Easy and Crude Walk Through Walls guide

[Helder]

Ok so I figured I owed everyone a guide on how I make some of the Walk Through Walls codes I've been making recently. Now this is a simple and crude method that works on some games, and by some I mean few. I will post the games and methods I used to make the codes below and also the tools I used. All these games can be hacked by anyone with little to no knowledge of 6502 ASM or any ASM. I will also post a more in depth and more complex guide for the more advanced users for making the codes for other games which this method doesnt work. These games can also be used with the more advanced method I will explain later for a Better Walk Through Walls code.

Ok here is the list of games I will be using as examples:

Krusty's Super Fun House V1.1 (This game is utter garbage and I feel so sorry for anyone who got this as some kind of gift in the old days.)
Ghoul Patrol

Tools:
Snes9X1.43.ep9r8
GGConvC

The tools along with a reference guide are in the included rar file in my post.

Ok now to the hacking, first of all all my codes consist of first finding the address in RAM that says where your horizontal location is. The way on about 90% of the games I have hacked is if you're going right you do a greater than search and if going left a less than search so I will load up the emulator and rom Krusty's Super Fun House V1.1 the emulator freezes and wont progress until you press the "RUN" button on the debugger console. You might have to setup you buttons if using a pad so go ahead and do so, now that thats done get into the start of the game and you will see Krusty near a door and a wall so the code making will be simpler since the wall is close. Now as a rule of thumb always make a save state here in case the emulator crashes which it often does and maybe an open notepad file to save the possible codes again because the emulator is known to crash and doesnt always save the codes made.

I will open up the "cheat" menu at the top and click on search for new cheats and follow the methods I explained up above and also using the "Show Hex" button on the Debugger console and setting it to RAM I can test and see the RAM change on the fly.

OK so my code for the location of the character is 7E0303, now that we have that we get to the fun part using the "Break Points" button. Put the code into any of the fields with 000000 and pop in our location address 7E0303 and click the "Write" box and hit ok and hit the "RUN" Button.

Now this game is a great game to try this code method because on many other games there are constant breaks from just standing still but this one doesn't have this issue. So take a step left and the game will break once you hit a wall and show this in the Debug Console window:

00/E697 85 03 STA $03 [$00:0303] A:0098 X:0000 Y:0000 P:envmXdizc

so what does this mean? The game is storing a value into the address [$00:0303] which is essentially our code 7E0303 but notice this only occurs when you actually walk into a wall? So this is writing a value to stop us from moving any further so we will copy the code above and format it like so 00E69785. Put that into the Cheat Menu's first option: Game Genie,Pro Action Replay Codes. But before we finalize the code we want to make it not store the value so we will change the instruction to load instead, this essentially skips whatever that instruction was supposed to do. Using the Game Genie Code Converter I included click on the SNES button and in the bottom right pop in the current opcode 85 which we got from 00E69785. You will notice that it will say STA Z so in order to keep things uniform we will look for the value that loads Z register and looking through the list yourself you should have come to A5 as the op code LDA Z.

So the code we will try is 00E697A5, now pop that into the cheats and make sure you hit the Add Button and then ok. It might be a good idea to go to the break points menu on the Debugger console and uncheck the "Write" box. Now lets us try the code out and see what effects its has. WOW we went straight through the wall, but if you haven't noticed we can't go to the right once inside the wall so that essentially means that code we found is for the left direction only.

So now we go looking for the other direction and since the steps are exactly the same we will turn the break point for the RAM code back on so go ahead and click the "Write" Box and take a step towards the right and the debugger breaks and shows us:

$00/E79D 85 03 STA $03 [$00:0303] A:0058 X:0000 Y:0000 P:envmXd

So we will do the same thing we did above take the address above and change the Store into a Load and we get this: 00E79DA5 so put that into the cheats and shut off the break point and test it out.Wow once again we are Walking Through the Walls. Our code is complete! or is it? Well you could leave it like it is or you could go for one more code to make you jump up through the walls/ceilings.

The Method is rather simple and is exactly the same as we did above, and we basically need to find the Vertical location address which is generally right near the Horizontal address we found above. If you have the Hex editor open like I instructed above all you need to do is jump and you will see some number move and after some testing I see the code is 7E0307. So put that into the Break Points menu and again Check off the "WRITE" and get back into the game, perform a jump and as soon as we get near the cieling the emulator breaks on this:

$00/EB13 85 07 STA $07 [$00:0307] A:00B0 X:0000 Y:001C P:envmXdizc

Using the same methods from before we get the code 00EB13A5, we test the code out in various locations like when you are in a wall and you will notice you can jump through the ceilings. So there is your first Walk Through Walls code made super easy, and to finish it off we will use the Game Genie Code Converter to make usable codes out of these addresses:

Walk Through Walls (RAW)
00E697 A5
00E79D A5
00EB13 A5

into

Walk Through Walls (GG)
C93B-6FAF
C93B-A70F
C93F-ADA4

I will post back on the other game I mentioned as its almost the exact same method except the game behaves a little differently.

[Tony H]

Thanks helder.

[Helder]

I'm sure you were aware of this method as its the most simple, but the key factor here is the break on Write. I have tried the break on Read and it just didn't produce results I was looking for anyways once I write the more complex version it will be more useful to the rest of us.

[rimsky82]

Krusty's Super Fun House V1.1 (This game is utter garbage and I feel so sorry for anyone who got this as some kind of gift in the old days.)

Actually, I rather enjoyed this game. I never owned it, but a friend had let me borrow it for a while and I had some fun with it. Your mentioning it has made me realize I need to add it to my wishlist so I can add it to my collection. What don't you like about it?

[Helder]

Just the game play and graphics I didnt get too much into it so I can't say its pure crap but I was expecting something along the lines of the other simpsons titles especially on the graphics dept.

[bungholio]

I've kind of had a barbaric guessing method for PS2 games. I accidentally encountered it first with Silent Hill 2 when I accidentally found position modifiers without realizing it. I did a dump of the game while playing and opened it up in PS2Dis and went to the position modifiers. I checked what addresses referred to those position modifiers, and then went to the top of those functions and canceled them with a "jr ra". I tried that to a bunch of the functions that referred to the position modifiers, and eventually ended up with 2 canceled functions that seemed to allow me to go through walls. One of those functions kind of had a bunch of problems with it, but the other result was perfect. I think I tried the same kind of method for Silent Hill 4 and didn't find one that way, but I can't recall if I actually had a way of dumping the game data at the time which would probably be why I didn't find it. I've probably done that for a few games, but I can't remember any at the moment other than Okami.

With Okami I kept deleting some float addition operations and eventually one caused me to have odd collision problems with the ground. I checked what addresses were loaded and stored and found that they didn't quite work. I got impatient and just tried getting rid of all of the other nearby addresses, and one allowed me to go through solid objects and walk on air at the same time. That address had a pointer though and froze the game quite quickly. I messed with a bunch of functions that eventually separated the walking through solid objects and walking on air effects (that was a bonus accident for me). Truthfully for that code I half-assed it and am surprised it hasn't caused too many problems, because that should be almost as problematic as modifying the address itself, but there were a lot of referrers and it was probably those other functions that referred to that address that caused it to freeze initially.

[Helder]

The more complex method is similar to what you did to find the Okami code, but in a more controlled manner although I do test some random branches and what not if its a somewhat difficult game to crack but most you can find by doing traces and following the instructions line per line and noting any branches or conditionals.

[adaml]

Good stuff helder. I remember how excited I was when I figured out how to find cheats to change your character's position along the vertical or horizontal axis. It got me past obstacles and onto parts of the screen that I wouldn't have been able to get to normally. Once in awhile an axis code would move your character on the screen, but then when you disabled the code he would pop right back to where he was before...never did figure out why that happened. Your walk through walls info is light years beyond my remedial skills though

[Lazy Bastard]

Nice; someone really needed to write a new guide to WTW codes. Thanks for writing it, helder. I'll add it to the Library later.

[Helder]

Thanks for the praise guys but once I make the more complex version is when we will hopefully see an explosion of the codes popularity and it being made.So without further ado here is the second part to my original post, Lazy could you put this together with the other post as well as its supposed to be a whole.

Ok so now that you are somewhat familiar with the method posted above and how we find the horizontal and vertical Ram addresses lets us put the skills learned to the next test: Ghoul Patrol

I will summarize on many of the things because its just a rehash of whats up above.

Let's start off by loading the game and getting to the first level and as a good rule of thumb make a save state (press Shift+F1 to save and just F1 to load). In some games (most to be exact) there is a code for each direction just like the previous game but on some 1 and sometimes 2 codes are all thats needed but this games falls in the first category so it has a code for each direction, lets gets a crackin:

From the initial beginning of the game we look for out Horizontal location code, and we come up with 7E0A2E and while we are at it lets find the Vertical location code as well which should be simple to find if you have the Hex Editor up and just look at the next few addresses as we move up/down and its this 7E0A3A.

Now lets set up our break points,go ahead and put both the codes in the fields to save some time for later and just check the "Write" box on the one we are working with. We will start with the Horizontal code first, as soon as you hit the "Run" button you will notice the game just breaks and as you hit "Run" a few more times it keeps breaking on this:

$81/9A92 85 2E STA $2E [$00:0A2E] A:0417 X:1C4D Y:0000 P:envmxdizc

This is what I mentioned earlier in the Kruty paragraph about many other games having a constant break from standing still or not even doing anything, generally we just ignore these. So how do we find a break then? Simple just hold Right on the pad and keep hitting the "Run" button till you get to a wall but keep on eye on the bedug window. Once you get close to the wall there will be a new break amidst the other one above and it should be this:

$81/9CA2 85 2E STA $2E [$00:0A2E] A:0427 X:0001 Y:0003 P:envmxdizc

so we will do what we did with Krusty and change the STA to a LDA: 819CA285 to 819CA2A5. Lets try it out and see what happens (don't forget to turn off the breakpoint!) Wouldn't you know we were able to walk through the wall on the right albeit a bit slowly but effective, now lets see if we can go back towards the left......hmm we cant so put the break back on and walk Left hitting the "Run" button till we get a different break:

$81/9C7B 85 2E STA $2E [$00:0A2E] A:0458 X:0001 Y:0003 P:envmxdizc

again we will take the address above and make it into a LDA : 819C7B85 to 819C7BA5 and after some testing we can Walk Through Walls!! but only on the horizontal plain what a bummer, so lets use our other code we found for the vertical plain and make the other 2 codes needed.


Lets get near a wall that is above you so you have to walk UP and turn on the other breakpoint (7E0A3A) and like up above keep hitting that "Run" button till we see a new break:

$81/9D1D 85 3A STA $3A [$00:0A3A] A:0208 X:0001 Y:0003 P:envmxdizc

this is the only new break amidst the constant breaks and we get this after the LDA change: 819D1DA5 and another successful code and test made.Let's make the final code for the DOWN direction now.

$81/9D44 85 3A STA $3A [$00:0A3A] A:01CF X:0001 Y:0003 P:envmxdizC

this is our last and final break so lets change it to a LDA : 819D44A5 after another test we have no boundary we can't walk through! Our Final code is this:

Walk Through Walls (RAW)
819CA2A5
819C7BA5
819D1DA5
819D44A5

and as a Game Genie code:

Walk Through Walls (GG)
C9BC-4D65
C9B5-44A5
C9BF-1705
C9B0-1FD5

now go out there and find some more codes! Also a reason that the character moves a little awkwardly/slow is because the wall detection routine is still being run we just stopped the important part from storing (STA) and therefore allows us to move. In the complex version I will again use this or the Krusty game to make a walk through walls code that completly bypasses this routine and therefore making you move as if no wall even exists! Stay Tuned!

[bshi02]

May I ask some question about your guide?
Why should you replace STA opcode with LDA?
and Why should you keep hitting"Run" button in order to find a breaking on address in Ghoul Patrol?

[Helder]

The LDA is basically a load of the value in a register to an address while the STA is store the value in a register to an address. So in this method I explained the game "breaks" on the STA when you get to a wall but doesn't when you walk normally so this implies that something before this STA told the game to write a value to an address that will stop you from moving any further because of the wall. If you change it to a load LDA it will load the same value again but never store it to the address and never making that change, this is an old trick used in many GG or rom codes for so long and its still used today (this is how many Infinite type codes are made).
Now the Other question you had was why I hit the "Run" button is quite simple as you would know this yourself if you followed the guide, this game like many others write constantly to various addresses which we normally just ignore and look for any new addresses that show when we get close to a wall and ignore the other 2 or 3 addresses that constantly cause breaks. The new address that shows is the one that we are interested in since it only shows when we hit a wall and we try the method I described to get a working code.

[bshi02]

I just have followed your guide and now I understand that why I have to keep pressing RUN button.
It will be frozen immediately when you set write breakpoint on found address,because a certain address keep trying a change on address which I just to set breakpoint.
To continue gameplaying,I have to press run button whensoever there is any freezing after setting any breakpoints.
Thanks very much for your answers.

[Keylan]

I just want to let you know that I used parts of this guide to find a way to move my character in a Genesis game. It helped me get past a part that always froze my emulator. Thank you very much for this guide.

[Helder]

I guess I should do a MESS version for the Genesis walk through walls codes as that is what I use to make Genesis codes.