Sonic
the Hedgehog 2 & Knuckles
Hacking Guide
Using
a hexadecimal editor is possible to modify the game, publishing it byte to byte.
Knowing where it is each instruction and altering it correctly you can
personalize the game. You can draw other character in the place of Sonic, but
this is not easy since it has that if fact point to point. To alter the name of
the levels in the level select menu and in
title it of the levels. But to program the game it is necessary that he
is in the binary format, it is not very difficult to convert the game for binary,
you can use a conversion program or emulative Genecyst that he/she has the
option DUMP ROM, that makes the conversion.
In
spite of Sonic 2 & Knuckles to be just Sonic 2 coupled Sonic & Knuckles,
this game can be considered a new version of Sonic 2, because the game Sonic
& Knuckles after identifying the cartridge coupled Sonic 2 activates a
memory that is at the end of the two games, and this memory tells all the
instructions of the game of Sonic 2 basically & Knuckles, just using the
cartridge of Sonic 2 for the graphs and maps of the levels, see that in this
manual you will see that the information that are altered in most of the case
meet above the address 0x300000 and little thing they were among the addresses
0x200000 to 0x2FFFFF that is where the game of Sonic 2 is in the memory when
being coupled Sonic & Knuckles, tends above in hands the information and
more in elapsing perhaps of the document you uniform that can say that the game
Sonic 2 & Knuckles a new game of Sonic 2 can be considered with Knuckles.
Observe
the table below with the levels and with its respective ids, these ids is
important because the game uses these ids for if referene the certain level..
LEVEL |
ID |
EMERALD
HILL |
00 |
METROPOLIS |
04 |
METROPOLIS |
05 |
WING
FORTRESS |
06 |
HILL
TOP |
07 |
OIL
OCEAN |
0A |
MYSTIC
CAVE |
0B |
CASINO
NIGHT |
0C |
CHEMICAL
PLANT |
0D |
DEATH
EGG |
0E |
AQUATIC
RUIN |
0F |
SKY
CHASE |
10 |
Notice
that some numbers are jumped as of the 01, 03, 06 and 09.
In spite of not existing a level name for these ID's in the relationship
and nor in the level select menu. If you place these ID's that they are lacking
it can access lost levels (Makes the experience and see the results). it
Observes the table with the standard location of the phases and soon soon after
an explanation. .
Level |
Address |
EMERALD
HILL
ACT 1 |
307906 e 307907 |
ACT 2 |
307908
e 307909 |
CHEMICAL
PLANT
ACT 1 |
30790A e 3079B |
ACT
2 |
30790C
e 30790D |
AQUATIC
RUIN
ACT 1 |
30790E
e 30790F |
ACT
2 |
307910
e 307911 |
CASINO
NIGHT
ACT 1 |
307912
e 307913 |
ACT 2 |
307914
e 307915 |
HILL
TOP
ACT 1 |
307916
e 307917 |
ACT 2 |
307918
e 307919 |
MYSTIC
CAVE
ACT 1 |
30791A
e 30791B |
ACT 2 |
30791C
e 30791D |
OIL
OCEAN
ACT 1 |
30791E
e 30791F |
ACT 2 |
307920
e 307921 |
METROPOLIS
ACT 1 |
307922
e 307923 |
ACT
2 |
307924
e 307925 |
ACT
3 |
307926
e 307927 |
SKY
CHASE |
307928
e 307927 |
WING
FORTRESS |
30792A
e 30792B |
DEATH
EGG |
30792C
e 30792D |
The table above indicates where they are located
the configuration bytes in the screen of level select. The 1st.
address of the table it indicates the byte of the zone and the 2nd.
address indicates the act byte. Example in the address 307916 you will see the
byte 07 (Hill Top zone) and in the address 307917 you will see the byte 00 (Act 1).
LEVELS
MUSIC
You
can also choose the music to be played in the levels. The format is of just a
byte for level and it is very simple. To place another music of its preference,
play the sounds in the sound test, write down the number of the music and place
in the byte that represents the chosen level.
See below in the table the location of the selection of music.
Observation: When modifying the music of the levels it adds 80 to the number of
Sound Test and place in the wanted place, the table below has some examples of
as the midis they are in Rom and as they appear in Sound Test.
LEVE: |
Music
in the Rom |
Music
in the Sound Test |
Address |
EMERALD
HILL |
82 |
02 |
30397C |
ID
01 |
82 |
02 |
30397D |
WOOD
ZONE |
85 |
05 |
30397E |
ID
03 |
84 |
04 |
30397F |
METROPOLIS |
85
|
05 |
303980
|
METROPOLIS
3 |
85
|
05 |
303981
|
WIN
FORTRESS |
8F
|
0F |
303982
|
HILL
TOP |
86
|
06 |
303983
|
HIDDEN
PALACE |
90 |
10 |
303984 |
ID
09 |
8D |
0D |
303985 |
OIL
OCEAN |
84 |
04 |
303986 |
MYSTIC
CAVE |
8B |
0B |
303987 |
CASINO
NIGHT |
89 |
09 |
303988 |
CHEMICAL
PLANT |
8E |
0E |
303989 |
DEATH
EGG |
8A |
0A |
30398A |
AQUATIC
RUIN |
87 |
07 |
30398B |
SKY
CHASE |
8D |
0D |
30398C |
ALTERING
OBJECTS
You
can also alter objects in the levels as badnicks, lives, obstacles, etc... The
configuration of the objects in the levels uses 6 long bytes, being in the
format XX-XX-YY-YY-OO-VV. Explaining to X's better indicates the horizontal
position in the screen, Y's indicates the vertical position in the screen, O's
indicates the objects they be she placed and V's indicates the possible
variations of each object. To obtain the exact location of the place where you
want for the objects, make the code of the debug mode and write down the first
line of coordinates in the place of SCORE, These will be the coordinates that
you should type to place the object in the wanted place. See the location where
game it search the objects of the levels. The levels finish the mappings before
the bytes FF-FF-00-00-00-00. Starting from these bytes next level begins.
.EMERALD
HILL
ACT
1 |
DF3FE
|
ACT
2 |
DF7B2 |
METROPOLIS
ZONE
ACT 1 |
DFBD2
|
ACT
2 |
E005E |
ACT
3 |
E05A4 |
WING
FORTRESS
|
E0C10
|
HILL
TOP ACT
1 |
E1018 |
ACT 2 |
E1396 |
HIDDEN
PALACE |
2E8C80 |
OIL
OCEAN ACT
1 |
E1A4A |
ACT
2 |
E1F18 |
MYSTIC
CAVE
ACT
1 |
E23DA |
ACT
2 |
E26F2
|
CASINO
NIGHT
ACT 1 |
33F06E
|
ACT
2 |
33F74C
|
CHEMICAL
PLANT
ACT 1 |
E2A88
|
ACT
2 |
E2EFC |
DEATH
EGG |
2EB230 |
AQUATIC
RUIN
ACT 1 |
E34D8 |
ACT 2 |
E398E |
SKY
CHASE |
2EBBDE |
I
BEGIN OF KNUCKLES IN THE PHASES
In
this part you can define in that point of the screen Knuckles begins. To select
a place different from the original. Use the debug mode. Go to the place from
where you want to begin and write down the coordinates (first line in the place
of Score), Tends in hands the coordinates it places them in the place of the
level chosen accordingly below in the address of the table.
LEVEL |
LOCATION |
COORDINATES |
Emerald
Hill 1 |
30A488 |
0060028F |
Emerald
Hill 2 |
30A48C |
006002AF |
01-00 |
30A490 |
0060028F |
01-01 |
30A494 |
006002AF |
Wood
1 |
30A498 |
006001AC |
Wood
2 |
30A49C |
006001AC |
03-00 |
30A4A0 |
0060028F |
03-01 |
30A4A4 |
006002AF |
Metropolis
1 |
30A4A8 |
0060028C |
Metropolis
2 |
30A4AC |
006005EC |
Metropolis
3 |
30A4B0 |
0060020C |
05-01 |
30A4B4 |
006002AF |
Wing
Fortress 1 |
30A4B8 |
006004CC |
Wing
Fortress 2 |
30A4BC |
01E004CC |
Hill
Top 1 |
30A4C0 |
006003EF |
Hill
Top 2 |
30A4C4 |
006006AF |
Hidden
Palace 1 |
30A4C8 |
023001AC |
Hidden
Palace 2 |
30A4CC |
023001AC |
09-00 |
30A4D0 |
0060028F |
09-01 |
30A4D4 |
006002AF |
Oil
Ocean 1 |
30A4D8 |
006006AC |
Oil
Ocean 2 |
30A4DC |
0060056C |
Mystic
Cave 1 |
30A4E0 |
006006AC |
Mystic
Cave 2 |
30A4E4 |
006005AC |
Casino
Night 1 |
30A4E8 |
006002AC |
Casino
Night 2 |
30A4EC |
0060058C |
Chemical
Plant 1 |
30A4F0 |
006001EC |
Chemical
Plant 2 |
30A4F4 |
0060012C |
Death
Egg 1 |
30A4F8 |
0060012D |
Death
Egg 2 |
30A4FC |
0060012D |
Aquatic
Ruin 1 |
30A500 |
0060037E |
Aquatic
Ruin 2 |
30A504 |
0060037E |
Sky
Chase 1 |
30A508 |
01200070 |
Sky
Chase 2 |
30A50C |
01400070 |
EVENTS
In
the games of Sonic, the Sega Logo, The screen of I title, the levels, the
Special Stages, etc.. they are different events and they are called with
different codes and you it can you work them placing its values in the
appropriate place, the numbers that you will see below in the table they simply
belong the code of the game and theses numbers don't polish by chance of 4 in 4,
If you go until the address 0x3000A0 you will see several numbers 6000xxxxx it
notices that the neighbor 6000xxxx has one it distances of 4 bytes of the
address 0x3000A0, the neighbor 6000xxxx has 8 bytes of the address 0x3000A0 and
so on. Before you wonder: what does this have of important? - I answer: being
known the exact initialization place of the events you can reprogram them
without affecting the operation of the game. See below in the table the events
and its respective initialization addresses.
EVENT |
ID: |
START |
Sega
Logo |
00 |
0x303310 |
Screen
Titles |
04 |
0x3034E8 |
Demo
Mode |
08 |
0x3039A0 |
Normal
Gameplay |
0C |
0x3039A0 |
Special
Stage |
10 |
0x304A0A |
Continue |
14 |
0x3072A6 |
Level
Select Menu |
18-1C |
0x3076C2 |
End
Sequence |
20 |
0x308008 |
Level
Select Menu |
24 |
0x3076C2 |
CODES
OF THE GAME
Level
Select Menu
In
this part you will know the codes of the game and as to alter them, the access
code to the Level Select Menu is: up, up, up, down, down, down, left, right,
left, right. In the Rom this code this stored in the format of the keys of the
game and you it can it simply alters placing the value of the corresponding key.
The code this stored in the address 0x3038E2 and you will see the following
bytes: -01-01-01-02-02-02-04-08-04-08-00-FF - where: 01-is up, 02 is down,
04 is left, 08 is right and 00-FF indicate end of the code, you can modify the
access code to level select menu even so the game only accepts code for the
directional keys, you should place the bytes 00-FF in the end to indicate that
the code finished
TABLE
SUMMARY
CODE |
LOCATION |
Level
Select Menu |
0x3038E2
á 0x3038ED |
Keys |
Value |
UP |
01 |
DOWN |
02 |
LEFT |
04 |
RIGHT |
08 |
Debug
Mode and Super Knuckles
Them
code to proceed is made after having been acessed the level select menu and they
are inserted in Sound Test playing the respective music. These are easier to
alter because are stored in Rom in the same way that are typed in Sound Test.
The only difference in relation to the access code to the level select menu is
that you have to type FF instead of 00-FF to indicate it I finish of the code.
See below in the table the codes and its respective locations.
Event |
Code |
Location |
Debug
Mode |
01-09-09-04-01-00-01-08 |
0x307C7A
to 0x307C81 |
All
Emeralds (Super Knuckles) |
01-06-07-07-07-02-01-06 |
0x307C83
to 0x307C8A |
CURIOSITIES
You will see the codes of Sonic 2 alone, but without none usefulness in this game, now the onlooker is that if these codes were used the game it would not join in the music Oil Ocean when being made the code (01-01-02-04), because if you observe in the address 0x307C4C you will see the bytes 10-3C-00-BF and not 10-3C-00-3F as it happens in the game of Sonic 2 and that it causes the lock in the music Oil Ocean, I am commenting this because it Sega it didn't correct this bug nor in Sonic Jam in spite of not joining in the music OIL OCEAN SONIC JAM doesn't play the Sound of the it continues that should be played when doing the code 01-01-02-04. Many other bugs that happen in the cartridge of Sonic 2 doesn't happen in this version, a simple example is the bug of the debug that when you die and it tries to place an object in the screen the game it doesn't place the object in the screen while you doesn't leave in the edition way and to come back, being avoided the game as soon as freezes.