Super Punch-Out!! (SNES)
This game has a notes page
This game has a prerelease article
Super Punch-Out!! is the fourth game in Nintendo's legendary Punch-Out!! line.
- 1 Sound Test
- 2 Prototype Fragments
- 3 Checksum Generator
- 4 Anti-Piracy
- 5 Regional Differences
Hold L+R on the second controller at the opening Nintendo logo for the game's sound test.
This needs A LOT more research...
A number of free space areas in the ROM contain copies of bank $00 from a prototype version. Some of these ROM offsets and differences are documented below. See the Notes page for more info.
This includes a copy of $007FC0-007FFF which is the cartridge header. The entire first half (which is not required for cartridge operation) is blank.
00FFC0 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00FFD0 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00FFE0 0000 0000 2886 0080 0480 3D9F 0000 F49C ....(.....=..... 00FFF0 0000 0000 2886 0000 0480 0480 0580 F49C ....(...........
007FC0 5375 7065 7220 5075 6E63 682D 4F75 7421 Super Punch-Out! 007FD0 2120 2020 2020 020B 0301 3300 6F01 90FE ! ....3.o... 007FE0 0000 0000 C488 0080 0480 99A2 0000 6DA0 ..............m. 007FF0 0000 0000 C488 0000 0480 0480 0580 6DA0 ..............m.
For reference, here's a summary of the data for the first half of the above retail version header:
7FC0-7FD4 ASCII game title (21 bytes) 7FD5 0x20 = mode $20, no FastROM 7FD6 0x02 = cart type is ROM + battery-backed RAM 7FD7 0x0B = 16 megabit cart size 7FD8 0x03 = 64Kbit SRAM 7FD9 0x01 = country code (North America) 7FDA 0x33 = manufacturer code 7FDB 0x00 = first version 7FDC-7FDD checksum complement 7FDE-7FDF checksum
Much of this fragment is contained in the $099CDB-09D95F fragment; it's easier to just investigate that one instead. The last $0160 bytes, which are exclusive to this fragment, matches up to $0066B7-006816. However, there's no differences except for address shifts.
The largest fragment found so far, this matches up to approx. $002054-0066B6. Two differences have been found so far:
- The ending was not yet added. When the Special Circuit is completed the game simply enters an infinite loop (using a BRA $FE operation).
- The anti-piracy test run after completing the World Circuit (which is responsible for unlocking the Special Circuit) runs a checksum on the entire 32,768 bytes of the first ROM bank, instead of skipping the first 4 bytes as seen in the final game. It's not clear why this change was made. Currently, only one of the first 4 bytes has a known purpose (the checksum generator). The other bytes are still unsolved.
If offset $000002 (SNES address $008002) is changed from $FF to $00, the game calls a subroutine on boot up to create checksums used for the Minor Circuit and World Circuit anti-piracy tests, as well as a complete checksum of the entire ROM used for the cartridge header. It attempts to write the calculated values to ROM region, possible on development hardware, but not on a retail cartridge.
The game contains a much more thorough set of anti-piracy tests than those seen in earlier SNES titles and will display one of the above messages if there's a problem. In addition, what appears to be various error codes will be written to $70000F. The stack test and two jump tests aren't fully implemented and failing them doesn't do anything besides write the error code. They may have been abandoned because of the (rare) possibility of a false positive due to the console's RAM being mostly random on power up.
Boot Up Tests
If the console was already in Native Mode, the test fails as this is evidence another program (e.g., a menu belonging to a backup unit aka cartridge copier) was running before the game had a chance to boot. The string System Error !! is written to $7E07F0 in RAM, and Copy Machine !? to the beginning of SRAM (battery-backed memory used to hold the save game data). The 8-bit accumulator is written to $70000F.
If the Direct Page register is non-zero, the test fails. All of the above Emulation Flag info also applies, except that the lower 8 bits of the Direct Page register is written to $70000F.
If the Reset Vector was at the top of the stack, the test fails. The idea behind this test, as well as next two jump tests, is to look for fingerprints of the various methods that unauthorized attached hardware can use to switch from its programming to that of the game cartridge. Error code: $12
The beginning of RAM (range $7E0000-7E1FFF) is searched for the pattern $4Cxxxx, where xxxx is the Reset Vector. Error code: $11
The beginning of RAM (range $7E0000-7E1FFF) is searched for the pattern $6CFCFF, an indirect jump. Error code: $10
The test fails if any one of nine 16-bit values in the cartridge header were modified. Error code: $13
Native Mode FFE4 COP FFE8 ABORT FFEA NMI FFEE IRQ
Emulation Mode FFF4 COP FFF8 ABORT FFFA NMI FFFC RESET FFFE IRQ
These tests are run after completing a circuit.
A checksum is run on 50 bytes worth of initialization code and data starting at offset $000004 which include the Emulation Flag and Direct Page tests. If the checksum generated doesn't match the hardcoded value, the test fails.
During the boot process, successfully passing the various boot up tests described earlier will write individual bytes to RAM range 7E7B00-7E7B05 forming the string SPO001 in memory. The test fails if the string isn't an exact match as it means some/all of the boot up tests were bypassed.
A checksum is run on offset $000004-007FFF, which is all but the first 4 bytes of the very first ROM bank. This bank contains a lot of the game engine including the programming for all of the above tests. If the checksum generated doesn't match the hardcoded values, the Special Circuit will not be unlocked. If it was already unlocked, it will be locked again.
Note that many game enhancer cheats, including Galoob's official Game Genie codes published in the 1990s like "Always have K.O. punch after first hit" will cause the checksum to fail. To avoid this, turn any cheats off before pressing Start to proceed from the scoring screen to the next screen.
In the international versions, the ability to enter your name in Japanese is hidden with a button code. Highlight "New Game" and use any one of these three combinations: X + A, Start + X + A or Start + X. The Japanese version enables it by default, and updated the name entry screen to clearly indicate that L or R changes the character set.
|The Punch-Out!! series|
|NES||Mike Tyson's Punch-Out!!|