Easy and Crude Walk Through Walls guide

[47iscool]

Okay, I think I may be close to cracking a WTW for this one (Way of The Samurai) and I'll tell you how:

I found the jump address again (the one I found when making the super jump code). The reason I wasn't able to go through the wall is a weird one. As I went toward the hill I got a few addresses when I set CE to show the jump writes, it gave about four addresses when he was walking or running into the hill. NOP two of the JAL commands behind the given addresses and it allowed me to walk uphill. I know this is not WTW but it is disabling some of the barriers.

[47iscool]

Success! Click here!

[Keylan]

You guys are using the watch point command, right? For example (Game Boy/Gear):

wp C234,1,r

will break and open the debugger when the RAM address is read from.

Or:

wp C234,1,w,pc!=1234 && pc!=4321

will break on writes to the RAM address unless the ROM addresses 1234 or 4321 caused it.

I was not. I am still very new to using debuggers. I didn't even know I could type anything in anywhere. I had found the option for set breakpoint in MESSUI's debugger, and was using that. I will have to look into using watch points, and see if i can find out anything else from there.

Still having issues with the cheat menu in MESSUI. I can get it to work if I load the game through it's short name in Software, but when I try picker, it never shows the cheat menu. And either way I do it I can't find an option for search. I have been using Regen for searching.

[Keylan]

I seem to be having issues with using watchpoints and breakpoints. I found where the info is for the on screen position, but when I set this as a watchpoint, the game never stops. I go up and touch the wall, but the game just keeps going. The game I am trying is Kid Chameleon.

Perhaps I am not using the correct information. Here is what I have figured out.

Direction the character is facing - FF24F6:
FF - Left
00 - Right

FF24FB - Horizontal Position
FF24FF - Vertical Position

I tried setting watchpoints to FF24FB (wp FF24FB,1,w), but it says stopped at watchpoint 1 writing word to 00FF24FB (PC=8FB2) (data=5). The data changes with each step, but it doesn't stop at a watchpoint when I touch a wall. It also seems to stop when I jump, which doesn't have anything to do with the horizontal position. I am not sure what I am doing wrong. The value for PC changes with each step, but only changes between 4 different ones.

Am I doing something wrong in the way I am doing this?

[Helder]

I seem to be having issues with using watchpoints and breakpoints. I found where the info is for the on screen position, but when I set this as a watchpoint, the game never stops. I go up and touch the wall, but the game just keeps going. The game I am trying is Kid Chameleon.

Perhaps I am not using the correct information. Here is what I have figured out.

Direction the character is facing - FF24F6:
FF - Left
00 - Right

FF24FB - Horizontal Position
FF24FF - Vertical Position

I tried setting watchpoints to FF24FB (wp FF24FB,1,w), but it says stopped at watchpoint 1 writing word to 00FF24FB (PC=8FB2) (data=5). The data changes with each step, but it doesn't stop at a watchpoint when I touch a wall. It also seems to stop when I jump, which doesn't have anything to do with the horizontal position. I am not sure what I am doing wrong. The value for PC changes with each step, but only changes between 4 different ones.

Am I doing something wrong in the way I am doing this?

I will write up a guide for this game since you have a little experience already with in a few days so stay tuned. I don't mind people using this thread to post anything that they learn or methods they used so other can also use the info for themselves.

the code is :
008F50:6000

but you die as soon as you try to go through any wall so an invincible code or disable hit routine is needed.

[Keylan]

Thanks a bunch Helder.

I seem to have been somewhat on the right course with the hook and trace I used in Gens Tracer. It was giving me areas of 8F38 and 8FB0, so it was nearby the 8F50.

I was actually thinking about the "instant death" thing last night. Sometimes while playing the game if you collect a helmet to close to a wall you can die by touching it. And if I moved the player into a wall manually at the addresses I posted he would die. Probably should have tried a different game, but it was one of my favorites growing up, and I am trying to get back through it to beat it finally. It has so many levels I could never last that long. It was the first game I wanted to try.

I managed to create a never lose HP code by setting the hp to 6 constantly while I was playing. I am sure there is a way to find the part that subtracts life from the HP, and disable/skip that routine, but this code worked fine for me.

[Helder]

I just tried the Invincible code on the site as well as the HP code and neither protect you from dieing in the wall. I will look into the routine that kills you when you're considered in the wall(this will likely involve quite some trace log back tracking) and post back likely tomorrow what results I get.

[Helder]

Well I figured out the death routine and disabled it so now the final code is:

WTW With Invincibility
008F50:6000
00B614:6000

I will get another game to try to make a guide with unless you guys want me to explain how I did this game.

[47iscool]

Well I figured out the death routine and disabled it so now the final code is:

WTW With Invincibility
008F50:6000
00B614:6000

I will get another game to try to make a guide with unless you guys want me to explain how I did this game.

The more methods we know the better. I wouldn't have been able to make a WTW codes without tutorials.

So if you don't mind me asking, how did you make that one for this game? I also heard that someone made a WTW for SM64 but he dies when going through the wall, could the technique you used on this game maybe work for SM64?

[Keylan]

Thank you very much.

It would be fine to use this game for a guide. I already have the game, so it would save me the trouble of trying to find it to follow the tutorial. Pretty much anything with a way to learn the walk through walls code is fine. I should hopefully be able to use this to find out how to do it in other games as well.

A quick question though, I have seen other games, like in Pier Solar (I mention this because I know that you made a WTW code for that game already), where the screen moves in all 4 directions and the character stays in the same spot. But then when the characters get close to the edge of the map, the screen stops to allow the character to walk off the screen to exit the map. Are codes for this different side-scrollers? Would you have to map out the screen move and the character position separately? Or just move to the edge of the map to figure out the character position to figure out a code for it?

If you are able to do a tutorial for the Invincibility part too, that would be awesome, but if it is too much the WTW part would be fine as well.

Thanks again for all the help you have given to us.

[Helder]

Unfortunately the code has some issues, first the code for the death routine allows you to kill enemies but won't allow you to finish the level since the game doesn't register you as being in the area. Second the code only works for the right direction so further code tracing of routines is needed to see how it can be done to work 100%. I will have to use a different game since this will be too complex for the average joe just getting deeper into ASM. Stay tuned till I have something to work with.

[Helder]

Ok so as promised here is a guide for Chakan (U,E) for the Genesis. I will assume you all know how to enable the debugger in MESS and take it from there. This was made using the MESSUI/MESS version 0.148

When you first start the game there is a small wall on the left and right of the Round Background image and we will use that to use as a wall to test the code on.

I found the horizontal address to be ffc0d4 , this game like some older systems and many newer systems use is a 32bit value (many games use 16bit). If you don't know how to find Ram codes then don't bother following this guide.

I set up a watch point with this address to see if there are constant breaks so we can avoid them and only concentrate on when it breaks when we get near a wall. Before moving on use this command to ignore the z80 Sound CPU since have no need to trace it or see what it's doing: ignore 1

To set up a watch point we type in the debugger console: wp ffc0d6,1,w and press Enter.

Once entered press F12 to return to game and I get no breaks except when I walk, to the right I get PC=64406 as the address making the writes to the RAM address that we set a watch point on. Continue walking to the right and keep pressing F12 to make the game move frame by frame.

Once I get close enough to the wall a new address shows up in the list which is PC=6566A which pretty much tells the game to stop moving because of a wall.

So now that we know how many routines more or less prevent us from moving forward we will use the Trace feature of MESS which is basically ultimate tool in hacking codes since you will see how everything is run in code.

The way I like to setup a trace log is 2 parts, first we leave the watch point on and move away from the wall so we get the game to break when we can move. So move back away from the wall and then move back to the right so we get the break we first got PC=64406.

Once you get a break we will now setup the trace log, type this into the debugger console: trace chakan1.log < you can use any filename you want and .log or .txt or whatever.

Once the trace has started I like to log atleast 2 or 3 breaks so hit F12 to return to game and get a break and repeat 2 more times. Once we have a few breaks we will turn off the trace so type: trace off

Continue pressing F12 till we are close to the wall and setup another trace and the console functions similar to a dos console so pressing up or down on the arrow keys will cycle your previous commands so press up 2 times to see the first trace log and just change the 1 in the file name to a 2.

Once the trace has started continue pressing F12 till we reach our wall and new break shows PC=6566A , as soon as it does and you press F12 to return to game press the tilde ~ key to return to the debugger and turn off the trace or you will have a massive trace file to look at.

Open both trace files and on the second trace file (2) search for 64406, continue the search till you get the message "Can't find 64406" which tells us that we have reached the last time we were able to move or simply the last time the routine was run before it stopped.

Do the same for trace one (1) since that is the good trace we will be comparing when we could move. Now line the 2 files next to each other so the addresses line up and scroll through the files to see any changes from one to the other. This can be tedious and time consuming and another method I use is to look for the stop routine we got above at PC=6566A on the second trace and move up on the addresses till I get to a RTS which is a return from some subroutine and then search for that same RTS on the first trace and I get : 0655FA: rts

Using that as our starting point I line up both files again and scroll down till I see any differences. I find where the game branches to different routines:

1st trace:
065E68: bmi $660a8
065E6C: cmpi.w #$2, D0
065E70: bgt $660a8
065E74: add.w D0, D0
065E76: move.w ($6,PC,D0.w), D0
065E7A: jmp (PC,D0.w)
0660A8: adda.w #$8, A3

2nd trace:
065E68: bmi $660a8
065E6C: cmpi.w #$2, D0
065E70: bgt $660a8
065E74: add.w D0, D0
065E76: move.w ($6,PC,D0.w), D0
065E7A: jmp (PC,D0.w)
065EA0: movea.l ($8,A6), A0

As you can see there is a jump to different locations but looking at trace 1 we see the jump goes to: 0660A8 but not on the second trace. Looking a little above the jump we see 2 branch conditions that will take us to 0660A8 so I test the theory that if I make one of those an absolute branch it should skip the entire Stop Walking Routine.

We need to edit the Rom data to test the code and using the built in Memory Viewer press CTRL+M and on the right hand drop down menu choose "Region:maincpu" then input the address we want to change 065E70 and press enter.

The ASM instruction for this BGT conditional is 32bit: 6700 0236 and if you are a little familiar with the Genesis ASM or have pugsy's 68000 Instruction list you will see that changing the 6700 to 6000 will be an absolute branch so let's test the theory.

Make sure to disable the watch point by typing: wpclear
Now let's see if it worked or crashed the game or whatever effects it might have....... well the code works yay BUT having the code always active you will fall through the floors so further testing and hacking is needed to perfect the code if it can be.

Congratulations you have made a WTW code with a little more advance method and using traces too.

[Demonic722]

Nice work, Helder! We should add this tutorial to the library for beginners to see it.

[Keylan]

I managed to follow this for the most part, and duplicate the results. I will have to look into it a bit more to make sure I understand it. I went ahead and also looked at the codes you posted for Kid Chameleon. I compared the results for the walk through walls to the right, and tried to figure it out walking left. The code is

008FC6:6000

It works to walk left through walls with your new invincibility code. The only problem is needing to disable that code to finish the level.

It was a little different for that game, as there did not seem to be change in the PC value when it got near the wall. I basically looked at the trace I had, and found the 8F50 and saw where it was in relation to the 8F3A that I got from the PC value. Saw it was two above the nearest rts below it, and did the same thing walking left.

I also noticed that when I walked past the edge of the right screen near the flag, the level froze. Even with the new code to walk left, it just freezes. Even the enemy nearby and the clock stop.

I will see what I can do in trying this out on a new game, to see if I can figure it out.

Thanks

[Helder]

Great work on your own! Yes there is no absolute method to make these and that game was a bit more complex and it isn't always the first or second RTS above or below but sometimes quite a few.

Using this information you can tackle many games and many different codes, just remember that a game uses many sub-routines to execute various effects then at the end there is usually an RTS which is a return to the previous location before a branch or jump.

After the RTS it will always show the address that is usually a few bytes away from the address that initiated the jump/branch so always look for an address in the log that is either 2 or 4 subtracted from that address after the RTS. Sometimes you will see numerous routines were executed after that jump/branch so it can be a bit daunting to a beginner at first but stick to it and you will do fine.