ADnova's guide to....... *****Dreamcast Hacking***** Version 1.11 October 6, 2001 --------------------------------------------------------------------- Table of Contents --------------------------------------------------------------------- 1) ............. Introduction a) ........... What's new 2) ............. Review of basic hacking methods and knowledge 3) ............. Dreamcast Code Breaker code types 4) ............. Uses of the different code types a) ........... 00-type b) ........... 01-type c) ........... 02-type d) ........... 04-type e) ........... 05-type f) ........... 0D-type g) ........... 0E-type 5) ............. Dreamcast Joker commands a) ........... How to use Joker commands in DC codes 6) ............. Hacking with Code Breaker 7) ............. Credits and thank-you's 8) ............. Legal garbage and contact information --------------------------------------------------------------------- 1) Introduction --------------------------------------------------------------------- Hacking for Dreamcast isn't quite the same as hacking for Playstation or Nintendo 64. No GS pro, no game trainers, no hacking utilities to use (not yet anyway). I wrote this guide to help people who want to hack their own codes for the DC. Where I can I'll use examples to clarify how to use a code. Any problems or questions about the guide or DC hacking, let me know. One important thing - you must have either a Code Breaker or an Xploder to hack your own codes. You can try with the Game shark CDX, but this guide won't help you with that device. The reason is because Gameshark CDX codes are encrypted, which makes many of the hacking methods described below difficult or impossible. Also, throughout the guide I will only refer to the Code Breaker, however all of the guide can be applied using the Xploder. I have assumed that the reader has at least some basic knowledge of hacking for other platforms, but the review is there for those that don't. This is the first guide I've ever written, so I guarantee that there will be something wrong somewhere. A) -- What's new -- Version 1.11 - Since this guide is now up at hacking 101, I fixed up some mistakes and tried to make certain parts easier to understand. Version 1.01 - A few minor updates, spelling/grammar fixes, and stuff like that. Version 1.00 - First version of this guide. I plan on adding much more information about Dreamcast hacking, as soon as I learn it myself. --------------------------------------------------------------------- 2) Review of basic hacking methods and knowledge --------------------------------------------------------------------- If you're already an experienced hacker, then go ahead and skip this section. If not, then read up and hopefully you'll learn something. Also - all numbers in this guide are hex numbers, unless stated otherwise. --Hex-- First of all, you need to learn hex. Hex is a counting system that has 16 digits instead of the normal 10. It's really quite simple, but you should at least be familiar with it before you try to hack anything. Why should you learn it? Well, because every code you see is actually in hex. So, if you want to make your own codes, you need to know what the numbers mean. This table shows you all you need to know for now: Decimal number Hex number (a.k.a. hexadecimal) 0 ----> 0 1 ----> 1 2 ----> 2 3 ----> 3 4 ----> 4 5 ----> 5 6 ----> 6 7 ----> 7 8 ----> 8 9 ----> 9 10 ----> A 11 ----> B 12 ----> C 13 ----> D 14 ----> E 15 ----> F 16 ----> 10 This is just meant to give you an idea of how it works. Save yourself the headache of trying to convert from one to the other and just use a program that converts hex to decimal (and vice-versa). If you have windows, use windows calculator with scientific view. --Anatomy of a code: Addresses, values, prefixes, floats and bytes-- Hold on to your brain - this could get complicated. :) First, you should know the layout of a basic Dreamcast code: 0?-AAAAAF VVVVVVVV The prefix: the prefix is the ? in the code. It tells the Code Breaker what type of code you're using. The address: this is the AAAAA in the code. This is what part of the RAM that the code will be affecting. The float: The float is the F digit in the code. This is part of the address. The value: The value is the VVVVVVVV in the code. The value tells the Dreamcast what number to put at the address. To better explain what each part does, and what a byte is, look at the following figure: (This will look familiar if you've ever used a hex editor) 0 1 2 3 4 5 6 7 8 9 A B C D E F 0C32EFA? 00 00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 Explanation: the number 0C32EFA? is the address. For now, you can ignore the 0C part of the address. All DC RAM addresses have 0C at the front of the address, because that's where DC's RAM is located (more about that later). It is not the prefix, and it isn't actually used when inputing a Code Breaker code. The hex numbers from 0 to F above the sets of double zero's are also part of the address. Each double zero is a 'byte' and that is where the values are located. Here, we have the value 'FF' at address '0C32EFA4'. The 4 in the address comes from the part where the value is located. Here it's 4, so the address is 0C32EFA4 (and 4 replaces the ?). For future reference, this part of the address will be called the 'float'. Make sense? One futher note: a byte is made up of two hexadecimal digits. It does NOT have to be two zero's. I use zero's just to make it clear what is being affected or changed. If this were an actual code, it might be: 00-32EFA4 000000FF That's all you need to know for now, next to know are the different prefixes that you can use. --------------------------------------------------------------------- 3) Dreamcast Code Breaker code types --------------------------------------------------------------------- What a code does depends on the prefix. The prefix tells the Xploder what to do with the numbers that follow. That said, that are several code types (meaning: what prefix the code has), that you should know about. Each will be explained in more detail later, this is just a general overview. All of the information on code types here is based on the information at www.cmgsccc.com 00 code type: This code has '00' as a prefix. The normal layout of this type of code is: 00-AAAAAF 000000VV As you can see, the value (VV) is only one byte. The value must be between 00 and FF, since the first six zero's in the value are ignored. The float(F) can have any value, from 0-F. 01 code type: The prefix for this code type is '01'. The float for this code type must be even, ie: 0,2,4,6,8,A,C,E. The code looks like this: 01-AAAAAF 000000VV You'll notice that this code type affects two bytes (VV VV), so the value can be from 0000-FFFF. The first four zero's are ignored. 02 code type: This type of code affects four bytes, and is laid out like this: 02-AAAAAF VVVVVVVV Here, the float must be 0,4,8, or C. The value here can be from 00000000 to FFFFFFFF. Right now you might be wondering why the float has to be certain values for the different code types. Let me explain with an example, from Skies of Arcadia: Ship parts item modifier (slot one): 01-56E704 0000???? <---item digit goes here. Max ship parts modifier (slot one): 01-56E706 00000063 Note that both codes are 01 code types. This means that they each affect two bytes, but there's more to it than that. Lets break down the first code: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0C56E704 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 Since the 01 code type affects two bytes, it also affects two float numbers. Let's look at the second code: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0C56E706 00 00 00 00 00 00 00 63 00 00 00 00 00 00 00 00 This code affects two bytes, and the float from 6-7. We can easily combine these two codes, with the 02 code type. Max ship parts item modifier (slot one): 02-56E704 0063???? The code would look like this: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0C56E704 00 00 00 00 ?? ?? 00 63 00 00 00 00 00 00 00 00 The 02 code type affects four bytes and four floats. Since the 02 type codes write to four bytes (and floats), it can only start at every fourth float. Confusing enough? Anyway, back to the different code types: 04 code type: This code type has basically the same effect as the '50' code type on the Gameshark Pro for Playstation. It's useful to combine many codes into one. I'll save explanation of this code type until later, here's the layout and brief explanation for now: 04-AAAAAF WWWWZZZZ VVVVVVVV The AAAAAF is the address where the code starts. WWWW is the number of addresses that the code will affect. ZZZZ is how much the current address is to be incremented by to get to the next address in the code, mulitplied by four. The reason that ZZZZ is multiplied by four is because the value written to each address in the code, VVVVVVVV, is the same type that the 02 code type has. Meaning that at each address, four bytes are written to. That also means that the float must be 0,4,8, or C. 05 code type: The layout: 05-AAAAAF VVVVVVVV ZZZZZZZZ This code will copy ZZZZZZZZ number of bytes from the address AAAAAF, to the address VVVVVVVV. Normal codes only allow you to write to the DC RAM, addresses 0C000000-0CFFFFFF. Well with this code you can write to any area in the DC memory. The float in this code can range from 0-F. More about this code type later. 0B code type: Codes with prefixes '0B' seem to be enable codes. I have only seen them used on two games, Shenmue and F355 Challenge. That's pretty much all I know about them. 0D code type: An activator code, similar to the D0 type code used on Nintendo 64 and Playstation. The layout for this code type is: 0D-AAAAAF 000ZVVVV This code will check a certain condition, indicated by the value of Z. The possible Z values are: 0 = If equal to 1 = If different to 2 = If less than 3 = If greater than The code reads the condition type, then goes to address AAAAAF and checks the value(VVVV) at that address. If the condition is true, then it 'activates' the next two line code. If not, then it doesn't activate the next two lines. To clarify, you would actually enter four lines under one code description, something like this: 0D-123456 00000001 01-123456 0000000A In this example, Z=0, so the condition is If equal to. The value at address 123456 is checked, and if it is equal to 1, then the next two line code is activated. As you can see, when the next two line code is activated, the value at address 123456 becomes A. 0E code type: This code type is also an activator, but is used to activate more than 2 lines of codes. Layout: 0E-WWVVVV 0ZAAAAAF All of the terms have the same definitions as in the 0D code type, but there is now one new term, WW. The value in WW tells the Code Breaker how many lines of codes to activate if the condition is true. The value in WW can be odd or even. This code type will be explained in more detail later on. 0F code type: The following information is taken straight from Code Master's DC code types FAQ (although it's slightly modified to be consistent): "Format: 0F-AAAAAF 0000VVVV AAAAAF = Address VVVV = 2-byte Value Functionality: This is one of the least common code types. It simply writes the given 2 byte value, VVVV, to the given address, AAAAAF BEFORE anything is run for the game. Used for games like PSO that require Enable Codes and such. (The float MUST be even.)" So, as you can see this code will write to the specified location before the game even starts to run. And also, the float must be 0,2,4,8,A,C, or E, just like the 01 code type. That is all I'm going to say about this code type in this version of the guide. --------------------------------------------------------------------- 4) Uses of the different code types --------------------------------------------------------------------- The first three code types we deal with are quite simple (00, 01, and 02 types). What prefix to use depends on either the size of the value, or how many bytes you want to change. A) -- 00 code type -- Use this code type when you only want to change the value in one byte. Example: Say you want a code to give you 'max health' in a game. If the max health you can get in the game is 270F (9999 decimal), that means that the code you use should affect two bytes, but what happens if you used the 00 code type? Look at the following example: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0C320BA4 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 So, for this game, the addresses that control health are 320BA4 and 320BA5. That covers two bytes and floats, and 00 affects only 1. If you entered the code: 00-32BA25 000000FF Then it would only affect the byte at float 5, leaving the byte at the fourth float unchanged. The point of all of this is that you have to know how many bytes you need to affect with the code, which you'll know by how large or small the number is in the game (usually). What the 00 code type is good for is pinpointing very specific addresses. The first six zero's in the value are ignored, it doesn't write these zero's to any address. Example: Skies of Arcadia, Vyse name change modifier. In this code, each character in the name takes up one byte. Since you want to make each character different, you must use the 00 code type (well, not really, but this is just an example). The address and values would look like this: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0C56DD70 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 The question marks are where you would put the values for whatever character you wanted that part of the name to be. You should note that two 02 type codes could be used here, much more effective than eight 00 type codes. Generally, just use the 00 code type if you're sure that you only need or want to change the value of one byte. B) -- 01 code type -- The 01 prefix is used when you want to change two bytes with the same code. When the value you want to change ranges from 0000-FFFF, use this code type. Example: Grandia 2, Max MP for Mareg: 01-E2E59C 000003E7 In the usual form, the code looks like: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0CE2E59C 00 00 00 00 00 00 00 00 00 00 00 00 03 E7 00 00 Note that the other bytes aren't necessarily zero's, I'm just doing that to show what is being affected. Now, 3E7 = 999 in decimal, and that is the maximum value that MP can be in this game. The game itself will read both of these bytes to get the value for MP, so that is why the 01 code type should be used to change both of the bytes. C) -- 02 code type -- This code type is used to write to four bytes at once. It can be used when the value you're changing is large, like this: Example: Grandia 2, Max experience Mareg. 02-E2E590 05F5E0FF Which looks like: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0CE2E590 05 F5 E0 FF 00 00 00 00 00 00 00 00 00 00 00 00 05F5E0FF = 99,999,999 in decimal, which is the maximum value that the game uses for experience. The 02 code type is not just used for large numbers. Remember, it affects four bytes, so consider the following example: These codes are for the game Fur Fighters: Infinite pistol ammo, VLF facility level: 01-E026D4 0000270F Infinite shotgun ammo, VLF facility level: 01-E026D6 0000270F Knowing what you already know, you should easily see how we could use the 02 code type to combine these codes. Here is the combined code: 02-E026D4 270F270F Which looks like this: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0CE026D4 00 00 00 00 27 0F 27 0F 00 00 00 00 00 00 00 00 Understand? The first code wrote 270F at float 4, while the second code wrote 270F at float 6. Why not just write 270F at both with one code? That's it for the basic code types. The rest of the code types have special features that you'll definitely want to use. D) -- 04 code type -- If you've hacked codes for Playstation, it's almost certain that you've used the '50' code type. Well, on DC the '04' code type has pretty much the same effect, but of course there are some differences. This code is more complex than the ones we've already covered, but I'll try to explain how it works as best I can. For example, say you had four different codes, and they were: 02-7798B0 02-7798B4 02-7798B8 02-7798BC 01FF01FF 01FF01FF 01FF01FF 01FF01FF These codes would be: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0C7798B0 01 FF 01 FF 01 FF 01 FF 01 FF 01 FF 01 FF 01 FF You should notice that the floats for these codes are 0,4,8,C. We know the layout of the 04 code type, so how do we use it? It's simple actually. 04-AAAAAF WWWWZZZZ VVVVVVVV First: obviously, the prefix used is 04. Next, what is the start address? In this example it is 7798B0, so put that number in AAAAAF. Then figure out how many codes you need to combine. There are four codes in this example, so WWWW = 0004. The ZZZZ equals how much you want to increment the address by for every code, multiplied by four. Here, each addresses is 4 more than the previous one, so ZZZZ = 0001. Why is it multiplied by four? That's explained by the value, VVVVVVVV. The code will write to four bytes at each address (just like the 02 code type), which means that the next bytes written to must be a separate four bytes. Probably the most important thing to remember is that the 04 code type is the same as using WWWW number of 02 type codes. The number of addresses that this code can affect can be up to FFFF. Example: If you put in the code: 04-000000 FFFF0001 FFFFFFFF Then the code would write FF at every byte of every address from 000000 to FFFFFF (which is a very bad idea for a code, but it's just an example, right?) What about different values of ZZZZ? Well, usually ZZZZ will be equal to 0001, but there may be times when you want to jump to an address that isn't right next to the last one. For example, if some codes you wanted to combine had a difference of 120 between each one, then ZZZZ would equal 30. Don't forget, ZZZZ is multiplied by four. If you remember from the Playstation GS pro, you could add one to the value for every code in the string. Unfortunately, you can't do that on Dreamcast. E) -- 05 code type -- With this code you can copy the values in a certain number of bytes, and put them at a different address. The catch here is that the address you can copy to doesn't have to be in RAM. Just to remind you, the layout is: 05-AAAAAF BBBBBBBB ZZZZZZZZ The copy-from address, AAAAAF, is an address in the normal RAM. The copy-to address BBBBBBBB can be anywhere. Here is a memory map of the DC that you can use, compiled by several people in the DC hobbyist community, with special thanks to Dan Potter: 00000000 - 03FFFFFF 00000000 - 001FFFFF Boot ROM (2MB) 00200000 - 003FFFFF Flash ROM (256K) 04000000 - 07FFFFFF Video RAM (8MB) 08000000 - 0BFFFFFF ? 0C000000 - 0CFFFFFF System RAM (16MB) 10000000 - 13FFFFFF PowerVR: 10000000 - 107fffff Tile accelerator 10800000 - 11ffffff Texture mem (wronly) 14000000 - 17FFFFFF G2/Expansion (modem) port, 1-4 bytes/access 1C000000 - 1FFFFFFF Internal I/O registers 1F000000 - 1FF0???? Memory mapped registers A05F8000 PowerVR registers A0700000 SPU Registers A0800000 - A09FFFFF Sound RAM (2MB) A1000000 Parallel port; Mappable for PCI bus space (used with the broadband adapter) A2000000 CD/GD-ROM port A4000000 Non-cached mirror of texture RAM A5000000 - A57FFFFF Non-cached mirror of VRAM FF000000 - FFF0???? Mirror of memory mapped registers If you're experienced enough, this code type can let you change nearly any area of DC memory. The normal area of DC RAM, 0C000000 - 0CFFFFFF, can be categorized further, but I'll save that information for the "Hacking with Code Breaker" section. Now, obviously if you want to copy from a certain address you have to know what it is you're copying. So you can do one of two things. One, you can write whatever value you want to a specific location in the normal RAM area, then copy that value to another location in DC memory (not necessarily RAM). Or two, you can copy an unchanged value from RAM to another memory area. If you can just use the other code types, why would you use this code type to change values in RAM? Well, because the values in the address you copy to change dynamically. Example: In an RPG, a certain characters stats might be at the address 0C4599A2. All the stats for that character are contained within, say, 32 bytes. Now, another characters stats are located at address 0C4599DD. If you used the code: 05-4599A2 0C4599DD 00000032 Then those 32 bytes would be copied from one characters stats to the others. This is useful because nothing is being altered or written to at the copy from address (4599A2). You should also be aware that this code doesn't just copy the values once, it is a continuos copy. So, when the byte values at the copy from address change, so do the values at the copy to address. Note: the Code Breaker reads the number of bytes to copy as a decimal number, so beware. F) -- 0D code type -- These last two code types, 0D and 0E, are activator codes. You may be familiar with that term if you've used those type of codes on N64 and Playstation. Instead of having a different prefix for each condition, on the DC the condition is just one digit in the code. Example: The 0D type activator is useful if you want to have codes like: get 99 coins when you pick up one, or win one fight instead of two to win the match, etc.. To use the 'get 99 coins' example above, you first have to know the address that contains the values for number of coins. Let's say for example that the address was 2290BC. Normally when you start a level you'd have no coins. If you remember the layout, the AAAAAF here would be 2290BC, the address where the coins are. The condition type Z, would be 0, which means If equal to. The VVVV would be 1, because that's the number we'd need to activate the code that follows. Here's what the code would look like: 0D-2290BC 00000001 00-2290BC 00000063 So, the game checks the value at address 2290BC, and when it is equal to 1, the next two line code is activated. In this example, when you pick up 1 coin, the next code becomes active, and writes 63 (which is 99 in decimal) at address 2290BC. G) -- 0E code type -- The 0E code type is similar to the 0D code type, with the addition of one important term - WW. This WW controls how many lines you want to activate if the condition is true. Example: Good for sports games, if you want to start the game with a lead on the other team. You need to know the addresses that control the score of both teams (usually away and home). If the home team score address is 1C0920 and the away team score address is 1C0924, then you have all you need to make this type of code. The code might look like: 0E-040000 001C0920 00-1C0920 00000064 00-1C0924 00000000 The code will check the value at address 1C0290, which is the home team score address. The condition here is If equal to, so if the value at that address = VVVV (0000 in this example), then activate the next WW amount of lines. WW equals 04 in this example. At the beginning of the game, the home team score is 0, so the activator takes effect right away. It then writes the value 64 (99 decimal) to the home score address , and gives the away team a 0. This code type is also used for Dreamcast Joker command codes, which will be discussed in the next section. --------------------------------------------------------------------- 5) Dreamcast Joker commands --------------------------------------------------------------------- Joker commands are used with activator codes, so that you can activate the code just by pressing a button. They are very useful codes, and can be used with both 0D and 0E type activators. The list below contains the joker command codes for the different buttons. This list was compiled by UL1 on the X-hub message board: Button Joker code A FFFB B FFFD X FBFF Y FDFF START FFF7 D-UP FFEF D-DOWN FFDF D-LEFT FFBF D-RIGHT FF7F The following instructions are based on what CodeMaster wrote in his joker code FAQ: To combine two joker commands (i.e. press A and Y to activate a code), you have to add the joker codes for the buttons together. For example, the joker code for A and B would be: A = FFFB B = FFFD FFFB + FFFD = 1FFF8 However, the joker code is only four digits, so you add the 1 at the beginning to the last digit, to get the combined joker code. So the joker command for pressing both A + B buttons is FFF9. A) How to use joker commands in DC codes To illustrate how these work, I'll use some codes for World series baseball 2K1 as examples. The first and most important thing you must have in order to use joker commands is the address that tells the DC what buttons you are pressing. To be honest, there is almost no possiblity that you'll be able to find out this address with just the Code Breaker or Xploder. If the address for this function is already known, however, then you're ready to use joker commands. -- Using the 0D activator with joker commands -- From world series baseball 2K1: 0D-25D5A8 0000FFEB 0199E188 00000000 Code effect: Press A + D-pad up to make away team score = 0 In this code, the address that the condition is checked from is the address that records what buttons are being pressed, 25D5A8. The condition is 0000, so it's an If equal to type of condition. The FFEB is the value that the Code Breaker checks for at the address. FFEB is a joker command for A + D-pad up. So, when you press A + D-pad up at the same time, the condition returns true and the following two lines are activated. The address 99E188 is the away team score address, that contains the value for the current away team score. When you press the joker command buttons that activate the code, the Code Breaker will write 0000 at the address 99E188. Note that there's only four zero's being written because the code type being activated is an 01 type. -- Using the 0E activator with joker commands -- Also for World series baseball 2K1: 0E-04FD5F 0025D5A8 01-99E188 00000032 01-99E18C 00000000 Code effect: Press Y + D-pad down to put away team in the lead. According to the code layout: 0E-WWVVVV 0ZAAAAAF WW is the number of lines the code will activate. VVVV contains the four digit joker command. 0Z is the condition type, and AAAAAF is the address that the Code Breaker will check the condition from. In this example, the condition is 00, If equal to. The number of lines to activate is 04, and FD5F is the joker command for Y + D-pad down. The address you put at AAAAAF is the address that records the values for whatever buttons you press. For World Series Baseball 2K1, that address is 25D5A8. Note that this address is different for every game. We know that 99E188 is the away team score modifier, and we now know that 99E18C is the home team score modifier. When Y + D-pad up are pressed, the value at address 25D5A8 becomes FD5F, and the next WW (04 here) number of lines are activated. The next two codes set the away team score to 32 (in hex, which is 50 in decimal) and the home team score to 0. On a side note, you should realize that the two 01 type codes in this example could be combined into one 02 type code. You would just need to change WW from 04 to 02. It would look something like this: 0E-02FD5F 0025D5A8 02-99E188 00320000 --------------------------------------------------------------------- 6) Hacking with Code Breaker --------------------------------------------------------------------- When you're trying to hack with the Code Breaker, you have only two methods, guessing and modifying. If you've gotten used to using GS pro's, then trying to poke around to find codes with the Code Breaker will remind you of the days of the Game Genie. Well, okay, it's not quite that bad. Modifying is definitely the best way to find your own codes for DC. For most games, a certain area of RAM will contain almost all the memory that controls important things, such as lives, power, or score. So you can just change the address on existing codes to find new ones. And for the most part, it will work fine. Just remember what code type you're using, and make sure the float can be used with that type. The 04 code type can give you the ability to change as many bytes as you want with one code, so it's very useful for code searching. Well, sort of. For example, if there was one code available for a game, and it was 99 lives, player one. The code might be: 00-ACC240 00000063 You would know that the byte at address ACC240 controls the number of lives for player one. Since most games group together the values that affect similar things in a game, for instance player one stats, you could do a 04 search. How would you do this? You could enter: 04-ACC240 00040001 63636363 What would this actually do? To put it in a familiar form: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0CACC240 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 It writes 63 to all the bytes from ACC240-ACC24F. When you start your game, check player one's stats, and see if any have changed to 99. If any did, then you've found some codes! Another way of modifying codes is to use the 0D and 0E activator codes. All you need is the addresses for two different things you want to change, and you can have your new code. Even better, if you know the address that contains the values for the buttons you press, you can easily create joker command codes for nearly anything you want. This is where the 0E activator code type can be useful. Use it with 04 and 05 code types, or any code you want to activate that has more than two lines. To sum it up, modifying existing codes is by far the most effective method of hacking with the Code Breaker. Of course, for those of you with the patience, you could try the classic "guessing" method. I have to admit though, I haven't found a single code using this method with Code Breaker DC yet, but don't let that stop you. When you're dealing with FFFFFF different addresses to choose from, you'll want to cover as much ground as you can with each code. Forget using the 00, 01, or 02 code types. You'll need to use the 04 code type. This method is totally primitive, but you're not restricted to modifying codes. A sample code: 04-200000 00500001 FFFFFFFF This code will write FF to every byte from address 0C200000 to 0C200140 (50 * 4, in hex). Assuming the game will start, you now must look for anything that has changed. Now is where extreme patience comes in to play. Go through every menu, get in a fight, go buy something at a town, look to see if anything is different. For example, when you put in the above code and try to buy something in a town and everything is much more expensive than before, then you've probably found the address that affects the prices of certain items. There is a catch-22 when using this code finding method. You can write a value to any number of bytes, up to FFFF * 4. Writing to that many bytes at once will greatly increase your chances of finding something. At the same time, there is a greater chance of locking up your game. Also, if you do find a good effect when using this method, depending on how many addresses you're writing to it might be nearly impossible to find what address contains the value you want to change. Basically, use this method at your own risk! The following info, sent to me by Dan Potter, will probably be useful to you if you want to guess your own codes: 0C000000 - 0C008000 : in-RAM BIOS space (syscalls, etc); a small chunk of the BIOS is copied here on startup and this contains some library hooks like CD access 0C008000 - 0C010000 : IPL space (bootstrap containing the SEGA license screen,etc) 0C010000 - 0D000000 : program (and memory heap) grows upward in this space, stack grows downward from the top If you want to guess your own codes, it would probably be a good idea to stay out of the area from 0C000000 to 0C010000, unless you know what you're doing and you want to change something there. I guess all I can say now is good luck. :) --------------------------------------------------------------------- 7) Credits and Thank-you's --------------------------------------------------------------------- -- The first people I must thank (and give credit to) are CodeMaster and VB|Daryl from www.cmgsccc.com. All of the different code type information was provided by them or from their site. Also, the method of how to combine the joker codes for two buttons was originally written by CodeMaster. -- Dan Potter, for his help with the Dreamcast memory map. -- Kong K. Rool and Macrox from gscentral.com. Their hacking guide to all the other systems has loads of great information on hacking, and much of what I know is from reading that guide. -- Joshy9 for testing out many of the codes I've made. -- UL1, for posting the DC joker commands -- Blaze, for making the Xploder, and Pelican for making the Code Breaker -- All the hackers at hacking 101 (www.hacking101.5u.com). This site is now THE place to go if you want to learn how to hack. --------------------------------------------------------------------- 8) Legal garbage and contact information --------------------------------------------------------------------- This guide is missing alot of information that I would like to have in it. If you know something I don't, or have a better way of doing something that I've written about in this guide, please let me know. Also, if you don't understand something, know how I could make this guide better, or if there's a mistake in the guide, then let me know. e-mail: adnova2001@hotmail.com website: http://www.geocities.com/adnova2001/ADnovaCodes.html This document Copyright © 2001 ADnova. Any product mentioned in this guide is a trademark of it's respective company. This guide may not be changed or altered in any way without the express written permission of it's author (ADnova). The only sites where this guide may appear (besides my homepage, of course) are: www.gamefaqs.com www.hacking101.5u.com