What the cartridge draws
Under each caption is where it comes from. They are all rebuilt by make imagenes, no emulator needed.
The gallery has no screenshots. The graphics are drawn from the ROM's bytes: tools/graficos.py rebuilds video memory with the same copies the cartridge makes and decompresses its runs with the same format the Z80 runs. The three emulator captures there are say so in their caption. The listing and the numbers come from the binary and are reproduced with make.
Three blocks — 0x6718 (16 bytes), 0x6AA6 (251) and 0x6BF6 (172) — are, byte for byte, background lists and tiles from Athletic Land, the house's earlier cartridge, moved here by +1,724, +1,002 and +1,027.
And they are unused: not one instruction points at them, and their addresses appear in no table. This game is that engine recompiled — 68.5% of its instructions line up one to one — and 439 bytes of scenery came along in the move with nothing left to draw them. The same goes for the dead routine at 0x44D2, which is the same one it has there.
The menu does not lead straight into play: two screens come first. On the first you choose the kid with two bytes, 0xE05B and 0xE05C, which give the row and column of each half of the figure (0x78C9 places five sprites from them). On the second you type the name: ten letters at 0xE05D, cycled round between blank and Z (0x7968).
Out of the factory it says ANNA LEE, and it is written into the player's start-up values at 0x44A3, next to the lives and the time. With two players the screen comes round twice: each names their own (0x426B).
INIT (0x404F) writes jp 0x402C into the H.KEYI hook and drops into a jr to itself forever. From there, every frame the interrupt plays the sound, reads the controls and runs one step of whatever state 0xE000 names.
And it carries a latch, 0xE005. If a step takes longer than a frame, the next interrupt only moves the music along and leaves (0x404C), so the game slows down instead of tripping over itself.
0x4082 is not handed the table: it finds it. It does add a,a / pop hl, and that pop picks up the return address, which is exactly where the word table starts. Then it jumps with jp (hl) and never comes back to the call.
There are five such tables: the game's 20 states (0x4144), the menu's six steps (0x41F8), the player's 17 states (0x6016) and two of four for the set-up screens. Each closes exactly against its lowest destination, and that is what gives its size.
Since the dispatcher never returns, there is no way to chain anything behind it… except to leave it there first. 0x4131 loads HL with one of two addresses — 0x4735 with a game in play, 0x40C1 without — and does push hl: the state's ret lands there.
Miss that and the tracer never reaches those two routines, and they come out of the listing as if they were data. That is 138 bytes of code: the blinking of the player label and the menu's key reading.
The drawing unpacker needs ld (IX+A),B — a variable displacement — and the Z80 only takes a fixed one inside the opcode. The cartridge's answer is to write the displacement byte as it goes: seven bytes copied into RAM that do ld (0xE5FD),a and then ld (ix+00h),b, where 0xE5FD is exactly the operand of that second instruction.
Many of the house's cartridges hide their catalogue number and the title in katakana at the end of the ROM; Manuel Pazos (@ManuelPazosMSX) found it, and it is thanks to him that anyone knows to look. Here it is absent: behind the filler there is sound-player data and no 0xAA to close the mark. RC-716 comes from the catalogue, not from the binary.
Under each caption is where it comes from. They are all rebuilt by make imagenes, no emulator needed.