Hit Anywhere Tutorial

[nolberto82]

Example: Legend of Zelda (1.0) - NES
Emulator Used: FCEUX

To make this kind of code you need to find the health for the enemies. For this game in address 0x485+. In this example the enemy's HP was at 0x488. I put a breakpoint on write on that address.
The debugger snaps here:

$7C63:9D 85 04  STA $0485,X @ $0488 = #$20

Now we need to works backwards to see what determines when an enemy is hit. We can use the tracer from this emulator to see what's going on. To get what we want leave the breakpoint for the enemy's HP on. Then start the trace logger when close to the enemy and swing your sword. When the debugger snaps stop the tracer. The file you get is going to be a few megabytes long but what you need is the last part of the file. Now we know that 0x7C63 is where the HP for enemies is stored so I worked my way backwards looking at the trace log looking for any branch that was skipping 0x7C63. Another way to check is to be around enemies swing your sword with a breakpoint on execute if the debugger snaps then you are on the right path. This is the code that determines if an enemy is hit:

                
$7BEF:20 FF 7D  JSR $7DFF                 

[COLOR="Blue"]$7DFF:A9 00 LDA #$00              This routine is used by the enemy and
$7E01:85 06     STA $0006 = #$00  the player. It checks to see how close the enemy and the player are.
$7E03:A4 00     LDY $0000 = #$0D           
$7E05:A5 02     LDA $0002 = #$69           
$7E07:38        SEC                       
$7E08:E5 04     SBC $0004 = #$75          
$7E0A:20 1F 70  JSR $701F                  
$701F:10 05     BPL $7026                  
$7021:49 FF     EOR #$FF                   
$7023:18        CLC                        
$7024:69 01     ADC #$01                   
$7026:60        RTS                        
$7E0D:85 0A     STA $000A = #$08           
$7E0F:C5 0D     CMP $000D = #$10          
$7E11:B0 10     BCS $7E23                  
$7E13:A5 03     LDA $0003 = #$C5           
$7E15:38        SEC                        
$7E16:E5 05     SBC $0005 = #$C6           
$7E18:20 1F 70  JSR $701F                  
$701F:10 05     BPL $7026                  
$7021:49 FF     EOR #$FF                   
$7023:18        CLC                        
$7024:69 01     ADC #$01                   
$7026:60        RTS                        
$7E1B:85 0B     STA $000B = #$00           
$7E1D:C5 0E     CMP $000E = #$0C           
$7E1F:B0 02     BCS $7E23                  
$7E21:E6 06     INC $0006 = #$00           
$7E23:A5 06     LDA $0006 = #$01           
$7E25:60        RTS  [/COLOR]
                      

$7BF2:F0 74     BEQ $7C68                   if 0x0006 = 0 go to end. Stop this opcode from jumping
$7BF4:C0 0F     CPY #$0F                   
$7BF6:D0 1E     BNE $7C16                  
$7C16:BD B2 04  LDA $04B2,X @ $04B5 = #$00 
$7C19:25 09     AND $0009 = #$01           
$7C1B:D0 4C     BNE $7C69                  
$7C1D:BD 4F 03  LDA $034F,X @ $0352 = #$10 
$7C20:C9 33     CMP #$33                   
$7C22:F0 04     BEQ $7C28                  
$7C24:C9 34     CMP #$34                   
$7C26:D0 03     BNE $7C2B
$7C28:4C 40 A4  JMP $A440                        Stop this one from jumping.
$7C2B:C9 13     CMP #$13                  
$7C2D:F0 04     BEQ $7C33                  
$7C2F:C9 12     CMP #$12                  
$7C31:D0 0C     BNE $7C3F                  
$7C3F:C9 0B     CMP #$0B                  
$7C41:F0 04     BEQ $7C47                  
$7C43:C9 0C     CMP #$0C                   
$7C45:D0 0D     BNE $7C54                  
$7C54:A9 02     LDA #$02                   
$7C56:8D 04 06  STA $0604 = #$00           
$7C59:BD 85 04  LDA $0485,X @ $0488 = #$20 
$7C5C:C5 07     CMP $0007 = #$10           
$7C5E:90 16     BCC $7C76                  
$7C60:38        SEC                        
$7C61:E5 07     SBC $0007 = #$10           
$7C63:9D 85 04  STA $0485,X @ $0488 = #$20

After stopping the branch and the jump you'll be able to hit enemies anywhere on the screen. Getting items from anywhere is similar to this hit anywhere. I tried to make it at clear as possible.

[Lazy Bastard]

Cool; I've been wondering how to hack Hit Anywhere codes. Thanks for the guide. I'll add it to the Library

[nolberto82]

Thanks, LB. I'm going to add the "get items from anywhere" later on.

[Abystus]

Thanks nolberto! I have tried something similar for Teenage Mutant Ninja Turtles (NES). Using a Break on Read on the spinning Turtle Power up address (Found in the database 000540 91) I have determined (a while back) after a little debugging that the below to be the hit routine:

$9AD3:BD 40 04  LDA $0440,X @ $0445 = #$8D 
[COLOR="Lime"]$9AD6:F0 35     BEQ $9B0D <-- Setting this to branch always makes everyone immune to attack.[/COLOR]
$9AD8:84 1A     STY $001A = #$00
$9ADA:A0 08     LDY #$08
$9ADC:20 11 9B  JSR $9B11
$9ADF:A4 1A     LDY $001A = #$00
$9AE1:BD 80 04  LDA $0480,X @ $0485 = #$B2 <-- X Cord Check
$9AE4:D9 80 04  CMP $0480,Y @ $0480 = #$A0
$9AE7:B0 08     BCS $9AF1
$9AE9:A5 11     LDA $0011 = #$B9
$9AEB:C5 08     CMP $0008 = #$9B
$9AED:90 1E     BCC $9B0D
$9AEF:B0 06     BCS $9AF7
$9AF1:A5 10     LDA $0010 = #$AB
$9AF3:C5 09     CMP $0009 = #$A5
$9AF5:B0 16     BCS $9B0D
$9AF7:BD 60 04  LDA $0460,X @ $0465 = #$B4 <-- Y Cord Check
$9AFA:D9 60 04  CMP $0460,Y @ $0460 = #$4D
$9AFD:B0 08     BCS $9B07
$9AFF:A5 13     LDA $0013 = #$B2
$9B01:C5 0A     CMP $000A = #$3D
$9B03:90 0A     BCC $9B0F
$9B05:B0 08     BCS $9B0F
$9B07:A5 12     LDA $0012 = #$A7
$9B09:C5 0B     CMP $000B = #$5D
[COLOR="Lime"]$9B0B:90 02     BCC $9B0F <-- This branch determines if anything was hit.[/COLOR]
[COLOR="Red"]$9B0D:18        CLC <-- This means nothing was hit. Set to 38 gives hit anywhere to everyone.[/COLOR]
$9B0E:60        RTS
[COLOR="Red"]$9B0F:38        SEC <--Something was hit.[/COLOR]
$9B10:60        RTS

If you enable hit anywhere in this routine by setting the value 38 it will freeze when leaving the sewers. After determining a hit it will return to its calling routine below:

$9587:20 D3 9A  JSR $9AD3
$958A:90 08     BCC $9594
$958C:A9 01     LDA #$01
$958E:8D E6 03  STA $03E6 = #$00
$9591:20 84 97  JSR $9784
$9594:E8        INX
$9595:E0 10     CPX #$10
$9597:D0 D5     BNE $956E
$9599:AD E6 03  LDA $03E6 = #$00
$959C:D0 05     BNE $95A3
$959E:85 8D     STA $008D = #$00
$95A0:8D E5 03  STA $03E5 = #$00
$95A3:A5 D3     LDA $00D3 = #$00
$95A5:D0 21     BNE $95C8
$95A7:A0 00     LDY #$00
$95A9:AD 40 05  LDA $0540 = #$01
$95AC:29 10     AND #$10
$95AE:D0 01     BNE $95B1
$95B0:C8        INY
$95B1:B9 70 05  LDA $0570,Y @ $0570 = #$80
$95B4:F0 0D     BEQ $95C3
$95B6:98        TYA
$95B7:48        PHA
$95B8:AA        TAX
$95B9:A0 00     LDY #$00
$95BB:20 11 9B  JSR $9B11
$95BE:68        PLA
$95BF:A8        TAY
$95C0:20 C9 95  JSR $95C9
$95C3:C8        INY
$95C4:C0 05     CPY #$05
$95C6:90 E9     BCC $95B1
$95C8:60        RTS

When playing around with these branches you will get mixed results however I haven't found the proper combination to allow the player to hit anywhere without the enemy being able to as well. Also most modifications to this routine will also cause issues when leaving the sewers. Anyone wanna shed some light on this?

[nolberto82]

I haven't checked that game but by looking at your code have you tried changing this line:

$958A:90 08     BCC $9594

A lot of hit routines on return like to check the carry flag.


Edit - This is the code:

06:95E3:20 D3 9A  JSR $9AD3                   This routine gets call often that's why you got a crash.
06:95E6:90 29     BCC $9611                   This is the check
06:95E8:BD 40 04  LDA $0440,X @ $0445 = #$8D
06:95EB:C9 10     CMP #$10
06:95ED:90 22     BCC $9611

Hit Anywhere
GXVPTIEP

[Abystus]

I haven't checked that game but by looking at your code have you tried changing this line:

$958A:90 08     BCC $9594

A lot of hit routines on return like to check the carry flag.

I am still looking at the second routine, however it appears when setting that branch to a 10 instead of a 90 your turtle will be hit anywhere by enemies. I am assuming the other branches that follow should be able to determine if it were an enemy or yourself that was hit (as it only branches a short distance and is followed by many branches.) because that branch basically just reflects based on the carry flag set by the first routine. Seems a bit overly complicated to check if you or an enemy was hit .


--Edit--

Nice! Well appears I was close to where it was. Thanks for checking into that for me .

[nolberto82]

I edited my post. You only change the check after the routine. Now you have an idea of what to look for. You should check the entire game to see if it needs an additional code.

[Abystus]

Hit Anywhere +

All Enemies Die in One Hit (Includes Bosses)
99A510

= Actually fun to play this game again .

Again thanks for taking a look at it.

[nolberto82]

I added the Hit Anywhere code and gave you credit too. I wish I had a game genie and code like that in the mid 90's when I first played this game.

[Abystus]

Yep would have been nice to have when originally playing this difficult game. Even with the code on it's still difficult because of certain jumps you have to make where one false move will kill you. I am gonna check a little farther into the game, however thus far I have not had any issues with the code on the stages I've tried. It appears to work fine both in-doors and while on the top down view. I'll post here if anything changes but I think we may have conquered the beast.

[Abystus]

I have found an area where 95E624 freezes the game. After your turtles get the blimp and fly to the enemy headquarters (stage 4 I think? it's dark outside. To get here quickly Activate A0F204 then complete the first level to move to this level instead of the dam stage.), go up and the first man hole you see enter it. The game will lock at this point (even if you disable the code go in and then re-enable it after your in the level.), however it works in the other man hole (bottom right of the level) no problems. I may look at it later as I am a little short on time tonight.

[nolberto82]

Which emulator are you using?

[Abystus]

FCEUXD SP 1.07 currently as it seems to be the best I've found so far. I haven't tried in other emulators, and It could just be a glitch in the emu. Hopefully it turns out to be a glitch as I'm not sure I could hate this game any more than I do already lol.

[nolberto82]

I'm asking because I encountered problems when using game genie codes with all version fceu including the newer versions. I can't check it right now.

[Abystus]

I revisited the code 95E624 and noticed the way you were cancelling the branch is rather odd. Basically you changed the branch to a BIT operation which caused problems possibly due to an operation change later on in the game. I changed the code to cancel the branch location by changing it to 0095E700 which then loaded that area fine along with achieving the same effect as the previous code. So for now the corrected code should be 0095E700 until another problem comes up with it. I'll be giving this code some more testing in the later levels to see if anything odd happens, however I think it was just the format of how the branch was changed in the previous code that was causing the issue.

Original:

$95E3:20 D3 9A  JSR $9AD3
[COLOR="Green"]$95E6:90 29     BCC $9611 <-- Original Game Code[/COLOR]
$95E8:BD 40 04  LDA $0440,X @ $044F = #$00

First Change:

$95E3:20 D3 9A  JSR $9AD3
[COLOR="Green"]$95E6:24 29     BIT $0029 = #$29 <-- Original Code Change[/COLOR]
$95E8:BD 40 04  LDA $0440,X @ $044F = #$00

Correction:

$95E3:20 D3 9A  JSR $9AD3
[COLOR="Green"]$95E6:90 00     BCC $95E8 <-- Corrected Code Change[/COLOR]
$95E8:BD 40 04  LDA $0440,X @ $044F = #$00