Hey Guys,

I'm compiling a list of things that are off/uneven with the scoring on Bad Cats.

*The most obvious to me is the 20M last ball shot. That would be better at 5M IMO.
*The second is the Jackpot bonus. Again, drop it down to something more reasonable.
*Perhaps the awarding of extra balls could be less-frequent

Anyone else have anything they wished could be changed score-wise or minor things that would make this game more balanced/enjoyable?

Bumping this again. Yes, I'm doing a code update for this game.

Im gonna play around with changing the last ball bonus down to say, 8 million. This hack will be interesting, as it has two variables invovled (on last ball & score change) so I either edit the hex value to eliminate the change on last ball (easier), or try to change the value. Ive been successful with NES rom hacks as well as arcade games. This is new terrritory for me, but I'm assuming the concept is the same - load into pinmame, watch address values for changes, figure out which addresses do what, edit values, make sure it doesn't screw up the checksum and save rom and reload.

The fun has begun...

Decompiled u27 and I'm going through the memory addresses. I'll start with a straight-up hex edit of the original bonus on last ball and see if it works. If I'm successful, I'll move onto other areas. Being an alpha-numeric display it is also very easy to change that as well (can't just change scoring table update, the display also has to match for anything displayed in ANSI).

There also seems to be a good amount of padding in this ROM too, so there would be space for additional rules or whathaveyou if I ever got that nuts about it.

I was able to isolate the 3rd ball 10 Million score value and change it in a hex editor. Found some useful tools as well, one of which can recalculate checksums, among other things. Haven't tested on the actual machine yet (because it is 1/2 way through being shopped out), but it seems to work in Pinmame for the time being. I'll post more updates as I make progress with this. I looked into it, and changing rules or adding addition stuff other that score values looks to be over my head, but I may revisit this at some point when I have some more time. It is much easier to find and change integer values than trace and hunt through steps to make rule changes.

The Debug version of VPINMAME DOS decomplies for you and allows you to run the processor(s) in steps or in real time. You can also disassemble using dasmx130. I do that, then keep it up in Notepad++ to view side-by-side to compare with the active memory addresses, then I name/comment stuff as I figure out what it is.

The method for figuring out what memory address does what is a pain in the butt, as you have to simulate the switches by hitting combinations of keys in Pinmame (for instance, a ball in the trough would be W-S). So you simply step through what is necessary to shift values in the memory, run a trace on what shifts/changes, output the results and search, then convert those hex values to decimal in the case of scoring. Some stuff is mostly the same from game to game in SYS11, like score for player 1 is held in $0200-0202. I used the System 11 pinball Hacking guide by Francis as a starting point: http://pinhacks.com/showthread.php?tid=80&pid=314

In the case of finding the bonus value change, I had to drain 2 balls immediately to get to the third ball, then watch for changing values on the last ball. You can run a trace within a memory range, convert the hex values to decimal and see if they reflect what you're looking for. I think this was a temporary memory range for score changing, so it was something in $02F0-$02FF range. I saw some values change, took a guess, edited the value, and watched what happened.

In other situations, it is much more difficult because you'll have to simulate things like stacking scores and multiplying score values. This was probably one of the easiest things possible to change as I didn't have to simulate anything other than getting to ball 3, and didn't have to track active score changes.

I have this stuff at home, so I'll post some stuff when I get a chance later, but this is the process in a nutshell of hacking these. Pretty much works the same as NES games, which I've done before, only is screwy because of all the inputs.

Sure, np. The version I have is older, I know that much. I'll send you the decompiled u27 with comments I've made so far too if you want. Not much identified in there so far, but it is a start if you wanna play around with it.

Also, I made this to help with the insanity of rows/columns in pinmame. The original schematic isn't easy on the eyes. This is nice to just print out and read from.

BC_SWITCH_MATRIX.pdf

I'm using Pinmame 2.3 as well. I don't have MSVC, otherwise I would have compiled a newer version myself. My IDE of choice is Code:Blocks, which often can make life difficult for stuff like this.

And if you run traces, remember to set them to break on whatever address it is that needs to be updated. Otherwise you'll end up with like a 5 GB file!

And the fun continues....
bc_debug.png

I figured while I'm at this that I'll try and document some of the steps in case anyone else is interested in doing this.

As far as changing values in the actual ROM image, it will initially look confusing because if you pull up the ROM in any HEX editor it isn't going to start in the same place it does inside the debugger. That's because the address starting point in the assembler/debugger is $8000 (cats_u27.l5+4000), not $0000 as would be expected. A picture makes this easier to understand.

bc_hex_1.png
bc_hex_2.png

From here, you can review any traces you've done, see where they are called from on the ROM, then edit the value. Just keep in mind these differences when going between the debugger and editing the ROM (as if assembly wasn't confusing enough).

And as far as changing code, make sure to disable CPU(s)#1&2 as they are sound CPUs and are unnecessary for rule/scoring changes. You can do this by typing in "IGNORE CPU" followed by the number that you want to ignore in the debug window.

Score changes aren't too tricky, as you just set a trace on the 1st player memory address $0200-0202 and have it return to the debug window whenever it updates. After you run a trace of A B and X (after running whatever switches necessary to activate that scoring), you just search through the code for those memory addresses and see where the memory is getting those instructions from in the ROM. From there, you usually see some math where a static integer value is grabbed from the ROM. Then it is just a matter of finding it in the ROM with the hex editor, changing the value (convert hex => dec then dec => hex again) and inserting it. Then you have to recalculate/regenerate the checksum or you'll get a CRC error. It uses the SHA1 checksum algorithm.

This is a useful guide as well and also has tools and instructions for generating checksums on modified roms: http://www.maddes.net/pinball/wpc_debugging.htm

For the time being in Pinmame, I just have the CRC check bypassed. But when I actually finish with it and go to burn the EPROM, I'll recalculate it.

Bad Cats uses 27512's for both the game ROMs. Only the main game ROM is going to be updated.

I may get to work on this a bit this week at night. It has been at a standstill since the holidays.

Well I ran out of time to work on this, but I didn't want it to die either. If anyone wants to grab an RAR with everything you need to do this, here it is: http://thedefog.com/pin/bcedit.rar

that has a hex editor, the debug version of pinmame, dasm, and the sys11 tutorial for editing roms.

for the 10 million score edit, you have to simulate getting to ball 3, then activate the special just as if you were playing it. You'll see a value change if you're watching the memory addresses in that area that deal with temporary scoring elements. The way the 20 mill works is that there is a routine that checks when special is activated whether or not it is the last ball. If yes, 20 mill will be enabled. All you have to do to is either edit the award amount (AND THE PLAIN ASCII TXT that says 20 million IN THE EPROM to whatever value, then regenerate or disable the checksum). The method in which I attempted to do it did not work for multiple player (I am not so great at this).