Speedy Gonzales: Cheese Cat-astrophe (Genesis)
|Speedy Gonzales: Cheese Cat-astrophe|
A Europe-only game starring the fastest mouse in all of Mexico.
An unreferenced string containing developer credits can be found at 0x1A8A8:
*** A GAME BY JEAN-MARC & OLIVIER LEBOURG ***
|This needs some investigation.|
Discuss ideas and findings on the talk page.
Specifically: Check if there's another way to activate this.
There is a hidden level select that is prevented from being loaded by a condition at 0x186fa. Function 0x1c77a returns the next sequence to load, which is then converted to another value stored in register D1. The condition overwrites D1 if it has value 0, which loads the level select. We can replace the assigned value in that condition to be 0 with patch
0x18702 = 00 00 (Game Genie code ACDT-CAAC) to load the level select when starting the game.
This screen contains a build date along with the phrase "Trichons un peu" (lit. "Let's cheat a little"). Use Up / Down to change the level / sequence and A to select the entry. Some entries only have code to reload the menu. One example can be seen at 0x00daf0.
Menu text starts at 0x18D8E:
SPEEDY V]0270295 TRICHONS UN PEU SELECT PHASE OR SEQ] MENU 1A1] SAND DESERT 1 1A2] SAND DESERT 2 1B1] DRY LANDS 1 1B2] DRY LANDS 2 q1C1] ROCKY MOUNTAINS 1 1C2] ROCKY MOUNTAINS 2 2A1] LAKE OF PIRANHAS 1 ;2C1] LAKE OF PIRANHAS 2 92B1] WEEK END IN HAWAI 1 52B2] WEEK END IN HAWAI 2 73A1] SCAFFOLDINGS 1 :3A2] SCAFFOLDINGS 2 =3B] RIVER OF PAINT ?3C1] MANY FACES OF SYL 1 @3C2] MANY FACES OF SYL 2 A4A1] ELECTRIC WIRES 1 B4A2] ELECTRIC WIRES 2 G4B1] SYLVESTER FACTORY 1 C4B2] SYLVESTER FACTORY 2 D4C1] WALL OF BRICKS 1 E4C2] WALL OF BRICKS 2 FBOSS 1 BOSS 2 MBOSS 3 HBOSS 4 IBOSS 5 LBACK TO INTRODUCTION SHOW 1ST INTER LEVEL SEQ ORIVER OF CHEESE JGOTO ENDING SEQ KOVER OVER OVER OVER OVER
The level select is also loaded on some error conditions, including a description of the error. Text for descriptions can be found at 0x0191cc:
OBJ TO RESTORE OVERFLOW CHK_SUM ERROR
Only the first error happens to be checked by the game at 0xec6c. With a debugger, we can set a breakpoint at that address, then when the breakpoint is hit, set the program counter to 0xec74 to enter the error subroutine.
Apparently there's no checksum validation anymore, since the corresponding description is unreferenced, and the game loads as normal if the ROM is patched.
Ironically, the subroutine that loads the error description has a programming error: it uses an
movea.w instruction at 0x01927c to load the address stored at 0xffe63e, which points to the description at 0x000191cc. Since only 2 bytes are actually loaded by that instruction, the subroutine attempts to load text at address 0x0001, which happens to contain the terminator character 0xff, therefore no description is displayed.
With a debugger, we can set a breakpoint at 0x019280, then set
A1 = 000191cc to load the correct description address.
Address 0xffffe3 stores the world to load returned by the password validation function 0x0a11c6.
Besides the 3 known passwords, there's another one stored in the table at 0x0a1230, corresponding to a sequence of 6 chillis. This password sets
0xffffe3 = 0x01, which happens to be different from the wrong / no password, which sets
0xffffe3 = 0x00. However, due to the conditional logic described in the level select section, either case ends up loading world 1.