Mail has been fixed; you should now be able to confirm your e-mail address, watch pages, and the like.
Please report any issues on Discord.

Super Punch-Out!! (SNES)

From The Cutting Room Floor
Jump to navigation Jump to search

Title Screen

Super Punch-Out!!

Developers: Nintendo IRD, Locomotive
Publisher: Nintendo
Platform: SNES
Released in JP: March 1, 1998
Released in US: October 1994
Released in EU: January 26, 1995


SoundtestIcon.png This game has a hidden sound test.
RegionIcon.png This game has regional differences.
PiracyIcon.png This game has anti-piracy features.


NotesIcon.png This game has a notes page
PrereleaseIcon.png This game has a prerelease article

Super Punch-Out!! is the fourth game in Nintendo's legendary Punch-Out!! line.

Sound Test

Snessuperpunch-sound.png

Hold L+R on the second controller at the opening Nintendo logo for the game's sound test.

(Source: GameFAQs)

Prototype Fragments

Hmmm...
To do:
This needs A LOT more research...

A number of free space areas in the ROM contain copies of bank $00 from a prototype version. Some of these ROM offsets and differences are documented below. See the Notes page for more info.

04E94E-04FFFF

This includes a copy of $007FC0-007FFF which is the cartridge header. The entire first half (which is not required for cartridge operation) is blank.

Proto:

00FFC0 0000 0000 0000 0000 0000 0000 0000 0000 ................
00FFD0 0000 0000 0000 0000 0000 0000 0000 0000 ................
00FFE0 0000 0000 2886 0080 0480 3D9F 0000 F49C ....(.....=.....
00FFF0 0000 0000 2886 0000 0480 0480 0580 F49C ....(...........

Final (US):

007FC0 5375 7065 7220 5075 6E63 682D 4F75 7421 Super Punch-Out!
007FD0 2120 2020 2020 020B 0301 3300 6F01 90FE !     ....3.o...
007FE0 0000 0000 C488 0080 0480 99A2 0000 6DA0 ..............m.
007FF0 0000 0000 C488 0000 0480 0480 0580 6DA0 ..............m.

For reference, here's a summary of the data for the first half of the above retail version header:

7FC0-7FD4 ASCII game title (21 bytes)
7FD5      0x20 = mode $20, no FastROM
7FD6      0x02 = cart type is ROM + battery-backed RAM
7FD7      0x0B = 16 megabit cart size
7FD8      0x03 = 64Kbit SRAM
7FD9      0x01 = country code (North America)
7FDA      0x33 = manufacturer code
7FDB      0x00 = first version
7FDC-7FDD checksum complement
7FDE-7FDF checksum

09446D-095ABF

Much of this fragment is contained in the $099CDB-09D95F fragment; it's easier to just investigate that one instead. The last $0160 bytes, which are exclusive to this fragment, matches up to $0066B7-006816. However, there's no differences except for address shifts.

099CDB-09D95F

The largest fragment found so far, this matches up to approx. $002054-0066B6. Two differences have been found so far:

  • The ending was not yet added. When the Special Circuit is completed the game simply enters an infinite loop (using a BRA $FE operation).
  • The anti-piracy test run after completing the World Circuit (which is responsible for unlocking the Special Circuit) runs a checksum on the entire 32,768 bytes of the first ROM bank, instead of skipping the first 4 bytes as seen in the final game. It's not clear why this change was made. Currently, only one of the first 4 bytes has a known purpose (the checksum generator). The other bytes are still unsolved.

Checksum Generator

If offset $000002 (SNES address $008002) is changed from $FF to $00, the game calls a subroutine on boot up to create checksums used for the Minor Circuit and World Circuit anti-piracy tests, as well as a complete checksum of the entire ROM used for the cartridge header. It attempts to write the calculated values to ROM region, possible on development hardware, but not on a retail cartridge.

Anti-Piracy

Super Punch-Out!!000.png Super Punch-Out!!001.png Super Punch-Out!!002.png

The game contains a much more thorough set of anti-piracy tests than those seen in earlier SNES titles and will display one of the above messages if there's a problem. In addition, what appears to be various error codes will be written to $70000F. The stack test and two jump tests aren't fully implemented and failing them doesn't do anything besides write the error code. They may have been abandoned because of the (rare) possibility of a false positive due to the console's RAM being mostly random on power up.

Boot Up Tests

Emulation Flag

If the console was already in Native Mode, the test fails as this is evidence another program (e.g., a menu belonging to a backup unit aka cartridge copier) was running before the game had a chance to boot. The string System Error !! is written to $7E07F0 in RAM, and Copy Machine !? to the beginning of SRAM (battery-backed memory used to hold the save game data). The 8-bit accumulator is written to $70000F.

Direct Page

If the Direct Page register is non-zero, the test fails. All of the above Emulation Flag info also applies, except that the lower 8 bits of the Direct Page register is written to $70000F.

Stack

If the Reset Vector was at the top of the stack, the test fails. The idea behind this test, as well as next two jump tests, is to look for fingerprints of the various methods that unauthorized attached hardware can use to switch from its programming to that of the game cartridge. Error code: $12

Jump

The beginning of RAM (range $7E0000-7E1FFF) is searched for the pattern $4Cxxxx, where xxxx is the Reset Vector. Error code: $11

Indirect Jump

The beginning of RAM (range $7E0000-7E1FFF) is searched for the pattern $6CFCFF, an indirect jump. Error code: $10

Cartridge Header

The test fails if any one of nine 16-bit values in the cartridge header were modified. Error code: $13

Native Mode
FFE4 COP
FFE8 ABORT
FFEA NMI

FFEE IRQ
Emulation Mode
FFF4 COP
FFF8 ABORT
FFFA NMI
FFFC RESET
FFFE IRQ

Circuit Tests

These tests are run after completing a circuit.

Minor Circuit

A checksum is run on 50 bytes worth of initialization code and data starting at offset $000004 which include the Emulation Flag and Direct Page tests. If the checksum generated doesn't match the hardcoded value, the test fails.

Major Circuit

During the boot process, successfully passing the various boot up tests described earlier will write individual bytes to RAM range 7E7B00-7E7B05 forming the string SPO001 in memory. The test fails if the string isn't an exact match as it means some/all of the boot up tests were bypassed.

World Circuit

A checksum is run on offset $000004-007FFF, which is all but the first 4 bytes of the very first ROM bank. This bank contains a lot of the game engine including the programming for all of the above tests. If the checksum generated doesn't match the hardcoded values, the Special Circuit will not be unlocked. If it was already unlocked, it will be locked again.

Note that many game enhancer cheats, including Galoob's official Game Genie codes published in the 1990s like "Always have K.O. punch after first hit" will cause the checksum to fail. To avoid this, turn any cheats off before pressing Start to proceed from the scoring screen to the next screen.

Regional Differences

In the international versions, the ability to enter your name in Japanese is hidden with a button code. Highlight "New Game" and use any one of these three combinations: X + A, Start + X + A or Start + X. The Japanese version enables it by default, and updated the name entry screen to clearly indicate that L or R changes the character set.