# Zanac (U)

## Status

**Pass 3 complete.** All address-derived `Label_XXXX` names have been replaced
with semantic entry-point names (133 routines) plus address-based names for
remaining branch targets (~212 `Sub_XXXX`/`Next_XXXX`/`Skip_XXXX`/`Exit_XXXX`).
All raw `$XXXX` jsr/jmp operands replaced with label references. Zero-page
aliases renamed to semantic names (14 named). Data tables named (26 tables).
The project builds and verifies byte-identical to the original ROM.

`make` assembles `header.s`, `prg.s`, `prg.07.s`, links them with `ld65` and compares the
result against `rom.nes`:

```
Byte-identical ROM verified.
```

### Pass 1 results

| Metric | Value |
|--------|-------|
| PRG size | 131072 bytes (128 KB) at file offset $0010 |
| Code | 6206 bytes (37.9% of bank 7) |
| Instructions | 2977 |
| Bank 7 routines | 391 labels traced |
| Banks as data | Banks 0-6 (switchable $8000-$BFFF) |

### Pass 2 results

| Metric | Value |
|--------|-------|
| Semantic entry-point names | 133 (Reset, NmiHandler, InputRead, ObjInitCall, ObjMoveCall, ObjDrawCall, ObjUpdateCall, SetOamPtrs, WaitVblank, GameModeDispatch, etc.) |
| Internal branch labels | ~212 (`Sub_XXXX`/`Next_XXXX`/`Skip_XXXX`/`Exit_XXXX`) |
| Raw `$XXXX` jsr/jmp operands | 0 (all replaced with label references) |
| Raw `$XXXX` branch operands | 0 (all replaced with label references) |
| Remaining `Label_XXXX` | 0 (all replaced) |

### Pass 3 results

| Metric | Value |
|--------|-------|
| Semantic zero-page aliases | 14 (Reset, NmiHandler, InputRead, ObjInitCall, ObjMoveCall, ObjDrawCall, ObjUpdateCall, SetOamPtrs, WaitVblank, GameModeDispatch, etc.) |
| Named data tables | 26 (JumpTable, IndexTable, SpriteTable, TextTable, etc.) |
| Raw `$XXXX` jsr/jmp operands | 0 |
| Raw `$XXXX` branch operands | 0 |
| Remaining `Label_XXXX` | 0 |

### Pass 1 notes

- Bank 7 (last 16 KB, fixed at CPU $C000-$FFFF) was traced from vectors:
  NMI=$CE8D, RESET=$E7BF, IRQ=$CEC4. Bank 7 code is assembled separately
  as `prg.07.s` with `.org $C000` and linked at file offset $1C010.
- Banks 0-6 (switchable at $8000-$BFFF) are emitted as raw `.byte` data;
  bank-switch analysis is needed to trace code in those banks
- Seven invalid opcode addresses found: $D506, $D876, $E15B, $E44B, $E520,
  $E909, $F0FE (likely data mis-decoded as opcodes or vice versa)

## ROM

| Property | Value |
|----------|-------|
| Format | iNES |
| Mapper | 2 |
| Board | UNROM |
| Mirroring | Horizontal |
| Four-screen VRAM | no |
| Battery | no |
| PRG | 128 KB (8 x 16 KB), at file offset $0010 |
| CHR | none |
| Trainer | none |
| Footer | none |
| NMI vector | $CE8D |
| RESET vector | $E7BF |
| IRQ vector | $CEC4 |
| ROM file | `Zanac (U).nes` |
| SHA-256 | `7e75a19b9e11715c0eb19a2017a322df02f5cf4f7b30acef0fa7a0615236bda4` |

### Header notes

- none

## Open work

- **Pass 1** - complete. Bank 7 traced (37.9% code); banks 0-6 as raw data.
  Build verifies byte-identical.
- **Pass 2** - complete. All 133 entry points have semantic names;
  ~212 internal branch labels remain as address-based names;
  All raw `$XXXX` jsr/jmp/branch operands replaced with label references.
- **Pass 3** - complete. Semantic zero-page aliases applied (14 named).
  26 data tables named (JumpTable, IndexTable, SpriteTable, TextTable, etc.).
- **Promotion** to `NROM/<name>/` once ready, as `git mv`.

## Files

| File | Purpose |
|------|---------|
| `prg.s` | Pass 3 disassembly (banks 0-6 as raw `.byte` data) |
| `prg.07.s` | Pass 3 disassembly for bank 7 (fixed at CPU $C000-$FFFF) |
| `header.s` | iNES header include |
| `prg.bin` | 131072 bytes (128 KB) PRG image |
| `rom.nes` | byte-identical copy of the original ROM |
| `linker.cfg` | HEADER / PRG / PRG7 memory areas |
| `prg.07.cfg` | Linker config for assembling prg.07.bin |
| `symbols.inc` | NES hardware register names |
| `locals.inc` | zero-page aliases (14 semantic names applied) |
| `Makefile` | build and byte-identity check |