Tape Recovery Case Study #2
Background
In this case we will analyse a corrupted tape where three games are stored at. The fundamental analysis were done to determine whether it was Audio Waveform or Data in the signal. The result was presented in 3 different games:
- Kickstart II (Case Study #3)
- The Mystery Of The Nile (Case Study #2)
- Super Zaxxon (Case Study #1)
The interesting part was to allocate the actual errors and find out where the errors were at to answer why the games did not load or start correctly. All this possible using 3 different analysis methods.
Recovered Data
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
UNRECOGNIZED DATA
C64 ROM-TAPE-HEADER
UNRECOGNIZED DATA
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
UNRECOGNIZED DATA
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
UNRECOGNIZED DATA
UNRECOGNIZED DATA
Clean Data
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
UNRECOGNIZED DATA
UNRECOGNIZED DATA
Final Data
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
C64 ROM-TAPE-HEADER
BLEEPLOAD
BLEEPLOAD
BLEEPLOAD
BLEEPLOAD
BLEEPLOAD
BLEEPLOAD
BLEEPLOAD
BLEEPLOAD TRIGGER
BLEEPLOAD SPECIAL
BLEEPLOAD SPECIAL
Result
When we compare the three different signal flows we detect very poor signals in both the Recovered and Clean Data, those errors will follow us all the way to the ninth "block", when as we can see in the Final Data the structure has changed. This is because this block is where the BLEEP LOADER is supposed to be initialized and executed to read the BLEEPLOAD Signal Structure. In this case it was impossible to reconstruct or even rebuild the data, due the Recovered Data was too incomplete.
Even if the analyses of the signals indicates a similar signal flow, in depth when we compare the Clean Data with the Final Data the errors are to fatal.
Here we can see the sync is correct and the Data is correct.
Clean Data ($5400-$55FF)
5400 78 sei
5401 a9 09 lda #$09
5403 8d 16 03 sta $0316
5406 a9 55 lda #$55
5408 8d 17 03 sta $0317
540b a9 c1 lda #$c1
540d 8d 18 03 sta $0318
5410 a9 fe lda #$fe
5412 8d 19 03 sta $0319
5415 a5 01 lda $01
5417 29 de and #$de
5419 85 01 sta $01
541b a9 02 lda #$02
541d 8d 05 dd sta $dd05
5420 a9 32 lda #$32
5422 8d 04 dd sta $dd04
5425 a9 19 lda #$19
5427 8d 0e dd sta $dd0e
542a a9 7f lda #$7f
542c 8d 0d dc sta $dc0d
542f a9 91 lda #$91
5431 8d 0d dc sta $dc0d
5434 a0 00 ldy #$00
5436 84 af sty $af
5438 84 ab sty $ab
543a a9 0f lda #$0f
543c 85 a3 sta $a3
543e 20 98 54 jsr $5498
5441 a4 aa ldy $aa
5443 b1 a8 lda ($a8),y
5445 85 ac sta $ac
5447 c8 iny
5448 b1 a8 lda ($a8),y
544a 85 ad sta $ad
544c 20 28 55 jsr $5528
544f 20 51 55 jsr $5551
5452 a5 a5 lda $a5
5454 c5 ab cmp $ab
5456 f0 05 beq $545d
5458 20 b2 54 jsr $54b2
545b f0 e4 beq $5441
545d 20 9f 54 jsr $549f
5460 20 71 55 jsr $5571
5463 f0 05 beq $546a
5465 20 b2 54 jsr $54b2
5468 f0 d7 beq $5441
546a a5 a4 lda $a4
546c 85 a3 sta $a3
546e e6 ab inc $ab
5470 ee 20 d0 inc $d020
5473 20 9d 55 jsr $559d
5476 85 ac sta $ac
5478 20 9d 55 jsr $559d
547b 85 ad sta $ad
547d 6c ac 00 jmp ($00ac)
5480 48 pha
5481 4a lsr a
5482 4a lsr a
5483 4a lsr a
5484 4a lsr a
5485 20 8c 54 jsr $548c
5488 68 pla
5489 c8 iny
548a 29 0f and #$0f
548c 09 30 ora #$30
548e c9 3a cmp #$3a
5490 90 02 bcc $5494
5492 e9 39 sbc #$39
5494 99 c4 05 sta $05c4,y
5497 60 rts
5498 a2 00 ldx #$00
549a a0 28 ldy #$28
549c 4c ca 54 jmp $54ca
549f a0 28 ldy #$28
54a1 a9 20 lda #$20
54a3 99 c4 05 sta $05c4,y
54a6 c8 iny
54a7 c0 35 cpy #$35
54a9 d0 f8 bne $54a3
54ab a2 0a ldx #$0a
54ad a0 02 ldy #$02
54af 4c ca 54 jmp $54ca
54b2 a2 12 ldx #$12
54b4 a0 02 ldy #$02
54b6 20 ca 54 jsr $54ca
54b9 a5 ab lda $ab
54bb a0 32 ldy #$32
54bd 20 80 54 jsr $5480
54c0 a5 a5 lda $a5
54c2 c5 ab cmp $ab
54c4 90 d2 bcc $5498
54c6 a2 1a ldx #$1a
54c8 a0 28 ldy #$28
54ca bd c8 55 lda $55c8,x
54cd 99 c4 05 sta $05c4,y
54d0 c8 iny
54d1 e8 inx
54d2 c9 20 cmp #$20
54d4 d0 f4 bne $54ca
54d6 60 rts
54d7 78 sei
54d8 20 0c 55 jsr $550c
54db a5 bd lda $bd
54dd c5 a3 cmp $a3
54df d0 28 bne $5509
54e1 a9 01 lda #$01
54e3 85 bd sta $bd
54e5 a9 f2 lda #$f2
54e7 8d 14 03 sta $0314
54ea a9 54 lda #$54
54ec 8d 15 03 sta $0315
54ef 4c 09 55 jmp $5509
54f2 78 sei
54f3 20 0c 55 jsr $550c
54f6 90 11 bcc $5509
54f8 a4 72 ldy $72
54fa a5 bd lda $bd
54fc 99 3c 03 sta $033c,y
54ff a9 01 lda #$01
5501 85 bd sta $bd
5503 c8 iny
5504 98 tya
5505 29 1f and #$1f
5507 85 72 sta $72
5509 4c bc fe jmp $febc
550c ad 0d dc lda $dc0d
550f 48 pha
5510 29 01 and #$01
5512 05 af ora $af
5514 85 af sta $af
5516 68 pla
5517 18 clc
5518 29 10 and #$10
551a f0 0b beq $5527
551c a9 19 lda #$19
551e 8d 0e dd sta $dd0e
5521 ad 0d dd lda $dd0d
5524 4a lsr a
5525 26 bd rol $bd
5527 60 rts
5528 78 sei
5529 a9 00 lda #$00
552b 85 72 sta $72
552d 85 71 sta $71
552f 85 bd sta $bd
5531 a9 d7 lda #$d7
5533 8d 14 03 sta $0314
5536 a9 54 lda #$54
5538 8d 15 03 sta $0315
553b 58 cli
553c 20 9d 55 jsr $559d
553f c5 a3 cmp $a3
5541 f0 f9 beq $553c
5543 49 ff eor #$ff
5545 c5 a3 cmp $a3
5547 d0 df bne $5528
5549 20 9d 55 jsr $559d
554c c5 a3 cmp $a3
554e d0 d8 bne $5528
5550 60 rts
5551 a0 00 ldy #$00
5553 84 a8 sty $a8
5555 20 9d 55 jsr $559d
5558 99 a4 00 sta $00a4,y
555b c8 iny
555c c0 04 cpy #$04
555e d0 f5 bne $5555
5560 68 pla
5561 85 ac sta $ac
5563 68 pla
5564 85 a9 sta $a9
5566 48 pha
5567 a5 ac lda $ac
5569 48 pha
556a a5 a5 lda $a5
556c a0 0a ldy #$0a
556e 4c 80 54 jmp $5480
5571 a0 00 ldy #$00
5573 84 aa sty $aa
5575 84 ae sty $ae
5577 a5 a5 lda $a5
5579 d0 04 bne $557f
557b a9 40 lda #$40
557d 85 ae sta $ae
557f 20 9d 55 jsr $559d
5582 91 a6 sta ($a6),y
5584 45 aa eor $aa
5586 85 aa sta $aa
5588 c8 iny
5589 c4 ae cpy $ae
558b d0 f2 bne $557f
558d 20 9d 55 jsr $559d
5590 a8 tay
5591 20 9d 55 jsr $559d
5594 88 dey
5595 d0 fa bne $5591
5597 20 9d 55 jsr $559d
559a c5 aa cmp $aa
559c 60 rts
559d 84 b0 sty $b0
559f ad 12 03 lda $0312
55a2 c9 b2 cmp #$b2
55a4 f0 0b beq $55b1
55a6 a5 af lda $af
55a8 f0 07 beq $55b1
55aa a9 00 lda #$00
55ac 85 af sta $af
55ae 20 c5 55 jsr $55c5
55b1 a6 71 ldx $71
55b3 e4 72 cpx $72
55b5 f0 e8 beq $559f
55b7 bd 3c 03 lda $033c,x
55ba 48 pha
55bb e8 inx
55bc 8a txa
55bd 29 1f and #$1f
55bf 85 71 sta $71
55c1 68 pla
55c2 a4 b0 ldy $b0
55c4 60 rts
55c5 6c 11 03 jmp ($0311)
55c8 13 ???
55c9 05 01 ora $01
55cb 12 ???
55cc 03 ???
55cd 08 php
55ce 09 0e ora #$0e
55d0 07 ???
55d1 20 0c 0f jsr $0f0c
55d4 01 04 ora ($04,x)
55d6 09 0e ora #$0e
55d8 07 ???
55d9 20 60 02 jsr $0260
55dc 0c ???
55dd 0f ???
55de 03 ???
55df 0b ???
55e0 3f ???
55e1 20 12 05 jsr $0512
55e4 17 ???
55e5 09 0e ora #$0e
55e7 04 ???
55e8 60 rts
55e9 14 ???
55ea 0f ???
55eb 20 00 00 jsr $0000
55ee ff ???
55ef ff ???
55f0 00 brk
55f1 00 brk
55f2 ff ???
55f3 ff ???
55f4 00 brk
55f5 00 brk
55f6 ff ???
55f7 ff ???
55f8 00 brk
55f9 00 brk
55fa ff ???
55fb ff ???
55fc 00 brk
55fd 10 7f bpl $567e
55ff ff ???
Final Data ($5400-$55FF)
5400 78 sei
5401 a9 09 lda #$09
5403 8d 16 03 sta $0316
5406 a9 55 lda #$55
5408 8d 17 03 sta $0317
540b a9 c1 lda #$c1
540d 8d 18 03 sta $0318
5410 a9 fe lda #$fe
5412 8d 19 03 sta $0319
5415 a5 01 lda $01
5417 29 de and #$de
5419 85 01 sta $01
541b a9 02 lda #$02
541d 8d 05 dd sta $dd05
5420 a9 32 lda #$32
5422 8d 04 dd sta $dd04
5425 a9 19 lda #$19
5427 8d 0e dd sta $dd0e
542a a9 7f lda #$7f
542c 8d 0d dc sta $dc0d
542f a9 91 lda #$91
5431 8d 0d dc sta $dc0d
5434 a0 00 ldy #$00
5436 84 af sty $af
5438 84 ab sty $ab
543a a9 0f lda #$0f
543c 85 a3 sta $a3
543e 20 98 54 jsr $5498
5441 a4 aa ldy $aa
5443 b1 a8 lda ($a8),y
5445 85 ac sta $ac
5447 c8 iny
5448 b1 a8 lda ($a8),y
544a 85 ad sta $ad
544c 20 28 55 jsr $5528
544f 20 51 55 jsr $5551
5452 a5 a5 lda $a5
5454 c5 ab cmp $ab
5456 f0 05 beq $545d
5458 20 b2 54 jsr $54b2
545b f0 e4 beq $5441
545d 20 9f 54 jsr $549f
5460 20 71 55 jsr $5571
5463 f0 05 beq $546a
5465 20 b2 54 jsr $54b2
5468 f0 d7 beq $5441
546a a5 a4 lda $a4
546c 85 a3 sta $a3
546e e6 ab inc $ab
5470 ee 20 d0 inc $d020
5473 20 9d 55 jsr $559d
5476 85 ac sta $ac
5478 20 9d 55 jsr $559d
547b 85 ad sta $ad
547d 6c ac 00 jmp ($00ac)
5480 48 pha
5481 4a lsr a
5482 4a lsr a
5483 4a lsr a
5484 4a lsr a
5485 20 8c 54 jsr $548c
5488 68 pla
5489 c8 iny
548a 29 0f and #$0f
548c 09 30 ora #$30
548e c9 3a cmp #$3a
5490 90 02 bcc $5494
5492 e9 39 sbc #$39
5494 99 c4 05 sta $05c4,y
5497 60 rts
5498 a2 00 ldx #$00
549a a0 28 ldy #$28
549c 4c ca 54 jmp $54ca
549f a0 28 ldy #$28
54a1 a9 20 lda #$20
54a3 99 c4 05 sta $05c4,y
54a6 c8 iny
54a7 c0 35 cpy #$35
54a9 d0 f8 bne $54a3
54ab a2 0a ldx #$0a
54ad a0 02 ldy #$02
54af 4c ca 54 jmp $54ca
54b2 a2 12 ldx #$12
54b4 a0 02 ldy #$02
54b6 20 ca 54 jsr $54ca
54b9 a5 ab lda $ab
54bb a0 32 ldy #$32
54bd 20 80 54 jsr $5480
54c0 a5 a5 lda $a5
54c2 c5 ab cmp $ab
54c4 90 d2 bcc $5498
54c6 a2 1a ldx #$1a
54c8 a0 28 ldy #$28
54ca bd c8 55 lda $55c8,x
54cd 99 c4 05 sta $05c4,y
54d0 c8 iny
54d1 e8 inx
54d2 c9 20 cmp #$20
54d4 d0 f4 bne $54ca
54d6 60 rts
54d7 78 sei
54d8 20 0c 55 jsr $550c
54db a5 bd lda $bd
54dd c5 a3 cmp $a3
54df d0 28 bne $5509
54e1 a9 01 lda #$01
54e3 85 bd sta $bd
54e5 a9 f2 lda #$f2
54e7 8d 14 03 sta $0314
54ea a9 54 lda #$54
54ec 8d 15 03 sta $0315
54ef 4c 09 55 jmp $5509
54f2 78 sei
54f3 20 0c 55 jsr $550c
54f6 90 11 bcc $5509
54f8 a4 72 ldy $72
54fa a5 bd lda $bd
54fc 99 3c 03 sta $033c,y
54ff a9 01 lda #$01
5501 85 bd sta $bd
5503 c8 iny
5504 98 tya
5505 29 1f and #$1f
5507 85 72 sta $72
5509 4c bc fe jmp $febc
550c ad 0d dc lda $dc0d
550f 48 pha
5510 29 01 and #$01
5512 05 af ora $af
5514 85 af sta $af
5516 68 pla
5517 18 clc
5518 29 10 and #$10
551a f0 0b beq $5527
551c a9 19 lda #$19
551e 8d 0e dd sta $dd0e
5521 ad 0d dd lda $dd0d
5524 4a lsr a
5525 26 bd rol $bd
5527 60 rts
5528 78 sei
5529 a9 00 lda #$00
552b 85 72 sta $72
552d 85 71 sta $71
552f 85 bd sta $bd
5531 a9 d7 lda #$d7
5533 8d 14 03 sta $0314
5536 a9 54 lda #$54
5538 8d 15 03 sta $0315
553b 58 cli
553c 20 9d 55 jsr $559d
553f c5 a3 cmp $a3
5541 f0 f9 beq $553c
5543 49 ff eor #$ff
5545 c5 a3 cmp $a3
5547 d0 df bne $5528
5549 20 9d 55 jsr $559d
554c c5 a3 cmp $a3
554e d0 d8 bne $5528
5550 60 rts
5551 a0 00 ldy #$00
5553 84 a8 sty $a8
5555 20 9d 55 jsr $559d
5558 99 a4 00 sta $00a4,y
555b c8 iny
555c c0 04 cpy #$04
555e d0 f5 bne $5555
5560 68 pla
5561 85 ac sta $ac
5563 68 pla
5564 85 a9 sta $a9
5566 48 pha
5567 a5 ac lda $ac
5569 48 pha
556a a5 a5 lda $a5
556c a0 0a ldy #$0a
556e 4c 80 54 jmp $5480
5571 a0 00 ldy #$00
5573 84 aa sty $aa
5575 84 ae sty $ae
5577 a5 a5 lda $a5
5579 d0 04 bne $557f
557b a9 40 lda #$40
557d 85 ae sta $ae
557f 20 9d 55 jsr $559d
5582 91 a6 sta ($a6),y
5584 45 aa eor $aa
5586 85 aa sta $aa
5588 c8 iny
5589 c4 ae cpy $ae
558b d0 f2 bne $557f
558d 20 9d 55 jsr $559d
5590 a8 tay
5591 20 9d 55 jsr $559d
5594 88 dey
5595 d0 fa bne $5591
5597 20 9d 55 jsr $559d
559a c5 aa cmp $aa
559c 60 rts
559d 84 b0 sty $b0
559f ad 12 03 lda $0312
55a2 c9 b2 cmp #$b2
55a4 f0 0b beq $55b1
55a6 a5 af lda $af
55a8 f0 07 beq $55b1
55aa a9 00 lda #$00
55ac 85 af sta $af
55ae 20 c5 55 jsr $55c5
55b1 a6 71 ldx $71
55b3 e4 72 cpx $72
55b5 f0 e8 beq $559f
55b7 bd 3c 03 lda $033c,x
55ba 48 pha
55bb e8 inx
55bc 8a txa
55bd 29 1f and #$1f
55bf 85 71 sta $71
55c1 68 pla
55c2 a4 b0 ldy $b0
55c4 60 rts
55c5 6c 11 03 jmp ($0311)
55c8 13 ???
55c9 05 01 ora $01
55cb 12 ???
55cc 03 ???
55cd 08 php
55ce 09 0e ora #$0e
55d0 07 ???
55d1 20 0c 0f jsr $0f0c
55d4 01 04 ora ($04,x)
55d6 09 0e ora #$0e
55d8 07 ???
55d9 20 60 02 jsr $0260
55dc 0c ???
55dd 0f ???
55de 03 ???
55df 0b ???
55e0 3f ???
55e1 20 12 05 jsr $0512
55e4 17 ???
55e5 09 0e ora #$0e
55e7 04 ???
55e8 60 rts
55e9 14 ???
55ea 0f ???
55eb 20 00 00 jsr $0000
55ee ff ???
55ef ff ???
55f0 00 brk
55f1 00 brk
55f2 ff ???
55f3 ff ???
55f4 00 brk
55f5 00 brk
55f6 ff ???
55f7 ff ???
55f8 00 brk
55f9 00 brk
55fa ff ???
55fb ff ???
55fc 00 brk
55fd 10 7f bpl $567e
55ff ff ???
Even if the loader is correct and there are no errors. The following Data Signal is where things go wrong.
Since we can't reach the BLEEPLOAD it's more or less impossible to decode the Data Signal.
However I managed to disassemble the BLEEPLOAD TRIGGER
*=$5600
LDY #$00
B5602 JSR $559D
STA $0073,Y
INY
CPY #$08
BNE B5602
LDY #$20
B560F LDA $5600,Y
EOR ($A8),Y
STA $5600,Y
INY
BNE B560F
SEI
LDA #$2F
STA $00
LDA #$D6
T5621 .byte $BF,$80,$D8,$74,$68,$94,$95,$0D,$74,$57,$F2
STY $0E,X
ADC $C0DC
AND $EB
ADC $F1,X
TAY
T5636 .byte $42,$06,$00,$D0,$E1,$97,$AC,$9C,$88,$F0
T5640 .byte $05,$D7,$0E,$CA,$39,$F0,$64,$18,$54
LSR $08F3
LSR $ED,X
AND $8CF0
SED
LDY $75,X
CPY $7DBB
T5657 .byte $14,$F0,$17,$55,$F9,$C4,$A5,$5F,$D1
T5660 .byte $21,$D8,$D4,$7D,$08,$FC,$1B
ADC $1352,Y
ORA $A1
LDA $A3
LDY #$02
CPY #$82
T5672 .byte $14,$80
TYA
ADC $85,X
NOP
CLI
AND $0155,X
LSR $E8,X
EOR ($A9),Y
RTI
T5681 .byte $CF,$B6,$E3,$49,$A5,$72,$F6,$56,$79,$D2,$9E,$F4,$F8,$19,$C3
T5690 .byte $76,$FE,$0F,$C7,$53,$14,$F7,$0C,$DB,$00,$A0,$28,$B3
AND $54,X
LDY #$D7
LSR $20,X
STA $FA3B,Y
INY
CPY #$CA
T56A9 .byte $2F,$F8,$A2,$F5,$5F,$02,$4C
T56B0 .byte $35,$AB,$A2,$12,$5F,$FD,$20,$CA,$AB,$5A,$AB,$A0,$CD,$DE,$80,$14
T56C0 .byte $5A,$5A,$C5,$AB,$6F,$2D,$A2,$1A,$5F,$D7,$BD,$C8,$AA,$66,$C4,$05
T56D0 .byte $37,$17,$C9,$20,$2F,$0B,$60,$78,$DF,$F3,$55,$A5,$42,$2A,$A3
BNE T56B8
LSR $01,X
STA $42
LSR $F2,X
STA $FCEB
LDA #$54
T56EC .byte $72,$EA,$03
JMP $AAF6
SEI
JSR $AAF3
BCC $5709
T56F8 .byte $5B,$8D,$A5,$BD,$66,$C3,$83,$A9
This is going a bit over my head but yeah, it was fun to be able to crack this nut in a way.
Result and Conclusion
The method is similar to what I used in Recovery Case Study 2, with the exception I ran into too many errors that made the process hit the wall. First of all the the title "MYSTERY", read from the first C64 ROM-TAPE-HEADER made me confused. I did not have many references on what this was. But the further on my analysis went the more information I was able to dig out from the Data Signals. To combine the title with the loader I was able to eliminate the amount of response when I searched for my answers. Then I saw a very familiar title, "The Mystery Of The Nile", and then I was certain this was the game.
After the final analysis and comparison I was set, this is what we were looking for and I was able to dig up a working image that was indeed 100% equivalent to the merged one on the tape.
Best Regards,
Xiny6581