Pokémon Snap Hacking

Level Select

While playing, the current level ID can be found at 800AF3C0(U). Arrays of the levels script pointers can be found at 800AC03C(U) and 800AC058(U). The routine used for loading a level is at 800E303C(U), where A0 is the level ID to load.

Value	Level Description
0x00	Beach
0x01	Tunnel
0x02	Volcano
0x03	River
0x04	Cave
0x05	Valley
0x06	Rainbow Clouds
0x07	Dummy?
0x08	Title
0x09	Rate Pictures
0x0A	Dummy?
0x0B	Professor Oak
0x0C	Pokémon Album
0x0D	Professor Oak
0x0E	Pokemon Report
0x0F	Professor Oak's Check
0x10	Dummy?
0x11	Credits
0x12	Credits
0x13	Credits
0x14	Credits
0x15	Beach Demo
0x16	Gallery
0x17	Gallery
0x18	Unused Japanese Screen

The unused Japanese screen can be seen in the video below.

Level Data

Below is an incomplete list of level data locations in the USA ROM/RAM.

Level	RAM Pointer	ROM Start	ROM End	RAM Start	RAM End
Beach	800ABE34	0055C110	005DF5D0	802C40A0	802CBE10
Tunnel	800ABE7C	005DF5D0	006401B0	-	-
Cave	800ABEC4	006401B0	006C05E0	-	-
River	800AFF0C	006C05E0	007272E0	-	-
Volcano	800ABF54	007272E0	0079F1B0	-	-
Valley	800ABF9C	0079F1B0	00825E30	-	-
Rainbow	800ABFE4	00825E30	0082F8E0	803466C0	-

8009AE10(U) loads the level script into memory, 8009B634(U) loads some level-specific information.

Model Data

The polygon data for Beach can be found at 0x5B0F80(U) and the display list at 0x5B23B0(U), other levels are yet to be documented. Below is a table of model data locations discovered for the USA ROM/RAM, this list is currently quite small.

Description	ROM Offset	RAM Offset
Beach (Level)	0055C110	802C40A0
Rainbow Clouds (Level)	00825E30	803466C0
Butterfree	005B4048	-
Doduo	005B6060	-
Kangaskhan	005C3470	-
Meowth	005D2E80	-
Mew	0082F200	-

Music

A table of music sequences can be found at 0xAEFC10(U)/800604D0(U). The current music ID playing is stored at 803A66C0(U).

Value	Level Description
0x00	Beach
0x01	Pokéflute 1
0x02	Pokéflute 2
0x03	Pokéflute 3
0x04	Tunnel (Electrified)
0x05	Volcano
0x06	River
0x07	Valley
0x08	Professor Oak
0x09	Ranking Photos
0x0A	Pokemon Album
0x0B	Credits
0x0C	Scores
0x0D	Cave
0x0E	Rainbow
0x0F	Falling Droplets
0x10	Final Ranking
0x11	Failure?
0x12	Cheery?
0x13	Mystic?
0x14	Birds
0x15	Birds
0x16	Empty
0x17	Title
0x18	Jigglypuff
0x19	Intro
0x1A	Level Select
0x1B	Options
0x1C	Approaching Mew
0x1D	Level Complete?
0x1E	Mystic?
0x1F	Chime
0x20	Fanfare 1
0x21	Fanfare 2
0x22	Jazz
0x23	Fanfare 3
0x24	Mystic?

Player Movement

All player data can be found at 80366BA4(U). 800E3C50(U) stores the player's rotation, 800E3C94/800E3CE0(U) updates X position, 800E3CA4/800E3CE4(U) updates Y position, and 800E3CB4/800E3CEC(U) updated Z position. 800E3DFC(U), 800E3E28(U) and 800E3E94(U) handle the transition into the next chunk of the level, while 800E3D9C(U) determines whether to jump to the next section. The Beach second section object is found at 801FFAD0(U) and the third section at 801FFDF0(U), no further details have been documented.

Miscellaneous Findings

The checksum for this game can be removed by deleting the assembly command at 0x658(U).

Below is an experimental code to enable free-roam in the USA ROM, the checksum must be disabled for this to work.

 0x61490:
 NOP
 NOP
 SWC1 F22, $0020 (R16)
 NOP
 
 0x61400: NOP
 0x61444: NOP
 0x61464: NOP
 0x61474: NOP
 0x61680: NOP
 
 0x613E8:
 LUI A3, $8036
 ORI A3, A3, $6BA4
 LWC1 F20, $000C (A3) - Get object X position
 LWC1 F21, $0010 (A3) - Get object Y position
 LWC1 F22, $0014 (A3) - Get object Z position
 LUI A2, $4100 - How fast to move object
 MTC1 A2, F23
 LUI A1, $8005 - Get P2 D-pad state
 LB A1, $89E0 (A1)
 ADDIU A2, R0, $0002
 BEQ A1, A2, DPAD_RIGHT
 ADDIU A2, R0, $0001
 BEQ A1, A2, DPAD_LEFT
 ADDIU A2, R0, $0004
 BEQ A1, A2, DPAD_UP
 ADDIU A2, R0, $0008
 BEQ A1, A2, DPAD_DOWN
 NOP
 BEQ R0, R0, END
 NOP
 
 //DPAD LEFT
 NEG.S F23, F23
 
 //DPAD RIGHT
 ADD.S F20, F20, F23
 SWC1 F20, $000C (A3)
 BEQ R0, R0, END
 NOP
 
 //DPAD UP
 NEG.S F23, F23
 
 //DPAD DOWN
 ADD.S F22, F22, F23
 SWC1 F22, $0014 (A3)
 
 //END

User Tools