From: ajpierce@med.unc.edu (Andrew Pierce)
Subject: Twill
Organization: UNC-CH School of Medicine
Date: Thu, 30 Jul 1992 04:19:16 GMT

   Well, it looks like I still have a few surprises left after all. :-)
Twill entered KotH at #1 and seems to be swapping off with FlashPaper at
the moment (except for it and Crimp 2's accidental deletion due to a KotH
"feature" which Bill tells me he will hunt down and ;kill :-) )
   Here is the code to Twill.  Basically it is a dwarf which bombs with a
mov <x,y instruction.  The theory is that as has been pointed out for
scanners, if you can bomb instructions as fast as you can scan them, you
might as well just bomb them.  I first tested the mov <x,y instruction a
month or two ago in my program "Superdwarf" which briefly made it onto the
hill near the bottom for a brief while.  Twill represents a significant
increase in complexity.  It uses a mod 2 fibonacci bomb pattern and self
modifies four times before turning into a mod 1 core clearer.  The
third self-modification step uses the controversial "mov <0,0"
instruction.  If you missed the original "in register" vs "in memory"
debate, maybe Twill will be instructional.  On an "in register" system
such as KotH and MAD's MADgic Core, Twill turns into a coreclearer.  On an
"in memory system" (no examples come to mind) Twill will kill itself.  The
spl 0,0 instruction is a placeholder.  I needed a spacer and figured that
would be a good one.  The difference is about 15 KotH points mainly due to
increased robustness.  Twill eventually nukes the spl instruction with no
problem.  Twill functions correctly with a process limit of 64 as well as
the 8000 process limit used on KotH.
   I will go through the 4 self-modifications individually to help out new
redcode programmers.

;redcode
;name Twill
;author Andy Pierce

offset	dat #5138,#-5138
start	spl 0,0
	sub offset,1
	mov <0,0
	jmp -2,0

	end start

------------------------------------------------------------------------

   The first self-modification occurs when the mov instruction is
mov <-2,2.  This converts the spl 0,0 to a spl 0,-1 and adds a
dat #5138,#5138 instruction.  Twill now looks like this:

1st self-modification:
	dat #5138,#-5138
	spl 0,-1
	sub -2,1
	mov <-2,+2
	jmp -2,0
	dat #5138,#-5138

   The second self-modification occurs when the mov instruction is 
mov <+2,-2.  This obliterates the spl instruction and decrements the
B-field of the mirrored dat instruction (which will be crucial later on).
Twill now looks like this:

2nd self-modification:
	dat #5138,#-5138
	dat #0,#0        (probably)
	sub -2,1
	mov <+2,-2
	jmp -2,0
	dat #5138,#-5139

   The third self-modification is the controversial one using the
mov <0,0 instruction.  On an "in register" system, the sub instruction is
copied over the mov instruction.  On an "in memory" system, the mov <0,0
instruction would be converted to a mov <0,-1 instruction.  Here is why:
   i) in register:  put a and b operands into registers and evaluate
                    them separately.  *evaluation of the a operand 
		    predecrement does NOT change the value of the b operand
		    stored in the register*  An effective mov -1,0
		    is executed.
   ii) in memory:   the a operand is evaluated first and then an
                    intermediate form of the instruction is rewritten to
		    memory before the b operand is evaluated.  The
		    intermediate instruction is mov -1,-1 (after the
		    a field has been evaluated).  Now the b-field is
		    evaluated as a -1.  An effective mov -1,-1 is
		    executed.

3rd self-modification:
	dat #5138,#-5138
	dat #0,#0
	sub -2,1
	sub -2,1
	jmp -2,0
	dat #5138,#-5139

   The fourth self-modification occurs when the second sub instruction has
been set to sub 2,-3 by the action of the first sub instruction.  This
changes the original dat #5138,#-5138 to dat #0,#1.  Twill now looks
like this:

4th self-modification:
	dat #0,#1
	dat #0,#0
	sub -2,1
	sub 2,-3
	jmp -2,0
	dat #5138,#-5139

   Now the first sub instruction merely decrements the b-field of the
second sub instruction by one each time through the loop.  The second sub
instruction subtracts 5138,-5139 (the value of the mirrored dat statement)
from every location starting with the location immediately before Twill
and proceeding all around the core.  Since a-fields are effected by the
sub, with any luck, spl jmx and djn instructions which happen to have
survived the throrough initial mod 2 bombing pass will hopefully be
converted to point to the twilight zone, killing the other program.

   Well there you have it!  Not bad for a five line program... :-)

     -Andy
ajpierce@med.unc.edu