Rambo: First Blood Part II

01 · The loader

A load that switches the KERNAL off under itself

The disk is Ocean's original, mastered on 4 December 1985 and "PROTECTED BY XROM SYSTEM . TEQUILA SUNRISE BELGIUM", as a sector of the directory track says in plain text. The boot file loads at $0101, over the stack, so the KERNAL's own return from the load lands in it. It resets the drive and sends it the command &, which runs the 31-byte file of that name as drive code. That code runs the BAM, the sector the drive keeps in its buffer at $0700, as a program, and the BAM decrypts itself and hooks the drive's job loop: from then on every track and sector the C64 asks for is renumbered, so the directory and the files the C64 sees are not the ones on the disk.

The second load reads a hidden directory and a two-sector file that loads from $FE0B, runs past $FFFF and ends at $0001. Its last byte goes to the processor port and banks the KERNAL out while the KERNAL's own load loop is running. The processor carries on in the RAM beneath, where the boot file had already written a BRK at $F51E, and the BRK goes through the vector the stream itself left at $FFFE, into the next stage. After two more stages of decryption a fast loader reads the game from 409 sectors the directory does not list.

In the emulator used for this write-up (VICE 3.13.2 and 3.14.0 with a 1541), the first file the loader opens after the hidden directory is reported as missing, and the boot falls back to READY.. Sending the loader back once to open it again gets past it (the recipe is in the game folder's orientation.md on GitHub). Why the emulated drive misses that file was not found.

02 · A quirk

The helicopter's rotor only sounds with the music off

The flight starts a repeating sound on voice 1 (command 20) and, while the gunship is on screen, another on voice 2 (command 22). The routine that repeats them, loop_tick ($8423), does nothing while any voice belongs to the music (voice_mask, $828A). The game gives the music all three voices unless S has switched it off, so with the music on both loops stay silent. This was read in the code and reproduced on the driver in test_music.js; it has not been checked by ear in the emulator.

03 · A secret

The credits are in the high-score table

The 80 names of the heroes table start as the credits, ten letters to a name: CODING BY TONY, DAVE, BILL, MARTIN; GRAPHICS BY STEVE, TONY, DAVE; MUSIC AND SOUND FX BY MARTIN; TAPE LOADER BY BILL; DRINKS BY BREWS LEE; ASSISTED BY, followed by friends and colleagues (heroes_names, $B0F0). Every default score is a round thousand, from 80,000 down to 1,000 (table_defaults, $C435), so the credits scroll past in the attract pages until someone beats them. The music data also holds MUSIC BY MARTIN GALWAY ($922B), which nothing prints.

04 · Leftovers

Code and data nothing reaches

What	Where
Lock and unlock the stick. `read_stick` tests the lock, but only these two routines write it and nothing calls them, so the lock is never set.	`$07A4`, `$07AA`
Tune 28, which no code asks for.	`cmd_tune_chain2` `$84B8`
About 2.3 KB in the driver's sequence format that no tune pointer reaches.	`$B6FB`
A second copy of the screen-row drawer, assembled for other working bytes.	`$2833`
Code that would set CIA 2's time-of-day clock.	`$CF0D`
Code that would send RESTORE back to BASIC. The game points the NMI at an `RTI` instead (`$FFF9`), so RESTORE does nothing.	`$CE56`
The bytes `$C5 $CE $C4`, "END" in shifted PETSCII, between modules.	`$801C`, `$2833`, `$CF06`
Character-shaped bytes outside the video bank.	`$3A00`

05 · Difficulty

The jungle gets more dangerous the further north you go

Each frame bullet_fire ($2586) picks a soldier and fires with a chance of one in (255 − row/4)/4, where the row is how far north the screen is. At the south end that is one chance in 63; near the top of the map it is about one in 4.