cd32-prey-doc

Reverse-engineering notes on Prey: An Alien Encounter (KirkMoreno Multimedia / Almathera Systems, 1993) for the Amiga CD32 — a disc with no audio track that carries an hour of speech as 1,225 identical 60 KB files, whose intro animation shipped under the filename Test, whose digitised actors still have the videotape timecode burnt into the picture, and which happens to answer the standing question about a fragment of the Amiga operating system that has been pressed onto every disc of this format since 1993.

122 MB, 1,439 files, nothing compressed, and a master cut eleven minutes after the last file was written.

It is also documented against the 1992 CDTV release of the same game, which turned out to be the control disc this pipeline needed: 1,201 files are byte-identical across the fourteen months between them, and running the same tools over both corrected two claims these notes had made on one disc's evidence. See docs/09-cdtv-1992.md.

Documentation only. No game assets, no extracted art, no audio and no executable code are committed here. The tools in tools/ reproduce every figure, table and image in these pages from your own legally obtained copy.

What is documented

Doc	Contents
00-overview.md	The release, why the "1993" in the filename is right, and what kind of game the file set says it is
01-disc-image.md	Cue sheet, volume descriptors, the sector map, and 6,000 empty sectors before the volume starts
02-trademark-block.md	The block is not at sector 21 — and /CD32.TM is the file it came out of
03-filesystem.md	Four timestamp epochs on one disc, and a digitising log written by a machine with no clock
04-boot-chain.md	Three lines of startup-sequence, 59 Workbench commands, two of which run
05-executables.md	Prey and DoPrey: a two-process handshake, 5,323 relocations, and 448 register writes the usual grep misses
06-scenes-and-audio.md	1,225 chunks of exactly 61,440 bytes, and the AUD3LEN write that explains the number
07-graphics.md	One frame geometry for 87 files, fourteen AGA screens, and a 619-frame CDXL
08-leftovers.md	The archaeology
09-cdtv-1992.md	The 1992 CDTV release of the same game — the control disc, and the two claims it corrects
10-open-questions.md	What is unresolved, with the measurement behind it
notes/file-inventory.md	All 1,463 directory records with LBA, size and timestamp
notes/scene-map.md	All 177 scenes: directory, chunk count, bytes, and the shuffled block assignment
notes/string-inventory.md	Every word-shaped string in the disc's own programs
notes/cdtv-vs-cd32.md	All 1,514 paths across the two releases, matched, sized and hashed
cd32-platformnotes-doc	Platform checklist — what to look for on any CD32 or CDTV disc. Shared by every Amiga CD pipeline

Highlights

The Commodore trademark block is not at sector 21, and this disc says where it came from

Two previous discs put it at sector 21 and the checklist called it "sector 21". On Prey, sector 21 is entirely zero. The block is at LBA 6021, and the primary volume descriptor's application-use area — offset 883, normally empty — points at it:

offset 884:  46 53 00 00        "FS"
offset 888:  54 4D 00 14        "TM",  0x0014 = 20   <- a constant, not the path-table LBA
offset 892:  00 00 08 00        2048
offset 896:  00 00 17 85        6021                 <- read this, do not assume 21

The bytes themselves are identical to Dragonstone's and to Marvin's, all three SHA-1s, on a master cut fourteen months earlier than either. Including the 876 bytes of unlinked AmigaDOS object file that follow the ASCII-art banner: compilation unit exec, defining AddPort, GetMsg, PutMsg, FindPort, ReplyMsg and WaitPort, with HUNK_SYMBOL intact and Commodore's own Exec assembler macros expanded by line number.

And then there is /CD32.TM — an ordinary file, in the root directory, 2,048 bytes, dated 10 June 1993, referenced by nothing on the disc, whose SHA-1 is c5ffcef2a5e33d2df606185823cd95d1c174d65f: exactly the trademark sector.

So the question that two discs of hashing could only narrow is answered sideways, by a file somebody forgot to delete:

Commodore distributed the trademark block to CD32 developers as a 2,048-byte file named CD32.TM, and that file already contained the fragment of Exec's source. The stale-buffer accident happened once, at Commodore, and every disc since has copied the result.

…and the CDTV disc shows the .TM block is not the same thing on both consoles

The 1992 CDTV release has the same pointer, the same 'TM' tag and the same constant 20 — pointing at 22,152 bytes at LBA 48,621, eleven times longer, and there is no Commodore trademark banner anywhere on that disc. What is there instead is /CDTV.TM, and it begins:

cdtv 35.2 (6.2.91)
CDTV Device Driver
Copyright (c) 1990, Commodore-Amiga, Inc.
Created by Carl Sassenrath, Ukiah CA

The CDTV device driver, by the designer of AmigaOS's Exec kernel, in the block every disc of the format reserves. So the mechanism is shared and the payload is per-console — and the exec fragment is a CD32-era artefact that appeared when the shorter CD32 .TM file was assembled, not something the format has carried since 1991.

The CDTV boot script even names the operation: its second line is CD0:c/rmtm — remove TM — a Commodore command that opens playerprefs.library and intuition.library and runs once, immediately before the game. Which is the same shape as the CD32 disc opening freeanim.library and never calling it.

75 MB of speech, in 1,225 files that are all exactly the same size

Nine directories, SCRIPT00 to SCRIPT08, 1,225 files, 61,440 bytes each, 68.6 % of every byte of file data on the disc. Raw 8-bit signed mono PCM, no header. The game builds their names from a template it carries in plain text:

Prey:ScriptXX/SYYYYCZZ          directory / scene / chunk

177 scenes, no gaps. And the chunk size is not arbitrary — it is a DMA register value. At offset 0x2B0 of the game executable:

move.w  #$7800,$00DFF0D4        AUD3LEN = 30,720 words = 61,440 bytes  = one chunk
move.w  #$F000,$00DFF0C4        AUD2LEN = 61,440 words = 122,880 bytes = two
move.l  #180,d0
move.w  d0,$00DFF0C6            AUD2PER = AUD3PER = 180

Period 180 on PAL is 19,705 Hz, so a chunk is 3.118 seconds and the 1,225 of them are 63 minutes 40 seconds of audio — streamed through Paula, off an ordinary ISO 9660 file system, while AmigaDOS is still running. A disc that carries an hour of sound and has no audio track.

$00DFF000 is the wrong thing to grep for

The checklist's test for "does this program drive the hardware" is to count loads of the custom-chip base address. MORENO/DoPrey contains zero of them — and 448 references to individual registers, written absolutely as $00DFF0xx: all four Paula channels, the Blitter, DMACON, INTENA.

Search for the three-byte prefix 00 DF F0 and histogram the fourth byte. The old test would have filed this disc as "never touches the hardware".

It really uses AGA — the first one here that does

Eight bitplanes, 256 colours, on ten screens. No ECS Amiga can display that, and the CDTV release of the same game is the control: the same artwork, by the same people, at five planes and 32 colours.

Six of the fourteen screens also carry palette values that need more than four bits per gun. That claim needs a careful test — an ILBM CMAP stores eight bits per gun whatever the hardware, and a 4-bit value can be written into a byte as either v << 4 or v * 17. An earlier version of these notes tested only for the second form; the CDTV disc, whose palettes are entirely of the first form, showed that up. Corrected in docs/07-graphics.md and in the checklist.

Archaeology

• The intro animation is called Test. 12,657,312 bytes, 619 CDXL frames at 240 × 96 in seven planes, 11.5 % of the disc, and both executables build their command lines around Prey:Moreno/Test. Nobody renamed it.
• C/WACK, Commodore's low-level debugger, shipped on the CDTV release — breakpoints, single-step, disassembly, task inspection, serial console. The CD32 release replaced it with C/Prod_Prep, Commodore's factory hard-disk formatter. Both Prey masters shipped a piece of Commodore's internal tooling, and a different one each time.
• The videotape timecode is still in the picture. Several frames of PREYDATA/BDL000 — a digitised actor in a spacesuit — carry a burnt-in timecode window reading 07:56, and a few frames later 08:06. Another frame is a terminal screen reading RIGHT ON, COMMANDER!!!.
• C/Prod_Prep is Commodore's factory hard-disk formatter, on a retail game disc, in the directory Kickstart assigns to C:. It can partition, write an RDB and low-level format a SCSI drive. Nothing runs it. It came with a Workbench system directory that was copied wholesale — 78 files, all stamped 1993-09-22 12:19:26, one second.
• Two files the game asks for are not on the disc. Prey:Moreno/Almathera, a CDXL the publisher's logo was going to be, in the slot where a last-minute still image shipped instead; and Prey:Moreno/PreyData/Begynd — begynd, Danish for begin, the counterpart of AFSLUT, finish, which is the GAME OVER screen and is present.
• The sound effects are named in Danish: SPIL (play), KAMP (fight), AFSLUT (finish), and the missing BEGYND. The publisher was in Croydon.
• XLFIRST.old shipped, a month and a day after it was superseded.
• 113 of SCRIPT01's 132 files carry AmigaDOS day-zero timestamps in five separate sittings, out of name order, while the other 1,093 scene files carry one bulk-copy stamp. Scenes 68–89 were re-recorded, chunk by chunk, on a machine whose clock had never been set.
• Seven consecutive BDL sprite banks are missing from the middle of the series, and DRS004 from the middle of another.
• All 34 airlock animations share the same uncleared buffer tail. Twenty real frames in a twenty-five-slot file, and the last five slots are the same stale bytes in every one of them.

The 1993 in the filename is correct

The dump is named (1993) and catalogues date the CD32 release to 1994. The PVD creation date is 1993-11-29 21:15:11; the last file written to the master, the 640 × 512 title screen, is stamped 21:03:54 the same evening. Eleven minutes and seventeen seconds. The game executable was linked at 20:35:42 the night before. This is a 1993 master of a game that reached shops the following year.

Reproducing

python tools/pvd.py      <iso>                       volume descriptors, field by field
python tools/tmsector.py <iso>                       the .TM block, wherever it is and
                                                     whatever length it declares
python tools/isofs.py    <iso>                       every directory record
python tools/extract.py  <iso> out/                  the file tree
python tools/census.py   out/                        size, entropy, zlib ratio, occupancy
python tools/hunk.py     out/MORENO/DoPrey           hunks, memory flags, relocations
python tools/scan.py --regs out/MORENO/DoPrey        library calls and custom-chip registers
python tools/scan.py --ver  out/                     every $VER: string on the disc
python tools/frames.py   out/MORENO/PREYDOOR/AIR001 --sheet air.png
python tools/ilbm.py     out/MORENO/PREYDATA/HELP --png help.png
python tools/cdxl.py     out/MORENO/TEST --sheet intro.png
python tools/audio.py    wav out/SCRIPT06/S0002C00 s2.wav --rate 19705
python tools/audio.py    plot waves.png out/SCRIPT06/S0002C00 out/MORENO/PREY8SVX/GAME

Every one of those works unchanged on the CDTV image as well.

Needs Python 3, numpy and pillow. Place the .iso and .cue beside this README; they are in .gitignore and are not distributed here.