Jump to content

Photo

Night Stalker hack


6 replies to this topic

#1 pacman3211 OFFLINE  

pacman3211

    Star Raider

  • 60 posts

Posted Sun Mar 23, 2014 3:53 PM

Night stalker with black background

 

Attached File  nightstalker.rom   8.06KB   219 downloads

 

Robot never fires

 

Attached File  nightstalker.rom   8.06KB   218 downloads

 

No background music

 

Attached File  nightstalker.rom   8.06KB   191 downloads

 

 

 


Edited by pacman3211, Sun Mar 23, 2014 4:23 PM.


#2 Rick Reynolds OFFLINE  

Rick Reynolds

    Dragonstomper

  • 734 posts

Posted Sun Mar 23, 2014 9:09 PM

Neat!  I'd love to see a hack that gives the player infinite bullets!



#3 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,388 posts
  • Location:@R6 (top of stack)

Posted Mon Mar 24, 2014 7:00 AM

Neat!  I'd love to see a hack that gives the player infinite bullets!

 

 

With the .BIN format, you can do hacks like this entirely with .cfg files. For infinite bullets, copy stalker.bin to, say, infbullet.bin and use this .cfg file:

[macro]
@P 5B6D 34

The "@P" means "POKE", and can be used to overwrite ROM.  This works in jzIntv and INTVPC.  (Note:  In jzIntv at least, it can only overwrite ROM that's part of the game being loaded, and won't overwrite other ROMs, and it won't poke into memory with no ROM.  Not sure about INTVPC.)

 

Anyway, the above @P will poke a NOP opcode over the DECR that decrements your bullet count.


Edited by intvnut, Mon Mar 24, 2014 7:00 AM.


#4 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,388 posts
  • Location:@R6 (top of stack)

Posted Mon Mar 24, 2014 7:10 AM

And since this is a programming forum, I guess I should say how I did the hack.

 

  1. Fired up Night Stalker in jzIntv's debugger.
  2. Run game and tap disc to get into the main game screen.
  3. F4 to break out  to debugger.
  4. "m 35D" shows me the address of the EXEC hand controller dispatch.  ($51C6)
  5. "m 51C6" shows me the hand controller dispatch table.  Entries are in SDBD order.  The second entry ($5B14) is the entry used for the keypad.
  6. "u 5B14" shows the code for processing keypad events.  Running "u" a couple more times shows more code.
  7. Notice a series of compares and branches:  "If 2 goto $5B42; if 4 goto $5B48" etc. Disassembling further sees those code paths converge on code at $5B5A.

The code at $5B5A looks like this:

 $5B5A:    0280 0168              MVI  $0168,R0                              
 $5B5C:    0008                   INCR R0                                    
 $5B5D:    0240 0168              MVO  R0,$0168                              
 $5B5F:    0004 0114 02D5         JSR  R5,$16D5                              
 $5B62:    0004 015C 016B         JSR  R5,$5D6B                              
 $5B65:    0001                   SDBD                                       
 $5B66:    02B8 0082 0018         MVII #$1882,R0                             
 $5B69:    0240 0325              MVO  R0,$0325                              
 $5B6B:    0280 0160              MVI  $0160,R0                              
 $5B6D:    0010                   DECR R0                                    
 $5B6E:    0240 0160              MVO  R0,$0160                              
 $5B70:    02B7                   PULR R7 

I put a watch on $168 and $160 and run again.   I notice that $168 gets set to 1 while a bullet is in the air, and cleared when the bullet is gone.  $160 is the number of bullets.  Looking at the disassembly, the DECR R0 at $5B6D is what decrements the bullet count.

 

So, I NOP it out. Et voila!  Infinite bullets.

 

The opcode for NOP is $34.  Hence the poke statement above.  It pokes $34, the NOP opcode, to lcoation $5B6D, the DECR R0 instruction.



#5 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,388 posts
  • Location:@R6 (top of stack)

Posted Mon Mar 24, 2014 9:39 AM

Another neat trick with SDK-1600's tools:  You can "bake in" a patch such as the one above with rom_merge. 

 

So, to bake in that hack above, assuming you've copied Night Stalker to "infbullets.bin", and written the "infbullets.cfg" shown above.

 

  rom_merge infbullets.bin infbullets-baked-in.bin

 

Now that patch is applied within the BIN file "infbullets-baked-in.bin"

 

 

BTW, it appears that jzIntv will do something when you try to @P outside the ROM's space.  Currently, it appears to just poke zeros, though.  So, don't do it.  :-)



#6 intvdave OFFLINE  

intvdave

    Dragonstomper

  • 763 posts

Posted Mon Mar 24, 2014 9:58 AM

Neat hacks pacman. I have been messing around a bit with NS also. Mine is still a work in progress but the below video (click on image to watch it) gives you an idea where I am going with it.  I have a thread about this at:

 

http://www.intellivi...c.php?f=4&t=219

 

ns.gif


Edited by intvdave, Mon Mar 24, 2014 9:58 AM.


#7 Rev OFFLINE  

Rev

    IntellivisionRevolution

  • 16,526 posts
  • Location:NC

Posted Mon Mar 24, 2014 8:58 PM

Nice!   I like the added speed!     

 

Good to see maze variations......now where is my snow level!   :)     

 

 

hmmm, but how would snow get inside the caves?   D'oh!






0 user(s) are browsing this forum

0 members, 0 guests, 0 anonymous users