A View to a Kill

01 · Checked against the sources

Where the code and the sources disagree

02 · City Hall

Bug: a burning room runs the end test from the middle of an instruction

The main loop's test for a burning room branches to $7090, which is the second byte of a branch instruction. From there the processor reads ORA $57AD, then an undocumented instruction that shifts a byte of memory left and ORs it in (SLO, writing $0BFC), and arrives at the load of the code flag in the end test ($7096). Seen in the emulator with Bond's room set on fire: with CCPHJ typed, the next pass showed the mission-complete screen and DB4CT; without it, a new game. The byte at $0BFC went from $40 to $80, the undocumented shift at work. Whether the branch was meant to go to the end test and the target is off by a byte, or was changed later, is not known.

The gauges and the clock cannot kill Bond

The energy gauges empty and nothing happens ($8900). The clock counts and nothing reads it: where a test might have been there are nine NOPs ($6EA1).

A table read from the screen

When the fire spreads to the next floor, the new temperatures are masked with AND $03E9,Y ($95AD), a read of the screen, where an AND # of a fixed value was probably meant. Not tried in the emulator.

03 · The intro

Bug: on some boots the credits never scroll

Before the credits the intro writes $97 to the video chip's control register ($CB50). Its top bit is also the top bit of the raster line the next interrupt is asked for, which becomes line 496, a line a European screen never reaches. A later read, AND and write of the register clears it ($C540), but reading that bit gives the line the beam is on, so if the beam is below line 255 at that moment the bit is written back set. Then no interrupt ever comes again: the credits, the music and everything else driven from the interrupt stop. Seen in the emulator: of four boots started a tenth of a second apart, three scrolled the credits and in one the scrolling routine never ran.

04 · The mine

A digit counter with no limit

Each digit entered is stored at $1B73 plus the count so far, and nothing limits the count ($38AA). The numbered objects stay in the list after use, so a digit can be entered again and again. The fourteenth digit would land on the pause flag and stop the clock, and the forty-sixth on the code flag itself, which would make the section winnable without DB4CT once the count wraps round after 256. None of this was tried in the emulator.

Two smaller slips: the welcome page loads the stack pointer from the byte at $FF where the number $FF was meant ($7D1D), harmless because the next routine sets it again; and the planks' handler tests for an object number no object has ($3970).

05 · Left in the files

An older code, an older end screen, and an older menu

City Hall holds a code prompt nothing calls, which asks for QRS21 and gives three tries ($967B), and an end screen nothing shows: WEBL DONE 007 YOUR CODE IS 111122 ($7E5A). It also holds the mine's end screen, with ILVCT, at the mine's address. The intro holds the menu of an earlier crack of the game: SEE OPENING, PARIS-CHASE, CITY ESCAPE, SILICON MINE, FINALE. The About tab lists every layer.

06 · Open questions

Questions still open

• Whether the code prompts and end screens are the game's own or were written by crackers. The older prompt and end screen in City Hall point to someone having replaced them; the memo pages, which are plainly the game's, print the same way.
• What the meter on the mine's panel measures. It rises towards the upper right of the mine ($3000); the sources call something a Geiger counter.
• Which of the two tunes is the Bond theme and which the title song.
• What City Hall's door codes 1, 2, 3, 5 and 7 look like: the drawing code handles only 0 and 6.
• Why Paris rewrites two short stretches of its map at every start ($4140).