Random Boxes

This program is a machine code loader and launcher that prints random sized boxes with random character fills.. The BASIC program uses a single `RAND USR 17298` call at line 2 to transfer execution into the machine code embedded in the REM, which begins at address 16514 (the first byte after the REM token and length bytes on a 16K machine). The REM data is substantial — several hundred bytes of Z80 opcodes — and handles all primary logic including what appear to be floating-point arithmetic routines, display output via RST instructions, and structured data tables stored at fixed addresses in the 0x4400 region. Lines 10–30 provide a simple BASIC wrapper: clearing memory, saving the program under the name “1032%2”, then restarting with RUN.

---

Program Analysis

Program Structure

The BASIC listing is intentionally minimal, serving only as a vehicle to store and launch Z80 machine code:

1. Line 1 — A REM statement containing the entire machine code payload (several hundred bytes of raw Z80 opcodes).
2. Line 2 — RAND USR 17298 transfers execution to the machine code. Address 17298 decimal is 0x4392, which falls well into the REM body, suggesting the code self-relocates or that the REM begins at the standard address 0x4009 and the entry point is offset accordingly.
3. Line 10 — CLEAR with no argument resets the BASIC stack and clears variables.
4. Line 20 — SAVE "1032%2" saves the program to tape.
5. Line 30 — RUN re-executes from line 1 after saving.

The flow implies the program is intended to be loaded, auto-saved under the given name, and then run. Lines 10–30 act as a distribution/duplication wrapper rather than core program logic.

Machine Code Entry Point

On a standard 16K machine the REM data begins at address 16514 (0x4082). RAND USR 17298 (0x4392) therefore enters the code at a byte offset of 784 into the REM block, past the initial setup routines. The first bytes of the REM (\2A\39\40\E5\CD\2B\0F) decode as:

• 2A 39 40 — LD HL,(0x4039)
• E5 — PUSH HL
• CD 2B 0F — CALL 0x0F2B (a ROM routine)

This suggests the very start of the REM block (reachable via a different entry or self-modifying jump) begins by reading a word from address 0x4039 and calling into the ROM, consistent with floating-point or channel setup.

ROM Calls and RST Usage

Throughout the disassembly several well-known ROM entry points appear:

Address	Likely ROM routine
0x0F2B	Evaluate expression / FP stack
0x0F23	Related arithmetic entry
0x0A1F	Print character / output
0x0918	Display / print routine
0x0BBD	Cassette or I/O routine

RST instructions appear as D7 (RST 0x10 — print character to current channel) and CF (RST 0x08 — error handler), which are standard Spectrum/TS2068 ROM fast-call idioms used to minimise code size.

Fixed Memory Map at 0x4400

A notable feature is the heavy use of absolute addresses in the 0x4400–0x44FF range as a structured data area. Addresses referenced include:

• 0x4421 / 0x4439 / 0x443A / 0x443B — flag bytes and counters read and written throughout the code.
• 0x441E — a single byte used as a direction or mode flag (modified by 32 1E 40 = LD (0x401E),A).
• 0x44C7, 0x44C9, 0x44CB, 0x44CD, 0x44CF, 0x44D1, 0x44D3, 0x44D5, 0x44D7, 0x44D9 — a tightly packed array of 16-bit words, each loaded/stored with LD HL,(...) / LD (...),HL pairs, suggesting a table of coordinates or vector components.
• 0x445D — used as a base pointer in one display loop.

Arithmetic and Multiply Routines

The REM block contains what appears to be a custom 16-bit multiply routine starting near offset 0x41C5. It uses the classic shift-and-add pattern:

• A loop counter of 16 (06 10) iterates once per bit.
• Double-length left shifts are performed with ADD HL,HL and RL C / RL A.
• Conditional ADD HL,DE accumulates partial products.

A separate signed division or normalisation block appears at approximately offset 0x41ED, using ED 52 (SBC HL,DE) and ED 62 (NEG equivalent on HL) with carry checks, typical of fixed-point scaling code used in line-drawing or 3D projection.

Display and Graphics Handling

Several code sections use D7 (RST 16) to stream character codes to the display, including control codes 0x12 (AT), 0x16 (INK/PAPER attribute tokens), and 0x13 (TAB). The sequence 3E 12 D7 (LD A,18 / RST 16) appears more than once, consistent with positioning the print cursor via AT row/column pairs. A loop at one location outputs a sequence of block graphic characters from a table, building a sprite or border directly through the channel output system rather than direct screen memory writes.

FD CB (IY-bit) Instructions

Several FD CB prefix instructions appear, operating on bits of (IY+offset). For example:

• FD CB 21 46 — BIT 0,(IY+33) — tests a system flag.
• FD CB 21 4E — BIT 1,(IY+33)
• FD CB 01 4E — BIT 1,(IY+1)
• FD CB 01 C6 — SET 0,(IY+1)

These are accessing the system variables area via the IY register (which the ROM keeps pointing to 0x5C3A on the Spectrum/TS2068), specifically flags related to input mode and key state.

Notable Techniques

• REM as code store: The entire executable lives in the REM at line 1; RAND USR jumps directly into it, bypassing any BASIC interpreter overhead.
• EX (SP),HL tricks: E3 (EX (SP),HL) appears multiple times to swap HL with the top of stack, a compact way to pass or return values without dedicated registers.
• Self-modifying or table-driven dispatch: Several JP (HL) / E9 instructions at the ends of routines use a pointer loaded from the data table at 0x4400, providing an indirect jump dispatch mechanism.
• Inline data tables: The final bytes of the REM (2A 00 07 00 1E 00 ...) are clearly a data table rather than code, used as parameters for the routines above.

Anomalies and Observations

• The CLEAR at line 10 has no address argument; this clears variables but does not set a new RAMTOP, which means it does not protect the machine code sitting in the REM from being overwritten by BASIC — the machine code must have already finished and returned to BASIC by this point.
• The SAVE filename "1032%2" uses the %2 escape for inverse video of ‘2’, which on tape gives a distinctive visual name but does not affect the saved bytes.
• The RUN at line 30 after saving will re-enter line 1 and immediately jump back into machine code via line 2, causing any post-save logic to loop.