Fun with a hex editor and Windows Pinball


My wife really likes to play the Pinball game that comes with Windows (tm). She's incredibly good at it, too. I never really looked anywhere online to see what kind of high scores other people rack up, so maybe compared to the world champion Pinball on Windows (tm) players, she's not very good, but she's way better than I am. If you don't know what Pinball game I'm talking about, it's the one that looks like this:
Pinball Screenshot

I've heard her complain about the kicker gates in the lower left and lower right corners of the table that appear, respectively, after your ball falls into the lower left or right corner and the kicker shoots the ball back out. These gates make it such that if your ball heads toward the corner again, the ball will be funneled right down the chute into oblivion and you'll lose a ball. If you don't know which gates I'm talking about, it's the thing that's pointed out in this picture:
Pinball Screenshot showing gate

I was bored this weekend, and I figured I could use a few extra brownie points with the missus since she did all the laundry for the 2nd week in a row without any help from me, so I decided to assist her in cheating at Windows (tm) Pinball.

How I tracked this down

I started out by launching Microsoft's (tm) WinDbg. If you don't have it installed, check this out and you'll find everything you need to know. As debuggers go, this thing is pretty nice. Anyway, before I even started stepping through the code with the debugger, I had a look through the disassembled source code (WinDbg includes a nice disassembler) just to try to take some wild guesses as to where I should set breakpoints. In this case, I got really lucky; There were 4 routines that just screamed at me: RightKickerGateControl, RightKickerControl, LeftKickerGateControl and LeftKickerControl. Jackpot! To avoid being arrested or sued or beaten up by Bill Gates (tm), I'm certainly not going to post any of the disassembled code on here. For cryin' outs, it's easy enough for you to look at the disassembly yourself if you want to.

Once I found these routines in the disassembled source and studied what they do (which took a long time and lots of googling since I don't know x86 assembly all that well) I set breakpoints at these functions and stepped into them with a debugger. I discovered that there's a conditional in RightKickerControl and LeftKickerControl that determines whether to close the gate or not, and the easiest way to fix this would be to make the condition always false, since a true condition is what causes the gate to close. Since the comparison is against a value that I know will never be zero, it was easiest to just change the value it compares against to 0, which will guarantee a false.

How you can turn off the kicker gates

If you'd like to turn off the kicker gates, just make a copy of your PINBALL.EXE (name it something like PINBALL_HACKED.EXE), then open up your copy in a hex editor. You'll notice that the bytes at 0xb928 and 0xb94e are both 0x3c. Here's what the original looks like in XVI32 (I have the value at 0xb928 highlighted in this picture, but 0xb94e is also visible in this shot):
Hex output of PINBALL.EXE

Change these two values to 0x00 and save. It should look like this when you're done:
Hex output of PINBALLHACKED.EXE
That's all you need to do. If the values you see at these locations in the executable aren't 0x3c, don't replace them since you'd obviously be looking at a different version of the file than I have. If this is the case, you're unlucky and you're going to need to do some heavy lifting on your own using a disassembler to find out where RightKickerControl and LeftKickerControl are.