Page 1 of 1

The thread of POKEs

Posted: Thu Sep 27, 2018 4:54 pm
by R-Tape
A dumping area for miscellaneous POKEs, one day destined for the Tip-Shop.

A Trick of the Tale. No eyestraining death effect:

POKE 33485,201

It wouldn't be so bad if you only saw it once in a while, but the game's rock hard!

Re: The thread of POKEs

Posted: Thu Sep 27, 2018 9:21 pm
by Juan F. Ramirez
I still remember the day I discovered POKEs and how to use them. It was with Sabre Wulf. I could easily cross the jungle and it was cool!

I realized it opened a whole world of posibilities ! :twisted:

After checking the Tipshop I think it was POKE 47219, 201 ('Ghost jungle), IIRC.

Re: The thread of POKEs

Posted: Fri Sep 28, 2018 9:56 pm
by g0blinish
a couple years ago I'd got idea to find POKES:
1. start game and dump whole memory
2. collect items or loose life N times. Save dump again.

3. compare all dumps and check values what differ or close to known values.

Gosh, all efforts doesn't help to find cheat, even on AtAri.

Re: The thread of POKEs

Posted: Fri Sep 28, 2018 10:12 pm
by Ralf
a couple years ago I'd got idea to find POKES:
1. start game and dump whole memory
2. collect items or loose life N times. Save dump again.

3. compare all dumps and check values what differ or close to known values.
Goblinish, this is a nice idea. So nice that someone actually invented it before you ;)

So, there is an utility called Hokey Pokey:
http://www.worldofspectrum.org/pub/sinc ... key102.zip

It does exactly what you say. You save a snapshot of your game, lose a life, save a second snapshot and compare the memory.

I used it several times myself. Sometimes I failed to find the poke as my searched value was saved in memory in some more complicated way. But sometimes it helped me ;)

Finding the proper cell is often only the first step. When I find where energy, time or number of lives is stored, I want next to find instructions that change that value and replace them with my poke.

Re: The thread of POKEs

Posted: Fri Sep 28, 2018 10:52 pm
by R-Tape
Ralf wrote: Fri Sep 28, 2018 10:12 pm So, there is an utility called Hokey Pokey:
http://www.worldofspectrum.org/pub/sinc ... key102.zip
Oooh handy. Sooner or later we'll have to start incorporating utilities like these into ZXDB.

I'm not an advanced PEEKer and POKer, but I do alright. I rarely have success searching for the #lives counter though—it's usually the DEC (HL) or DEC A that I look for; or I just read the code until I see things that make sense. We have so many AGD games these days that one knows which bits of code to look for (usually 32028,x), in fact knowing Jonathan's usual voracious anti-hack efforts, I'm surprised he didn't incorporate prophylactic measures into the engine.

With the 'Trick of the Tale' POKE above, I just opened the SPIN debugger during the annoying death effect. It doesn't always work as the point of interrupt is usually taken, but in this case the program counter was smack in the middle of the OUT instructions that most coders will recognise as an effect of some kind.

I had trouble with daveysludge's Pooper Scooper recently. I found the byte that completed the level when zero, but I couldn't find the lives counter, or decrement lives. Anyone?

Re: The thread of POKEs

Posted: Sat Sep 29, 2018 7:25 am
by djnzx48
Lives counter is at 59193, POKE 25729, 0 for infinite lives and POKE 45504, x for number of lives. I used the cheats finder in SpecEmu to get these and it's really easy to use, especially as it lets you set breakpoints on memory accesses.

Re: The thread of POKEs

Posted: Sat Sep 29, 2018 9:39 am
by Ralf
I just read the code until I see things that make sense
The next level of experience would be using conditional breakpoints ;)
So if you know which memory cell stores lives and the value of lives is currently 3 then put a global breakpoint on condition

[Lives]<>3

and lose a life, you will get into debugger at exact instruction that changed [Lives] value.

I do it in Spin emulator, maybe other tools enable it as well.

Re: The thread of POKEs

Posted: Sat Sep 29, 2018 2:40 pm
by g0blinish
a good cheat for an emulator: Freeze memory cell option.

Re: The thread of POKEs

Posted: Sat Sep 29, 2018 3:07 pm
by pavero
djnzx48 wrote: Sat Sep 29, 2018 7:25 am Lives counter is at 59193, POKE 25729, 0 for infinite lives and POKE 45504, x for number of lives. I used the cheats finder in SpecEmu to get these and it's really easy to use, especially as it lets you set breakpoints on memory accesses.
I have found these addresses for infinite lives at least ...

25729,0 : 43049,0 : 43129,0 : 44049,0 : 44133,0 : 57400,0 : 63561,0 : 63642,0

Re: The thread of POKEs

Posted: Sun Nov 04, 2018 3:14 pm
by R-Tape
One for S.E.U.D developers. These stop bonus 1 + 2 being automatically collected when they fall off the end of the screen:

Code: Select all

49191,201
49206,201

Re: The thread of POKEs

Posted: Sun Nov 04, 2018 7:16 pm
by Alessandro
R-Tape wrote: Sun Nov 04, 2018 3:14 pm One for S.E.U.D developers. These stop bonus 1 + 2 being automatically collected when they fall off the end of the screen:

Code: Select all

49191,201
49206,201
Thanks Dave - this is much simpler than the solution I found following Jonathan's advice (here).

Some other POKEs for SEUD (thanks to Dave and Jonathan):
  • POKE 29679,156 to enable PAPER color change.
  • The keycodes are stored between 50501 and 50507 and must be changed
  • Player score is located at 51340.
  • Lives are located at 48429.
  • A routine at 48905 colours the screen to whatever INK colour you have chosen, if you poke in an instruction at 48915 to jump to your own colour routine it arrives there with the HL register pair pointing at the colour for that level.
  • To avoid making the SEUD game (or level) restart after the player reaches the end: the three bytes at 48561 are the ones which restart the game. There is a JP Z,LOOPLV (202, 167, 187) instruction at that address. Changing that to a RET Z followed by two NOPs (200, 0, 0) will exit the game.
I also found, by following the flow of the game with the Spectaculator monitor/debugger, that you can add custom sound effects for shooting, bonus collection and explosions. For the hidden bonus game of Apulija-13 2.0, I initially employed the standard AY sound effect, then took notice of the address the program jumped to for those events and modified the CALL to that effect with three distinct calls to short beeper sound routines stored after the main code.

On the other hand Dave - I remember you managed to hack the SEUD core code to add two horizontal bars of different attributes to that of the game area, for horizontally scrolling titles. Could you tell us how did you do it?

Re: The thread of POKEs

Posted: Sun Nov 04, 2018 7:53 pm
by R-Tape
Alessandro wrote: Sun Nov 04, 2018 7:16 pm
Thanks Dave - this is much simpler than the solution I found following Jonathan's advice (here).
Oh. That worries me. I haven't done a full disasm of SEUD, and the odds of me finding a better solution than Jonathan are very small indeed*. I tested them and can't find anything wrong, but based on this I'll need to investigate further.

*My only hope is that this is the reason (Jon's quote from WoS):
Forgive me if this doesn't make too much sense, I've been drinking homebrew. It's the best I can do in my current inebriated state!
:mrgreen:
On the other hand Dave - I remember you managed to hack the SEUD core code to add two horizontal bars of different attributes to that of the game area, for horizontally scrolling titles. Could you tell us how did you do it?
It was a long time ago, on a now lost laptop. At least 3 people have asked me for this, so I should create a patch, or detailed notes. I'm too busy right now, but will look at this.

Re: The thread of POKEs

Posted: Sun Nov 04, 2018 9:20 pm
by Einar Saukas
R-Tape wrote: Fri Sep 28, 2018 10:52 pmOooh handy. Sooner or later we'll have to start incorporating utilities like these into ZXDB.
This kind of information is stored in tables "tools" and "toolfiles" in ZXDB.

Re: The thread of POKEs

Posted: Sun Nov 04, 2018 10:14 pm
by Alessandro
Sorry, I just noticed I forgot to amend and complete this:
Alessandro wrote: Sun Nov 04, 2018 7:16 pm The keycodes are stored between 50501 and 50507 and must be changed
The above should read as follows:

The keycodes are stored between 50501 and 50507 and can be changed according to the codes returned by the ROM routine at address 654, which returns the number of the key pressed (in the E register), in the range 0-39. Check this handy table:

Image

Re: The thread of POKEs

Posted: Tue May 26, 2020 3:20 pm
by XoRRoX
S.E.U.D.

I was messing about with it and figured out invincibility: poke 48966,201 (RET, is normally RET Z (200)). Great for dev testing.