I took a look at the disassembly of the game, trying to figure out what makes the RNG tick.
Language: asm6502
;Function $00:920A
LDA $005A
AND #$48 ; Get XOR of bits $40 and $08 from address $005A
ADC #$38
ASL
ASL ; Now it's in our carry bit.
ROL $005C ; And shifted into the big-endian RNG bytes at $005B and $005C
ROL $005B ; Upper bit that's shifted out is thrown away
INC $005A ; +$01
LDA $005A ; Many things are added to $005A...
ADC $0018 ; P1 immediate - Mirror of controller state
ADC $0019 ; P1 pressed - Bits are set if pressed now, but not held before
ADC $001A ; P2 immediate
ADC $001B ; P2 pressed
ADC $005D ; Frame timer low-byte
ADC $005E ; Frame timer high-byte
ADC $005F ; ? Unknown. Looks to be always zero so far...
ADC $0060 ; ? Unknown. Looks identical to $005D MOD 8
ADC #$0D ; +$0D
STA $005A
RTS
There is a two-byte shifter at address 0x005B that merely shifts its bits to the left. It is big-endian in its shifts, for whatever reason. The upper bit that gets shifted out looks to be thrown away, as the following INC instruction messes with the carry bit (
unless I missed some detail in 6502 assembly in an embarrassing manner). The low bit that gets shifted in is an XOR of 0x005A bits 0x48. If 0x40 and 0x08 are different (01 or 10), we shift in a 1; If the same (11 or 00), we shift in a 0.
Seeing as it doesn't feed back into the RNG, I must assume its used elsewhere, such as spawning position of enemies or something.
As for what feeds 0x005A, it looks to be a sum of controller data and timers, plus an extra 14. The carry bit is always added in every time, with a constant added in the end, so the effective period of 0x005A is 255, not 256. Can't get 255 with carry set, and can't get 0 with carry clear, so with the constant added, we'll never get a result of 13 sitting in 0x005A.
Controller data includes what's being held at the moment and whether or not you just now pressed it and not have done so before this frame. Updates to the controller addresses are, of course, skipped during lag frames. The game intentionally inserts a lag frame following every normal frame for speed consistency, so half the frames come up lag according to FCEUX. Even so, every frame, both normal and lag, uses the controller data for RNG purposes, and since I only have control every other frame, this slightly reduces my RNG-controlling abilities.
As for other addresses of note, 0x005D is a two-byte little-endian frame timer that resets to zero whenever a new area is loaded. 0x005F looks to be always zero so far. 0x0060 is a frame timer that simply runs from 0 to 7 then resets to zero. All these timers run every frame, both normal and lag.
It looks like most of these have a variety of purposes to the game in some fashion. I'll have to figure out the timer, since I've spotted in one spawning routine, that it looks for a very particular time before letting it spawn.
In any case, with P2, I should be able to control the RNG very nicely, as it's simply added in along with all the other stuff, giving access to a wide range of possible values for address 0x005A.
Other, less-RNG-related things that come to mind:
The X and Y axis of your ship's speed are limited independent of one another. In other words, it's a rectangular restriction rather than a circular one. You can max out your speed (3.0 pixels/frame) in one axis before dealing with the other axis, and this will not slow you down one bit. This is the reason why I point exactly to the right at the start of planet 7 for a bit before facing straight up to maintain height.
While your thrusters and the gravity are limited in how fast you can move, the game forgets to apply this limitation when a tethered object drags you along. This means your X-speed can exceed 3.0 pixels/frame for an extended period as long as you do not thrust with any force to the left or right. You can thrust straight up or straight down without losing the boosted speed. Motion downward or upward often has gravity often getting in the way, so except for tiny fractions of 1/256, a boosted Y-speed isn't happening when gravity is affecting you.
In other news, I haven't yet put the effort into bypassing that big enemy. So it's still a wall to me. But I have been spending time optimizing the route through the start of planet 7, and get myself walled by that same enemy several frames earlier as well as picking up a little extra cash from shooting stuff. So at least I'm richer by the time I get stuck.