Saturday, August 12, 2017

Shenmue Passport Unlocked! | Hack to Skip Dial-up Check

Shenmue Passport Unlocked

I'm excited to be able to share a hack I've put together which allows easy access to the online section of the Shenmue Passport disc - without the standard requirement of a Dreamcast console + internet connection.

It is in the form of a small, targeted patch to apply to the Shenmue Passport disc which effectively skips the check for an internet connection, thus allowing the "online" section of the disc to be accessed and browsed (to the extent possible while offline).

Read on for an overview of the unlocked content - and see the end for simple instructions to patch the Shenmue Passport disc image.


What is Shenmue Passport?


Shenmue Passport, the fourth disc in the set of discs for the first game, is a bonus disc that contains additional content related to the game, such as music and cutscene clips, that are intended to enhance the player's experience. You are prompted to select one of your save-game files at the start, and this is used to govern the information that is displayed on certain screens.

The main menu contains four sections:
The main menu of the Shenmue Passport disc
The main menu of the Shenmue Passport disc.

  • Information: seven Shemmue animated character heads introduce various features of the game, such as QTEs, Money, Battles and so on.
  • Theater: view promo video clips or select from the cutscenes you have triggered during the game.
  • Music: here you can listen to the Shenmue theme, or other songs that you have encountered in the game so far.
  • Passport: the online section which will be described in more detail below.


Passport Online Section


As mentioned, the online section assumes an internet connection, specifically to the server that was set up for the release of Shenmue. Unfortunately, it was closed down by Sega in March of 2002.

This section in fact contains a fair amount of offline content along with content that requires a connection to the server,

The issue is that upon entering the Passport section, an initial check is made for an internet connection. If one cannot be established, an error message is displayed and you are bounced back to the top menu.

Without a network connection, an error message is shown.
Without a network connection, an error message is shown.

Enterprising Dreamcast enthusiasts have found ways to get the console online through use of hardware & software (such as a DreamPi - custom software combined with a Raspberry Pi and a USB dial-up modem), and these methods can be successfully used to allow access to the online section of the Shenmue Passport.

But the thought that will have crossed the minds of many Shenmue fans is that would be nice if extra hardware and additional set-up could be avoided altogether. In short: a software-only solution.

Shenmue Passport Hack: The Proposal


The Shenmue community is known for the passion and of its fans, and this time a strong case was made by BlueMue on the Shenmue Dojo forums for the community to direct its attention to perhaps one of the last bastions of Shenmue that may never be properly experienced by most players - the online portions of the Shenmue Passport disc.

I was immediately drawn to the idea, and started thinking about how we could tackle it.

Shenmue Passport Hack: Figuring It Out


Three tools that came in very useful were: a debugger (Demul v0.49 - this is the only version I know of that has an enabled debugger), a memory editor/viewer (Cheat Engine) and online documentation for SH-4 assembly language.

The first problem was choosing where in the code to begin the investigation, as there is a huge amount and it is easy to get lost in a tangled web of low-level instructions. Locating the text of the connection error message ("The user registration process...") seemed a logical place to start.

Having tracked down the code that accessed this piece of text, I worked backwards through the code logic from that point, looking in particular for checks in the code that would have the effect of causing the message to be displayed (or not). This part took the most time, but after tracking through false leads and dead-ends, I discovered a check that fit the ticket - disabling this check caused the code to skip the connection check and continue straight through to the next menu screen. Success!

Instructions for applying the patch to a disc image are given at the end of this article, in the section named "Patch: Instructions".


Overview of the Unlocked Content 


The areas that can now be explored consist of the following:

The menu inside the online section.
The menu inside the online section.

  • Shenmue World: inside are categories for Places (maps and screenshots of locations visited in the game), Profiles (text profiles of characters you have met, plus their 3D model that can be rotated), Moves (a list of moves Ryo has mastered)
  • Nozomi's Messages: a place where Nozomi once gave hints to the player, now devoid of messages.
  • Network Ranking: screens for displaying global high-score rankings for various arcade games in Shenmue. Although empty now, music from each game can be enjoyed.
  • shenmue.com: this once displayed the now-defunct Shenmue.com website. Clicking it plays a snippet of music then returns back to the menu. 
  • Everyone's Space: from here you can visit the Shenmue Goodies page or the Free Market (capsule toy trading). The What's New category is "under construction".
  • Online Manual: a number of topics are displayed, but none are accessible.
  • Data Review: incredibly detailed stats on your game to date. The speed of text scrolling can be increased by holding down one of the controller buttons.
  • Urgent Messages: a "Topics" icon can be selected here, leading to a screen with an image of Nozomi; however I found this to be a dead-end requiring a reset; the B button would not take me back to the menu.
I've taken some footage of each area in the video below.
Thank you to Ziming from Shenmue Dojo for creating the splash & outro for the video.


Some differences can be observed compared to the case where the disc is run on a Dreamcast with an internet connection. For example, with a real connection there is a text message on many of the screens saying "The required data cannot be retrieved at this time. Please try again." which is not displayed with this hack.


The Patch: Instructions

Edit: clarified information on the disc image format required & added patch for PAL version.

If you have a CDI or MDF image file of the Shenmue Passport disc, just apply the patch directly. For a GDI image, apply it to the track07.bin file (thanks to Radar on the Shenmue Dojo for testing and confirming).

The instructions vary slightly, depending on whether you have an NTSC or PAL version of the game. If you are not sure, it is fine to try both as only one of the search sequences will be present.

Patch for Shenmue Passport Disc

1) Load the disc image into your favorite hex editor.
2) Search for the 4-byte hex sequence appropriate to your Shenmue version:
(NTSC:)   98 23 0F 89         (PAL:)   88 23 0F 89

and change the third and fourth bytes as follows:
(NTSC:)   98 23 27 27         (PAL:)   88 23 27 27

3) Repeat the search in Step 2 one more time. If the sequence is found a second time, update it in the same way.
4) Save the image. Done!

Next Steps


I hope this patch will open up the online section of the disc to a wider audience than before. There is plenty of scope for experimentation with the content within.

For example, although a Goodies file can no longer be downloaded from the server, what would happen if it is copied onto the VMU save file directly? Another area that looks interesting is the capsule toy trading. And potentially the code could be manipulated to unlock as much of the offline data as possible...


Join Phantom River Stone on Facebook & Twitter!


We want to try to reach as many Shenmue fans as possible!

If you are interested in more Shenmue content like this, please take a moment to Like the Phantom River Stone Facebook page and Follow us on Twitter. Thank you!

4 comments:

  1. new to all this hex editing but i messed around with settings and could not find that sequence. everytime i find 98, another set of numbers follow

    ReplyDelete
    Replies
    1. using the OG passport disc btw

      Delete
    2. One possibility is PAL vs NTSC. The patch at the moment is confirmed for the NTSC version of Shenmue Passport (on a cdi image). If you are using the PAL Shenmue, I will be publishing a separate patch for that version as it turns out the code differs slightly.

      Delete
  2. Update: the patch now covers both PAL and NTSC - see the refreshed instructions in the post.

    ReplyDelete