This article is part of a series exploring the reverse engineered inner workings of Downland, a game for the Tandy Color Computer, released in 1983, written by Michael Aichlmayr.
Late last year I started one of those projects I always wanted to do but could never find the time or couldn’t start it successfully. I reverse engineered Downland for the Tandy Color Computer, released in 1983.
Downland was one of those formative games for me. My best friend had a CoCo 2 with a copy of the game and we spent hours trying to beat it. But man, that game is hard.
The player jump physics are game’s best and aggravating aspect. They were the most fluid I had ever seen. But man, no air control whatsoever. When you leaped, you were committed all the way, like in Castlevania for the NES. The jump was floaty enough that there was enough time for a drop to appear ahead and fall on top of you just when you landed. Those drops are the worst.
It was my third or fourth attempt at RE’ing the game. I forget. For these first attempts I had used MAME’s debugger to run through the code and memory variables. I’d try to track memory changes and figure out what they did. And of course I had to learn how to read 6809 assembly code. (hint: I am not an assembly code guy)
At the time I could figure out some of the player state and the section of memory that tracked the drop state. But this method was too slow going for me. The MAME debugger was too cumbersome to use. I’d give up after a week or two. With just the MAME debugger and a text file, reverse engineering this way was like trying to figure out the layout of a blacked out mansion while walking around holding a match.
This time was successful because I decided to learn Ghidra (https://github.com/NationalSecurityAgency/ghidra). It helped a lot with making sense out the code and rom layout, and figuring out the data formats. I also used the trs80gp emulator (http://48k.ca/trs80gp.html) which has great debugging capabilities. The pair of tools really opened everything up and in very little time with these new found powers I managed to eclipse the little knowledge I had gained in the past doing things manually. I soon started learning things about the game that only the original author had ever seen. Finally being able to unlock secrets of this 40 year old game gave me such a wonderful feeling.
I forget the timeline but I think it took me over two months, maybe three, to get the disassembly in a state where I could make sense of how most of everything worked. Enough to be able to start figuring out how to convert it to the C programming language. At the same time I created a tool to convert the Ghidra listing to a buildable assembly file for LWTools (https://www.lwtools.ca/), with which I could build a byte-for-byte reproduction of the original Version 1.1 rom.
After the initial two months I kept updating the disassembly during the year the more I had to get into the details during the conversion to C. Some corners of the disassembly could use a bit more documentation but what’s there I believe is very usable.
The work can be found on GitHub at https://github.com/pw32x/Downland_RE
Maybe in the future if I’m not too lazy I’ll talk about more in detail.
