Hacking Magic Castle for Free Play

Here are some of my notes from adding a "Free Play" option to Magic Castle.

If you read my notes on Farfalla, this is a continuation of that effort.

ROM Layout (1 x 2532 and 1 x 2764)

Again, the first step is figuring out where everyhing is. Fortunately, this configuration is simple, having already figured out the 2543 ROM1 and 2764 ROM2 layouts previously.

Building Memory Image for Disassembly

dd bs=2048 count=1 if=MCASTLE.IC1 of=Rom1Bank1 skip=0
dd bs=2048 count=1 if=MCASTLE.IC1 of=Rom1Bank2 skip=1

dd bs=2048 count=1 if=MCASTLE.IC2 of=Rom2Bank1 skip=0
dd bs=2048 count=1 if=MCASTLE.IC2 of=Rom2Bank2 skip=1
dd bs=2048 count=1 if=MCASTLE.IC2 of=Rom2Bank3 skip=2
dd bs=2048 count=1 if=MCASTLE.IC2 of=Rom2Bank4 skip=3

dd bs=2048 count=1 if=/dev/zero of=RAM skip=0

cat Rom1Bank1 Rom2Bank1 Rom2Bank3 RAM Rom1Bank2 Rom2Bank2 Rom2Bank4 RAM  > MagicCastle.bin

By converting to 2 x 2764, Rom1 Bank3 and Rom1 Bank4 are completely empty. No other changes are needed.

ROM1 Bank1 - Stays the same (ROM1 Bank1)
ROM2 Bank1 - Stays the same (ROM2 Bank1)
ROM2 Bank3 - Stays the same (ROM2 Bank3)
ROM1 Bank2 - Stays the same (ROM1 Bank2)
ROM2 Bank2 - Stays the same (ROM2 Bank2)
ROM2 Bank4 - Stays the same (ROM2 Bank4)

ROM1 has free space.
ROM2 is full.
Put hacking code @ 6000, 6040 (ROM1 Bank4)

Examining the disassembled source code, the Coin Meter, Credit Check, and Credit Decrement code are all virtually identical to Farfalla and the others.

Patches:

Disables "Coin Meter" check
Patch [07 FF] to [07 00] @0x23C3 (0x0BC3 in ROM1 image)

Disable credit = 0? check
Patch [0C 1F 22] to [1F 60 00] @0x279E (0x0F9E in ROM1 image)
Return address: 0x27A1

Prevent credit decrement less than 0
Patch to [0C 1F 22 A4 01] to [1F 60 18 C0 C0] @0x27DB (0x0FDB in ROM1 image)
Return address: 0x27E0

PinMAME tested - OK 22 February 2011
Game tested - Not Tested Yet

Copyright © 2011. All rights reserved.

This document may be freely distributed so long as the content is not modified.