I'm excited to be able to share a hack I've put together which allows easy access to the online section of the Shenmue Passport disc - without the standard requirement of a Dreamcast console + internet connection.
It is in the form of a small, targeted patch to apply to the Shenmue Passport disc which effectively skips the check for an internet connection, thus allowing the "online" section of the disc to be accessed and browsed (to the extent possible while offline).
Read on for an overview of the unlocked content - and see the end for simple instructions to patch the Shenmue Passport disc image.
What is Shenmue Passport?
Shenmue Passport, the fourth disc in the set of discs for the first game, is a bonus disc that contains additional content related to the game, such as music and cutscene clips, that are intended to enhance the player's experience. You are prompted to select one of your save-game files at the start, and this is used to govern the information that is displayed on certain screens.
The main menu contains four sections:
 |
| The main menu of the Shenmue Passport disc. |
- Information: seven Shemmue animated character heads introduce various features of the game, such as QTEs, Money, Battles and so on.
- Theater: view promo video clips or select from the cutscenes you have triggered during the game.
- Music: here you can listen to the Shenmue theme, or other songs that you have encountered in the game so far.
- Passport: the online section which will be described in more detail below.
Passport Online Section
As mentioned, the online section assumes an internet connection, specifically to the server that was set up for the release of Shenmue. Unfortunately, it was closed down by Sega in March of 2002.
This section in fact contains a fair amount of offline content along with content that requires a connection to the server,
The issue is that upon entering the Passport section, an initial check is made for an internet connection. If one cannot be established, an error message is displayed and you are bounced back to the top menu.
 |
| Without a network connection, an error message is shown. |
Enterprising Dreamcast enthusiasts have found ways to get the console online through use of hardware & software (such as a DreamPi - custom software combined with a Raspberry Pi and a USB dial-up modem), and these methods can be successfully used to allow access to the online section of the Shenmue Passport.
But the thought that will have crossed the minds of many Shenmue fans is that would be nice if extra hardware and additional set-up could be avoided altogether. In short: a software-only solution.
Shenmue Passport Hack: The Proposal
The Shenmue community is known for the passion and of its fans, and this time a strong case was made by BlueMue on the Shenmue Dojo forums for the community to direct its attention to perhaps one of the last bastions of Shenmue that may never be properly experienced by most players - the online portions of the Shenmue Passport disc.
I was immediately drawn to the idea, and started thinking about how we could tackle it.
Shenmue Passport Hack: Figuring It Out
Three tools that came in very useful were: a debugger (Demul v0.49 - this is the only version I know of that has an enabled debugger), a memory editor/viewer (Cheat Engine) and online documentation for SH-4 assembly language.
The first problem was choosing where in the code to begin the investigation, as there is a huge amount and it is easy to get lost in a tangled web of low-level instructions. Locating the text of the connection error message ("The user registration process...") seemed a logical place to start.
Having tracked down the code that accessed this piece of text, I worked backwards through the code logic from that point, looking in particular for checks in the code that would have the effect of causing the message to be displayed (or not). This part took the most time, but after tracking through false leads and dead-ends, I discovered a check that fit the ticket - disabling this check caused the code to skip the connection check and continue straight through to the next menu screen. Success!
Instructions for applying the patch to a disc image are given at the end of this article, in the section named "Patch: Instructions".
Overview of the Unlocked Content
The areas that can now be explored consist of the following:
 |
| The menu inside the online section. |
- Shenmue World: inside are categories for Places (maps and screenshots of locations visited in the game), Profiles (text profiles of characters you have met, plus their 3D model that can be rotated), Moves (a list of moves Ryo has mastered)
- Nozomi's Messages: a place where Nozomi once gave hints to the player, now devoid of messages.
- Network Ranking: screens for displaying global high-score rankings for various arcade games in Shenmue. Although empty now, music from each game can be enjoyed.
- shenmue.com: this once displayed the now-defunct Shenmue.com website. Clicking it plays a snippet of music then returns back to the menu.
- Everyone's Space: from here you can visit the Shenmue Goodies page or the Free Market (capsule toy trading). The What's New category is "under construction".
- Online Manual: a number of topics are displayed, but none are accessible.
- Data Review: incredibly detailed stats on your game to date. The speed of text scrolling can be increased by holding down one of the controller buttons.
- Urgent Messages: a "Topics" icon can be selected here, leading to a screen with an image of Nozomi; however I found this to be a dead-end requiring a reset; the B button would not take me back to the menu.
Some differences can be observed compared to the case where the disc is run on a Dreamcast with an internet connection. For example, with a real connection there is a text message on many of the screens saying "The required data cannot be retrieved at this time. Please try again." which is not displayed with this hack.
The Patch: Instructions
Edit: clarified information on the disc image format required & added patch for PAL version.Update: instructions for the Japanese NTSC version and US Shenmue have also now been added, as identified on this blog by Pome.
If you have a CDI or MDF image file of the Shenmue Passport disc, just apply the patch directly. For a GDI image, apply it to the track07.bin file (thanks to Radar on the Shenmue Dojo for testing and confirming).
The instructions vary slightly, depending on which version you have of the game.
I hope this patch will open up the online section of the disc to a wider audience than before. There is plenty of scope for experimentation with the content within.
For example, although a Goodies file can no longer be downloaded from the server, what would happen if it is copied onto the VMU save file directly? Another area that looks interesting is the capsule toy trading. And potentially the code could be manipulated to unlock as much of the offline data as possible...
We want to try to reach as many Shenmue fans as possible!
If you are interested in more Shenmue content like this, please take a moment to Like the Phantom River Stone Facebook page and Follow us on Twitter. Thank you!
Become a Patron!
If you have a CDI or MDF image file of the Shenmue Passport disc, just apply the patch directly. For a GDI image, apply it to the track07.bin file (thanks to Radar on the Shenmue Dojo for testing and confirming).
The instructions vary slightly, depending on which version you have of the game.
Patch for Shenmue Passport Disc
1) Load the disc image into your favorite hex editor.
2) Search for the 4-byte hex sequence appropriate to your Shenmue version:
(US NTSC:) 98 23 0F 89 (PAL:) 88 23 0F 89
(Japan:) 98 23 10 89 (US Shenmue:) 98 28 0D 89
and change the third and fourth bytes as follows:
(NTSC:) 98 23 27 27 (PAL:) 88 23 27 27
(Japan:) 98 23 27 27 (US Shenmue:) 98 28 27 27
3) Repeat the search in Step 2 one more time. If the sequence is found a second time, update it in the same way.
4) Save the image. Done!
Next Steps
I hope this patch will open up the online section of the disc to a wider audience than before. There is plenty of scope for experimentation with the content within.
For example, although a Goodies file can no longer be downloaded from the server, what would happen if it is copied onto the VMU save file directly? Another area that looks interesting is the capsule toy trading. And potentially the code could be manipulated to unlock as much of the offline data as possible...
Join Phantom River Stone on Facebook & Twitter!
We want to try to reach as many Shenmue fans as possible!
If you are interested in more Shenmue content like this, please take a moment to Like the Phantom River Stone Facebook page and Follow us on Twitter. Thank you!
new to all this hex editing but i messed around with settings and could not find that sequence. everytime i find 98, another set of numbers follow
ReplyDeleteusing the OG passport disc btw
DeleteOne possibility is PAL vs NTSC. The patch at the moment is confirmed for the NTSC version of Shenmue Passport (on a cdi image). If you are using the PAL Shenmue, I will be publishing a separate patch for that version as it turns out the code differs slightly.
DeleteUpdate: the patch now covers both PAL and NTSC - see the refreshed instructions in the post.
ReplyDeleteSounds like the image has been corrupted somehow when saving. What disc image format did you try it on (GDI, CDI etc)?
DeleteEven with the hack, there are some screens that just won't work as they need a real online connection to SEGA servers (which of course are no longer running). These include Shenmue.com, the online manual pages, Nozomi's messages, the highscore ranking tables and swapping a winning can for Shenmue Goodies.
ReplyDeleteOk so i don't know if anyone still uses this but i opened track07.bin and follwed the steps to apply the patch that worked ok but when i load disc 4 it freezes on the sega screen.
ReplyDeletei am using shenmue NTSC version, and t he emulator i am using is DEMUL version 0.7
any help would be appreciated, thank you.
Does the GDI load fine when the track07.bin is reverted back to the original? One thing to double-check is that, when updating the file, the mode of the hex editor is overwrite (not insert). After updating track07.bin the file should have exactly the same length as before.
Deleteyes the GDI does load fine when i change the 4 byte back to 98 23 0F 89, it's only when changing too 98 23 27 27 and then load the GDI it then freezes and never get's past the sega screen.
DeleteI do open track07.bin once i have applied the patch too make sure that i find line 98 23 27 27 and it is there soo it must be overwriting and not just inserting.
Just too add i managed too get a CDI version of the NTSC passport disc,loading the CDI image into a hex editor and changing too 4bytes and the 98 23 0F 89 too 98 23 27 27 and it is still freezing.Does the hex editing software matter at all, i use HxD
DeleteAny hex editor should be fine. I applied the patch to an NTSC CDI image of the Shenmue passport using HxD just now, and confirmed that the disc image runs fine after saving the edit, running on Demul v0.7. If you are still having trouble, you can drop me an email (it's on the About Me page).
Deleteok so i did apply the patch and finally the disc does work and doesn't freeze so the patch is working on the NTSC version with no problems, but it will not let me past the
ReplyDeleteuser registration process too connect to network, and then it takes me straight back too the main menu.
It sounds like the patch didn't save properly, as that is the usual behavior when the internet connection check is there. Since it seems you're not having much luck, perhaps you could look to see if there is an image online someone has already applied the patch to.
Deletehmm yea i will see if i can try and find an image but what with all the crackdown lately on "certain sites" it's getting a lot harder too find such patched files and games.
ReplyDeleteThis is so nice, the real question is what did they publish back then? What were on that sites? and also is there a way to have the goodies file without connection?
ReplyDeleteIn terms of content, the disc contains almost everything so it was a design decision to hide a lot behind the network connection check. But unfortunately it does not include the VMU character files. The servers were also used to store things like text for character / location descriptions and hints from Nozomi - even though they could easily have been put on the disc. And of course the shared network rankings.
DeleteHello, I found and overwrite the values on tackbin 07 but when I run it still looks for the connection. Pal version with Flycast.
ReplyDeleteHi, you could try searching a second time as there may be a second set of values to update.
DeleteI did it, I even looked for the old value afterwards to confirm its replacement and he no longer found it as proof of its replacement. I tried with 2 different versions and it doesn't work, I don't understand why.
Delete