Metroid: "ENGAGE RIDLEY MOTHER F*CKER" ...actually works?

First, pardon the censor as I'm not sure if this forum would tolerate explicit language, even if it's part of a cheat code. Second, I don't know where this should go, I chose hardware since it works on actual NES hardware, and on a specific version of the game. If it's the wrong subforum, feel free to move.

Okay, so a few months back, I made a thread about coming into possession of a multicart, of which some games were broken. Anyhow, one of the games on the multicart is Metroid, and unlike most multicart versions of games, it doesn't have a mangled title screen or removed copyright. However, it appears that this version of Metroid is special, as it's the only version where the infamous ENGAGE RIDLEY MOTHER FUCKER password actually works, and doesn't crash the game nor does it load you into a bad area. Here is the video proof.

https://www.youtube.com/watch?v=YE8y5QAd5ew

If you look this code up on YouTube, you will see a variety of videos with largely the same result, with the exception of this one:

https://www.youtube.com/watch?v=gp75tGICd_M

Much like mine, it loads Samus with her Zero Suit, the ice beam, three tanks of health, and 82 missiles. What it does different is that it loads her into Brinstar with glitched graphics, and the stage does not scroll left or right. In my version it loads her into Tourian, which is also a stage that does not scroll left or right, only up and down. What's interesting is that, according to this map, Tourian is directly above the starting location of Brinstar, so maybe the game erroneously loaded the wrong Y axis but (maybe?) loaded the correct tiles.

Another thing worth mentioning: Based on my playthrough, Samus does not have the morph ball ability and thus can't use the bombs, she doesn't have the spinning jump ability, she can have a maximum of 205 missiles, and if you go to the previous area, where you'd see a statue of Kraid and Ridley, only Kraid's is there while Ridley's flickers (is it supposed to do that?). The bridge is also not present, which leads me to believe that the game does a logistics check, and considering it's impossible for you to be here (and also impossible to leave), the game crashes as a result. Some other interesting things; in Mother Brain's room, only the final barrier is erect, the first four are opened, and the game over sound appears to be slightly glitched. The game over sound plays normally without this code.

So what does NESDev think? A possible new piece to a puzzle? An undiscovered dump of Metroid? Or was this discovered long before I have? My apologies if so.

A more accurate description is that the scrolling mode is set to vertical using this password (mmc1 has h/v mirror toggling at the programmers' disposal and the game has a h/v scrolling state in RAM). This applies to the original starting room here, but samus can't move in those directions in any meaningful way because of solids, thus blocking her from progression. In tourian, on the other hand, the location is actually a vertical shaft, so she can progress. The mirroring is set, as it happens, correctly for this shaft.

Scrolling direction is at addr $49, and temporarily also at $4A. Additionally, $57 keeps track of previous scrolling mode and door alignment so we know whether to toggle scrolling mode or not, and if any alignment needs to be done before control over samus is resumed after the transition.

I have a lot of thoughts on the matter. All of them are subjective, so they're worthless. What you're actually wanting is something definitive. Threads like this always are; speculation does nothing but brew falsehoods and rumours.

What is fact: definitive answers will come from whoever disassembles the entire game and takes the time to reverse-engineer the password scheme, combined with understanding what such passcodes end up doing. This is the only way you will know the truth behind what's happening. For example, this is the exact type of work that was required to understand how/what the "negative world" in Super Mario Bros was really about (hint: there are no negative world numbers).

My gut feeling is that several of these "humourous" passcodes just happen to be complying with overall password syntax rules but trigger/exhibit bugs as a result of what they modify in ZP/RAM -- speculation on my part, not fact.

The question I have is actually "why is the multicart version of Metroid the only one where the password works"? Perhaps it's an undiscovered dump, perhaps it has been modified slightly to fit on the multicart, and it just so happened to make the code work?

the metroid we know clears all of RAM and sets vertical mirroring on reset, so that rules out uninitialized memory/registers at least. Without disassembling this particular ROM or comparing it to an original ROM image, idk if much else can be said with certainty.

Same answer applies: no way of knowing without reverse-engineering everything, including both the menuing system and Metroid. It's the only way to get a definitive answer.

Speculative answer (read: no facts backing this up for this particular multicart or this game): multicarts -- much like the PowerPak -- use ZP/RAM for their menuing system. Some commercial games themselves don't initialise ZP/RAM properly, and end up reading values from ZP/RAM (that might normally be filled with $00 or $FF, i.e. power-on defaults if used in a legitimate (non-multicart) cartridge), thus ending up with different behaviour.

Here are some examples -- but far from a definitive list -- http://wiki.nesdev.com/w/index.php/Game ... RAM_values . You may notice some games do this intentionally as a form of pseudo RNG.

There have been several nesdev forum threads about these type of matters in the past few years.

If Metroid is a title which is known not to behave this way, then there still many possibilities, including a hacked version of the game (this is somewhat common with multicarts -- just because a title screen/etc. looks identical to the real thing doesn't mean it's the same code), or some general bugs in the multicart (maybe it leaves a particular PRG page loaded where on a real cart it would be mapped to something different). Just too many possibilities to cover.

Is it possible to rip individual games from multicarts? I can't seem to find this multicart ROM online, perhaps I (or someone else who owns it) could try dumping it? I just wanted to share my "discovery", in case it ever makes me internet famous or whatever.

It's usually possible. What mapper is your multicart?

<speculations galore> There's so many options. For example, if the initialization following the reset vector was removed from various games on the multicart, it hypothetically means you could inject cheats/mods into RAM from the loader/menu software as an alternative to including multiple copies of the same game hacked in various ways. This is highly speculative, of course. I'm not even sure if anyone would go through the trouble if the goal is to earn a quick buck off others' IP, but the process would be quick and straightforward. RAM init code is easy to find, and you could just replace it with NOP instructions in a hex editor or modify it to clear fewer pages of RAM or whatever. </s>

If you enter the relevant password into the Metroid Password Generator, it says "Invalid password: Reset bit is set".

If you read the corresponding technical documentation, it says:


So at least you know where to look.

I don't want to reiterate it all here, but here is a previous thread where we discussed this password and its effects in detail:

https://forums.nesdev.com/viewtopic.php?f=2&t=15160

I have no idea, it's possibly one of those new chinese multicarts with improper voltage regulators, which can damage consoles.

Very interesting thread. I've entered Dwedit's 000000 00000B 000000 00000B code and while it too works, it only loads default Samus into Tourian, rendering the game unwinnable. I also tried BBBBBB BBBBBB BBBBBB IIIIII and it too loaded Samus in Turian, with the zero suit, the wave gun, spinning jump, and 30 some rockets. However, getting past the metroids has proven to be difficult, and thus -potentially- unwinnable since they cannot be killed by any other means besides being frozen and then shot at with rockets.

Also I've come across a few rants of Koitsu regarding this code, but I reckon this should be different in that this is (to my knowledge) the only documented case of it actually working.

Oh, it's a physical multicart instead of one you've already got dumped? Yeah, that's an extra step in the way. I don't suppose you can easily open the cart and look inside?

Yeah, no surprise I've ranted about it -- I tend to be that type. Old habits die hard I guess. For some reason people just have a weird fixation on Metroid. It's either the passcode system or the "nude Samus" rumour, which I happily debunked in a YT video after a post here on nesdev. For the latter, the individual who started the thread thought it was hilarious that I took it so seriously -- "it was just a joke/attempt to troll" or some such -- except the subject had come up many times throughout my life that you could say I grew sick of it. Given the popularity of the video (it's still my top-viewed video on YT, which also bothers me, LOL), I'd say it's still to this day a long-running gag/subject/whatever.

But there's another reason for my general annoyance: if anyone was part of the original 90s emulation and romhacking scenes, they might remember the catchphrase CAN'T HACK METROID. So I'm not picking on you at all, believe me. :-)

When I was a kid, the JUSTIN BAILEY ------ ------ code was fascinating, simply because my tech-brain wondered "who is Justin Bailey and why is his name in this game?" It wasn't until I started programming that I realised it's could just be a "side effect" of the password system and that there were certainly other codes that would pass/work but have weird side effects or result in impossible scenarios. Kid Icarus has similar behaviours, IIRC (see ICARUS FIGHTS MEDUSA ANGELS, DANGER !!!!!! TERROR HORROR, or KidKid Icarus KidKid Icarus). The password systems felt horribly complex due to how long they were and how many characters there were, but in reality it all boils down to how its implemented/the algorithm. And let's face it: those passwords sucked unless you had immaculate handwriting.

At my age now, I think people just focus on Metroid because, much like the original Zelda, it was a pretty epic and amazing accomplishment for the time (mid-to-late 1986). It's one of several early-generation NES games that really struck a chord with players. But then again, that also applies to the NES itself; considering my previous (and first!) home console was an Atari 2600, the NES blew it out of the water. The Intellivision and Colecovision were "neat" but the games didn't feel as appealing. But let's face it: Nintendo's dominant marketing played a pretty big role too. So my point is: I get why Metroid is so neat/memorable, but every so often someone gets all focused on some edge case about some aspect of it and because of my age I'm like "here we go again", hahahaha. :-)

Here ya go. It's an interesting cartridge, it appears to be a famicom cart mounted to a 72-pin converter.

https://cdn.discordapp.com/attachments/ ... 133633.jpg

https://cdn.discordapp.com/attachments/ ... 133700.jpg

I believe that's one of those COOLBOY carts. Metroid will have been mapper hacked to MMC3 inside; should be pretty easy to dump it given a Kazzo or similar.

Perhaps being mapper hacked to MMC3 is what makes this version load otherwise invalid passwords? I find it amusing that all of the "invalid" passwords seem to load at Tourian. In any case, I'll see if I can source a Kazzo. That's if I feel like it.