tmerrittandClaude Opus 4.8
49e117bfcc
- Apply symbols.inc hardware register names to Defender 2 (U) (51 operands)
- Apply symbols.inc hardware register names to Donkey Kong 3 (JUE) (36 operands)
- Add APU register symbols (-) to Defender 2 (U) and Donkey Kong 3 (JUE) symbols.inc
- Apply symbols to Donkey Kong Jr. Math (U) (80 operands: 11 single + 69 hardware)
- Apply symbols to Excitebike (JU) (786 operands: 785 single + 1 hardware)
- Add promotion criteria to PROMPTS.md: symbol/local substitution,
ROM-specific semantic naming, and verification checklist
Add branch/jump target naming requirement to PROMPTS.md
All branches and jumps must target symbolic labels with descriptive names
derived from program flow role (e.g., _Loop, _Next, _Done, _Store, _Return),
never raw address literals. Adds criterion 8 to verification checklist.
Rename all OVERVIEW.md to README.md; add root README content to top-level
- Rename all OVERVIEW.md files to README.md throughout the repo (47 files)
- Prepend README.md content to top-level OVERVIEW.md before rename
- Fix apply_symbols.py NAME_RE regex to handle spaced assignments
- Apply symbols.inc to Defender 2 (U) (51 hardware operands)
- Apply symbols.inc to Donkey Kong 3 (JUE) (36 hardware operands)
- Apply symbols.inc to Donkey Kong Jr. Math (U) (80 operands: 11 single + 69 hardware)
- Apply symbols.inc to Excitebike (JU) (786 operands: 785 single + 1 hardware)
- Add missing Zp18/FrameCounter aliases to Excitebike prg.s
- Build all 27 top-level projects: byte-identical
Promote Donkey Kong Jr. Math back to _wip tier
Moves code from `copilot` folder and verifies each builds after
Add pre-commit hook for byte-identical verification
Add .git/hooks/pre-commit that runs 'make' then 'make clean' in each
project directory before committing. This ensures every project builds
byte-identical before any commit is accepted.
Also includes all file moves from the Donkey Kong Jr. Math (U) demotion
and other file restructuring from the session.
moves code out of copilot folder, its all AI generated.
Moves NROM games into NROM folder
removes copilot folder from Lunar Pool
Adds makefile to build all projects recursively
Updates docs to reflect changes in layout
Repromotes Donkey Kong Jr Math
Repromotes Excitebike
Promotes Popeye (JU) (PRG 1)
Updates Makefile to provide summary of build failure/success
Promote Raid on Bungeling Bay (U): Pass 2/3 partial, whole-ROM byte-identical
Move _wip/NROM/Raid on Bungeling Bay (U) to NROM/ and switch the build
from a PRG-only compare to a whole-ROM one:
- header.s/chr.s added (one-line .incbin of header.bin / chr.bin)
- linker.cfg gains HEADER ($0000, $0010) and CHR ($0000, $2000)
areas ahead of PRG ($C000, $4000)
- rom.nes symlink to the space-containing original ROM name
- Makefile builds header.o/prg.o/chr.o into reconstructed.nes and
compares it against rom.nes ('Byte-identical ROM verified.')
- one leftover neutral indirect operand jmp (Zp01) at $E2EC becomes
jmp (IndDispatch01); apply_symbols.py reports 0 substitutions pending
README.md / TODO.md / AGENTS.md updated: 29 promoted, 7 in _wip/.
Pac-Man (U): Pass 2 complete (label renaming) + Pass 3 partial (ZP aliases, table names)
Pass 2 — fresh map derived from the committed split, not from any drafted
map (the drafted maps in other projects were audited and found not
applicable):
- all 194 address-derived Label_XXXX definitions renamed to semantic
routine-entry names plus <Routine>_<Role>_<addr> internal branch
targets; zero Label_ remains
- all 49 jsr/jmp call sites resolved from raw $XXXX to labels; zero
raw $XXXX call operands remain
- routinemap.tsv / derived_names.tsv record the derivation
Pass 3 (partial):
- 15 proven semantic zero-page aliases added to locals.inc
(GameState, NmiFlag, ScrollX/Y, PpuCtrlShadow, OamDmaPage,
CocktailModeFlag, ActivePlayerFlag, GameplaySuspended, FrameCounter,
StateTimer, Player1/2Input, ActiveInput, CopyrightVerified)
- 112 operands substituted into prg.s (11 single + 101 hardware)
- key data tables named: ProgrammerSig ($C0EB), GameStateDispatchTable
($C253), TitleScreenData ($C2FD), EntityPtrTable ($D912),
AudioCommandTable ($EFDD)
Also corrects the README's claim that the RESET vector points at padding:
$FF00 holds real boot code (sei/cld, PPU off, double vblank wait, then
jmp ColdStart at $C042).
.gitignore: ignore reconstructed_prg.bin (build artifact of the _wip
Makefiles; '**/reconstructed.*' does not match the underscore form).
Promote Pac-Man (U): Pass 2/3 complete, whole-ROM byte-identical
Move _wip/NROM/Pac-Man (U) to NROM/ and switch the build from a PRG-only
compare to a whole-ROM one:
- header.s/chr.s added (one-line .incbin of header.bin / chr.bin)
- linker.cfg gains HEADER ($0000, $0010) and CHR ($0000, $2000)
areas ahead of PRG ($C000, $4000)
- rom.nes symlink to 'Pac-Man (U) [!].nes' (the original ROM name
contains a space and brackets)
- Makefile builds header.o/prg.o/chr.o into reconstructed.nes and
compares it against rom.nes
- reconstructed.nes is 24,592 bytes, MD5 a69d310f8cae9397fbd39f204672b5c7
- equal to the original ROM; the header/prg/chr splits were checked
against the original before promotion and are byte-exact
Pass 3 residue closed. The last 7 multi-alias zero-page operands are
resolved per site through a new sites.tsv, each proven from context
rather than guessed:
- jmp ($0010) at $C250/$D3CA/$D90F/$D9B6 -> (DispatchPtrLo); each
is immediately preceded by sta DispatchPtrLo/sta DispatchPtrHi
- jmp ($00FE) at $EFDA -> (AudioHandlerPtrLo); preceded by
sta AudioHandlerPtrLo/sta AudioHandlerPtrHi
- sta a:$0000,y at $C048/$C089 -> a:Zp00,y; the literal zero-page
base in the two ZP clear loops, so the neutral name is used rather
than the semantic WorkPtrLo. The 'a:' prefix survives the
substitution, so the bytes stay 99 00 00 (sta abs,Y)
apply_symbols.py now reports 119 operands substituted (101 hardware,
11 single-name, 7 site) and 0 residue.
New tool _tools/align_audit_comments.py: re-aligns the audit comment to
column 35 after a substitution lengthens an operand (nesdis.py pads each
instruction to 31 characters). Whitespace-only, so the byte identity
cannot change. 405 lines re-aligned in this project; all 2,387 audit
comments still match prg.bin at the stated PRG offset, 0 mismatches.
Docs: root README.md / TODO.md / AGENTS.md updated - 30 promoted, 6 in
_wip/; a per-project detail entry for Pac-Man (U) added; the stale
'Donkey Kong 3 (JUE) has no README.md' claim corrected (it has a
318-line one).
Promote Raid on Bungeling Bay (U) [a2]: Pass 3 complete, whole-ROM byte-identical
Move _wip/NROM/Raid on Bungeling Bay (U) [a2] to NROM/ and switch the build
from a PRG-only compare to a whole-ROM one:
- header.s/chr.s added (one-line .incbin of header.bin / chr.bin)
- linker.cfg gains HEADER ($0000, $0010) and CHR ($0000, $2000)
areas ahead of PRG ($C000, $4000)
- rom.nes symlink to 'Raid on Bungeling Bay (U) [a2].nes' (the original
ROM name contains spaces and brackets)
- reconstructed.nes is 24,592 bytes, MD5 659d340a1e9d420eee28df13319b0094
- equal to the original ROM; the header/prg/chr splits were checked
against the original before promotion and are byte-exact
Pass 3 - 15 semantic zero-page aliases, each applied only at the sites
where its role is proven:
- PpuCtrlShadow ($C2), 15 sites: the reset entry primes it right after
'sta PPUCTRL', and every other use is an ora/and/eor followed by
'sta PPUCTRL'
- NmiPathSelector ($C4), 5 sites: written 1 at $C3E9 and 0 at $C962
- GameState ($D6), 6 sites: 'cmp #$02' and used as an index at $C4C7
- FrameSubCounter ($55), 6 sites: set to $0A at $C520, decremented per
NMI at $C07B
- PrngPeriodCounter ($EA) / PrngSeedB ($EB) / PrngState ($EC), 13 sites:
the PRNG state
- PtrLo ($00) / PtrHi ($01), 8 sites: the 16-bit pair $1C13 and $1610
compared at $E785/$E791
- IndDispatch01 ($01) / IndDispatch02 ($02), 3 sites: the computed
dispatch at $E2EC
- IndDispatch1B ($1B) / IndDispatch1C ($1C), 6 sites: the dispatch at
$E7A3
- IndDispatch17 ($17) / IndDispatch19 ($19): the dispatches at $E79D
and $E7A0
Addresses that carry two names keep the neutral ZpXX name where the other
role applies - $01 is PtrHi at the 16-bit compare and IndDispatch01 at the
dispatch; $17 is IndDispatch17 at the dispatch and Zp17 for the absolute
RAM $0017 store in the copy loop at $E895/$E8D0.
New tool _tools/apply_zp_aliases.py does the per-site substitution:
apply_symbols.py only rewrites *numeric* operands, so it cannot rename an
operand that is already written as a neutral ZpXX name. The tool keeps the
ca65 'a:' prefix (dropping it would turn 'sta a:Zp17,y' into a zero-page
store and change the bytes) and rewrites only the operand token, so the
audit comment survives byte for byte.
Naming correction in the promoted sibling. Finishing this dump showed that
$EA was misnamed 'VBlankWaitCounter': the routine at $C412 is the game's
pseudo-random generator (the classic eor/asl/php/lsr/plp/rol scrambler,
called from thirteen gameplay sites, twice in a row at $CDF4/$CDF9 with the
second result masked #$07), so $EA is the scrambler's phase counter.
Renamed PrngPeriodCounter in both dumps and named $EB/$EC PrngSeedB /
PrngState. The sibling's two 'sta a:IndDispatch17,y' operands were also
wrong - they are absolute stores to RAM $0017, not the dispatch pointer -
and are now 'a:Zp17,y', matching the file's 'a:' = absolute convention.
Audit-comment alignment re-done with _tools/align_audit_comments.py (1,040
lines here, 1,080 in the sibling). Both files still match prg.bin at every
stated PRG offset: 5,467 and 5,483 audit comments, 0 mismatches.
Docs: root README.md / TODO.md / AGENTS.md updated - 31 promoted, 5 in
_wip/; per-project detail entries added for both Raid dumps.
Promote Pac-Man (Tengen) (U): Pass 2/3 from scratch, whole-ROM byte-identical
Move _wip/NROM/Pac-Man (Tengen) (U) to NROM/ and switch the build from a
PRG-only compare to a whole-ROM one:
- header.s/chr.s added (one-line .incbin of header.bin / chr.bin)
- linker.cfg gains HEADER ($0000, $0010) and CHR ($0000, $2000)
areas ahead of PRG ($C000, $4000)
- rom.nes symlink to 'Pac-Man (Tengen) (U) [!].nes'
- reconstructed.nes is 24,592 bytes, MD5 d34e7a74d8d2c231b6cc601210e28ad0
- equal to the original ROM; the header/prg/chr splits were checked
against the original before promotion and are byte-exact
Disassembled from scratch. No name, map or file was carried over from the
sibling 'Pac-Man (U)' dump; the map was derived from this dump's own
committed split and the two were only compared afterwards.
Pass 2 (new tool _tools/apply_pass2_map.py):
- all 194 Label_XXXX definitions renamed to semantic routine entries plus
<Routine>_<Role> branch targets; zero Label_ remains
- all 48 raw $XXXX jsr/jmp operands resolved to labels; zero raw $XXXX
call or branch operands remain
- the map is in routinemap.tsv
Pass 3:
- 30 semantic zero-page aliases, each applied only at the sites where its
role is proven (per-site choice in sites.tsv; the addresses that carry
two roles keep the neutral ZpXX name elsewhere). _tools/
derive_zp_aliases.py records how the set was derived, and locals.inc
records the reason for every remaining neutral slot
- 28 data tables named (new tool _tools/name_data_region.py), including
CharacterDataTable ($C66A) and CharacterNameStrings ($C67E), where the
ROM itself names Blinky, Pinky, Inky and Clyde - which is why the four
indexed entities are called ghosts and not 'actors'
- apply_symbols.py reports 0 substitutions pending and 0 residue
- audit-comment alignment re-done with _tools/align_audit_comments.py;
all 2,479 audit comments still match prg.bin at the stated PRG offset
Pass 1 correction - six command handlers recovered (new tool
_tools/recode_region.py). ScriptCommandTable ($EFDD) is read by the traced
instruction at $EFCC, and six of its entries point at $F00A, $F022, $F03A,
$F052, $F062 and $F072 - all of which the tracer had left as data, and two
of which it had mis-split across the 'jmp $EF61' at $F01F and $F04F.
Those 120 bytes are code here, decoded straight from the ROM; the six
handlers tile $F00A-$F081 exactly. The same gap exists in the promoted
'Pac-Man (U)' dump, which has not been corrected - recorded in both READMEs.
Residue (documented, not guessed): the unreached main game logic at
$C45A-$C55F is still .byte data. It is code - the tracer's own decoder
walks it cleanly and the dispatch table at $C511 points into it - but
nothing reaches it, so it cannot be entered without a guess. The same gap
exists in the promoted 'Pac-Man (U)' dump. Re-deriving it is a Pass 1 job;
a Mesen Code Data Logger capture is the tool the repo uses for it.
Docs: root README.md / TODO.md / AGENTS.md updated - 32 promoted, 4 in
_wip/; a per-project detail entry added for the Tengen dump.
Promote Pyramid (U): Pass 1 corrected, Pass 2/3 complete, whole-ROM byte-identical
Move _wip/NROM/Pyramid (U) to NROM/ and switch the build from a PRG-only
compare to a whole-ROM one:
- header.s/chr.s added (one-line .incbin of header.bin / chr.bin)
- linker.cfg gains HEADER ($0000, $0010) and CHR ($0000, $2000)
areas ahead of PRG ($C000, $4000)
- rom.nes symlink to 'Pyramid (U) (Sachen).nes'
- reconstructed.nes is 24,592 bytes, MD5 aa285ff17f25dd05da5996b7466c59e2
- equal to the original ROM; the header/prg/chr splits were checked
against the original before promotion and are byte-exact
Pass 1 correction - the committed split was a strict subset of the correct
one. This game dispatches through 'jmp' trampoline tables that live
*inside* the data regions, and the tracer cannot follow a jmp there, so
828 bytes of code were still marked as data. Four such tables were found
($C01E 3 entries, $C02A 6, $C042 2, $C054 5) plus ten more entries at
$C000-$C01B; all sixteen targets decode as valid instructions. Seeding
them, the $C800 boot mainline and six further code starts recovers the
whole lot, plus a five-byte stub at $DF89 (lda $33 / jmp $DECB) that sat
in a hole between two routines. The re-trace loses NO committed code byte
and takes the split from 34.5% to 39.6% (3,130 instructions / 6,493 code
bytes). 'make regen' reproduces it, so the split stays verifiable.
Pass 2 - a fresh map derived from this dump's own committed split:
- 428 Label_XXXX definitions renamed; zero Label_ residue
- 320 raw $XXXX jsr/jmp operands resolved; zero raw $XXXX branch
operands remain
- 431 routine entries and the 32 data blocks named from the code
- the internal branch-target names are derived mechanically from the
branch that reaches them by the new _tools/derive_branch_names.py
(beq -> OnZero, bne -> OnNonzero, bcc/bcs -> the carry cases, a
backwards branch -> Loop)
- recorded in routinemap.tsv
Pass 3:
- 24 semantic zero-page aliases, each applied only where its role is
proven; the 57 slots that stay neutral are each listed with the reason
in locals.inc (the neutral set lives in zp_aliases.inc so that
'make regen' can rebuild locals.inc from prg.bin)
- 32 data tables named - TaskVectorTable1/2, LevelScriptData,
MusicPeriodTable, SoundEnvelopeTable, the actor tables - recorded in
data_region_names.tsv
- apply_symbols.py reports 0 substitutions pending and 0 residue; no
hardware register is left as a raw literal
- the audit comments are now canonical on every line, data included
(the old file carried only 'PRG:$xxxx' on its 1,358 data lines);
all 3,762 audit comments match prg.bin at their stated PRG offset
Kept as-is, not 'cleaned up':
- sta $4100 stays a raw operand. The iNES header claims mapper 0 but
the boot code writes past the NES register space; the ROM does not
explain it, so it is recorded rather than guessed
- the 'A'/'V' check on RAM $0120/$0121 and its seed/clear routines
are named for what they do, not for what they are for
- the ninth entry of the $C3A6 task vector table ($D820) is a junk
slot and stays data
Docs: root README.md / TODO.md / AGENTS.md updated - 33 promoted, 3 in
_wip/; a per-project detail entry added.
Hogan's Alley (JU): Pass 1 correction, Pass 2, Pass 3, promoted to NROM/
The light-gun game whose engine dispatches through *inline* tables:
`IndirectCall` at $C34D pops the return address of the `jsr` that called
it and reads a 16-bit handler pointer from the word that follows, so all
six handler tables ($C124 19 entries, $C219 4, $C89C 14, $CDD1 1, $D234 2,
$D3D6 14) live inside the code stream and the static tracer cannot follow
them.
Pass 1 correction. The committed split was a strict subset of the correct
one -- 41.8% of the PRG was classified as code. A fresh Mesen Code Data
Logger capture was merged with the four captures already in the folder
(hogans_merged.cdl, the OR of five per-byte flag arrays, 6,544 code bytes)
and _tools/cdl_reclass.py rewrote the split to match what the CPU actually
fetched: 1,216 bytes moved from data to code, five the other way, 59 labels
emitted. The split is now 49.1% code (3,950 instructions, 8,041 bytes).
The four branch targets the reclassifier could not prove were turned into
labels by the new _tools/resolve_raw_branches.py.
Pass 2. 206 routine entries hand-named from this dump's own code and 413
internal branch targets derived mechanically by _tools/derive_branch_names.py:
630 Label_XXXX definitions gone, 484 raw $XXXX call operands resolved, 15
call targets the tracer had never labelled given a label. Recorded in
routinemap.tsv. No SubC<addr> residue was needed -- every entry the engine
reaches is named after what it does.
Pass 3. 60 semantic zero-page aliases, each applied only where its role is
proven (zp_aliases.inc, zp_alias_sites.tsv); the slots that stay neutral are
each listed with the reason. All 34 data blocks named
(data_region_names.tsv). apply_symbols.py reports 1 residue: `sta a:$00B4,y`
at $C203, the same address as Zp40/ActorPalette but forced to absolute
addressing, so it must stay numeric.
Promotion. header.s, chr.s and a HEADER/PRG/CHR linker.cfg added, rom.nes
symlinked to the original ROM; the whole-ROM cmp passes on the first
promoted build. There is deliberately no `make regen` target: the Pass 1
split here is the static trace corrected by a CDL capture, and the base the
correction was applied to is not what the current _tools/nesdis.py
produces, so prg.s is the maintained source of truth.
Tools changed:
nesdis.py --split/--note/--provenance options, so a data
region can carry its own name and explanation;
a forced-data address is no longer reported as a
recovered routine entry
apply_pass2_map.py can create the label for a call target the tracer
left unlabelled; no longer double-labels it
apply_zp_aliases.py --at-file, an address-based per-site list
derive_branch_names.py keeps the map's own header instead of writing a
fixed one
resolve_raw_branches.py new: turns `bXX *+$NN` operands into labels
build_hogans_map.py new: the hand-written Pass 2 map builder
The existing regen pipelines (MUSCLE (U), Urban Champion (JU)) still
reproduce prg.s byte for byte.
Apply the symbols.inc register names at Pass 1; fix a dropped byte in cdl_reclass
nesdis.py now names the hardware registers as it renders the operands, so a
project's Pass 1 output already reads `lda PPUSTATUS` instead of `lda $2002`
and the Pass 3 apply_symbols.py step has nothing left to do for them.
* nesdis.py --symbols FILE reads a symbols.inc-style file and substitutes
the register names. Only unambiguous entries in the $2000-$4017 window
are used: $4017 is both JOY2 and APUFRAMECOUNTER, so it stays numeric
and apply_symbols.py reports it as multi-alias residue, exactly as
before. The default is the symbols.inc next to --out, so a new project
gets the names without asking; --no-symbols opts out.
* The renderer records the operand's numeric value on the Insn, because
operand_value() used to re-parse the operand text and could no longer
read a name.
* The controller bit masks in symbols.inc (PAD_A and friends) are
constants, not addresses, and are still never substituted.
MUSCLE (U) and Urban Champion (JU) keep --no-symbols: their committed
prg.s was produced with the registers named by the Pass 3 apply_symbols.py
step, and the columns in those files reflect the in-place substitution.
Adding the missing apply_symbols.py step to both regen pipelines makes
them reproduce their committed prg.s byte for byte again - neither did
before this change (MUSCLE was 440 lines out, Urban Champion 772).
cdl_reclass.py had a bug that cost a byte: a region whose last source row
straddled the region's end was replaced by a regeneration of the region
only, so the tail of that row was dropped. Mario Bros (JU) hit it at
$C595, where the rebuild came out one byte short and every label after it
shifted. A region now covers the whole rows it replaces.
pass2.py reflow takes an optional column argument; the default is
unchanged (the ';' lands on the same column as before).
Mario Bros (JU): Pass 1 correction, Pass 2, Pass 3, promoted to NROM/
A two-player platformer whose handler tables are *inline*: the pointers sit
in the middle of the code stream, right after the `jsr` that reads them, so
the static tracer could never follow them.
Pass 1 correction. The committed split was a strict subset of the correct
one -- only 72.0% of the PRG was classified as code. A Mesen Code Data
Logger capture of this ROM (mario_mesen.cdl, 10,915 code bytes) showed
1,010 bytes the tracer had left as data were code; two branch targets the
capture never reached ($E4CB and $E639) were forced with --override for 57
more, so 1,067 bytes moved from data to code and 22 moved the other way.
The split is now 78.4% code (6,210 instructions, 12,847 bytes). The three
branch targets the reclassifier could not prove were turned into labels by
_resolve_raw_branches.py, which now refuses to put a label on a `.byte` row.
Pass 2. 206 routine entries and 519 internal branch targets: 931
Label_XXXX definitions gone, 51 raw $XXXX call operands resolved and 12 call
targets the tracer had never labelled given a label. Zero SubC residue --
the 185 entries a previous session had left as address-derived residue were
all named from this dump's own code. Recorded in routinemap.tsv.
Pass 3. 25 semantic zero-page aliases, each applied only where its role is
proven (zp_aliases.inc); the slots that stay neutral are each listed with the
reason. 35 data tables named -- GameStateHandlerTable, EnemyBehaviourTable,
EnemyScriptTable, EnemyTypePointerTable, SoundRoutineTable,
NoteFrequencyTable and the rest -- and recorded in
data_region_names.tsv. apply_symbols.py reports 0 residue.
Promotion. header.s, chr.s and a HEADER/PRG/CHR linker.cfg added, rom.nes
symlinked to the original ROM; the whole-ROM cmp passes on the first
promoted build. There is deliberately no `make regen` target: the Pass 1
split here is the static trace corrected by a CDL capture, and the base the
correction was applied to is not what the current _tools/nesdis.py
produces, so prg.s is the maintained source of truth.
Tools:
apply_pass2_map.py renames a label of any spelling -- SubC<addr> is
the honest residue form -- and its references
follow it; one combined pattern, so a 16,000-line
file does not need a substitution per label
resolve_raw_branches.py refuses to label a data row
build_mario_map.py new: the hand-written Pass 2 map builder
Remove the old _wip/NROM/Mario Bros (JU) folder (promoted to NROM/)
Mario Bros (JU): add the promoted-tier header, CHR, rom.nes symlink and zero-page aliases
Moves _ROMS/<ROM> into _wip/<MAPPER>/<ROM>
Sync the docs and the skeleton tool with the 857-project _wip tier
The _wip/ tier now holds 857 projects across 30 mapper folders, all
building byte-identical for the whole ROM. README.md, TODO.md and
AGENTS.md still described the old 39-project tier, so bring them in line
with WIP.md, which carries the tier's index.
The tier is no longer 39 projects of NROM-256 with a 16/32 KB PRG:
only two projects have a 16 KB PRG, 151 have 32 KB, 523 have 128 KB and
one has 1.5 MB, so most of it is a banked mapper whose image does not fit
the 6502's address space. Those projects link their MEMORY areas at .nes
file offsets rather than CPU addresses, which is the only option and the
honest model; the 39 older projects keep the CPU-address layout because
their PRG really is one contiguous window.
make_skeleton.py gains the two layouts (--layout flat|cpu), the board
name for the mapper, and a fix for find_rom() mistaking the build
output reconstructed.nes for the source ROM.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
NES PowerPad Test Card (U) — Game Flow from Power-On
This document describes the execution flow of the disassembled NES PowerPad Test Card (U) PRG bank (16 KB, mapped at CPU $C000–$FFFF), starting from power-on. It is based entirely on copilot/prg.s in the repository. The rebuild is verified byte-identical to the original prg.bin.
1. ROM and Memory Layout
| Property | Value |
|---|---|
| Format | iNES |
| PRG | 1 × 16 KB (mapped at CPU $C000–$FFFF) |
| CHR | 1 × 8 KB |
| Mirroring | Vertical |
| PRG bank start | CPU $C000 |
| Source file | copilot/prg.s (~1,650 lines with headers) |
| Output | reconstructed.nes (whole ROM: 16-byte header + 16,384-byte PRG + 8,192-byte CHR) |
Interrupt vectors (CPU $FFFA–$FFFF)
| Vector | Address | Handler |
|---|---|---|
| NMI | $E06E | NmiHandler |
| RESET | $E000 | Reset |
| IRQ / BRK | $E000 | Reuses Reset |
2. Build Status
make in copilot/ assembles prg.s with ca65, links with ld65, and verifies against prg.bin.
Verification result: BYTE-IDENTICAL — reconstructed.nes matches rom.nes exactly (header + PRG + CHR).
3. Pass Status
| Pass | Status | Description |
|---|---|---|
| Pass 1 | Complete | Code/data split — entire PRG bank classified as traced code (~7.2%) or explicit .byte data (~92.8%) with ; CPU:$xxxx PRG:$xxxx annotations |
| Pass 2 | Complete | Routine headers added for all labeled positions; key routines semantically named (Reset, NmiHandler, VramWrite, ReadPad, ProcessPads, etc.); zero-page aliases in locals.inc |
| Pass 3 | Complete | All data tables named: VramWriteSourcePointerTable ($F000, 9 streams), Player1TileTable/Player2TileTable ($E4B4/$E4C0), PaletteData ($E121), and all nine VramWrite payload streams (PowerPadSideAButtonGraphics, PanelFrameTiles, StatusMessageText, SideATestPromptText, …). Screen text decoded from CHR. Remaining 46 Label_Exxxx are internal loop/branch targets. |
4. Reset — CPU $FFFC → $E000
Reset ($E000)
On power-on or reset:
- Calls a chain of initialization subroutines in sequence:
ResetInit($E09B): sei/cld, disable PPU rendering, wait for two vblanksClearRAM($E0C9): clear 8 pages of zero-page RAMClearVRAM($E0EB): clear nametable memoryLoadPalette($E107): load 32 bytes of palette data into PPU palette RAMClearVRAM_Fill23($E142): fill VRAM with $23 (blank tile attribute)InitAPU($E16B): initialize APU pulse/triangle channelsClearVRAM_FillFF($E187): fill VRAM with $FF- Five
LoadPatternTableroutines ($E19A–$E1CB): load pattern tables from $F000 region SetPPUCTRL_NMI($E219): enable NMI bit in PPUCTRL
- Main loop (
Label_E058at $E058): callsClearScreen($E4FA),WaitForVBlank($E092), checks$07(frame counter high nibble), loops back to $E000 if zero, otherwise callsResetScroll($E22D) and jumps back to $E058.
Key point: The main loop is driven by vblank waits and frame counter checks. All per-frame work (controller reading, pad processing, screen drawing) happens inside the NMI handler.
5. NMI / Frame Heartbeat — NmiHandler ($E06E)
The NMI fires once per frame:
- Save registers (
PHA / TXA / PHA / TYA / PHA). - Calls
DisableNMI($E1FB) — clears NMI bit in PPUCTRL shadow. - Increments
Zp03(frame counter). - Reads
PPUSTATUS($2002), stores toZp02(vblank flag). - Calls
ReadPad($E338) — reads controller pad data. - Calls
ShiftPads($E362) — shifts pad data into state variables. - Calls
ProcessPads($E398) — processes pad transitions, updates scores. - Calls
DrawScore($E3E1) — draws score digits. - Calls
DrawLives($E407) — draws lives indicators. - Restore registers (
PLA / TAX / PLA / TAY / PLA / RTI).
6. Key Subroutines
| Label | Address | Description |
|---|---|---|
Reset |
$E000 | Cold-start initialization and main loop entry |
NmiHandler |
$E06E | Per-frame NMI: pad read, process, score/lives draw |
WaitForVBlank |
$E092 | Waits for vblank flag, clears it |
ResetInit |
$E09B | Cold-start hardware init (PPU, APU, vblank waits) |
ClearRAM |
$E0C9 | Clears 8 pages of zero-page RAM |
ClearVRAM |
$E0EB | Clears nametable memory with zeros |
LoadPalette |
$E107 | Loads 32-byte palette into PPU palette RAM |
ClearVRAM_Fill23 |
$E142 | Fills VRAM with blank tile value $23 |
InitAPU |
$E16B | Initializes APU pulse/triangle channels |
ClearVRAM_FillFF |
$E187 | Fills VRAM with $FF |
LoadPatternTable1–5 |
$E19A–$E1CB | Load pattern tables from $F000 region |
VramWrite |
$E1CC | Generic VRAM write via indirect pointer |
EnableNMI |
$E1F1 | Enables NMI bit in PPUCTRL shadow |
DisableNMI |
$E1FB | Disables NMI bit in PPUCTRL shadow |
SetPPUCTRL_NMI |
$E219 | Sets NMI bit ($80) in PPUCTRL shadow |
ResetScroll |
$E22D | Resets PPU scroll X/Y to zero |
InitRoundParams |
$E236 | Initializes round parameters |
DrawPlayer1Pad |
$E270 | Draws player 1 pad indicators |
DrawPlayer2Pad |
$E2B0 | Draws player 2 pad indicators |
ClearRows |
$E2F0 | Clears screen rows with blank tiles |
ClearGameVars |
$E32D | Clears game variables $06–$09 |
ReadPad |
$E338 | Reads controller pad via shift register |
ShiftPads |
$E362 | Shifts pad data into state variables |
ProcessPads |
$E398 | Processes pad transitions, updates scores |
DrawScore |
$E3E1 | Draws score digits on screen |
DrawLives |
$E407 | Draws lives indicators on screen |
ShiftVar1–4 |
$E433–$E47E | Shift pad bits into score accumulators |
UpdatePads |
$E47F | Updates pad state, checks button transitions |
LoadPatternTable6–7 |
$E4A0–$E4B3 | Load additional pattern tables |
ProcessPadBits |
$E4FA | Process pad bit data for transitions |
SetAPUNoise |
$E52E | Sets APU noise channel |
ClearAPUNoise |
$E534 | Clears APU noise channel |
ClearScreen |
$E53A | Clears screen with blank tile $5F |
7. Zero-Page Aliases (locals.inc)
| Alias | Address | Role |
|---|---|---|
Zp00 |
$00 | PPUCTRL shadow register |
Zp01 |
$01 | PPUMASK shadow register |
Zp02 |
$02 | VBlank flag |
Zp03 |
$03 | Frame counter / NMI tick |
Zp05 |
$05 | Score/digit temp |
Zp06 |
$06 | Pad 1 state byte 1 |
Zp07 |
$07 | Pad 1 state byte 2 |
Zp08 |
$08 | Pad 1 state byte 3 |
Zp09 |
$09 | Pad 1 state byte 4 |
Zp0A |
$0A | Pad 2 state byte 1 |
Zp0B |
$0B | Pad 2 state byte 2 |
Zp0C |
$0C | Pad temp / swap variable |
Zp0D |
$0D | Pad mode / draw flag |
Zp0E |
$0E | Shift counter / temp |
Zp0F |
$0F | Delay counter |
Zp10 |
$10 | VRAM pointer low byte |
Zp11 |
$11 | VRAM pointer high byte |
Zp12 |
$12 | Score digit 1 accumulator |
Zp13 |
$13 | Score digit 2 accumulator |
Zp14 |
$14 | Score digit 3 accumulator |
Zp15 |
$15 | Score digit 4 accumulator |
Full list in copilot/locals.inc.
8. Data Tables
8.1 Direct tables
| Table | Address | Size | Description |
|---|---|---|---|
PaletteData |
$E121 | 32 | Palette loaded into PPU $3F00-$3F1F by LoadPalette |
Player1TileTable |
$E4B4 | 12 | PPUADDR low bytes for player 1, indexed Y=0..11 |
Player2TileTable |
$E4C0 | 12 | Same for player 2; $00 = "skip this button" |
VramWriteSourcePointerTable |
$F000 | 18 | 9 little-endian stream pointers, one per LoadPatternTable* / draw call site |
8.2 VramWrite payload streams
VramWrite ($E1CC) reads records of <addr hi> <addr lo> <count> <count bytes>, terminated by a $00 at a record boundary. All nine streams tile $E4CC-$E7C2 with no gaps and no overlaps:
| Slot | Ptr | Stream label | Address | Records | Writes to |
|---|---|---|---|---|---|
| 0 | $F000 | PowerPadSideAButtonGraphics |
$E54F | 2 | $2083, $20A3 — 52 tile graphics in pattern table 0 |
| 1 | $F002 | PowerPadButtonLabelTiles |
$E58A | 4 | $2136, $2156, $2236, $2256 — button captions |
| 2 | $F004 | PanelFrameTiles |
$E5B3 | 8 | $2124…$22C4 — panel borders for six indicator boxes |
| 3 | $F006 | SideAPressedButtonRow |
$E64C | 6 | $2184…$22A4 — side-A button caps |
| 4 | $F008 | SideAPanelButtonRow |
$E6BF | 6 | same rows, alternate layout |
| 5 | $F00A | StatusMessageText |
$E732 | 3 | $2121, $2163, $2183 — status messages |
| 6 | $F00C | Player1ButtonIconStream |
$E4CC | 2 | $2196, $21B6 |
| 7 | $F00E | Player2ButtonIconStream |
$E4E3 | 2 | $2296, $22B6 |
| 8 | $F010 | SideATestPromptText |
$E790 | 2 | $2304, $2344 — the prompt rows |
8.3 Screen text (decoded from CHR)
Font mapping read directly out of chr.bin pattern table 1: digits $30-$39 = '0'-'9', letters $3A-$52 = 'A'-'Z' (note W is absent from the A-Z run), $57 = -, $58 = /, $59 = \, $5F = space.
| Address | Text |
|---|---|
| $2121 | CONNECT POWER PAD <$5D> CONTROLLER |
| $2163 | <$60>IF POWER PAD IS CONNECTED<$62> |
| $2183 | <$61> IC MAY BE BAD <$53> <$63> |
| $2304 | PRESS A TO TEST SIDE-A |
| $2344 | PRESS B TO TEST SIDE-B |
Tiles $53-$5E are truncated glyph fragments in CHR ROM — including the W of POWER, which sits at $5E and renders incomplete. The original cartridge therefore displays partial marks at those positions; this is a ROM authoring artifact, reproduced faithfully.
9. Build
cd "NES PowerPad Test Card (U)/copilot"
make # → ca65 + ld65 + cmp reconstructed.nes rom.nes → "Byte-identical ROM verified."
10. Notes
- The 16 KiB PRG is two byte-identical 8 KiB halves.
prg[0x0000:0x2000] == prg[0x2000:0x4000]is exactly true. Both halves hold the same program, pointer table, and vector set. The vectors point at$E06E/$E000/$E000, so the CPU always enters the$E000copy; nothing references$C000-$DFFF, so the first copy is dead and is kept as classified.bytedata rather than disassembled. - Unreached gaps inside the live code region decode as valid subroutines (PPUMASK show/hide background, PPUCTRL NMI-disable, frame-counter digit tiles,
ldx #$80 / txs). Per Pass-1 policy they stay.bytedata; each is decoded in theprg.sheader comment block. - The PRG is approximately 7.2% code / 92.8% data. Most data is
$FFpadding from$E7C3-$EFFFand$F012-$FFF9. - The NMI handler drives per-frame updates; the main loop spins waiting for vblank and frame-counter changes.
- IRQ vector points to $E000 (
Reset) and is effectively unused.
11. Next Steps
- Optional: refine the
Zp05–Zp0Faliases now thatProcessPads/DrawScore/DrawLivessemantics are known (pad-state bytes vs. shift counters). - Optional:
$E4CC-$E4F9holds two near-identical icon streams differing only in two bytes; could be collapsed to a parameterized table in a future reconstruction, but the byte form is preserved as-is.