Dreamcast Guides : Region/Cheat Code Hacking

ADnova's guide to.......


                    *****Dreamcast Hacking*****

                          Version 1.11
                         October 6, 2001

---------------------------------------------------------------------
                        Table of Contents
---------------------------------------------------------------------


1) ............. Introduction
  a) ........... What's new

2) ............. Review of basic hacking methods and knowledge

3) ............. Dreamcast Code Breaker code types

4) ............. Uses of the different code types
  a) ........... 00-type
  b) ........... 01-type
  c) ........... 02-type
  d) ........... 04-type
  e) ........... 05-type
  f) ........... 0D-type
  g) ........... 0E-type

5) ............. Dreamcast Joker commands
  a) ........... How to use Joker commands in DC codes

6) ............. Hacking with Code Breaker

7) ............. Credits and thank-you's

8) ............. Legal garbage and contact information


---------------------------------------------------------------------
1) Introduction
---------------------------------------------------------------------

Hacking for Dreamcast isn't quite the same as hacking for Playstation
or Nintendo 64. No GS pro, no game trainers, no hacking utilities to
use (not yet anyway). I wrote this guide to help people who want to
hack their own codes for the DC. Where I can I'll use examples to
clarify how to use a code. Any problems or questions about the guide
or DC hacking, let me know.
One important thing - you must have either a Code Breaker or an
Xploder to hack your own codes. You can try with the Game shark
CDX, but this guide won't help you with that device. The reason is
because Gameshark CDX codes are encrypted, which makes many of the
hacking methods described below difficult or impossible.
Also, throughout the guide I will only refer to the Code Breaker,
however all of the guide can be applied using the Xploder.
I have assumed that the reader has at least some basic knowledge of
hacking for other platforms, but the review is there for those that
don't.
This is the first guide I've ever written, so I guarantee that there
will be something wrong somewhere.

A) -- What's new --

Version 1.11 - Since this guide is now up at hacking 101, I fixed up
some mistakes and tried to make certain parts easier to understand.

Version 1.01 - A few minor updates, spelling/grammar fixes, and stuff
like that.

Version 1.00 - First version of this guide. I plan on adding much more
information about Dreamcast hacking, as soon as I learn it myself.


---------------------------------------------------------------------
2) Review of basic hacking methods and knowledge
---------------------------------------------------------------------

If you're already an experienced hacker, then go ahead and skip this
section. If not, then read up and hopefully you'll learn something.
Also - all numbers in this guide are hex numbers, unless stated
otherwise.


--Hex--
First of all, you need to learn hex. Hex is a counting system that has
16 digits instead of the normal 10. It's really quite simple, but you
should at least be familiar with it before you try to hack anything.
Why should you learn it? Well, because every code you see is actually
in hex. So, if you want to make your own codes, you need to know what
the numbers mean.

This table shows you all you need to know for now:

Decimal number 		Hex number (a.k.a. hexadecimal)

	0          ---->            0
	1          ---->            1
	2          ---->            2
	3          ---->            3
	4          ---->            4
	5          ---->            5
 	6          ---->            6
	7          ---->            7
	8          ---->            8
	9          ---->            9
	10         ---->            A
	11         ---->            B
	12         ---->            C
	13         ---->            D
	14         ---->            E
	15         ---->            F
	16         ---->           10

This is just meant to give you an idea of how it works. Save yourself
the headache of trying to convert from one to the other and just use
a program that converts hex to decimal (and vice-versa). If you have
windows, use windows calculator with scientific view.

--Anatomy of a code: Addresses, values,  prefixes, floats and bytes--

Hold on to your brain - this could get complicated. :)

First, you should know the layout of a basic Dreamcast code:

0?-AAAAAF
VVVVVVVV

The prefix: the prefix is the ? in the code. It tells the Code Breaker
what type of code you're using.

The address: this is the AAAAA in the code. This is what part of the
RAM that the code will be affecting.

The float: The float is the F digit in the code. This is part of the
address.

The value: The value is the VVVVVVVV in the code. The value tells the
Dreamcast what number to put at the address.

To better explain what each part does, and what a byte is, look at the
following figure: (This will look familiar if you've ever used a hex
editor)

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0C32EFA?   00  00  00  00  FF  00  00  00  00  00  00  00  00  00 00  00

Explanation: the number 0C32EFA? is the address. For now, you can
ignore the 0C part of the address. All DC RAM addresses have 0C at the front
of the address, because that's where DC's RAM is located (more about that
later). It is not the prefix, and it isn't actually used when inputing a Code
Breaker code.
The hex numbers from 0 to F above the sets of double zero's are also
part of the address. Each double zero is a 'byte' and that is where the values
are located. Here, we have the value 'FF' at address '0C32EFA4'. The 4 in the
address comes from the part where the value is located. Here it's 4, so the
address is 0C32EFA4 (and 4 replaces the ?). For future reference, this part
of the address will be called the 'float'. Make sense?

One futher note: a byte is made up of two hexadecimal digits. It does NOT
have to be two zero's. I use zero's just to make it clear what is being
affected or changed.

If this were an actual code, it might be:

00-32EFA4
000000FF

That's all you need to know for now, next to know are the different
prefixes that you can use.


---------------------------------------------------------------------
3) Dreamcast Code Breaker code types
---------------------------------------------------------------------

What a code does depends on the prefix. The prefix tells the Xploder
what to do with the numbers that follow. That said, that are several
code types (meaning: what prefix the code has), that you should know
about. Each will be explained in more detail later, this is just a
general overview. All of the information on code types here is based on
the information at www.cmgsccc.com


00 code type: This code has '00' as a prefix. The normal layout of this
type of code is:

00-AAAAAF
000000VV

As you can see, the value (VV) is only one byte. The value must be between
00 and FF, since the first six zero's in the value are ignored.
The float(F) can have any value, from 0-F.


01 code type: The prefix for this code type is '01'. The float for this
code type must be even, ie: 0,2,4,6,8,A,C,E. The code looks like this:

01-AAAAAF
000000VV

You'll notice that this code type affects two bytes (VV VV), so the value
can be from 0000-FFFF. The first four zero's are ignored.


02 code type: This type of code affects four bytes, and is laid out like
this:

02-AAAAAF
VVVVVVVV

Here, the float must be 0,4,8, or C. The value here can be from 00000000
to FFFFFFFF.


Right now you might be wondering why the float has to be certain values
for the different code types. Let me explain with an example, from
Skies of Arcadia:

Ship parts item modifier (slot one):

01-56E704
0000???? <---item digit goes here.

Max ship parts modifier (slot one):

01-56E706
00000063

Note that both codes are 01 code types. This means that they each affect
two bytes, but there's more to it than that. Lets break down the first
code:


           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0C56E704   00  00  00  00  ??  ??  00  00  00  00  00  00  00  00  00  00

Since the 01 code type affects two bytes, it also affects two float
numbers. Let's look at the second code:

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0C56E706   00  00  00  00  00  00  00  63  00  00  00  00  00  00  00  00

This code affects two bytes, and the float from 6-7. We can easily combine
these two codes, with the 02 code type.

Max ship parts item modifier (slot one):

02-56E704
0063????

The code would look like this:

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0C56E704   00  00  00  00  ??  ??  00  63  00  00  00  00  00  00  00  00

The 02 code type affects four bytes and four floats.

Since the 02 type codes write to four bytes (and floats),
it can only start at every fourth float. Confusing enough? Anyway, back
to the different code types:


04 code type: This code type has basically the same effect as the '50' code
type on the Gameshark Pro for Playstation. It's useful to combine many
codes into one. I'll save explanation of this code type until later,
here's the layout and brief explanation for now:

04-AAAAAF
WWWWZZZZ
VVVVVVVV

The AAAAAF is the address where the code starts. WWWW is the number of
addresses that the code will affect. ZZZZ is how much the current address
is to be incremented by to get to the next address in the code, mulitplied
by four. The reason that ZZZZ is multiplied by four is because the value
written to each address in the code, VVVVVVVV, is the same type that
the 02 code type has. Meaning that at each address, four bytes are
written to. That also means that the float must be 0,4,8, or C.


05 code type: The layout:

05-AAAAAF
VVVVVVVV
ZZZZZZZZ

This code will copy ZZZZZZZZ number of bytes from the address AAAAAF,
to the address VVVVVVVV. Normal codes only allow you to write to the
DC RAM, addresses 0C000000-0CFFFFFF. Well with this code you can write
to any area in the DC memory. The float in this code can range from 0-F.
More about this code type later.


0B code type: Codes with prefixes '0B' seem to be enable codes. I have only
seen them used on two games, Shenmue and F355 Challenge. That's pretty much
all I know about them.


0D code type: An activator code, similar to the D0 type code used on
Nintendo 64 and Playstation. The layout for this code type is:

0D-AAAAAF
000ZVVVV

This code will check a certain condition, indicated by the value of Z.
The possible Z values are:

0 = If equal to
1 = If different to
2 = If less than
3 = If greater than

The code reads the condition type, then goes to address AAAAAF and checks
the value(VVVV) at that address. If the condition is true, then it
'activates' the next two line code. If not, then it doesn't activate the
next two lines. To clarify, you would actually enter four lines under
one code description, something like this:

0D-123456
00000001
01-123456
0000000A

In this example, Z=0, so the condition is If equal to. The value at address
123456 is checked, and if it is equal to 1, then the next two line code is
activated. As you can see, when the next two line code is activated, the
value at address 123456 becomes A.


0E code type: This code type is also an activator, but is used to activate
more than 2 lines of codes. Layout:

0E-WWVVVV
0ZAAAAAF

All of the terms have the same definitions as in the 0D code type, but
there is now one new term, WW. The value in WW tells the Code Breaker how
many lines of codes to activate if the condition is true. The value
in WW can be odd or even. This code type will be explained in more detail
later on.


0F code type:

The following information is taken straight from Code Master's DC code
types FAQ (although it's slightly modified to be consistent):

"Format: 0F-AAAAAF
         0000VVVV

AAAAAF = Address
VVVV = 2-byte Value

Functionality: This is one of the least common code types.
It simply writes the given 2 byte value, VVVV, to the given address,
AAAAAF BEFORE anything is run for the game. Used for games like PSO that
require Enable Codes and such. (The float MUST be even.)"

So, as you can see this code will write to the specified location before
the game even starts to run. And also, the float must be 0,2,4,8,A,C, or
E, just like the 01 code type. That is all I'm going to say about this
code type in this version of the guide.

---------------------------------------------------------------------
4) Uses of the different code types
---------------------------------------------------------------------

The first three code types we deal with are quite simple (00, 01, and
02 types). What prefix to use depends on either the size of the value,
or how many bytes you want to change.

A) -- 00 code type --

Use this code type when you only want to change the value in one byte.

Example: Say you want a code to give you 'max health' in a game. If the
max health you can get in the game is 270F (9999 decimal), that means that
the code you use should affect two bytes, but what happens if you used the
00 code type? Look at the following example:

            0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0C320BA4    00  00  00  00  ??  ??  00  00  00  00  00  00  00  00  00  00

So, for this game, the addresses that control health are 320BA4 and
320BA5. That covers two bytes and floats, and 00 affects only 1. If you
entered the code:

00-32BA25
000000FF

Then it would only affect the byte at float 5, leaving the byte at the
fourth float unchanged.

The point of all of this is that you have to know how many bytes you need
to affect with the code, which you'll know by how large or small the
number is in the game (usually).

What the 00 code type is good for is pinpointing very specific addresses.
The first six zero's in the value are ignored, it doesn't write these
zero's to any address.

Example: Skies of Arcadia, Vyse name change modifier.

In this code, each character in the name takes up one byte. Since you
want to make each character different, you must use the 00 code type
(well, not really, but this is just an example).
The address and values would look like this:

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0C56DD70   ??  ??  ??  ??  ??  ??  ??  ??  ??  00  00  00  00  00  00  00

The question marks are where you would put the values for whatever
character you wanted that part of the name to be.
You should note that two 02 type codes could be used here, much more
effective than eight 00 type codes. Generally, just use the 00 code type
if you're sure that you only need or want to change the value of one byte.


B) -- 01 code type --

The 01 prefix is used when you want to change two bytes with the same
code. When the value you want to change ranges from 0000-FFFF, use this
code type.

Example: Grandia 2, Max MP for Mareg:

01-E2E59C
000003E7

In the usual form, the code looks like:

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0CE2E59C   00  00  00  00  00  00  00  00  00  00  00  00  03  E7  00  00

Note that the other bytes aren't necessarily zero's, I'm just doing
that to show what is being affected. Now, 3E7 = 999 in decimal, and that
is the maximum value that MP can be in this game. The game itself will
read both of these bytes to get the value for MP, so that is why the 01
code type should be used to change both of the bytes.


C) -- 02 code type --

This code type is used to write to four bytes at once. It can be used when
the value you're changing is large, like this:

Example: Grandia 2, Max experience Mareg.

02-E2E590
05F5E0FF

Which looks like:

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0CE2E590   05  F5  E0  FF  00  00  00  00  00  00  00  00  00  00  00  00

05F5E0FF = 99,999,999 in decimal, which is the maximum value that the
game uses for experience.

The 02 code type is not just used for large numbers. Remember, it affects
four bytes, so consider the following example:

These codes are for the game Fur Fighters:

Infinite pistol ammo, VLF facility level:

01-E026D4
0000270F

Infinite shotgun ammo, VLF facility level:

01-E026D6
0000270F

Knowing what you already know, you should easily see how we could
use the 02 code type to combine these codes.
Here is the combined code:

02-E026D4
270F270F

Which looks like this:

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0CE026D4   00  00  00  00  27  0F  27  0F  00  00  00  00  00  00  00  00

Understand? The first code wrote 270F at float 4, while the second code
wrote 270F at float 6. Why not just write 270F at both with one code?

That's it for the basic code types. The rest of the code types have
special features that you'll definitely want to use.


D) -- 04 code type --

If you've hacked codes for Playstation, it's almost certain that you've
used the '50' code type. Well, on DC the '04' code type has pretty much
the same effect, but of course there are some differences. This code is
more complex than the ones we've already covered, but I'll try to explain
how it works as best I can.

For example, say you had four different codes, and they were:

02-7798B0      02-7798B4    02-7798B8     02-7798BC
01FF01FF       01FF01FF     01FF01FF      01FF01FF

These codes would be:

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0C7798B0   01  FF  01  FF  01  FF  01  FF  01  FF  01  FF  01  FF  01  FF

You should notice that the floats for these codes are 0,4,8,C. We know the
layout of the 04 code type, so how do we use it? It's simple actually.

04-AAAAAF
WWWWZZZZ
VVVVVVVV

First: obviously, the prefix used is 04. Next, what is the start address?
In this example it is 7798B0, so put that number in AAAAAF. Then figure
out how many codes you need to combine. There are four codes in this
example, so WWWW = 0004. The ZZZZ equals how much you want to increment
the address by for every code, multiplied by four. Here, each addresses
is 4 more than the previous one, so ZZZZ = 0001. Why is it multiplied by
four? That's explained by the value, VVVVVVVV. The code will write to
four bytes at each address (just like the 02 code type), which means that
the next bytes written to must be a separate four bytes.
Probably the most important thing to remember is that the 04 code type is
the same as using WWWW number of 02 type codes.
The number of addresses that this code can affect can be up to FFFF.

Example: If you put in the code:

04-000000
FFFF0001
FFFFFFFF

Then the code would write FF at every byte of every address from 000000 to
FFFFFF (which is a very bad idea for a code, but it's just an example,
right?)

What about different values of ZZZZ? Well, usually ZZZZ will be equal to
0001, but there may be times when you want to jump to an address that
isn't right next to the last one. For example, if some codes you wanted
to combine had a difference of 120 between each one, then ZZZZ would equal
30. Don't forget, ZZZZ is multiplied by four.
If you remember from the Playstation GS pro, you could add one to the
value for every code in the string. Unfortunately, you can't do that
on Dreamcast.


E) -- 05 code type --

With this code you can copy the values in a certain number of bytes, and
put them at a different address.
The catch here is that the address you can copy to doesn't have to
be in RAM. Just to remind you, the layout is:

05-AAAAAF
BBBBBBBB
ZZZZZZZZ

The copy-from address, AAAAAF, is an address in the normal RAM.
The copy-to address BBBBBBBB can be anywhere. Here is a memory map of
the DC that you can use, compiled by several people in the DC hobbyist
community, with special thanks to Dan Potter:

00000000 - 03FFFFFF	      00000000 - 001FFFFF Boot ROM (2MB)
                              00200000 - 003FFFFF Flash ROM (256K)
04000000 - 07FFFFFF	  Video RAM (8MB)
08000000 - 0BFFFFFF	  ?
0C000000 - 0CFFFFFF       System RAM (16MB)
10000000 - 13FFFFFF       PowerVR:
                              10000000 - 107fffff Tile accelerator
                              10800000 - 11ffffff Texture mem (wronly)
14000000 - 17FFFFFF       G2/Expansion (modem) port, 1-4 bytes/access
1C000000 - 1FFFFFFF       Internal I/O registers
1F000000 - 1FF0????       Memory mapped registers
A05F8000                  PowerVR registers
A0700000                  SPU Registers
A0800000 - A09FFFFF	  Sound RAM (2MB)
A1000000                  Parallel port; Mappable for PCI bus space
                                  (used with the broadband adapter)
A2000000                  CD/GD-ROM port
A4000000                  Non-cached mirror of texture RAM
A5000000 - A57FFFFF       Non-cached mirror of VRAM
FF000000 - FFF0????	  Mirror of memory mapped registers


If you're experienced enough, this code type can let you change nearly
any area of DC memory. The normal area of DC RAM, 0C000000 - 0CFFFFFF,
can be categorized further, but I'll save that information for the
"Hacking with Code Breaker" section.

Now, obviously if you want to copy from a certain address you have to
know what it is you're copying. So you can do one of two things.
One, you can write whatever value you want to a specific location in
the normal RAM area, then copy that value to another location in DC
memory (not necessarily RAM).
Or two, you can copy an unchanged value from RAM to another memory area.

If you can just use the other code types, why would you use this code
type to change values in RAM? Well, because the values in the
address you copy to change dynamically.

Example: In an RPG, a certain characters stats might be at the address
0C4599A2. All the stats for that character are contained within, say,
32 bytes. Now, another characters stats are located at address 0C4599DD.
If you used the code:

05-4599A2
0C4599DD
00000032

Then those 32 bytes would be copied from one characters stats to the
others. This is useful because nothing is being altered or written to at
the copy from address (4599A2). You should also be aware that this code
doesn't just copy the values once, it is a continuos copy. So, when the
byte values at the copy from address change, so do the values at the
copy to address.
Note: the Code Breaker reads the number of bytes to copy as a decimal
number, so beware.



F) -- 0D code type --

These last two code types, 0D and 0E, are activator codes. You may be
familiar with that term if you've used those type of codes on N64 and
Playstation. Instead of having a different prefix for each condition,
on the DC the condition is just one digit in the code.

Example: The 0D type activator is useful if you want to have codes like:
get 99 coins when you pick up one, or win one fight instead of two to
win the match, etc..

To use the 'get 99 coins' example above, you first have to know the address
that contains the values for number of coins. Let's say for example that
the address was 2290BC. Normally when you start a level you'd have no coins.
If you remember the layout, the AAAAAF here would be 2290BC, the address
where the coins are. The condition type Z, would be 0, which means If
equal to. The VVVV would be 1, because that's the number we'd need to
activate the code that follows. Here's what the code would look like:

0D-2290BC
00000001
00-2290BC
00000063

So, the game checks the value at address 2290BC, and when it is equal
to 1, the next two line code is activated. In this example, when you
pick up 1 coin, the next code becomes active, and writes 63 (which is
99 in decimal) at address 2290BC.


G) -- 0E code type --

The 0E code type is similar to the 0D code type, with the addition of
one important term - WW. This WW controls how many lines you want to
activate if the condition is true.

Example: Good for sports games, if you want to start the game with a
lead on the other team. You need to know the addresses that control
the score of both teams (usually away and home). If the home team score
address is 1C0920 and the away team score address is 1C0924, then you
have all you need to make this type of code. The code might look like:

0E-040000
001C0920
00-1C0920
00000064
00-1C0924
00000000

The code will check the value at address 1C0290, which is the home team
score address. The condition here is If equal to, so if the value at
that address = VVVV (0000 in this example), then activate the next WW
amount of lines. WW equals 04 in this example. At the beginning of the
game, the home team score is 0, so the activator takes effect right away.
It then writes the value 64 (99 decimal) to the home score address , and
gives the away team a 0.

This code type is also used for Dreamcast Joker command codes, which
will be discussed in the next section.



---------------------------------------------------------------------
5) Dreamcast Joker commands
---------------------------------------------------------------------


Joker commands are used with activator codes, so that you can activate
the code just by pressing a button. They are very useful codes, and can
be used with both 0D and 0E type activators. The list below contains
the joker command codes for the different buttons. This list was
compiled by UL1 on the X-hub message board:

Button              Joker code

  A                    FFFB
  B                    FFFD
  X                    FBFF
  Y                    FDFF
 START                 FFF7
 D-UP                  FFEF
 D-DOWN                FFDF
 D-LEFT                FFBF
 D-RIGHT               FF7F


The following instructions are based on what CodeMaster wrote in his
joker code FAQ:
To combine two joker commands (i.e. press A and Y to activate a code), you
have to add the joker codes for the buttons together. For example, the
joker code for A and B would be:

A = FFFB
B = FFFD

FFFB + FFFD = 1FFF8

However, the joker code is only four digits, so you add the 1 at the
beginning to the last digit, to get the combined joker code. So the joker
command for pressing both A + B buttons is FFF9.


A) How to use joker commands in DC codes

To illustrate how these work, I'll use some codes for World series
baseball 2K1 as examples.

The first and most important thing you must have in order to use joker
commands is the address that tells the DC what buttons you are pressing.
To be honest, there is almost no possiblity that you'll be able to find out
this address with just the Code Breaker or Xploder. If the address for
this function is already known, however, then you're ready to use joker
commands.

 -- Using the 0D activator with joker commands --

From world series baseball 2K1:

0D-25D5A8
0000FFEB
0199E188
00000000

Code effect: Press A + D-pad up to make away team score = 0

In this code, the address that the condition is checked from is the
address that records what buttons are being pressed, 25D5A8. The
condition is 0000, so it's an If equal to type of condition. The
FFEB is the value that the Code Breaker checks for at the address. FFEB is
a joker command for A + D-pad up. So, when you press A + D-pad up at
the same time, the condition returns true and the following two lines
are activated. The address 99E188 is the away team score address, that
contains the value for the current away team score. When you press the
joker command buttons that activate the code, the Code Breaker will write
0000 at the address 99E188. Note that there's only four zero's being
written because the code type being activated is an 01 type.

 -- Using the 0E activator with joker commands --

Also for World series baseball 2K1:

0E-04FD5F
0025D5A8
01-99E188
00000032
01-99E18C
00000000

Code effect: Press Y + D-pad down to put away team in the lead.

According to the code layout:

0E-WWVVVV
0ZAAAAAF

WW is the number of lines the code will activate. VVVV contains the
four digit joker command. 0Z is the condition type, and AAAAAF is
the address that the Code Breaker will check the condition from.

In this example, the condition is 00, If equal to. The number of lines
to activate is 04, and FD5F is the joker command for Y + D-pad down.
The address you put at AAAAAF is the address that records the values for
whatever buttons you press. For World Series Baseball 2K1, that address
is 25D5A8. Note that this address is different for every game.
We know that 99E188 is the away team score modifier, and we now know that
99E18C is the home team score modifier. When Y + D-pad up are pressed, the
value at address 25D5A8 becomes FD5F, and the next WW (04 here) number of
lines are activated. The next two codes set the away team score to 32
(in hex, which is 50 in decimal) and the home team score to 0.

On a side note, you should realize that the two 01 type codes in this
example could be combined into one 02 type code. You would just need to
change WW from 04 to 02. It would look something like this:

0E-02FD5F
0025D5A8
02-99E188
00320000


---------------------------------------------------------------------
6) Hacking with Code Breaker
---------------------------------------------------------------------

When you're trying to hack with the Code Breaker, you have only two methods,
guessing and modifying. If you've gotten used to using GS pro's, then
trying to poke around to find codes with the Code Breaker will remind you
of the days of the Game Genie. Well, okay, it's not quite that bad.

Modifying is definitely the best way to find your own codes for DC.
For most games, a certain area of RAM will contain almost all the memory
that controls important things, such as lives, power, or score. So you can
just change the address on existing codes to find new ones. And for the
most part, it will work fine. Just remember what code type you're using,
and make sure the float can be used with that type.

The 04 code type can give you the ability to change as many bytes as you
want with one code, so it's very useful for code searching. Well, sort
of. For example, if there was one code available for a game, and it
was 99 lives, player one. The code might be:

00-ACC240
00000063

You would know that the byte at address ACC240 controls the number of
lives for player one. Since most games group together the values that
affect similar things in a game, for instance player one stats, you
could do a 04 search. How would you do this? You could enter:

04-ACC240
00040001
63636363

What would this actually do? To put it in a familiar form:

           0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F

0CACC240  63  63  63  63  63  63  63  63  63  63  63  63  63  63  63  63

It writes 63 to all the bytes from ACC240-ACC24F. When you start your
game, check player one's stats, and see if any have changed to 99. If
any did, then you've found some codes!

Another way of modifying codes is to use the 0D and 0E activator codes.
All you need is the addresses for two different things you want to
change, and you can have your new code. Even better, if you know the
address that contains the values for the buttons you press, you can
easily create joker command codes for nearly anything you want.
This is where the 0E activator code type can be useful. Use it with
04 and 05 code types, or any code you want to activate that has more
than two lines.

To sum it up, modifying existing codes is by far the most effective
method of hacking with the Code Breaker.


Of course, for those of you with the patience, you could try the classic
"guessing" method. I have to admit though, I haven't found a single code
using this method with Code Breaker DC yet, but don't let that stop you.
When you're dealing with FFFFFF different addresses to choose from,
you'll want to cover as much ground as you can with each code. Forget
using the 00, 01, or 02 code types. You'll need to use the 04 code type.
This method is totally primitive, but you're not restricted to modifying
codes. A sample code:

04-200000
00500001
FFFFFFFF

This code will write FF to every byte from address 0C200000 to 0C200140
(50 * 4, in hex).
Assuming the game will start, you now must look for anything that has
changed. Now is where extreme patience comes in to play. Go through
every menu, get in a fight, go buy something at a town, look to see
if anything is different. For example, when you put in the above
code and try to buy something in a town and everything is much
more expensive than before, then you've probably found the address
that affects the prices of certain items.
There is a catch-22 when using this code finding method. You can write
a value to any number of bytes, up to FFFF * 4. Writing to that many
bytes at once will greatly increase your chances of finding something.
At the same time, there is a greater chance of locking up your game.
Also, if you do find a good effect when using this method, depending
on how many addresses you're writing to it might be nearly impossible
to find what address contains the value you want to change. Basically,
use this method at your own risk!

The following info, sent to me by Dan Potter, will probably be useful
to you if you want to guess your own codes:

0C000000 - 0C008000 : in-RAM BIOS space (syscalls, etc); a small
                          chunk of the BIOS is copied here on startup
                          and this contains some library hooks like
			  CD access

0C008000 - 0C010000 : IPL space (bootstrap containing the SEGA
                          license screen,etc)

0C010000 - 0D000000 : program (and memory heap) grows upward in
                          this space, stack grows downward from the top

If you want to guess your own codes, it would probably be a good idea
to stay out of the area from 0C000000 to 0C010000, unless you know
what you're doing and you want to change something there.
I guess all I can say now is good luck. :)

---------------------------------------------------------------------
7) Credits and Thank-you's
---------------------------------------------------------------------

-- The first people I must thank (and give credit to) are CodeMaster
   and VB|Daryl from www.cmgsccc.com. All of the different code type
   information was provided by them or from their site. Also, the method of
   how to combine the joker codes for two buttons was originally written by
   CodeMaster.

-- Dan Potter, for his help with the Dreamcast memory map.

-- Kong K. Rool and Macrox from gscentral.com. Their hacking guide to
   all the other systems has loads of great information on hacking, and
   much of what I know is from reading that guide.

-- Joshy9 for testing out many of the codes I've made.

-- UL1, for posting the DC joker commands

-- Blaze, for making the Xploder, and Pelican for making the Code Breaker

-- All the hackers at hacking 101 (www.hacking101.5u.com). This site
   is now THE place to go if you want to learn how to hack.

---------------------------------------------------------------------
8) Legal garbage and contact information
---------------------------------------------------------------------

This guide is missing alot of information that I would like to have in it.
If you know something I don't, or have a better way of doing something
that I've written about in this guide, please let me know.
Also, if you don't understand something, know how I could make this
guide better, or if there's a mistake in the guide, then let me know.

e-mail: adnova2001@hotmail.com

website: http://www.geocities.com/adnova2001/ADnovaCodes.html




This document Copyright © 2001 ADnova. Any product mentioned in this
guide is a trademark of it's respective company. This guide may not be
changed or altered in any way without the express written permission of
it's author (ADnova). The only sites where this guide may appear (besides
my homepage, of course) are:
www.gamefaqs.com
www.hacking101.5u.com