This is getting somewhat off-topic.
1. Load the ROM into a hex editor
2. Find the level names
There's a text search function in most hex editors. In MM2 they're capitalised, in MM96 they're Title Cased; in either case, it's a bit of luck that they're in ASCII. There are tools for finding text in other encodings, anyway.
Finding the text is a starting point for reverse engineering the level data. In this case, it's extremely easy because the text is all together and that's a good indicator that the text ordering tells you the level data ordering.
Anyway, you find the first letter of the first name (Raining Champ) at offset 0x4548b. That's a hexadecimal number telling you what position in the file I am referring to. There's usually a bunch of numbers at the left telling you the address, but it ends in 0, and the data it shows has 16 bytes on a line. The status bar will tell you exactly which byte the cursor is on, it'll be the same row address as on the left but with the last digit changed. There's probably a "go to" function to jump to any given address, which is why I posted it.
3. Copy paste and number
Counting text strings in hex is hard work. I copy/pasted the block of text into a text editor, split it up to one track per line, and then wrote numbers before each, to make it easy to find which number means which track.
Since we're dealing with a raw binary file, we need to deal with values as hex numbers. 2 digits of hex means 1 byte. So we number them. Anyone who deals with computers knows that you normally number things starting at 0. So number them 00, 01, 02, 03, ... 09, 0A, 0B, 0C, 0D, 0E, 0F, 10, 11, 12, ... etc.
The next thing I did was to fire up Kega and do an Action Replay code search using these values. I just started a bunch of levels and assumed there'd be a byte in RAM that matched the number from my list; Kega helped find which byte. From that, I can make a PAR code that will override the level by force. Unfortunately, PAR codes are a bit screwy when they are moved from Kega to Gens, and it's a hassle to modify them, you end up having to input all possible values and selectively enable the right one. But it did confirm that my numbering was correct. I posted the PAR code for MM2 earlier in this thread.
4. Write the number sequence for the start of Time trial
5. Search the ROM for those bytes
6. Type the values from your list
After using the PAR code for a while, I wondered if it'd be easier to do a ROM hack. I noted the first three tracks in Time Trial mode, looked up their numbers, and then searched the ROM for those numbers. At first I tried a 16-bit search - the Mega Drive has a 16-bit CPU so they might be 16-bit numbers - by searching for the bytes with 00s in between, but that drew a blank; then I searched for them without the 00s and I got one hit, at offset . I overwrote the data with some other values - 00 01 02 etc - and saved to a new file, since I don't want to lose the original data. I loaded up the modified one and sure enough, the first Time Trial track had become Raining Champ. The relevant offset for the time trial track data in MM96 is 0x452c5.
So, the short version: hex editor, go to offset 0x452c5, type in numbers from your list, but no more than 27 (and no values outside the list) otherwise you'll break the game. Because you can break it, always make a backup.
Some of the values will show up as title cards (eg. Pro Hovercraft and Unused in MM2) but then bug out when you start the race.
To map the bonus tracks, I went back to the PAR code and applied it on a bonus track title card, enabling me to get any bonus track while the game was in the right mode.
