don't click here

AAAHH!!! Real Monsters! Genesis Hacking

Discussion in 'Technical Discussion' started by Ravenfreak, Apr 17, 2012.

  1. Ravenfreak

    Ravenfreak

    2 Edgy 4 U Tech Member
    3,077
    176
    43
    O'Fallon Mo
    Sonic 1 Game Gear Disassembly
    I got the urge to dig into one of my favorite games of all time, AAAHH!!! Real Monsters! Bellow are my notes, not much now but I've discovered something new about the game. ^_^ Anyway my notes are composed of a few RAM addresses, ASCII text within the ROM, and each screen id. Here they are:
    Code (Text):
    1. Winner and Diploma ASCII Text: $27Ad9
    2. $27BEB- Hidden screen text
    3. RAM info. Not much here yet but it's something.
    4. $B781- Unknown, setting it to 0E loads a glitchy HUD and the first level's music plays
    5. $B78C- set this to be invincible (byte of course)
    6. $B78D- Heart counter (byte)
    7. $B99A- Horizontal camera scroll (Word) setting this will automatically make the camera scroll, even if you're not moving
    8. The game consists of 44 different screens, holy shit! Anyway here they are listed bellow. Though I am not sure
    9. what the screen mode RAM offset is located at, though I'll look into this more later. Note: Assignment 2 is unused,
    10. because the boss fight is a different level all together. However, I have no clue why the programmers did this, would have
    11. been more creative if they used the title card (that's what each Assignment screen is).
    12. Level: 01   . Viacom      
    13. Level: 02   . Title      
    14. Level: 03   . Nickelodeon      
    15. Level: 04   . Dump 1          
    16. Level: 05   . Dump 2          
    17. Level: 06   . Dump 3          
    18. Level: 07   . Dump 4          
    19. Level: 08   . Dump 5          
    20. Level: 09   . Dump 6          
    21. Level: 10   . Dump 7          
    22. Level: 11   . Post Office 1    
    23. Level: 12   . Post Office 2    
    24. Level: 13   . Post Office 3    
    25. Level: 14   . Mall 1          
    26. Level: 15   . Continue        
    27. Level: 16   . Hunter 1        
    28. Level: 17   . Hunter 2        
    29. Level: 18   . Dino 1          
    30. Level: 19   . Dino 2          
    31. Level: 20   . Gym 1            
    32. Level: 21   . School 1        
    33. Level: 22   . Options          
    34. Level: 23   . Score            
    35. Level: 24   . Legal Screen    
    36. Level: 25   . Googleplex      
    37. Level: 26   . Dump Bonus 1    
    38. Level: 27   . Assignment 1    
    39. Level: 28   . Assignment 2
    40. Level: 29   . Assignment 3    
    41. Level: 30   . Assignment 4    
    42. Level: 31   . Assignment 5    
    43. Level: 32   . Post Boss
    44. Level: 33   . Diploma          
    45. Level: 34   . Win              
    46. Level: 35   . Credits          
    47. Level: 36   . Intro Bed        
    48. Level: 37   . Intro Hall      
    49. Level: 38   . Game Over        
    50. Level: 39   . Sega License    
    51. Level: 40   . Assignment 1f    
    52. Level: 41   . Assignment 2f    
    53. Level: 42   . Assignment 3f    
    54. Level: 43   . Assignment 4f    
    55. Level: 44   . Assignment 5f
    And if you skim over my notes, you've probably missed this tidbit. There's an unused screen that's programmed in but they decided not to use it. Usually on the final assignment screen of the last part of any level, the Gromble tells you what you need to find as well as who you need to scare. In the post office level, for some reason they decided to not describe who you're supposed to scare, instead it shows you what you need to find and you fight the boss of that level in a completely different level. (Usually you fight the boss within the same level, yet they have a transition from Post office 3 to Post Boss.) This is the unused screen:
    [​IMG]
     
  2. Shoemanbundy

    Shoemanbundy

    Researcher
    1,094
    30
    28
    Chicago, Illinois
    selling shoes
    Thought I was one of the only people to have a soft spot for this game :) Cool find, I need to find more games to look for level ram values again, had fun doing that with games trying to find unused areas or screens :)
     
  3. Andlabs

    Andlabs

    「いっきまーす」 Wiki Sysop
    2,175
    1
    0
    Writing my own MD/Genesis sound driver :D
    There's been a lot of work done already on this game over at TCRF; why not add to it? Everything you've found so far is new anyway, and that's only a good thing =P
     
  4. Ravenfreak

    Ravenfreak

    2 Edgy 4 U Tech Member
    3,077
    176
    43
    O'Fallon Mo
    Sonic 1 Game Gear Disassembly
    So I found some more stuff inside the ROM. Here are my new findings, and I'll probably edit this post just in case I miss something (because my notes are a huge jumbled mess right now, especially since I've been converting some subroutines from Hex to asm from hand. :v:) First I'll start with my RAM addresses, then some important subroutines. I labeled these as important because some people who would want to hack this game can start from there. Also the RAM addresses are in no particular order, because I simply just jotted them down as I found them. :v: Anyway here's my new findings, enjoy. :) (Also andlabs, I posted this over at tcrf and yes I'm Raven over at jul if you didn't read my intro topic. xP)
    RAM addresses:
    Code (Text):
    1. $FFFFE7E6- Setting this makes the garbage get thrown upwards (so I'm guessing the game checks to see if up and b was pressed
    2. then it sets this)
    3. $FFFFE836- Garbage thrown flag? (at address $B5BE in the ROM the game checks to see if B was pressed, and branches to the
    4. appropriate routine. Setting this will prevent the player from throwing garbage.)
    5. $FFFFE7F8- Dificulty flag (set to one to set it to Nightmare, the game is set to scary by default. However, when this is
    6. set, the difficulty text on the options screen is gone.) This is checked by the subroutine at ROM address $F70C. The routine
    7. right before it sets the life counter to 7, so if you wanted to change that value to anything it isn't difficult. Bellow are both subroutines converted from hex so it's easier to
    8. understand what's going on.
    9. $FFFFE776- Garbage counter
    10. $FFFFE774- Lives counter
    11. $FFFFE778- Book counter
    12. $FFFFE800- Player X coordinate update flag (used to update where the player should be after performing Ickis' special move, though its best not to edit this because it's very sensitive)
    13. $FFFFE784- debug flag (Set this during gameplay to enable the Monsters Options and debug cheat.)
    14. $FFE852-$FFE871- Button inputs are stored here for the Monsters Options cheat. Each are store as longword values. Bellow is the subroutine converted to asm so it's easier to understand.
    Okay onto some subroutines:
    $F702 in the ROM sets the life counter to 7. Right after that, the difficulty flag is checked, and the life counter is set
    to 3. Here's the asm code, so it's easier to understand:
    Code (ASM):
    1. move.w #7,($FFFFE774).w; set number of lives
    2. tst.w ($FFFFE7F8).w; check to see if the difficulty flag was set
    3. beq.s $06; if it wasn't branch since we don't want to set the lives to 3
    4. move.w #3,($FFFFE774).w; otherwise set the life counter to 3
    This subroutine caps the book counter and it's located at ROM address $1A478:
    Code (ASM):
    1.  
    2. cmpi.w  #9, ($FFFFE778).w; does the player have 9 books?
    3. beq.s   $06; if not, branch
    $197C6 contains the routine to cap the garbage counter. Have some more code:
    Code (ASM):
    1.  
    2. cmpi.w  #$64, ($FFFFE778).w; is the garbage counter at 100?
    3. blt.s   $08; if it's less than 100 branch
    4. move.w  #$63, ($FFFFE778).w; cap the counter at 99
    Here's the monsters options button check routine, but I converted this kind of fast so the branches might be off a bit... plus I actually converted the branches to ROM offsets. :v:
    Code (ASM):
    1.  
    2. cmpi.l   $10404040,($FFFFE852).w
    3. beq.s    $33C7; if there was no input or was incorrect, branch
    4. cmpi.l   $10404040,($FFFFE856).w
    5. bne.s    $3431
    6. cmpi.l   $10404040,($FFFFE85A).w
    7. bne.s    $3431
    8. cmpi.l   $10404040,($FFFFE85E).w; was BAAA pressed?
    9. bne.s    $3431; if so, branch
    10. cmpi.l   $40404020,($FFFFE862).w; was AAAC pressed?
    11. bne.s    $3431; if so, branch
    12. cmpi.l   $10404040,($FFFFE866).w; was BAAA pressed?
    13. bne.s    $3431; if so, branch
    14. cmpi.l   $10404040,($FFFFE86A).w; was BAAA pressed again? Note: Both the debug cheat and hidden screen cheat uses this RAM address
    15. bne.s    $3431; if so, branch
    16. cmpi.l   $10404040,($FFFFE86E).w; was BAAA pressed yet again? Note: the hidden screen cheat uses this address as well
    17. bne.s    $3431; if so, branch
    18. cmpi.l   $20202040,($FFFFE871).w; was CCCA pressed?
    19. jmp      $343E; if so, we need to set the debug flag
    Button values are exactly the same from the Sonic games (of course it's still a Mega Drive/Genesis game, so it uses these global values. xP) so if you wanted to change these it wouldn't be difficult. Anyway those are my findings as of today.
     
  5. Ravenfreak

    Ravenfreak

    2 Edgy 4 U Tech Member
    3,077
    176
    43
    O'Fallon Mo
    Sonic 1 Game Gear Disassembly
    Sorry for the double post, but since I am documenting all this stuff I decided it was time to actually make a hack. Also one thing I forgot to note (and many of you Techies probably knew this) but in order to actually change any of the button presses for the Monsters Options cheat you need to add padding, otherwise the ROM will break. :v: Here's my ROM hack, it aims to make the game a bit more difficult. You start with 3 lives on Scary, 1 on Nightmare. And all those button presses are a thing of the past, cause now you only need to pause the game, press B 9x, unpause the game, press A and then pause the game again. (Eh maybe the same amount of effort, but pressing all those buttons is a pain in the ass IMO...)
    http://www.mediafire.com/?uyuzfra8ce833a8
    I know it's not much, but meh. Oh and I found 2 more RAM addresses. Here they are:
    $FFFFE83A- Right boundary screen lock. Used during boss fights. (byte)
    $FFFFB818- Screen shaking flag. If you are sensitive to this kind of stuff, I suggest you don't set this flag because the screen shakes violently. (word)