Here, you'll find a little hacking guide (far from being finished yet) for Boycott Advance and Visual Boy Adavnce savestates of the European version of Sonic Advance ROM.

Note : this guide is far from being finished yet, probably some new info will maybe soon revealed, who knows ?

Note (for the Frenchies) : cette section est pour l'instant en Anglais (car la communauté anglaise a l'air de mieux s'intéresser aux bidouillage des jeux ;)). Mais je la traduirai vraisemblablement ;). 


Ya know, even games like Sonic Advance can be hacked the same way as we did with Genesis Sonic games! Yes, my friend! There exists two methods to hack Sonic advance :

  • the first one consits in a direct editing in a portion of RAM called Internal RAM using Boycott Advance debugger (debugger is not activated by default in Boycoot Advance, you have to edit the BoycottAdvance.ini file, find a section called "## Debugging Features ##########" and finally write "1" on the field "DebugMenuEnable" instead of "0"). It's the one I use, I think it's also the easiest one (because changes are immediately seen on the screen). Note : that feature only exist in Boycott Advance emulator, Visual Boy Advance only has a RAM viewing feature. Last minute : Visual Boy Advance version 1.1 now has an RAM editing possibitiy, wow ! Just go a few sections lower to see how to hack using Visual Boy Advance Debugger !!
  • the second one consists in editing a savestate (Boycott or Visual) with an hexeditor. But you must decompress it first by renaming the savestate file into a gz file and decompress it with WinZip. Here, you'll be able to hack.

Well, let's explain them in details.

RAM editing with Boycott Advance debugger

If you did the manipulation above correctly, a Debug menu should appear beside the others on Boycott Avance menu bar. Let's take a look at it. But load your game fisrt. Start a normal adventure with any character. Now, open the Debug menu. Go to "Select Memory Address" and select "Internal RAM". Now, go back up and select "Show Memory". A dialog box showing data starting at the offset 03000000 should appear. To hack, simply double-click one line and you'll be able to edit it in real time, yay ! Now, you can go to the Startup data section in this guide to look for the interesting locations to hack ;).

RAM editing with Visual Boy Advance debugger

Make sure first not to be in fullscreen mode. If it isn't the case, go into the 'Video' menu and select 'x1' or 'x2' or etc. but not fullscreen modes. Debug features will not work in fullscreen. Just go into the Tools menu and select the 'Memory viewer' option. A dialog box should appear. You can select '0x03000000 - IRAM' as viewing location, it's even recommended :p ! You can also see a text field on upper right corner with a 'Go !' button. It's the place for typing specific offsets without searching or scrolling during hours. Don't forget also, to tick the 'Automatic update' option at the lower left corner of this dialog box. Data in this memory viewing window will be automatically updated each time game status is different (ex. permanently changing values as time or animations values can be seen updated each time they are modified by the game). This will keep you from jungling between game and debugger window (because joystick is still active when debugger is active, unlike Boycott Advance). And, I forgot the most important : to hack, simply click on a value, you'll see a black cursor that will let you modify the current value where it's pointed on, yay ! Now, you can go to the Startup data section in this guide to look for the interesting locations to hack ;).

Savestate hacking and decompression

Well, for savestates, it becomes a bit tricky as they are compressed in GZ format. Fisrt, you have to take a savestate during an adventure playing with any character. Now, rename the savestate file by adding to the existing extension (.cot to .co9 for Boycott and .sgm for Visual Boy Advance) the ".gz" extension (it becomes for example .cot.gz, .sgm.gz). Now, open it with WinZip and decompress it. Now, you can look at the Startup data section to see what are for the moment the interesting locations to hack ;). And, when you finish hacking, there's no need to recompress it again in GZ format. Just let the file extension with its original name (if you added the gz extension like mentionned below, the decompressed file should then be .cot or .sgm for example) and it will be automatically recognized by the emulator ! (thanks LOst for this info ;)).

Now, it's time to hack..

Startup Data

You'll find here a little table of the things we're currently able to hack for the moment. First column is the offsets in Inernal RAM, the second one the offsets for a decompressed Boycott Advance savestate, the third one the offstes for a decompressed Visual Boy Advance savestate and finally the fourth one the description of the data corresponding to these offsets. OK, let's go :

 

Internal RAM offset

Boycott Advance offset

Visual Boy Advance offset

Data description

03004FEC

451B9

 51CB

Rings in 16-bit format. Takes effects immediately but counter blocked to 999 if higher value.

 03005024

451F1

5203 

Number of lives (takes effect immediately but the counter will stay blocked to 9 even if you have more)

03005030 

451FD 

520F 

Score in 32-bit format. Takes effect immediately. But counter displays glitched sprites if value higher than 7FFFFFFF ("FF FF FF 7F" when editing if you are in a one-byte ordering system).

 03005034

 45201

5213 

Timer in 24-bit format. Takes effect immediately. And, if you put "FF FF FF", you'll die of course.

0300505C

45229

523B

Put 01 to enable Time Attack mode. Pause the game and you'll have the traditionnal Time Attack menu !!! (Change Act, Change Character, etc.)

03005078

45245

5257

Rings in special stage in 16-bit format. "Now it's easy to finish the Special Stage now, with any character" (LOst). [found by LOst]

 03005084

45251 

5263 

Character in game. 00 = Sonic, 01 = Tails , 02 = Knuckles and 03 = Amy and upper values give you a corrupted Sonic (impossible to move and jump). You need to pass a level to get the modification effective !!! If you die, only the live counter will be changed.

03005088 and
0300508C 

45255
and
45259 

5267
and
526B 

Well, don't know how this works but when both values are 02, it gives you Sonic and Tails together.

 0300514C

45319 

 532B

The current zone you're in. Values go from 00 to 0D where 00 is NGHZ act 1, 01 NGHZ act 2 and OD is X-Zone. Like on a Genesis, you need to die for the change to be fully effective. Infact, when you change the value, graphics are not glitched at all, you just have some objects that change their aspect (moving plateforms, jumping plateforms/clouds, etc.) and look like the ones you find in the level where you want to go.


Note : Visual Boy Advance offsets have been originally found by LOst. I deduced other values by simple hex calculating.Other thing, about conversions : you must subsract 2FBFE33 to an Internal RAM offset to get the Boycott Advance savestate one (BA offset = IRAM offset - 2FBFE33). And you must substract 2FFFE21 to an Internal RAM offset to get the Visual Boy Advance savestate one. Well, I hope this will help you more in finding new things to hack in this game, whatever the hacking method you use ;).

Remarks about level switching

It's possible to go to X-zone with any character (the floor starts to move in the zone you're in but the level layout is unchanged !!!) but it will just show you a Super Sonic sprite, replaced by the current character chosen when you die !!!! And, finally a last thing about levels, if you put a higher value than 0D, you'll have twin versions of the same zones but with different names (the word "chao" appears in all these zones like chao forest, space chao...) and no object layout in them !!!! And it's also impossible to complete them because of their looping structure. No, these zones are NOT beta zones, maybe test zones or secret zones you only access from the Tiny Chao Garden (??). Dunno, maybe... And I forgot a thing about level switching. It appears, when you switch to another level by hacking, that the status data for time and X,Y positions are kept !!!! It means that when you switch to a level at 4:56:12 for example, well you start the next level at 4:56:12 and oftenly inside a wall !!!! (because X,Y positions are wrong) And the game behave like a Genesis one : when you want to go left, the character moves very quickly to the right and vice versa... it seems that Sonic Advance has a similar game engine to Genesis Sonic games.

- A person named Catweed emails me and tells me that the "twin levels" we're talking about are accessible via a special multi-player mode called "Chao Hunt". So, they're no longer hidden levels. Thanks a lot for this info, Catweed ;). The article that revealed that info was found here : www.jeuxvideo.com.


Menu and option selected data

Mostly, data relative to options selected in menus (like sound in sound test or option in option menu, etc. Here's a table of the interesting locations to hack that I've just found :

 

Internal RAM offset

Boycott Advance offset

Visual Boy Advance offset

Data description

03002552

4271F

 2731

Option selected in main (title) menu. Becomes 030028A2 if you enter this menu not for the first time (or if you entered other menus first). 00 to 05 are conventionnal values for 'game start', 'options', etc. Other numbers will either crash the game or give you some other ingame menus. OK, here they are :

- 0F = Time attack game
- 10 =  Time attack records per character
- 1E = Player data viewing
- 21 = Sound test
- 22 = Language select
- 2A = Name entry menu
- 2B = All time attack records for current player 

 03002A32

42BFF

2C11

Option selected in 'Options' menu. 00 to 07 are conventionnal values for 'player data', 'level', 'time up', etc. Others numbers will crash the game or give you the famous 4-bar screen (example : value '08' will give you that 4-bar thing)

0300271C

428E9 

28FB

Sound/music selected in sound test. And yes, you can go higher than 39 or 42 !!! Up to 255 to be exact. But a lot of values are not affected and some of them are redoundant or simply reproduce the musics we know. What I recommand is to set this value to 'FE' and decrease it progressively in sound test, by selecting with the left direction button, sounds # 254, # 253, # 252, etc. (attention, if you increase it accidentally, you'll go back to normal sounds and will not be able to listen to hidden sounds again!). OK, here are some interesting sounds to listen to (decimal or sound test values) :

Hidden music :
- 54 (=109, multi/singlepack waiting music)
- 58 (=121)
- 68 (=127)
- 72 (=133) 

[Dioxaz's note : that's no longer hidden music, since they had been discovered all to be multi-pack game musics -- but I just ignore which event they correspond to :P -- please, you can tell me what correspond these musics to, by mail or on The SSRG message boards]

SFX :
- 223 (beep, option select)
- 224 (character select noise)
- 225 (chao voice saying something like "ohimok'p pop")
- 226 (weird noise, probably simulating wind ?)
- 227 (weird bass pitch changing noise...) 

03002749

 42916

2928

Level selected in level select menu. Becomes 030023F9 for 'time attack' or if you enter this menu not for the first time (or if you entered other menus first). Let you change the current level selected even if you don't have unlocked this level (it will appear in grey this case). And like for the level switching value, values go from 00 to 0D and Moon Zone is accessible with any character with the same glitches as those I mentionned a bit higher on this page. And, of course, values higher than 0D will give you access to chao hunt zones.

0300285C

42A29

2A3B

Becomes 03002874 for 'time attack' or if you enter this menu not for the first time (or if you entered other menus first). Sprite selected in character select menu where 80 is Sonic, B0 is Tails, EC is Knuckles and 28 is Amy. Other values will freeze the game or give you glitched sprites or crap.


Savegame or battery relative data

You know, it's that data which is stored in those famous *.sav files generated by GBA emulators. But, hacking directly into these files is not that easy. Worse, you can even loose all your savegame data, just by changing one byte into those files. This is mostly due to built-in integrity checkers stored in thoses files. If you change a value without reporting this change into these intgrity values, all your savegame data (aka completed levels, chao rings, time attack records, etc.) will be lost !!! So, I propose you a rather more friendly method to hack this special data : directly hacking into RAM or savestates ! All that without caring of integrity checkers (because they are automatically rewritten when a change is made into this data in real time). Savegame or battery data start at offset 03005160 in Internal RAM (or 4532D for a decompressed Boycott Advance savestate and 533F for a decompressed Visual Boy Advance one). OK, here's a table of the interesting locations to hack that I've found for the moment :
 

Internal RAM offset

Boycott Advance offset

Visual Boy Advance offset

Data description

03005168,
0300516A,
0300516C
and
0300516E

45335,
45337,
45339
and
4533B

5347,
5349,
534B
and
534D

Respectively, last levels completed by Sonic, Tails, Knuckles and Amy. Level values are the same as mentionned above (00 for Neo Green Hill act 1, 01 for NGHZ act 2, 02 for Secret Base act 1, etc). Maximal value is 0D (OF when X-Zone has been completed by Sonic).

 03005170

4533D

535F

Player's name for player's data (6 characters/symbols maximum). Capital letters are in ASCII but other symbols use some other code. Try and see what happens :p.

03005584

45751

5763

6-Emerald activation (writing 01 instead of 00 at this offset will give you access to X-Zone and extra musics in sound test, aka musics #40, 41 and 42).

03005588

 45755

5767

Ring number in Tiny Chao garden (16-bit format). I think the maximal value we can have is 'FFFF' but I'm not sure.

0300558A

45757

5769

Integrity checking value (16-bit format) for Sonic and Knuckles completed levels and chao rings (and maybe more things). Touching at this value won't do anything because it is automatically corrected when you enter something wrong. And no, your savegame data will NOT be lost if you do something here. So, I purely recommend to forget about it ;)...

0300558E

4575B

576D

Integrity checking value (16-bit format) for Amy and Tails completed levels (and maybe more things). Touching at this value won't do anything because it is automatically corrected when you enter something wrong. And no, your savegame data will NOT be lost if you do something here. So, I purely recommend to forget about it ;)...


Little remark about modifying savegame data in realtime : to automatically update integrity checking values, you must enter the option menu and get out of it ABSOLUTELY. Or, all your changes will not be effective. I don't know, but when you enter option menu and get out of it, it forces the game to make an integrity checking routine and update, if necessary, integrity checking numbers.

I recall you that this page is under construction, that means that it's far from being finished (aka, I'm sure, lot of things to come soon ;)).

Well, that's all about savestate hacking in Sonic Advance emulation. If you ever have questions, remarks to make or if this document contained mistakes, just don't hesitate : sonic-discovery@fr.st for my e-mail address (the one from the site) and le forum Sonic-Online (for French people - section 'émulation' cette fois) and The SSRG message boards for English people.