Disassembling 2600 Games?

[tschak909]

I tried to take a whack at naming the rooms, and I just... ugh.

 

swiss cheese skyline 1

swiss cheese skyline 2

something that looks like greek ruins

....

 

-Thom

[LeChuck]

Out of curiosity, how long does an average commented disassembly take you? I'm about 80% done with my first, although it's been off and on (well mostly off) for a year or so. It was pretty quick until it got to the chunks of code that are pure game logic, obscure RAM flag usage, and other 'huh?' subroutines.

 

It may be obvious, but one thing I found helpful is to read the manual and play the game on all variations - then note down all the logic that must be present somewhere in the code (I am surprised how much I miss that's in the manual). I also like to note down weird bugs or glitches to figure out along the way.

[DanOliver]

I'm normally after a specific feature so I only go into detail with those parts. The rest uses generic labels, enough to assemble. I can change code and see the results to make sure I understand the part I care about. So length of time depends how fast I can grasp a feature.

 

For a first game to see overall structure I don't need to go into a lot of detail.

[ZackAttack]

Don't forget Stella source code is available. You can customize it in order to help automate the process.

 

Reversing software requires a deep understanding of the system at all levels. You will get a lot faster with some practice.

[DEBRO]

Hi there,

 

Out of curiosity, how long does an average commented disassembly take you? I'm about 80% done with my first, although it's been off and on (well mostly off) for a year or so. It was pretty quick until it got to the chunks of code that are pure game logic, obscure RAM flag usage, and other 'huh?' subroutines.

 

It may be obvious, but one thing I found helpful is to read the manual and play the game on all variations - then note down all the logic that must be present somewhere in the code (I am surprised how much I miss that's in the manual). I also like to note down weird bugs or glitches to figure out along the way.

 

I'm not sure how long it takes me because I do it for fun like a jigsaw puzzle. I come and go to it as I find time.

 

I generally focus on games I played as a kid. This is because I have vested time into how they play which makes figuring out the code easier.

 

I also try to label everything. This becomes difficult when I run into a routine that I know is just there for a branch. The original engineer more than likely would have labeled the routine something generic like 2$:, 3$:, etc. or JMP [REAL_LABEL_NAME] + n but I try to name them something.

 

Sometimes I get close to completing, loose interest and move on to another one. I have many WIP disassembly projects like that. I'm forcing myself to get back to Pac-man and I really need to finish Megamania. Astrosmash is another one I'm practically complete with but I don't like the magic numbers in the listing. I'd like to revisit it too to document their use better so the code is self documenting.

 

I also go back to ones I've completed as well and find things that I could document better or clear up mistakes I actually made. For instance...my constant ROMTOP that I've used in all my disassemblies and code is not really a correct label. ROM_BOTTOM or BASE_ROM_ADDRESS would be better.

[LeChuck]

That pretty much describes my approach as well. I have used the puzzle analogy with many people (although I usually clarify that it is the type of puzzle that could drive one to madness). Luckily I have a knack for tracing assembly code (due to work and other hobbies), and it is satisfying to create order from chaos.

 

Speaking of, time to get back to it .. just a few more lines ..

[Thomas Jentzsch]

Same here.

 

I usually start with easier stuff like scoring (looking for SED/CLD), switches, horizontal object positioning and kernel. That way I can identify some variables and that gives the code some basic structure. From there it is more or less random, whatever seems to make sense is checked next. Often one analysis leads to another. Finally I try to fill the gaps in variable definitions and to eliminate magic numbers.

[RevEng]

I tend to start with the registers. By the time you've earmarked audio routines and controller polling, you have a good idea where the main loop is. On the 2600 (as Thomas noted) object positioning is a bridge into core game variables. Lives is usually pretty easy to track down too.

 

I don't take on disassembles for the sake of it, so I don't go 100%. I do like to go farther than I need to, and have a good picture of all of the major game functions and variables. But I don't feel a need to take on obvious magics or give meaningful names to minor branch destinations. (like loops)

 

I've done some A8 and 7800 disassembles as of late, and they're more of a pain since there's more room for abstract game logic. For those bits I use either contextual analysis or plain old brute force modification+emulation to figure them out. Worst case, moving on to other parts often reveals variables in those hard parts.

 

I also tend to use ridiculously long and descriptive camel case variable and label names. It really does help when your known variables show up in some very abstract bit of code.

[LeChuck]

Yep, I suspect we all go about this in mostly similar methods. Reminds me of following electromechanical pinball schematics - start with the lights (or other obvious landmarks) and work backwards.

 

Are there any commented disassembly conventions around here? For now I'm doing everything in my personal style, but I could adjust it before posting if it would make it easier to follow for others here. I read DEBRO's disassembly of Basketball recently, that looked nice.

 

As far as my disassembly - I'd probably call it 85% now (I'm afraid to mention which game it is - I'm pretty sure it hasn't been done, but I'd be horrified if I found out it was before I finished). Some logic and RAM usage tackled every session, can't wait to finish .. hopefully by the new year, or shortly after.

[Thomas Jentzsch]

Yes, Dennis comments like I do to. Every commented file will be liked, but if you format it something more common, than this is even more appreciated.

 

And you should mention the game, else someone else might be "horrified".

[DEBRO]

Yes, Dennis comments like I do to. Every commented file will be liked, but if you format it something more common, than this is even more appreciated.

 

And you should mention the game, else someone else might be "horrified".

Yes! I am a student of JTZ and adopted his style.

 

I agree with Thomas. You should mention which game you're working on especially being ~80% completed. Hoping I can remove one from my TODO list.

[Nukey Shay]

Isn't everything on yours?

[LeChuck]

At the risk of being horrified, my first commented disassembly had to be Space Invaders. I know there is the SI Deluxe hack with some comments, and a few other hacks with comments, but I wanted to go 100% on the original binary (every RAM bit, every instruction, every table accounted for). I've searched for this periodically out of paranoia, but I haven't seen it done yet .. which is very surprising considering the popularity. Anyway, being on vacation this week I finally finished it - hurrah!

 

Now I'm in the stage of polishing off the file, renaming labels, and other cleanup before posting. As part of this I wanted to explain a few things I've always wondered about too (besides the overall logic flow and object usage) - the double shot trick, why some invaders don't display a death animation, how it randomly breaks up the shield bits on collisions, etc. I'll start a new thread when it's ready so I can systematically brain dump everything I've learned going through the code.

 

Not sure which game will be next. Some of my other favorites have already been done (Combat, E.T., Pitfall, Asteroids, Superman) .. maybe Pac-Man, Journey:Escape, Spider-Man, Missile Command, or ..

 

Dennis - Out of curiosity, what is on your TODO list?

[DEBRO]

On 12/7/2016 at 8:36 AM, Nukey Shay said:

Isn't everything on yours?

 

LOL...yes...reverse engineer all the things!!!!

 

On 12/19/2016 at 2:22 AM, LeChuck said:

At the risk of being horrified, my first commented disassembly had to be Space Invaders. I know there is the SI Deluxe hack with some comments, and a few other hacks with comments, but I wanted to go 100% on the original binary (every RAM bit, every instruction, every table accounted for). I've searched for this periodically out of paranoia, but I haven't seen it done yet .. which is very surprising considering the popularity. Anyway, being on vacation this week I finally finished it - hurrah!

 

Now I'm in the stage of polishing off the file, renaming labels, and other cleanup before posting. As part of this I wanted to explain a few things I've always wondered about too (besides the overall logic flow and object usage) - the double shot trick, why some invaders don't display a death animation, how it randomly breaks up the shield bits on collisions, etc. I'll start a new thread when it's ready so I can systematically brain dump everything I've learned going through the code.

 

Not sure which game will be next. Some of my other favorites have already been done (Combat, E.T., Pitfall, Asteroids, Superman) .. maybe Pac-Man, Journey:Escape, Spider-Man, Missile Command, or ..

 

Dennis - Out of curiosity, what is on your TODO list?

 

EXCELLENT!!! Space Invaders has been on my list for years! Same as you, I yearned to have it completely commented and hopefully understand why frying allowed for the double-shots.

 

Here is my current TODO list.

 

20th Century Fox

==============

Fast Eddie

Turmoil

 

Activision

========

Barnstorming

Boxing

Checkers

Dragster

Ice Hockey

Fishing Derby

Frostbite

Grand Prix

Keystone Kapers

Laser Blast

Megamania (really need to finish this up...but I keep loosing interest)

Plaque Attack

Pressure Cooker

Seaquest

Venetian Blinds (pretty much done...I want to clean it up)

 

Atari

=====

Asteroids

Basketball

Breakout

Centipede

Circus Atari

Defender

Demons to Diamonds

Dodge'em

Elevator Action

Football

Hangman

Homerun

Missile Command

Ms. Pac-man (finish it and clean up the labels)

Night Driver

Pac-man

ROTLA

Space Invaders (I can remove this one now )

Street Racer

Superman (clean up the listing and name the screens)

Vanguard

Video Olympics

Video Pinball

 

Coleco

======

Carnival

Donkey Kong (do it right this time)

Mouse Trap

 

M Network

=========

Astroblast (clean up listing and remove magic numbers)

Super Challenge Football

 

Parker Bros

==========

Frogger

Qbert

The Empire Strikes Back

 

US Games Corp

============

Gopher

Word Zapper

Edited April 18, 2021 by DEBRO

[LeChuck]

EXCELLENT!!! Space Invaders has been on my list for years! Same as you, I yearned to have it completely commented and hopefully understand why frying allowed for the double-shots.

I'll post the gory details when I start a new thread. But the short answer is that if you power up with the reset switch held, it leaves a byte of game selection flags uninitialized .. so it thinks you're in the variation with two players firing simultaneously. And due to the state of two other flags, it allows player 0 to take both of the potential shots.

 

Cool TODO list, hope you don't have any other plans

Edited December 19, 2016 by LeChuck

[Nukey Shay]

It's safe to say that it is invoked in a manner unforeseen by the programmer...otherwise, it would have been one of the most killer easter eggs of all time. If the bit check requirement had been flipped, it would never show up at all. The mind boggles.

[LeChuck]

Indeed. The missing initialization would normally happen when it processes being in the game select state .. so it wasn't designed to go straight into starting a new game without running that atleast once.

 

We had a broken toilet line flood the house, so I'm behind on finishing this labeling/cleanup. Hopefully by end of January or so .. uggh

[JeremiahK]

Not sure if you have seen this already but here is a list I just found of disassembled 2600 games.

http://www.bjars.com/disassemblies.html

They aren't all fully commented, but I thought you would like to know.

Edited August 26, 2017 by JeremiahK

[tschak909]

*chuckles-a-bit*

[vidak]

What a great number of disassemblies! I'm glad BJARS collected them all in one place.

 

I can add it to the list of programming resources I'm trying to collect!

[+stephena]

Just in case anyone isn't aware, Stella has full support for disassembling (and saving) ROMs of 4K or less (basically the same limitation as Distella, which Stella is using internally). And it will often do a much better job than Distella, since it takes runtime access into account, and can generally tell if something is graphics vs. code, etc, that is often impossible to do with a standalone static analysis.

 

Also, we hope to eventually extend this to multi-bank ROMs, first the standard Atari ones, then later the more esoteric ones. There is currently an issue in Stella for this already: https://github.com/stella-emu/stella/issues/184. We hope to implement this eventually, and in the final form have it generate a disassembly that is completely ready to recompile.

[LeChuck]

Indeed. The missing initialization would normally happen when it processes being in the game select state .. so it wasn't designed to go straight into starting a new game without running that atleast once.

 

We had a broken toilet line flood the house, so I'm behind on finishing this labeling/cleanup. Hopefully by end of January or so .. uggh

It was wishful thinking to have this done by end of January - I'm still finishing insurance haggling for this flood and unpacking boxes! Anyway, this is still on my todo list once things get back to normal. Hopefully in the next couple months .. it is on the cusp of being complete!

[+Stephen]

It was wishful thinking to have this done by end of January - I'm still finishing insurance haggling for this flood and unpacking boxes! Anyway, this is still on my todo list once things get back to normal. Hopefully in the next couple months .. it is on the cusp of being complete!

Looking forward to this, it's still one of my all time fave 2600 games.

[nitrofurano]

would be really great if http://atariage.com/software_search.php?SystemID=2600could host assembly code related to each game in a more organized way, whatever original and/or disassembled sources, specially for documentation and didactic purposes

[+SvOlli]

How about opening a git repo (maybe on github) for collecting all known disassemblies?

 

The Stella group repository would work for that quite nicely. And if for legal reasons this might be too risky, a user account or another group would work also.