Announcement

**ugetab** · 10-08-2006, 11:14:18 PM

How about this:
I'd rather have people who can rise to the level needed to use it, instead of bringing it down to the level that people want it at. If it's explained like the readers are idiots, too many idiots will start doing idiot things with it, and code quality will suffer in the name of code quantity.

**Lazy Bastard** · 10-09-2006, 11:15:11 AM

Heh, this is a point ugetab and I disagree on. I propose that beginners can become advanced hackers later, and that young hackers may grow up and learn more extensively later on, but without that initial push into hacking, they may just move on to other endeavors, and become mathematicians or something...ugetab contests that, if someone wanted to hack badly enough, they'd figure it out.

In any case, since I've never used the Gens Tracer, don't really hack Genesis, and don't have the time to play around with it and let you know, I can't help you, heh.

**Whipon** · 10-09-2006, 06:58:40 PM

ugetab, who entitled you as the Saint of the Rom Hackers???

Well, my friend ugetab, i was only asking for help, because i don't know how to use Gens Tracer. Are you a Super Hacker for knowing to use it?. I'm a IDIOT for asking for help?. I think you must descend for your throne in the sky. If you don't want to help DONT ATTACK to the "IDIOTS" who want help for, maybe, some day become a Hacking God like you and have a sit to the right of the Lord.
I learned how to make NES game genie codes thanks to Tony Hedstrom and his faqs. You are calling him a super villian to teach the "IDIOTS" how to hack. What in the hell do you mean with "the idiots will start to make stupid things"??????. Maybe if I can make a GG code I will create an Atomic Bomb with a Genesis cartdridge?. Reading your post I uderstand your point: any person who whants to learn from others is an idiot. If i could learn by miself I do so. But if I remember right this forum name is "School of Hacking". As i said if you don't want to help, or if you think that we "IDIOTS" dont deserve your vast knowledge DONT INSULT THE PEOPLE WHO WANTS TO LEARN.
Thats all. Thank you very much for reading. I feel very relaxed now.

**Pugsy** · 10-09-2006, 07:10:24 PM

The skill & fun comes with cheats that are not possible with just RAM locations so I agree with ugetab on this, if you are interested in modifying game code you are basically on your own and as a complete beginner it's unlikely you will have much success with bugfree cheats other than straight RAM-ROM transfers. I have my own tool I use to aid ROM invincibility cheat making a lot easier - but in the wrong hands it could lead to a load of buggy cheats (and as it's main use is for MAME ROM cheats I won't release it at all incase it backfires).

I've personally never used the Gens Tracer either and probably never will, you use the tools you are used to unless something better comes along. Have you tried the debugger in HazeMD? Which I think is likely to be much more powerful? If you can get yourself fixed up with HazeMD and the romset and know basically how to use it I can give you a few pointers on how to use it to convert a RAM cheat into a ROM cheat.

**Whipon** · 10-10-2006, 04:31:36 AM

Thank you, it would be great

I had no problem in try another program. If HazeMD is more powerfull and you know how to use it, please, tell me the correct way to use it. Finding ram cheats is very easy for me, I only had problems triying to make them GG codes. I tried the Chemistry method and Gens tracer with no luck. So i asked for help. I'll appreciatte very much if you can lend me a hand with HazeMD.
Thanks a lot!.
Whipon.

**Pugsy** · 10-10-2006, 07:57:13 AM

You asked for it....

Point to Note, If you find RAM locations using the HazeMD cheat engine that you want to convert to ROM cheats they will be in the format E0XXXX to use them in the HazeMD debugger you will need to change them into FFXXXX.

I'm assuming that you've got HazeMD and have set it up - ie you've rebuilt the ROMs using clrmame to use the correct mame format names (I'm not going to hold your hand with that)

Here's a worked example for infinite lives for the game "Chuck Rock (U) [c][!]" , I personally always use the commandline to run HAZEMD - but you can use a fronted like emuloader with it. I'm not sure if hazemd32 has a debug build (hazemd comes with the non-debug hazemd.exe & and the debug hazemdd.exe)

From the cheat.dat for hazemd we have these RAM cheats:-

Code:

; [ Chuck Rock (U) [c][!] ]
:g_chuk:00000000:E006D1:00000009:FFFFFFFF:Infinite Lives
:g_chuk:00000000:E006D5:00000007:FFFFFFFF:Infinite Energy
:g_chuk:00000000:E00657:00000003:FFFFFFFF:Invincibility

On the commandline type

Code:

hazemdd -debug -joy g_chuk

The game info will then display just press the space key

You will then be dumped into the debugger,

Now in the debugger type

Code:

IGNORE 1

{this will make the debugger ignore the Z80 cpu on the genesis - all cheats use the 68000 which is CPU 0}

Now hit F12 to exit the debugger and start the ROM

Now start playing the game so you are ready to lose a life

Press the tilde or the ~ key (the key that is normally next to the escape key) to enter the debugger

From the cheat file you will see that infinite lives uses location E006D1, which you will need to replace the E0 with FF for the debugger watchpoint to catch it so, in the debugger type

Code:

WP FF06D1,1,w

{type HELP WPSET if you want an explanation of what that does in the debugger - or just HELP for other instructions/functions}

Now press F12 and lose the rest of the energy...and then you will be dumped back into the debugger at 2056A and this will be displayed in the debugger

Code:

02055E: 6692                       bne     $204f2
020560: 6100 DB5C                  bsr     $1e0be
020564: 5379 FFFF 06D0             subq.w  #1, $ffff06d0.l
02056A: 6A06                       bpl     $20572
02056C: 4EF9 0002 0588             jmp     $20588.l

So you can see that the previous instruction before 2056A is a sub at 020564 which is the lives decrement, the thing you've got to remember is that if you are going to change an instruction that's just before a branch is if you just NOP it you may well find that the branch is not handled correctly so it is better to try and change the decrement in a way which allows the branch still to be tested so a compare is better (you need a good understanding of 68000 instructions). There are many ways of skinning a cat, so you can play around with a way of changing it so that you'd only need to change one instruction - here's a cool way that will make life easier

change

Code:

020564: 5379 FFFF 06D0             subq.w  #1, $ffff06d0.l

to

Code:

020564: 5379 0001 06D0             subq.w  #1, $106d0.l

This method is quite good as 106D0 is a rom address and so the subq won't have any effect and the branch will always be taken and it will only need a single GG code (just remember to check the value in the location isn't going to cause a problem in this case it won't).

So in hazemdd format we'd have this:-

Code:

:g_chuk:20900000:020566:00000001:FFFFFFFF:Infinite Lives:ROM Cheat

Plug 020566:0001 into the GG Code Creator

and you will get

Code:

AECT-EADG   which is the Game Genie code for Infinite Lives

Just follow this method and GG codes from existing RAM cheats is frankly just a tedious exercise (and rather pointless unless you have an actual Genesis and GG with that game)

The debugger has a lot more features like DASM and TRACE that makes making cheats a lot easier - you will just have to play.

**Whipon** · 10-10-2006, 06:30:58 PM

Thank you very much!!!

Thanks for the info. I'll start to hack right now. I appreciatte very much your help. I have a lot of games I love to cheat. I have an Ngage and i use a Genesis emulator in it: Picodrive. The latest version supports Game Genie, but doesn't support PAR. So i tried to hack Rings of Power with the methods avalaible in the web but i had no results. But hanks to you now I can spare another night hacking it to the bone!!!!. Thank you very much again, you re great!.
Whipon.

**Tony H** · 10-10-2006, 06:49:44 PM

Pugsy, that's a neat trick changing the RAM address to a ROM address (FFFF 06D0 to 0001 06D0). Thanks for posting that.

Tony.

**Whipon** · 10-13-2006, 09:06:35 PM

What about master codes?

Thanks to the info by Pugsy I'm having a lot of fun. But I have some problems with some games: the master code. It's possible to make one?. I just was wondering if them can be created with HazeMD and his great debugger.
Whipon.

**Pugsy** · 10-14-2006, 05:48:59 AM

I've never actually made any master codes as such, I presume a master code is just a way of bypassing any crc/checksum checks on the game code. Two things you can do to help you find the code to bypass these is checks as far as I can see:-

1. Use the DASM command and dump the code around the master location for several games were you have a master code and then see if you can see any common methods of doing the check (you should probably find that games from the same company use the same instructions though probably at a different address).

2. When the debugger is first loaded put a BP on the Program Counter location and then run the game as normal (continue with F12 if it hits the BP) then during play press F3 to reset the game, the debugger should kick in as it hits the breakpoint then execute a TRACE in the debugger (eg TRACE gamenocheats) until the sega logo is displayed then press the tilde key and type TRACE OFF. F12 back to the game, enable a ROM cheat that will cause the game to hang if it's enabled from the start (normally you enable HAzeMDD cheats after the game is run - so you avoid the checksum checks at the very beginning). Now press F3 to reset the game and the debugger will kick in again - now useTRACE again (eg TRACE gamewithcheat) until it's obvious the sega logo is no going to be displayed (eg a red screen) then press the tilde key and type TRACE OFF. Now open the two TRACE files which you will find in the HAZEMD folder and compare them side by side..the files should be identical until a checksum branch is taken in one file and not taken in the other.. Then it should just be a matter of forcing that branch to operate the same way as it does in the good trace file....at least it puts you in the right area to look.

**Tony H** · 10-14-2006, 02:16:18 PM

Whipon, I've been thinking about writing a beginners guide to making Genesis master codes, but have never gotten around to it. I've figured out a way for people that don't know any 68k assembly to make master codes. I'll give you a very quick condensed version of it here.

Before I get started, let me mention something... this method will NOT work for every game. It's best to know some basic 68k assembly to make master codes, but this method should help those that don't know any assembly.

Remember, this is going to be a VERY short version. In other words, I'm writing this in a hurry.

You'll need a copy of Gens and a hex editor. I'm using Gens Ver 2.10 and Hex Workshop 2.54 (I know 2.54 is old, but it's paid for).

Open your ROM with Gens. In Gens, add a Game Genie code and activate it. It can be almost any GG code you want. All we're trying to do is upset the checksum routine so we get a blank/red screen. This GG code will work fine: AATT-AATT.

Once the GG code it activated, press "TAB". This will reset the game. You should get a red/blank screen.

Next, click on "CPU / Debug / Genesis - 68000". You should see one line of code in red. Write down the first number in this line. This is a ROM address.

Exit Gens.

Open up the ROM with your hex editor.

Go to the ROM address that you wrote down from Gens and click on it with your mouse. Click on "Edit / Find". Under "Direction", make sure you click on "UP". Where it says "Find What", type in 66. Click "Find Next". If the first match is an even number, write down the address and the 2 byte opcode for that address (ie. 66xx). If it's an odd number, skip it and search again until you find an even numbered match. You only need 1 match (address).

Now go back to the original ROM address you got from Gens and do the exact same thing you did with the number 66, except this time, do it with the number 67. Just remember to skip odd numbered addresses. Once you find the first match for 67 that's an even number, write it down (ie. the ROM address and the 2 byte opcode (67xx))

You should now have 2 ROM addresses written down along with their 2 byte opcodes. One for 66, and one for 67. Pick the higher number of the two addresses. Make a Game Genie code to change that ROM address like so: if it's a 66xx, then make a GG code to change it to 67xx. If it's a 67xx, then make a GG code to change it to 66xx.

If your new GG code doesn't work, try using the other ROM address and doing the same thing (change 66xx to 67xx etc).

If it still doesn't work, try changing either of the opcodes to 60xx.

Well, that's it. All we're trying to do here is change a BNE to BEQ and visa versa. BNE and BEQ = Branch if not equal and Branch if equal.

I just read over what I just wrote and I can tell I skipped a lot of stuff, so I'm quessing you'll have some questions. If you have any questions, let me know which game you're trying to make a master code for and I'll use that ROM as an example.

Tony.

P.S. Remember, this method will NOT work for every game. I still need to add a LOT of stuff to it, but as I add more info, the guide becomes harder to follow. There's hopefully a good compromise somewhere.

**Tony H** · 10-14-2006, 07:15:13 PM

Here's an example of the method from above...

The game is Cyborg Justice.

Start Cyborg Justice in Gens. Activate a Game Genie code (AATT-AATT) and press TAB to reset the game and get a blank red screen. Click on "CPU / Debug / Genesis - 68000". In the debugger, look at the top left hand corner and you'll see one red line of code which reads:

0336 BRA #$FE

Write down the first number: 0336. This is a ROM address.

Close Gens.

Open the Cyborg Justice ROM with a hex editor (make sure it's in BIN format).

Go to the ROM address you wrote down from before (0336) and click on it with your mouse. Click on "Find". Under "Direction" click "UP", and at "Find What" type 66. Click "Find Next" and you get a match at $24C. That's an even number, so write it down like this: 00024C:66FC (66FC is the opcode at that address).

Next, do the same thing as with the 66, except for 67. Start back at 0336 and search "Up" for 67 and the first match is $31C. That's also an even number (remember, we don't want any odd numbers) so we'll keep it. Write it down like this: 00031C:673E (673E is the opcode at that address).

So the 2 ROM addresses (and opcodes) we have are:

00024C:66FC
00031C:673E

Pick the higher number of the two. 00031C is higher than 00024C so 00031C:673E is the one we'll try first.

Now all we need to do to make our Game Genie master code is change the 00031C:673E to 00031C:663E. So enter this into a Game Genie to hex conversion program (there's a GG conversion program here at GSHI or there's one on my web site). Here's what you enter into the GG conversion program: 00031C:663E = H2BT-AN26.

H2BT-AN26 is your master code. If you try it out, you'll see that it works fine.

Hope that helps.

Tony.

EDIT: Just in case you don't know how to count in hex, here are all the even numbers: 0 2 4 6 8 A C E.

**Whipon** · 10-14-2006, 09:01:43 PM

Thank you!!!

Thanks a lot!. I'll start to practice the methods right now

!. As i said in another post, I appreciate very much your help, I started to hack roms a few months ago and I'm still learning. I focuse in the Infinite Amount codes or Start with more. And I'm very happy, because, thank to this site I'm having a lot of fun. Actually I'm hacking Alien Soldier (E). When I find the master code i'll post the codes. Also i have a lot of NES codes that I like to share. One more time: this site rocks!!!!!
Regards.
Whipon.

**Whipon** · 10-15-2006, 02:30:49 PM

No luck

I tried the two methods given above, but I had no luck with any of them. I'm triying to make a master code for Alien Soldier. these are the codes i created (PAR and GG):

Infinite Energy,
FFA216:0BB8
0146E2:600C

Infinite Phoenix Teleport,
017C02:4E71

Infinite Ammo Weapon 1,
FFA260:0BB8
01871A:6002

Infinite Ammo Weapon 2,
FFA262:0BB8
018AFE:6002

Infinite Ammo Weapon 3,
FFA264:0BB8
018BE2:6002

Infinite Ammo Weapon 4,
FFA266:0BB8
018D0C:6002

Infinite Time,
FFA270:0999
0133B2:6002
0133AA:6002

And these are the rom addresses that i found with the Tony Hedstrom method:
The one given by the debug in Gens:
05B4
The Addresses found with the hex editor in the rom:
00034C:6700
00052E:66F6

I changed these 2 with the same result: the red screen.

Anyway hacking is fun and I enjoyed triying

!!!!

Whipon.

Announcement

Please, somebody make a Gens Tracer Tutorial!!!!

Please, somebody make a Gens Tracer Tutorial!!!!

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment