Subject: Twilight Zone 9.4BH and ROM hacking
From: [email-masked] (Ted Estes)
Date: Fri, 16 Apr 1999 00:56:07 GMT
Newsgroups: rec.games.pinball

I have been hesitant to jump into the fray here, as I'm really not in the mood
for an argument (or even a "friendly" debate).

Let me start out by stating that I have, in the past, hacked ROMs for pinball
games.  I can probably claim to be one of the first persons to have created
a simulator for an arcade hardware system.  I was running ROMs from early
Bally and Williams games on a 25MHz 80386 in 1990.  (Poor thing could barely
simulate that lowly 1MHz 6800 in real time, too.)  On the other hand, I didn't
distribute my hacked ROMs.  I did the work purely for my own education and
and amusement.  (I don't mean to imply that what I did was any less illegal,
though.)

Anyway, there are so many points to touch on here, I'm not quite sure where
to start.  I will try to type slowly and use small words so that the one or
two people who haven't "gotten it" yet may possibly understand.

First, some issues on the legality:

- Copying and distributing ROM images of copyrighted software is a violation
  of copyright law.
   
  This is pretty simple.  I don't have much else to say about this.  One is
  allowed to make a backup copy of software for archival purposes in case of
  the destruction of the original.  One cannot distribute this backup copy
  without also distributing the original.

- The license agreement that is included with software downloaded from the
  Williams Electronics, Inc., website states, in part, "You may not decompile,
  reverse engineer, disassemble or otherwise reduce the Software to a human-
  perceivable form.  You may not modify, network, rent, lease, loan, or create
  derivative works based upon the Software in whole or in part."

  Pretty hard to argue with that.  The only place to have received a copy of
  Twilight Zone revision 9.4H is from the WMS website, and one must agree to
  the license restriction to do so.  Getting a copy from somewhere else just
  means that the person distributing it violated the agreement, which does
  not nullify any portion of the license agreement as it applies to the person
  receiving the ROM image.

- The back cover of the Twilight Zone manual reads, in part, "Because this
  game is protected by Federal copyright, trademark, and patent laws,
  unauthorized game conversion may be illegal under Federal law."

  Hard to argue that the hacked ROM isn't an unauthorized game conversion.

Now, the question of why Williams would be concerned about a hacked ROM has
received much discussion.  Let me touch on a few of the major issues here:

- The game still says "Williams" on it, whether it has a hacked ROM inside
  or not.
  
  The player has no idea that the software running in that Williams game has
  a modified ROM.  What if it's buggy and the game keeps crashing?  What if
  someone has put something offensive in it?  What if the game just acts
  screwy in some way?
  
  Williams puts a lot of effort into developing fun games that will (one would
  hope) earn money for the operator and bring entertainment to the player.
  Part of that effort is in trying to maintain a consistent level of quality
  and a consistent "feel" for both the operator and player.  Williams must
  retain control of its software for its games in order to accomplish this.
  
  If you don't think this is much of an issue, you are wrong.  Witness the
  reactions on rec.games.pinball by some people to new games.  "I tried <X>
  and it's a tilt-monster!"  Now, the more knowledgeable players know that
  the tilt setting is an adjustable feature -- it is not game specific.
  But what about software acting "whacky"?  Have you, gentle reader, ever been
  confused by a game and wondered if there were rule changes due to a
  different software revision, or even just different operator settings?
  
  Another issue is with licensed titles.  Williams has entered into an
  agreement with the license holder that specifies, in part, how that property
  may be presented in the game.  Hacking a game ROM that tampers with the
  presentation of the licensed property in any way is an unauthorized use
  of that license.

- The unwitting operator who installs a hacked ROM may not be aware that the
  ROM is not an official Williams release.
  
  This is not as unlikely as one may think.  It's one thing to say that a ROM
  hacker will distribute a ROM image with the warning "Use at your own risk."
  It's quite another in practice.  The person updating his/her game may just
  see a new version and say "Oh, this is version 9.6.  I have 9.2. I should
  upgrade."  I've heard tales of helpful patrons burning ROM updates and
  giving them to an operator who might otherwise not have updated a game on
  location.  What if that new ROM image has bugs unwittingly introduced by
  the hacker, or -- worse -- malicious code intentionally placed there?

  This also becomes a support issue.  Technical support people at distributors
  and at Williams try to do their best at helping debug games over the phone.
  One of the first questions is:  "What revision of software are you running?"
  If the ROM hacker has not been thoughtful enough, or perhaps not
  knowledgeable enough, to change the revision number, the operator may be
  running a ROM that reports "9.2" but isn't really "9.2".  Something in
  the program may be mimicking a hardware problem thus greatly complicating
  the debug process.

Regarding Home version ROMs:

- My employer, Williams Electronics Games, Inc., is good enough to tolerate
  its software developers working on "Home" versions of games.

  This work is not encouraged.  It is not officially sanctioned.  They are
  nice enough to let us do it.  They could just as easily forbid it.  In order
  for me to do a Home version of software, I have to use proprietary
  information that belongs to Williams.  I use inhouse tools that belong to
  Williams.  It would be perfectly reasonable for them to prohibit the use of
  this information and tools by me for any use other than development of new
  games and maintenance of old ones.  As soon as Home ROMs become too much
  of a bother, then I fully expect my employer to institute a policy that
  disallows them.

  In the past, home ROMs have been distributed through the "friend of a
  friend" network.  Not a lot of thought was placed on controlling them, nor
  considering the ramifications of having them placed on location.  Home ROMs
  in general are not tested as carefully as production ROMs.  Nor are they as
  carefully labeled.  (For example, more than one version of Twilight Zone
  "H-8" has been distributed.  Hey, it wasn't an official release, why change
  the revision number?)

  In order to stem possible problems with Home ROMs, the policy of making them
  "Free Play Only" was instituted.  This was to prevent the use of these ROMs
  on location, to avoid the problems I've outlined above.  (Possibly buggy
  software; game acting "whacky" or different; etc.)
  
  I offer another real-world example:  I made a special version of Twilight
  Zone for a friend of mine.  His father had had a stroke, and could only use
  one arm.  I made a version that controlled all the flippers at once from
  either flipper button.  One selected the option by holding a flipper button
  while starting a game.  It doesn't take too much imagination to visualize
  the head scratching involved in trying to debug a game on location that had
  this ROM installed in it.  "Darn game flips all the flippers at once.  But
  only sometimes!"

  The "Free Play Only" policy is a perfectly reasonable control on objections
  to un-official software revisions.  Those individuals with games at home who
  desire pay-for-play are welcome to use an official software version.

Regarding the Twilight Zone Home ROM (9.4H) in particular:

- I was motivated enough to spend a significant amount of time making a new,
  semi-major software release for the game.

  I won't delve into all the details, but if you'd like to read the story of
  how this all came about, I invite you to visit http://gameroommagazine.com
  and order the February 1999 issue.  The cover story is by me and cronicles
  the one-year time span of the project.  I fixed a bunch of bugs and added a
  handful of new features.  Through the help of some dedicated beta testers
  I went through 4 or 5 revisions of software to finally produce 9.4H.

  When I released 9.4H, I intended to followup with a release of a pay-for-
  play version of 9.4.  It would have had a few of the home-only features
  permanently disabled.  I decided to let 9.4H percolate a bit before
  releasing 9.4, as I didn't want to have other bug reports come in, and have
  to further inconvenience those operators conscientious enough to upgrade
  their games by a subsequent release of 9.5.  As it turns out, 9.4H has a few
  minor bugs that were discovered by the people who upgraded.  I have been
  (slowly) fixing those bugs in anticipation of a 9.5 release.

Regarding the hacked Twilight Zone ROM (9.4BH):

- The changes made in the hacked ROM amounted to a few dozen bytes.  Here is a
  summary of the changes:

  The most significant change is that the "Free Play Only" restriction was
  defeated.  This allows the operation of the ROM on location.  An operator
  who does so without also turning off the "Mute & Pause" feature is going to
  be in for a surprise.

  The hacker was thoughtful enough to change the revision number from 9.4H to
  9.4BH.  This is handy for being able to tell that this not an official ROM.

  The hacked ROM changes the "Door Spots" adjustment.  The old settings values
  were:
  	0 - Spot EB panel when EB earned
	1 - Spot 10 million panel when skill shot earned (default setting)
	2 - Spot Battle the Power panel when Battle the Power earned
	3 - Spot Light Gumball panel when GUM-BALL earned
	4 - (undocumented) light door knob on first door award

  The new settings are:
	0 - no panels spotted
  	1 - Spot EB panel when EB earned
	2 - Spot 10 million panel when skill shot earned (default setting)
	3 - Spot Battle the Power panel when Battle the Power earned
	4 - Spot Light Gumball panel when GUM-BALL earned
	5 - (undocumented) light door knob on first door award

  The final change was to modify the "1st EX.BALL RAMP" range setting from
  4-12 to 4-32.  Interestingly, the range for "2nd EX.BALL RAMPS" is 30-70.
  Beats me what happens if you set the 2nd one to happen before the first.
  I also don't know how that might interact with the auto-EB percentaging
  code.

Regarding a few other odds and ends that have been brought up over the last
few days:

- Writing a Home version ROM is in no way comparable to hacking a few bytes
  in the ROM.

  While the person who hacked 9.4H went to a lot of effort to find the places
  to change to make the above modifications, the end result is trivial
  compared to the changes I implemented in going from 9.2 to 9.4H.  While
  anything is possible, I sincerely doubt that anyone would go through the
  trouble of trying to implement anything as significant as I did by hacking
  on the ROM.

  Also note that I introduced lots of bugs along the way.  I was working with
  source code and a debugger.  I wasn't reverse engineering and changing bytes
  in the ROM.  I was working on source code of which I wrote a significant
  portion.  Let me repeat my point to drive it home for the one or two of you
  who missed it:  I introduced bugs.

  Anyone who suggests that a ROM hacker can replace a motivated developer
  using the tools I had at my disposal has no clue about the work involved.

- "WPC is old news, why not release the source code?"  Just because software is
  old, doesn't mean it is no longer valuable.

  I can hardly fathom the call for releasing the source code to old games
  for general consumption.  The source code embodies 20 years of knowledge
  about embedded systems, coin operated games, and pinball machines.  Ever
  hear of trade secrets?  Do you even comprehend the meaning of "intellectual
  property"?  A change of hardware, microprocessor, or programming language
  doesn't invalidate an algorithm.

  Putting that aside, Williams certainly doesn't need dozens of homebrew
  software packages running on their hardware in the field.  What a PR and
  support nightmare!

  I fail to see the business sense in this action, no matter how I try to
  evaluate it.  For example, what if someone reprogrammed an old game in a
  way to give it new "legs" on location?  How would that help Willliams?
  It would only possibly delay that operator's decision to buy new product.

And, finally, my personal feelings on the subject:

  I put a lot of conscientious effort in making the Twilight Zone Home ROM.  I
  fielded suggestions from rec.games.pinball, and implemented quite a few of
  them.  I took great pains to test and debug the release.  I released the
  "Free Play Only" software first to avoid problems with someone operating a
  game with bugs I may have missed during testing.

  Someone took that result of my efforts and disabled the "Free Play Only"
  safeguard, implemented another couple of small changes (that I might have
  put in myself, had I been asked nicely), and then distributed the result on
  the Internet.

  What started out as a fun project no longer is.  I am saddened.

Ted Estes
Williams Electronics Games, Inc.

(This is my only public statement on this matter.  I have tried to include in
this statement what I believe to be the policy of Williams Electronics Games,
Inc. at the moment of this writing.  I am not a lawyer.  If you have some
questions about the legality of copying, reverse-engineering, and/or modifying
software please consult your lawyer.  If you have questions about the Software
License Agreement from Williams, I can put you in touch with the WMS Legal
Department.  If you followup to this post, please do not quote me out of
context.  If you would like to contact me, please mail to [email-masked])
-- 
"If hard data were the filtering criterion you could fit the
 entire contents of the Internet on a floppy disk." -- Cecil Adams