Esrael s2k
From Sonic Retro
|
This historical hacking document is preserved here for archival purposes. It has not been revised since its original writing and may be outdated. |
Using a hex editor it is possible to modify Sonic 2 & Knuckles, editing it byte by byte. By knowing where each function is and modifying it correctly, it is possible to customize the game. You can draw another character in Knuckles' place, but it's not very easy, because it needs to be drawn pixel by pixel. You can change the level names in the level select menu and in the level title cards. But to program the game, it needs to be in the binary format. It isn't hard to convert the game to binary form. You can use a conversion program or the Genecyst emulator's DUMP ROM option, which does the conversion.
In spite of Sonic 2 & Knuckles being just Sonic 2 coupled with Sonic & Knuckles, this game can be considered a new version of Sonic 2, because Sonic & Knuckles, after identifying that the cartridge attached is Sonic 2, activates a memory that is at the end of the two games, and this memory contains all the game code, only using the Sonic 2 cartridge for the graphs and maps of the levels. In this guide, you will see that the information that's altered in most of the cases is above the address $300000, where the extra memory is stored, and a few things are in the addresses $200000 to $2FFFFF, where Sonic 2 is stored in memory. Because of this, Sonic 2 & Knuckles can be considered to be a completely new game, using Sonic 2's engine and data, and starring Knuckles.
Contents
Level IDs
Observe the table below with the levels and their respective IDs. These IDs are important because the game uses them for referencing the levels.
| Level | ID |
|---|---|
| Emerald Hill | 00 |
| Metropolis | 04 |
| Metropolis | 05 |
| Wing Fortress | 06 |
| Hill Top | 07 |
| Oil Ocean | 0A |
| Mystic Cave | 0B |
| Casino Night | 0C |
| Chemical Plant | 0D |
| Death Egg | 0E |
| Aquatic Ruin | 0F |
| Sky Chase | 10 |
Note that some numbers are skipped, like 01, 03, 06 and 09. Although these do not have level names and are not in the level select, if you place these IDs, you can access lost levels (try it and see the results). The table below gives the location of the level IDs for each level in the level select menu. The first address in the table is for the zone byte, and the second for the act byte. For example, at the address $307916 you will see the byte 07 (Hill Top Zone) and at the address $307917 you will see the byte 00 (Act 1).
| Level | Act | Address |
|---|---|---|
| Emerald Hill | Act 1 | $307906-$307907 |
| Act 2 | $307908-$307909 | |
| Chemical Plant | Act 1 | $30790A-$30790B |
| Act 2 | $30790C-$30790D | |
| Aquatic Ruin | Act 1 | $30790E-$30790F |
| Act 2 | $307910-$307911 | |
| Casino Night | Act 1 | $307912-$307913 |
| Act 2 | $307914-$307915 | |
| Hill Top | Act 1 | $307916-$307917 |
| Act 2 | $307918-$307919 | |
| Mystic Cave | Act 1 | $30791A-$30791B |
| Act 2 | $30791C-$30791D | |
| Oil Ocean | Act 1 | $30791E-$30791F |
| Act 2 | $307920-$307921 | |
| Metropolis | Act 1 | $307922-$307923 |
| Act 2 | $307924-$307925 | |
| Act 3 | $307926-$307927 | |
| Sky Chase | $307928-$307927 | |
| Wing Fortress | $30792A-$30792B | |
| Death Egg | $30792C-$30792D |
Level Music
You can change the music which plays in each level. The format is very simple: one byte per level, that byte being the ID of the music to play. To change what music plays, play the desired music in the sound test, write down the number of the music and place it in the byte that represents the chosen level. Note that the music ID is actually equal to the music number in the sound test + $80, so remember to add $80 before placing it in the playlist. The table below gives the address of the music ID for each level:
| Level | Music ID | Music number | Address |
|---|---|---|---|
| Emerald Hill | 82 | 02 | $30397C |
| ID 01 | 82 | 02 | $30397D |
| Wood Zone | 85 | 05 | $30397E |
| ID 03 | 84 | 04 | $30397F |
| Metropolis | 85 | 05 | $303980 |
| Metropolis 3 | 85 | 05 | $303981 |
| Wing Fortress | 8F | 0F | $303982 |
| Hill Top | 86 | 06 | $303983 |
| Hidden Palace | 90 | 10 | $303984 |
| ID 09 | 8D | 0D | $303985 |
| Oil Ocean | 84 | 04 | $303986 |
| Mystic Cave | 8B | 0B | $303987 |
| Casino Night | 89 | 09 | $303988 |
| Chemical Plant | 8E | 0E | $303989 |
| Death Egg | 8A | 0A | $30398A |
| Aquatic Ruin | 87 | 07 | $30398B |
| Sky Chase | 8D | 0D | $30398C |
Altering objects
You can also alter the objects in the levels such as badniks, monitors, obstacles, etc. The configuration of the objects in the levels uses 6 bytes in the format XX XX YY YY OO VV. XX XX is the horizontal position, YY YY is the vertical position, OO is the object to be placed, and VV is the object subtype. To obtain the exact location where you want to place your objects, enable debug mode and note the first line of coordinates on the HUD in the place of the score counter. These will be the coordinates that you should use for the object. The table below lists the locations of the object placement data for each level. Each level's data ends with FF FF 00 00 00 00, after which the next level's data begins.
| Emerald Hill | Act 1 | $DF3FE |
| Act 2 | $DF7B2 | |
| Metropolis | Act 1 | $DFBD2 |
| Act 2 | $E005E | |
| Act 3 | $E05A4 | |
| Wing Fortress | $E0C10 | |
| Hill Top | Act 1 | $E1018 |
| Act 2 | $E1396 | |
| Hidden Palace | $2E8C80 | |
| Oil Ocean | Act 1 | $E1A4A |
| Act 2 | $E1F18 | |
| Mystic Cave | Act 1 | $E23DA |
| Act 2 | $E26F2 | |
| Casino Night | Act 1 | $33F06E |
| Act 2 | $33F74C | |
| Chemical Plant | Act 1 | $E2A88 |
| Act 2 | $E2EFC | |
| Death Egg | $2EB230 | |
| Aquatic Ruin | Act 1 | $E34D8 |
| Act 2 | $E398E | |
| Sky Chase | $2EBBDE |
Level Starting locations
You can change Knuckles' starting location for each level. To find out what coordinates to use, enable Debug Mode, go to your new starting location, and write down the coordinates (the top line in the HUD in place of the score counter). Refer to the table below to get the address you have to place your new coordinates at:
| Level | Address | Default Coordinates |
|---|---|---|
| Emerald Hill 1 | $30A488 | 0060028F |
| Emerald Hill 2 | $30A48C | 006002AF |
| 01-00 | $30A490 | 0060028F |
| 01-01 | $30A494 | 006002AF |
| Wood 1 | $30A498 | 006001AC |
| Wood 2 | $30A49C | 006001AC |
| 03-00 | $30A4A0 | 0060028F |
| 03-01 | $30A4A4 | 006002AF |
| Metropolis 1 | $30A4A8 | 0060028C |
| Metropolis 2 | $30A4AC | 006005EC |
| Metropolis 3 | $30A4B0 | 0060020C |
| 05-01 | $30A4B4 | 006002AF |
| Wing Fortress 1 | $30A4B8 | 006004CC |
| Wing Fortress 2 | $30A4BC | 01E004CC |
| Hill Top 1 | $30A4C0 | 006003EF |
| Hill Top 2 | $30A4C4 | 006006AF |
| Hidden Palace 1 | $30A4C8 | 023001AC |
| Hidden Palace 2 | $30A4CC | 023001AC |
| 09-00 | $30A4D0 | 0060028F |
| 09-01 | $30A4D4 | 006002AF |
| Oil Ocean 1 | $30A4D8 | 006006AC |
| Oil Ocean 2 | $30A4DC | 0060056C |
| Mystic Cave 1 | $30A4E0 | 006006AC |
| Mystic Cave 2 | $30A4E4 | 006005AC |
| Casino Night 1 | $30A4E8 | 006002AC |
| Casino Night 2 | $30A4EC | 0060058C |
| Chemical Plant 1 | $30A4F0 | 006001EC |
| Chemical Plant 2 | $30A4F4 | 0060012C |
| Death Egg 1 | $30A4F8 | 0060012D |
| Death Egg 2 | $30A4FC | 0060012D |
| Aquatic Ruin 1 | $30A500 | 0060037E |
| Aquatic Ruin 2 | $30A504 | 0060037E |
| Sky Chase 1 | $30A508 | 01200070 |
| Sky Chase 2 | $30A50C | 01400070 |
Events
In this game, the Sega logo, title screen, levels, special stages, etc. are different events and have IDs assigned to them. The table below lists the ID and starting code location of each event. The IDs go in units of 4, and by knowing the exact initialization place of the events you can reprogram them without affecting the operation of the game.
| Event | ID | Code |
|---|---|---|
| Sega Logo | 00 | $303310 |
| Screen Titles | 04 | $3034E8 |
| Demo Mode | 08 | $3039A0 |
| Normal Gameplay | 0C | $3039A0 |
| Special Stage | 10 | $304A0A |
| Continue | 14 | $3072A6 |
| Level Select Menu | 18-1C | $3076C2 |
| End Sequence | 20 | $308008 |
| Level Select Menu | 24 | $3076C2 |
Cheat Codes
Level Select Code
You can alter the codes used in the game. The code for the Level Select Menu is 
, , , 
, , , 
, 
, , . In the ROM this code is stored in the Motorola key format, and you can simply alter it by placing new key values. The code is stored at the address $3038E2, and consists of the following bytes: 01 01 01 02 02 02 04 08 04 08 00 FF, where 01 is , 02 is , 04 is , 08 is , and 00 FF indicates the end of the code. You can modify this code as you wish, but remember to keep the bytes 00 FF at the end so the game knows the code has ended. Summary:
| Code | Location |
|---|---|
| Level Select Menu | $3038E2-$3038ED |
| Key | Value |
|
|
01 |
|
|
02 |
|
|
04 |
|
|
08 |
Debug Mode and Super Knuckles
These codes are used from the level select menu and are inserted in the sound test by playing the respective music. They are easier to alter because they are stored in ROM in the same way they are typed in Sound Test. The only difference from the level select code is that FF is used to indicate the end of the code rather than 00 FF. The table below lists the locations of the codes:
| Event | Code | Location |
|---|---|---|
| Debug Mode | 01,09,09,04,01,00,01,08 | $307C7A-$307C81 |
| All Emeralds (Super Knuckles) | 01,06,07,07,07,02,01,06 | $307C83-$307C8A |
Curiosities
You will see the codes of Sonic 2 alone in this game. Even though they do not work, the Oil Ocean music bug (after entering the 14 continues cheat) has been fixed, because if you observe the address $307C4C you will see the bytes 10 3C 00 BF and not 10 3C 00 3F, which is what is present in the Sonic 2 ROM and causes the music lock. This bug is not even fixed in Sonic Jam. Many other bugs that happen in Sonic 2 don't happen in this version. For example, the bug where the game freezes if you enter object placement mode after dying and place an object does not occur in this game.
References