News: 11 March 2016 - Forum Rules
Current Moderators - DarkSol, KingMike, MathOnNapkins, Azkadellia, Danke

Author Topic: Street Fighter Zero 2 - Action Replay code for 60hz bypass? S-DD1 mod completed  (Read 2830 times)

snesicom

  • Jr. Member
  • **
  • Posts: 4
    • View Profile
Hi all,

I'm Anthony, from down under Australia.

I'm generally not a tinkerer when it comes to games, but I've joined this forum seeking some insight.

I recently purchased Street Fighter Zero 2, Super Famicom cart, for use with my PAL SNES. Assuming it would work like a Street Fighter 2 Turbo Super Famicom cart I bought as a kid in the 90's, using a Universal Adapter, I tried it out - no good, just jail bars on the screen.

Tried my Pro Action Replay with a PAL game piggy-backed - same issue.

After some research, I found it was due to the S-DD1 security chips in these carts (like Star Ocean), which forbid devices like these adapters from blocking its ability to talk to the security chip inside the SNES to verify region.

I found some information online, showing one way around this, was to open the cart, lift pin 82 on the S-DD1 chip, removing it from ground, and giving it 5v. I performed this modification to force it to PAL, and as such, communicate with the SNES directly (with no adapter), thus allowing its region security procedure to run.

This worked. The game booted up directly slotted into the PAL SNES, however with a warning 'This game pack was not designed for use with your Super Nintendo Entertainment System (PAL)'.

The game continues to boot, and performs its normal game introduction.
I proceeded to play the game, and it played well. That was, until I won my first fight, and the finish 'taunt' screen comes up with Ken on the screen and his one liner...
After that screen, instead of going to the next fight, the 'PAL' warning message comes up again, and reboots the entire game.

Although I bypassed the hardware security in this cart, it appears Capcom has a coded security check to check for region / 60hz perhaps. It teases you and lets you play a bit before rebooting. I found other games around, like Demons Crest on Youtube, does the same thing after playing one level, when using it in a PAL system.

After looking online, I found a good way to see if it was my hardware fix at fault, or a code thing. I downloaded the Japanese Zero 2 ROM, and tested it on ZSNES emulator, with the option 'force PAL' - Identical symptoms! Reboots after one fight and same PAL warnings.

Now you're thinking 'why bother with PAL' and 'ugly borders' and 'slower frames' etc.

You're right, PAL is inferior to the purist, I agree.

But, I have my childhood SNES, and my entire collection is all PAL (so I'm not starting again), except 2 carts, and I'm not really looking to increase my collection any further in future, other than a couple of extra carts here and there. I just wanted Zero 2, because I had all other Street Fighter carts on SNES and just wanted to complete the collection.

A few things I wanted to clear up, and I might be unreasonable so I apologise

- I don't want to hard-modify my console with a new CIC, or a switch for 50/60Hz. Not for the sake for just one Zero 2 cart not working, and not when all my other games work perfect. Seems drastic. I know it'd be beneficial to have an NTSC option if I were to get an Everdrive cart for example, but I know that won't be a path I'd be going down, and I dont forsee any further NTSC titles at this point.

- If I cant get this cart working, I'm not spending 3-4 times the amount on a PAL version of Alpha 2. I'll probably just give up on the idea and just keep the cart for the sake of having all Street Fighter SNES games in my collection. I have Zero 2 on my arcade machine, so I'm not really in it for the fast 60Hz speed or perfection, so if it were to run in PAL i'd be happy to throw it in and play it every now and then on the SNES.

- I dont want to buy a Super Famicom console just for the one cart to work.

- Why bother you ask - it's a challenge I guess, to see if there IS a way to get it working as is in PAL mode, via modification to the cart, or means of action replay.

Now that's out of the way, I'll tell you what I have done to try and troubleshoot.

1. Now that the cart was hard modified to PAL, I thought I'd try the Action Replay route again. With no piggy back PAL cart on the back, Zero 2 boots as normal, however still complaining about 'not designed for PAL'. The action replay does not trick the 50/60hz check.
With a PAL piggy back cart inserted on the rear, the game does not boot, it goes back to a jail-bar screen (as it did prior to modification), assumably due to the security chip being blocked I'd suppose. Universal adapter with piggy back - jail bars. The cart will now only function if directly connected to SNES, or with Action Replay with no piggy back cart, but of course with a PAL warning/reboot after one fight.

2. I found an Action Replay code online for 'Alpha 2', whereby you can select what 'level' fight you want to start at. I entered it in choosing level 2 or 3 from memory as the code, then started the game.
I chose my character at the character select screen, and then it showed 'next fight', and sure enough it started me on 'fight 3' with two other fighters crossed off my list as though I had fought and beat them already (despite only just booting the game) LOL. It left me fight, and I won, and then came the finish taunt one liner with Kens face, followed by 'not designed for PAL', and game rebooted. So basically, the security isn't set to JUST check after one fight, but its set to check after any fight it seems.

3. Upon research online, I found a tool called UCON64. I used it on the Japanese ROM I downloaded of Zero 2, using the switch -f , which removes region check on the rom. It edited the ROM file, and made a new .sfc rom file export.
I used the new rom in ZSNES, with 'force PAL' - issue resolved. No more PAL warning screen, despite being in 'force PAL'
Unfortunately though, not resolved in real life on my actual SNES, as this was fixed by editing a ROM file on a PC.
I then performed a command in UCON64 to check the original ROM file VS the newly modified file (I also performed this check in a normal HEX editor comparing tool) - both gave me this same information:

1 difference between the two files:

Original ROM
0000271c f0

Fixed ROM
0000271c 80

This is where I got stuck. I don't know what I can do with this data.

I guess I was hoping for a solution which is cart based, not console e.g:

1. I thought that there might be a way to use the above data from the fixed rom, to make a Pro Action Replay code (remembering the cart boots with Pro Action Replay, as though it were a PAL cart, provided no piggy back cart is connected). I was wondering if a Pro Action Replay code could be made from this, as a way to bypass the 50/60Hz check.

I can see there's action replay codes to bypass SRAM check here for Donkey Kong Country 2, I have to imagine there's a way for Action replay to bypass the region check:

http://board.zsnes.com/phpBB3/viewtopic.php?f=9&t=10645

Does someone have the ability to read the data from the game to work out how to obtain such Action Replay codes?!

If the above code doesn't help make an Action Replay code - is there any other way to bypass 50/60Hz check without modifying the console?

2. There is a bypass for the S-DD1 hardware chip via forcing it to PAL via pin 82 to + voltage. Are there any further mods which can be done to the one cartridge, to overlook the 60Hz 'PAL' concern?

3. I imagine there'd be a way to re-write the 'fixed' ROM file to the current rom chip in the Zero 2 cart, or replacing it with another chip. Problem is, the costs involved in getting a replacement chip and writing hardware, would just write off the cart, and may as well just get a PAL cart (which I dont want to bother spending money on).

I guess if either of the two above options are possible, please let me know.

Thanks heaps!

rainponcho

  • Sr. Member
  • ****
  • Posts: 275
    • View Profile
Quote
$C0/2717 AD 3F 21    LDA $213F  [$BF:213F]   A:2401 X:0000 Y:0067 P:envMXdizC
$C0/271A 29 10       AND #$10                A:2403 X:0000 Y:0067 P:envMXdizC

==> 80 12
$C0/271C F0 12       BEQ $12    [$2730]      A:2410 X:0000 Y:0067 P:envMXdizC

$C0/2730 9C C7 1D    STZ $1DC7  [$BF:1DC7]   A:2400 X:0000 Y:0067 P:envMXdiZC

Finished whole game. Only that pal check triggers.


edit: Oh wait. Read thread more thoroughly. Let me see if I can make a PAR out of it.

edit2: region unlock - 7E1DC700 (PAR)
« Last Edit: October 19, 2016, 11:35:54 am by rainponcho »

snesicom

  • Jr. Member
  • **
  • Posts: 4
    • View Profile
Hi all,

Thank you for your detailed and prompt responses!

I received responses on here, as well as NesDev forum, as I was trying to get maximum exposure on such a select problem.

'Revenant' from NesDev provided a code C0271C80 - Thanks!

and, on the this forum, I was provided a code 7E1DC700 by user 'rainponcho' - Thanks!

I tested both codes individually on PC, on ZSNES, with 'force PAL'. These were the results:

1. Code C0271C80 - bypassed the boot warning of 'This Game Pack was not designed for your SNES (PAL)'. I played a couple of fights, and after each fight, the next fight came up! It works 100%

2. Code 7E1DC700 - bypassed the boot warning of 'This Game Pack was not designed for your SNES (PAL)'. I played one fight, and directly after the taunt screen following the fight, the 'This Game Pack was not designed for your SNES (PAL)' warning came up, and the game rebooted. Strange that it was able to bypass the initial warning screen though?! It's as though it fixed half the problem.

Unfortunately, in real life (not emulation), I only own a Pro Action Replay 1. I did test code C0271C80 on it - and it did not work at all.
I imagine this to be due Revenant's (nesDev) comment, that only Pro Action Replay 2 or 3 will work with this code due to writing to ROM, not just RAM (if i understood that correctly).

I have not had a chance to test 7E1DC700 code in real life on Pro Action Replay 1 - I'll try tonight - though I imagine if it does in fact beat the initial 'PAL' Hz check screen, that it will demonstrate the same issue that the emulation shows - that the protection kicks in after the first fight is completed. It's as though code 7E1DC700 is part of the equation. Perhaps a second code is needed for the additional checks the game performs?! Not sure. Chances are my Action Replay 1 might not even be capable full stop with either code provided.

So I guess this leaves me with a question. ZSNES allows you to enter multiple codes from different cheat devices. It says 'enter a Game Genie, Pro action replay code etc etc.'. So when you enter in C0271C80 , how do we know which cheat device the ZSNES is emulating?! Is it, it's own cheat engine? Does the code depict which device it needs to use? How do we know this code isn't in fact just working by emulating one certain device. Is there a way to find out what exact device or BIOS zsnes is using to make this code work?

Basically, I want to make certain that a Pro Action Replay 2 will in fact 100% work with code C0271C80, before I spend the money on one. My aim would be to buy an Action Replay 2 (easily available locally), and sell my Action Replay 1 to offset the cost (they seem to sell easy locally which is good). I just dont want to buy an Action Replay 2, to find out, I have to sell it, and chase down a rarer Action Replay 3 from overseas instead.

Any info would be greatly appreciated and thanks for everyone's efforts so far!!

Anthony.


JLukas

  • Jr. Member
  • **
  • Posts: 12
    • View Profile
Watch out, the PAR2 with a BIOS 1.x doesn't support HiROM patching (ie, ROM patch codes that begin with the letter C,D,E,F).  Look for a PAR2 with BIOS 2.x, ask the seller to boot up the cart and check the title screen. edit: Just to be clear, this post addresses the BIOS versions of the PAR2 specifically, not to be confused with the three main releases PAR1 / PAR2 /PAR3.  The PAR2 is already known for people searching for 2.x BIOS carts because the 1.x BIOS don't work correctly with playing PAL Terranigma on a NTSC machine.
« Last Edit: October 22, 2016, 01:21:00 am by JLukas »

rainponcho

  • Sr. Member
  • ****
  • Posts: 275
    • View Profile
Zsnes, Snes9x both apply cheat codes every nmi (frame draw). So every 60Hz or 50Hz. This causes ram cheat code to fail.

Bsnes applies every time 7E1DC700 ram address is read = works okay. Probably Higan also.

I thought that's how PAR1 work - every time ram address is read, it applies the code?? Maybe not though. :)

snesicom

  • Jr. Member
  • **
  • Posts: 4
    • View Profile
Watch out, the PAR2 with a BIOS 1.x doesn't support HiROM patching (ie, ROM patch codes that begin with the letter C,D,E,F).  Look for a PAR2 with BIOS 2.x, ask the seller to boot up the cart and check the title screen. edit: Just to be clear, this post addresses the BIOS versions of the PAR2 specifically, not to be confused with the three main releases PAR1 / PAR2 /PAR3.  The PAR2 is already known for people searching for 2.x BIOS carts because the 1.x BIOS don't work correctly with playing PAL Terranigma on a NTSC machine.


Wow I didnt know that. I already have an action replay 2 in transit before even reading this. Only cost $25. Im very fortunate it was version 2.p firmware listed in the ad. Lucky.
Will let you know once it arrives and I test the fix. Will be a week at least.

Revenant

  • Full Member
  • ***
  • Posts: 205
    • View Profile
I thought that's how PAR1 work - every time ram address is read, it applies the code?? Maybe not though. :)

PAR1 (and the rest) use a RAM-resident interrupt hook to apply RAM cheats every frame.

I didn't know about the PAR2 firmware difference, that's interesting. My guess is that the reason the 1.x BIOS doesn't work correctly with HiROM games is that the PAR2 uses the xx6000-xx7FFF range for its own internal memory, which conflicts with how HiROM games ordinarily map their own SRAM, and only the later firmware is able to actually deal with that correctly.

edit: Are there any actual dumps of 2.x firmware floating around? No-Intro only has 1.0 and 1.1.
« Last Edit: October 23, 2016, 03:52:10 am by Revenant »

snesicom

  • Jr. Member
  • **
  • Posts: 4
    • View Profile
Thank you for all the help put in, this is now working 100% with no console modification.

Ive put some photos up. I really need to get a CRT :)

Basically, once the S-DD1 chip is modified for PAL on the Zero 2 cart (pin 82 lifted, and wired to 5v), you then connect the game to an Action Replay 2 with version 2 BIOS firmware, and enter code C0271C80, in order to bypass the secondary 'this game pack is not designed for PAL' security message.

Once I entered in the code, pressed enter to start game, I flicked the action replays' switch to the top position in order to activate codes, then pressed Reset on the SNES console, and off it went.

Thanks again!