Super Punch-Out!! (SNES)

Super Punch-Out!!
Developers: Nintendo IRD, Locomotive Publisher: Nintendo Platform: SNES Released in JP: March 1, 1998 (Nintendo Power) Released in US: October 1994 Released in EU: January 26, 1995 This game has unused modes / minigames. This game has debugging material. This game has a hidden sound test. This game has a hidden level select. This game has regional differences. This game has anti-piracy features. This game has a prerelease article This game has a notes page

Super Punch-Out!! is the fourth game in Nintendo's legendary Punch-Out!! line.

Sub-Pages

Prerelease Info

Notes

Free Match Mode An alternate way to fight and train against any of 16 opponents! Also featured: a two-player mode?!

Debug Functions

Game Genie code DF6D‑DD6D enables a handful of debugging functions.

• Two arrows, one red and one white, will appear on the left side of the screen during a match. This may be a CPU usage meter.
• Press and hold Select on controller 2 at any time to freeze the game. Release to unfreeze.
• During a match, pause to open the Retire menu, then press L on controller 1 to advance frames.
• During a match, pause to open the Retire menu, then hold L+R and press Select on controller 1 to instantly win the match.
• In free match mode, at the opponent profile screen, press A or Start to go to the match, then quickly hold A until the match begins. If done right, the player's graphics can be cycled through by pressing A/B (the number of the current graphic will be displayed in place of the score). Press Select to toggle between left/right handedness, Start to toggle transparency, and L+R to reset the game.
• In free match mode, at the opponent profile screen, press A or Start to go to the match, then quickly hold B until the match begins. If done right, the opponent's graphics can be cycled through by pressing A/B (the number of the current graphic will be displayed in place of the score). Press Select to toggle between left/right handedness, and L+R to reset the game.

(Source: cah4e3)

Sound Test

Hold L+R on the second controller at the opening Nintendo logo for the game's sound test.

(Source: GameFAQs)

Prototype Fragments

To do: This needs A LOT more research...

A number of free space areas in the ROM contain copies of bank $00 from a prototype version. Some of these ROM offsets and differences are documented below. See the Notes page for more info.

04E94E-04FFFF

This includes a copy of $007FC0-007FFF which is the cartridge header. The entire first half (which is not required for cartridge operation) is blank.

Proto:

00FFC0 0000 0000 0000 0000 0000 0000 0000 0000 ................
00FFD0 0000 0000 0000 0000 0000 0000 0000 0000 ................
00FFE0 0000 0000 2886 0080 0480 3D9F 0000 F49C ....(.....=.....
00FFF0 0000 0000 2886 0000 0480 0480 0580 F49C ....(...........

Final (US):

007FC0 5375 7065 7220 5075 6E63 682D 4F75 7421 Super Punch-Out!
007FD0 2120 2020 2020 020B 0301 3300 6F01 90FE !     ....3.o...
007FE0 0000 0000 C488 0080 0480 99A2 0000 6DA0 ..............m.
007FF0 0000 0000 C488 0000 0480 0480 0580 6DA0 ..............m.

For reference, here's a summary of the data for the first half of the above retail version header:

7FC0-7FD4 ASCII game title (21 bytes)
7FD5      0x20 = mode $20, no FastROM
7FD6      0x02 = cart type is ROM + battery-backed RAM
7FD7      0x0B = 16 megabit cart size
7FD8      0x03 = 64Kbit SRAM
7FD9      0x01 = country code (North America)
7FDA      0x33 = manufacturer code
7FDB      0x00 = first version
7FDC-7FDD checksum complement
7FDE-7FDF checksum

09446D-095ABF

Much of this fragment is contained in the $099CDB-09D95F fragment; it's easier to just investigate that one instead. The last $0160 bytes, which are exclusive to this fragment, matches up to $0066B7-006816. However, there's no differences except for address shifts.

099CDB-09D95F

The largest fragment found so far, this matches up to approx. $002054-0066B6. Two differences have been found so far:

• The ending was not yet added. When the Special Circuit is completed the game simply enters an infinite loop (using a BRA $FE operation).
• The anti-piracy test run after completing the World Circuit (which is responsible for unlocking the Special Circuit) runs a checksum on the entire 32,768 bytes of the first ROM bank, instead of skipping the first 4 bytes as seen in the final game. It's not clear why this change was made. Currently, only one of the first 4 bytes has a known purpose (the checksum generator). The other bytes are still unsolved.

Checksum Generator

If offset $000002 (SNES address $008002) is changed from $FF to $00, the game calls a subroutine on boot up to create checksums used for the Minor Circuit and World Circuit anti-piracy tests, as well as a complete checksum of the entire ROM used for the cartridge header. It attempts to write the calculated values to ROM region, possible on development hardware, but not on a retail cartridge.

Anti-Piracy

The game contains a much more thorough set of anti-piracy tests than those seen in earlier SNES titles. If the game detects that an anti-piracy check was failed, it will display the above messages that changes sequentially on each boot until the third message is reached or the game has booted successfully. In addition, what appears to be various error codes will be written to $70000F. The stack test and RAM tests aren't fully implemented and failing them doesn't do anything besides write the error code. They may have been abandoned because of the (rare) possibility of a false positive due to the console's RAM being mostly random on power up.

Boot State Tests

Emulation Flag

If the console was already in Native Mode, the test fails as this is evidence another program (e.g., a menu belonging to a backup unit aka cartridge copier) was running before the game had a chance to boot. The string System Error !! is written to $7E07F0 in RAM, and Copy Machine !? to the beginning of SRAM (battery-backed memory used to hold the save game data). The 8-bit accumulator is written to $70000F.

Direct Page

If the Direct Page register is non-zero, the test fails. All of the above Emulation Flag info also applies, except that the lower 8 bits of the Direct Page register is written to $70000F.

Stack Test

If the Reset Vector was at the top of the stack, the test fails. Explained in more detail in the next section. Error code: $12

RAM Tests

The beginning of RAM (range $7E0000-7E1FFF) is searched for two types of fingerprints left behind by the unauthorized devices. The two jump tests, along with the stack test mentioned in the previous section, are looking for the various methods that attached hardware can use to switch from its programming to that of the game cartridge.

Jump $4C

Checks for operation $4C????, where ???? is the Reset Vector. Error code: $11

Indirect Jump $6C

Checks for operation $6CFCFF, an indirect jump. Error code: $10

Cartridge Header Test

The test fails if any one of nine 16-bit values in the cartridge header were modified. Error code: $13

Native Mode
FFE4 COP
FFE8 ABORT
FFEA NMI

FFEE IRQ

Emulation Mode
FFF4 COP
FFF8 ABORT
FFFA NMI
FFFC RESET
FFFE IRQ

Circuit Tests

These tests are run after completing a circuit.

Minor Circuit

A checksum is run on 50 bytes worth of initialization code and data starting at offset $000004 which include the Emulation Flag and Direct Page tests. If the checksum generated doesn't match the hardcoded value, the test fails.

Major Circuit

During the boot process, successfully passing the various boot up tests described earlier will write individual bytes to RAM range 7E7B00-7E7B05 forming the string SPO001 in memory. The test fails if the string isn't an exact match as it means some/all of the boot up tests were bypassed.

World Circuit

A checksum is run on offset $000004-007FFF, which is all but the first 4 bytes of the very first ROM bank. This bank contains a lot of the game engine including the programming for all of the above tests. If the checksum generated doesn't match the hardcoded values, the Special Circuit will not be unlocked. If it was already unlocked, it will be locked again.

Notes

• Many game enhancer cheats, including Galoob's official Game Genie codes published in the 1990s like "Always have K.O. punch after first hit" will cause the checksum to fail. To avoid this, turn any cheats off before pressing Start to proceed from the scoring screen to the next screen.
• Using emulator save states, including suspend states in Nintendo's own Super NES Classic and on the SNES Nintendo Switch Online service, will cause the Special Circuit to not be unlocked.

Regional Differences

In the international versions, the ability to enter your name in Japanese is hidden with a button code. Highlight "New Game" and use any one of these three combinations: X + A, Start + X + A or Start + X. The Japanese version enables it by default, and updated the name entry screen to clearly indicate that L or R changes the character set.

International versions	Japanese version