Actions

SCHG

Nem s3

From Sonic Retro

Historical document icon.svg

This historical hacking document is preserved here for archival purposes.
It has not been revised since its original writing and may be outdated. For an SCHG-equivalent document, see SCHG:Sonic 3.


Introduction

Here are my hacking notes on the Sonic 3 rom. If you use these notes I'd appreciate it if you would mention it with your hack or your utility, so that other people can find their way here. For hex editing I recommend you use a hex utility called Hex Workshop, and for emulators I recommend you get both Gens and Genecyst. Genecyst may be old and kinda crap, but it has a whole heap of debug outputs that really help when it comes to seeing exactly what it's doing and when.

First of all it's very important that you understand the basics. All data stored on a computer is in the form of 1's and 0's. On a CD for example, a laser hits the surface, and if the laser bounces back and hits the lens it's a 1, and if it doesn't it's a zero. Each 1 or 0 is called a bit, and a bit cannot have any other characters in it other that a 1 or a 0. Now the computer deals with bits in groups of 4. There are 16 possible combinations for a group of four 1's and 0's, so to make it simpler it deals with it as one value, rather than 4 (Eg. 0110 becomes 6). Now as there are 16 possible combinations for a group of 4 bits, this value to represent their values must have 16 values itself, so rather than a simple 0-9, this value is 0-F (0123456789ABCDEF). This value is called a hexadecimal value (hex value for short). Each hex value is dealt with in groups of 2, called a byte, each byte having 128 possible combinations. Now on a final output level the byte may be looked up on an ASCII table, which will convert that value into a recognisable character (Eg. a byte value of 73 becomes a lowercase s on an English ASCII table). You will practically never touch the ASCII version of the code in hacking though.

Now one important thing to realise is that as one character of hex has 16 values and a decimal (real) value only has 10, it may be necessary to convert the numbers between them from time to time. This is done with the use of a base converter (included in hex workshop). Let's say you wanted to give Sonic 50 rings. If you enter 50 as the value, you will in fact end up with 80, because that value you are entering is actually a hex value, but if you use the base converter to convert it first, you merely enter the value of 50 into the decimal box, and it will spit out a hex value of 32, which will in fact give you 50 rings in the game. Another useful utility that you will need is a hex calculator (also included in hex workshop). A hex calculator is the same as a normal calculator, but it deals with hex values rather than decimal values.

Another thing you need to know is that each level in Sonic 3 has a value assigned to it, but this value does not correspond with each level's final position in the game. Here is a list of the level values in Sonic 3:

00 Angel island zone
01 Hydrocity zone
02 Marble garden zone
03 Carnival Night zone
04 Flying Battery zone
05 Ice cap zone
06 launch base zone
07 Empty
08 Empty
09 Empty
0A Empty
0B Empty
0C Empty
0D Empty
0E Azure Lake
0F Balloon Park
10 Chrome Gadget
11 Desert Palace
12 Endless Mine
13 Bonus Stage
14 Empty
15 Empty
16 Empty
17 Empty

One other thing you need to know is the way that the Mega Drive stores all the art. All the art that is used in the game is stored in the form of 8x8 pixel blocks. These blocks do not actually store colours at all, they actually only have one hex value per pixel. That value specifies what point on the palette line the pixel will get its colour from. The palette has 4 lines, each with 16 colours on them. Now the colours on the palette can be changed at any point during play, and some palette colours may even automatically change colour each couple of frames to make it look like the colour is flashing.

Now these 8x8 blocks are not what make up the level directly. 4 8x8 blocks are grouped together to form a 16x16 block, and it is at this point that the palette line to use for that 16x16 block is specified. The 8x8 patterns can also have their x, y, or x and y values reversed when placing them in a 16x16 block. Also it's at the 16x16 level that the collision definitions are specified. Now finally we get to a 128x128 block, and these are the things that the actual level info loads. It is made up of 64 16x16 blocks, and each block inside them can use a different palette line. You cannot place anything except a sprite or a 128x128 block directly into a level.

Now that you know all the basics, here's my breakdown:

Address Listing

For the most part, there are no breaks in this list. If one address follows on directly from another on this list, it does so in the rom, with the exception of data that comes before 50000. All the compiled code that is used in the game is stored in this section, and that's a pain in the ass to sort through, so there will be many breaks there. The column on the left lists it's file location, the column in the middle contains it's name and description, and the column on the right will contain any special notes about it, such as compression format used if applicable, and number of blocks an art tile uses. The right column will also contain a link with the text further info, if that particular block requires it. That link will jump to a detailed explanation of that thing. Anything linked like that will also be listed in the contents at the top of the page. Any patterns that are not used anywhere in the game will be preceeded by this red dot Reddot.gif .

See SCHG:Nem s3/Address listing.

Offset indexes

An offset index is a handy way of keeping a block of data grouped together, and also replacing a whole heap of pointers. The way it works is there is a list of two byte vaues, and depending on the block of data the game wants to load, it will take one of those values and add it to the starting address of the offset index. The most common usage is for every act of every level value, there is an offset that acts as the pointer to the block of data to use for it. Lets look at an example:

5AF8C: 00F8 0112 012C 0140 0148 0150 0158 016C

This is the beginning of the offset index for the pattern load cue's. If the game was trying to access the second pattern load cue, it would take the pointer to the offset index which is 5AF8C, and it would jump to the second offset, which in this case is 0112. It would then add that value to the location of the offset index, and that gives the location of the data.

5AF8C + 0112 = 5B09E

So in this case the data is located at 5B09E in the rom. This type of system is used for many things in the rom such as pattern load cue's, sprite mappings, etc.

Pointer list

A pointer list is simply a block of pointers. Pointers are a 4 byte number that gives the location of data. This location is listed on the lefthand side of a hex editor. The most common use of a pointer list in the game is to specify a block of data to be used in conjunction with each level or act. Simply count across to the pointer you wish to modify. For example, if you want to change the pointer to the data for HCZ act 1, and it's done on an act by act basis, you'll want to modify the third pointer in the list, which would be 8 bytes along.

Main level load block

This pointer table is what is used to load up the block mappings and main level patterns for every level in the game. Here's a breakdown of the pointer table in the S3 rom:

5AB0C-5AF8B: Main level load blocks (Bpatterns/Epatterns/B16x16/E16x16/B128x128/E128x128)

5AB0C-5AB3B: Angel Island zone (00)
5AB0C-5AB23: Act 1
5AB0C: AIZ act 1 base tiles (1A566A) [0B]
5AB10: AIZ act 1 extended tiles (1A647C) [0B]
5AB14: AIZ act 1 base 16x16 block mappings (1A374A) [0A]
5AB18: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AB1C: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AB20: AIZ act 1 128x128 block mappings (1ABC40) [00]


5AB24-5AB3B: Act 2
5AB24: AIZ act 2 base tiles (1B15D2) [0C]
5AB28: AIZ act 2 extended tiles (1B3784) [0C]
5AB2C: AIZ act 2 base 16x16 block mappings (1B0052) [0B]
5AB30: AIZ act 2 extended 16x16 block mappings (1B08F2) [0B]
5AB34: AIZ act 2 128x128 block mappings (1B51E8) [00]
5AB38: AIZ act 2 128x128 block mappings (1B51E8) [00]
5AB3C-5AB6B: Hydrocity zone (01)
5AB3C-5AB53: Act 1
5AB3C: HCZ base tiles (1B9668) [0E]
5AB40: HCZ act 1 extended tiles (1BAE7A) [0F]
5AB44: HCZ base 16x16 block mappings (1B91F8) [0C]
5AB48: HCZ act 1 extended 16x16 block mappings (1BA5EA) [0C]
5AB4C: HCZ base 128x128 block mappings (1BA2AA) [00]
5AB50: HCZ act 1 extended 128x128 block mappings (1BD0CC) [00]
5AB54-5AB6B: Act 2
5AB54: HCZ base tiles (1B9668) [10]
5AB58: HCZ act 2 extended tiles (1BFA6C) [11]
5AB5C: HCZ base 16x16 block mappings (1B91F8) [0D]
5AB60: HCZ act 2 extended 16x16 block mappings (1BF17C) [0D]
5AB64: HCZ base 128x128 block mappings (1BA2AA) [00]
5AB68: HCZ act 2 extended 128x128 block mappings (1C18EE) [00]
5AB6C-5AB9B: Marble Garden zone (02)
5AB6C-5AB83: Act 1
5AB6C: MGZ base tiles (1C3EBE) [12]
5AB70: MGZ act 1 extended tiles (1C8A70) [12]
5AB74: MGZ base 16x16 block mappings (1C356E) [0E]
5AB78: MGZ act 1 extended 16x16 block mappings (1C8760) [0E]
5AB7C: MGZ base 128x128 block mappings (1C6460) [00]
5AB80: MGZ act 1 extended 128x128 block mappings (1C9452) [00]
5AB84-5AB9B: Act 2
5AB84: MGZ base tiles (1C3EBE) [14]
5AB88: MGZ act 2 extended tiles (1CA132) [14]
5AB8C: MGZ base 16x16 block mappings (1C356E) [0F]
5AB90: MGZ act 2 extended 16x16 block mappings (1C9CD2) [0F]
5AB94: MGZ base 128x128 block mappings (1C6460) [00]
5AB98: MGZ act 2 extended 128x128 block mappings (1CB1C4) [00]
5AB9C-5ABCB: Carnival Night zone
5AB9C-5ABB3: Act 1
5AB9C: CNZ tiles (1CDC74) [16]
5ABA0: CNZ tiles (1CDC74) [17]
5ABA4: CNZ 16x16 block mappings (1CCC34) [10]
5ABA8: CNZ 16x16 block mappings (1CCC34) [10]
5ABAC: CNZ 128x128 block mappings (1D0E96) [00]
5ABB0: CNZ 128x128 block mappings (1D0E96) [00]
5ABB4-5ABCB: Act 2
5ABB4: CNZ tiles (1CDC74) [18]
5ABB8: CNZ tiles (1CDC74) [19]
5ABBC: CNZ 16x16 block mappings (1CCC34) [11]
5ABC0: CNZ 16x16 block mappings (1CCC34) [11]
5ABC4: CNZ 128x128 block mappings (1D0E96) [00]
5ABC8: CNZ 128x128 block mappings (1D0E96) [00]
5ABCC-5ABFB: Flying battery zone (04)

MEDIAWIKI WON'T ACCEPT THIS BLOCK?

5ABE4-5ABFB: Act 2
5ABE4: ICZ base 16x16 block mappings (1D3FB6) [1C]
5ABE8: ICZ base 16x16 block mappings (1D3FB6) [1C]
5ABEC: ICZ base 16x16 block mappings (1D3FB6) [13]
5ABF0: ICZ base 16x16 block mappings (1D3FB6) [13]
5ABF4: ICZ base 16x16 block mappings (1D3FB6) [00]
5ABF8: ICZ base 16x16 block mappings (1D3FB6) [00]
5ABFC-5AC2B: Ice Cap zone (05)
5ABFC-5AC13: Act 1
5ABFC: ICZ base tiles (1D4296) [1E]
5AC00: ICZ act 1 extended tiles (1D64C8) [1E]
5AC04: ICZ base 16x16 block mappings (1D3FB6) [14]
5AC08: ICZ act 1 extended 16x16 block mappings (1D5958) [14]
5AC0C: ICZ base 128x128 block mappings (1D56A8) [00]
5AC10: ICZ act 1 extended 128x128 block mappings (1D844A) [00]
5AC14-5AC2C: Act 2
5AC14: ICZ base tiles (1D4296) [20]
5AC18: ICZ act 2 extended tiles (1DAF0A) [20]
5AC1C: ICZ base 16x16 block mappings (1D3FB6) [15]
5AC20: ICZ act 2 extended 16x16 block mappings (1DA26A) [15]
5AC24: ICZ base 128x128 block mappings (1D56A8) [00]
5AC28: ICZ act 2 extended 128x128 block mappings (1DCFBC) [00]
5AC2C-5AC5B: Launch base zone (06)
5AC2C-5AC43: Act 1
5AC2C: LBZ base tiles (1DFABC) [22]
5AC30: LBZ act 1 extended tiles (1E120E) [22]
5AC34: LBZ base 16x16 block mappings (1DEA8C) [16]
5AC38: LBZ act 1 extended 16x16 block mappings (1DEFCC) [16]
5AC3C: LBZ act 1 128x128 block mappings (1E2FA0) [00]
5AC40: LBZ act 1 128x128 block mappings (1E2FA0) [00]
5AC44-5AC5B: Act 2
5AC44: LBZ base tiles (1DFABC) [24]
5AC48: LBZ act 2 extended tiles (1E77D0) [25]
5AC4C: LBZ base 16x16 block mappings (1DEA8C) [17]
5AC50: LBZ act 2 extended 16x16 block mappings (1E5F70) [17]
5AC54: LBZ act 2 128x128 block mappings (1EAF04) [00]
5AC58: LBZ act 2 128x128 block mappings (1EAF04) [00]
5AC5C-5AC8B: Empty (07)
5AC5C-5AC73: Act 1
5AC5C: AL 16x16 block mappings (1EE0C4) [26]
5AC60: AL 16x16 block mappings (1EE0C4) [26]
5AC64: AL 16x16 block mappings (1EE0C4) [18]
5AC68: AL 16x16 block mappings (1EE0C4) [18]
5AC6C: AL 16x16 block mappings (1EE0C4) [00]
5AC70: AL 16x16 block mappings (1EE0C4) [00]
5AC74-5AC8B: Act 2
5AC74: AL 16x16 block mappings (1EE0C4) [28]
5AC78: AL 16x16 block mappings (1EE0C4) [28]
5AC7C: AL 16x16 block mappings (1EE0C4) [19]
5AC80: AL 16x16 block mappings (1EE0C4) [19]
5AC84: AL 16x16 block mappings (1EE0C4) [00]
5AC88: AL 16x16 block mappings (1EE0C4) [00]
5AC8C-5ACBB: Empty (08)
5AC8C-5ACA3: Act 1
5AC8C: AIZ act 1 base tiles (1A566A) [0B]
5AC90: AIZ act 1 extended tiles (1A647C) [0B]
5AC94: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AC98: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AC9C: AIZ act 1 128x128 block mappings (1ABC40) [00]
5ACA0: AIZ act 1 128x128 block mappings (1ABC40) [00]
5ACA4-5ACBB: Act 2
5ACA4: AIZ act 1 base tiles (1A566A) [0C]
5ACA8: AIZ act 1 extended tiles (1A647C) [0C]
5ACAC: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5ACB0: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5ACB4: AIZ act 1 128x128 block mappings (1ABC40) [00]
5ACB8: AIZ act 1 128x128 block mappings (1ABC40) [00]
5ACBC-5ACEB: Empty (09)
5ACBC-5ACD3: Act 1
5ACBC: AL 16x16 block mappings (1EE0C4) [2E]
5ACC0: AL 16x16 block mappings (1EE0C4) [2E]
5ACC4: AL 16x16 block mappings (1EE0C4) [2E]
5ACC8: AL 16x16 block mappings (1EE0C4) [2E]
5ACCC: AL 16x16 block mappings (1EE0C4) [2E]
5ACD0: AL 16x16 block mappings (1EE0C4) [2E]
5ACD4-5ACEB: Act 2
5ACD4: AL 16x16 block mappings (1EE0C4) [2E]
5ACD8: AL 16x16 block mappings (1EE0C4) [2E]
5ACDC: AL 16x16 block mappings (1EE0C4) [2E]
5ACE0: AL 16x16 block mappings (1EE0C4) [2E]
5ACE4: AL 16x16 block mappings (1EE0C4) [2E]
5ACE8: AL 16x16 block mappings (1EE0C4) [2E]
5ACEC-5AD04: Empty (0A)
5ACEC-5AD03: Act 1
5ACEC: AIZ act 1 base tiles (1A566A) [0B]
5ACF0: AIZ act 1 extended tiles (1A647C) [0B]
5ACF4: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5ACF8: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5ACFC: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD00: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD04-5AD1B: Act 2
5AD04: AIZ act 1 base tiles (1A566A) [0C]
5AD08: AIZ act 1 extended tiles (1A647C) [0C]
5AD0C: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AD10: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AD14: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD18: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD1C-5AD4C: Empty (0B)
5AD1C-5AD33: Act 1
5AD1C: AIZ act 1 base tiles (1A566A) [0B]
5AD20: AIZ act 1 extended tiles (1A647C) [0B]
5AD24: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AD28: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AD2C: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD30: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD34-5AD4B: Act 2
5AD34: AIZ act 1 base tiles (1A566A) [0C]
5AD38: AIZ act 1 extended tiles (1A647C) [0C]
5AD3C: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AD40: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AD44: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD48: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD4C-5AD7B: Empty (0C)
5AD4C-5AD63: Act 1
5AD4C: AIZ act 1 base tiles (1A566A) [0B]
5AD50: AIZ act 1 extended tiles (1A647C) [0B]
5AD54: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AD58: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AD5C: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD60: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD64-5AD7C: Act 2
5AD64: AIZ act 1 base tiles (1A566A) [0C]
5AD68: AIZ act 1 extended tiles (1A647C) [0C]
5AD6C: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AD70: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AD74: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD78: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD7C-5AD93: Empty (0D)
5AD7C-5AD93: Act 1
5AD7C: AIZ act 1 base tiles (1A566A) [0B]
5AD80: Unknown patterns (1A944E) [0B]
5AD84: AIZ act 1 base 16x16 block mappings (1A374A) [2A]
5AD88: Unknown extended 16x16 block mappings (1A458A) [2A]
5AD8C: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD90: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AD94-5ADAB: Act 2
5AD94: AIZ act 1 base tiles (1A566A) [0C]
5AD98: AIZ act 1 extended tiles (1A647C) [0C]
5AD9C: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5ADA0: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5ADA4: AIZ act 1 128x128 block mappings (1ABC40) [00]
5ADA8: AIZ act 1 128x128 block mappings (1ABC40) [00]
5ADAC-5ADDB: Azure lake (0E)
5ADAC-5ADC4: Act 1
5ADAC: AL tiles (1EEB84) [42]
5ADB0: AL tiles (1EEB84) [42]
5ADB4: AL 16x16 block mappings (1EE0C4) [26]
5ADB8: AL 16x16 block mappings (1EE0C4) [26]
5ADBC: AL 128x128 block mappings (1F1936) [00]
5ADC0: AL 128x128 block mappings (1F1936) [00]
5ADC4-5ADDC: Act 2
5ADC4: AL tiles (1EEB84) [42]
5ADC8: AL tiles (1EEB84) [42]
5ADCC: AL 16x16 block mappings (1EE0C4) [27]
5ADD0: AL 16x16 block mappings (1EE0C4) [27]
5ADD4: AL 128x128 block mappings (1F1936) [00]
5ADD8: AL 128x128 block mappings (1F1936) [00]
5ADDC-5AE0B: Ballon Park (0F)
5ADDC-5ADF3: Act 1
5ADDC: BP tiles (1F2896) [43]
5ADE0: BP tiles (1F2896) [43]
5ADE4: BP 16x16 block mappings (1F1FC6) [28]
5ADE8: BP 16x16 block mappings (1F1FC6) [28]
5ADEC: BP 128x128 block mappings (1F4878) [00]
5ADF0: BP 128x128 block mappings (1F4878) [00]
5ADF4-5AE0B: Act 2
5ADF4: BP tiles (1F2896) [43]
5ADF8: BP tiles (1F2896) [43]
5ADFC: BP 16x16 block mappings (1F1FC6) [29]
5AE00: BP 16x16 block mappings (1F1FC6) [29]
5AE04: BP 128x128 block mappings (1F4878) [00]
5AE08: BP 128x128 block mappings (1F4878) [00]
5AE0C-5AE3B: Chrome Gadget (10)
5AE0C-5AE23: Act 1
5AE0C: CG tiles (1F5948) [44]
5AE10: CG tiles (1F5948) [44]
5AE14: GC 16x16 block mappings (1F4F68) [34]
5AE18: GC 16x16 block mappings (1F4F68) [34]
5AE1C: GC 128x128 block mappings (1F743A) [00]
5AE20: GC 128x128 block mappings (1F743A) [00]
5AE24-5AE3B: Act 2
5AE24: CG tiles (1F5948) [44]
5AE28: CG tiles (1F5948) [44]
5AE2C: GC 16x16 block mappings (1F4F68) [34]
5AE30: GC 16x16 block mappings (1F4F68) [34]
5AE34: GC 128x128 block mappings (1F743A) [00]
5AE38: GC 128x128 block mappings (1F743A) [00]
5AE3C-5AE6B: Desert Palace (11)
5AE3C-5AE53: Act 1
5AE3C: DP tiles (1F81BA) [45]
5AE40: DP tiles (1F81BA) [45]
5AE44: DP 16x16 block mappings (1F7A6A) [35]
5AE48: DP 16x16 block mappings (1F7A6A) [35]
5AE4C: DP 128x128 block mappings (1FA75C) [00]
5AE50: DP 128x128 block mappings (1FA75C) [00]
5AE54-5AE6B: Act 2
5AE54: DP tiles (1F81BA) [45]
5AE58: DP tiles (1F81BA) [45]
5AE5C: DP 16x16 block mappings (1F7A6A) [35]
5AE60: DP 16x16 block mappings (1F7A6A) [35]
5AE64: DP 128x128 block mappings (1FA75C) [00]
5AE68: DP 128x128 block mappings (1FA75C) [00]
5AE6C-5AE9B: Endless Mine (12)
5AE6C-5AE83: Act 1
5AE6C: EM tiles (1FB6CC) [46]
5AE70: EM tiles (1FB6CC) [46]
5AE74: EM 16x16 block mappings (1FAC1C) [36]
5AE78: EM 16x16 block mappings (1FAC1C) [36]
5AE7C: EM 128x128 block mappings (1FE2FE) [00]
5AE80: EM 128x128 block mappings (1FE2FE) [00]
5AE84-5AE9B: Act 2
5AE84: EM tiles (1FB6CC) [46]
5AE88: EM tiles (1FB6CC) [46]
5AE8C: EM 16x16 block mappings (1FAC1C) [36]
5AE90: EM 16x16 block mappings (1FAC1C) [36]
5AE94: EM 128x128 block mappings (1FE2FE) [00]
5AE98: EM 128x128 block mappings (1FE2FE) [00]
5AE9C-5AECB: Bonus stage (13)
5AE9C-5AEB3: Act 1
5AE9C: Bonus stage 1 base tiles (1FEE2E) [47]
5AEA0: Bonus stage 1 base tiles (1FEE2E) [47]
5AEA4: Bonus stage 16x16 block mapings (1FEA0E) [33]
5AEA8: Bonus stage 16x16 block mapings (1FEA0E) [33]
5AEAC: Bonus stage 128x128 block mappings (1FFB80) [00]
5AEB0: Bonus stage 128x128 block mappings (1FFB80) [00]
5AEB4-5AECB: Act 2
5AEB4: Bonus stage 1 base tiles (1FEE2E) [47]
5AEB8: Bonus stage 1 base tiles (1FEE2E) [47]
5AEBC: Bonus stage 16x16 block mapings (1FEA0E) [33]
5AEC0: Bonus stage 16x16 block mapings (1FEA0E) [33]
5AEC4: Bonus stage 128x128 block mappings (1FFB80) [00]
5AEC8: Bonus stage 128x128 block mappings (1FFB80) [00]
5AECC-5AEFB: Empty (14)
5AECC-5AEE3: Act 1
5AECC: Nothing (1FFF20) [47]
5AED0: Nothing (1FFF20) [47]
5AED4: Nothing (1FFF20) [37]
5AED8: Nothing (1FFF20) [37]
5AEDC: Nothing (1FFF20) [00]
5AEE0: Nothing (1FFF20) [00]
5AEE4-5AEFB: Act 2
5AEE4: Nothing (1FFF20) [47]
5AEE8: Nothing (1FFF20) [47]
5AEEC: Nothing (1FFF20) [37]
5AEF0: Nothing (1FFF20) [37]
5AEF4: Nothing (1FFF20) [00]
5AEF8: Nothing (1FFF20) [00]
5AEFC-5AF2B: Empty (15)
5AEFC-5AF13: Act 1
5AEFC: Nothing (1FFF20) [47]
5AF00: Nothing (1FFF20) [47]
5AF04: Nothing (1FFF20) [38]
5AF08: Nothing (1FFF20) [38]
5AF0C: Nothing (1FFF20) [00]
5AF10: Nothing (1FFF20) [00]
5AF14-5AF2C: Act 2
5AF14: Nothing (1FFF20) [47]
5AF18: Nothing (1FFF20) [47]
5AF1C: Nothing (1FFF20) [38]
5AF20: Nothing (1FFF20) [38]
5AF24: Nothing (1FFF20) [00]
5AF28: Nothing (1FFF20) [00]
5AF2C-5AF5B: Empty (16)
5AF2C-5AF43: Act 1
5AF2C: AIZ act 1 base tiles (1A566A) [0B]
5AF30: AIZ act 1 extended tiles (1A647C) [0B]
5AF34: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AF38: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AF3C: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AF40: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AF44-5AF5B: Act 2
5AF44: AIZ act 1 base tiles (1A566A) [0C]
5AF48: AIZ act 1 extended tiles (1A647C) [0C]
5AF4C: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AF50: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AF54: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AF58: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AF5C-5AF73: Empty (17)
5AF5C-5AF73: Act 1
5AF5C: AIZ act 1 base tiles (1A566A) [0B]
5AF60: AIZ act 1 extended tiles (1A647C) [0B]
5AF64: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AF68: AIZ act 1 extended 16x16 block mappings (1A394A) [0A]
5AF6C: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AF70: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AF74-5AF8B: Act 2
5AF74: AIZ act 1 base tiles (1A566A) [0C]
5AF78: AIZ act 1 extended tiles (1A647C) [0C]
5AF7C: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AF80: AIZ act 1 extended 16x16 block mappings (1A394A) [0B]
5AF84: AIZ act 1 128x128 block mappings (1ABC40) [00]
5AF88: AIZ act 1 128x128 block mappings (1ABC40) [00]

Sonic 3 is quite different from the previous sonic games in the way that the core of S3 allows the programmers to change virtually anything about the level during game easily, making things such as smooth transition betwen acts and intro sequences possible. The data itself is often cut into sections, allowing the programmers to load just the modules that need updating. For each level, there may be a base block of data and an extended block of data for each thing. The way this works is the base block of data is the first section of that data block, and the extended one is the second. If you decompress both of them and chuck the extended one on the end of the base one, you get the full block of data. It is seperated like this to allow programmers to duplicate as little data as possible in any patches they may want to apply to that data while the level is running, and thus save rom space and cut down on the power required to make the transition. Now as you can see, these pointers specify the loading addresses in the rom for the 16x16 and 128x128 block mappings, as well as the main pattern block for that level. The main pattern block will always be loaded into the VRAM at address 0000. These loading addresses are all preceeded by a one byte value, so the address pointer only uses three bytes rather than the standard four. The value that proceeds the 128x128 block mappings specifies a value on the palette index to load for that level. For more information on the palette system, go here. The values preceeding the main level pattern and 16x16 block mapping pointers give the index numbers of the pattern load cue's to use for that level. For more information on that go here.

Pattern load cue's

The pattern load cue's are what loads all the peices of art into the VRAM that are not in the main level load block. Here's a breakdown of the pattern load cue's in the S3 rom:

Index Location Name Contents Rom Vram Number
00 5B084 Unknown -Sonic lives counter
-Ring and score/time/rings
-Points and starpoll
-Monitor
15CEE6
15F2EC
15F528
15D2DE
FA80
D780
BC80
9880
(3)
01 5B09E Unknown -Sonic lives counter
-Monitor
-Ring and score/time/rings
-Points and starpoll
15CEE6
15D2DE
15F2EC
15F528
FA80
9880
D780
BC80
(3)
02 5B0B8 Unknown -Explosion
-Squirrel
-Bluebird
15E6C0
15FDA6
15F9D4
B400
B000
B240
(2)
03 5B0CC Game/Time over -Game/Time over text 15E49A F380 (0)
04 5B0D4 Signpost -End of level signpost 15DA5A A000 (0)
05 5B0DC Springs and spikes -Horizontal springs and vertical spikes 15EFFC 9280 (0)
06 5B0E4 Competition mode -Mini spring and spikes
-Mini spring and button
-Competition mode powerups
196D10
196B9C
196F02
7220
75A0
78C0
(2)
07 5B0F8 Unknown -Tails lives counter
-Monitor
-Ring and score/time/rings
-Points and starpoll
15CFFE
15D2DE
15F2EC
15F528
FA80
9880
D780
BC80
(3)
08 5B112 Monitor -Monitor 15D2DE 9880 (0)
09 5B11A Special stage platform test -Special stage sphere 911CE 9C00 (0)
0A 5B122 AIZ intro -Waves from AIZ intro 1481A0 7A20 (0)
0B 5B12A AIZ 1st load cue -Rope on flying fox
-Unknown
-Unknown
-Impact splash on water
-Bubbles from underwater
-Grass tiles
18D8BC
18DA22
18DC90
18E4D8
15E1FC
18D586
8360
6480
6660
79E0
8B80
7EE0
(5)
0C-0D 5B150 AIZ 2nd load cue -Misc AIZ blocks
-Rope on flying fox
-Unknown
-Bubbles
-Button
-Unknown
18E760
18D8BC
18DB46
15E1FC
15C900
18D72A
5D20
8360
8700
8B80
8AC0
8800
(5)
0E 5B176 HCZ 1st load cue -Bubbles
-Misc HCZ blocks
-Unknown
-Misc MCZ blocks
-Unknown
-Metal spikeball
15E1FC
18FD88
18FCD4
190348
18FBB4
18FAEC
8B80
7940
84C0
6F40
85C0
87C0
(5)
0F 5B19C HCZ 2nd load cue -Blowfly 16A3E0 8980 (0)
10 5B1A4 Unknown -Bubbles
-Misc HCZ blocks
-Unknown
-Unknown
-Metal spikeball
-Sliding tube
15E1FC
18FD88
18FCD4
18FBB4
18FAEC
191B36
8B80
7940
84C0
85C0
87C0
6B80
(5)
11 5B1CA Unknown -Unknown
-HCZ bridge
-Blowfly
193714
19204C
16A3E0
6A00
0500
8980
(2)
12-13 5B1DE MGZ 1st load cue -Unknown
-Unknown
-MGZ signs
-Diagonal spring
19382E
19426C
19487C
15CBD2
6BE0
7FE0
8A20
8F00
(3)
14-15 5B1F8 MGZ 2nd load cue -Unknown
-Unknown
-MGZ signs
-Diagonal spring
19382E
19426C
19487C
15CBD2
6BE0
7FE0
8A20
8F00
(3)
16-19 5B212 CNZ 1st load cue -Misc CNZ blocks
-Bubbles
-Lightbulb
194AB6
15E1FC
195874
6A20
8B80
8600
(2)
1A-1D 5B226 CNZ 2nd load cue -Diagonal spring 15CBD2 8740 (0)
1E-1F 5B22E ICZ 1st load cue -Unknown
-Diagonal spring
-Button
-Ice blocks
-Unknown
38FFE
15CBD2
15C900
171B0E
172732
D700
8740
8AC0
76C0
68C0
(4)
20-21 5B24E ICZ 2nd load cue -Diagonal spring
-Button
-Ice blocks
-Unknown
-Bubbles
15CBD2
15C900
171B0E
172BB4
15E1FC
8740
8AC0
76C0
6EE0
8B80
(4)
22-23 5B26E LBZ 1st load cue -Unknown
-Unknown
1959DE
1964FC
7860
8AA0
(1)
24 5B27C LBZ 2nd load cue -Unknown
-Bubbles
1959DE
15E1FC
7860
8B80
(1)
25 5B28A Unknown -Unknown 196760 5D40 (0)
26-2D 5B292 Unknown -Diagonal spring
-Horizontal and vertical spikes
15CBD2
15EFFC
8740
9280
(1)
2E-41 5B2A0 Unknown -Diagonal spring
-Horizontal and vertical spikes
15CBD2
15EFFC
8740
9280
(1)
42 5B2AE Azure lake -Unknown
-Unknown
-Unknown
-Unknown
-Unknown
-Mini spring and spikes
-Mini spring and button
-Competition mode powerups
14F5E2
1973F8
197BCA
197570
1980C4
196D10
196B9C
196F02
FC00
D780
E000
C000
EBC0
7220
75A0
78C0
(7)
43 5B2E0 Baloon park -Unknown
-Unknown
-Unknown
-Unknown
-Unknown
-Unknown
-Mini spring and spikes
-Mini spring and button
-Competition mode powerups
19815E
14F5E2
1973F8
197BCA
197570
1980C4
196D10
196B9C
196F02
6000
FC00
D780
E000
C000
EBC0
7220
75A0
78C0
(8)
44 5B318 Chrome gadget -Unknown
-Unknown
-Unknown
-Unknown
-Unknown
-Unknown
-Mini spring and spikes
-Mini spring and button
-Competition mode powerups
1989A8
14F5E2
1973F8
197BCA
197570
1980C4
196D10
196B9C
196F02
5000
FC00
D780
E000
C000
EBC0
7220
75A0
78C0
(8)
45 5B350 Desert palace -Unknown
-Unknown
-Unknown
-Unknown
-Unknown
-Unknown
-Mini spring and spikes
-Mini spring and button
-Competition mode powerups
1989A8
14F5E2
1973F8
197BCA
197570
1980C4
196D10
196B9C
196F02
5000
FC00
D780
E000
C000
EBC0
7220
75A0
78C0
(8)
46 5B388 Endless mine -Unknown
-Unknown
-Unknown
-Unknown
-Unknown
-Unknown
-Mini spring and spikes
-Mini spring and button
-Competition mode powerups
1989A8
14F5E2
1973F8
197BCA
197570
1980C4
196D10
196B9C
196F02
5000
FC00
D780
E000
C000
EBC0
7220
75A0
78C0
(8)
47 5B3C0 Dispencer bonus stage -Dispencer
-Horizontal springs and vertical spikes
18AE2A
15EFFC
2B60
9280
(1)
48-5A 5B3CE AIZ act 1 boss -Firebomber from AIZ
-Bombs launched by firebomber
-Explosion
-Small explosion
164BF2
1671A2
17FB50
17F800
8340
8E80
9040
9A40
(3)
5B 5B3E8 Unknown -Unknown
-Small explosion
168400
17F800
6080
A000
(1)
5C-5D 5B3F6 Unknown -Unknown
-Small explosion
16E548
17F800
A5C0
A000
(1)
5E 5B404 Unknown -Unknown
-Egg prison
-Small explosion
-Squirrel
-Bluebird
1706B0
182180
17F800
15FDA6
15F9D4
A5C0
89C0
A000
85C0
8800
(4)
5F 5B424 Unknown -Unknown
-Small explosion
173CCC
17F800
9520
A000
(1)
60 5B432 Unknown -Robotnic in main ship
-Unknown
18041E
1791DE
A5C0
9AC0
(1)
61-6A 5B440 FBZ act 2 mini boss -Lazer boss from FBZ
-Robotnic
-More Robotnic stuff
-Small explosion
170C76
180BEC
181002
17F800
A5C0
8CC0
9520
A000
(3)
6B 5B45A Unknown -Robotnic in main ship
-Small explosion
18041E
17F800
A5C0
9A40
(1)
6C 5B468 HCZ act 2 boss -Water sprial
-Robotnic in main ship
-Small explosion
-Egg prison
16929E
18041E
17F800
182180
6400
A5C0
A000
9280
(3)
6D 5B482 Unknown -Robotnic in main ship
-Small explosion
-Egg prison
18041E
17F800
182180
A5C0
A000
9280
(2)
6E 5B496 Unknown -Unknown
-Robotnic in main ship
-Small explosion
-Egg prison
16EA04
18041E
17F800
182180
8600
A5C0
A000
9280
(3)
6F 5B4B0 FBZ act 2 boss -FBZ act 2 boss
-Robotnic's head
-Other explosion
-Robotnic in main ship
-Small explosion
-Egg prison
171178
18097A
1800A2
18041E
17F800
182180
7C00
8200
8A80
A5C0
A000
9280
(5)
70 5B4D6 Unknown -Unknown
-Robotnic in main ship
-Small explosion
-Egg prison
172F1E
18041E
17F800
182180
54C0
A5C0
A000
9280
(3)
71 5B4F0 Unknown -Unknown
-Small explosion
17599C
17F800
7540
A000
(1)
72-77 5B4FE Unknown -Robotnic in main ship
-More Robotnic stuff
-Small explosion
18041E
181002
17F800
A5C0
9520
A000
(2)
78-7B 5B512 Unknown -Robotnic in main ship
-Small explosion
18041E
17F800
A5C0
A000
(1)

This pointer list has an offset index to locate the correct cue. Go here for an explanation of how this works. Note that the number in parenthesis is the recorded number of requests in the cue. If a number follows it in brackets, it means the actual number that exists differs from the recorded one. This means any load requests past the recorded number were not being loaded, but still exist in the rom. Now, each load cue has a two byte value before it that specifies how many addresses are in the cue, to avoid it reading too far, and going into the next cue. This value is dead simple, just enter the number of patterns on the cue in hex between the first two bytes, but you have to count 00 as 1, so if there was 16 loading addresses in the cue, you'd have 000F preceding it. After that, there are 6 bytes per load request. The first four bytes are a pointer to the art block to use, and the two bytes after that are the location in the VRAM to load them into. To change the pattern load cue's being loaded for a level, you need to change the values in the main level load block. For more information on that go here.

Collision definitions

Ok, I'm going to explain how collision works on objects that are not sprites in the sonic games. First of all forget the image that the block contains. The image has absolutely nothing to do with the collision. There's basically in invisible collision box on top of every 16x16 block that sets what's solid and what's not. This collision box has two parts to it. The main part of it is the collision array (an array is basically a table of values). The collision array stores the actual data that says that is a block is solid in certain places. It does that through 16 bytes per collision box. To understand how those 16 bytes set what's solid, imagine a 16x16 block. Now imagine that 16x16 block with the numbers 1-10 (hex) down the side starting from the bottom and going up to the top, and starting from the left and going up as it moves right along the top, so that you can give an exact location of each pixel. (eg, the top left pixel would be 10,00) Now, in this array the first two bytes define what's solid for the row of pixels on the left side of that 16x16 block. Basically the first of those two bytes says where to start making things solid, and the second byte says where to stop making them solid. So if you entered the value 0010, the first row would be solid from the very bottom of the block all the way up to the top. If you were to enter the value 020E, there would be two pixels on either side of the block that are not solid, and everything in the middle would be. The next two bytes after that are for the next row, etc. After 16 bytes the definitions for the next collision box begin.

Now, to specify which blocks use which collision boxes, there are collision indexes, which give an array location for each 16x16 block. If you look at the space used by the collision array, you can divide that by 16 (the number of bytes used by each entry into the array) to give a one byte value, which represents the maximum number of collision boxes that the array can hold in the S3 platform, which is FF. Now, for each level there is at least one 16x16 collision index, and that index consists of a whole heap of array locations, one for each 16x16 block. If for example you wanted the 9th 16x16 block to use the collision box with an array location of 3E, you would give the 9th byte of the collision index for that level a value of 3E.

It is through collision indexes that the loops work in the game. It's commonly believed that there are layers, and that the sprite represented by 4 rings changes between them. This is partly true. For any levels that use multiple layers like that, there is a secondary 16x16 collision index. That object switches the 16x16 collision index in use. The pointers to these 16x16 collision indexes are stored at 4ADC-4B63. The first set of pointers in this group specify the location of the primary collision index to use for each level, and the second set specify the location of the secondary collision index to use for each level.

Now just setting something as solid, doesn't give it the effect of having a slope. There's an index in the rom, which has one byte in it for each collision array location. To understand how this value works, think of two lines running parallel to each other, both with the value 0-F along them. Now, the first value of the byte gives a point on the right line, and the second value gives a point on the left line. Now imagine drawing a line between these to points. If the points are different, the resulting gradient will be taken to create the effect of a slope and the resistance going up it on the box in the corresponding collision array location.

Level layout

In the S3 rom none of the level leyout's are compressed as such, but due to the nature of the way they're stored editing them is not nessicarily straightforward. Check the savestate hackng guide for information on how to edit the level layout.

Ring placement

The data for ring placement has an offset index to locate the correct group. Go here for an explanation of how this works. Now, in the rom each ring does not have to be stored individually. Instead you can place one ring, and specify that a certain number of rings come after it. The definitions for one ring takes up 4 bytes in the rom. Let's look at an example: 1234 5678 Now, in this example the ring will be placed at an x location of 1234, and a y location of 678. With that value where the 5 was entered, if the value entered is below 8, an additional ring will be placed next to the one before it for every unit that the value entered is above 0. Entering a value above 8 will place an additional ring below the one before it for each unit that the value entered is above 8. When specifying a position as the start of a group of rings, if the group is horizontal, the rings will go across to the right of that point, and if the group is vertical the rings will go down from that point. The value FFFF closes the group of ring locations, and it is essential that this is at the end of the ring locations list, or else the game will keep on reading past that point until it hits that value.

Sprite placement

Sprites are quite simple to define. It takes six bytes to define one sprite. The first two bytes are the x location of the sprite, and the next two bytes are the y location of the sprite. The 5th byte is the number on the sprite array to lookup to get the location for the function to use for the programming of that sprite, and the 6th byte is an optional declaration to use with the function for that sprite. Go here for more info on what exactly that means, and a list of all the sprites in the S3 rom.

Main level Block mappings

For information on exactly what the block mappings do, read the introduction. In the S3 rom, the 128x128 and 16x16 block mappings are compressed. Editing compressd data is extremely impractical, so in order to edit this data you will need to extract them first. Chaosax-extract is capable of decompressing this data. Once it's decompressed you can edit it just like in the savestate, so check the savestate section for further info on editing them. Once you've made the appropriate changes, you can use chaos-pack to recompress the data.

Uncompressed art

Any art that needs to be updated on the fly will not be compressed in the rom. This is because the game can't work with compressed data, and needs to extract any data it wants to use to the ram. This decompression process takes a fair bit of computation, and because of that it wouldn't be possible to create the appearance of a smooth animation using compressed data. The same reason is true as to why any data that is not loaded into the ram will always be uncompressed, because otherwise they would have to load it into the ram just to read it.

Now, for example all of the blocks for Sonic and Tails are uncompressed, because they of course need to be updated quickly. You can use basically any editing utility to edit them, but you can only change what each block looks like through this. In order to edit what blocks are placed where in each of Sonic's animation frames, you need to edit the mappings for them, and for more information on that go here. Now in their uncompressed form, you can edit them just like you would in the VRAM, so for more information on that check the sonic 2 savestate breakdown.

Sprite mapping format

Sprite mappings are what construct an image for a sprite out of the 8x8 blocks. This format has two parts to it, the image layout and the pattern reloading. The patern reloading is only applicable to sprites that are animated and have to reload uncompressed patterns from the rom, such as the playable characters. It is important to understand when dealing with sprite mappings that a single sprite may be made up of several sections. When dealing with mappings you can freely create, move, and resize these sections. Each one is independent of each other, and as such each on is defined seperately.

Each section has a maximum size of 4x4 units, each one capable of holding an 8x8 block. You cannot actually specify what block goes where within that box. You give it a VRAM location, and starting at the top and working it's way down the first vertical column, then moving across one and working it's way down again, it loads as many blocks from that point in the VRAM as it needs. Here's an explination of the two parts of the sprite mapping format:

00 03 EC 0D 00 00 FF EC FC 06 00 08 00 04 FC 0A 00 0E FF EC

Don't panic, it's clearer once you break it down into it's sections like this:

1 00 03
2 EC 0D 00 00 FF EC
3 FC 06 00 08 00 04
4 FC 0A 00 0E FF EC

The first section is the header. This is very simple, it's just a two byte value specifying how many sections the sprite has to it, so if you wanted 4 sections, you'd enter 0004. For every section there is, another six bytes follow. Here's what each byte does:

EC 0D 00 00 FF EC
1 2 3 4
1 Vertical offset
2 Layout of block
3 Standard palette/block selection
4 Horizontal offset

Vertical offset

The vertical offset is set by 1 signed byte. What this means is that if you set it to 80 the image will be placed 128 pixels above the sprite location, and if you set it to 7F it will be placed 128 pixels below it. These values decrease as you get closer to thier respective ends, so FE would offset it by 1 pixel up.

Layout of block

For anyone who's comfortable working with binary, I'll explain exactly how this works. For any who aren't, just bear with me. The first 4 bits of this byte are unused. Bits 5 and 6 are the number of blocks vertically, and bits 7 and 8 are the number of blocks horizontally. For anyone who doesn't understand what that means, well here's yet another table:

Value entered Size of section
00 1x1
01 2x1
02 3x1
03 4x1
04 1x2
05 2x2
06 3x2
07 4x2
08 1x3
09 2x3
0A 3x3
0B 4x3
0C 1x4
0D 2x4
0E 3x4
0F 4x4

Standard palette/block selection

You may have seen this table elsewhere:

Value palette line flipped horizntally flipped vertically
1 n n
1 1 n y
2 2 n n
3 2 n y
4 3 n n
5 3 n y
6 4 n n
7 4 n y
8 1 n n
9 1 n y
A 2 n n
B 2 n y
C 3 n n
D 3 n y
E 4 n n
F 4 n y

Well this is the system that's applies to the first hex value (4 bits) of these two bytes. The last hex value of the first byte and all of the second byte combine to give a block number in the VRAM of the starting location of the tiles to use for this section. At 800 the block number restarts at 0, but the image is flipped horizontally. This is different from the way it's normally used though, because that block number is an offset from the default location in the VRAM.

Horizontal offset

This works just like the vertical offset, but in this case it's a 2 byte value rather than a 1 byte value. 8000 and up is right, 7FFF and down is left.

Pattern reloading

Here's another excert from Sonic's mappings:

00 01 FB A2
1 2

The pattern reloading is very simple. The first two bytes are the header, which once again just says the number of sections. After that there's two bytes for each section. The first hex value of the first byte is the number of blocks to load from the rom, and the last hex value and second byte combine to give the number of blocks that come before the first one you want to access.

Sega intro sound

The Sega intro sound is just an 16000HZ wav sound. Opening up the rom in any sound editing program that supports raw audio with the settings listed next to the location on the list will enable you to playback the sound effect. You could also insert your own sound in the same place as long as it's at the same bitrate. The bitrate is to do with the quality of the sound. The lower it is the crappier it will sound, because that's to do with how often the output is modified. Just think of the difference between long play and short play on a VCR. Stuff recorded in long play does save space, but the quality of the recording is worse.

Art compression format

The art compression format is a very dense compression format. It's only used for art because the format relies on the data being in blocks of 64 bytes. This format is used for all the compressed art in sonic 1 and sonic 2 beta, and all the compressed art except for the main level pattern blocks in Sonic 2. In S3 this format is sparsely used, as it was pretty much replaced by the Kozinski compression format. As I said this format is very dense, and as such it requires a hell of a lot of computation to decompress. Because of this it also requires a hell of a lot of time and effort to crack. I've had a go at it, but the lightning has yet to strike. When I crack it I'll post the format breakdown here, and create a simple program to decompress it, but until then it is impossible to directly edit any art using this format. The porting of a compressed block of art is simple though, so if you want to transfer art from one game to another, you can just tack it onto the end and enter the pointer into the pattern load cue of the level or event you want it to appear at, along with a VRAM location to load it into. Go Here for more information on that.

Moduled tile format

The moduled tile format is a method of storage that uses the Kozinski compression format. The utility called Chaosax-extract is capable of extracting this format, and the utility called chaos-pack is capable of re-compressing into this compression format. The moduled format itself requires explanation though. Each pattern block is preceeded by a two byte header. This two byte value is simply how many bytes are compressed in the archive. Directly after this header, the actual compressed data starts, so you'll need to add 2 bytes to any main pattern block compressed in this manner when adding it into chaosax-extract to allow it to extract successfully. The reason for this header is that if the archive is over 1000 (hex) the art is broken down into modules, each one carrying a maximum of 1000. If for example there were 54D6 bytes of compressed data, the data block would be in 6 modules. The first five would contain 1000 bytes of compressed data, and the last would contain 4D6 bytes. In the address listing, any block that is a standalone archive, or the first piece of an archive will have the header in the right hand column. Any modules of an archive will have module X written in their name, where x is the number of the module, and will not have any header written in the right-hand column. If you wish to decompress a module, you do mot have to add 2 bytes to it's address, as it has no header.

Rasterised layer deformation

Raster effects are simply effects to do with deformation of an image based on lines of pixels. In Sonic 3, these effects are used to create the movement effects for the backgrounds and foregrounds of all the levels, as well as the splitscreen effect in competition mode. In addition to these effects, in Sonic 3 the programmers used this section of code to achieve other rather clever runtime effects, such as the wall moving after you from behind at the beginning of HCZ act 2, and the FBZ bombing the ground after you in AIZ act 2. Because the programming for these effects are stored in the form of compiled code, you'll have to learn ASM in order to edit them. Changing which effect to use for what level is easier though.

The pointer list for this section of code requires explination too. There are 8 pointers (32 bytes) for each level value. First of all, here's those 12 bytes for HCZ:

0003 C28C 0003 C29C 0003 C5AE 0003 C5C2 0003 C298 0003 C2CA 0003 C5B6 0003 B42A
01 02 03 04 05 06 07 08

And here's what each pointer is for:

01 Act 1 initial foreground layout
02 Act 1 initial background layout
03 Act 2 initial foreground layout
04 Act 2 initial background layout
05 Act 1 rasterised effects
06 Act 1 layer deformation and load checkpoints
07 Act 2 rasterised effects
08 Act 2 layer deformation and load checkpoints

Initial background/foreground layout:

This affects the layout of the background or foreground tiles upon the loading of that section. Becuase the rasterised layer deormation effect and patterns are often changed in level, this is required to correct the layout if it differs from the one it should be set to. This is only accessed once upon loading the level.

Rasterised effects

Rasterised effects are used for many flashy effects throughout the game that would otherwise be impossible. Some of these effects are the treetruck in AIZ act 1, FBZ bombing sequence in AIZ act 2, Crushing wall in HCZ act 2, etc. Becuase of how integrated these effects are, don't expect to be able to readily transfer these from one level to another. This section of code is accessed each loop to check for the condition.

Layer deformation and load checkpoints

This is what determins the movement of the background and foreground, as well as when new patterns are loaded into the VRAM during the level. This block should be transferrable between levels, but no guarantees. Also you'll need to edit this section of code if you don't want it to load patterns at it's checkpoints, or if you want to change which background movement effect is used when. This section of code is accessed each loop to check the conditions, and to update the output.

Dynamic screen resizing

In S3, the programmers allowed for some very fancy effects to do with the height and width of the sceen. They allowed for the X/Y start, and X/Y ending locations to be changed at any point during the level, based on any event they cared to use. All the programming for the screen resizing is compiled, so it's very difficult to edit directly. The code itself is farily simple though, so if you have some experience with ASM you shouldn't find it difficult to modify.

Palettes

All the main palettes used in the game are linked in a pointer table at 8BF94. In this pointer table there are 8 bytes per palette. The first four simply give a location in the rom for the data to load. The fifth and sixth bytes give the location in the system ram to load the data into, and the seventh and eighth bytes give the number of four byte blocks being loaded. Here's a palette pointer:

0000 2942 FB20 0007

Now in this case the palette is being loaded from 00002942 in the rom into the beginning of the second above water palette row (FB20), and it's loading 16 colours (0007). Here's a listing of the palette pointers in the S3 rom:

Index Pointer location Palette location Name of palette slot Palette line Number of colours
00 8BF54 8C134 1 64
01 8BF5C 8C1B4 2 16
02 8BF64 8C1D4 1 64
03 8BF6C 8C234 Main palette line 1 16
04 8BF74 8C274 Level select palette 1 64
05 8BF7C 8C2F4 2 16
06 8BF84 8C134 1 64
07 8BF8C 8C134 1 64
08 8BF94 8C134 1 64
09 8BF9C 8C134 1 64
0A 8BFA4 8C314 AIZ act 1 intro 2 48
0B 8BFAC 8C3D4 AIZ act 2 2 48
0C 8BFB4 8C594 HCZ act 1 above water 2 48
0D 8BFBC 8C5F4 HCZ act 2 above water 2 48
0E 8BFC4 8C754 MGZ act 1 2 48
0F 8BFCC 8C754 MGZ act 2 2 48
10 8BFD4 8C7B4 CNZ act 1 2 48
11 8BFDC 8C7B4 CNZ act 2 2 48
12 8BFE4 8C894 FBZ act 1 2 48
13 8BFEC 8C894 FBZ act 2 2 48
14 8BFF4 8C894 ICZ act 1 2 48
15 8BFFC 8C8F4 ICZ act 2 2 48
16 8C004 8C9D4 LBZ act 1 2 48
17 8C00C 8CA34 LBZ act 2 2 48
18 8C014 8CB74 07 act 1 2 48
19 8C01C 8CB74 07 act 2 2 48
1A 8C024 8CB74 08 act 1 2 48
1B 8C02C 8CB74 08 act 2 2 48
1C 8C034 8CB74 09 act 1 2 48
1D 8C03C 8CB74 09 act 2 2 48
1E 8C044 8CB74 0A act 1 2 48
1F 8C04C 8CB74 0A act 2 2 48
20 8C054 8CB74 0B act 1 2 48
21 8C05C 8CB74 0B act 2 2 48
22 8C064 8CB74 0C act 1 2 48
23 8C06C 8CB74 0C act 2 2 48
24 8C074 8CB74 0D act 1 2 48
25 8C07C 8CB74 0D act 2 2 48
26 8C084 8CB74 Azure lake act 1 2 48
27 8C08C 8CB74 Azure lake act 2 2 48
28 8C094 8CBD4 Baloon park act 1 2 48
29 8C09C 8CBD4 Baloon park act 2 2 48
2A 8C0A4 8C374 AIZ intro level palette when Knuckles is on screen 2 48
2B 8C0AC 8C494 AIZ act 1 underwater 1 64
2C 8C0B4 8C514 AIZ act 2 underwater 1 64
2D 8C0BC 8CA94 LBZ act 1 underwater 1 64
2E 8C0C4 8CA94 LBZ act 2 underwater 1 64
2F 8C0CC 8CB14 2 48
30 8C0D4 8C434 AIZ act 2 FBZ bombing sequence 2 48
31 8C0DC 8C654 HCZ act 1 underwater 1 64
32 8C0E4 8C6D4 HCZ act 2 underwater 1 64
33 8C0EC 8CD54 Dispencer bonus stage palette 2 48
34 8C0F4 8CC34 Desert palace 2 48
35 8C0FC 8CC94 Chrome gadget 2 48
36 8C104 8CCF4 Endless mine 2 48
37 8C10C 8CDB4 2 48
38 8C114 8CE14 2 48
39 8C11C 8C954 ICZ act 2 underwater 1 64
3A 8C124 8C814 1 64
3B 8C12C 8C374 2 48

To change the palette being loaded for each level, you need to change the palette index number in the main level load block. For more information on that go here. The palettes themeslves are very easy to modify as they are all uncompressed in the rom. Refer to the savestate hacking documents for information on how to edit palettes.

Character start location array

The start location for the characers and the camera for each level are stored in this array at address 5B02. It couldn't be any simpler to modify, there's just two values per act, the first being the X location, and the second being the Y location.

Music playlist for levels

This is actually part of a sub in the code, but it's editable all the same. Pretty simple, just one byte per level. That one byte is the value of the song you wish to play. The value of the songs can be obtained from the sound test in the level select screen.

Level select level order

The level select one is easy to modify. There is a list of two byte values at 6A8E in the rom. Just enter the level value followed by an act number for each of the levels you want to load, in the order you want them to be loaded. The values are listed in order from the first one in the top lefthand corner, going down to the bottom of the screen, and starting again at the top on the other side. For a list of the level values for all the different stages, look at the beginning of the introduction to this page. By default, a slot that is not accessable has the value 5555 in it.

ASCII text

ASCII text is raw text just like you'd type in notepad. Editing it is just as easy, simply type it in. There are two flags you need to know though. To signal the end of a block of text the hex values 0000 must be entered. At the beginning of each block there is another two byte value, which is the vertical location on the screen for it to be placed. The text is automatically centered horizontally.

Object debug list

The object debug list in the Sonic 3 platform is different from previous versions. There's a two byte header, which is the number of objects in the list. After that there's 10 bytes per object. Here's an object from the AIZ debug list:

00 01 8C F6 00 01 90 DE A6 BC
1 2 3 4 5

And here's what each byte does:

1 Frame to display
2 Pointer to code
3 Declaration
4 Pointer to mappings
5 Flip/mirror/VRAM location

Frame to display

This is simply the frame of the sprite that will be displayed on the preview picture before you place an object. Right now it's set to 00, which is the first frame.

Pointer to code

This is the pointer to the code to use for the sprite. The object number on the sprite array is not used, allowing an object to be placed in the debug list while not being in the sprite array. Code locations can be obtained from the address listing.

Declaration

This is the declaration for the loading of the sprite. For information on exactly what that is, go here. In this example the declaration is 08, which switches the type of monitor it is in the case of this sprite.

Sprite mappings

This is a pointer to the location in the rom to load the mappings for that sprite. This will be located in the programming for the sprite itself. Do not change this unless porting between levels, or you're absolutely sure you know what you're doing, or the game will most likely hang. This only affects the preview picture, not the placed object itself. In this case, the sprite mappings are being loaded from the address 012D36 in the rom.

Flip/mirror/VRAM location

The first hex value of the 7th byte is to do with flipping and mirroring of the sprite, as well as the palette line to use for it. Refer to the following table for an explination of what responce each value will create.

Value palette line flipped horizntally flipped vertically
1 n n
1 1 n y
2 2 n n
3 2 n y
4 3 n n
5 3 n y
6 4 n n
7 4 n y
8 1 n n
9 1 n y
A 2 n n
B 2 n y
C 3 n n
D 3 n y
E 4 n n
F 4 n y

In the case of our example, the value of 0 is used, so the preview image will use the first palette line, and will not be flipped or mirrored.

The last hex value of the 7th byte, and all of the 8th byte in this block combine to give a starting location in the VRAM to find the patterns to use for that sprite when displaying the preview. This is not an actual location, but merely the number of blocks after which to load the patterns from. After the value of 800 is passed, the block number resets to zero but the image is mirrored. In this case, that block number is 680.

Dynamic pattern reloading

Dynamic pattern reloading is a method of loading patterns into the VRAM, but unlike the other methods, this one has no limitations, because it uses actual programmed code. Basically this is here for any effects to do with patterns changing in game that isn't posible using the normal load cue system, such as many areas of the backgrounds in the S3 levels where the patterns to display is determined by the position of the screen. Becuase the programming for it is in the form of compiled code, direct editing of it is not possible.

Animated pattern load cue's

Animated patterns require the art they are working with to be in an uncompressed form, so if you are attempting to make an animated pattern, make sure the art is uncompressed or it won't work. Now, the length of each load request on the cue varies depending on the animation. The first byte specifies a value that will determine how often to switch frames in the animation. If you use this value you will not be able to specify a frame as having a different duration to another. Setting this to FF will disable automatic frame control and allow the user to input a manual duration for each frame. This will mean that for every frame the user wants in the animation, they have to allow another byte at the end of the load request. If you want automatic pattern control, which you would use if you want all the animations frames to have the same duration. Just enter how many screen refreshes to wait until the next frame of the animation is displayed. Bytes 2,3, and 4 are the address in the rom to load the patterns from. Bytes 5 and 6 are the location in VRAM to load the patterns into. Byte 7 is the number of frames the animation has, and byte 8 is the number of spaces in VRAM to use for each frame. The function of the bytes beyond this point depend on whether or not automatic frame control is enabled, so refer to appropriate section below.

With automatic frame control

One byte per frame of animation. This byte simply specifies the image to use for each frame of the animation. Based on the loading address entered, this value is the offset in 8x8 blocks to load each frame from in the rom. So if for example you were dealing with an animation that had 4 8x8 blocks per frame, and there were 4 frames of that, and you wanted it to display each frame one by one, you would enter the value 0004 080C.

Without automatic frame control

Two bytes per frame of animation. The first byte is the offset of blocks in the file to load the animation frame from. This byte simply specifies the image to use for each frame of the animation. Based on the loading address entered, this value is the offset in 8x8 blocks to load each frame from in the rom. The second byte is the number of screen refreshes to keep that image loaded for, before going on to the next animation frame.

Sprite programming

The programming for a sprite in the sonic games are stored as a function, and that function can take one declaration. People often confuse this declaration with a subtype value, but it's not really. What that basically means for the non programmers out there is that when the game places a sprite, you can enter a value along with the sprite number that may alter something about that sprite, but what it does varies depending on what sprite you're working with. Now because these functions are now compiled, the only way you can effectively edit them is to find the code for it and decompile it into assembly, alter it as necessary, and then recompile it and enter it back into the rom. This document will contain all the info necessary to enter a new sprite or replace an old one, but when it comes to the ASM you're on your own.

Now, the value assigned to a sprite in the game is done by a pointer index at 5CC96. It�s pretty simple, just one pointer per address value. Here's the pointer list in Sonic 3:

Index Pointer location Name of the sprite Code location
00 5CC96 Ring 18CF6
01 5CC9A Monitor 1B41E
02 5CC9E Layer changer 1AFC2
03 5CCA2  ???????? 1D3C4
04 5CCA6 Collapsing platform from AIZ 1DE1C
05 5CCAA Rocks from AIZ 1D656
06 5CCAE Flying fox from AIZ 200AE
07 5CCB2 Spring 213D8
08 5CCB6 Spikes 22612
09 5CCBA Trunk of plamtree in AIZ 1C3BC
0A 5CCBE End of flying fox in AIZ 1C3FE
0B 5CCC2 Spinning balls 2336E
0C 5CCC6 Unknown. Something you hold onto. 20768
0D 5CCCA Unknown. A breakable barrier. 1F6BC
0E 5CCCE  ???????? 23C70
0F 5CCD2  ???????? 1DF4C
10 5CCD6 Lift from LBZ 28C10
11 5CCDA Unknown. Hovering platforms. 23D32
12 5CCDE  ???????? 24722
13 5CCE2 Switch thingy that you bust from LBZ 24912
14 5CCE6 Unknown. A long vertical barrier with repeated block. 24C24
15 5CCEA Unknown. Line of blocks in foreground. 250D2
16 5CCEE Head that spurts out fire from LBZ 25394
17 5CCF2 Flying fox from LBZ 25584
18 5CCF6 Cylindrical platform that spins around screw from LBZ 25A12
19 5CCFA Unknown. Repeated blocks in background. 26144
1A 5CCFE Unknown. Resemble a seesaw. Automatically locked at center until you jump. 26202
1B 5CD02 Bustable section of pipe from LBZ 264FA
1C 5CD06 Unknown. Top hurts you. Bobs up and down slightly when hit from bottom. 268FE
1D 5CD0A Unknown. Hovering platforms. 2425E
1E 5CD0E Thing on wall that accelerates you in a ball when you go through it from LBZ 2795A
1F 5CD12 Unknown. Something you hold onto. 27BF0
20 5CD16 Unknown. Bottom hurts you. 28114
21 5CD1A  ???????? 28286
22 5CD1E Sprite that summons up flying badnicks from LBZ 283B8
23 5CD22  ???????? 2848A
24 5CD26 Unknown. Upon contact, it teleports you across the map. 28542
25 5CD2A  ???????? 18CF6
26 5CD2E Sprite that makes you enter ball 1C440
27 5CD32  ???????? 1C704
28 5CD36 Unknown. Invisible collision box. 1C7E6
29 5CD3A Unknown. Large solid box that cycles patterns around edge. 29336
2A 5CD3E Breakable vertical barriers used for spintubes in AIZ and ICZ 2963A
2B 5CD42 Long diagonal string of platforms, with each of them tilting in sequence from AIZ 29F80
2C 5CD46 Collapsing wooden bridge from AIZ 2A3A4
2D 5CD4A Spawnpoint for wooden platforms that travel down waterfall in AIZ 2AC4E
2E 5CD4E Rotating spikey log from AIZ 2AF20
2F 5CD52 Unknown. Fixed sprite in background. 2B2DA
30 5CD56 Unknown. Animated block in background. 2B66A
31 5CD5A  ???????? 2B9B6
32 5CD5E Unknown. Long vertical barrier with repeated block. 2A7F2
33 5CD62 Button 2BB20
34 5CD66 Starpoll 2C41E
35 5CD6A Leaves in foreground of AIZ 2B72E
36 5CD6E Wooden pole that Sonic hangs onto in HCZ 1C8EE
37 5CD72 Unknown. Big block with section to the left solid. 2E4BA
38 5CD76 Fan from CNZ 2EF5E
39 5CD7A  ???????? 2F2D8
3A 5CD7E Hand that pops out of the floor and speeds you up from HCZ 2F650
3B 5CD82  ???????? 2E786
3C 5CD86 One way barrier from HCZ 2FAB0
3D 5CD8A Spring that pops up out of floor 22072
3E 5CD8E  ???????? 2FDBE
3F 5CD92  ???????? 3015C
40 5CD96 Unknown. A block. 1CFF2
41 5CD9A Baloon from CNZ 30368
42 5CD9E Cannon from CNZ 30764
43 5CDA2 Platform you jump on to make rize from CNZ 30BDC
44 5CDA6 Trap door that opens when you get shot out of tube from CNZ 30D30
45 5CDAA Lightbulb from CNZ 30DFC
46 5CDAE Sprite that makes you float from fans 30E7E
47 5CDB2 Rotating cylinder from CNZ 31262
48 5CDB6 Sprite that creates resistance and acceleration barriers in CNZ 310A0
49 5CDBA Unknown. Sprite forces you to move right. 31B54
4A 5CDBE Bumper from CNZ 32082
4B 5CDC2  ???????? 31C20
4C 5CDC6 Spiral spintube from CNZ 32302
4D 5CDCA Sprite that creates surface and spinning effect when walking on diagonal rotating cylinder from CNZ 3259A
4E 5CDCE  ???????? 32A70
4F 5CDD2  ???????? 31D08
50 5CDD6  ???????? 32EC0
51 5CDDA Unknown. Hovering platforms. 243FC
52 5CDDE Unknown. Bottom hurts you. 28114
53 5CDE2 Platform moving in circle on chain thingy from MGZ 331D0
54 5CDE6  ???????? 2E04E
55 5CDEA Head thing on wall that launches arrows from MGZ 335AC
56 5CDEE Rotating cylinder with spikes on sides moving up/down and left/right from MGZ 33A7A
57 5CDF2 Horizontal block that you need spinning platform to bust 33874
58 5CDF6 Huge spikeball spinning on chain from MGZ 3333C
59 5CDFA Gizmo that raises platform when Spin Dashed at from MGZ 249B2
5A 5CDFE Large sprite that sits in background 33CC8
5B 5CE02 Free moving spintop from MGZ that hovers when you run on it 34190
5C 5CE06 Spintop mounted on block 34F20
5D 5CE0A An invisible horizontal barrier that bounces you back when you jump into it 31EFA
5E 5CE0E Platform with blade on bottom from CG 3500C
5F 5CE12 Spring that pops up out of floor 221C6
60 5CE16 Unknown. A block with the left side solid. 3518A
61 5CE1A Baloon from BP 35312
62 5CE1E Unknown. A block that sits there cycling patterns. 354CC
63 5CE22 Mini button from competition mode 35834
64 5CE26  ???????? 358F6
65 5CE2A Starpost and HUD for competition mode 36172
66 5CE2E Goo dripper from EM 3768A
67 5CE32 Moving block from HCZ 245B4
68 5CE36 Rotating cylinder from HCZ 31880
69 5CE3A Unknown. Appears to make character enter ball and spinoff to right. 3867A
6A 5CE3E Unknown. Top hurts you. Possibly spikes from competition mode. 1D096
6B 5CE42 Unknown. Same as above. 1D224
6C 5CE46 Unknown. Vertical string of repeated blocks in background. 37C94
6D 5CE4A Sprite of water hitting surface 37994
6E 5CE4E Unknown. Something dropping a stream of something else. 3780E
6F 5CE52 Ring 18CF6
70 5CE56 Ring 18CF6
71 5CE5A Ring 18CF6
72 5CE5E Ring 18CF6
73 5CE62 Ring 18CF6
74 5CE66 Ring 18CF6
75 5CE6A Ring 18CF6
76 5CE6E Ring 18CF6
77 5CE72 Ring 18CF6
78 5CE76 Ring 18CF6
79 5CE7A Ring 18CF6
7A 5CE7E Ring 18CF6
7B 5CE82 Ring 18CF6
7C 5CE86 Ring 18CF6
7D 5CE8A Ring 18CF6
7E 5CE8E Ring 18CF6
7F 5CE92 Ring 18CF6
80 5CE96  ???????? 46442
81 5CE9A Spikeball launcher on ground from AIZ 54B66
82 5CE9E Rhinobot from AIZ 54C52
83 5CEA2 Coconut throwing guys from AIZ 54F52
84 5CEA6  ???????? 19230
85 5CEAA Mini boss from LBZ act 1 4F474
86 5CEAE Rocket boss from end of LBZ act 2 4F9AC
87 5CEB2 Thingy that's on the wall and hides in shell from LBZ 59746
88 5CEB6 Green dude from LBZ that punches and swings ball 59A74
89 5CEBA Orbit badnick from LBZ 59DB2
8A 5CEBE Lazer thing on track from LBZ 59EA4
8B 5CEC2 Dive bomber bird things from LBZ 5A0DA
8C 5CEC6  ???????? 5040E
8D 5CECA  ???????? 4BF90
8E 5CECE  ???????? 4B5A8
8F 5CED2  ???????? 4C93E
90 5CED6  ???????? 19230
91 5CEDA  ???????? 19230
92 5CEDE  ???????? 19230
93 5CEE2  ???????? 19230
94 5CEE6  ???????? 19230
95 5CEEA  ???????? 19230
96 5CEEE  ???????? 19230
97 5CEF2  ???????? 19230
98 5CEF6  ???????? 19230
99 5CEFA Jet badnick from HCZ 556AE
9A 5CEFE Turret from HCZ that you need to bus to break platform 55726
9B 5CF02 Blowfly from MCZ 5580A
9C 5CF06 Ground runner guy from HCZ that launces rocket from back 559AA
9D 5CF0A Fish from HCZ 55D3C
9E 5CF0E Puffer fish from HCZ 56068
9F 5CF12 Blue worm like badnick made out of balls from AIZ 554C6
A0 5CF16 Shell badnick from CNZ 56D72
A1 5CF1A Badnick that teleports from roof to floor and vice versa from CNZ 56F4C
A2 5CF1E Bat from CNZ 5712A
A3 5CF22 Floating blue guy from MGZ with spikes that pop in and out 56122
A4 5CF26 Drill thingy from MGZ 56246
A5 5CF2A Spikes that pop up and shoot from MGZ 56954
A6 5CF2E Grasshopper from MGZ 56C1E
A7 5CF32 Cannon like ground badnick from FBZ 57242
A8 5CF36 Mouse from FBZ 574B8
A9 5CF3A  ???????? 470B2
AA 5CF3E Penguin from ICZ 59276
AB 5CF42 Orbit badnick from ICZ 595C6
AC 5CF46 Unknown. Locks screen X at 10E0. Suspect used for ICZ mini boss. 46974
AD 5CF4A  ???????? 47CF6
AE 5CF4E  ???????? 5A2C0
AF 5CF52 Sonic's first encounter with MGZ boss in act 2 49D72
B0 5CF56 Sonic's final encounter with MGZ boss in act 2 4A0F8
B1 5CF5A Tails' version of MGZ boss act 2 4A45E
B2 5CF5E  ???????? 4ECCE
B3 5CF62  ???????? 4E37E
B4 5CF66 FBZ act 2 final boss 4DBA0
B5 5CF6A  ???????? 48CDA
B6 5CF6E FBZ act 2 lazer mini boss 4D558
B7 5CF72 Robotnic's empty ship that you can jump in 5A834
B8 5CF76 Large metal column after lazer boss in FBZ that moves 57C54
B9 5CF7A ICZ platform wedged on wall that you can jump on to move 57764
BA 5CF7E Large metal column after lazer boss in FBZ that moves 57A92
BB 5CF82 Thing lodged in roof that shoots cold stuff at you to freeze you in ICZ 57E38
BC 5CF86 Stack of ice blocks that you can smash from ICZ 58324
BD 5CF8A Swinging platform from ICZ 584BC
BE 5CF8E Falling icicle from ICZ 5894C
BF 5CF92 Block of ice you can break from ICZ 58B24
C0 5CF96 Icicle on roof from ICZ 58A58
C1 5CF9A Unknown. A block in background that hurts you. 58C6A
C2 5CF9E Unknown. A row of blocks in foreground. 58CE8
C3 5CFA2 Platform suspended between to elastically chain thingys that when you jump on propels you up from ICZ 59032
C4 5CFA6  ???????? 56354
C5 5CFAA Unknown. Sits in background with picture of monitor and no animation. 522EA
C6 5CFAE Egg prison 544E0
C7 5CFB2  ???????? 446F2
C8 5CFB6 Unknown. A one way block. 57B46
C9 5CFBA Unknown. Sits inbackground with picture of button. 4549C
CA 5CFBE AIZ intro with plane 4584E
CB 5CFC2 Giant golden ring 44236
CC 5CFC6 LBZ act 1 mini boss activation trigger 5A512
CD 5CFCA Robotnic flying off into background 51B4C
CE 5CFCE  ???????? 43830
CF 5CFD2 Unknown. A few blocks hovering in background 43B08
D0 5CFD6 FInal S3 boss from LBZ act 2 50CAA
D1 5CFDA Breakable vertical barriers used for spintubes in AIZ and ICZ 455F4
D2 5CFDE Button 4564C
D3 5CFE2 Unknown. Large vertical block. Posibly waterfall. 45424


Sonic Community Hacking Guide
General
Sonic Music Hacking Guide | SonED2 Manual
Game-Specific
Sonic the Hedgehog (16-bit) | Sonic the Hedgehog (8-bit) | Sonic Eraser | Sonic CD (prototype 510) | Sonic CD | Sonic CD (PC) | Sonic CD (2011) | Sonic 2 (Nick Arcade prototype) | Sonic 2 (Simon Wai prototype) | Sonic 2 (16-bit) | Sonic 2 (8-bit) | Sonic 2 & Knuckles | Dr. Robotnik's Mean Bean Machine | Sonic Triple Trouble | Sonic 3 | Sonic & Knuckles | Sonic 3 & Knuckles | Sonic & Knuckles Collection | Sonic Crackers | Sonic 3D: Flickies' Island | Chaotix | Sonic R PC | Sonic Jam 6 | Sonic Advance | Sonic Advance 2 | Sonic Advance 3 | Sonic Battle | Sonic Adventure | Sonic Adventure DX: Director's Cut | Sonic Adventure DX: PC | Sonic Adventure (2010) | Sonic Adventure 2 | Sonic Adventure 2: Battle | Sonic Adventure 2 (PC) | Sonic Heroes | Shadow the Hedgehog | Sonic Riders | Sonic the Hedgehog (2006) | Sonic & Sega All-Stars Racing | Sonic Unleashed (Xbox 360/PS3) | Sonic Generations
Legacy Guides
The Nemesis Hacking Guides The Esrael Hacking Guides
ROM: Sonic 1 | Sonic 2 | Sonic 2 Beta | Sonic 3

Savestate: Sonic 1 | Sonic 2 Beta/Final | Sonic 3

Sonic 1 (English / Portuguese) | Sonic 2 Beta (English / Portuguese) | Sonic 2 and Knuckles (English / Portuguese)
Move to Sega Retro
Number Systems (or scrap) | Assembly Hacking Guide | Subroutine Equivalency List | 68000 Instruction Set | 68000 ASM-to-Hex Code Reference | VDP Documentation | Official Sega 32X Documentation | Official Mega-CD Documentation | Official Sega Mega Drive Documentation