SkoolKit

Spectrum game disassembly toolkit

No instruction left uncommented

On the 15th anniversary of the release of SkoolKit 1.0, SkoolKit 9.5 has been released. To get a copy, please head over to the download page, the Python Package Index, or GitHub.

When it comes to annotations, SkoolKit has always stayed out of the way and allowed the reverse engineer (that’s you) free rein to decide where to place comments in the skool file and how to word them. Which is how it should be, because only the reverse engineer (that’s you again) really understands what the code is doing and how to convey that information to a reader of the disassembly. However, if you’ve ever, when starting a new disassembly project, been filled with dread by the daunting sight of a completely bare skool file, then SkoolKit 9.5 is here to help (a little). New in this release is a comment generator component, which can be enabled by using the --comments (or -C) option of sna2ctl.py or sna2skool.py. For example:

$ sna2ctl.py -C game.z80 > game.ctl

Now take a look at game.ctl and revel in the ready-made comments that describe what each individual instruction is doing. What if you’ve already started on a control file, for which sna2ctl.py did not employ the comment generator? No problem. sna2skool.py can use it to generate comments for the instructions that don’t yet have any:

$ sna2skool.py -C -c game.ctl game.z80 > game.skool

Of course, the comment generator is not in any way smart, doesn’t understand how the game you’re disassembling actually works, and should never be used to produce a ‘complete’ disassembly automatically from scratch. But if you’re a bit hazy on how an arithmetic or logic operation works on the flags, or what one of the rarely used instructions (e.g. RLD or OTIR) actually does, then the comment generator can provide a useful jog to the memory. Which is better than nothing.

If, by chance and over time, you find the comment generator to be more useful than not, you can enable it by default for both sna2ctl.py and sna2skool.py by setting their Comments configuration parameters to 1 in skoolkit.ini.

Anyway, moving on to other new features, trace.py, when running with screen contents displayed, will now respond to keypresses. This means you could use it to enter programs into the simulated ZX Spectrum, or even play games, though I wouldn’t recommend it. With no border, or sound, or menus to control its operation, trace.py is a poor substitute for a proper emulator. But in a pinch it could be useful if the code you’re tracing depends on user input.

Another new feature for trace.py - which makes more sense now that it can respond to keypresses - is the --map option. Just like the --map option of rzxplay.py, it produces a code execution map. And, just like a code execution map produced by rzxplay.py, one produced by trace.py can be used with the --map option of sna2ctl.py when generating a control file.

Finally, with an eye to the looming SkoolKit 10.0 (no release date planned yet, so don’t panic), there are several macro-related deprecations in the works in this release. They all concern syntax oddities that have been around for a long time, and which I’m now determined to eradicate (eventually) by encouraging the use of parentheses where appropriate. Specifically, #CALL, #LINK and #FONT now support alternative syntaxes that do away with the ugly colons, and the new #FRAMES macro is an aptly named drop-in replacement (more or less) for the frame-splicing #UDGARRAY* macro that avoids the weird asterisk. In addition, the plain #UDGARRAY macro now strongly prefers its UDG specifications to be enclosed in parentheses, and its attribute address range specifications to be enclosed in square brackets.

For details of the other new features that may or may not be overshadowed by the comment generator, check out the changelog. After that, why not download a copy of 9.5 and use the comment generator to remind yourself what RRD and INIR do, and how ‘RET C’ works after a CP?

Tracing with a screen near you

SkoolKit 9.4 has been released. To get a copy, please head over to the download page, the Python Package Index, or GitHub.

With the 9.x series well under way, and full 128K support (9.0 and 9.1), RZX support (9.2) and PZX support (9.3) now firmly entrenched, 9.4 quite reasonably steps down a gear and modestly introduces some minor enhancements to the Skoolkit commands and skool macros that we have come to know and love.

First, the --screen option of trace.py. As its name suggests, it displays the contents of the Spectrum’s screen while code is executing (so long as you have pygame installed). This can help if you want to produce a snapshot at a particular point that’s easier to judge by eye than by, say, the number of instructions executed (--max-operations) or the number of T-states elapsed (--max-tstates).

By default, the screen is refreshed at a rate of 50 frames per second (i.e. normal Spectrum speed), but that can be changed by setting the ScreenFps configuration parameter. A value of 0 sets trace.py (and screen updates) running at maximum speed. Also by default, the screen is rendered with a scale factor of 2 (i.e. 512x384 pixels), but that can also be changed by setting the ScreenScale configuration parameter.

In addition to writing a snapshot file or WAV file after code execution has completed, trace.py can now write a PNG image file of the screen contents. Or, indeed, all three at the same time, now that multiple output file arguments are allowed. By default, the image scale factor is 2 (i.e. 512x384 pixels again), but that can be changed by setting the PNGScale configuration parameter.

In other command news, skool2bin.py can now read configuration from skoolkit.ini, and can also pad its output with zeroes on the left by using the PadLeft configuration parameter, or (perhaps more usefully) on the right by using the PadRight configuration parameter. So if PadRight is set to 65536, you can (for example) use bin2sna.py on the output of skool2bin.py without ever having to specify the origin address.

Turning now to skool macros, this release bestows upon #FOREACH support for a new special variable: POKEname. This expands to a list of the POKEs made by the #POKES macro on the named snapshot created by the #PUSHS macro. For example, if the udgfix snapshot has three POKEs:

#PUSHSudgfix #POKES30000,1;30001,2;30002,3 #UDG30000 #POPS

then:

#FOREACH(POKEudgfix)(p,p,: )

would expand to:

POKE 30000,1: POKE 30001,2: POKE 30002,3

Individual POKEs and subsequences of POKEs on a snapshot can be specified by using Python’s square brackets notation for indexing ([i]) and slicing ([start:stop]) a list. For example, POKEudgfix[0] yields the first POKE, and POKEudgfix[1:] yields every POKE but the first.

There are more new features to discover, but for details on those and the bug fixes in SkoolKit 9.4, head over to the changelog. When you’re finished there, get a copy of 9.4 and start rendering POKE lists with absolute precision.

Let's talk about PZX

SkoolKit 9.3 has been released. To get a copy, please head over to the download page, the Python Package Index, or GitHub.

As if introducing support for RZX files in SkoolKit 9.2 wasn’t enough, 9.3 continues on the new file format bandwagon by introducing support for PZX files. In case you’re not aware, PZX is a tape file format that’s much simpler than TZX, and leaves no room for ambiguity about where one pulse ends and the next begins. Which is quite important for a computer whose tape-loading routines are all about those ‘edges’ between pulses (and in some cases about whether those pulses are high or low, another topic on which PZX is unambiguous).

So now that you are aware, you will no doubt want to convert your entire collection of TAP and TZX files to PZX format. And you can do that safe in the knowledge that SkoolKit 9.3 has you covered: tapinfo.py can show information on the blocks in a PZX file, and tap2sna.py can LOAD that same PZX file. On top of that, bin2tap.py can now write PZX files too.

In other news, sna2skool.py has finally gained the ability to disassemble some of the more obscure ‘undocumented’ instructions in the Z80 assembly language, such as ‘IN F,(C)’, ‘OUT (C),0’ and ‘RLC (IX+d),B’. It can also now disassemble ED6B0000 to ‘LD HL,(0)’ if you want it to, along with a batch of other variant opcode sequences, such as ED4E to ‘IM 0’, or ED4C to ‘NEG’. This new feature is disabled by default, though, for good reasons. One is that your assembler might not recognise some of these instructions, which will be a problem if you want to run it on the output of skool2asm.py. Another is that your assembler probably won’t assemble instructions with variant opcode sequences back to the original byte values.

But if you want to enable this feature despite these dangers, you can set the Opcodes configuration parameter for sna2skool.py to one or more of the following values in a comma-separated list:

  • ED63 - LD (nn),HL
  • ED6B - LD HL,(nn)
  • ED70 - IN F,(C)
  • ED71 - OUT (C),0
  • IM - IM 0/1/2 variants
  • NEG - NEG variants
  • RETN - RETN variants
  • XYCB - RLC (IX+d),B etc.
  • ALL - all of the above

One other potential danger with instructions that have variant opcode sequences is that skool2asm.py and skool2html.py won’t assemble them back to their original byte values, thus creating a discrepancy between the internal memory snapshot derived from the skool file and the snapshot that was used to create the disassembly. To work around this, the new @bytes directive can be used to remove any ambiguity. Whenever sna2skool.py encounters an instruction with a variant opcode sequence, it will automatically insert a @bytes directive. For example:

@bytes=$ED,$4E
 $8000 NEG     ; This assembles to ED4E (not ED44)

On a completely different note (pun intended), trace.py can now write a WAV file after code execution has completed. This means, for example, that you could create a WAV file of the Fairlight theme tune like this:

$ tap2sna.py https://worldofspectrum.net/pub/sinclair/games/f/Fairlight48V1.tzx.zip fairlight.z80
$ trace.py --stop 49217 fairlight.z80 fairlight.wav

And that’s just some of the news. Information on the the other new features and bug fixes in SkoolKit 9.3 can be found in the changelog. After you’re done reading that, grab a copy of 9.3 and unleash it on your new collection of PZX files.