New Guide: How to Make "Moon Jump" Codes

[Tony H]

Finally finished it:

http://codehut.gshi.org/HowToJumpCodes.txt

Feel free to add it to the site. Since the formatting may get changed below (extra spaces removed, etc), the link above will probably be easier to read.

Let me know if you have any questions.

=======================


How To Make "Moon/High Jump" Game Genie Codes for Genesis Games


Version 0.5 Sept 15 2012


Written by Tony Hedstrom [email protected]

http://www.angelfire.com/games2/codehut/

http://codehut.gshi.org/


Back at the keyboard making another hacking guide. This time, I'm going to
explain how to make Game Genie codes to make your character jump higher.

There are 2 different types of high jump codes. The regular high jump code,
and the moon jump code. Moon jump codes actually change the amount of gravity
in the game, which in turn makes you jump higher. Moon jump codes also make
you jump up slower, and come back down slower (just like on the moon). Much
easier to control your character with this type of code.

For now, I'm only going to explain how to make moon jump codes. I'll add
regular high jump codes later.


For our example, I'm going to use a game called Blaster Master 2. It's a
relatively easy game to make a moon jump code for. There are some "official"
high jump Game Genie codes for this game, but they are completely different
than the moon high jump codes we're going to make.

Here's what you'll need...

1) The Blaster Master 2 ROM (use Google to find it).

2) An emulator that has RAM searching abilities (Gens Hacking, Fusion, etc).

3) A Genesis Debugger (Gens Tracer, ReGenD, MESS, etc).

4) A Game Genie conversion program.


For our example, I'm using Gens Hacking version for searching RAM addresses,
and Gens Tracer for the debugger. Which ever debugger you use needs to be
able to make an assembly trace file, with register information. You can
download Gens Hacking version, Gens Tracer, and a Game Genie conversion program
from here:

http://gamehacking.org/downloads/gen...ng_version.zip

http://gamehacking.org/downloads/Gens2.12aR2Tracer.zip

http://gamehacking.org/downloads/ggconv.zip


OK, now on to the fun stuff.

The first thing you need to do, is find the RAM address for your vertical
position. Load up your Blaster Master 2 ROM, and get your vehicle up as high
as you can on one of the little platforms up above you. The higher the better.

NOTE: In this game, if you stand still for more than a few seconds, a fireball
starts to attack you. Very annoying if you're trying to make codes. Here's a
Game Genie code to get rid of the fireball: ABNT-JAA0

Once you're up on one of the platforms, make a save state there. Open up your
RAM searcher and reset it for a 2 or 4 byte search. Go back to the game for a
few seconds and slightly move your vehicle without falling off. Search for
"Equal to previous". Go back to the game and move your vehicle off the platform
(without jumping) so it just starts to fall and pause the emulator (press ESC on
Gens to pause it). Search for "Greater than previous". Unpause the emulator for
a split second so you fall down just a bit more and then repause. Search for
"Greater than previous". Keep doing this until you only have a few RAM addresses
left.

Note that if searching for "Greater than previous" doesn't work for your game,
try searching for "Less than previous".

With our example, you should be able to narrow down your results to about 7 RAM
addresses. Test each one until you find the address that makes your vehicle
float in mid-air. This is the address that controls your vertical position.
In our example, the correct RAM address is FF179E. In Gens, this code makes
your vehicle float in mid-air: FF179E:0113.


Now that we have our vertical RAM address, the next step is to make a memory
trace log of it to find out where in the ROM we need to look, and an assembly
trace log to find out exactly what's happening in the game. If you're using
another debugger besides Gens Tracer, you can just set a breakpoint for our
RAM address instead of making a memory trace log.

To setup Gens Tracer to make a memory trace log, go to your Gens Tracer
folder and open up the file called 'hook_log.txt'. Type in our RAM address
just like this:

hook_pc1 0 -1 -1
hook_pc2 1 -1 -1
hook_pc3 1 -1 -1

hook_rd1 0 -1 -1
hook_rd2 0 -1 -1
hook_rd3 0 -1 -1

hook_wr1 0 FF179E FF179E
hook_wr2 0 -1 -1
hook_wr3 0 -1 -1

hook_ppu1 1 -1 -1
hook_ppu2 1 -1 -1
hook_ppu3 1 -1 -1


Save and close.

Start up Gens Tracer and load your Blaster Master 2 ROM. If you made a save
state up on one of the platforms earlier with Gens, you can use that same save
state with Gens Tracer. If not, get up as high as you can on one of the
platforms like you did before. Make a save state here if you haven't already.

This part is very important, so follow the instructions exactly. While on
the platform, move your vehicle off (without jumping) so that you start to fall.
While you are falling, press the "," key and immediately press the "," key
again. This turns the memory logger on and off. You only need it turned on
for about 1/2 of a second. Just make sure that it is turned on and off while
you are falling.

Next we'll make our assembly trace log. Load up your save state so that you are
up on the platform. As before, move your vehicle off the platform (without
jumping) so that you start to fall. While you are falling, press the "/" key
and immediately press the "/" key again. This starts and stops the assembly
trace logger. As before, make sure you start and stop it while you are falling.
Exit Gens Tracer.

We now have our memory and assembly trace logs. Lets see what we can find.

Go to your Gens Tracer folder and open up the file called 'hook.txt'. This is
our memory trace log we just made. It should look something like this:

[0349A] W32 = 00A6D800 [FF179E]
[0349A] W32 = 00AC8800 [FF179E]
[0349A] W32 = 00B27000 [FF179E]
[0349A] W32 = 00B89000 [FF179E]
[0349A] W32 = 00BEE800 [FF179E]
[0349A] W32 = 00C57800 [FF179E]

TRACE STOPPED

As you can see, our vertical RAM address is having a value added to it from
ROM address 0349A. Let's open up our assembly trace log file to find out
where that value is coming from. In your Gens Tracer folder, open up the file
called 'trace.log'. It's probably going to be a large file, so you'll need
something like MS Word to open it.

This part is a little confusing, so bear with me. If you try to search our
'trace.log' for ROM address 0349A, you won't get any matches. What I usually
do is just remove the last digit from the ROM address shown and that will get
you pretty close to where you need to be (unless the last digit is zero in which
case you would remove the last digit AND subtract 1 from the second to last
digit). If that's too confusing, just search for the address shown. If you
don't get any matches, subtract 2 and search again. If still no matches,
subtract 2 and search again, etc. Just remember that they are hex numbers, so
use your Windows calculator if you need to.

Here is the assembly/instruction that is adding to our RAM address:


03498 D1 A8 ADD.L D0,$001E(A0) A0=00FF1780 A1=00FF5BA2
A2=0006E61A A3=0004DABA A4=00FF15D2 A5=00FF169E A6=0004B8E4 A7=FFFFFFF8
D0=0004D000 D1=001C00A7 D2=00000018 D3=000000FF D4=000000FF D5=00000180
D6=000680CC D7=00000022 xnzvc


Do not be intimidated by assembly. Once you break it down, it's not that hard
to understand. Plus, we're only interested in one small part of it. We just
want to know what is adding to our RAM address (FF179E).

In the assembly above, it's adding register D0 to RAM address $001E(A0). The
RAM address can be figured out by adding 001E to the address in register A0.
A0 = 00FF1780, so 001E + 00FF1780 = 00FF179E. Bingo! That's our vertical
position RAM address, so we know we're on the right track. So we know that
register D0 is being added to our RAM address, so we just need to back trace
register D0 to see where the value there is coming from. As you can see above,
the value in register D0 is 0004D000. If you back trace and look at the
instruction right before that, here is what you'll see:


03494 20 28 MOVE.l $002E(A0),D0 A0=00FF1780 A1=00FF5BA2
A2=0006E61A A3=0004DABA A4=00FF15D2 A5=00FF169E A6=0004B8E4 A7=FFFFFFF8
D0=FFFE0BE0 D1=001C00A7 D2=00000018 D3=000000FF D4=000000FF D5=00000180
D6=000680CC D7=00000022 xnzvc


This is moving the value from RAM address $002E(A0) into register D0. Lets
figure out that RAM address (just like before): $002E + the address in register
A0. So 002E + 00FF1780 = 00FF17AE. We are one step closer. Now we need to
figure out where the value for RAM address FF17AE is coming from. We can do
this just like we did with our other RAM address... do a memory trace log with
Gens Tracer (or set a breakpoint if you're using a different debugger).

I've found that with most high jump/moon jump codes, you'll have to track down 2
different RAM addresses before you find what you're looking for.

Do a memory trace log just like before. Setup your 'hook_log.txt' file like
this:

hook_pc1 0 -1 -1
hook_pc2 1 -1 -1
hook_pc3 1 -1 -1

hook_rd1 0 -1 -1
hook_rd2 0 -1 -1
hook_rd3 0 -1 -1

hook_wr1 0 FF17AE FF17AE
hook_wr2 0 -1 -1
hook_wr3 0 -1 -1

hook_ppu1 1 -1 -1
hook_ppu2 1 -1 -1
hook_ppu3 1 -1 -1


Save and close. Make sure you close your 'hook.txt' file from earlier, because
Gens Tracer needs to make another one for our new RAM address.

Run Gens Tracer, load your ROM and your save state up on the platform, move your
vehicle off the platform (without jumping), and start and stop the memory logger
while you are falling (by pressing the "," key twice). Exit Gens.

Here's what our new 'hook.txt' file looks like:


[034CA] W32 = 00046000 [FF17AE]
[034CA] W32 = 00049800 [FF17AE]
[034CA] W32 = 0004D000 [FF17AE]
[034CA] W32 = 00050800 [FF17AE]
[034CA] W32 = 00054000 [FF17AE]
[034CA] W32 = 00057800 [FF17AE]
[034CA] W32 = 0005B000 [FF17AE]

TRACE STOPPED


We're almost there. As you can see, ROM address 034CA is adding to our RAM
address. One other thing you may notice, is that the value that is being
added is always 3800. Keep that in mind.

Look in your assembly trace log from before and you'll see this is the assembly/
instruction that is adding to our RAM address (FF17AE):


034C8 D1 A8 ADD.L D0,$002E(A0) A0=00FF1780 A1=00FF5BA2
A2=0006E61A A3=0004DABA A4=00FF15D2 A5=00FF169E A6=0004B8E4 A7=FFFFFFF8
D0=00003800 D1=001C00A7 D2=00000018 D3=000000FF D4=000000FF D5=00000180
D6=000680CC D7=00000022 xNzvC


Just like before, it's adding the value from register D0 to RAM address
$002E(A0). If you look at register D0, the value there is 00003800. Let's
back trace register D0 to find out where that value is coming from. That
00003800 is our holy grail. Once we find that, we can make our moon jump
Game Genie codes.

Here is the instruction that we just looked at, as well as a few instructions
before it so we can back trace register D0:


034AA 20 3C MOVE.l #$00003800,D0 A0=00FF1780 A1=00FF5BA2
A2=0006E61A A3=0004DABA A4=00FF15D2 A5=00FF169E A6=0004B8E4 A7=FFFFFFF8
D0=00000E00 D1=001C00A7 D2=00000018 D3=000000FF D4=000000FF D5=00000180
D6=000680CC D7=00000022 xnZvc

034B0 0C 79 CMPI.W #$0010,($00FF0534) A0=00FF1780 A1=00FF5BA2
A2=0006E61A A3=0004DABA A4=00FF15D2 A5=00FF169E A6=0004B8E4 A7=FFFFFFF8
D0=00003800 D1=001C00A7 D2=00000018 D3=000000FF D4=000000FF D5=00000180
D6=000680CC D7=00000022 xnzvc

034B8 66 0E BNE #$0E [034C8] A0=00FF1780 A1=00FF5BA2
A2=0006E61A A3=0004DABA A4=00FF15D2 A5=00FF169E A6=0004B8E4 A7=FFFFFFF8
D0=00003800 D1=001C00A7 D2=00000018 D3=000000FF D4=000000FF D5=00000180
D6=000680CC D7=00000022 xNzvC

034C8 D1 A8 ADD.L D0,$002E(A0) A0=00FF1780 A1=00FF5BA2
A2=0006E61A A3=0004DABA A4=00FF15D2 A5=00FF169E A6=0004B8E4 A7=FFFFFFF8
D0=00003800 D1=001C00A7 D2=00000018 D3=000000FF D4=000000FF D5=00000180
D6=000680CC D7=00000022 xNzvC


As you can see, that "00003800" in register D0 is coming from the very top
instruction above (034AA 20 3C MOVE.l #$00003800,D0). BAM! We found it.
Changing that 3800 with a Game Genie code will change the gravity for our
vehicle. Lower values will make you jump higher and descend slower.

One last thing... unless you're familiar with assembly, figuring out the exact
ROM address for our Game Genie code can be a little tricky. Here's an easy way
to figure it out...

Open up your Blaster Master 2 ROM with a hex editor. Go to the ROM address
listed next to our 00003800 value from above (03D4AA). This is what you'll see:

203C00003800

By clicking on the "3" of the 3800 in your hex editor, it will show you what
ROM address that is. In this case it's 03D4AE. So enter 03D4AE:xxxx into your
Game Genie conversion program to get your GG codes. This one will make you moon
jump all the way to the top of the screen and descend slower: 03D4AE:0A00.


Shoot me an email if you have any questions: [email protected]

Tony H.

P.S. You may be wondering why we didn't just search for the 2nd RAM address
(FF17AE) to begin with to save time. If you check RAM address FF17AE while
you're falling, you'll see that it gets to a certain value and then stops adding.
If you were searching for "greater than" while falling, that RAM address would
be eliminated from your matches.

[dlevere]

Added to the Wiki.