don't click here

How to add FFFFxx hex hacks into roms?

Discussion in 'General Sega Discussion' started by MarzSyndrome, Nov 8, 2008.

  1. MarzSyndrome

    MarzSyndrome

    Everything is going to the beat. Member
    I should point out that I have knowledge of implementing Action Replay/Game Genie hacks permanently into rom images by hex-editing the appropriate sections.


    So I was interested in trying to use this knowledge to implement the Japanese Credits cheat into Sonic 1 by default, and got an address from this thread, but it seems that goes way beyond the size of the rom itself. Searching around seems to associate FFFFxx addresses heavily with savestates. So can such codes only be hacked into savestates? I tried calculating an alternative address with the tip from this page, but to no avail.


    Thanks for reading.
     
  2. Tweaker

    Tweaker

    Banned
    12,387
    2
    0
    FFxxxx patch codes work by editing RAM, not ROM. It isn't possible to apply any changes that occur by editing the RAM outside of hooking certain routines where you want and adding some machine code to edit certain RAM values. ROM-based patch codes, however (xxxxxx codes) can be applied permanently by simply editing the relevant offset inside the ROM.
     
  3. MathUser

    MathUser

    3rd top wiki contributor Researcher
    2,151
    8
    18
    Yeah, to be able to convert RAM addresses/PAR codes to ROM addresses would require a debugger with breakpoints I think. And I don't know if any have ever been released yet.
     
  4. Correct.
     
  5. MarzSyndrome

    MarzSyndrome

    Everything is going to the beat. Member
    Ahhh, so I see - kinda thought it was strictly a RAM issue but needed detailed clarification. Cheers.

    So there's pretty much no way to get the Japanese credits to appear upon bootup like with the Level Select and Debug Mode without, indeed, having to use a breakpoint-supporting debugger program?

    Although I'm puzzled that two different codes for the Level Select seemingly exist - one for ROM (AJ3A-AA4G) and another for RAM (FFFFE0:0001).
     
  6. Well, the Game Genie and Pro Action Replay were two separate devices that were sold separately. It's easy to decrypt the GG code to hex and edit that in.
     
  7. FraGag

    FraGag

    Tech Member
    That's silly. All you have to do is add or change a line that will set the flag in the code where it's cleared. If it's cleared in a loop, you'll have to add a line after the loop; if it's cleared separately, you'll have to change the line to set the flag instead of clearing it.
     
  8. MarzSyndrome

    MarzSyndrome

    Everything is going to the beat. Member
    No, I mean it is seemingly possible to unlock the Level Select either through ROM or RAM - I know how to decode GG codes into PAR/hex code.

    Hmmm, I don't think I'm that knowledgeable in working out what flags are related to what in the game. Unless you mean use any debugger tool, and just keep an eye on what changes in the code after unlocking Japanese credits?
     
  9. FraGag

    FraGag

    Tech Member
    You could simply use an existing disassembly of Sonic 1 (available on the wiki here: Disassemblies) and search for "Japanese Credits".
     
  10. A lot of things can be done either through ROM or RAM, but the method to make them happen usually differs vastly between the two. As an example, I'll take one of the most famous GG codes, ACLA-ATD4, which is the code for accessing HPZ. Off the top of my head, that translates to 00947A:0800, and what it does is changes the level select entry pointer for Death Egg Zone to point to Hidden Palace Zone instead. If you wanted to access HPZ through RAM, you could instead use FFFE10:0800, which directly changes the level number flag in RAM to point to HPZ. The end result is obviously the same, you end up in HPZ, but the way in which that result is achieved is quite different.
     
  11. Tom41

    Tom41

    Pheer the baby EggRobo! Oldbie
    291
    0
    0
    UK
    Both the Game Genie and Action Replay work by intercepting ROM reads, in effect changing some of the data that's going from the cartridge to the MD console. The Game Genie simply does ROM patch codes, but the Action Replay must do something like hooking the VSync routine or other code in the ROM. AR works on any cartridge game, so modifying the RAM constantly isn't game-dependent.

    Sadly, I don't know any more about the internal workings of the AR to know how it works, or how it can still run the game as normal while there's effectively an extra ROM in the way.