Q-bert (USA)

Q-bert (USA) is on a CNROM board with 32,768 bytes of program. A crawl of 6,400 steps from power-on kept 56 paths that found new code. Played back over 251,556 frames, they executed 8,718 bytes of it, 27 percent.

What the rules named

The 227 routines the runs entered

Every place the game's code was entered, by a call, an interrupt or a jump through a table. The ones a rule named come first, with what the rule saw, and their names in the listing say what they are: a poll, an engine, a drain.

at	its name in the listing	entered by	times	what it is, and the evidence
$911E	`sprites_911E`	a call	1,304,277	The sprite writers: frames it ran in 81,519, writes to the sprite page 3,237,903
$91EC	`sprites_91EC`	a call	1,079,301	The sprite writers: frames it ran in 66,686, writes to the sprite page 1,079,299
$8207	`engine_8207`	a call	282,967	The jump engine: tables 18, jumps through them 282,967
$CE58	`sound_CE58`	a call	179,428	The sound driver: frames it ran in 45,282, writes 15,987
$CC12	`poll_CC12`	a call	163,051	The poll: port $4016, reads a frame 16, strobes a frame 4 The poll: port $4017, reads a frame 16, strobes a frame 4
$CAF5	`nmi`	each frame (NMI)	81,735	The game inside the interrupt: frames it ran in 81,791, frames in all 82,296, the spin is at $CAF2
$90A5	`drain_90A5`	a call	81,573	The palette writers: frames it ran in 81,573, writes 7,136 The picture writer: frames it ran in 81,573, writes 257,177, in the blank 256,645, while drawing 532
$CB69	`scroll_CB69`	a call	81,573	The scroll writer: frames it ran in 81,545, writes in the blank 163,090
$8000	`random_8000`	a call	81,525	The random byte: frames it ran in 80,637, bytes $003C,$003D, rotates 2, exclusive-ors 1
$9292	`sprites_9292`	a call	81,520	The sprite writers: frames it ran in 81,519, writes to the sprite page 4,137,789
$BA3C	`compare_BA3C`	a call	11,684	Where two things are compared: instructions 2, pairs of bytes 25, bytes in all 20, times compared 12,986, X positions at $0480,$0482,$0483,$0484,$0485,$0490,$0492,$0493,$0494,$0495, Y positions at $0460,$0462,$0463,$0464,$0465,$0470,$0472,$0473,$0474,$0475
$B39E	`dispatch_B39E`	a table	2,654	Where two things are compared: instructions 1, pairs of bytes 6, bytes in all 5, times compared 373, X positions at $0480,$0482,$0483,$0484,$0490
$B4D7	`dispatch_B4D7`	a table	2,150	Where two things are compared: instructions 3, pairs of bytes 9, bytes in all 9, times compared 4,211, X positions at $0480,$0482,$0490, Y positions at $0460,$0462,$0463,$0464,$0465,$0470
$E88D	`sprites_E88D`	a call	971	The sprite writers: frames it ran in 971, writes to the sprite page 971
$B404	`dispatch_B404`	a table	743	Where two things are compared: instructions 1, pairs of bytes 2, bytes in all 3, times compared 328, Y positions at $0460,$0462,$0470
$CC3B	`bank_CC3B`	a call	194	The bank switch: writes 388, in the blank 4, while drawing 384
$CA85	`reset`	power-on	56	The bank switch: writes 112, in the blank 112, while drawing 0 The sprite writers: frames it ran in 81,791, writes to the sprite page 14,336
$CC37	`bank_CC37`	a call	56	The bank switch: writes 112, in the blank 0, while drawing 112
$9329		a call	1,160,818
$8452		a call	664,576
$D3CD		a call	179,428
$D430		a call	104,220
$CE35		a call	98,459
$D4C9		a call	91,411
$CB9F		a call	81,573
$CBB5		a call	81,530
$CD6C		a call	81,530
$CDDA		a call	81,530
$CE3C		a call	81,530
$CBDB		a call	81,526
$84FD		a call	81,517
$CBF7		a call	81,500
$9C73		a table	50,426
$D20E		a call	47,694
$D237		a call	47,694
$D1A7		a call	35,214
$D1C6		a call	35,214
$9CDC		a table	31,422
$E510		a call	31,390
$D252		a call	29,546
$E8B9		a call	26,880
$E8E0		a call	26,196
$E85F		a call	26,096
$8132		a call	24,896
$E4E9		a call	23,441
$E5D4		a table	22,899
$E611		a table	21,912
$84F4		a call	18,620
$8220		a call	18,021
$84A1		a call	17,911
$C4FF		a call	15,395
$C272		a call	14,309
$D0B7		a call	14,270
$811C		a table	14,095
$802D		a table	12,958
$D1D3		a call	12,483
$C1F1		a call	12,376
$C7C8		a call	12,213
$A1A4		a call	11,809
$9EF1		a table	11,721
$E4C6		a call	11,721
$C12E		a call	11,720
$B9C3		a call	11,574
$A7C5		a call	11,552
$A880		a call	11,552
$B123		a call	11,552
$C28E		a table	11,416
$C29D		a call	11,416
$C54A		a call	10,771
$B17E		a call	10,060
$C286		a table	9,591
$C4E3		a call	9,133
$C216		a table	8,155
$C4C4		a call	8,155
$C55F		a call	7,985
$E6D6		a table	7,508
$C56A		a call	7,410
$81B5		a call	6,436
$9D9A		a table	5,600
$CC8E		a call	4,767
$BCE7		a call	4,704
$C555		a call	4,624
$B1D3		a table	4,300
$E741		a table	4,185
$E7A3		a call	4,185
$D3E7		a table	4,053
$A8C1		a call	4,041
$D2BA		a table	3,854
$80AE		a table	3,834
$B1B3		a table	3,712
$BFD9		a call	3,544
$C243		a call	2,984
$C268		a call	2,878
$EF72		a call	2,801
$EF88		a call	2,800
$E796		a table	2,704
$B4F3		a table	2,605
$84EE		a call	2,334
$84F6		a call	2,334
$F01B		a table	1,985
$A9B6		a call	1,957
$D1FD		a call	1,788
$BFAD		a call	1,772
$9E0D		a table	1,676
$BC73		a call	1,568
$BC82		a call	1,568
$BDCB		a call	1,568
$BDD9		a call	1,568
$BDE7		a call	1,568
$BDF5		a call	1,568
$C145		a call	1,492
$C190		a call	1,492
$C196		a call	1,492
$E81A		a call	1,406
$B4E7		a table	1,374
$B233		a table	1,339
$D370		a table	1,108
$D39C		a call	1,000
$A1C9		a table	962
$D38F		a call	856
$D2C1		a table	806
$C21F		a table	787
$C2F7		a call	786
$E59A		a table	784
$E5AF		a table	784
$B1C3		a table	709
$CEBE		a call	674
$E94D		a call	642
$C2AF		a table	599
$C33E		a call	599
$E575		a call	594
$CBC3		a call	584
$C23C		a call	580
$A222		a table	561
$CB89		a call	533
$E5DF		a table	495
$E5FA		a table	492
$9E73		a table	476
$CD57		a call	418
$C000		a call	408
$A217		a table	384
$B6C0		a call	381
$D2D4		a table	379
$E940		a call	322
$E730		a table	300
$9E1F		a table	297
$F0A6		a table	256
$814C		a call	253
$B73D		a call	236
$F102		a call	232
$83E0		a call	228
$C37D		a table	215
$EFDA		a table	200
$E51D		a table	199
$E918		a call	198
$83E4		a call	193
$9E2B		a table	174
$F04E		a table	148
$D3DA		a call	144
$D340		a table	138
$9E23		a table	132
$8143		a call	121
$8303		a call	117
$B31E		a table	116
$CC56		a call	115
$E645		a call	115
$81D4		a call	114
$B267		a table	113
$E70D		a table	100
$E6E9		a table	99
$B243		a table	94
$B37F		a table	93
$D2EB		a table	90
$E77F		a table	87
$EFFD		a table	80
$A2CA		a table	78
$C448		a call	72
$F072		a table	72
$9E27		a table	70
$B665		a table	64
$A871		a call	62
$A913		a call	62
$A99C		a call	62
$AA50		a call	62
$AA6A		a call	62
$83BA		a call	59
$9E9D		a call	58
$8157		a table	56
$8174		a table	56
$817F		a table	56
$9E5D		a call	56
$BC24		a call	56
$BE1C		a call	56
$CA8A		an interrupt (IRQ)	56
$CB53		a call	56
$9CA8		a call	55
$B149		a call	54
$9CE7		a table	52
$80F2		a table	50
$8107		a table	50
$81CF		a call	50
$81D8		a call	50
$8236		a call	43
$8290		a call	39
$E6FB		a table	33
$9D20		a table	30
$8265		a call	28
$9E41		a table	28
$9EC8		a table	28
$BBE2		a call	28
$C77A		a call	28
$B2B3		a table	27
$B2F7		a table	27
$EFCC		a table	25
$EFE5		a table	25
$C356		a table	19
$C806		a call	18
$A1D4		a table	17
$C219		a call	15
$C42F		a call	15
$E908		a call	9
$C451		a call	6
$EFA2		a table	5
$F037		a table	4
$C459		a table	3
$C49D		a table	2
$CD9B		a call	1

Where it waits

Loops a rule named that sit inside a routine and are not themselves a place the code is entered.

at	its name in the listing	what it is, and the evidence
$CAF2	`spin_CAF2`	The idle spin: turns 550,559,895, turns a frame 6,689

The tables it jumps through

A table of addresses the game picks one from. Some sit right after a call to a jump engine; others are anywhere in the cartridge, and we find them by where the address the game jumped through was loaded from. Some games jump by pushing an address and returning to it, and some keep a table as two, the low bytes of its addresses in one place and the high bytes in another; both are found the same way. An entry is counted as far as the runs saw one taken; the true table may be longer. The last column is the byte of memory whose value picked the entry, where we could follow it: the game's mode, or what one of its objects is doing.

at	reached	entries	taken	chosen by the byte at
$801B	after a call	9	8	$0018
$8179	after a call	1	1	$0090
$9C8A	after a call	14	9	$0034
$9CE1	after a call	3	3	$0090
$9DD4	after a call	5	5
$A1CE	after a call	3	3	$0088
$B1A1	after a call	9	4	$0613, $0614, $0615, $0616
$B1B9	after a call	4	4	$061B
$B1C9	after a call	4	4	$061E, $061B
$B1D9	after a call	5	5	$061C, $061D, $061B
$B239	after a call	4	4	$061B
$C1F8	after a call	11	9	$0053
$D457	through a pointer	21	7
$E515	after a call	4	4	$008E
$E59F	after a call	1	1	$008F
$E5D9	after a call	3	3	$008F
$E6DB	after a call	7	7	$008F
$E885	after a call	4	4	$002E
$EF8E	after a call	10	10	$060A

The memory its routines share

567 bytes of memory were written by one routine and read by another, and 73 places were reached through an index, which is what a table or a set of object slots in memory looks like.

The console's 2,048 bytes of memory, one row for each 256. A numbered span is a column of one of the object tables drawn below, counted in the same order, as long as the table and filled as it is there. Where a table's columns overlap, its things lie one after another, each with all its properties, so the table is one outline with a mark where each property starts. A dark square is a position a rule saw compared. A tick under a row is one of the 24 busiest shared bytes. The second row is the page the processor keeps its stack in. Reaches through an index that belong to no table are not drawn: the loops that clear memory reach nearly every byte.

Reaches through an index: those that hold positions, then the longest

from	bytes reached	instructions	positions it holds
$0460	16	24	5 down
$0480	16	15	5 across
$0470	6	3	5 down
$0490	6	3	5 across
$0300	256	39
$0700	256	14
$0400	256	12
$0500	256	1
$0200	253	2
$0201	253	1
$0202	253	1
$0203	253	1

What travels with a position

Arrays that at least two routines step through together with an array of positions, across the same range. That is what a table of the things on the screen looks like in memory: one array for each property, one slot for each thing. We can say which arrays hold positions, which of the others get added into them, which is what a speed does, which pick the way through a jump table, which is what a state or a kind does, and which are only ever counted down, which is what a timer does. What the rest hold is not named yet.

Table 1: 10 arrays of up to 16 slots that 24 routines step through together. Each column is an array at its address and each row a slot, so one thing on the screen is one row across all of them. A number under a column is how many more bytes that array was reached across than the table is long. X and Y are positions, and the darker squares are the slots a rule saw compared. + is added into a position, which is what a speed does. → chose a jump, which is what a state or a kind does. ↓ is only ever counted down, which is what a timer does. A plain outline travels with them and is not named yet.

slots	arrays	routines	positions across	positions down	added into them	choosing a jump	counted down	travelling with them
16	10	24	$0480, $0490	$0460, $0470		$0611, $0619		$0400, $0410, $0420, $0440, $0611, $0619

The 24 busiest shared bytes

byte	reads and writes	routines writing	routines reading
$0000	9,977,128	6	6
$0008	8,630,698	6	6
$0009	8,406,231	6	6
$0001	7,593,107	6	6
$0003	6,703,813	6	6
$0002	5,145,878	6	6
$0005	5,067,354	6	6
$000E	3,430,929	4	6
$0004	2,963,678	6	6
$000C	2,501,844	2	3
$000B	2,260,331	3	3
$0022	1,013,183	2	3
$00AB	926,224	2	6
$009A	608,721	6	6
$00F7	489,112	2	3
$00A5	440,417	6	6
$000D	421,839	5	6
$0032	384,952	6	6
$0030	376,590	5	6
$0098	375,027	3	6
$0099	375,027	3	6
$001E	311,568	6	6
$009B	306,222	6	6
$0601	287,425	6	5

This page shows none of the game's bytes. The listing these figures were read from stays with the cartridge.

All the games