Mortal Kombat Trilogy (NES)

Mortal Kombat Trilogy is a 1998 reskin of Cony Soft's Mortal Kombat 5, itself an unlicensed NES adaptation of Mortal Kombat 3. This version adds a Trilogy introduction screen and a "HOSEKN" title-screen credit, and doubles the original eight-fighter roster through duplicates rather than eight new characters.¹

Hosenkan Electronics has been suggested as the publisher because of the "HOSEKN" credit, but that identification is unconfirmed.

Hidden Two-Player Join#

During a one-player fight against the computer, press A + B simultaneously on Controller 2. This interrupts the fight with the following message:

PLAY TWO HAS

ENTERED TOURNMENT

Both mistakes are in the game's text: "PLAY" instead of "PLAYER", and "TOURNMENT" instead of "TOURNAMENT".

After a short delay, the game returns to the character-selection flow with both players active. The feature is already enabled; no cheat device or ROM patch is required. It provides an arcade-style way to interrupt a single-player match and admit a second player.

The input check at CPU address C1F4 tests whether the opponent is computer-controlled, then checks the A and B bits in Controller 2's held-button state. Holding both buttons together works; there is no longer sequence to enter.

16-bit x86 Remnants#

Several areas of the PRG-ROM contain 16-bit x86 machine code, alongside the game's native 6502 code. The surviving routines include text-record generation, checksum calculations, string copying, and buffered data output. They use x86 stack frames, segmented memory pointers, far calls, and far returns.

Locations#

The table below lists all 16 likely locations. These are extraction windows containing the remnants and adjacent ROM bytes; individual routine locations are given in the sections below.

All offsets are relative to the start of PRG-ROM, and the end offsets are exclusive. For the examined ROM, add 10 to obtain an offset in the complete .nes file.

The ROM contains several exact duplicates. Windows 02, 04, 06, 08, and 10 sit inside a larger 594-byte sequence repeated at PRG offsets 00AB69, 00EB69, 012B69, 016B69, and 01AB69.

The 738-byte bank-tail samples form two further sets: identical copies at 0038C8, 0078C8, and 00B8C8; and another version at 00F8C8, 0138C8, 0178C8, and 01B8C8. Each sample ends at its next 4000-byte boundary.

Byte-to-Pair Conversion#

A complete 87-byte routine occupies PRG offsets 01DF43–01DF99 inclusive. It splits an input byte into its upper and lower four-bit halves, or nibbles. Each half is passed to the helper at 0C9E:13A3, upper half first. The two returned bytes are written consecutively to a buffer.

Its operation can be summarized using descriptive function names:

output_byte(helper_0C9E_13A3((input_byte >> 4) & 0x0F));
output_byte(helper_0C9E_13A3( input_byte       & 0x0F));

For example, input AB supplies 0A and 0B to the helper in that order. The same helper is used throughout the text-record generation code to encode numeric fields.

Selected instructions from this routine show its x86 structure:

Bytes                 Instruction
55                    push bp
83 EC 06              sub  sp,6
8B EC                 mov  bp,sp
C4 36 06 C4           les  si,[0C406h]
                      ...
25 0F 00              and  ax,000Fh
                      ...
9A A3 13 9E 0C        call far 0C9Eh:13A3h
                      ...
26 88 04              mov  es:[si],al
                      ...
83 C4 06              add  sp,6
5D                    pop  bp
CB                    retf

The buffer position is held in a segment-and-offset pointer, and the routine advances it once for each output byte. 0C9E:13A3 is the x86 address encoded in the far call, rather than an NES CPU address.

Text Records and Checksums#

Window 00 includes several paths that construct text records one character at a time. The code at PRG offset 002ECD writes the prefix :02000002. Other paths begin with S903 at 003381, S804 at 00358C, and S705 at 00380E.

These paths append numeric fields through the nibble-conversion helper and calculate check bytes. The colon-prefixed path adds field values and negates the accumulated sum. The S-prefixed paths add their field values and invert the result with NOT AL. The resulting check byte is also passed through the conversion helper.

The records end with carriage return and line feed, 0D 0A. The code then calculates the number of bytes in the output buffer and passes the buffer and its length to a transfer helper.

Formatted Text and Separators#

Window 12 includes code that builds formatted text using spaces, colons, asterisks, and line breaks. A loop at PRG offset 01DE2B writes exactly 78 asterisks, followed by two line-feed bytes and a zero terminator. The surrounding code also writes space-padded fields and converts individual bytes through the 87-byte routine.

Window 14 contains string-copying loops. One reads an indexed entry from a table with a 32-byte stride; another appends bytes from the string at x86 data offset 14C0 until it reaches a zero byte. The completed output buffer is zero-terminated and passed to the helper at 0C9E:025B.

Buffered Data Output#

The remnants contain several buffer-management routines:

1000 bytes is 4 KiB. The two routines that transfer buffered output use the same far-call target, 22CA:000A.

Other Data Processing#

Window 13 includes paths that process data in two- and four-byte groups, passing bytes to helpers in different orders. Another part extracts three bytes from a value stored across two 16-bit words and passes the resulting three-byte block to the transfer helper.

Window 15 also contains code that traverses records in 3D-byte steps, tests flag bit 40, and processes 20-byte fields through a character helper. Near the end of the ROM, a separate fragment compares two input bytes with 2D and 4C — the characters -L — and advances the pointer by two on a match.

References#