There is not a single screenshot here. The screens are drawn by running in Python the same routines the cartridge runs on the Z80: its decompressor, its painter and its masked painter. The rest —the listing and the numbers— comes out of the binary and is reproduced with make.
The finding is Manuel Pazos’s, who told it at a talk; what this disassembly adds is where it is written and the exact rule. p02:81EE bumps a counter every time you enter pause, and when stage 24 ends p02:82DE takes its low two bits and subtracts one: if nothing is left, the princess comes out alive.
So you have to have paused 1, 5, 9, 13… times —the remainder of dividing by four has to be 1— and never pausing gives you the bad ending. The count survives losing a life, but CONTINUE wipes it. Both texts are in the ROM: YOU HAVE SUCCEEDED IN RESCUING THE PRINCESS and YOU HAVE FAILED TO RESCUE THE PRINCESS.
You type them on the title screen and they turn on CONTINUE, which does not exist without them. p02:9522 watches NINE keys with the BIOS SNSMAT and keeps the last six pressed in a queue; p02:9634 compares them against two six-byte patterns. And the nine watched keys —A, I, K, M, N, O, R, U and Z— are exactly the letters needed to spell those two names and no others.
They do not do the same thing: NORIKO leaves 0xFE in 0xF0F7 and KAZUMI 0xFF, and with exactly 0xFE the game-over wipe skips 143 bytes, so NORIKO also keeps what you are carrying.
The gambling machine's reels take their symbol from the Z80's R register —the memory refresh counter— masked to four bits, and use that index into the sixteen-entry table at 0x7B34. The cherry takes five of the sixteen slots: 31.2 % per reel, and at least one on 67.5 % of the spins.
And the payout code at p01:7AF0 treats it apart: every reel showing a cherry bumps a counter, and the first three multipliers in the table are 1, 2 and 4. Every other symbol pays only on three of a kind: ×8, ×10, ×15, ×20 and the jackpot. It is the classic cherry rule, written in Z80.
Falling into the middle of a mode 3, 4 or 5 crevasse (p01:72F2) opens the shop, and the mode is the shopkeeper. All three sell the same —the stage's seven-item list, 0xAF90— but each with his own price table: the usual one (0x6FD5), the double one (0x6FE5, except item 7, which goes from 17 to 32 and not 34) and Santa Claus’s, all zeros (0x6FF5), who closes the shop after the first purchase (p01:6F09): he gives one thing away. There are 41 shops on 18 stages: 18 usual, 20 expensive and three Santas, on stages 6, 12 and 21.
And every shopkeeper talks: MAY I HELP YOU? GET WHATEVER YOU LIKE., HEY YOU! YOU MUST BUY SOMETHING FROM ME!! and WELCOME! I WILL GIVE YOU A JEWEL.; press END and they say goodbye, the angry one with BUY MORE! WAIT! DAMN IT!!. The six screens are drawn from the tables and checked against 14 openMSX dumps: zero differences.
The warnings script at 0xB046 turns the object that comes out after its distance into a crevasse and attaches two bytes: the mode and the list. With mode 2, falling in and pressing down (p02:999C) leads to the WARP, a 0x150-step run through backdrop 9, and when it ends p03:B94A reads the 17-byte record at 0xB79B picked by the list and adds stages. There are six: 1 to 6, 6 to 9, 9 to 12, 13 to 15, 15 to 18 and 18 to 21, all six measured in openMSX. And on the map before every stage they show up as dotted roads (0x8D85).
Thirteen is what the cartridge declares to the Konami Game Master in its second header, the one at 0x4010. The game says otherwise: p02:8328 compares the stage with 0x19 and the three script tables —terrain, creatures and the third one— close at exactly 24 entries. And LEVEL 2 is a whole different design, without a single matching section.
0xE08B is not the stage length: it is the time. p02:922D takes one off it every 32 frames whether you move or not, below 0x15 it beeps every other frame, and when the stage ends p02:94D1 turns it into points 0x20 at a time. What goes down with the terrain is something else, 0xE08D, and the nine end-of-stage cues come from it.
Which is why the item at p03:B31E, which adds 0x50 in BCD, does not make the run longer: it gives extra time. It is the only thing in the whole cartridge that touches that counter once the stage is up.
The 24-step circle and the 32-step parabola are written in the ROM and read back. But to aim at the player, bank 9 does real trigonometry: p09:ACE3 is a 16-by-8 division by subtract-and-shift —the Z80 has no div— and p09:ACBA an arctangent that looks the quotient up in a table of eight tangents in 8.8 format, 11.25 degrees apart. The angle comes out in the house's 256 units of a circle.
With a semaphore at 0xE005. No static tracer follows that: it is where 14 KB of invented code in banks 12 and 13 came from, and they had to be declared by hand. The 0xFF padding at the tail of a bank does something similar: 0xFF is rst 38h, so the tracer walked out into the neighbouring bank through the back door.
None of these images is a screenshot: tools/graficos.py draws them from the ROM.