There are two kinds of picture here and they are not mixed. The tiles, the sprite drawings and the Konami logo are reconstructed: they are drawn by a tool that repeats, instruction by instruction, the cartridge's two drawing interpreters over an empty video memory. The screens are openMSX screenshots, and their captions say so; the title above is cropped from one of them. The listing and the numbers come from the binary and are reproducible with make.
tools/comun_konami.py indexes every twelve-byte chunk of one cartridge and looks for it in the other, stretching each match as far as it goes. With the tool's threshold —24 bytes in a row— Super Cobra gives 400 bytes in common with Athletic Land, 287 with Monkey Academy, 239 with Antarctic Adventure… and zero with Frogger.
The 28 bytes that turn up against Time Pilot are not code either: they are the small KONAMI logo at 0x43BE, a drawing. Konami had two different frameworks running at once, and these two 1983 cartridges are one of each.
It is the biggest thing the two share, and there is no single offset that aligns them. Dropping the threshold to eight bytes, of the 320 in 0x5D30–0x5E70 there are 177 —55.3 %— inside an identical run, spread over six runs whose offsets range from 0x1B0B to 0x1B28.
An offset that drifts 29 bytes along the same block is the signature of code with pieces added and removed in the middle, not of a copy and paste.
SUBE_FUENTE (0x4AA0) does ld hl,(00004h). That address is CGTBL, the pointer to the font the BASIC ROM keeps there, and 0x180 bytes are uploaded from it: 48 characters, from 0 to _.
Neither the score digits nor the menu words are Konami artwork. And they are uploaded twice, at two different offsets and in two different colours, because in SCREEN 2 colour goes per pattern line and the same character cannot have two colours.
PINTA_DIBUJO is at 0x4068 and BORRA_DIBUJO two bytes earlier, at 0x4064. The only difference is what they load into C: 0xFF one, 0x00 the other. Down in the loop there is an and c (0x4076) which with 0xFF leaves the byte alone and with 0x00 turns it into zero.
The game really uses it that way: the INVASION SUCCEEDED banner is drawn by entering at 0x4068 and taken away by entering at 0x4064. And the same goes for the submodes: 2 enters at 0x5275 and 4 at 0x5278, three instructions further in, skipping the call that moves the engine flame.
It is not a misreading, and it is not one: there are four. The explosion offset table (0x566B) starts on the operand of the jp at 0x566A; the how-many-per-zone one (0x58D6), on that of the jp at 0x58D5; the bomb margins one (0x55D3), on a call and an scf/ret.
In all three, the entries that land on top of code cannot be used: the index never reaches the value it would take to read them.
The fourth is uglier. SONIDO_PISTAS (0x5CD8) uses 0x5E5F as its base, two bytes before the first real word: entry 0 sits on the last two note periods and points at 0x383C, outside the cartridge. Sound number 0 cannot be requested, and nobody requests it.
DESPACHA (0x4050) does not keep its table apart: it does a pop hl to take the return address and use it as a base, so the table sits right behind the call and is never returned to. It ends in jp (hl).
That has a consequence: the ret of the dispatched routine does not go back to the dispatcher, it goes back to whatever the caller left on the stack. 0x4691 exploits that with a push hl before dispatching, and that is why 0x488B and 0x49EA run without a single instruction calling them.
0x412B copies seven bytes from 0x41DD to 0xE5F8 and calls them as a routine from then on:
ld (0E5FDh),a · ld (ix+000h),b · ret
0xE5FD is the third byte of the ld (ix+000h),b, that is, its own displacement: the routine writes it over itself with A and then stores B. It is ld (IX+A),B, which does not exist, because IX's displacement is a fixed byte of the opcode and not a register. Those are the only seven bytes of the cartridge that do not run from ROM.
Manuel Pazos found that Konami cartridges hide their RC-7xx catalogue number and the katakana title at the end of the ROM. It is not here.
The last byte with content is 0x5FF3 —the end of the last sound track— and from 0x5FF4 to 0x5FFF there are twelve 0xFF bytes and nothing else. The "RC-705" on this site comes from the catalogue, not from the binary.
PUNTOS_DE_PREMIO (0x501E) needs a random number and has no generator. It uses the Z80's R register, the dynamic memory refresh counter, which climbs by itself with every instruction executed: its low two bits give 0, 1, 2 or 3, and that goes into the high byte of the prize. Out come 0, 100, 200 or 300 points.
Under each caption is the address it comes from, and whether the picture is reconstructed or captured.
tools/mapa.py runs the cartridge on a Z80 interpreter written in Python, plays the game, and saves the column that comes in from the right on every scroll step