Re: Tempest Cheat on rev 1 and Atari Code Mystery

I've figured out more since then. What I hit upon was the Pokey
protection routine. There is an yet another protection scheme that does
the more famous memory location scrambling.

This Pokey routine was actually tripped over in MAME around early 2000
when they were rewriting the Pokey driver. Strange lockups past 150,000
points.

I guess what I'm trying to figure out now is, when I play Tempest v1 in
MAME, why am I not hitting the more famous data scrambling routine that
resulted in free men and what not.

Josh McCormick wrote:

> crossposted from RGVAC
>
> I've got a small mystery I ran across that I wanted to share.
>
> As some people may be aware, rev 1 of Tempest had a cheat where, if
> your score fell in to a certain range, some very strange things would
> happen. I've taken the list of what strange things would happen at
> what score from HERE...
>
> http://www.arcade-history.com/history_database.php?page=detail&id=2865
>
> Basic idea (as claimed), the score, in XXYYZZ format, must be so where
> XX is > 16, YY is between 29 and 60, and ZZ is the special code which
> triggers an event.
>
> I looked for something close to this in the Tempest source code. I
> believe the relevant section for the copyright protection code is
> around $C5B6...
>
> http://www.ionpool.net/arcade/tempest_code_project/136002.txt
>
> But here's the part that gets me. This is the actual code which does
> the destruction (which users had interpreted as a bug/feature)...
>
> C5BC A6:40 LDX:zp Zp RAM 0040
> C5BE FE:00 02 INC:abs,x $0200,X
> C5C1 60: RTS:imp Ret from Sub
>
> What this says is, get the last two digits of the player's high score.
> Add that number to $0200. Go to THAT memory address ($0200+ZZ), and
> increase the number found there by one.
>
> But that's what is odd. It would be increasing memory addresses
> 200-270 or so. Not much is documented to be in that location (although
> it would definately have a big effect on gameplay). At least, nothing
> that would match the wild descriptions of what all changed with the
> different scores...
>
> http://www.ionpool.net/arcade/tempest_code_project/memory.html
>
> BUT, if you look at RAM addresses 0000-0070 or so, they match
> perfectly with the descriptions (at the first URL referenced in this
> posting) of what the side effect was when you reach a certain score.
>
> Examples --
>
> ZZ=14,15 "credit sound without actual credit".
> RAM 0014,0015 "counter timer to hold closed hardware coin counter"
>
> ZZ=41 "switch last 2 digits of score"
> RAM 0041 "middle two digits of player 1's score"
>
> ZZ=42 "increase score quickly"
> RAM 0042 "highest two digits of player 1's score"
>
> zz=50,51 "player moves by itself"
> RAM 0050 "spinner position change since last read"
> RAM 0051 "player's position in the tunnel"
>
> zz=48 "255 extra lives."
> RAM 0048 "Lives for Player 1"
>
> So what does all this mean? First, it is interesting to see how
> someone's explanation of what happened at what score matches up with
> what we've found that the source code has at what memory location. You
> can see what the effects would be of the score bug.
>
> But also... we've got a mismatch. The code says to trash all the data
> in the $200-$299 range (with certain exceptions due to BCD, binary
> decimal coding, but we'll ignore that for now). So here's the
> (unproven) theory...
>
> Atari gave the instructions to replace the two ROMs (136002.117 and
> 136002.122 in MAME naming convention). Those were the two that were
> necessary to remove the bug. (The bug was that it believed the
> copyright notice was changed, so it would run the scrambler code,
> which was based on the player's score. Except, the copyright notice
> was actually okay. Ooops.)
>
> But, I believe that as Atari released later versions of the game, they
> had also changed the ROM with the $C000-C799 code (ROM 136002.119). My
> guess for this is two reasons. First, to change the nature of the bug,
> since the side-effects of the copyright scrambler were somewhat well
> known. Also, to prevent it directly writing to a memory address
> (0013-0015) which could affect the coin counters. But when they made
> this change, they didn't tell anybody. They just quietly put it out
> into the field.
>
> So... to confirm...
>
> Can anyone (or better yet... a few people) with an actual Tempest
> machine with the v1 ROMs (and not a MAME copy) dump their 136002.119
> ROM and allow it to be compared with the newer v3 version? I highly
> suspect that Atari made a change that they didn't tell anyone about.
> It would be nice to nail this down with a bit of proof.
>
>
> ---------------------------------------------------------------------------
>
> ** Unsubscribe, subscribe, or view the archives at
> http://www.vectorlist.org
> ** Please direct other questions, comments, or problems to
> chris@westnet.com
>

---------------------------------------------------------------------------
** Unsubscribe, subscribe, or view the archives at http://www.vectorlist.org
** Please direct other questions, comments, or problems to chris@westnet.com
Received on Fri Sep 17 15:53:16 2004