440 replies to this topic

[Stumblor]

I found the fast flip memory address for AFM.   This one I found by tilting and watching for values that go from 0->1 and 1->0 when the ball drains.    More excitingly, it shuts off correctly when I get video mode awarded.  
 

 

Nice work! If you don't mind, would you be able to send me some info, even a video, of how specifically you did it (DM is fine)? I've been trying with AFM over the past few days and can't quite seem to crack the method. If I could see how with this one I could be of more assistance with the rest.

 

This is what I'm currently doing, but have questions regarding:

 

1. Which process to look at (currently the 'VPinMame - AFM' process)

2. Which value to look for (I was alternating between 1 and 0) 

3. Which process to use (for AFM/WPC95 I found that going in and out of R Flippper test mode in service menu disabled the L Flip)

4. When the dynamic memory candidate address was found, how to translate this to a VS memory location (say for 12345678 in CheatEngine, I put a VS breakpoint in at 0x12345678)

 

Seems like 2 & 3 have been answered already above, I'll try that method later and see if I can replicate.

 

Thanks for the help, and apologies for the hand holding. I think once I crack this I can be of more help :-/ 

Edited by Stumblor, 04 July 2018 - 06:02 AM.

[DJRobX]

I"ve committed inaugural WPC-95 support for AFM, Medieval Madness, Monster Bash, and FishTales.    I probably would have done Scared Stiff too but NFozzy already has a hack in place for that table.  

The new VPM (once Carny builds it) will trigger solenoid 31, so it is compatible with the existing UseSolenoids=2 implementation present in wpc.vbs.   You will just need to update VPM and change UseSolenoids=2 like other supported WPC tables. 

 

Here's what I figured out to be the fastest way to determine WPC addresses:

 

1) Use PinMame32 to load the ROM.   This greatly shrinks the amount of stuff your CheatEngine will need to search through vs trying to search it with VPX/Vpinmame
2) The WPC95 emulators all seem to have "simulators" implemented in Pinmame32.   They pretend a ball is in play.  Great, but tilt is not typically one of the switches offered.  

3) Look for the line in the simulator .c file (afm.c, mm.c, mb.c, etc..) that has a bumper switch we can hijack for tilt.  It'll be something like :

{"Bottom Bumper", 1,swBottomJet, 0, stFree, 1},

Change that to "swTilt" so you can press a key in the simulator to tilt the table. 
4) Start pinamme32 in the debugger.    Attach cheat engine to it   Let it get through the test. 

5) In cheatengine search for bytes with 0.    

6) Start the table (5-credit, 1-start, just like vpm).

7) In cheatengine search for bytes with 1

8) Tilt the table (Alt-R if you hijacked the bottom bumper usually.. it's on the help screen).  Once it danger-danger-tilts, in cheatengine search for 0.

9) In Pinmame32 pick the ball thats in play and hit Q to drain it.   Tilt will go away and it should be back in the shooter lane.  In cheatengine search for 1 

 

At this point it will be whittled down to just a few .. possibly even just one.     You can tilt again and end the game, and watch the values change in CheatEngine.  The one that's changing correctly is hopefully obvious at this point. 

Take that address, and break the Visual Studio debugger.   Add a data change breakpoint on that address.   Resume debugging.    

Tilt or start the table.  Once that value changes VS debugger will pop up.   You'll be in a WRITE_HANDLER.    Offset contains the magic address we need.   So far all of them have been right around 0x80. 

 

WPC does not seem to respond to manipulating this value like SAM does, so we have to rely on just testing the table and seeing that it operates correctly.  

 

If you get the latest VPM code from SVN, for WPC-95 you now just need to add  wpc_set_fastflip_addr(0xMAGICNUMBER) into the init function.  
 

Edited by DJRobX, 04 July 2018 - 06:49 AM.

[nFozzy]

Fish Tales should okay already

 

Here's the full list of incompatible games:

WPC-95's: https://www.ipdb.org...advanced&mpu=11

Whitestar: https://www.ipdb.org...advanced&mpu=33

Zaccaria: https://www.ipdb.org...advanced&mpu=36

[Stumblor]

Fish Tales should okay already

 

Here's the full list of incompatible games:

WPC-95's: https://www.ipdb.org...advanced&mpu=11

Whitestar: https://www.ipdb.org...advanced&mpu=33

Zaccaria: https://www.ipdb.org...advanced&mpu=36

 

Thanks nFozzy - did you say Capcom was incompatible as well?

[DJRobX]

Capcom would definitely benefit from this sort of feature.  

VPM's flipper solenoids do not work properly on Capcom tables, so all of the VP tables currently have faked "fast flips".   The flipper solenoids make one really latent "pulse" instead of flipping normally. 

 

There's also a feature of Kingpin that it weakens the flippers as time runs out.   Probably would be helpful to figure out where the strength value is being stored internally as well.   I think you can adjust strengths from the test menu so it probably is possible to figure out. 

Edited by DJRobX, 04 July 2018 - 05:26 PM.

[toxie]

The latter would be awesome to have!

[DJRobX]

Nice work! If you don't mind, would you be able to send me some info, even a video, of how specifically you did it (DM is fine)?

 

 

I added SafeCracker and took a video while doing it.   This one went really smoothly but you can see the whole process.  

 

https://youtu.be/EzlYqJXmcW4

[Stumblor]

 

Nice work! If you don't mind, would you be able to send me some info, even a video, of how specifically you did it (DM is fine)?

 

 

I added SafeCracker and took a video while doing it.   This one went really smoothly but you can see the whole process.  

 

https://youtu.be/EzlYqJXmcW4

 

 

Perfect - thanks for putting that together. I was actually doing the entire process in a simialr way - all except for the final data breakpoint which I was leaving as 4 bytes - not 1! Tripped at the last hurdle..

 

Will have a crack at TOTAN & JunkYard now. 

[DJRobX]

Awesome!  Just let me know the addresses you find, and I will pop them in so they get committed into the official VPM version.  

 

Thanks for jumping in and lending a hand!   

[Stumblor]

No problem. Considering the amount of free man hours my cab must contain it's the least I can do!!

 

All the offsets I get are currently displayed as ints - not in hex as your video showed. Possibly a setting at my end? Anyway have converted them below:

 

JunkYard = 128 (int) => 0x0000080

 

Totan = 123 (int) => 0x000007B

 

NBA Fastbreak = 943 (int) => 0x000003AF

 

Cirqus Voltaire = 128 (int) =>  0x0000080

^^ I had a bit of trouble with this one as 6 different memory address always stayed on between in play / tilt, however this was the only address that stayed active in the service menu (i think flippers stay active in all WPC95 service menus? Will check on CV in my cab)

 

No Good Gofers = Kept getting unhandled memory exceptions when trying to debug so couldn't continue with this one (ngg_13 & ngg_12) Full Exception details: Unhandled exception at 0x00BE65BA in PinMAME32_VC2012vcmd.exe: 0xC0000005: Access violation reading location 0x00000080.

 

Champion Pub = 128 (int) =>  0x0000080

 

Cactus Canyon = 135 (int) => 0x00000087

Edited by Stumblor, 06 July 2018 - 11:24 AM.

[DJRobX]

Sweet!    Awesome.   Thank you!    I'll look into NGG.  ​Yes, you can right click on the watch window and check "hexadecimal display" to flip back and forth.  

The pattern strongly suggests that CV is probably correct (0x80 is common).    You'll know for sure if the flippers stay on but shut off properly in video mode.    NBA fastbreak has a higher address than any of the others so will be interesting to see if that one holds up or not.    
 

[DJRobX]

OK, NGG had a bug in its simulator output for the wheel.    Odd because I used that simulator to validate that the wheel position worked correctly originally the last time I modified it.    I just added some bounds checking for now.    Found its address at 0x84.

 

All the values Stumblor found plus mine are committed to the repo now.    I did Scared Stiff (0x81) and Congo (0x80) which in theory means all the WPC-95 tables are covered!   I'll go bug Carny to make a build.

Edited by DJRobX, 05 July 2018 - 10:49 PM.

[jesperpark]

Oh man I feel like a little kid, sitting at a grown up table listening to the adults talk.  Most everything goes over my head, but I understand this is all great news!!

 

Thanks to everyone working on this

[Thalamus]

Haha. That comment was very fitting Jesper. So refreshing seeing another pinball lover using his abilities to push us further. Thank you @stumblor and @DjRobX !

[Slydog43]

Thanks for all the time put into this, as this is such an important new feature for VP.  

[Stumblor]

 

All the values Stumblor found plus mine are committed to the repo now.    I did Scared Stiff (0x81) and Congo (0x80) which in theory means all the WPC-95 tables are covered!   I'll go bug Carny to make a build.

 

Great! I might recheck NBAFB later tonight too to be sure.

 

So once the build is released and we update VPM, WPC95 tables can be FastFlipped using the usual method (UseSolonoids=2) and SAM tables can be done using... vpmFlipsSAM.RomControl = False ?

[DJRobX]

For SAM you add the following to the end of the init routine:

InitVpmFFlipsSAM

 

and yes, these wpc95 tables will work just like the other WPCs (UseSolenoids=2).   Same caveats apply.  In AFM for example you also need:

 

Const cSingleLFlip = 0

Const cSingleRFlip = 0

Otherwise the fast flip routine seems to think the table has upper flippers, and the left flipper triggers the diverter. 

Edited by DJRobX, 06 July 2018 - 06:21 AM.

[Stumblor]

Awesome, thanks for that!

 

Looks like Carny has published a new build with these updates over on the other site, topic: SAMBuild3.1 beta thread for those looking. Guess I know what I'll be doing today!!

 

Great stuff guys.

[Stumblor]

Have just tested the WPC95 tables on my cab - here are the results:

 

Congo - working

AFM - working (**)

SafeCracker - working

TOTAN - working (**)

Scared Stiff - working

Junk Yard - working

NBA - not working, will review

Med Madness - working (**)

Cirqus Voltaire - working (**)

No Good Gofers - couldn't test , TBA

Champ Pub - working (**)

Moster Bash - working

Cactus Canyon - working (**)

 

** These tables require the additional 'cSingle' code to function properly:

Const cSingleLFlip = 0
Const cSingleRFlip = 0

Edited by Stumblor, 07 July 2018 - 06:49 AM.

[Stumblor]

@DJRobx

 

Think this is the correct value for NBA, which correlates better with the general trend of the others:

 

NBA = 122 (int) => 0x0000007a