Landstalker: 11EA7-84E71
Shining Force: 02C02-04E71
Phantasy Star 4: 00040-66006
Don't be too surprised if the Shining Force and PS4 codes don't work. In particular, PS4 might pop up the Red Screen of Death. I couldn't find PAL dumps of those so I used the US (actually, the PS4 one may or may not be the US version, but it is NTSC and English) ones, hoping that the boot code is the same except for the compared value (this was true for Landstalker at least, so there is some hope).
As for how I do it, using Shining Force as an example:
First, find a ROM image of the game to patch. Then use a tool like GROM (a genesis ROM image manipulation tool by Bart Trzynadlowski) to convert the ROM to raw binary (.bin) format. Then disassemble it (I use
IRAPC ).
Here's where the fun part begins
.
Search the assembly listing for A10001. This is the address of the Genesis/MD version register. If using IRAPC, this will match a table of constants at the beginning of the file (this is because IRA is intended to allow you to edit the assembly listing and reassemble without breaking anything). The statement looks like this (undoubtedly Ikon will mangle the spacing):
EXT_0C7A EQU $A10001
In this case, EXT_0C7A is the label for A10001, so search the file for EXT_0C7A. On Shining Force, this turns up the following routine (Ikon could probably use a code/monospace tag...):
LAB_155C:
move.b EXT_0C7A, d0 ;02C014: 103900A10001
andi.b #$C0, d0 ;02C01A: 020000C0
cmp.b d0,d1 ;02C01E: B200
bne.s LAB_155D ;02C020: 6602
rts ;02C022: 4E75
This is the routine that checks the version register. The upper two bits of the version register are what matters here, so everything but those bits are zeroed out (this is what andi.b #$C0,d0 does). In this case, you don't know what value the version register is being compared to, because it's loaded into d1 before the routine is called, but some games do load this value in the check routine. Anyway, the critical instruction here is the bne.s instruction. bne stands for "branch if not equal", and it jumps to another part of the program if the version register didn't match the desired value (determined with the cmp.b instruction). Since that's probably the "wrong version" code, you don't want that branch to happen, ever. So open up a hex editor, go to address 02C020, and change 6602 to 4E71. 4E71 is the 68000 "no operation" instruction, so that branch can now never happen.
Other games might use beq (branch if equal) instead of bne. In this case, you always want the branch to happen. A beq instruction will always start with the byte 67. Changing this to 60 will make the branch unconditional, so it will always be taken.
Yet other games might not use the cmp instruction, using something like btst instead. I don't want to even try to cover every possibility here though, and regardless of which instruction is used to do the actual comparison, it's still the branch instruction that matters (though if cmp isn't being used, bne and beq may lose their equal/not equal connotation and you might need to reverse the patch values).
Now load up an emulator (I use KGen98), switch to the "wrong" country version, load the ROM and hope that it works
.
The PAR code format is pretty simple. There are 24 bits for the address, and 16 bits for the desired replacement data, written in hexadecimal. For whatever reason, Datel decided to seperate the address/data pair into two halves rather than seperate the address from the data, so the code for SF is:
Address: 02C020
Data: 4E71
PAR Code: 02C02-04E71
There are two things that I know of that can complicate this process: PAL/NTSC-specific graphics optimizations, and a checksum routine. Games with PAL/NTSC-specific graphics optimizations (such as Golden Axe 3) will cause problems because the game program will try to use invalid timings for graphics. A checksum routine (which can be found on e.g. Mega Man: The Wily Wars) will cause the game to not run, usually making it display a solid red screen instead. Incidentally, GA3 and MM:WW are the other two games I've found patches for, and you should probably thank Arakon for ordering me to do so
. GA3 reads and compares the version register multiple times, so I just tried patching different comparison routines until a combination worked. Removing the internal checksum from MM:WW involved going through it with a debugger, which I don't feel like going into right now...
Hope this helps
.
Edit: added note about games not using cmp.
(Edited by ExCyber at 6:36 am on Sep. 15, 2001)
