7 ms·

NES Game Genie Technical Notes (2001)

164 points by camtarn 4y ago

deleted 4y ago
[deleted]
password4321 4y ago
The one I have memorized: GXXZZLVI Still couldn't get anywhere in Battletoads even with infinite lives! Also, the form factor seemed like it hastened the demise of our NES, making the cartridge connection even more flakey than normal wear and tear.
- JohnBooty 4y ago
  Really? Hmmm, I would have expected it to extend the life of the NES's slot, at least if the GG was left permanently inserted. Because then the Game Genie's slot would be subject to wear + tear + oxidation, not the NES's slot. This is pure speculation on my part and is, it seems, incorrect.
  - password4321 4y ago
    I'm not sure we ever tried unplugging the cartridge from the device while inside the console, that sounds like it would have been a good idea. IIRC it was mostly how the wedge on top pushed things down so the bundle would correctly be detected as completely inserted, eventually the Game Genie was pretty much required.
    - behringer 4y ago
      That happens more or less normally. Just requires some adjustment to the slot connector.
JamesSwift 4y ago
How were the original codes collected? I assumed the devs themselves were somehow involved in the process? But then I read the Wikipedia article and it outlines how Nintendo tried to shut it down, so that seems unlikely. I guess the manufacturers really just manually sat down and figured them all out on their own... pretty crazy.
- upupandup 4y ago
  Even more curious is how do ppl discover the hex codes for like Gameshark? I had a friend who would just guesstimate and successfully able to manipulate playstation games. It was fascinating to watch.
  - K0SM0S 4y ago
    This is actually amazing: > The code is GOSSIP (amazing coincidence that it happens to also be an English word). This works in Capcom's Ghosts 'n Goblins to start your player with a really funky weapon. Oh, the potential for easter eggs if you anticipated the use of a Game Genie by players, this was meta-gaming at its earliest in strictly offline mode. You could even hide codes in-story for later replays and whatnot. What's not to love about such a hacky mode of expression, a hacking-friendly barebones paradigm.
  - kbrackbill 4y ago
    I'm not sure if this applies to the playstation, but I remember the nintendo 64 gameshark I had had some "code finding" features that involved using a button on the cartridge to filter down to memory addresses that had changed a certain way since the last button press. This meant that if you were looking for say, the address where your character's health was stored, you could press the button, get hit in the game, press the button again, and search for values in memory that had decreased since the last button press. Doing this several times was a fairly reliable way of finding things. I'm a bit fuzzy on the details but that was the general idea. Most modern emulators have similar but much more fleshed out features. They're nice not only for finding cheat codes but for reverse engineering games for the purposes of making romhacks or tool assisted speedruns and things like that.
    - 0des 4y ago
      huh, okay I always wondered what the button did. I always assumed it was to 'activate' codes that were input, maybe for a different game that I hadnt played yet and thus hadn't needed to use it yet.
VyseofArcadia 4y ago
> After all, given 2 Game Genie codes, one that granted 5 lives on startup and another code that granted 9 lives, and the only difference between the 2 codes was one character, even a novice player could probably figure out that modifying that one character to any of the acceptable letter characters would grant between 1 and 16 lives on startup. I fail to see why that was an outcome they wanted to avoid.
- monocasa 4y ago
  They sold books of codes in addition to the hardware.
  - VyseofArcadia 4y ago
    I bought some as a kid, and the real value wasn't additional codes for games already covered, but codes for new games that didn't have any yet. I would have felt pretty ripped off if I had spent what little money I could get on the newest Super Mario Bros. 3 codes only to discover it was six extra lives when I already had a code for three.
  - delecti 4y ago
    At least some of those code books also included instructions for that kind of experimentation though. I very clearly remember my dad using those instructions to change Mario's jump height in SMB1 to just bypass whole levels by modifying the existing jump height codes.
- bluedino 4y ago
  Increases the values of the codes. They could sell another code book with more codes for the same games etc
- cortesoft 4y ago
  I also remember being able to do something like this with the Sega genesis game genie… you could modify some of the codes with simple changes to change the number of free lives given, for example.
jmiller099 4y ago
Love this! Was in my bookmarks as I had to make a couple of codes late last year to slow the ball in arkanoid, so it could be enjoyed by someone who couldn't keep up. Needed to use FCEU to find the ball speed info and some online references to the 6502 ASM instruction set for substituting instructions to keep the ball slowed.
lastangryman 4y ago
I had the Game Genie. Young me had no idea how it worked, but I sort of had an intuitive guess when I entered some random codes in and mario level 1 suddenly became full of random bits of pixels you could climb up and jump around on. Amazing read.
- konfusinomicon 4y ago
  I had a friend whose mother wouldn't allow him to get one because the commercial showed the TV exploding and she was afraid that would happen to them..in hindsight, it was a good excuse to not have to buy your kid something he really wanted
deleted 4y ago
[deleted]
marcodiego 4y ago
> This is probably to make the Game Genie codes seem more magical. Then there is an example of a code: "ZEXPYGLA". I'd think it was designed to be easier to memorize.
- chc 4y ago
  How do you think all the complex bit-shifting makes it easier to memorize?
wzdd 4y ago
I bought one of these recently, and it's amazing how powerful it is given that it's a toy. It sits on the bus between the CPU and the cartridge, so you effectively get to change up to three bytes of program text / rodata* on the fly. My favourite code is ANTOSA. This is a code for Super Mario Bros. which turns all pipes you can't enter upside-down. SMB1 has been disassembled with commentary, so it's now possible to see how the code works. It turns out there is a table of blocks for the top two layers of both non-warp and warp pipes, that looks like this: VerticalPipeData 98dd: 11 10 .bulk $11,$10 ;used by pipes that lead somewhere 98df: 15 14 .bulk $15,$14 98e1: 13 12 .bulk $13,$12 ;used by decoration pipes 98e3: 15 14 .bulk $15,$14 The code to draw the pipes gets this address of this table and stores it in the Y register. Then, if the pipe isn't a warp pipe, it executes 4 INY (increment Y) instructions in a row to adjust the offset. The ANTOSA code just replaces two of the INY instructions with a two-byte BVS (Branch on Overflow Set) instruction. However, the Overflow flag is never set at this point, so effectively this instruction is a two-byte no-op. The practical upshot is that Y is only incremented by 2, which means it points two bytes inside the "pipes that lead somewhere" data rather than directly at the "used by decoration pipes" data. It turns out that the first two bytes determine the top of the pipe, and the second two bytes determine the second layer, so decoration pipes are effectively drawn (second layer, top layer). And voila -- "upside down" non-warp pipes. If it was intentional, it was very clever. But I suspect it wasn't -- BVS is an odd choice for a two-byte NOP! An alternative would be change one of the INYs to a DEY (decrement Y), producing the functionally-equivalent codes EETOKX, EETOSX, EETOVX or EETONX, depending on which INY you change. I admit ANTOSA sounds cooler. The full SMB disassembly (not mine) is here if you're interested: https://6502disassembly.com/nes-smb/SuperMarioBros.html https://6502disassembly.com/nes-smb/SuperMarioBros.html * Typically. NES cartridges could also contain RAM.
- raldi 4y ago
  The Game Genie decoder at https://games.technoplaza.net/ggencoder/js/ https://games.technoplaza.net/ggencoder/js/ claims that ANTOSA means, "Overwrite $18ED with 0x70". 0x70 is indeed BVS, but how does that address (or its endian-corrected $ED18) correspond to any INY instructions in the disassembly?
regus 4y ago
The Game Genie code that is forever etched in my brain is PIGOAP, it lets you swim in any level in Super Mario Brothers 1. https://youtu.be/yjBsHyJlkRE?t=16 https://youtu.be/yjBsHyJlkRE?t=16 --- There is a guy on Youtube called "Displaced Gamers" that explains how NES games work. There is an interesting episode where he breaks down how a certain item in the game Faxanadu behaves. It's a pendant that is supposed to increase your attack power, but when you get it does the opposite. In the video he explains exactly what is going on in the code: the game was shipped with a bug. He then goes about crafting a Game Genie code to fix the bug. It's a fascinating video: https://www.youtube.com/watch?v=FeemO9yW-hs https://www.youtube.com/watch?v=FeemO9yW-hs --- If you are curious as to how the Game Genies works, watch this: https://www.youtube.com/watch?v=C86OsYRACTM https://www.youtube.com/watch?v=C86OsYRACTM --- If you are curious about the origins of the Game Genie, watch this: https://www.youtube.com/watch?v=fOm4qR4fFDA https://www.youtube.com/watch?v=fOm4qR4fFDA
- camtarn 4y ago
  It was watching the recently-HN'ed Displaced Gamers video on Super Mario's warp zones that actually got me curious about how the Game Genie codes were encoded :) I'm definitely going to go through his past videos - looks like so much interesting stuff in there.
- aidenn0 4y ago
  The NES release of FF I has quite a few bugs. There's a page that lists them all along with patches: https://gamefaqs.gamespot.com/boards/522595-final-fantasy/45575058 https://gamefaqs.gamespot.com/boards/522595-final-fantasy/45...
  - jandrese 4y ago
    It's impressive how much of those patches are NOPing out code bloat. An enterprising hacker could probably do some interesting stuff with the space freed up just fixing the bugs.
TazeTSchnitzel 4y ago
If this interested you, you'll probably love this video series that reverse-engineers the “passwords” used by old NES games for saving data: https://youtube.com/playlist?list=PLzLzYGEbdY5nEFQsxzFanSDv_38Hz0w7B https://youtube.com/playlist?list=PLzLzYGEbdY5nEFQsxzFanSDv_...

164 points by camtarn 4y ago

deleted 4y ago

[deleted]

The one I have memorized: GXXZZLVI Still couldn't get anywhere in Battletoads even with infinite lives! Also, the form factor seemed like it hastened the demise of our NES, making the cartridge connection even more flakey than normal wear and tear.

JohnBooty 4y ago
Really? Hmmm, I would have expected it to extend the life of the NES's slot, at least if the GG was left permanently inserted. Because then the Game Genie's slot would be subject to wear + tear + oxidation, not the NES's slot. This is pure speculation on my part and is, it seems, incorrect.
- password4321 4y ago
  I'm not sure we ever tried unplugging the cartridge from the device while inside the console, that sounds like it would have been a good idea. IIRC it was mostly how the wedge on top pushed things down so the bundle would correctly be detected as completely inserted, eventually the Game Genie was pretty much required.
  - behringer 4y ago
    That happens more or less normally. Just requires some adjustment to the slot connector.

JamesSwift 4y ago

How were the original codes collected? I assumed the devs themselves were somehow involved in the process? But then I read the Wikipedia article and it outlines how Nintendo tried to shut it down, so that seems unlikely. I guess the manufacturers really just manually sat down and figured them all out on their own... pretty crazy.

upupandup 4y ago
Even more curious is how do ppl discover the hex codes for like Gameshark? I had a friend who would just guesstimate and successfully able to manipulate playstation games. It was fascinating to watch.
- K0SM0S 4y ago
  This is actually amazing: > The code is GOSSIP (amazing coincidence that it happens to also be an English word). This works in Capcom's Ghosts 'n Goblins to start your player with a really funky weapon. Oh, the potential for easter eggs if you anticipated the use of a Game Genie by players, this was meta-gaming at its earliest in strictly offline mode. You could even hide codes in-story for later replays and whatnot. What's not to love about such a hacky mode of expression, a hacking-friendly barebones paradigm.
- kbrackbill 4y ago
  I'm not sure if this applies to the playstation, but I remember the nintendo 64 gameshark I had had some "code finding" features that involved using a button on the cartridge to filter down to memory addresses that had changed a certain way since the last button press. This meant that if you were looking for say, the address where your character's health was stored, you could press the button, get hit in the game, press the button again, and search for values in memory that had decreased since the last button press. Doing this several times was a fairly reliable way of finding things. I'm a bit fuzzy on the details but that was the general idea. Most modern emulators have similar but much more fleshed out features. They're nice not only for finding cheat codes but for reverse engineering games for the purposes of making romhacks or tool assisted speedruns and things like that.
  - 0des 4y ago
    huh, okay I always wondered what the button did. I always assumed it was to 'activate' codes that were input, maybe for a different game that I hadnt played yet and thus hadn't needed to use it yet.

VyseofArcadia 4y ago

> After all, given 2 Game Genie codes, one that granted 5 lives on startup and another code that granted 9 lives, and the only difference between the 2 codes was one character, even a novice player could probably figure out that modifying that one character to any of the acceptable letter characters would grant between 1 and 16 lives on startup. I fail to see why that was an outcome they wanted to avoid.

monocasa 4y ago
They sold books of codes in addition to the hardware.
- VyseofArcadia 4y ago
  I bought some as a kid, and the real value wasn't additional codes for games already covered, but codes for new games that didn't have any yet. I would have felt pretty ripped off if I had spent what little money I could get on the newest Super Mario Bros. 3 codes only to discover it was six extra lives when I already had a code for three.
- delecti 4y ago
  At least some of those code books also included instructions for that kind of experimentation though. I very clearly remember my dad using those instructions to change Mario's jump height in SMB1 to just bypass whole levels by modifying the existing jump height codes.
bluedino 4y ago
Increases the values of the codes. They could sell another code book with more codes for the same games etc
cortesoft 4y ago
I also remember being able to do something like this with the Sega genesis game genie… you could modify some of the codes with simple changes to change the number of free lives given, for example.

jmiller099 4y ago

Love this! Was in my bookmarks as I had to make a couple of codes late last year to slow the ball in arkanoid, so it could be enjoyed by someone who couldn't keep up. Needed to use FCEU to find the ball speed info and some online references to the 6502 ASM instruction set for substituting instructions to keep the ball slowed.

lastangryman 4y ago

I had the Game Genie. Young me had no idea how it worked, but I sort of had an intuitive guess when I entered some random codes in and mario level 1 suddenly became full of random bits of pixels you could climb up and jump around on. Amazing read.

konfusinomicon 4y ago
I had a friend whose mother wouldn't allow him to get one because the commercial showed the TV exploding and she was afraid that would happen to them..in hindsight, it was a good excuse to not have to buy your kid something he really wanted

deleted 4y ago

[deleted]

marcodiego 4y ago

> This is probably to make the Game Genie codes seem more magical. Then there is an example of a code: "ZEXPYGLA". I'd think it was designed to be easier to memorize.

chc 4y ago
How do you think all the complex bit-shifting makes it easier to memorize?

wzdd 4y ago

I bought one of these recently, and it's amazing how powerful it is given that it's a toy. It sits on the bus between the CPU and the cartridge, so you effectively get to change up to three bytes of program text / rodata* on the fly. My favourite code is ANTOSA. This is a code for Super Mario Bros. which turns all pipes you can't enter upside-down. SMB1 has been disassembled with commentary, so it's now possible to see how the code works. It turns out there is a table of blocks for the top two layers of both non-warp and warp pipes, that looks like this: VerticalPipeData 98dd: 11 10 .bulk $11,$10 ;used by pipes that lead somewhere 98df: 15 14 .bulk $15,$14 98e1: 13 12 .bulk $13,$12 ;used by decoration pipes 98e3: 15 14 .bulk $15,$14 The code to draw the pipes gets this address of this table and stores it in the Y register. Then, if the pipe isn't a warp pipe, it executes 4 INY (increment Y) instructions in a row to adjust the offset. The ANTOSA code just replaces two of the INY instructions with a two-byte BVS (Branch on Overflow Set) instruction. However, the Overflow flag is never set at this point, so effectively this instruction is a two-byte no-op. The practical upshot is that Y is only incremented by 2, which means it points two bytes inside the "pipes that lead somewhere" data rather than directly at the "used by decoration pipes" data. It turns out that the first two bytes determine the top of the pipe, and the second two bytes determine the second layer, so decoration pipes are effectively drawn (second layer, top layer). And voila -- "upside down" non-warp pipes. If it was intentional, it was very clever. But I suspect it wasn't -- BVS is an odd choice for a two-byte NOP! An alternative would be change one of the INYs to a DEY (decrement Y), producing the functionally-equivalent codes EETOKX, EETOSX, EETOVX or EETONX, depending on which INY you change. I admit ANTOSA sounds cooler. The full SMB disassembly (not mine) is here if you're interested: https://6502disassembly.com/nes-smb/SuperMarioBros.html https://6502disassembly.com/nes-smb/SuperMarioBros.html * Typically. NES cartridges could also contain RAM.

raldi 4y ago
The Game Genie decoder at https://games.technoplaza.net/ggencoder/js/ https://games.technoplaza.net/ggencoder/js/ claims that ANTOSA means, "Overwrite $18ED with 0x70". 0x70 is indeed BVS, but how does that address (or its endian-corrected $ED18) correspond to any INY instructions in the disassembly?

regus 4y ago

The Game Genie code that is forever etched in my brain is PIGOAP, it lets you swim in any level in Super Mario Brothers 1. https://youtu.be/yjBsHyJlkRE?t=16 https://youtu.be/yjBsHyJlkRE?t=16 --- There is a guy on Youtube called "Displaced Gamers" that explains how NES games work. There is an interesting episode where he breaks down how a certain item in the game Faxanadu behaves. It's a pendant that is supposed to increase your attack power, but when you get it does the opposite. In the video he explains exactly what is going on in the code: the game was shipped with a bug. He then goes about crafting a Game Genie code to fix the bug. It's a fascinating video: https://www.youtube.com/watch?v=FeemO9yW-hs https://www.youtube.com/watch?v=FeemO9yW-hs --- If you are curious as to how the Game Genies works, watch this: https://www.youtube.com/watch?v=C86OsYRACTM https://www.youtube.com/watch?v=C86OsYRACTM --- If you are curious about the origins of the Game Genie, watch this: https://www.youtube.com/watch?v=fOm4qR4fFDA https://www.youtube.com/watch?v=fOm4qR4fFDA

camtarn 4y ago
It was watching the recently-HN'ed Displaced Gamers video on Super Mario's warp zones that actually got me curious about how the Game Genie codes were encoded :) I'm definitely going to go through his past videos - looks like so much interesting stuff in there.
aidenn0 4y ago
The NES release of FF I has quite a few bugs. There's a page that lists them all along with patches: https://gamefaqs.gamespot.com/boards/522595-final-fantasy/45575058 https://gamefaqs.gamespot.com/boards/522595-final-fantasy/45...
- jandrese 4y ago
  It's impressive how much of those patches are NOPing out code bloat. An enterprising hacker could probably do some interesting stuff with the space freed up just fixing the bugs.

TazeTSchnitzel 4y ago

If this interested you, you'll probably love this video series that reverse-engineers the “passwords” used by old NES games for saving data: https://youtube.com/playlist?list=PLzLzYGEbdY5nEFQsxzFanSDv_38Hz0w7B https://youtube.com/playlist?list=PLzLzYGEbdY5nEFQsxzFanSDv_...