loading...
All Defender articles | Back to top

Defender Sound ROM Disassembly

Defender enemy points values

In the previous article, the audio hardware of the Defender arcade machine was described in detail. In this article, we will look into the audio software of Defender, 2 KB of MC6800 machine code located in a ROM chip. This code generates all the different sounds heard in the game.

We will disassemble the sound ROM so we can inspect it in assembly code form. The disassembled code with some annotation is available for download.

After disassembling the ROM, we will reassemble it and check if it is exactly the same as the original, verifying the correctness of our disassembly.

Disassembly

The 'Defender' sound ROM (defend.snd) is 2 KB of MC6800 machine code. It looks like this in hexidecimal form.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F
00000000  FF 0F 8E 00 7F CE 04 00 6F 01 6F 03 86 FF A7 00 6F 02 86 37 A7 03 86 3C A7 01 97 09 4F 97 07 97  ÿ.Ž..Î..o.o.†ÿ§.o.†7§.†<§.—.O—.—
00000020  04 97 05 97 06 97 08 0E 20 FE 16 48 48 48 1B CE 00 13 DF 0F CE FD 76 BD FD 21 C6 09 7E FB 0A 96  .—.—.—.. þ.HHH.Î..ß.Îýv½ý!Æ.~û.–
00000040  1B B7 04 00 96 13 97 1C 96 14 97 1D DE 18 96 1C 73 04 00 09 27 10 4A 26 FA 73 04 00 96 1D 09 27  .·..–.—.–.—.Þ.–.s...'.J&ús..–..'
00000060  05 4A 26 FA 20 E8 B6 04 00 2B 01 43 8B 00 B7 04 00 96 1C 9B 15 97 1C 96 1D 9B 16 97 1D 91 17 26  .J&ú è¶..+.C‹.·..–.›.—.–.›.—.‘.&
00000080  CB 96 1A 27 06 9B 13 97 13 26 B9 39 86 01 97 1A C6 03 20 0A 86 FE 97 1A 86 C0 C6 10 20 00 97 19  Ë–.'.›.—.&¹9†.—.Æ. .†þ—.†ÀÆ. .—.
000000A0  86 FF B7 04 00 D7 15 D6 15 96 0A 44 44 44 98 0A 44 76 00 09 76 00 0A 24 03 73 04 00 96 19 4A 26  †ÿ·..×.Ö.–.DDD˜.Dv..v..$.s..–.J&
000000C0  FD 5A 26 E5 96 19 9B 1A 97 19 26 DB 39 86 20 97 15 97 18 86 01 CE 00 01 C6 FF 20 00 97 13 DF 16  ýZ&å–.›.—.&Û9† —.—.†.Î..Æÿ .—.ß.
000000E0  D7 14 D6 15 96 0A 44 44 44 98 0A 44 76 00 09 76 00 0A 86 00 24 02 96 14 B7 04 00 DE 16 09 26 FD  ×.Ö.–.DDD˜.Dv..v..†.$.–.·..Þ..&ý
00000100  5A 26 E1 D6 14 D0 13 27 09 DE 16 08 96 18 27 D0 20 CC 39 C6 01 D7 04 4F 97 19 20 14 4F 97 19 C6  Z&áÖ.Ð.'.Þ..–.'Ð Ì9Æ.×.O—. .O—.Æ
00000120  03 20 0D 86 01 97 19 CE 03 E8 86 01 C6 FF 20 00 97 18 D7 13 DF 16 7F 00 15 DE 16 B6 04 00 16 54  . .†.—.Î.è†.Æÿ .—.×.ß....Þ.¶...T
00000140  54 54 D8 0A 54 76 00 09 76 00 0A D6 13 7D 00 19 27 02 D4 09 D7 14 D6 15 91 0A 22 12 09 27 26 B7  TTØ.Tv..v..Ö.}..'.Ô.×.Ö.‘."..'&·
00000160  04 00 DB 15 99 14 25 16 91 0A 23 F0 20 10 09 27 14 B7 04 00 D0 15 92 14 25 04 91 0A 22 F0 96 0A  ..Û.™.%.‘.#ð ..'.·..Ð.’.%.‘."ð–.
00000180  B7 04 00 20 B9 D6 18 27 B5 96 13 D6 15 44 56 44 56 44 56 43 50 82 FF DB 15 99 13 D7 15 97 13 26  ·.. ¹Ö.'µ–.Ö.DVDVDVCP‚ÿÛ.™.×.—.&
000001A0  98 C1 07 26 94 39 86 FD 97 0F CE 00 64 DF 0B DB 0C 96 11 99 0B 97 11 DE 0B 25 04 20 00 20 03 08  ˜Á.&”9†ý—.Î.dß.Û.–.™.—.Þ.%. . ..
000001C0  27 11 DF 0B 84 0F 8B 9A 97 10 DE 0F A6 00 B7 04 00 20 DC 39 4F B7 04 00 97 11 4F 91 11 26 03 73  '.ß.„.‹š—.Þ.¦.·.. Ü9O·..—.O‘.&.s
000001E0  04 00 C6 12 5A 26 FD 4C 2A F1 73 04 00 7C 00 11 2A E8 39 CE 00 13 6F 00 08 8C 00 1B 26 F8 86 40  ..Æ.Z&ýL*ñs..|..*è9Î..o..Œ..&ø†@
00000200  97 13 CE 00 13 86 80 97 11 5F A6 01 AB 00 A7 01 2A 02 DB 11 74 00 11 08 08 8C 00 1B 26 EC F7 04  —.Î..†€—._¦.«.§.*.Û.t....Œ..&ì÷.
00000220  00 7C 00 12 26 DC CE 00 13 5F A6 00 27 0B 81 37 26 04 C6 41 E7 02 6A 00 5C 08 08 8C 00 1B 26 EA  .|..&ÜÎ.._¦.'..7&.ÆAç.j.\..Œ..&ê
00000240  5D 26 BF 39 7A 00 08 39 7F 00 08 97 11 CE FD AA A6 00 27 2D 7A 00 11 27 06 4C BD FD 21 20 F1 08  ]&¿9z..9...—.Îýª¦.'-z..'.L½ý! ñ.
00000260  DF 0F BD FD 21 DF 0D DE 0F A6 00 97 15 A6 01 EE 02 DF 13 8D 3E DE 0F 08 08 08 08 DF 0F 9C 0D 26  ß.½ý!ß.Þ.¦.—.¦.î.ß..>Þ.....ß.œ.&
00000280  E8 7E FD 0E 86 03 97 08 39 7A 00 08 27 0C D6 15 58 58 58 58 1B 97 15 4F 20 FE 4A 81 0B 23 01 4F  è~ý.†.—.9z..'.Ö.XXXX.—.O þJ..#.O
000002A0  CE FE 41 BD FD 21 A6 00 CE FF FF DF 13 8D 04 8D 2A 20 FC CE 00 16 81 00 27 15 81 03 27 09 C6 01  ÎþA½ý!¦.Îÿÿß....* üÎ....'...'.Æ.
000002C0  E7 00 08 80 02 20 EF C6 91 E7 00 6F 01 08 08 C6 7E E7 00 C6 FA E7 01 C6 DD E7 02 DE 13 4F F6 00  ç..€. ïÆ‘ç.o...Æ~ç.Æúç.ÆÝç.Þ.Oö.
000002E0  12 5C D7 12 D4 15 54 89 00 54 89 00 54 89 00 54 89 00 54 89 00 54 89 00 54 89 00 1B 48 48 48 48  .\×.Ô.T‰.T‰.T‰.T‰.T‰.T‰.T‰..HHHH
00000300  B7 04 00 09 27 03 7E 00 16 39 36 A6 00 DF 0D DE 0F A7 00 08 DF 0F DE 0D 08 5A 26 EF 32 39 4F 97  ·...'.~..96¦.ß.Þ.§..ß.Þ..Z&ï29O—
00000320  04 97 05 39 7F 00 04 96 05 84 7F 81 1D 26 01 4F 4C 97 05 39 86 0E BD FB 81 96 05 48 48 43 BD FC  .—.9...–.„...&.OL—.9†.½û.–.HHC½ü
00000340  39 7C 00 17 BD FC 3B 20 F8 86 03 BD F8 2A D6 06 C1 1F 26 01 5F 5C D7 06 86 20 10 5F 81 14 23 05  9|..½ü; ø†.½ø*Ö.Á.&._\×.† ._..#.
00000360  CB 0E 4A 20 F7 CB 05 4A 26 FB D7 13 BD F8 3F 20 FB 96 07 26 09 7C 00 07 86 0D 8D 05 20 69 7E FC  Ë.J ÷Ë.J&û×.½ø? û–.&.|..†... i~ü
00000380  2E 16 58 1B 1B 1B CE FE EC BD FD 21 A6 00 16 84 0F 97 14 54 54 54 54 D7 13 A6 01 16 54 54 54 54  ..X...Îþì½ý!¦..„.—.TTTT×.¦..TTTT
000003A0  D7 15 84 0F 97 11 DF 0B CE FE 4D 7A 00 11 2B 08 A6 00 4C BD FD 21 20 F3 DF 18 BD FC 75 DE 0B A6  ×.„.—.ß.ÎþMz..+.¦.L½ý! óß.½üuÞ.¦
000003C0  02 97 1A BD FC 87 DE 0B A6 03 97 16 A6 04 97 17 A6 05 16 A6 06 CE FF 55 BD FD 21 17 DF 1B 7F 00  .—.½ü‡Þ.¦.—.¦.—.¦..¦.ÎÿU½ý!.ß...
000003E0  23 BD FD 21 DF 1D 39 96 13 97 22 DE 1B DF 0D DE 0D A6 00 9B 23 97 21 9C 1D 27 26 D6 14 08 DF 0D  #½ý!ß.9–.—"Þ.ß.Þ.¦.›#—!œ.'&Ö..ß.
00000400  CE 00 24 96 21 4A 26 FD A6 00 B7 04 00 08 9C 1F 26 F1 5A 27 DA 08 09 08 09 08 09 08 09 01 01 20  Î.$–!J&ý¦.·...œ.&ñZ'Ú.......... 
00000420  DF 96 15 8D 62 7A 00 22 26 C1 96 07 26 46 96 16 27 42 7A 00 17 27 3D 9B 23 97 23 DE 1B 5F 96 23  ß–..bz."&Á–.&F–.'Bz..'=›#—#Þ._–#
00000440  7D 00 16 2B 06 AB 00 25 08 20 0B AB 00 27 02 25 05 5D 27 08 20 0F 5D 26 03 DF 1B 5C 08 9C 1D 26  }..+.«.%. .«.'.%.]'. .]&.ß.\.œ.&
00000460  DD 5D 26 01 39 DF 1D 96 15 27 06 8D 08 96 1A 8D 16 7E FB E7 39 CE 00 24 DF 0F DE 18 E6 00 08 BD  Ý]&.9ß.–.'...–...~ûç9Î.$ß.Þ.æ..½
00000480  FB 0A DE 0F DF 1F 39 4D 27 2B DE 18 DF 0D CE 00 24 97 12 DF 0F DE 0D D6 12 D7 11 E6 01 54 54 54  û.Þ.ß.9M'+Þ.ß.Î.$—.ß.Þ.Ö.×.æ.TTT
000004A0  54 08 DF 0D DE 0F A6 00 10 7A 00 11 26 FA A7 00 08 9C 1F 26 DE 39 8E 00 7F B6 04 02 0E 43 84 1F  T.ß.Þ.¦..z..&ú§..œ.&Þ9Ž..¶...C„.
000004C0  D6 08 27 09 2A 03 BD FA 48 4A BD FA 89 5F 81 0E 27 02 D7 06 81 12 27 02 D7 07 F6 EF FD C1 7E 26  Ö.'.*.½úHJ½ú‰_..'.×...'.×.öïýÁ~&
000004E0  03 BD EF FD 4D 27 27 4A 81 0C 22 08 BD FB 81 BD FB E7 20 1A 81 1B 22 0E 80 0D 48 CE FD 58 8D 21  .½ïýM''J..".½û.½ûç ...".€.HÎýX.!
00000500  EE 00 AD 00 20 08 80 1C BD F8 2A BD F8 3F 96 04 9A 05 27 FE 4F 97 07 96 04 27 03 7E F9 13 7E FB  î... .€.½ø*½ø?–.š.'þO—.–.'.~ù.~û
00000520  34 DF 0D 9B 0E 97 0E 24 03 7C 00 0D DE 0D 39 0F 8E 00 7F CE FF FF 5F E9 00 09 8C F8 00 26 F8 E1  4ß.›.—.$.|..Þ.9.Ž..Îÿÿ_é..Œø.&øá
00000540  00 27 01 3E 86 01 BD F8 2A BD F8 3F F6 EF FA C1 7E 26 DC BD EF FA 20 D7 FB 49 F9 13 FB 24 F8 8C  .'.>†.½ø*½ø?öïúÁ~&ܽïú ×ûIù.û$øŒ
00000560  FB 71 FB 1E F8 CD F8 94 F9 1C F9 23 F9 A6 F9 D4 F9 F3 FA 44 FA 84 40 01 00 10 E1 00 80 FF FF 28  ûqû.øÍø”ù.ù#ù¦ùÔùóúDú„@...á.€ÿÿ(
00000580  01 00 08 81 02 00 FF FF 28 81 00 FC 01 02 00 FC FF FF 01 00 18 41 04 80 00 FF 8C 5B B6 40 BF 49  ......ÿÿ(..ü...üÿÿ...A.€.ÿŒ[¶@¿I
000005A0  A4 73 73 A4 49 BF 40 B6 5B 8C 0C 7F 1D 0F FB 7F 23 0F 15 FE 08 50 8B 88 3E 3F 02 3E 7C 04 03 FF  ¤ss¤I¿@¶[Œ....û.#..þ.P‹ˆ>?.>|..ÿ
000005C0  3E 3F 2C E2 7C 12 0D 74 7C 0D 0E 41 7C 23 0B 50 7C 1D 29 F2 7C 3F 02 3E F8 04 03 FF 7C 3F 2C E2  >?,â|..t|..A|#.P|.)ò|?.>ø..ÿ|?,â
000005E0  F8 12 0D 74 F8 0D 0E 41 F8 23 0B 50 F8 1D 2F F2 F8 23 05 A8 F8 12 06 BA F8 04 07 FF 7C 37 04 C1  ø..tø..Aø#.Pø./òø#.¨ø..ºø..ÿ|7.Á
00000600  7C 23 05 A8 7C 12 06 BA 3E 04 07 FF 3E 37 04 C1 3E 23 05 A8 1F 12 06 BA 1F 04 07 FF 1F 37 04 C1  |#.¨|..º>..ÿ>7.Á>#.¨...º...ÿ.7.Á
00000620  1F 23 16 A0 FE 1D 17 F9 7F 37 13 06 7F 3F 08 FA FE 04 0F FF FE 0D 0E 41 FE 23 0B 50 FE 1D 5F E4  .#. þ..ù.7...?.úþ..ÿþ..Aþ#.Pþ._ä
00000640  00 47 3F 37 30 29 23 1D 17 12 0D 08 04 08 7F D9 FF D9 7F 24 00 24 08 00 40 80 00 FF 00 80 40 10  .G?70)#........ÙÿÙ.$.$..@€.ÿ.€@.
00000660  7F B0 D9 F5 FF F5 D9 B0 7F 4E 24 09 00 09 24 4E 10 7F C5 EC E7 BF 8D 6D 6A 7F 94 92 71 40 17 12  .°ÙõÿõÙ°.N$...$N..Åìç¿.mj.”’q@..
00000680  39 10 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 48 8A 95 A0 AB B5 BF C8 D1 DA E1 E8 EE F3  9.ÿÿÿÿ....ÿÿÿÿ....HŠ• «µ¿ÈÑÚáèîó
000006A0  F7 FB FD FE FF FE FD FB F7 F3 EE E8 E1 DA D1 C8 BF B5 AB A0 95 8A 7F 75 6A 5F 54 4A 40 37 2E 25  ÷ûýþÿþýû÷óîèáÚÑÈ¿µ« •Š.uj_TJ@7.%
000006C0  1E 17 11 0C 08 04 02 01 00 01 02 04 08 0C 11 17 1E 25 2E 37 40 4A 54 5F 6A 75 7F 10 59 7B 98 AC  .................%.7@JT_ju..Y{˜¬
000006E0  B3 AC 98 7B 59 37 19 06 00 06 19 37 81 24 00 00 00 16 31 12 05 1A FF 00 27 6D 11 05 11 01 0F 01  ³¬˜{Y7.....7.$....1...ÿ.'m......
00000700  47 11 31 00 01 00 0D 1B F4 12 00 00 00 14 47 41 45 00 00 00 0F 5B 21 35 11 FF 00 0D 1B 15 00 00  G.1.....ô.....GAE....[!5.ÿ......
00000720  FD 00 01 69 31 11 00 01 00 03 6A 01 15 01 01 01 01 47 F6 53 03 00 02 06 94 6A 10 02 00 02 06 9A  ý..i1.....j......GöS....”j.....š
00000740  1F 12 00 FF 10 04 69 31 11 00 FF 00 0D 00 12 06 00 FF 01 09 28 A0 98 90 88 80 78 70 68 60 58 50  ...ÿ..i1..ÿ......ÿ..( ˜.ˆ€xph`XP
00000760  44 40 01 01 02 02 04 04 08 08 10 10 30 60 C0 E0 01 01 02 02 03 04 05 06 07 08 09 0A 0C 80 7C 78  D@..........0`Àà.............€|x
00000780  74 70 74 78 7C 80 01 01 02 02 04 04 08 08 10 20 28 30 38 40 48 50 60 70 80 A0 B0 C0 08 40 08 40  tptx|€......... (08@HP`p€ °À.@.@
000007A0  08 40 08 40 08 40 08 40 08 40 08 40 08 40 08 40 01 02 04 08 09 0A 0B 0C 0E 0F 10 12 14 16 40 10  .@.@.@.@.@.@.@.@..............@.
000007C0  08 01 01 01 01 01 02 02 03 03 04 04 05 06 08 0A 0C 10 14 18 20 30 40 50 40 30 20 10 0C 0A 08 07  .................... 0@P@0 .....
000007E0  06 05 04 03 02 02 01 01 01 07 08 09 0A 0C 08 17 18 19 1A 1B 1C 00 00 00 FC B6 F8 01 FD 2F F8 01  ........................ü¶ø.ý/ø.

Generated by HxD

Not very readable.

In order to gain some insight into the algorithms contained within it, we need to disassemble it, meaning converting the machine code to equivalent assembly code.

I disassembled defend.snd using Peter Clare's DASMx.

dasmx.exe -c6800 -o0xf800 -a defend.snd

DASMx produced disassembly output looking like this:

        org     $F800
;
        stx     X0F8E
;
        db      $00
;
XF804:
        clr     XCE04
;
        db      $00
;
        clr     $01,x
        clr     $03,x
        ldaa    #$FF
        staa    $00,x
        ...

DASMx has a few syntactic quirks in its output that makes it incompatible with our preferred assembler, 'vasm', in particular the use of the prefixes X and L for constants. I had to fix these before I could reassemble it. I wrote this Ruby script to postprocess the code:

lines = File.new("defend.asm").readlines
lines.each do |l|
    match = /^\t(?<mnemonic>[a-z]*)\t(?<operands>.*)/.match(l)
    if match then
        mnemonic = match[:mnemonic]
        operands = match[:operands]

        if operands[0] == 'X' or operands[0] == 'L' then
            # unless branch
            unless mnemonic =~ /^b[^i]/ then
                operands[0] = '$'
            end
        end

        puts "\t" + mnemonic + "\t" + operands
    else
        puts l
    end
end

After running the postprocessing script, I also replaced the data declaration statement db with the syntax dc.b using a simple search-and-replace. After all postprocessing, the assembly code now looked like this:

        org     $F800
;
        stx     $0F8E
;
        dc.b    $00
;
XF804:
        clr     $CE04
;
        dc.b    $00
;
        clr     $01,x
        clr     $03,x
        ldaa    #$FF
        staa    $00,x
        ...

Looking more closely at the output, it looked a bit weird. The two dc.b declarations in the middle of the code didn't really make sense. However, if the code started with an offset of 1 byte, it looks more reasonable. So, after some hand editing, I had output that looked like this - starting with a mystery byte $ff, and then some reasonable startup code:


        dc.b    $ff     ; ??? mystery byte ???

; F801 RESET, NON-MASKABLE INTERRUPT HANDLER =================

        sei             ; disable interrupts
        lds     #$007f  ; SP = 007f
        ldx     #$0400
        clr     $01,x   ; 0401 = 0
        clr     $03,x   ; 0403 = 0
        ldaa    #$FF
        staa    $00,x   ; 0400 = FF
        ...

The full hand-edited version is available here.

Now we have a full disassembly, we can try reassembling it to see if the resulting binary is the same as the original defend.snd.

Reassembly

Recreating the ROM and thus verifying our disassembled code requires a MC6800 assembler. This also allows experimenting with modifying the code or creating entirely new replacement ROMs. The open source assembler 'vasm' built with Motorola-style syntax works well for this purpose.

Currently, there isn't a Windows binary download of vasm publicly available, so it is necessary to build it from source. It is distributed with a Makefile, which can be built with Visual Studio's nmake tool. To build it, start the Visual Studio 'Developer Command Prompt' and enter the directory containing the vasm source, and then execute these commands:

makedir obj_win32
nmake -f Makefile.Win32 CPU=6800 SYNTAX=mot

This generates the executable vasm6800_mot_win32.exe, which can be used to create a ROM file.

We can test the assembler with a simple program:

    ldaa #7

A single instruction that sets the accumulator register to the value 7.

Assembling it using this command:

vasm6800_mot_win32 -Fbin test.asm -o test.bin

results in a 2 byte file test.bin:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  86 07                                            †.

Generated by HxD

It works. Armed with a MC6800 assembler, we can now try to reassemble our disassembled ROM:

vasm6800_mot_win32 -Fbin defend-hand_edited.asm -o defend-reassembled.snd

The result is what we hope for, a binary that has exactly the same content as the original ROM, which can be verified within reasonable doubt using an MD5 sum:

md5sum defend.snd defend-reassembled.snd
ec5b36f80f7bd93ba9e6269f0376efd6 *defend.snd
ec5b36f80f7bd93ba9e6269f0376efd6 *defend-reassembled.snd

Now that we have verified our disassembled code, we can start analyzing the sound algorithms in detail.

References

Motorola 6800:

Before I found DASMx, I tried using Sean Riddle's 6800dasm (mirrored here), but the output of DASMx was easier to convert to code compatible with vasm.