These days one of my favorite Youtubers, Yotobi, uploaded a very interesting video about the Takeshi no Chōsenjō game released for the Famicom console in 1986. The topic of the video brings to light a very special and secret easter egg: instead of finishing the game in the manner intended by the author (famous for being very intricate and confusing), the player can be warped to the final stage by “simply” throwing 20,000 punches on the opening game screen.
This kind of thing has always intrigued me, so I decided to investigate the matter and asked myself: “Where and how does the game handle the logic behind this secret?“. Let’s find out!
Finding the punch counter
First we need to locate the memory address where the game keeps track of the punches thrown. To do this we launch Mesen (an excellent NES emulator which includes a set of powerful and useful debugging tools) and load the game ROM.
To find the counter we can help us with a tool called Cheat Finder (Tools -> Cheats -> Cheat Finder tab), which allows us to search for all memory addresses containing a specific value and then to filter them gradually (yes, like Cheat Engine). Once opened, given that the game has just been launched, we can assume that the number of punches thrown is currently equal to 0. So the first thing we do is set the filter as “Current value is Equal to 0” and we click Add Filter. Now, without closing the tool, let’s go back to the game and throw a single punch. Let’s go back to the cheat finder and set the filter as “Equal to 1“. And here it is, we are left with only one address: 0x60.
We can confirm that it is the address we are looking for by throwing another couple of punches and we will notice that its value will go up accordingly.
Analyzing its memory region
Great! Now that we know the right address, we can take a look at it and its neighbors straight from memory. We can use the Memory Viewer tool (Tools -> Memory Tools -> Memory Viewer tab) and scroll down to line 0x60. At this point the thing I immediately asked myself was: “each cell of this memory is one byte, so their maximum value is 255. How can it count up to 20,000?” Let’s throw 256 punches and see what happens:
As I imagined, the game also relies on a second address: 0x61. This means that the game counts the punches in a space 2 bytes large, so with a maximum value of 65535.
Analyzing the code
Knowing where the game goes to write each time a punch is thrown, we can add a breakpoint on those addresses and we will be automatically notified whenever a code instruction tries to access them. To do this we use the debugger (Debug -> Debugger) and through the Memory Tools we add a breakpoint on the address 0x60 (right click on it -> Edit Breakpoint and make sure “Break Execution” flag is checked). Let’s throw a punch now and see what happens.
And there it is! The execution stopped as soon as the code tried to read from the address of our punch counter. To better understand the code let’s comment it:
LDA $60 //load the value stored in the address 0x60 (our first punch counter)
ADC #$01 //add 1 to it
STA $60 //store the new value in the same address
LDA $61 //load the value stored in the address 0x61 (our second punch counter)
ADC #$00 //add 0 and any remainder of the previous addition (i.e. when the first counter reaches 255 and we throw another punch the remainder will be 1. This is responsible for what we saw earlier: every 256 punches the second counter increases by 1)
STA $61 //store the value
CMP #$78 //check if the second counter is equal to 0x78 (120 in decimal)
BNE $FCFC //jump to instruction at address $FCFC (a simple return) if the second counter has not yet reached 120, continue otherwise (warp to final stage)So we found that the game will take us to the final stage only when the second counter has reached 120 and we know that to increase it by 1 we have to increase the first counter up to 256. This means that we will warped to the final stage if we throw 256*120=30720 punches, not 20000 (THEY HAVE BEEN LYING TO US THIS ENTIRE TIME!!!! 😱😱😱)
Modding the ROM
Jokes aside, let’s now take advantage of the information we have obtained to be able to access the final level without having to throw all those punches. We know that the game on line 0xFD10 checks that the second counter has risen to 120. What would happen if we told it to check that it is 0 instead? Let’s have some fun!
With the debugger still open, we can right-click on line 0xFD10 and then click on “Edit Selected Code”. From the new window that opens we are able to modify the instruction from CMP #$78 to CMP #$0. Apply and close.
What now? We throw a punch and we win! 🤛😎
We were teleported directly to the final stage with a single punch!
Conclusions
It was very interesting to investigate this secret and I hope you enjoyed it. Also, making it to the final stage doesn’t mean we’ve already won the game. Actually you have to continue to the left avoiding the enemies until you get to the treasure. If you want to know more I suggest you watch the video I mentioned at the beginning of this article.