Tempest Cheat on rev 1 and Atari Code Mystery

crossposted from RGVAC

I've got a small mystery I ran across that I wanted to share.

As some people may be aware, rev 1 of Tempest had a cheat where, if
your score fell in to a certain range, some very strange things would
happen. I've taken the list of what strange things would happen at
what score from HERE...

http://www.arcade-history.com/history_database.php?page=detail&id=2865

Basic idea (as claimed), the score, in XXYYZZ format, must be so where
XX is > 16, YY is between 29 and 60, and ZZ is the special code which
triggers an event.

I looked for something close to this in the Tempest source code. I
believe the relevant section for the copyright protection code is
around $C5B6...

http://www.ionpool.net/arcade/tempest_code_project/136002.txt

But here's the part that gets me. This is the actual code which does
the destruction (which users had interpreted as a bug/feature)...

C5BC A6:40 LDX:zp Zp RAM 0040
C5BE FE:00 02 INC:abs,x $0200,X
C5C1 60: RTS:imp Ret from Sub

What this says is, get the last two digits of the player's high score.
Add that number to $0200. Go to THAT memory address ($0200+ZZ), and
increase the number found there by one.

But that's what is odd. It would be increasing memory addresses
200-270 or so. Not much is documented to be in that location (although
it would definately have a big effect on gameplay). At least, nothing
that would match the wild descriptions of what all changed with the
different scores...

http://www.ionpool.net/arcade/tempest_code_project/memory.html

BUT, if you look at RAM addresses 0000-0070 or so, they match
perfectly with the descriptions (at the first URL referenced in this
posting) of what the side effect was when you reach a certain score.

Examples --

ZZ=14,15 "credit sound without actual credit".
RAM 0014,0015 "counter timer to hold closed hardware coin counter"

ZZ=41 "switch last 2 digits of score"
RAM 0041 "middle two digits of player 1's score"

ZZ=42 "increase score quickly"
RAM 0042 "highest two digits of player 1's score"

zz=50,51 "player moves by itself"
RAM 0050 "spinner position change since last read"
RAM 0051 "player's position in the tunnel"

zz=48 "255 extra lives."
RAM 0048 "Lives for Player 1"

So what does all this mean? First, it is interesting to see how
someone's explanation of what happened at what score matches up with
what we've found that the source code has at what memory location. You
can see what the effects would be of the score bug.

But also... we've got a mismatch. The code says to trash all the data
in the $200-$299 range (with certain exceptions due to BCD, binary
decimal coding, but we'll ignore that for now). So here's the
(unproven) theory...

Atari gave the instructions to replace the two ROMs (136002.117 and
136002.122 in MAME naming convention). Those were the two that were
necessary to remove the bug. (The bug was that it believed the
copyright notice was changed, so it would run the scrambler code,
which was based on the player's score. Except, the copyright notice
was actually okay. Ooops.)

But, I believe that as Atari released later versions of the game, they
had also changed the ROM with the $C000-C799 code (ROM 136002.119). My
guess for this is two reasons. First, to change the nature of the bug,
since the side-effects of the copyright scrambler were somewhat well
known. Also, to prevent it directly writing to a memory address
(0013-0015) which could affect the coin counters. But when they made
this change, they didn't tell anybody. They just quietly put it out
into the field.

So... to confirm...

Can anyone (or better yet... a few people) with an actual Tempest
machine with the v1 ROMs (and not a MAME copy) dump their 136002.119
ROM and allow it to be compared with the newer v3 version? I highly
suspect that Atari made a change that they didn't tell anyone about.
It would be nice to nail this down with a bit of proof.

---------------------------------------------------------------------------
** Unsubscribe, subscribe, or view the archives at http://www.vectorlist.org
** Please direct other questions, comments, or problems to chris@westnet.com
Received on Thu Sep 16 20:47:26 2004