Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - Hacked Woody Pop? (+BMX Trial, Super Racing and other Paddle Controllers games)

Reply to topic
Author Message
Toy Soldiers
  • Guest
Reply with quote
Hacked Woody Pop? (+BMX Trial, Super Racing and other Paddle Controllers games)
Post Posted: Mon Apr 23, 2007 7:53 pm
Would it be possible for someone to hack into a Sega MS 3 or Handy which has Woody Pop built in and release it as a rom? I'm talking about the hacked Tec Toy version which can be played with the control pad and not the paddle.
 
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8651
  • Location: Paris, France
Reply with quote
Post Posted: Mon Apr 23, 2007 11:36 pm
Phil, please stop posting under other's names, this is disturbing.

I have those systems but not the knowledge the dump the embedded ROM. The hack TecToy made can probably be replicated fairly easily. I don't have time for that myself now but it's probably doable in a matter of hours. However, knowing that you own a Paddle Control, a better hack would be to fix Woody Pop for it to function on export Master System with a Paddle Control.
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 412
  • Location: GBG
Reply with quote
Post Posted: Tue Apr 24, 2007 9:02 am
Is there a need for a program that can dump the bios to SRAM in a cart?
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8651
  • Location: Paris, France
Reply with quote
Post Posted: Tue Apr 24, 2007 9:50 am
No, I have such program. But I could not access the BIOS on those systems.
  View user's profile Send private message Visit poster's website
Phil (my name is)
  • Guest
Reply with quote
Post Posted: Tue Apr 24, 2007 7:23 pm
Sorry Bock for all the names!

Regarding my suggestion, I thought this was maybe easier and more "do-a-ble" to do since no one has fixed the Paddle & Woody Pop glitch in the 20 years this great game has been around.

All I want to do is have a dumped rom on a cartridge of the game hacked or not so I can insert my PAR into it and CHEAT CHEAT CHEAT. I dream of having infinite balls..........

I must complete this game before I die.

Thanks
 
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8651
  • Location: Paris, France
Reply with quote
Post Posted: Tue Apr 24, 2007 9:42 pm
Can you make a video of the game played on your European system? I don't have access to it now, I want to compare it to MEKA behavior when enforcing non-Japanese mode (I'm not sure of MEKA emulation on this matter). Thanks.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8651
  • Location: Paris, France
Reply with quote
Post Posted: Tue Apr 24, 2007 9:52 pm
I made a first patch, but I don't trust MEKA emulation on this specific part so it may not function on a real system. What this patch does is to force the game thinking it run on a Japanese system.

Edit the ROM image (make a backup copy before) and overwrite the following 5 successives addresses with 00: 06F2, 06F3, 06F4, 06F5, 06F6. That's 5 byte to modify. Can you apply the patch and test this on your console?

Frankly, I think it may not work but I'm interested in hearing result. Fact is that all existing games have specific (different) reading code to read the Paddle on an export system, but since the Paddle was never really released/supported here, it's not impossible that both methods actually works.
  View user's profile Send private message Visit poster's website
  • Joined: 12 Feb 2006
  • Posts: 194
  • Location: Wales
Reply with quote
Post Posted: Thu Apr 26, 2007 5:57 pm
It does work, the paddle acts just as it does on a Japanese console.
Any chance of finding which addresses to change in Alex Kidd BMX Trial too?
  View user's profile Send private message Visit poster's website
Phill
  • Guest
Reply with quote
Post Posted: Thu Apr 26, 2007 6:57 pm
Fantastic thanks Bock I could almost kiss you (almost)
 
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8651
  • Location: Paris, France
Reply with quote
Post Posted: Thu Apr 26, 2007 7:15 pm
Glad to hear it works.
Similar patch for BMX Trial:
ROM[143D] = 00

Note that's trivial to find those patch once the underlying problem is understood. Explanation: basically, all games using the Paddle Control were programmed with a dual way of reading the paddle. When the game detect an export system, it use a polling method that seems incompatible with the Japanese Paddle Control. This polling method was likely the one used in some prototype Paddle Control for the export market, that never got released.

The patch for Woody Pop and BMX Trial just makes the game thinks it's running on a Japanese system to use the correct code.

Here's the debugging log:
-- Logging session started on Thu Apr 26 21:09:38 2007
Welcome to Meka Debugger!
Enter H for help. Open HELP menu for details.
Press TAB for completion.
Machine reset
Break at $0000
# b io 3F
Breakpoint [0] added.
 [0] Break IO    RW   3F
# c
1424: [0] break IO write to 3F, writing value=f5
1430: [0] break IO write to 3F, writing value=55
# d
1432: DB DD       >INA (DDh)
1434: E6 C0        AND C0h
1436: B7           OR A
1437: 20 06        JR NZ,+06h (143Fh)
1439: AF           XOR A
143A: 3D           DEC A
143B: D3 3F        OUTA (3Fh)
143D: 77           LD (HL),A            ; write country detection result here
143E: C9           RET
143F: AF           XOR A
1440: 77           LD (HL),A            ; write country detection result here
# p hl
 $C001  bin: %11000000.00000001  asc: N/A  dec: -16383
# b w C001
Breakpoint [1] added.
 [1] Break CPU   .W.  C001
# c
143D: [1] break CPU write to C001, writing value=00
  View user's profile Send private message Visit poster's website
  • Joined: 12 Feb 2006
  • Posts: 194
  • Location: Wales
Reply with quote
Post Posted: Thu Apr 26, 2007 7:43 pm
The BMX Trial modification works too, thanks for that Bock
  View user's profile Send private message Visit poster's website
Phill
  • Guest
Reply with quote
Post Posted: Thu Apr 26, 2007 8:31 pm
What about Megasumi (?) Rescue..........I love that game too
 
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8651
  • Location: Paris, France
Reply with quote
Post Posted: Thu Apr 26, 2007 8:35 pm
Megumi Rescue (untested):

ROM[05AD] = 00
ROM[05AE] = 00
ROM[05AF] = 00
ROM[05B0] = 00
ROM[05B1] = 00

Please confirm if it works.
  View user's profile Send private message Visit poster's website
  • Joined: 12 Feb 2006
  • Posts: 194
  • Location: Wales
Reply with quote
Post Posted: Thu Apr 26, 2007 9:20 pm
Yep it works perfectly
  View user's profile Send private message Visit poster's website
  • Joined: 24 Dec 2011
  • Posts: 29
  • Location: Norway
Reply with quote
Hacked OutRun and OutRun 3-D for paddle
Post Posted: Fri Jan 06, 2012 4:51 am
Hi, all! I know it's an old thread, so here goes nothing:

I was elated, mildly put to find the addresses to hack the above games!
I've been trying so much with the debugger in meka to replicate the results shown by Bock to find country detection code in OutRun and OutRun 3-D and i just can't do it!

-If any of you know how to work the meka debugger, could you please help me find the addresses i need to edit to make an

OutRun and
OutRun 3-D rom that will boot in Mark III mode.

I own a Sega Paddle Control HPD-200 and OutRun and OutRun 3-D (and EPROM programmer for cart mods) and find OutRun poorly controllable with the paddle and OutRun 3-D to me acts like there is no support at all for the paddle. (This of course with both running in export mode).

Thanks so much in advance!
  View user's profile Send private message
  • Joined: 24 Dec 2011
  • Posts: 29
  • Location: Norway
Reply with quote
Hacked OutRu for JP mode
Post Posted: Fri Jan 06, 2012 6:37 pm
I managed to do it with the OutRun rom!

Opened it in a hex editor and went to address 7fff
and changed the 4 to 3 and got the Mark III logo in an emulator
set to auto-detect region.

Couldn't you just have done this with the other ones aswell
or is there something i haven't thought of here?
I can't get the Mark III logo when i do the same to OutRun 3-D.
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14744
  • Location: London
Reply with quote
Post Posted: Fri Jan 06, 2012 10:04 pm
That won't work on a real system.
  View user's profile Send private message Visit poster's website
  • Joined: 27 May 2011
  • Posts: 2
Reply with quote
Super Racing - Help!
Post Posted: Tue Jun 19, 2012 11:59 am
Hi!

First of all, thanks guys, this topic is fantastic.
I got a Sega Paddle a few days ago and I thought I was hopeless since it didn't work properly with the supported games and I read somewhere that it didn't work with non-Japanese systems...
So this topic saved me from the previous huge let down.

However, the game that I really want to enjoy with the Sega Paddle Control is Super Racing.

If you could, please, tell me what addresses of the rom I should edit in order to force the Japanese mode I would thank you VERY much.

Thanks a lot.
  View user's profile Send private message
  • Joined: 27 May 2011
  • Posts: 2
Reply with quote
Post Posted: Tue Jun 19, 2012 7:28 pm
Hi!

I managed to find the part that should be edited...

Just replace the following addresses with 00 value:
C0B, C0C, C0D, C0E

According to the manual (page 2/3) (thanks "tou sa" and this wonderful site for the scans), you need to use a regular controller in the second controller port in order to change the gears. I tested and it works perfectly.

By the way, I'm using it on a Mega Drive model 1, not a SMS...
  View user's profile Send private message
  • Joined: 16 Mar 2006
  • Posts: 281
Reply with quote
What about Galaxtic Protector?
Post Posted: Sun Apr 13, 2014 10:56 am
Hi this is a really old post...but I would like to play Galactic Protector with paddle contoller on my UK SMS via the Everdrive.

What modification would the rom require for it to work?

As Woody Pop has already had a Korean Hack so you can use a regular control pad, how about doing hacks so you can do the same with Megumi Rescue and Galactic Protector?

I'm going to try to alter Woody Pop, BMX Trial, Super Racing etc from so I can use the paddle from the results of this old post via the debugger in Meka. I've never ever tried anything like this before, but I need to learn or maybe ask you guys how to do it...

Thanks guys!!!
  View user's profile Send private message
  • Joined: 16 Mar 2006
  • Posts: 281
Reply with quote
Post Posted: Wed Apr 16, 2014 5:14 pm
Once you've modified a rom in Meka's Debugger how do you save it a new .sms file?

I also tried modifying BMX Trial as per Bock's screenshots but it doesn't result in the address being changed 143D=00

I'm not sure what I'm doing wrong, any help would be great?
  View user's profile Send private message
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8651
  • Location: Paris, France
Reply with quote
Post Posted: Wed Apr 16, 2014 5:21 pm
Phil wrote
Once you've modified a rom in Meka's Debugger how do you save it a new .sms file?


You can't.

Quote
I also tried modifying BMX Trial as per Bock's screenshots but it doesn't result in the address being changed 143D=00


You have to write from the ROM tab not from the CPU tab.
You can't write to rom from the cpu.
  View user's profile Send private message Visit poster's website
  • Joined: 23 Aug 2009
  • Posts: 213
  • Location: Seattle, WA
Reply with quote
Post Posted: Mon Oct 16, 2017 2:03 am
Not to overly necro, but I'd like to see if we can get patches for the remaining three games. I've gotten the ones in this thread so far all working on my US console with an Everdrive, but was hoping to get the following unblocked:


    * Galactic Protector
    * Out Run
    * Out Run 3D


Can anyone help out on those?
  View user's profile Send private message
  • Joined: 29 May 2016
  • Posts: 1
Reply with quote
Post Posted: Wed Mar 27, 2019 7:06 am
Last edited by RestfulCargo on Fri Mar 29, 2019 1:37 pm; edited 2 times in total
Hello. Here is the info for the missing games. Usually a necro post is something to be discouraged but in this case it's actually a good thing. Thanks to everybody before me that payed it forward:

Galactic Protector (UE).sms
SET 00 for addresses:
ROM[07EE]
ROM[07EF]
ROM[07F0]
ROM[07F1]
ROM[07F2]
ROM[07F3]

Out Run (World).sms
SET 00 for addresses:
ROM[0838]
ROM[0839]
ROM[083A]
ROM[083B]
ROM[083C]
ROM[083D]

Out Run 3-D (Europe).sms
SET 00 for addresses:
ROM[0474]
ROM[0475]
ROM[0476]
ROM[0477]
ROM[0478]
ROM[0479]
  View user's profile Send private message
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8651
  • Location: Paris, France
Reply with quote
Post Posted: Wed Mar 27, 2019 8:15 am
Quote
Usually a necro post is something to be discouraged

We always encourage posting to the relevant topic rather than creating a disconnected topics, if it is an old topic this is absolutly fine.

Thanks!
  View user's profile Send private message Visit poster's website
  • Joined: 13 Apr 2005
  • Posts: 248
  • Location: Aracruz - ES, Brazil
Reply with quote
Post Posted: Wed Mar 27, 2019 4:59 pm
Let me use this topic (who was raised from the grave) to make one question who was done HERE (the last post from Maxim is a "must see") and the answer was not very clear and objective to kill my doubts.

So, the question is: The Handle Controller uses the same driver of one of the two paddle drivers (japan or western/world/export), or it uses it own driver?

And if the Handle Controller uses the same driver of the export paddle, the Handle Controller can be used to play paddle games in western consoles, or play Handle Controller compatible games with the "export paddle"?





Toy Soldiers wrote
I'm talking about the hacked Tec Toy version which can be played with the control pad and not the paddle.

I'm not aware about SMS games who was design to be played using only the Paddle controler, and Tec Toy hacked them to use the standard controler to be release in Brazil. Can someone clarify me this information?
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14744
  • Location: London
Reply with quote
Post Posted: Wed Mar 27, 2019 11:25 pm
Last edited by Maxim on Thu Mar 28, 2019 7:13 pm; edited 1 time in total
I think the Paddle Controller only emits normal joypad data, i.e. left and right signals when turned that way, with no analogue data. The planned export paddle doesn't exist, but is an externally clocked version of the Japanese paddle. It should be fairly simple to make an "export paddle" device using a microcontroller.

To emulate an analogue controller using a joypad you can compute an 8 bit position and let the control pad affect that, either linearly (so left/right change it by 1 every frame), or by emulating a kind of inertia in the value (so longer movements go faster), or for games where the paddle describes a direction, emulate that based on the direction actually pressed. I think Tec Toy did the simplest of these.
  View user's profile Send private message Visit poster's website
  • Joined: 13 Apr 2005
  • Posts: 248
  • Location: Aracruz - ES, Brazil
Reply with quote
Post Posted: Thu Mar 28, 2019 5:58 pm
First of all, thanks for the reply, Maxim.




Now lets go to the topic. My question is if the Handle Controller is a "re-design" of the "export" Paddle Controller or not. If yes, that's means we can play games like Woody Pop or BMX Trial using this special controller, right? Can somebody with a Handle Controller can test paddle compatible games (specially Japan-exclusive games) at western consoles? All my tests was using Meka, so I can't say what happen using the real hardware... That's why I'm making this question.




Now about Tec Toy's hack: Which paddle-exclusive game(s) was hacked by Tec Toy to be released in Brazil?

Just to note:

Checking THIS PAGE, there's only seven paddle-compatible games released, which one was released worldwide (Out Run), and another one was an european/brazilian exclusive release with no japanese release (Out Run 3D).

BMX Trial Alex Kidd, Woody Pop, Galactic Protector and Megumi Rescue are paddle-exclusive games.

Woody Pop's Korean version, Super Arkanoid, was hacked to use the regular controller instead of the paddle controller (the game stills askes for a japanese BIOS to be played properlly). Woody Pop for Game Gear uses the system's controls due the lack of a periferal support (the game even uses the button 2 to slow down the moviments, who is a smart way to offer some kind of speed control, something the korean hack lacked).

Galactic Protector is the only paddle game with two players support (each player must have their own paddle controller).

Super Racing, Out Run, and Out Run 3-D can be played using or the regular controller, or the paddle controller. The game will detect which controller is connected. If the controllers are changed while the game is running, the games will not work properlly. Out Run can be soft reseted to fix this issue, while the other two games must be hard reseted (turn off and turn on the system).
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14744
  • Location: London
Reply with quote
Post Posted: Thu Mar 28, 2019 6:04 pm
No, the handle controller does not act like a paddle.
  View user's profile Send private message Visit poster's website
  • Joined: 13 Apr 2005
  • Posts: 248
  • Location: Aracruz - ES, Brazil
Reply with quote
Post Posted: Thu Mar 28, 2019 6:56 pm
Maxim wrote
No, the handle controller does not act like a paddle.
Really? So, it's just a glorified standard controller with nothing special? My hype is over. =P

Ok. And about the Tec Toy hack I asked before?
  View user's profile Send private message
Reply to topic



Back to the top of this page

Back to SMS Power!