- **note:** Opened only for writing, so they are output rather than something to obtain. All of them sit in the BAM directory.
**entries:**
- what: cfg\<table>.cfg and cfg\<table>.seq, per table settings and camera sequences, source_ref: BAM.dll 1.5-408 .text:0x10025e59, 0x100319b9, 0x10032bdb, note: Built as cfg\\<table> then finished with the extension. Saved from the menu and read back on the next launch of the same table.
- what: Cache\<table>-shadows.zip, precomputed shadow maps, source_ref: BAM.dll 1.5-408 .text:0x10105c18-0x1010697f, note: Checked with GetFileAttributesA and rebuilt when absent. Holds shadowmaps.txt and one <name>-shadows.tga per light, written through the rendering engine.
- what: set3points.dat, the three point calibration of the screen corners, source_ref: BAM.dll 1.5-408 .text:0x10077b80-0x10077bd7, note: fopen_s with wb, fwrite, fclose. No read site exists.
- what: BAM_debug.log, BAM_CRASH.log and OpenGLdbg.log, source_ref: BAM.dll 1.5-408 .text:0x1007a45b, 0x1007ae0a, 0x100d4318-0x100d4391, note: The crash log is written from the fault handler installed at load time; the other two only when the matching switch is on the command line.
shipped_but_not_loaded:
- **note:** Present in a distribution with no code path that opens it
**entries:**
- what: zlib.dll in BAM-OpenVR.zip, source_ref: BAM.dll, renderingengine.dll and every plugin import directory, note: No shipped binary imports it and neither BAM.dll nor renderingengine.dll names it in any string; both carry their own zlib.
- what: License.txt, 3741 bytes, source_ref: bam-setup.exe payload, note: The zlib licence the loader source carries, copied into the install.
named_but_not_obtainable:
- **note:** A literal the code opens that no distribution can provide
**entries:**
- what: c:\games\ppmm.bin, source_ref: BAM.dll 1.5-408 .text:0x100cff69-0x100cffa5, note: fopen_s with rb then fread, guarded by two globals and reached only after glGetFloatv has read the modelview and projection matrices. The path is absolute and points at a directory no install creates.
platform_components:
- **note:** Named in import directories but supplied by Windows or by a Microsoft redistributable, so they are prerequisites rather than payload.
**entries:**
- what: MSVCP140.dll, VCRUNTIME140.dll, CONCRT140.dll and the api-ms-win-crt set, source_ref: BAM.dll, renderingengine.dll import directories, note: Visual C++ 2015 or later runtime. Neither distribution carries it.
- what: MSVCR100.dll, MSVCR120.dll and MSVCP120.dll, source_ref: PostFX.dll, TrackIR.dll, DesktopKinect.dll, PinballHighScore.dll import directories, note: Visual C++ 2010 and 2013 runtimes, for the older plugins.
- what: opengl32, glu32, dinput8, hid, avicap32, avifil32, msvfw32, d3d11, dxgi, source_ref: BAM.dll, renderingengine.dll, plugin import directories, note: Windows components.
Technical notes
BAM, Better Arcade Mode, by Rafal Janicki. FPLoader.exe starts
Future Pinball.exe suspended, writes the BAM.dll path into the new process
with VirtualAllocEx and WriteProcessMemory, runs LoadLibraryA on it through
CreateRemoteThread, waits for that thread and resumes the main one. Everything
else lives in BAM.dll, which detours the running program. The loader is
published as source; the shipped FPLoader.exe carries the same .text and
.rdata as the build committed to that repository and differs only by an
Authenticode blob, 9472 bytes against 5384.
ref: BAM_FPloader FPLoader.cpp:259-305, FPLoader.exe .text sha1
d5ca74154fe97002, PE timestamp 2016-04-25 19:17:12
BAM.dll is searched in the loader's own directory first, then in
C:\Games\Future Pinball\BAM. Both missing puts up "Couldn't locate BAM.dll."
and returns -1. Future Pinball.exe comes from /FPEXE if that switch names an
existing file, otherwise from one level above the loader, then from the
loader's directory, then from C:\Games\Future Pinball\; the same failure path
reports "Couldn't locate Future Pinball.exe.". Before the process is created
the loader prepends its own directory to %PATH% so the system resolves
renderingengine.dll from there while the working directory is the game
directory. /STAYINRAM keeps the loader alive until the game thread ends; the
rest of the command line is handed to Future Pinball untouched, which is how
/Open, /Play, /Exit and /ArcadeRender reach it.
ref: BAM_FPloader FPLoader.cpp:40-48, 87-111, 166-240, 249-257
BAM.dll is closed source. Its version resource reads 1.5.408 and its debug
tags name BAM.cpp, dllmain.cpp, BallManager.cpp, RenderEngine.cpp,
plugin.cpp, pbo.cpp, stereo3d.cpp and debug.cpp. Twenty five entry points are
detoured in one pass: CreateFileA, CreateFileW, ReadFile, WriteFile,
CloseHandle, GetFileSize, DeleteFileA, FindResourceA, LoadResource,
LockResource, SizeofResource, CoCreateInstance, StgOpenStorage,
GetOpenFileNameA, ChooseColorA, GetDlgItem, SendMessageA, ShowWindow,
SwapBuffers, ChoosePixelFormat, SetPixelFormat, wglCreateContext,
wglDeleteContext, wglMakeCurrent and wglGetProcAddress, with glFrustum,
glTexImage2D and wglChoosePixelFormatARB taken separately. That is how BAM
sees the program's own resource and file traffic and can answer it. Newton is
reached through GetModuleHandleA on the copy Future Pinball already imported
followed by GetProcAddress on 83 entry points; no second copy is loaded.
ref: BAM.dll 1.5-408 .text:0x10082a75-0x10082f3d, 0x100831b3-0x100831d9,
0x1002ab92-0x1002abeb, .rsrc version, debug tags Routed_glTexImage2D and
Routed_wglChoosePixelFormatARB
Every path BAM builds hangs off the directory holding BAM.dll. The module
handle saved at load time goes through GetModuleFileNameA, the result is cut
at the last separator, and one of two format strings finishes the job:
"%s\%s.%s" for a name and an extension, "%s\%s" for the cfg subdirectory.
Settings for a table are cfg\
.cfg and cfg\
.seq, with default.cfg
and default.seq as the fallbacks.
ref: BAM.dll 1.5-408 .text:0x10025e40-0x1002605a, 0x100319a0-0x10031d48,
0x10032bdb-0x10032f23
Keys are the one text file. bam.cfg is read with fopen_s and parsed as
"%s = %s" lines over the names Menu, Menu2, Left, Right, Up, Down, Enter,
Snapshot, 3DSwitch, SaveXML, SnapShotPath, SnapShotBackboxPath, HeadTracking,
ForceArcadeMode, SwitchToNextBall, SwitchToPrevBall, RoomOnOff, Cam, Overlay,
BallShadows and OverlayAspectFix. A Keyboard.cfg found beside it is renamed to
bam.cfg first. RetroBat rewrites the two SnapShotPath lines before launching.
ref: BAM.dll 1.5-408 .text:0x100c3960-0x100c3a97, .rdata:0x10654208-0x10654324,
retrobat emulatorLauncher/Generators/Fpinball.Generator.cs:183-209
A ball or a room is a zip of BMP/.bmp entries named for the resource ids
Future Pinball itself uses: the program carries 29 resources of type BMP and
every id the shipped packs contain is one of them, 452 being the ball.
balls*.zip is walked with FindFirstFileA and each hit becomes a choice in the
menu; default.zip in the BAM directory is applied without being chosen. The
routed FindResourceA answers the nine SHADERS resources the same way, while
the single XML resource, id 464, is read straight from the program by the save
path and is what the presets under XML\ are edited copies of. The 83 GLSL
programs BAM renders with are
resources of type TEXT inside BAM.dll, so no shader file is read from disk.
ref: BAM.dll 1.5-408 .text:0x1002d4f3-0x1002d52d, 0x100ae8ec-0x100ae990,
0x10037130-0x100371de, 0x1007e83b-0x1007e896, .rsrc TEXT,
Future Pinball.exe 1.9.1.20101231 .rsrc BMP, SHADERS, XML
Plugins are loaded by changing the working directory to plugins\, walking
*.dll with FindFirstFileA, calling LoadLibraryA on each and binding
BAM_PluginStart and BAM_PluginStop. A plugin keeps its settings by writing a
raw structure to .cfg in that working directory, which is why
the cfg files beside the plugins carry no text.
ref: BAM.dll 1.5-408 .text:0x100cf400-0x100cf75c,
BAM_Plugins Common/BAM.h:116-157
renderingengine.dll is bound in BAM.dll's import directory through
FindProgram, SetModuleWithResources, LoadFileToMemory and SaveFileFromMemory,
so the loader resolves it before any BAM code runs. It carries Assimp, zlib,
libpng and libjpeg, reads the zip packs and writes the per table shadow cache
under Cache.
ref: BAM.dll 1.5-408 import directory, .text:0x10105c18-0x1010697f
ES-DE declares the emulator as FUTURE-PINBALL-FPLOADER for Windows only,
finding FPLoader.exe under BAM\, BAM-OpenVR\ or BAM-OpenVR-OC\, and invokes it
with /Exit /Play /Open in the background. RetroBat reaches the same binary
under the emulator or core key bam, through the generator it shares with
Future Pinball. Two distributions are served: bam-setup.exe carries the
loader, the mod, the renderer, the tools, the plugins, the ball packs and the
physics presets, while BAM-OpenVR.zip carries the OpenVR plugin and the
settings files the other package leaves for the first save to create.
ref: es-de resources/systems/windows/es_find_rules.xml:448-461,
es-de resources/systems/windows/es_systems.xml:764,
retrobat emulatorLauncher/Generators/Fpinball.Generator.cs:131-135
70 files | 3 required, 67 optional | 68 in repo, 2 missing
Categories: 38 BIOS, 32 game data
BAM.dllrequiredin repobundled The mod, injected into Future Pinball and holding every feature
Probed with GetFileAttributesA at four locations, /FPEXE first. Absent, the loader stops before creating any process. The size is that of release 1.9.1.20101231.
BAM-Tracker.exeoptionalin repobundled Head tracking calibration host
Imports BAM.dll and runs it outside the game. BAM.dll lowercases the host command line and looks for this name to know it is hosted by the tracker rather than by Future Pinball.
ModelImporter.exeoptionalin repobundled Converts models to the .fpm form tables import
Same document shape as the presets under XML. The save path produces one by extracting resource 464 of type XML from Future Pinball, 6264 bytes, so no copy ships.
default.zipoptionalin repogame_data Texture pack applied to every table
Matches the name NPClient with strstr and pairs LoadLibraryA with GetProcAddress on it. The plugin imports no registry function, so the client library is resolved as a plain module name.
PostFX.dlloptionalin repobundled Bloom and the unfinished ambient occlusion pass
Named in BAM.dll and compared against the enumerated file names, so it is the one plugin the mod knows by name. Its nine GLSL programs are TEXT resources inside the plugin, read with FindResourceA. Two builds circulate under this name, the 39632 bytes of bam-setup.exe and 191240 bytes in BAM-OpenVR.zip.
PinballHighScore.dlloptionalin repobundled Records high scores across tables
LoadLibraryA followed by GetProcAddress on cvCreateFileCapture_FFMPEG, cvGrabFrame_FFMPEG and the rest. A null handle leaves the entry points unbound and only the file source is lost.
CLEyeMulticam.dlloptionalin repo CL-Eye Platform SDK driver interface for the PlayStation Eye