Eternal Champions (Genesis/MD) Hacking questions

[Billytime!]

Thank you for taking the time to read this, I have a project in the works regarding the original Eternal Champions. While I am relatively new at 68000 asm, I have been fairly adept at 65816 asm when it came to hacking SNES games so the transition was... somewhat smooth? Currently I have made cheats for every move that uses Inner Strength in order to completely overhaul the way the special moves system works in the game plus a few other helpful codes which is all documented in the link below.

But I'm going to cut to the chase here, I'm stumped on a few things.

1.Slowing down the in game timer:
Using FF9CB4 as a breakpoint in Gens r57 seems to get me to the right place, but I haven't found the right modification to slow the timer down. 99 seconds feels more like 40 and time overs are very common for this reason.

2.Adjusting damage done by special moves
This isn't listed in the database but FFAABB is the ram address I use to modify P2's health. Also serves well as a breakpoint. When using trident's spinning trident (Yes, its a dumb name) by pressing X+Y+Z, I learn that 02 is stored in D6 while the opponent's remaining health is listed under D4. Here is a picture for reference.

https://imgur.com/nmqQzSF

3.Increasing hitstun when taking damage
This one I have no Idea to approach but to explain, when attacking an opponent its very easy to just break out of a combo by simply holding back to block. Further compounded by having the players pushed away from each other after each successive hit. I'm looking to have a longer hitstun and no player pushback to allow for more seamless combos.

EDIT: I do have a potential ram address to work with FFAB47

Any help and insight would be greatly appreciated. I love these consoles and games and I truly love the work I see on this site. It is really inspiring and I want to be a part of it. But first, some baby steps.

[Tony H]

Hi Billy. I'll take a look at some of these and see what I can figure out. I'm not familiar with Eternal Champions at all, so anything that requires in depth knowledge of the game, I may pass on.

[Tony H]

I have a solution for your first request (Timer). Since you're familiar with asm, I'll explain how I did this as I go along.

After looking at ways to slow down the timer, it was going to be a little more involved than I thought. There are 30 "checks" on the timer before it decreases, and I think the game runs at 30 FPS. Not sure if they're tied together or not, but decided to go with an easier approach. I can come back to this and spend more time on it if the solution below won't work for you.

How to add more starting time...

When you do a break point on the RAM address for the timer (FF9CB4), this is one of the results. It shows where the value of 99 for the timer is coming from in the ROM...

[01:FD5A] W08 = 99 [FF9CB5]

This is what the 68000 instruction looks like in the asm trace log...

01:FD56 11 FB MOVE.b $B8(PC,D0),($9CB5) A0=0001FD1A A1=000D3788 A2=000AB3B6 A3=FFFFDCA6 A4=FFFFE870 A5=FFFFB994 A6=00C00000 A7=00FFFFA4 D0=00000002

The ROM addresses for the different timer starting values are at ROM addresses 0001FD10 to 0001FD13. Those values are 30 60 99 99 (30 seconds, 60 seconds, 99 seconds, and 99 seconds (I think the second value of 99 is what's used if you select infinite time). In that instruction above, the value in register D0 determines which of those 4 timer values are going to be used (and I'm assuming the value in D0 comes from when you select the starting timer value in the options).

The problem with that instruction is that it is only moving a single byte, and it is handled as a decimal number, so 99 is the maximum you can use. I tried hex numbers, but didn't work. What we have to do, is change the instruction there so that it will move a word, instead of a byte. We can do this with 3 Game Genie codes (I'm showing them in raw format)...

01FD56:31FC = This is a move word instruction.
01FD58:0129 = this is the value that the move instruction is going to move (we can set this to any value we want to adjust the starting time).
01FD5A:9CB4 = This is the RAM address that the new value will be moved to (our timer RAM address)

I used a new starting time value above of 129, which will give you an extra 30 seconds of play time, but you can set it to any value you want. Just remember to treat it as a decimal number, and not a hex number. When the game starts, I think it will still initially show 99, then as soon as the match starts, the timer will show the second byte of our new value (29), then as soon as it reaches zero, the timer will continue counting from 99.

I'll take a look at the other requests later.

[Billytime!]

Just got done testing the code. While it is very useful, It does override 30 and 60 second time periods.

Good call on Decimal though, I normally search unsigned or hex.

I am interested in these timer checks however. I was looking at other timer codes for other games to see if I could find any similarities in instructions, such as the timer codes for the Sonic games. It seemed like a hole in one. lol

EDIT: I see the checks now.
00:2696 4A 78 TST.W ($9CB4)

I tried replacing the instruction with NOP via 4E71, timer still counts down as it normally would. This is getting very interesting.

[Tony H]

If I remember correctly, the timer speed in some sonic games was fairly easy to manipulate. I think i made a few Game Genie codes for that. The EC game is programed much differently.

[Billytime!]

I did some toying around with this address

01:FD96 67 1A BEQ #$1A [01:FDB2] A0=0001FD7C A1=000D3788 A2=000BB9C8 A3=FFFFDBFC A4=FFFFE870 A5=FFFFB69C A6=00C00000 A7=00FFFFA4 D0=000E0097 D1=00000001 D2=0000248C D3=000061DE D4=0000DBFC D5=0000003A D6=000000EB D7=000D000D xnzvc

Messing with 01FD96 and 01FD7C doesn't do much except to game the game crash the moment a single second counts down. I was thinking maybe the code was counting down milliseconds but I did find something neat here.

FFFFA4 is the ram address for the pause function which is loaded as A7. However toying with it causes a crash as well.

[Tony H]

I may come back to the timer issue later. Want to post some info I found on the damage done by special moves before I forget...

I used your example with Trident and his spinning attack thing, and traced the damage to P2 using the RAM address you posted for P2 health. You already found the right area to look at in the asm trace file, so I'll skip the memory trace part.

This is what it looks like in the asm trace file (similar to the image you posted above)...

01:7EE8 98 46 SUB.W D6,D4 A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000068 D5=0000023B D6=00000002 D7=00C00000 xnzvc

01:7EEA 37 44 MOVE.w D4,$0068(A3) A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000066 D5=0000023B D6=00000002 D7=00C00000 xnzvc

Looks like you already figured some of this out, but will explain it just in case. The value in register D6 is the amount that will be subtracted from P2's health. In your image from above, you show that the value in D6 is 02. Same with mine.

I prefer to use a asm trace log text file, which for me makes it easier to trace back to find where values in registers come from. I will show everything back to where that value is loaded into register D6...

01:7ED0 1C 2D MOVE.b $006A(A5),D6 A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000068 D5=0000023B D6=00000000 D7=00C00000 xnzvc

01:7ED4 48 86 EXT.W D6 A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000068 D5=0000023B D6=00000002 D7=00C00000 xnzvc

01:7ED6 67 16 BEQ #$16 [01:7EEE] A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000068 D5=0000023B D6=00000002 D7=00C00000 xnzvc

01:7ED8 9C 6B SUB.W $0118(A3),D6 A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000068 D5=0000023B D6=00000002 D7=00C00000 xnzvc

01:7EDC 6E 02 BGT #$02 [01:7EE0] A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000068 D5=0000023B D6=00000002 D7=00C00000 xnzvc

01:7EE0 DD 6B ADD.W D6,$0128(A3) A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000068 D5=0000023B D6=00000002 D7=00C00000 xnzvc

01:7EE4 31 C6 MOVE.w D6,($9CA4) A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000068 D5=0000023B D6=00000002 D7=00C00000 xnzvc

01:7EE8 98 46 SUB.W D6,D4 A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000068 D5=0000023B D6=00000002 D7=00C00000 xnzvc

01:7EEA 37 44 MOVE.w D4,$0068(A3) A0=00065EE8 A1=000188C2 A2=000AB3C4 A3=FFFFAA52 A4=FFFFE72C A5=FFFFAF7C A6=00C00000 A7=00FFFF9C D0=00000226 D1=0000021A D2=00000079 D3=00000083 D4=00000066 D5=0000023B D6=00000002 D7=00C00000 xnzvc

If you start at the bottom at 01:7EEA (that is where our new health value is moved into the RAM address for P2's health), and read backwards while paying attention to register D6, you can see that the value in D6 is always 02 until you get to the very top line (01:7ED0) where it changes to 00. This is where our value we're interested in is being loaded into register D6. It says

MOVE.b $006A(A5),D6

This means move the value from 006A(A5) to D6. Register A5 has an address of FFFFAF7C, then add 006A to get FFFFAFE6. If you do breakpoint on that, you'll see it comes from here:

01:A4A0 3B 7C MOVE.w #$0228,$006A(A5) A0=FFFFAB86 A1=000D3788 A2=000A4020 A3=FFFFDB34 A4=FFFFE678 A5=FFFFAF7C A6=00C00000 A7=00FFFFA4 D0=001E0002 D1=00000100 D2=00000100 D3=000061D5 D4=0000DB34 D5=00000038 D6=000001EA D7=00C000D0 xnZvc

Keep in mind that different special moves will probably have different addresses.

Using these Game Genie codes, you can modify the damage done (it will change the value in D6)...

01A4A2:0628 = 3x damage (D6 will have a value of 06)
01A4A2:0128 = half damage (D6 will have a value of 01)

The value that's being loaded is 2 bytes (0228), and I haven't had time to figure out what the other part of the value is used for, but you can probably figure that out. Maybe it's the total amount of damage done, or something like that.

[Billytime!]

Very cool! I understand now. I was even able to cook up a code of my own!

Trident's Fireball deals very little damage - 01A64E:0202

[Tony H]

Excellent. Were you able to figure out what the second byte was for?

EDIT: Above, the value was 0228, and hadn't figured out what the "28" part was for yet.

[Billytime!]

I changed 01A64E:0202 to 01A64E:0200 for Trident's fireball. Without the extra 02 the fireball will pass through the other player. So my best guess is those last two digits for the attack's hitbox.

EDIT: Another curiosity I have found. FF9373 and FF9B5A controls AI difficulty in single player's practice menu. However when entering the contest, certain characters like RAX and Trident set FF9B5A to FF. I wonder if this is something that can be tweaked. Poked the trace log and found this.

00:81E4 21 C8 MOVE.L A0,($9B5A) A0=FFFFD10E A1=FFFFD84E A2=000081DE A3=FFFFFDF6 A4=0006C8A4 A5=00000000 A6=00C00000 A7=00FFFFF6 D0=00000000 D1=00000000 D2=00FF3FFF D3=00000040 D4=00000000 D5=33333333 D6=33333333 D7=66766676 xnzvc

I highly doubt this piece of code does anything other than garble graphics, which I have done more than a few times tonight. Anyways, productive night! Now to catch some Zs.

[Billytime!]

It may be a double post but a very justified one!

I have solved number 3's pushback problem! As it turns out, each move has a different amount of pushback when the hit lands. By using FFAB4B as a breakpoint while attacking with a close HP as Blade, I received this code....

01:7760 37 46 MOVE.W D6,$00F8(A3)
A0=000622AA A1=00018672 A2=000C224C
A3=FFFFAA52 A4=FFFFE72C A5=FFFFAB86
A6=00C00000 A7=00FFFFA0
D0=00000318 D1=0000032C
D2=0000006D D3=00000071
D4=00000305 D5=0000032E
D6=00000008 D7=00C00000 xnzvc

I simply used the method you described to me earlier in the thread which led me to this code.

01:775A 1C 29 MOVE.B $0002(A1),D6
A0=000622AA A1=00018672 A2=000C224C
A3=FFFFAA52 A4=FFFFE72C A5=FFFFAB86
A6=00C00000 A7=00FFFFA0
D0=00000318 D1=0000032C
D2=0000006D D3=00000071
D4=00000305 D5=0000032E
D6=00000000 D7=00C00000 xnZvc

By adding 2 to A1, I found myself at 018674 in my hex editor which gave me this code.

Blade's Up close HP doesn't push back as far - 018674:0606

This will be a very involved process but It will be worth it to Allow for more seamless combos that the original game did not have.

[Tony H]

Nice work.

About 10 years ago, I started posting some 68000 instructions with explanations on what they do. Might be helpful...

https://gamehacking.org/vb/forum/vid...-assembly-info

[Billytime!]

I took a gander at these this morning, very helpful stuff!

I'm certainly going to bookmark this as there are some other sega games I'd love to take a crack at.

[Billytime!]

So I have one last inquiry and its a doozy! It revolves around AI routines.

I've been poking around trace logs to make it so the CPU cannot block any attacks. Because the cpu cheats and can negate hit stun.

I made a very small dent in this endeavor.

Cpu controlled by P2 (Auto Block)
05B6FA:4E71
05B6FC:4E71

This code will place the cpu under P2's control except my attacks will be blocked automatically as if the cpu was retaining a small amount of control.


One last code just for the hell of it.

Midknight doesn't counter projectiles
05B6F2:4E71
05B6F4:4E71

I wasn't sure of the full extent of this code, but I have noticed a difference facing midknight in contest mode. When you fire a projectile at midknight, his response is to use his mist attack which makes him invulnerable for a short period of time. By using this code, he just blocks the projectiles instead.

[Tony H]

I have a quick tip on how to shorten your codes. Instead of doing two NOPs for adjacent addresses, you can use a single branch instruction instead. Here is what your codes would look like...

Before:
05B6FA:4E71
05B6FC:4E71

After:
05B6FA:6002

========

Before:
05B6F2:4E71
05B6F4:4E71

After:
05B6F2:6002