Tape Recovery Case Study #3

Background
In this case we will analyse a corrupted tape where three games are stored at. The fundamental analysis were done to determine whether it was Audio Waveform or Data in the signal. The result was presented in 3 different games:

  • Kickstart II (Case Study #3)
  • The Mystery Of The Nile (Case Study #2)
  • Super Zaxxon (Case Study #1)

The interesting part was to allocate the actual errors and find out where the errors were at to answer why the games did not load or start correctly. All this possible using 3 different analysis methods.

Recovered Data

Lead Signal

C64-ROM-TAPE HEADER

Loader Init Parts(Basic)

Loading picture + VISLOAD T2 + Rest

VISLOAD T2 Game Data

Clean Data

Lead Signal

C64-ROM-TAPE HEADER

Loader Init Parts(Basic)

Loading picture + VISLOAD T2 + Rest

VISLOAD T2 Game Data

Final Data

Lead Signal

C64-ROM-TAPE HEADER

Loader Init Parts(Basic)

Loading picture + VISLOAD T2 + Rest

VISLOAD T2 Game Data

Result
When we compare the three different signal flows we see the following:

  • Lead signals are okay
  • C64-ROM-TAPE Header can be read, even if the Recovered Data is starting to get artifacts.

The "Loader Init Parts", is when the signal is starting to get bad and corrupted.
This part is crucial for the final result since it contains the following data:

10 sys 65493:rem display
20 sys 65493:rem hi-res screen
30 sys 49154:rem display it
40 sys 65493:rem cc00
50 sys 52224:rem load rest

Now, this was interesting and give us the full structure of the tape and what is to expect. The Loading Screen is loaded and allocated in $6000 and the actual viewer is allocated in $C000 and VISLOAD T2 will sneak in $CC00, to load the rest of the game. This makes sense too, because first the Loading Screen is loaded and then the viewer is loaded, as the basic program will execute it all. As seen ??? equals OP Code.

KICKSTART_II016(6000-8710)

c000 3f ???
c001 7f ???
c002 ad 11 d0 lda $d011
c005 29 ef and #$ef
c007 8d 11 d0 sta $d011
c00a a2 7f ldx #$7f
c00c a0 40 ldy #$40
c00e 20 9c c0 jsr $c09c
c011 a2 04 ldx #$04
c013 a0 00 ldy #$00
c015 20 a1 c0 jsr $c0a1
c018 a2 83 ldx #$83
c01a a0 27 ldy #$27
c01c 20 72 c0 jsr $c072
c01f a2 83 ldx #$83
c021 a0 28 ldy #$28
c023 20 9c c0 jsr $c09c
c026 a2 d8 ldx #$d8
c028 a0 00 ldy #$00
c02a 20 a1 c0 jsr $c0a1
c02d a2 87 ldx #$87
c02f a0 0f ldy #$0f
c031 20 72 c0 jsr $c072
c034 ad 10 87 lda $8710
c037 8d 21 d0 sta $d021
c03a ad 11 d0 lda $d011
c03d 09 22 ora #$22
c03f 8d 11 d0 sta $d011
c042 ad 16 d0 lda $d016
c045 29 df and #$df
c047 09 10 ora #$10
c049 8d 16 d0 sta $d016
c04c ad 18 d0 lda $d018
c04f 09 08 ora #$08
c051 8d 18 d0 sta $d018
c054 a2 60 ldx #$60
c056 a0 00 ldy #$00
c058 20 9c c0 jsr $c09c
c05b a2 20 ldx #$20
c05d a0 00 ldy #$00
c05f 20 a1 c0 jsr $c0a1
c062 a2 7f ldx #$7f
c064 a0 3f ldy #$3f
c066 20 72 c0 jsr $c072
c069 ad 11 d0 lda $d011
c06c 09 10 ora #$10
c06e 8d 11 d0 sta $d011
c071 60 rts
c072 8e 01 c0 stx $c001
c075 8c 00 c0 sty $c000
c078 a0 00 ldy #$00
c07a b1 fb lda ($fb),y
c07c 91 fd sta ($fd),y
c07e a5 fc lda $fc
c080 cd 01 c0 cmp $c001
c083 d0 08 bne $c08d
c085 a5 fb lda $fb
c087 cd 00 c0 cmp $c000
c08a d0 01 bne $c08d
c08c 60 rts
c08d e6 fb inc $fb
c08f d0 02 bne $c093
c091 e6 fc inc $fc
c093 e6 fd inc $fd
c095 d0 e3 bne $c07a
c097 e6 fe inc $fe
c099 4c 7a c0 jmp $c07a
c09c 86 fc stx $fc
c09e 84 fb sty $fb
c0a0 60 rts
c0a1 86 fe stx $fe
c0a3 84 fd sty $fd
c0a5 60 rts

VISLOAD T2 init

cc00 20 d5 ff jsr $ffd5
cc03 20 d5 ff jsr $ffd5
cc06 ad 11 d0 lda $d011
cc09 29 ef and #$ef
cc0b 8d 11 d0 sta $d011
cc0e 20 d5 ff jsr $ffd5
cc11 20 d5 ff jsr $ffd5
cc14 20 8a ff jsr $ff8a
cc17 4c 36 80 jmp $8036

Even if the chunk is loaded to $8000, it starts on $8036. This is because the lower part is where VISLOAD T2 is located and loaded into $033C.
But as far as the analyse go, we see a damaged signal in the Recovered Data and even if we managed to repair most of the signal in Clean Data, we still had to give it another go to successfully get to the Final Data.
The last part had lots of error and since it only uses Long and Short Pulses, which is the structure of VISLOAD T2, this must be read exact to be able to start the game. No data, no game. Again we had to clean up and use parts of the Clean and Recovered Data to reconstruct the Final Data. This time we used a 3 pass recovery process. Most of the work was done in TapClean, but the multiple wave files were also analysed in an audio editor using equalizers and filters.

Conclusion
We got the job done! Kickstart II was recovered and saved as a .tap file. Even if this game exists, the process would be the same for any kind of data recovery and most important we could recover and we extended some knowledge.

Best Regards,
Xiny6581