I started hacking Stunt Race FX in 2006, when Sukasa asked for info in a thread during Incarnation 3. Due to boredom, as well as ZSNES being horrendous when it comes to accurately emulating the Super FX chip, I quickly abandoned it.

However, with the recent advent of an emulator which fully supports the chip--BSNES--I am once again inspired to hack Stunt Race FX.

Here some relevant links:

Stunt Race FX hacking notes by Matrixz - This is a newer version of the document Matrixz posted at the previous link. Most of the ROM addresses in these notes are only accurate for the European version of the game.

The addresses I'm documenting in this thread are for the headerless Stunt Race FX (U) ROM. Some of this info may be repeated from the previous link, but I like to have everything in the same place.

Track Data

Locations
1F4A5-1F4F8 Track Data pointers (3 bytes per track, 28 tracks)
28000: Menu "Track" Data
28074: 00- Easy Ride Track Data
28AB9: 01- Aqua Tunnel Track Data
2990B: 02- Sunset Valley Track Data
2A4FC: 03- Night Owl Track Data
2B285: 04- King's Forest Track Data
2BF92: 05- Sea Breeze Track Data
2CADA: 06- White Land Track Data
2D7F4: 07- Night Cruise Track Data
68000: 08- Lake Side Track Data
68CF9: 09- Big Ravine Track Data
69B5E: 0A- Sky Ramp Track Data
6AD25: 0B- Harbor City Track Data
6BD71: 0C- Rock Field Track Data
6CC71: 0D- Up'N Down Track Data
ADB6F: 0E- Ice Dance Track Data
6DF8C: 0F- Blue Lake Track Data
AC000: 10- Cotton Farm Track Data
AC6C3: 11- Toxic Desert Track Data
ACD4C: 12- Marine Pipe Track Data
AD444: 13- Port Arena Track Data
2E509: 14- Bonus 1 Track Data
2EBB7: 15- Bonus 2 Track Data
2F245: 16- Bonus 3 Track Data
AEEB7: 17- Radio Control 1 Track Data
AF106: 18- Radio Control 2 Track Data
AF313: 19- Radio Control 3 Track Data
AF50A: 1A- Radio Control 4 Track Data
6F126: 1B- Test Run Track Data


Format/Commands

0x06: Start of track data


0x1A: Flags 1
1A bb 00
bb: Unknown (set to 01 in Radio Control tracks)


0x14: Flags 2: For unknown reasons, the 0x14 command appears more than once on several tracks, even though it can be used toset multiple bits simultaneously.
14 pp PP
pp= Low byte:
bit 0: Rain
bit 1: Falling snow
bit 2: Unknown
bit 3: Unknown
bit 4: SPLASH death on Y=0000 plane (combine with bit 5 to give the illusion of deep water)
bit 5: Y=0000 plane and certain collision types are wet (combine with bit 4 to give the illusion of deep water)
bit 6: Snow on track
bit 7: More friction on track
PP= High byte:
bits 8-16: Unknown


0x08: Object direction: This command affects every object defined after it, until another 0x08 command is used.
08 dd

dd= Direction:
00: North
40: West
80: South
C0: East


0x0E: Vehicle objects
0E xx XX yy YY zz ZZ 40 A0 00 00 ll mm 08 00 00 00 00 00 00 00 02 vv VV II dd

XXxx= X-coordinate (signed; 8000-7FFF)
YYyy= Y-coordinate (signed)
ZZzz= Z-coordinate (signed)

08mmll= ASM Pointer (high byte is always 08):
AF0F: Player 1
AFD7: Player 2
B079: Enemy (Radio Control)
B1BA: Enemy 1
B1C7: Enemy 2
B1D4: Enemy 3

VVvv= Car type:
81B9: F-Type (Player 1's default setting)
82E5: 2WD
8411: 4WD
853D: Coupé (Player 2's default setting in Battle Trax)
8669: Trailer
876E: Enemy F-Type (Enemy 1's default setting)
8886: Unused Enemy 3WD
8990: Enemy 4WD (Enemy 2's default setting)
8AA8: Enemy Coupé (Enemy 3's default setting)

II= ID:
01: Player 1
02: Player 2
04: Enemy 1
08: Enemy 2
10: Enemy 3
40: Enemy (Radio Control)


0x12: Vehicle starting coordinates (Radio Control enemies don't need this command)
12 JJ xx XX yy YY zz ZZ dd

JJ= ID:
01: Player 1
02: Player 2/Enemy 1
03: Enemy 2
04: Enemy 3


0x16/0x18: Startup/camera routine (0x16 is for Player 1 and 0x18 is for Player 2)
16 ll mm 08
18 ll mm 08

08mmll= ASM Pointer (high byte is always 08):
8E26: Player enters Trailer? (Bonus Trax)
8E5D: Start inside of Trailer (Stunt Trax)
8F8E: Vehicle moves forward at start (Radio Control)
917D: Camera zooms in from back (Battle Trax)
919F: Default


0x02/0x0C: Standard objects (0x02 objects overlap the previous object; 0x0C objects go behind the previous object)
02 xx XX yy YY zz ZZ kk KK 00 00 ll mm hh rr RR tt TT uu UU ww WW
0C xx XX yy YY zz ZZ kk KK 00 00 ll mm hh rr RR tt TT uu UU ww WW

KKkk= Model ID (A040-FE6C; each value increments by 1C, so the second value is A05C, then A078, A094, A0B0 and so on)
QQqq= Collision ID (same range of values as the Model ID, but set to 0000 for objects without collision)

hhmmll= ASM pointer

RRrr, TTtt, UUuu, WWww= Unknown flags; related to collision
Note: Usually, the first standard object on a track is the 3D "GOAL" text.


0x0A: Animated objects
0A xx XX yy YY zz ZZ kk KK 00 00 ll mm hh rr RR tt TT uu UU ww WW __ -- 00

__= Unknown variable (values used: 02, 05, 08, and 10)
--= Unknown variable (values used: 01 or 02)


0x04: Path coordinate data
This data is used to tell CPU cars where to go, as well as determining if the player is going in the wrong direction.

04 nn NN xx XX yy YY zz ZZ ss SS xx XX yy YY ... etc.

NNnn: Number of path points (can be set to 00 for tracks without a path)
SSss= Unknown (common values are 014A, 019C, 01B8 and 025D. 025D tends to be the value used on straightaways, while the lower values are used on different types of turns.)
Note: The first point is always 64h past the start line, while the last point is 64h before the start line.

An incomplete listing of objects, as well as screen captures of them, can be found in this archive:
srfx_objects.zip

More to come...

____________________