On a small note, I made a few discoveries regarding the unused bg scrolling while exploring the differences between these two revisions. They are:


1) These bg prove that 09Z was worked on.
2) This proves there was a later Wood Zone than we have in our beta [the scrolling bg is missing in beta, ALSO, it would 100k ugly with the current beta bg!
3) I found by mistake, that in beta, WZ is SCROLLING! The code for the scrolling doesn\'t work, but 100k at the debug camera coords :D Imagine the later WZ...


Now, with the differences:

Sonic 2 Rev 00 and Rev 01 differences.

I covered *ALL* differences, so stfu about pigs in CNZ etc.

I\'m skipping the different jump/branch absolute addresses, for obvious reasons.

rev00/rev01

0x180/0x180 - Game serial (GM 00001051-00 - rev 00, GM 00001051-01 - rev 01)
0x18e/0x18e - Checksum (obviously)

====================

0x306/0x306 - The following code was deleted in Rev 01:

loc_306:
move.w  ($C00004).l,d1
btst    #1,d1
bne.s   loc_306

====================

0xc28a/0xc296 - This is the background scrolling offset index. In Rev 01, some levels were cut off:

Wood_Zone_BG:
asr.w   #2,d0
addi.w  #$400,d0
move.w  d0,($FFFFEE0C).w
asr.w   #3,d1
move.w  d1,($FFFFEE08).w
rts    

and HPZ:

Hidden_Palace_Zone_BG:
asr.w   #1,d0
move.w  d0,($FFFFEE0C).w
clr.l   ($FFFFEE08).w
rts    

This BG isn\'t linked with the ROM in the offset index. I wonder if I could get it to work in some zone...
Edit: This is actually level 09.

Unknown_Zone_BG:
asl.l   #4,d0
move.l  d0,d2
asl.l   #1,d0
add.l   d2,d0
asr.l   #8,d0
addq.w  #1,d0
move.w  d0,($FFFFEE0C).w
clr.l   ($FFFFEE08).w


====================

0x2ad7a/0x2ad78 - a bugfix in rev 01 (fixes the code for a vertical/diagonal spring from CNZ that you hold down jump on to pull back further). this code was inserted in rev 01:
0x2af72/0x2af7a - the same bug fix, for the second time, in a different part of the code

Update: the code somehow disables the spring code when you\'re dead. Tested in both Rev 00 and Rev 01, we haven\'t found the difference.

Basically, the code is like:

if (Sonic/Tails == dead) dont_spring;

locret_2AD78:
rts  
 
loc_2AD7A:

cmpi.b  #4,$24(a1)
bcc.s   locret_2AD78


and the second bugfix:

locret_2AF78:

rts    

loc_2AF7A:
cmpi.b  #4,$24(a1)
bcc.s   locret_2AF78


====================

0x12000/0x11fd4 - A bugfix in Ring Object in Rev 01. Prevents from flagging (flagging is in the later, unedited code), that player got the 100 and 200 rings 1up, when he actually didn\'t get it (because of the lives overflow).

this code:
------------
cmpi.w  #999,($FFFFFE20).w;check if lives == 999
bcc.s   lives_overflow;if lives >= 999, branch (skip changing the counter)
addq.w  #1,($FFFFFE20).w;add 1 to lives counter

lives_overflow:
ori.b   #1,($FFFFFE1D).w;some flag setting
move.w  #$B5,d0  ;set the 1up sound

------------

is changed to this: (I even commented it)
------------
loc_11FD4:

move.w  #$B5,d0  ;set the sound to 1up
cmpi.w  #999,($FFFFFE20).w;check if lives == 999
bcc.s   loc_12016 ;if lives >= 999, branch (skip adding to the counter etc.)
addq.w  #1,($FFFFFE20).w;add one life to the counter
ori.b   #1,($FFFFFE1D).w;some flag setting

------------

====================

0x12998/0x1296c - a bugfix in Super Ring Monitor in rev 01, that fixes the overflow of rings in rev 00.

this code:
------------
lea  ($FFFFFE20).w,a2
lea  ($FFFFFE1D).w,a3
lea  ($FFFFFE1B).w,a4

cmpa.w  #$B000,a1
beq.s   Player_who_hit_the_monitor_is_Sonic

lea     ($FFFFFED0).w,a2
lea     ($FFFFFEC9).w,a3
lea     ($FFFFFEC7).w,a4

Player_who_hit_the_monitor_is_Sonic:
addi.w  #10,(a2)
------------

is changed to this:

------------
 lea ($FFFFFE20).w,a2
 lea ($FFFFFE1D).w,a3
 lea ($FFFFFE1B).w,a4
 lea ($FFFFFEF0).w,a5
 cmpa.w #$B000,a1
 beq.s Player_who_hit_the_monitor_is_Sonic
 lea ($FFFFFED0).w,a2
 lea ($FFFFFEC9).w,a3
 lea ($FFFFFEC7).w,a4
 lea ($FFFFFEF2).w,a5

Player_who_hit_the_monitor_is_Sonic:
 addi.w #10,(a5)
 cmpi.w #999,(a5)
 bcs.s loc_129A0
 move.w #999,(a5)

loc_129A0:
 addi.w #10,(a2)
 cmpi.w #999,(a2)
 bcs.s loc_129AE
 move.w #999,(a2)
------------

So yeah, when you hit the Super Ring monitor with 999 rings, you overflow that in Rev 00. Also, Rev 01 adds an invisible copy of the rings value.
Rattle made pix of that:
<a href=\"http://img195.imageshack.us/img195/1487/sonic2revision000054ng.jpg\" target=\"_blank\">http://img195.imageshack.us/img195/1487/so...ion000054ng.jpg</a>
<a href=\"http://img195.imageshack.us/img195/3393/sonic2revision000064as.jpg\" target=\"_blank\">http://img195.imageshack.us/img195/3393/so...ion000064as.jpg</a>

====================

0x16634/0x16634 - this another bugfix changes this (in Rev 00): (btw, the loc_x are the Rev 01 locations)

tst.b   (a0)
beq.w   loc_1671C
tst.l   4(a0)
beq.w   loc_1671C

to this (in Rev 01):

tst.b   (a0)
beq.w   loc_166F2

This has something to do with dynamic level building. I have no idea what it does though =P

few bytes after this, there\'s another branch (bne). It was slightly changed in Rev 01:

Rev 00:
 bne.w loc_16724
Rev 01:
 bne.w loc_1671C

====================

0x16724/0x1671C - uh, no idea what it does. In Rev 01, the following code was removed:

move.w (1).w,d0
bra.s loc_166F2
loc_16724:

====================

Deleted/inserted NOPs (4e71):

0xe5bc/0xe5e6 - one NOP deleted in Rev 01
0x16f80/0x16f72 - one NOP inserted in Rev 01

====================

0x1ccfe/0x1ccec - another bugfix in Rev 01. This time fixes Tails\' code. This code (note: loc_x are Rev 01 locations):

loc_1CCEC:
tst.b   ($FFFFFE1A).w
bne.s   loc_1CD38

is changed to:

loc_1CCEC:
tst.b   ($FFFFFE1A).w
beq.s   loc_1CD0E
tst.b   ($FFFFFECC).w
beq.s   loc_1CD38
move.w  #0,$3A(a0)
clr.b   ($FFFFFE1E).w
clr.b   ($FFFFFECA).w
move.b  #8,$24(a0)
rts    


====================

0x20f54/0x20f64 - this code was deleted in Rev 01:

loc_20f54:
tst.w ($FFFFFE08).w
beq.s locret_20F64
jmp  sub_164F4

btw, few bytes higher, a reference to loc_20f54 was changed to locret_20F64:

Rev 00:
 bne.s loc_20f54

Rev 01:
 bne.s locret_20F64
 
====================

0x27144/0x27148 - this code:

jmp_164F4:
jmp     sub_164F4

loc_27148:
jmp     loc_164E6


is changed to this:

loc_27148:
jmp     loc_164E6

In Rev 01 .Also, few jumps further, there is a 0x0000 word which is added in Rev 01.

====================

0x26ff0/0x26ff4 - this code:

-----------
 bsr.s loc_2704c
loc_26FF6:
 movem.l (sp)+,d1-d4
 lea ($FFFFB040).w,a1
 moveq #4,d6
 bsr.w loc_27154
 cmpi.b #1,d4
 bne.s loc_2702C
 btst #1,$22(a1)
 beq.s loc_2702C
 move.b $22(a0),d1
 move.w 8(a0),d0
 sub.w 8(a1),d0
 bcs.s loc_27024
 eori.b #1,d1

loc_27024:
 andi.b #1,d1
 bne.s loc_2702C
 bsr.s loc_2704c

loc_2702C:
 move.w 8(a0),d0
 andi.w #-$80,d0
 sub.w ($FFFFF7DA).w,d0
 cmpi.w #$280,d0
 bhi.w loc_27148
 tst.w ($FFFFFE08).w

loc_27042:
 beq  fe08_null
 bsr.w jmp_164F4
fe08_null:
 rts

-----------

is changed to this:

-----------
 bsr.s loc_27042
loc_26FF6:
 movem.l (sp)+,d1-d4
 lea ($FFFFB040).w,a1
 moveq #4,d6
 bsr.w loc_27154
 cmpi.b #1,d4
 bne.s loc_2702C
 btst #1,$22(a1)
 beq.s loc_2702C
 move.b $22(a0),d1
 move.w 8(a0),d0
 sub.w 8(a1),d0
 bcs.s loc_27024
 eori.b #1,d1

loc_27024:
 andi.b #1,d1
 bne.s loc_2702C
 bsr.s loc_27042

loc_2702C:
 move.w 8(a0),d0
 andi.w #-$80,d0
 sub.w ($FFFFF7DA).w,d0
 cmpi.w #$280,d0
 bhi.w loc_27148
 rts

loc_27042:
 cmpi.b #4,$24(a1)
 bcs.s loc_2704C
 rts
-----------

====================

0x42d26/0x42d36 - Pattern Load Cue $3a had doubled patterns, which wasted space. This was fixed in Rev 01. This code:

PLC_3A:
 dc.w 3
 dc.l ArtNem_7D22C
 dc.w $B000
 dc.l ArtNem_7E86A
 dc.w $B600
 dc.l ArtNem_7C2F2
 dc.w $BE80
 dc.l ArtNem_7EEBE
 dc.w $A800
 dc.l ArtNem_7C2F2
 dc.w $BE80
 dc.l ArtNem_7EEBE
 dc.w $A800
 dc.l $0
 
was changed tO:

PLC_3A:
 dc.w 3
 dc.l ArtNem_7D22C
 dc.w $B000
 dc.l ArtNem_7E86A
 dc.w $B600
 dc.l ArtNem_7C2F2
 dc.w $BE80
 dc.l ArtNem_7EEBE
 dc.w $A800
 
====================

0x12aee/0x12ae2 - bugfix, clearing Sonic and Tails animations on some ocassion (in routine #9, btw). Anyway, this code was inserted:

move.b  #0,($FFFFB01A).w
move.b  #0,($FFFFB05A).w

====================

0xbaee/0xbafa - changes the typo in credits (in Rev 00 it says Tohmas - Rev 01 fixes it to Thomas)

====================

Update: this is probably music changes

0x180b4/0x180a8 - slight change. I don\'t know what it does.

Rev 00: 0x05 B4 24 18 86 00 05 B8 82 E8 44 00 06 2C 86 A8 44 00 06 48 02 60
Rev 01: 0x05 B0 24 10 86 00 05 B8 82 E8 44 00 06 2C 86 A8 44 00 06 38 03 0C

0x1841b/0x1840f - another change in this chunk of data

Rev 00: 0x40
Rev 01: 0x50

0x184b7/0x184ab:
R00: 0x60
R01: 0x40

0x184f3/0x184e7:
R00: 0x60
R01: 0x40

0x186a3/0x18697:
R00: 0xC0 87 D0 C8 AC 16 E0 03 00 74 33
R01: 0xE0 03 00 74 33 16 E0 87 D0 C8 AC

0x187e7/0x187db:
R00: 0x70 03 90 84 00 21 A5 04 44 85 81 21 B0 81 70 C8 AC 22 80 02 C0 03 D0 22 F8 02 F0 03 52 23 18 03 6C 86 00 23 50 02 8C D6 00 23 5C
R01: 0x20 81 70 C8 AC 21 70 03 90 84 00 21 A5 04 44 85 81 22 80 02 C0 03 D0 22 F8 02 F0 03 52 23 48 03 70 86 00 23 50 02 8C D6 00 23 90

====================

The last one. Yay. Object placement changes:

The format is X (2 bytes), Y (2 bytes), object (2 bytes)

EHZ2
-----
Rev00: $1A08, $0380, $030A
Rev01: $19F8, $0328, $030A

The $030a object is a collision switch. I have no idea why Sega changed it though. As Gunner112k said: \"The first thing I tried to do in this ROM is to go to EHZ Act 2 and go to that fucking secret wall that has been haunting my life forever. IT WORKED.

(I never told people about that, but in the rev 01 ROM you could never get through that secret wall, and I originally owned 2 Sonic 2 carts, one that you could get through and one that you couldn\'t. So that means I had this rev 00 for so long.)\"


WFZ1
-----
Rev00: $0A79, $0368, $7901
Rev01: $0A79, $8368, $7901

Rev00: $17F1, $062C, $7902
Rev01: $17F1, $862C, $7902

Rev00: $282E, $0428, $7903
Rev01: $282E, $8428, $7903

They\'re lampposts. I don\'t know why the changed the Y coords, though.


CNZ1
-----
Rev00: $2840, $0688, $0D00
Rev01: $2840, $0684, $0D00

The sign post in CNZ1 was moved a bit too far down.


CNZ2
-----
Rev00: $2740, $0668, $0D00
Rev01: $2740, $0664, $0D00


====================