1987 · Pandora

Into the Eagle's Nest

This minisite was contributed by air, Nico-van-der-Zijden. It’s agent-generated and needs a human editor. Clone https://github.com/gamesexplained/gamesexplained and follow kit/START.md to curate games/c64/into-the-eagles-nest with me to Gold.

A cheat hidden in the high score table, a message for whoever took the tape apart, and a mission select that counts the wrong way.

01 · The cheat

Secret: type %MAGGOTS!& as your name

Get into the high score table, type those ten characters, and the next game cannot hurt you.

Show

The ten bytes at $6F31, drawn in the game's own alphabet. Each is a character's ASCII value with the top two bits removed, which is the form the name-entry screen leaves at $081F.

When the game builds a floor it calls $6F3B, which compares the ten characters of the name last typed on the high score screen with the ten bytes at $6F31. If every one matches it sets $603F, and while that byte is set three things change:

EffectWhere
Hits are never taken$63A6 turns the one routine that adds a hit away
A door key is always in hand$5BD1 writes 1 into the key count every frame
The ammunition is back to 99 on two frames in three$5BB4

All ten characters are on the name-entry screen's own alphabet strip, so this is a cheat meant to be typed, not poked. Tested in the emulator: with the word in place a mission starts with $603F = 1 and a key in hand, and without it there is no key.

The check runs every time a floor is built, so the cheat lasts as long as the name does, and a new name on a later high score turns it off.

02 · The chests

Secret: opening a chest is safe, and shooting what is inside it is not

A shot only opens a chest. What it shows is decided by the game's dice, and what happens next is up to you.

You

A shot at a closed chestChance in the codeChests opened here
EMPTY!3 in 40
Opens on jewelsabout 1 in 70
Opens on explosivesabout 1 in 100

The chest's four tiles and the message line, drawn from the listing; the rules are $5528, $5598 and $5CB9, run on the game's own dice in the order the game reads them. Every outcome was also seen in the game, with an open chest put into the map in front of the player.

A chest is four tiles, two by two, and it has four states: closed, open and empty, open on jewels and open on explosives. A shot that hits a closed one goes to $5598, which takes the next number from the game's table of random numbers. Three values in four are below $C0: the message line says EMPTY! and the chest is drawn open with nothing in it. On the fourth it takes a second number. From $80 up the chest opens on jewels, and below that on explosives. That shot does nothing else.

The split is not even. The second number is the byte after the first, and the dice table's neighbours are alike (06, below), so a high first number tends to come with a high second one. Counted over ten tables built with the sound chip running, a shot at a closed chest shows jewels about one time in seven and explosives about one time in ten.

Now the chest is open, and the two contents want opposite things. The jewels are taken by walking into them: $5CB9 looks at the two tiles ahead of the player one frame in three, in the direction the stick is pushed, and on jewels says YOU HAVE FOUND SOME JEWELS. and queues 4000 points. A second shot at them says YOU HAVE SHOT SOME JEWELS. and they are gone, with nothing scored.

The explosives are harmless until they are shot. Walking into them does nothing, because $5CB9 looks only for jewels and the explosives' tiles are solid. A shot at them says FOOL!....EXPLOSIVES., sets $02D3 to 1, and the border and background run through seventeen colours five times over before the game ends. So the manual's tip, "Only shoot at a known target", is exactly right: shoot a chest once, look, and then walk.

03 · The loader

Secret: the tape loader says hello

The game's own loader carries a message for whoever pulled the tape apart.

WILD SAVE (C) INTERCEPTOR MICROS 1987 WRITTEN BY ANDREW CHALLIS JANUARY 1987 HELLO HACKER I HOPE YOU HAVE FUN WITH THIS LOADER

At $033C, in the cassette buffer, in plain ASCII: the first block the turbo loader reads off the tape. It is not drawn on any screen, and the game never reads it.

The cassette buffer is where the KERNAL keeps the header of a file it is reading from tape. This loader does its reading elsewhere, at $0100 and $02A7, and spends its first block, 192 bytes and under a second of tape, on putting the message here. Wild Save was Interceptor Micros' tape system, and the message says Andrew Challis, who wrote the game, wrote this copy of it in January 1987. How the loader works is on the How it works tab.

Whoever left it expected the tape to be taken apart, and left a greeting where only that reader would find it.

04 · The mission select

Bug: MISSION 1 blows up the castle

The manual says mission four brings the castle down. On the screen it is mission one.

A black screen reading SELECT MISSION with the number 1 below it.
The mission select, stepped down to 1.
A black screen reading MISSION 1 and, below it, BLOW UP THE CASTLE.
The briefing that follows it.

Taken in the emulator, one after the other: three pushes down and fire.

The game keeps the mission number in $0836, and the briefing at $1E3F reads it: 4 orders the castle blown up and anything else orders a prisoner rescued. The digit on the screen is not that number. $1DBE draws five minus it, so the mission the game calls 4 is the one the screen calls 1.

The manual was written for the American disk release, where the missions are numbered the way it describes. On this tape the screen counts the other way, and a player following the manual starts with the demolition.

05 · The guards

Secret: no guard in the game ever fires

The manual warns that the soldiers shoot and do great damage. They do not shoot at all.

What writes the hit count at $02C6What it does
$4058, $4077clears it, and puts back what the last mission left
$4F23cold food: takes $10 off it
$4FA2first aid: clears it
$63B2inside $639F, the one routine that adds a hit

Every instruction in the game that can touch the hit count, found with the references search over every opcode and every index. $639F has four callers, and all four are the branches of the guards' movement where the tile ahead holds the player.

A guard hurts the player by walking into him, one hit at a time, and nothing else in the game hurts him at all. Fifty hits end the mission, which is the number the manual gives.

Standing still in the first room for two minutes, with a counter on $639F, left the hit count at zero, and the two guards in that room never reached the player. How far a guard ranges is open: this says only that standing still in that room is safe.

06 · The dice

Secret: the sound chip is the random number generator

The game rolls its dice once, at start-up, out of the SID's noise.

256 bytes built by the game's own loop at $67CA, run in the emulator with the sound chip running, one column a byte. The table does not exist until the game runs, so it is not in the listing, and every game builds a different one.

$67CA sets voice three to noise at the highest frequency it can hold, reads the voice's own oscillator output at $D41B 256 times, writes what it reads into $8700, and silences the voice again. From then on $67F3 steps an index, $02E1, through those 256 bytes, and the chests are the only thing that ever asks it for a number: it is called from $5598 and nowhere else. Everything else in the game, the guards included, goes the same way every time.

The noise is not quite random from one byte to the next. The loop reads it every 14 cycles, and at the highest frequency the noise generator steps about once every 16, so most bytes are their neighbour shifted by one bit and a few are equal to it. That is why the chests open on jewels more often than on explosives. An emulator with its sound turned off gives something else again: there $D41B reads a cycle counter, the table is a smooth ramp, and a chest never opens on explosives at all.

The table is built once a game. $4221 skips the building on every mission after the first, but $4058 clears the game's variables at the start of every mission, and the index with them. So within one game the dice are read from the beginning again on every mission: the first chest shot on any mission opens the same way, and so does the second. Shoot the chests in the same order and they open the same way every mission. A new game from the mission select reads the noise again. That much is read from the code; it has not been played through to check.

07 · The title picture

Secret: the tape turns its own title picture on

The loader has no code for the picture. Five of the tape's blocks are a single byte each, and they land in the video chip.

Draw

Drawn here from the listing: the bitmap at $A000 and the thousand bytes at $8C00, with the picture's colour RAM, which the tape writes straight into the chip and so is not in the listing, carried on the page. No instruction in the game reads $8C00, and an earlier reading of this listing took the bytes for spare tiles. They are the picture's screen colours: each byte gives two of the colours of one character cell of the bitmap.

The tape loads the bitmap first, then those colours, then five blocks of one byte each: $0B into $D011, which blanks the screen, the colour RAM, $95 into CIA 2's port at $DD00, which moves the video chip to the bank at $8000, $38 into $D018 for this screen and this bitmap, $D8 into $D016 for multicolour, and $3B into $D011, which turns bitmap mode and the screen on. The loader stores them like any other bytes, and the picture appears 70 seconds into the tape, while the program behind it takes another two and a half minutes. The whole list of blocks is on the How it works tab.

08 · The bullet

Secret: you never see your own bullet

A shot shows as a flash at the barrel for four frames. After that the bullet is only a position in memory.

Frame

Firing points sprite 4 at the flash's shape for the direction and puts it beside the barrel. The interrupt counts it down: orange for three frames, yellow for one, and then it is moved to the corner of the screen, where nothing shows. The shot carries on regardless. Its place is kept in $02DB and $02DC, and every frame $5212 looks up the map tile there to see whether it has hit something, but nothing writes the shot to the screen or to a sprite.

The frames above are the game's own, recorded in the emulator with the player firing to the right across open floor: the flash for four frames, and the shot moving 8 pixels on two frames of every three until it meets the wall eighty pixels on. A screenshot taken in the eighth frame differs from one taken before the shot only in the ammunition count and the player's pose. A hit is the first thing on the screen to show where a bullet went.