Hidden things in PCE/Turbo games -- post your findings here!

[ccovell]

Hey, folks.  A little idle trawling through the data tracks of Darius and Darius II CD netted me some interesting text fields:

Code: [Select]

DARIUS Version 0.90
Presented by NEC Avenue.
Programed by Masas (Bit's Lab.)
         and Max   (Bit's Lab.)
Special thanks         J.M.Kim
                       Y.TOH
                       Jariten
In Darius II:

Code: [Select]

copyright TOBI soft,programmed by masahiro tobita  $Header: DB.CV  1.8  89/10/11 11:29:30 
TOBI  Exp $ Symbolic debugger Ver 1.30 copyright 1987,88,89 Hudson soft
SDPORT %x,%x,%x,%x,%x format error: SDPORT=APORT,BPORT,CPORT,CMDPORT,DELAY
 PPI PORT = $%04x,$%04x,$%04x,$%04x,$%04x
 SD: We have no 8255 port.
  Target system is   FAMICOM  C62 BOAD  C62  Hu7  Hu7D ROM Version %d.%d
 Rom version is not match. This SD need version %d.%d illegal symbol size. #n=0...9
 not enough memory %02x illegal command %s
 protect off
 protect on
 kanji mode on
 kanji mode off
 can't exec
 This command is supported above v%d.%d ROM
 continue  %04x(%02x%04x)  %s
 Y/N? N
     ^error
This looks like remnants of Hudson's Fami/PCE assembler, as well as real-time debugger that interfaces with the PCE hardware:

Code: [Select]

b# bl b@ bc b- bd be br bm bp b x t u z p @ y/n y@ y* y+ y ? ry rw ro rg rf sd se sf sy sw ad ae af ay aw
cp cn cd ce cf cy cw # n d e l f w m h vp vg vd ve vy vw vf vm vc von vof kj q .sd r not found %s
 #%s BANK %x %x
 illegal mpr number
  %d:%02x

Code: [Select]


 AD[,range>]      :adpcm dump          F<range> data    :fill memory
 AE[address]      :adpcm edit          G[adress][,address] :go
 AF<range>        :adpcm fill          H                :lock history buffer
 AW<range>filename:adpcm write         I filename       :exec indirect file
 AY filename      :adpcm yank          kj               :flip kanji mode
 B                :display breakpoint  L[<range>]          :list
 B[bp][address]   :set breakpoint      M <range> address   :move memory
 BC[<bp>]         :clear breakpoint    N name value        :symbol define
 BE[<bp>]         :enable breakpoint   P[string]           :print symbol
 BD[<bp>]         :disable breakpoint  Q                   :quit
 BR               :reset break count   RG                  :reset go
 B#[address]      :set hard break      RF<range>           :rom fill
 BM[break mode]   :change break mode   RY filname          :rom image read
 CD[,range>]      :color dump          RW<range> filename  :rom image write(MX)
 CE[address]      :color edit          RO filename         :rom image write(BX)
 CF<range>        :color fill          SD[<range>]         :sram dump
 CW<range>filename:color write         SE[address]         :sram edit
 CY filename      :color yank          SF<range>           :sram fill
 CP               :change protect mode SW<range> filename  :sram write
 CN               :change normal mode  SY filename [offset]:sram yank
 D[<range>]       :dump memory         T[N][count]         :trace
 E[address]       :edit memory         U[N][count]         :untrace
 VC[0|1]             :vram change      y@ filename         :read symbol
 VD<range>           :vram dump        y+ filename         :add symbol
 VE[address]         :vram edit        Y/N                 :yes no ask
 VF<range> data      :vram fill        Z[num=command]      :command buffer
 VW<range> filename  :vram write       @[bank]             :bank set
 VY filename [offset]:vram yank        ![command]          :exec dos
 VG<range> address   :vram to mem      ?[exp]    :print expression(hex)
 VM<range> address   :move vram memory /

Code: [Select]

brk ora sxy st0 tsb ora asl rmb0 php ora asl ??? tsb ora asl bbr0
bpl ora ora st1 trb ora asl rmb1 clc ora inc ??? trb ora asl bbr1
jsr and sax st2 bit and rol rmb2 plp and rol ??? bit and rol bbr2
bmi and and ??? bit and rol rmb3 sec and dec ??? bit and rol bbr3
rti eor say tma bsr eor lsr rmb4 pha eor lsr ??? jmp eor lsr bbr4
bvc eor eor tam csl eor lsr rmb5 cli eor phy ??? ??? eor lsr bbr5
rts adc cla ??? stz adc ror rmb6 pla adc ror ??? jmp adc ror bbr6
bvs adc adc tii stz adc ror rmb7 sei adc ply ??? jmp adc ror bbr7
bra sta clx tst sty sta stx smb0 dey bit txa ??? sty sta stx bbs0
bcc sta sta tst sty sta stx smb1 tya sta txs ??? stz sta stz bbs1
ldy lda ldx tst ldy lda ldx smb2 tay lda tax ??? ldy lda ldx bbs2
bcs lda lda tst ldy lda ldx smb3 clv lda tsx ??? ldy lda ldx bbs3
cpy cmp cly tdd cpy cmp dec smb4 iny cmp dex ??? cpy cmp dec bbs4
bne cmp cmp tin csh cmp dec smb5 cld cmp phx ??? ??? cmp dec bbs5
cpx sbc ??? tia cpx sbc inc smb6 inx sbc nop ??? cpx sbc inc bbs6
beq sbc sbc tai set sbc inc smb7 sed sbc plx ??? ??? sbc inc bbs7
 pointer break
 SD: continue exit key break
 memory protection break
 hard pointer break
 violation speed break
 pointer break at bp%d
 real brk fetched
  no address
 break point over
 #       [%02x%04x] %s
 %d %c %04x[%02x%04x] (%04x,%04x)  %s
 no break pointer
 breakpoint list or '*' expected!!
 bad break point list
 no address
 Illegal symbol.
 Symbol not found.
 on off illegal break mode
 illegal break mode
 user break
 memory protection break
 hard pointer break
 violation speed break
 pointer break or real brk feched
 read:  write:  speed: on off A =  X =  Y =  S =  PC =  illegal register name
  A =   X =   Y =   S =   B =     N:  V:  D:  I:  Z:  C:  high  low illegal mpr number
 B = %02x : %02x
 B = %02x :  MPR%x: %02x
 MPR%x:   MPR  %d:%02x %s%02x :  %x
 flag %c = %d :  %x
 can't trace rom area
 %s.sym %s.map can't load %s
 .sym .map r Symbol over
 rb HU00SYM Symbol over
 Symbol over
  Z%d = %s


Code: [Select]

test.bin : main.o pack.o enemyknl.o intr.o conect.o
lk @linkfile
cv test.bx test.bin
copy test.bx bx
se test.sym
HDWRITE TEST.BIN TEST:TEST.BIN

main.o : main.s work.equ equfile.equ macro.src biosw.equ info.equ silver.equ missile.equ laser.equ bomb.equ bigtitle.equ title.equ select.equ zone.equ hiscore.equ proco.equ demo.equ scroll.equ
as -v main.s
pack.o : pack.s work.equ equfile.equ macro.src biosw.equ info.equ syserror.equ
as -v pack.s
enemyknl.o : enemyknl.s work.equ equfile.equ macro.src biosw.equ info.equ dfmacro.src enemyknl.equ silver.equ
as -v enemyknl.s
intr.o : intr.s work.equ equfile.equ macro.src biosw.equ info.equ scroll.equ silver.equ
as -v intr.s

conect.o : conect.s work.equ  silver.equ
as -v conect.s

The rest looks like the strings inside the assembler itself, generated by Borland Turbo C
I looked for MS-DOS .COM or .EXE file beginnings, but couldn't find them... maybe someone else can?

Code: [Select]

Turbo C++ - Copyright 1990 Borland Intl. Divide error
Abnormal program termination

$MAKE  Version 3.5  Copyright (c) 1991 Borland International
 __MAKE__ __MSDOS__ 1 .mak
Available memory %ld bytes

 builtins.mak / define( %s, %s )
 undefine( %s )
 inclib( %s )
 isdef( %s )
 definefile( %s )
 defineedepend( %s, %s )
 defineextension( %s )
      MAKE0000.$$$    process( %s )
 interprule: %s
 NO PATH .PATH. AUTODEPEND SILENT SWAP IGNORE KEEP target = '%s'
 interpcmd: %s
 xcmd = '%s'
 control()
 parsecntrl()
 include undef elif endif else error Expanded to: '%s'
 opening %s
break cd chdir cls copy ctty date del echo erase for if md mkdir path prompt rd rem ren rename rmdir set time type ver verify vol age of %s is %x:%x
 PATH \ COMSPEC   s = %s cmd = %s
 .com .exe .bat    :1・|3・Pullp = %s Search string = %s
 Replace string = %s
 *** %d errors during make ***
 Fatal Error '%s' does not exist - don't know how to make it Unable to execute command: %s Incorrect command line argument: %s Unable to open makefile Not enough memory Error directive: %s Unable to redirect input or output No terminator specified for in-line file operator
 Circular dependency exists in makefile Command arguments too long Unexpected end of file in conditional started at line %d Unknown preprocessor statement Bad filename format in include statement Filename too long
No filename ending Unable to open include file '%s' Macro expansion too long If statement too long Command too long Rule line too long Bad undef statement syntax Misplaced else statement Command syntax error Misplaced elif statement
Misplaced endif statement Illegal character in constant expression '%c' Expression syntax error in !if statement Illegal octal digit Character constant too long Division by zero Redefinition of target '%s' Bad macro output translator


Code: [Select]

make( %s )
 %s is newest
 obj aging %s %lx ? %lx
 rebuilding %s
 Fatal:  Could not create temporary file '%s'
  %s
 exit code = %d cutoff = %d
 
** error %d ** deleting %s
 .   %s  -> %s   Assertion failed: %s, file %s, line %d
 bytesRead > 0 makein.c  $*$*$*
Turbo Make  0x0350 makefile ,0  Syntax: MAKE [options ...] target[s]

    -B%c              Builds all targets regardless of dependency dates
    -Dsymbol         defines symbol
    -Dsymbol=string  defines symbol to string
    -Idirectory      names an include directory
    -K%c              keeps ( does not erase ) temporary files created by MAKE
    -S%c              swaps MAKE out of memory to execute commands.
    -W               write all non-string options back to the .EXE file
    -Usymbol         undefine symbol
    -ffilename       uses filename as the MAKEFILE
    -a%c              performs auto-dependency checks for include files
    -i%c              ignores errors returned by commands
    -n%c              prints commands but does not do them
    -s%c              silent, does not print commands before doing them
    -? or -h         prints this message

      Options marked with '+' are on by default.
      To turn off a default option follow it by a '-',
         for example: -a-

Code: [Select]

Assertion failed: %s, file %s, line %d
 bytesread < UINT_MAX config.c Cannot write a string option.
 MAKE.EXE Cannot find MAKE.EXE
 
Write options to %s? ( Y/N ) [N]:
Enter full path of MAKE.EXE to modify:  Unable to open file %s.
 %s not a MAKE.
 Write error on file %s.
               %s  %d : 
  2147483648  File not found File creation error              !!!!!

Next, Meikyuu no Elfinee has 2 different debug menus in 2 different CD sectors (plus some other hidden text.)  If you copy the unused debug menu over the location of the used one, you get this:

[NightWolve]

Interesting finds. I used Borland's Turbo C++ and Turbo Assembler back in my university days around ~'96. That's what I first started to really learn programming with.

[ccovell]

In Gate of Thunder:

Code: [Select]

HDWRITE Version 2.1 Copyright 1987,88,89,90 Hudson soft
 使用法：HDWRITE ［スィッチ］ パス名 ［グループ名］ ［ラベル名］
-U[M,N] ファイルの追加・更新、[M]は最大値、[N]はオフセット
16進 8桁のバイト値指定、[N]は800Hの倍数であること
-K 指定ファイル以後を全て削除する
-D ファイルに削除マークを付ける
-X ファイルの取り出し
-L 一覧出力
 エラーが発生しました
  がありません
 MD_GROUP__NAME____.EXT____BYTES__YY/MM/DD__HH:MM:SS__RECORD__LENGTH
 これ以後のファイルを削除します。よろしいですか(Y) ?
削除しました READ: WRITE: DELETE: KILL: G:\CD_DOC.DIR
\
\SI_OBJ  N_DEMO.BIN
SYSTEMPOST_GAP4S SYSTEMPRE_GAP 3S

[PixyJunket]

Interesting finds. I used Borland's Turbo C++ and Turbo Assembler back in my university days around ~'96. That's what I first started to really learn programming with.

I started with Commodore 64 BASIC, but I did a lot with Turbo Pascal and Turbo C++ in high school.

[SuperGrafx]

Love this stuff.
It's interesting looking at stuff the programmers never intended you to see.
If I recall, there was one PCE game that had a message from a programmer buried in the data tracks where he provided his company's direct phone number (in case someone had the means and ability to uncover the message). 

Neat little window into the world of the earliest days of console programmer's minds.

[ccovell]

Yes, many early Telenet games have a hidden message by its programmer, giving his then *private* telephone number... ;-)

Once, after I posted some messages extracted from Telenet games (eg: VISUAL DEBUGGER BY ******.  HELLO HU7CD PROGRAMMERS!), "******" himself e-mailed me and kinda gave me the 3rd degree about where I found these messages, and asked me not to share his e-mail address.  But his e-mail footer had his home and work numbers in it.  :-D

Oh, another: the Develo CDs (Assembler, BASIC) are chock full of direct ASM and MML files, but they also contain all the dev & transfer executables/files for the PC-98 and MSX computers as LHA archives on the CD.  Of course the CD isn't ISO-9660, so they have to be extracted through the Develo kit, or manually from the CD binary...

[esteban]

Yes, many early Telenet games have a hidden message by its programmer, giving his then *private* telephone number... ;-)

Once, after I posted some messages extracted from Telenet games (eg: VISUAL DEBUGGER BY ******.  HELLO HU7CD PROGRAMMERS!), "******" himself e-mailed me and kinda gave me the 3rd degree about where I found these messages, and asked me not to share his e-mail address.  But his e-mail footer had his home and work numbers in it.  :-D

Ha! That's pretty amusing.

Did you ever find out how ******* found out about your post?

Perhaps a third-party alerted him? (Even that seems far-fetched, though).

It is crazy that he contacted you, though.

[ccovell]

Yes, a 3rd party did e-mail me, and then the same day I got an e-mail from ******.

[esteban]

Yes, a 3rd party did e-mail me, and then the same day I got an e-mail from ******.

Ha! Crazy.

[NightWolve]

So he coded in his own crediting (which is fine, one way around companies that'll deny you specific credit or outright cheat you out of any, hint hint, X.X.XSEED Games), and then when a fan made that crediting more widely known beyond being tucked away in compiled binary game data, after learning about it, he got nervous/upset and wanted said fan to remove any and all traces of what was posted ? Heh.

I started with Commodore 64 BASIC, but I did a lot with Turbo Pascal and Turbo C++ in high school.

We were in the DOS BASIC era in my High School years on RadioShack Tandy 1000 machines so I guess you were ahead of us, and while I glanced at programs written by others a few times, I never really knew what the heck was going on with them much.

As an aside, I wanted to throw in the history of my first ever videogame hack. Yes indeed, it occurred in High School. When I would get to play around in the computer labs, I once got a hold of a videogame called "Moon Patrol" (for DOS). Well, at some point, I got the idea of wanting to change the "GAME OVER" message to "YOU SUCK!!" I guess I really sucked at it and would repeatedly fail to get very far and that would be why. Heh.

So, at first I used the basic program Microsoft included for editing, edit.com, but what I didn't know at the time was that as a text editor, once you save an open file, it'll scan it byte-by-byte and if it encounters a linefeed character (LF or \n) without a carriage return character (CR or \r) before it, it'll pre-pend one to force the CRLF line breaking standard that DOS/Windows followed unlike UNIX which went with just a single LF character for line breaks.

Obviously, if it's a binary executable and every byte code encountered of 10 is prepended with 13, you're gonna damage the code, not fix line breaks for a text file!! So naturally after I saved my change, the game didn't work anymore... No, I then had to learn about hex editors, and once I did, I tracked down the "GAME OVER" text again in the "Moon Patrol" executable, made my change, saved it, and voila, what was my first ever text hack to a videogame... Given the game's difficulty level, every time I died, it appropriately told me "YOU SUCK!!" cause I'm pretty sure that I did. I just made the game more honest.

Wouldn't have guessed at the time I would go on to do fan translation projects for videogames, but I guess little things like that are where I can back-trace my start/interest in that sort of thing.

[Necromancer]

Is that mini-game still in there?

[Bonknuts]

I used to have a large collection of hidden stuffs from CD projects (and hucards). The 2/5minute game of Gunhed rom has a US NES text/code in it - some adventure game. Aldynes has Castle Quest graphics in the rom.

 In CD data tracks of a lot of game, you'll find 16bit pcm data in the there as well from other games. Sometimes graphics and text of other games they were working on at the time, or just alt graphics. Riot Zone has some character graphics from the Westone arcade version. Beyond Shadow gate has lots of game source code, but also has a text string that read, "look at your own code, you wanker" - or something to that effect. Dracula-x has a hidden 'mini' stage label 'stage-x' with something subtitled in japanese. All the items and chandles are in miniture mode. I could get that to load, but couldn't find the rest of the level data (levels are an accumulated of segments in different sectors of the data track). One of the Far East of Eden games has parts of the source code in it, and it looked like the programmer was having a bad day (lots of use of the F word in there). One of the huvideo games, or motion video games, has a large chuck of the video encoder source in the data track. Gate of thunder has a hidden test level, which I was able to kinda get working; a binary difference search showed the US and JP version showed the US team knew about it and made some small changes.

[ccovell]

Necro: yes, the final game has a shooter, a Head-On/Rally-X clone, an Arkanoid clone, and a quiz game as mini-games.  They're accessible from the regular debug menu in Elfinee.

Aha, I knew it.  That Gunhed ROM has text from Tombs & Treasures (Asteka II on the Famicom), since both were developed by Compile.

That Dracula X mini-stage: isn't it just the "hidden" polygonal stage that you can play when you use a System 2.0 card with Drac X?

[NightWolve]

Yeah, didn't we already have this thread actually, and it was full of those hidden images from Konami I think with the fiery dragon/snake, or whatever it was ? I thought Chris had made it also, but I guess it was Bonknuts. I was gonna look for it when I had the chance, but somebody else might remember better.

That Dracula X mini-stage: isn't it just the "hidden" polygonal stage that you can play when you use a System 2.0 card with Drac X?

Correct, but there's probably a trick (or somebody's hack) to access it with a Turbo Duo as you're stuck with System 3.0 there and it wouldn't make sense to buy an old system card just to access it.

[ishiyakazuo]

In Gate of Thunder:

Code: [Select]

HDWRITE Version 2.1 Copyright 1987,88,89,90 Hudson soft
 使用法：HDWRITE ［スィッチ］ パス名 ［グループ名］ ［ラベル名］
-U[M,N] ファイルの追加・更新、[M]は最大値、[N]はオフセット
16進 8桁のバイト値指定、[N]は800Hの倍数であること
-K 指定ファイル以後を全て削除する
-D ファイルに削除マークを付ける
-X ファイルの取り出し
-L 一覧出力
 エラーが発生しました
  がありません
 MD_GROUP__NAME____.EXT____BYTES__YY/MM/DD__HH:MM:SS__RECORD__LENGTH
 これ以後のファイルを削除します。よろしいですか(Y) ?
削除しました READ: WRITE: DELETE: KILL: G:\CD_DOC.DIR
\
\SI_OBJ  N_DEMO.BIN
SYSTEMPOST_GAP4S SYSTEMPRE_GAP 3S

For giggles, I translated the text.  It's unlikely that this tool will ever be used again, but hey, why not.

Code: [Select]

HDWRITE Version 2.1 Copyright 1987,88,89,90 Hudson soft
 How to use：HDWRITE ［switch］ pathname ［group name］ ［label name］
-U[M,N] File add/update, [M] is the maximum value, [N] is offset
Specified as hex, 8 columns of byte values, [N] is in multiples of 800H
-K Deletes everything from the specified file onward
-D Puts a deletion mark on the file
-X Extracts file
-L List output
 Error occurred
  does not exist
 MD_GROUP__NAME____.EXT____BYTES__YY/MM/DD__HH:MM:SS__RECORD__LENGTH
 Everything from the specified file onward will be deleted.  Is that OK(Y)?
Deleted READ: WRITE: DELETE: KILL: G:\CD_DOC.DIR
\
\SI_OBJ  N_DEMO.BIN
SYSTEMPOST_GAP4S SYSTEMPRE_GAP 3S