Pitfall! (1984)

A 16 KB cartridge from 1984, taken apart byte by byte. There's no map stored inside it: the jungle's 255 screens are made up as it goes by an eight-bit register, and the 32 treasures are exactly the 32 scenes of one type.

Activision · 1984 · A 16 KB cartridge · MSX1 · page 2 · Dump 4d899d62…

The optimal route is a calculation, not a recorded game. The 189 screens of the walkthrough come from walking the world the cartridge generates with its own rules, counted in SCREENS CROSSED: the clock, jumping and dodging are not in it, and ladders are counted as free. Everything else —the listing, the numbers and the map— comes from the binary and is reproducible with make.

The game in numbers

100%of the binary explained
255scenes in the world
32treasures hidden
9,467bytes of code
6,917bytes of data
0bytes unidentified

What turned up when we took it apart

The world isn't stored, it's generated

There is no map in the cartridge. The 255 screens come out of a single byte, 0xE222, a feedback shift register: the seed is 0xC4 and the feedback taps are bits 7, 5, 4 and 3. Leaving to the right, 0xB68F steps it forward; leaving to the left, 0xB69F —its exact inverse— steps it back.

Those eight bits carry the three decisions of every screen: two bits pick the scenery, three the kind of scene and three the variant. The ring is maximal —255 states, with 0x00 left outside it and used by the title screen— and the simulation agrees with the emulator on all 255.

The 32 treasures are exactly the 32 scenes of one kind

Type 5 is the only one dispatched through table 0xAEA4, which holds four routines repeated two by two. Since the eight variants share out four scenes each, every class of treasure comes up eight times: 8+8+8+8 = 32, and not one more.

Each routine writes what its own is worth into 0xE188 —2, 3, 4 or 5, that is thousands of points— so the whole world holds 8·(2000+3000+4000+5000) = 112000 points. With the 2000 the score starts at, 114000: the ceiling of the game.

A treasure already taken has its return address eaten

What has been picked up is remembered in 32 bits, 0xE21D-0xE220: one byte per class of treasure and one bit per treasure. Before drawing one, 0xAAFF rotates its bit out into the carry.

And if it was set, there's no branch and no flag: it does pop hl and ret. It swallows its caller's return address, and the routine that was going to draw the treasure never runs.

The tunnel crosses the world three times as fast

Changing screen is 0x9CBE's job: when the player's X reaches the right-hand edge it puts him back on the other side and steps the screen register on. But it steps on one place or three depending on bit 0 of 0xE2EB, which is what says whether you're up on the surface or down in the tunnel. The left-hand routine is symmetrical.

The route that collects the 32 treasures goes down whenever it can: 189 screens with the tunnel against 238 never going down, 21 % fewer. The only way down is a ladder, and the ladders are measured over the 255 captures: the 63 scenes of kinds 0 and 1.

The vine is computed, not stored as a picture

The vine is painted every frame, and it's the code that paints it: what the cartridge doesn't carry is a drawing of it. On every step, 0xA471 traces a sixteen-point straight line onto a bitmap at 0xE18A and sends it to video memory as a sprite pattern. The slope comes from the table at 0xA61A, indexed by the phase of the swing, which runs up and down between 1 and 0x20.

There isn't one written word in this cartridge

Not a string, not an alphabet, not a hidden message. The font the game loads is ten digits, the colon and a blank: enough for the score and the clock, and not enough for a single letter.

Everything that looks like text —the title banner and the Copyright 1982, 1984 at the foot— is drawing, cut into tiles, one per position. That's why searching the ROM for strings returns nothing readable, and why that one line at the foot, with its two dates, is the only thing the cartridge signs.

The eight kinds of scene

Emulator captures, but not of anyone playing: it is told what to put in the screen register and asked for a photograph of each scene. Here is one of each kind, picked by crossing the register value with the table that comes out of the cartridge: get that reading wrong and what sits under each caption would be something else.

Type 0 · 0xA9AA — pits in the ground, with a ladder down to the tunnel. Bit 7 of the screen register splits the type in two: one pit or three
Type 0 · 0xA9AA — pits in the ground, with a ladder down to the tunnel. Bit 7 of the screen register splits the type in two: one pit or three
Type 1 · 0xA9AA — the other half of the pits, and the other half of the ladders: types 0 and 1 hold the 63 ways down there are
Type 1 · 0xA9AA — the other half of the pits, and the other half of the ladders: types 0 and 1 hold the 63 ways down there are
Type 2 · 0xAC7C — a tar pit, with a vine. The same drawing as type 3 in another colour: it writes 1B 1B 1B into the colour table
Type 2 · 0xAC7C — a tar pit, with a vine. The same drawing as type 3 in another colour: it writes 1B 1B 1B into the colour table
Type 3 · 0xAC6B — a water pool, which is that colour patch undone: 7B 7B 7B where type 2 put 1B 1B 1B, and a vine as well
Type 3 · 0xAC6B — a water pool, which is that colour patch undone: 7B 7B 7B where type 2 put 1B 1B 1B, and a vine as well
Type 4 · 0xAD75 — a lagoon with three crocodiles: three four-byte blocks in the code, three crocodiles on screen. Half of these scenes carry a vine, and it is the variant that decides, not the type
Type 4 · 0xAD75 — a lagoon with three crocodiles: three four-byte blocks in the code, three crocodiles on screen. Half of these scenes carry a vine, and it is the variant that decides, not the type
Type 5 · 0xADF6 — the treasure scene, the only one that scores. There are 32 of them in the ring, eight of each value
Type 5 · 0xADF6 — the treasure scene, the only one that scores. There are 32 of them in the ring, eight of each value
Type 6 · 0xAE04 — tar with a vine, and the vine is traced point by point on every step
Type 6 · 0xAE04 — tar with a vine, and the vine is traced point by point on every step
Type 7 · 0xADE8 — water with NO vine: it is the only one of the pool family that never calls monta_la_liana, neither directly nor by table
Type 7 · 0xADE8 — water with NO vine: it is the only one of the pool family that never calls monta_la_liana, neither directly nor by table