Jump to content
Due to a large amount of spamers, accounts will now have to be approved by the Admins so please be patient. ×
IGNORED

Atari Kangaroo High Score Save Mod


Recommended Posts

  • Administrators

Disclaimer.

I DON'T CLAIM TO BE AN EXPERT IN ANYTHING BUT I'M GOOD AT PRETENDING I KNOW STUFF.

 

Long story short, I love my dedicated cabs but I also love my games to save their high scores. A few weeks ago I saw a post by @Apocalypse saying he has done some assembly so I asked him if he could have a look at Kangaroo for me. All I knew was there has to be a routine that erases the ram on boot so that code needs to be modified secondly some sort of battery backed up ram is needed.

While Apocalypse was kind enough to do it for me several problems arose.

1. He didn't have the original board and while Mame is great Kangaroo isn't emulated properly so it was a pain in the butt Pming back and forth with every quirk and problem.

2. I didn't understand wtf he was talking about when discussing what he modified to achieve the outcome.

Out of frustration and in less than a week I've taught myself some basic Z80 assembly the result of which is my own high score save hack/mod for Kangaroo.

A big thanks to Apocalypse for giving me the motivation I needed to go out and learn.

 

The following are just notes I took for myself so treat them as such as there's no continuity

 

60 bytes used for 10 high scores from E1A0 to E1DB, E1DC to E1FF doesnt seem to be used.

Each score uses 6 bytes first 3 bytes 00 00 00 is the letters next 3 is for the actual score.

 

Notes:

Ram = 1KB E000-E3FF

E02F Holds Credits

"6D" is loaded into ram E3FE before ram is cleared, not sure why.

ED00 = Plr 1 Controls

Left=02

Up=04

Right=01

Down=08

Test Mode=80

Setting stored location E3FC

EC00 = Coin + Start + Dips

08=Coin

02=1 Player Start

04=2 Player Start

 

Code for high score hack

006D-0079 Blanks Ram with zeros

 

006D ld hl,$E000 //hl=$E000

0070 ld bc,$0400 /BC=$0400 (1024)

0073 ld (hl),00 //Writes Zeros to ram $E000=$E3FF

0075 inc hl //increment hl by 1

0076 dec bc //decrement bc by 1

0077 ld a,c //loads c into a

0078 or b

0079 jr nz,$0073 //Jumps back to 0073 until BC is zero

 

Rewrite

006D ld hl,$E000

0070 ld de,$E001

0073 ld (hl),00

0075 ld bc,$019f

0078 ldir

0079 nop

Saves 1 byte

 

This code populates score boards with 5000

0093 ld hl,$E1A4 ; Load 00 in hl

0096 ld b,$0A ;Sets b to 10

0098 ld (hl),$50 //hl=50

009A a,$06 ;loads 06 into a

009C rst $20 // jumps to address 0020

009D djnz $0098 //Jumps back to 98 until BC=0

12 Bytes

Code needs to be removed, I used 12 nop's as a place holder.

 

0020 add a,l // adds a+l

0021 ld l,a // l=a

0022 ld a,h // a=h

0023 adc a,$00

0025 ld h,a

0026 ret

Not modified.

 

Here's the original Code

006d 2100e0    ld      hl,0e000h
0070 010004    ld      bc,0400h
0073 3600      ld      (hl),00h
0075 23        inc     hl
0076 0b        dec     bc
0077 79        ld      a,c
0078 b0        or      b
0079 20f8      jr      nz,0073h
007b af        xor     a
007c 3206e8    ld      (0e806h),a
007f 3207e8    ld      (0e807h),a
0082 cdda5d    call    5ddah
0085 3e3e      ld      a,3eh
0087 cb78      bit     7,b
0089 2802      jr      z,008dh
008b 3e0e      ld      a,0eh
008d 322ee0    ld      (0e02eh),a
0090 3209e8    ld      (0e809h),a
0093 21a4e1    ld      hl,0e1a4h
0096 060a      ld      b,0ah
0098 3650      ld      (hl),50h
009a 3e06      ld      a,06h
009c e7        rst     20h
009d 10f9      djnz    0098h

The original fills the entire 1k of ram with zeros then sets the default score of 5000 for each of the 10 scores.

 

Here's my modified version.

006d 2100e0    ld      hl,0e000h
0070 1101e0    ld      de,0e001h
0073 3600      ld      (hl),00h
0075 019f01    ld      bc,019fh
0078 edb0      ldir    
007a 21dce1    ld      hl,0e1dch
007d 11dde1    ld      de,0e1ddh
0080 3600      ld      (hl),00h
0082 012102    ld      bc,0221h
0085 edb0      ldir    
0087 af        xor     a
0088 3206e8    ld      (0e806h),a
008b 3207e8    ld      (0e807h),a
008e cdda5d    call    5ddah
0091 3e3e      ld      a,3eh
0093 cb78      bit     7,b
0095 2802      jr      z,0099h
0097 3e0e      ld      a,0eh
0099 322ee0    ld      (0e02eh),a
009c 3209e8    ld      (0e809h),a

My version blanks the ram in 2 parts. The first routine blanks E000 to E19F, E1A0 to E1DB are skipped then the second routine blanks E1DC to the end of the ram at E3FF. The optomised code saves 2 precious bytes and to fit the second blanking routine in i had to move several lines of code down. Luckily only one line of code needed to be modified 0x0095. The code that fills the scoreboard with 5000 was removed to make way for my code.

 

Checksums are stored on rom 136008-106.ic17 in 5FF5 to 5FFE

The only one I need to worry about is

IC7 = 2D(5FF5) is for stock unmodified rom

 

Here's the checksum code. To find out what address the code I set a watchpoint wp 0000,1,r

We know the first rom address is from 0x0000 to 0x0FFF so when we pop it into test mode it will stop when this address is read.

Here is the code for the rom checking routine.

I need to set a breakpoint also bp 0d95

This will stop the mame debugger after the calculations are done for the first rom.

1731   0D4F FD 21 DE 0D         ld      iy,0ddeh
1732   0D53 DD 21 70 AB         ld      ix,0ab70h
1733   0D57 11 F5 5F            ld      de,5ff5h ;address where the checksum values are stored in IC17 0x5FF5-0x5FFE
1734   0D5A 3E 06               ld      a,06h
1735   0D5C 21 00 00            ld      hl,0000h
1736   0D5F CD 81 0D            call    0d81h
1737   0D62 DD 21 80 A9         ld      ix,0a980h
1738   0D66 3E 01               ld      a,01h
1739   0D68 32 08 E8            ld      (0e808h),a
1740   0D6B 3E 02               ld      a,02h
1741   0D6D 21 00 C0            ld      hl,0c000h
1742   0D70 CD 81 0D            call    0d81h
1743   0D73 DD 21 90 A9         ld      ix,0a990h
1744   0D77 3E 02               ld      a,02h
1745   0D79 32 08 E8            ld      (0e808h),a
1746   0D7C 3E 02               ld      a,02h
1747   0D7E 21 00 C0            ld      hl,0c000h
1748   0D81 F5                  push    af
1749   0D82 D5                  push    de
1750   0D83 01 00 10            ld      bc,1000h
1751   0D86 AF                  xor     a
1752   0D87 57                  ld      d,a
1753   0D88 7A                  ld      a,d
1754   0D89 86                  add     a,(hl)
1755   0D8A 23                  inc     hl
1756   0D8B 0B                  dec     bc
1757   0D8C 57                  ld      d,a
1758   0D8D 78                  ld      a,b
1759   0D8E B1                  or      c
1760   0D8F 20 F7               jr      nz,0d88h
1761   0D91 42                  ld      b,d
1762   0D92 D1                  pop     de
1763   0D93 1A                  ld      a,(de)
1764   0D94 B8                  cp      b
1765   0D95 C4 A0 0D            call    nz,0da0h ;breakpoint set here. Will jump to 0da0 if rom bad.
1766   0D98 13                  inc     de
1767   0D99 F1                  pop     af
1768   0D9A FD 23               inc     iy
1769   0D9C 3D                  dec     a
1770   0D9D 20 E2               jr      nz,0d81h ;will jump to 0d81 if rom checks out ok
1771   0D9F C9                  ret     

 

We know the correct value for the stock rom is 2D which the first 2 hex values in register A. Basically register B gets compared to A and if its doesn't match then the game jumps to code that registers an error in this case ERROR ROM-0 then loops back to check the remaining roms.

If A and B do match then the program will continue to loop until all roms are checked.

The values for A are stored in rom 5 (IC17) from address 0x5FF5 to 0x5FFE, took me hours to work out where the code was getting its checksum comparison values from.

 

1773   0DA0 D5                  push    de
1774   0DA1 E5                  push    hl
1775   0DA2 11 20 AB            ld      de,0ab20h
1776   0DA5 21 48 0E            ld      hl,0e48h
1777   0DA8 01 C6 0D            ld      bc,0dc6h
1778   0DAB CD E8 0D            call    0de8h
1779   0DAE 11 20 A9            ld      de,0a920h
1780   0DB1 01 D1 0D            ld      bc,0dd1h
1781   0DB4 CD E8 0D            call    0de8h
1782   0DB7 DD E5               push    ix
1783   0DB9 D1                  pop     de
1784   0DBA FD 7E 00            ld      a,(iy+00h)
1785   0DBD CD F4 0D            call    0df4h
1786   0DC0 D5                  push    de
1787   0DC1 DD E1               pop     ix
1788   0DC3 E1                  pop     hl
1789   0DC4 D1                  pop     de
1790   0DC5 C9                  ret  

 

To fix our error open IC17 in a hex editor, go to 0FF5 and change 2D to 1D (which we got from the B register or just use a program like HEX workshop to calculate the 8 bit checksum)

Do a hard reset on the mame debugger now because we edited IC 17 we get ERROR ROM-5.

 

Rom 5 (IC17) turned out to be real tricky. Problem I found is rom 5 holds the checksums, the checksum for rom 5 is at 0FFA which for Jeffs Free play hack the value is 4B . Because the checksum for rom 0 changed (2D to 1D) The checksum for the rom is now 3B. Now if we change 4B to 3B we've changed the roms checksum and you will keep getting ERROR ROM-5. The solution is to change an unused hex value, in this case I'm going to use 0FF4 which Jeff used to tag himself into the rom ".K....^.JEFFS ROMHACK-..4zK.....".

Since checksum of rom went down by 1 we need to raise it by one so 0FF4 value of 4B(the K in ROMHACK) will now be 5B, this gives us our 4B checksum we need and now when we go into test we get no errors :) Its just pure coincidence that both value were 4B, in the vanilla roms with my high score save mod rom 5(IC17) checksum is 05 so editing 0FF5 from 2D to 1D for rom 0(IC7) we also need to edit 0FF4 to 0F to bump our rom checksum back to the 05 its expecting.

 

NVRAM Adapter

Here's a pic of the adapter I made.

  1. You need
  2. DS1220AB
  3. Pin strips
  4. 24 Pin Socket
  5. Wire
  6. Patience
  7. A Brain

IMAG0415.jpg IMAG0417.jpg

 

IMAG0418.jpg

You will also need to removed the 2114 rams at IC 5 and IC6 and install 18 pin sockets.

Wiring for NVRAM adapter

Anybody want to help me make a professional adapter feel free :)

2x2114(1k) to DS1220(2k) 
IC6-2114	
Pin		Pin
1		2  A6
2		3  A5
3		4  A4
4		5  A3
5		8  A0
6		7  A1
7 		6  A3
8 CS		18 CE
9 GND		12 GND
10 		21 WE
11		17 D7
12		16 D6
13		15 D5
14		14 D4
15		22 A9
16		23 A8
17		1  A7
18 VCC		24 VCC
               19 A10  Tie to Ground.
	20 OE	IC21 (74ls32) Pin 8
IC5-2114
Only 4 data lines need to be connected for D0-D3
11		13 D3
12		11 D2
13		10 D1
14		9  D0	 

 

And here it is working in my machine :)

IMAG0430.jpg

IMPORTANT

There are 2 versions of the hack, one for the stock Atari board with no hacks which is attached and the second to use with Jeff's free play hack. If you want that version you'll have to PM with proof you own the roms which he charges for.

http://www.jeffsromhack.com/products/kangaroo.htm

You can still use IC 7 from the Vanilla on Jeff's but you will get ERROR ROM - 0 in test (which you can ignore).

NVRAM must be filled with zero's before the first bootup.

Use a programmer to achieve this OR simply go into TEST.

 

WARNING. Entering TEST will blank scores, I may play around with this in the future.

Change the ram to a generic 6116 before entering

Test to preserve scores.

The PCB will run with the modified roms without the adapter however it won't save the high scores obviously.

The hack was made using the ATARI version of the game so make sure you're running that rom set.

Enjoy all fellow Kangaroo lovers...which isn't many it would seem :(

Kangaroo HSS Mod STD.rar

Edited by Arcade King
Link to comment
Share on other sites

  • Administrators
Assembly in less than a week :o Well done and on a great game too. Should I come round and put the high score on it? :lol

 

Brad

 

I'm counting on it ;) Brian can't play for shit man lol

Ms Pacman should be finished this weekend, as you can see I've been distracted.

Link to comment
Share on other sites

  • Administrators
I'm counting on it ;) Brian can't play for shit man lol

Ms Pacman should be finished this weekend, as you can see I've been distracted.

 

 

Can't wait for some Ms Pacman love!

 

The only game Brian is decent at is Gyruss. He sucks at the rest ;)

 

Brad

Link to comment
Share on other sites

  • Administrators
Can't wait for some Ms Pacman love!

 

The only game Brian is decent at is Gyruss. He sucks at the rest ;)

 

Brad

 

Well mate I've got the online multigame mod for my Ms Pacman board so your scores will go world wide. Better get some practice in, I want to see you name in there :)

Link to comment
Share on other sites

  • Super Moderator
Assembly in less than a week :o Well done and on a great game too. Should I come round and put the high score on it? :lol

 

Brad

 

A quick check of the MGL high score board does not reveal the name of Brad

 

Awesome work Trav, what are you going learn next week for fun?

Link to comment
Share on other sites

  • Administrators
A quick check of the MGL high score board does not reveal the name of Brad

 

Awesome work Trav, what are you going learn next week for fun?

 

No Pacoff would be complete without the mighty @Foot :D you got to come :D

Haven't seen you in ages mate.

Link to comment
Share on other sites

  • Administrators
Well mate I've got the online multigame mod for my Ms Pacman board so your scores will go world wide. Better get some practice in, I want to see you name in there :)

 

Online? What? Heh I ain't that good on it. It's just a childhood fave =)

 

I am ranked a crap 29 on TG for a mame comp I was in about 15 years ago though ;)

 

Brad

Link to comment
Share on other sites

  • Administrators
Online? What? Heh I ain't that good on it. It's just a childhood fave =)

 

I am ranked a crap 29 on TG for a mame comp I was in about 15 years ago though ;)

 

Brad

 

Don't worry mate your impressive Dig Dug Score is still there ;)

 

IMAG0431[1].jpg

Link to comment
Share on other sites

Thanks for the write up and explanation. Cool thing to do.

 

I like that we get so obsessed by the hobby we spend so much time, effort and learning new skills on endeavours like this - if we had to find an hour to paint the letterbox we're "too busy".

Link to comment
Share on other sites

  • Administrators
Thanks for the write up and explanation. Cool thing to do.

 

I like that we get so obsessed by the hobby we spend so much time, effort and learning new skills on endeavours like this - if we had to find an hour to paint the letterbox we're "too busy".

 

I hate painting :( ....unless its an arcade machine :D

@Brad you asked what I'm going to do next, I'd like to remove the continue screen out of Moon Patrol, its always bugged me, it has no place in a classic game!

I'm also trying to work out why when I disassemble a combined rom set and reassemble the output is always smaller. I think TASM is optomising the code because it comes out with no errors but in say Kangaroo's case it was 3 bytes smaller.

Link to comment
Share on other sites

  • Administrators
I hate painting :( ....unless its an arcade machine :D

@Brad you asked what I'm going to do next, I'd like to remove the continue screen out of Moon Patrol, its always bugged me, it has no place in a classic game!

I'm also trying to work out why when I disassemble a combined rom set and reassemble the output is always smaller. I think TASM is optomising the code because it comes out with no errors but in say Kangaroo's case it was 3 bytes smaller.

 

I agree on the continues but damn what a challenge!

 

Also I think the smaller size will almost definitely be due to a more modern compiler.

 

Cheers,

 

Brad

Link to comment
Share on other sites

I'd like to remove the continue screen out of Moon Patrol

I found a quick way by modifying only one instruction: the one which tests the continue timer, I replaced it by a non conditional jump so whatever the value of the counter game returns to the title screen, it doesn't wait it to reach 0. I can send you the file if you want.

Or let you have a look first.

I'd really like to see the result of Crystal Castles on real hardware too. Have a look at my code you'll learn a lot I thing (I've added two subroutines to add button detection during attract and other small things to let the attract run when credited/in freeplay). I quite like the result in MAME, it's neat and look exactly how it should have been IMO.

Link to comment
Share on other sites

  • Administrators
I found a quick way by modifying only one instruction: the one which tests the continue timer, I replaced it by a non conditional jump so whatever the value of the counter game returns to the title screen, it doesn't wait it to reach 0. I can send you the file if you want.

Or let you have a look first.

I'd really like to see the result of Crystal Castles on real hardware too. Have a look at my code you'll learn a lot I thing (I've added two subroutines to add button detection during attract and other small things to let the attract run when credited/in freeplay). I quite like the result in MAME, it's neat and look exactly how it should have been IMO.

 

That's actually very clever, I'd probably expand on that and tie it into some code to use one of the unused dips so you could turn it on and off, could be something other people may want. I like working things out myself but I wont say no to a kick in the right direction so I'd love to see what you did :). Moon Patrol certainly has a lot of free space to play with. My pcb has the high score save mod installed so I'll have to dump the rom on that first and modify that.

I'm getting to CC don't worry, I've burnt the roms ready to go just need to get to the cab, I've just been busy over the weekend so I've had to put CC and Mp on the backburner.

Link to comment
Share on other sites

  • 5 weeks later...
  • Administrators

Quick edit to my 2114 to DS1220 adapter, I forgot to add A10(Pin 19) Needs to be tied to ground.

A few people have contacted me about using my mod so there are a few Kangaroo lovers out there :)

 

The PCB will run with the modified roms without the adapter however it won't save the high scores obviously.

The hack was made using the ATARI version of the game so make sure you're running that rom set.

Link to comment
Share on other sites

  • 3 weeks later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...