====== Pokémon Snap Hacking ======
~~NOTOC~~
==== Level Select ====
While playing, the current level ID can be found at **800AF3C0**(U). Arrays of the levels script pointers can be found at **800AC03C**(U) and **800AC058**(U). The routine used for loading a level is at **800E303C**(U), where **A0** is the level ID to load.

^ Value ^ Level Description ^
| 0x00 | Beach |
| 0x01 | Tunnel |
| 0x02 | Volcano |
| 0x03 | River |
| 0x04 | Cave |
| 0x05 | Valley |
| 0x06 | Rainbow Clouds |
| 0x07 | Dummy? |
| 0x08 | Title |
| 0x09 | Rate Pictures |
| 0x0A | Dummy? |
| 0x0B | Professor Oak |
| 0x0C | Pokémon Album |
| 0x0D | Professor Oak |
| 0x0E | Pokemon Report |
| 0x0F | Professor Oak's Check |
| 0x10 | Dummy? |
| 0x11 | Credits |
| 0x12 | Credits |
| 0x13 | Credits |
| 0x14 | Credits |
| 0x15 | Beach Demo |
| 0x16 | Gallery |
| 0x17 | Gallery |
| 0x18 | Unused Japanese Screen |

The unused Japanese screen can be seen in the video below.
{{youtube>bNyJrvIFtZA?medium}}
==== Level Data ====
Below is an incomplete list of level data locations in the USA ROM/RAM.

^ Level ^ RAM Pointer ^ ROM Start ^ ROM End ^ RAM Start ^ RAM End ^
| Beach | 800ABE34 | 0055C110 | 005DF5D0 | 802C40A0 | 802CBE10 |
| Tunnel | 800ABE7C | 005DF5D0 | 006401B0 | - | - |
| Cave | 800ABEC4 | 006401B0 | 006C05E0 | - | - |
| River | 800AFF0C | 006C05E0 | 007272E0 | - | - |
| Volcano | 800ABF54 | 007272E0 | 0079F1B0 | - | - |
| Valley | 800ABF9C | 0079F1B0 | 00825E30 | - | - |
| Rainbow | 800ABFE4 | 00825E30 | 0082F8E0 | 803466C0 | - |

**8009AE10**(U) loads the level script into memory, **8009B634**(U) loads some level-specific information.

==== Model Data ====
The polygon data for Beach can be found at **0x5B0F80**(U) and the display list at **0x5B23B0**(U), other levels are yet to be documented. Below is a table of model data locations discovered for the USA ROM/RAM, this list is currently quite small.

^ Description ^ ROM Offset ^ RAM Offset ^
| Beach (Level) | 0055C110 | 802C40A0 |
| Rainbow Clouds (Level) | 00825E30 | 803466C0 |
| Butterfree | 005B4048 | - |
| Doduo | 005B6060 | - |
| Kangaskhan | 005C3470 | - |
| Meowth | 005D2E80 | - |
| Mew | 0082F200 | - |

==== Music ====
A table of music sequences can be found at **0xAEFC10**(U)/**800604D0**(U). The current music ID playing is stored at **803A66C0**(U).

^ Value ^ Level Description ^
| 0x00 | Beach |
| 0x01 | Pokéflute 1 |
| 0x02 | Pokéflute 2 |
| 0x03 | Pokéflute 3 |
| 0x04 | Tunnel (Electrified) |
| 0x05 | Volcano |
| 0x06 | River |
| 0x07 | Valley |
| 0x08 | Professor Oak |
| 0x09 | Ranking Photos |
| 0x0A | Pokemon Album |
| 0x0B | Credits |
| 0x0C | Scores |
| 0x0D | Cave |
| 0x0E | Rainbow |
| 0x0F | Falling Droplets |
| 0x10 | Final Ranking |
| 0x11 | Failure? |
| 0x12 | Cheery? |
| 0x13 | Mystic? |
| 0x14 | Birds |
| 0x15 | Birds |
| 0x16 | Empty |
| 0x17 | Title |
| 0x18 | Jigglypuff |
| 0x19 | Intro |
| 0x1A | Level Select |
| 0x1B | Options |
| 0x1C | Approaching Mew |
| 0x1D | Level Complete? |
| 0x1E | Mystic? |
| 0x1F | Chime |
| 0x20 | Fanfare 1 |
| 0x21 | Fanfare 2 |
| 0x22 | Jazz |
| 0x23 | Fanfare 3 |
| 0x24 | Mystic? |

==== Player Movement ====
All player data can be found at **80366BA4**(U). **800E3C50**(U) stores the player's rotation, **800E3C94/800E3CE0**(U) updates X position, **800E3CA4/800E3CE4**(U) updates Y position, and **800E3CB4/800E3CEC**(U) updated Z position. **800E3DFC**(U), **800E3E28**(U) and **800E3E94**(U) handle the transition into the next chunk of the level, while **800E3D9C**(U) determines whether to jump to the next section. The Beach second section object is found at **801FFAD0**(U) and the third section at **801FFDF0**(U), no further details have been documented.

==== Miscellaneous Findings ====
The checksum for this game can be removed by deleting the assembly command at **0x658**(U).  
  
Below is an experimental code to enable free-roam in the USA ROM, the checksum must be disabled for this to work.
   0x61490:
   NOP
   NOP
   SWC1 F22, $0020 (R16)
   NOP
   
   0x61400: NOP
   0x61444: NOP
   0x61464: NOP
   0x61474: NOP
   0x61680: NOP
   
   0x613E8:
   LUI A3, $8036
   ORI A3, A3, $6BA4
   LWC1 F20, $000C (A3) - Get object X position
   LWC1 F21, $0010 (A3) - Get object Y position
   LWC1 F22, $0014 (A3) - Get object Z position
   LUI A2, $4100 - How fast to move object
   MTC1 A2, F23
   LUI A1, $8005 - Get P2 D-pad state
   LB A1, $89E0 (A1)
   ADDIU A2, R0, $0002
   BEQ A1, A2, DPAD_RIGHT
   ADDIU A2, R0, $0001
   BEQ A1, A2, DPAD_LEFT
   ADDIU A2, R0, $0004
   BEQ A1, A2, DPAD_UP
   ADDIU A2, R0, $0008
   BEQ A1, A2, DPAD_DOWN
   NOP
   BEQ R0, R0, END
   NOP
   
   //DPAD LEFT
   NEG.S F23, F23
   
   //DPAD RIGHT
   ADD.S F20, F20, F23
   SWC1 F20, $000C (A3)
   BEQ R0, R0, END
   NOP
   
   //DPAD UP
   NEG.S F23, F23
   
   //DPAD DOWN
   ADD.S F22, F22, F23
   SWC1 F22, $0014 (A3)
   
   //END