Can You Inject New Behaviors into a Binary Without Source Code?

Down, Down, Left, Left, Up, Up, Right, Right, Down, Down

Down, Down, Left, Left, Up, Up, Right, Right, Down, Left, Up, Right

# Step 1: Extract ROM files from ZIP
unzip mvscj.zip -d mvscj_extracted/
 
# Step 2: Decrypt program ROM using cps2crypt
# (cps2crypt is part of MAME tools)
./cps2crypt -d mvscj_extracted/mvscj.03 mvscj.03.dec mvsc.key
 
# Step 3: Make modifications to mvscj.03.dec
 
# Step 4: Re-encrypt the modified ROM
./cps2crypt -e mvscj.03.dec mvscj.03.mod mvsc.key
 
# Step 5: Replace original file
cp mvscj.03.mod mvscj_extracted/mvscj.03

=== CPS2 Memory Map (68000 CPU) - CONFIRMED ===
 
ROM Space:
    0x000000 - 0x0FFFFF : Program ROM (1MB used, 4MB max)
    
Hardware Registers:
    0x400000 - 0x40000F : CPS-B registers (layer ctrl, priority, palette)
    0x660000 - 0x66BFFF : Video RAM (48KB, scroll layers)
    0x700000 - 0x701FFF : Object RAM bank 1 (8KB, 1024 sprites)
    0x708000 - 0x709FFF : Object RAM bank 2 (8KB, double-buffered)
    0x800000 - 0x800007 : Input ports (P1/P2 joy+buttons)
    0x900000 - 0x92FFFF : Palette/GFX RAM (192KB)
    
RAM Space:
    0xFF0000 - 0xFFFFFF : Work RAM (64KB)
    
Player Structure Bases:
    0xFF3000 : P1 Character (char ID at +0x53 = $FF3053)
    0xFF3100 : P2 Character (char ID at +0x53 = $FF3153)
 
Unlock System (base = A5 = $FF8000):
    0xFF803C : Red Venom unlock flag
    0xFF8040 : Orange Hulk unlock flag
    0xFF8044 : Gold War Machine unlock flag
    0xFF8048 : Shadow Lady unlock flag
    0xFF804C : Lilith unlock flag
 
Cursor Position:
    0xFF2000 : P1 cursor grid position
    0xFF2002 : P2 cursor grid position
 
=== ROM Data Tables (CONFIRMED) ===
    
    0x065CCA : Character data table (32 bytes/entry)
    0x00BD00 : Animation/sprite data (~512 bytes)
    0x014D6E : Secret table Type A (Shadow Lady, 16-byte entries)
    0x04A3F2 : Secret table Type B (Lilith/Gold WM, 2-byte pairs)
    0x024D3A : Secret table Type C (Orange Hulk/Red Venom, 2-byte pairs)
    
=== Secret Character Load Functions (CONFIRMED) ===
    
    0x022B2E : load_red_venom (66 bytes)
    0x05D044 : load_orange_hulk (60 bytes)
    0x07EF90 : load_gold_war_machine (12 bytes)
    0x0A26C8 : load_shadow_lady (20 bytes)
    0x0FF9B4 : character_load_main (98 bytes)
 
=== Spider-Man Palette Offsets (in mvc.06a) ===
    
    0x48642 : P button palette (32 bytes)
    0x486A2 : K button palette (32 bytes)
    0x48682 : Web attack P palette (32 bytes)
    0x486E2 : Web attack K palette (32 bytes)

; ============================================
; Armored Spider-Man Selection Code Handler
; Insert into character select input routine
; ============================================
 
ARMORED_CODE_CHECK:
    ; Check if cursor is on Spider-Man (position 0x0F)
    CMP.B   #$0F, D0         ; D0 = current cursor position
    BNE     .skip_armored     ; Not on Spider-Man, skip
    
    ; Check input sequence buffer
    LEA     input_buffer, A0  ; A0 = input history buffer
    LEA     armored_code, A1  ; A1 = expected sequence
    MOVEQ   #9, D1            ; 10 inputs to check (0-9)
    
.check_loop:
    MOVE.B  (A0)+, D2         ; Get buffered input
    CMP.B   (A1)+, D2         ; Compare with expected
    BNE     .skip_armored     ; Mismatch, skip
    DBRA    D1, .check_loop   ; Continue checking
    
    ; Code matched! Select Armored Spider-Man
    MOVE.B  #$2E, D0          ; Set character ID to 0x2E
    MOVE.B  #$01, armored_flag ; Set flag for palette load
    BRA     .select_character
    
.skip_armored:
    ; Continue with normal selection
    RTS
 
; Expected input sequence (Down=2, Left=4, Up=8, Right=6)
armored_code:
    DC.B    $02, $02          ; Down, Down
    DC.B    $04, $04          ; Left, Left 
    DC.B    $08, $08          ; Up, Up
    DC.B    $06, $06          ; Right, Right
    DC.B    $02, $02          ; Down, Down

# Armored Spider-Man Palette (32 bytes, RGB444 big-endian)
ARMORED_PALETTE_P = bytes([
    0x00, 0x00,  # 0: Transparent
    0x09, 0x99,  # 1: Silver (main body)
    0x0B, 0xBB,  # 2: Light Silver (highlights)
    0x06, 0x66,  # 3: Dark Silver (shadows)
    0x04, 0x44,  # 4: Gunmetal (secondary)
    0x07, 0x77,  # 5: Light Gunmetal
    0x03, 0x33,  # 6: Dark Gunmetal
    0x00, 0x00,  # 7: Black (outline)
    0x0F, 0xF0,  # 8: Yellow (visor glow)
    0x0D, 0xA8,  # 9: Skin tone
    0x0D, 0xDD,  # 10: Chrome (web)
    0x05, 0x55,  # 11: Mid-gray
    0x02, 0x22,  # 12: Dark accent
    0x08, 0x88,  # 13: Medium gray
    0x0A, 0xAA,  # 14: Light gray
    0x0F, 0xFF,  # 15: White
])

#!/usr/bin/env python3
"""
MvC1 Armored Spider-Man ROM Patcher v2.0
Adds Armored Spider-Man as character ID 0x2E
 
Selection Code: Down, Down, Left, Left, Up, Up, Right, Right, Down, Down
Starting from Spider-Man's position
"""
 
import struct
import sys
import os
 
# Configuration - TO BE DISCOVERED VIA MAME DEBUGGER
CONFIG = {
    "char_table_offset": 0x000000,      # TODO: Find via debugger
    "char_entry_size": 0x20,            # Estimated 32 bytes per entry
    "char_count": 24,                   # Number of character entries
    "palette_table_offset": 0x000000,   # TODO: Find via debugger
    "palette_entry_size": 0x40,         # 64 bytes per palette
    "input_handler_offset": 0x000000,   # TODO: Find via debugger
    "spider_man_id": 0x0E,
    "armored_spider_man_id": 0x2E,
    "spider_man_position": 0x0F,        # Grid position
}
 
# Armored Spider-Man Palette (RGB555 Format)
ARMORED_PALETTE = bytes([
    0x00, 0x00,  # 0: Transparent
    0x18, 0x63,  # 1: Silver (main)
    0x9C, 0x73,  # 2: Light Silver
    0x52, 0x4A,  # 3: Dark Silver
    0x4A, 0x29,  # 4: Gunmetal Blue
    0xEF, 0x3D,  # 5: Light Gunmetal
    0xC6, 0x18,  # 6: Dark Gunmetal
    0x00, 0x00,  # 7: Black
    0xE0, 0x7F,  # 8: Yellow (visor)
    0xCB, 0x5A,  # 9: Skin tone
    0xDE, 0x7B,  # 10: Chrome
    0x10, 0x42,  # 11: Shadow
    0x8C, 0x31,  # 12: Mid-tone
    0x00, 0x00,  # 13: Reserved
    0x00, 0x00,  # 14: Reserved
    0xFF, 0x7F,  # 15: White
    # Colors 16-31: Copy from original Spider-Man
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
])
 
# Input sequence (Down=2, Left=4, Up=8, Right=6)
INPUT_SEQUENCE = bytes([
    0x02, 0x02,  # Down, Down
    0x04, 0x04,  # Left, Left
    0x08, 0x08,  # Up, Up
    0x06, 0x06,  # Right, Right
    0x02, 0x02,  # Down, Down
])
 
def read_rom(filepath):
    """Read ROM file into bytearray"""
    with open(filepath, 'rb') as f:
        return bytearray(f.read())
 
def write_rom(filepath, data):
    """Write bytearray to ROM file"""
    with open(filepath, 'wb') as f:
        f.write(data)
 
def find_pattern(data, pattern, start=0):
    """Find byte pattern in data"""
    pattern_len = len(pattern)
    for i in range(start, len(data) - pattern_len):
        if data[i:i+pattern_len] == pattern:
            return i
    return -1
 
def hex_dump(data, offset, length=64):
    """Print hex dump of data region"""
    print(f"\nHex dump at 0x{offset:06X}:")
    for i in range(0, length, 16):
        hex_str = ' '.join(f'{data[offset+i+j]:02X}' 
                          for j in range(min(16, length-i)))
        print(f"  {offset+i:06X}: {hex_str}")
 
if __name__ == '__main__':
    print("MvC1 Armored Spider-Man ROM Patcher")
    print("=" * 40)
    print("NOTE: This script requires ROM offsets to be")
    print("discovered via MAME debugger first.")
    print()
    print("See documentation for MAME debugging steps.")