If you'd like to support our preservation efforts (and this wasn't cheap), please consider donating or supporting us on Patreon. Thank you!
Notes:Metal Slader Glory: Director's Cut
This page contains notes for the game Metal Slader Glory: Director's Cut.
Debug screen
The developers disabled the debug menu by changing a table referenced by password screen, located at ROM address 0x140423. The table contains three byte entries that tell the game where to go for each password entry. RAM address $178 is used as an indexer. Here's a table of what byte value corresponds to what (Japanese text is the password):
00 = <NO MATCH> 01 = て゛は゛っく゛ やろう★ (Debug password) 02 = えりな もう おきなよ 03 = か゛んは゛って しらへ゛なきゃ 04 = めかにっくに いってみよう 05 = つき゛は つきた゛ね 06 = せっけいしゃ さか゛さなきゃ 07 = めものは゛しょへ いくよ 08 = と゛うしようか かんか゛えよう 09 = あす゛さ むかえにいこう 0a = あす゛さ ひきとりにいくよ 0b = あす゛さのところへ いくよ 0c = さんし゛ゅうこ゛くに かえるよ 0d = さんし゛ゅうこ゛くに いくよ 0e = さんし゛ゅうこ゛くに もと゛るよ 0f = みんなのところに もと゛るよ 10 = おれたちも て゛よう！ 11 - 12 = One of the debug screens (unused) 13 - FF = <Chapter 1>
Located at SNES address $839ed6 is the password checking routine. The code references the values $4239 and $423a to read the password's top and bottom segments respectively. The top segment stores the dakuten and handakuten.
These two subroutines reference the dialogue code:
839eff jsr $b59e 839f02 jsl $819130
Eventually, the routine $83b4d3 is referenced. This unpacks a dialogue pointer when given a specified dialogue id (stored at RAM address $128). The first password to check has the script id of $18. In this scenario we're unpacking the pointer for one of the passwords. A possible password candidate is stored at $418a. After stored, we compared the entered password with the possible candidate.
The branch located at SNES address $839f35 is reached when the password entered is good, and the branch located at $839f33 is reached when all passwords are invalid.
;password doesn't match any passwords. Get out. .branch_fail 839f33 sec 839f34 rts ; goto $83ac26 .branch_match 839f35 lda $74 [000174] 839f37 sta PasswordMatchedIndex 839f39 sec 839f3a rts ; goto $83ac26
When the password is confirmed valid, the code from here on out gets much more complicated. The PasswordMatchedIndex value is swapped from RAM location to RAM location, many times without the game ever using it for a calculation. The code is likely obfuscated, however, the password data table, located at 0x140423, is in a standard format.
