I'm playing with an old ZX Spectrum 48k and I'm wondering how exactly it is possible to enter. You load a game with a tape - then somehow break out of the program type in the POKE statements and start running the program again? I've done a lot of searching on this but haven't been able to find exactly how this is done so any leads on this would be greatly appreciated. If you can manage to stop between those steps, you can POKE around to increase the number of lives,... Once a machine program is running there is usually no way to stop it and get back to the BASIC interpreter. Unless the machine program provides some explicit or inadvertent way to do so. Worth noting that sometimes the loader program would include custom loader code embedded as machine code in REM statements. In this case the machine code would be executed before the rest of the game is loaded, and control never returned back to BASIC so there is no opportunity to execute POKEs in that case. About line 40, usr 40000 is the expression that does the trick, calling assembly at position 40000. The instruction Randomize just initializes the random seed used by rnd, thought it will actually never return. The process will stop before executing the loader. This is useful when the loader included a poke instruction that disabled BREAK. The problem with these methods were that at first the attempts to hide the loader inners were naive, such as including a PAPER 0: INK 0 instruction or something like that at line 10, making everything temporarily invisible , but soon they would get a lot more complex, up to the point to actually be an assembler program included in REM instructions. The next step was to analyze the headers of the assembly code loaded after the basic loader, conclude the dump address and the length of the code, and create your own loader in which you could include the poke instructions you wanted. Many magazines distributed this kind of loaders, which were intended to be loaded before the original one the loader looked for specific blocks, bypassing the original basic loader. So then developers decided to include the assembly blocks in tape without the headers, as well as protecting the loader. Or including a loader that just loads an assembly program that substitutes the loader in ROM, using different speeds, without header information, etc. Or including a loader that loads a headless block including the presentation screen and the code for the game. And then special hardware such as the appeared. Reading the you can see how invoking multiface's software included in the peripheral hardware's ROM by pressing a red button which provoked a NMI not masked interruption , a menu was shown allowing you to save the memory at that point and the saved code would be free of any protection, thus opening the path to create your own loader with pokes , or even examine PEEK current values at specific addresses in memory and enter POKE's directly with which you could find the beginning of those routines, for example, that diminish your lives in one. The POKE's instructions were usually of the kind this is a simplification : POKE addr, 0 or POKE addr, 201. The number addr was the beginning of a routine diminishing the number of lives available, or detecting the clash with an enemy. The code 0 is the assembly NOP no operation instruction. During a NOP, the CPU does nothing. The code 201 or C9 is the assembly RET return instruction, which means to return for a subroutine. In BASIC, you would call a subroutine with GOSUB and return from its end with RETURN. When a Spectrum game loads, it initially loads in a small loader program, and runs that, the tape continues and the bulk of the program is loaded in. The last command in the loader program then issues a poke command which calls everything loaded and starts the game. So, as I remember, you have to pause the tape once the loader program has loaded, and stop the line of code from automatically issuing the final poke, then continues. Then once the bulk has loaded, you issue your poke from the command line, and then the original poke to start the game. The loader program will be loaded after the first set of red and blue lines, followed with the very short yellow and blue lines on the screen as I recall it prints the name of the program found at this point. Stop the tape, press Break, then List to see the code. Best of luck and great question! The POKE codes printed in ZX Spectrum magazines usually expected you to have a plug-in hardware device e. Once the game loaded, you could press the Multiface button to halt the game, enter the POKEs, and then return back to the game. Without a special device, you need to play with the loader programs, as described by the other answers. You need to load the initial small loader program and then BREAK into the code. If you're lucky, the code will do something simple with loading in the rest of the game and then execute the actual machine code game using the RANDOMIZE USR call. In this case you can modify the loader BASIC program to do the POKES after the game has loaded but before the game is started. However, many games make this hard because they include custom loader code. This is often written in machine code embedded into the small BASIC program in REM statements. The machine code will load the game and execute it, and because they never return control to the BASIC code, there is no opportunity to enter the POKEs. If you are dedicated enough, you could try modifying the machine code to either return control back to BASIC so you can POKE away, or else perform the POKEs via machine code calls. This is quite hard, because if I remember rightly, the editor used to scramble lines containing non printable characters in the REM statements. There were software tools like RoyBot that could help you with modifying code in memory. Some game developers did really crazy stuff to prevent game hacking, such as implementing loader code that actually overwrote its own code while it was being executed.
