DOOM 32X Hacking Notes
Written by Damian Grove
Release: 01/07/2011




0x000D76 -- Code for main menu (after exiting "Options")
0x000E3C -- Code for transitioning from "Skill Level" to game
0x000EA0 -- Code for "Skill Level" selection
0x000E66 -- Code for "Level" selection
0x000EF8 -- Code for "Run", "Fire", and "Use" selections
0x000FB0 -- Code for "Controls" selection
0x001010 -- Code for "Options" selection
0x001110 -- Code for "Music" selection
0x001158 -- Code for "Sfx" selection

Skull menu X/Y offsets -- 0x000C7E




0x0367EC -- Pointer to WAD file (WAD file at 0x0BB000)




0x037EC8 -- Pointer to "SKY1" string (string at 0x037DCC)
0x037ECC -- Pointer to "SKY2" string (string at 0x037DD4)
0x037ED0 -- Pointer to "SKY3" string (string at 0x037DDC)

These need debugging to fully understand:
0x037E4C -- Changing this to 1 makes episode 1 display SKY3 (why?)
0x037E56 -- Changing this to 1 makes episode 2 display SKY3 (why?)




Big digit intervals on status bar -- 0x002102




DEMO1 starts at 0x04EA04




Maximum level number selection (15) is at 0x000E74
Minimum level number selection (1) is at 0x000E8E

0x00212A -- something with intermission screen... more research later




IDKFA cheat is the word at 0x00193A and 0x001940
IDDQD cheat is the word at 0x001958 and 0x00195E




0x002488 -- Code to play a song

"3EBC 00## 4EB9 00882488" -- instructions used to play music ##




0x0043C8 -- Z80 sound driver

0x005C16 -- List of voice pointers (each voice is 0x27 bytes)
	0x005E96 -- E1M1 bass

0x006EA2 -- Song pointers (starting at song #0; E1M1 is #1)
	data: xx (yyyy) -- xx tells how many yyyy's there are
	yyyy is a pointer to an FM track

	0x00776F -- E1M1 main melody
	0x007C9F -- E1M1 bass
	0x01083D -- E1M1 beat

	data: 00-5F -- Note
	data: 60-7F -- Controllers
		controller: 6B xx -- Play track xx
	data: 80-BF -- Note sustain time (lower = quicker)
	data: C0-FF -- Note interval (lower = quicker)




Music playlist -- 0x000C52
Intermission song -- 0x00124C
Title song -- 0x0013BA
Credits song -- 0x00144E




0X04E900 -- rndtable[] from "d_main.c"




Sound pointer table starts at 0x0B11D8 (all in big-endian)

Sound header for explosion starts at 0x069520

long --- length of sound in bytes
long --- ???
long --- ???




Music pointers, or something??? -- somewhere in 0x11040




Another set of sounds -- starts at 0x01142C (all in little-endian)

long --- location of sound file
short -- start of sound at location (useful to skip header maybe??)
short -- size of the sound in bytes
long --- 0x00000000 (doesn't seem to be used for anything)

first sound is menu open
second sound is menu close




Sound file names pointers -- 0x068E30

These point to the filenames of each sound. This table doesn't appear
to be used by the game. Pointers are big-endian, and the format goes
like this:

[ptr] [???] [???] [???] [???] [???] [???]

That's 7 long words. This table is in "sounds.c" in the Jag source