Sonic
the Hedgehog 2 & Knuckles
Hacking Guide
Using a hexadecimal editor is possible to modify the game,
publishing it byte to byte. Knowing where it is each instruction and altering it
correctly you can personalize the game. You can draw other character in the
place of Sonic, but this is not easy since it has that if fact point to point.
To alter the name of the levels in the level select menu and in title it of the levels. But to program
the game it is necessary that he is in the binary format, it is not very
difficult to convert the game for binary, you can use a conversion program or
emulative Genecyst that he/she has the option DUMP ROM, that makes the
conversion.
In
spite of Sonic 2 & Knuckles to be just Sonic 2 coupled Sonic & Knuckles,
this game can be considered a new version of Sonic 2, because the game Sonic
& Knuckles after identifying the cartridge coupled Sonic 2 activates a
memory that is at the end of the two games, and this memory tells all the
instructions of the game of Sonic 2 basically & Knuckles, just using the
cartridge of Sonic 2 for the graphs and maps of the levels, see that in this
manual you will see that the information that are altered in most of the case
meet above the address 0x300000 and little thing they were among the addresses
0x200000 to 0x2FFFFF that is where the game of Sonic 2 is in the memory when
being coupled Sonic & Knuckles, tends above in hands the information and
more in elapsing perhaps of the document you uniform that can say that the game
Sonic 2 & Knuckles a new game of Sonic 2 can be considered with
Knuckles.
Observe
the table below with the levels and with its respective ids, these ids is
important because the game uses these ids for if referene the certain
level..
|
LEVEL |
ID |
|
EMERALD HILL |
00 |
|
METROPOLIS |
04 |
|
METROPOLIS |
05 |
|
WING
FORTRESS |
06 |
|
HILL TOP |
07 |
|
OIL OCEAN |
0A |
|
MYSTIC
CAVE |
0B |
|
CASINO
NIGHT |
0C |
|
CHEMICAL
PLANT |
0D |
|
DEATH EGG |
0E |
|
AQUATIC
RUIN |
0F |
|
SKY CHASE |
10 |
Notice that some numbers
are jumped as of the 01, 03, 06 and 09.
In spite of not existing a level name for these ID's in the relationship
and nor in the level select menu. If you place these ID's that they are lacking
it can access lost levels (Makes the experience and see the results). it
Observes the table with the standard location of the phases and soon soon after
an explanation. .
|
Level |
Address |
|
EMERALD
HILL
ACT 1 |
307906 e 307907 |
|
ACT 2 |
307908 e
307909 |
|
CHEMICAL
PLANT
ACT 1 |
30790A e 3079B |
|
ACT 2 |
30790C e
30790D |
|
AQUATIC
RUIN
ACT 1 |
30790E e
30790F |
|
ACT 2 |
307910 e 307911 |
|
CASINO
NIGHT
ACT 1 |
307912 e
307913 |
|
ACT 2 |
307914 e
307915 |
|
HILL
TOP
ACT 1 |
307916 e
307917 |
|
ACT 2 |
307918 e
307919 |
|
MYSTIC
CAVE
ACT 1 |
30791A e
30791B |
|
ACT 2 |
30791C e 30791D |
|
OIL
OCEAN
ACT 1 |
30791E e
30791F |
|
ACT 2 |
307920 e
307921 |
|
METROPOLIS
ACT 1 |
307922 e
307923 |
|
ACT 2 |
307924 e 307925 |
|
ACT 3 |
307926 e 307927 |
|
SKY
CHASE |
307928 e 307927 |
|
WING
FORTRESS |
30792A e
30792B |
|
DEATH
EGG |
30792C e 30792D |
The table above indicates
where they are located the configuration bytes in the screen of level select.
The 1st. address of the table it indicates the byte of the zone and
the 2nd. address indicates the act byte. Example in the address
307916 you will see the byte 07 (Hill Top zone) and in the address 307917 you
will see the byte 00 (Act 1).
LEVELS MUSIC
You can also choose the
music to be played in the levels. The format is of just a byte for level and it
is very simple. To place another music of its preference, play the sounds in the
sound test, write down the number of the music and place in the byte that
represents the chosen level. See
below in the table the location of the selection of music. Observation: When
modifying the music of the levels it adds 80 to the number of Sound Test and
place in the wanted place, the table below has some examples of as the midis
they are in Rom and as they appear in Sound Test.
|
LEVE: |
Music in
the Rom |
Music in
the Sound Test |
Address |
|
EMERALD HILL |
82 |
02 |
30397C |
|
ID
01 |
82 |
02 |
30397D |
|
WOOD ZONE |
85 |
05 |
30397E |
|
ID 03 |
84 |
04 |
30397F |
|
METROPOLIS |
85
|
05 |
303980
|
|
METROPOLIS 3 |
85
|
05 |
303981
|
|
WIN
FORTRESS |
8F
|
0F |
303982
|
|
HILL TOP |
86
|
06 |
303983
|
|
HIDDEN PALACE
|
90 |
10 |
303984 |
|
ID 09 |
8D |
0D |
303985 |
|
OIL OCEAN |
84 |
04 |
303986 |
|
MYSTIC CAVE |
8B |
0B |
303987 |
|
CASINO
NIGHT |
89 |
09 |
303988 |
|
CHEMICAL PLANT |
8E |
0E |
303989 |
|
DEATH
EGG |
8A |
0A |
30398A |
|
AQUATIC
RUIN |
87 |
07 |
30398B |
|
SKY CHASE |
8D |
0D |
30398C |
ALTERING OBJECTS
You can also alter objects
in the levels as badnicks, lives, obstacles, etc... The configuration of the
objects in the levels uses 6 long bytes, being in the format XX-XX-YY-YY-OO-VV.
Explaining to X's better indicates the horizontal position in the screen, Y's
indicates the vertical position in the screen, O's indicates the objects they be
she placed and V's indicates the possible variations of each object. To obtain
the exact location of the place where you want for the objects, make the code of
the debug mode and write down the first line of coordinates in the place of
SCORE, These will be the coordinates that you should type to place the object in
the wanted place. See the location where game it search the objects of the
levels. The levels finish the mappings before the bytes FF-FF-00-00-00-00.
Starting from these bytes next level begins.
|
.EMERALD HILL
ACT
1 |
DF3FE
|
|
ACT 2 |
DF7B2 |
|
METROPOLIS
ZONE
ACT 1 |
DFBD2
|
|
ACT 2 |
E005E
|
|
ACT
3 |
E05A4 |
|
WING
FORTRESS
|
E0C10
|
|
HILL
TOP ACT
1 |
E1018 |
|
ACT 2 |
E1396 |
|
HIDDEN
PALACE |
2E8C80 |
|
OIL
OCEAN ACT
1 |
E1A4A |
|
ACT
2 |
E1F18
|
|
MYSTIC CAVE
ACT
1 |
E23DA
|
|
ACT 2 |
E26F2 |
|
CASINO
NIGHT
ACT 1 |
33F06E
|
|
ACT 2 |
33F74C
|
|
CHEMICAL
PLANT
ACT 1 |
E2A88 |
|
ACT
2 |
E2EFC |
|
DEATH
EGG |
2EB230 |
|
AQUATIC
RUIN
ACT 1 |
E34D8 |
|
ACT 2 |
E398E |
|
SKY
CHASE |
2EBBDE |
I BEGIN OF KNUCKLES IN THE
PHASES
In this part you can define
in that point of the screen Knuckles begins. To select a place different from
the original. Use the debug mode. Go to the place from where you want to begin
and write down the coordinates (first line in the place of Score), Tends in
hands the coordinates it places them in the place of the level chosen
accordingly below in the address of the table.
|
LEVEL |
LOCATION |
COORDINATES |
|
Emerald Hill
1 |
30A488 |
0060028F |
|
Emerald Hill 2 |
30A48C |
006002AF |
|
01-00 |
30A490 |
0060028F |
|
01-01 |
30A494 |
006002AF |
|
Wood
1 |
30A498 |
006001AC |
|
Wood
2 |
30A49C |
006001AC |
|
03-00 |
30A4A0 |
0060028F |
|
03-01 |
30A4A4 |
006002AF |
|
Metropolis 1 |
30A4A8 |
0060028C |
|
Metropolis 2 |
30A4AC |
006005EC |
|
Metropolis 3 |
30A4B0 |
0060020C |
|
05-01 |
30A4B4 |
006002AF |
|
Wing
Fortress 1 |
30A4B8 |
006004CC |
|
Wing
Fortress 2 |
30A4BC |
01E004CC |
|
Hill Top
1 |
30A4C0 |
006003EF |
|
Hill Top
2 |
30A4C4 |
006006AF |
|
Hidden
Palace 1 |
30A4C8 |
023001AC |
|
Hidden
Palace 2 |
30A4CC |
023001AC |
|
09-00 |
30A4D0 |
0060028F |
|
09-01 |
30A4D4 |
006002AF |
|
Oil Ocean
1 |
30A4D8 |
006006AC |
|
Oil Ocean
2 |
30A4DC |
0060056C |
|
Mystic
Cave 1 |
30A4E0 |
006006AC |
|
Mystic Cave 2 |
30A4E4 |
006005AC |
|
Casino
Night 1 |
30A4E8 |
006002AC |
|
Casino Night 2 |
30A4EC |
0060058C |
|
Chemical
Plant 1 |
30A4F0 |
006001EC |
|
Chemical
Plant 2 |
30A4F4 |
0060012C |
|
Death Egg
1 |
30A4F8 |
0060012D |
|
Death Egg
2 |
30A4FC |
0060012D |
|
Aquatic
Ruin 1 |
30A500 |
0060037E |
|
Aquatic Ruin 2 |
30A504 |
0060037E |
|
Sky Chase
1 |
30A508 |
01200070 |
|
Sky Chase
2 |
30A50C |
01400070 |
EVENTS
In the games of Sonic, the
Sega Logo, The screen of I title, the levels, the Special Stages, etc.. they are
different events and they are called with different codes and you it can you
work them placing its values in the appropriate place, the numbers that you will
see below in the table they simply belong the code of the game and theses
numbers don't polish by chance of 4 in 4, If you go until the address 0x3000A0
you will see several numbers 6000xxxxx it
notices that the neighbor 6000xxxx has one it distances of 4 bytes of the
address 0x3000A0, the neighbor 6000xxxx has 8 bytes of the address 0x3000A0 and
so on. Before you wonder: what does this have of important? - I answer: being
known the exact initialization place of the events you can reprogram them
without affecting the operation of the game. See below in the table the events
and its respective initialization addresses.
|
EVENT |
ID: |
START |
|
Sega Logo |
00 |
0x303310 |
|
Screen Titles |
04 |
0x3034E8 |
|
Demo Mode |
08 |
0x3039A0 |
|
Normal Gameplay |
0C |
0x3039A0 |
|
Special
Stage |
10 |
0x304A0A |
|
Continue |
14 |
0x3072A6 |
|
Level
Select Menu |
18-1C |
0x3076C2 |
|
End Sequence |
20 |
0x308008 |
|
Level
Select Menu |
24 |
0x3076C2 |
CODES OF THE GAME
Level Select Menu
In this part you will know
the codes of the game and as to alter them, the access code to the Level Select
Menu is: up, up, up, down, down, down, left, right, left, right. In the Rom this
code this stored in the format of the keys of the game and you it can it simply
alters placing the value of the corresponding key. The code this stored in the
address 0x3038E2 and you will see the following bytes:
-01-01-01-02-02-02-04-08-04-08-00-FF - where: 01-is up, 02 is down, 04 is
left, 08 is right and 00-FF indicate end of the code, you can modify the access
code to level select menu even so the game only accepts code for the directional
keys, you should place the bytes 00-FF in the end to indicate that the code
finished
TABLE SUMMARY
|
CODE |
LOCATION |
|
Level
Select Menu |
0x3038E2 á 0x3038ED |
|
Keys |
Value |
|
UP |
01 |
|
DOWN |
02 |
|
LEFT |
04 |
|
RIGHT |
08 |
Debug Mode and Super
Knuckles
Them code to proceed is
made after having been acessed the level select menu and they are inserted in
Sound Test playing the respective music. These are easier to alter because are
stored in Rom in the same way that are typed in Sound Test. The only difference
in relation to the access code to the level select menu is that you have to type
FF instead of 00-FF to indicate it I finish of the code. See below in the table
the codes and its respective locations.
|
Event |
Code |
Location |
|
Debug
Mode |
01-09-09-04-01-00-01-08 |
0x307C7A
to 0x307C81 |
|
All
Emeralds (Super Knuckles) |
01-06-07-07-07-02-01-06 |
0x307C83
to 0x307C8A |
CURIOSITIES
You will see the codes of Sonic 2 alone, but without none usefulness in this game, now the onlooker is that if these codes were used the game it would not join in the music Oil Ocean when being made the code (01-01-02-04), because if you observe in the address 0x307C4C you will see the bytes 10-3C-00-BF and not 10-3C-00-3F as it happens in the game of Sonic 2 and that it causes the lock in the music Oil Ocean, I am commenting this becaus