I have been trying to figure out how the RNG works in Golden Axe 1 (on Sega Genesis). Specifically, the patterns the thieves run around the screen. I think the RAM address CB20 is used in some way. If I watch it as a 2 byte unsigned integer it goes up 4 every frame the game is running (not including loading frames). It sometimes randomly goes up 8 on a frame but I could not find a pattern. By freezing this address I was able to reproduce specific patterns the thief moves around in arcade mode at the camp after stage 1. I poked the address with numbers from 0-80 going up 4 each time and found 7 patterns, but I could not see any pattern to it so I'm guessing the game generates a seed based on this address value on a given frame to determine which pattern to use. I tried going up 1 number at a time, the thief doesn't ever load if I use an odd number, and even numbers that are not a division of 4 still work. I took a screen grab of where the thief moved with each address
https://imgur.com/a/ZgJ0fHW
I also noticed by freezing and unfreezing the address that the direction the thief will move next is generated some time before it moves, and the address is re-used before it moves each time.
I was hoping to find a way to manipulate the rng in a way I could use for real time runs but it looks like this won't be possible due to it being bound to time at such a small denominator. For a TAS though, you can pause the game to alter the rng as the counter keeps going even when paused.
I would be interested to know other people's thoughts on whether my conclusions are accurate and if there is any more testing I can do?
Below are the ram addresses of note:
CB20: Game time counter (used for rng)
C17A: Possibly another game time counter but it doesn't seem to be linked to seconds like the previous address, I don't think it's used for rng
