Action replay codes for nightmare difficulty in Saturn Doom

[fafling]

It doesn't appear to have been found already. There was a report recently on Kronos Discord by user WhiteySnakey that the nightmare difficulty could be unlocked in the PSX version of Doom, and he thought that since the Saturn version shares some similarities with the PSX one, that difficulty level could also be hidden inside.

So I gave it a shot with Kronos Cheat search feature, and got lucky. Here are the Action replay codes to unlock the nightmare difficulty level in all 3 regions of Saturn Doom :

• The master code is the same for the 3 regions, it's the default one on my Action replay plus :
  F6000914 C305
  B6002800 0000
• US version cheat code :
  1604A2AA 0004
  16065618 0063
  16028868 007C
  1602886A E162
  1602886C 2310
• Japanese version cheat code :
  1604A306 0004
  16065674 0063
  160288D4 007C
  160288D6 E162
  160288D8 2310
• European version cheat code :
  1604A166 0004
  160654CC 0063
  160287E4 007C
  160287E6 E162
  160287E8 2310

Enabling this cheat locks the difficulty option in nightmare mode (that's the effect of the 1st line of the code).
Here is how the main menu looks in the European version with the cheat enabled :

The name of the difficulty is no longer displayed. This isn't because it's too frightening that It-Must-Not-Be-Named . In fact, the string that happens to be in memory where the "Nightmare" string should be is "bcdfghjklmnpqrstvwxyz0123456789!". It is used for the password display.
The 2nd line of the code serves to insert a terminal 0 at the beginning of that string, instead of character "b", to interrupt it. Without that terminal 0, the string is too long and crashes the game at the main menu.

The 3 last lines of the code patch the password display routine to put that character "b" temporarily in place just before it may be accessed. The choice of the 1st character of that string to be replaced by the terminal zero is dictated by the size constraint of the patch : it would require at least one more code than what could be inserted to put back another letter than the 1st.

In game, monster placement is the same as in Ultra Violence, but they move faster, shoot at a faster rate and their projectiles move faster. Contrary to the PC version, monsters don't respawn (thankfully, it's hard enough).

I don't know if the game can be completed in that mode, I've only been through 4 levels before I got toasted.

Also note that when continuing a game with a password without the cheat, the difficulty is set by the password, however a password obtained with the cheat enabled and input with the cheat disabled will set the difficulty as "I am a wimp". So a password obtained in the nightmare difficulty must be input with the cheat enabled in order to continue the game with the same difficulty, and that only works when the password is launched from the main menu. When launched from the pause menu, the difficulty is set as if the cheat was disabled (so "I am a wimp" for a password obtained in nightmare). And a password obtained in an easier difficulty can be used with the cheat enabled to continue the game in nightmare mode if launched from the main menu.

The cheat codes work in Kronos emulator without needing the master code. They should be input after the Sega logo, in Tools > Cheat Lists.

A tutorial on how to use the Cheat search in Kronos, made by @Benjamin Siskoo :


An Action replay code is obtained from the address found in Kronos Cheat search that way :

• The 1st part of the code is the hexadecimal memory address found in Kronos for a 16 bit value, with the initial 0 of the address replaced by 1.
• The 2nd part is the hexadecimal 16 bit value to be set at that memory address.

 

[fafling]

Modified OP to add a patch to prevent the password being incompletely displayed if it contains the replaced letter.

The nitty-gritty details of the patch of the password display routine :

060288D4 : 017C : mov.b @(r0, r7), r1 => 007C : mov.b @r7, r0 ; The password letter index can be loaded directly in r0 without doing extu.b because its value is positive and lower than 32 so its MSB is always 0 and mov.b already extends like extu.b. Makes the 2 following instructions useless so they can be used to put back the letter.
060288D6 : 611C : extu.b r1, r1 => E162 : mov #0x62 r1 ; Loads the original letter code.
060288D8 : 6013 : mov r1, r0 => 2310 : mov.b r1, @r3 ; r3 contains the address of the string "bcdfghjklmnpqrstvwxyz0123456789!". 0 will be inserted back automatically by the 1st Action replay code, which thankfully doesn't run simultaneously, before returning to the main menu.

Thanks to @XProger for reporting of the extu optimization in SegaXtreme Discord.