Patching Daytona in m2emulator

[Boomslang]

yay i got it going

just tested over 2 player then 3 player and worked well. Perhaps not interesting to anyone but Its cool for multiplayer network racing against all the AI cars aswell as your friends

I only know how to do this over cheat engine currently so will need someone who can script into the lua or something for this if anyone is interested

[Howard_Casto]

I'm interested, but you know the pace I go at.  You might want to release your output script in the meantime for those that want to use it. 

[Boomslang]

Yep I'll post it tonight

I also made another which has the outputs aswell as 3 cheats I added to change the total lap number for longer endurance races 99 laps,180 laps or 255 laps. 255 is the most which can be done, just a small 9-10 hour endurance race on expert if anyone is keen 

[Boomslang]

Firstly everyone can Thank SailorSat, she has done all the magic here really!! and I couldn't do any of it without her knowledge

Ill post 2 different lua files for using with TS2 etc

This one will get VR lights working with TS2 with no cheats
daytona.lua

Code: [Select]

ROM = "daytona"
require("model2"); -- Import model2 machine globals


function Init()
Patch_SpecialInputs();
Patch_LampOutputs();
os.execute ("tsstub.exe "..ROM)
end

function Patch_SpecialInputs()
-- first, disable old read
Romset_PatchDWord(0, 0x1E504, 0x5CA01E00); -- MOV g4,0x00 (NOOP?)

-- now jump to our patched read
Romset_PatchDWord(0, 0x1E508, 0x090219F8); -- CALL 0x0003FF00

-- read io port
Romset_PatchDWord(0, 0x3FF00, 0x80A03000);
Romset_PatchDWord(0, 0x3FF04, 0x01C00012); -- LDOB g4,0x01C00012

-- read patched mask
Romset_PatchDWord(0, 0x3FF08, 0x80B83000);
Romset_PatchDWord(0, 0x3FF0C, 0x00500820); -- LDOB g7,0x00500820

-- and em
Romset_PatchDWord(0, 0x3FF10, 0x58A50097); -- AND g4,g4,g7

-- restore old mask
Romset_PatchDWord(0, 0x3FF14, 0x8CB800FF); -- LDA g7,0xff

-- return
Romset_PatchDWord(0, 0x3FF18, 0x0A000000);  -- RET
end

function Patch_LampOutputs()
-- reroute 0x01C0001E to 0x00500824
for offset = 0x00000000, 0x0003FFFF, 4 do
if Romset_ReadDWord(0, offset) == 0x01C0001E then
Romset_PatchDWord(0, offset, 0x00500824);
local opcode = offset - 1;
if Romset_ReadByte(0, opcode) == 0x80 then
Romset_PatchByte(0, opcode, 0x90) -- replace LDOB with LD
end
if Romset_ReadByte(0, opcode) == 0x82 then
Romset_PatchByte(0, opcode, 0x92) -- replace STOB with ST
end
end
end
end

function PostDraw()
if I960_ReadByte(RAMBASE + 0x00000820) == 0x00 then
I960_WriteByte(RAMBASE + 0x00000820, 0xFF);
end

-- 0xFF = normal
-- 0xFD = force beginner
-- 0xFB = force advanced
-- 0xF9 = force expert

-- 0xF7 = emergency/remote start

-- 0x7F = ex.start; as long as hold down, the track selection stays on (even after the 15 second countdown)

-- 0x3E = DIK_F4
-- 0x3F = DIK_F5
local data = 0xFF;
data = XOR(SHL(Input_IsKeyPressed(0x3E), 0x07), data); -- F4 for ex.start
data = XOR(SHL(Input_IsKeyPressed(0x3F), 0x03), data);  -- F5 for emergency/remote start
I960_WriteByte(RAMBASE + 0x00000820, data);

Video_DrawText(0,0,HEX8(I960_ReadByte(0x00500824)),0xFFFFFF);
end


This one will get VR lights working with TS2 with cheats. I added time cheat, 99,180,255 max laps (will not change the visible out of lap icon eg 8,80 or whatever. Will simply say 99/8 then tick over to 00/8 once you hit 100 or 200 etc). Just modify the script if you don't want to change lap numbers

daytona.lua

Code: [Select]

ROM = "daytona"
require("model2"); -- Import model2 machine globals


function Init()
Patch_SpecialInputs();
Patch_LampOutputs();
os.execute ("tsstub.exe "..ROM)
end

function Patch_SpecialInputs()
-- first, disable old read
Romset_PatchDWord(0, 0x1E504, 0x5CA01E00); -- MOV g4,0x00 (NOOP?)

-- now jump to our patched read
Romset_PatchDWord(0, 0x1E508, 0x090219F8); -- CALL 0x0003FF00

-- read io port
Romset_PatchDWord(0, 0x3FF00, 0x80A03000);
Romset_PatchDWord(0, 0x3FF04, 0x01C00012); -- LDOB g4,0x01C00012

-- read patched mask
Romset_PatchDWord(0, 0x3FF08, 0x80B83000);
Romset_PatchDWord(0, 0x3FF0C, 0x00500820); -- LDOB g7,0x00500820

-- and em
Romset_PatchDWord(0, 0x3FF10, 0x58A50097); -- AND g4,g4,g7

-- restore old mask
Romset_PatchDWord(0, 0x3FF14, 0x8CB800FF); -- LDA g7,0xff

-- return
Romset_PatchDWord(0, 0x3FF18, 0x0A000000);  -- RET
end

function Patch_LampOutputs()
-- reroute 0x01C0001E to 0x00500824
for offset = 0x00000000, 0x0003FFFF, 4 do
if Romset_ReadDWord(0, offset) == 0x01C0001E then
Romset_PatchDWord(0, offset, 0x00500824);
local opcode = offset - 1;
if Romset_ReadByte(0, opcode) == 0x80 then
Romset_PatchByte(0, opcode, 0x90) -- replace LDOB with LD
end
if Romset_ReadByte(0, opcode) == 0x82 then
Romset_PatchByte(0, opcode, 0x92) -- replace STOB with ST
end
end
end
end

function PostDraw()
if I960_ReadByte(RAMBASE + 0x00000820) == 0x00 then
I960_WriteByte(RAMBASE + 0x00000820, 0xFF);
end

-- 0xFF = normal
-- 0xFD = force beginner
-- 0xFB = force advanced
-- 0xF9 = force expert

-- 0xF7 = emergency/remote start

-- 0x7F = ex.start; as long as hold down, the track selection stays on (even after the 15 second countdown)

-- 0x3E = DIK_F4
-- 0x3F = DIK_F5
local data = 0xFF;
data = XOR(SHL(Input_IsKeyPressed(0x3E), 0x07), data); -- F4 for ex.start
data = XOR(SHL(Input_IsKeyPressed(0x3F), 0x03), data);  -- F5 for emergency/remote start
I960_WriteByte(RAMBASE + 0x00000820, data);


end

function Frame()
local gameState = I960_ReadByte(0x5010A4)

if   gameState==0x16 -- Ingame
  or gameState==0x03 -- Attract ini
  or gameState==0x04 -- Attract Higscore ini
  or gameState==0x05 -- Attract Highscore
  or gameState==0x06 -- Attract VR Ini
  or gameState==0x07 -- Attract VR
then
Model2_SetStretchBLow(1) -- Stretch the bg tilemap (sky & clouds) when widescreen
Model2_SetWideScreen(1)
else -- No widescreen on the rest of the screens
Model2_SetStretchBLow(0)
Model2_SetWideScreen(0)
end

end

--Some sample code follows to show how to draw strings and setup options/cheats
--
--function PostDraw()
-- Video_DrawText(20,10,HEX32(I960_GetRamPtr(RAMBASE)),0xFFFFFF);
-- Video_DrawText(20,10,HEX32(I960_ReadWord(RAMBASE+0x10D0)),0xFFFFFF);
-- Video_DrawText(20,20,HEX32(RAMBASE),0xFFFFFF);
-- Video_DrawText(20,30,Options.cheat1.value,0xFFFFFF);
-- Video_DrawText(20,40,Input_IsKeyPressed(0x1E),0xFFFFFF);
--end
--
--function cheat1func(value)
--
--end
--
--function cheat1change(value)
--
--end
--
--
--function cheat2func(value)
--
--end
--
--function cheat2change(value)
--
--end
--
--

function lapcheatfunc2(value)
I960_WriteWord(RAMBASE+0x10EC,99);
end
function lapcheatfunc1(value)
I960_WriteWord(RAMBASE+0x10EC,180);
end
function lapcheatfunc(value)
I960_WriteWord(RAMBASE+0x10EC,255);
end
function timecheatfunc(value)
I960_WriteWord(RAMBASE+0x10D0,50*64); --50 seconds always
end


Options =
{
-- cheat4={name="Cheat 4",values={"Off","On"},runfunc=cheat4func,changefunc=cheat4change},
lapcheat4={name="99 Laps",values={"Off","On"},runfunc=lapcheatfunc2},
-- cheat3={name="Cheat 3",values={"Off","On"},runfunc=cheat3func,changefunc=cheat3change},
lapcheat1={name="180 Laps",values={"Off","On"},runfunc=lapcheatfunc1},
-- cheat2={name="Cheat 2",values={"Off","On"},runfunc=cheat2func,changefunc=cheat2change},
lapcheat={name="255 Laps",values={"Off","On"},runfunc=lapcheatfunc},
-- cheat1={name="Cheat 1",values={"Off","On"},runfunc=cheat1func,changefunc=cheat1change},
timecheat={name="Infinite Time",values={"Off","On"},runfunc=timecheatfunc}

}


This is the ini file to go into memcfg folder of TS2

daytona.ini

Code: [Select]

[Info]
Name=Daytona USA
WinCaption=Daytona USA
WinClass=MYWIN
ExeName=
ExePath=
LaunchGame=0
Enable=1
ExitMode=1
[Inputs]

[Outputs]
Enable=1
EmuName=Model2
NumberOutputs=9

Output1PTR=&H1AA888|&H100|&H824
Output1Type=byte
Output1BitMask=&h1
Output1Name=Coin Chute 1

Output2PTR=&H1AA888|&H100|&H824
Output2Type=byte
Output2BitMask=&h2
Output2Name=Coin Chute 2

Output3PTR=&H1AA888|&H100|&H824
Output3Type=byte
Output3BitMask=&h4
Output3Name=Start_Lamp

Output4PTR=&H1AA888|&H100|&H824
Output4Type=byte
Output4BitMask=&h8
Output4Name=View1_Lamp

Output5PTR=&H1AA888|&H100|&H824
Output5Type=byte
Output5BitMask=&h10
Output5Name=View2_Lamp

Output6PTR=&H1AA888|&H100|&H824
Output6Type=byte
Output6BitMask=&h20
Output6Name=View3_Lamp

Output7PTR=&H1AA888|&H100|&H824
Output7Type=byte
Output7BitMask=&h40
Output7Name=View4_Lamp

Output8PTR=&H1AA888|&H100|&H824
Output8Type=byte
Output8BitMask=&h80
Output8Name=Leader_Lamp

Output9PTR=&H1AA888|&H100|&H52D8
Output9Type=integer
Output9Name=RPM


oh and to get the network multiplayer going with AI positions is a little funky as It cannot be done before a race starts (goes back to test menu immediately if too soon) so I was hoping to add it as a cheat or similar to launch once im in a race but I need it to do a few things in a row as like a macro. I currently use cheat engine to do it

Step 1 - launch network multiplayer as per normal and start a race
Step 2 -  RAMBASE+4008 needs to be locked on all slave machines. Doesn't matter for Master it seems
Step 3 - RAMBASE+5484,RAMBASE+5784,RAMBASE+5A84,RAMBASE+5D84,RAMBASE+6084,RAMBASE+6384,RAMBASE+6684 needs to be locked too if you are playing 8 player to stop nodes from resetting (car 2-8 nodes)
Step 4 - RAMBASE+4000 needs to be changed to 99 (network will lose sync with each other)
Step 5 - RAMBASE+10A4 needs to be changed to 13 (restart entrance to race with 40 positions)
Step 6 - RAMBASE+4000 needs to be changed to 01 (network will re-sync)

Pretty sure master actually doesnt need the nodes stuff to be locked, and i think technically only slave 2 needs car 2 node locked, only slave 3 needs car 3 node locked etc but its properly easier just to lock all 7 across all machines if thats possible like it is in cheat engine. Anyway its a bit clunky over cheat engine so id love to make a quick cheat or something to do all this quickly but it works well once its done.

Ive only tested up to 3 players so far and it worked well, 3 started in position 38/40,39/40 and 40/40 and changed if we passed each other and dropped down as we passed AI cars (i got down to 16/40 after a few mins)

here is a horrible video of me doing it while holding my phone and trying to use cheat engine 1 handed between mouse/keyboard lol across both networked "machines" then driving a little on keyboard

[Howard_Casto]

I don't know if this helps you, but you should be able to automate the process if you can find a value that is set once the race starts.  It doesn't really matter what the value is set to, so long as you can read it.  Then you can add the multiplayer init to a if/then statement and you are good to go. 

[Boomslang]

Well if I don't lock RAMBASE+4008 then it changes the number slightly something like ****200 is when it's working normally otherwise it changes the last 3 digits to 180

However I can't then change it back to 200. It stays at 180 even if I try

Only way I found is if I locked it so it couldn't change

Does that make sense?

[Howard_Casto]

Yeah but there are certainly other variables you can find.  For example something pumps out the 3,2,1 countdown.  Cheat engine is your friend on this one. 

[Boomslang]

RAMBASE+1850 does the countdown
01 for 3
02 for 2
03 for 1
think it was 27 for go and then changes to 40 and remains on that

sits at 00 when starting race etc until the 3 count begins

[Howard_Casto]

Well that would probably work... you might have to include a delay. 

[Boomslang]

I don't really know how to do any scripting but would it be best to create a cheat and once turned on then when race begins it automatically runs the needed stuff

[Boomslang]

When you aren't so busy then we can look at it. I can't code so ill get no where on it

[Howard_Casto]

yeah it should be doable.  I've got to set m2emulator back up first..... long story.

[Boomslang]

I mucked around for an hour today and got some VR lights going for a few other model 2 games today. Ill add it to this thread since I posted daytona one here too. Hopefully will tide someone over until Howard re-does everything for TS2 with m2 emulator 1.1a

lua files go in your m2 directory in scripts folder
ini files go in your ts2 directory in memcfg folder

indy500.lua

Code: [Select]

ROM = "indy500"
require("model2"); -- Import model2 machine globals

function Init()
os.execute ("tsstub.exe "..ROM)
end

function Frame()
I960_WriteDWord(0x005ec6b0,0x00000000)
end


srallyc.lua

Code: [Select]

ROM = "srallyc"
require("model2"); -- Import model2 machine globals

function Init()
os.execute ("tsstub.exe "..ROM)
end
function Frame()
Model2_SetWideScreen(1)
Model2_SetStretchALow(1)
Model2_SetStretchBLow(1)
Model2_SetStretchAHigh(1)
Model2_SetStretchBHigh(1)
end
function timecheatfunc(value)
I960_WriteWord(RAM2BASE+0xB0B0,99*60); -- 99 seconds always
end
function firstplacefunc(value)
I960_WriteWord(RAM2BASE+0x20C8,0); -- competitors in front
end
Options =
{
timecheat={name="Infinite Time",values={"Off","On"},runfunc=timecheatfunc},
firstplace={name="1st Place",values={"Off","On"},runfunc=firstplacefunc}
}



stcc.lua

Code: [Select]

ROM = "stcc"
require("model2"); -- Import model2 machine globals

function Init()
os.execute ("tsstub.exe "..ROM)
end


srallyc.ini

Code: [Select]

[Info]
Name=Sega Rally Championship
WinCaption=Sega Rally Championship
WinClass=MYWIN
ExeName=
ExePath=
LaunchGame=0
Enable=1
ExitMode=1

[Outputs]
Enable=1
EmuName=Model2
NumberOutputs=2

Output1PTR=||&H174CF0
Output1Type=byte
Output1BitMask=4
Output1Name=Start_Lamp

Output2PTR=||&H174CF0
Output2Type=byte
Output2BitMask=32
Output2Name=View1_Lamp


indy500.ini

Code: [Select]

[Info]
Name=Indianapolis 500 (Rev A, Twin, Newer rev)
WinCaption=Indianapolis 500 (Rev A, Twin, Newer rev)
WinClass=MYWIN
ExeName=
ExePath=
LaunchGame=0
Enable=1
ExitMode=1
[Inputs]

[Outputs]
Enable=1
EmuName=Model2
NumberOutputs=4

Output1PTR=||&H174CF0
Output1Type=byte
Output1BitMask=4
Output1Name=Start_Lamp

Output2PTR=||&H174CF0
Output2Type=byte
Output2BitMask=16
Output2Name=View1_Lamp

Output3PTR=||&H174CF0
Output3Type=byte
Output3BitMask=32
Output3Name=View2_Lamp

Output4PTR=||&H174CF0
Output4Type=byte
Output4BitMask=128
Output4Name=Leader_Lamp


stcc.ini

Code: [Select]

[Info]
Name=Sega Touring Car Championship
WinCaption=Sega Touring Car Championship
WinClass=MYWIN
ExeName=
ExePath=
LaunchGame=0
Enable=1
ExitMode=1

[Outputs]
Enable=1
EmuName=Model2
NumberOutputs=4

Output1PTR=||&H174CF0
Output1Type=byte
Output1BitMask=4
Output1Name=Start_Lamp

Output2PTR=||&H174CF0
Output2Type=byte
Output2BitMask=16
Output2Name=View1_Lamp

Output3PTR=||&H174CF0
Output3Type=byte
Output3BitMask=32
Output3Name=View2_Lamp

Output4PTR=||&H174CF0
Output4Type=byte
Output4BitMask=128
Output4Name=Leader_Lamp



[Howard_Casto]

Great work man.  I guess I'm going to have to start working on that pretty soon huh. 

to anyone wondering why I jump around so much...Sometimes when I can't sleep I'll muck around in cheat engine with a random game.  When I find something I need to implement it fairly quickly or my now swiss-cheese memory will forget about how I need to use the variables I found.  I've tried notes, but they are only partially effective. 

Anyway, I think what I've found in 2k6 is implemented enough to use, so a release will come soon. 

[BigPanik]

Back to the Daytona rom.

I try to get Special Edition output commands (Lamps, FFB and seat cylinders).
SailorSat has modify the Saturn add edition rom. How to patch the Special Edition? How to find the LDOB/STOB opcodes  to be modify?

Thanks

[SailorSat]

Why not use the Saturn Ads version and set cabinet type to special?

[baritonomarchetto]

Great work man.  I guess I'm going to have to start working on that pretty soon huh. 

to anyone wondering why I jump around so much...Sometimes when I can't sleep I'll muck around in cheat engine with a random game.  When I find something I need to implement it fairly quickly or my now swiss-cheese memory will forget about how I need to use the variables I found.  I've tried notes, but they are only partially effective. 

Anyway, I think what I've found in 2k6 is implemented enough to use, so a release will come soon.

Am I welcome to suggest you the next game to toy with Howard? Atari Badlands. Why? It would be GREAT to be able to increase the number of laps
Looking at the bezel of my unit the original plan was to have 4 laps races, but the game ended to be released with only 3 laps...
(Sorry for the OT)

[Howard_Casto]

You could probably do that with mame's built in cheat engine.  Altering something like the number of laps is pretty trivial. 

[hammerheader]

I wonder what the heck ElSemi's been up to in these past six years. He seriously needs to open source this emulator, since that'd make patches like this much easier to make.