Driving you into cyber dive

In a previous article I posted a link to a script that can patch Burning Rangers Taikenban (the trial version of BR) to enable additional levels. That was just a warmup! This post includes step-by-step instructions for doing the following tricks:

• Selecting levels and characters

• Controlling the auto demos

• Enabling Versus mode and co-op mode

• Manipulating objects

My hope is that you'll try these tricks yourself tell me about new ones you find! But if you just want to look at the pictures and watch the videos, that's cool too.

Gallery

Let's not bury the lede: these techniques reveal that Versus mode was present in the released versions of Burning Rangers. We had it all along!

The main Versus arena isn't much better than the version in the January 3 prototype. Actually, it's worse — Player 1 is stuck under the floor and can't get out (some hacking can fix this). And there's only one room instead of three. It looks cool, though! Videos: Shou & Tillis, Big & Lead.

Two player co-op can also be enabled in the released versions of BR. Player 2 can tag along and collect crystals. Having another Ranger can lead to some goofy results, like Lead meeting himself in Mission 4.

Level select allows you to explore inaccessible parts of various discs:

• The December 1 prototype doesn't let you get past Mission 2, but with level select you can check out Missions 3 and 4.

• Burning Rangers Taikenban normally lets you play part of Mission 1, but with level select you can play the rest of it.

Combining level select with character select allows you to put characters into places they normally can't go:

• You can put Big, Lead, Chris, or Iria into Mission 4 (yes, Iria can rescue herself)

• You can play the Training space with characters other than Shou and Tillis

Things get more interesting when you add in "Auto Demo control."

• Flash Sega Saturn Vol. 25 normally lets you watch a few scripted demos, but it's secretly a prerelease build of the game. You can control it and explore it!

• Similarly, Sega Flash Vol. 7 is meant to let you watch scripted demos. But if you take over control, you've basically got a copy of the EU release.

So If you don't want to drop $500 on Ebay for Burning Rangers, try Sega Flash Vol. 7 for $15!

Editing object data lets you do lots of cool stuff, like replacing all locked doors with crystals.

There are some cool items in the December 1 build that are missing from the final game. Check out these capsules with cards inside them — doesn't the purple one look like an Ideya? They reduce the limit by 5 points when you collect them.

Some interesting debug screens can be turned on. One showing the players coordinates relative to objects in the level is enabled by default in the January 3 build, but it's got extra information about the current level's password in the final version.

Another set of debug screens has information about the player's position and rotation, and another set gives details about the camera.

Pro Action Replay codes

Most of the tricks can be done with Pro Action Replay codes. If you don't want to mess around with memory editing yourself, try this instead. The code list includes:

• Level select for the December 1 and January 3 prototypes

• Control and level select for Flash Sega Saturn Vol. 25 and Sega Flash Vol. 7

• Level select for the release versions of Burning Rangers

• ...and more!

Thanks to some hard work by privateye, these codes are included in Pseudo Saturn Kai. They've been tested on real Saturn hardware!

Tools and terminology

I used the Mednafen emulator; it can play all of the BR discs without issue on my machine. You can use the Mednafee frontend to get a GUI.

You'll need to supply your on BIOS files (see the Mednafen docs) and disc image backups. I trust you to obtain these in an appropriate manner.

Once you're able to load a game to play it, you'll want to familiarize yourself with these keyboard shortcuts:

• Number keys 0 through 9: select a save state slot – you'll be using a lot of these

• F5 key: save to the current save state slot

• F7 key: load from the current save state slot

• Alt+D: Toggle the debugger

  • Alt+1: Go to the CPU debugger.

    • S key: Pause the emulation and advance one instruction.

    • R key: Resume the emulation.

  • Alt+3: Go to the memory editor.

    • > (hold shift, press .): Switch memory tabs.

    • G key: Go to a particular memory address

    • S key: Search for a hex string in memory

    • Insert key: Enable editing. Type in the hex value to do the edit.

Step by step guide

Most of the exercise below will follow this template:

1. Enable the debugger (Alt+D)

2. Go to the CPU debugger (Alt+1)

3. Press a button on your controller

4. Pause the emulation (S)

5. Open the memory editor (Alt+3)

6. Switch to the High Work Area tab (>>)

7. Go to a particular address (G)

8. Enable editing and change a value (Insert)

9. Go back to the CPU debugger (Alt+1)

10. Resume emulation (R)

Level select

Try this with one of the final versions of the game (Japan, US, or Europe) to get the hang of it. The same trick also works for all of the prereleases.

Start up the game and select Story mode. Choose Tillis as your character. Once you're at the Mission select screen, take a save state.

Pull up the CPU debugger. Press Start on the controller to select a mission. As the screen starts fading, pause the emulation before the loading screen comes up. If you miss your chance, load your save state and try again.

Open to the memory editor and switch to the High Work Area tab. Go to the address FFC15. Its current value will depend on which Mission you selected. Enable editing and change it to one of the following values:

• Mission 1: 00, 01, and 02

• Tutorial: 03

• Versus arena: 04

• Mission 2: 05, 06, 07, 08, 09

• Mission 3: 0A, 0B, 0C

• Mission 4: 0F, 10, 11, 12, 13

Each mission is composed of multiple "rounds." The last one is always the boss. 0E is the cutscene that follows Mission 2; you can't really play it. 0D is missing for unknown reasons. The Training space, Versus arena, and boss round of Mission 4 are missing in some of the prereleases.

If you want to change characters, see the next section before you resume the emulation. Your chosen round will load upon resumption.

Character select

Follow the same steps above for level select. Before you resume the emulation, go to the address FFC19. Its current value will be 01 if you chose Tillis. Change it to one of the following values:

• Shou: 00

• Tillis: 01

• Big: 02

• Lead: 03

• Chris: 04

• Iria: 05

The Dec 1 prototype only has Shou and Tillis implemented. Flash Sega Saturn Vol. 25 and the Jan 3 prototype won't load Chris or Iria because they're missing loading screens, but you can switch to them if you start a Mission with a different character and change in between rounds.

Multiplayer

Follow the same steps above for level and character select. Before you resume the emulation:

• Go to the address FFC1F. This controls multiplayer — set it to 02.

• Go to the address FFC1A. This controls the second player's character — set it to one of the values above.

When you resume the emulation, you'll have Angels With Burning Hearts playing and a second player can control player 2. This only works on the Jan 3 prototype and the final releases.

If you select round 04, you'll have the Versus Mode arena to play in. The final release version has player 1 stuck under the floor, however, so it's not very fun. You can fix this by changing memory address 28062 to 6F.

If you choose a different round, you can have something like a broken Sonic & Tails co-op experience.

Controlling auto demos

We'll start with Flash Sega Saturn Vol. 25. Start up the demo disc and select the Burning Rangers item from the menu. Once you get to the BR title screen, take a save state.

Pull up the CPU debugger and wait for the screen to fade to black. Once it starts fading, pause the emulation. If you miss your chance, load your save state and try again.

Open to the memory editor and switch to the High Work Area tab. Go to the address FEF54. It should be set to the value FF (auto demo). Change it to 00 (normal control). Then pull up the CPU debugger and start the emulation again.

That's it! Japanese gamers could have played Burning Rangers early and for free if they'd had the right Pro Action Replay code. Character and mission selection works as described above, so you can explore all of the missions.

Sega Flash Vol. 7 is a UK demo disc that works the same way, except the address to edit is FEF58. This one is slightly less exciting because it was built after the Japanese release version. It's missing the files for voice navigation, alas.

Editing objects

This information comes via Andreas Scholl, the patron saint of Burning Rangers.

Start mission 1 and let it load for a moment. Just before the loading screen disappears, take a save state. Pause the emulation and then open the memory editor. Go to address B1390. You'll see these values: 18 04 0B 9D 00 00 00 00.

The first three bytes are coordinates. The fourth byte is an object type: 9D is a red crystal. The next four bytes are object-specific parameters, which are all 00 for crystals.

Change 9D to 9E and resume your emulation. You'll notice that the two crystals at the start of the mission have changed: one of them is now green. Indeed, 9E is a green crystal.

That's the essence of the trick! Here are some object codes to play with:

• 01: Survivor

• 02: Orange flames

• 10: Blue fuel tank

• 11: Red fuel tank

• 12: Yellow fuel tank (!)

• 13: Burning sun enemy

• 1C: HST-2000 robot

• 32: Voice cue

• 40: Flamethrower

• 51: A door with yellow on one side and red on the other, left/right orientation

Many objects cause crashes or prevent the stage from fully loading, so be prepared to spend a lot of time resetting your state. Some objects only load in a particular mission, e.g. 7E is a dolphin in Mission 2.

The limit-reducing capsules referenced above are 0x21 through 0x2B in the December 1 build of the game; they're gone in other builds.

We don't know quite what all the parameters do, so if you discover something interesting, do let me know! A good round to play with things in is 0x11, the part of Mission 4 with all the platforming: it's relatively empty, and there are six crystals (9D) easily find-able in the memory.

Other tricks

Address FFC30 is normally set to 02 in the final release, but it seems to have flags that can be combined:

• 10: The limit doesn't increase and you can't die. This is INVINCIBLE from the hidden debug menu in some builds.

• 20: Shows debug information on the screen. This is DEBUG DISP from the hidden debug menu in some builds. It is set by default in the January 3 prototype.

The other flags are the IMM GOUR, CRYSTAL ALL, CRYSTAL 20, and LIGHT ONCE items from the December 1 build's debug menu (they are at FFC2C in that build). I have no idea what they do. Tell me if you figure it out! 

Address FFC31 also has flags that seem to be combine-able. They match with the December 1 build's debug menu:

• 01: NO DISP, the character doesn't show up at all.

• 02: PLAYER-2, this is a broken multiplayer mode. The second player can't move; only move the first player's position with jump.

• 04: INFO OFF, this removes the HUD and the limit.

• 08: NO OBJECT, this disables all objects. The result is not very playable.

In the December 1 build these are at FFC2D.

Screens with player and camera position data can be enabled by setting 1E45D to values between 01 and 08:

• 01: PL-MOTION

• 02: PL-POS

• 03: PL-CAMPOS

• 04: PL-ROT

• 05: CAM-ROT

• 06: CAM-POS

• 07: CAM-MESH

• 08: CAM-MOD

Address FFC1F can be set to 04 to enable "BGM mode." That is, Angels With Burning Hearts will be playing during missions.

Let me know if you find other things!

Open questions

Here are things I'd like to figure out:

• There's a debug menu in the final game, or at least the strings for one. Can it be enabled? Answered! It can't be displayed, but you can control it invisibly.

• Can the placement mode from the January 3 build be enabled in the final releases? Answered! You can, but not with a button press.

• How about the SET LIGHT camera trick from the December 1 build?

• What was MAP EDIT supposed to do?

• Are the spinning fan and anti gravity hallway from the prototypes in the final release? Answered! The locations are still there, but the gimmicks are gone.

• More about how the password system works

Also, if you happen to have, say, the Tokyo Game Shown '97 Autumn build of the game, please get in touch...