButton FFFFF376
    RAM_CurrentPlayerJumpHeight FFFFF405
    RAM_CurrentPlayerJumpFrame FFFFF406
    RAM_DemoModeFlag FFFFF40A
    RAM_PlayerButtstompFlag FFFFF40B
    RAM_CurrentSoundID FFFFF40E
    RAM_LevelRestartFlag FFFFF40F
    RAM_PlayerInAir FFFFF410
    RAM_NextStageFlag FFFFF412
    RAM_EnablePauseFlag FFFFF41D
    RAM_CurrentSoundTestOption FFFFF41E
    RAM_CurrentSoundTestArrayElement FFFFF41F
    RAM_ResetToSegaScreenFlag FFFFF422
    RAM_NoSoundFadeFlag FFFFF424
    RAM_PlayerHurtFlag FFFFF445
    RAM_InvincibilityTimer FFFFF446
    RAM_PlayerState FFFFF447
    RAM_NoLivesFlag FFFFF449
    RAM_PlayerSwimFlag FFFFF44B
    RAM_PlayerSwimAnimateFlag FFFFF44C
    RAM_FallingFlag FFFFF44E
    RAM_StageClearFlag FFFFF44F
    RAM_InvincibilityFlag FFFFF450
    RAM_EmeraldAppearsFlag FFFFF451
    RAM_PaletteCopy FFFFF780
    RAM_PaletteCopyLine1 FFFFF784
    Nem_code_table FFFFF880
    RAM_CurrentHighScore FFFFFF04
    RAM_SoundTest_CurrentDifficulty FFFFFF0D
    RAM_CurrentControlSetting FFFFFF0E
    RAM_CurrentDifficulty FFFFFF0F
    RAM_CurrentStageID FFFFFF42
    RAM_CurrentDemoNum FFFFFF48
    RAM_AddressTable FFFFFF60


    6.) Disassembly
    I started to label a disassembly of the game which you can download here. It's no where near complete, but I got a lot of the data down at least. It's the first one I made that's this involved, so excuse the bad mistakes I made. You can open the Ida Pro database in 6.1 or later.

Friends