Knightmare

Konami left two typos in its cosine tables. The cartridge carries two cosine quadrants to get the sine and cosine of an angle, and a cosine quadrant can only go down: these two go up once each, and the value that goes up is precisely the only one that departs from the function. There is also a cheat inside that asks for left and right at once -impossible on a joystick- and hands over twenty-six lives.

Konami - (c) Konami 1986 - An RC-739 32 KB cartridge - MSX1 - pages 1 and 2 - Dump 6e7a8a2d...

Not one capture here. Every picture is drawn from the bytes of the ROM, by running in Python the very same decompressors, mirrors and band builders the Z80 runs, and then checked byte for byte against openMSX's VRAM: the eight stages dumped from the emulator come out with zero differences in colour (6,144 bytes), patterns (6,144) and the 704 tiles of the map. The listing and the numbers are reproducible with make, and reassembling gives back the ROM byte for byte.

The cartridge in numbers

100%of the binary explained
985code blocks measured
22.4%of the listing commented
15,233bytes of code
17,535bytes of data
0bytes unidentified

What turned up when we took it apart

Konami left two typos in its cosine tables

The cartridge carries two cosine quadrants, one scaled to 255 (0x844E) and one to 128 (0x848F), and uses them to get the sine and cosine of an angle from 0 to 255. A cosine quadrant can only go down. These two go up once each, and the value that goes up is precisely the only one that departs from the function: entry 58 of the first is 0x2F where it should be 0x25, and entry 12 of the second is 0x74 where it should be 0x7A. The other 64 entries of each table fit the cosine with a mean deviation of 0.48 and 1.73. Two data typos, and a test now watches them.

A cheat that asks for left and right at once

0x6F44 is called exactly once, right after the game is reset. It wants the controller to read 0x2C in its low six bits -bits 2, 3 and 5: left and right at the same time plus the second button, which a joystick cannot do- and a key from keyboard rows 3, 4 or 5 as well. One of the three puts 26 lives into (0xE060); the other two touch the weapon in (0xE069).

The Game Master header declares eight stages and a routine of this very cartridge

At 0x4010 sits the second header, the one the Konami Game Master reads from the next slot: "CD" 07 39, that is RC-739. The 21 bytes that follow are laid out by a flags byte, and the layout works out byte for byte: it ends at 0x4024, exactly where code starts again. It declares the scene variable, the lives, the high score, the score, eight stages and one more address: 0x56C8, a routine of this cartridge that nothing inside it ever calls. What it does takes ten bytes: turn the stage the Game Master writes into (0xE061) into the internal index at (0xE062).

Each stage's sections overlap by exactly one band

The scenery is assembled in bands of four rows, and the bitmap that says when the block pointer moves on advances six bytes per section while seven are read. So the last band of one section and the first of the next come from the same byte. And not only from the same byte: the scenery they give is identical, checked on all nine joins of each of the eight stages.

Three palettes out of a single colour script

Stages 0, 3 and 7 share tiles and colour script. What tells them apart is (0xE661): the block reader (0x443B) translates five colour codes -0xE1, 0xEC, 0xE8, 0xE6 and 0xE5- by subtracting 0x50, and another 0x50 when the bank is 2. One 640-byte block gives all three sceneries. Stages 5 and 6 go further: they share tiles and colour, and differ only in the map.

The demo is a recorded game

0x5A73 pulls one byte out of 0x5A95 every eight frames and hands it to guarda_lo_recien_pulsado, the very door the joystick comes in through. That is 118 keypresses, some nineteen seconds at 50 Hz. The cp 0xFF that would end it never arrives: there is not a single 0xFF inside the block, and the demo is cut short some other way.

The eight stages, in full

Each one is a 256 x 1952 pixel strip, drawn from the ROM block by block; not one is a capture. They read bottom to top, which is how they are played. Drag sideways to see all eight.

<b>Stage 1.</b> The whole strip, top to bottom: 61 bands of four rows, assembled block by block. Read it bottom to top, which is how it is played, and the top band is the boss gate. The rivers and the bridges are NOT stage tiles: <code>monta_el_marcador</code> (0x565C) uploads them, the same in all eight.
Stage 1. The whole strip, top to bottom: 61 bands of four rows, assembled block by block. Read it bottom to top, which is how it is played, and the top band is the boss gate. The rivers and the bridges are NOT stage tiles: monta_el_marcador (0x565C) uploads them, the same in all eight.
<b>Stage 2.</b> The desert. It carries 61 tiles of its own, fewer than any other.
Stage 2. The desert. It carries 61 tiles of its own, fewer than any other.
<b>Stage 3.</b> The same tiles as stage 1, run through the translator at <code>0x443B</code> with <code>(0xE661)</code> set to one.
Stage 3. The same tiles as stage 1, run through the translator at 0x443B with (0xE661) set to one.
<b>Stage 4.</b> Stage 1's tiles again. All that changes is the palette: that is why the walls are pink, not grey.
Stage 4. Stage 1's tiles again. All that changes is the palette: that is why the walls are pink, not grey.
<b>Stage 5.</b> Brickwork. Stages 5 and 6 share tiles and colour and differ only in the map.
Stage 5. Brickwork. Stages 5 and 6 share tiles and colour and differ only in the map.
<b>Stage 6.</b> Stage 5's twin, with a different map.
Stage 6. Stage 5's twin, with a different map.
<b>Stage 7.</b> The water one, and the only one that loads nine extra tiles, at <code>0x2470</code> (0x553E).
Stage 7. The water one, and the only one that loads nine extra tiles, at 0x2470 (0x553E).
<b>Stage 8.</b> The castle, with the final boss waiting on the top band.
Stage 8. The castle, with the final boss waiting on the top band.
<b>Stage 1, with its objects.</b> The 36 records of the list at 0x6AF8 where they are born, already broken: in each question mark's place, what it drops (yellow scroll a life, cyan 500 points, blue bomb, red freeze; grey block; EXIT sign with its destination stage; bridge), framed white if the block is visible and dashed magenta if hidden. The cyan strips at the edges are the side passages.
Stage 1, with its objects. The 36 records of the list at 0x6AF8 where they are born, already broken: in each question mark's place, what it drops (yellow scroll a life, cyan 500 points, blue bomb, red freeze; grey block; EXIT sign with its destination stage; bridge), framed white if the block is visible and dashed magenta if hidden. The cyan strips at the edges are the side passages.
<b>Stage 2, with its objects.</b> 42 of them, and two exits: to 3 and to 4.
Stage 2, with its objects. 42 of them, and two exits: to 3 and to 4.
<b>Stage 3, with its objects.</b> 42, with the first three hidden bridges and the exit to stage 5.
Stage 3, with its objects. 42, with the first three hidden bridges and the exit to stage 5.
<b>Stage 4, with its objects.</b> 46: six bridges, nine grey blocks in rows of three and the exit to stage 6, the last one.
Stage 4, with its objects. 46: six bridges, nine grey blocks in rows of three and the exit to stage 6, the last one.
<b>Stage 5, with its objects.</b> 52, the most; no exits from here on.
Stage 5, with its objects. 52, the most; no exits from here on.
<b>Stage 6, with its objects.</b> 50, every one of them hidden.
Stage 6, with its objects. 50, every one of them hidden.
<b>Stage 7, with its objects.</b> 45, nineteen of them bridges: the water stage.
Stage 7, with its objects. 45, nineteen of them bridges: the water stage.
<b>Stage 8, with its objects.</b> 43, all hidden, and thirteen grey blocks.
Stage 8, with its objects. 43, all hidden, and thirteen grey blocks.

What the cartridge draws

Under each picture is where it comes from and what is on it.

The title screen, assembled by running the steps of <code>monta_el_titulo</code> (0x47BA). The big logo is 33 tiles -eleven by three- written by a loop starting at tile 0x60.
The title screen, assembled by running the steps of monta_el_titulo (0x47BA). The big logo is 33 tiles -eleven by three- written by a loop starting at tile 0x60.
The KONAMI banner of the intro, at the place it reaches after its fourteen steps.
The KONAMI banner of the intro, at the place it reaches after its fourteen steps.
The first screen of stage 1 with its scoreboard, exactly as it comes out of the emulator: the byte-for-byte check gives ZERO differences.
The first screen of stage 1 with its scoreboard, exactly as it comes out of the emulator: the byte-for-byte check gives ZERO differences.
Popolon's twelve frames. He is THREE sprites -two from the frame and one from the stage bank- and each frame takes exactly 64 bytes. The last four are the explosion.
Popolon's twelve frames. He is THREE sprites -two from the frame and one from the stage bank- and each frame takes exactly 64 bytes. The last four are the explosion.
The stage 1 boss, assembled from the SEVEN sprites declared by the table at <code>0x902D</code>, each with its own offset and colour.
The stage 1 boss, assembled from the SEVEN sprites declared by the table at 0x902D, each with its own offset and colour.
And the stage 3 one, which is NINE of them, from the table at <code>0x9338</code>.
And the stage 3 one, which is NINE of them, from the table at 0x9338.
The sixteen kinds of creature, one per block at <code>0xA993</code>. They do not fit at once: the cartridge reloads them into THREE slots of the sprite sheet (0x1D00, 0x1E00 and 0x1F00) as they are needed.
The sixteen kinds of creature, one per block at 0xA993. They do not fit at once: the cartridge reloads them into THREE slots of the sprite sheet (0x1D00, 0x1E00 and 0x1F00) as they are needed.
The 42 frames of the table at <code>0x7772</code>, each with ITS type's block loaded in the slot: without that the pattern byte is relative and draws nothing. The grey background is deliberate: nearly all of them are colour-1 silhouettes, that is black.
The 42 frames of the table at 0x7772, each with ITS type's block loaded in the slot: without that the pattern byte is relative and draws nothing. The grey background is deliberate: nearly all of them are colour-1 silhouettes, that is black.
The seven weapons of the table at <code>0x63FB</code>, a <code>[pattern][colour]</code> pair each. Only the last two animate, with four frames apiece.
The seven weapons of the table at 0x63FB, a [pattern][colour] pair each. Only the last two animate, with four frames apiece.
The seven frames of a shot leaving, from the table at <code>0x8250</code>, which <code>0x8231</code> indexes with the count.
The seven frames of a shot leaving, from the table at 0x8250, which 0x8231 indexes with the count.
And the raw material: the 37 fixed patterns <code>0x54BE</code> uploads at the start of every stage -the weapons, the shots and the items-. They are white because a sprite pattern has NO colour of its own: whichever table uses it supplies one, and the ones that have it are above.
And the raw material: the 37 fixed patterns 0x54BE uploads at the start of every stage -the weapons, the shots and the items-. They are white because a sprite pattern has NO colour of its own: whichever table uses it supplies one, and the ones that have it are above.