Streets of Rage Online
[ Hacking ]
Info on hacking both the ROM and game savestates. Please submit anything you find; you will get full credit for it.

Savestates
- Game Data
- Character Data
- GFX Data

ROM
- Text
- Music
- Palettes
- Other

Programs
- Trainers

[ Streets of Rage 3 Menu ]

Savestate Hacking: Info
This info is for savestates created by Gens/Genecyst (plus any other emulators that use the same format). You will need to understand hexeditors to make use of this info. Most of this info should work in BK3 with no problems.

Converting to PAR code format & vice versa

The Genecyst format savestate places the beginning of the RAM at offset 2478. This means that any savestate addresses will be 2478 addresses above their real RAM address, which are used by PAR codes. You should hopefully know that the format of a PAR code is XXXXXX:YYYY, where X is the address and Y is the value to set to.

  • To convert a PAR code address to a savestate address, remove the first FF part from the address section (to give a 4-digit number) and then add 2478 in hexadecimal (use the Windows Calculator).
    Example: The PAR code to change the difficulty setting to Very Easy is FFFF09:0002. Remove the FF part to find the RAM address for difficulty; in this case FF09. In the Windows Calculator, add 2478 to get 12381, which is the address you would edit in a savestate. To enable Very Easy you would then place 02 (the value from the PAR code) into 12381 in the savestate.

  • To convert a savestate address to PAR code address, first subtract 2478 from the address in the Windows Calculator. Then place an FF in front of it. The data part of the code is then made up of one of the possible values given for that address.
    Example: The address for making Roo selectable is AD67. Subtracting 2478 from this gives 88EF. Placing FF in front gives us the address part of the PAR code ie. FF88EF. To create the value part you look at the possible values (00 for no & 01 for yes) and use the correct one. This means the code to enable Roo as a selectable character would be FF88EF:0001

    Note: All Genesis emulators have problems with PAR codes. You will find that some codes work on a real PAR but not in emulation and vice versa (often the address will be one address out due to differences in how a code is interpreted).

Savestate Hacking: Game Data
Game data covers things like current stage and difficulty etc.

AD58-9 - Round 6 Switches
AD58 has some effect on the hidden rigth hand lift; moving it above 00 makes the player visible again. AD59 is how many switches are destroyed; 04 appears to work as a good value for both when accessing the hidden areas.

AD5A - Time Remaining in Round 6
Amount of time left before the building is filled with gas, stored as standard decimal value. eg. 60=60 seconds

AD5B - Show/enter hidden areas in Round 6
This activates a section of code not used in normal gameplay. '48' will reveal a hidden exit behind the wall of the top floor of Round 6. Use 08 when you wish to enter the hidden areas. Experimenting with this value has led me to believe that it controls where in Round 6 you will appear when completing a room.

AD67 - Roo selectable
Tells the game whether or not Roo is selectable. This applies to both on the in-game continue character select and on the starting character select screen. 00=No Roo, 01=Selectable Roo

AD68 - 2 Players can select same character
Tells the game whether or not 2 Players can select same character. 00=No, 01=Yes

11986 - End Scene
Normally this is on 00. If moved above 00 it tells the game to end the scene, so your character will walk off screen and/or the screen will fade to black and the next stage will start.

1199D - Stage select available in Options
Toggles whether or not the stage select appears. 00=No, 01=Yes

11F79 - Screen select
This is a powerful address that tells the game to move from one screen to another. Changing this can produce some corrupted graphics, especially if you try to move from in-game. Some values setup another value eg 10 goes to 12 - to access the level select witout bugs, enter 10 rather than 12. Some values appear to use other addresses, as all the cut scenes have a value of 26.

Values:

  • 00 - Unused
  • 02 - Sega logo
  • 04 - BK3 Intro animation (skips to 06 in SOR3)
  • 06 - Title screen intro
  • 08 - (Changes to 0A)
  • 0A - Title screen (animation finished, "Press Start Button" flashing)
  • 0C - (Restarts level, changes to 0E)
  • 0E - In-game
  • 10 - (Changes to 12)
  • 12 - Secret level select (all scenes etc.)
  • 14 - (Changes to 16)
  • 16 - Character select
  • 18 - (Changes to 1A)
  • 1A - Main Menu
  • 1C - (Changes to 1E)
  • 1E - Options
  • 20 - (Changes to 22)
  • 22 - Advance 1 Scene
  • 24 - Advance 1 Scene, then show next cut scene
  • 26 - All cut scenes, credits, BK3 Intro & ending helicopter animation - to view most cut scenes, enter 26 and the level & scene of that preceding it
  • 28 - (Changes to 2A)
  • 2A - Start stage (changing to this restarts the stage)
  • 2C - (Changes to 2E)
  • 2E - Round Clear
  • 30 - (Changes to 32)
  • 32 - Duel in-game
  • 34 - (Changes to 36)
  • 36 - High Score Table
  • 38 - Japanese writing on screen (BK3 Round 1 Intro) - BK3 only
  • 3A - Letter Intro
  • 3C - Round 7(A) Unsuccessful Ending Text
  • 3E - Round 7(A) Successful Ending Text
  • 40 - (Changes to 42)
  • 42 - Duel Win Screen
  • 44 - (Changes to 46)
  • 46 - Axel/Blaze & Skate/Zan info screens
  • 48 - (Changes to 4A)
  • 4A - Demos

11F7B - Scene
Controls the scene you are currently on. Changing it mid-level causes the game to load in that scene's floor plan, which generally messes things up completely. Changing this value on the main menu allows you to select your starting scene (use with 11F7D to select a starting round). Values: 00=Scene 1, 01=Scene 2, 02=Scene 3.

11F7D - Stage
Controls the stage you are currently on. Changing it mid-level causes the game to load in that level's floor plan, which generally messes things up completely. Changing this value on the main menu allows you to select your starting stage. Values: Round 1=00, Round 2=01, Round 3=02... Round 7(A)=06, Round 7(B)=07.

The hidden level select allows you to see how the game organises the levels into Rounds & Scenes.

11F84 - Ash selectable
Tells the game whether or not Ash is selectable on the in-game continue character select. 00=No Ash, 01=Selectable Ash

11F85 - Shiva selectable
Tells the game whether or not Shiva is selectable on the in-game continue character select. 00=No Shiva, 01=Selectable Shiva

12381 - Difficulty Setting
Controls difficulty setting, changing this mid-game doesn't always work. Can be used to access secret Very Easy and Very Hard difficulty settingsin SOR3. Values: 02=Very Easy, 04=Easy, 06=Normal, 08=Hard, 0A=Very Hard

12383 - Lives per continue
Controls the number of lives allotted per continue. 01=1 life, 02=2 lives etc.

12391 - Player 1 Master Character Value
Controls what character to use for Player 1 whenever a stage ends - see Character Data for more information.

12393 - Player 2 Master Character Value
Controls what character to use for Player 2 whenever a stage ends - see Character Data for more information.

12394-95 - Enable Super Zan
Tells the game whether to use Super Zan when playing Zan. Both address must be set to a value larger than 00, usually FF, for it to work. However, changing 12396 to FF also seems to enable Super Zan.

12396-97 - Enable Super Skate
Tells the game whether to use Super Skate when playing Skate. It appears only 12397 needs to be set to a value above 00, usually FF, but it works equally well if both are set to FF.

12398-99 - Enable Super Axel
Tells the game whether to use Super Axel when playing Axel. Setting 12398 only to a value above 00 gives Axel a devastating repeating kick attack, but does not enable his special Dragon Wing which knocks everyone to the floor. Setting 12398 to a value gives Axel his repeating punch and special Dragon Wing.

Savestate Hacking: Character Data
SOR3 stores the data for the onscreen characters' (ie players & punks) status bars in blocks. Each block is (I think) 256 bytes and uses the same layout, so techniques for editing the players can be used to edit the punks and so on. Objects such as bonuses also have blocks but share few of the player/punk values. In this way the game is similar to SOR2. However, lots of the data has been moved around compared to SOR2, so be ready for some changes.

The first block is Player 1, the second Player 2, the third is used only by bosses (anyone confirm this?) and then the rest are the punks, followed by any objects such as containers, bonuses or weapons. The Player 1 block begins at 10379, and to get to the next block you add "100" (it's actually 256 but who cares?), so 10479 is the start of Player 2 data and so on. I will use the same system from the SOR2 Hacking page of having X represent a block number, in this case 3 for P1, 4 for P2 etc.

10X82 (1st digit) - Palette
Changing this obviously changes the colours of the sprite you're editing. Acceptable values are 0, 2, 4 and 6 which represent the 4 on screen palettes. Palette 0 is the player palette used by all 4 characters, the status bar, and most of the punks in their standard incarnations (eg Galsia rather than Joseph). It is possible to use 8, A, C and E, which also represent the 4 palettes. However, the game will interpret any object with this value as being part of the foreground, so the object will be visible through any scenery.

10X82 (2nd digit)-10X83 - Graphics Location
Tells the Genesis where in RAM it will find the graphics for a sprite. Changing the value can give some bizarre results. It can be used to transform a punk; match it to that of a different on-screen punk and also change the punk's 10X85 value to that of the different punk.

10X85 - Character
Changes character/punk. However, in the case of the players, you have to change another value (I've named this the master character value) to make this change permanent, or they will change back at the end of a stage. For Player 1 this value is 12391, for Player 2 it is 12393. Those addresses take the same values as 10X85. For example, whatever the value in 10385, Player 1 will always change back to the character whose value is in 12391 at the end of each stage.

This also doesn't change the graphic set the Genesis is using to create the sprite (especially for punks!). To fully change a punk into another you need to edit both this address and the graphics addresses, which I have yet to isolate. Below is an incomplete & mostly untested list of values that represent the different characters. *=player version

00 - Ash *
02 - Shiva *
04 - Zan
06 - Axel
08 - Blaze
0A - Skate
0C - Roo *

0E - Galsia
10 - Donovan
12 - Signal
14 - Storm
16 - Big Ben
18 - Robot
1A - Biker
1C - Electra
1E - Zack
20 - Goldie
22 - Ninja?
24 - Ninja?
26 - Ninja?
28 - Gunman
2A - Gunman
2C - Gunman
2E - Suzy
30 - Karate guy??
32 - Robot X
34 - ????
36 - Break
38 - Robot X
3A - ???
3C - Mona & Lisa
3E - Ash
40 - Yamato
42 - Yamato
44 - Jet
46 - Rocket
48 - Dr Dahm???
4A - ????
4C - Bruce

4E - Chicken
50 - Money
52 - Gold
54 - 1up
56 - Apple

58 - Knife
5A - Plank(?)
5C - Bat(?)
60 - Grenade
(each weapon will have it's own value)

10XE4 - Health
The amount of health in the player/punk/weapon's health bar. This value is the decimal value (measured out of 104 pixels) divided by 2 then converted to hexadecimal. This gives a max value for this of 34.

10XE5 - Health Bar Size
The size of a punk or weapon's health bar. This value is the decimal value (measured out of 104 pixels) divided by 2 then converted to hexadecimal. This gives a max value for this of 34. Different punks and weapons obviously have different sized bars. The players' bar size cannot be changed from 34.

10XE6 - Health shown on screen
The amount of health currently being shown in the health bar. This will normally be in sync with the "real" health value of 10XE4, and will revert to the real value if changed.

10XF9-10XFB - Score
Score is held as three bytes. Unlike SOR2, the number is converted to hexadecimal. Nudging 10XF9 value will often increase a player's score massively and will give you 3 Score Stars instantly.

10Y03 - Lives
Number of lives for a player or punk. 00=0, 01=1 etc.

10Y19 - Continues
Number of continues for a player. 07=6 continues etc

10Y5D - Score Stars Displayed
Changes with the number of score stars but editing it has absolutely no effect. 00=0, 01=1, 02=2, 03=3. Possibly to do with the number of stars displayed on the status bar. There is no value that can be edited to give a different number of stars; the game simply looks at the number of points you have and gives you them accordingly.

These addresses contain the onscreen text, and can be editing by using my sor3names.tbl file with Hexposure.

P1 Name - 20500-20508
P1 Score Text - 2050C-20517
P1 OK Text - 2051C-2051F
P2 OK Text - 20520-20524
P2 Name - 2052A-20533
P2 Score Text - 20536-20540
P1 Lives Text(?) - 2059B
P2 Lives Text(?) - 205C5

Savestate Hacking: Graphics Data
As you will probably know, the graphics you see onscreen are made up of 8x8 tiles (open up Patterns in Genecyst to see them). Inside the savestate is a map of where to place these tiles in order to create the graphics, which can be easily edited. However, it does not affect the actual floor plan of the level, which is stored elsewhere.

Graphics data is spaced throughout the savestate RAM, with the background, foreground etc being spaced apart. The format used is 2 bytes per tile eg. 4085. The tiles are listed in rows from left to right. In SOR3 the background data begins at the very start of RAM, so the tile selected in 2478-9 will be in the top-left corner of the screen.

The first digit of the first byte is the palette of the tile; acceptable values are 0, 2, 4 and 6 which represent the 4 on screen palettes. Use 8, A, C or E to get the game to interpret the tile as being part of the foreground, so it will be visible in front of everything else.

The three remaining numbers are to select which of the many tiles loaded in RAM should be used. In the example above, 085 means the 85th tile. The tiles start at 12498 in the savestate - use TLP to view them.

ROM Hacking: Info
All info here is for the ROM in binary (.BIN) format. Use SegaTool or similar program to convert a SMD ROM.

Much of the info here can be turned into a PAR/GG code, as the addresses used are identical.
Example: To change Round 1 Scene 1's music to the Boss theme, you would use the address 24F6 and the value 03 to create the code 0024F6:0003. This type of PAR code (without the FF at the start) can be converted to a GG code.

ROM Hacking: Text
Go to Downloads to download TBL files that will allow you to edit all the in-game text. Below are the addresses and what TBL file to use for them.

SOR3NAMES

5AA - Territory Lockout Text
32F6 - Player/Punk Status Bar Names
3866 - Weapon Status Bar Names
5498 - Player Names (not sure where used)
6F9E - Player Names (minus Ash & Shiva - character select screen?)
713A - End of Duel Text
E904 - Press 2up Start
EBEA - Select Player
EDAA - Continue Text
13B18 - Title Screen (note: 0340 0341 0342 0343 is the SEGA logo)
13C9A - Main Menu
487A7 - Character Select Screen (height, weight, number of stars)
489EB - Duel Round Select Names
4A964 - Options (lots of smaller text from this spread out below)
4ABE0 - Difficulties
4B404 - Controls

SOR3INTRO

100 - Header Text
27D8A2 - Letter Intro
27DAE8 - Round 7(A) Good Ending
27DD1E - Round 7(A) Bad Ending

SOR3CUT

246256 - Character Info Screens
2463F8 - Cut Scenes
2488C4 - Weird Unused Text

SOR3CRED

46918 - Ending Credits

ROM Hacking: Music
The musics assigned to each stage are contained in the addresses below. To convert to the BK3 ROM address simply add FB6. R=Round, S=Scene. Refer to the hidden level select shot if you are unsure which stage it refers to.

24F6 - R1 S1 - Warehouse
24F7 - R1 S2 - Harbour
24F8 - R1 S3 - Alley
24F9 - R2 S1 - Street
24FA - R2 S2 - Disco
24FB - R2 S3 - Mona & Lisa Boss fight
24FC - R3 S1 - Construction Site
24FD - R3 S2 - Bulldozer
24FE - R3 S3 - Elevator
24FF - R4 S1 - Subway
2500 - R4 S2 - Subway 2nd section
2501 - R4 S3 - Yamato Boss fight
2502 - R5 S1(A) - Syndicate hideout first room
2503 - R5 S1(B) - Syndicate hideout second room alternate exit #1
2504 - R5 S1(C) - Syndicate hideout second room alternate exit #2
2505 - R5 S1(D) - Syndicate hideout second room alternate exit #3
2506 - R5 S1(E) - Syndicate hideout second room alternate exit #4
2507 - R5 S1(F) - Syndicate hideout third room
2508 - R5 S2 - Syndicate hideout upstairs
2509 - R5 S3 - Elevator
250A - R6 S1 - Corridors
250B - R6 S2(A) - Trap & Switch Rooms
250C - R6 S2(B) - Trap & Switch Rooms
250D - R6 S2(C) - Trap & Switch Rooms
250E - R6 S2(D) - Trap & Switch Rooms
250F - R6 S2(E) - Trap & Switch Rooms
2510 - R6 S2(F) - Trap & Switch Rooms
2511 - R6 S3 - Jet Boss fight
2512 - R7(A) S1 - Wastelands (Hidden Motorbike Stage)
2513 - R7(A) S2 - Forest
2514 - R7(A) S3 - Robot Factory
2515 - R7(A) S4 - Dr Dahm Boss fight
2516 - R7(A) S5 - Robot Y Boss fight
2517 - R7(B) S1 - Bridge (Hidden Motorbike Stage)
2518 - R7(B) S2 - Outside City Hall
2519 - R7(B) S3 - Inside City Hall
251A - R7(B) S4 - Shiva Boss fight

The values you can use in these addresses are as follows. I've referred to the BGMs as they appear in the game. Some values don't seem to work on certain stages - both the Robot Y & Shiva stages have FF as a value, which does not work elsewhere.

  • 00 - Unused music, not listed on sound test
  • 01 - R1 S1 - Warehouse
  • 02 - R3 S2 - Bulldozer
  • 03 - Boss theme
  • 04 - R3 S1 - Construction Site
  • 05 - R5 S2 - Syndicate hideout upstairs
  • 06 - R7(B) S2&3 - City Hall
  • 07 - R2 S1 - Street
  • 08 - R7(A) S2 - Forest
  • 09 - R1 S2 - Harbour
  • 0A - R7(A) S3 - Robot Factory
  • 0B - R7(A) S4 - Dr Dahm Boss fight
  • 0C - R4 S1 - Subway
  • 0D - R4 S2 - Subway 2nd section
  • 0E - R2 S2 - Disco
  • 0F - Ash's theme
  • 10 - R3 S3 - Elevator
  • 11 - Yamato's theme
  • 12 - Robot X's theme(??)
  • 13 - Jet's theme
  • 14 - Character select
  • 15 - Round Clear
  • 16 - Game Over
  • 17 - R5 S1(A-F) - Syndicate hideout second rooms
  • 18 - Ending
  • 19 - Bad End 1
  • 1A - Bad End 2
  • 1B - Bad End (slow - unused in game??)
  • 1C - Bomb rumble (BK3)
  • 1D - BK3 title screen sound
  • 1E - Bomb rumble (BK3)
  • 1F - Smashing sound (BK3)
  • 20 - R7(A) S5 - Self destruct sound
  • 21 - Bomb ticks & footsteps - R1 intro (BK3)
  • 22 - Bad End?
  • 23 - Bomb blast sound (BK3 intro)
ROM Hacking: Palettes
The palettes are stored in the standard format.
47F20 - Axel Alternate Duel Palette
47F40 - Blaze Alternate Duel Palette
47F60 - Skate Alternate Duel Palette
47F80 - Zan Alternate Duel Palette
47FA0 - Roo Alternate Duel Palette
(For the BK3 address, add 9B8)
ROM Hacking: Other

13E3F - Starting continues
Number of continues you start with. Normal is 03=2 continues

118B3 - Apple heal amount
Amount of health added when an apple is picked up. Normal is 14; this is the same format as the health bar, so it's the number of pixels divided by 2 then converted to hex.

118C3 - Chicken heal amount
Amount of health to set to (not add) when a chicken is picked up. Normal is 34 (ie full health); this is the same format as the health bar, so it's the number of pixels divided by 2 then converted to hex.

47F16-1F - Character Select Screen Construction (1)
Controls what character to brings up onscreen when moving cursor. The format is 00 XX 00, where the XX values are the same as used in RAM, so Axel is 06, Roo is 0C and so on.

4846A-73 - Character Select Screen Construction (2)
Controls what character to select when a character is selected (it is possible to have for the character onscreen and the one selected for the game to be different). The format is 00 XX 00, where the XX values are the same as used in RAM, so Axel is 06, Roo is 0C and so on.

Programs: Trainers
Porfa's trainer for BK3 allows you to change your character, lives, health, difficulty and round ingame, and can access the hidden levels. It also has a nice set-skip option which allows you to complete a scene without killing the punks! It's available for download here.

Note: You will require Gens 1.00 & a copy of the BK3 ROM.