Kane

01 · The ride's bonus

Secret: reach Kane with under a minute left for the biggest bonus

Reach Kane with a minute or more on the clock and the time bonus is 80 to 169 counts of points. Reach it with less than a minute left and it is 256 counts, more than any faster finish pays.

The clock counts down from 2.00, minutes and seconds, each kept as a BCD byte, a byte whose two halves are two decimal digits (clock_mins $48, clock_secs $47). At the finish a loop adds 15, 20 or 25 points by level, as many times as the byte zpa_10 says. With a minute or more left the game puts the seconds there plus $50, added as a plain binary sum although the seconds are BCD. So 1.30 gives $30 + $50 = $80, 128 counts, and 1.00 gives only 80. With under a minute left nothing is put there. The byte still holds the 0 left by the routine that unpacked the ride's sprites, and a loop that counts down from 0 runs 256 times.

In the emulator on level 1, reaching Kane at 1.00 gave 1,200 points and reaching it a second later, at 0.59, gave 3,840. Each also got a few more from the next bug.

02 · Counting the score

Bug: the score counts up more points than it was given

Points go onto the score a few at a time, one frame after another. While 100 to 999 are waiting the game counts them in steps of eleven, and the sums go wrong: the 594 points of a gunman on level 3 put 706 on the score.

The score and the points still to come (pending, $8FA4) are four BCD bytes each. Every frame count_score takes a step off the one and adds it to the other, with the processor's decimal mode on. The step is 1 while fewer than 100 are waiting, $99 while 1,000 or more are, and $0B in between. $0B is not a BCD number: it is eleven written in binary. The 6502's decimal mode only works on digits 0 to 9. Given $0B, it leaves digits of 10 to 15 in the score, which the game prints as the characters after 9 in its font: : ; < = > ?. The next adds carry those digits on as extra points.

The points waiting go wrong too: taking eleven from 550 leaves $054F, which the next step reads as 544. A gunman on level 3 is worth 594 points and puts 706 on a score whose last digit is 0 to 4, as the emulator showed, or 690 on one whose last digit is 5 to 9. Under 100 the count is right, and so it is for the 149 points of a duck on level 2. Most larger amounts the game pays gain a little.

03 · The shoot-out

Secret: keep walking and the gunmen's shots cannot hit the Marshall

A gunman's shot only counts while the Marshall stands still. Walking left and right between shots, he cannot be hit. The inlay says only that standing still makes the gunmen's shots more accurate, and their aim does close in on a Marshall who stands (gunmen_aim, $8A61).

When a gunman fires, gunman_fires ($8AF2) first looks at facing ($90B5), which holds which way the Marshall walks: 1 for left, $FF for right, and 0 only when he stands or fires. Anything but 0 and the shot does nothing at all, not even the puff of dust a miss kicks up. The Marshall can only fire while he stands, so the trick is to stand, shoot and walk on before the next gunman fires. A gunman fires once, after coming out of his hiding place and waiting seven of his steps, between three and four seconds after he starts to appear (gunman_step, $8810).

04 · F1

Secret: F1 restarts a ride with the clock full and nothing lost

After a fall the game tells you that F1 will restart the level. F1 works at any moment of a ride, fall or no fall, costs no token, and puts two minutes back on the clock.

The ride's loop checks the F1 key on every pass and jumps back to start_ride ($1F3B), which sets the clock to 2.00 and the distance to 0.00. A ride whose clock is running out can be started again as often as you like, so the clock never has to reach 0.00. In the emulator, with four seconds left on ride 1 and 2.50 miles covered, F1 gave a new ride with the clock full, the distance back at 0.00 and the same number of tokens. Each restart also adds 2 points to the score, the 2 the game has in hand from setting the minutes.

05 · The hiding places

Bug: two gunmen can hide in the same place

The game means each of the sixteen hiding places to hold one gunman at a time. A slip in the check lets a second gunman into a place that is taken, where he stands in the first one's spot.

When a gunman's sprite is free, gunmen_appear ($3E77) picks a place at random and should turn it away if place_used ($914D) marks it taken. The test reads the wrong entry ($3ED4): place_used at the gunman's own number, 0 to 3, instead of the place's. So a gunman can take a place another is in, and is sent away from any place while the place with his own number is taken.

Watched in the emulator for two and a half minutes, four times a second, two gunmen shared a place in 29 of the 552 looks. The pair look like a single gunman.

06 · Reset

Bug: a reset after the train gets away drops into BASIC

The game sets itself up so that pressing a reset button restarts it. Let the train get twenty coaches ahead and a reset loses the game and leaves the machine in BASIC.

On a reset the C64 looks for the letters CBM80 at $8004 and, when they are there, jumps through the address before them instead of starting BASIC. The game writes those bytes before every stage, pointing at its own start ($3163). The rides keep their obstacles in a buffer from $8010. When the train is caught or gets away, clear_obstacles ($313F) clears every obstacle byte out of it, but it starts at $8000, below the buffer, and clears the high bytes of the two addresses and the "8" and "0" of the letters too. Until the next stage writes them back, a reset finds no game.

07 · The first shot

Bug: the Marshall's first shot after the game loads makes no sound

Each of the Marshall's shots is a burst of noise. The first one after the tape has loaded is silent, and so is every shot in the next three and a half seconds.

The shot's sound (shot_sound, $920E) counts frames in shot_time ($25). At 0 it starts the noise and sets the count to 20, and at 10 it stops the noise and ends the effect, leaving 9. Nothing sets the count before the first shot, and once the game has loaded that byte holds 189. So the first shot counts down from 189 to 10, 179 frames, without passing 0, and never starts the noise. Seen in the emulator: shot_time went from 189 to 9 in three and a half seconds of the first shot, and the code that starts the noise never ran.

Every later shot starts from the 9 the last one left, so its noise comes nine frames, about a fifth of a second, after the trigger. The gunmen's shots ($9247) count the same way from a count that starts at 0, so only their first shot comes at once.

08 · The train

Bug: the coach count stops at 19 when the train gets away

Fall twenty coaches behind and the train has got away. The count under the picture stops at 19 while the game's own count goes on.

The train's ride (train_step, $228B) prints the coach count on every pass while it is under 20. From 20 it takes another path, which clears the obstacles, slows the horse until it stands and then costs a token, and never reaches the line that prints the count. So the last number shown is 19, whatever the count is.

09 · The ending's tune

Bug: the ending's tune slows at two of its nine places

The tune at the end of the game has a list of nine places where it should slow down. It slows at the first two it reads and then waits for one it can never reach.

The ending's loop ($31DC) watches how far voice 1 has got and slows the tune a step (tempo) each time it reaches the next place in tune_slowdowns ($8E5D): $14, $19, $1E, $23, $25, $27, $28, $29, $32. It reads the first place, sets its count to 1, and adds one to the count before it reads the next, so after $14 it reads the third place, $1E, and never the second. After $1E it waits for $23. Voice 1 moves two bytes a note from an even start, so it only ever reaches even places, and $23 never comes. At $2B the loop ends with the tune slowed twice. Five of the nine places are odd, and $32 lies past the end, so no count would have reached them all. The How it works page plays the ending as the game does.

10 · The shoot-out's bonus

The shoot-out's bonus loop sets a count of five and never uses it

Shoot the twelfth bad guy and the shoot-out pays a bonus: 99 points on level 1, 198 on level 2, 297 on level 3. The code around the loop that pays it suggests more was meant.

The bonus loop at $37E3 runs once for each level up to this one. Inside it, Y is loaded with 5 and the game adds 99 points, then repeats while the last add left a number other than 0. That number is the top byte of the points waiting, which is 0 for any bonus this size, so each level adds 99 once. Nothing counts Y down. A loop that loads 5 into a register usually counts it, and five lots of 99 a level would have made the bonus 495, 990 or 1,485. A test beside this page runs the game's loop at each level.

11 · Leftovers

Leftovers in the code

The tape carries pieces of an older build and some code that never runs.

• An older build of the game. The last block on the tape loads code at $8010 to $8727 that is an earlier version of the code from the end of check_shot to gunmen_appear, assembled about 18 KB higher. Its own reset bytes at $8000 point at it. Nothing runs it: the first ride writes its obstacle buffer over it. Another piece, an older gunman_step, sits at $3F3A.
• A debug printer. show_timer_hex ($300E) prints CIA 1's timer as hex digits until its low byte reads 0. The only way in is to fall out of the division routine ($2FEE) when its answer passes 255, which the aiming code's numbers never make it do.
• A routine nothing calls. The 56 bytes before draw_token ($1D96) wait for the raster and print a number as two digits. No code reaches them.
• A jump after a jump. JMP $37E3 at $3EC1, into the shoot-out's bonus, follows another jump, and nothing jumps to it.
• A seventeenth hiding place. The table of places at $9169 has room and bytes for a seventeenth, which no gunman is ever sent to.
• Two more routines nothing calls. Among the graphics and samples, one at $CF73 prints a byte in hex through the KERNAL's print routine, and one at $FF90 copies memory from $5000 up under the KERNAL ROM.
• Characters that are a sound. The ride's character set is copied from $F6C0. Its last 64 characters are the first bytes of the ending's “Well done” at $FCC0, and nothing a ride shows uses them.