Invincibility code for Golden Axe III (Genesis)

[Whipon]

Hello!!!.
I'm hacking Golden axe III, and I would like to make an Invincibility code for it. The RAM address for the invincibility is FFC84C. I managed to make the invincibility time infinite (003DCE 1140 => 6002), but I can't manage to make the game write any value to FFC84C at the start of the game, so you can be invincible allways.
Can anyone lend me a hand with this one, please?.
Thanks in advance!!!.

[Pugsy]

Without looking at the game I maybe able to give you some pointers. I think you maybe going at this the wrong way, the problem with writing a value to FFC84C at the start of the game is probably because it's in a batch of memory that's zeroed as part of a routine - fairly standard practice so to be able to make it not change one address is probably a non-starter whilst keeping the number of codes down. If you are lucky the game may read and compare FFC84C ingame even when it's zero....so you could always do a wp ffc84c,1,r and find any possibles that way. If you do it right FFC84C should stay at 0 and you will be invincible, do it slightly wrong (maybe the only option to keep the number of codes down) you will find that ffc84c will continuously decrement but you will still be invincible (alhough it may have serious side effects like flickering or causing crashes later).

Another harder option would be to drop the invincibility timer option completely and look for the collision routine.

[Whipon]

Thank, you very much, Pugsy. I'll try to put your advices in practice tonight .
C U.

[Whipon]

Well, doing a wp FFC84C ,1,r outputs this:

003DB2: 6600 03E6 bne $419a
003DB6: 4E75 rts
003DB8: 1028 00A8 move.b ($a8,A0), D0
003DBC: 6714 beq $3dd2
003DBE: 0868 0000 0001 bchg #$0, ($1,A0)
003DC4: 5300 subq.b #1, D0
003DC6: 6606 bne $3dce
003DC8: 08A8 0000 0001 bclr #$0, ($1,A0)
003DCE: 1140 00A8 move.b D0, ($a8,A0)
003DD2: 1028 00A9 move.b ($a9,A0), D0
003DD6: 6704 beq $3ddc
003DD8: 5328 00A9 subq.b #1, ($a9,A0)
003DDC: 4E75 rts
003DDE: 0C28 00FF 0122 cmpi.b #-$1, ($122,A0)
003DE4: 6706 beq $3dec
003DE6: B028 0122 cmp.b ($122,A0), D0
003DEA: 6406 bcc $3df2
003DEC: 4228 0123 clr.b ($123,A0)

The one reading FFC84C is 003DB8. If I change the 1028 to a 11FC it gives invincibility to the main character and also to some enemies, making the game unplayable. If I change it to 0000 it gives invincibility to any char in the game. If I change 003DBC 6714 to 0000 I get the same results without flash. Is there any hope to make the code or its impossible because of the programming code of the game?.
I can't understand this one:

Another harder option would be to drop the invincibility timer option completely and look for the collision routine.

I really appreciate your help. I couldn't reach this far without that little tutorial about HazeMD .

[Pugsy]

Ok, I've had a look...The code at 003DB8 is executed with different addresses in the A0 register
which means that the code is used for other things hence why you've got problems with enemies
getting Invincibility...I'm afraid there's not a lot you can do here unless you are happy using a
lot of codes. However, a key component of a cheat finders toolbox is imagination....

I've thought of a solution in making a GG code from a PAR code in just 3 codes, however I would steer
clear of this method as much as possible as requires a lot of testing (which I've not done in this
example) to make sure the cheat works throughout the game and will always require 3 codes!

Basically we need to look for some code we can safely change, simplest & safest thing is to look
for a sequence of NOPs are that run often enough. So put a BP on 003DB8, then we can start a
TRACE and run it for one or a few breakpoints and then TRACE OFF. We can then search for a
sequence of NOPs...I found three NOPs at 109A4 which is ideal for the 3 codes that will be needed.
One really useful thing I discovered about the Genesis is that it's possible to poke 00FF1234 by
poking 1234.w and this means we will need just a single code for the address, with another one
each for the poke value and one for the opcode. Obviously this code relies on 109a4 being executed
enough and during every part of the game....so it's possible it may just work for the start of the
game. Annoying it's flickering Invincibility but that's a trade-off to keep the number of codes down.



so we can change

nop
nop
nop

to

move.b #$8, $c84c.w

HazeMD codes:-

:g_gax3:20900000:0109A4:000011FC:FFFFFFFF:Invincib ility
:g_gax3:20900000:0109A6:00000008:FFFFFFFF:Invincib ility (2/3)
:g_gax3:20900000:0109A8:0000C84C:FFFFFFFF:Invincib ility (3/3)


And GG codes

9TET-DCFE
BAET-CAFG
KTET-CVZJ Invincibility (Flickering)

[Chemist]

The RAM address for the invincibility is FFC84C. I managed to make the invincibility time infinite (003DCE 1140 => 6002)...

It's possible to create GG codes, which don't affect the value in FFC84C, but make your characters invincible. This result can be reached by blocking conditional branch instructions. There are some codes:


000E48:60FA
Invincible in close combat. In VS mode, player 2 is vulnerable.


000A44:600E
Invincible against special attacks of enemies (fire breath, dragon's tongue, etc).


000A56:600E
Invincible against special attacks of your companion.


These 3 codes don't give you total invincibility: a player still can be hurt by falling off the screen, by barrels and by magic of the last boss (lightning). However, it's possible to find codes against these kinds of vulnerability.

[Whipon]

Thank you very much to both of you!!!. The two methods are amazing . I tested the Pugsy method and it worked in the entire game. Also the Chemist method is very cool and interesting. Can you please, explain a bit how you found the codes, Chemist? Thanks again n___n

[Chemist]

The basic idea of my method is to trace some amount of commands from some point when character is vulnerable,
memorize the value of Program Counter (PC), then return to that point, make him invincible using RAM cheat, and trace the
same amount of commands. If the new value of PC doesn't equal the old, then conditional branch instruction was passed. If new
PC equals the old one, we didn't reach that branch yet. Our task is to find the exact amount of commands we need to trace to
reach the conditional branch. This way, we'll find the value of PC exactly before branch, and get the address part of Game
Genie code.


IMPORTANT NOTE: at first, we may get not exactly what we need. For example, we may reach a test: "Do we need to decrease
invincibility value by 1 or it's already equals zero?". In this case, we have to block this using Game Genie code. There are
2 possible GGs to kill conditional test:

1. Making invincibility value ALWAYS DECREASE (it will even decrease from 0 to FF, making vulnerable character invincible,
ignoring the fact it was not planned).

2. Making invincibility value NEVER CHANGE.

Be sure you've chosen 2nd variant, or FURTHER COMPARATIVE TRACING WILL BE POINTLESS.
Okay, we've killed that test properly and may continue tracing.


ANOTHER IMPORTANT NOTE: sometimes, we need to kill more than one conditional test to reach total invincibility.
Don't forget this, and don't hurry to call your fresh GG code "Total Invincibility". A character may be invincible
in close combat, but vulnerable to projectiles, etc.


OKAY, HOW TO DO THIS?


Tools: Gens v. 2.14, Artmoney v 6.23 (you can download the newer version from www.artmoney.ru).


1. Make a savestate just before the enemy's spear hits a character, then make an exact copy of it. Let's say the first
savestate was made in slot #0, and second was made in slot #1. I will call them state(0) and state(1). Just in
case, make a copy of state(0) in 9th slot.


2. Then pause Gens (Esc) and load state(1). Using Artmoney, change the value in address FFC84C (Artmoney address is
00826D4C) to 7F (Why not FF, the maximal value? Some games process values larger than 7F as negative. For that reason,
I have a habit of using 7F instead of FF. For Golden Axe 3, it doesn't matter will you use 7F or FF). After making changes,
save state(1) again. Gens must be paused during these operations.


3. Unpause Gens and make sure that character in state(0) gets a hit, and character in state(1) doesn't.


4. Now we have savestates to compare. Open debugger in Gens.

Hotkeys:

T - trace 1 command
Y - trace 10 commands
U - trace 100 commands
I - trace 1000 commands
O - trace 10000 commands
P - trace 100000 commands

H - emulate H Blank (we don't need this)
J - emulate V Blank (we don't need this)

Okay, press P (trace 100000 commands). What? Debug pauses? Something must be going wrong...

Well, to go any further, we must make all 'DEC' Game Genie codes. You can find more information here:
http://www.thegshi.org/vb/showthread.php?t=489

3RD IMPORTANT NOTE: If you open Game Genie window (File -> Game Genie) in debug mode, and then close it, an
effect of all Game Genie codes will disappear. To make it reappear, you need to relaunch debugger (quit from the debug
mode and then enter again).


5. Okay, we made all 'DEC' codes, and now debugger flies over a code. It's time for comparative tracing.


1) Make sure you're in debug mode, and all 'DEC' ones are enabled.

2) Load state(0), press 'P' (trace 100000) and memorize the value of PC after that. Open state(1), and do the
same thing.

3) Compare the first and second values of PC after tracing (I'll call them PC(0) and PC(1)). If PC(0)
doesn't equal PC(1), we've flied over the first test of value in our RAM address. If PC(0) equals PC(1)
(what a miracle! After tracing 100000 commands!), load state(0), press P, and save it. Do the same with
state(1)...

...

4) Okay, we've saved state(0) and state(1) just before conditional branch. PC(0) equals PC(1),
but if we load each state and trace just 1 command (press 'T'), PC(0) will not be equal to PC(1).
Congratulations, there are first results. Now we should force the game chose 'vulnerable way'. Why VULNERABLE? Take a look at the
"IMPORTANT NOTE" in the almost beginning.

Okay, we forced the game follow the way represented in state(0) (we have vulnerable character in state(0),
right?). We've made a GG code. But what does it do? We don't know, because we're still in debug mode. For this reason, I
suggest to call it "Step 1" or just "1". I will call GG code with opposite effect "-1" ("-2", "-3", etc).

5) It's time to see, what does our "1" do. We should quit debug mode. Phew...

If blinking character in state(1) gets damage, make the opposite code of "1" ("-1"). If "-1" makes non-blinking
in state(0)character invincible, our job is done. (Ok, we should also test this code through the game,and give
it proper name). If not, we should repeat our actions to do "Step 2" (or just "2") GG code. Etc, until we're satisfied.



That's all. I hope this information will be useful for you. If something is complicated, tell me please.


Chemist.

[Pugsy]

That's a good guide, you've obviously put a lot of work into it and it works for you which is good.

Though I have to say it does sound incredibly complex. I also assumed that you were talking about sprite collision invincibility rather than a timer derived invincibility though. Personally I've never been a fan of save state methods as they are ultimately a lot more work though in many cases there is no alternative.

Having read through your method, I can simplify it somewhat....by just using HazeMDD with the debugger enabled. I appreciate that you are used to Gens32 but HazeMDD has the MAME debugger...and no other emulator can touch the power of this beast. The two bugbears of HazeMDD is that you need to rename your ROMs but this can be done easily with clrmame which get the dat info straight from the hazemdd.exe just like MAME does and a frontend like emuloader fixes the lack of a windows frontend.

Anyway start the game in HazeMDD with the debugger enabled (type IGNORE 1 and hit ENTER and press F12 when the debugger first appears). Start playing the game and when you are ready to start searching press the tilde key to bring up the debugger and enter this rather elegant watchpoint command (you can customise it too):-

wp ffc84c,1,r,1,{printf "Suspect @ %06x\n",PC; g}

and press F12 to restart the game...do what you like and when you are ready press F12 again and in the debugger window you will find a list of the PC value after every single read of FFC84C.

So you'd get something like this:

SUSPECT @ 003DBC
SUSPECT @ 003DBC
SUSPECT @ 000E3E
SUSPECT @ 003DBC
SUSPECT @ 00607A
SUSPECT @ 003DBC
SUSPECT @ 003DBC

Run it long enough and you will have a nice list of addresses to investigate further. To be honest for most games a single simple rw watchpoint will often turn up the goods with timer invincibility cheats in a matter of 5 mins or less.

I am amazed that people who make genesis cheats haven't adopted hazemdd as the emulator of choice in making genesis cheats, there's no need for any external RAM searching (has a built in fully functioning cheat engine) and a debugger that is incredibly powerful and fairly easy to use. Granted as an emulator it's not as good as Gens but it does run over 99% of genesis games without difficulty...so surely it's worth a look at least?

[Whipon]

It was a very interesting reading. Thank you very much to both of you to take the time to explain it to me. I'll start to do my homework right now, maybe untill the cock starts his cocakdodleedoo, lol!!!. (I don't have a cock, its just a joke :P).
Thank you very much, dear hacking masters!!!!
Whipon.