Esrael s2b

This historical hacking document is preserved here for archival purposes. It has not been revised since its original writing and may be outdated. For an SCHG-equivalent document, see SCHG:Sonic the Hedgehog 2 (Simon Wai prototype).

Using a hexadecimal editor it's possible to modify the game, editing it byte-by-byte. Knowing where it is each instruction and altering it correctly you can customize the game. You can draw other character in the place of Sonic but this is not easy since he has that if fact point to point. To change the name of the levels in the selection menu and in I title it of the levels. But to program the game it is necessary that he is in the binary format, it is not very difficult to convert the game to binary, you can use a conversion program or the emulator Genecyst that has the DUMP ROM option, that makes the conversion.

Level Select Menu

The Level Select Menu of Sonic 2 Beta uses a format of plain text of 26 characters per line. All lines can fit up to 26 characters besides the lines that show only STAGE 1 and 2. The first space begins in the letter G of GREEN HILL and the last space finishes in I number it 0 of STAGE 0, the first space begins where it finishes the space of the first line and like this until the end of the screen of selection of levels. see the list of the levels and the respective addresses below in the editor hexadecimal. In the editor you will see addresses for example in hexadecimal in the following format: 000035B9. But in the page you will see that same address represented by 3B59. Look at the image of the hexadecimal editor and soon I list all the levels and their respective addresses.

LEVEL	OFFSET
GREEN HILL ZONE STAGE 0	3D7C to 3D96
GREEN HILL ZONE STAGE 1	3D97 to 3DB1
WOOD ZONE STAGE 0	3DB2 to 3DCC
WOOD ZONE STAGE 1	3DCD to 3DE7
METROPOLIS ZONE STAGE 0	3DE8 to 3E02
METROPOLIS ZONE STAGE 1	3E03 to 3E1D
METROPOLIS ZONE STAGE 2	3E1E to 3E38
HILL TOP STAGE 0	3E39 to 3E53
HILL TOP STAGE 1	3E54 to 3E6E
HIDDEN PALACE ZONE STAGE 0	3E6F to 3E89
HIDDEN PALACE ZONE STAGE 1	3E8A to 3EA4
OIL OCEAN ZONE STAGE 0	3EA5 to 3EBF
OIL OCEAN ZONE STAGE 1	3EC0 to 3EDA
DUST HILL ZONE STAGE 0	3EDB to 3EF5
DUST HILL ZONE STAGE 1	3EF6 to 3F10
CASINO NIGHT ZONE STAGE 0	3F11 to 3F2B
CASINO NIGHT ZONE STAGE 1	3F2C to 3F46
CHEMICAL PLANT ZONE STAGE 0	3F47 to 3F61
CHEMICAL PLANT ZONE STAGE 1	3F62 to 3F7C
GENOCIDE CITY ZONE STAGE 0	3F7D to 3F97
GENOCIDE CITY ZONE STAGE 1	3F98 to 3FB2
NEO GREEN HILL ZONE STAGE 0	3FB3 to 3FCD
NEO GREEN HILL ZONE STAGE 1	3FCE to 3FE8
DEATH EGG ZONE STAGE 0	3FE9 to 4003
DEATH EGG ZONE STAGE 1	4004 to 401E
SPECIAL STAGE	401F to 4039
SOUND TEST	4A3A to 4054

The name of the levels uses a non-ASCII group of characters. It is necessary to know the equivalence of the letters to modify the name. Look at the table below and modify the names. Run the game and go to the level select menu and see the names that you replaced.

00 = 0	01 = 1	02 = 2	03 = 3	04 = 4
05 = 5	06 = 6	07 = 7	08 = 8	09 = 9
0A = $	0B = -	0C = =	0D = <-	0E = <-
0F = Y	10 = Z	11 = A	12 = B	13 = C
14 = D	15 = E	16 = F	17 = G	18 = H
19 = I	1A = J	1B = K	1C = L	1D = M
1E = N	1F = O	20 = P	21 = Q	22 = R
23 = S	24 = T	25 = U	26 = V	27 = W
28 = X	FF =

You can also define the level that the game loads when pressing "START" in the menu of selection of levels. The place where the game search the levels when pressing "START" in any level in the level select menu are starting from the address 3AD4 on. Look at the hexadecimal editor image:

The cursor in the image is exactly in the 3AD4h address, this is the initial address for load of the levels of the menu of selection of levels. The menu of selection of levels uses 2 bytes to select a level. the 1st. byte defines the zone to be loaded the 2nd. byte defines the act to be loaded, in the byte that configures the act the 00 it indicates act 1 and the 01 it indicates the act 2, the only exception is Metropolis Zone Act 3 that is represented by 05-00, the others they follow the rule above. To facilitate the understanding and the edition of the levels I created two tables: one with ID of the levels that will be used in the 1st byte of the levels. Look:

LEVEL	ID
GREEN HILL	00
WOOD ZONE	02
METROPOLIS	04
METROPOLIS	05
HILL TOP	07
HIDDEN PALACE	08
OIL OCEAN ZONE	0A
DUST HILL ZONE	0B
CASINO NIGHT ZONE	0C
CHEMICAL PLANT ZONE	0D
GENOCIDE CITY ZONE	0E
NEO GREEN HILL ZONE	0F
DEATH EGG ZONE	10

Notice that some numbers are jumped as of the 01, 03, 06 and 09. In spite of not existing a level name for these IDs in the relationship and nor in the menu of selection of levels. If you place these IDs that you are being missing you he can acquire the lost levels (he makes the experience and see the results). it Observes the table with the standard of the levels location and soon after an explanation.

LEVEL	ADDRESS
GREEN HILL ZONE STAGE 0	3AD4 & 3AD5
GREEN HILL ZONE STAGE 1	3AD6 & 3AD7
WOOD ZONE STAGE 0	3AD8 & 3AD9
WOOD ZONE STAGE 1	3ADA & 3ADB
METROPOLIS ZONE STAGE 0	3ADC & 3ADD
METROPOLIS ZONE STAGE 1	3ADE & 3ADF
METROPOLIS ZONE STAGE 2	3AE0 & EAE1
HILL TOP STAGE 0	3AE2 & 3AE3
HILL TOP STAGE 1	3AE4 & 3AE5
HIDDEN PALACE ZONE STAGE 0	3AE6 & 3AE7
HIDDEN PALACE ZONE STAGE 1	3AE8 & 3AE9
OIL OCEAN ZONE STAGE 0	3AEA & 3AEB
OIL OCEAN ZONE STAGE 1	3AEC & 3AED
DUST HILL ZONE STAGE 0	3AEE & 3AEF
DUST HILL ZONE STAGE 1	3AF0 & 3AF1
CASINO NIGHT ZONE STAGE 0	3AF2 & 3AF3
CASINO NIGHT ZONE STAGE 1	3AF4 & 3AF5
CHEMICAL PLANT ZONE STAGE 0	3AF6 & 3AF7
CHEMICAL PLANT ZONE STAGE 1	3AF8 & 3AF9
GENOCIDE CITY ZONE STAGE 0	3AFA & 3AFB
GENOCIDE CITY ZONE STAGE 1	3AFC & 3AFD
NEO GREEN HILL ZONE STAGE 0	3AFE & 3AFF
NEO GREEN HILL ZONE STAGE 1	3B00 & 3B01
DEATH EGG ZONE STAGE 0	3B02 & 3B03
DEATH EGG ZONE STAGE 1	3B04 & 3B05
SPECIAL STAGE	3B06 & 3B07

The table above indicates where they are located the configuration bytes in the menu of selection of levels. The 1st. I address of the table it indicates the byte of the zone and the 2nd. address indicates the act byte. Example in the address 3AE6 you will see the byte 08 (Hidden Palace zone) and in the address 3AE7 you will see the byte 00 (Act 1). In case you want to turn an inaccessible level in the menu of level selection he types 80 in the byte of the zone.

Music

You can also choose the music to be played in the levels. The format is of just a byte for level and it is very simple. To place another music of its preference, play the sounds in the sound test, write down the number of the music and place in the byte that represents the chosen level. Obs: for technical questions the level Death Egg cannot have its selected music. See below in the table the location of the selection of music. Also observe that for the correct operation will be necessary to alter the bytes in the two addresses listed below.

Level	Music	Address 1	Address 2
GREEN HILL	82	4140	FD66
ID 02	82	4141	FD67
WOOD ZONE	83	4142	FD68
ID 03	90	4143	FD69
METROPOLIS	83	4144	FD6A
METROPOLIS 3	83	4145	FD6B
ID 06	93	4146	FD6C
HILL TOP	96	4147	FD6D
HIDDEN PALACE	86	4148	FD6E
ID 09	8F	4149	FD6F
OIL OCEAN ZONE	81	414A	FD70
DUST HILL ZONE	85	414B	FD71
CASINO NIGHT ZONE	84	414C	FD72
CHEMICAL PLANT ZONE	8D	414D	FD73
GENOCIDE CITY ZONE	8D	414E	FD74
NEO GREEN HILL ZONE	87	414F	FD75
DEATH EGG ZONE	not to move	4150	FD76

Start Level

You can define which level the game loads when pressing " START " during the screen title, that now is NEO GREEN HILL. For so much it goes to the address 383A and 383B, you will see the bytes 0F-00 that belong NEO GREEN HILL act 1, Change these bytes using ID of the levels in the selection menu and select the level that the game should load when pressing " START ". Former: if you change these bytes for 07-01 the game it will load the level HILL TOP act 2 when pressing " START " in the screen title.

Order of the Levels

Now the sequence of the levels of the game is NGHZ 1-2, CPZ 1-2, HTZ 1-2, GHZ 1-2, but it is possible to alter the order with that the levels are exhibited in the game. The sequence begins in Offset BF9A á BFDD. The format is similar to the menu of selection of levels, that is to say two bytes for level. The picture below exhibition the current sequence of the levels in order in that are played. Change ID to go for a level different from the specified.

FROM	TO	ADDRESS	ID
START	NGHZ 1	383A & 383B	0F-00
NGHZ 1	NGHZ 2	BFD6 & BFD7	0F-01
NGHZ 2	CPZ 1	BFD8 & BFD9	0D-00
CPZ 1	CPZ 2	BFCE & BFCF	0D-01
CPZ 2	HTZ 1	BFD0 & BFD1	07-00
HTZ 1	HTZ 2	BFD6 & BFB7	07-01
HTZ 2	GHZ 1	BFB8 & BFB9	00-00
GHZ 1	GHZ 2	BF9A & BF9B	00-01

Title Cards

Originally these are disabled in the version beta, but you cannot you activate them.

Changing objects

You can also alter objects in the levels as badnicks, lives, obstacles, etc... The configuration of the objects in the levels uses 6 long bytes, being in the format XX-XX-YY-YY-OO-VV. Explaining to X's better indicates the horizontal position in the screen, Y's indicates the vertical position in the screen, O's indicates the objects they be she placed and V's indicates the possible variations of each object. To obtain the exact location of the place where you want for the objects, make the code of the debug mode and write down the first line of coordinates in the place of SCORE, These will be the coordinates that you should type to place the object in the wanted place. See the location where the game search the objects of the phases. The levels finish the mapeamento before the bytes FF-FF-00-00-00-00. Starting from these bytes next level begins.

GREEN HILL ZONE STAGE 0	4404A
GREEN HILL ZONE STAGE 1	442C6
METROPOLIS ZONE STAGE 0	445C0
METROPOLIS ZONE STAGE 1	4458A
METROPOLIS ZONE STAGE 2	44B30
HILL TOP STAGE 0	44EFC
HILL TOP STAGE 1	45130
HIDDEN PALACE ZONE STAGE 0	4554A
OIL OCEAN ZONE STAGE 0	4565E
OIL OCEAN ZONE STAGE 1	457C0
DUST HILL ZONE STAGE 0	459AC
CHEMICAL PLANT ZONE STAGE 0	45A2A
CHEMICAL PLANT ZONE STAGE 1	45CC4
NEO GREEN HILL ZONE STAGE 0	4605A
NEO GREEN HILL ZONE STAGE 1	46216

Select a level to exhibit the available objects and its coordinates.

• GREEN HILL
• CHEMICAL PLANT
• WOOD
• GENOCIDE CITY
• METROPOLIS
• NEO GREEN HILL
• HILL TOP
• DEATH EGG
• HIDDEN PALACE
• SPECIAL STAGE
• OIL OCEAN
• SOUND TEST
• DUST HILL
• CASINO NIGHT

Object Properties

This part is very interesting because it is in her that the game search all the objects. In this local one you can edit the objects of the game and to add other objects using null spaces in the game.

Palette of Colors

In this part you can edit the colors of the levels, Sonic, Tails, etc.. The Format is 0BGR. To edit the colors it uses Paint Brush of Windows. choose a color any it selects to edit or of a double click in the color. Observe it I number of the colors (GREEN / RED / BLUE) it Uses the calculator of Windows in the scientific way and divide it I number of each color for 16. Ignore the numbers after the point. Convert the result for hexadecimal (In the scientific way simply click in hex). it Places in the place of the bytes in agreement with the order (0BGR 0 - it doesn't move; B - BLUE; G - GREEN, R - RED). This method can be used that works.

See the location of the palettes below:

ID	LEVEL / EVENT	ADDRESS
00	SEGA LOGO	2A16
01	Tela Titulo	2A96
02	Menu de Seleção de Fases	2B16
03	Sonic / Tails / Title Cards ...	2B96
04	Green Hill	2BB6
05*	01-00	2BB6
06	Wood	2C16
07*	03-00	2BB6
08 / 09	Metropolis	2C76
0A	06-00	2F36
0B	Hill Top	2CD6
0C	Hidden Palace	2D36
0D*	09-00	2BB6
0E	Oil Ocean	2E16
0F	Dust Hill	2E76
10	Casino Night	2ED6
11	Chemical Plant	2F96
12*	Genocide City	2BB6
13	Neo Green Hill	3076
14*	Death Egg	2BB6
15	Hidden Palace (underwater)	2D96
16	Chemical Plant (underwater)	2FF6
17	Neo Green Hill (underwater)	30D6
18	Special Stage	3156

(*) Not to change these palettes because the pointers are the same of Green Hill.

Other Palettes (Waterfalls, Lights, etc...)

LEVEL	EVENT	ADDRESS
Green Hill / Neo Green Hill	Water Cycling	2284
Wood	Mat Spin	2324
Metropolis	..................	2334
Metropolis	Engagement Spin	2340
Metropolis	Background Lights	234C
Hill Top	Lava Cycling	22A4
Hidden Palace	Water Cycling	2360
Hidden Palace	.................	2370
Oil Ocean	Oil Cycling	2380
Dust Hill	Lanterns	2390
Casino Night	Lights	2398
Casino Night	Mat Spin	23BC
Casino Night	Background Lights	23CE
Chemical Plant	..............	2422
Chemical Plant	..............	2458
Chemical Plant	Background Lights	2482

Demo Mode

You can choose the order in that the levels are shown in the demo mode and also to select other levels for the demo mode. See below in the table the current sequence and its respective locations.

SEQUENCE	LEVEL	OFFSET	ID
1o.	Chemical Plant	3C16 & 3C17	0D-00
2o.	Green Hill	3C18 & 3C19	00-00
3o.	Hidden Palace	3C1A & 3C1B	08-00
4o.	Hill Top	3C1C & 3C1D	07-00

Sonic's Starting Location

In this part you can define in that point of the screen Sonic begins. To select a place different from the original. Use the way debug. Go to the place from where you want to begin and write down the coordinates (first line in the place of Score), Tends in hands the coordinates it places them accordingly in the place of the chosen level in the address of the table below.

LEVEL	OFFSETS	COORDINATES
Green Hill 1	5B02 to 5B05	00-60-02-8F
Green Hill 2	5B06 to 5B09	00-40-02-AF
01-00	5B0A to 5B0D	00-60-02-8F
01-01	5B0E to 5B11	00-40-02-AF
Wood 1	5B12 to 5B15	00-60-01-AC
Wood 2	5B16 to 5B19	00-40-01-AC
03-00	5B1A to 5B1D	00-60-02-8F
03-01	5B1E to 5B21	00-40-02-AF
Metropolis 1	5B22 to 5B25	00-60-02-8C
Metropolis 2	5B26 to 5B29	00-40-05-EC
Metropolis 3	5B2A to 5B2D	00-60-01-EC
05-01	5B2E to 5B31	00-40-02-AF
06-00	5B32 to 5B35	00-60-02-8F
06-01	5B36 to 5B39	00-40-02-AF
Hill Top 1	5B3A to 5B3D	00-40-03-AF
Hill Top 2	5B3E to 5B41	00-40-06-8F
Hidden Palace 1	5B42 to 5B45	02-30-01-AC
Hidden Palace 2	5B46 to 5B49	00-30-01-BD
09-00	5B4A to 5B4D	00-60-02-8F
09-01	5B4E to 5B51	00-40-02-AF
Oil Ocean 1	5B52 to 5B55	00-60-06-AC
Oil Ocean 2	5B56 to 5B59	00-50-05-6C
Dust Hill 1	5B5A to 5B5D	00-60-06-AC
Dust Hill 2	5B5E to 5B61	00-60-05-AC
Casino Night 1	5B62 to 5B65	00-60-02-8F
Casino Night 2	5B66 to 5B69	00-40-02-AF
Chemical Plant 1	5B6A to 5B6D	00-30-01-EC
Chemical Plant 2	5B6E to 5B71	00-30-01-2C
Genocide City 1	5B72 to 5B75	00-60-02-8F
Genocide City 2	5B76 to 5B79	00-40-02-AF
Neo Green Hill 1	5B7A to 5B7D	00-50-03-7C
Neo Green Hill 2	5B7E to 5B81	00-50-03-7C
Death Egg 1	5B82 to 5B85	00-60-02-8F
Death Egg 2	5B86 to 5B89	00-40-02-AF

Debug

In this part you can define which the objects will be loaded during the way debug. See as configuring the debug. (If you go a researcher of Roms, he/she will see objects that are disabled in the way debug). THE Format to configure the objects in the way debug is OO-PPPPPP-VV-SSSSSS where: OO is the object, PPPPPP it is the point of assembly of the object (it Consults the properties of the OBJECTS to catch this information), VV is the variant of the object and SSSSSS it is the address of the sprite regarding the object in V-RAM (necessary Sprite has to be loaded in V-RAM). To have success in the configuration he chooses an existent object in the level (You can use of another level, but he had needed to do special configurations). For you to understand the format I will get an object of GREEN HILL, that is to say the monitor. former: 26-00B6D2-07-00-0680. Separating the bytes has: 26 monitors, 00B6D2 Point of Assembly of the monitors, 07 monitor of invincibility, 00 frame set and 0680 search of Sprite in VRAM. Now see below in the table the location of the levels for DEBUG.

LEVELS	OFFSETS	Quantity of Objects
GREEN HILL	23DF2	18 (*)
METROPOLIS	23ECC	28
HILL TOP	23FAE	19
HIDDEN PALACE	24078	8 (*)
OIL OCEAN	240F2	16 (*)
DUST HILL	24194	16
CASINO NIGHT	24216	02
CHEMICAL PLANT	24228	18
NEO GREEN HILL	242C2	17
All the incomplete levels	23DE0	02

(*) All these levels can have more objects, because they have objects for the debug that are disabled. If you move in the pointers it can activate these objects. Activating these objects you will have the ALLIGATOR, the RHINOCEROS and a PIRANHA in GREEN HILL and in HIDDEN PALACE, even so without SPRITES because they are not usually loaded in VRAM.

Lives

In this part you can define with how many lives the game it begins. You can select up to 255 lives, even so above 99 the counter won't show the real number. The table below exhibition the values pattern of the Game. For example if you want to begin with 10 lives he/she should type the value in hexadecimal that is to say 0A.

ADDRESS	BYTE	DESCRIPTION
3B1B	03	Normal Mode
3BFB	03	Demo Mode

Rings

In this part you can select the value of each ring. You to choose that each ring to the ditch from 0 to 8 to be collected. If you want a difficult game he/she makes each ring to be worth 0. he/she Sees the table I lower a relationship of the possible values for the rings.

ADDRESS	BYTE	1 RING =
AD22 - AD23	50-F0	0
AD22 - AD23	52-78	1 (padrão)
AD22 - AD23	54-78	2
AD22 - AD23	56-78	3
AD22 - AD23	58-78	4
AD22 - AD23	5A-78	5
AD22 - AD23	5C-78	6
AD22 - AD23	5E-78	7
AD22 - AD23	50-78	8

Lost objects

0xAEB6 - Big Ring (Sonic 1) (part 1)

0xAF80 - Big Ring (Sonic 1) (part 2)

0xC068 - Special Stage - Title Cards

0x13F00-Springs - Special Stage (Sonic 1)

0x1405C - Oxygen (Sonic 1)

Misc. Options

0x38A - 0004 move to 0000 Start With Sega Logo.

0x1F30 - Palette Cicling Pointers

0x3926 - 0001 -> Enable / 0000 ->Disable Level Select Menu

0x3D3B - First number in the Sound Test (80)

0x4CCA - Skip End Level art Settings

0x5BC8 - Bg Screen Size Pointers

0x5E16 - Bg Scrool Pointers

0x7A26 - Boss and Misc Settings Pointers

0x22408 - Animated Sprites (Load in Vram) Pointers

0x229A2 - Animated Sprites (Assembly) Pointers

0x23DBE - Debug Mode Pointers

0x50000 - Sonic Sprites (Uncompressed)

0x6254C - Tails Sprites (Uncompressed)