ACE 2

01 · The hamster

Secret: entering DUSTY BUG on the high-score table makes plane one immortal for good

The programmer left a message in the code: enter the name of the programmer's hamster on the high-score table and player one becomes immortal. The name is in the code too, scrambled. Press Next letter to unscramble it.

The message, in plain ASCII (the usual codes for letters) at $51B4-$53D3, is never printed. It ends: "IF YOU ENTER THE NAME OF MY HAMSTER ON THE HIGH SCORE TABLE, PLAYER ONE WILL BE IMMORTAL. A REAL HACKER WILL FIND HER NAME FROM THE CODE". The hamster is DUSTY BUG.

After every game, $5634 compares the first eight letters of the name buffer ($6933) with the hamster's name, so DUSTY BU is enough. It makes the comparison whether or not anyone qualified for the table, and whichever pilot typed the name, so a name entered by pilot two makes plane one immortal. A match sets the flag at $0975, and nothing in the game ever clears it. The flag is the last byte of the high-score table, so it is written to the disk with the scores ($1F30) and read back the next time the game loads ($09E5).

With the flag set, plane one burns no fuel ($43FC) and the side panel shows IMMORTAL where it counted the planes left ($1C44). In the kit's machine, from a recorded flight, plane one's fuel stayed at 247 for 300 frames with the flag set and fell to 245 without it. A crash or a kill still marks the plane as lost, but the check that would take it away passes over plane one while the flag is set ($0D93). The other pilot still scores 200 points for each kill ($282F), so an immortal plane one can be shot down again and again for points.

02 · YOU TRAITOR

Secret: the game has a YOU TRAITOR message that it never shows

Message 12 in each pilot's list reads YOU TRAITOR. No instruction in the game raises it.

The message routine takes the message's number in the processor's X register and a time in its Y register. Every caller loads X with a number written into the instruction itself, so the list above is the whole of what the cockpits can show. Message 19 is a first copy of TARGET LOCKED, pointing at the same text as message 20, which the lock uses. Message 12 has its own text, YOU TRAITOR, at $6CEC. It is also in the older copy of the game's text that the game loads at $C000 and never reads (below), so it was in the game's message list in an earlier build too, and nothing in this build says what it was for.

03 · Out of chaff

Bug: pressing for chaff with none left nudges plane two

With an enemy radar missile in the air and no chaff left, the decoy key shows NO CHAFF. The code then carries on into the lines meant for a pilot who has chaff, with the wrong number in the X register, which those lines use to find the pilot's count.

The decoy routine shows NO CHAFF through the message routine with X = 11, the message's number. There is no jump past the next lines, which take a chaff from this pilot's count and start its timer, both indexed by X. With 11 in X they hit the object table instead: one is taken from $0293, and 8 is written into $0297, the middle byte of plane two's position across. Plane two moves by less than an eighth of a square of the map, whichever pilot pressed the key, every pass the key is held.

04 · Weight

Bug: plane two's weight comes from plane one's fuel tank

Each pass the game weighs the plane it is working on: its missiles, plus its fuel. The fuel it reads is always plane one's.

Fuel is 0-255, so after the division it adds 0 to 3 to the weight. Plane two's drag follows plane one's fuel gauge: while plane one is full, plane two flies as if full, and once plane one has burnt its fuel, or refuelled, plane two's drag changes with it.

05 · The repair

The game breaks two of its own bytes twice a frame and a timer mends them

Both of the game's raster interrupts call $6066, which writes two wrong bytes into the game and starts a timer that, a few cycles later, makes the chip interrupt the processor with an NMI that puts them back.

$6066 starts timer A of the second CIA chip with a count of 5 and its interrupt on, reaching the chip's registers through an index ($DCF0 + X) so that the CIA 2 addresses never appear in the code. The NMI handler, $2AA6, acknowledges the chip and writes the two correct bytes back. The game sets the NMI vector itself, and the reset vector too, through a pointer built at run time ($0A07). Anything that points the NMI vector elsewhere leaves the play interrupt starting with the wrong instruction and the object drawer returning early.

06 · The alphabet

The game's letters have no Z

All the game's screen text is stored scrambled, one byte per letter, and read back through a table of 26 entries for the codes $41-$5A. Twenty-five of them give a letter. The last gives 0.

The scrambling keeps the text from showing in a memory dump. With no code for Z, no word with a Z in it can be written, and the colour code's grid shows the gap: its column names run A to Y, then AA to FF, and the 26th name in the table at $675E, where Z belongs, is the code $5A, which reads back as a 0 byte. None of the 40 squares the game asks about is in that column.

07 · Leftovers

A plain copy of the scrambled text loads beside it

The loader brings in 2,560 bytes from track 17 to $C000 that no instruction reads: an older build's copy of the game's text and tables, with the text in plain letters.

The game goes to the trouble of scrambling every word it prints, then loads a plain copy of most of them into memory, where any memory dump shows them. The programmer's message, with its dedication "TO THE VERY WONDERFUL TERESA" and its hint about the hamster, is plain ASCII too, among the code.