http://forums.sonic-cult.org/index.php?showtopic=5195&st=40#


Ok, here's the deal. I haven't hacked out the copy protection (yet). What I've done is gotten around it. You see, the protection only interferes in two places: When you try and start a game, and when trying to load the next level. Well, the solution is to take over an already running game (the demo), and then change the level manually.

Do the following:
1. Load up the final SegaSonic arcade rom in mame (sonic.zip).
2. Wait until the game reaches a demo, and when it does, make a savestate by pressing shift+F7, then any number or letter on the keyboard (the slot you want to save in).
3. Open up the savestate in whatever hex editor you have. If you don't have one, get one. The savestate will be in the "sta" folder of your mame directory, and will have the name "sonic-.sta", where is the character you pressed after shift+F7.
4. Change the byte at 0x10FC34 in the savestate from 0x00 to 0xFF.
5. Change the two bytes at 0x10FC6E from whatever they are to 0x0000.
6. Change the byte at location 0x10FC98 to the level number of the stage you want to go to (list below).
7. Load the savestate back in by pressing F7, followed by the character you pressed to make the savestate.
8. Press 5 to insert a coin, and 1 to start a game.

After some slightly unpredictable screwups, the level you want should load. Pressing the action button usually makes the screwed up level you'll see to start with disappear, and the level reload. Here are the level numbers:


CODE  
0x03: Trap tower (4)
0x04: Landslide limbo (5)
0x05: Starting area (0)
0x06: Game intro
0x07: Control tutorial
0x08: Volcanic Vault (1)
0x09: Icy Isle (2)
0x0A: Desert Dodge (3)
0x0B: Robotnic (7)
0x0C: Eggman's Tower - 1 (7)
0x0D: Eggman's Tower - 2 (7)
0x0E: Eggman's Tower - 3 (7)
0x0F: Eggman's Tower - 4 (7)
0x10: Wild Waterways (6)

Any level numbers outside of this crash the game. The numbers in parenthesis after some of those levels indicate the order in which those levels occur in the final game.

The final level, Eggman's Tower, is actually divided up into five parts. The first part starts inside, after having entered the building at the end of the previous level, wild waterways. This first inside area leads to an outside area that runs aruond the building on some railings, then back inside to the next level of the tower. The next level of the tower is very similar to the first, and consists of an inside area followed by an outside area on some railings. This then leads into the top of the tower, and the faceoff with Robotnic. Put simply, level numbers 0x0C, 0x0D, 0x0E, 0x0F, and 0x0B are, in that order, all parts of the same level.

Now it appears that all the levels that exist in the final are present in the beta. While several of the levels are just totally blank, and the camera just scrolls through them with no objects, the level maps themselves are all complete. In the beta, level 0x10 (wild waterways) is not normally accessable through the level select, as it only goes up to 0x0F, but if you change the value at 0x10FC98 to 0x10 while level select is active, you can select and see this level in the beta.


On the technical side, there are three primary values I have identified that are of interest. They are as follows:

0x10FC31: Core engine state (byte)
0x10FC8B: Game engine state (byte)
0x10FC98: Level (short/le)

The level is straightforward, and all those values have already been posted. The core engine state value is a value that the engine keeps to allow it to keep track of what it is suppost to be doing. It has a few simple modes, which are as follows:

Core engine state:
0x00: Warning
0x01: Test menu
0x02: Ranking mode
0x03: SEGA screen
0x04: Demo 1
0x05: Demo 2
0x06: Game
0x07: Unknown

Also attached to this state value is the preceeding byte at 0x10FC30. This byte lets the engine know if it has been in the same state for a cycle already, and hence, if all the data for what it is suppost to be executing has already been initialised. If this is set to 0x00, the game engine will start executing the function it is set to do from the start. You should always set this byte to 0x00 if you change the engine state value yourself.

The game engine state vaue is just another value that the game engine keeps that lets the game know what it is doing, however this value is only used when the core engine state value is set to 0x06, which is the mode it is set to while a player controlled game is running. This value has a lot of settings, and a lot of them are hard to figure out. Here are the ones I know the function of so far:

Game engine state:
0x03: Normal level
0x04: Level map
0x08: Stage select mode
0x09: Ground check mode (beta only)
0x0E: Game over
0x10: Unknown (shows lightning from intro)
0x17: Level complete
0x1B: Character select
0x1C: Unknown (Camera autoscrolls)
0x1D: Level results screen
0x1E: Unknown (level fades and restarts)
0x1F: Fade out to "You Failed"
0x20: "You Failed"
0x49: Unknown (drops back to warning)
0x4E: Unknown (Interesting lockup)

The ground check mode is a mode that only exists in the beta it would seem. When in ground check mode, the character disappears, and the screen scrools over the level. There are many other ways to achieve this, but in ground check mode, pressing the player 2 action button a few times gets you past obstacles where the game is waiting for an event that is never going to happen like that, like for the character to walk somewhere. This allows you to get right to the end of any level. Pressing the player 1 start button quits this mode.

There's another tidbit in the test menu too. In the final, there's a lost menu option in the space just above the "exit" option. It's something to do with moving the seat or some other crap. To access this menu, make a savestate in the test menu and change the byte at 0x10D648 to 0x09, and the lost menu will be selected.

Here are a few other miscellaneous values I've locked down too:

0x109164 - 0x109166: Rings player 1 has (short/le)
0x10F282: Time remaining for boss
0x10FC34: Character control status (set to 0xFF for full control)
0x10FC6E - 0x10FC70: Time remaining in demo. Set to 0x0000 for infinate. (short/le)
0x10FD04 - 0x10FD08: Pointer to level sprites (long/le)
0x10FCA4 - 0x10FCA8: Pointer to level collision boundaries (long/le)
0x10FE09: Level transparency


In addition to all this, the final at least has quite a bit more to unlock. There is apparently a "Fence Set Mode", and a "Scroll skip mode", as well as some kind of general debug feedback to be enabled, and who knows what there is in terms of lost tiles and objects and whatnot.


Anyway, here's some techie info on the rom files in the final game, for anyone who might find it useful. I'll be going back to the roms shortly and taking a much more thorough look, so I'll probably add to this quite a bit.