Debug Menus

[Hacc]

I have nothing currently written on this topic, but I was going through some old text files and found this saved in one of them with codes. This was written by Parasyte on the old GSC boards in '05 (8/19/05 to be exact). I didn't find the tip mentioned before the SQL issue. And for the sake of completeness, I had saved another that was posted on Kodewerx. I was a save-addict back then.

Text references, it's all about text references. I wrote about it briefly on the board before the SQL database was destroyed, so this one will be even more brief.

Find some debug text in the game or RAM. Not just crap saying "IS Debugger" or "MetroTRK Debugger" or "* Debugger". Anything in the game labelled as a "debugger" is unlikely to be of use to anyone other than the developers. However, they can still be interesting for the extreme hackers. (Most debuggers do not display anything on screen, but rather send text messages and other data to a console program running on a linked computer. Casual gamers will unlikely have access to the hardware required to use those.)

Any way, you locate some debug text. Usually anything saying "Debug Menu" or "Sound Test" etc. is good stuff to work with. Use a good disassembler and debugger in tandem to track the program routines responsible for reading and displaying the text on screen. This is done with one method which may vary depending on the game; locate a pointer. Locating a pointer to the text is usually the easy part. Just text search in the disassembly listing for the address(es) where the text lies in memory. You may find the pointer among an assembly routine, or among a pointer table. You may also not find a pointer to the specific text at all. In such cases, you would attempt to locate the "first" text string listed from the debug menu. For example, imagine you are hacking a game with the following text:

Code:
Konami Presents
A game by Hideo Kojima
09/13/04 13:10:47
Debug Menu
Option 1....Blah
Option 2....Etc.

If you are unable to locate a pointer to the text "Debug Menu", then you should attempt to figure out which of these text strings is likely to be the first of the debug menu listing. In this example, it will not be the first two, since those are much more likely to show up in the game's normal intro. It may actually be the date/time displayed first in the menu. When you find the pointer you are looking for, no matter which piece of text it points to, you can be certain that the game will make use of it. You just have to make it so. (Games for which you can find no pointers to the debug text, you may as well give up unless you are proficient with assembly and debug menu hacking. In which case you would not require such a lesson in the first place.)

Now then, "making it so" is often easier said than done. It takes patience, skill, knowledge and effort. Your job from this point is to find out why the game is NOT using the pointed text. Either the whole routine is not being executed, or only the text loading code is being skipped. It may also be that SEVERAL LAYERS of nested subroutines are not getting executed. How you accomplish this task is left soley to the hacker(s) involved. Whether it is nopping/forcing a branch at some point, creating your own function call elsewhere, or changing a pointer of some sort. (Physical pointers, array indices, switch statement cases, and the like.)

That's about as much detail as I am willing to get into without divulging on certain games from the past and present. So unless someone is willing to tutor you, I would suggest you do some research on your own. Get to understand the codes which have already been hacked. Figure out how they work, and learn to back-trace with those examples.

I wish I did not have to be so vague, but when dealing with other people's code (IE, software written by someone other than you), you have no choice but to learn their style and work with it. I believe that the only thing which can truly teach that is experience.

[Abystus]

Speaking for screen dedicated to Debug Menus, Sound Tests, etc... it's usually best to find the menu modifier for the game (a ram address or addresses that control what screen your currently are viewing). On the NES/SNES these types of addresses are usually the norm, and can be found via the hex editor with relative ease. You of course would want to open the hex editor first in an attempt to see if any strings of the debug menu exist like the example above (sometimes this text is not visible), then proceed to find the menu modifier address.

Once you have found the value at that address which controls the load of the debug menu (if one exists), you can then choose your entry point by modifying the value written to this address by another routine within the game (or you can just write your own call and hook into the code wherever you want).

[LiquidManZero]

There's one thing to consider if the game was done by a japanese developer. The text for the menu, even if it's in english... May be encoded as shift_jis or something otherwise non-ascii. Or perhaps the game used normal 1 byte per character text, but it's still not quite the normal values for each letter. Squaresoft particularly liked doing this. For odd text having a relative search either program or capable hex editor is extremely useful.

There are some general relative searching programs here: Romhacking.net - Utilities - Searching
As for hex editors capable of that trick, I particularly like Translhextion despite it having major issues with large files. There's also Windhex, but somehow this ends up being a more annoying program to work with.

Translhextion can be obtained here: Gamehacking.org - Downloads
...and Windhex can be had here: Romhacking.net - Utilities - WindHex32

[Hacc]

@ Abystus: I recently found a debug menu via the Screen Modifier method for a PlayStation game. When I saw the menu, I instantly laughed at what it was called: "Oh Arse". That was so random. The funny thing is, I stumbled upon the addresses used for its options in the retail. It wasn't until I found the menu in the demo, that their purpose made sense (its removed in the retail). There looks to be a simple combination to access it in the demo, but no luck yet.

So, for those looking into accessing these menus and the like, the most obscure text could be the name/option used for/in them.

@ LiquidManZero: Thanks for the tip and links. I've dealt with a decent amount of Japanese games. Not too long ago, I hacked MediEvil (JP) and they "omitted" a couple options when you enable Cheat Mode. The most handy of them being the 'Camera' option. I made a code to use the option and the text was not translated (the rest of the game was).

[Lazy Bastard]

Hmm...we should compile this into a rough guide for the GameHacking.org Library.

[BigBossman]

I went to http://tcrf.net they have quite a bit of hidden menus & debug stuff that I never knew existed on different games. One I never knew about was the different hidden music & sound effect options they had for Ninja Gaiden 2 (NES). There's also a hidden debug menu & music menu for Castlevania 3.

Of course they posted some GG codes for Double Dragon 2 & Double Dragon 3 (also for NES) to access different parts of the game, but I didn't have any luck getting that to work.

Its still interesting though.

[Hacc]

@ Lazy Bastard: That sounds like a good idea.

I was remembering some of the old hackers that hacked these codes regularly, and remembered Labmaster. I don't have the link to his old site, but came across this one.

The Primer Series link is down, but I found alternatives here and here.

Lesson 19 is written specifically for Debug Rooms/Menus.

[Lazy Bastard]

Sweet...we should really add the whole thing to the Library.

[Hacc]

The folks over at the TCRF are working on guides to find these menus among other things: http://tcrf.net/The_Cutting_Room_Floor:Guides

[Helder]

@ Lazy Bastard: That sounds like a good idea.

I was remembering some of the old hackers that hacked these codes regularly, and remembered Labmaster. I don't have the link to his old site, but came across this one.

The Primer Series link is down, but I found alternatives here and here.

Lesson 19 is written specifically for Debug Rooms/Menus.

What ever happened to Labmaster? I remember hacking many games alongside him, If I remember correctly he was from Australia or New Zealand. It's a shame these guys don't stick around in the after years.