Using MetaCheat

The Meta-cheat feature is modeled after the cheat features found in many other emulators, so for emulator fans it should look pretty familiar.  The purpose is to allow the user to search the computer ram for values that change over time and then add cheats which set the memory locations to fixed values.  It is also possible to use MetaCheat to watch a range of memory addresses for debugging purposes.  One word of note is that the MetaCheat doesn't currently have any context around page switched ram, so searches might act funky if a game uses AUX ram and swaps frequently (case in point: Marble Madness).  This is because the cheat search uses the same mechanisms for reading ram as the emulated CPU.  Therefore search is affected equally by soft switches.  When in doubt, pause the game when performing searches to avoid unexpected behavior.

Activating MetaCheat

To enable MetaCheat, open the configuration by pressing F4.  Select "Computer (Apple //e)" on the left and then select MetaCheats for the active cheat module.  Apply or Save and close the configuration screen.


Using MetaCheat

To show the cheat window, press the END key.  If you close the window at any time, cheats will still be active and you can restore the window by pressing END again.
A typical scenario is searching for a memory value and holding that value to be the same thing all the time.  First you have to search for the memory location from the search tab.  Search for the current value in question.   TIP: If the value can go higher than 255, it is probably a word value.  Some games store their values in BCD, so the decimal value 10 would actually be stored as $10 in hex.  This is rare but not totally uncommon.  If search returns more than 256 items it will remember the results but will not show them.

Now play around until the value changes (e.g. your health goes down, or you lose a life, etc).  Now search for the new value.  What search will do is only search against the current results and discard any of them that no longer match.  Once you get to a small number of results you can see the live value in the current value column.  If you click on the row and click "Add selected", then a cheat will be created to hold that address to the value shown in the value box (you can change the value before clicking "Add Selected" if you want a different value.)  If the value starts with $ or 0x then it is assumed to be a hexadecimal string.  Otherwise it will be treated as an integer.

At any time if you want to start the search over, click Reset.

Using the "change" search is a little different.  The first time you search for changes, it will find EVERYTHING in memory.  Then you search for how much the change should be, e.g. when you lose a life it will change by -1 so search for that.  This is useful for games like Moon Patrol which store a different value in memory than they show on the screen.

Once you find a few interesting game variables, clear out the search results and then add a range of memory addresses before and after the address you found.  Click the "Add" button to add them as watches.  You can now spy on the game while you're playing it!  This is an especially useful way to discover addresses for things which you don't know the values such as game coordinates or health meters.

Some games have values you only want to change briefly.  Once you know the value in question you can use the CPU trace function (from the 65c02 device in configuration) to disassemble the program while it runs.  Keep in mind this will be VERY slow (for now -- but better debugging is on the way hopefully).  But once you have the trace in hand you can search for the address to find where the code changes that value.  Once you have that information you can alter the program code instead of the variable.  

This is how I found the Moon Patrol super jump cheat: I used the MetaCheat watch function to monitor the zero-page and noticed one address change when I was jumping.  I added a cheat (address $14) to force it to be 4 all the time.  What happened was the jump started but the buggy kept going up!  This is the behavior of y acceleration so I knew I had something.  I ran the CPU trace right before jumping and then stopped the trace as soon as the tires left the ground.  I searched through the trace for STA $14, STY $14 or STX $14 and found a STA $14 instruction at $D4B.  I found the LDA #$04 instruction at $D49 in the trace just before that.    I patch the LDA #$04 instruction to load the accumulator with a larger value like 5 or 6 before it issues STA $14 right afterwards and now instead of holding the variable fixed (and just sending the buggy into a buggy orbit), I shoot it just a little further off the ground.

From the "Cheats" tab you can look at the list of current cheats that are active and can also disable or remove them if needed.  Games like Marble Madness and Moon Patrol give you bonus points for time and you need to disable clock cheats otherwise the game will just keep giving you points in an infinite loop!  (Maybe not a bad thing?)   You can also add a specific cheat from the Cheats tab if you already know the memory address and value you want to use.

Cheats are not saved and go away when you close the emulator.  This is expected behavior; you are cheating after all.

Some cheats I've discovered

 Game Cheat  Address (Hex)  Notes 
Ultima I (1986 version) HP 7EC6 Word value (other stats are in the same area, as well as inventory!)
Ultima I (1986 version) Food 7EE5 Word value
Ultima I (1986 version)Format bug fixA8C8, A8C9, A8CASet all three to EA (NOP) to fix the bug that prevents it from formatting a player disk (Found by Hot Rod!)
Moon Patrol Super Jump D4A The normal value is 4. 5 or 6 yield bigger but still manageable jumps.  Higher numbers yield hilarious but unplayable results.
Moon Patrol  Lives  214. 218 218 updates immediately, 214 updates when the level restarts
Moon Patrol Time 44 Make sure to disable at the end of the stage or it will keep tallying score forever!
Marble Madness Time 6077, 8C13 Disable at the end of a level!
Zork I Score 4CE1 There was another entry at 4DE1, but either way you should be ashamed for using this cheat.  ;-)
AlcazarInventoryB54C - B54F0 = nothing, 1-7 = gun with bullets, Other numbers give you things like poison, keys, etc.
Robot BattleX Coordinate654FSet to 250 ($fa) to be get a lot of target practice (this is a pretty decent Robotron clone, IMHO)
Star BlazerFuelB8 (word value)Word value in BCD, set to $9999 for infinite fuel.
Star Blazer LivesBCNumber of lives
Star BlazerBombs BANumber of bombs stored in BCD.  Set to $99 for infinite.
Beautiful BootMess up animation0, 2Lock them both to $80 and the it will kill the animation for the most part.

Comments