Keep your eye out for Mr Speaker and @twalve's frightfully good book, jQuery: Novice to Ninja - in stores NOW!

Hacking Windows Pinball

The Cheat
Okay, first up for those who perhaps are not so interested in spending many hours trawling through pages and pages of assembler code, I’ll skip straight to the good bits and give you a run down of the sneaky CHEAT_MODE I found hidden in the pinball game included with windows XP.

Load up the game and type the words hidden test. Looks pretty normal? Well, as your ball is flyin’ ’round, click on the pinball machine. Drag your mouse around. The ball follows your every command – blatantly ignoring the laws of gravity we have come to expect it to follow!

There’s more too. The “hidden test” mode has a bunch of functions put in there to help the developers out during the game’s creation. Here’s ones I found, or can see in the code:

h: Shows the high-score table, with an entry of 1,000,000,000 for you to put your name next to.
m: Shows the amount of system memory
r: Increases your “rank” in the game
y: Shows the game frame rate in the title
These ones I can see are trapped in the code, but I can’t see what they do:
b, F11, F12, F15 (how do you do that? Key code 0×7E)

There also seems to be some way to turn it off, but I can’t figure it out. And also I keep making the graphix do wacky things, as if I haven’t pushed the cartridge in to the Megadrive properly or something.

I had a quick google around for cheats for this game – I found all the other cheats in the game: 1max = free ball, gmax = the gravity thing etc… but no sites listed the “hidden test” cheat. So I’m assuming that no one bothered to pull the key-handling code to bits. I did, and here’s how you can do it too….

How’d you find that cheat?

Right. That’s it for games – now I’ll explain how I did it and show you how to do some basic reverse engineering and cracking ya self. It’s not really really difficult but it is really really tedious. And potentially spirit-crushing. So, it that’s your thing then read on, otherwise – get back to pinball!

windows debuggerHere’s the idea behind cracking and reverse engineering: A program is a set of zillions of instructions that the computer runs to do stuff for us. The computer executes these instructions one at a time. Using a debugger we can step through and look at each instruction to see what’s going on. Out of the zillions of single instructions, there will only be a few (well, a bunch) that we care about – like, say, the ones that say “If this registration number is incorrect, then exit the program”. We then just need to change it to say “If this registration number is NOT incorrect, then exit the program”. Pretty easy hey?

The catch is that machine level instructions are presented as assembly code – a very low level programming language which is bloody hard to understand. The more assembler you learn, the easier it is to figure out what’s going on. I’m told. You at least need to know the basics if you want to hack around – otherwise it’s like looking at random squiggles and dots.

Have a search for “asm tutorials” or “assembler tutorials” and you’ll find some good’ens. However, the best resource I found is an old DOS .exe called the Ketman x86 Tutor or something. It’s seriously great for learning, but was made for DOS so some bits (like file access) don’t work. It’s also the “demo” version – but for picking up the basics it’s awesome++. Another way to figure out assembler is to write some very basic programs in C, then run those in the debugger. Oh. The debugger…

Let’s get Hackin’tron

First up, you have to get WinDbg, the windows debugger from Microsoft. Then configure it to get the symbols from the Microsoft Symbols server. Or just search for “WinDbg Symbols” and you’ll find some good set up info.

Once you’ve got that going, open Pinball and open the debugger. From the debugger select “Attach to Process” and select the pinball.exe process. The debugger springs to life! Have a look at the pinball game now. You can’t mess with it. It’s just sitting there waiting to execute the next instruction.

Now, in the command window type x pinball!*. If you have your symbol path set up correctly, it will go and grab the symbols (whatever they are) from Microsoft. Then it will display a bunch of information about pinball.exe – including all the function names, and some variables!

Look through the list – there are heaps of interesting things. And you can set breakpoints on ANY of them. Unfortunately most programs in the wild don’t come with “symbol” information like this. It certainly makes life easier for us beginners though.

Break points

After checking out the list I ended up setting a break point on what looked to be a “key down” function, as I reasoned that this would be where it checked for cheats. I typed: bp PINBALL!pb_keydown – bp means breakpoint. When the program is running, and hits a breakpoint, it will stop executing instructions, and give control back to the debugger. Next hit F5 to continue running the program. The debugger says “the debuggee is running….” and Pinball starts playing again.

Now, back in the game press the any key. Pinball freezes again. That’s good – the debugger has stopped at our breakpoint.

You can then step through each of Pinball’s instructions with F10 (to jump over function calls) and F11 (to step in to the function calls). Each time you step over an instruction it executes it and goes to the next instruction. By continually pressing F10, or F11 you are now actually running the program very very very slowly… Look at each instruction as it passes – after a handful of instructions you will see the code: call PINBALL!pbctrl_bdoor_controller. “call” is the instruction to start a function or procedure and “pbctrl_bdoor_controller” is the function name. Hmm… “bdoor_controller”? Could that mean… back-door controller? (spoiler: yep, it does!)

Well, who cares about “key down” functions when we’ve got “back door” function! Remove the breakpoint we set (press F9 in the command window to get a dialog box of breakpoints) and the set a new breakpoint with bp PINBALL!pbctrl_bdoor_controller. Now when we run pinball it will break at the start of the back-door code!

Next, have a look at the back-door controller function in the disassembly (View->Disassembly). The function is a few pages long. This is pretty good – we no longer have to worry about the zillions of other instructions anymore, we just need to figure out what these ones do. It’s a good idea to step through the function a few times just to see if anything obvious looks useful. Once you get to the “ret” instruction (ret = return) the function is finished – so hit F5 again to run the program, and press another key in Pinball. You’ll be back at the start of the function again.

It can be hard to get an idea of what’s going on. So I copied-pasted the function into notepad and had a lil’ study. Buried in the middle I noticed this assignment: mov [PINBALL!cheat_mode (01024ff8)],eax. Oooh! A variable called “cheat mode”! That instruction says that the variable “cheat_mode” is stored in memory location 01024ff8. So open up the memory window (View->Memory) and type that number into the location bar. The first byte you see is 00. We all know that 0 means off and 1 means on, so edit the first byte to be 01. Now, disable your breakpoint and press F5. Pinball is running in cheat mode!!!! Woooo!!!

That was pretty easy eh? But that’s just half the work. We don’t want to have to edit memory or write a patch to get in to cheat mode if we don’t have to. Time to figure out how the bdoor_controller function really works…

The back door function

My guess was that the program would need to get the key code of the key you pressed, so I started looking in memory for where that might happen. I noticed this code about 9 instructions in to the bdoor_controller function: 0100e1c6 mov eax,[ebp+0x8]. I read somewhere that the “ebp” register is where arguments are stored for function calls, so I guessed that this would be reading an argument passed in to the bdoor_controller function.

I opened up the “memory” window in the debugger and typed in “eax” – this shows the memory that is pointed at by the eax register. As it passed the above code the value in that area of memory changes! I then ran the program, and pressed another key – it changed again. Yep – this is where the key you pressed is stored. The number you see in that memory location is the key code in hexadecimal.

some old pinballI then spent the good part of an afternoon stepping through the back door controller function figuring out how it worked. Basically, If the key you press is the start of a cheat word it assigns a number to a counter. If the next key you press is the next letter of cheat, the counter is incremented. This continues until you press the last letter of the cheat, with the correct number in the counter. Then the cheat executes.

There were two ways I found the cheats – one was to find the counter value that was required to execute the cheat instruction and then work backward by finding which letters incremented the counter to that value. The other way was to find code that initially sets the counter value and worked forwards from there, writing down the letters that incremented the counter each time.

Here’s an example of how I found the extra ball cheat, using the “working backwards” method:

Find the code that runs the cheat: 0100e477 call PINBALL!table_add_extra_ball (0100c2f3)

Follow the instuctions upwards looking to see what would need to happen for this code to get executed. A few instructions up there is this compare, followed by a conditional jump:

0100e463 mov eax,[edge_man+0x14 (01025050)] ; Get Counter
0100e468 cmp eax,0x3f
0100e46b jnz back_door+0x2ce (0100e47e) ; Jmp if counter not 63 (x3f)

As the instuction before 100e463 is a jump statement, then execution must get to here from somewhere else. So in my copy-pasted function I searched for “100e463″ to see where it gets called. There is only 1 occurance and it is here:
0100e453 jz back_door+0x2b3 (0100e463) ; Jmp if its "X" (x58)

Ta da! The last letter of the cheat is “X”! But for the cheat to fire, the key needs to be “X” and the counter needs to be 63 (0×3f). So now we need to find where the counter is compared to 62. I searched the function for 62 (0×3e) and found the place where the counter is compared: 0100e25a cmp eax,0x3e then followed the code backwards from there. As before, there is a jump statement a few instructions up, so this bit of code must get called from somewhere else. The instruction after the jump is 100e24c, so I searched for this and found:
0100e1fc jz back_door+0x9c (0100e24c) ; Jmp if its "A" (x41)

The second last letter is “A”! Now simply repeat this until you find the area where the counter is initialised and you’ve got the whole cheat! Tedious, but strangely rewarding.

There are some cheats I think that must have been removed before the game was released, or were put in there as red-herrings. I found the word “QUOTES” in the routine, as well as the word “CINEMATRONICS.” – both which appear to do nothing in the end.

You’re away!

That’s not too tricky hey. Picking up some assembler makes the process a lot easier, but as long as you think about how the program would have to work in a higher-level language you’ll figure it out.

As a bonus I’ve included an annotated text document of the routine in case you get stuck. Let me know if you find anything else in there!

153 Comments

  1. Mrs. Speaker wrote:

    Cheatin’? But that’s aginst the rules!

    Sunday, January 8, 2006 at 10:14 pm | Permalink
  2. Bill G wrote:

    Impressive, most impressive.

    Monday, January 9, 2006 at 9:23 am | Permalink
  3. Martin wrote:

    I believe the b+F11+F12 just traces where the ball has been, maybe just a function that the M$ team used when making the game.

    Monday, January 9, 2006 at 3:24 pm | Permalink
  4. Abx0r wrote:

    Bet the M$ team that made the game are laughing so hard because it took so long for someone to figure this out.

    Monday, January 9, 2006 at 7:03 pm | Permalink
  5. bez wrote:

    You weren’t a Blechley park cryptologist in another life, were you? Nice work, for your next project I suggest explorer.exe

    Monday, January 9, 2006 at 7:07 pm | Permalink
  6. we wrote:

    j00 r +3h 1337 h4>

    Monday, January 9, 2006 at 7:41 pm | Permalink
  7. Alan wrote:

    Interesting read.

    Monday, January 9, 2006 at 9:05 pm | Permalink
  8. Steve Ballmer wrote:

    **Throws a chair across the room

    I’ll **** you. I’ve done it before and I’ll do it again!

    Monday, January 9, 2006 at 9:13 pm | Permalink
  9. Chris wrote:

    I think thiis is an excellent article. Good job.

    Monday, January 9, 2006 at 9:22 pm | Permalink
  10. Chris wrote:

    Ahahahaha @ Steve

    Monday, January 9, 2006 at 9:22 pm | Permalink
  11. Jonas Åström wrote:

    There are keyboards with up to F24 keys. Just FYI :)

    Monday, January 9, 2006 at 9:35 pm | Permalink
  12. random wrote:

    @ Abx0r:

    msft didnt make the game, maxis did, and the cheat was relatively well-known too. Sorry to spoin your day :P

    Monday, January 9, 2006 at 9:38 pm | Permalink
  13. Nice post!
    Funny how long it took… Wait, did I say funny? Sad…

    Excellent n00b guide though!

    Monday, January 9, 2006 at 10:04 pm | Permalink
  14. Deathpasser wrote:

    Random:

    ‘pinball’ + ‘hidden’ + ‘test’ in Google says to me that this cheat was NOT relitively well known, so I don’t think you spoiled anyones day.

    Monday, January 9, 2006 at 10:25 pm | Permalink
  15. Scott wrote:

    You might check out “OllyDbg” for another debugger.
    http://ollydbg.win32asmcommunity.net/
    and OpenRCE
    http://www.openrce.org/articles/
    Nice post though!

    Monday, January 9, 2006 at 10:44 pm | Permalink
  16. Lsv wrote:

    Very impressive.

    Monday, January 9, 2006 at 10:59 pm | Permalink
  17. tron wrote:

    Excellent! Thanks for sharing your light.

    Monday, January 9, 2006 at 11:32 pm | Permalink
  18. Ivan Minic wrote:

    Mr.Burns mode on:
    Excellent :)
    Mr.Buns mode off

    Tuesday, January 10, 2006 at 12:03 am | Permalink
  19. QLaw wrote:

    Great job doing this project, and the writeup was very easy to understand too. Ignore the haters. You’re better than they are because you learned it and spent a long time doing it and then did a kickass howto for it.

    Thanks for posting. :)

    Tuesday, January 10, 2006 at 12:14 am | Permalink
  20. gr wrote:

    well I believe that because MS Pinball is FREE (nothing paid for the game, although we all paid for the OS) nobody ever thought that MS would have implemented some cheats into it. Nobody Bothered because they thought it’s a LAME game from MS (I don’t think anyone Bought windows for the pinball game!!!).
    excellent work!
    Great article.

    Tuesday, January 10, 2006 at 12:21 am | Permalink
  21. astig decena wrote:

    WOW..

    GOOD JOB..

    KEEP IT UP DUDE!!!..

    AND WHAT DID MICROSOFT SAID ABOUT THAT CRACKING THING?

    TNX ALOT DUDE..

    PINOY!!!

    Tuesday, January 10, 2006 at 12:22 am | Permalink
  22. Ryan Merket wrote:

    Good tutorial. But you seriously should stop debugging in WinDbg – try Olly – it is 400 times better.

    But if you get REAL serious you should try Softice.

    Tuesday, January 10, 2006 at 12:30 am | Permalink
  23. turf_is_an_idiot wrote:

    I can digg it!
    Excellent.

    Tuesday, January 10, 2006 at 12:32 am | Permalink
  24. Matt wrote:

    Great tutorial. Well done, and appreciated.

    Tuesday, January 10, 2006 at 12:39 am | Permalink
  25. jaya wrote:

    That was impressive!

    Tuesday, January 10, 2006 at 1:01 am | Permalink
  26. Source wrote:

    It doesn’t work :(

    Tuesday, January 10, 2006 at 1:04 am | Permalink
  27. micronanopico wrote:

    Apple keyboards have an F15 key.

    Tuesday, January 10, 2006 at 1:39 am | Permalink
  28. flashman wrote:

    Does not work in XP pro’s version for me. :-(

    Tuesday, January 10, 2006 at 2:10 am | Permalink
  29. Isn’t F15 Shift + F3?

    Tuesday, January 10, 2006 at 2:31 am | Permalink
  30. Roomba wrote:

    I love that little pinball game, good way to kill time at lunch. I think this might kill some of the fun, I hope not.

    Tuesday, January 10, 2006 at 4:01 am | Permalink
  31. Martin2 wrote:

    I spent the entire night trying your tricks on it, you bastrd! :) Thanks, a bug has bitten! As you said: tedious, but strangely rewarding…

    Tuesday, January 10, 2006 at 4:47 am | Permalink
  32. GageBlack wrote:

    Pretty cool!

    Tuesday, January 10, 2006 at 4:57 am | Permalink
  33. Anonymous wrote:

    This looks like it should work on ALL version of windows (i tried xp pro, xp home and w2k) – the cheat is, in the game type h,i,d,d,e,n,space,t,e,s,t – that turns the mode on. Then hit “m” to see if you did it right – if the memory box pops up you did!

    Tuesday, January 10, 2006 at 6:22 am | Permalink
  34. It doesn’t work for me!

    Tuesday, January 10, 2006 at 6:35 am | Permalink
  35. M$ Team wrote:

    HA HA

    Tuesday, January 10, 2006 at 7:04 am | Permalink
  36. WPG_Brownie wrote:

    Damn l33t work on the write up man. Keep up the good work.

    But you better go into hiding, them MSofties will throw the DMCA at ya ;)

    Tuesday, January 10, 2006 at 7:23 am | Permalink
  37. Emplyst wrote:

    YOU ARE MY GOD

    Tuesday, January 10, 2006 at 7:26 am | Permalink
  38. magnus wrote:

    I was messing around with this, and I pressed capital Y and after that everything started getting red and wierd looking…

    Tuesday, January 10, 2006 at 8:03 am | Permalink
  39. Euan wrote:

    Man thats pretty indepth. Nice write up.

    Tuesday, January 10, 2006 at 8:06 am | Permalink
  40. Veachian64 wrote:

    Very cool. The brief assembly tutorial is much appreciated.

    Tuesday, January 10, 2006 at 8:26 am | Permalink
  41. WinZIP wrote:

    cool :)

    Tuesday, January 10, 2006 at 9:01 am | Permalink
  42. David Duke wrote:

    you were dugg!

    Tuesday, January 10, 2006 at 10:47 am | Permalink
  43. GodIwishEAdidntownMaxis wrote:

    To all you people attacking “M$” in this thing, know what you’re talking about first ;)

    The Pinball game is actually but a single table of a series of tables from the /MAXIS/ game “Full tilt pinball”.

    Microsoft simply liscenced the rights to include the game with various editions of the windows os.

    Tuesday, January 10, 2006 at 12:38 pm | Permalink
  44. PMC wrote:

    Looks like if you press b right when the ball passes the flippers, a ball is created in the center of the table and dropped… Don’t know why, since it doesn’t seem to work after the third ball gutters and it just remains on the screen for a second if you do it with the first few balls. Once the next ball appears in the shooter, the magically-appeared ball disappears. One way around this is to yank it quickly into one of the warp tunnels… it stays on the board then and doesn’t force you to shoot.

    Tuesday, January 10, 2006 at 3:10 pm | Permalink
  45. Skate wrote:

    Good cracking tutorial. As a scener, I only care about the demoscene and I never support cracking. But of course I know where this scene come from and I didn’t forget the years that I make cracks in commodore 64 scene. So, this article is somehow useful :)

    Tuesday, January 10, 2006 at 6:27 pm | Permalink
  46. Microsoft are the borg wrote:

    All you hypocrite kids who write M$ wouldn’t think 2 seconds about making the money that Microsoft does. So shut up and look in the lower left corner of your screen.

    Tuesday, January 10, 2006 at 11:04 pm | Permalink
  47. blindmatrix wrote:

    Nice work man!,, :D

    Wednesday, January 11, 2006 at 12:26 am | Permalink
  48. JlucasH05B wrote:

    Excellent Hack, you must do another hacks for learn how other programmers do his stuff.

    Is not Cracking is Hacking please go to the wikipedia all the people who commented this project as CRACKING oh god!!

    Wednesday, January 11, 2006 at 2:13 am | Permalink
  49. Chuckawucka wrote:

    You can turn off the hack by just turning off the game. Once you do reload the game, the hack will be gone (but the mega high scores will still remain)

    Wednesday, January 11, 2006 at 8:21 am | Permalink
  50. hahah wrote:

    hahaha this is not normal.

    Wednesday, January 11, 2006 at 2:04 pm | Permalink
  51. Josh wrote:

    Sorry, but this just does not work on the version I have. I have tried typing this code (hidden space test) during the game load screen, before deployment, and afterwards. I have tried typing it both with and without pressing the enter key at the end. All attempts at initiating this cheat have failed.

    Thursday, January 12, 2006 at 1:45 am | Permalink
  52. Josh wrote:

    Ok take back previous post. To properly activate the cheat, the code MUST be entered while the game is in full screen mode, which should have been mentioned earlier ;)

    Thursday, January 12, 2006 at 1:50 am | Permalink
  53. jamez wrote:

    No, it does not have to be entered in full screen mode, you just have to makesure pinball is the active window.

    Thursday, January 12, 2006 at 4:05 am | Permalink
  54. jamez wrote:

    This is not Cracking, it is not even Hacking -nothing has been modified, “hidden test” is a normal fuction of the game.
    This is Reverse Engineering – he read the code and saw what made it function.

    Thursday, January 12, 2006 at 4:26 am | Permalink
  55. Dee wrote:

    This was a great article. Kudos! ^_^ Seriously, there are probably cracks for any game that a major corp writes. Some programmers can be really fun fun. Even minesweeper has one (at least). I didn’t have to debug anything to get it, though. =)

    Thursday, January 12, 2006 at 7:25 am | Permalink
  56. booger wrote:

    jamez: this totally IS hacking – at least in the old school definition. Hacking is all about pulling stuff apart to see how it works! And the dood never said it WAS cracking – he said the same techniques could be USED for cracking

    Thursday, January 12, 2006 at 8:16 am | Permalink
  57. SockBoy wrote:

    Does this cheat work with normal pinball machines @ the arcade? How do I attach a mouse to a pinball machine? Is there a USB/PS2/Serial port in the back?

    I will become Pinball King!

    Thursday, January 12, 2006 at 1:53 pm | Permalink
  58. Dr K wrote:

    Excellent, dude! I’m happy the tradition lives on. Real mastery isn’t from playing the game but changing it. You beat the Kobayashi-Maru scenario! Pwned!

    Friday, January 13, 2006 at 6:32 pm | Permalink
  59. Leion wrote:

    I think this is a really cool tutorial. Thanks :)

    Sunday, January 15, 2006 at 3:42 am | Permalink
  60. Aiden wrote:

    That was pure genius. A+++

    Monday, January 16, 2006 at 2:47 pm | Permalink
  61. NOVA NUT wrote:

    How do you open up the Windows debugger? I used the run program and used your command but it says it couldn’t find it. Any tips?

    Tuesday, January 24, 2006 at 7:26 am | Permalink
  62. Mr. Speaker wrote:

    Once you’ve installed the debugger it will just be in your start menu: Start -> Programs -> Debugging Tools For Windows -> WinDbg

    When it loads go: File -> Attach To Process.

    Then select the pinball (or whatever program) process.

    Tuesday, January 24, 2006 at 9:07 am | Permalink
  63. Office 2003 wrote:

    Is it possible to get this blog feed via email? Hanah in Chicago.

    Friday, February 3, 2006 at 8:10 am | Permalink
  64. ginyooin wrote:

    hehe, i might be late but this was interesting, im even more amazed at how you used windbg to it all. kudos

    Saturday, February 4, 2006 at 10:51 am | Permalink
  65. Rosso wrote:

    Doesn’t appear to work for me on Pinball..

    Wednesday, February 15, 2006 at 4:34 pm | Permalink
  66. AshleyF wrote:

    it sure works for me!! very well…l0l i used it on the computer at my middle skool and l0l people dont knoe how to beat my score!!!

    Monday, February 20, 2006 at 1:52 pm | Permalink
  67. Microsoft wrote:

    It has come to our attention that you have been finding out the different codes for programs and other companies programs, example “Maxis” and I personally think that you have real potential. Here at Microsoft we could need another program decoder like you to find the glitchs in our programs and repaire them. You will be paid $45 an hour and you’ll work a 30 hour work week, that’s if you take my offer though. I would really like it if you would come and work for me.

    Sincerly,
    Bill Gates.
    P.S. If you want the job call me at (555) 882-8080

    Tuesday, March 7, 2006 at 11:39 pm | Permalink
  68. Linus wrote:

    Nice Hacking!
    It seems like you a man with lot of potencial, gime a call!
    Ya will know where yo ucan find me!
    LiNuS

    Thursday, March 9, 2006 at 10:29 pm | Permalink
  69. Anonymous wrote:

    wow i didnt know bill gates had such bad grammar…. by the way nice work man keep it up

    Tuesday, March 14, 2006 at 2:21 pm | Permalink
  70. Mpot wrote:

    Nice dude. I read the tutorial on reverse engineering and I got a bit lost(And I like to think of myself as a computer whiz…). Anyway, I played pinball and used the cheats. It was really fun, looking at all the features that the game has(Which I couln’t access because I suck at pinball). Thank’s for the 1337 guide.

    P.S. -
    If that is really Bill Gates then I’m God.

    Saturday, March 18, 2006 at 9:44 am | Permalink
  71. Microsoft wrote:

    This really is [Niagara District Catholic School Headmaster], I like to [go fishing with] Steve Jobs. [It makes me outwardly chuckle]. This was [not in part] a [particularly hilarious] joke[.] [Could it be that] you [were] actually [ensnared] into think[ing] that anyone would really care about you [teaching newbies how to] hack a pinball game. Why don’t you hack something better. Like [a newbie OS like] windows it’s self. Although the most impressive thing I have ever done is play with myself.

    [I love you]

    Monday, March 20, 2006 at 11:32 pm | Permalink
  72. cardsharp wrote:

    This is pretty sweet, i’m amazed that someone could be so bored as to find cheats in a basic windows applicatiom, but i’m happy that you did becuase now i have the one-up on all of my classmates.

    Tuesday, March 21, 2006 at 5:03 am | Permalink
  73. Peter North wrote:

    Hey, I was wondering in what file does the Pinball game store the high scores. Does anyone know? And if you do, is it stored as a [Humanly] unreadable binary file. I know there is already programs that can edit the high scores, but I was just curious

    Saturday, March 25, 2006 at 9:09 am | Permalink
  74. mcginnis40 wrote:

    how do i get my pinball for windowsxp back if you can help thanks

    Monday, April 3, 2006 at 5:49 am | Permalink
  75. Strife wrote:

    those are uber hacks

    i love you

    Sunday, April 23, 2006 at 1:31 pm | Permalink
  76. Joel wrote:

    Ok i did the cheat (sweet, got 500 mill..)

    but i tried to end the game to get my unbeatabler high score, but it wouldnt let me. lall the tries i did to put it in the guitter, it just said redeploy or player 1 start again! whats the deal? how do i stop it and get my own high score in!

    Tuesday, May 2, 2006 at 8:34 am | Permalink
  77. Me wrote:

    If you can hack pinball then doesnt this mean by default you can hack my computer, I love you guys, you are such geeks. x

    Friday, June 23, 2006 at 4:52 am | Permalink
  78. nagash wrote:

    i hail u as my GOD, i hav been searching for SO long to find sumthing like this!

    Friday, June 23, 2006 at 5:29 pm | Permalink
  79. Katy wrote:

    I was very glad when I read this that it wasn’t the same old same old. You know the ones that are written in computer garb that some of us can’t read cuz we don’t have a hack for the lingo. I don’t have my lingo degree yet and still refer to most of it as “that whatchamacallit file” or “thingamajig program” LOL…
    Thanks for the easy to understand article that actually helps us with other projects as well by giving me the understanding of how and why, rather than just the end code.
    Wish me luck in my many more learning journeys.
    One day I too will be able to help others.

    Tuesday, June 27, 2006 at 7:21 am | Permalink
  80. Anonymous wrote:

    I’m retarded, haven’t read any of the other comments here and in an attempt to hide my lack of reading ability from myself I will come to the conclusion that “It doesent work”

    Tuesday, June 27, 2006 at 6:04 pm | Permalink
  81. Tom wrote:

    You might want to know it’s not Microsoft who developed this, but another company (I think it may be Maxis).
    Those M$ dudes may not even know about the cheats :P

    Oh how I know this?
    I used to have a demo of this Pinball demo. It was called “Full Tilt! Pinball, Space Cadet Demo” or something like that…
    Maybe a Google search to that will help? :P

    Thursday, June 29, 2006 at 12:54 am | Permalink
  82. shubaca wrote:

    very, very cool…love it to bits

    Friday, July 7, 2006 at 5:53 pm | Permalink
  83. narasect wrote:

    *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll –
    ntdll!DbgBreakPoint, i downloaded the symbol for the proper computer and, I did as you said, open pinball and attach the process, when ever i do it, it gives me that error help…

    Sunday, August 20, 2006 at 1:57 am | Permalink
  84. ads wrote:

    dude nice to bad u cant turn it of to save ya score
    #

    Saturday, August 26, 2006 at 12:04 am | Permalink
  85. Dreams wrote:

    Good job dude :0)

    Friday, September 8, 2006 at 10:25 pm | Permalink
  86. R2d2 wrote:

    Do you have something for Classic solitaire.

    Tuesday, September 12, 2006 at 9:02 am | Permalink
  87. nick wrote:

    I just have to say I will use this to show all my friends how good i am at pinball in my windows class at school

    Friday, September 15, 2006 at 8:48 am | Permalink
  88. theo wrote:

    here are some other cheatz
    rmax-increase rank
    gmax-gravity hole
    1max-extra ball

    Monday, September 18, 2006 at 8:17 am | Permalink
  89. theo wrote:

    of yeah, highscores wont work with cheatz

    Monday, September 18, 2006 at 8:19 am | Permalink
  90. chris wrote:

    yea dude….im amazed somebody actually broke in the pinball app..i actually think its pretty funyy.watch ou for the feds…you can actually get put in jail for modifiying windows apps…GL 8)

    Thursday, September 21, 2006 at 10:44 am | Permalink
  91. .:^~GOD^~:. wrote:

    hey i realized that you are a good programmer so i i think you should work for me….call me at 1-800-GO-2GOD or just kill yourself…

    PS…this is really god and i am real

    Thursday, September 21, 2006 at 10:51 am | Permalink
  92. kkid28 wrote:

    Sweet man, my brother’s gonna be freakin out when he finds out I did this to his high scores! lol

    Saturday, September 30, 2006 at 5:38 pm | Permalink
  93. perion666 wrote:

    Good job! I’m working on an rce project for another app but have to migrate to windbg – I’m used to SoftICE. This has provided me with something to play with while I get the hang of windbg. So far I don’t like it (windbg) and would much rather use SICE but SICE is giving me grief on my laptop under XP sp2 whereas windbg seems stable (except for exporting logger file to txt file which crashes).

    thanx for the tips.

    perion666

    Sunday, October 29, 2006 at 9:32 am | Permalink
  94. jigsaw wrote:

    how can you hack with out geting caught by the cops or teachers.

    Tuesday, October 31, 2006 at 2:24 am | Permalink
  95. jigsaw wrote:

    hello my good ppl i will like to play a game right now you all are being watch but i must warn you if you try to run we will get you let the games begin.

    Tuesday, October 31, 2006 at 2:26 am | Permalink
  96. TheMcNasty wrote:

    So, say you don’t have symbols for a program. How do you set a break point when it calls the hmemcpy function in windows (which I do have symbols for) because you can do it in softice and wdb just says it can’t resolve it.

    Thursday, November 2, 2006 at 12:47 am | Permalink
  97. sev wrote:

    ^bez – No kernel32.dll!

    Monday, November 27, 2006 at 8:26 am | Permalink
  98. KD wrote:

    is their a way to turn it off and keep the high score

    Friday, December 8, 2006 at 10:01 am | Permalink
  99. billy wrote:

    i was just wondering how you go with teminxz ti-lop

    Saturday, December 9, 2006 at 10:04 pm | Permalink
  100. billy wrote:

    its pretty cool

    Saturday, December 9, 2006 at 10:05 pm | Permalink
  101. pinball wizard wrote:

    whooo hoo hoo! i play a mean pinball! you can’t beat me! wahoooooooo!

    Sunday, December 10, 2006 at 8:44 am | Permalink
  102. souravXtreme wrote:

    AMAZIIIIIIIIIIIIIIIIIING!!!!

    Friday, December 22, 2006 at 12:05 am | Permalink
  103. ALAN wrote:

    TRY AND GET A HACK FOR YAHOO POOL OR FIFA 07 THANKS LOL

    Monday, January 1, 2007 at 2:51 pm | Permalink
  104. serial hacker wrote:

    very good i like your info

    Tuesday, January 2, 2007 at 11:07 pm | Permalink
  105. Axel wrote:

    Hei! You are amazing!
    I have a little problem, and i hope you can help me.

    When i tipes in “x pinball!*”, this message hits me:
    *** ERROR: Module load completed but symbols could not be loaded for C:\Programfiles\Windows NT\Pinball\PINBALL.EXE

    Do you know what to do?

    Thanks.

    PS: do you think you can tell me in a easy way, because im not good in english and im not too good with computers?

    You are a geanius!

    Wednesday, January 10, 2007 at 11:55 pm | Permalink
  106. HelpsUhack wrote:

    type in bmax ,you never die

    Saturday, January 13, 2007 at 2:55 am | Permalink
  107. Eric wrote:

    This cheat is fucking good

    Saturday, January 13, 2007 at 7:18 am | Permalink
  108. robbo3791 wrote:

    if you make the table tilt after typing bmax then u can save ur highscore

    Saturday, January 13, 2007 at 7:48 am | Permalink
  109. Red Fish wrote:

    Nice article. The comments are more amusing then the content, but good start. From someone who started when “everyone” who programmed computers knew assembly it was rather amusing. Nice to see the old skills being rediscovered. :)

    Monday, January 15, 2007 at 5:48 am | Permalink
  110. montel wrote:

    those were gr8 i am ten years old

    Saturday, January 20, 2007 at 9:03 pm | Permalink
  111. Michael wrote:

    Nice Man. I did this and started playing, and told my girlfriend to come look at my high ass score in pinball…she freaked out and told me I was the best Pc pinball player EVER! Dude, you got me LAID! Hats off to you my friend!

    Sunday, January 21, 2007 at 1:55 pm | Permalink
  112. Carlos wrote:

    CINEMATRONICS is simply the name if the company that developed the game. Space Cadet was originally part of Full Tilt! Pinball which was published by Maxis and developed by Cinematronics. Microsoft a limited version of the Space Cadet table with Plus! 95. It has come with every version of Windows since then. Sadly, it does not come with Vista. The original game Full Tilt had 2 other tables as well as better animation, various resolutions that players can select from and multi-ball play.

    Sunday, January 21, 2007 at 2:04 pm | Permalink
  113. Alias wrote:

    I’m sorry that some people are giving you such retarded responses to this article. lol. Things like: “z’omg ur such a n00b h4x other stuffz lolz i hav gnoe’ grammarz”. Thanks for sharing this. By the way; I’m sure the feds and M$ could care less if he presented a few of the game’s codes to people.

    Tuesday, February 20, 2007 at 2:24 pm | Permalink
  114. Sub12 wrote:

    There is a ‘Edit Pinball Components FOR TESTING PURPOSES ONLY’ section. I opened it in Resource Hacker. I’m not entirely sure what it does yet.

    Wednesday, February 21, 2007 at 4:13 am | Permalink
  115. Sparx wrote:

    Sweet! I was looking up if there was an easier way to get points when i found this…my brother is certain i can’t beat his score, but now im certain he cant beat mine!!

    Thursday, March 1, 2007 at 2:57 am | Permalink
  116. Good to see people+ are still around spreading the knowledge

    Thursday, March 15, 2007 at 12:23 pm | Permalink
  117. MAT wrote:

    I GOT 999,999,999 I OWNED IT WITHOUT THESE CHEATS AND I WAS ON BALL 3

    Friday, March 23, 2007 at 3:44 am | Permalink
  118. MATMAN WIZARD wrote:

    SO YAH I USED THE CHEAT AND I GOT SO MUCH BUT I COULD NEVER GET OF BALL 1 LOL

    Friday, March 23, 2007 at 3:46 am | Permalink
  119. u r a lozer wrote:

    [Comment removed. Short-Word-Contraction overload failure (or should that be underload?)]

    Thursday, April 26, 2007 at 4:53 am | Permalink
  120. jason wrote:

    NICE ;P

    Sunday, May 6, 2007 at 1:38 am | Permalink
  121. Puffy wrote:

    I tried this shit and it doesnt work on my pc, can u maybe put a demonstration on your site?

    Saturday, May 26, 2007 at 10:26 am | Permalink
  122. Help wrote:

    I want to use ball follow mouse cheat and then have the high score come up at the end

    Saturday, June 2, 2007 at 5:46 pm | Permalink
  123. Help wrote:

    I have now fixed this problem by clearing out the high score chart.

    Sunday, June 3, 2007 at 9:17 am | Permalink
  124. R2D2 wrote:

    I found a new cheat for Classic Solitaire. I don’t like it when it take to long to win the game. This only works on windows 2000 and XP. Use the Alt+Shift+2 and you instantly win the game.

    Friday, June 15, 2007 at 10:02 am | Permalink
  125. R2D2 wrote:

    You are the pinball king!

    Friday, June 15, 2007 at 10:05 am | Permalink
  126. 1337 h4x0r0z wrote:

    Awosme..I found other things to Freecell and solitaire.

    Wednesday, June 20, 2007 at 1:48 pm | Permalink
  127. evilpeople wrote:

    amazing you dont know what it means to me to finally be able to understand hacking.your illustrated hands on instructions made it so easy to understand.premo,u should follow up with a forum on how to crack without the symbols,i tried but was totally lost befor i started,also the last part-the back door function was a little om the light side of information that would have been very usefull.if u do deside to write a forum on not using symbols could u use compaq game console as example.please if u have more info like this please feel free to send me a link to it.great work

    Thursday, July 5, 2007 at 8:10 am | Permalink
  128. sean wrote:

    thx a lot!

    Friday, July 13, 2007 at 3:07 am | Permalink
  129. Julien wrote:

    Cool , i’m not the only one loosing some precious time doing stuff like “Hacking” ( Well …i should write customizing !) Space Cadet.
    OFFSET line 14110h Replace 75 by EB with an Hex editor. Save it. Open Pinball , shake the table as much as you can an enjoy it !

    Saturday, July 28, 2007 at 3:10 am | Permalink
  130. ultimatedood wrote:

    awesom thats soooo coool though when I press h and entered my high score and went back to the game, when tha ball was move the “squeare” were the ball was turned red. then i press h again, and the whole thing turned red. (not complety red, but red shadees sorta)

    Monday, July 30, 2007 at 11:10 am | Permalink
  131. hOLLA wrote:

    YOU ARE THE MAN… HOLLA HOLLA

    Friday, August 24, 2007 at 6:54 am | Permalink
  132. laura wrote:

    great thanks for that article, most of it worked =]]

    Saturday, September 29, 2007 at 8:18 pm | Permalink
  133. peace wrote:

    Thanks 4 da cheats!

    Saturday, October 20, 2007 at 10:43 am | Permalink
  134. witono wrote:

    amazing.. great work

    Tuesday, November 27, 2007 at 4:17 am | Permalink
  135. ashley wrote:

    nicee

    Wednesday, December 5, 2007 at 11:42 am | Permalink
  136. ha wrote:

    Thanks guys… i never (k)new about hidden cheats till 2003. I’m a dumbass

    Thursday, December 27, 2007 at 10:51 am | Permalink
  137. SAlNT wrote:

    lol i just pwned the high score on the work computer… and just found this out and have ruined the high scores list with a ridiculous 1,000,000,000 score lol people will think i cheated for the top score

    Monday, March 31, 2008 at 5:05 am | Permalink
  138. Microsoft wrote:

    I r teh Pwnage!

    woop w00t secks me pl0x

    Saturday, April 26, 2008 at 12:30 am | Permalink
  139. jarad riley wrote:

    could i plea have my code!.

    Sunday, May 25, 2008 at 4:50 pm | Permalink
  140. NOT wrote:

    With all thsoe mispelinsg that can’t be Bill Gates. Plus the area code 555 doesn’t exist :D

    Sunday, June 1, 2008 at 12:33 pm | Permalink
  141. NOT wrote:

    With all thsoe mispelinsg that can’t be Bill Gates. Plus the area code 555 doesn’t exist :D

    Sunday, June 1, 2008 at 12:34 pm | Permalink
  142. dumdum! wrote:

    its hidden test not hidden space test Josh lolz

    Friday, June 20, 2008 at 11:16 pm | Permalink
  143. Rajesh wrote:

    hey….nice work…very good article…

    Sunday, September 14, 2008 at 2:38 pm | Permalink
  144. lalaboy wrote:

    Hey mr speaker ur cheats r down right AWESOME! Stop giving others ur awesome cheats! (ur = you’re, or your… I don’t know the difference! LOL!!)

    Wednesday, October 22, 2008 at 4:07 pm | Permalink
  145. luke dyer wrote:

    sweet man thats insain 1,000,000,000 yahh::::::::::)

    Thursday, October 30, 2008 at 1:44 am | Permalink
  146. ivor wrote:

    i tried it it worked ONCE then stopped working. When you say “to type in “hidden test”" you mean in the hi scores right?

    Thursday, November 13, 2008 at 10:30 am | Permalink
  147. SparK wrote:

    no, he means, type it while you play

    no field or anything, just anywhere in the running application

    Saturday, January 24, 2009 at 7:16 am | Permalink
  148. Studs wrote:

    end hidden test

    Monday, August 24, 2009 at 4:15 am | Permalink
  149. Kenny Meyer wrote:

    This is really nice. Teached me something new..! Many, many thanks. Great article

    Thursday, October 15, 2009 at 2:31 am | Permalink
  150. GOD IN YOUR COMPUTER wrote:

    you guys the reason your highscore wont work is because you get them to high it has a limit

    Sunday, January 3, 2010 at 5:02 am | Permalink
  151. Dippidy Doo wrote:

    this is a really confuzzling website!!!

    Saturday, January 23, 2010 at 8:43 am | Permalink
  152. Ryan wrote:

    Very nice article about the cheats for pinball.

    Wednesday, March 24, 2010 at 1:44 am | Permalink
  153. benzine wrote:

    Great post, thanks for sharing it. I feel like I’ll try to follow as many of this as possible with my next blog.

    Sunday, July 11, 2010 at 2:49 am | Permalink

5 Trackbacks/Pingbacks

  1. proxy.11a.nu on Monday, January 9, 2006 at 11:34 pm

    Learn reverse engineering and cheat in MS Pinball at the same time

    This is just a very cool hack. “Mr. Speaker” documented how he reverse engineered MS Pinball to find a previously undocumented cheat mode. Very cool intro to reverse engineering, and if you are thinking of getting into that it’s defi…

  2. NIF on Tuesday, January 10, 2006 at 2:01 am

    Your click is important, please hold

    Today’s dose of NIF – News, Interesting & Funny … Welcome to Monday! (+ Open Trackbacks)

  3. Sangent - The Daily Ramblings on Tuesday, January 10, 2006 at 11:07 am

    MS Pinball Cheat

    This article not only reveals the coolest cheat for the Pinball game included with Windows, but also explains how the author found it, and gives the basic techniques for reverse engineering and cracking programs.

  4. digitalfive.org on Wednesday, February 1, 2006 at 6:04 pm

    Cheating Windows XP Pinball!

    Ever wanted to be the pinball wizard? Now you can! It’s possible to cheat at the Pinball game that is included in Windows XP, and it’s dead easy. For simplicity reasons, I’ve moved the cheats to a seperate page outside of the blog tim…

  5. [...] Product Key « .. NextGenHacker101 owes me a new monitor – Larry Osterman's WebLog – Sit.. Hacking Windows Pinball – O! Mr Speaker! 1000 Hacker Tutorials 2008 « Full and Free – Everything you need >>> Enabling [...]

Post a Comment

Your email is never published nor shared. Required fields are marked *
*
*
Captcha! Please type 'lolz' *