They probably used this trick when they were busy debugging or testing the game ROM. They could then modify the game ROM without having to recompute the checksum.
Nowadays it takes a few milli seconds to calculate a checksum. But back in 79, it would have saved them a lot of time for any single modification they could make.

Well this is just my theory. Does anyone know a former Bally engineer that can solve this mystery?
Thanks

#2 6 years ago

PIP

Quench

Pinside member

8y 114K 8,039

OP
Quoted from scass:
They probably used this trick when they were busy debugging or testing the game ROM. They could then modify the game ROM without having to recompute the checksum.

Probably this ^^^

When modifying/testing new code, it's annoying having to recalculate the checksum for each $400 hex bytes that need to equal zero and then modify the checksum locations every time you want to test a change. There are multiple checksum locations and every game has some of them in different locations.

The special $5A5A you speak of would be read from U2 not U5, and the location varies between different version U6 system ROMs. The value normally stored there represents the upper ROM location of U1/U2 to perform the checksum downwards from.

#3 6 years ago

???

scass

Inactive member

Bruxelles

7y 12,150 8

Hello @Quench,

This is the piece of code:

58EA : FE 51 6E ldx X516E
58ED : 8C 5A 5A cpx #$5A5A
58F0 : 27 23 beq L5915

It first loads into the index register the value stored in memory $516E (somewhere in U2), and the value is $1800 (first byte of U5)
Then it compares with the value $5A5A

#4 6 years ago

PIP

Quench

Pinside member

8y 114K 8,039

Yes that code looks very familiar

If you're modifying code, temporarily change the value of location $516E (which is in U2) to $5A5A
When you're finished changing code, restore the value $1800 (or $2000 if you expand code in U6 to 2732) and fix up all the checksum locations.

#5 6 years ago

???

scass

Inactive member

Bruxelles

7y 12,150 8

I get it now. I though it was comparing the content in memory of the index register with $5A5A.

So no more « special ROM » in U5.

Indeed by changing the content of $51E6 on U2, they were able to modify the game rom (U1 et U2) and skip the first test.

Thanks Quench 

#6 6 years ago

PIP

Quench

Pinside member

8y 114K 8,039

One other thing you may find interesting:
When you enter test mode via the red service switch inside the coin door, if you then press the S33 switch on the MPU board, the CPU will jump to address $2000.

This is for use with the Bally AID-1 test board connected to the top J5 connector. If you don't have an AID-1 board connected and press the S33 switch during the test modes, the game will crash.
Pressing the S33 switch only jumps to $2000 in the hardware test modes (displays, lamps, solenoids, sounds).

You could make your own card to plug into J5 with your own test code ROM on it that you can execute via test mode.

Reply

Wanna join the discussion? Please sign in to reply to this topic.

Hey there! Welcome to Pinside!

Donate to Pinside

Great to see you're enjoying Pinside! Did you know Pinside is able to run without any 3rd-party banners or ads, thanks to the support from our visitors? Please consider a donation to Pinside and get anext to your username to show for it! Or better yet, subscribe to Pinside+!

This page was printed from https://pinside.com/pinball/forum/topic/the-early-bally-5a5a-checksum-mystery and we tried optimising it for printing. Some page elements may have been deliberately hidden.

Scan the QR code on the left to jump to the URL this document was printed from.