Forums

Hey Guys. I found this code during my rounds while I was looking for something else. I've added a "functional" version to the Cheats page. It works, but it's messy and I would like to have the actual code. I gave it a couple of tries, but didn't get much farther than when I first started.

The basics: The code is run from the options screen. Music MUST be playing for it to work. Once enabled, the options screen reloads with the extra options enabled.

Stage Select (1-6) (not sure if there are more)
Damage On/Off (you can still get knocked around-but no damage)

I'm not sure how the code works. If you write a value of 01 to D318 while music is playing, it enables the code. Since pressing start exits the screen and pressing up or down stops the music and makes the code inoperable, it doesn't leave much options. There is a fraction of a second between when you move the cursor up and down and the music stops, but nothing I tried worked. If you exit after enabling the code, you need to enable it again. It seems to retain changes you made, so that's not necessarily bad, but it does mean, the code takes place within this screen.

I found code in the area comparing the value at C363 with certain values and the BGM and SE values, but those are the same values that correspond to button 2 (plays music) and left/right..so it could just be i got misled by code that merely handles the music playback routine on that screen. Even so, the code that triggers the code should be somewhere near. 23DD2 is where it seems to read if the code is triggered. If it isn't key presses (there aren't many viable options) then maybe the code is set by selecting an SE and then playing back a song, but I had no luck with the ones I tried. I figure I'd turn to the community, and hope it's something easy enough to discover.

I tested a little with SMS and was not able to find the cheat. The options screen is a bit different for that version, so it could just be for the GG .

Set "BGM" to 14 and "SE" to 21. With "SE" selected, hold buttons 1 and 2 and press Up.

You are right to state (on the Cheats page) that the extra options are enabled when the value at $d320 is $01, and (above) that they first become enabled when $d318 is $01. However it is not true that music must be playing for the options to become enabled - only that "BGM" must be selected.

Most of the code for the options screen seems to be in bank 8 of the ROM, so I used MEKA to disassemble that bank. It contains only one instance of "ld a,01h \ ld (D320h),a", at CPU address $b4c6. This code runs if the b register contains the value $01 when the code at $b4bd is executed, and using MEKA's TRACE command we can see that the contents of the b register come from $d318. Therefore this is the code which enables the extra options. The code at $b4bd is only executed if "BGM" is selected, so that must be true for the options to become enabled.

So, how does $d318 become set to $01? The only instance of "ld a,01h \ ld (D318h),a" near the options screen code is at $b40b, but this does not run until the Start button is pressed to exit the screen. However, the following function is jumped to from several places near the options screen code:

9436: 3A 18 D3 ld a,(D318h)
9439: 3C inc a
943A: 32 18 D3 ld (D318h),a
943D: 37 scf
943E: C9 ret

One of those jumps is at the end of the following piece of code, which again only runs if "BGM" is selected:

B550: 21 04 01 ld hl,0104h
B553: 3A 1B D3 ld a,(D31Bh)
B556: BD cp l
B557: 20 1E jr nz,+1Eh (B577h)
B559: 3A 1C D3 ld a,(D31Ch)
B55C: BC cp h
B55D: 20 18 jr nz,+18h (B577h)
B55F: 3A 62 C3 ld a,(C362h)
B562: FE 31 cp 31h
B564: 20 11 jr nz,+11h (B577h)
B566: 2A 1D D3 ld hl,(D31Dh)
B569: 11 01 02 ld de,0201h
B56C: A7 and a
B56D: ED 52 sbc hl,de
B56F: 20 06 jr nz,+06h (B577h)
B571: 3A 20 D3 ld a,(D320h)
B574: A7 and a
B575: 28 02 jr z,+02h (B579h)
B577: 37 scf
B578: C9 ret
B579: 3E 01 ld a,01h
B57B: 32 25 D3 ld (D325h),a
B57E: CD 75 00 call 0075h
B581: C3 36 94 jp 9436h

The 16-bit current value of "BGM" is stored at $d13b, and that of "SE" is at $d13d. The byte at $c362 stores the buttons which are currently being pressed. We can see, then, that this code checks that "BGM" is set to 14, that Up+1+2 is pressed, that "SE" is set to 12 and that the extra options are not already enabled. If this code runs (with "BGM" selected) and all of these conditions pass, the value at $d318 is incremented from 0 to 1, which causes the options to become available.

SoR2GGOptions.png (548 B)

SoR2GGExtraOptions.png (670 B)

The "Round" and "Damage" options are also available on the Master System version: Set "Level" to "Easy", "Players" to 01, "BGM" to 02 and "SE" to 03. With "Level" selected, press buttons 1 and 2 together.

I felt that the SMS version probably did contain the extra options, since the data describing the strings on the options screen ("LEVEL", "PLAYERS", BGM", "SE" and "EXIT") at $3594d - $35986 is directly followed by descriptions of two more strings: "ROUND" and "DAMAGE".

In order to find out how to enable the extra options, I watched MEKA's Memory Editor and found that the byte at $ce00 is used to store which row of the options screen is currently selected. Setting a breakpoint on $ce00 led me to the code which changes the value. I worried for a short while because this code can only handle 5 rows (ld a,04h at $95fe and cp 05h at $9602), only to find a second copy of the code written to handle 7 rows (ld a,06h at $9643 and cp 07h at $9647).

Using the TRACE function from the breakpoint, I soon found "ld a,(C61Ch) \ cp 30h" at 95a3, which resembled the code used to check button presses in the Game Gear version. I confirmed that the byte at $c61c stores the buttons which are currently being pressed.

The checking of button presses turned out to be the first in a series of tests:

95A3: 3A 1C C6 ld a,(C61Ch)
95A6: FE 30 cp 30h
95A8: 20 2C jr nz,+2Ch (95D6h)
95AA: 3A 00 CE ld a,(CE00h)
95AD: A7 and a
95AE: 20 26 jr nz,+26h (95D6h)
95B0: 3A 37 C6 ld a,(C637h)
95B3: A7 and a
95B4: 20 20 jr nz,+20h (95D6h)
95B6: 3A 8E D2 ld a,(D28Eh)
95B9: FE 01 cp 01h
95BB: 20 19 jr nz,+19h (95D6h)
95BD: 3A 01 CE ld a,(CE01h)
95C0: FE 02 cp 02h
95C2: 20 12 jr nz,+12h (95D6h)
95C4: 3A 02 CE ld a,(CE02h)
95C7: FE 03 cp 03h
95C9: 20 0B jr nz,+0Bh (95D6h)
95CB: 3E 02 ld a,02h
95CD: 32 80 CE ld (CE80h),a
95D0: CD 29 99 call 9929h
95D3: C3 18 96 jp 9618h
95D6: ...

As well as checking the button presses, this code ensures that "Level" is selected and set to "Easy", and that "Players", "BGM" and "SE" are set to 01, 02 and 03 respectively. If these tests all pass, $02 is written to $ce80. It turns out that this is what enables the extra options - for the standard options screen, the value at $ce80 is $01.

SoR2SMSOptions.png (669 B)

SoR2SMSExtraOptions.png (828 B)

I have added the above cheats to Cheats/StreetsOfRageII-GG and Cheats/StreetsOfRageII-SMS.

Wonderful exposition. Thank you for the clear and detailed explanation.

I had no idea MEKA had a tracer. Is there documentation available for this? It seems there are alot of features Meka has I am not aware of. I know you can set breakpoints, but thought it was lacking a tracer. I also spent time pouring over trace logs (emulcious) but was not able to put together what was happening anywhere as detailed as you. I probably would have had some challenge identifying all the parts on my own, but the code snippets and accompanying explanation make it almost seem obvious once you see all that code in that order. Of course hindsight is easy. I had a tough time figuring out beyond the basics. And you're right about the music not needing to be played. Strange, I must have made some goof, cause I could have sworn I tried enabling it several times with only BGM selected and it didn't work...but it actually does.

Thanks for figuring out the SMS version as well. It's nice when these codes are unearthed even after so long a time :)

Author	Message
sherpa Joined: 28 Nov 2014 Posts: 365	Help Wanted: Cheat code for Streets of Rage II GG Posted: Sun Apr 19, 2015 10:03 pm
sherpa Joined: 28 Nov 2014 Posts: 365	Hey Guys. I found this code during my rounds while I was looking for something else. I've added a "functional" version to the Cheats page. It works, but it's messy and I would like to have the actual code. I gave it a couple of tries, but didn't get much farther than when I first started. The basics: The code is run from the options screen. Music MUST be playing for it to work. Once enabled, the options screen reloads with the extra options enabled. Stage Select (1-6) (not sure if there are more) Damage On/Off (you can still get knocked around-but no damage) I'm not sure how the code works. If you write a value of 01 to D318 while music is playing, it enables the code. Since pressing start exits the screen and pressing up or down stops the music and makes the code inoperable, it doesn't leave much options. There is a fraction of a second between when you move the cursor up and down and the music stops, but nothing I tried worked. If you exit after enabling the code, you need to enable it again. It seems to retain changes you made, so that's not necessarily bad, but it does mean, the code takes place within this screen. I found code in the area comparing the value at C363 with certain values and the BGM and SE values, but those are the same values that correspond to button 2 (plays music) and left/right..so it could just be i got misled by code that merely handles the music playback routine on that screen. Even so, the code that triggers the code should be somewhere near. 23DD2 is where it seems to read if the code is triggered. If it isn't key presses (there aren't many viable options) then maybe the code is set by selecting an SE and then playing back a song, but I had no luck with the ones I tried. I figure I'd turn to the community, and hope it's something easy enough to discover. I tested a little with SMS and was not able to find the cheat. The options screen is a bit different for that version, so it could just be for the GG .

RetroSpark Joined: 08 Dec 2005 Posts: 488 Location: Melbourne, Australia	Posted: Mon Apr 20, 2015 5:45 am Last edited by RetroSpark on Mon Apr 20, 2015 11:45 am; edited 3 times in total
	Set "BGM" to 14 and "SE" to 21. With "SE" selected, hold buttons 1 and 2 and press Up. You are right to state (on the Cheats page) that the extra options are enabled when the value at $d320 is $01, and (above) that they first become enabled when $d318 is $01. However it is not true that music must be playing for the options to become enabled - only that "BGM" must be selected. Most of the code for the options screen seems to be in bank 8 of the ROM, so I used MEKA to disassemble that bank. It contains only one instance of "ld a,01h \ ld (D320h),a", at CPU address $b4c6. This code runs if the b register contains the value $01 when the code at $b4bd is executed, and using MEKA's TRACE command we can see that the contents of the b register come from $d318. Therefore this is the code which enables the extra options. The code at $b4bd is only executed if "BGM" is selected, so that must be true for the options to become enabled. So, how does $d318 become set to $01? The only instance of "ld a,01h \ ld (D318h),a" near the options screen code is at $b40b, but this does not run until the Start button is pressed to exit the screen. However, the following function is jumped to from several places near the options screen code: 9436: 3A 18 D3 ld a,(D318h) 9439: 3C inc a 943A: 32 18 D3 ld (D318h),a 943D: 37 scf 943E: C9 ret One of those jumps is at the end of the following piece of code, which again only runs if "BGM" is selected: B550: 21 04 01 ld hl,0104h B553: 3A 1B D3 ld a,(D31Bh) B556: BD cp l B557: 20 1E jr nz,+1Eh (B577h) B559: 3A 1C D3 ld a,(D31Ch) B55C: BC cp h B55D: 20 18 jr nz,+18h (B577h) B55F: 3A 62 C3 ld a,(C362h) B562: FE 31 cp 31h B564: 20 11 jr nz,+11h (B577h) B566: 2A 1D D3 ld hl,(D31Dh) B569: 11 01 02 ld de,0201h B56C: A7 and a B56D: ED 52 sbc hl,de B56F: 20 06 jr nz,+06h (B577h) B571: 3A 20 D3 ld a,(D320h) B574: A7 and a B575: 28 02 jr z,+02h (B579h) B577: 37 scf B578: C9 ret B579: 3E 01 ld a,01h B57B: 32 25 D3 ld (D325h),a B57E: CD 75 00 call 0075h B581: C3 36 94 jp 9436h The 16-bit current value of "BGM" is stored at $d13b, and that of "SE" is at $d13d. The byte at $c362 stores the buttons which are currently being pressed. We can see, then, that this code checks that "BGM" is set to 14, that Up+1+2 is pressed, that "SE" is set to 12 and that the extra options are not already enabled. If this code runs (with "BGM" selected) and all of these conditions pass, the value at $d318 is incremented from 0 to 1, which causes the options to become available. SoR2GGOptions.png (548 B) SoR2GGExtraOptions.png (670 B)

RetroSpark Joined: 08 Dec 2005 Posts: 488 Location: Melbourne, Australia	Posted: Mon Apr 20, 2015 9:03 am Last edited by RetroSpark on Mon Apr 20, 2015 12:46 pm; edited 1 time in total
	The "Round" and "Damage" options are also available on the Master System version: Set "Level" to "Easy", "Players" to 01, "BGM" to 02 and "SE" to 03. With "Level" selected, press buttons 1 and 2 together. I felt that the SMS version probably did contain the extra options, since the data describing the strings on the options screen ("LEVEL", "PLAYERS", BGM", "SE" and "EXIT") at $3594d - $35986 is directly followed by descriptions of two more strings: "ROUND" and "DAMAGE". In order to find out how to enable the extra options, I watched MEKA's Memory Editor and found that the byte at $ce00 is used to store which row of the options screen is currently selected. Setting a breakpoint on $ce00 led me to the code which changes the value. I worried for a short while because this code can only handle 5 rows (ld a,04h at $95fe and cp 05h at $9602), only to find a second copy of the code written to handle 7 rows (ld a,06h at $9643 and cp 07h at $9647). Using the TRACE function from the breakpoint, I soon found "ld a,(C61Ch) \ cp 30h" at 95a3, which resembled the code used to check button presses in the Game Gear version. I confirmed that the byte at $c61c stores the buttons which are currently being pressed. The checking of button presses turned out to be the first in a series of tests: 95A3: 3A 1C C6 ld a,(C61Ch) 95A6: FE 30 cp 30h 95A8: 20 2C jr nz,+2Ch (95D6h) 95AA: 3A 00 CE ld a,(CE00h) 95AD: A7 and a 95AE: 20 26 jr nz,+26h (95D6h) 95B0: 3A 37 C6 ld a,(C637h) 95B3: A7 and a 95B4: 20 20 jr nz,+20h (95D6h) 95B6: 3A 8E D2 ld a,(D28Eh) 95B9: FE 01 cp 01h 95BB: 20 19 jr nz,+19h (95D6h) 95BD: 3A 01 CE ld a,(CE01h) 95C0: FE 02 cp 02h 95C2: 20 12 jr nz,+12h (95D6h) 95C4: 3A 02 CE ld a,(CE02h) 95C7: FE 03 cp 03h 95C9: 20 0B jr nz,+0Bh (95D6h) 95CB: 3E 02 ld a,02h 95CD: 32 80 CE ld (CE80h),a 95D0: CD 29 99 call 9929h 95D3: C3 18 96 jp 9618h 95D6: ... As well as checking the button presses, this code ensures that "Level" is selected and set to "Easy", and that "Players", "BGM" and "SE" are set to 01, 02 and 03 respectively. If these tests all pass, $02 is written to $ce80. It turns out that this is what enables the extra options - for the standard options screen, the value at $ce80 is $01. SoR2SMSOptions.png (669 B) SoR2SMSExtraOptions.png (828 B)

RetroSpark Joined: 08 Dec 2005 Posts: 488 Location: Melbourne, Australia	Posted: Mon Apr 20, 2015 12:12 pm
	I have added the above cheats to Cheats/StreetsOfRageII-GG and Cheats/StreetsOfRageII-SMS.

sherpa Joined: 28 Nov 2014 Posts: 365	Posted: Mon Apr 20, 2015 2:31 pm
sherpa Joined: 28 Nov 2014 Posts: 365	Wonderful exposition. Thank you for the clear and detailed explanation. I had no idea MEKA had a tracer. Is there documentation available for this? It seems there are alot of features Meka has I am not aware of. I know you can set breakpoints, but thought it was lacking a tracer. I also spent time pouring over trace logs (emulcious) but was not able to put together what was happening anywhere as detailed as you. I probably would have had some challenge identifying all the parts on my own, but the code snippets and accompanying explanation make it almost seem obvious once you see all that code in that order. Of course hindsight is easy. I had a tough time figuring out beyond the basics. And you're right about the music not needing to be played. Strange, I must have made some goof, cause I could have sworn I tried enabling it several times with only BGM selected and it didn't work...but it actually does. Thanks for figuring out the SMS version as well. It's nice when these codes are unearthed even after so long a time :)

Forums

View topic - Help Wanted: Cheat code for Streets of Rage II GG