It truly has been a long time since I used this particular feature, but anyways I felt like it may be time to write some of the things down I do just in case anybody is interested in them and for me to maybe revisit at a later point too.
So, recently I did several tests with different gameboy models because I was interested in how exactly their audio differs from each other and for that I chose the smurfs because it uses several interesting registers to do stereo effects as well as volume control, I may get to those tests in a future blog entry, I dont know yet
To focus a bit more on the smurfs, I was looking for some form of sound test because I wanted to also record most other tracks too because I think they are pretty good, but after searching on the internet there did not seem to be anything, in fact, I only found a whopping 2 passwords you can use in the options menu on the title screen to warp to act 5 (PBSP) and act 10 (ZRMS) - and that was it.
At that point I got curious if there truly was nothing else so I fired up the emulator bgb because of its very nice debugger features and started poking around, it just took me one look into the memory viewer to immediately see where the passwords were stored, its literally at the ROM start at hex D3 and D7:
So it was just a task of setting a breakpoint for it on read and I saw where it compared that data, which was right here when pressing start on the title screen:
As you can see, "de" gets loaded with D3 and D7 here, also "hl" gets loaded with D93A, that is the memory location of the password you enter in the options menu, 2941 is just comparing both strings, and if they were true it loads "c" with either hex 28 (stage 5) or hex 58 (stage 10), if it did not match then it gets set to hex 0 (stage 1), "c" then gets moved to "a" and "b" gets loaded with hex FF, so far its all pretty simple and does not seem all that interesting...
However, the code right above this looks like this:
You might notice that right in the first line, it loads from D93A, which is our entered password, and then comparing it to some hardcoded hex value, it does so for the first 3 letters and then that last comparison is actually the index of the 4th letter instead of its displayed value, so to be a bit more specific, it compares the first 3 letters against hex 42 (B), hex 58 (X) and hex 4D (M) and makes sure the 4th letter is below index hex 13. If all of that is verified true, then it takes the index of the 4th letter and essentially multiplies it by 8 (stage numbers are multiplied by 8 for some reason), loading hex FE into "b" and jumping to the same location where the "regular" passwords also continue at, meaning this acts as a form of secret developer level select! Also I should note, the "b" value is different from this password so when you load a bonus stage, it returns to the main menu after the bonus is finished since it has no act it was loaded from.
So with all that explained, here is a list of valid level select passwords you can enter in the options menu:
BXMB - Act 1
BXMC - Act 2
BXMD - Act 3
BXMF - Act 4
BXMG - Act 4 Boss
BXMH - Act 5
BXMJ - Act 6
BXMK - Act 7
BXML - Act 8
BXMM - Act 9
BXMN - Act 9 Boss
BXMP - Act 10
BXMQ - Act 11
BXMR - Act 12
BXMS - Final Boss
BXMT - Final Boss Defeated + Ending
BXMV - Bonus Stage The Dam
BXMW - Bonus Stage The Mushrooms
BXMX - Bonus Stage The Bubbles
I dont think those were documented before so hey, I actually may have found something new
Oh, also because I already looked at the memory locations where the password was set I noticed some more interesting locations too, such as these:
D942 - sound effect to play next
D95A - music to play next (16 bit address)
D9AA - invincibility frames after hit (counting down on hit)
D9B5 - lives
D9B6 - health
D9CD - timer (uses 2 bytes for 0-9 each)
With those I made up a set of game genie codes just for the sake of having done gameboy cheats, never wrote my own ones before.
edit: My original set of codes were only for v1.0, that version boots up saying 1993 like this:
If you have that version then this original set of codes will work:
185-14E-4CA - disable sound effects
wish that one was an option ingame, its weird how you can disable music but not sound effects...
005-EBC-19E - infinite lives
006-D7A-19E - infinite health
C97-C3A-D5D - infinite time
186-B1A-6EA - phase through enemies
pretty generic ones I know, but hey, every game has cheats like these in some form right?
replace title music with:
1BA-85D-80A - act 1/act 11 music
21A-85D-80A - act 2 music
1EA-85D-80A - act 3 music
36A-85D-80A - act 4/act 12 music
24A-85D-80A - act 5 music
27A-85D-80A - act 6 music
2AA-85D-80A - act 7 music
2DA-85D-80A - act 8 music
30A-85D-80A - act 9 music
33A-85D-80A - act 10 music
39A-85D-80A - bonus music
42A-85D-80A - intro part 1/game over music
45A-85D-80A - intro part 2/boss defeated music
48A-85D-80A - boss music
4BA-85D-80A - final boss music
4EA-85D-80A - credits music
just for show, I understand how the music works in this game, and sadly I did not see any code resembling a sound test, so these just demonstrate how to for example swap music around.
if your game however is v1.1 indicated by it saying 1994 on boot like this:
then here are the adjusted codes for that:
185-4AE-4CA - disable sound effects
wish that one was an option ingame, its weird how you can disable music but not sound effects...
006-C1C-19E - infinite lives
007-E9A-19E - infinite health
C98-D5A-D5D - infinite time
187-C3A-6EA - phase through enemies
pretty generic ones I know, but hey, every game has cheats like these in some form right?
replace title music with:
1BA-49D-80A - act 1/act 11 music
21A-49D-80A - act 2 music
1EA-49D-80A - act 3 music
36A-49D-80A - act 4/act 12 music
24A-49D-80A - act 5 music
27A-49D-80A - act 6 music
2AA-49D-80A - act 7 music
2DA-49D-80A - act 8 music
30A-49D-80A - act 9 music
33A-49D-80A - act 10 music
39A-49D-80A - bonus music
42A-49D-80A - intro part 1/game over music
45A-49D-80A - intro part 2/boss defeated music
48A-49D-80A - boss music
4BA-49D-80A - final boss music
4EA-49D-80A - credits music
just for show, I understand how the music works in this game, and sadly I did not see any code resembling a sound test, so these just demonstrate how to for example swap music around.
If you actually read through all of this then thank you, maybe something like this was interesting to read, let me know
So, recently I did several tests with different gameboy models because I was interested in how exactly their audio differs from each other and for that I chose the smurfs because it uses several interesting registers to do stereo effects as well as volume control, I may get to those tests in a future blog entry, I dont know yet
To focus a bit more on the smurfs, I was looking for some form of sound test because I wanted to also record most other tracks too because I think they are pretty good, but after searching on the internet there did not seem to be anything, in fact, I only found a whopping 2 passwords you can use in the options menu on the title screen to warp to act 5 (PBSP) and act 10 (ZRMS) - and that was it.
At that point I got curious if there truly was nothing else so I fired up the emulator bgb because of its very nice debugger features and started poking around, it just took me one look into the memory viewer to immediately see where the passwords were stored, its literally at the ROM start at hex D3 and D7:
So it was just a task of setting a breakpoint for it on read and I saw where it compared that data, which was right here when pressing start on the title screen:
As you can see, "de" gets loaded with D3 and D7 here, also "hl" gets loaded with D93A, that is the memory location of the password you enter in the options menu, 2941 is just comparing both strings, and if they were true it loads "c" with either hex 28 (stage 5) or hex 58 (stage 10), if it did not match then it gets set to hex 0 (stage 1), "c" then gets moved to "a" and "b" gets loaded with hex FF, so far its all pretty simple and does not seem all that interesting...
However, the code right above this looks like this:
You might notice that right in the first line, it loads from D93A, which is our entered password, and then comparing it to some hardcoded hex value, it does so for the first 3 letters and then that last comparison is actually the index of the 4th letter instead of its displayed value, so to be a bit more specific, it compares the first 3 letters against hex 42 (B), hex 58 (X) and hex 4D (M) and makes sure the 4th letter is below index hex 13. If all of that is verified true, then it takes the index of the 4th letter and essentially multiplies it by 8 (stage numbers are multiplied by 8 for some reason), loading hex FE into "b" and jumping to the same location where the "regular" passwords also continue at, meaning this acts as a form of secret developer level select! Also I should note, the "b" value is different from this password so when you load a bonus stage, it returns to the main menu after the bonus is finished since it has no act it was loaded from.
So with all that explained, here is a list of valid level select passwords you can enter in the options menu:
BXMB - Act 1
BXMC - Act 2
BXMD - Act 3
BXMF - Act 4
BXMG - Act 4 Boss
BXMH - Act 5
BXMJ - Act 6
BXMK - Act 7
BXML - Act 8
BXMM - Act 9
BXMN - Act 9 Boss
BXMP - Act 10
BXMQ - Act 11
BXMR - Act 12
BXMS - Final Boss
BXMT - Final Boss Defeated + Ending
BXMV - Bonus Stage The Dam
BXMW - Bonus Stage The Mushrooms
BXMX - Bonus Stage The Bubbles
I dont think those were documented before so hey, I actually may have found something new
Oh, also because I already looked at the memory locations where the password was set I noticed some more interesting locations too, such as these:
D942 - sound effect to play next
D95A - music to play next (16 bit address)
D9AA - invincibility frames after hit (counting down on hit)
D9B5 - lives
D9B6 - health
D9CD - timer (uses 2 bytes for 0-9 each)
With those I made up a set of game genie codes just for the sake of having done gameboy cheats, never wrote my own ones before.
edit: My original set of codes were only for v1.0, that version boots up saying 1993 like this:
185-14E-4CA - disable sound effects
wish that one was an option ingame, its weird how you can disable music but not sound effects...
005-EBC-19E - infinite lives
006-D7A-19E - infinite health
C97-C3A-D5D - infinite time
186-B1A-6EA - phase through enemies
pretty generic ones I know, but hey, every game has cheats like these in some form right?
replace title music with:
1BA-85D-80A - act 1/act 11 music
21A-85D-80A - act 2 music
1EA-85D-80A - act 3 music
36A-85D-80A - act 4/act 12 music
24A-85D-80A - act 5 music
27A-85D-80A - act 6 music
2AA-85D-80A - act 7 music
2DA-85D-80A - act 8 music
30A-85D-80A - act 9 music
33A-85D-80A - act 10 music
39A-85D-80A - bonus music
42A-85D-80A - intro part 1/game over music
45A-85D-80A - intro part 2/boss defeated music
48A-85D-80A - boss music
4BA-85D-80A - final boss music
4EA-85D-80A - credits music
just for show, I understand how the music works in this game, and sadly I did not see any code resembling a sound test, so these just demonstrate how to for example swap music around.
if your game however is v1.1 indicated by it saying 1994 on boot like this:
185-4AE-4CA - disable sound effects
wish that one was an option ingame, its weird how you can disable music but not sound effects...
006-C1C-19E - infinite lives
007-E9A-19E - infinite health
C98-D5A-D5D - infinite time
187-C3A-6EA - phase through enemies
pretty generic ones I know, but hey, every game has cheats like these in some form right?
replace title music with:
1BA-49D-80A - act 1/act 11 music
21A-49D-80A - act 2 music
1EA-49D-80A - act 3 music
36A-49D-80A - act 4/act 12 music
24A-49D-80A - act 5 music
27A-49D-80A - act 6 music
2AA-49D-80A - act 7 music
2DA-49D-80A - act 8 music
30A-49D-80A - act 9 music
33A-49D-80A - act 10 music
39A-49D-80A - bonus music
42A-49D-80A - intro part 1/game over music
45A-49D-80A - intro part 2/boss defeated music
48A-49D-80A - boss music
4BA-49D-80A - final boss music
4EA-49D-80A - credits music
just for show, I understand how the music works in this game, and sadly I did not see any code resembling a sound test, so these just demonstrate how to for example swap music around.
If you actually read through all of this then thank you, maybe something like this was interesting to read, let me know
