Demonia

A game that does not fit in the visible RAM of an MSX and hides twenty-six kilobytes underneath the BASIC ROM. And inside, stowing away, a 1984 machine code monitor by the same author: its back door still wired up, its command table buried under the game's own data, and in the single-step buffer the last instruction it ever ran before someone saved the tape.

Microids · 1986 · Tape, 58,334 bytes · MSX1 · 64 KB · Signed: (C) 1986 PAR SABLATOU CLAUDE

There is not a single screenshot here. Every picture is drawn from the tape: a tool replays the game's own decompressor over the compressed maps and then develops each tile the way the VDP would, with its patterns and its colours. The screens coming out right is the proof that the routines have been understood. The listing and the numbers come from the binary and are reproduced with make.

The tape in numbers

100%of the tape explained
13listings
1,308routines identified
20,299bytes of code
37,597bytes of data
0bytes unidentified
33.0%comment density
26screen maps drawn

What turned up when we took it apart

A 1984 machine code monitor stows away inside the game

From 0xC000 onwards, inside the game block, sits a whole program that is not the game: a machine code monitor with its command interpreter, its disassembler, its single-step, its register dump and its error messages in French. That is 4,377 bytes, 7.5% of the tape.

It is signed, at 0xD948: Auteur:Claude SABLATOU, MONITEUR MSX, Copyright (C) 1984 LORICIELS. And the game's title screen, read by decompressing the map at 0x4281, says (C) 1986 PAR SABLATOU CLAUDE. The author left his own working tool inside: a 1984 Loriciels monitor riding along in a 1986 Microids game.

And its back door is still wired up

The monitor's entry point, 0xC924, really is called from the game's own code, at 0x9C6D:

9C6D  3A 9B FC    ld a,(0xFC9B)   ; INTFLG
9C70  FE 03       cp 3
9C72  CC 24 C9    call z,0xC924   ; and into the monitor

0xFC9B is INTFLG, where the BIOS records that STOP was pressed, and 3 is the value for CTRL+STOP. There is a second, loose call 0xC924 at 0xAA95 that no branch reaches any more.

Measured: the bytes and what 0xFC9B is. That the intent was to leave a door open is a reading, not a fact.

But the monitor no longer obeys anything

It recognises its commands by looking the typed initial up in a table of fifteen three-byte entries starting at 0xD5C6 (ld hl,0xD5C6 / ld b,15, at 0xC28D). There is no table at 0xD5C6.

The game's 24 screen records run from 0xD0C0 to 0xD8FF, 88 bytes each, and 0xD5C6 lands in the middle of record 14. The game's data was written straight over the command table. With all fifteen keys zero, any keypress walks the fifteen entries in vain, prints Commande illegale and asks again: the monitor boots, paints the registers and does nothing else. That accounts for 2,094 bytes of code nobody can reach.

The fossil: the last instruction that monitor ever ran

Single-stepping works by copying the stopped program's instruction into a four-byte buffer at 0xCC5F and running it there. 0xCBB9 clears those four bytes before every step, so what was left recorded on the tape is the last thing that went through it:

CC5F  2A 78 80 00      ld hl,(0x8078)

And 0x8078 falls inside this very game's variable page.

Measured: the four bytes, that 0xCBB9 clears them and 0xCBDB fills them, and where 0x8078 lands. That it was a debugging session on this game fits, but the binary does not say so.

Twenty-six kilobytes hidden underneath the BASIC ROM

The game does not fit in the RAM an MSX booted into BASIC can see. What it does is look for a 64 KB slot and put 26 KB into pages 0 and 1, underneath the ROM.

The seven blocks the tape carries behind the loader are not run where they land: each one has a little routine glued to it that switches the slot, does an LDIR and switches it back. That is why there are thirteen listings here and not seven, and why verify takes two passes.

The five hidden chunks match the RAM of a running openMSX byte for byte, and also the RAM snapshots inside a replay recorded on a different machine. Two independent measurements.

Two files with the same name, and a :RUN that tells them apart

The tape holds three named files and all three are called DEMON: the BASIC loader, a 249-byte BIN loading at 0x8180 and a 24,576-byte BIN loading at 0x8000.

Line 50 of the loader is BLOAD"CAS:DEMON",R:RUN. Since tape is sequential, the first pass finds the small BIN — the loader for the seven blocks — and, after the RUN, the second pass finds the big one, which is the game. They share a name on purpose.

The title screen says DEMONIA, and it had to be drawn to see it

Dump the title map as text and only two rows read back: L'INTRUSION on row 17 and (C) 1986 PAR SABLATOU CLAUDE on row 19. Everything else comes out as dots.

It is not that there is nothing there: the title is made of graphic tiles, not ASCII. Drawn with its patterns, the screen spells DEMONIA in huge letters across the first eight rows, with a small L'INTRUSION underneath as a subtitle. That is the wordmark at the top of this page, cropped straight out of it.

And things that have not run since 1986

0x9134: the same instruction written twice, ld hl,0x8058 followed by ld hl,0x8058. Three bytes that do nothing.

Eight bytes of impossible conditional returns: 0x823A has three ret nc in a row, and 0x8C3E and 0xBFE3 have pairs and triples of ret nz. When two return on the same condition, the second never gets to run.

Fifty bytes of NOP inside live code, in eleven runs. The two runs of six at 0xDC01 and 0xDC12 sit immediately before and after an LDIR that copies tables into the hidden RAM: exactly where a slot switch someone removed would have gone.

What the tape draws

Under each caption is the address it comes from. They are all rebuilt by make imagenes and no emulator is needed.

DRAWN from 0x4281 — the title screen. DEMONIA across the first eight rows, in graphic tiles; underneath, small, the L'INTRUSION subtitle and the author's signature
DRAWN from 0x4281 — the title screen. DEMONIA across the first eight rows, in graphic tiles; underneath, small, the L'INTRUSION subtitle and the author's signature
DRAWN from 0x4000 — the first title-screen map, with no wordmark. The table at 0xD000 does not point at it: the title screen is built in three passes
DRAWN from 0x4000 — the first title-screen map, with no wordmark. The table at 0xD000 does not point at it: the title screen is built in three passes
DRAWN from 0x418A — the title screen almost entirely tile 0. This is the intermediate step that clears the screen before the wordmark goes on
DRAWN from 0x418A — the title screen almost entirely tile 0. This is the intermediate step that clears the screen before the wordmark goes on
The game screens, drawn one by one from the compressed maps between 0x43DE and 0x5468 and laid out together. The graveyard up top, the caves below. That is 24 entries in the table at 0xD000 but only 23 distinct maps: screens 13 and 14 point at the same one
The game screens, drawn one by one from the compressed maps between 0x43DE and 0x5468 and laid out together. The graveyard up top, the caves below. That is 24 entries in the table at 0xD000 but only 23 distinct maps: screens 13 and 14 point at the same one
DRAWN from 0x43DE — the first screen: the door, a headstone and the grass over red earth. 204 compressed bytes yield all 640 tiles
DRAWN from 0x43DE — the first screen: the door, a headstone and the grass over red earth. 204 compressed bytes yield all 640 tiles
DRAWN from 0x48FA — 334 compressed bytes, one of the most expensive on the tape. The brick galleries, with their stalagmites
DRAWN from 0x48FA — 334 compressed bytes, one of the most expensive on the tape. The brick galleries, with their stalagmites
DRAWN from 0x451D — the cheapest map on the tape: 81 bytes. The more a tile repeats, the less the map costs
DRAWN from 0x451D — the cheapest map on the tape: 81 bytes. The more a tile repeats, the less the map costs
DRAWN from 0x4E54 — 347 bytes, the longest of the 26. The red ladder and the water are tiles like any other: there are no objects, only the map
DRAWN from 0x4E54 — 347 bytes, the longest of the 26. The red ladder and the water are tiles like any other: there are no objects, only the map