tmerritt/disasm
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pass 3 for NES PowerPad Test Card (U): name all data tables and VramWrite streams

Browse Source 
- Decoded the VramWrite ($E1CC) stream format: <addr hi> <addr lo> <count> <bytes>, $00 terminator
- Named all 9 payload streams ($E4CC-$E7C2, no gaps/overlaps) plus VramWriteSourcePointerTable at $F000
- Split PadBitTableLives into Player1TileTable ($E4B4) and Player2TileTable ($E4C0), 12 entries each (Y=0..11)
- Decoded CHR font (digits $30-$39, letters $3A-$52, space $5F; 'W' missing from the A-Z run)
  and recovered on-screen text including 'PRESS A TO TEST SIDE-A' / 'SIDE-B'
- Documented that the 16 KiB PRG is two byte-identical 8 KiB halves; $C000 copy is dead
- Documented 7 unreached subroutines inside the live code region (kept as .byte per Pass-1 policy)
- Fixed a stray duplicate sentence and stale _wip paths in root OVERVIEW.md

Byte-identical ROM verified.
This commit is contained in:
tmerritt committed 2026-10-16 20:24:23 -04:00
1 parent 3ef16a6f99
commit 4c644d2a20
23 files changed
+17290 -507
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

OVERVIEW.md
+22 -23
View File
@@ -181,7 +181,7 @@ This document provides a consolidated overview of all NES disassembly projects i
| `Ice Climber (U)` | $C076 / $C014 / $FFF0 | V | BYTE-IDENTICAL |
| `Lode Runner (U)` | $C02C / $C000 / $FFF9 | H | BYTE-IDENTICAL |
| `Lunar Pool (U)` | $FF65 / $E80C / $FF64 | H | BYTE-IDENTICAL |
| `MUSCLE (U)` | $86CB / $8000 / $8764 | H | BYTE-IDENTICAL |
| `MUSCLE (U)` | $86CB / $8000 / $8764 | H | **Pass 3 done** — code/data split, full semantic naming, data tables structured; see `_wip/MUSCLE (U)/OVERVIEW.md` |
| `Mario Bros (JU)` | $C07D / $C000 / $C000 | H | BYTE-IDENTICAL |
| `Millipede (U)` | $C7F1 / $C735 / $FFF0 | H | BYTE-IDENTICAL |
| `Pac-Man (Tengen) (U)` | $C0FA / $C033 / $C16A | V | BYTE-IDENTICAL |
@@ -196,13 +196,14 @@ This document provides a consolidated overview of all NES disassembly projects i
Notable vector/header observations for Pass 1 work:
- **Pac-Man (U)** RESET at `$FF00` (vector-page tail), while the Tengen variant RESETs at `$C033` — different builds confirmed (PRG bytes differ).
- **MUSCLE (U)** vectors sit in the `$8000-EFFF` window — inconsistent with the `prg.s` skeleton's expected `$C000-$FFFF` mapping; verify the header/image match before Pass 1.
- **MUSCLE (U)** — resolved at Pass 1: this is the one NROM ROM in the set mapped **low**, at $8000–$BFFF, because RESET is $8000. The skeleton's `$C000` linker assumption was wrong and `linker.cfg` had to move. The vectors themselves still sit in the mirror at $FFFA. IRQ $8764 is a bare `RTI` that doubles as the NMI epilogue.
- **Lunar Pool (U)** NMI `$FF65` / IRQ `$FF64` are adjacent in the vector page; RESET `$E80C`.
- **NES PowerPad Test Card (U)** — *at Pass 2/3*: minimal code (~7.2%), data-heavy test cartridge. RESET at $E000 (non-$C000 entry). NMI handler reads controllers via shift register, processes pad transitions, draws score/lives. See `NES PowerPad Test Card (U)/OVERVIEW.md`.
- **Ice Climber (JE) vs (U)**: byte-identical PRG *and* header — only the CHR differs (~regional title graphic).
- **Popeye (JU) PRG 0 vs PRG 1**: different PRG binaries (and mirroring); same vectors.
- **Raid on Bungeling Bay (U) vs [a2]**: `[a2]` differs in mirroring only per header, but PRGs differ — separate builds.
- **Pyramid (U)** — *already at Pass 1*: interesting unlicensed Sachen boot ($4100 mapper pokes, "AV" stack-byte check, two queued-event dispatchers). See its `OVERVIEW.md`.
- **MUSCLE (U)** — *at Pass 3*: bytecode-VM game. A naive recursive trace reaches only 50.6% of the PRG because the game dispatches through three jump tables and two zero-page `jmp (zp)` calls that a static descender cannot follow: a 38-entry token-program pointer table at `$8CEF`, a 40-entry opcode handler table at `$9237`, a second 16-entry handler table at `$9F2B`, and a 3-entry per-level VRAM-writer table at `$AC35`. Resolving those took code coverage to 64.9%. Compressed-VRAM RLE decoder at `$AC82` with a 12-byte fill table at `$ACBD`; restoring division by 20 at `$82AC`; four-channel sound engine with per-channel state in zero page `$C4-$EF`. See `MUSCLE (U)/OVERVIEW.md`.
- **CIRCUS** — *at Pass 2/3*: full recursive disassembly complete. NMI-driven frame state machine (main loop is a spin loop at $C057). Menu text at $C763 ("CONTINUE", "STAGE", "SELECT", "PLAY"). Object state machine at $DC3F–$FE7B. Audio sequence data at $FABB–$FFFB. See `CIRCUS/OVERVIEW.md`.
- **Joypad Test Cartridge (U)** — *at Pass 2/3*: minimal code (~3.5%), data-heavy test cartridge. NMI handler drives per-frame PPU/OAM updates. Uses return-address modification trick at `RetAddrUpdate` ($CDC8) with `VramPtrWrite` ($CD3F) for runtime-computed dispatch. See `Joypad Test Cartridge (U)/OVERVIEW.md`.
- **Wild Gunman (U)** — *at Pass 2/3*: NMI-driven frame loop with sprite/OAM table at $C844. See `Wild Gunman (U)/OVERVIEW.md`.
@@ -259,26 +260,24 @@ make verify # (where supported by the Makefile)
## Summary
All 14 projects in this repository rebuild **byte-identical** to their original ROMs:
| # | Project | Build Status |
|---|---------|--------------|
| 1 | Balloon Fight (JU) | BYTE-IDENTICAL |
| 2 | Baseball (UE) | BYTE-IDENTICAL |
| 3 | Bomberman (U) | BYTE-IDENTICAL |
| 4 | Burger Time (U) | BYTE-IDENTICAL |
| 5 | Clu Clu Land (JU) | BYTE-IDENTICAL |
| 6 | Defender 2 (U) | BYTE-IDENTICAL |
| 7 | Excitebike (JU) | BYTE-IDENTICAL |
| 8 | Tennis (JU) | BYTE-IDENTICAL |
| 9 | Pac-Man (USA) (Namco) | BYTE-IDENTICAL |
| 10 | Donkey Kong 3 (JUE) | BYTE-IDENTICAL |
| 11 | Donkey Kong Jr. (JU) | BYTE-IDENTICAL (Pass 2/3) |
| 12 | CIRCUS | BYTE-IDENTICAL (Pass 2/3) |
| 13 | Wild Gunman (U) | BYTE-IDENTICAL (Pass 2/3) |
| 14 | Joypad Test Cartridge (U) | BYTE-IDENTICAL (Pass 2/3) |
| 15 | NES PowerPad Test Card (U) | BYTE-IDENTICAL (Pass 2/3) |
All 15 projects in this repository rebuild **byte-identical** to their original ROMs:
The 20 `_wip/` skeleton projects above also all rebuild byte-identical (PRG level); all Pass 1 work and promotion to this index's numbered inventory is future work.
| # | Project | Build Status | Pass 3 |
|---|---------|--------------|--------|
| 1 | Balloon Fight (JU) | BYTE-IDENTICAL | in progress |
| 2 | Baseball (UE) | BYTE-IDENTICAL | complete |
| 3 | Bomberman (U) | BYTE-IDENTICAL | complete |
| 4 | Burger Time (U) | BYTE-IDENTICAL | complete |
| 5 | Clu Clu Land (JU) | BYTE-IDENTICAL | complete |
| 6 | Defender 2 (U) | BYTE-IDENTICAL | complete |
| 7 | Excitebike (JU) | BYTE-IDENTICAL | complete |
| 8 | Tennis (JU) | BYTE-IDENTICAL | complete |
| 9 | Pac-Man (USA) (Namco) | BYTE-IDENTICAL | complete |
| 10 | Donkey Kong 3 (JUE) | BYTE-IDENTICAL | complete |
| 11 | Donkey Kong Jr. (JU) | BYTE-IDENTICAL | pending |
| 12 | CIRCUS | BYTE-IDENTICAL | complete |
| 13 | Wild Gunman (U) | BYTE-IDENTICAL | pending |
| 14 | Joypad Test Cartridge (U) | BYTE-IDENTICAL | pending |
| 15 | NES PowerPad Test Card (U) | BYTE-IDENTICAL | pending |
The 20 `_wip/` skeleton projects above also all rebuild byte-identical (PRG level); all Pass 1 work and promotion to this index's numbered inventory is future work.