Notes:Linus Spacehead's Cosmic Crusade

This page contains notes for the game Linus Spacehead's Cosmic Crusade.

Password Encoding

The twenty bytes $069A–$06AD store the fully-encoded text characters of the latest password from either the player entering one or an adventure screen generating one, which is where the auto-filled password comes from after a Game Over or Illegal Password. Another twenty bytes $067E–$0691 store the raw values of that password after decoding or before encoding.

There are 32 glyphs available for any password character, so each of the 20 characters effectively stores 5 bits of information. Most of the storage happens by reading a whole byte in RAM as a Boolean value to turn into a bit flag, and then bit flags are stored from the high bit down to the low bit as the encoding goes forward through the bytes. Here's what goes into the array of raw 5-bit values:

$067E: Effectively the high 5 bits of the 7-bit integer stored in $061B (rotates its bits right 2 times and keeps the low 5 bits).
$067F: The low 2 bits of $061B as this value's high 2 bits, followed by bit flags $061C, $061D, $061E.
$0680: Bit flags $061F, $0620, $0621, $0622, $0623.
$0681: Bit flags $0624, $0625, $0626, $0627, $0628.
$0682: Bit flags $0629, $062A, $062B, $062C, $062D.
$0683: Bit flags $062E, $062F, $0630, $0631, $0632.
$0684: Bit flags $0633, $0634, $0635, $0636, $0637.
$0685: Bit flags $0638, $0639, $063A, $063B, $063C.
$0686: Bit flags $063D, $063E, $063F, $0640, $0641.
$0687: Bit flags $0642, $0643, $0644, $0645, $0646.
$0688: Bit flags $0647, $0648, $0649, $064A, $064B.
$0689: Bit flags $064C, $064D, $064E, $064F, $0650.
$068A: Bit flags $0651, $0652, $0653, $0654, $0655.
$068B: Bit flags $0656, $0657, $0658, $0659, $065A.
$068C: Bit flag $065B followed by all 4 of $065C's bit flags (in the low 4 bits either way).
$068D: Bit flags $065D, $065E, $065F, $0660, $0661.
$068E: Bit flags $0662, $0663, $0664, $0665, $0666.
$068F: The high 5 bits of $0046.
$0690: The low 3 bits of $0046, as this value's low 3 bits. (So this character's high 2 bits go unused.)
$0691: Checksum consisting of the other 19 values $067E–$0690 added together and only the low 5 bits of the sum kept.
       (That's modulo 32 if you're doing the math yourself.)

So this checksum isn't great security: You could make the game accept any bogus password just by retrying it with the last character changed in a maximum of 32 tries.

Now for encrypting the password, the ROM contains the following string at $3EB1B in the US version and $3EA43 in the European version, right after the 32 password glyphs in their usual sequence:

LWEA3JOG9IB6ZTQS7MDYK4CVN8FHPXUR

It's all the password glyphs again, but in a jumbled order. This is to obscure how the password characters increment: A character's position in that jumbled string represents its true value, from "L"=0 to "R"=31 ($1F).

Following that are twenty offset values, one for each index of the password:

$0A $13 $1C $02 $0D $02 $1F $00 $02 $02 $01 $09 $00 $00 $09 $03 $11 $0F $06 $18

These offsets are added when encoding and subtracted for decoding, and this is what transforms the starting password of all zeroes (which would otherwise be all "L") into "BYPETERLEEWILLIAMSON".

So it's pretty simple to make a single change to an existing password when the offsets will be the same every time: Just find what amount you need to add to which character, and count forward from it through the above jumble string that many places, looping back to the start if you hit the end, to find the replacement character for it. Then count the checksum character forward by the same amount to get its replacement. You could instead subtract a number by counting backward if that's easier. You could also make multiple changes by remembering to count the sum of those changes to the checksum in the end.

The password does not appear to store the Birth Certificate because you start with it and can't get rid of it.

Text Compression

Text banks begin shortly after $28000 and $2C000 in both versions of the ROM. Toward the end of the ROM are "dictionaries" of the characters that values from the text banks translate into. At first there are many common pairs of letters indexed two-for-one, and then the entire font of single characters follows as a simple cipher for everything that couldn't be paired. Here are all those values for easy reference:

	$0	$1	$2	$3	$4	$5	$6	$7	$8	$9	$A	$B	$C	$D	$E	$F
$00	DE	ER	EN	IN	AN	AR	ES	CH	TE	AS	IC	IE	ON	OU	LE	RE
$10	RA	ST	TO	EL	ET	IS	OR	UE	CO	DO	HA	HE	LA	LI	ME	NE
$20	NO	PA	SE	TH	TI	VE	AL	AT	EI	IL	IT	OL	OM	OS	UN	UR
$30	CA	DA	GE	LO	MA	MI	ND	PE	QU	RO	RT	SI	TA	TR	YO	AD
$40	AI	CE	PO	US	UT	MO	HI	RI	CI	ED	A	B	C	D	E	F
$50	G	H	I	J	K	L	M	N	O	P	Q	R	S	T	U	V
$60	W	X	Y	Z	!	?	.	1	2	3	4	5	6	7	8	9
$70	0	,	'	¡	¿	Ö	Ü	Ä	Ç	-	È

On top of that, any of these characters or pairings can be given a blank space afterward by setting the value's high bit (adding $80). So for instance, while $49 would produce only "ED", $C9 would print "ED ".

Control code $FF starts a new line in the same piece of text, while $FE separates different pieces of text and their translations. $FB appears to be some rarely-used padding mechanism. Every English piece of text begins with another two control codes that have not yet been thoroughly documented, but they probably control screen position or wait time; just don't read them as letters.

During the bus cutscene, some of the punctuation changes places, so switch to reading $66 as a comma, $67 as a period, and $68 as an apostrophe when dumping that scene's text.

A few strings are stored uncompressed, with character values corresponding to where their tiles are placed in their section of the PPU pattern table. Here are the addresses to find them in both versions of PRG ROM:

USA	Europe	Contents
N/A	$1BD7D	Pie Slap arena names
$24ADC	$24AD6	"NEW YORK CITY"
$2662B	$26624	Language names
$2FE75	$2FE63	Verbs and prepositions selected
$3BEE3	$3BAC4	Developers' names
$3EAB2	$28004	Password entry character grid
$3F6C7	$3F620	Compression dictionary for the tall font
$3F825	$3F77E	Compression dictionary for the short font

RAM Addresses Identified So Far

Feel free to add more if you're sure of them, but note if you find they differ by version.

$0034: Player 1 controller input received—Gets taken over during the demo.
$0035: Player 1's controller input.
$003E: Cursor's X coordinate.
$003F: Cursor's Y coordinate.
$0046: Current adventure location. Known values:
  $00: Old Lino Town
  $01: The Post Office
  $02: Cape Carnival
  $03: The Wilderness
  $04: Nearly Freezing Pool
  $05: The Border
  $06: Formica City
  $07: Dodgey City
  $08: The River Bank
  $09: Dodgey River Bank
  $0A: Cosmic Coast
  $0B: Foreign Soil
  $0C: Linograd
  $0D: The Caves
  $0E: No Mans Causeway (left side)
  $0F: No Mans Causeway (right side)
  $10: Linoville
  $11: Bus Depot
  $12: Detroitica Bus Depot
  $13: Factory Reception
  $14: Workshop
  $15: Staff Room
  $16: Car Lot
  $17: Scrapyard
  $18: Gas Station
  $19: Hub
  $1A: No.1
  $1B: No.2
  $1C: No.3
  $1D: No.4
  $1E: No.5
  $1F: No.6
  $20: Camera Shop
  $64: Only used during the scene of the bus arriving at Planet Detroitica's map, not a valid location.
$004A: Player 2's controller input (Pie Slap only).
$0089: Extra lives.
$008A: Player character's X coordinate.
$008C: Player character's Y coordinate.
$008E: Player character's X coordinate with respect to the camera.
$008F: Player character's inverted Y coordinate.
$0090: Player character's Y velocity in arcade sections, which maxes out at $17.
$0091: Player character's X velocity in arcade sections, which is capped between 7 and -7, equating to 1 pixel per frame.
$0092: Player character faces right if $00, left if $01.
$0094: Animation choice when airborne.
$009A: X coordinate of last click on graphics field.
$009C: Y coordinate of last click on graphics field.
$00A6: Is $01 if starting from password, which is copied to bytes $072D–$0742, robbing the player of 1 out of every 8 Cosmic Candies.
$00F0: Language chosen for text.
$00FA: Cosmic Candies on hand.
Some more Europe-exclusive stuff:
$00FF: Bit field flagging which of the 8 Password items remain.
$0460: Splatdrone 1's angle.
$0461: Splatdrone 1's X velocity.
$0462: Splatdrone 1's Y velocity.
$0463: Splatdrone 1's X coordinate.
$0464: Splatdrone 1's Y coordinate.
$0465: Splatdrone 1's speed increased.
$0466: Splatdrone 1's pies doubled.
$046A: Splatdrone 2's angle.
$046B: Splatdrone 2's X velocity.
$046C: Splatdrone 2's Y velocity.
$046D: Splatdrone 2's X coordinate.
$046E: Splatdrone 2's Y coordinate.
$046F: Splatdrone 2's speed increased.
$0470: Splatdrone 2's pies doubled.
$0477: Splatdrone 1's pie 1's X coordinate.
$0478: Splatdrone 1's pie 1's Y coordinate.
$0481: Splatdrone 2's pie 1's X coordinate.
$0482: Splatdrone 2's pie 1's Y coordinate.
$048B: Splatdrone 1's pie 2's X coordinate.
$048C: Splatdrone 1's pie 2's Y coordinate.
$0495: Splatdrone 2's pie 2's X coordinate.
$0496: Splatdrone 2's pie 2's Y coordinate.
$04BA: Splatdrone 1's pie curve inertia—Drops to half, rounded down, with each pickup.
$04BB: Splatdrone 2's pie curve inertia.
$04BC: Splatdrone 1's pie speed.
$04BD: Splatdrone 2's pie speed.
$04BE: Splatdrone 1's pies bounce.
$04BF: Splatdrone 2's pies bounce.
$04C4: Countdown timer to next powerup.
For most inventory items, 1 means you have it, 0 means it's back where you'd find it on the field.
$061A: Birth Certificate
$061B: Gold Lino Dollars (can be any integer)
$061C: Passport Photos
$061D: A Waterproof/Rubber Plug
$061E: Helium Balloon
$061F: Old Lino Town Teleport Key
$0620: Dodgey City Teleport Key
$0621: Linoville Teleport Key
$0622: Formica City Teleport Key
$0623: Linograd Teleport Key
$0624: Driving Licence
$0625: Letter From Linograd
$0626: Fuse Wire
$0627: Gunpowder
$0628: Targetting Device
$0629: Match Stick
$062A: Surf Board
$062B: Car Keys
$062C: A Metal Bar (Bus Stop Sign)
$062D: Computer Key
$062E: Camera
$062F: Supa Color Film
$0630: Money Box
$0631: Anti Gravity Slide
$0632: Bridge
$0633: Blowpipe
$0634: Trampoline
$0635: A Ready Made Letter
$0636: Cosmic Joke Book
$0637: Passport
$0638: Icing Sugar
$0639: Bus Ticket
$063A: Fire Extinguisher
For action routes, a value of 1 means you've cleared it and don't have to play it again.
$063B: "Old Lino Town"→"Cape Carnival"
$063C: "Old Lino Town"→"The Wilderness"
$063D: "Old Lino Town"→"The Border"
$063E: "The Wilderness"→"Nearly Freezing Pool"
$063F: "The Border"→"The River Bank"
$0640: "The Border"→"Formica City"
$0641: "Formica City"→"Cosmic Coast"
$0642: "Frozen Pool"→"Dodgey City"
$0643: "Dodgey River Bank"→"Dodgey City"
$0644: "Cosmic Coast"→"Foreign Soil"
$0645: "Cape Carnival"→"Linograd"
$0646: "Linograd"→"The Caves"
$0647: "Linograd"→"No Mans Causeway"
$0648: "No Mans Causeway"→"No Mans Causeway"
$0649: "No Mans Causeway"→"Linoville"
$064A: "Linoville"→"Bus Depot"
$064B: "Detroitica Bus Depot"→"Factory Reception"
$064C: "Factory Reception"→"Workshop"
$064D: "Workshop"→"Staff Room"
$064E: "Staff Room"→"Car Lot"
$064F: "Scrapyard"→"Factory Reception"
$0650: "Hub"→"No.6"
$0651: "Hub"→"No.1"
$0652: "Hub"→"No.2"
$0653: "Hub"→"No.3"
$0654: "Hub"→"No.4"
$0655: "Hub"→"No.5"
Other world changes set bytes to 1 but sometimes also use them as live countdown timers.
$0656: The Bus has landed at the Detroitica Bus Depot.
$0657: Mail is in transit. This is set to $27 and decrements every 4–5 seconds (256 frames) until Linochev's letter arrives at $01.
$0658: The Scary One-Eye Monster has left The Wilderness.
$0659: The Border of Formica is open. This quickly decrements from $1F to $01 to control door height.
$065A: Formica City's barrier is up via the first button. This will also go from $1F to $01 and back to $1F and $00 if necessary.
$065B: Formica City's barrier is permanently open.
$065C: The Missile in Linograd has 4 bit flags altogether, where any combination of the low 3 bits is valid:
  $01: Gunpowder has been installed.
  $02: Fuse Wire has been installed.
  $04: Targetting Device has been installed.
  $08: Missile has launched and destroyed the wall. Normally this clears the other bits.
$065D: The Nearly Freezing Pool is Frozen.
$065E: You've met Shady Lionel, but you couldn't afford the license the first time, so you won't reintroduce yourselves next time.
$065F: The Bath Tub's leak has been plugged so you can ride it.
$0660: You have the strength to jump No Man's Causeway's long gap.
$0661: Your car has arrived at the space station. This decrements from $F2 to $01 to control scene timing.
$0662: Detroitica's car-zapping robots have been deactivated.
$0663: The reception Computer has been switched on for use.
$0664: The Power Generator's fire has been put out, halting Vork the crusher robot.
$0665: The Money Box contains the 10 Spacebucks.
$0666: Unknown, but it is preserved by the password.
$067E–$0691: Raw values of the latest password.
$069A–$06AD: Latest Password.
$072D–$0742: One long bit field of whether the player has collected each of the 170 Cosmic Candy bars in the game.
$078D: Background music track currently playing (US).
$078E: Background music track currently playing (Europe). Known values for both versions:
  $00: Silence
  $01: Bus Depot/Scrapyard
  $02: Offices
  $03: Cape Carnival
  $04: Wilderness
  $05: Formica City
  $06: Dodgey City
  $07: River Bank
  $08: Coast
  $09: Linograd
  $0A: The Caves
  $0B: No Man's Causeway adventure areas
  $0C: Old Lino Town/Detroitica Bus Depot
  $0D: Workshop
  $0E: Factory Reception/Car Lot
  $0F: Linoville/Gas Station Hub
  $10: Outer sectors
  $11: Bumper car race
  $12: Drive through asteroids/Bouncey Slap
  $13: Beast 64bit Computer
  $14: Old Lino Town action routes
  $15: Formica action routes
  $16: Dodgey City action routes
  $17: Surfing stage/Slapper
  $18: Secret Tunnel
  $19: Linograd action routes
  $1A: No Man's Causeway action route
  $1B: Linoville action routes
  $1C: Detroitica entrance route/even-numbered space station spokes
  $1D: Car assembly line stage
  $1E: Vork/Airy Slap
  $1F: Electrified exit from Detroitica stage
  $20: Scrapyard action route
  $21: Unused
  $22: Odd-numbered space station spokes
  $23: Bus ride
  $24: Attract mode
  $25: Ending
  $26: Win jingle
  $27: Main menu
  $28: Ending finale jingle
  $29: Death jingle
  $2A: Game Over