Repton 3: Emulator/RNG issue

[skipchris]

Hi,

Apologies if not posting in the correct sub-forum, this is my first post.

I have an issue with Repton 3, but I don’t know where to begin solving it. Any pointers would be greatly appreciated.

Repton 3 was one of the first games I ever played and is an enduring obsession. I’m currently playing the bbc micro version on BeebEm 4.

My issue is simply thus — when playing Screen E (Majesty) of Toccata, I simply cannot beat the timer and get past the fungus *when having played through screens A-D first*. I’ve tried this time after time, and on every attempt the fungus has grown and blocked my path.

Conversely, if I start from a password, I can always clear the fungus.

I don’t *think* this is a bug in the original game… If so, I can’t find a reference to it by googling. So my best guess is that it’s caused by how the emulator is generating random numbers.

I’m a programmer by trade, so I (probably) have the skills to get to the bottom of this, but I haven’t the faintest idea where to start (or if I shouldn’t bother because it is a bug in the original).

Any help, anyone?

[Diminished]

Welcome to the forum.

I bet this is a bug in the original game...

Do we have a disassembly of this anywhere? I'm sure I've seen someone on here say they'd been through it.

I did start disassembling Repton 1 at one point (it was fascinating to see the difference in programming style between Tim Tyler and Mike Jakobsen, having gone through Citadel first -- spoilers: Tyler was much more keen on using the stack) but I never finished it.

It might help if you could clarify the precise version you're using, as there may be a few different ones. Did you get it from Stairway to Hell?

D

[geraldholdsworth]

This certainly does sound like a bug. I'm guessing that it doesn't matter if it is a real BBC or an emulator, the OS will still be the same...which brings me to an additional question - what is the OS version you are trying it on (just type *HELP)?

EDIT: thinking about it, the OS version might not make a difference. Won't hurt to let us know which you're using though.

[skipchris]

Thanks for chiming in folks.

It has something of the feel of a bug in the original, but I just thought if this was definitely the case I’d be able to find reference to it online, as it basically makes the toccata scenario un-completable (compared to countless references to the missing diamond in Repton 2 which makes the whole game uncompletable).

*HELP yields:
OS 3.20
MOS
TERMINAL 1.2
VIEW B3
ADFS 1.5
EDIT 4
ViewSheet B1.0
DFS 2.24
SRAM 1.04

I’m not sure where exactly my disk image is from. Doesn’t appear to match the one on Stairway To Hell, which I’ve now downloaded. I’ll have a crack using this version at lunchtime and let you know if I get on any different.

[Diminished]

Possible approach (thinking aloud):

- find a level with fungus, or just design one in the editor
- save state
- wait for the fungus to spread, note where it spreads to
- load state again, open debugger
- find a byte in VRAM that is overwritten by the new piece of fungus, set a watchpoint
- wait for the watchpoint to be hit
- examine stack, find the subroutine that deals with the fungus

I have a feeling this might not work though; it wouldn't surprise me if R3 uses some intermediate representation of the level (because of the editor). It depends on whether the fungus routine itself updates the screen, or if it just makes a note of the spread in a list and then the update is pushed to the screen later.

[lurkio]

I’m not sure where exactly my disk image is from. Doesn’t appear to match the one on Stairway To Hell, which I’ve now downloaded. I’ll have a crack using this version at lunchtime and let you know if I get on any different.

Another version to try:

• http://bbcmicro.co.uk/game.php?id=425

[billcarr2005]

And another version (straight sector dump of the original disk)

[skipchris]

Cheers for the alt versions, folks.

Can confirm it’s happening with the version from STH.

I’ll try these and see what happens. Just mildly annoying that the ‘success’ case (enter password) is very quick to test, but the ‘error’ case requires me to play thru screens A-D to test.

Silver linings though, I am probably the world speedrun champ of those four screens!

[skipchris]

Also, just looking at what else I have at my disposal… 

Is it reasonable to test with BeebEm in different hardware modes? (Currently using Master, but have the option of BBC-B and BBC-B+)

[skipchris]

Further research:

https://www.youtube.com/watch?v=k7oNG4g ... dex=6&t=0s

Looks like it *is* a bug in the original (or at least not just affecting me).

Of course, this raises the question, "is there a workaround"?

[Diminished]

OK, that's really interesting.

It's not quite the end of the story, though, since that guy is playing on an emulator, and it might very well also be BeebEm; he doesn't specify whether the issue occurred on original hardware or not. I still think it's unlikely to be emulator-specific, although if you're not sick to death of trying you could have a shot in jsbeeb (which is based on b-em) and see if it persists.

I did have a poke around this morning to try to see if I could locate the fungus sub, hoping that it would provide a clue as to where it gets its RNG from, but didn't make any progress. I imagine if the offending code could be found, then a patch could be put together, provided there's enough memory spare.

[Diminished]

So I dumped the RAM in-game and tossed it into WFDIS. The code looks a little bit evil. I see a lot of indirection -- jump tables, pointer tables, and I'm guessing an orgy of self-modification.

I let the game run for about a second and had the emulator print all the JSRs, so if anyone wants to follow along, here's a list of subroutines it called in that 1s of gameplay. Probably a good starting point for further spelunking. (EDIT: Stairway disc version).

JSR 1706
JSR 1712
JSR 1718
JSR 1916
JSR 1ca6
JSR 27a0
JSR 27a3
JSR 2833
JSR 285a
JSR 2880
JSR 28a1
JSR 2960
JSR 2966
JSR 296c
JSR 296f
JSR 29a
JSR 29a5
JSR 2ba7
JSR 2e6b
JSR 303c
JSR 3074
JSR 3146
JSR 401
JSR 407
JSR 40a
JSR 40d
JSR 5811
JSR 5e4
JSR 64e

[geraldholdsworth]

There is someone on here that knows Matthew Atkinson. Might it be worth asking him if he still has the source, and if he is willing to share?

[Pernod]

There is someone on here that knows Matthew Atkinson. Might it be worth asking him if he still has the source, and if he is willing to share?

Yes, I know him. He's in the Acorn Facebook group so anyone can easily contact him.

[SimonSideburns]

Cheers for the alt versions, folks.

Can confirm it’s happening with the version from STH.

I’ll try these and see what happens. Just mildly annoying that the ‘success’ case (enter password) is very quick to test, but the ‘error’ case requires me to play thru screens A-D to test.

Silver linings though, I am probably the world speedrun champ of those four screens!

Would it not be possible to save a machine state save (whatever you want to call it) once you've completed screens A to C?

[Diminished]

Would it not be possible to save a machine state save (whatever you want to call it) once you've completed screens A to C?

I think the point was to try different versions -- save states wouldn't help with that, as they contain the whole of RAM at the time of the save, so you'd effectively be loading the old version back in again.

[Rocketeer]

Dave Moore has all the source for R3 for all versions, I passed it onto him several years ago along with Tempest etc.
No or very little self modifying code in there.

From memory the fungus code scanned a game row each pass of the main loop and if it found a cell occupied by fungus would
generate a random number, certain values would then try to grow the fungus, calculate a random offset in four (only four since we didn't
want it growing diagonally through walls) directions, if it could grow into that space (earth/space etc) then fungus was added there,
screen refreshed if in view, Monster/Repton death check routines called then exit otherwise continue row scan until until end of row
or one new fungus added...I think.

[Arcadian]

Dave Moore has all the source for R3 for all versions, I passed it onto him several years ago along with Tempest etc.

I'm afraid I certainly never received any source code from you, for any games (I'm assuming I'm replying to Matthew?). That's something I'd have definitely remembered. I still have all my Acorn related emails dating back to '99 when I launched the STH site.

Did you forward it to someone else in the scene perhaps? And do you still have all the source?

[Rocketeer]

Hi Dave, yes it's Matthew. If not you then I have no idea who I sent it to all those years ago. Do you have the original artwork for UIM?
I'm pretty sure that the person who has that is the one I sent the source to. No source left for anything I'm afraid.

Turns out it was my faulty memory, I sent the source discs to someone else around the same time I was e-mailing Dave. Apologies to Dave for the confusion. For anybody else please feel safe to send vintage discs etc to Dave for archiving. They are in very safe hands. As you may have heard these and many other source dics have recently been re-discovered and are currently being recovered.

[Diminished]

Well, that's ... unfortunate.

Thanks for stopping by, Matthew.

[skipchris]

(hi, Matthew!)

meditating deeply on this, i think i recall reading that anecdotally there’s a delay at the start of the level before fungus grows at all… So it’s possibly that that’s misbehaving rather than the fungus growth routine itself.

still need to test more.

[Diminished]

I've made a little progress. I've located the fungus routine. It's at &27B1.

Code: Select all

fungus              dec v_downcount_1_lo
                    bne L_fungus_ret
                    lda #$04
                    sta v_downcount_1_lo
                    dec v_downcount_1_hi
                    bpl L27c1
                    lda #$17
                    sta v_downcount_1_hi
L27c1               ldx #$1b
                    stx $62
L27c5               lda v_downcount_1_hi
                    ldx $62
                    jsr L1ca6
                    cmp #$1a
                    bne L282b
                    lda $0f
                    and #$03
                    tay
                    lda $27a9,y
                    clc
                    adc $62
                    sta $60
                    tax
                    lda $27ad,y
                    clc
                    adc v_downcount_1_hi
                    sta $61
                    jsr L1ca6
                    cmp #$1a
                    beq L282b
                    cmp #$02
                    beq L27ff
                    cmp #$03
                    beq L27ff
                    cmp #$06
                    beq L27ff
                    cmp #$1e
                    beq fungus_kill_player
                    bne L282b
L27ff               sta $87
                    lda #$1a
                    ldx $60
                    ldy $61
                    jsr L1ca9
                    lda $60
                    sta $70
                    lda $61
                    sta $72
                    lda #$00
                    sta $71
                    sta $73
                    lda #$ff
                    sta $90
                    jsr S27a3
                    bcs L_fungus_ret
                    jsr L2003
                    lda #$1a
                    sta $87
                    jmp L2003
                    
L282b               dec $62
                    bpl L27c5
L_fungus_ret        rts
                    
fungus_kill_player  inc v_death_flag
                    rts
                    

[Diminished]

(hi, Matthew!)

meditating deeply on this, i think i recall reading that anecdotally there’s a delay at the start of the level before fungus grows at all… So it’s possibly that that’s misbehaving rather than the fungus growth routine itself.

still need to test more.

I think you may be spot on with this.

There's a 16-bit counter at &85/&86. At the start of a game, or when you enter a password, the high byte is set to &ff. However, when the fungus routine times out, it seems to reset the counter to &04 -- it won't ever go back above that value ... So you do indeed get a grace period of about ten seconds -- either at the start of a brand new game (screen A) or upon entering a password -- during which the fungus is guaranteed not to spread.

I've tried returning to the status screen by pressing RETURN; that doesn't reset the counter to &ff. Neither does losing a life, so I don't think there's a workaround available without modifying the game.

The patch is obvious -- reset that counter to &ff at the start of each new level -- although I haven't quite managed to work out how to do that yet.

[Rocketeer]

The initial delay before the fungus seems right, I think that came at the request of Steve Botterill who found that if you had a screen with a lot of fungus to start with then it was on your case straight away. He wanted a fungus delay at the screen start so as not to make it too difficult.

IIRC there is a bug Richard Hanson told me about reported to him by a customer (don't know if it's documented) in that when you move into the crown at the game end then enter the map as Repton is moving, then return. The crown is gone and so the game doesn't end. I think it would have been corrected by swapping around two subroutines in the main loop. He did say it was so obscure that I was not to bother with it.

[Diminished]

The initial delay before the fungus seems right, I think that came at the request of Steve Botterill who found that if you had a screen with a lot of fungus to start with then it was on your case straight away. He wanted a fungus delay at the screen start so as not to make it too difficult.

IIRC there is a bug Richard Hanson told me about reported to him by a customer (don't know if it's documented) in that when you move into the crown at the game end then enter the map as Repton is moving, then return. The crown is gone and so the game doesn't end. I think it would have been corrected by swapping around two subroutines in the main loop. He did say it was so obscure that I was not to bother with it.

I've just duplicated that one (I think you mean the timebomb rather than the crown). Nice.

[Rocketeer]

Yes the time bomb! Was going to confirm it myself tonight but you beat me to it.

[Diminished]

Matthew, if you're still reading this ... what are the chances I can find a bit of spare RAM for a patch? Do you have any idea where?

EDIT: This looks like where the patch is needed, starting at &2FF8.

Code: Select all

Ltimebomb_defused   jsr i_disable_gameplay
                    jsr L170c
                    jsr L1919
                    lda v_current_level
                    asl a
                    tax
                    lda $3230,x
                    ora $3231,x
                    beq L3019
                    jsr i_display_status_2
L3010               jsr i_check_spc_or_fire
                    tya
                    bmi L3010
                    jsr L1919
L3019               inc v_current_level
                    lda v_current_level
                    ; CONSTANT: levels per episode
                    cmp #$08
                    bcs L3036
                    jsr L2409
                    jsr L2106
                    jsr L0404
                    jsr L2406
S302e = * + 1       
                    jsr L2103
                    jsr S307b
                    jmp Linit_level

Replacing that final JMP at &3033 with a jump to a short routine to reset the fungus counter ought to do the trick. Then the patch routine would need to resume by jumping to Linit_level (&2FAB). Just need to find a few bytes of spare RAM somewhere.

[Arcadian]

Hi Dave, yes it's Matthew. If not you then I have no idea who I sent it to all those years ago. Do you have the original artwork for UIM?
I'm pretty sure that the person who has that is the one I sent the source to. No source left for anything I'm afraid.

Yes, I bought the art for UIM and Psyanki (both of which I still have) but I wasn't send any floppies/emailed any images? (Had I received the source on floppies, the first thing I would have done is immediately dump the discs for posterity).

Do you have any email backups so we can identify where the source/discs went (I'm assuming this may be unlikely as we corresponded via your Grattan email account back in the early noughties).

Can you remember if you sent out the actual floppy discs, or did you extract images yourself and email out ssd's/dsd's?

[Rocketeer]

Matthew, if you're still reading this ... what are the chances I can find a bit of spare RAM for a patch? Do you have any idea where?

EDIT: This looks like where the patch is needed, starting at &2FF8.

Code: Select all

Ltimebomb_defused   jsr i_disable_gameplay
                    jsr L170c
                    jsr L1919
                    lda v_current_level
                    asl a
                    tax
                    lda $3230,x
                    ora $3231,x
                    beq L3019
                    jsr i_display_status_2
L3010               jsr i_check_spc_or_fire
                    tya
                    bmi L3010
                    jsr L1919
L3019               inc v_current_level
                    lda v_current_level
                    ; CONSTANT: levels per episode
                    cmp #$08
                    bcs L3036
                    jsr L2409
                    jsr L2106
                    jsr L0404
                    jsr L2406
S302e = * + 1       
                    jsr L2103
                    jsr S307b
                    jmp Linit_level

Replacing that final JMP at &3033 with a jump to a short routine to reset the fungus counter ought to do the trick. Then the patch routine would need to resume by jumping to Linit_level (&2FAB). Just need to find a few bytes of spare RAM somewhere.

The way I developed it was quite primitive since I didn't have a linker. A block of code is defined by a jump table of several JMPs into the actual routines themselves so I didn't have to keep changing addresses of those routines used in other assembler. In general the last JMP was the last routine highest in memory so if you can find that and where it ends then the memory between that and the next set of JMPs should be free.

[Rocketeer]

Hi Dave, yes it's Matthew. If not you then I have no idea who I sent it to all those years ago. Do you have the original artwork for UIM?
I'm pretty sure that the person who has that is the one I sent the source to. No source left for anything I'm afraid.

Yes, I bought the art for UIM and Psyanki (both of which I still have) but I wasn't send any floppies/emailed any images? (Had I received the source on floppies, the first thing I would have done is immediately dump the discs for posterity).

Do you have any email backups so we can identify where the source/discs went (I'm assuming this may be unlikely as we corresponded via your Grattan email account back in the early noughties).

Can you remember if you sent out the actual floppy discs, or did you extract images yourself and email out ssd's/dsd's?

Dave, I can only conclude it got lost in the post then. I did send out the actual floppies probably five in total maybe more. Didn't have any machines to make backups on then so might have been touch and go even if they actually had arrived.