How to make invincibility codes?

[MathUser]

I know this should go in the retro forum but I was hoping to put this somewhere where it would be noticed.

Theres a game called gradius 2 for NES. I was wondering how to make a code for invincibility. THe game has no kind of flashing event, like when you respawn or anything, and there is no invincibililty powerup. So Im wondering how to make such a code so enemies can't touch you.

[Lazy Bastard]

Hmm...if you can find any way to differentiate between when you're being hurt and not being hurt, you could probably find the address that controls whether it's the former or the latter, and lock it to the lather...other than that, someone un-lazy and possibly more educated in some field or another would have to help, heh.

[MathUser]

Yeah, I havent run into those instances yet. There is a shield, but it doesn't protect you from everything. There are other games that have no such invincibility moments. Atomic Runner for Genesis for example. THere is no kinda powerups that will let you take a hit. It's always instant death. Somehow a guy stilll made a invincibility code. I asked him to share his method. But you know some hackers don't want to share their info. I hate that, back in the day people used to share their info but now people wanna be secretive about their methods.

[Lazy Bastard]

Heh, usually that means he found it randomly, and completely by accident.

[ugetab]

This is my first NES ROM Hack code. I played 1 full cycle with the code on, and ended up with 46 lives to use for the next cycle.

Gradius 2:
Never Die (ROM Hack):
Address: F50C
Value: 096
Compare: 32
Read Substitute: On

(Game Genie: ATENGIAZ)


This was no accidental discovery either.

In response to the idea that people are 'secretive', usually the mental processes used to find such codes are worth a sit-in lecture on the subject to the code maker, rather than a passive message to the person who wants to know.

I can tell you that I created a utility to copy data from one save-state to another to find the memory location, used a file viewer to determine that the RAM started 84 bytes into the FCEU save state, and used the calculated memory address of the death value in the debugger to breakpoint the ROM addresses used to initiate a death...

but all of that is just a rough overview of a refined process, both for figuring out what needs to be figured out, and for figuring out the specific problems.

Making it sound like code makers have documented all of their techniques on the off chance that a mildly interested party will request the information is somewhat offensive to me, since I know from experience that there are few places one can demonstrate their abilities in a way other than 'here's that code you wanted'.

Edit:
Changed and confirmed Game Genie code, since I didn't know how my existing converter worked for NES codes.

[Lazy Bastard]

A valid, nicely-organized collection of points

Still, it's not difficult to at least throw in such a basic overview, if requested, with possible elaboration at a different time, if needed. I always try to help a hacker trying to learn something; it's just the way things should be. Given, most of we hackers are weird dudes, perfectly entitled to our idiosyncratic hermitages from time to time...but we should try to help out where we can.

Grasping at the idea that the more you help others to improve themselves and their abilities, the less useful you become...is vain and ridiculous. I'd love it if everyone around was a master VG hacker...games would be hilariously hacked around the clock, and with that much work put in, there'd be a lifetime of codes to play around with...but bleh, dreams for another time.

[ugetab]

I'd be quite happy to help someone if I thought they really meant to make use of the effort I put into teaching and helping them, but even beyond that, I have nobody who taught me. I learned through experience, and I think such learning allows you to become advanced in a field much more efficiently than getting help every time a problem comes up.

I used the MAME debugger and several other utilities for long enough to be able to pick up on the general strategies needed to hack an NES code the first time I tried to do it, using a debugger and cheat code system I'd never touched before today.

[MathUser]

Oya, I can tell you I'm interested in making invinicibility codes. So how do you figure out the exact moment to do some searches? Like is there supposed to be some kind of invinicibility in effect when you get killed and I do some seraches there? Like, so is this just a code to change your status, as in alive, dead. I got no clue myself.

But yes, I knew there had to be a method to making those types of codes cause there's a lot of them out there.

[ugetab]

I very specifically went for a ROM hack in this case.

To do a ROM hack, you need to find an address that will initiate your death when activated(and activated has the potential to be any value other than the value it already is), then use that address as a breakpoint/watchpoint, so that the code that changed the value will be displayed, and you have the potential to see where all of the death routine starts, and stop the code from executing.

For the Gradius code, I 'Step'ped through the code until the RTS(return to where the code was called from), then pressed the up arrow on the scroll bar a few times until the instructions made sense. The Jump address shown showed me where the death routine started, so I set the starting address of the jump to an 'RTS' so it would immediately return without doing anything.

I must say, however, that routine was a very simple death routine. There are games that I've tried to make invincibility for that confound my abilities to this day. Try not to start with a game with an insane difficulty level that you know others have given up on at least once.


Another misconception I see you have is that I used the internal search method. I used 'Save States', as in press a number and press F5 to save, and F7 to load.

I have developed one of the most sure-fire way to hack games using any emulator with working(and not compressed) save states. I save 1 save-state Without the effect I want, and save one save-state With the effect I want, and I then copy PORTIONS of one save-state file over the same portions of the other file. I go by intuition whether to go from activated to deactivated, or deactivated to activated. I'll go in increments dependant on the file size, large increments for large files, smaller increments for small files.

After each time I copy data, I'll load the state to check and see if the effect I want has happened, and if it has, I restore the modified file, and use the previous increment address as the start, and the current increment address as the end, and use smaller copy increments within an ever narrowing range until I track down the effects bytes to within a very small area, often to 5-10 bytes to manually check for single-byte activatoes.

This is very complex...extremely complex to explain, but if you let the possibilities of this system play around in your head, and you get a good intuitive feel for how things are programmed, you can find just about anything.

Another thing to remember is to try and do whole series of games at once(or remember how a series has worked), because programmers tend to reuse old game code, which can significantly simplify a complex procedure.(I used this type of knowledge to make Gameshark repair codes for the FF9 character problems that resulted from some cheat codes many people used, and to hack some Megaman 8 stuff for the PSX, and most impressively, I've hacked almost identical code for every existing MAME arcade Mortal Kombat through UMK3 game to give infinite fatality time)

For a time before I had a debug build of MAME, I used save-states to track down hard-to-find values, even though it was a bit inefficient compared to other emulator save-states.


Bottom line is this: You need to practice with something(MAME Debugger, FCEU Debugger, Universal Game Editor and Save States, Save State Cracker, etc), and you need to really want to do this enough to let it eat more time than you reasonably have in a day.

You'll need to learn how to remember an assembly programming instruction's function to do anything more than simple ROM hacking. MAME is good for this because it has a wide variety of different Assembly types for the games that use it. Some ASMs use 1 byte per instruction, some use up to 4 bytes per instruction. Recording NOPs, JMPs, JSRs, and RTSs instructions in a game-specific file and stepping through code as you search for some simple value to modify in ROM with an LDA and an STA or some other code. (and then figure out how to force the cheat engine to modify that ROM address)


Note that while this is a significant amount of work, it's not as much like a school course, because you can learn all there is to know about how to make code RTS(return from a jump) without causing many errors, and still know next to diddly-squat about how to make code that will write values to memory in the place of what would normally be written. You get to learn just what your mind can imagine would be helpful to you in a given situation.


This, however, has probably made you think twice about even getting into ROM hacking at this point, as this much text easily put me off from the idea before I started by just jumping into it and doing simple stuff to start with, and learning on my own. I was silly and thought I'd start with a request that someone else hadn't been able to do with their amount experience. I eventually beat the problem, but I don't think that there was anything casual about how I chased the problem with about every free moment I had. I just don't notice that kind of dogged determination very often in others. But, I'm kinda weird, and I don't really associate myself with this 'reality' stuff everyone else is so wrapped up in.


I'm all written out and less capable of thinking from figuring out how to phrase things, so do what you can with what I've written, and ask for something specific if you need any more info.

[ugetab]

Invincibility:
Gradius 1(Buggy-graphics version)
GKOKPPSX
NAEGAXLP
XGEGPXOG

Gradius 1 (E) (non-buggy-graphics version)
GKSGAPSX
VUSGPOLO
XKSGZOOG

Edit:
Removed confusing info from codes