Notes:WildCATS

This page contains notes for the game WildCATS.

Empty subroutines

Throughout the programming are jumps to subroutines $BE8000 and $BE8001, but they are empty and only contain a 6B RTL instruction.

Password system

Pointers to the game's seven passwords start at ROM address $00448E (SNES address $80C48E):

00448E 6BC4 70C4 75C4 7AC4 7FC4 84C4 89C4

Each password is 5 bytes/letters and stored obfuscated. Stored password list:

00446B 0E15100B14 //MVSHW
004470 0908131407 //JKPWD
004475 0011171515 //CRTVV
00447A 17100B000B //TSHCH
00447F 150E07000B //VMDCH
004484 0F10091713 //LSJTP
004489 0113140000 //BPWCC

Passwords are obfuscated by using XOR #$43 on each byte:

$80/C25C 49 43 00    EOR #$0043

Conversion table:

00 ^ 43 = 43
01 ^ 43 = 42
04 ^ 43 = 47
05 ^ 43 = 46
07 ^ 43 = 44
08 ^ 43 = 4B
09 ^ 43 = 4A
0A ^ 43 = 49
0B ^ 43 = 48
0D ^ 43 = 4E
0E ^ 43 = 4D
0F ^ 43 = 4C
10 ^ 43 = 53
11 ^ 43 = 52
12 ^ 43 = 51
13 ^ 43 = 50
14 ^ 43 = 57
15 ^ 43 = 56 
17 ^ 43 = 54

Password letters (ASCII):

B=42
C=43
D=44
F=46
G=47
H=48
J=4A
K=4B
L=4C
M=4D
N=4E
P=50
Q=51
R=52
S=53
T=54
V=56
W=57
X=58
Y=59
Z=5A

Each password corresponds to a bit in memory address $7E1F85 (with only 7 passwords, the final bit $80 goes unused):

$80/C28D FA          PLX
$80/C28E E0 00 00    CPX #$0000              //1st password
$80/C291 F0 5B       BEQ $5B    [$C2EE]
$80/C293 E0 02 00    CPX #$0002              //2nd password
$80/C296 F0 4B       BEQ $4B    [$C2E3]
$80/C298 E0 04 00    CPX #$0004              //3rd password
$80/C29B F0 3B       BEQ $3B    [$C2D8]
$80/C29D E0 06 00    CPX #$0006              //4th password
$80/C2A0 F0 2B       BEQ $2B    [$C2CD]
$80/C2A2 E0 08 00    CPX #$0008              //5th password
$80/C2A5 F0 1B       BEQ $1B    [$C2C2]
$80/C2A7 E0 0A 00    CPX #$000A              //6th password
$80/C2AA F0 0B       BEQ $0B    [$C2B7]

//0C BPWCC (7th password)
$80/C2AC AD 85 1F    LDA $1F85  [$7E:1F85]
$80/C2AF 09 40 00    ORA #$0040
$80/C2B2 8D 85 1F    STA $1F85  [$7E:1F85]
$80/C2B5 80 40       BRA $40    [$C2F7]

//0A LSJTP (6th password)
$80/C2B7 AD 85 1F    LDA $1F85  [$7E:1F85]
$80/C2BA 09 20 00    ORA #$0020
$80/C2BD 8D 85 1F    STA $1F85  [$7E:1F85]
$80/C2C0 80 35       BRA $35    [$C2F7]

//08 VMDCH (5th password)
$80/C2C2 AD 85 1F    LDA $1F85  [$7E:1F85]
$80/C2C5 09 10 00    ORA #$0010
$80/C2C8 8D 85 1F    STA $1F85  [$7E:1F85]
$80/C2CB 80 2A       BRA $2A    [$C2F7]

//06 TSHCH (4th password)
$80/C2CD AD 85 1F    LDA $1F85  [$7E:1F85]
$80/C2D0 09 08 00    ORA #$0008
$80/C2D3 8D 85 1F    STA $1F85  [$7E:1F85]
$80/C2D6 80 1F       BRA $1F    [$C2F7]

//04 CRTVV (3rd password)
$80/C2D8 AD 85 1F    LDA $1F85  [$7E:1F85]
$80/C2DB 09 04 00    ORA #$0004
$80/C2DE 8D 85 1F    STA $1F85  [$7E:1F85]
$80/C2E1 80 14       BRA $14    [$C2F7]

//02 JKPWD (2nd password)
$80/C2E3 AD 85 1F    LDA $1F85  [$7E:1F85]
$80/C2E6 09 02 00    ORA #$0002
$80/C2E9 8D 85 1F    STA $1F85  [$7E:1F85]
$80/C2EC 80 09       BRA $09    [$C2F7]

//00 MVSHW (1st password)
$80/C2EE AD 85 1F    LDA $1F85  [$7E:1F85]
$80/C2F1 09 01 00    ORA #$0001
$80/C2F4 8D 85 1F    STA $1F85  [$7E:1F85]