Announcement

Collapse
No announcement yet.

Atari Kangaroo High Score Save Mod

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Atari Kangaroo High Score Save Mod

    Disclaimer.
    I DON'T CLAIM TO BE AN EXPERT IN ANYTHING BUT I'M GOOD AT PRETENDING I KNOW STUFF.

    Long story short, I love my dedicated cabs but I also love my games to save their high scores. A few weeks ago I saw a post by [MENTION=19490]Apocalypse[/MENTION] saying he has done some assembly so I asked him if he could have a look at Kangaroo for me. All I knew was there has to be a routine that erases the ram on boot so that code needs to be modified secondly some sort of battery backed up ram is needed.
    While Apocalypse was kind enough to do it for me several problems arose.
    1. He didn't have the original board and while Mame is great Kangaroo isn't emulated properly so it was a pain in the butt Pming back and forth with every quirk and problem.
    2. I didn't understand wtf he was talking about when discussing what he modified to achieve the outcome.
    Out of frustration and in less than a week I've taught myself some basic Z80 assembly the result of which is my own high score save hack/mod for Kangaroo.
    A big thanks to Apocalypse for giving me the motivation I needed to go out and learn.

    The following are just notes I took for myself so treat them as such as there's no continuity

    60 bytes used for 10 high scores from E1A0 to E1DB, E1DC to E1FF doesnt seem to be used.
    Each score uses 6 bytes first 3 bytes 00 00 00 is the letters next 3 is for the actual score.

    Notes:
    Ram = 1KB E000-E3FF
    E02F Holds Credits
    "6D" is loaded into ram E3FE before ram is cleared, not sure why.
    ED00 = Plr 1 Controls
    Left=02
    Up=04
    Right=01
    Down=08
    Test Mode=80
    Setting stored location E3FC
    EC00 = Coin + Start + Dips
    08=Coin
    02=1 Player Start
    04=2 Player Start

    Code for high score hack
    006D-0079 Blanks Ram with zeros

    006D ld hl,$E000 //hl=$E000
    0070 ld bc,$0400 /BC=$0400 (1024)
    0073 ld (hl),00 //Writes Zeros to ram $E000=$E3FF
    0075 inc hl //increment hl by 1
    0076 dec bc //decrement bc by 1
    0077 ld a,c //loads c into a
    0078 or b
    0079 jr nz,$0073 //Jumps back to 0073 until BC is zero

    Rewrite
    006D ld hl,$E000
    0070 ld de,$E001
    0073 ld (hl),00
    0075 ld bc,$019f
    0078 ldir
    0079 nop
    Saves 1 byte

    This code populates score boards with 5000
    0093 ld hl,$E1A4 ; Load 00 in hl
    0096 ld b,$0A ;Sets b to 10
    0098 ld (hl),$50 //hl=50
    009A a,$06 ;loads 06 into a
    009C rst $20 // jumps to address 0020
    009D djnz $0098 //Jumps back to 98 until BC=0
    12 Bytes
    Code needs to be removed, I used 12 nop's as a place holder.

    0020 add a,l // adds a+l
    0021 ld l,a // l=a
    0022 ld a,h // a=h
    0023 adc a,$00
    0025 ld h,a
    0026 ret
    Not modified.

    Here's the original Code
    Code:
    006d 2100e0    ld      hl,0e000h
    0070 010004    ld      bc,0400h
    0073 3600      ld      (hl),00h
    0075 23        inc     hl
    0076 0b        dec     bc
    0077 79        ld      a,c
    0078 b0        or      b
    0079 20f8      jr      nz,0073h
    007b af        xor     a
    007c 3206e8    ld      (0e806h),a
    007f 3207e8    ld      (0e807h),a
    0082 cdda5d    call    5ddah
    0085 3e3e      ld      a,3eh
    0087 cb78      bit     7,b
    0089 2802      jr      z,008dh
    008b 3e0e      ld      a,0eh
    008d 322ee0    ld      (0e02eh),a
    0090 3209e8    ld      (0e809h),a
    0093 21a4e1    ld      hl,0e1a4h
    0096 060a      ld      b,0ah
    0098 3650      ld      (hl),50h
    009a 3e06      ld      a,06h
    009c e7        rst     20h
    009d 10f9      djnz    0098h
    The original fills the entire 1k of ram with zeros then sets the default score of 5000 for each of the 10 scores.

    Here's my modified version.
    Code:
    006d 2100e0    ld      hl,0e000h
    0070 1101e0    ld      de,0e001h
    0073 3600      ld      (hl),00h
    0075 019f01    ld      bc,019fh
    0078 edb0      ldir    
    007a 21dce1    ld      hl,0e1dch
    007d 11dde1    ld      de,0e1ddh
    0080 3600      ld      (hl),00h
    0082 012102    ld      bc,0221h
    0085 edb0      ldir    
    0087 af        xor     a
    0088 3206e8    ld      (0e806h),a
    008b 3207e8    ld      (0e807h),a
    008e cdda5d    call    5ddah
    0091 3e3e      ld      a,3eh
    0093 cb78      bit     7,b
    0095 2802      jr      z,0099h
    0097 3e0e      ld      a,0eh
    0099 322ee0    ld      (0e02eh),a
    009c 3209e8    ld      (0e809h),a
    My version blanks the ram in 2 parts. The first routine blanks E000 to E19F, E1A0 to E1DB are skipped then the second routine blanks E1DC to the end of the ram at E3FF. The optomised code saves 2 precious bytes and to fit the second blanking routine in i had to move several lines of code down. Luckily only one line of code needed to be modified 0x0095. The code that fills the scoreboard with 5000 was removed to make way for my code.

    Checksums are stored on rom 136008-106.ic17 in 5FF5 to 5FFE
    The only one I need to worry about is
    IC7 = 2D(5FF5) is for stock unmodified rom

    Here's the checksum code. To find out what address the code I set a watchpoint wp 0000,1,r
    We know the first rom address is from 0x0000 to 0x0FFF so when we pop it into test mode it will stop when this address is read.
    Here is the code for the rom checking routine.
    I need to set a breakpoint also bp 0d95
    This will stop the mame debugger after the calculations are done for the first rom.
    Code:
    1731   0D4F FD 21 DE 0D         ld      iy,0ddeh
    1732   0D53 DD 21 70 AB         ld      ix,0ab70h
    1733   0D57 11 F5 5F            ld      de,5ff5h ;address where the checksum values are stored in IC17 0x5FF5-0x5FFE
    1734   0D5A 3E 06               ld      a,06h
    1735   0D5C 21 00 00            ld      hl,0000h
    1736   0D5F CD 81 0D            call    0d81h
    1737   0D62 DD 21 80 A9         ld      ix,0a980h
    1738   0D66 3E 01               ld      a,01h
    1739   0D68 32 08 E8            ld      (0e808h),a
    1740   0D6B 3E 02               ld      a,02h
    1741   0D6D 21 00 C0            ld      hl,0c000h
    1742   0D70 CD 81 0D            call    0d81h
    1743   0D73 DD 21 90 A9         ld      ix,0a990h
    1744   0D77 3E 02               ld      a,02h
    1745   0D79 32 08 E8            ld      (0e808h),a
    1746   0D7C 3E 02               ld      a,02h
    1747   0D7E 21 00 C0            ld      hl,0c000h
    1748   0D81 F5                  push    af
    1749   0D82 D5                  push    de
    1750   0D83 01 00 10            ld      bc,1000h
    1751   0D86 AF                  xor     a
    1752   0D87 57                  ld      d,a
    1753   0D88 7A                  ld      a,d
    1754   0D89 86                  add     a,(hl)
    1755   0D8A 23                  inc     hl
    1756   0D8B 0B                  dec     bc
    1757   0D8C 57                  ld      d,a
    1758   0D8D 78                  ld      a,b
    1759   0D8E B1                  or      c
    1760   0D8F 20 F7               jr      nz,0d88h
    1761   0D91 42                  ld      b,d
    1762   0D92 D1                  pop     de
    1763   0D93 1A                  ld      a,(de)
    1764   0D94 B8                  cp      b
    1765   0D95 C4 A0 0D            call    nz,0da0h ;breakpoint set here. Will jump to 0da0 if rom bad.
    1766   0D98 13                  inc     de
    1767   0D99 F1                  pop     af
    1768   0D9A FD 23               inc     iy
    1769   0D9C 3D                  dec     a
    1770   0D9D 20 E2               jr      nz,0d81h ;will jump to 0d81 if rom checks out ok
    1771   0D9F C9                  ret
    We know the correct value for the stock rom is 2D which the first 2 hex values in register A. Basically register B gets compared to A and if its doesn't match then the game jumps to code that registers an error in this case ERROR ROM-0 then loops back to check the remaining roms.
    If A and B do match then the program will continue to loop until all roms are checked.
    The values for A are stored in rom 5 (IC17) from address 0x5FF5 to 0x5FFE, took me hours to work out where the code was getting its checksum comparison values from.

    Code:
    1773   0DA0 D5                  push    de
    1774   0DA1 E5                  push    hl
    1775   0DA2 11 20 AB            ld      de,0ab20h
    1776   0DA5 21 48 0E            ld      hl,0e48h
    1777   0DA8 01 C6 0D            ld      bc,0dc6h
    1778   0DAB CD E8 0D            call    0de8h
    1779   0DAE 11 20 A9            ld      de,0a920h
    1780   0DB1 01 D1 0D            ld      bc,0dd1h
    1781   0DB4 CD E8 0D            call    0de8h
    1782   0DB7 DD E5               push    ix
    1783   0DB9 D1                  pop     de
    1784   0DBA FD 7E 00            ld      a,(iy+00h)
    1785   0DBD CD F4 0D            call    0df4h
    1786   0DC0 D5                  push    de
    1787   0DC1 DD E1               pop     ix
    1788   0DC3 E1                  pop     hl
    1789   0DC4 D1                  pop     de
    1790   0DC5 C9                  ret
    To fix our error open IC17 in a hex editor, go to 0FF5 and change 2D to 1D (which we got from the B register or just use a program like HEX workshop to calculate the 8 bit checksum)
    Do a hard reset on the mame debugger now because we edited IC 17 we get ERROR ROM-5.

    Rom 5 (IC17) turned out to be real tricky. Problem I found is rom 5 holds the checksums, the checksum for rom 5 is at 0FFA which for Jeffs Free play hack the value is 4B . Because the checksum for rom 0 changed (2D to 1D) The checksum for the rom is now 3B. Now if we change 4B to 3B we've changed the roms checksum and you will keep getting ERROR ROM-5. The solution is to change an unused hex value, in this case I'm going to use 0FF4 which Jeff used to tag himself into the rom ".K....^.JEFFS ROMHACK-..4zK.....".
    Since checksum of rom went down by 1 we need to raise it by one so 0FF4 value of 4B(the K in ROMHACK) will now be 5B, this gives us our 4B checksum we need and now when we go into test we get no errors Its just pure coincidence that both value were 4B, in the vanilla roms with my high score save mod rom 5(IC17) checksum is 05 so editing 0FF5 from 2D to 1D for rom 0(IC7) we also need to edit 0FF4 to 0F to bump our rom checksum back to the 05 its expecting.

    NVRAM Adapter
    Here's a pic of the adapter I made.
    1. You need
    2. DS1220AB
    3. Pin strips
    4. 24 Pin Socket
    5. Wire
    6. Patience
    7. A Brain

    Click image for larger version

Name:	IMAG0415.jpg
Views:	1
Size:	408.1 KB
ID:	1896406 Click image for larger version

Name:	IMAG0417.jpg
Views:	1
Size:	295.3 KB
ID:	1896407

    Click image for larger version

Name:	IMAG0418.jpg
Views:	1
Size:	321.8 KB
ID:	1896408
    You will also need to removed the 2114 rams at IC 5 and IC6 and install 18 pin sockets.
    Wiring for NVRAM adapter
    Anybody want to help me make a professional adapter feel free
    Code:
    2x2114(1k) to DS1220(2k) 
    IC6-2114	
    Pin		Pin
    1		2  A6
    2		3  A5
    3		4  A4
    4		5  A3
    5		8  A0
    6		7  A1
    7 		6  A3
    8 CS		18 CE
    9 GND		12 GND
    10 		21 WE
    11		17 D7
    12		16 D6
    13		15 D5
    14		14 D4
    15		22 A9
    16		23 A8
    17		1  A7
    18 VCC		24 VCC
                    19 A10  Tie to Ground.
    		20 OE	IC21 (74ls32) Pin 8
    IC5-2114
    Only 4 data lines need to be connected for D0-D3
    11		13 D3
    12		11 D2
    13		10 D1
    14		9  D0
    And here it is working in my machine
    Click image for larger version

Name:	IMAG0430.jpg
Views:	1
Size:	209.5 KB
ID:	1896410
    IMPORTANT
    There are 2 versions of the hack, one for the stock Atari board with no hacks which is attached and the second to use with Jeff's free play hack. If you want that version you'll have to PM with proof you own the roms which he charges for.
    http://www.jeffsromhack.com/products/kangaroo.htm
    You can still use IC 7 from the Vanilla on Jeff's but you will get ERROR ROM - 0 in test (which you can ignore).
    NVRAM must be filled with zero's before the first bootup.
    Use a programmer to achieve this OR simply go into TEST.

    WARNING. Entering TEST will blank scores, I may play around with this in the future.
    Change the ram to a generic 6116 before entering
    Test to preserve scores.
    The PCB will run with the modified roms without the adapter however it won't save the high scores obviously.
    The hack was made using the ATARI version of the game so make sure you're running that rom set.

    Enjoy all fellow Kangaroo lovers...which isn't many it would seem
    Last edited by Arcade King; 4th July 2017, 06:15 AM.

  • #2
    Assembly in less than a week Well done and on a great game too. Should I come round and put the high score on it?

    Brad
    My Projects - Space Invaders Bartop, Williams A-Go-Go, Galaxian Bartop, Jukebox Kiosk 1&2, Jukebox Kiosk 3, Virtual Minipin, Generic Upright, MultiCab, Rampage,

    Comment


    • #3
      Originally posted by Brad View Post
      Assembly in less than a week Well done and on a great game too. Should I come round and put the high score on it?

      Brad
      I'm counting on it Brian can't play for shit man lol
      Ms Pacman should be finished this weekend, as you can see I've been distracted.

      Comment


      • #4
        Originally posted by Arcade King View Post
        I'm counting on it Brian can't play for shit man lol
        Ms Pacman should be finished this weekend, as you can see I've been distracted.

        Can't wait for some Ms Pacman love!

        The only game Brian is decent at is Gyruss. He sucks at the rest

        Brad
        My Projects - Space Invaders Bartop, Williams A-Go-Go, Galaxian Bartop, Jukebox Kiosk 1&2, Jukebox Kiosk 3, Virtual Minipin, Generic Upright, MultiCab, Rampage,

        Comment


        • #5
          Originally posted by Brad View Post
          Can't wait for some Ms Pacman love!

          The only game Brian is decent at is Gyruss. He sucks at the rest

          Brad
          Well mate I've got the online multigame mod for my Ms Pacman board so your scores will go world wide. Better get some practice in, I want to see you name in there

          Comment


          • #6
            Originally posted by Brad View Post
            Assembly in less than a week Well done and on a great game too. Should I come round and put the high score on it?

            Brad
            A quick check of the MGL high score board does not reveal the name of Brad

            Awesome work Trav, what are you going learn next week for fun?
            "Beer, it does a belly good!"

            Wanted: Pacman Cab Next Project: Skinny MAME Cab for Samfoot, thread soon, no really. I might even do one on my Pole Position cab!

            Comment


            • #7
              Originally posted by Foot View Post
              A quick check of the MGL high score board does not reveal the name of Brad

              Awesome work Trav, what are you going learn next week for fun?
              No Pacoff would be complete without the mighty [MENTION=269]Foot[/MENTION] you got to come
              Haven't seen you in ages mate.

              Comment


              • #8
                Originally posted by Arcade King View Post
                Well mate I've got the online multigame mod for my Ms Pacman board so your scores will go world wide. Better get some practice in, I want to see you name in there
                Online? What? Heh I ain't that good on it. It's just a childhood fave =)

                I am ranked a crap 29 on TG for a mame comp I was in about 15 years ago though

                Brad
                My Projects - Space Invaders Bartop, Williams A-Go-Go, Galaxian Bartop, Jukebox Kiosk 1&2, Jukebox Kiosk 3, Virtual Minipin, Generic Upright, MultiCab, Rampage,

                Comment


                • #9
                  Originally posted by Brad View Post
                  Online? What? Heh I ain't that good on it. It's just a childhood fave =)

                  I am ranked a crap 29 on TG for a mame comp I was in about 15 years ago though

                  Brad
                  Don't worry mate your impressive Dig Dug Score is still there

                  Click image for larger version

Name:	IMAG0431[1].jpg
Views:	1
Size:	322.5 KB
ID:	1820784

                  Comment


                  • #10
                    Originally posted by Brad View Post
                    Assembly in less than a week
                    That's exactly what I said to him when he messaged me to explain his work!
                    Incredible and impressive!
                    Kudos

                    Comment


                    • #11
                      Thanks for the write up and explanation. Cool thing to do.

                      I like that we get so obsessed by the hobby we spend so much time, effort and learning new skills on endeavours like this - if we had to find an hour to paint the letterbox we're "too busy".

                      Comment


                      • #12
                        Originally posted by Fire_Power View Post
                        Thanks for the write up and explanation. Cool thing to do.

                        I like that we get so obsessed by the hobby we spend so much time, effort and learning new skills on endeavours like this - if we had to find an hour to paint the letterbox we're "too busy".
                        I hate painting ....unless its an arcade machine
                        [MENTION=217]Brad[/MENTION] you asked what I'm going to do next, I'd like to remove the continue screen out of Moon Patrol, its always bugged me, it has no place in a classic game!
                        I'm also trying to work out why when I disassemble a combined rom set and reassemble the output is always smaller. I think TASM is optomising the code because it comes out with no errors but in say Kangaroo's case it was 3 bytes smaller.

                        Comment


                        • #13
                          Very bloody cool Trav. Finding a reason to learn new shit is one of the great parts of this hobby.

                          Very inspirational.
                          Woody

                          Comment


                          • #14
                            Originally posted by Arcade King View Post
                            I hate painting ....unless its an arcade machine
                            @Brad you asked what I'm going to do next, I'd like to remove the continue screen out of Moon Patrol, its always bugged me, it has no place in a classic game!
                            I'm also trying to work out why when I disassemble a combined rom set and reassemble the output is always smaller. I think TASM is optomising the code because it comes out with no errors but in say Kangaroo's case it was 3 bytes smaller.
                            I agree on the continues but damn what a challenge!

                            Also I think the smaller size will almost definitely be due to a more modern compiler.

                            Cheers,

                            Brad
                            My Projects - Space Invaders Bartop, Williams A-Go-Go, Galaxian Bartop, Jukebox Kiosk 1&2, Jukebox Kiosk 3, Virtual Minipin, Generic Upright, MultiCab, Rampage,

                            Comment


                            • #15
                              Originally posted by Arcade King View Post
                              I'd like to remove the continue screen out of Moon Patrol
                              I found a quick way by modifying only one instruction: the one which tests the continue timer, I replaced it by a non conditional jump so whatever the value of the counter game returns to the title screen, it doesn't wait it to reach 0. I can send you the file if you want.
                              Or let you have a look first.
                              I'd really like to see the result of Crystal Castles on real hardware too. Have a look at my code you'll learn a lot I thing (I've added two subroutines to add button detection during attract and other small things to let the attract run when credited/in freeplay). I quite like the result in MAME, it's neat and look exactly how it should have been IMO.

                              Comment

                              Users Viewing Topic: 0 members and 1 (guests)
                              Working...
                              X