Dreamcast: ADnova's guide to the Dreamcast Hacking

@Dreamcast

Published in 

Dreamcast

 · 5 years ago

ADnova's guide to....... 

 
                    *****Dreamcast Hacking***** 

                          Version 1.11 
                         October 6, 2001 

--------------------------------------------------------------------- 
                        Table of Contents 
--------------------------------------------------------------------- 

 
1) ............. Introduction 
  a) ........... What's new 

2) ............. Review of basic hacking methods and knowledge 

3) ............. Dreamcast Code Breaker code types 

4) ............. Uses of the different code types 
  a) ........... 00-type 
  b) ........... 01-type 
  c) ........... 02-type 
  d) ........... 04-type 
  e) ........... 05-type 
  f) ........... 0D-type 
  g) ........... 0E-type 

5) ............. Dreamcast Joker commands 
  a) ........... How to use Joker commands in DC codes 

6) ............. Hacking with Code Breaker 

7) ............. Credits and thank-you's 

8) ............. Legal garbage and contact information 

 
--------------------------------------------------------------------- 
1) Introduction 
--------------------------------------------------------------------- 

Hacking for Dreamcast isn't quite the same as hacking for Playstation 
or Nintendo 64. No GS pro, no game trainers, no hacking utilities to 
use (not yet anyway). I wrote this guide to help people who want to 
hack their own codes for the DC. Where I can I'll use examples to 
clarify how to use a code. Any problems or questions about the guide 
or DC hacking, let me know. 
One important thing - you must have either a Code Breaker or an 
Xploder to hack your own codes. You can try with the Game shark 
CDX, but this guide won't help you with that device. The reason is 
because Gameshark CDX codes are encrypted, which makes many of the 
hacking methods described below difficult or impossible. 
Also, throughout the guide I will only refer to the Code Breaker, 
however all of the guide can be applied using the Xploder. 
I have assumed that the reader has at least some basic knowledge of 
hacking for other platforms, but the review is there for those that 
don't. 
This is the first guide I've ever written, so I guarantee that there 
will be something wrong somewhere. 

A) -- What's new -- 

Version 1.11 - Since this guide is now up at hacking 101, I fixed up 
some mistakes and tried to make certain parts easier to understand. 

Version 1.01 - A few minor updates, spelling/grammar fixes, and stuff 
like that. 

Version 1.00 - First version of this guide. I plan on adding much more 
information about Dreamcast hacking, as soon as I learn it myself. 

 
--------------------------------------------------------------------- 
2) Review of basic hacking methods and knowledge 
--------------------------------------------------------------------- 

If you're already an experienced hacker, then go ahead and skip this 
section. If not, then read up and hopefully you'll learn something. 
Also - all numbers in this guide are hex numbers, unless stated 
otherwise. 

 
--Hex-- 
First of all, you need to learn hex. Hex is a counting system that has 
16 digits instead of the normal 10. It's really quite simple, but you 
should at least be familiar with it before you try to hack anything. 
Why should you learn it? Well, because every code you see is actually 
in hex. So, if you want to make your own codes, you need to know what 
the numbers mean. 

This table shows you all you need to know for now: 

Decimal number 		Hex number (a.k.a. hexadecimal) 

	0          ---->            0 
	1          ---->            1 
	2          ---->            2 
	3          ---->            3 
	4          ---->            4 
	5          ---->            5 
 	6          ---->            6 
	7          ---->            7 
	8          ---->            8 
	9          ---->            9 
	10         ---->            A 
	11         ---->            B 
	12         ---->            C 
	13         ---->            D 
	14         ---->            E 
	15         ---->            F 
	16         ---->           10 

This is just meant to give you an idea of how it works. Save yourself 
the headache of trying to convert from one to the other and just use 
a program that converts hex to decimal (and vice-versa). If you have 
windows, use windows calculator with scientific view. 

--Anatomy of a code: Addresses, values,  prefixes, floats and bytes-- 

Hold on to your brain - this could get complicated. :) 

First, you should know the layout of a basic Dreamcast code: 

0?-AAAAAF 
VVVVVVVV 

The prefix: the prefix is the ? in the code. It tells the Code Breaker 
what type of code you're using. 

The address: this is the AAAAA in the code. This is what part of the 
RAM that the code will be affecting. 

The float: The float is the F digit in the code. This is part of the 
address. 

The value: The value is the VVVVVVVV in the code. The value tells the 
Dreamcast what number to put at the address. 

To better explain what each part does, and what a byte is, look at the 
following figure: (This will look familiar if you've ever used a hex 
editor) 

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0C32EFA?   00  00  00  00  FF  00  00  00  00  00  00  00  00  00 00  00 

Explanation: the number 0C32EFA? is the address. For now, you can 
ignore the 0C part of the address. All DC RAM addresses have 0C at the front 
of the address, because that's where DC's RAM is located (more about that 
later). It is not the prefix, and it isn't actually used when inputing a Code 
Breaker code. 
The hex numbers from 0 to F above the sets of double zero's are also 
part of the address. Each double zero is a 'byte' and that is where the values 
are located. Here, we have the value 'FF' at address '0C32EFA4'. The 4 in the 
address comes from the part where the value is located. Here it's 4, so the 
address is 0C32EFA4 (and 4 replaces the ?). For future reference, this part 
of the address will be called the 'float'. Make sense? 

One futher note: a byte is made up of two hexadecimal digits. It does NOT 
have to be two zero's. I use zero's just to make it clear what is being 
affected or changed. 

If this were an actual code, it might be: 

00-32EFA4 
000000FF 

That's all you need to know for now, next to know are the different 
prefixes that you can use. 

 
--------------------------------------------------------------------- 
3) Dreamcast Code Breaker code types 
--------------------------------------------------------------------- 

What a code does depends on the prefix. The prefix tells the Xploder 
what to do with the numbers that follow. That said, that are several 
code types (meaning: what prefix the code has), that you should know 
about. Each will be explained in more detail later, this is just a 
general overview. All of the information on code types here is based on 
the information at www.cmgsccc.com 

 
00 code type: This code has '00' as a prefix. The normal layout of this 
type of code is: 

00-AAAAAF 
000000VV 

As you can see, the value (VV) is only one byte. The value must be between 
00 and FF, since the first six zero's in the value are ignored. 
The float(F) can have any value, from 0-F. 

 
01 code type: The prefix for this code type is '01'. The float for this 
code type must be even, ie: 0,2,4,6,8,A,C,E. The code looks like this: 

01-AAAAAF 
000000VV 

You'll notice that this code type affects two bytes (VV VV), so the value 
can be from 0000-FFFF. The first four zero's are ignored. 

 
02 code type: This type of code affects four bytes, and is laid out like 
this: 

02-AAAAAF 
VVVVVVVV 

Here, the float must be 0,4,8, or C. The value here can be from 00000000 
to FFFFFFFF. 

 
Right now you might be wondering why the float has to be certain values 
for the different code types. Let me explain with an example, from 
Skies of Arcadia: 

Ship parts item modifier (slot one): 

01-56E704 
0000???? <---item digit goes here. 

Max ship parts modifier (slot one): 

01-56E706 
00000063 

Note that both codes are 01 code types. This means that they each affect 
two bytes, but there's more to it than that. Lets break down the first 
code: 

 
           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0C56E704   00  00  00  00  ??  ??  00  00  00  00  00  00  00  00  00  00 

Since the 01 code type affects two bytes, it also affects two float 
numbers. Let's look at the second code: 

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0C56E706   00  00  00  00  00  00  00  63  00  00  00  00  00  00  00  00 

This code affects two bytes, and the float from 6-7. We can easily combine 
these two codes, with the 02 code type. 

Max ship parts item modifier (slot one): 

02-56E704 
0063???? 

The code would look like this: 

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0C56E704   00  00  00  00  ??  ??  00  63  00  00  00  00  00  00  00  00 

The 02 code type affects four bytes and four floats. 

Since the 02 type codes write to four bytes (and floats), 
it can only start at every fourth float. Confusing enough? Anyway, back 
to the different code types: 

 
04 code type: This code type has basically the same effect as the '50' code 
type on the Gameshark Pro for Playstation. It's useful to combine many 
codes into one. I'll save explanation of this code type until later, 
here's the layout and brief explanation for now: 

04-AAAAAF 
WWWWZZZZ 
VVVVVVVV 

The AAAAAF is the address where the code starts. WWWW is the number of 
addresses that the code will affect. ZZZZ is how much the current address 
is to be incremented by to get to the next address in the code, mulitplied 
by four. The reason that ZZZZ is multiplied by four is because the value 
written to each address in the code, VVVVVVVV, is the same type that 
the 02 code type has. Meaning that at each address, four bytes are 
written to. That also means that the float must be 0,4,8, or C. 

 
05 code type: The layout: 

05-AAAAAF 
VVVVVVVV 
ZZZZZZZZ 

This code will copy ZZZZZZZZ number of bytes from the address AAAAAF, 
to the address VVVVVVVV. Normal codes only allow you to write to the 
DC RAM, addresses 0C000000-0CFFFFFF. Well with this code you can write 
to any area in the DC memory. The float in this code can range from 0-F. 
More about this code type later. 

 
0B code type: Codes with prefixes '0B' seem to be enable codes. I have only 
seen them used on two games, Shenmue and F355 Challenge. That's pretty much 
all I know about them. 

 
0D code type: An activator code, similar to the D0 type code used on 
Nintendo 64 and Playstation. The layout for this code type is: 

0D-AAAAAF 
000ZVVVV 

This code will check a certain condition, indicated by the value of Z. 
The possible Z values are: 

0 = If equal to 
1 = If different to 
2 = If less than 
3 = If greater than 

The code reads the condition type, then goes to address AAAAAF and checks 
the value(VVVV) at that address. If the condition is true, then it 
'activates' the next two line code. If not, then it doesn't activate the 
next two lines. To clarify, you would actually enter four lines under 
one code description, something like this: 

0D-123456 
00000001 
01-123456 
0000000A 

In this example, Z=0, so the condition is If equal to. The value at address 
123456 is checked, and if it is equal to 1, then the next two line code is 
activated. As you can see, when the next two line code is activated, the 
value at address 123456 becomes A. 

 
0E code type: This code type is also an activator, but is used to activate 
more than 2 lines of codes. Layout: 

0E-WWVVVV 
0ZAAAAAF 

All of the terms have the same definitions as in the 0D code type, but 
there is now one new term, WW. The value in WW tells the Code Breaker how 
many lines of codes to activate if the condition is true. The value 
in WW can be odd or even. This code type will be explained in more detail 
later on. 

 
0F code type: 

The following information is taken straight from Code Master's DC code 
types FAQ (although it's slightly modified to be consistent): 

"Format: 0F-AAAAAF 
         0000VVVV 

AAAAAF = Address 
VVVV = 2-byte Value 

Functionality: This is one of the least common code types. 
It simply writes the given 2 byte value, VVVV, to the given address, 
AAAAAF BEFORE anything is run for the game. Used for games like PSO that 
require Enable Codes and such. (The float MUST be even.)" 

So, as you can see this code will write to the specified location before 
the game even starts to run. And also, the float must be 0,2,4,8,A,C, or 
E, just like the 01 code type. That is all I'm going to say about this 
code type in this version of the guide. 

--------------------------------------------------------------------- 
4) Uses of the different code types 
--------------------------------------------------------------------- 

The first three code types we deal with are quite simple (00, 01, and 
02 types). What prefix to use depends on either the size of the value, 
or how many bytes you want to change. 

A) -- 00 code type -- 

Use this code type when you only want to change the value in one byte. 

Example: Say you want a code to give you 'max health' in a game. If the 
max health you can get in the game is 270F (9999 decimal), that means that 
the code you use should affect two bytes, but what happens if you used the 
00 code type? Look at the following example: 

            0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0C320BA4    00  00  00  00  ??  ??  00  00  00  00  00  00  00  00  00  00 

So, for this game, the addresses that control health are 320BA4 and 
320BA5. That covers two bytes and floats, and 00 affects only 1. If you 
entered the code: 

00-32BA25 
000000FF 

Then it would only affect the byte at float 5, leaving the byte at the 
fourth float unchanged. 

The point of all of this is that you have to know how many bytes you need 
to affect with the code, which you'll know by how large or small the 
number is in the game (usually). 

What the 00 code type is good for is pinpointing very specific addresses. 
The first six zero's in the value are ignored, it doesn't write these 
zero's to any address. 

Example: Skies of Arcadia, Vyse name change modifier. 

In this code, each character in the name takes up one byte. Since you 
want to make each character different, you must use the 00 code type 
(well, not really, but this is just an example). 
The address and values would look like this: 

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0C56DD70   ??  ??  ??  ??  ??  ??  ??  ??  ??  00  00  00  00  00  00  00 

The question marks are where you would put the values for whatever 
character you wanted that part of the name to be. 
You should note that two 02 type codes could be used here, much more 
effective than eight 00 type codes. Generally, just use the 00 code type 
if you're sure that you only need or want to change the value of one byte. 

 
B) -- 01 code type -- 

The 01 prefix is used when you want to change two bytes with the same 
code. When the value you want to change ranges from 0000-FFFF, use this 
code type. 

Example: Grandia 2, Max MP for Mareg: 

01-E2E59C 
000003E7 

In the usual form, the code looks like: 

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0CE2E59C   00  00  00  00  00  00  00  00  00  00  00  00  03  E7  00  00 

Note that the other bytes aren't necessarily zero's, I'm just doing 
that to show what is being affected. Now, 3E7 = 999 in decimal, and that 
is the maximum value that MP can be in this game. The game itself will 
read both of these bytes to get the value for MP, so that is why the 01 
code type should be used to change both of the bytes. 

 
C) -- 02 code type -- 

This code type is used to write to four bytes at once. It can be used when 
the value you're changing is large, like this: 

Example: Grandia 2, Max experience Mareg. 

02-E2E590 
05F5E0FF 

Which looks like: 

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0CE2E590   05  F5  E0  FF  00  00  00  00  00  00  00  00  00  00  00  00 

05F5E0FF = 99,999,999 in decimal, which is the maximum value that the 
game uses for experience. 

The 02 code type is not just used for large numbers. Remember, it affects 
four bytes, so consider the following example: 

These codes are for the game Fur Fighters: 

Infinite pistol ammo, VLF facility level: 

01-E026D4 
0000270F 

Infinite shotgun ammo, VLF facility level: 

01-E026D6 
0000270F 

Knowing what you already know, you should easily see how we could 
use the 02 code type to combine these codes. 
Here is the combined code: 

02-E026D4 
270F270F 

Which looks like this: 

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0CE026D4   00  00  00  00  27  0F  27  0F  00  00  00  00  00  00  00  00 

Understand? The first code wrote 270F at float 4, while the second code 
wrote 270F at float 6. Why not just write 270F at both with one code? 

That's it for the basic code types. The rest of the code types have 
special features that you'll definitely want to use. 

 
D) -- 04 code type -- 

If you've hacked codes for Playstation, it's almost certain that you've 
used the '50' code type. Well, on DC the '04' code type has pretty much 
the same effect, but of course there are some differences. This code is 
more complex than the ones we've already covered, but I'll try to explain 
how it works as best I can. 

For example, say you had four different codes, and they were: 

02-7798B0      02-7798B4    02-7798B8     02-7798BC 
01FF01FF       01FF01FF     01FF01FF      01FF01FF 

These codes would be: 

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0C7798B0   01  FF  01  FF  01  FF  01  FF  01  FF  01  FF  01  FF  01  FF 

You should notice that the floats for these codes are 0,4,8,C. We know the 
layout of the 04 code type, so how do we use it? It's simple actually. 

04-AAAAAF 
WWWWZZZZ 
VVVVVVVV 

First: obviously, the prefix used is 04. Next, what is the start address? 
In this example it is 7798B0, so put that number in AAAAAF. Then figure 
out how many codes you need to combine. There are four codes in this 
example, so WWWW = 0004. The ZZZZ equals how much you want to increment 
the address by for every code, multiplied by four. Here, each addresses 
is 4 more than the previous one, so ZZZZ = 0001. Why is it multiplied by 
four? That's explained by the value, VVVVVVVV. The code will write to 
four bytes at each address (just like the 02 code type), which means that 
the next bytes written to must be a separate four bytes. 
Probably the most important thing to remember is that the 04 code type is 
the same as using WWWW number of 02 type codes. 
The number of addresses that this code can affect can be up to FFFF. 

Example: If you put in the code: 

04-000000 
FFFF0001 
FFFFFFFF 

Then the code would write FF at every byte of every address from 000000 to 
FFFFFF (which is a very bad idea for a code, but it's just an example, 
right?) 

What about different values of ZZZZ? Well, usually ZZZZ will be equal to 
0001, but there may be times when you want to jump to an address that 
isn't right next to the last one. For example, if some codes you wanted 
to combine had a difference of 120 between each one, then ZZZZ would equal 
30. Don't forget, ZZZZ is multiplied by four. 
If you remember from the Playstation GS pro, you could add one to the 
value for every code in the string. Unfortunately, you can't do that 
on Dreamcast. 

 
E) -- 05 code type -- 

With this code you can copy the values in a certain number of bytes, and 
put them at a different address. 
The catch here is that the address you can copy to doesn't have to 
be in RAM. Just to remind you, the layout is: 

05-AAAAAF 
BBBBBBBB 
ZZZZZZZZ 

The copy-from address, AAAAAF, is an address in the normal RAM. 
The copy-to address BBBBBBBB can be anywhere. Here is a memory map of 
the DC that you can use, compiled by several people in the DC hobbyist 
community, with special thanks to Dan Potter: 

00000000 - 03FFFFFF	      00000000 - 001FFFFF Boot ROM (2MB) 
                              00200000 - 003FFFFF Flash ROM (256K) 
04000000 - 07FFFFFF	  Video RAM (8MB) 
08000000 - 0BFFFFFF	  ? 
0C000000 - 0CFFFFFF       System RAM (16MB) 
10000000 - 13FFFFFF       PowerVR: 
                              10000000 - 107fffff Tile accelerator 
                              10800000 - 11ffffff Texture mem (wronly) 
14000000 - 17FFFFFF       G2/Expansion (modem) port, 1-4 bytes/access 
1C000000 - 1FFFFFFF       Internal I/O registers 
1F000000 - 1FF0????       Memory mapped registers 
A05F8000                  PowerVR registers 
A0700000                  SPU Registers 
A0800000 - A09FFFFF	  Sound RAM (2MB) 
A1000000                  Parallel port; Mappable for PCI bus space 
                                  (used with the broadband adapter) 
A2000000                  CD/GD-ROM port 
A4000000                  Non-cached mirror of texture RAM 
A5000000 - A57FFFFF       Non-cached mirror of VRAM 
FF000000 - FFF0????	  Mirror of memory mapped registers 

 
If you're experienced enough, this code type can let you change nearly 
any area of DC memory. The normal area of DC RAM, 0C000000 - 0CFFFFFF, 
can be categorized further, but I'll save that information for the 
"Hacking with Code Breaker" section. 

Now, obviously if you want to copy from a certain address you have to 
know what it is you're copying. So you can do one of two things. 
One, you can write whatever value you want to a specific location in 
the normal RAM area, then copy that value to another location in DC 
memory (not necessarily RAM). 
Or two, you can copy an unchanged value from RAM to another memory area. 

If you can just use the other code types, why would you use this code 
type to change values in RAM? Well, because the values in the 
address you copy to change dynamically. 

Example: In an RPG, a certain characters stats might be at the address 
0C4599A2. All the stats for that character are contained within, say, 
32 bytes. Now, another characters stats are located at address 0C4599DD. 
If you used the code: 

05-4599A2 
0C4599DD 
00000032 

Then those 32 bytes would be copied from one characters stats to the 
others. This is useful because nothing is being altered or written to at 
the copy from address (4599A2). You should also be aware that this code 
doesn't just copy the values once, it is a continuos copy. So, when the 
byte values at the copy from address change, so do the values at the 
copy to address. 
Note: the Code Breaker reads the number of bytes to copy as a decimal 
number, so beware. 

 

F) -- 0D code type -- 

These last two code types, 0D and 0E, are activator codes. You may be 
familiar with that term if you've used those type of codes on N64 and 
Playstation. Instead of having a different prefix for each condition, 
on the DC the condition is just one digit in the code. 

Example: The 0D type activator is useful if you want to have codes like: 
get 99 coins when you pick up one, or win one fight instead of two to 
win the match, etc.. 

To use the 'get 99 coins' example above, you first have to know the address 
that contains the values for number of coins. Let's say for example that 
the address was 2290BC. Normally when you start a level you'd have no coins. 
If you remember the layout, the AAAAAF here would be 2290BC, the address 
where the coins are. The condition type Z, would be 0, which means If 
equal to. The VVVV would be 1, because that's the number we'd need to 
activate the code that follows. Here's what the code would look like: 

0D-2290BC 
00000001 
00-2290BC 
00000063 

So, the game checks the value at address 2290BC, and when it is equal 
to 1, the next two line code is activated. In this example, when you 
pick up 1 coin, the next code becomes active, and writes 63 (which is 
99 in decimal) at address 2290BC. 

 
G) -- 0E code type -- 

The 0E code type is similar to the 0D code type, with the addition of 
one important term - WW. This WW controls how many lines you want to 
activate if the condition is true. 

Example: Good for sports games, if you want to start the game with a 
lead on the other team. You need to know the addresses that control 
the score of both teams (usually away and home). If the home team score 
address is 1C0920 and the away team score address is 1C0924, then you 
have all you need to make this type of code. The code might look like: 

0E-040000 
001C0920 
00-1C0920 
00000064 
00-1C0924 
00000000 

The code will check the value at address 1C0290, which is the home team 
score address. The condition here is If equal to, so if the value at 
that address = VVVV (0000 in this example), then activate the next WW 
amount of lines. WW equals 04 in this example. At the beginning of the 
game, the home team score is 0, so the activator takes effect right away. 
It then writes the value 64 (99 decimal) to the home score address , and 
gives the away team a 0. 

This code type is also used for Dreamcast Joker command codes, which 
will be discussed in the next section. 

 

--------------------------------------------------------------------- 
5) Dreamcast Joker commands 
--------------------------------------------------------------------- 

 
Joker commands are used with activator codes, so that you can activate 
the code just by pressing a button. They are very useful codes, and can 
be used with both 0D and 0E type activators. The list below contains 
the joker command codes for the different buttons. This list was 
compiled by UL1 on the X-hub message board: 

Button              Joker code 

  A                    FFFB 
  B                    FFFD 
  X                    FBFF 
  Y                    FDFF 
 START                 FFF7 
 D-UP                  FFEF 
 D-DOWN                FFDF 
 D-LEFT                FFBF 
 D-RIGHT               FF7F 

 
The following instructions are based on what CodeMaster wrote in his 
joker code FAQ: 
To combine two joker commands (i.e. press A and Y to activate a code), you 
have to add the joker codes for the buttons together. For example, the 
joker code for A and B would be: 

A = FFFB 
B = FFFD 

FFFB + FFFD = 1FFF8 

However, the joker code is only four digits, so you add the 1 at the 
beginning to the last digit, to get the combined joker code. So the joker 
command for pressing both A + B buttons is FFF9. 

 
A) How to use joker commands in DC codes 

To illustrate how these work, I'll use some codes for World series 
baseball 2K1 as examples. 

The first and most important thing you must have in order to use joker 
commands is the address that tells the DC what buttons you are pressing. 
To be honest, there is almost no possiblity that you'll be able to find out 
this address with just the Code Breaker or Xploder. If the address for 
this function is already known, however, then you're ready to use joker 
commands. 

 -- Using the 0D activator with joker commands -- 

From world series baseball 2K1: 

0D-25D5A8 
0000FFEB 
0199E188 
00000000 

Code effect: Press A + D-pad up to make away team score = 0 

In this code, the address that the condition is checked from is the 
address that records what buttons are being pressed, 25D5A8. The 
condition is 0000, so it's an If equal to type of condition. The 
FFEB is the value that the Code Breaker checks for at the address. FFEB is 
a joker command for A + D-pad up. So, when you press A + D-pad up at 
the same time, the condition returns true and the following two lines 
are activated. The address 99E188 is the away team score address, that 
contains the value for the current away team score. When you press the 
joker command buttons that activate the code, the Code Breaker will write 
0000 at the address 99E188. Note that there's only four zero's being 
written because the code type being activated is an 01 type. 

 -- Using the 0E activator with joker commands -- 

Also for World series baseball 2K1: 

0E-04FD5F 
0025D5A8 
01-99E188 
00000032 
01-99E18C 
00000000 

Code effect: Press Y + D-pad down to put away team in the lead. 

According to the code layout: 

0E-WWVVVV 
0ZAAAAAF 

WW is the number of lines the code will activate. VVVV contains the 
four digit joker command. 0Z is the condition type, and AAAAAF is 
the address that the Code Breaker will check the condition from. 

In this example, the condition is 00, If equal to. The number of lines 
to activate is 04, and FD5F is the joker command for Y + D-pad down. 
The address you put at AAAAAF is the address that records the values for 
whatever buttons you press. For World Series Baseball 2K1, that address 
is 25D5A8. Note that this address is different for every game. 
We know that 99E188 is the away team score modifier, and we now know that 
99E18C is the home team score modifier. When Y + D-pad up are pressed, the 
value at address 25D5A8 becomes FD5F, and the next WW (04 here) number of 
lines are activated. The next two codes set the away team score to 32 
(in hex, which is 50 in decimal) and the home team score to 0. 

On a side note, you should realize that the two 01 type codes in this 
example could be combined into one 02 type code. You would just need to 
change WW from 04 to 02. It would look something like this: 

0E-02FD5F 
0025D5A8 
02-99E188 
00320000 

 
--------------------------------------------------------------------- 
6) Hacking with Code Breaker 
--------------------------------------------------------------------- 

When you're trying to hack with the Code Breaker, you have only two methods, 
guessing and modifying. If you've gotten used to using GS pro's, then 
trying to poke around to find codes with the Code Breaker will remind you 
of the days of the Game Genie. Well, okay, it's not quite that bad. 

Modifying is definitely the best way to find your own codes for DC. 
For most games, a certain area of RAM will contain almost all the memory 
that controls important things, such as lives, power, or score. So you can 
just change the address on existing codes to find new ones. And for the 
most part, it will work fine. Just remember what code type you're using, 
and make sure the float can be used with that type. 

The 04 code type can give you the ability to change as many bytes as you 
want with one code, so it's very useful for code searching. Well, sort 
of. For example, if there was one code available for a game, and it 
was 99 lives, player one. The code might be: 

00-ACC240 
00000063 

You would know that the byte at address ACC240 controls the number of 
lives for player one. Since most games group together the values that 
affect similar things in a game, for instance player one stats, you 
could do a 04 search. How would you do this? You could enter: 

04-ACC240 
00040001 
63636363 

What would this actually do? To put it in a familiar form: 

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F 

0CACC240  63  63  63  63  63  63  63  63  63  63  63  63  63  63  63  63 

It writes 63 to all the bytes from ACC240-ACC24F. When you start your 
game, check player one's stats, and see if any have changed to 99. If 
any did, then you've found some codes! 

Another way of modifying codes is to use the 0D and 0E activator codes. 
All you need is the addresses for two different things you want to 
change, and you can have your new code. Even better, if you know the 
address that contains the values for the buttons you press, you can 
easily create joker command codes for nearly anything you want. 
This is where the 0E activator code type can be useful. Use it with 
04 and 05 code types, or any code you want to activate that has more 
than two lines. 

To sum it up, modifying existing codes is by far the most effective 
method of hacking with the Code Breaker. 

 
Of course, for those of you with the patience, you could try the classic 
"guessing" method. I have to admit though, I haven't found a single code 
using this method with Code Breaker DC yet, but don't let that stop you. 
When you're dealing with FFFFFF different addresses to choose from, 
you'll want to cover as much ground as you can with each code. Forget 
using the 00, 01, or 02 code types. You'll need to use the 04 code type. 
This method is totally primitive, but you're not restricted to modifying 
codes. A sample code: 

04-200000 
00500001 
FFFFFFFF 

This code will write FF to every byte from address 0C200000 to 0C200140 
(50 * 4, in hex). 
Assuming the game will start, you now must look for anything that has 
changed. Now is where extreme patience comes in to play. Go through 
every menu, get in a fight, go buy something at a town, look to see 
if anything is different. For example, when you put in the above 
code and try to buy something in a town and everything is much 
more expensive than before, then you've probably found the address 
that affects the prices of certain items. 
There is a catch-22 when using this code finding method. You can write 
a value to any number of bytes, up to FFFF * 4. Writing to that many 
bytes at once will greatly increase your chances of finding something. 
At the same time, there is a greater chance of locking up your game. 
Also, if you do find a good effect when using this method, depending 
on how many addresses you're writing to it might be nearly impossible 
to find what address contains the value you want to change. Basically, 
use this method at your own risk! 

The following info, sent to me by Dan Potter, will probably be useful 
to you if you want to guess your own codes: 

0C000000 - 0C008000 : in-RAM BIOS space (syscalls, etc); a small 
                          chunk of the BIOS is copied here on startup 
                          and this contains some library hooks like 
			  CD access 

0C008000 - 0C010000 : IPL space (bootstrap containing the SEGA 
                          license screen,etc) 

0C010000 - 0D000000 : program (and memory heap) grows upward in 
                          this space, stack grows downward from the top 

If you want to guess your own codes, it would probably be a good idea 
to stay out of the area from 0C000000 to 0C010000, unless you know 
what you're doing and you want to change something there. 
I guess all I can say now is good luck. :) 

--------------------------------------------------------------------- 
7) Credits and Thank-you's 
--------------------------------------------------------------------- 

-- The first people I must thank (and give credit to) are CodeMaster 
   and VB|Daryl from www.cmgsccc.com. All of the different code type 
   information was provided by them or from their site. Also, the method of 
   how to combine the joker codes for two buttons was originally written by 
   CodeMaster. 

-- Dan Potter, for his help with the Dreamcast memory map. 

-- Kong K. Rool and Macrox from gscentral.com. Their hacking guide to 
   all the other systems has loads of great information on hacking, and 
   much of what I know is from reading that guide. 

-- Joshy9 for testing out many of the codes I've made. 

-- UL1, for posting the DC joker commands 

-- Blaze, for making the Xploder, and Pelican for making the Code Breaker 

-- All the hackers at hacking 101 (www.hacking101.5u.com). This site 
   is now THE place to go if you want to learn how to hack. 

--------------------------------------------------------------------- 
8) Legal garbage and contact information 
--------------------------------------------------------------------- 

This guide is missing alot of information that I would like to have in it. 
If you know something I don't, or have a better way of doing something 
that I've written about in this guide, please let me know. 
Also, if you don't understand something, know how I could make this 
guide better, or if there's a mistake in the guide, then let me know. 

e-mail: adnova2001@hotmail.com 

website: http://www.geocities.com/adnova2001/ADnovaCodes.html 

 

 
This document Copyright © 2001 ADnova.