ROM Secrets

Undocumented cheats found by reverse engineering

Hidden features, debug leftovers, and unknown cheat codes found by disassembling and decompiling retro game ROMs with Ghidra. Every finding includes the ROM address and hex so you can verify it yourself.

3 Games analysed
5 Findings
3 Platforms

Wizards & Warriors X: The Fortress of Fear

Game Boy Rare 1990
Cheat code
Uncapped lives: enter [heart]-2-[heart] on the Scroll of Honour Undocumented

The known cheat for this game is entering W-[heart]-W as your name on the high score screen to start with 6 lives. But the code at 0x2DF4 checks for a second name that no cheat database lists: [heart]-2-[heart]. This sets a flag that removes the 9-life cap entirely, letting extra-life pickups push you past the normal maximum.

2DD4 LD HL,$C31F ; load high-score name pointer 2DDA LD A,($C002) ; 1st character tile 2DDD CP $EF ; 'W' in tile encoding 2DDF JR NZ,$2DF4 2DE1 LD A,($C006) ; 2nd character 2DE4 CP $D4 ; heart symbol 2DE6 JR NZ,$2DF4 2DE8 LD A,($C00A) ; 3rd character 2DEB CP $EF ; 'W' again 2DEF LD A,$03 2DF1 LD ($C2F6),A ; known: W-heart-W = 6 lives 2DF4 LD A,($C002) 2DF7 CP $D4 ; heart symbol 2DFB LD A,($C006) 2DFE CP $CA ; '2' in tile encoding 2E02 LD A,($C00A) 2E05 CP $D4 ; heart again 2E09 LD A,$06 2E0B LD ($C2F6),A ; NEW: heart-2-heart = uncapped lives
ROM
0x2DF4 - 0x2E0D
Flag
$C2F6 set to $06 removes the 9-life cap on extra-life pickups
Verified
Ghidra SM83 static analysis + cross-reference with known W-heart-W code
How to use: On the Scroll of Honour (high score) screen, enter the heart symbol, then the number 2, then the heart symbol as your 3-character name. Start a new game. Extra-life pickups will now push your lives past 9.

Trouble Shooter

Mega Drive Vic Tokai 1992
Hidden feature
Hidden stage select: Player 2 holds Start+C+Right on title screen

The title-screen handler at 0x480C checks Player 2's controller for a specific button combination. If P2 holds Start + C + Right (byte $A8 in the input register at $FFFFF605), a hidden stage select becomes available. This gate was found by decompiling the title-screen state machine and tracing the branch that was never taken in normal play.

$480C FUN_0000480c: ; title-screen handler ... MOVE.B ($FFFFF605).w,D0 ; read P2 input CMPI.B #$A8,D0 ; Start+C+Right? BNE.W skip_stage_select ; if match: enable stage select
ROM
0x480C (68000)
Input
P2 controller: $A8 = Start + C + Right held simultaneously
Verified
Ghidra decompilation + mednafen (visual: "SELECT STAGE" appears)
How to use: On the title screen, have Player 2 hold Start + C + Right on their controller. A stage select will appear.
Binary patch
Always-on stage select patch

We rewrote the title-screen handler in place (92-byte footprint, no code cave needed) to show "SELECT STAGE" and a number on every boot. Player 1 presses A to advance the stage number. The original P2 button gate is bypassed entirely. Header checksum recomputed at 0x18E.

Patch
Rewrites FUN_0000480c (92 bytes in place)
Input
P1 A button (BTST #6,($FFFFF603).w) advances stage
Build
build_stage_select_patch.py

Battle Mania Daiginjou

Mega Drive Vic Tokai 1993
Hidden feature
Obscure stage select unlock via BGM sequence

The Options screen BGM selector hides an unlock sequence: play SILENCE x4 then NOTHING 13 x3. This builds counters at $FFFFFE3A/$3B; when they reach $0403, the new-game routine at $295C2 unlocks a stage select screen instead of starting Stage 1. While documented on Sega Retro/TCRF, the RE confirmed the exact mechanism and enabled a one-byte patch to bypass it.

$295C2 CMPI.W #$0403,($FFFFFE3A).w ; check unlock counters $295C8 BNE.W $296D0 ; skip if not unlocked ; fall through to stage select screen
ROM
0x295C2 (68000, 1MB ROM)
Counters
$FFFFFE3A = SILENCE count, $FFFFFE3B = NOTHING 13 count
BGM table
ROM 0x28BB2
How to use: In Options, cycle the BGM selector to play SILENCE four times, then NOTHING 13 three times. Exit options and start a new game. A stage select screen will appear.
Binary patch
Always-on stage select (NOP the BNE)

The simplest possible patch: NOP the conditional branch at $295C8 so the stage select always shows on new game, no BGM sequence needed. Four bytes changed, checksum recomputed.

$295C8 66 00 01 06 BNE.W $296D0 ; original: skip stage select $295C8 4E 71 4E 71 NOP; NOP ; patched: always show it
Patch
0x295C8: 66000106 → 4E714E71
Checksum
$9333 → $C90F
Build
build_bm_stageselect.py