Nemesis

Konami's Gradius squeezed into a 128 KB MegaROM for the MSX1: twelve stages, thirty-one kinds of enemy and a power-up meter, with the maps built one column at a time in RAM.

Konami · © Konami 1986 · An RC-742 128 KB MegaROM, Konami4 mapper · MSX1 · 16 banks of 8 KB · Only 6 banks carry code

There is not one illustration or capture here. The screens and the twelve maps are drawn from the bytes of the ROM, by running in Python the same run-length decompressor, the same character loader and the same column builder the Z80 runs. The listing and the numbers come from the binary and are reproducible with make.

The cartridge in numbers

100%of the binary explained
916routines named
12stages drawn
25,471bytes of code
105,601bytes of data
23.4%of lines commented

What turned up when we took it apart

The stages are not played in order, and four of them are bonus

There are two ways out of a stage: acaba_la_fase adds one to the stage number, and salta_a_la_fase writes one straight in. EIGHT places jump to the second, each with its own number, and that gives the real running order: 1 - 2 - 9 - 3 - 10 - 4 - 11 - 5 - 6 - 7 - 12 - 8. Stages 9 to 12 are bonus stages: no boss, and their ending puts the stage back to 3, 4, 5 and 8. What opens them is the target at the end of the stage: 0xB130, the only instruction in the whole 128 KB that stops the screen, is the one the finals of stages 2, 3, 4 and 7 test.

This cartridge turns the VRAM map upside down

The eight bytes at 0x575A program the VDP registers and put nothing where the BIOS puts it: patterns live at 0x2000 and colours at 0x0000, the name table sits at 0x3800 and the sprite attributes at 0x3B00, right behind it. Anyone reading the addresses in this listing expecting the usual layout will get every one of them wrong.

The map is not on screen: it is in RAM, and it is scrolled by hand

The twenty-two rows of thirty-two cells live at 0xED00. On every scroll step 0x469D shifts them one column left with twenty-two ldirs, 0x46AE feeds the new column in on the right, and 0x47FE pushes all 704 bytes to VRAM with outi. The incoming column comes from the stage script: six piece numbers every four columns, each piece four by four characters. That is how the twelve maps below are drawn, without touching an emulator.

All the randomness in the cartridge is the Z80's R register

There is no seed and no generator. What stands in for chance is ld a,r, the refresh register, which counts on its own with every instruction: it decides which of the two star drawings goes into each sky column (0x4750), which of the sixteen doors each falling rock comes through (0xABC2), how many frames each drawing of the out-of-step blinking enemy lasts (0xB016 and 0xBC59) and how far the one that walks on the ground gets (0xAAE6).

Every enemy is one number and two routines

An object boils down to its type, 1 to 0x1F. That number drives two twin tables: the one at p00:0x5DFD says who moves it every frame and the one at p01:0x6B46 who finishes building it when it is born. Of the thirty-one types, twenty have at least one of the two in bank 3 and sixteen have both, which is why 0xA7B9..0xB537 is the longest stretch of code in the cartridge.

The spiral is done without sines: an eighth and a multiplication

Type 0x1D closes in a spiral around a centre, and there is no sine table for it: take the difference to the centre along one axis, divide it by eight with three sra a and add it to the other, then the same the other way round. That is a turn of about seven degrees per step. The radius shrinks separately, multiplying both coordinates by a byte that starts at 0xFF and drops by one every 0x3C frames.

The demo is not played by a clever machine: it is a recording

Bank 12 holds, per stage, a list of pairs [how many frames][what the joystick reads]. 0x5CDA walks it and drops the recorded value into 0xE009, the very byte where 0x5767 leaves what it reads from the real joystick, with the fire bit forced on. And it starts fully powered: 0x5CB8 calls the same routine the HYPER cheat calls.

The keyboard cheats are only read while the game is paused

0x44E7 watches the GRAPH key and, with the screen stopped, 0x50C9 collects letters into 0xE1E8 until RETURN is pressed; then what was typed is compared against the words at 0x51BF. Typing them while playing does nothing: the cheat keyboard only exists while the game is paused.

The checkpoint table falls one short: stage 12 reads code

The table at 0x4214 says which distance each stage restarts at if you had already got that far, and it is read with HL = 0x4212 and TWICE the stage number. It holds eleven entries: stage 1 takes the one at 0x4214 and stage 11 the one at 0x4228. Stage 12 reads at 0x422A, which is already code — the first two bytes of a call — and gets 0xBACD, that is 47,821. Since the scroll never gets anywhere near that distance, stage 12 always restarts at 0x20: the bug is real and its effect is nothing.

Konami's hidden mark: RC-742 and グラディウス

At the end of bank 3, at offset 0x07FFF of the dump, sit the cartridge code RC-742 and eight katakana characters that read グラディウス, that is Gradius. It is the signature Konami hid in its cartridges, and the person who found and documented it is Manuel Pazos.

What the cartridge draws

Under each picture is where it comes from and what is on it. The maps are the whole stage, end to end.

The attract screen, built the way the cartridge builds it: six compressed blocks from bank 9 into the three thirds of patterns and colours, the frame characters from bank 10, and the name table, 768 uncompressed bytes, from the start of bank 9
The attract screen, built the way the cartridge builds it: six compressed blocks from bank 9 into the three thirds of patterns and colours, the frame characters from bank 10, and the name table, 768 uncompressed bytes, from the start of bank 9
The title screen proper, which is a different one: monta_la_pantalla_del_titulo (0x5B31) decompresses its patterns from 0x9C57 and its colours from 0x9EAB into the three thirds, and on top of that escribe_el_panel_del_titulo (0x5B77) writes the logo panel, five rows of 28 characters from cell 0x3882
The title screen proper, which is a different one: monta_la_pantalla_del_titulo (0x5B31) decompresses its patterns from 0x9C57 and its colours from 0x9EAB into the three thirds, and on top of that escribe_el_panel_del_titulo (0x5B77) writes the logo panel, five rows of 28 characters from cell 0x3882
THE SAME BINARY CARRIES BOTH NAMES. This is the other panel, the one at 0x9BCB, drawn just like the one in the header. The cartridge reads the machine's character set from 0x002B of the BIOS and, with the low nibble at zero -a Japanese machine-, writes this one; with anything else, the one at 0x9B3F, which reads NEMESIS. These are not two versions of the cartridge: the two panels sit right next to each other in bank 9
THE SAME BINARY CARRIES BOTH NAMES. This is the other panel, the one at 0x9BCB, drawn just like the one in the header. The cartridge reads the machine's character set from 0x002B of the BIOS and, with the low nibble at zero -a Japanese machine-, writes this one; with anything else, the one at 0x9B3F, which reads NEMESIS. These are not two versions of the cartridge: the two panels sit right next to each other in bank 9
The whole of stage 1. The first 0x80 steps are sky -one star per column, on the row the table at 0x478E gives- and from there the script takes over: the ground with volcanoes and vegetation, and the ceiling
The whole of stage 1. The first 0x80 steps are sky -one star per column, on the row the table at 0x478E gives- and from there the script takes over: the ground with volcanoes and vegetation, and the ceiling
Stage 2: stalactites and stalagmites, and the stone structures at the end. All of it comes from the same set of pieces at 0x8000 of bank 11
Stage 2: stalactites and stalagmites, and the stone structures at the end. All of it comes from the same set of pieces at 0x8000 of bank 11
Stage 3. There is no terrain at all here: its script range is 0xFFFF, so 0x46AE always goes to the star routine and the whole stage is sky. The same happens with the sixth
Stage 3. There is no terrain at all here: its script range is 0xFFFF, so 0x46AE always goes to the star routine and the whole stage is sky. The same happens with the sixth
Stage 4, the crystal one
Stage 4, the crystal one
Stage 5. It is the only one with its own background engine -0xB2AA, in bank 3- and it uses the other set of pieces, the one at 0x8FF0. Most of what moves in it is not in the map at all: they are rectangles of characters erased and repainted every frame
Stage 5. It is the only one with its own background engine -0xB2AA, in bank 3- and it uses the other set of pieces, the one at 0x8FF0. Most of what moves in it is not in the map at all: they are rectangles of characters erased and repainted every frame
Stage 6. The other pure-sky stage, like the third one
Stage 6. The other pure-sky stage, like the third one
Stage 7, the only one with its spawns written out one by one: forty-three words at 0xAF3F, each with nine bits of distance, five of row and two of variant
Stage 7, the only one with its spawns written out one by one: forty-three words at 0xAF3F, each with nine bits of distance, five of row and two of variant
Stage 8, the cell maze one
Stage 8, the cell maze one
Stage 9, the first of the four BONUS stages: you get in by touching the target at the end of stage 2, and it drops you into stage 3
Stage 9, the first of the four BONUS stages: you get in by touching the target at the end of stage 2, and it drops you into stage 3
Stage 10, a BONUS stage: entered from stage 3 and leaving into stage 4
Stage 10, a BONUS stage: entered from stage 3 and leaving into stage 4
Stage 11, a BONUS stage: entered from stage 4 and leaving into stage 5
Stage 11, a BONUS stage: entered from stage 4 and leaving into stage 5
Stage 12, a BONUS stage: entered from stage 7 and leaving into stage 8, the last one
Stage 12, a BONUS stage: entered from stage 7 and leaving into stage 8, the last one
The 256 characters of each of the three thirds stage one is drawn with, just as the loader at 0x42FC leaves them. In the third one you can read the power-up meter labels: <code>SPEED UP</code>, <code>MISSILE</code>, <code>DOUBLE</code>, <code>LASER</code> and <code>OPTION</code>
The 256 characters of each of the three thirds stage one is drawn with, just as the loader at 0x42FC leaves them. In the third one you can read the power-up meter labels: SPEED UP, MISSILE, DOUBLE, LASER and OPTION
And the ones for the end of the game, which come from bank 10. The name table of that screen is almost unused: the only thing written over it is the four-by-four drawing from the stream at 0x4FB2
And the ones for the end of the game, which come from bank 10. The name table of that screen is almost unused: the only thing written over it is the four-by-four drawing from the stream at 0x4FB2
The 16x16 sprite patterns decompressed into VRAM 0x1800. The first three are the ship with its three tilts; behind them come the options, the shots, the explosions and the enemies
The 16x16 sprite patterns decompressed into VRAM 0x1800. The first three are the ship with its three tilts; behind them come the options, the shots, the explosions and the enemies