Mayhem in Monsterland

01 · The cheat

Secret: 25 keys on the title screen give infinite lives

Typing a sequence of 25 digits from 1 to 5 on the title screen stops the game from taking lives away. Nothing on the screen asks for it.

The buttons, or the keys 1 to 5 while this panel has the focus, run a port of the title's key check $9EF9, one frame with the key down and one with it up. The port was run beside the game's code in a 6502 simulator, with the keyboard answered from the keys held, over 400 runs of 600 frames: sequences typed with wrong keys, keys held for several frames and two keys at once. It agreed on every frame. In the emulator, the 25th key wrote the RTS and a stage whose clock ran out then left the lives at 03, where the same stage without the cheat lost one; the first 24 keys were set from the code there rather than typed.

The title screen runs from Jellyland's file, and each frame it calls $9EF9, which reads the keys 1 to 5 and compares each new press with the next entry of the sequence at $9EE0: 2 1 5 4 3 5 1 4 3 2 5 2 3 1 4 4 1 2 5 3 2 4 3 5 1. A correct key moves the position on; a wrong one sets it back to the start, and does not count as the first key of a new attempt. After the 25th, the routine writes $60, an RTS, over the first byte of the engine's $BDC1, the routine that takes a life off. The only sign is the top-score line on the title, whose three sprites change colour ($93A7).

The cheat lasts until the title screen starts again, which puts the original byte back ($A58B). The game can still end: Q in the pause sets the lives to $FF directly ($1EB4), and that is game over.

02 · Lives

Bug: losing a life at 10 lives leaves 00

The lives counter is two decimal digits. Taking a life from 10 leaves 00, the last life, so the counter drops by ten at once. The same happens at 20, 30 and every other multiple of ten.

The buttons run ports of the two routines. Run beside the game's code in a 6502 simulator, from every pair of digits with the tens 0 to 10 and the units 0 to 9 and from the game-over value, both ports left the same digits as the game: 224 cases.

$BDC1 subtracts one from the units. When the units are 0 it subtracts one from the tens instead and leaves the units at 0, where it should have set them to 9 ($BDCC-$BDD1). 10 becomes 00. The game ends only when a life is lost at 00, which turns the tens into $FF ($3BAC), so 00 is one more life and not game over. From 10, the second death ends the game, where it should have taken the eleventh.

Ten lives is within reach. A new game starts with 03, and every land the loader brings in adds one more ($CC55 calls the same $3866 as the extra-life awards), so a player who loses none arrives at Rockland with 07. Extra-life bonuses and every million points add the rest.

03 · The loading screens

Bug: Cherryland's loading screen gives Rockland's star quota as 338, not 348

While a land loads, the screen shows its name and its two quotas. The quotas on the screen come from the land before.

Land loading	Its quotas as the loading screen gives them	Printed from	Dust `$903E`-`$9040`	Star count starts at `$9041`-`$9043`	Finish opens at `$904A`-`$904C`	Stars to collect
Jellyland	dust 10, stars 113	the engine, `$D77D`	00 01 00	01 05 03	00 04 00	153 - 40 = 113
Pipeland	dust 11, stars 231	Jellyland's file	00 01 01	03 03 01	01 00 00	331 - 100 = 231
Spottyland	dust 15, stars 159	Pipeland's file	00 01 05	02 01 04	00 05 05	214 - 55 = 159
Cherryland	dust 10, stars 250	Spottyland's file	00 01 00	03 00 00	00 05 00	300 - 50 = 250
Rockland	dust 8, stars 338	Cherryland's file, `$9185`	00 00 08	03 07 08	00 03 00	378 - 30 = 348
The ending	"GAME COMPLETE"	Rockland's file	-	-	-	-

The quota lines are text in each file at $916F and $9185. The other columns are the bytes the engine counts with, in each land's own file: three decimal digits each, one to a byte, as the panel shows them.

The star count on the panel does not start at zero. When the land turns happy, the engine loads the counter from $9041-$9043 ($3BC6), every star Mayhem collects takes one off it ($36ED), and the finish line opens when it has come down to the number in $904A-$904C ($374F-$3753). The stars a player must collect are the difference between the two, and that difference is what the loading screen calls the star quota.

The loader ($CBAD) prints the loading screen before it loads the land, so the quota lines cannot come from the land's own file: they are in the file of the land before it, at $916F and $9185, and a new game first copies Jellyland's lines into place from the engine ($D76E). The lines are text typed into each file, separate from the numbers the game counts with. Four of the five agree. Cherryland's says 338 for Rockland, which counts its stars from 378 down to 30, a quota of 348.

Rockland's file carries lines for a land that does not exist: its loading line says "GAME COMPLETE", shown while the ending loads, and its quota lines say 12 and 365, which no screen prints.

04 · The protection

Secret: the answers to the code sheet are in the game

After the intro, the game asks for a code from the printed sheet that came in the box.

The protection screen, asking for the code at a square of the sheet

The protection screen, a screenshot from the emulator.

The protection screen gives a square of the sheet, such as F27, and wants the five colours printed there, typed as digits from 1 for blue to 5 for yellow. The answers are in the game, exclusive-ORed with $45: a table of 47 squares at $4A00-$4B77, and the five keys this boot expects, copied to $017B on the stack page ($4594-$45A2 compares them). Three wrong codes send the game to $C000, which clears memory from $040A upward without end.

The same file still carries some of the tools it was made with. Next to the answer table, the copy loaded from disk holds a small program the game never runs ($4800-$49E1): a link that let another computer write and read the Commodore's memory and start code over a cable in the user port, signed "DOWNLOAD BY JAZ" ($49F0). Beside it, a routine at $4B7B saved memory from $0200 to $A8FF to the disk drive under the name GAME, which is exactly the span of the file on the disk, and the first bytes of that file are BASIC's input line, still reading SYS 5632: the command that started the link at $1600. The game clears this screen memory before play, so none of it is ever seen. Andy Roberts recalls working on Mayhem with an Amiga-based cross-development system, and a 1990 Commodore Format feature on Apex describes John Rowlands sending his code from another computer to the C64 through a "Programmer's Development System". Whether this link belonged to either, and who Jaz was, could not be found.

05 · The extra life

Bug: a million reached through the time bonus earns no extra life

The game gives an extra life each time the score passes a million. One award can pass a million without it: the 100,000 points of the SUPER TIME BONUS, when the score already has a 9 in its hundred-thousands.

$350B gives the life in two places. At $3530 it gives one before adding anything when the award's own digit is the millions, which only the 1,000,000 award is. At $355A, inside the loop that carries into the digits above, it gives one when the hundred-thousands digit rolls over from 9 to 0. Every award below 100,000 that passes a million goes through that loop, and so does the life.

The 100,000 award is the exception, because the hundred-thousands is its own digit. When that digit overflows, $3541-$3548 take ten off it in place, and the carry loop starts one digit up, at the millions. The test at $355A watches for the hundred-thousands rolling over, and the loop never visits it. The score reaches its next million and the lives stay as they were.

Only one award in the game is worth 100,000: the SUPER TIME BONUS of the stage-complete screen ($BEAA), paid when the clock reads 000 as that screen opens. No monster in the five lands carries event 14. No way to that screen with the clock at 000 was found. The clock stops the moment Mayhem crosses the finish line: it ticks only while the stage-complete flag $1BC6 is clear ($2016), and the finish sets that flag earlier in the same pass ($2B4C). A clock that does reach 000 costs the life first ($383F). So the bonus, and the bug with it, looks out of a player's reach.

06 · More from the code

Things a player who finished it would not know

The first touch is free. Touching a monster the first time costs no life: it sets a flag and starts a grace count of $64 while Mayhem flickers ($B61D). The count goes down only on every other call ($EF4A-$EF4E), so the grace lasts about 200 calls. The second touch costs the life ($B5E4). An extra life, the power-up or one of the bonuses clears the flag again ($387D).
Some monsters cannot be jumped on. A monster's kind below $F7 is its strength, and a stomp takes off more the further Mayhem fell ($342E). Kinds $FB and $F7 cannot be stomped at all ($B59D), $FC and $FA always hurt, and $F8 hurts when walked into but dies to a stomp ($B5B1); a charge with the lightning power-up kills them ($B5B9).
Monsters that come back pay nothing. A defeated monster's record is marked ($CB02); if the same monster appears again it is removed without its item ($C962). The marks are cleared when a land starts ($E595).
The ending goes back to the title by loading Jellyland. Fire on the last screen of the ending takes the same road as game over: the engine reloads Jellyland from the disk, and Jellyland's file holds the title screen ($CE66, $CBA5, $F45E). There is no score screen.
A copy of the cheat in Pipeland. Pipeland's file has Jellyland's title code at $9EC4-$9F3D, the cheat's key check included, left over from the buffer the files were built in. Nothing calls it there.
Poking for lives. The German C64-Wiki gives $BE15 as a poke for unlimited lives and $37FD for extra time. In this release the first lands in the lightning's timer and the second on the counter that stops the clock ($37FD is DEC $1BAA); the lives routine is at $BDC1. The wiki's invincibility poke at $B61D does hit its mark, the grace flag above.