Metro Cross AY mod - fix needed

[Alessandro]

This is a hack of Metro Cross which will play the AY music tracks of the Amstrad conversion in the background. It will load on 128/+2/+2A/+3 Spectrums with a DivMMC and ESXDOS, or with an emulator like Fuse which can emulate the Beta 128 interface attached to them.

http://disegnareconlaluce.altervista.or ... ss-mod.zip

Unfortunately, as it is, it is unusable on such machines for more than a reason.

On the 128/+2, the game is caught by a severe attack of 'snow effect'. Apparently the hack stores the music routine and the tunes in bank 1, which on those models is contended between the CPU and the ULA. I even tried to save a Z80 snapshot, convert it to TAP with Z802TAP and modify the resulting file so that bank 4 would contain the music data, and altered the main code at 25691 and 25732 in order to load bank 4 instead of 1. However the dreaded effect persists.

On the +2A/+3, the game runs fine until the player reaches level 5. A few screens after start, the game crashes and resets to 48 BASIC. The defect does not occur on the 128/+2 (you can run the game on SpecEmu and turn snow effect emulation off to see it).

Anyone willing to fix it please? A working TAP file would be great.

[bob_fossil]

I think the issue is that the interrupt table is in contended memory. In game, the I register is $60, which means the IM2 table is at $6060 - 24672. I think it needs to be moved so it's above 32768 to avoid the snow effect. So you'd need to find another 257 bytes of free memory above address 32768 on a 256 byte boundary and modify where I is set in game to point to the new table.

[bob_fossil]

For your MC128.szx, try poking:

Code: Select all

POKE 25541,195
POKE 25547,195

and then press SPACE to start the game.

This will move the IM2 table from $6000 to $C300 and change I from $60 to $C3. Hopefully the run of zeroes at this address that gets overwritten with the IM2 table aren't crucial for the game. I've tried a snapshot with these modifications made and the snow is gone on my +2. Played through the first level and it seemed okay. Can't guarantee it's fully fixed.

[Alessandro]

Hi @bob_fossil, thank you for the suggestion

It seems that on later levels that address for the IM2 table is too low, with obstacles appearing out of nowhere in the lowest lanes and other glitches, so I moved it to 57856 and so far it seems safe enough to hold it there.

http://disegnareconlaluce.altervista.org/MC128B.zip

Unfortunately there is always the same incompatibility with the +2A/+3, the game resets to 48 BASIC in the first few screens of level 5 (also check MC-2A-liv5.szx in the file linked in the first post).

[bob_fossil]

Hi @bob_fossil, thank you for the suggestion

It seems that on later levels that address for the IM2 table is too low, with obstacles appearing out of nowhere in the lowest lanes and other glitches, so I moved it to 57856 and so far it seems safe enough to hold it there.

Good work! As I said, I hadn't given my fix a massive amount of play testing but at least that can be crossed off the list of problems.

Unfortunately there is always the same incompatibility with the +2A/+3, the game resets to 48 BASIC in the first few screens of level 5 (also check MC-2A-liv5.szx in the file linked in the first post).

Sorry, I'm not familiar with debugging or fixing +2A/+3 specific issues. I'm sure someone like @Ast A. Moore might be able to help?

[Ralf]

Alessandro, why don't you write at zx.pk.ru directly to the people who made this mod?

By the way, I played it and Spectrum version of Metro Cross is really great, keeping over 90% of features of the original.
Yes, scrolling could be more fluent and less tearing. And it could be more colourful. But then it wouldn't be Spectrum

[Alessandro]

I don't speak Russian. Besides, I just found that the problem also occurs with the original US Gold release, so it is a case of incompatibility with the +2A not depending from the modification.

[Alessandro]

When loaded under +3 BASIC or in USR 0 mode, the game - either the original US Gold release or the modification - will jump to 15872 for some unknown reason at the start of level 5 or, in USR 0 mode, as early as the middle of level 4. In the original Spectrum ROM, the standard character set is stored at that address, namely the data for character "@". At that address, ROM 0 of the +2A/+3 contains a routine which, to my knowledge, should allow ROM switching. The game will execute the code, then the RET instruction at the end will go straight to location 0, causing a reset.

This is the code, taken from Paul Farrow's disassembly:

Code: Select all

        ld      (OLDHL),hl
        push    af
        pop     hl

.l3e05  ld      (OLDAF),hl
        ex      (sp),hl
        ld      c,(hl)
        inc     hl
        ld      b,(hl)
        inc     hl
        ex      (sp),hl
        push    bc
        pop     hl
        ld      a,(BANK678)
        ld      bc,$1ffd
        res     2,a
        di      
        ld      (BANK678),a
        out     (c),a
        ei      
        ld      bc,$3e2d
        push    bc
        push    hl
        ld      hl,(OLDAF)
        push    hl
        pop     af
        ld      hl,(OLDHL)
        ret     
        push    bc
        push    af
        ld      a,(BANK678)
        ld      bc,$1ffd
        set     2,a
        di      
        ld      (BANK678),a
        out     (c),a
        ei      
        pop     af
        pop     bc
        ret     

+3 system variables involved in the code:
X2 5B52h (23378) OLDHL Temporary register store while switching ROMs.
X2 5B56h (23382) OLDAF Temporary register store while switching ROMs.
X1 5B67h (23399) BANK678 Copy of last byte output to I/O port (8189). This port is used to control the +3 extended RAM and ROM switching (bits 0..2 - if bit 0 is 0 then bit 2 controls the 'vertical' ROM switch 0<->2 and 1<->3), the disk motor (bit 3) and Centronics strobe(bit 4). This byte must be kept up to date with the last value output to the port if interrupts are enabled.

Incidentally, 15872 is 256 * 62. Now, according to Archie Robbins' tip in the Yie Ar Kung-Fu entry in The Tipshop:

This game [Yie Ar Kung-Fu 128], between levels, left IM1 with interrupts enabled with IY not set to standard Sys Vars value. +3 decides to update the clock (speccy does this every 50th of a second) and instead of modifying 23672, as 48K and 128K do it modifies IY+62, usually the same, but in this case it's right in the middle of YAKF's code.... This is fixed by leaving the game in IM2 between levels.....

Could it be a similar case?

It is also interesting to note that if you reach the start of level 5 and let the clock reach zero without moving the character, the game will be over normally.

The following snapshots were taken at the start of level 5 with the game loaded under +3 BASIC and 48 BASIC respectively:

http://disegnareconlaluce.altervista.org/MC48-2A.zip

All of the above is, in the end, relevant for the game modification which adds AY music. After the fix suggested by @bob_fossil, it will run on the 128/+2. I played the original release under 48 BASIC on the +2A reaching level 11 without any issues.

[Ast A. Moore]

Well, it’s tricky. The game crashes because the developers mess around with the IY register while allowing the native interrupts to run.

The IY is modified three or four times during the game, so instead of treating each case individually, it’d make sense to write a custom ISR along these lines:

Code: Select all

	push iy
	ld iy, 5c3a
	call $38
	pop iy
	ei
	reti

Since the mod already uses a custom ISR, it’s trivial to augment it with the code above. The only problem is finding some room for it. There’s some at around $ffe0, so if the mod’s jump to the ROM’s ISR at $64b9 is instead redirected to the snipped above, it should all behave nicely.

Here’s an SZX file with the fix applied.

Give it a thorough run through, and if everything works fine, I’ll try to incorporate the fix into a TAP/TZX (time permitting).

[Alessandro]

Thank you @Ast A. Moore

The fix seems to get the game working as expected. I made a TAP file that will soon be added to the DivIDE/DivMMC collection of compatible TAP files.

http://disegnareconlaluce.altervista.org/MC128C.zip

If you could provide a fixed TZX of the original release, it would be great.

[Ast A. Moore]

Cool.

I’ve optimized my patch even further, and figured out where to place the bits and pieces inside the original release. Now, the tricky bit will be the reverse engineering of the original loader and decryptor. That’ll take some time.

[Ast A. Moore]

Bloody Alkatraz!

But I think I beat it. Will probably release the bug-fixed TZX tomorrow. Stay tuned.

[Ast A. Moore]

Well, I’ll be a monkey’s uncle, but I did manage to crack the Alkatraz copy protection and squeeze in the code for the +2A/+3 crash workaround. Took a whole lot of manual assembly and encryption. Bleepload is child’s play in comparison.

I also optimized my original code a little bit.

Played the game through to Round 17 with an infinite time poke. (The game wraps around after Round 16 with increased difficulty.) No nasty side effects, it seems.

So, grab it at the usual place (also, see link in my signature).

[Pegaz]

Well, I’ll be a monkey’s uncle, but I did manage to crack the Alkatraz copy protection and squeeze in the code for the +2A/+3 crash workaround. Took a whole lot of manual assembly and encryption. Bleepload is child’s play in comparison.

I also optimized my original code a little bit.

Played the game through to Round 17 with an infinite time poke. (The game wraps around after Round 16 with increased difficulty.) No nasty side effects, it seems.

So, grab it at the usual place (also, see link in my signature).

Outstanding work, thank you.

[Alessandro]

Thanks

A TAP file of this fix will soon be added to the TAP files for the DivIDE collection.

Just for the record, the AY mod was made by Slider and @goodboy in 2013.