Planet Bob - Analyzing the Park Patrol CRT

[RSS Bot]

Hi there!

 

For the start, I should mention, that there's 4 completly different 100% versions of Park Patrol available, which could be used as base for a NES port:

• An image of a original Tape
  
• An image of a original disk
  
• A dump of a orignal Cartridge
  
• A Remember Crack
  

They'd all have their advantages and disadvantages. I choose to check out the cartridge first, because it it seems to have the least overhead of all versions, having the game concentrated in 32K.

 

Ok, I'm a bit rusty on C64 stuff, so please bear with me and feel free to correct me wherever I'm going totally wrong

 

First I had to learn, how the "CRT" format for C64 emulators works. It's some pretty straightforward header info wrapping around the actual dump, detaling all info the emulator needs to know.

 

So for the Part Patrol cartridge dump, the info it basically reveals is this:

 

We have 4 banks of 8K ROM blocks, that will all get mapped into the C64 adaress range from $8000-$9FFF

 

Unlike VCS bankswitching, only the first and the third bank have some startup code though, so I think the hardware secures somehow that it won't power up with the other two active.

 

With a Hexeditor I extracted those two 8K banks out of the CRT file. For those of you who love digging into Hexfiles, I found two interesting ASCII Strings there:

 

Bank 1: 2078FILE PRESS EXPERT

(Googling doesn't reveal anything, I'd assume it's got something to do with an Activision inhouse packer)

 

Bank 3: N0:ACTIVISIOLOTONYMON

(Hm... ACTIVISIO - LO - TONY - MO - N ?!? Tony (Ngo) is the name of the programmer...)

 

So, disassembling the entry code for bank 1 reveals this snippet:

CODE

S_8009

stx $D016

jsr P_FDA3; $FDA3

jsr P_FD50; $FD50

jsr P_FD15; $FD15

jsr P_FF5B; $FF5B

cli

jsr P_E453; $E453

jsr P_E3BF; $E3BF

jsr P_A644; $A644

ldx #$FB

txs

lda #$00

sta $FB

lda #$80

sta $FC

lda #$00

sta $FD

lda #$CE

sta $FE

ldy #$00

ldx #$02

B_8039

lda ($FB),Y

sta ($FD),Y

iny

bne B_8039

 

inc $FC

inc $FE

dex

bne B_8039

 

jmp J_CE4A; $CE4A

 

 

Disassembling the code for bank 3 reveals tons of code, so I think I'll spend some quality time with the small snippet above first

 

http://www.atariage.com/forums/index.php?a...;showentry=2005