There is not one screenshot here. Every picture is drawn by repeating what the cartridge does: video memory is rebuilt with its own copies and then the calls that paint each thing are replayed. Everything else —the listing and the numbers— comes from the binary and is reproducible with make.
INIT writes jp 0x4038 into the H.KEYI hook and drops into a two-byte jr $ at 0x419B. That empty loop is the main program: from then on everything —the sound, the sprites, the controls and one step of the game— happens inside the interrupt, one step per frame, and 0xE005 is the lock that keeps a slow step from cutting the music.
0x7253 picks the position of the ? by subtracting a random 0-15 from the value of the equation's first digit. With a 9 in front it can land on any of the first ten positions; with a 1 in front, only in the first operand.
Measured in the emulator with 400 level-1 equations: zero exceptions, 238 with the ? in the first two positions and only 67 in the result.
All that tells one level from another is three to five bytes at 0x712B: 0A 0E (+ =), 0B 0E (− =), 0D 0E (÷ =), 0C 0E (× =) and 0C 10 0A 11 0E (× ( + ) =). The generator decides the rest on seeing the symbol, in BCD: division is built from the quotient and multiplication is repeated addition.
And a random choice of alternative scripts is cancelled with a xor a (0x6FBC): always the first one.
You pick it by jumping into it (100 points) and throw it with the button the way you face, along one of the two arcs at 0x742F/0x7451. A fruit in the air kills whatever it hits: the crab, which shows a 500, or the monkey.
Only the third crab jumps (0x616F), so only it grabs and throws fruit, and that is why a fruit carried by a crab always follows the sprite at 0xE0C8: the code takes it for granted.
INIT copies six sprites to 0x1800 and then the 22 to 0x18C0 without reloading HL: COPIA_A_VRAM preserves it. The game uses the second set —the monkey is pattern 0x18, the crab 0x30— and the first six get overwritten by whichever sprite set is due: normal, fruit on the head, or holding the card.
The professor top right is the player's monkey in dark red, and the one that brings the answer by balloon on the third miss is the same monkey climbing, mirrored, in cyan.
The three entries for 0xA1 in the track table point at the same 0xFF: three mute tracks that shut the three channels. And the effects belong to the monkey: an actor other than the monkey can only request number 9, the crab dying (0x78F7). Crab footsteps and jumps make no sound.
Each of these pictures is a routine of the cartridge replayed outside it: the tiles are loaded the way the ROM loads them and then whatever paints them is called, with its own pointers and its own video addresses. Under each caption is the address of the routine that draws it.
