From: David Caldwell Sent: Wednesday, November 26, 1997 4:26 PM To: Jerry Lawrence Subject: RE: Pac maze Importance: High At 02:39 PM 11/26/97 -0500, Jerry Lawrence wrote: > >by the way, the maze in pacman starts at offset 0x436 in rom 6j, not 0x437 as we >once thought... > >I'm still looking around for the power pellet storage area in the roms, so if you >have any helpful hints, i'd appreciate them! :) > Hey, sorry for the slow response... A little while ago I was in contact with a guy who had done a lot of reverse enginerring on pac-man. He gave me a list of stuff (I think he has more, but I havent pressed him for more, I've gotten real busy at work, and really havent touched anything pacman for a little while). I've been meaning to post it on my web page, but I havent found the time. Anyway, heres a copy of what he mailed me, theres no power pellet info, but maybe you can have some fun with it: >$4E13 = current board number >$4e14 = number of lives left >$4e15 = number of lives displayed at bottom of screen > >$1369 = dec $4e14 >$136d = dec $4e15 > >$08e2 = determines how many dots you must eat to end level > ( normal is $f4 ) > >$171d - 1788 = routine to check for collision with normal ghosts >$1789 = routine to check for collision with blue ghosts >$1763 = change this location to $c9 (return from subroutine) and > there is no collision detection at all > >$0efd - 0f3b = table for fruit shapes, colors, point value. > (the 3 bytes are stored in the above order) > >$1376 = routine to control blue time. > (set this to $c9 and ghosts stay blue until eaten) > >$338d - ?? = speed control table > >here is a partial map for speeds: >(each speed control contains 4 bytes which can be manipulated for >interesting effects) > >$338d - 3390 = Pacman normal speed for Board 1 >$3391 - 3394 = Pacman Blue speed for Board 1 >$3395 - 3398 = 2nd alternate speed for red ghost >$3399 - 339c = 1st alt. speed for red ghost >$339d - 33a0 = Ghost normal speed for board 1 >$33a1 - 33a4 = Ghost blue speed for board 1 >$33a5 - 33a8 = Ghost tunnel speed for board 1 > >$33a9 - 33b6 = unknown ( made changes to this section but noticed > no difference in game play) > >$33b7 - 33ba = Pacman normal speed for Boards 2-4 >$33bb - 33be = Pacman blue speed for boards 2-4 >$33bf - 33c6 = ?? (possible alt. speed for red ghost) >$33c7 - 33ca = Ghost reg speed for boards 2-4 >$33cb - 33ce = Ghost blue speed for boards 2-4 Good luck! Feel free to email any time, and I'll try to help... Cant guarantee anything though! :) -David ============================================================================= >From M.C. Silvius: Attached you find parts of the Basic code I use. I'm sure you can figure out how to use the numbers in your code (all decimal). They are all the numbers I use, counted from the start of the Rom, except the Galaxian Bootleg, all the numbers used here should be 2048 less. I count PRG7 and PRG8 as 1 rom There are several possibilities to patch the Namco Roms to work. The easiest one is to change the number 64 to 48 at position 31 in the NamcoPac.6j and PRG7. (This is how the Midway Pacman reads). I know the meaning of this change, but I'm still testing other solutions. Happy programming, The Sil E-mail: msilvius@caiw.nl http://www.caiw.nl/~msilvius --+------------------------------------+-- 749 REM n=namestart nl=length nn=nicknamestart nnl=nicklength 750 REM MsPacMan MsPacatk 751 n(0) = 3434: n(1) = 3465: n(2) = 3496: n(3) = 3529 752 nl(0) = 8: nl(1) = 8: nl(2) = 8: nl(3) = 6 760 REM PacMan PacPlus Pacmod 761 FOR g = 0 TO 3 762 n(g) = 31 * g + 3418: nl(g) = 9 763 nn(g) = 31 * g + 3434: nnl(g) = 8 764 n(g + 4) = 31 * g + 3542: nl(g + 4) = 9 765 nn(g + 4) = 31 * g + 3558: nnl(g + 4) = 8 766 NEXT g 770 REM PuckMan Hangly NamcoPac PacJap 771 n(0) = 2168: nl(0) = 10: nn(0) = 2074: nnl(0) = 7 772 n(1) = 2203: nl(1) = 11: nn(1) = 2101: nnl(1) = 6 773 n(2) = 2572: nl(2) = 10: nn(2) = 2518: nnl(2) = 7 774 n(3) = 2607: nl(3) = 10: nn(3) = 2545: nnl(3) = 7 775 n(4) = 2185: nl(4) = 11: nn(4) = 2088: nnl(4) = 6 776 n(5) = 2221: nl(5) = 11: nn(5) = 2114: nnl(5) = 6 777 n(6) = 2589: nl(6) = 11: nn(6) = 2532: nnl(6) = 6 778 n(7) = 2624: nl(7) = 11: nn(7) = 2559: nnl(7) = 6 790 REM Galaxian Bootleg = PacJap + 800/608, First Run 770-778 791 FOR i = 0 TO 1: REM ghosts 0,1 792 n(i) = n(i + 4) + 800: nl(i) = 11: nn(i) = nn(i + 4) + 800: nnl(i) = 6 793 NEXT i: FOR i = 2 TO 3: REM ghosts 2,3 794 n(i) = n(i + 4) + 608: nl(i) = 11: nn(i) = nn(i + 4) + 608: nnl(i) = 6 795 NEXT i ============================================================================= >From M.C. Silvius: There are several possibilities to patch the Namco Roms to work. The easiest one is to change the number 64 to 48 at position 31 in the NamcoPac.6j and PRG7. (This is how the Midway Pacman reads). I know the meaning of this change, but I'm still testing other solutions. ============================================================================e Pac man checksum protection, hanglyman map info, mspac info: >From M.C. Silvius: > /* > Did you know that Hangly Man has already 2 maps in Rom 6J. > The second map (3rd level in the game) is stored from position $3E60. > The Second Pellet information is stored from position $3CE0. > */ > I remember the screen going blank when the game got to the 3rd level, but > i just figured it drew the map differently... ah. i'll put in support for that... cool! Will be hard to do, bacause I found out some more: Additional info: The Hangly Man Roms are full of patches, most of them in the free space at the end of each Rom. The second maze info actually has 3 parts. The first part is $3CE0. After that the maze is redrawn from position $413B on the screen with the info of Rom 6H. There is a small table there: $2FCE-2FFA, which contains new code for openings in the top and bottom of the maze, but by a piece of hardcoding in Rom 6F, the left part is again redrawn. This is the Z80 routine: $1FB6-$1FEC The result is a maze that is not symmetrical. So: $3CE0, table, basic maze. $2FCE, table, part top/bottom redrawn. $1FB6, code, left middle part closed again. > > /* > Still haven't found out what to change to move the energizers, but still > working on it. Found the energizers/power pellets!!!!!!! They are on the screen positions $4064, $4078, $4384, $4398. After a simple search I found them in Rom 6H. They are all found twice. $4064 -- $24B2 & $2473 $4078 -- $24BA & $2478 $4384 -- $24BF & $247D $4398 -- $24C$ & $2482 Don't tried to change them yet, just wanted to share this information. These adresses are for all PacMan variants. > I think I found a better way to remove the checksum protection for all > PacMan variants, it's like the way the protection is removed in > MsPacMan. Basicly it has the same four first Roms as in PacMan. They are > full of patches, however, and I'm still reading and interpreting the Z80 > code. > cool... well, let me know what you find... i'm very curious. just for now though, > the only thing that needs to be changed to disable the copy protection on > the namco pacman is that one byte, correct? Yes, this 'one byte crack' works fine. I used that one in my PacNames program. The MsPacMan 'crack' is probably better for all variants: Here's the crack: They changed in Rom 6J the positions $301A & $301B to $00. If I figured it out correctly the Roms are checked, but nothing is done with the result now. In PuckMan they used a third option, but the MsPacMan 'crack' should work fine, but is still untested. > > One thing i'm curious about... when i first started hacking on the pacman roms > last spring, i noticed that if i changed the bytes between the ghost name and > nickname, odd display things would happen. I couldn't get any corollation between > the color of the text, position, and those bytes, although it seemed related > somehow... if you disassembled that rom, i'd be curious about the results... There is an address table for the beginnings of the names/nicknames. If you compare NamcoPac & MidwayPac you find the exact place, I did once, but forgot the result. The names are read from the names table and are printed except when a slash / should be printed, then the routine breaks off. So when you remove the slash, unexpected things can happen. My ideas: - First, skip the text-patch part, saves you a lot of time ;-) (There is already a program around, you know) - Second, I've got some more info on MsPacMan. I don't know if you found out already but here I go: All info is from Roms Boot5($8000) & Boot6($9000) Maze tables: $88c1, $8BAE, $8EA8, $9179, same RLE method as in PacMan, no encryption. Pellet tables: $8A3B, $8D27, $9018, $92EC, same RLE method. Power pellets tables: $8B35, $8E20, $9112, $93FA, all 8 bytes long (4 power pellets) Should not be hard to alter the maze editor now, I think Table with all the maps for the different levels: $94DF, 00 00 01 01 01 02 02 02 02 03 03 03 03 03 (13 bytes). Can be changed I think. That's all for this moment, but still reading and 'hacking' Bye for now, Marcel