Esrael s2k

From Sonic Retro

Historical document icon.svg This historical hacking document is preserved here for archival purposes.
It has not been revised since its original writing and may be outdated.

Using a hex editor it is possible to modify Sonic 2 & Knuckles, editing it byte by byte. By knowing where each function is and modifying it correctly, it is possible to customize the game. You can draw another character in Knuckles' place, but it's not very easy, because it needs to be drawn pixel by pixel. You can change the level names in the level select menu and in the level title cards. But to program the game, it needs to be in the binary format. It isn't hard to convert the game to binary form. You can use a conversion program or the Genecyst emulator's DUMP ROM option, which does the conversion.

In spite of Sonic 2 & Knuckles being just Sonic 2 coupled with Sonic & Knuckles, this game can be considered a new version of Sonic 2, because Sonic & Knuckles, after identifying that the cartridge attached is Sonic 2, activates a memory that is at the end of the two games, and this memory contains all the game code, only using the Sonic 2 cartridge for the graphs and maps of the levels. In this guide, you will see that the information that's altered in most of the cases is above the address $300000, where the extra memory is stored, and a few things are in the addresses $200000 to $2FFFFF, where Sonic 2 is stored in memory. Because of this, Sonic 2 & Knuckles can be considered to be a completely new game, using Sonic 2's engine and data, and starring Knuckles.

Level IDs

Observe the table below with the levels and their respective IDs. These IDs are important because the game uses them for referencing the levels.

Level ID
Emerald Hill 00
Metropolis 04
Metropolis 05
Wing Fortress 06
Hill Top 07
Oil Ocean 0A
Mystic Cave 0B
Casino Night 0C
Chemical Plant 0D
Death Egg 0E
Aquatic Ruin 0F
Sky Chase 10

Note that some numbers are skipped, like 01, 03, 06 and 09. Although these do not have level names and are not in the level select, if you place these IDs, you can access lost levels (try it and see the results). The table below gives the location of the level IDs for each level in the level select menu. The first address in the table is for the zone byte, and the second for the act byte. For example, at the address $307916 you will see the byte 07 (Hill Top Zone) and at the address $307917 you will see the byte 00 (Act 1).

Level Act Address
Emerald Hill Act 1 $307906-$307907
Act 2 $307908-$307909
Chemical Plant Act 1 $30790A-$30790B
Act 2 $30790C-$30790D
Aquatic Ruin Act 1 $30790E-$30790F
Act 2 $307910-$307911
Casino Night Act 1 $307912-$307913
Act 2 $307914-$307915
Hill Top Act 1 $307916-$307917
Act 2 $307918-$307919
Mystic Cave Act 1 $30791A-$30791B
Act 2 $30791C-$30791D
Oil Ocean Act 1 $30791E-$30791F
Act 2 $307920-$307921
Metropolis Act 1 $307922-$307923
Act 2 $307924-$307925
Act 3 $307926-$307927
Sky Chase $307928-$307927
Wing Fortress $30792A-$30792B
Death Egg $30792C-$30792D

Level Music

You can change the music which plays in each level. The format is very simple: one byte per level, that byte being the ID of the music to play. To change what music plays, play the desired music in the sound test, write down the number of the music and place it in the byte that represents the chosen level. Note that the music ID is actually equal to the music number in the sound test + $80, so remember to add $80 before placing it in the playlist. The table below gives the address of the music ID for each level:

Level Music ID Music number Address
Emerald Hill 82 02 $30397C
ID 01 82 02 $30397D
Wood Zone 85 05 $30397E
ID 03 84 04 $30397F
Metropolis 85 05 $303980
Metropolis 3 85 05 $303981
Wing Fortress 8F 0F $303982
Hill Top 86 06 $303983
Hidden Palace 90 10 $303984
ID 09 8D 0D $303985
Oil Ocean 84 04 $303986
Mystic Cave 8B 0B $303987
Casino Night 89 09 $303988
Chemical Plant 8E 0E $303989
Death Egg 8A 0A $30398A
Aquatic Ruin 87 07 $30398B
Sky Chase 8D 0D $30398C

Altering objects

You can also alter the objects in the levels such as badniks, monitors, obstacles, etc. The configuration of the objects in the levels uses 6 bytes in the format XX XX YY YY OO VV. XX XX is the horizontal position, YY YY is the vertical position, OO is the object to be placed, and VV is the object subtype. To obtain the exact location where you want to place your objects, enable debug mode and note the first line of coordinates on the HUD in the place of the score counter. These will be the coordinates that you should use for the object. The table below lists the locations of the object placement data for each level. Each level's data ends with FF FF 00 00 00 00, after which the next level's data begins.

Emerald Hill Act 1 $DF3FE
Act 2 $DF7B2
Metropolis Act 1 $DFBD2
Act 2 $E005E
Act 3 $E05A4
Wing Fortress $E0C10
Hill Top Act 1 $E1018
Act 2 $E1396
Hidden Palace $2E8C80
Oil Ocean Act 1 $E1A4A
Act 2 $E1F18
Mystic Cave Act 1 $E23DA
Act 2 $E26F2
Casino Night Act 1 $33F06E
Act 2 $33F74C
Chemical Plant Act 1 $E2A88
Act 2 $E2EFC
Death Egg $2EB230
Aquatic Ruin Act 1 $E34D8
Act 2 $E398E
Sky Chase $2EBBDE

Level Starting locations

You can change Knuckles' starting location for each level. To find out what coordinates to use, enable Debug Mode, go to your new starting location, and write down the coordinates (the top line in the HUD in place of the score counter). Refer to the table below to get the address you have to place your new coordinates at:

Level Address Default Coordinates
Emerald Hill 1 $30A488 0060028F
Emerald Hill 2 $30A48C 006002AF
01-00 $30A490 0060028F
01-01 $30A494 006002AF
Wood 1 $30A498 006001AC
Wood 2 $30A49C 006001AC
03-00 $30A4A0 0060028F
03-01 $30A4A4 006002AF
Metropolis 1 $30A4A8 0060028C
Metropolis 2 $30A4AC 006005EC
Metropolis 3 $30A4B0 0060020C
05-01 $30A4B4 006002AF
Wing Fortress 1 $30A4B8 006004CC
Wing Fortress 2 $30A4BC 01E004CC
Hill Top 1 $30A4C0 006003EF
Hill Top 2 $30A4C4 006006AF
Hidden Palace 1 $30A4C8 023001AC
Hidden Palace 2 $30A4CC 023001AC
09-00 $30A4D0 0060028F
09-01 $30A4D4 006002AF
Oil Ocean 1 $30A4D8 006006AC
Oil Ocean 2 $30A4DC 0060056C
Mystic Cave 1 $30A4E0 006006AC
Mystic Cave 2 $30A4E4 006005AC
Casino Night 1 $30A4E8 006002AC
Casino Night 2 $30A4EC 0060058C
Chemical Plant 1 $30A4F0 006001EC
Chemical Plant 2 $30A4F4 0060012C
Death Egg 1 $30A4F8 0060012D
Death Egg 2 $30A4FC 0060012D
Aquatic Ruin 1 $30A500 0060037E
Aquatic Ruin 2 $30A504 0060037E
Sky Chase 1 $30A508 01200070
Sky Chase 2 $30A50C 01400070


In this game, the Sega logo, title screen, levels, special stages, etc. are different events and have IDs assigned to them. The table below lists the ID and starting code location of each event. The IDs go in units of 4, and by knowing the exact initialization place of the events you can reprogram them without affecting the operation of the game.

Event ID Code
Sega Logo 00 $303310
Screen Titles 04 $3034E8
Demo Mode 08 $3039A0
Normal Gameplay 0C $3039A0
Special Stage 10 $304A0A
Continue 14 $3072A6
Level Select Menu 18-1C $3076C2
End Sequence 20 $308008
Level Select Menu 24 $3076C2

Cheat Codes

Level Select Code

You can alter the codes used in the game. The code for the Level Select Menu is Up, Up, Up, Down, Down, Down, Left, Right, Left, Right. In the ROM this code is stored in the Motorola key format, and you can simply alter it by placing new key values. The code is stored at the address $3038E2, and consists of the following bytes: 01 01 01 02 02 02 04 08 04 08 00 FF, where 01 is Up, 02 is Down, 04 is Left, 08 is Right, and 00 FF indicates the end of the code. You can modify this code as you wish, but remember to keep the bytes 00 FF at the end so the game knows the code has ended. Summary:

Code Location
Level Select Menu $3038E2-$3038ED
Key Value
Up 01
Down 02
Left 04
Right 08

Debug Mode and Super Knuckles

These codes are used from the level select menu and are inserted in the sound test by playing the respective music. They are easier to alter because they are stored in ROM in the same way they are typed in Sound Test. The only difference from the level select code is that FF is used to indicate the end of the code rather than 00 FF. The table below lists the locations of the codes:

Event Code Location
Debug Mode 01,09,09,04,01,00,01,08 $307C7A-$307C81
All Emeralds (Super Knuckles) 01,06,07,07,07,02,01,06 $307C83-$307C8A


You will see the codes of Sonic 2 alone in this game. Even though they do not work, the Oil Ocean music bug (after entering the 14 continues cheat) has been fixed, because if you observe the address $307C4C you will see the bytes 10 3C 00 BF and not 10 3C 00 3F, which is what is present in the Sonic 2 ROM and causes the music lock. This bug is not even fixed in Sonic Jam. Many other bugs that happen in Sonic 2 don't happen in this version. For example, the bug where the game freezes if you enter object placement mode after dying and place an object does not occur in this game.


Sonic Community Hacking Guide
SonED2 Manual | Subroutine Equivalency List
Sonic the Hedgehog (16-bit) | Sonic the Hedgehog (8-bit) | Sonic CD (prototype 510) | Sonic CD | Sonic CD (PC) | Sonic CD (2011) | Sonic 2 (Simon Wai prototype) | Sonic 2 (16-bit) | Sonic 2 (Master System) | Sonic 3 | Sonic 3 & Knuckles | Chaotix | Sonic Jam | Sonic Jam 6 | Sonic Adventure | Sonic Adventure DX: Director's Cut | Sonic Adventure DX: PC | Sonic Adventure (2010) | Sonic Adventure 2 | Sonic Adventure 2: Battle | Sonic Adventure 2 (PC) | Sonic Heroes | Sonic Riders | Sonic the Hedgehog (2006) | Sonic & Sega All-Stars Racing | Sonic Unleashed (Xbox 360/PS3) | Sonic Colours | Sonic Generations | Sonic Forces
Technical information
Sonic Eraser | Sonic 2 (Nick Arcade prototype) | Sonic CD (prototype; 1992-12-04) | Dr. Robotnik's Mean Bean Machine | Sonic Triple Trouble | Tails Adventures | Sonic Crackers | Sonic 3D: Flickies' Island | Sonic & Knuckles Collection | Sonic R | Sonic Shuffle | Sonic Advance | Sonic Advance 3 | Sonic Battle | Shadow the Hedgehog | Sonic Rush | Sonic Classic Collection | Sonic Free Riders | Sonic Lost World
Legacy Guides
The Nemesis Hacking Guides The Esrael Hacking Guides
ROM: Sonic 1 | Sonic 2 | Sonic 2 Beta | Sonic 3

Savestate: Sonic 1 | Sonic 2 Beta/Final | Sonic 3

Sonic 1 (English / Portuguese) | Sonic 2 Beta (English / Portuguese) | Sonic 2 and Knuckles (English / Portuguese)
Move to Sega Retro
Number Systems (or scrap) | Assembly Hacking Guide | 68000 Instruction Set | 68000 ASM-to-Hex Code Reference | SMPS Music Hacking Guide | Mega Drive technical information