|
Research / Sonic 2 / Differences between rev00 and rev01 On a small note, I made a few discoveries regarding the unused bg scrolling while exploring the differences between these two revisions. They are: 1) These bg prove that 09Z was worked on. 2) This proves there was a later Wood Zone than we have in our beta [the scrolling bg is missing in beta, ALSO, it would 100k ugly with the current beta bg! 3) I found by mistake, that in beta, WZ is SCROLLING! The code for the scrolling doesn't work, but 100k at the debug camera coords :D Imagine the later WZ... Now, with the differences: Sonic 2 Rev 00 and Rev 01 differences. I covered *ALL* differences, so stfu about pigs in CNZ etc. I'm skipping the different jump/branch absolute addresses, for obvious reasons. rev00/rev01 0x180/0x180 - Game serial (GM 00001051-00 - rev 00, GM 00001051-01 - rev 01) 0x18e/0x18e - Checksum (obviously) ==================== 0x306/0x306 - The following code was deleted in Rev 01: loc_306: move.w ($C00004).l,d1 btst #1,d1 bne.s loc_306 ==================== 0xc28a/0xc296 - This is the background scrolling offset index. In Rev 01, some levels were cut off: Wood_Zone_BG: asr.w #2,d0 addi.w #$400,d0 move.w d0,($FFFFEE0C).w asr.w #3,d1 move.w d1,($FFFFEE08).w rts and HPZ: Hidden_Palace_Zone_BG: asr.w #1,d0 move.w d0,($FFFFEE0C).w clr.l ($FFFFEE08).w rts This BG isn't linked with the ROM in the offset index. I wonder if I could get it to work in some zone... Edit: This is actually level 09. Unknown_Zone_BG: asl.l #4,d0 move.l d0,d2 asl.l #1,d0 add.l d2,d0 asr.l #8,d0 addq.w #1,d0 move.w d0,($FFFFEE0C).w clr.l ($FFFFEE08).w ==================== 0x2ad7a/0x2ad78 - a bugfix in rev 01 (fixes the code for a vertical/diagonal spring from CNZ that you hold down jump on to pull back further). this code was inserted in rev 01: 0x2af72/0x2af7a - the same bug fix, for the second time, in a different part of the code Update: the code somehow disables the spring code when you're dead. Tested in both Rev 00 and Rev 01, we haven't found the difference. Basically, the code is like: if (Sonic/Tails == dead) dont_spring; locret_2AD78: rts loc_2AD7A: cmpi.b #4,$24(a1) bcc.s locret_2AD78 and the second bugfix: locret_2AF78: rts loc_2AF7A: cmpi.b #4,$24(a1) bcc.s locret_2AF78 ==================== 0x12000/0x11fd4 - A bugfix in Ring Object in Rev 01. Prevents from flagging (flagging is in the later, unedited code), that player got the 100 and 200 rings 1up, when he actually didn't get it (because of the lives overflow). this code: ------------ cmpi.w #999,($FFFFFE20).w;check if lives == 999 bcc.s lives_overflow;if lives >= 999, branch (skip changing the counter) addq.w #1,($FFFFFE20).w;add 1 to lives counter lives_overflow: ori.b #1,($FFFFFE1D).w;some flag setting move.w #$B5,d0 ;set the 1up sound ------------ is changed to this: (I even commented it) ------------ loc_11FD4: move.w #$B5,d0 ;set the sound to 1up cmpi.w #999,($FFFFFE20).w;check if lives == 999 bcc.s loc_12016 ;if lives >= 999, branch (skip adding to the counter etc.) addq.w #1,($FFFFFE20).w;add one life to the counter ori.b #1,($FFFFFE1D).w;some flag setting ------------ ==================== 0x12998/0x1296c - a bugfix in Super Ring Monitor in rev 01, that fixes the overflow of rings in rev 00. this code: ------------ lea ($FFFFFE20).w,a2 lea ($FFFFFE1D).w,a3 lea ($FFFFFE1B).w,a4 cmpa.w #$B000,a1 beq.s Player_who_hit_the_monitor_is_Sonic lea ($FFFFFED0).w,a2 lea ($FFFFFEC9).w,a3 lea ($FFFFFEC7).w,a4 Player_who_hit_the_monitor_is_Sonic: addi.w #10,(a2) ------------ is changed to this: ------------ lea ($FFFFFE20).w,a2 lea ($FFFFFE1D).w,a3 lea ($FFFFFE1B).w,a4 lea ($FFFFFEF0).w,a5 cmpa.w #$B000,a1 beq.s Player_who_hit_the_monitor_is_Sonic lea ($FFFFFED0).w,a2 lea ($FFFFFEC9).w,a3 lea ($FFFFFEC7).w,a4 lea ($FFFFFEF2).w,a5 Player_who_hit_the_monitor_is_Sonic: addi.w #10,(a5) cmpi.w #999,(a5) bcs.s loc_129A0 move.w #999,(a5) loc_129A0: addi.w #10,(a2) cmpi.w #999,(a2) bcs.s loc_129AE move.w #999,(a2) ------------ So yeah, when you hit the Super Ring monitor with 999 rings, you overflow that in Rev 00. Also, Rev 01 adds an invisible copy of the rings value. Rattle made pix of that: http://img195.imageshack.us/img195/1487/so...ion000054ng.jpg http://img195.imageshack.us/img195/3393/so...ion000064as.jpg ==================== 0x16634/0x16634 - this another bugfix changes this (in Rev 00): (btw, the loc_x are the Rev 01 locations) tst.b (a0) beq.w loc_1671C tst.l 4(a0) beq.w loc_1671C to this (in Rev 01): tst.b (a0) beq.w loc_166F2 This has something to do with dynamic level building. I have no idea what it does though =P few bytes after this, there's another branch (bne). It was slightly changed in Rev 01: Rev 00: bne.w loc_16724 Rev 01: bne.w loc_1671C ==================== 0x16724/0x1671C - uh, no idea what it does. In Rev 01, the following code was removed: move.w (1).w,d0 bra.s loc_166F2 loc_16724: ==================== Deleted/inserted NOPs (4e71): 0xe5bc/0xe5e6 - one NOP deleted in Rev 01 0x16f80/0x16f72 - one NOP inserted in Rev 01 ==================== 0x1ccfe/0x1ccec - another bugfix in Rev 01. This time fixes Tails' code. This code (note: loc_x are Rev 01 locations): loc_1CCEC: tst.b ($FFFFFE1A).w bne.s loc_1CD38 is changed to: loc_1CCEC: tst.b ($FFFFFE1A).w beq.s loc_1CD0E tst.b ($FFFFFECC).w beq.s loc_1CD38 move.w #0,$3A(a0) clr.b ($FFFFFE1E).w clr.b ($FFFFFECA).w move.b #8,$24(a0) rts ==================== 0x20f54/0x20f64 - this code was deleted in Rev 01: loc_20f54: tst.w ($FFFFFE08).w beq.s locret_20F64 jmp sub_164F4 btw, few bytes higher, a reference to loc_20f54 was changed to locret_20F64: Rev 00: bne.s loc_20f54 Rev 01: bne.s locret_20F64 ==================== 0x27144/0x27148 - this code: jmp_164F4: jmp sub_164F4 loc_27148: jmp loc_164E6 is changed to this: loc_27148: jmp loc_164E6 In Rev 01 .Also, few jumps further, there is a 0x0000 word which is added in Rev 01. ==================== 0x26ff0/0x26ff4 - this code: ----------- bsr.s loc_2704c loc_26FF6: movem.l (sp)+,d1-d4 lea ($FFFFB040).w,a1 moveq #4,d6 bsr.w loc_27154 cmpi.b #1,d4 bne.s loc_2702C btst #1,$22(a1) beq.s loc_2702C move.b $22(a0),d1 move.w 8(a0),d0 sub.w 8(a1),d0 bcs.s loc_27024 eori.b #1,d1 loc_27024: andi.b #1,d1 bne.s loc_2702C bsr.s loc_2704c loc_2702C: move.w 8(a0),d0 andi.w #-$80,d0 sub.w ($FFFFF7DA).w,d0 cmpi.w #$280,d0 bhi.w loc_27148 tst.w ($FFFFFE08).w loc_27042: beq fe08_null bsr.w jmp_164F4 fe08_null: rts ----------- is changed to this: ----------- bsr.s loc_27042 loc_26FF6: movem.l (sp)+,d1-d4 lea ($FFFFB040).w,a1 moveq #4,d6 bsr.w loc_27154 cmpi.b #1,d4 bne.s loc_2702C btst #1,$22(a1) beq.s loc_2702C move.b $22(a0),d1 move.w 8(a0),d0 sub.w 8(a1),d0 bcs.s loc_27024 eori.b #1,d1 loc_27024: andi.b #1,d1 bne.s loc_2702C bsr.s loc_27042 loc_2702C: move.w 8(a0),d0 andi.w #-$80,d0 sub.w ($FFFFF7DA).w,d0 cmpi.w #$280,d0 bhi.w loc_27148 rts loc_27042: cmpi.b #4,$24(a1) bcs.s loc_2704C rts ----------- ==================== 0x42d26/0x42d36 - Pattern Load Cue $3a had doubled patterns, which wasted space. This was fixed in Rev 01. This code: PLC_3A: dc.w 3 dc.l ArtNem_7D22C dc.w $B000 dc.l ArtNem_7E86A dc.w $B600 dc.l ArtNem_7C2F2 dc.w $BE80 dc.l ArtNem_7EEBE dc.w $A800 dc.l ArtNem_7C2F2 dc.w $BE80 dc.l ArtNem_7EEBE dc.w $A800 dc.l $0 was changed tO: PLC_3A: dc.w 3 dc.l ArtNem_7D22C dc.w $B000 dc.l ArtNem_7E86A dc.w $B600 dc.l ArtNem_7C2F2 dc.w $BE80 dc.l ArtNem_7EEBE dc.w $A800 ==================== 0x12aee/0x12ae2 - bugfix, clearing Sonic and Tails animations on some ocassion (in routine #9, btw). Anyway, this code was inserted: move.b #0,($FFFFB01A).w move.b #0,($FFFFB05A).w ==================== 0xbaee/0xbafa - changes the typo in credits (in Rev 00 it says Tohmas - Rev 01 fixes it to Thomas) ==================== Update: this is probably music changes 0x180b4/0x180a8 - slight change. I don't know what it does. Rev 00: 0x05 B4 24 18 86 00 05 B8 82 E8 44 00 06 2C 86 A8 44 00 06 48 02 60 Rev 01: 0x05 B0 24 10 86 00 05 B8 82 E8 44 00 06 2C 86 A8 44 00 06 38 03 0C 0x1841b/0x1840f - another change in this chunk of data Rev 00: 0x40 Rev 01: 0x50 0x184b7/0x184ab: R00: 0x60 R01: 0x40 0x184f3/0x184e7: R00: 0x60 R01: 0x40 0x186a3/0x18697: R00: 0xC0 87 D0 C8 AC 16 E0 03 00 74 33 R01: 0xE0 03 00 74 33 16 E0 87 D0 C8 AC 0x187e7/0x187db: R00: 0x70 03 90 84 00 21 A5 04 44 85 81 21 B0 81 70 C8 AC 22 80 02 C0 03 D0 22 F8 02 F0 03 52 23 18 03 6C 86 00 23 50 02 8C D6 00 23 5C R01: 0x20 81 70 C8 AC 21 70 03 90 84 00 21 A5 04 44 85 81 22 80 02 C0 03 D0 22 F8 02 F0 03 52 23 48 03 70 86 00 23 50 02 8C D6 00 23 90 ==================== The last one. Yay. Object placement changes: The format is X (2 bytes), Y (2 bytes), object (2 bytes) EHZ2 ----- Rev00: $1A08, $0380, $030A Rev01: $19F8, $0328, $030A The $030a object is a collision switch. I have no idea why Sega changed it though. As Gunner112k said: "The first thing I tried to do in this ROM is to go to EHZ Act 2 and go to that fucking secret wall that has been haunting my life forever. IT WORKED. (I never told people about that, but in the rev 01 ROM you could never get through that secret wall, and I originally owned 2 Sonic 2 carts, one that you could get through and one that you couldn't. So that means I had this rev 00 for so long.)" WFZ1 ----- Rev00: $0A79, $0368, $7901 Rev01: $0A79, $8368, $7901 Rev00: $17F1, $062C, $7902 Rev01: $17F1, $862C, $7902 Rev00: $282E, $0428, $7903 Rev01: $282E, $8428, $7903 They're lampposts. I don't know why the changed the Y coords, though. CNZ1 ----- Rev00: $2840, $0688, $0D00 Rev01: $2840, $0684, $0D00 The sign post in CNZ1 was moved a bit too far down. CNZ2 ----- Rev00: $2740, $0668, $0D00 Rev01: $2740, $0664, $0D00 ==================== Back | Printer friendly 2. Sonic 2 Rev 00 disassembly (by drx) >> |