HeroQuest II is played by a party of four heroes. The console has two controller ports. The answer this disc gives to the checklist's question is the simplest one available: it does not need four controllers, because it does not have four inputs. The whole game is driven by a single screen pointer, and both controller ports move the same pointer.
The input routine runs from the vertical-blank handler at
QuestII.hunk1 + 0x76b4:
0x76b4 movem.l d1-d7/a0-a6,-(a7)
0x76b8 lea $DFF000.l,a6
0x76be addq.l #1,$36f70.l ; the frame counter
0x76c4 jsr $12ba8.l
0x76ca bsr $7aee ; ReadJoyPort(0)
0x76ce bsr $7b1a ; ReadJoyPort(1)
0x76d2 bsr $9e8
0x76d6 bsr $2182
and the two port readers are the same eleven instructions with a different argument:
0x7aee movea.l $d5c0.l,a6 ; lowlevel.library
0x7af4 moveq #0,d0 ; port 0 (0x7b1a: moveq #1,d0)
0x7af6 jsr -30(a6) ; ReadJoyPort
0x7afa move.l d0,d1
0x7afc andi.l #$20000000,d1
0x7b02 beq.w +4
0x7b06 bra.b $7b46 ; -> the mouse handler
0x7b08 move.l d0,d1
0x7b0a andi.l #$10000000,d1
0x7b10 beq.w +6
0x7b14 bra.w $7940 ; -> the joystick / pad handler
0x7b18 rts ; neither: nothing plugged in
Both readers branch to the same two handlers, and both handlers write the same
two variables — the pointer's X at $7be8 and its Y at $7bea. There is no
second pointer, no per-player state and no second set of buttons. Whichever port
a device is in, it moves the one cursor; the four heroes are selected and
commanded through it in turn, hot-seat, exactly as the board game is played.
The checklist asks whether a CD32 title reads the pad's seven buttons through
lowlevel.library or by clocking the pad protocol by hand on CIA-A and POTGO.
This one uses lowlevel.library, and it reads two buttons. The complete set
of bit tests on the value ReadJoyPort returns, in both handlers:
btst #0, #1, #2, #3 the four directions (joystick handler only)
btst #22 button 1 -> $36f60 (mouse path) / $36f62 (joystick path)
btst #23 button 2 -> $36f61 (mouse path) / $36f63 (joystick path)
and nothing else. No QueryKeys (−48), no GetKey (−42), no AddKBInt (−54)
and no SetJoyPortAttrsA (−114) anywhere in the file. Five of the CD32 pad's
seven buttons are not read at all — which is what a game designed for a
two-button Amiga mouse in 1993 looks like when it is moved to a console.
There is one direct hardware read of a control line on the whole disc, and it is not for the pad:
QuestII.hunk1 + 0x156b0
btst.b #2,$DFF016.l ; POTGOR bit 10 = DATLY, port 0
which is the right mouse button on port 0, read the classic way because
ReadJoyPort does not report it for a mouse. It appears once, and what it
cancels is the subject of the last section here.
The joystick handler at 0x7940 does not report directions to the game; it
integrates them into a pointer velocity:
0x7982 btst #3,d0 ; one direction
0x7988 subq.w #1,d1 ; velocity--
0x798a cmpi.w #$ffe0,d1 ; clamped at -32
0x7994 btst #2,d0 ; the other
0x799a addq.w #1,d1 ; velocity++
0x799c cmpi.w #$20,d1 ; clamped at +32
0x79a6 moveq #0,d1 ; neither held: velocity 0
0x79e0 asr.w #2,d1
0x79e2 add.w d1,$7bea.l ; and into the pointer coordinate
with the same eight instructions again for the other axis. So a held direction accelerates the pointer over eight frames to a maximum of 32/4 = 8 pixels per frame and stops dead when released.
The mouse handler at 0x7b46 does the other half — 8-bit hardware counters
differenced with wraparound at ±127, clamped to the screen — and writes the
same $7be8 / $7bea.
The game also installs a handler on input.device
(IND_ADDHANDLER, doc 09), with an Interrupt structure at hunk1 + 0x36e2e,
and removes it with IND_REMHANDLER at shutdown. That is how it gets keyboard
events without polling the keyboard matrix, and it is why a program that never
calls QueryKeys can still respond to a keypress.
CD32 nonvolatile.library, alone: no password, no save file, no RAM:
fallback, no Devs/Mountlist. Two calls, GetCopyNV (−30) and StoreNV (−42),
each behind a one-routine wrapper.
appName 'Hero Quest II ' hunk1 + 0xd66f -- 14 characters, trailing space
itemName ' Save' hunk1 + 0xd67e -- 5 characters, leading space
Both names carry a stray space, and the game's title everywhere else on the disc
is HeroQuest II as one word. Whatever a CD32 shows in its NVRAM manager for
this title, it shows it with the spaces.
0xd55c movem.l d0-d7/a0-a6,-(a7)
0xd560 lea $d66f.l,a0 ; appName
0xd566 lea $d67e.l,a1 ; itemName
0xd56c movea.l $d5cc.l,a6 ; nonvolatile.library
0xd572 jsr -30(a6) ; GetCopyNV
0xd576 tst.l d0
0xd578 beq.b $d58c ; nothing stored -> return -1
0xd57a movea.l d0,a0
0xd57c subq.w #1,d5
0xd57e move.b (a0)+,(a5)+ ; copy d5 bytes into the caller's buffer
0xd580 dbra d5,$d57e
0xd594 movem.l d1-d7/a0-a6,-(a7)
0xd598 lea $d66f.l,a0 ; appName
0xd59e lea $d67e.l,a1 ; itemName
0xd5a4 divu.w #$a,d0 ; <-- the size, divided by ten
0xd5a8 addq.l #1,d0
0xd5aa andi.l #$ffff,d0
0xd5b0 movea.l $d5cc.l,a6
0xd5b6 jsr -42(a6) ; StoreNV
Both wrappers are called from one place each, with the same constant:
0x15660 lea $25800.l,a5
0x1566a move.l #$ee,d5 ; 238
0x15670 jsr $d55c.l ; GetCopyNV -> copies 238 bytes out
0x1567e lea $25800.l,a2
0x15688 move.l #$ee,d0 ; 238
0x1568e jsr $d594.l ; StoreNV
The save record is 238 bytes at $25800. GetCopyNV reads 238 bytes back.
StoreNV is handed (238 / 10) + 1 = 24.
So the game stores 24 bytes and reads 238. Under Commodore's documented
convention StoreNV(appName, itemName, data, length) takes a byte count, so
214 bytes of the 238 the game copies back out of GetCopyNV's buffer were never
written — they are whatever nonvolatile.library returns past the end of a
24-byte object.
The checklist added "check the lengths against each other" after Gloom, which
stores two bytes and reads twenty back. This is the same defect an order of
magnitude larger, and the divu.w #10 says how it happened: somebody believed
the length was in units of ten bytes, and rounded up.
Two smaller notes on the same system. The text (doc 08) has eight save-slot
labels, Save Position 1 to Save Position 8, and LOAD / SAVE / RESET /
EXIT beside them — for a save system that stores one item under one name. And
the load wrapper is entered with a6 pointing at the string
FrogAndParrot (hunk1 + 0x15474):
0x15650 lea $15474.l,a6 ; 'FrogAndParrot'
0x15656 bsr.b $15660 ; the GetCopyNV wrapper
0x15658 beq.b +4
0x1565a bra.b $155e2 ; failure path
and on a successful load a word four bytes past the end of that string is
cleared (0x15624: move.w d0,$15482.l). See doc 11 for
what The Frog and Parrot is.
QuestII.hunk1 + 0x156a0 is a complete AmigaDOS volume-check loop:
0x156a0 movem.l d0-d7/a0-a6,-(a7)
0x156a4 jsr $702.l
0x156aa movea.l $d5c4.l,a6 ; dos.library
0x156b0 btst.b #2,$DFF016.l ; the right mouse button
0x156b8 beq.w $156ce ; pressed -> give up, return -1
0x156bc move.l #$15730,d1 ; a name
0x156c2 moveq #-2,d2 ; ACCESS_READ
0x156c4 jsr -84(a6) ; Lock
0x156c8 tst.l d0
0x156ca bne.b $156dc
0x156cc bra.b $156b0 ; no lock -> spin
0x156dc move.l d0,d5 / d1
0x156e0 move.l #$15732,d2 ; a FileInfoBlock
0x156e6 jsr -102(a6) ; Examine
0x156ea beq.b $156b0 ; failed -> spin
0x156ee move.l d5,d1
0x156f0 jsr -90(a6) ; UnLock
0x156f4 movea.l #$1573a,a0 ; FileInfoBlock + 8 = fib_FileName
0x156fa lea $1571a.l,a1 ; 'Legacy of Sorasil DISK'
0x15700 moveq #$15,d7 ; 22 bytes
0x15702 cmpm.b (a0)+,(a1)+
0x15704 bne.b $1570c ; differs -> done
0x15706 dbra d7,$15702
0x1570a bra.b $156b0 ; all 22 matched -> spin
That is the floppy release's "please swap disks" wait: lock a volume, read its
name, and keep looping while the name is still the one already in the drive,
with the right mouse button as the cancel. It pairs with text entry 94,
Please insert Legacy of Sorasil Patch, which ships untranslated in all three
language files (doc 08).
Nothing calls it. There is no bsr.b, bsr.w, bsr.l, jsr or jmp to
0x156a0 anywhere in the 113,112-byte code hunk, and the address 0x000156a0
does not appear as a longword in the code or the data hunk — so it is not in a
jump table either. Unless it is reached through a computed address, the disk-swap
loop is dead code that shipped.
And there is a second reason it could not work if it were called. The name it
compares against is Legacy of Sorasil DISK, 22 characters. The CD's own volume
identifier is Legacy of Sorasil — seventeen. The comparison would fail at the
eighteenth byte on the first pass and the loop would exit immediately. That is
an inference about what Examine returns for the root of the boot volume rather
than a measurement, and it is in doc 12 as such; but it
is the only reading under which shipping this routine on a CD is harmless, and
the disc did ship it.