There is not one illustration or capture here. The wordmark and every screen are drawn from the bytes of the ROM, by running in Python the same decompressor and the same painters the Z80 runs, and checked byte for byte against openMSX's VRAM. The listing and the numbers come from the binary and are reproducible with make.
It copies the neighbouring cartridge's first 256 start-up bytes into RAM, reading them through RDSLT, and looks there for the sequence 9B FD: the operand of ld (0xFD9B),hl, the instruction a Konami game uses to install its interrupt routine into the H.KEYI hook. It replaces that with five bytes (0x4CB9) and the instruction becomes ld (0xD130),hl + call 0xD814: the game's own hook is saved and the Game Master has the control. Then it runs the patched copy, not the original.
It works across the whole catalogue because every Konami cartridge starts the same way. Checked over the 42 cartridge ROMs in the collection: all 40 Konami ones carry that instruction in the 256 bytes of their INIT. The only two that do not are Casio World Open — not a Konami title — and the Game Master itself.
First it checks whether the neighbour carries the second header at 0x4010, the one starting with AB or CD. Only five of the 42 ROMs in the collection have it. For everything else it adds up the 256 bytes from 0x5000 to 0x50FF of the neighbour's ROM and looks that 16-bit sum up in the table at 0x5F3A: 62 entries pointing at 29 stand-in headers of 19 bytes for 28 games — the table carries each game's alternative builds.
The table has been checked: of the 28, 25 were verified by actually summing the bytes of their ROMs. The other three have no ROM here and come from the manual, and binary and manual agree even in the gaps: neither has RC-719, RC-722 or RC-726.
The cheat table at 0x5B02 gives one routine per game, and two pairs share theirs. One is RC-710 and RC-711, the two Hyper Olympic titles, told apart inside by their catalogue number. The other is RC-700 and RC-716: as far as the Game Master is concerned, Athletic Land and Cabbage Patch Kids are the same program and get the same variables poked. That is exactly what was measured when the second one was disassembled — now said by Konami itself.
The cartridge cannot paint on the game's screen without ruining it, so it signals with the keyboard light: 0x4E70 calls CHGCAP every time the game is frozen or resumed. And freezing really does silence the PSG: 0x4E85 saves the three channel volumes before zeroing them, and 0x4EF8 puts them back.
There is a rarely seen saving in there too: 0xD12D holds the channel C volume and is also the low byte of the IY used for inter-slot calls. It works because CALSLT only looks at IYh.
The Game Master sits in page 1. The game it is cheating sits in page 1 as well, in another slot: the two cannot be switched in at once. The whole cartridge is built around that fight. Six blocks of code are copied into RAM and executed there, because switching the slot from ROM would be sawing off the branch you are sitting on.
That forces careful reading: the absolute addresses inside those blocks point at where they run, not where they are stored. The tracer carries a directive (!reubica) to follow them, and with it the trace went from 52.9% to 60.0%.
The disk and tape menus only clear 0x100 bytes from 0x3A00, that is the bottom eight rows: everything else stays as it was. And before that, 0x4275 calls the routine that carries the game's VRAM into RAM so it can be put back. So on a real machine the top half of those screens is the game still running, not a cartridge backdrop.
Four fragments (0x6445, 0x6787, 0x6904 and 0x6938) disassemble to correct Z80, start right after a ret and end right where a label that is used begins. But there is not one 16-bit reference nor one relative jump landing on them, searched across all 16,384 bytes. Plus two two-byte doors (0x5022 and 0x6FB5), each a ld b,N put there to enter the neighbouring routine with a different value, that nobody jumps to. They are leftovers from an earlier build: there are three of this cartridge.
In the last 22 bytes: RC-735 and 19 katakana bytes reading 10バイタノシムカートリッジ — "the cartridge for ten times the fun" — which was its slogan. The format was discovered by Manuel Pazos (@ManuelPazosMSX). As a bonus, this mark confirms that 0xBA is the ー lengthener, which had been left open until now.
Under each picture is where it comes from and what is on it.
© KONAMI 1986 that dates the build, and the six sprite attributes. Checked against openMSX's VRAM: of the 16,384 bytes the only one that differs is 0x39A9, and it is not a mistake — it is the cursor blinking
KONAMI