Wow, i just read through most of that thread. Saw my name mentioned a few times. If you don't know who I am, I'm the one that added ms pac to mame all those years ago, I've also done a number of fairly significant hacks, like 2 player simultaneous play. I'll post my thoughts here rather than bump an old thread. I'd like to disagree slightly with John about the difficulty of forcing the fruits. The r register is incremented with the code that runs. So given the same input you will get the same r register result. That should be obvious, if not then the mame input files would not work. The input is only accepted once per frame. Therefore the speed of the z80 is irrelevent. In order for your pattern to generate the same fruit you have a tolerance of an entire frame. 1/60 of a second, not milliionths of a second. That being said I do not believe it is possible to run even a single pattern with every input being within 1/60 of a second much less an entire game. And furthermore I don't think anyone runs patterns in ms pac anyway. So I will agree with John it is not possible. I'll also agree that ms pac was written by drunken college students. :P Also I don't believe the r register is ever cleared and I doubt it boots to zero. IIrc most of the registers boot in an undetermined state.
As for forcing mspac to go to 141 I've always beleived that is possible. But I've never gotten around to serious experimenting. Whether you get a reset or upside mazes depends on the values in ram, and those of course can be controled. There is a possiblity of it depending on the value read from the bus with no devices enabled. That would depend on the board. I think most boards will read FF in this case but it's possible some may not. I've just recently added some code to mame to reflect this, I blieve it's inlcuded in mame .92. If anyone's curious about it look at the code at $95c3 where level($4e13)=134.
Note line $95da has the result of ORing almost any address with $40. If it hits the flip register you get upside down mazes. If it hits the number of lives, your lives could go from 1 to $41(65 decimal). If it hits your score then a 40, 4,000 or 400,000 point bonus may be possible. If it hits the number of players you've suddenly got a 2 player game going. If it hits the level number you've suddenly warped to level 198. It will keep writing addresses until it reads a 0. If it goes to long then the watchdog will reset the machine.
;draw slides and slows from 24f9
;kill screen @134 reads data at fe78 & writes
95c3 3a134e ld a,(#4e13) ; load level number
95c6 fe03 cp #03 ;There are only tables for 3 levels after that there are no tunnel slow downs
95c8 f23425 jp p,#2534 ;exit, end of this sub draws gate pink ;jp nc, d2
95cb 21df95 ld hl,#95df ;the list of tables of addresses
95ce cdbd94 call #94bd ;level based lookup input:hl=start of table, output:bc= pointer to data
95d1 210044 ld hl,#4400 ;start of screen color
95d4 0a ld a,(bc) ;list of screen addresses for each maze
95d5 03 inc bc ;point to next address
95d6 a7 and a ;check for 0, 0 signals end of list
95d7 ca3425 jp z,#2534 ;draws gate pink, finishes pac code
95da d7 rst #10 ;hl=hl+a
95db cbf6 set 6,(hl) ;the byte at the location has bit 6 set.
95dd 18f5 jr #95d4
table | not table!
95df 8b3d 8e28 fe78 cc0a ????? ;table pointers to where tables of where the tunnels are
; there's only 2 tables since it only matters on 0-3 level
Virtually anything can happen. The limitation is it can't make a variable go down, it can only make it go up. This isn't random it's a result of what's in ram, so there's no reason it can't be forced to a certain extent.
PS, warping up levels won't help, every level after 141 crashes, and in the upper levels there's actually several different crashes so even if cosmic radiation flipped a bit in ram and you got past the first crash one of several other crashes would kill you.
PSS, it's very interesting someone would mention a 400,000 point bonus, I don't remember mentioning this code bug, although I may have, I've known about it for a long time.