POKEs

To the Spectrum, everything in memory is bytes, numbers between 0 and 255. The BASIC manual, written by Steven Vickers, asks you to picture memory as a long row of numbered boxes, each with one byte inside. The boxes from 0 to 16383 are ROM: they have glass lids, and you can only read what was put there in the factory. The ones after that are RAM, and those you can open and change ^[1].

To read a box there is PEEK: PEEK 0 gives you the first byte of the ROM. To write there is POKE, in the form POKE address, value. The manual's example is POKE 31000,57, and PRINT PEEK 31000 shows that the 57 stayed there. The value has to be between -255 and 255, and the Spectrum adds 256 to negative ones ^[1].

The RAM is laid out in areas. The screen image starts at 16384, the colours of each position (the attributes) at 22528, the printer buffer at 23296 and the system variables from 23552 to 23733; only then come the BASIC program, its variables and, right at the top, the stacks and the user-defined graphics ^[1]. On a 16K Spectrum, the boxes above 32767 don't even exist ^[1].

The manual didn't hide the risk: POKE gives you immense power over the computer, and a power of destruction just as great, because a wrong value at the wrong address can wipe out in an instant a program that took hours to type in. But it reassured you straight away: you can't do the machine any permanent harm ^[1]. This is the instruction a generation cheated with.

A machine code game keeps the number of lives in one of these boxes, and somewhere in the code there is an instruction that takes one away when you die. In Bug-Byte's Manic Miner, the complete disassembly of the game shows it beyond doubt: the lives are at address 33879 and, at address 35136, there is the instruction DEC (HL), which decreases that number by one ^[2].

On the Z80 processor, the instruction DEC (HL) is byte 53, and byte 0 is NOP, an instruction that does nothing ^[3]. The famous POKE 35136,0 swaps one for the other: the game still passes through there when you die, but no longer deducts anything, and the lives become infinite ^[4]. That is why the tips lists also taught the way back: POKE 35136,53 switches the cheat off ^[5].

Jet Set Willy, from Software Projects, does the same. The routine that takes a life fetches the number from address 34252 and has its DEC (HL) at 35899, and that is where POKE 35899,0 lands ^[6][7].

It wasn't always the deducting instruction that got wiped out. In a tip for Chuckie Egg published in Your Spectrum, Andrew Pennell warned that his POKE didn't remove any DEC: it changed a jump, which worked, but made the game over message appear a few times in the middle of play ^[8]. Another value that turns up a lot in the lists is 201, the code for the RET instruction, which returns from a routine ^[3]: in Saboteur!, for example, POKE 40004,201 gets the dogs out of your way ^[9].

And watch out for versions, because the addresses change from one edition to another. Manic Miner was reissued by Software Projects, and there the lives POKE is no longer 35136 but 35142 ^[5]. The POKEs you see on this page are for the editions shown.

In Crash, the cheats lived in the Playing Tips section, which carried solutions and tricks to make games easier. In the early years it was Robin Candy who wrote it, and in April 1986 the magazine even gave away a supplement of nothing but his tips; then came Hannah Smith ^[10]. When she left, a 15-year-old boy from Ludlow, Nick Roberts, wrote in asking for the job and, two months later, he was the tips editor ^[11].

The raw material arrived by post. Roberts remembers sacks of letters every week, with maps and tapes full of POKE routines, which he picked out for publication. He also hunted for POKEs himself, digging through the games' code with a Multiface, and says it was always a thrill to find messages the programmers had left in there ^[11].

Sinclair User printed the discoveries in its readers' letters, with name and town. In August 1984, three readers from Merseyside, Wiltshire and Birmingham sent in the infinite lives POKE for Jet Set Willy ^[12]. Two years later, the magazine had a little POKE corner with the classics for quick reference: Manic Miner, Jet Set Willy, Atic Atac ^[13].

In Your Sinclair, the tips section was first called Hack Free Zone, to set it apart from Hacking Away, which was the one with POKEs to type in; in 1987 the two merged into the Tipshop. Hacking Away's successor was Practical Pokes, presented mostly by Jon North, with POKEs to type in and for the Multiface ^[14]. In January 1991 it was still there, opening with Jon North promising POKEs in quantity ^[15].

In Spain, MicroHobby had Tokes & Pokes. In December 1990, a reader from Barcelona wrote in to say he didn't understand the explanation of how to put pokes into his Spectrum +2; the magazine replied that it was as simple as could be and, in the same issue, explained it again in a separate box ^[16].

Typing the POKE was the easy part; the hard part was reaching memory before the game started. The classic method, as MicroHobby explained it: instead of LOAD, you typed MERGE "", which loads the small BASIC program at the start of the tape and stops without running it. You stopped the tape, edited the line with the RANDOMIZE USR, which is the one that starts the machine code, and put the POKEs immediately before it ^[16].

In the British magazines it was the same. For Jet Set Willy, Sinclair User told you to load with MERGE "", stop the tape, add the line 37 POKE 35899,0, type GOTO 10 and start the tape playing again ^[12]. But MicroHobby warned that this only worked with unprotected games: turbo loaders, at more than 2000 baud, or flashing-colour loaders made it impractical ^[16].

And there were more and more protections. Speedlock, by David Aubrey-Jones and David Looker, spent about a year being sent to publishers without any of them taking it up, until Ocean first used it in Daley Thompson's Decathlon, which Crash reviewed in November 1984. Aubrey-Jones says he made it because he was getting more and more fed up with how long normal loading took ^[17]. With protections like these, copying the tape with a copier program became almost impossible, and the loaders had to be taken apart by hand ^[18].

For those games, the magazines printed hack listings: BASIC programs, often with DATA lines full of machine code, that took over the loading and slipped the POKEs in along the way. It wasn't an exact science: one of these routines for Underwurlde, published in Crash, came to replace another, from the previous issue, that didn't work ^[19].

In January 1991, Your Sinclair was teaching how to take apart Speedlock 1 and 2. Version 2 had six decryption routines, and part of the code checked whether a Multiface was plugged in. The code made use of Z80 tricks, such as the R register and jumps that depend on parity, and deliberately started with garbage, to make you think you were at the wrong address ^[15].

In February 1986, Sinclair User introduced the Multiface One, from Romantic Robot. At the press of a button, it copied whatever program was running to disk, microdrive or Wafadrive, and let you look at what was in memory and make POKEs to reach the high scores ^[20].

The secret was in the hardware. The button triggers the Z80's non-maskable interrupt, and the Multiface takes over the machine with its own ROM ^[21]. As the protections of the time acted mostly during loading, or just after, a game caught halfway through was already whole and unprotected in memory ^[21].

For cheating, all you had to do was stop the game, type in the address and the value and go back to where you were, with no MERGE and no listings. The magazines started printing Multiface POKEs every month ^[21]. There were even programs for the device's own 8 KB of RAM, such as Lifeguard, which analysed memory during the game to find out which addresses to change ^[21].

After the Multiface One, for the 48K Spectrum, came the Multiface 128, in April 1987, and the Multiface 3, in November that year, for the Amstrad models the 128 didn't support ^[21].

A device that copied any game at the press of a button wasn't innocent, and nobody pretended it was. Sinclair User itself opened its review of the Multiface by pointing out that back-up devices are always controversial, and that this one was going to be the most controversial of all ^[20].

The line between cheating and piracy was thin. MicroHobby told its readers that the best way to put the pokes in was with a transfer program ^[16], and among the best-known copier programs was Trans Express, also from Romantic Robot ^[18]. Andrew Pennell, in the Chuckie Egg tip, chose not to publish a loader of his own, so as not to tread on anyone's toes, and used a modified version of the game's own loader ^[8].

Protections had a price too. When Ocean adopted Speedlock, the Crash readers' forum argued about it for months, and some complained that games now loaded worse ^[17].

Sometimes it was the publisher itself sending in POKEs. In 1984, Jet Set Willy players kept dying in several places after going through the attic. Software Projects assured Sinclair User that this wasn't a bug but a deliberate way of making the end of the game harder, and published four POKEs to cancel it out ^[12]. The modern disassembly of the game treats it as what it was, a bug, and explains that those POKEs fix it, along with other problems ^[7].

POKEs have survived in .POK files, a format created for the SGD program to apply POKEs to snapshots before opening the emulator. Each cheat starts on an N line, with its name; the M and Z lines hold the POKEs, Z being the last, with the memory bank, the address, the new value and the original value, so it can be undone; a value of 256 means the program asks you for the number; and a Y closes the file ^[22].

In the Manic Miner file kept in ZXDB, the infinite lives line is Z 8 35136 0 53 ^[23]. The 8 means the bank is ignored, as in all 48K games, the 0 is the new value and the 53 the original ^[22]: the same DEC (HL) the disassembly finds at that address ^[3][2].

ZXDB, the database created by Einar Saukas that feeds Spectrum Computing, attaches to each game its POKE file and the list of magazine articles it appeared in, with links to the scanned pages ^[23]. The Tipshop gathers the tips published in the magazines, showing the issue and page they came from ^[5].

Emulators do the rest. Fuse looks for a GAME.POK on its own when you open GAME.TAP, and has a POKE finder similar to the Multiface's Lifeguard: you search for the number of lives you have, lose one, search for the new number, and soon a single address is left. In the Fuse manual's example, the instruction that deducts the life is then replaced by a NOP ^[24], exactly what POKE 35136,0 does in Manic Miner.

You don't need a game to try it. Between addresses 23552 and 23733 lie the system variables, which hold the state of the Spectrum itself. The manual says you can peek at them with PEEK and that some of them can be changed with POKE, to good effect ^[25].

Only some. The manual marks with an X the ones you shouldn't touch, because the system may crash, and with an N the ones that have no lasting effect ^[25]. The ones we suggest are outside both those lists and take up a single byte; the two-byte ones store the less significant byte first, the opposite of what you might expect ^[25].

On the 48K Spectrum, keywords aren't spelled out: at the start of the line the cursor is in K mode, and the key you press gives the word printed on it ^[26]. And if anything goes wrong, you don't break anything; just reset ^[1].