Sonic 3 (Nov 3, 1993 prototype) - Technical Analysis & Research thread

Discussion in 'Engineering & Reverse Engineering' started by JoseTB, Nov 18, 2019.

  1. JoseTB


    Tech Member
    There have been a couple references to this, but just in case it flies under the radar: you can access Sonic 2's options screen via the PAR code 00039A:0024

    Player select and sound test work (in fact this seems to be the only way to play as Tails alone without hacking it directly), but selecting 2P stages takes you back to the SEGA screen. No sound plays in the background, so the data select song remains unused.


    • Informative Informative x 5
    • List
  2. Prototype


    I'm not sure where I should post this now, but I feel it's more technical than endless MJ discussion, so here.

    When trying to force load an unfinished level slot, you tend to get garbage data for the BG but with visible repeating chunks with associated collision data, indicating that it could be loading some kind of dummy test level collision data.

    Placing the weird Scaling Sprite object in AIZ also seemingly causes AIZ's collision data to change to this same set. The BG naturally goes all buggy, but I did notice that the repeating chunks ended up appearing semi-legibly for once suggesting that these repeating platform chunks were intended to use Tree Trunk and floor BG pieces. Collision works as you'd expect.

    Can't tell through the buggy mess whether the item layouts are intended to appear that way, but there are other object pieces that work.

    Attached Files:

    • Informative Informative x 1
    • List
  3. SyntaxTsu


    Is there any evidence of the ICZ side of the CNZ-ICZ teleporter?
    By this point in time, FBZ was either just moved or was in the last few days before being moved, so if the ICZ side of the CNZ-ICZ teleporter exists, it'd seem to increase the likelihood that Knuckles was never meant to go through that zone.
  4. muteKi


    Fuck it Member
    The teleporter isn't there, but the room is. All signs (including the lack of any truly Knuckles-exclusive area, the only zone to lack any of all ones he has access to) point to it not being a level he was expected to enter.
  5. SyntaxTsu


    I'm thinking more along the line of leftover graphics, but that's still good info to keep around.
  6. Dark Sonic

    Dark Sonic

    Working on my art!
    It's also the zone notorious for having the wrong sprites for the Act 2 boss for Knuckles, using Robotnik instead of the Eggrobo. Plot wise FBZ doesn't make sense for Knuckles anyway, it most likely crashed after Sonic and Tails got through the level.

    But a barely 4 level campaign for Knuckles would have been rather weak for a game called "Sonic & Knuckles" so fuck it, FBZ for Knuckles it is :V
  7. SGR


    Give me the gams. Member
    I am glad you brought up the weird scaling sprite object. I have been trying to investigate it but I haven't gotten very far. I'm by no means any good at 68k ASM, but it's code is located at 0x01AA34 in the ROM:

    Code (Text):
    2. ROM:0001AA34 ; ---------------------------------------------------------------------------
    3. ROM:0001AA34                 moveq   #0,d0
    4. ROM:0001AA36                 move.b  5(a0),d0
    5. ROM:0001AA3A                 move.w  loc_1AA42(pc,d0.w),d1
    6. ROM:0001AA3E                 jmp     loc_1AA42(pc,d1.w)
    7. ROM:0001AA42 ; ---------------------------------------------------------------------------
    8. ROM:0001AA42
    9. ROM:0001AA42 loc_1AA42:                              ; CODE XREF: ROM:0001AA3Ej
    10. ROM:0001AA42                                         ; DATA XREF: ROM:0001AA3Ar
    11. ROM:0001AA42                 ori.b   #$48,d4 ; 'H'
    12. ROM:0001AA46                 addq.b  #2,5(a0)
    13. ROM:0001AA4A                 move.w  $10(a0),$34(a0)
    14. ROM:0001AA50                 move.w  $14(a0),$36(a0)
    15. ROM:0001AA56                 move.l  #unk_1B1B8,$C(a0)
    16. ROM:0001AA5E                 move.w  #$6500,$A(a0)
    17. ROM:0001AA64                 move.b  #4,4(a0)
    18. ROM:0001AA6A                 move.w  #$200,8(a0)
    19. ROM:0001AA70                 move.b  #$40,7(a0) ; '@'
    20. ROM:0001AA76                 move.b  #$40,6(a0) ; '@'
    21. ROM:0001AA7C                 move.b  #4,$40(a0)
    22. ROM:0001AA82                 move.l  #$FFFE0000,$42(a0)
    23. ROM:0001AA8A                 tst.w   $32(a0)
    24. ROM:0001AA8E                 beq.s   loc_1AA96
    25. ROM:0001AA90                 subq.w  #1,$32(a0)
    26. ROM:0001AA94                 bra.s   loc_1AADA
    27. ROM:0001AA96 ; ---------------------------------------------------------------------------
    28. ROM:0001AA96
    29. ROM:0001AA96 loc_1AA96:                              ; CODE XREF: ROM:0001AA8Ej
    30. ROM:0001AA96                 tst.b   $30(a0)
    31. ROM:0001AA9A                 bne.s   loc_1AAB0
    32. ROM:0001AA9C                 addq.b  #1,$40(a0)
    33. ROM:0001AAA0                 cmpi.b  #$80,$40(a0)
    34. ROM:0001AAA6                 bne.s   loc_1AADA
    35. ROM:0001AAA8                 move.b  #1,$30(a0)
    36. ROM:0001AAAE                 bra.s   loc_1AADA
    37. ROM:0001AAB0 ; ---------------------------------------------------------------------------
    38. ROM:0001AAB0
    39. ROM:0001AAB0 loc_1AAB0:                              ; CODE XREF: ROM:0001AA9Aj
    40. ROM:0001AAB0                 subq.b  #1,$40(a0)
    41. ROM:0001AAB4                 bcc.s   loc_1AADA
    42. ROM:0001AAB6                 move.b  #0,$40(a0)
    43. ROM:0001AABC                 move.b  #0,$30(a0)
    44. ROM:0001AAC2                 move.w  #$3C,$32(a0) ; '<'
    45. ROM:0001AAC8                 move.b  $20(a0),d0
    46. ROM:0001AACC                 addq.b  #1,d0
    47. ROM:0001AACE                 cmpi.b  #5,d0
    48. ROM:0001AAD2                 bcs.s   loc_1AAD6
    49. ROM:0001AAD4                 moveq   #0,d0
    50. ROM:0001AAD6
    51. ROM:0001AAD6 loc_1AAD6:                              ; CODE XREF: ROM:0001AAD2j
    52. ROM:0001AAD6                 move.b  d0,$20(a0)
    53. ROM:0001AADA
    54. ROM:0001AADA loc_1AADA:                              ; CODE XREF: ROM:0001AA94j
    55. ROM:0001AADA                                         ; ROM:0001AAA6j ...
    56. ROM:0001AADA                 move.w  $34(a0),d2
    57. ROM:0001AADE                 move.w  $36(a0),d3
    58. ROM:0001AAE2                 moveq   #0,d0
    59. ROM:0001AAE4                 move.b  $40(a0),d0
    60. ROM:0001AAE8                 addq.w  #4,d0
    61. ROM:0001AAEA                 move.l  #$100,d4
    62. ROM:0001AAF0                 divu.w  d0,d4
    63. ROM:0001AAF2                 sub.w   d4,d2
    64. ROM:0001AAF4                 sub.w   d4,d3
    65. ROM:0001AAF6                 move.w  d2,$10(a0)
    66. ROM:0001AAFA                 move.w  d3,$14(a0)
    67. ROM:0001AAFE                 clr.w   ($FFFFF740).w
    68. ROM:0001AB02                 tst.w   $32(a0)
    69. ROM:0001AB06                 bne.s   loc_1AB32
    70. ROM:0001AB08                 move.l  a0,-(sp)
    71. ROM:0001AB0A                 bsr.w   sub_1AB3C
    72. ROM:0001AB0E                 movea.l (sp)+,a0
    73. ROM:0001AB10                 move.l  a0,-(sp)
    74. ROM:0001AB12                 move.w  #$6500,d0
    75. ROM:0001AB16                 bsr.w   sub_1ABE2
    76. ROM:0001AB1A                 movea.l (sp)+,a0
    77. ROM:0001AB1C                 move.w  ($FFFFF740).w,d3
    78. ROM:0001AB20                 lsl.w   #4,d3
    79. ROM:0001AB22                 move.l  #$FFFE8000,d1
    80. ROM:0001AB28                 move.w  #$A000,d2
    81. ROM:0001AB2C                 jsr     (sub_12FC).l
    82. ROM:0001AB32
    83. ROM:0001AB32 loc_1AB32:                              ; CODE XREF: ROM:0001AB06j
    84. ROM:0001AB32                 move.w  $34(a0),d0
    85. ROM:0001AB36                 jmp     loc_11B1A
    86. ROM:0001AB3C
    87. ROM:0001AB3C ; =============== S U B R O U T I N E =======================================
    88. ROM:0001AB3C
    89. ROM:0001AB3C
    90. ROM:0001AB3C sub_1AB3C:                              ; CODE XREF: ROM:0001AB0Ap
    91. ROM:0001AB3C                 moveq   #0,d1
    92. ROM:0001AB3E                 move.w  d1,($FFFFF740).w
    93. ROM:0001AB42                 movea.w d1,a0
    94. ROM:0001AB44                 movea.w d1,a1
    95. ROM:0001AB46                 movea.w d1,a2
    96. ROM:0001AB48                 movea.w d1,a3
    97. ROM:0001AB4A                 movea.w d1,a4
    98. ROM:0001AB4C                 movea.w d1,a5
    99. ROM:0001AB4E                 lea     ($FFFEA000).l,a6
    100. ROM:0001AB54                 tst.b   ($FFFFF742).w
    101. ROM:0001AB58                 beq.s   loc_1AB60
    102. ROM:0001AB5A                 lea     ($FFFEA000).l,a6
    103. ROM:0001AB60
    104. ROM:0001AB60 loc_1AB60:                              ; CODE XREF: sub_1AB3C+1Cj
    105. ROM:0001AB60                 move.w  #$1F,d1
    106. ROM:0001AB64
    107. ROM:0001AB64 loc_1AB64:                              ; CODE XREF: sub_1AB3C+54j
    108. ROM:0001AB64                 movem.l a0-a5,-(a6)
    109. ROM:0001AB68                 movem.l a0-a5,-(a6)
    110. ROM:0001AB6C                 movem.l a0-a5,-(a6)
    111. ROM:0001AB70                 movem.l a0-a5,-(a6)
    112. ROM:0001AB74                 movem.l a0-a5,-(a6)
    113. ROM:0001AB78                 movem.l a0-a5,-(a6)
    114. ROM:0001AB7C                 movem.l a0-a5,-(a6)
    115. ROM:0001AB80                 movem.l a0-a5,-(a6)
    116. ROM:0001AB84                 movem.l a0-a5,-(a6)
    117. ROM:0001AB88                 movem.l a0-a5,-(a6)
    118. ROM:0001AB8C                 movem.l a0-a3,-(a6)
    119. ROM:0001AB90                 dbf     d1,loc_1AB64
    120. ROM:0001AB94                 tst.b   ($FFFFF742).w
    121. ROM:0001AB98                 beq.s   locret_1ABA0
    122. ROM:0001AB9A                 move.w  #$100,($FFFFF740).w
    123. ROM:0001ABA0
    124. ROM:0001ABA0 locret_1ABA0:                           ; CODE XREF: sub_1AB3C+5Cj
    125. ROM:0001ABA0                 rts
    126. ROM:0001ABA0 ; End of function sub_1AB3C
    127. ROM:0001ABA0
    128. ROM:0001ABA0 ; ---------------------------------------------------------------------------
    All I know about it is that it reserves a portion of VRAM starting at 0xA000 to 0xC000 (I think) and writes to that particular portion. I also think the Object ID is $80, not 100% positive. What is $80 in the final? What I want to know most is, though, where on earth is the art for it?
  8. Fred


    Taking a break Oldbie
    Sonic 3 Unlocked
    There is no art for it, it tries to get its art from the start of RAM. It's a test object like the sphere test, so I wouldn't be surprised if at one point it also had its own game mode which loaded some art to RAM.
    • Informative Informative x 1
    • List
  9. InvisibleUp


    friendly internet ghost Member
    First off the ori instruction at $1AA42 is actually two words used as a jump table for the object's two routines. The initialization routine is at $1AA42 + $04 = $1AA46 which leads into the main routine at $1AA42 + $48 = $1AA8A

    The init routine just sets some variables in the object's RAM, using the offsets from

    sub_12FC seems to be the bit that draws the object, or at least does something with the DMA queue. loc_11B1A seems to be related to graphics as well, although it's likely a shared routine. loc_0001ab3c might be a memory copy routine.

    Can't really give more pointers right this second because I don't have a whole lot labeled (and I don't have a copy of IDA Pro to check the other disasm out).

    Edit: formatting
  10. SGR


    Give me the gams. Member
    Crap. I was hoping there'd be something there. :(
  11. Fred


    Taking a break Oldbie
    Sonic 3 Unlocked
    The game mode might still be there! I'll definitely check as soon as I get the time.
  12. Black Squirrel

    Black Squirrel

    it's wiki to rock a rhyme Wiki Sysop
    Northumberland, UK
    to rock a rhyme that's right on time it's wiki
    I've noticed the "drop dash" doesn't work on bridges (or indeed any objects, but the bridges in IceCap Zone are the most obvious). It seems a stretch to say this alone caused them to invent the insta-shield but it could have been a contributing factor.
  13. Black Squirrel

    Black Squirrel

    it's wiki to rock a rhyme Wiki Sysop
    Northumberland, UK
    to rock a rhyme that's right on time it's wiki


    You can trigger the Launch Base Zone Act 1 boss. You just need to move Tails to the right when the screen locks. And if you die during the battle it breaks again.

    When you beat it, Act 2 loads (which is more than can be said for most of the other stages). But it's a horrible glitched mess and you're sent zooming off to the right to where Knuckles is, and promptly die.
    • Like Like x 1
    • Informative Informative x 1
    • List
  14. kazblox


    Diassemblies and decompilations.
    dead code.png
    Dead code starting at $EF1DD. Offsets are all zeroed out, and I had to separate it from the ROM because it's located off by one. It spans for a while; currently investigating.
    • Informative Informative x 2
    • List
  15. SyntaxTsu


    Yup, saw that happen on stream. I wonder why LBZ has its level transition to Act 2, whilst the other three stages which work like it does in Sonic 3 don’t have them? Perhaps they were testing it on the one stage first...

    Also, I wonder if there are any remnants of the scrapped miniboss gimmick in the final... outside of the bottom chunk that was used, that is.
  16. Ralakimus


    pretty much a dead account Tech Member
    Yeah, the code that activates the spindash as Sonic touches the floor is only handled for level terrain, and not in any solid object routine.
    • Informative Informative x 1
    • List
  17. evilhamwizard


    I believe this might be leftover compiled code from Star Trek. It's in a very odd spot since this data is right in the middle of the Z80 stuff for Sonic 3.
  18. kazblox


    Diassemblies and decompilations.
    The dead code in full. As I guessed in my head, and as you guessed as well, it's from Star Trek - The Next Generation. Matches up with the unassembled source leftovers.
    Last edited: Nov 20, 2019
    • Informative Informative x 1
    • List
  19. JcFerggy


    Do you want to taco 'bout it? Member
    Nova Scotia, Canada
    GoldenEye: Source, Other Stuff
    Not sure if this is the correct thread to ask this, but anyway;

    From my limited understanding, the Proto music compositions are slightly different than the PC music, right? Would it be possible to use either the FM or Midi PC tracks, and make a psudo-final versions of these tracks? Like comparing other tracks in the proto that are in the final, some are different in varying degrees, so its to believed that these could be unfinished as well, right?

    I suppose without getting our hands on a later build, it's all fan fiction in the end..., but it's an interesting thought.
  20. Prototype


    So would the odd level terrain spawned glitchily by placing the Scaling Sprite Object be an intended function? Or is it a side effect of the object calling for now-missing data and calling up some other level routine by mistake? Or heck, is it calling on any weird Star Trek data routines?

    All I know is that it's the same level terrain you get when you access a nonexistent level slot, and when triggered in AIZ with the Scaling Sprite it is the only place where those level structures gain any sort of credible artwork assigned in a way that fits.