Speedy Gonzales: Cheese Cat-astrophe (Genesis)

Speedy Gonzales: Cheese Cat-astrophe
Developer: Cryo Interactive Publisher: Sega Platform: Genesis Released in EU: February 1, 1995 This game has unused code. This game has hidden developer credits. This game has debugging material. This game has a hidden level select.

A Europe-only game starring the fastest mouse in all of Mexico.

Developer Credits

An unreferenced string containing developer credits can be found at 0x1A8A8:

*** A GAME BY JEAN-MARC & OLIVIER LEBOURG *** 

Level Select

This needs some investigation. Discuss ideas and findings on the talk page. Specifically: Check if there's another way to activate this.

There is a hidden level select that is prevented from being loaded by a condition at 0x186fa. Function 0x1c77a returns the next sequence to load, which is then converted to another value stored in register D1. The condition overwrites D1 if it has value 0, which loads the level select. We can replace the assigned value in that condition to be 0 with patch 0x18702 = 00 00 (Game Genie code ACDT-CAAC) to load the level select when starting the game.

This screen contains a build date along with the French phrase "Trichons un peu" (lit. "Let's cheat a little"). Use Up / Down to change the level / sequence and A to select the entry. Some entries only have code to reload the menu. One example can be seen at 0x00daf0.

Menu text starts at 0x18D8E:

SPEEDY  V]0270295
TRICHONS UN PEU
SELECT PHASE OR SEQ]
MENU                          
1A1] SAND DESERT 1            
1A2] SAND DESERT 2            
1B1] DRY LANDS 1              
1B2] DRY LANDS 2              
q1C1] ROCKY MOUNTAINS 1        
1C2] ROCKY MOUNTAINS 2        
2A1] LAKE OF PIRANHAS 1       
;2C1] LAKE OF PIRANHAS 2       
92B1] WEEK END IN HAWAI 1      
52B2] WEEK END IN HAWAI 2      
73A1] SCAFFOLDINGS 1           
:3A2] SCAFFOLDINGS 2           
=3B]  RIVER OF PAINT           
?3C1] MANY FACES OF SYL 1      
@3C2] MANY FACES OF SYL 2      
A4A1] ELECTRIC WIRES 1         
B4A2] ELECTRIC WIRES 2         
G4B1] SYLVESTER FACTORY 1      
C4B2] SYLVESTER FACTORY 2      
D4C1] WALL OF BRICKS 1         
E4C2] WALL OF BRICKS 2         
FBOSS 1                        
BOSS 2                        
MBOSS 3                        
HBOSS 4                        
IBOSS 5                        
LBACK TO INTRODUCTION          
SHOW 1ST INTER LEVEL SEQ      
ORIVER OF CHEESE               
JGOTO ENDING SEQ               
KOVER OVER OVER OVER OVER      

(Source: Original TCRF research)

Error Handler

The level select is also loaded on some error conditions, including a description of the error. Text for descriptions can be found at 0x0191cc:

OBJ TO RESTORE OVERFLOW
CHK_SUM ERROR

Only the first error happens to be checked by the game at 0xec6c. With a debugger, we can set a breakpoint at that address, then when the breakpoint is hit, set the program counter to 0xec74 to enter the error subroutine.

Apparently there's no checksum validation anymore, since the corresponding description is unreferenced, and the game loads as normal if the ROM is patched.

Ironically, the subroutine that loads the error description has a programming error: it uses an movea.w instruction at 0x01927c to load the address stored at 0xffe63e, which points to the description at 0x000191cc. Since only 2 bytes are actually loaded by that instruction, the subroutine attempts to load text at address 0x0001, which happens to contain the terminator character 0xff, therefore no description is displayed.

With a debugger, we can set a breakpoint at 0x019280, then set A1 = 000191cc to load the correct description address.

(Source: Original TCRF research)

Redundant Password

Address 0xffffe3 stores the world to load returned by the password validation function 0x0a11c6.

Besides the 3 known passwords, there's another one stored in the table at 0x0a1230, corresponding to a sequence of 6 chillis. This password sets 0xffffe3 = 0x01, which happens to be different from the wrong / no password, which sets 0xffffe3 = 0x00. However, due to the conditional logic described in the level select section, either case ends up loading world 1.

(Source: Original TCRF research)