Notes:Shadowrun (SNES)

Location list
(this list and SNES addresses based on the North American version)

Pro Action Replay code can be used to change the destination (for the first 256 exits only) when using the open Matchbox cheat. For the full 512 exit range, in a debugger set a write breakpoint on, Step Into, and then enter your new value.

0000 0001 outside morgue 0002 0003 morgue, starting a new game 0004 0005 0006 0007 0008 0009 000A 000B 000C 000D 000E 000F 0010 0011 0012 0013 0014 0015 0016 0017 0018 0019 001A 001B 001C 001D 001E 001F morgue lobby 0020 0021 0022 0023 0024 0025 0026 0027 0028 0029 002A 002B 002C 002D 002E 002F 0030 0031 0032 0033 0034 0035 0036 0037 0038 0039 003A 003B 003C 003D 003E 003F 0040 0041 0042 0043 0044 0045 0046 0047 0048 0049 004A 004B 004C 004D 004E 004F 0050 0051 0052 0053 0054 0055 0056 0057 0058 0059 005A 005B 005C 005D 005E 005F 0060 0061 0062 0063 0064 0065 0066 0067 0068 0069 006A 006B 006C 006D 006E 006F 0070 0071 0072 0073 0074 0075 0076 0077 0078 0079 007A 007B 007C 007D 007E 007F 0080 0081 0082 0083 0084 0085 0086 0087 0088 0089 008A 008B 008C 008D 008E 008F 0090 0091 0092 0093 0094 0095 0096 0097 0098 0099 009A 009B 009C 009D 009E 009F 00A0 00A1 00A2 00A3 00A4 00A5 00A6 00A7 00A8 00A9 00AA 00AB 00AC 00AD 00AE 00AF 00B0 00B1 00B2 00B3 00B4 00B5 00B6 00B7 00B8 00B9 00BA 00BB 00BC 00BD 00BE 00BF 00C0 00C1 00C2 00C3 00C4 00C5 00C6 00C7 00C8 00C9 00CA 00CB 00CC 00CD 00CE 00CF 00D0 00D1 00D2 debug room 00D3 00D4 00D5 00D6 00D7 00D8 00D9 00DA 00DB 00DC 00DD 00DE 00DF 00E0 00E1 00E2 00E3 00E4 00E5 00E6 00E7 00E8 00E9 00EA 00EB 00EC 00ED "You have reached the end. Thank you for playing Shadowrun. (C) 1993 DATAEAST. Developed by BEAM Software." 00EE 00EF 00F0 00F1 00F2 00F3 00F4 00F5 00F6 00F7 00F8 00F9 00FA 00FB 00FC 00FD 00FE 00FF

0100 0101 0102 0103 0104 0105 0106 0107 0108 0109 010A 010B 010C 010D 010E 010F 0110 0111 0112 0113 0114 0115 0116 0117 0118 0119 011A 011B 011C 011D 011E 011F 0120 0121 0122 0123 0124 0125 0126 0127 0128 0129 012A 012B 012C 012D 012E 012F 0130 0131 0132 0133 0134 0135 0136 0137 0138 0139 013A 013B 013C 013D 013E 013F 0140 0141 0142 0143 0144 0145 0146 0147 0148 0149 014A 014B 014C 014D 014E 014F 0150 0151 0152 0153 0154 0155 0156 0157 0158 0159 015A 015B 015C 015D 015E 015F 0160 0161 0162 0163 0164 0165 0166 0167 0168 0169 016A 016B 016C 016D 016E 016F 0170 0171 0172 0173 0174 0175 0176 0177 0178 0179 017A 017B 017C Dark Blade weapons shop 017D 017E 017F 0180 0181 0182 0183 0184 0185 0186 0187 0188 0189 018A 018B 018C 018D 018E 018F 0190 0191 0192 0193 0194 0195 0196 0197 0198 0199 019A 019B 019C 019D 019E 019F 01A0 01A1 01A2 01A3 01A4 01A5 01A6 01A7 01A8 01A9 01AA 01AB 01AC 01AD 01AE 01AF 01B0 01B1 01B2 01B3 01B4 01B5 01B6 01B7 01B8 01B9 01BA 01BB 01BC 01BD 01BE 01BF 01C0 01C1 01C2 01C3 01C4 01C5 01C6 01C7 01C8 01C9 01CA 01CB 01CC 01CD 01CE 01CF 01D0 01D1 01D2 01D3 01D4 01D5 01D6 01D7 01D8 01D9 01DA 01DB 01DC 01DD 01DE 01DF 01E0 01E1 01E2 01E3 01E4 01E5 01E6 01E7 01E8 01E9 01EA 01EB 01EC 01ED 01EE 01EF 01F0 01F1 01F2 01F3 01F4 01F5 01F6 01F7 01F8 01F9 01FA 01FB 01FC 01FD 01FE 01FF

Script commands
command, format, description

00    00 xx            push xx

0A    0A xx            push xx + #$FF00

14    14 xxxx          push xxxx

16    16 ??

2C    2C ??

34    34 ??

44    44 jjjj          branch. jjjj = number of bytes to branch from beginning of script

48    48 jjjj          jump. jjjj = number of bytes to jump from beginning of script

56    56               end script

58    58 ii            multi-purpose, see below section. ii is an index for an unknown table starting at 82D895, and it's also * 2 for a jump table starting at 82D604

5E    5E               subtraction

7E    7E

80    80

86    86               increment last item placed on stack

8C    8C               comparison

9C    9C               comparison

AA    AA               check if equal

BA    BA

BC    BC (unk)         display text, may be a variable length command

BE    BE

C0    C0               push #$0000

C2    C2

Script command 58

58    58 4F            used to get x coord in Matchbox script 58    58 50            used to get y coord in Matchbox script

Breakpoints

 * , execute - breaks on each script command (NA version)
 * , execute - breaks on each script command (PAL English version)
 * , execute - breaks on each script command (PAL German version)

Debug room


You must be standing inside the red box to enable the first Matchbox beep.

Matchbox script
The Matchbox script is located at offset (SNES address ) in the North American version.

0E7C40 |                      2C 0000 1858 570A 0E7C50 | FFAA 442F 0014 0002 5813 1400 027E BE44 0E7C60 | 2C00 18E2 2D00 1A58 1258 7F00 D258 5600 0E7C70 | 01BA 589E BC48 3301 0080 5813 0080 AA44 0E7C80 | 3301 00F0 0081 1400 0800 0400 1900 1400 0E7C90 | 0258 C758 7E00 0158 17AA 587E 001F 5817 0E7CA0 | AA80 4433 0158 2858 4F14 6602 5E34 0358 0E7CB0 | 2858 5014 D501 5E34 0500 1858 5700 01AA 0E7CC0 | 1603 C09C 7E16 05C0 9C7E 587E 0001 5817 0E7CD0 | AA7E 0018 5857 0002 AA16 03C0 8C7E 1605 0E7CE0 | C09C 7E58 7E00 0158 17AA 7E80 0018 5857 0E7CF0 | 0003 AA16 03C0 9C7E 1605 C08C 7E58 7E00 0E7D00 | 0158 17AA 7E80 0018 5857 0004 AA16 03C0 0E7D10 | 8C7E 1605 C08C 7E58 7E00 0158 17AA 7E80 0E7D20 | 0018 5857 0005 AA58 7E00 1F58 17AA 7E80 0E7D30 | 442E 0100 1858 5700 03AA 44FE 0000 0100 0E7D40 | FF00 500A FF58 4C00 1858 5700 05AA 4418 0E7D50 | 010A FE00 1858 1200 0100 FF00 660A FF58 0E7D60 | 4C00 0300 FF00 4E0A FF58 4C00 1858 5786 0E7D70 | 0018 5812 4833 01C0 0018 5812 C258 B856

offset, SNES address, commands, description

startup 0E7C49 | 9CFC49 | 2C 00 0E7C4B | 9CFC4B | 00 18        push #$18 0E7C4D | 9CFC4D | 58 57        7E3BBB + 18 = 7E3BD3, copy cheat counter to 7E0000 0E7C4F | 9CFC4F | 0A FF        push #$FFFF 0E7C51 | 9CFC51 | AA           compare cheat counter to #$FFFF 0E7C52 | 9CFC52 | 44 2F 00     branch command 9CFC49 + 002F = 9CFC78 (goto 9CFC78 if cheat not already enabled)

opened Matchbox menu with cheat active 0E7C55 | 9CFC55 | 14 00 02 0E7C58 | 9CFC58 | 58 13

exit Matchbox menu or Examine Matchbox with cheat active 0E7C5A | 9CFC5A | 14 00 02 0E7C5D | 9CFC5D | 7E 0E7C5E | 9CFC5E | BE 0E7C5F | 9CFC5F | 44 2C 00     branch command 9CFC49 + 002C = 9CFC75

Examine Matchbox with cheat active 0E7C62 | 9CFC62 | 18 E2 4D 0E7C65 | 9CFC65 | 00 1A        push #$1A 0E7C67 | 9CFC67 | 58 12 0E7C69 | 9CFC69 | 58 7F 0E7C6B | 9CFC6B | 00 D2        push #$D2 (map D2 = debug room) 0E7C6D | 9CFC6D | 58 56 0E7C6F | 9CFC6F | 00 01        push #$01 0E7C71 | 9CFC71 | BA 0E7C72 | 9CFC72 | 58 9E 0E7C75 | 9CFC75 | 48 33 01     jump 9CFC49 + 0133 = 9CFD7C

opened Matchbox menu without cheat active 0EFC78 | 9CFC78 | 00 80        push #$80 0E7C7A | 9CFC7A | 58 13

exit Matchbox menu or Examine Matchbox without cheat active 0E7C7C | 9CFC7C | 00 80        push #$80 0E7C7E | 9CFC7E | AA           comparison 0E7C7F | 9CFC7F | 44 33 01     branch command 9CFC49 + 0133 = 9CFD7C

Examine Matchbox without cheat active 0E7C82 | 9CFC82 | 00 F0        push #$F0 0E7C84 | 9CFC84 | 00 81        push #$81 0E7C86 | 9CFC86 | 14 00 08 0E7C89 | 9CFC89 | 00 04        push #$04 0E7C8B | 9CFC8B | 00 19        push #$19 0E7C8D | 9CFC8D | 00 14        push #$14 0E7C8F | 9CFC8F | 00 02        push #$02 0E7C91 | 9CFC91 | 58 C7 0E7C93 | 9CFC93 | 58 7E 0E7C95 | 9CFC95 | 00 01        push #$01 (map 01 = outside morgue) 0E7C97 | 9CFC97 | 58 17 0E7C99 | 9CFC99 | AA           comparison 0E7C9A | 9CFC9A | 58 7E 0E7C9C | 9CFC9C | 00 1F        push #$1F (map 1F = morgue lobby) 0E7C9E | 9CFC9E | 58 17 0E7CA0 | 9CFCA0 | AA           comparison 0E7CA1 | 9CFCA1 | 80 0E7CA2 | 9CFCA2 | 44 33 01     branch command 9CFC49 + 0133 = 9CFD7C (goto 9CFD7C if on wrong map)

0E7CA5 | 9CFCA5 | 58 28 0E7CA7 | 9CFCA7 | 58 4F        get x coord 0E7CA9 | 9CFCA9 | 14 66 02     push #$0266 minimum x coord (see screenshot above) 0E7CAC | 9CFCAC | 5E           subtract minimum x coord from player x coord 0E7CAD | 9CFCAD | 34 03 0E7CAF | 9CFCAF | 58 28 0E7CB1 | 9CFCB1 | 58 50        get y coord 0E7CB3 | 9CFCB3 | 14 D5 01     push #$01D5 minimum y coord (see screenshot above) 0E7CB6 | 9CFCB6 | 5E           subtract minimum y coord from player y coord 0E7CB7 | 9CFCB7 | 34 05 0E7CB9 | 9CFCB9 | 00 18        push #$18 0E7CBB | 9CFCBB | 58 57        7E3BBB + 18 = 7E3BD3, copy cheat counter to 7E0000 0E7CBD | 9CFCBD | 00 01        push #01 0E7CBF | 9CFCBF | AA           compare cheat counter to #$01 0E7CC0 | 9CFCC0 | 16 03 0E7CC2 | 9CFCC2 | C0           push #$0000 0E7CC3 | 9CFCC3 | 9C           comparison 0E7CC4 | 9CFCC4 | 7E 0E7CC5 | 9CFCC5 | 16 05 0E7CC7 | 9CFCC7 | C0           push #$0000 0E7CC8 | 9CFCC8 | 9C           comparison 0E7CC9 | 9CFCC9 | 7E 0E7CCA | 9CFCCA | 58 7E 0E7CCC | 9CFCCC | 00 01        push #$01 0E7CCE | 9CFCCE | 58 17 0E7CD0 | 9CFCD0 | AA           comparison 0E7CD1 | 9CFCD1 | 7E 0E7CD2 | 9CFCD2 | 00 18        push #$18 0E7CD4 | 9CFCD4 | 58 57        7E3BBB + 18 = 7E3BD3, copy cheat counter to 7E0000 0E7CD6 | 9CFCD6 | 00 02        push #$02 0E7CD8 | 9CFCD8 | AA           compare cheat counter to #$02 0E7CD9 | 9CFCD9 | 16 03 0E7CDB | 9CFCDB | C0           push #$0000 0E7CDC | 9CFCDC | 8C           comparison 0E7CDD | 9CFCDD | 7E 0E7CDE | 9CFCDE | 16 05 0E7CE0 | 9CFCE0 | C0           push #$0000 0E7CE1 | 9CFCE1 | 9C           comparison 0E7CE2 | 9CFCE2 | 7E 0E7CE3 | 9CFCE2 | 58 7E 0E7CE5 | 9CFCE5 | 00 01        push #$01 0E7CE7 | 9CFCE7 | 58 17 0E7CE9 | 9CFCE9 | AA           comparison 0E7CEA | 9CFCEA | 7E 0E7CEB | 9CFCEB | 80 0E7CEC | 9CFCEC | 00 18        push #$18 0E7CEE | 9CFCEE | 58 57        7E3BBB + 18 = 7E3BD3, copy cheat counter to 7E0000 0E7CF0 | 9CFCF0 | 00 03        push #$03 0E7CF2 | 9CFCF2 | AA           compare cheat counter to #$03 0E7CF3 | 9CFCF3 | 16 03 0E7CF5 | 9CFCF5 | C0           push #$0000 0E7CF6 | 9CFCF6 | 9C           comparison 0E7CF7 | 9CFCF7 | 7E 0E7CF8 | 9CFCF8 | 16 05 0E7CFA | 9CFCFA | C0           push #$0000 0E7CFB | 9CFCFB | 8C           comparison 0E7CFC | 9CFCFC | 7E 0E7CFD | 9CFCFD | 58 7E 0E7CFF | 9CFCFF | 00 01        push #$01 0E7D01 | 9CFD01 | 58 17 0E7D03 | 9CFD03 | AA           comparison 0E7D04 | 9CFD04 | 7E 0E7D05 | 9CFD05 | 80 0E7D06 | 9CFD06 | 00 18        push #$18 0E7D08 | 9CFD08 | 58 57        7E3BBB + 18 = 7E3BD3, copy cheat counter to 7E0000 0E7D0A | 9CFD0A | 00 04        push #$04 0E7D0C | 9CFD0C | AA           compare cheat counter to #$04 0E7D0D | 9CFD0D | 16 03 0E7D0F | 9CFD0F | C0           push #$0000 0E7D10 | 9CFD10 | 8C           comparison 0E7D11 | 9CFD11 | 7E 0E7D12 | 9CFD12 | 16 05 0E7D14 | 9CFD14 | C0           push #$0000 0E7D15 | 9CFD15 | 8C           comparison 0E7D16 | 9CFD16 | 7E 0E7D17 | 9CFD17 | 58 7E 0E7D19 | 9CFD19 | 00 01        push #$01 0E7D1B | 9CFD1B | 58 17 0E7D1D | 9CFD1D | AA           comparison 0E7D1E | 9CFD1E | 7E 0E7D1F | 9CFD1F | 80 0E7D20 | 9CFD20 | 00 18        push #$18 0E7D22 | 9CFD22 | 58 57        7E3BBB + 18 = 7E3BD3, copy cheat counter to 7E0000 0E7D24 | 9CFD24 | 00 05        push #$05 0E7D26 | 9CFD26 | AA           compare cheat counter to #$05 0E7D27 | 9CFD27 | 58 7E 0E7D29 | 9CFD29 | 00 1F        push #$1F (map 1F = morgue lobby) 0E7D2B | 9CFD2B | 58 17 0E7D2D | 9CFD2D | AA           comparison 0E7D2E | 9CFD2E | 7E 0E7D2F | 9CFD2F | 80 0E7D30 | 9CFD30 | 44 2E 01     branch command 9CFC49 + 012E = 9CFD77 (goto 9CFD77 if one of the cheat steps failed)

beeping Matchbox section 0E7D33 | 9CFD33 | 00 18        push #18 0E7D35 | 9CFD35 | 58 57        7E3BBB + 18 = 7E3BD3, copy cheat counter to 7E0000 0E7D37 | 9CFD37 | 00 03        push #$03 0E7D39 | 9CFD39 | AA           compare cheat counter to #$03 0E7D3A | 9CFD3A | 44 FE 00     branch command 9CFC49 + 00FE = 9CFD47 (goto 9CFC47 if cheat counter != #$03)

Matchbox cheat counter == #$03 double beep section 0E7D3D | 9CFD3D | 00 01        push #$01 0E7D3F | 9CFD3F | 00 FF        push #$FF 0E7D41 | 9CFD41 | 00 50        push #$50 (sound index 50) 0E7D43 | 9CFD43 | 0A FF        push #$FFFF 0E7D45 | 9CFD45 | 58 4C

0E7D47 | 9CFD47 | 00 18        push #$18 0E7D49 | 9CFD49 | 58 57        7E3BBB + 18 = 7E3BD3, copy cheat counter to 7E0000 0E7D4B | 9CFD4B | 00 05        push #$05 0E7D4D | 9CFD4D | AA           compare cheat counter to #$05 0E7D4E | 9CFD4E | 44 18 01     branch command 9CFC49 + 0118 = 9CFD61 (goto 9CFD61 if cheat counter != #$05)

all cheat conditions met, enable cheat 0E7D51 | 9CFD51 | 0A FE        push #$FFFE 0E7D53 | 9CFD53 | 00 18        push #$18 0E7D55 | 9CFD55 | 58 12        store result to cheat counter, 7E3BBB + 18 = 7E3BD3 0E7D57 | 9CFD57 | 00 01        push #$01 0E7D59 | 9CFD59 | 00 FF        push #$FF 0E7F5B | 9CFD5B | 00 66        push #$66 0E7F5D | 9CFD5D | 0A FF        push #$FFFF

0E7F61 | 9CFD61 | 00 03        push #$03 0E7F63 | 9CFD63 | 00 FF        push #$FF 0E7F65 | 9CFD65 | 00 4E        push #$4E (sound index 4E) 0E7F67 | 9CFD67 | 0A FF        push #$FFFF 0E7F69 | 9CFD69 | 58 4C 0E7F6B | 9CFD6B | 00 18        push #$18 0E7F6D | 9CFD6D | 58 57        7E3BBB + 18 = 7E3BD3, copy cheat counter to 7E0000 0E7D6F | 9CFD6F | 86           cheat counter + 1 0E7D70 | 9CFD70 | 00 18        push #$18 0E7D72 | 9CFD72 | 58 12        store result to cheat counter, 7E3BBB + 18 = 7E3BD3 0E7D74 | 9CFD74 | 48 33 01     jump 9CFC49 + 0133 = 9CFD7C

failed cheat, reset cheat counter back to #$0000 0E7D77 | 9CFD77 | C0           push #$0000 0E7D78 | 9CFD78 | 00 18        push #$18 0E7D7A | 9CFD7A | 58 12        store result to cheat counter, 7E3BBB + 18 = 7E3BD3

exit 0E7D7C | 9CFD7C | C2 0E7D7D | 9CFD7D | 58 B8 0E7F7F | 9CFD7F | 56           end

Matchbox script (Japanese version)
The Matchbox script is located at offset (SNES address ) in the Japanese version.

000F6860          2C00 0080 5815 0080 AA44 1D00 000F6870 00F0 0081 1400 0800 0400 1900 1100 0258 000F6880 D0C2 58C1 56

The cheat sequence is missing.

Winter CES Warp
The Winter CES Warp script is located at offset (SNES address ) in the North American version. It's located immediately after the script for picking up the Dog Food in the debug room.

000E7EE0 000A 1460 02C0 0003 001C 0002 BA58 C700 ...`.........X.. 000E7EF0 0100 1658 1200 042E FC3B 0005 2E04 3C00 ...X.....;....<. 000E7F00 022E 093C 0002 2E0B 3C00 022E 073C 0002 ...<....<....<.. 000E7F10 2E0C 3C00 022E 083C 5820 58A2 00D2 5856 ..<....<X X...XV 000E7F20 0001 BA58 9EBC 56                      ...X..V

Note the push command for the debug room map index.

A pointer to this script is located at offset. To reach this pointer, must contain index  after executing a  instruction, but no matches for  were found in the bank.

Dark Blade weapons shop - Bulletproof Vest
The script involved with determining which items are available when you enter the shop starts at offset (SNES address ) in both the PAL English and PAL German versions. There's a couple of byte differences in the body and it's currently unknown what effects these have.

Of interest is this section (PAL English version) checking for Out of Stock status:

0E5E73 | 9CDE73 | 16 05 0E5E75 | 9CDE75 | 58 BB 0E5E77 | 9CDE77 | 00 01        push #$01 0E5E79 | 9CDE79 | 7E 0E5E7A | 9CDE7A | BE 0E5E7B | 9CDE7B | 44 95 00     branch command 9CDE13 + 0095 = 9CDEA8 (goto 9CDEA8 if item is in glass case) change command from "44 95 00" branch to "48 95 00" jump for all items available

A loop runs the above script 10x for the ten glass cases and from that this list of the item memory addresses is obtained (again, PAL English version): $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:3838] 01. Enfield AS-7 assault cannon - 40,000 nuyen $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:3833] 02. Full body suit 30,000 nuyen $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:309F] 03. Burlitzer's Finest Grenade - 80 nuyen $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:3829] 04. Partial Body Suit - 20,000 nuyen $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:3824] 05. Fully Concealable Jacket - 13,000 nuyen $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:381F] 06. Bullet Proof Vest - 8,000 nuyen $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:381A] 07. Heckler Koch 277 assault rifle - 24,000 nuyen $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:3815] 08. Uzi III sub-machine gun - 30,000 nuyen $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:3810] 09. Defiance T-250 shotgun - 12,000 nuyen $80/CB32 BF 01 00 7E LDA $7E0001,x[$7E:380B] 10. Ares Viper long range pistol - 3,000 nuyen

The memory addresses shifted in the PAL German version: $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:3833] 01. $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:382E] 02. $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:309F] 03. $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:3824] 04. $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:381F] 05. $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:381A] 06. (bulletproof vest) $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:3815] 07. $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:3810] 08. $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:380B] 09. $80/CAF4 BF 01 00 7E LDA $7E0001,x[$7E:3806] 10.

In the PAL English version, memory address for the Bullet Proof Vest is set to  Out of Stock when starting a new game.

In the PAL German version, memory address for the Bullet Proof Vest is set to  available when starting a new game.

Misc.
- location index in Japanese version