Atari_Ace's Blog - Beneath Apple Manor

RSS Bot · March 12, 2019

I was reading Dungeon Hacks, by David L. Craddock, the other day and found a short reference to the Atari 8-bit in the chapter on the first Rogue-like, Beneath Apple Manor:

For Beneath Apple Manor Special Edition, I reverse engineered the 6502 runtime environment for the Galfo Integer BASIC compiler and ported it to 8086 machines (IBM PC). Bob Christiansen of Quality Software also ported it to the Atari. I did not write Ali Baba--Bob might have--but it was in integer BASIC too I think, so Quality used the Galfo compiler on it to port it between machines too. Bob must have given me a copy, which is why I had it.

So there's another virtual machine hiding inside this game, so I had to find it and figure out how it works.

The first step of course was to download the xex file from www.atarimania.com and hook up a my disassembler to the image with appropriate offsets. The image has a number of parts:

use strict;use m6502;sub open_lst {  open my $fh, '<', 'bam.lst' or die;  $fh;}sub read_img {  my ($addr, $size) = @_;  read_img_core(    $addr, $size, '../bam.xex',    [0x0006 - 0xbf00, 0xbf00, 0xbf9f],    [0x00aa - 0x02e2, 0x02e2, 0x02e3],    [0x00b0 - 0x0c34, 0x0c34, 0x803f],    [0x74c0 - 0x8100, 0x8100, 0xa7ff],    [0x9bc4 - 0x0110, 0x0110, 0x0132],    [0x9beb - 0x02e0, 0x02e0, 0x02e1]);}assem(@ARGV);

The first chunk at $BF00 sets of a simple display list for the load. The load into $02E2 invokes that code before continuing the rest of the image. The next two chunks consist of the main portion of the code, with a small gap that isn't used by the program. The last two chunks load a small init routine and invoke it.

Let's look at the init routine:

                ; pull IP-1 from stack009A: 68                PLA009B: 85 B0             STA IP009D: 68                PLA009E: 85 B1             STA IP+1                ; increment IP by 100A0: E6 B0             INC IP00A2: D0 0B             BNE $00AF00A4: E6 B1             INC IP+100A6: D0 07             BNE $00AF                ; increment IP by A00A8: 18                CLC00A9: 65 B0             ADC IP00AB: 85 B0             STA IP00AD: B0 F5             BCS $00A4                ; read byte code and jump00AF: AD 40 1D          LDA $1D40 ; start at 1d4000B2: 85 B5             STA $B500B4: 6C FA 63          JMP ($63FA)

This is a little virtual machine fetch loop, with page $63 containing the bytecode vectors (which point to code in pages 64 to 6F), and entry points here to increment the IP by 1 or A, or pull the IP-1 from the stack (implementing an RTS-like return). The machine even has the start address built in ($1D40). It patches the bytecode into the indirect jump address directly, so it only supports 128 even byte-codes. The Atari Pascal virtual machine I posted about recently supported 256, but at the cost of a more expensive fetch loop.

We can now write a bytecode disassembler by disassembling the codes, figuring out how long each is, and making a table of those lengths. My preliminary disassembler looks like this:

And my preliminary bytecode disassembly of the start address is:

$81F0-$9FFF is the data for an ANTIC mode E picture, the title screen, with the display list at $8126. So 1/5 of the image is for this picture.$7C40-$8000 is the data for an ANTIC mode 2 (graphics 0) screen, with the display list at $7C20. The code modifies most of it to ANTIC mode 4 during the game for use as the main screen.A 1k character set is located at $0C00-$0CFF. The game doesn't just modify the Atari set.The game requires 48K to load, but likely runs in 32K. A little creativity (compressing the title screen and character set might be enough) could have squeezed it into 32K, but 48K was probably quite common when this hacked image was circulating.I'll probably return to do more work on disassembling this, but I've established how the virtual machine works, so I'm happy enough for a few hours work.

P.S. I took a quick look at Ali Baba and didn't see the same virtual machine. I'll need to explore that more fully to determine if it has a similar architecture.

Attached File(s)