Dynamite Dux: Easter Egg

Yes following the LayOut launch, I'm on a roll today. I'm not a big fan of Dynamite Dux, it's one of the weaker AM2 titles from the late 80s. However, knowing it was coded by Satoshi Mifune (aka Bin Chan), I knew there might be some goodies locked away waiting to be found.

This is one of the best AM2 extras I've found. It's an oldskool demo sequence with caricatures of the team.

To activate the sequence, you need to complete the game. On the Congratulations screen, hold player 2 start and press Player 1 start exactly 15 times.

I've uploaded a video of the complete sequence to youtube here.

Sprite Outtakes

You might think that after years of pulling OutRun apart I would have exhausted the hidden extras. Not quite yet! Here are a few unused sprites that are in the game.

Firstly, here's a motorbike that didn't make the final cut. The above is a mock-up to show what it would look like in-game. There is a preliminary data structure to hook the bike up in the game code, and that data structure is similar to the existing traffic entries so we can assume this was an early attempt to include other forms of traffic. However, the final higher level data structure is missing, which would include the palette information. So I've just used a random palette here.

Here's an extra frame from the end sequence with the genie. I guess there was originally concern that it wouldn't be clear who the genie was, so the extra frame on the left was made.

Finally here's another end sequence idea that was dropped. The existing sequence sees the guy kissed by the girl awarding the trophy, before flexing his muscles. It looks like the original plan was to also have him fall over. You can see the extra frames below:

You can use my quick and dirty sprite viewer to browse sprite data in other Sega titles. 

Space Harrier Easter Egg (Dev Credits)

Whilst you're patiently waiting for me to finish force feedback support in Cannonball (it's going well), here's a Space Harrier Easter Egg for you to try.

It's similar to the OutRun egg, in that it provides a Yu Suzuki development credit, along with the development date. Interestingly November 1985 was around the date the AM2 team started OutRun, which probably explains why the team used the Space Harrier code as a framework to work from.

Like most AM2 titles, the egg is somewhat tricky to activate. You need to enter the code during the death / respawn sequence; therefore after the character collides and flips upwards or is flashing.

The code is:

• Press button 3 (typically mapped to space on MAME) six times. 
• Press the start button eight times. 
• Then finally, press button 3 again. You should see the message.

You can enter the code over multiple iterations of this death sequence. So you can start after the first time you die, and complete it the second time you die. However, any error in input resets the code, so go carefully.

Unused Prototype Coconut Beach Track

Whilst working on the track select for time trial mode, I uncovered an unused OutRun track layout.

It appears to be an early prototype of Coconut Beach; and is found in all versions of the game. It is significantly different from both the Japanese and World versions of this level. It's tougher, with sharper bends although the final chicane is missing.  You'll notice there are a few scenery changes, as well as small amounts of ground debris. There are also scenery errors with directional signs pointing the wrong way.

Here is a video I recorded in MAME:

The level can be enabled only by using the MAME debugger. You will need to set the following breakpoint on the master CPU (Revision B romset):

focus 0
bpset e4ea,1,{b@260010 = 3A; g}

This breakpoint will swap out the final Coconut Beach track for the prototype.

UPDATE: This track is now playable in Cannonball.

Space Harrier Wiwi Jumbo Music Data In OutRun?

Whilst creating Cannonball, I uncovered a large section of unused YM2151 music data in the Z80 program code. Initially, I was excited - could this be an unreleased Hiroshi Kawaguchi classic? 

Unfortunately, after hacking the code to play the data it sounded like garbage. I wasn't sure if this was a problem with MAME's emulation, so I asked Alex of the OutRun bootloader project to play the sound on hardware. He sent me the results, which you can download here as an MP3. 

It still sounded wrong, so at this stage I stopped investigating. It wasn't until later that night when I randomly happened to be playing the Space Harrier soundtrack on vinyl, that I came across the following composition:

I wonder if this is the Space Harrier Wiki Jumbo track embedded, but playing incorrectly due to other modifications to the sound code? It's a shame, because otherwise we could have hacked OutRun to have an additional tune. Perhaps it's still possible with some additional work...

This maybe isn't a big surprise, we've already uncovered other segments of Space Harrier in the OutRun code.  

Cannonball news - I'm implementing a nice front-end menu, with lots of cool configuration options. Expect a new version after Christmas. 

Power Drift Easter Egg

Ding Ding Round Two! This time, we're pulling Power Drift apart. A crazy game, with some amusing secret messages, that I don't think have ever been revealed.... After 20 years, it's surely time to see what the developers were smoking.

As I realised during my OutRun work, AM2's titles contain weird and wonderful content. Power Drift it no exception, and I soon found text about elephants and various smells by examining the memory in MAME.

Then it was a case of tracing through tons of code to figure out how it was used. To complicate matters, there was a nasty red herring. If you enter SEX on the high-score table, you will see the message DANGER DANGER!

I thought I'd solved the puzzle, as searching for the string 'SEX' in memory revealed the following location:

You'll notice that the first three characters spell SEX, followed by various other letters. I recognised some of these initials as belonging to the AM2 development team, so I presumed entering the other names would invoke the other messages. Unfortunately, this wasn't quite correct. The fragment of code I'd uncovered that used the above table didn't seem to be called when I entered a name. 

Instead, I found a manual check against 'SEX' hard coded elsewhere. Here is some of my commented disassembly: 

What was going on? By examining the code, I realised that if you held BRAKE and pressed START when entering a special name, a separate function would execute. Bingo, this was the section that read the larger initial table. And now, we can display messages regarding elephants written in somewhat dubious English:

Not only that, but for each special name entered, you generally receive a different message dependent on which gear you are in. Here are some others, that amused me:

Well, finding other messages becomes easier when you've decompiled the code. A summary of the messages follows :)

When Brake & Start Button Depressed:

SEX: DANGER !! DANGER !!

When Brake & Start Button Pressed (Select one of two messages with gear):

SEX:  LAKE YOU ? ME TOO ! & MACHINE T.K.G.!!

KEY: I LOVE MAKIKO. & I LOVE CYNDI.

TKG:  I LOVE RAY CHAN. & I LOVE RIE CHAN.

GAK: SAKICHI !! KITARO !! & I LOVE CHISAKI !

OKA: I AM TALLER THAN T.K.G. ! & KIM SAN ISSHOU TUITE IKIMASU.

REE: HALLO !! LETS FIND ANOTHER MESSAGES. & ARE YOU M2C2 MENBER?

NAK: NIGASITA SAKANA WA DECOI.

AKI: LUCY IS MINE! & EMILY IS MINE!

MAT: DO YOU KNOW ELEPHANT SMELL??

SAD: I LOVE KAYURI CHINA & NS400 IS FARSTEST BIKE IN THE WORLD.

HIR: MUSIC DESIGN BY HIRO. & SOUND DESIGN BY MY DESHI.

Afterburner Easter Egg (Dev Credits)

Today I decompiled a portion of Afterburner II's code to investigate some unused developer text I found in the ROM.

I traced the usage of these strings back through the code, with some manual IDA work. In the end I landed on the following function which enables the related block of code:

This revealed that the text could be triggered on the Continue Play screen, providing the player hadn't already inserted a coin.  On this screen you must press the cannon button (fire 1) four times, the missile button (fire 2) twice, followed by the cannon button again. 

On inserting a coin and resuming the game, a (c) SEGA 1987 message will now be shown:

Message 1: (c) SEGA 1987

But what of the other text strings? Unfortunately, it appears that you can only display them using the Mame debugger. The routine to display them is present in the code, but the counter to select the message (which should increment each time you do the cheat), is broken as it resets when the Continue Play screen initializes. I think the original intention was to cycle the message each time the player entered the cheat code, but for whatever reason that never happened. 

You can manually set the counter (0x3F9126) to override this behaviour. Let's take a look: 

Message 2: Presented By Sega

Message 3: I Love Momoko

Message 4: Programmer Credits

What's interesting is Satoshi Mifune's name appears in the credits here, who later programmed titles including Shenmue and Virtual Striker. It's very difficult to find out the dev team members of these early AM2 titles, so great to have this proven. I wonder who Momoko was... 

I also investigated Afterburner I. It contains a similar routine, but is tougher to activate. This is because after pressing fire1 x4 and fire2 x2, you must almost simultaneously coin-up and start.

OutRun Unused Lap Time Code

There is a fair amount of unused code compiled into the OutRun ROMs. Much of it consists of redundant helper functions, that serve no interesting purpose.

I came across an unused routine today that's slightly more interesting. Firstly, OutRun stores the 'lap-time' of each stage you've completed - even though this information isn't really made use of (other than showing your previous lap-time on passing the checkpoint).

Either for debug purposes or as an unfinished feature the programmers included a routine to sequentially print these times during gameplay below the HUD.

Entering the following command in the mame debugger will print the lap-time for a particular stage you've already completed in a race.

d0 = x; pc = 7fea; g; [where x is the stage time to print]

Here's an example screen grab:

Here, I'm on Stage 3 and I've printed the lap-times for the previous two stages using the unused code routine. The lack of apostrophes in the additional lap print outs indicate that this idea was probably pulled at an early stage.

Code decompilation is progressing nicely. I'm on track to finish this year.

OutRun Easter Egg - The Definite Guide!

For a while it's been known that on some versions of OutRun holding the start button, just before a checkpoint, will reveal a secret message: "PROGRAM YU SUZUKI 1986 SEP".

However, it's also been known that this easter egg does not work on all versions of the game.

Well, that's until now. I've decompiled the code related to this and will list the differences below, including how to enable this easter egg on later revisions of the game.

Sitdown/Upright Revision A: This version works as stated. Just before any checkpoint, hold start (just before the sky is due to cycle to the upcoming level colour) to reveal the message. Easy.

Sitdown/Upright Revision B: Activating the egg on this version is more complex. First you will will need to achieve a high score, and enter "YU." as your name, complete with trailing full-stop.

Furthermore, the easter egg can only be activated when transitioning from Stage 2 to Stage 3 on this version of the game. Yes, they've actually included extra code to handle this.

It should also be noted that the egg can only be displayed once and is then deactivated. Also, if the user enters "YU." again on the high score table, the egg will also be deactivated. I'm not certain why this required such a rewrite - it's not as if it allows the user to cheat in the game.

The easter egg code is buried in the middle of a routine to handle setting up the sky palette fade from one level to the next. Which possibly indicates that the programmer wanted to keep the code hidden from more common routines that were shared with the team. I wonder who wrote this piece of code, and why it was heavily altered between revisions?

Aside from that I've completely disassembled the entire service test code - which enabled me to figure out a bunch of minor book keeeping information. I've also disassembled the palette changing code that handles the road, ground and sky when transitioning between levels. I've even disassembled some rather dull code relating to the coin chutes. Next - there's a load of tilemap code to be looked at. The quest continues!

Hidden Voices

If you try OutRun's Sound Test, you'll notice there are four voices you can apparently play. These are the speech samples Get Ready, Congratulations and Check Point. The forth sample, "Voice 4", doesn't work. If, like me, you've lost sleep over such a monumental issue - read on!

The elusive fourth voice is, in fact, still in the ROM files, namely those containing the PCM sample data. You can import these ROMs straight into a sound editor like Audacity and play them. I imported the raw files as PCM 8-bit unsigned, with a sample rate of 8000Hz. Note that the sample rate of the individual samples does differ though.

The 192K of sample data is stored across the following files:

opr10188.71
opr10189.70
opr10190.69
opr10191.68 - This file contains Voice 4
opr10192.67
opr10193.66

These PCM files contain all samples from the drums used in the music, through to the sound effects and speech.

You can hear an mp3 I exported of the voice here. The voice is "You're Doing Great", and seems to be stored at around 4000Hz, which is a lower sample rate than the other voices, which are at 8000Hz. I imagine the sample was removed because the designers couldn't figure out a good way of invoking it.  There is already a voice at the checkpoint stage, which is the main way of determining your progress. Using the voice mid-level, based on your current position and time, could have created bugs or just not proved that compelling.

I should admit that I haven't debugged the sound code much, so a lot of this is based on pretty rough experimentation. I haven't delved into the code to see if it's easy to hook this sound up somewhere with brief debugging. There are certainly no high-level calls from the 68000 code, as I've listed every sound that can be played (and there are more than just those in the sound test). Looking at the Z80 code might yield more information. But I don't envisage having to port this directly, as I am planning with the 68000 code.

Update: Thanks to the JAMMA+ forum I've been informed this hidden voice is apparently used in Space Harrier. So maybe the OutRun developers started by using some of the Space Harrier code as a framework. Certainly some of the error messages are the same as shown in previous blog posts.

Look Both Ways!

One interesting aspect of disassembling games you're fond of, is that you might uncover hidden code that was unused in the final build. This can give an insight into some of the features that were planned that didn't make the final cut, either because of time, technical problems or maybe they simply didn't prove fun during playtesting.

Lately I've been disassembling the traffic handling code, and in doing so I stumbled upon an interesting memory address that controlled a block of code related to spawning traffic. I was unable to figure out exactly what it did from the code and couldn't find any references where the address was written to. So I fired up the MAME debugger and wrote to the memory address manually so that the block of code would always execute.

In Outrun, all traffic drives into the horizon before disappearing. To my surprise, setting this flag caused the traffic to drive away from the horizon in the opposite direction towards the player's Ferrari. I imagine that the original idea was to have two-way traffic. The fact that Outrun's hardware supports two separate road layers means that the final effect could have been quite impressive with independent flows of traffic on each road!

As it is, the code is clearly unfinished, and no graphics exist for traffic travelling in the opposite direction. But it demonstrates what the development team originally planned. It certainly would have been impressive back in 1986 if they'd pulled it off. 

You can see for yourself in the MAME debugger by changing the address with: b@60b6b = 1 once the game has booted.

Outrun Decompilation Oddities

The decompilation is moving along reasonably nicely. I've slowly picking up a decent understanding of the game code.

One interesting thing with the decompilation is that it uncovers code routines and text that don't appear to be in the final game.

For example, check the strings in the following screenshot:

BIN CHAN E
COLOR BANK GA TARINA NOYO !
1 STAGE 127 KO INAINI SHITENE

If you set the program counter to 0x7644 (by typing pc=0x7644) in the mame debugger, and resume execution you will see for yourself.

The text can be translated roughly as follows:

To BIN CHAN
Color bank is lacking.
Make it less than 127 for one stage. 

Bin Chan (aka Satoshi Mifune) is a developer who worked on OutRun, Space Harrier and Afterburner. He is listed as BIN in the hi-score table.

It's suggested that this is some kind of protection. "Sega use the MCU to copy tilebank values on most of the system16 games, maybe they use it to copy a colour bank value on space harrier too, but it's not obvious until you get to that stage".