After Burner II (Genesis)

Max Out Missiles/Secret Message
At the start of various levels, the game will stop the action and send a ship which will restock your missiles; it only gives you 50 missiles. If you use a certain button combination before your ship makes contact with that ship (that is, before the RELOAD WEAPONS message appears), you will see a secret message and the ship will give you 100 missiles instead, maxing out your stock. Taken together, all the secret messages tell some story completely unrelated to the game (where exactly is it from? TODO).

Unused Related Text
Levels 1 and 23 (the cutscene-only level used for the ending) also have strings associated with this cheat, but the cheat does not work for those levels. Had it worked, you would just press B to activate it.

For the addresses, the first byte indicates the button combination, the next three bytes position (and possibly color? TODO) the text, and after that is the null-terminated string. The three bytes+string would be repeated if there were more text, however since these are the only strings printed here, the byte $FF ends printing. Most, if not all, text in the game takes the three bytes-string-...-$FF form.

Demo recording?
There is unused code at $6ACE that runs a special version of the main game loop that logs all controller input to the (invalid for this game) address range [$80000, $80400) for some time, then freezes with the message "READY TRACE!!" (at $6C3C in the above-mentioned string format). Pausing is disabled in this special game loop. The freezing is presumably caused by the opcode $FFFF (triggering a line 1111 emulator handler) at $6BBC; the game does jump into the (shared by most errors) handler. My (andlabs) best guess is that the debug hardware allowed grabbing the data from the address range above and placing it elsewhere for the demos.

You can jump into this game loop and play with patch codes 006350:4EF8 and 006352:6ACE (which replaces the actual game loop with this new one), however I do not know how to extract the data (it could just be changing the two addresses to be in SRAM for emulators that automatically create SRAM) or how to play your demos back (as I have not yet located the demo data in ROM).

Miscellaneous
The trap #8 vector (at $A0) is set to point to the out of bounds ROM address $F0CE0 in the US/Europe ROM rather than the standard error handler in the Japanese ROM. The reason for this, as well as what this would point to, is unknown.