Game Development Archeology: Zelda on Game Boy comes with source

Imagine you’re writing a Game Boy game, and the resulting ROM with all the code and data is just a little over one megabyte in size. No big deal, just pad the game to two megabytes, and use a 2 MB ROM in the cartridge. Just tell the linker to allocate 2 MB or RAM, put the actual data at the beginning, and then write a 2 MB “.gb” image to disk, which will then be sent to the ROM chip factory.

Now imagine you’re doing this in MS-DOS. Your linker, probably written in C, calls malloc() of the runtime library of the C compiler. You already know where this is going?

While modern operating systems will always clear all malloc()ed memory, so that you cannot get to other processes’ data, this was uncommon in the single-user MS-DOS days. If you allocate 2 MB of RAM (the linker must have used a DOS extender or XMS), you’d get memory with random data in it: leftovers from whatever was in this memory before. (seppel tells me that this can also be caused by seek()ing over EOF in MS-DOS, in which case the previous data on the hard disk will be in the image.)

This is what happened with the 1998 Game Boy/Game Boy Color game “The Legend of Zelda – Link’s Awakening DX” (MD5: ee0424cf1523f67c5007566aed70696d). If you look at the image starting at 0×106000, you will find all kinds of interesting data, which will tell you a lot about the game’s development. Let’s call this “game development archeology”…

The ROM image includes big chunks of Borland’s Turbo C IDE (Turbo Vision interface) for DOS, as well as traces of the “QBasic” MS-DOS Editor. It is unclear which editor they used for what, but they might have used Turbo C to write DOS code to support building, as there is a complete copy of this C program in the ROM:

#include
#include

int main(void) {
	FILE *fp,*f1;
	int a=0xcd;
	int b=0xc6;
	int c=0x29;
	int ch;
	unsigned long i=0;

	if((fp=fopen("zeldag.gb","rb"))==NULL) {
		printf("can't open the file");
		return 0;
	}

	if((f1=fopen("ttmp.asm","wt"))==NULL) {
		printf("can't new file ttmp.asm");
		return 0;
	}

	while((ch=fgetc(fp))!=EOF) {
		if(a==ch) {
			i++;
			ch=fgetc(fp);
			if(b==ch) {
				i++;
				ch=fgetc(fp);
				if(c==ch)
					fprintf(f1,"%lXH, " , i);
			}
		}
		i++;
	}

	fclose(fp);
	fclose(f1);
}

This writes the file offsets at which 0xcd,0xc6,0×29 was found in the ROM image into ttmp.asm. These bytes, interpreted as Z80 machine code, mean “CALL 0x29C6″. In the final ROM image, this sequence appears once, at 0x442B. If you have any idea why they look for this, please post it in the comments.

This is the list of files in their project directory at D:\GAMEBOY:
BANK37.ASM
CLEARKU.ASM
DAMA1.ASM
DAMA2.ASM
END.CPP
ENDEND.ASM
ENDEND.LST
ENDEND1.ASM
FEND1.ASM
FEND2.ASM
FEND3.ASM
FIND.ASM
FIND.CPP
IFCHAENL.ASM
INTWCHA.ASM
TEST.ASM
TTMP.ASM
TTMP.TXT
ZIPUTP.CPP

These filenames also appear in the ROM:
ADDPLAG.ASM
ADDPLAGF.ASM
CH64TBL.ASM
FEND.ASM
G.ASM
H.ASM
INSERTKU.ASM
INTWIN.ASM
KKKKKK.ASM
L.ASM
NOPLAY1.ASM
TAB.ASM
Y.ASM
ZXHPDM.ASM

And here comes the interesting part: There is actually some assembly source in the ROM; here is a small snippet:

JoyPort_1:
                 AND $02 ;LEFT
                 JR  NZ, JoyPort_2
                 CALL LEFTScroll
                 RET
JoyPort_2:
                 AND $04 ;UP
                 JR  NZ, JoyPort_3
                 CALL UPScroll
                 RET
JoyPort_3:
                 AND $08 ;DOWN
                 JR  NZ, JoyPort_4
                 CALL DOWNScroll

Well-documented, it seems. But there is also some assembly code that looks like this:

L_B000_28F7:
                LD A,$7F
                LD BC,$0800
                LD D,A
                LD HL,$9800
L_B000_2900:
                LD A,D
                LD (HLI),A
                DEC BC
                LD  A,B
                OR  A,C
                JR  NZ,L_B000_2900
                RET
L_B000_2914:
                LD  A,(HLI)
                LD  (DE),A
                INC DE
                DEC BC
                LD  A,B
                OR  A,C
                JR  NZ,L_B000_2914
                RET

The label names suggest that this code has been disassembled from existing Z80 machine code. Link’s Awakening DX is a color remake of an older Game Boy game, so it might very well be that they lost the original source, disassembled the old code and used it again for the remake. This could be easily proven by disassembling the original version and looking for this code.

If you want to do game development archeology yourself, you might want to look at titles like “X-Men – Wolverine’s Rage” (MD5: b1729716baaea01d4baa795db31800b0), which contains Windows 9x registry keys and INF files, “Mortal Kombat 4″ (MD5: 7311f937a542baadf113e9115158cde3), in which you can find some small source fragments, “Gift” (MD5: e6a51088c8fea7980649064bd3a9f9ff), which will tell you that the developers had some Game Boy emulators installed on their system, or the “BIT-MANAGERS” games “Spirou” (MD5:5aa012cf540a5267d6adea6659764441, Turbo C, MAP file, source) and “TinTin in Tibet” (Game Boy Color version, MD5: 8150a3978211939d367f48ffcd49f979), which, amongst other things, contains references to Nintendo’s Game Boy Advance (!) SDK (“C:\Cygnus\thumbelf-000512\H-i686-cygwin32\lib\gcc-lib\thumb-elf\2.9-arm-000512″, “/tantor/build/nintendo/arm-000512/i686-cygwin32/src/newlib/libc/stdio/stdio.c”).

If you find any more things like these, please post them (or links to your stories) as comments! Happy hacking!

pixelstats trackingpixel

75 Responses to “Game Development Archeology: Zelda on Game Boy comes with source”

  1. [...] pagetable.com Âť Blog Archive Âť Game Development Archeology: Zelda on Game Boy comes with source (tags: http://www.pagetable.com 2007 mes10 dia26 Zelda assembly gameboy games history) [...]

  2. [...] reporting that The Legend of Zelda – Link’s Awakening DX for the GB/GBC (as well as other games) has source code included and unencrypted. Apparently, the games needed to be 2MB in size, and if they weren’t big enough, padding with [...]

  3. [...] pagetable tienen un anĂĄlisis bastante interesante del viejo tĂ­tulo de hace casi 10 aĂąos, The Legend of Zelda – Link’s [...]

  4. Shiosai says:

    Sorry for the stupid question, but what program do you use to view the contents of a ROM file? Hex editor or something? If there is some kind of code inside, will it jump out at you?

  5. [...] post about traces of game history in the cartridge for Zelda on the GameBoy. This is what happened with the 1998 Game Boy/Game Boy Color game “The Legend of Zelda – Link’s [...]

  6. nathan says:

    this game is awsooooooooooooommmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmme

  7. Dave says:

    This little sequence was string dumped From an old ZX Spectrum game commissioned by Puffin books (The Warlock of Firetop Mountain), a good sum up of development back then….

    PS we apologise for the game being boring
    but we were literaly only given 3 weeks to
    write it .
    PPS Return of the Things !
    coming soon – the follow up to Halls
    The programme about which will be said :-
    “Oh no not again” ? Sinclair User
    “I’ll get them for this” GOD
    and finally
    “..sod 30% what about a wench ?..” The Authors
    ” one thats nice ”
    ” not too nice ”
    ” with huge …. tracts of land ”
    ” and not too expensive ”
    PSSP See you in the next game !
    Try not to take life seriously or you’ll
    go as far as
    have …..
    Virgin,22 years old,lonely,suicidal and mad .
    (interesting order they’re in huh ?)
    PSSPS It’s goodnight from me
    and It’s goodnight from another unoriginal joke
    (c) S.Brattel and the one and only N.Mottershead

  8. tomaitheous says:

    Heh – you should see all the stuff that was left over in PC-Engine CD games (TurboGrafx-16 in the US) – in the data tracks. Sometimes it’s left over WAVE data for audio tracks of other games, or leftover bits of source code, tools, and comments ;) I believe one game had either the full or almost full intact file of the MSDOS Japanese command.com

    The situation appears to be similar to the Zelda incident. They used an HD for a CD emulator instead of rom boards. There is one game that appears to have tons of personal stuff, files and info from one of the developers – stored in LHA files I believe. Other than that, I don’t think I should be giving out the name of the arcade card game…

  9. Duo says:

    We found this right after the game came out, but didn’t look too deeply into it, figuring it was just an error in their linking setup.

    Writing a small program to scan through a ROM for a certain CALL may have been done because Links Awakening DX is a CGB re-write of the original DMG Links Awakening. I think they may have not had all of the source code to the original version and had to hack it apart to make the updated version.

    That CALL they’re looking for may update screen data, which on the CGB would have to be modified to include updating color palettes after the image data. Aside from some minor additional features added to the game, it was essentially the same.

    Try running that C program on the original Link’s Awakening for DMG and see what listing it gets you. :) (fires up the hex editor to look)

  10. Thats really awesome :D

  11. [...] Link al articulo original Game Development Archeology: Zelda on Game Boy comes with source, porque el articulo de NaciĂłn arcade ya no existe. var a2a_config = a2a_config || {}; [...]

  12. JoseQ says:

    The Famicom game, Air Fortress, also has a bunch (LOTS) of assembly code easily readable if you open the ROM with a hex or text editor.

  13. Fernando says:

    Now this “game archaeology” thing is quite interesting.

    Some time ago I dumped the contents of the ROM file of the MSX game “Hydlide” in a hex editor, and I’ve found some interesting obscure writtings.

    If you want to know what I found, get an MSX Hydlide ROM, open it in an hex editor and try it yourself :D

  14. Belstaff Travel Bag…

    [...]Game Development Archeology: Zelda on Game Boy comes with source « pagetable.com[...]…

  15. Thank you for puting the time in to publish this info. I found it very useful. If you are ever interested in deep linking directories then please contact me….

    [...]Game Development Archeology: Zelda on Game Boy comes with source « pagetable.com[...]…

  16. Insurances in California…

    [...]Game Development Archeology: Zelda on Game Boy comes with source « pagetable.com[...]…

  17. Replica Louis vuitton handbag…

    [...]Game Development Archeology: Zelda on Game Boy comes with source « pagetable.com[...]…

  18. That CALL they?re looking for may update screen data, which on the CGB would have to be modified to include updating color palettes after the image data. Aside from some minor additional features added to the game, it was essentially the same.

  19. Heya terrific blog! Does running a blog similar to this require a large
    amount of work? I’ve absolutely no expertise in coding but I
    was hoping to start my own blog soon. Anyways, if you have any
    suggestions or tips for new blog owners please share.
    I understand this is off subject however I simply wanted to ask.
    Thanks a lot!

  20. web page says:

    Hi my loved one! I want to say that this article is awesome, nice written and come with approximately all
    vital infos. I would like to peer more posts like this .

  21. Actually shot prior to Prisoners, the sinister and devious Enemy is
    an epic mind-screw that crawls around in the dark corners of the psyche like a
    spider in a dusty attic. He is one of the versatile actors Indian Cinema has.
    A lady who struggles hard in their life to create their own identity and leaves
    her home, when her husband treat her like a servant who
    had to do everything that her husband would order
    her, and also bear the infertility of her husband is the story of this motivational movie
    and it can be said that this movie should be watched by all women who work hard in their life to earn respect and dignity.

    My page … cinema cafe coupons

  22. Alice says:

    Amazing steam showers, my family had one of these built about 5 years ago but it may
    possibly do with upgrading, would never get a boring old routine
    form of shower again

    Take a look at my web page; steam shower review, Alice,

  23. doterra scam says:

    ‘ 1 part Hydrogen peroxide 3% (you will get it from the store or buy on the internet).
    Another method recommends using drying agents ranging from alcohol to
    hydrocortisone to nail polish remover to white stick deodorant to hemorrhoid cream to the bubblegum pink medication you take for a sour stomach.
    This blend can be used as a preventive or as soon as
    you feel a cold coming on.

    Take a look at my web blog … doterra scam

  24. hello!,I like your writing very so much! proportion we be
    in contact extra about your post on AOL? I requjre an expert in this arera too solve my problem.

    Maybe that is you! Taking a look ahead to lookk you.

    My web pasge :: Bonesteel goo goo dolls cover

  25. Fran says:

    Thanks for a marvelous posting! I seeriously enjoyed reading it, you can bbe
    a great author. I will make sure to bookmar your
    blog and will eventually come back in the future. I want to encourage you continue
    your great posts, have a nice holiday weekend!

    my website – Hydroponic Starter Grrow Lights – Fran,

Leave a Reply

*
To prove you're a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.
Click to hear an audio file of the anti-spam word