Jump to content
pacman3211

Night Stalker hack

Recommended Posts

Neat! I'd love to see a hack that gives the player infinite bullets!

 

 

With the .BIN format, you can do hacks like this entirely with .cfg files. For infinite bullets, copy stalker.bin to, say, infbullet.bin and use this .cfg file:

[macro]
@P 5B6D 34

The "@P" means "POKE", and can be used to overwrite ROM. This works in jzIntv and INTVPC. (Note: In jzIntv at least, it can only overwrite ROM that's part of the game being loaded, and won't overwrite other ROMs, and it won't poke into memory with no ROM. Not sure about INTVPC.)

 

Anyway, the above @P will poke a NOP opcode over the DECR that decrements your bullet count.

Edited by intvnut

Share this post


Link to post
Share on other sites

And since this is a programming forum, I guess I should say how I did the hack.

 

  1. Fired up Night Stalker in jzIntv's debugger.
  2. Run game and tap disc to get into the main game screen.
  3. F4 to break out to debugger.
  4. "m 35D" shows me the address of the EXEC hand controller dispatch. ($51C6)
  5. "m 51C6" shows me the hand controller dispatch table. Entries are in SDBD order. The second entry ($5B14) is the entry used for the keypad.
  6. "u 5B14" shows the code for processing keypad events. Running "u" a couple more times shows more code.
  7. Notice a series of compares and branches: "If 2 goto $5B42; if 4 goto $5B48" etc. Disassembling further sees those code paths converge on code at $5B5A.

The code at $5B5A looks like this:

 $5B5A:    0280 0168              MVI  $0168,R0                              
 $5B5C:    0008                   INCR R0                                    
 $5B5D:    0240 0168              MVO  R0,$0168                              
 $5B5F:    0004 0114 02D5         JSR  R5,$16D5                              
 $5B62:    0004 015C 016B         JSR  R5,$5D6B                              
 $5B65:    0001                   SDBD                                       
 $5B66:    02B8 0082 0018         MVII #$1882,R0                             
 $5B69:    0240 0325              MVO  R0,$0325                              
 $5B6B:    0280 0160              MVI  $0160,R0                              
 $5B6D:    0010                   DECR R0                                    
 $5B6E:    0240 0160              MVO  R0,$0160                              
 $5B70:    02B7                   PULR R7 

I put a watch on $168 and $160 and run again. I notice that $168 gets set to 1 while a bullet is in the air, and cleared when the bullet is gone. $160 is the number of bullets. Looking at the disassembly, the DECR R0 at $5B6D is what decrements the bullet count.

 

So, I NOP it out. Et voila! Infinite bullets.

 

The opcode for NOP is $34. Hence the poke statement above. It pokes $34, the NOP opcode, to lcoation $5B6D, the DECR R0 instruction.

Share this post


Link to post
Share on other sites

Another neat trick with SDK-1600's tools: You can "bake in" a patch such as the one above with rom_merge.

 

So, to bake in that hack above, assuming you've copied Night Stalker to "infbullets.bin", and written the "infbullets.cfg" shown above.

 

rom_merge infbullets.bin infbullets-baked-in.bin

 

Now that patch is applied within the BIN file "infbullets-baked-in.bin"

 

 

BTW, it appears that jzIntv will do something when you try to @P outside the ROM's space. Currently, it appears to just poke zeros, though. So, don't do it. :-)

Share this post


Link to post
Share on other sites

Nice! I like the added speed!

 

Good to see maze variations......now where is my snow level! :)

 

 

hmmm, but how would snow get inside the caves? D'oh!

Share this post


Link to post
Share on other sites

If you want to disable all the enemies in Vectron, start the game, and at the "number of players" screen, enter this command into the debugger:

 

p 104 4

 

$104 is the Exec variable for "number of sprites in use". Fortunately, the last 4 of the 8 sprites are used for the Nasties, and it looks like you only have to set this once for the whole game.

 

Unfortunately, you can't just put this into the .cfg file as a macro, because that variable needs to be left alone during startup.

 

I know there was a very old thread on the Yahoo group "intvprog" regarding the Easter Egg that JZ discovered through ROM disassembly. I'm using dasm1600 for the first time to poke around a bit. I think I can replace the code segment to set $104 to 4 instead of setting that one value to 1, if the player presses 9 to activate the easter egg.

 

Stay tuned ...

Share this post


Link to post
Share on other sites

Okay. My first suggestion wouldn't work, but I came up with something that does.

 

Append the vectron.cfg file with this:

 

[macro]

@p 55ed 2b8

@p 55ee 4

@p 55ef 240

@p 55f0 104

 

This replaces the code to check if you want 2 players (so you can't have 2 players anymore). The only thing that matters at the "number of players" screen is whether you enter '9' to make the easter egg possible.

 

Have fun!

Share this post


Link to post
Share on other sites

I just tried the "Infinite bullets" poke for Night Stalker and it worked. Now, using the same technique to disable sprites as in Vectron, I found a place to write 7 to $104, eliminating robot bullets.

 

p 5073 7

p 5077 104

 

This replaces a 6 with a 7, just before it writes that value to $015f (lives counter) as well as $0162. If you replace 5077 with 5075, you start the game with 0 lives. Unfortunately, that gives you an automatic GAME OVER.

 

The side effects are that you start the game with 7 lives (which doesn't matter since you can't die anyhow), and you don't hear the heartbeat for the first 15 seconds of the game or so. So $0162 must be a timer for the heartbeat.

 

Some time ago, I was using the debugger to find variable addresses for other games. I recall messing with Lock & Chase and AD&D (Cloudy Mountain). My notes are on my old laptop. If I dig those up and try disassembling those ROMs, I can create patches for those as well.

Share this post


Link to post
Share on other sites

 

 

With the .BIN format, you can do hacks like this entirely with .cfg files. For infinite bullets, copy stalker.bin to, say, infbullet.bin and use this .cfg file:

[macro]
@P 5B6D 34

The "@P" means "POKE", and can be used to overwrite ROM. This works in jzIntv and INTVPC. (Note: In jzIntv at least, it can only overwrite ROM that's part of the game being loaded, and won't overwrite other ROMs, and it won't poke into memory with no ROM. Not sure about INTVPC.)

 

Anyway, the above @P will poke a NOP opcode over the DECR that decrements your bullet count.

 

 

Anyway to add game cheats via LTO Flash?

Share this post


Link to post
Share on other sites

 

Anyway to add game cheats via LTO Flash?

 

If you add these sections to your CFG file, the LTO Flash GUI will apply them when sending the game to the LTO Flash unit. This is true whether you download the file to flash, or you use the immediate "Download & Play" function.

 

So, copy stalker.bin to stalker_hack.bin, and stalker.cfg to stalker_hack.cfg, add the [macro] section, et voila. You're done. Add it to your menu or D&P and off you go. Infinite bullets.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...