Fever SOS top-5 lowered ROM hack patch files

[froztbite]

Bought the Fever SOS pcb this spring and while the game is fun and addicting to play I'm not good enough yet to get on to the highscore table. By my estimate you would have to play really good to at least to 3rd boss to even get to the last place . I stumbled onto Zakk's hack for the Dangun Feveron that lowers the 5th score on the highscore table so you can get there easier. But the patch files were not compatible with the Fever SOS version which I liked more. Also was thinking that why stop at just the 5th place and why not just lower them all so I can track multiple runs on how they stack up against each other even if I wouldn't always beat my previous best. So I started to read up on ROM hacking and started my journey to learn and to experiment.


First was to understand how the patch file were used and created. This was pretty straight forwarded that there are .ips files that are the patches which contain the information where (address) on the ROM changes need to be made and what the changes will be. With a tool like 'Lunar IPS' you can apply the patch onto a ROM/BIN file. Or if you have made changes to a ROM file manually you can create an .ips file by comparing a clean version and the modified version so that the .ips file can always replicate the change.


Second one was how would you actually create changes to a ROM/BIN file. For this you would need a hex editor. I opted for 'Cygnus Hex Editor' that you can get from Windows Store which seemed like a good tool for a beginner. With this I could compare the clean ROM files and what Zakk's patched ROM differed and started to understand a bit better what might need changing. While the data for the highscore table was same for the two versions they were at different address on the ROMs so that is why the Dangun Feveron patch file didn't work for Fever SOS. The scores were right next to each other so to expand the change for all top-5 wasn't a huge task.


Finally the Zakk's hack also contained a change to make ROM check always pass. The Dangun Feveron / Fever SOS doesn't have visible ROM/RAM check on bootup like a lot of older games and I don't yet have deep enough understanding on how the game code actually runs and does checks on the bootup so I didn't have clue what the actual effect was and was it needed for the Fever SOS.


With just the highscores changed the modified roms were not booting up in MAME but when I implement similar changes for the ROM check to always pass I got it booting on MAME. The ROM check pass had similar case that the data was the same but it was just in different address. However while the ROM were working on MAME when I burned the ROM for my Fever SOS pcb (No 'Cave' logo near JAMMA edge) they didn't work. The game tried to bootup but always reset before getting to the warning screen.


After this I stumbled onto ROM hack for the Fever SOS that was described as that a protection was removed so that the Fever SOS ROM could be run on the Dangun Feveron PCB. Didn't find a lot of documentation about who had made it or any more description what it does. Decided use the Hex Editor to compare how it differed from a clean ROM and then implement the same changes on top of my high score changes.

I made version of
- unprotected + highscore change
- unprotected + ROM check always pass + highscore change.

While both booted up in MAME I decided to go first with lowest number of changes while testing with actual PCB. The unprotected version + highscore change worked so I decided not to test the one with the ROM check always pass changes on the PCB.


So as a final result I uploaded the patch files which you can use to modify either clean on unprotected Fever SOS ROM U33 and U34 so that the highscore table is easier to get to and that it works both in Mame and an actual PCB. If someone wants to test this on the JP version of the PCB and / or Mister that would be appreciate. I can add the results to the documentation if this can be used with them .
https://github.com/VeeKiraRay/fever-sos___dangun-feveron___rom-hack-patches

Here is screenshot of the affected highscore table. On the left is unmodified and on the right with this change

 

[waiwainl]

Nice effort! Good story of the learning curve

 

[froztbite]

Thanks . I Like doing a little write ups on the stuff I have done as it will also help myself to retain the things I learned.

I managed to spend some more hours partially trying some tips and trick on finding what to modify and some just trying to brute force stuff.
Made some discoveries and created new patch files. I created a new repository for all the patch files and updated the link on the first post.
I tried to also write the more technical details in the repository like memory addresses and such if someone wants to try them out.

One thing from the score change that I also wanted to try and change was the initials. For this I first tried to find them as ASCII strings but no such luck. After some searching stumbled on a good tutorial on YouTube

View: https://www.youtube.com/watch?v=4JFO_MEPHsE


The short of it is that the alphabet values do not always correspond to the ASCII values but the value difference between the letters should still be same. So 'B' will always be +1 what ever 'A' is. The video creator had also created a python script that can try and search all permutation of said string of letters and return their memory address. Problem with searching short string like 3 letter initials is that they can give a lot of results from a single rom. Decided to try out all 5 initials. Some returned close to 100 results but luckily one had only around 5 results on ROM 33 and other and had a similar number of hits on ROM 34 so could focus on trying to change those and after a few attempts found the initials data.

Just for fun tried to also find the disco men count which was more pattern searching. The default values are 1000, 0900, 0800, 0700 and 0600. The two first digits were found on ROM 34 and the last two digits are on ROM 33.

After these was wondering what else could I pattern search that would actually affect the gameplay. Decided to go into settings and there you can change the 'Hero counts' (lives) where the default setting is 3 and after that when clicking 'A' you change it to 5, 2, 1 and finally back to 3. Found one match when searching a pattern of '03 05 02 01' and these are the lives count you get for each setting. So by changing the '05' to 'FF' and when choosing the 5 lives options from the in-game settings you will actually get 255 lives when starting the game. If you leave the rest of the values alone they will function as normal so you can opt-in for almost endless amount of lives if your tired of feeding credits and want to just practice . Only downside I noticed that you seem to get points for each extra live after the game so prepare wait a while it to finish and go over the 9 999 999 max score a few times.

Finally tried to also change the initial bomb count, but there was no setting for this in-game and there was no other number that I could figure out yet so that I could search a bigger pattern from the code. So I tried to brute force by changing a bunch of '03' values from the ROMs and the verifying what had changed. There are a lot of '03' in the two ROM files and I didn't have the patience to go through all of them. Did stumble on a lot of GFX glitchings, broken stuff, game crashes etc. But I did find maybe one useful change that might interest some that you can change the player ship colors. The P1 ship color default value is 03 and it can be changed to anything between 00 and FF so a lot of different values to try out. I think at least some of them are color schemes from enemies or other GFX from the game for example 'A0' was pulsating red. I compiled a few example for the preview image.

Haven't yet tried these new changes on the actual hardware, but seemed to work in MAME.

 

[ekorz]

A lot of memory locations have been found in various games and are in mame cheats files. http://cheat.retrogames.com/
e.g. bombs are at 105A3B in RAM for player 1 (p2 is 105A7B)

  <cheat desc="P1 Infinite Bombs">
    <script state="run">
      <action>maincpu.pb@105A3B=03</action>
    </script>
  </cheat>

So you can set a watchpoint at 105A3B to find out how it's set in the code, and what code adds or decrements it, and change all that logic if you wanted.

 

[froztbite]

Thank you for the great tip.

Was able to get the debugger working and get it to stop when the memory was set to '3' for bombs but still have a lot to learn on how to use the tool effectively and understanding the output it gives. Will have to dive into some tutorials maybe next weekend or when I get a few hours to myself to focus.

For now I'm happy enough to just be able to change initial values but maybe some day I try my hand on some bigger logic changes.

 

[ekorz]

I don't have the unprotected rom but this is basically what I'd do:

watchpoint:

wpset 105A3B,2,wr

coin up start game.
look for a write of 0003

Stopped at watchpoint 1 writing 0003 to 105A3A (PC=00A610)
Stopped at watchpoint 1 writing 0602 to 105A3C (PC=00A610)

the instruction is moving bytes from one address to the other, one being in program code and the other being our watchpoint in RAM.
but the source address is A0: A4C6 in the program code

The program rom is interleaved, so half of it is in cv01-u34.bin and the other half in cv01-u33.bin.
Half of A4C6 is 5263 so one of the files should have a 03 at that spot.
I see a 03 at 0x5263 in cv01-u33.bin - so I'd bet if you change that you start with more bombs!

 

[froztbite]

Thank you again. The 03 at 5261 (dfeveron) and 5280 (feversos) indeed did increase how many bombs you can use but game still shows only 3 bomb icons and it removes one from the screen even when there are more that they indicate but when the icons ran out it didn't stop from using the remaining bombs.

Must be a different value somewhere. But it will be a good practice trying to find out how to set a watchpoint on finding a memory addresses that go down after a bomb usage.

I was too fixated on the PC value at the end of the watchpoint print and was confused that when searching with that value I didn't find any 03 on the ROMs and even when I tried to change the values there it didn't alter anything.

 

[ekorz]

the bomb sprite count might run off a different memory value yeah. Lmk if you have any trouble hunting it down! I’d have to get those unprotected roms set up but otherwise it should be findable. But it’s fun learning so go for it!