A Brief History of Hacking

As you may know, I was the one who originally found the secret behind switching levels in an emulator, and discovered how to get the Hidden Palace zone in a save state. I also found out how to activate debug in Sonic 2 beta (sort-of), and have done even more hacking since!

Back... Back, through the mists of time... to my original Genesis, and my cart of Sonic 2.

It all started when I first got my Action Replay cheat cartridge. A code-book was supplied with it, and naturally I looked at the Sonic sections first. All the usual ones were there, infinite lives, unlimited rings etc. I then saw the code to select levels, and noticed in the level table that 08 said (Incomplete) Hidden Palace. I tried it out, and since then I was obsessed with the zone, trying to get more graphics in, fiddling with more codes etc.

My original site was the first to show the pics of Hidden Palace Zone, scanned from my Genesis console.

When emulators came out, I dumped the Sonic 2 ROM and tried to get Hidden Palace on an emulator - but failed. Emulators didn't support the Action Replay cheats. Then I had a thought - if an emulator save state is just a dump of the Genesis RAM with a bit tagged on, I should be able to find the RAM in a save state!

I took a snapshot of a normal place in Emerald Hill, and also dumped the RAM for that exact point. Then, I studied the RAM in a hex editor:

+-[_]--------0--1--2--3--4--5--6--7--8--9--A--B--C--D--E--F----------------[]-+
¦ 00000A0 ¦ F0 4C F0 50 F0 56 F0 50 F0 50 F0 51 F0 50 F0 4D ¦ _L_P_V_P_P_Q_P_M ¦
¦ 00000B0 ¦ F0 05 F0 06 F0 05 F0 06 F0 05 F0 06 F0 05 F0 06 ¦ _._._._._._._._. ¦
¦ 00000C0 ¦ F0 07 F0 08 00 07 00 08 00 07 00 08 F0 07 F0 08 ¦ _._........._._. ¦
¦ 00000D0 ¦ F0 0A F0 0B 00 0A 00 0B 00 0A 00 0B F0 0A F0 0B ¦ _._........._._. ¦
¦ 00000E0 ¦ F0 15 F0 15 F0 15 F0 15 F0 15 F0 15 F0 15 F0 15 ¦ _._._._._._._._. ¦
¦ 00000F0 ¦ F0 05 F0 06 F0 05 F0 06 F0 05 F0 06 F0 05 F0 06 ¦ _._._._._._._._. ¦
¦ 0000100 ¦ 00 00 00 00 00 00 00 00 F0 2B F0 2C F0 2D F0 2E ¦ ........_+_,_-_. ¦
¦ 0000110 ¦ F0 2B F0 2C F0 2D F0 2E F0 2F F0 30 F0 41 F4 41 ¦ _+_,_-_._/_0_A_A ¦

Afterwards, I loaded up the save state in my hex editor, and looked for the same piece of code. Sure enough, I found it!

+-[_]--------0--1--2--3--4--5--6--7--8--9--A--B--C--D--E--F----------------[]-+
¦ 0002510 ¦ 00 03 00 04 04 04 04 03 F0 4C F0 50 F0 56 F0 50 ¦ ........_L_P_V_P ¦
¦ 0002520 ¦ F0 50 F0 51 F0 50 F0 4D F0 05 F0 06 F0 05 F0 06 ¦ _P_Q_P_M_._._._. ¦
¦ 0002530 ¦ F0 05 F0 06 F0 05 F0 06 F0 07 F0 08 00 07 00 08 ¦ _._._._._._..... ¦
¦ 0002540 ¦ 00 07 00 08 F0 07 F0 08 F0 0A F0 0B 00 0A 00 0B ¦ ...._._._._..... ¦
¦ 0002550 ¦ 00 0A 00 0B F0 0A F0 0B F0 15 F0 15 F0 15 F0 15 ¦ ...._._._._._._. ¦
¦ 0002560 ¦ F0 15 F0 15 F0 15 F0 15 F0 05 F0 06 F0 05 F0 06 ¦ _._._._._._._._. ¦
¦ 0002570 ¦ F0 05 F0 06 F0 05 F0 06 00 00 00 00 00 00 00 00 ¦ _._._._......... ¦
¦ 0002580 ¦ F0 2B F0 2C F0 2D F0 2E F0 2B F0 2C F0 2D F0 2E ¦ _+_,_-_._+_,_-_. ¦

Then, using a little bit of calculation, I found the point where the Genesis RAM dump starts in the save state. I worked it out as 2478.

Then I could begin my real hacking... I took the code for accessing Hidden Palace, and chopped off the first two Fs to give me the address FE10. Then, using a hex calculator, I added together the raw address and the address of the start of the RAM, to give me the location in the save state. It came out as 12288. I then went back to the hex editor, found that location and changed its value from 00 (Emerald Hill) to 08 (Hidden Palace). Sure enough, when I reloaded the save state I was in Hidden Palace! The debug code for Sonic 2 beta was worked out in the same way - FE09 + 2478 = 12281 - change that to 01 to enable debug!

I then replaced my Genesis scans of Hidden Palace zone with screenshots from the emulator.

2. Knuckles in Sonic 3 trick

This one was slightly trickier, in that I did not have an original code to work from. Therefore, I went to the game select screen in Sonic 3, and took three save states with different characters selected - one for Sonic&Tails, one for Sonic alone, and one for Tails alone. I then went into DOS and did FC on the files, and wrote down all the locations where 00 had changed to 01, then to 02. (This is the way the Action Replay cheat search works) Eventually I found three locations, and by doing more save states was able to narrow the possibilities down to one. I then went to that area in the save state, and changed it to 03. Sure enough, when I reloaded the save state Knuckles was selected!

Here's a hint - if you're using FC to compare savestates and the list of differences is too big to be displayed all at once, then try it like this:

FC /B FILE1 FILE2 > DIFF.TXT

This will create a file called DIFF.TXT which will contain the output of FC - look at that to find the differences.