We just reached 20,000 articles on this wiki!
If you appreciate the work done within the wiki, please consider supporting The Cutting Room Floor on Patreon. Thanks for all your support!

Notes:Thunder Spirits

From The Cutting Room Floor
Jump to navigation Jump to search

This page contains notes for the game Thunder Spirits.


Configuration Mode

Addresses correspond to the North American version.

open configuration menu
$05/91AC AF 90 03 7F LDA $7F0390[$7F:0390]   //check if finished game. FFFF = no 0000 = yes
$05/91B0 D0 03       BNE $03    [$91B5]
$05/91B2 4C BD 92    JMP $92BD  [$05:92BD]   //yes, open expanded config mode.  replace 4C BD 92 with 4C F2 91 (JMP $91F2) for debug mode
$05/91B5 20 1F 89    JSR $891F  [$05:891F]   //no

Pause cheat

Addresses correspond to the North American version.

while paused...
$00/8D31 20 0D 88    JSR $880D  [$00:880D]
$00/8D34 20 95 AB    JSR $AB95  [$00:AB95]
$00/8D37 20 E1 B5    JSR $B5E1  [$00:B5E1]
$00/8D3A AD 69 1B    LDA $1B69  [$00:1B69]
$00/8D3D 89 00 20    BIT #$2000              //check Select
$00/8D40 F0 03       BEQ $03    [$8D45]

Select button pressed
$00/8D42 EE 6D 1B    INC $1B6D  [$00:1B6D]   //inc counter for times Select pressed

$00/8D45 89 20 00    BIT #$0020              //check L
$00/8D48 F0 08       BEQ $08    [$8D52]

L button pressed
$00/8D4A AD 6D 1B    LDA $1B6D  [$00:1B6D]
$00/8D4D C9 0A 00    CMP #$000A              //check if Select pressed 10x
$00/8D50 F0 09       BEQ $09    [$8D5B]      //if 10x, proceed to next section $8D5B

$00/8D52 AD 69 1B    LDA $1B69  [$00:1B69]
$00/8D55 89 00 10    BIT #$1000              //check Start
$00/8D58 F0 D7       BEQ $D7    [$8D31]

$00/8D5A 60          RTS

second part of cheat entry
$00/8D5B 20 0D 88    JSR $880D  [$00:880D]
$00/8D5E 20 95 AB    JSR $AB95  [$00:AB95]
$00/8D61 20 E1 B5    JSR $B5E1  [$00:B5E1]
$00/8D64 AD 69 1B    LDA $1B69  [$00:1B69]
$00/8D67 89 10 00    BIT #$0010              //check R
$00/8D6A F0 03       BEQ $03    [$8D6F]

R button pressed
$00/8D6C EE 6D 1B    INC $1B6D  [$00:1B6D]   //inc counter for times R pressed

$00/8D6F 89 00 20    BIT #$2000              //check Select
$00/8D72 F0 08       BEQ $08    [$8D7C]

Select button pressed
$00/8D74 AD 6D 1B    LDA $1B6D  [$00:1B6D]
$00/8D77 C9 0C 00    CMP #$000C              //Select pressed 10x + R 2x
$00/8D7A F0 09       BEQ $09    [$8D85]      //if #$0C, code entry successful, proceed to $8D85

$00/8D7C AD 69 1B    LDA $1B69  [$00:1B69]
$00/8D7F 89 00 10    BIT #$1000              //check Start
$00/8D82 F0 D7       BEQ $D7    [$8D5B]

$00/8D84 60          RTS

use cheat features
$00/8D85 20 0D 88    JSR $880D  [$00:880D]
$00/8D88 20 95 AB    JSR $AB95  [$00:AB95]
$00/8D8B 20 E1 B5    JSR $B5E1  [$00:B5E1]
$00/8D8E AD 69 1B    LDA $1B69  [$00:1B69]
$00/8D91 89 80 00    BIT #$0080              //check A
$00/8D94 F0 11       BEQ $11    [$8DA7]

A button pressed - upgrade/add weapons
$00/8D96 20 F1 8D    JSR $8DF1  [$00:8DF1]
$00/8D99 E2 20       SEP #$20
$00/8D9B A9 FF       LDA #$FF
$00/8D9D 99 63 1B    STA $1B63,y[$00:1B63]
$00/8DA0 C2 20       REP #$20
$00/8DA2 20 45 C1    JSR $C145  [$00:C145]
$00/8DA5 80 DE       BRA $DE    [$8D85]

$00/8DA7 89 00 80    BIT #$8000              //check B
$00/8DAA F0 14       BEQ $14    [$8DC0]

B button pressed - downgrade/remove weapons
$00/8DAC 20 F1 8D    JSR $8DF1  [$00:8DF1]
$00/8DAF E2 20       SEP #$20
$00/8DB1 A9 00       LDA #$00
$00/8DB3 99 63 1B    STA $1B63,y[$00:1B64]
$00/8DB6 C2 20       REP #$20
$00/8DB8 9C 61 1B    STZ $1B61  [$00:1B61]
$00/8DBB 20 45 C1    JSR $C145  [$00:C145]
$00/8DBE 80 C5       BRA $C5    [$8D85]

$00/8DC0 89 40 00    BIT #$0040              //check X
$00/8DC3 F0 0B       BEQ $0B    [$8DD0]

X button pressed - add support guns
$00/8DC5 A9 01 00    LDA #$0001
$00/8DC8 8D 12 04    STA $0412  [$00:0412]
$00/8DCB 20 45 C1    JSR $C145  [$00:C145]
$00/8DCE 80 B5       BRA $B5    [$8D85]

$00/8DD0 89 00 40    BIT #$4000              //check Y
$00/8DD3 F0 0B       BEQ $0B    [$8DE0]

Y button pressed - add shield
$00/8DD5 A9 03 00    LDA #$0003
$00/8DD8 8D 14 04    STA $0414  [$00:0414]
$00/8DDB 20 45 C1    JSR $C145  [$00:C145]
$00/8DDE 80 A5       BRA $A5    [$8D85]

$00/8DE0 89 10 00    BIT #$0010              //check R
$00/8DE3 F0 03       BEQ $03    [$8DE8]

R button pressed - self-destruct
$00/8DE5 20 6C AD    JSR $AD6C  [$00:AD6C]

$00/8DE8 89 00 10    BIT #$1000              //check Start
$00/8DEB F0 98       BEQ $98    [$8D85]

Start button pressed
$00/8DED 9C 61 1B    STZ $1B61  [$00:1B61]   //related to collision?
$00/8DF0 60          RTS                     //exit

sub for weapons
$00/8DF1 AD 6F 1B    LDA $1B6F  [$00:1B6F]
$00/8DF4 1A          INC A
$00/8DF5 C9 05 00    CMP #$0005
$00/8DF8 90 03       BCC $03    [$8DFD]
$00/8DFA A9 00 00    LDA #$0000
$00/8DFD 8D 6F 1B    STA $1B6F  [$00:1B6F]
$00/8E00 A8          TAY
$00/8E01 60          RTS

Name entry check

Hmmm...
To do:
Reformat
; format:                         ROM addr | logical addr of memory access
	rep	#$20            ; $28FD2
	lda	$7F0302,x       ; $28FD4 | $7F0302 - first two initials
	cmp	#$4040          ; $28FD8 - "  "
	beq	loc_28FE7       ; $28FDB - yes, see if we need to replace
	cmp	#$4141          ; $28FDD - "AA"
	beq	loc_28FE7       ; $28FE0 - yes, see if we need to replace
	cmp	#$4553          ; $28FE2 - "ES" (little-endian)
	bne	loc_29010       ; $28FE5 - no, do not replace
loc_28FE7:
	lda	$7F0304,x       ; $28FE7 | $7F0304 - last initial
	cmp	#$0040          ; $28FEB - " "
	beq	loc_28FFA       ; $28FEE - yes, replace
	cmp	#$0041          ; $28FF0 - "A"
	beq	loc_28FFA       ; $28FF3 - yes, replace
	cmp	#$0058          ; $28FF5 - "X"
	bne	loc_29010       ; $28FF8 - no, do not replace
loc_28FFA:
	sep	#$20            ; $28FFA - switch to byte reads/writes
	lda	#$45            ; $28FFC - "E"
	sta	$7F0302,x       ; $28FFE |  $7F0302
	lda	#$4D            ; $29002 - "M"
	sta	$7F0303,x       ; $29004 |  $7F0303
	lda	#$49            ; $29008 - "I"
	sta	$7F0304,x       ; $2900A |  $7F0304
	rep	#$20            ; $2900E - switch to word reads/writes
loc_29010:

andlabs's scattered notes

$7F0000 - 'Ohda'
used for reset check
does not appear to be used by any other SNES game? no name match with any of the Thunder Force III staff

$7F0004 - $FF if 'Ohda'; $00 otherwise

sub_9CE - Toshiba EMI screen

sub_B8000 - the actual gruntwork

sub_9DF - ending; starts after the fadeout for the final level but before the HUD is removed from the screen as well

sub_30003 -> loc_30107 -> sub_38000 -> loc_38005 - ending cutscene
$381E3 is right after "was eventually extinguished." has been output
$3823F is right after this block of text scrolls offscreen
$3828A is right after this part of the cutscene ends, leading into the slideshow
sub_3897E appears to be the routine that loads the slideshow image, with byte $7FFD80 choosing (zero for first, nonzero for second)
$38391 is right before the THE END screen shows up
verdict: seems to be nothing unused, unless I am missing extra data
00038262 4CD181    jmp loc_381D1  ; normal branch
00038265 A90100    lda #$0001     ; target 1 - NOTHING
00038268 8D901A    sta $1A90
0003826B 4CDA83    jmp loc_383DA
0003826E 9C901A    stz $1A90      ; target 2 - NOTHING, but controller input stops working?
00038271 4CDA83    jmp loc_383DA
00038274 A90200    lda #$0002     ; target 3 - NOTHING, but controller input stops working
00038277 8D901A    sta $1A90
0003827A 4CDA83    jmp loc_383DA
0003827D 20 42 93 9C DB  sub_3827D

if they all do nothing, I'll need to try subroutiune calls...

loc_383DA:

jsr sub_383DF ; $383DA plb ; $383DD rtl ; $383DE sub_383DF:

; does stuff

so we want 20DF83 - and the game hangs

ok final verdict: got nothing; off to the name entry code

$021A98 - level number (0..7; not sure what higher values would do)

huh? demo recording?

loc_B39:
	sta	$ABAD8C,x		; $B3B |  $ABAD8C -> ROM $55AD8C
loc_B3D:
	beq	loc_B4D		; $B40
	lda	$1B69		; $B42 | $1B69 -> $001B69
	bit	#$00		; $B45
	bpl	loc_B39		; $B47

loc_28BFD - actual start of name entry code (after following some jumps)

sub_2891F - PrintString - looks like I need to add a noreturn feature of sort, since this behaves like the PrintString in tecnosoft's MD games (pulls strings from instruction stream)

actually here the string starts after three bytes and ends on a null byte so maybe I can do a string feature...

loc_28FC7 - start of built in name check

loc_28FFA - loads EMI (replacement name)
verdict - doe not appear to check any other names
00282e0: d0e4 9c14 1c20 2183 a900 00ab 6b4d 5354  ..... !.....kMST
00282f0: 0053 484f 004e 4153 0054 3a4b 0050 4950  .SHO.NAS.T:K.PIP
0028300: 0053 4d49 0045 584f 0059 4f55 0056 3132  .SMI.EXO.YOU.V12
0028310: 004e 414f 0054 4945 004b 5234 0038 3431  .NAO.TIE.KR4.841

are TIE, KR4, 841 names that do not appear?


bugs in the disassembler

	rep	#$20		; $134F
	lda	$7F038A		; $1351 |  $7F038A
	bne	loc_1360		; $1355
	lda	#$F3		; $1357
	brk	#$20		; $1359
	lda	($AC),y		; $135B | $AC + d=$00 -> $0000AC
	jmp	loc_A0D		; $135D
loc_1360:
	lda	#$00F4		; $1360
	jsr	sub_2CB1		; $1363
	jmp	loc_A0D		; $1367

(need to actually add environment saving/restoring)