Street Fighter Zero 2 - Action Replay code for 60hz bypass?

Hi all,

I'm Anthony, from down under Australia.

I'm generally not a tinkerer when it comes to games, but I've joined this forum seeking some insight.

I recently purchased Street Fighter Zero 2, Super Famicom cart, for use with my PAL SNES. Assuming it would work like a Street Fighter 2 Turbo Super Famicom cart I bought as a kid in the 90's, using a Universal Adapter, I tried it out - no good, just jail bars on the screen.

Tried my Pro Action Replay with a PAL game piggy-backed - same issue.

After some research, I found it was due to the S-DD1 security chips in these carts (like Star Ocean), which forbid devices like these adapters from blocking its ability to talk to the security chip inside the SNES to verify region.

I found some information online, showing one way around this, was to open the cart, lift pin 82 on the S-DD1 chip, removing it from ground, and giving it 5v. I performed this modification to force it to PAL, and as such, communicate with the SNES directly (with no adapter), thus allowing its region security procedure to run.

This worked. The game booted up directly slotted into the PAL SNES, however with a warning 'This game pack was not designed for use with your Super Nintendo Entertainment System (PAL)'.

The game continues to boot, and performs its normal game introduction.
I proceeded to play the game, and it played well. That was, until I won my first fight, and the finish 'taunt' screen comes up with Ken on the screen and his one liner...
After that screen, instead of going to the next fight, the 'PAL' warning message comes up again, and reboots the entire game.

Although I bypassed the hardware security in this cart, it appears Capcom has a coded security check to check for region / 60hz perhaps. It teases you and lets you play a bit before rebooting. I found other games around, like Demons Crest on Youtube, does the same thing after playing one level, when using it in a PAL system.

After looking online, I found a good way to see if it was my hardware fix at fault, or a code thing. I downloaded the Japanese Zero 2 ROM, and tested it on ZSNES emulator, with the option 'force PAL' - Identical symptoms! Reboots after one fight and same PAL warnings.

Now you're thinking 'why bother with PAL' and 'ugly borders' and 'slower frames' etc.

You're right, PAL is inferior to the purist, I agree.

But, I have my childhood SNES, and my entire collection is all PAL (so I'm not starting again), except 2 carts, and I'm not really looking to increase my collection any further in future, other than a couple of extra carts here and there. I just wanted Zero 2, because I had all other Street Fighter carts on SNES and just wanted to complete the collection.

A few things I wanted to clear up, and I might be unreasonable so I apologise

- I don't want to hard-modify my console with a new CIC, or a switch for 50/60Hz. Not for the sake for just one Zero 2 cart not working, and not when all my other games work perfect. Seems drastic. I know it'd be beneficial to have an NTSC option if I were to get an Everdrive cart for example, but I know that won't be a path I'd be going down, and I dont forsee any further NTSC titles at this point.

- If I cant get this cart working, I'm not spending 3-4 times the amount on a PAL version of Alpha 2. I'll probably just give up on the idea and just keep the cart for the sake of having all Street Fighter SNES games in my collection. I have Zero 2 on my arcade machine, so I'm not really in it for the fast 60Hz speed or perfection, so if it were to run in PAL i'd be happy to throw it in and play it every now and then on the SNES.

- I dont want to buy a Super Famicom console just for the one cart to work.

- Why bother you ask - it's a challenge I guess, to see if there IS a way to get it working as is in PAL mode, via modification to the cart, or means of action replay.

Now that's out of the way, I'll tell you what I have done to try and troubleshoot.

1. Now that the cart was hard modified to PAL, I thought I'd try the Action Replay route again. With no piggy back PAL cart on the back, Zero 2 boots as normal, however still complaining about 'not designed for PAL'. The action replay does not trick the 50/60hz check.
With a PAL piggy back cart inserted on the rear, the game does not boot, it goes back to a jail-bar screen (as it did prior to modification), assumably due to the security chip being blocked I'd suppose. Universal adapter with piggy back - jail bars. The cart will now only function if directly connected to SNES, or with Action Replay with no piggy back cart, but of course with a PAL warning/reboot after one fight.

2. I found an Action Replay code online for 'Alpha 2', whereby you can select what 'level' fight you want to start at. I entered it in choosing level 2 or 3 from memory as the code, then started the game.
I chose my character at the character select screen, and then it showed 'next fight', and sure enough it started me on 'fight 3' with two other fighters crossed off my list as though I had fought and beat them already (despite only just booting the game) LOL. It left me fight, and I won, and then came the finish taunt one liner with Kens face, followed by 'not designed for PAL', and game rebooted. So basically, the security isn't set to JUST check after one fight, but its set to check after any fight it seems.

3. Upon research online, I found a tool called UCON64. I used it on the Japanese ROM I downloaded of Zero 2, using the switch -f , which removes region check on the rom. It edited the ROM file, and made a new .sfc rom file export.
I used the new rom in ZSNES, with 'force PAL' - issue resolved. No more PAL warning screen, despite being in 'force PAL'
Unfortunately though, not resolved in real life on my actual SNES, as this was fixed by editing a ROM file on a PC.
I then performed a command in UCON64 to check the original ROM file VS the newly modified file (I also performed this check in a normal HEX editor comparing tool) - both gave me this same information:

1 difference between the two files:

Original ROM
0000271c f0

Fixed ROM
0000271c 80

This is where I got stuck. I don't know what I can do with this data.

I guess I was hoping for a solution which is cart based, not console e.g:

1. I thought that there might be a way to use the above data from the fixed rom, to make a Pro Action Replay code (remembering the cart boots with Pro Action Replay, as though it were a PAL cart, provided no piggy back cart is connected). I was wondering if a Pro Action Replay code could be made from this, as a way to bypass the 50/60Hz check.

I can see there's action replay codes to bypass SRAM check here for Donkey Kong Country 2, I have to imagine there's a way for Action replay to bypass the region check:

http://board.zsnes.com/phpBB3/viewtopic.php?f=9&t=10645

Does someone have the ability to read the data from the game to work out how to obtain such Action Replay codes?!

If the above code doesn't help make an Action Replay code - is there any other way to bypass 50/60Hz check without modifying the console?

2. There is a bypass for the S-DD1 hardware chip via forcing it to PAL via pin 82 to + voltage. Are there any further mods which can be done to the one cartridge, to overlook the 60Hz 'PAL' concern?

3. I imagine there'd be a way to re-write the 'fixed' ROM file to the current rom chip in the Zero 2 cart, or replacing it with another chip. Problem is, the costs involved in getting a replacement chip and writing hardware, would just write off the cart, and may as well just get a PAL cart (which I dont want to bother spending money on).

I guess if either of the two above options are possible, please let me know.

Thanks heaps!

It's been a long time since I wrote my SNES PAR code parser, but doesn't the PAR just work with RAM addresses? Unless the data you want to modify is loaded into RAM before it's used you may need a Game Genie instead.

As for why you're getting that error message in the first place: SNES/SFC games have (at least) two kinds of region lockouts (well three if you count the difference in cart shape between NTSC SNES and SFC / PAL SNES). There's the CIC which you've already bypassed. Then there's a way for the game software to check - whenever it wants during runtime - if it's running on a PAL system or an NTSC system. Some games perform that check, some don't.

The PAR Mk2 and Mk3 both support patching ROM, so as long as you have either of those (or a Game Genie) it should be pretty trivial to patch away the software region check.

Based on the file difference you posted (which looks like it takes the usual approach of changing a branch instruction) the code C0271C80 should work, but I can't verify that at the moment since I'm at work.

I'd call that a workaround: the CIC for the S-DD1 is physically inside the S-DD1. When you change how pin 82 is tied, you change it from an NTSC to a PAL CIC.

And, the reason it didn't work with the pass-through ever: the S-DD1 requires a valid CIC handshake in order to operate. So when the universal adapter puts a bonus CIC in to fool the console ... it still doesn't fool the CIC in the cartridge.

Unfortunately, mask ROMs are like pressed CDs—they only contain one piece of content ever. It would be possible to remove the ROM, buy a replacement flash ROM, program it, and solder that down ... and if you know a friend with the relevant hardware it might even be a reasonable price.

You could build relatively simple (but comparatively large) extra hardware that would replace that one byte at that one address with the replacement value (like a permanent game genie). Three resistors, three transistors, and a 24-bit digital comparator (which needs to be made of a bunch of separate parts)

Hi all,

Thank you for your detailed and prompt responses!

I received responses on here, as well as ROMHacking forum, as I was trying to get maximum exposure on such a select problem.

'Revenant' from here provided a code C0271C80 - Thanks!

and, on the other forum, I was provided a code 7E1DC700 by user 'rainponcho' - Thanks!

I tested both codes individually on PC, on ZSNES, with 'force PAL'. These were the results:

1. Code C0271C80 - bypassed the boot warning of 'This Game Pack was not designed for your SNES (PAL)'. I played a couple of fights, and after each fight, the next fight came up! It works 100%

2. Code 7E1DC700 - bypassed the boot warning of 'This Game Pack was not designed for your SNES (PAL)'. I played one fight, and directly after the taunt screen following the fight, the 'This Game Pack was not designed for your SNES (PAL)' warning came up, and the game rebooted. Strange that it was able to bypass the initial warning screen though?! It's as though it fixed half the problem.

Unfortunately, in real life (not emulation), I only own a Pro Action Replay 1. I did test code C0271C80 on it - and it did not work at all.
I imagine this to be due Revenant's comment, that only Pro Action Replay 2 or 3 will work with this code due to working with ROM, not just RAM (if i understood that correctly).

I have not had a chance to test 7E1DC700 code in real life on Pro Action Replay 1 - I'll try tonight - though I imagine if it does in fact beat the initial 'PAL' Hz check screen, that it will demonstrate the same issue that the emulation shows - that the protection kicks in after the first fight is completed. It's as though code 7E1DC700 is part of the equation. Perhaps a second code is needed for the additional checks the game performs?! Not sure. Chances are my Action Replay 1 might not even be capable full stop with either code provided.

So I guess this leaves me with a question. ZSNES allows you to enter multiple codes from different cheat devices. It says 'enter a Game Genie, Pro action replay code etc etc.'. So when you enter in C0271C80 , how do we know which cheat device the ZSNES is emulating?! Is it, it's own cheat engine? Does the code depict which device it needs to use? How do we know this code isn't in fact just working by emulating one certain device. Is there a way to find out what exact device or BIOS zsnes is using to make this code work?

Basically, I want to make certain that a Pro Action Replay 2 will in fact 100% work with code C0271C80, before I spend the money on one. My aim would be to buy an Action Replay 2 (easily available locally), and sell my Action Replay 1 to offset the cost (they seem to sell easy locally which is good). I just dont want to buy an Action Replay 2, to find out, I have to sell it, and chase down a rarer Action Replay 3 from overseas instead.

Any info would be greatly appreciated and thanks for everyone's efforts so far!!

Anthony.

Thank you for all the help put in, this is now working 100% with no console modification.

Ive put some photos up. I really need to get a CRT

Basically, once the S-DD1 chip is modified for PAL on the Zero 2 cart (pin 82 lifted, and wired to 5v), you then connect the game to an Action Replay 2 with version 2 BIOS firmware, and enter code C0271C80, in order to bypass the secondary 'this game pack is not designed for PAL' security message.

Once I entered in the code, pressed enter to start game, I flicked the action replays' switch to the top position in order to activate codes, then pressed Reset on the SNES console, and off it went.

Thanks again!