Shuma-Gorath, Whole: Relocating a Character's Real Code into Marvel vs Capcom

▶ Play

The Blocker That Wasn't

Dark Sakura proved the native recipe: import a character from Marvel Super Heroes vs Street Fighter into MvC1 by running her own relocated code, not by force-fitting her onto a stock fighter. Shuma-Gorath ($30) was the test of whether it generalized -- and he arrived with a scary flag.

His sprite data looked compressed. Entropy measured 7.95 across his animation region, and CPS-2 has no known decompressor for that. Believing it would have meant 30-50 hours of codec archaeology before a single tile rendered.

It was a mirage, and the reason is the most important lesson in the whole project. The analysis artifact everyone had been reading was built by running the CPS-2 decryption over the entire first megabyte of the ROM -- which correctly recovers opcodes but scrambles the plaintext data that lives in the same address range. The "compressed" bytes were our own tool's garbage. In the original encrypted set, his animation tree is an ordinary table (entropy 4.43), his 11,587 tiles walk out with the exact pipeline built for Dark Sakura, and his idle stance -- authentic green body, palette solved -- rendered on the first try.

Relocating the Whole Block

Where Dark Sakura's port leans on shared engine paths, Shuma's relocates an entire block of his real MSHvSF code. The block $0301DE..$032A3E is copied verbatim into unencrypted arena space at $3FA060 and re-entered through trampolines, so his logic runs as his own code rather than being fitted onto anyone else's spine. The instructions his relocation displaces are replayed cleanly on the way in.

He commits from the character select with no cheat code -- one cell to the right of Wolverine. His name reads SHUMA on the select grid and SHUMA-GORATH on the lifebar, and the old Iron Spider branding is gone from both screens, verified by an independent six-dimension adversarial pass that included a GFX poison test.

The Defect Behind His Crashes

Shuma kept tripping crashes that felt unrelated -- a knockdown crash, ×5.94 damage, corrupted stun, a pinned camera, garbage sounds. They share one root cause, and it is the single most useful thing to name.

Fighter field $52 is char_index * 2. Every per-character table in the engine has exactly 23 entries, ids $00 through $2C. The secret id $30 is past the end of every one of those tables -- so each lookup reads whatever bytes happen to follow into memory:

Every crash with a numeric fingerprint traces to a specific past-end read:

• Knockdown / throw crashed on a relocation thunk that indexed its jump table by d1 instead of d0. The fix is one byte -- 0x3D359, d1 -> d0.
• Defense read a past-end damage-scale entry, so he took ×5.94 damage (55 per hit); clamped back to ×1.0 (9 per hit).
• Camera pinned on a past-end super-jump bound; five sound sites leaked garbage, including an Onslaught-theme fragment.

A 203-site census of those past-end reads now exists. It also explains why a "seat his real physics numbers" port is structurally walled: the 23-row tables are packed with zero slack, so id $30 physically aliases the next table's first rows. Overwriting to "fix" it corrupts the whole roster. Every fix has to be a reader-side clamp or redirect, never a table rewrite.

Mystic Stare: An Eyeball That Actually Flies

This is the payoff of the native era. Marvel vs Capcom 1 never had Shuma's Mystic Stare; teaching the 27-year-old engine to recognize the input (charge Back, then Forward + Punch) was the easy half. Making it fire was the hard half -- and it now does: a visible, moving eyeball crosses the screen.

Two details make this honest engineering rather than a lucky poke. First, the object allocator $3FAE was found by tracing a live Ryu Hadouken, because static matching failed to locate it -- and Ryu's own Hadouken still fires afterward, which is the proof the reroute is stock-safe. Second, the type-$78 dispatch is rerouted with only 3 encrypted bytes into a trampoline ($23CF70) that jumps to a relocated EYE_HANDLER at $3FC8C0. The result was independently verified: the object is real, owned by Shuma, and it moves.

Honest Caveats

Shuma is a hybrid: his own code and animations, but Ryu-clamped physics rows at roughly 22 dispatch sites -- which is why a mini "RYU" tag still shows under his lifebar portrait. Specifically:

• Air normals and combos are incomplete at some sites. The old donor build, riding Ryu's complete move-flow, had more moves wired than the native currently does; the native trades that completeness for authenticity and is still filling in. The path forward is to drive Ryu's working move skeleton (air normals, combo cancels, ready-fight walk) with Shuma's own animations and hitboxes.
• Correct MSHvSF SFX are not ported -- the wrong sounds were silenced, not replaced.
• Supers and most other specials are not wired.
• Pre-fight walk-back is missing, and a stun/KO animation stall exists.
• The blue vertical glitches rising from the ground are the boxshape VRAM-mirror columns at $922000 -- known root, poke-proven, unfixed.
• The 64MB core breaks Fightcade netplay. He is an offline character until that changes.

Status

He shares the native recipe with Dark Sakura, and the honest theme of both ports is the same: the parts you can prove, you prove; the parts you cannot, you say so on the record.