Binary Forensics: What Hidden Features Exist in Compiled Binaries?

Many compiled binaries contain hidden features, debug modes, and undocumented functionality left by developers. MvC1's CPS-2 ROM contains 6 secret characters accessible via directional input codes, plus evidence of at least one more that was never finished. This deep dive documents the complete secret character system, the input encoding scheme, and the forensic techniques used to find character ID 0x2E -- our "Armored Spider-Man" target.

Secret Character System

MvC1 features 6 secret characters accessible via directional-only input codes on the character select screen. All codes start from Zangief's portrait except where noted.

Secret Characters

Roll (ID 0x10)

Input Sequence:

Left, Left, Down, Down, Right, Right, Down, Down,
Left, Left, Up, Right, Up, Up, Right, Right

Byte Pattern:

04 04 02 02 06 06 02 02 04 04 08 06 08 08 06 06

Lilith (ID 0x2C)

Input Sequence:

Left, Left, Down, Down, Right, Right, Down, Down,
Left, Left, Up, Up, Right, Up, Up, Right, Right

Byte Pattern:

04 04 02 02 06 06 02 02 04 04 08 08 06 08 08 06 06

Gold War Machine (ID 0x28)

Input Sequence:

Left, Left, Down, Down, Right, Right, Down, Down,
Left, Left, Up, Up, Up, Right, Right

Byte Pattern:

04 04 02 02 06 06 02 02 04 04 08 08 08 06 06

Orange Hulk (ID 0x26)

Input Sequence:

Left, Down, Down, Right, Right, Down, Down,
Left, Left, Up, Up, Up, Up, Right

Byte Pattern:

04 02 02 06 06 02 02 04 04 08 08 08 08 06

Shadow Lady (ID 0x2A)

Input Sequence:

Left, Left, Down, Down, Right, Right, Down, Down,
Left, Left, Up, Up, Up, Up, Right, Down

Byte Pattern:

04 04 02 02 06 06 02 02 04 04 08 08 08 08 06 02

Red Venom (ID 0x24)

Input Sequence:

Left, Down, Down, Right, Right, Down, Down,
Left, Left, Up, Up, Up, Right, Right

Byte Pattern:

04 02 02 06 06 02 02 04 04 08 08 08 06 06

Target: Armored Spider-Man (ID 0x2E)

This is the primary target of the Phoenix Edition project. ROM analysis revealed 85 code references for ID 0x2E -- far more than any other unused ID -- suggesting Capcom may have planned this character.

Proposed Input Sequence:

Down, Down, Left, Left, Up, Up, Right, Right, Down, Down

Byte Pattern:

02 02 04 04 08 08 06 06 02 02

Design Rationale:

• Shorter than existing codes (10 vs 14-17)
• Forms a "box" pattern (easy to remember)
• Starts on Spider-Man (logical for Spider-Man variant)
• Unique pattern (no conflicts with existing 6 secret codes)

Character ID Table

Normal Characters

Secret Character IDs

Hidden/Unused IDs

Input System

Directional Input Encoding

Input Buffer

Code Detection System

Detection Logic (Estimated)

1. Monitor input buffer
2. On each new input:
   a. Check if cursor is on correct starting position
   b. Compare input buffer against all secret code patterns
   c. If match found:
      - Set character ID to secret character
      - Load secret palette
      - Play confirmation sound/effect
   d. If timeout or wrong input:
      - Reset code detection state

ROM Locations (TBD)

Character Select Screen Layout

Palette Swap System

How Palette Swaps Work

1. Graphics Reuse: Secret character uses base character's sprite data
2. Palette Override: Different palette applied to same sprites
3. Moveset Identical: Same animations, hitboxes, properties
4. ID Different: Separate character ID for tracking

Palette Swap Relationships

Implementation Guide

Adding a New Secret Character

1. Choose Character ID

   • Use unused ID (0x2E, 0x30, 0x32)
   • Follow pattern: base_id + 0x20 for secret variant

2. Create Palette

   • Design 16-color palette (RGB444 format)
   • Write to palette ROM (mvc.06a)
   • Document offset

3. Update Character Table

   • Location: 0x065CCA in mvc.05a
   • Entry size: 32 bytes
   • Copy base character entry
   • Update ID and palette pointer

4. Design Selection Code

   • Choose starting position
   • Create unique input sequence
   • Test for conflicts with existing codes

5. Implement Code Detection

   • Find code check routine in ROM
   • Add new code pattern
   • Link to character ID

6. Test

   • Verify code works
   • Check palette displays correctly
   • Ensure no conflicts with other characters

Tooling Model

For building detection and training tools:

from dataclasses import dataclass
 
@dataclass(frozen=True)
class SecretCode:
    name: str
    char_id: int
    start: str
    pattern: bytes
 
ROLL = SecretCode(
    name="Roll",
    char_id=0x10,
    start="Zangief",
    pattern=bytes([0x04,0x04,0x02,0x02,0x06,0x06,0x02,0x02,
                   0x04,0x04,0x08,0x06,0x08,0x08,0x06,0x06]),
)
 
LILITH = SecretCode(
    name="Lilith",
    char_id=0x2C,
    start="Zangief",
    pattern=bytes([0x04,0x04,0x02,0x02,0x06,0x06,0x02,0x02,
                   0x04,0x04,0x08,0x08,0x06,0x08,0x08,0x06,0x06]),
)
 
ARMORED_SPIDERMAN = SecretCode(
    name="Armored Spider-Man",
    char_id=0x2E,
    start="Spider-Man",
    pattern=bytes([0x02,0x02,0x04,0x04,0x08,0x08,0x06,0x06,0x02,0x02]),
)

Testing Scripts

Character ID Scanner

Script: scripts/char_id_scanner.lua

Scans all character slots and builds comprehensive ID table.

mame mvsc -autoboot_script scripts/char_id_scanner.lua

ID 0x2E Tester

Script: scripts/test_char_id_0x2e.lua

Forces character ID to 0x2E to test behavior.

mame mvsc -autoboot_script scripts/test_char_id_0x2e.lua

Secret Code Analyzer

Script: scripts/secret_code_analyzer.py

Analyzes ROM for secret code patterns.

python3 scripts/secret_code_analyzer.py

Next Steps

With deterministic replays, you can:

• Detect when a code is entered
• Label training data with "secret character chosen"
• Correlate to downstream outcomes (team comp, win rate, etc.)

References

• Code Discovery: Community findings, MAME debugger traces
• Character IDs: PalMod source, ROM analysis
• Input System: CPS-2 hardware documentation