Saturn RPG hacking roundup: Riglordsaga 2, Shiroki Majo, & Magic Knight Rayearth

The first in a series

Oct 17, 2024

In this edition I’ve got debug menu hacks for three Saturn RPGs:

These menus let you alter game parameters and warp to arbitrary areas, so you can pop into different parts of the game to check them out.

If you’re interested in translating Riglordsaga 2 or Shiroki Majo, these menus would surely be helpful aides. Take a look!

Riglordsaga 2

In a previous article, I wrote about enabling the hidden debug mode in Riglordsaga (a.k.a. Mystaria, a.k.a. Blazing Heroes). The question naturally arises: what about its sequel?

Answer: it’s go a very similar debug mode. The flag that controls it is at memory address 06091484. Set it to 01 and you’ll get extra menu items, coordinates on the screen, and the ability to walk out of bounds.

Left: Before the debug flag is set. Right: After it’s set.

This game has multiple test levels with special menus that let you view game scenes:

It looks like during development you could toggle the debug flag with the Start button. The code acts like this pseudo-Python:

if pressed_button & debug_toggle_button != 0:
    debug_flag ^= 1

For the final game, the debug_toggle_button value is set to 0, so this doesn’t work. We can turn restore it like this:

0600f596 e308  # Read a value of 08
0600f59a 4318  # Shift it to be 0800

This works because the bit pattern for the start button is 0000 1000 0000 0000, or 0800.

Get a disc image patch with these changes from SegaXtreme!

Shiroki Majo: Mouhitotsu no Eiyuu Densetsu

This game has a button code to activate a debug menu with lots of options.

After the Hudson screen, during the snow falling animation, press A; B; and then C. Then at the title screen, hold L and R and press Start. Once gameplay starts, hold X, Y, and Z at the same time to bring up the debug menu.

The function at address checks for both steps. Here’s my annotation of Ghidra’s decompilation of the first step:

The A button pattern is 0x0400; the B button pattern is 0x0100; and the C button pattern is 0x0200.

And the second step:

The Start button pattern is 0x0800, the R button pattern is 0x0080, and the L button pattern is 0x0008. Together they are 0x0888.

The debug flag that gets enabled here is at address 060793a8.

Here’s my translation of the top level menu items:

You can warp to different places with the MAP option, though sometimes you’ll need to adjust your starting position to be able to wind up somewhere sensible.

Magic Knight Rayearth

The INITMENU in Magic Knight Rayearth allows you to warp to arbitrary points in the game with its ROUND option. There are movie test (CINEPACK) and sound test options in the menu as well.

Activating this menu requires a bit of hacking. The four bytes at 060a13cc determine which mode the game will switch to. The one we want is 00000004, which is the debug menu.

The first mode switch looks like this:

06004096 eb01 mov #0x1,r11         # Put an immediate 1 into r11
...
060041fc 2e00  mov.b r0,@r14       # Load a value into the r14 address
060041fe 70ff  add -0x1,r0         # Subtract one from that value
06004200 600c  extu.b r0,r0        # Extend the sign of that value
06004202 4008  shll2 r0            # Multiply that value by 4
06004204 0d36  mov.l r3,@(r0,r13)  # etc...
06004206 a0cc  bra 0x060043a2      # etc...
06004208 2cb2  _mov.l r11,@r12     # Load a 1 into the game mode address

We need to change the value that’s loaded in the last instruction. But there’s not a good place to do it, since the r11 value is used elsewhere. We’ll make some room by dropping the extu.b instruction: this is extending the sign of the r0 value — good practice, since we’re doing math on it. But it’s unnecessary, since at this point in execution the value always winds up positive.

With that instruction out of the way, we’ll have room to load an immediate 4 and cause the game to launch straight into the debug menu.

060041fc 2e00  mov.b r0,@r14       # As before
060041fe 70ff  add -0x1,r0         # As before
06004200 4008  shll2 r0            # Skip the sign extension and multiply
06004202 0d36  mov.l r3,@(r0,r13)  # As before, but moved up by one slot
06004204 e004  mov #0x4, r0        # Put an immediate 4 into r0
06004206 a0cc  bra 0x060043a2      # As before
06004208 2c02  _mov.l r0,@r12      # Load the 4 into the game mode address

Get the patch from SegaXtreme.

Outro

You are welcome and encouraged to copy the information in this article to your favorite fan site or wiki.

I’ll cover more RPG hacks in future editions. For previous coverage of hidden debug modes in Saturn games, see:

Rings of Saturn

Discussion about this post