Punch Out No TKO!(Hard Mode improvement hack)
This hack makes Punch Out! a harder game by disabling TKO’s, and as I thought necessary, unlimited starless power punch. The stars will read 0, but power punches are now available for unlimited use.
Punch Out No TKO!
( Hard Mode hack improvement)
Patching
PATCHING: use file: Mike Tyson's Punch-Out!! (U) (PRG 1).nes , and your favorite IPS patching utility.
This ips file was made with Lunar IPS.exe
Hacking the rom
This hack makes Punch Out! A harder game by disabling TKO?s and as I thought neccesary, unlimited Star-less power punch. The Stars will read 0 , but power punches are now available for unlimited use.
Went into this with fair knowledge of how the NES memory addresses and offsets are found , and some knowledge on
Tools:
Fceux 2.x
Permanent Game genie utility (win32)
Patch #1 Unlimited Power Punch (pressing the Start button)
Planning to have game runthrough without the TKO's: this game becomes very difficult. The power punches will help, but it's still gonna be tough for Little Mac. This part was easy, it patched right in there.
Patch #2 : No more TKO?s
* TKO (technical knock out) has been removed ... this means only a KO (knock-out) or decision will give you the win. I had a bit of hacking to do to figure out the proper way to apply this. Proper searching with Fceux 2.x , and the well-known NES mappers documents, in this case was MMC2.txt , was helpful and neccesary in getting this one right.
Research of the Punch Out! memory mapper
Punch Out! Uses the MMC2. It is the only cartridge that uses this particular mapper.
After reviewing the doc, I see that my target memory space where the variable is , it is copied into to the NES memory every time a round starts or the game is RESET.
Yep I have to change the way this game thinks. Sooo....
New Mission: target & Redirect
First I had to find in the ROM the address where this change occurs. Loaded up FCEUX and opened HEX Editor. Ok, now I add a breakpoint with the HEX editor by right clicking the variable I know is responsible, ( 03CA ) then loaded up the debugger. Reset the game, and wait until Bald Bull gets knocked on his ass once in the game demo. The program pauses for you.
At first write break, I see there is nothing of interest, so I click the "Run" button and it breaks again for me to see this output: 06:B2CA:EE CA 03 INC $03CA = #$01
still paused, but it says now there is a INC operation and there is our address getting modified by some other bit of code. I don?t know ASM completely, but I assume that INC would be the thing to Increment the variable
I go to address B2CA in the RAM , and I see this is the column of hex code:
00B2CA : 0A B9 62 B3 99 C0 00 88 10 F7 EE CA 03 EE D1 03
there is, in red, the offset you right click on and select "go to ROM address".
Viola, the values appear in the ROM address. The address is backwards again
I change IN THE ROM FILE the offsets 1B30C and 1B30D (see picture below) from values of " CA 03 " (they are backwards , it actually stands for address 03CA) to now , it reads " 69 01 "
In the standard Punch Out! rom, the non- MikeTyson, the correct address to change is "between the double E's" ,
at column 1B2DB and 1B2DC
Removed my debugging breakpoint and Re-powered the game. WhenBald Bull gets knocked down this time, the NINTENDO 1987RD3 incrementing the RAM address 0169., the address to a useless comment that shows up in the games RAM , So, now that every time there is a knockdown, the 1 in 1987 is incremented, instead of the TKO counter.
it reads NINTENDO 1987RD3 (assuming the old R&D team #3 mustve left their signature)
So, now that every time there is a knockdown, the 1 in 1987 is incremented.
Notes
I do not forsee any problems , I have tested incrementing that variable to FF and beyond, also I viewed the ending credits to ensure the 1987 does not show up there.
Also , note, the 03CA still gets initialized to 00 at the match/round load and gets read. It just never moves from 00. So there is the TKO counter, not used.
Mike Tyson's Punch-Out!! (Japan, USA) (Rev A).nes - NOINTRO
CRC32: 3DF8E170
MD5: C119A5A9B0E2959AD5D11562F9F4CE55
SHA-1: 0F0C2C2E294FF8CE255A618964728C935FD8963B
SHA-256: 60EF51F55F6ADDB7A1893F816AAD75EE3E146DD646958A865D3BECE5B429B600