PinHacks

Full Version: STTNG Video Mode
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Would like to remove the ability to ever get an extra ball from the STTNG video mode - don't really care for "gimmee" extra balls (the ones you earn on the game are fine) - any thoughts on where the video mode runs from/how it's seeded? It would probably be easier to find the extra ball percentage of 5% of reduce it even further, or just find where it reads it and hack around that.

Thoughts?


It would be kind of neat to put back in the random video mode as well, and fix the 2 scoring bugs - the Q bug during warp 9/multiball, and the search the galaxy extra artifact bug, but I kind of like those - rewards you for exploiting/knowing about it and waiting to start Q before those 2 modes.
There is a "getRandomNumber()" function in the WPC code that could potentially be used to make the video mode more random. This is how the IJ mine cart is done, it just gets a random number and puts up the mine barriers randomly.

The WPC code has sort of a master table of indexed callback functions for different features. Code can call this function by passing in the desired function index as a parameter byte (byte after the jsr opcode) or code can call the function directly with the desired index in the A register.

The function that takes the parameter byte looks something like the following. All it does it grab that parameter byte, puts it into the A register, then calls the real function (shown below is snippet from sttng_lx7):
85A9: 34 22 PSHS Y,A
85AB: 10 AE 63 LDY $0003,S
85AE: A6 A0 LDA ,Y+
85B0: 10 AF 63 STY $0003,S
85B3: BD C8 97 JSR $C897
85B6: 35 A2 PULS A,Y,PC ; (PUL? PC=RTS)

So in the case of sttng_lx7 the function to call an indexed function is located at non-banked address $C897, and starts with the following few instructions (shown here for reference):
C897: 34 76 PSHS U,Y,X,B,A
C899: 32 7F LEAS $FFFF,S
C89B: 1C FE ANDCC #$00FE
C89D: BD 86 77 JSR $8677
C8A0: 80 E8 SUBA #$E8
C8A2: 24 03 BCC $C8A7

I know from similar code in ij_l7 that a little further into this instruction it loads X register with 0x81EF which is the address of the callback lookup table. At 0x81EF, in sttng_lx7, is 0x79593D which means the start of the callback table is $7959,3D. Looking at this table in sttng_l7 I see there are 0xB6 entries and each entry is 5 bytes in length. The 5 bytes contain the actual callback address. So easiest example, when code wants to run callback function index 0x00, it looks at the first 5-byte entry and then tries to run code at non-banked address $CA7F.

What I did was the following. Most of the callback routines ultimately check if a game is in progress, and if not, do nothing, so first start up a game. Then set a breakpoint at $C897. Then hit '5' to coin-up. You see you hit the breakpoint right away with somebody calling $C897 with value 0x0C which is the callback index for "show credits press start/insert coin message". What we do next is simply modify value in A register then hit 'esc' and see what happens. This lets you determine the callback index for various features during game play. Once you know the callback index, you need to look at the callback table at $7959,3D and find the indexed table entry and look at the last 3 bytes of the 5-byte entry to find the callback address. From that callback address you can do more tracing to see what happens and map out, for example, how the video modes work. Below are some examples I came across, along with what I determine is the callback address (my work may need checked):

0x1b, pong game, $6D51,24
0x26, poker with Riker, $7C36,22
0x4C, 25mil/shuttle prompt, $6F95,3B
0x86, shuttle video mode, $6909,23
ok, old thread, but I'm finally looking at this, although for a different reason. The request would be to completely eliminate the shuttle simulation part - and just always award the 25 million. I have tried changing the 4c function to other functions I found in the table using your breakpoint @C897 - replacing the table 4c with the other function. It still plays the selection sound effects, and apparently is still running an input although it gets confused as to what to do once it gets that input. I'm guessing that's because the lock hole (which would trigger the 4c function) is running some script first beforehand that checks if you are in an allowable mode to even start the shuttle simulation selection screen, starts playing the tune, before passing into the selection screen proper.

I'd want to react to the lock hole being hit and instead of giving the select video mode screen (there are 3 branches out of the selection screen - technically 4 if you count the pong game, I suppose - you can get 25 million, play shuttle video mode, play riker poker mode, or play breakout/pong) - just award the 25 million. I guess what I'm looking for could be achieved by making either flipper button select the left option (25 million), but only during this function.

I'm assuming that like previous generations of Larry Demar-helmed williams code that the code is really a mixture of assembly and whatever flavor of interpreted byte code (APPL?) that they were using at the time. I've been looking at the IJ disassembly code to see if I can wrap my head around how I know the earlier system 7 stuff works (thanks to Jess Aksey) and try and use that knowledge within WPC.
So, looks like someone on the tilt forums already did this a while ago so no need to delve into it although I'm going to still move forward so I can learn WPC stuff.
Reference URL's