8-Bit BTCS - 6502 Reverse Engineering Project

[Horpner]

Guess what? APAR always worked on level three.

Noooooooooooooooo!

[Darendor]

Well, I compared all 5 levels and in fact came up with this:

Code: Select all

LEVEL 1
fc11: 00 03 02 02    03 d4 e8 e5
LEVEL 2
fc11: 00 03 ff ff    03 d4 e8 e5
LEVEL 3
fc11: 01 03 ff ff    03 d4 e8 e5
LEVEL 4
fc11: 01 03 ff ff    03 d4 e8 e5
LEVEL 5
fc11: 01 03 ff ff    03 d4 e8 e5

Memory location fc11 is cleared for levels 1 and 2, but not for 3, 4, and 5. This would mean that levels 1 and 2 are not shielded but the other 3 are. The problem of course is that level 3 is in fact not shielded at all.

Notice how the "ff ff" is different for level 1?

Also notice how if you try to teleport from a level to another level, if the level you're trying to teleport into is shielded it'll just abort the spell without running the disk drive? This means to me that when the party enters a dungeon's entry level that it loads the information for all the levels - at least whether certain levels are shielded or not.

[Darendor]

Guess what? APAR always worked on level three.

Noooooooooooooooo!

So you're Vader and I'm Palpatine?

Alright then.

[Horpner]

Also notice how if you try to teleport from a level to another level, if the level you're trying to teleport into is shielded it'll just abort the spell without running the disk drive? This means to me that when the party enters a dungeon's entry level that it loads the information for all the levels - at least whether certain levels are shielded or not.

I believe the above to be correct. Good work! It makes sense that the teleport shielding information of every level would have to be in memory at all times.

Check out the memory at fc00 when inside Mangar's Tower. It's the same on every level:

Code: Select all

000fc00: 0b0c 0d0e 0fff ffff
000fc08: 0000 00ff ffff ffff

The top line contains, I think, file numbers for where the dungeon levels are stored on disk, probably NMAX, where XX is replaced with that letter. So this says that Mangar's Tower is stored in the files:

NMAB, NMAC, NMAD, NMAE, and NMAF.

Right below that, starting at fc08, is (I hope) the APAR shielding info. A 00 means the corresponding level is OK to teleport to, while ff means that it is not.

Here goes nothing. Punching in a string of five 00 at fc08 should allow teleportation with impunity. Do ">fc08: 00 00 00 00 00"

You might have to re-enter that command each time you change levels, though.

OK, I've tried this and have just one thing to say: EUREKA!

[Horpner]

On a sad personal note, this hack has allowed me to invalidate my theory about 8N, 10E on level five. With the APAR shielding turned off, that should have fixed any trap that teleports you down to level four. But nothing continues to happen.

On a happy note, the above hack allows you to teleport within a single level, also.

As a warning to would-be hackers: The number of 00's that you enter must be the same as the number of levels in your current dungeon. If not, the game could happily try to teleport you to the dungeon stored in the non-existent file NMAFF were you to accidentally teleport to a non-existent level. This is the same thing that happens if you install stairs up at the top of a tower, for example.

[Darendor]

Also notice how if you try to teleport from a level to another level, if the level you're trying to teleport into is shielded it'll just abort the spell without running the disk drive? This means to me that when the party enters a dungeon's entry level that it loads the information for all the levels - at least whether certain levels are shielded or not.

I believe the above to be correct. Good work! It makes sense that the teleport shielding information of every level would have to be in memory at all times.

Check out the memory at fc00 when inside Mangar's Tower. It's the same on every level:

Code: Select all

000fc00: 0b0c 0d0e 0fff ffff
000fc08: 0000 00ff ffff ffff

The top line contains, I think, file numbers for where the dungeon levels are stored on disk, probably NMAX, where XX is replaced with that letter. So this says that Mangar's Tower is stored in the files:

NMAB, NMAC, NMAD, NMAE, and NMAF.

Right below that, starting at fc08, is (I hope) the APAR shielding info. A 00 means the corresponding level is OK to teleport to, while ff means that it is not.

Here goes nothing. Punching in a string of five 00 at fc08 should allow teleportation with impunity. Do ">fc08: 00 00 00 00 00"

You might have to re-enter that command each time you change levels, though.

OK, I've tried this and have just one thing to say: EUREKA!

Can you spell this out in easy-to-understand steps for me? Thanks.

[Horpner]

A step by step guide to turning off APAR shields is quite simple.

First, you have to know how many levels there are in the dungeon you're in. For Mangar's Tower, there are five. Then you poke that many zeroes into memory location fc08. Open the monitor with Alt-M, and enter the command:

>fc08 00 00 00 00 00

Then you can teleport into all levels of The Tower.

When you enter a new level, those memory locations will be re-loaded from disk, so you'll have to repeat the command above.

[Darendor]

Okay, so...for my dungeon editor thingamabobber, I will be including a subroutine to disable-enable shielding.

Only...I won't be able to do it on a level by level basis apparently, it'll have to be done externally somehow.

Any ideas?

[Darendor]

I switch off the shield for Mangar's Tower, level and teleported to 0N 0E on that level. The memory location at fc08 promptly reset itself, which means that each time a dungeon level is loaded from disk it reads in the shielding status for each level.

I teleported back down to the entry stairs and again switched the shield mode to off for level 4, then teleported to 1 square west of the "switch" that turns all doors to walls and vice versa. Noticed the flag was turned back on, so I turned it back off and stepped onto the square, waited for the doors and walls to switch, then took a look at fc08 again. It did NOT reset, which means that that square absolutely does not load a 2nd level 4.

My six-level theory is hereby declared disproven.

[Horpner]

Okay, so...for my dungeon editor thingamabobber, I will be including a subroutine to disable-enable shielding.

Only...I won't be able to do it on a level by level basis apparently, it'll have to be done externally somehow.

Any ideas?

It seems to be a higher-level function than you'll want to include in the current editor, which is designed only for editing a single level.

What you would need is an outer layer that allows you to choose things like how many dungeon levels you want, which ones are shielded, etc. But we don't know quite enough about those files yet to manage it. For now, I guess we leave that function out.

[Darendor]

Something as an aside, if you kill Mangar and his crew then teleport out of the level and back in and try to kill him again, the disk drive spins but nothing else happens.

I walked down to the mystery square after killing Mangar, and sure enough 2 Liches appeared. 1280 experience and 640 coins for a 6 member party...
The square promptly deleted itself after the fight.

[Horpner]

My six-level theory is hereby declared disproven.

On the bright side, I now know how specials are loaded. The specials table is just below the specials coordinates, and it contains numbers that tell the engine which program to load and run from disk. For example, the mystery square on the fifth level loads and executes the file NM35.PRG.

EDIT: That is not the right file name. I've verified that NM35.PRG contains the "Perseverance in all things" special. The file pointer is 35ff, so that was my first guess. Unfortunately, it was wrong.

The reason there's disk access when you flip-flop the doors and walls, is that a program is loaded from disk and executed. The program manipulates the map data in memory. Most likely these files contain machine language programs, but I have to take a look.

[Darendor]

Yup, the mystery square spawns 2 Liches for the party to fight after Mangar is dead.

However, the party isn't supposed to be able to trip the square in the first place because the door that the 3 shapes makes appear is one-way only, meaning that you can only teleport out from Mangar's antechamber.

I'll record a video and post it maybe.

[Darendor]

My six-level theory is hereby declared disproven.

On the bright side, I now know how specials are loaded. The specials table is just below the specials coordinates, and it contains numbers that tell the engine which program to load and run from disk. For example, the mystery square on the fifth level loads and executes the file NM35.PRG.

The reason there's disk access when you flip-flop the doors and walls, is that a program is loaded from disk and executed. The program manipulates the map data in memory. Most likely these files contain machine language programs, but I have to take a look.

I once again feel stupid.

[Horpner]

Yup, the mystery square spawns 2 Liches for the party to fight after Mangar is dead.

However, the party isn't supposed to be able to trip the square in the first place because the door that the 3 shapes makes appear is one-way only, meaning that you can only teleport out from Mangar's antechamber.

I'll record a video and post it maybe.

Holy shiyot! I was starting to think the Liches where an urban legend. But now I'm wondering how in heck anybody ever found them before? Maybe hackers struck at some time in the past.