tmerritt
71ada15de0
Pass 3 named the 10 data regions in prg.s, then the project was promoted
out of _wip/ so `make` now proves header + PRG + CHR against the original
ROM instead of only the PRG bank.
Data regions named:
LevelPtrTable $C000-$C03B (60 B) level header data
ObjectPtrTable $C03C-$C043 (8 B) 4 pointer pairs
LevelDataPtrTable $C044-$C79D (1882 B) level data pointers
SpriteInitPtrTable labelled at $C4B0 see residue note
UnreachedCode_D650 $D650-$D696 (71 B) unreached code
UnreachedCode_E144 $E144-$E165 (34 B) unreached code
MusicDataTable $F55B-$FA47 (1261 B) music/sound data
APUDataTable $FAE6-$FB74 (143 B) APU pulse/noise tables
SfxDataTable $FE59-$FFEF (407 B) sound-effect data
VectorTable $FFF6-$FFFF (10 B) padding + NMI/RESET/IRQ
Promotion (per the AGENTS.md checklist):
- git mv "_wip/Donkey Kong (JU)" "Donkey Kong (JU)"
- add copilot/rom.nes -> ../Donkey Kong (JU).nes symlink
- add header.s / chr.s (one-line .incbin of header.bin / chr.bin)
- linker.cfg gains HEADER ($0000/16 B) and CHR ($0000/8 KB)
- Makefile switched from `cmp reconstructed_prg.bin prg.bin` to
`cmp reconstructed.nes rom.nes`
- no _tools path change (this Makefile never referenced _tools/)
and no `make regen` pipeline exists for it
Doc corrections:
- project OVERVIEW.md said Mirroring Vertical; header byte 6 = $00
means Horizontal (the root index was right) — fixed
- root OVERVIEW.md: row 18 now BYTE-IDENTICAL, tier paragraph and
summary table refreshed (they had drifted around the Lunar Pool and
Urban Champion promotions), new per-project detail entry
- counts corrected to 19 top-level / 17 _wip in OVERVIEW.md,
TODO.md and AGENTS.md
Residue recorded rather than guessed:
- Pass 2 is partial: 919 Label_ definitions remain (214 semantic
labels applied); noted in TODO.md so nobody reads the promotion as
full semantic naming
- SpriteInitPtrTable's label sits at $C4B0: the routine at $C807 reads
$C4A7,x/$C4A8,x, but that table starts mid-row and a label there
would split the canonical 16-byte audit-comment line
Verification:
make clean && make -> "Byte-identical ROM verified."
verify_pass1.py -> 19/19 top-level build, Donkey Kong (JU) OK
(6014 instr / 12505 B), all comments canonical
Doc-drift sweep: build tiers, mirroring, and stale status tails
Reconciled the docs against verified reality after the Lunar Pool / Urban
Champion / Donkey Kong (JU) promotions and the 2026-10-19 audit-comment
standardization. No source behaviour changed except the two build fixes below.
Build tier (whole-ROM vs PRG-only)
- AGENTS.md: the 17 `_wip/` projects are real disassemblies at the PRG-build
tier, not "skeletons"; header.s/chr.s/rom.nes are promotion additions;
verify_pass1.py covers the top-level projects.
- Root OVERVIEW.md: `_wip` prose, audit-comment narrative and summary table
refreshed (37.5% figure, SEEDED vs OK wording, re-trace false alarm).
- Promoted projects whose build blocks still claimed `make` emits
`reconstructed_prg.bin` compared to `prg.bin` (Balloon Fight, Baseball,
CIRCUS, Clu Clu Land, Excitebike, NES PowerPad, Pac-Man (USA), Tennis):
now describe the whole-ROM `reconstructed.nes` vs `rom.nes`.
- Lunar Pool / Urban Champion / CIRCUS also had stale `cd "_wip/..."`
build paths and "Promotion" items; retargeted to their top-level folders.
Mirroring (header byte 6 bit 0: 0 = Horizontal, 1 = Vertical)
- Corrected DK Jr. prose "horizontal mirroring (flag 6 = $01)" -> vertical,
and both `_wip/Pac-Man` variant notes "Both use vertical mirroring" ->
horizontal (both are byte-6 = $00).
- Re-audited every project OVERVIEW: 0 rows and 0 prose claims now disagree.
Stale status tails
- Retitled/restatused the `_wip` OVERVIEWs to their real `prg.s` (Golf,
Ice Climber (U), Lode Runner, Millipede, Pac-Man Tengen, Pac-Man (U),
Popeye 0/1, Raid, Raid a2, Hogan's Alley, Mario Bros); Golf's
skeleton-era contents rows and Next Steps corrected.
- Dropped the skeleton-era "## Next Steps (per `PROMPTS.md`)" heading and
the "(from the skeleton)" wording across all project OVERVIEWs.
- Rewrote Lunar Pool / Urban Champion Next Steps (both already Pass 1-3
complete and promoted; their tails still described pending Pass 2 and
promotion); fixed root row 13 (Wild Gunman) and row 20 (Duck Hunt).
Also lands two code fixes carried with this sweep:
- `_wip/Hogan's Alley (JU)`: $E9F1-$E9FD and $EA13-$EA14 reclassified as
data with canonical audit comments (the seeded build had decoded a data
table base as code, breaking the build since 2ae09f7). `make` ->
BYTE-IDENTICAL again; reconstructed_prg.bin/.lbl refreshed.
- `_wip/Pyramid (U)`: `Label_D72E` -> `NMI:` (byte-identical).
Verification:
make (Hogan's Alley, Pyramid) -> BYTE-IDENTICAL, BYTE-IDENTICAL
_tools/verify_pass1.py -> 19/19 build, all canonical,
"No truncated or unfaithful Pass 1"
mirroring audit (rows + prose) -> 0 mismatches
Donkey Kong (JU): complete Pass 2 — all 919 Label_ definitions named
The last non-zero Label_ residue in the repo is now gone. Every one of the
919 address-derived definitions in copilot/prg.s is replaced:
* 319 routine entry points (jsr/jmp targets):
- 102 named from observed behaviour (LoadSpriteInitPointerToZp00 $C807,
CopyVramDataToBuffer $CBDF, CheckSpriteListCollision $D8AD,
UpdateRandomSeed $F4ED, ReadControllers $F50E, UpdateSoundEngine $FA48, ...)
- 217 left as SubC<addr> — honest residue where the body is too
context-dependent to name without guessing (Golf: 108, Mario Bros: 223)
- the 77 already-named entries untouched
* 600 internal branch targets named <Routine>_Block / <Routine>_Block_n in
address order within their owning routine (DK Jr./Balloon Fight convention).
Ownership is control-flow containment, so a loop that physically precedes
its own entry lands correctly (FlushPpuBuffer_Block $F1EC under $F228).
* Two proposal collisions disambiguated by indexing zero-page slot:
UpdateObjectListZp5D/DispatchObjectStateZp5E ($DA16/$DA4C) vs
UpdateObjectListZpAE/DispatchObjectStateZpAF ($E1E9/$E250).
jsr/jmp operands stay numeric (Wild Gunman style); only branch operands are
symbolic. Applied with _tools/pass2.py apply (919 defs + 2,622 refs rewritten,
comments re-aligned); the ROM still rebuilds byte-identically and
verify_pass1.py reports 19/19 canonical with no truncated split.
Docs synced: project OVERVIEW.md gains a Pass 2 Details section, root
OVERVIEW.md rows + conventions, TODO.md section 4 closed. dk_full_map.tsv now
records the complete applied map (its zp rows remain unapplied proposals).
_wip status correction: five false "Pass 2 complete" claims + map audit
The `_wip` tier's "Pass 2 complete" headers counted their draft maps' rows, not
the names actually present in `prg.s`, and described the count of *neutral*
`ZpXX` slots in `locals.inc` as "zero-page semantic aliases". Verified against
the sources and corrected in the root inventory rows, the project OVERVIEWs and
TODO:
project named/total Label_ left drafted map
Pinball (JU) 180 / 681 501 210 rows, 179 applied
Ice Climber (JE) 76 / 973 897 255 rows, 76 applied
Donkey Kong Jr. Math 64 / 1035 971 243 rows, 62 applied
Duck Hunt (JUE) 31 / 472 441 272 rows, 31 applied
Ice Climber (U) 2 / 973 971 none - Pass 2 not started
No `_wip` project is Pass 2 complete. Ice Climber (U) was the worst case: the
2026-10-19 sweep itself restated it "Pass 2 complete" while describing its 971
`Label_` definitions in the same paragraph - a copy-paste from (JE); (U) has no
map file at all.
Drafted maps audited row by row against the committed split: they are not
applicable. 100/243 (DK Jr. Math), 96/255 (Ice Climber (JE)) and 17/210
(Pinball) rows point at addresses that are not instruction boundaries - they
were built against an older code/data split - while most of the rest are
unlabelled boundaries that no operand references, or (Duck Hunt) competing
candidate names for one label (`Label_C2BF` alone carries 205). Rows that are
both insertable and corroborated by control flow: 0 in every map. Recorded as
stale and kept for provenance; Pass 2 here needs a fresh map derived from the
committed split.
Also corrected while verifying:
- Mario Bros entry counts (docs said 252 / 90 + 165 / 477 sites / 156 neutral
slots; the file holds 262 distinct `jsr`/`jmp` targets = 39 semantic + 223
`SubC<addr>`, 478 sites, 151 slots).
- root `_wip` prose line/label ranges (4,482-17,180 lines, 192-971 `Label_`,
11,126 total) and the Ice Climber code figure (74.6% / 6,112 instr, not
74.7% / 6,113).
- TODO §4 re-scoped to the promoted tier, with the `_wip` residue table added.
Verification: `make` across all 17 `_wip` projects -> BYTE-IDENTICAL (17/17);
`_tools/verify_pass1.py` -> 19/19 build, all canonical, "No truncated or
unfaithful Pass 1 found". No source bytes changed.
Balloon Fight (JU): apply locals.inc/symbols.inc names to prg.s (Pass 3)
Substitutes symbol names for 922 numeric operands: 125 hardware registers
(symbols.inc) and 797 of 813 zero-page/RAM operands (locals.inc). The 15
multi-alias addresses were resolved per routine; 16 operands stay numeric
because $13 is used there as a plain high-byte scratch beside Temp12 and
none of its three aliases fits.
- _tools/apply_symbols.py: the substitution tool (dry run by default;
--sites supplies per-routine choices for multi-alias addresses, --report
lists the residue). Only the operand token is rewritten, so the
`; CPU:$.... PRG:.... XX XX` audit comments survive byte for byte.
- prg.s: operand tokens only. make prints "Byte-identical ROM verified."
- OVERVIEW.md (project): instruction quotes now match prg.s, new
alias-reuse table, and section 10 rewritten from the stale "497 Label_"
prose to the real naming state and the 16-site residue.
- OVERVIEW.md (root), TODO.md, AGENTS.md: status, counts, tool list.
verify_pass1.py: 19/19 OK, all audit comments canonical.
Bomberman (U): apply locals.inc/symbols.inc names to prg.s (Pass 3)
Substitutes 362 zero-page operands in copilot/prg.s with the names already
declared in copilot/locals.inc: 354 from single-name addresses and 8 from the
two multi-alias addresses, resolved per site:
$E0/$E1 IndirectPtrLo/Hi in the RAM-clear loop
(InitializeSystemAndRunMainLoop -> Main_WriteSoundDispatchIndex_C317,
which writes $00 across $0100-$07FF via (ptr),y),
SoundDelay0 (the base of the per-channel delay table, indexed by X)
in the sound engine;
No symbols.inc substitution was needed: copilot/prg.s contains no numeric
hardware operands ($2000-$4017) at all. All 362 operands were already written
with two hex digits, so no ca65 `a:` prefix was required.
make -> Byte-identical ROM verified. Operand token only; mnemonics, spacing and
the trailing `; CPU:$.... PRG:.... XX XX` audit comments are untouched.
Remaining numeric operands (758) address bytes that no .inc file names:
505 zero-page (133 addresses), 171 RAM $0100-$07FF (46 addresses) and 82
table reads in $8000+ (54 addresses).
Bomberman (U): substitute 24 in-file table labels at ROM operand sites
Uses the new `--labels` option of `apply_symbols.py` with the
ld65 `-Ln` output (`reconstructed.lbl`). Only labels that prg.s
actually defines and that live in the PRG (+) are considered,
so CHR/header segment labels cannot leak in.
24 numeric operands (`lda ,x`, `adc ,y`, etc.) now read
`lda SystemPaletteData,x`, `adc GameplayObjectClassTable,y`, etc.
All 24 point at exact label addresses; the remaining 58 ROM-space
numeric operands point at interior bytes or unlabelled tables and
stay numeric.
make -> Byte-identical ROM verified.
Bomberman (U): update docs for Pass 3 symbol application
- Project OVERVIEW.md: corrected source file from main.s to prg.s/header.s/chr.s;
output name from reconstructed_bomberman.nes to reconstructed.nes;
rewritten §10 Zero-Page/RAM Symbols table to match locals.inc (with aliases
and unnamed residue documented);
fixed §4 step 1/4 to use IndirectPtrLo/Hi and SoundDelay0 names;
fixed §11 InesHeader location (now header.s);
added §2 Pass 3 summary table;
added §13 notes on legacy main.s and Main_WriteSoundDispatchIndex_C317 misnomer.
- Root OVERVIEW.md §3: updated source line count (7,553), file list, and added
Pass 3 summary.
Both builds verified byte-identical.
Pass 3 symbol application to all 19 top-level projects (2026-10-19)
Ran _tools/apply_symbols.py --write on all 19 promoted projects to substitute
symbolic names from symbols.inc (hardware registers) and locals.inc (zero-page
RAM aliases, forward references) into prg.s operands. The tool preserves the
canonical audit comments (; CPU:$XXXX PRG:XXXX AA BB) and preserves byte
identity — all projects still rebuild byte-identical to their original ROMs.
Per-project operand substitutions:
Baseball (UE) 121 (85 single + 36 hardware)
Tennis (JU) 18 (18 single)
Pac-Man (USA) (Namco) 524 (524 single; 727 multi-alias residues)
CIRCUS 118 (38 single + 80 hardware; 23 multi-alias residues)
Wild Gunman (U) 76 (11 single + 65 hardware)
Joypad Test Cartridge (U) 47 (47 hardware)
NES PowerPad Test Card (U) 89 (89 hardware)
MUSCLE (U) 220 (91 single + 129 hardware)
Lunar Pool (U) 45 (18 single + 27 hardware)
Donkey Kong (JU) 75 (17 single + 58 hardware)
Urban Champion (JU) 70 (4 single + 66 hardware)
Already had symbols applied: Balloon Fight, Bomberman, Burger Time,
Clu Clu Land, Defender 2, Donkey Kong 3, Donkey Kong Jr.
Skipped: Excitebike (JU) — inline prg.s definitions conflict with locals.inc
values and source operands don't match ROM byte encodings; automatic
substitution breaks byte identity.
Documentation updated:
OVERVIEW.md — added Pass 3 symbol notes to all 19 project entries,
added Urban Champion as section #36
TODO.md — current state now reflects complete symbol application across
the promoted tier
Verification: python3 _tools/verify_pass1.py reports all 19 projects OK/SEEDED,
all canonical comments, no truncated or unfaithful Pass 1.
534 lines
47 KiB
Markdown
534 lines
47 KiB
Markdown
# Disassembly Project Index — /home/tmerritt/Projects/disassembly/
|
||
|
||
This document provides a consolidated overview of all NES disassembly projects in this directory. Each project has its own folder containing a `copilot/` subdirectory with the full source, build tooling, and — for every project except `Donkey Kong 3 (JUE)`, which still needs one — an individual `OVERVIEW.md` (at the project folder root) with a detailed power-on execution flow analysis.
|
||
|
||
---
|
||
|
||
## Project Inventory
|
||
|
||
**Mirroring** is the iNES *arrangement* value taken from header byte 6, bit 0 (`0` = Horizontal, `1` = Vertical), the convention `AGENTS.md` fixes. Several per-project `OVERVIEW.md` files previously carried the opposite *mirroring-direction* wording; all were normalized to this column on 2026-10-19.
|
||
|
||
| # | Project | Region/Version | PRG Size | CHR Size | Mirroring | Build Status | Vectors (NMI / RESET / IRQ) |
|
||
|---|---------|----------------|----------|----------|-----------|--------------|------------------------------|
|
||
| 1 | Balloon Fight (JU) | Japan | 16 KB | 8 KB | Horizontal | BYTE-IDENTICAL (Pass complete) | $C094 / $C000 / $C0F7 |
|
||
| 2 | Baseball (UE) | USA/Europe | 16 KB | 8 KB | Horizontal | BYTE-IDENTICAL (Pass complete) | $C046 / $C40B / $C43E |
|
||
| 3 | Bomberman (U) | USA | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass complete) | $C01A / $C000 / $FFF9 |
|
||
| 4 | Burger Time (U) | USA | 16 KB | 8 KB | Horizontal | BYTE-IDENTICAL (Pass complete) | $FF7F / $FD24 / $FD24 |
|
||
| 5 | Clu Clu Land (JU) | Japan | 16 KB | 8 KB | Horizontal | BYTE-IDENTICAL (Pass complete) | $C1F1 / $C196 / $C196 |
|
||
| 6 | Defender 2 (U) | USA | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass complete) | $CAA1 / $C983 / $CA9E |
|
||
| 7 | Excitebike (JU) | Japan | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass complete) | $C23B / $C184 / $FFF0 |
|
||
| 8 | Tennis (JU) | Japan | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass complete) | $C07D / $C000 / $C000 |
|
||
| 9 | Pac-Man (USA) (Namco) | — | 16 KB | 8 KB | Horizontal | BYTE-IDENTICAL (Pass complete) | $C10E / $C033 / $C17E |
|
||
| 10 | Donkey Kong 3 (JUE) | Japan / USA / Europe | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass complete) | $C08D / $C000 / $C000 |
|
||
| 11 | Donkey Kong Jr. (JU) | Japan | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass complete) | $C6E6 / $C66E / $FFF0 |
|
||
| 12 | CIRCUS | — | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass complete) | $C05A / $C000 / $4CB7 |
|
||
| 13 | Wild Gunman (U) | USA | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass 3 complete, 49.3% code) | $C086 / $C000 / $C000 |
|
||
| 14 | Joypad Test Cartridge (U) | USA | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass 3 complete) | $CCF7 / $C000 / $C000 |
|
||
| 15 | NES PowerPad Test Card (U) | USA | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass complete) | $E06E / $E000 / $E000 |
|
||
| 16 | MUSCLE (U) | USA | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass complete) | $86CB / $8000 / $8764 |
|
||
| 17 | Lunar Pool (U) | USA | 16 KB | 8 KB | Vertical | BYTE-IDENTICAL (Pass 2 complete, Pass 3 tables named) | $FF65 / $E80C / $FF64 |
|
||
| 18 | Donkey Kong (JU) | Japan | 16 KB | 8 KB | Horizontal | BYTE-IDENTICAL (Pass 2/3 complete, 76.3% code) | $C85F / $C79E / $FFF0 |
|
||
| 19 | `Donkey Kong Jr. Math (U)` | USA | 16 KB | 8 KB | Vertical | **PRG-IDENTICAL (Pass 1 complete, Pass 2 partial — 64 of 1,035 labels named, 81.9% code)** | $C4A9 / $C41E / $FFF0 |
|
||
| 20 | `Duck Hunt (JUE)` | Japan / USA / Europe | 16 KB | 8 KB | Vertical | **PRG-IDENTICAL (Pass 1 complete, Pass 2 partial — 31 of 472 labels named, 37.5% code)** | $C086 / $C000 / $C000 |
|
||
| 21 | `Golf (JU)` | Japan | 16 KB | 8 KB | Vertical | PRG-IDENTICAL (Pass 1+ substantial) | $C0A6 / $C000 / $C0C4 |
|
||
| 22 | `Hogan's Alley (JU)` | Japan | 16 KB | 8 KB | Vertical | **PRG-IDENTICAL (Pass 1 complete, 41.8% code, needs CDL reclass; build fixed 2026-10-19 — `$E9F1` forced back to data)** | $C088 / $C000 / $C000 |
|
||
| 23 | `Ice Climber (JE)` | — | 16 KB | 8 KB | Horizontal | **PRG-IDENTICAL (Pass 1 complete, Pass 2 partial — 76 of 973 labels named, 74.6% code)** | $C076 / $C014 / $FFF0 |
|
||
| 24 | `Ice Climber (U)` | USA | 16 KB | 8 KB | Horizontal | **PRG-IDENTICAL (Pass 1 complete, Pass 2 not started — 2 of 973 labels named, 74.6% code)** | $C076 / $C014 / $FFF0 |
|
||
| 25 | `Lode Runner (U)` | USA | 16 KB | 8 KB | Vertical | **PRG-IDENTICAL (Pass 1 complete, 52.6% code)** | $C02C / $C000 / $FFF9 |
|
||
| 26 | `Mario Bros (JU)` | Japan | 16 KB | 8 KB | Vertical | PRG-IDENTICAL (Pass 1 complete, Pass 2 substantial) | $C07D / $C000 / $C000 |
|
||
| 27 | `Millipede (U)` | USA | 16 KB | 8 KB | Vertical | **PRG-IDENTICAL (Pass 1 complete, 74.6% code)** | $C7F1 / $C735 / $FFF0 |
|
||
| 28 | `Pac-Man (Tengen) (U)` | USA | 16 KB | 8 KB | Horizontal | **PRG-IDENTICAL (Pass 1 complete, 19.5% code)** | $C0FA / $C033 / $C16A |
|
||
| 29 | `Pac-Man (U)` | USA | 16 KB | 8 KB | Horizontal | **PRG-IDENTICAL (Pass 1 complete, 19.6% code)** | $C0FA / $FF00 / $C16A |
|
||
| 30 | `Pinball (JU)` | Japan | 16 KB | 8 KB | Horizontal | **PRG-IDENTICAL (Pass 1 complete, Pass 2 partial — 180 of 681 labels named, 59.5% code)** | $C1ED / $C000 / $C1ED |
|
||
| 31 | `Popeye (JU) (PRG 0)` | — | 16 KB | 8 KB | Vertical | **PRG-IDENTICAL (Pass 1 complete, 72.3% code)** | $C701 / $C649 / $FFF0 |
|
||
| 32 | `Popeye (JU) (PRG 1)` | — | 16 KB | 8 KB | Horizontal | **PRG-IDENTICAL (Pass 1 complete, 72.3% code)** | $C701 / $C649 / $FFF0 |
|
||
| 33 | `Pyramid (U)` | USA | 16 KB | 8 KB | Vertical | PRG-IDENTICAL (Pass 1 done) | $D72E / $FF00 / $FF00 |
|
||
| 34 | `Raid on Bungeling Bay (U)` | USA | 16 KB | 8 KB | Vertical | **PRG-IDENTICAL (Pass 1 complete, 64.6% code)** | $C04C / $C000 / $C2C0 |
|
||
| 35 | `Raid on Bungeling Bay (U) [a2]` | — | 16 KB | 8 KB | Horizontal | **PRG-IDENTICAL (Pass 1 complete, 64.3% code)** | $C04C / $C000 / $C2C0 |
|
||
| 36 | Urban Champion (JU) | Japan | 16 KB | 8 KB | Vertical | **BYTE-IDENTICAL (Pass 3 complete, 33.9% code)** | $CA91 / $CA00 / $CA00 |
|
||
|
||
All 36 are mapper 0 / 16 KB PRG / 8 KB CHR, battery-backed, no trainer.
|
||
|
||
Rows 1-18 are **BYTE-IDENTICAL**: `make` compares the whole reconstructed ROM
|
||
against `copilot/rom.nes`. Rows 19-35 are **PRG-IDENTICAL**: their Makefiles
|
||
compare only `reconstructed_prg.bin` against `prg.bin`, so header and CHR are
|
||
not yet proven to rebuild. Treat those as unverified outside the PRG. Row 36
|
||
(Urban Champion) is also BYTE-IDENTICAL — it was promoted while still numbered
|
||
at the tail of the `_wip` block, so the tier split is by row ranges 1-18 + 36
|
||
versus 19-35, not a single cut.
|
||
|
||
**How to read this table.** The vectors are the three little-endian words at the **end of the
|
||
16 KB PRG** (`$FFFA-$FFFF` in the `$C000` mirror) — *not* fields in the iNES header, whose bytes
|
||
0-9 carry only sizes, mirroring and mapper. Regenerate the whole column with:
|
||
|
||
```bash
|
||
python3 - <<'EOF'
|
||
import os
|
||
for p in sorted(d for d in os.listdir('.') if os.path.isdir(os.path.join(d, 'copilot'))):
|
||
rom = open(f"{p}/copilot/rom.nes", 'rb').read()
|
||
prg = rom[16:16 + rom[4]*16384]; vo = len(prg) - 6
|
||
v = [prg[vo+i] | (prg[vo+i+1] << 8) for i in (0, 2, 4)]
|
||
print(f"{p:30s} {'Vertical' if rom[6] & 1 else 'Horizontal':10s} "
|
||
+ " / ".join("$%04X" % x for x in v))
|
||
EOF
|
||
```
|
||
|
||
Five rows were wrong before this pass, all from copy-paste duplication of a neighbouring row's
|
||
vectors, and are corrected above:
|
||
|
||
| Project | Was | Actually |
|
||
|---------|-----|----------|
|
||
| Burger Time (U) | `$C046 / $C40B / $C43E` (Baseball's) | `$FF7F / $FD24 / $FD24` |
|
||
| Clu Clu Land (JU) | `$C1F1 / $C000 / $FFF9` | `$C1F1 / $C196 / $C196` |
|
||
| Excitebike (JU) | `$C1F1 / $FD24 / $FD24` | `$C23B / $C184 / $FFF0` |
|
||
| Pac-Man (USA) (Namco) | `$C10E / $C000 / $C17E` | `$C10E / $C033 / $C17E` |
|
||
| Donkey Kong 3 (JUE) | `$C07D / $C000 / $C000` | `$C08D / $C000 / $C000` |
|
||
|
||
Donkey Kong Jr.'s mirroring was also wrong (Horizontal, actually Vertical). Odd vector *targets*
|
||
are not mistakes: Burger Time's `$FF7F` NMI and CIRCUS's `$4CB7` IRQ point into unused/data space,
|
||
which is common in this set — see "Notes" under Per-Project Details.
|
||
|
||
Region/Version comes from the folder-name suffix (JU/U/UE/JUE); these mapper-0 headers do not
|
||
encode region, so CIRCUS — whose folder carries no suffix — is left as `—` rather than guessed.
|
||
|
||
---
|
||
|
||
## Per-Project Details
|
||
|
||
### 1. Balloon Fight (JU)
|
||
- **Folder:** `Balloon Fight (JU)/`
|
||
- **ROM:** `balloon.nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (8,543 lines)
|
||
- **Linker:** PRG at $C000, 16 KB; single segment
|
||
- **Vectors:** NMI → $C094 (`NmiHandler`), RESET → $C000 (`Reset`), IRQ → $C0F7 (`IrqHandler`, self-loop)
|
||
- **Key subsystems:** NMI-driven frame loop with PPU command buffer, round spawner ($C790), bonus objects ($CB74), carrier/rescue sequence ($C6F9), particle system ($CDAA), sound driver ($FFF7 banked)
|
||
- **Build fix:** None needed; byte-identical out of the box. **Pass 1 verified complete 2026-10-16** — 5,303 instructions / 11,260 code bytes (68.7%), which is *more* than the complete-opcode static tracer finds (5,277 / 11,202); the 166 tracer-only bytes are genuine data (command scripts at $D437/$D45A, the $C3B5 pointer table, the arithmetic table at $FBCA), not missed code. The last two `.incbin` spans were converted to explicit classified bytes (`TrailingFillBeforeApuTables` at $F4C5, `SoundEngineTailBytes` at $F5FC), so no ROM byte is hidden
|
||
- **Pass 3 symbols (2026-10-19):** every operand `symbols.inc`/`locals.inc` defines is now
|
||
named in `prg.s` — **125** hardware-register operands and **797 of 813** zero-page/RAM
|
||
operands. The 15 multi-alias addresses were resolved per routine (`--sites` in
|
||
`_tools/apply_symbols.py`). **16** operands are left numeric: `$13` used as a plain
|
||
high-byte scratch beside `Temp12`, where none of its three aliases fits. Rebuild stays
|
||
byte-identical.
|
||
- **Details:** `Balloon Fight (JU)/OVERVIEW.md`
|
||
|
||
### 2. Baseball (UE)
|
||
- **Folder:** `Baseball (UE)/`
|
||
- **ROM:** `baseball.nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (21,624 lines — largest source)
|
||
- **Linker:** PRG at $C000, 16 KB; single segment
|
||
- **Vectors:** NMI → $C046 (`NMI`), RESET → $C40B (`Reset`), IRQ → $C43E (`IRQ`, `rti`)
|
||
- **Key subsystems:** Queued event system ($EB66–$EB9C) as the main frame driver, round/state machine ($C5FE), batting/pitching ($C6044–$C6414), object sorting ($C339), sound driver ($F9D0–$FE2x)
|
||
- **Build fix:** None needed; byte-identical out of the box
|
||
- **Pass 3 symbols (2026-10-19):** **121 operands substituted** (85 single-name + 36 hardware) from `symbols.inc`/`locals.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Details:** `Baseball (UE)/OVERVIEW.md`
|
||
|
||
### 3. Bomberman (U)
|
||
- **Folder:** `Bomberman (U)/`
|
||
- **ROM:** `bomberman.nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (7,553 lines), `header.s`, `chr.s`
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
|
||
- **Vectors:** NMI → $C01A (`NmiHandler`), RESET → $C000 (`Reset`), IRQ → $FFF9 (`IrqHandler`, `rti`)
|
||
- **Key subsystems:** NMI-driven PPU command queue and VRAM transfers, main loop at $C368 with state dispatch table ($C75D), bomb/object slots (80 slots at $03E6), sound driver ($E642–$FE2x) with dispatch table ($E6AD)
|
||
- **Build fix:** One-byte mismatch at CPU $E71B (`dec $E4` vs `dec $54`) — resolved by adding `RandomStateAlt = $E4` to `locals.inc` alongside `RandomState0 = $54` (zero-page reuse); also renamed `ControllerState` → `ControllerState1`, `Main_HandleControl_C368` → `MainGameLoop`, `Gameplay_HandleControl_C79D` → `GameplayUpdate`, `Sound_HandleControl_E65F` → `SoundUpdate`
|
||
- **Pass 3:** Applied 354 single-name + 8 site-resolved multi-alias operands from `locals.inc`; 24 in-file table labels from `reconstructed.lbl`; 0 hardware substitutions needed. Residue: 758 unnamed operands (179 distinct addresses).
|
||
- **Details:** `Bomberman (U)/OVERVIEW.md`
|
||
|
||
### 4. Burger Time (U)
|
||
- **Folder:** `Burger Time (U)/`
|
||
- **ROM:** `Burger Time (U) [!].nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (9,323 lines), `copilot/header.s`, `copilot/chr.s`
|
||
- **Linker:** HEADER, PRG at $C000 (0x3FFA), VECTORS at $FFFA, CHR
|
||
- **Vectors:** NMI → $FF7F (points *into* the vector page itself — not a real handler; NMI is effectively unused), RESET → $FD24 (`ResetHandler`, `sei` prologue), IRQ → $FD24 (reuses Reset)
|
||
- **Key subsystems:** Event-driven main loop via `CommonEngineExit` ($EB6A) and queued events ($EB9D), title screen / round state machine ($C5FE), object arrays ($03E6 state, $0436/$0486 position), audio engine ($F9D0–$FE2x) with music sequencer ($FD34)
|
||
- **Build fix:** None needed; byte-identical. Requires symlink `burger_time.nes → "../Burger Time (U) [!].nes"` due to spaces in ROM filename
|
||
- **Details:** `Burger Time (U)/OVERVIEW.md`
|
||
|
||
### 5. Clu Clu Land (JU)
|
||
- **Folder:** `Clu Clu Land (JU)/`
|
||
- **ROM:** `rom.nes` (24,592 bytes)
|
||
- **Source:** `copilot/main.s` (9,150 lines)
|
||
- **Linker:** PRG at $C000, 16 KB; single segment (no separate HEADER/CHR segments in cfg, but CHR data is embedded inline at end of prg.s)
|
||
- **Vectors:** NMI → $C1F1 (`NMIHandler`), RESET → $C196 (`ResetEntry`, shared with the IRQ handler), IRQ → $C196 (`IrqHandler`, reuses Reset)
|
||
- **Key subsystems:** State-machine main loop via dispatch table at $C000–$C00D, NMI-driven PPU command queue + VRAM transfers, object pools ($03E6 state, $0436/$0486 position), sound driver ($E642–$F7C0) with dispatch table ($E6AD)
|
||
- **Build fix:** One `bpl` branch to undefined label at CPU $FAB4 — replaced with `bne *-$1B` to produce original `d0 e3` bytes (disassembler mislabeled `bne` as `bpl`)
|
||
- **Details:** `Clu Clu Land (JU)/OVERVIEW.md`
|
||
|
||
### 6. Defender 2 (U)
|
||
- **Folder:** `Defender 2 (U)/`
|
||
- **ROM:** `Defender 2 (U).nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (11,905 lines)
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (0x3FFA), VECTORS at $FFFA, CHR at $0000
|
||
- **Vectors:** NMI → $CAA1 (`NmiHandler`), RESET → $C983 (`ResetHandler`), IRQ → $CA9E (`IrqHandler`, reuses Reset)
|
||
- **Key subsystems:** Event-driven main loop (`UpdateSideScrollingGameplay_CA6A` at $CA6A) waiting on NMI flag, side-scrolling gameplay ($C073–$C324 family), PPU streaming ($F20B–$F7C0), audio engine ($E642–$F7C0) with dispatch table ($E6AD)
|
||
- **Build fix:** Same `bpl` → `bne *-$1B` fix at CPU $E811 as Clu Clu Land (disassembler mislabeled `bne` as `bpl`)
|
||
- **Details:** `Defender 2 (U)/OVERVIEW.md`
|
||
|
||
### 7. Excitebike (JU)
|
||
- **Folder:** `Excitebike (JU)/`
|
||
- **ROM:** `rom.nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (14,111 lines)
|
||
- **Linker:** PRG at $C000, 16 KB; single segment
|
||
- **Vectors:** NMI → $C23B (`NMI`), RESET → $C184 (`Reset`), IRQ → $FFF0 (points into audio data region — likely placeholder/unused)
|
||
- **Key subsystems:** NMI-driven state machine with dispatch table at $C000–$C00D (14 states), title/menu system ($C346–$C454), gameplay update chain ($C99A), race update ($C8D6), audio engine ($F8DE) with 4 channels + SFX, serial I/O over controller port $4016
|
||
- **Build fix:** Same `bpl` → `bne *-$1B` fix at CPU $FAB4 (same pattern as Clu Clu Land/Defender 2)
|
||
- **Details:** `Excitebike (JU)/OVERVIEW.md`
|
||
|
||
### 8. Tennis (JU)
|
||
- **Folder:** `Tennis (JU)/`
|
||
- **ROM:** `Tennis (JU).nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (9,268 lines)
|
||
- **Linker:** PRG at $C000, 16 KB; single segment
|
||
- **Vectors:** NMI → $C07D (`NmiHandler`), RESET → $C000 (`Reset`), IRQ → $C000 (`Reset` reused)
|
||
- **Key subsystems:** NMI-synchronized main loop (`MainLoop` at $C04F), game state machine via `MainStateHandlerTable` ($C101, 12 states), game mode state machine via `GameModeStateTable` ($CAD7, 8 states), object/sprite system with fixed-point physics, audio engine ($F8DE) with serial I/O over controller port
|
||
- **Build fix:** None needed; byte-identical out of the box
|
||
- **Pass 3 symbols (2026-10-19):** **18 single-name operands** substituted from `locals.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Details:** `Tennis (JU)/OVERVIEW.md`
|
||
|
||
### 9. Pac-Man (USA) (Namco)
|
||
- **Folder:** `Pac-Man (USA) (Namco)/`
|
||
- **ROM:** `rom.nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (9,268 lines)
|
||
- **Linker:** PRG at $C000, 16 KB; single segment
|
||
- **Vectors:** NMI → $C10E (`NmiHandler`), RESET → $C033 (`Reset`; `locals.inc` defines `ResetOffset = $C033`), IRQ → $C17E (`IrqHandler`)
|
||
- **Key subsystems:** NMI-synchronized main loop (`MainLoop` at $C04F), game state machine via `MainStateHandlerTable` ($C101, 12 states), game mode state machine via `GameModeStateTable` ($CAD7, 8 states), object/sprite system with fixed-point physics, audio engine ($F8DE) with serial I/O over controller port
|
||
- **Build fix:** None needed; byte-identical out of the box
|
||
- **Pass 3 symbols (2026-10-19):** **524 single-name operands** substituted from `locals.inc` via `_tools/apply_symbols.py` — **727 multi-alias residues** left numeric (addresses with 2+ aliases, e.g. `$00` = `workPtr0`/`Zp00`). Rebuild stays byte-identical.
|
||
- **Details:** `Pac-Man (USA) (Namco)/OVERVIEW.md`
|
||
|
||
### 10. Donkey Kong 3 (JUE)
|
||
- **Folder:** `Donkey Kong 3 (JUE)/`
|
||
- **ROM:** `Donkey Kong 3 (JUE).nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (9,952 lines)
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
|
||
- **Vectors:** NMI → $C08D (`NmiHandler`; the `prg.s` header block records it as "Pass 2 control-flow entry at CPU $C08D"), RESET → $C000 (`Reset`), IRQ → $C000 (`Reset` reused)
|
||
- **Key subsystems:** Main loop with object/game state management at $C02E–$C18D, object movement and geometry calculations ($C28E–$C683), audio engine ($F8DE+) with sound channels ($F0–$FF), PPU command buffer streaming ($C3F4+)
|
||
- **Build fix:** Build split `main.s` into `header.s`, `prg.s`, `chr.s`; added `RandomStateAlt = $E4` for `dec $E4` at CPU $E71B (zero-page reuse with `RandomState0 = $54`). **2026-10-16 — one-byte branch-target bug fixed:** the project was recorded as BYTE-IDENTICAL but had never built byte-identical. The `bne` at CPU $C14C (PRG $014C) was annotated `D0 12` (target $C160) but assembled as `D0 0D`, because it was labelled `StoreSelectedPlayerAndScreenFlags` ($C15B) instead of the routine actually at $C160. Retargeted to `ClearAudioSetGameMode` — which is also the semantically correct target for a "mode != $01" test. `cmp` now passes.
|
||
- **Details:** `Donkey Kong 3 (JUE)/copilot/OVERVIEW.md`
|
||
|
||
### 11. Donkey Kong Jr. (JU)
|
||
- **Folder:** `Donkey Kong Jr. (JU)/`
|
||
- **ROM:** `Donkey Kong Jr. (JU).nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (12,807 lines; 6,135 instructions, 266 routines, 68 data labels, 0 conflicts)
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
|
||
- **Vectors:** NMI → $C6E6 (`NmiHandler`), RESET → $C66E (`ResetHandler`), IRQ → $FFF0 (stray byte, effectively unused)
|
||
- **Key subsystems:** Reset idles in a PRNG-advance loop — the entire frame state machine (title/attract/gameplay/sound) runs inside the NMI handler; VRAM/event queue at $0300 with dispatch table at $BFFE; 8-byte PRNG at $18–$1F; sound timers at $F1AF
|
||
- **Build fix:** None needed; byte-identical out of the box (`make` in `copilot/`). **Pass 1 verified complete 2026-10-16** — a full byte-accounting audit of `prg.s` confirms all 16,384 PRG bytes are emitted exactly once (6,199 instructions + 3,889 `.byte` + 16 `.word`), every emitted value equals the ROM byte, and there are zero audit-comment mismatches or duplicate addresses. No `.incbin` remains. A complete-opcode static tracer independently reaches 6,135 instructions / 12,358 code bytes (75.4%) — every one of which is already present in the file, and the file carries 121 further code bytes the tracer does not find (reached via the `DeferredTaskHandlerTable` dispatch at $BFFE). Pass 2/3 naming is complete; Pass 3 tables are named (`DeferredTaskHandlerTable`, `HudDigitDescriptorTable`, …)
|
||
- **Details:** `Donkey Kong Jr. (JU)/OVERVIEW.md`
|
||
|
||
### 12. CIRCUS
|
||
- **Folder:** `CIRCUS/`
|
||
- **ROM:** `rom.nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (~12,755 lines)
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
|
||
- **Vectors:** NMI → $C05A (`NmiHandler`), RESET → $C000 (`Reset`), IRQ → $4CB7 (outside mapped space — effectively unused)
|
||
- **Key subsystems:** NMI-driven frame state machine — main loop is a spin loop at $C057, all per-frame work runs in NMI; main state dispatcher at $C0D0 with 16-state pointer table; controller input with edge flags at $09; menu system with text table at $C763 ("CONTINUE", "STAGE", "SELECT", "PLAY"); palette/screen transfer via descriptor streams; VRAM queue processing; variant object state machine at $DC3F–$FE7B; audio engine with sequence data at $FABB–$FFFB
|
||
- **Build fix:** None needed; byte-identical out of the box (`make` in `copilot/`). Pass 1/2/3 complete — full code/data classification, semantic routine naming, and data table naming all done
|
||
- **Pass 3 symbols (2026-10-19):** **118 operands substituted** (38 single-name + 80 hardware) from `symbols.inc`/`locals.inc` via `_tools/apply_symbols.py` — **23 multi-alias residues** left numeric (addresses with 2 aliases: `$E4`=`Controller1Shift`/`ZpE4`, `$7C`=`WorkPointer0Lo`/`Zp7C`, `$7E`=`WorkPointer1Lo`/`Zp7E`). Rebuild stays byte-identical.
|
||
- **Details:** `CIRCUS/OVERVIEW.md`
|
||
|
||
### 13. Wild Gunman (U)
|
||
- **Folder:** `Wild Gunman (U)/`
|
||
- **ROM:** `rom.nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (~3,000 lines with routine headers)
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
|
||
- **Vectors:** NMI → $C086 (`NmiHandler`), RESET → $C000 (`Reset`), IRQ → $C000 (reuses `Reset`)
|
||
- **Key subsystems:** NMI-driven frame loop — main loop is a spin loop waiting on NMI phase flag ($20); NMI handler does OAM DMA ($4014), PPU updates, and calls game logic subroutines ($C29F, $C233, $C3AC, $C265); main state dispatcher at $C0B3 based on `GameMode` ($30); reset copies sprite/OAM data from $C844 to $05F0; APU enabled via $4015 = $0F
|
||
- **Build fix:** None needed; byte-identical out of the box (`make` in `copilot/` compares the whole ROM: `cmp reconstructed.nes rom.nes`). **Pass 1 redone 2026-10-16** — the original tracer followed only RESET/NMI/IRQ and jsr/jmp/branch targets and knew just the 151 documented opcodes, so it missed Wild Gunman's runtime dispatch (`Label_C341`'s `pla`-based computed goto puts the jump table inline right after each `jsr $C341`) and filed ~4.9 KB of real code as `.byte` data. Code coverage went **1,597 instr / 3,352 B (20.5%) → 3,956 instr / 8,085 B (49.3%)**. **Pass 2 complete** — all 733 labels carry names (zero `Label_Cxxxx`/`SubCxxxx` remain), routine headers on every entry point, zero-page aliases in `locals.inc` (`GameMode`=$30, `NmiPhase`=$20, `NmiFlag`=$22, `Timer2F`=$2F, etc.). **Pass 3 complete** — data tables named: `SpriteAttributeTable` ($C6AC), `NoteVolumeTable` ($F3EF), `VolumeEnvelopeTable` ($F48F), `SpritePositionTable` ($F77C); the OAM sprite block at $C844 is documented in-place as a comment rather than a label
|
||
- **Pass 3 symbols (2026-10-19):** **76 operands substituted** (11 single-name + 65 hardware) from `symbols.inc`/`locals.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Details:** `Wild Gunman (U)/OVERVIEW.md`
|
||
|
||
### 14. Joypad Test Cartridge (U)
|
||
- **Folder:** `Joypad Test Cartridge (U)/`
|
||
- **ROM:** `rom.nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (4,401 lines; 202 routines, all with described headers)
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
|
||
- **Vectors:** NMI → $CCF7 (`NmiHandler`), RESET → $C000 (`Reset`), IRQ → $C000 (reuses `Reset`)
|
||
- **Key subsystems:** NMI-driven frame loop — main loop spins waiting on NMI phase; NMI handler does OAM DMA ($4014), PPU scroll/control latch, and burst VRAM writes from table at $0302; `VramPtrWrite` ($CD3F) uses a return-address modification trick at `RetAddrUpdate` ($CDC8) for runtime-computed dispatch; `VramWrite` ($CDEE) sets PPU address and writes data to PPUDATA; reset clears RAM, initializes PPU ($2000=$10, $2001=$00), triggers OAM DMA, and enters main loop
|
||
- **Build fix:** Byte-identical out of the box, but **Pass 1 was badly truncated and has been redone**. It claimed 282 instructions / 580 bytes (3.5%); the tracer halted at `$C09E` on `DCP $3C20` (`$CF`), an undocumented opcode used as ordinary code, and filed 3,256 bytes of real code as `.byte`. Now **1,773 instructions / 3,836 bytes (23.4%)**, verified against a fresh trace. `nesdis.py --undocumented` supplies the 105 undocumented NMOS opcodes; ca65 V2.19 encodes none of them, so the 4 affected instructions are emitted as explicit `.byte` with the disassembly in the comment. Pass 2 then renamed all 202 labels (zero `Label_Cxxxx` left) and rewrote all 202 routine headersr all labels, semantic naming for key routines, zero-page aliases in `locals.inc` (`VramPtrLo`=$00, `PpuCtrlShadow`=$EF, `FrameCounterLo`=$53, etc.)
|
||
- **Pass 3 symbols (2026-10-19):** **47 hardware operands** substituted from `symbols.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Details:** `Joypad Test Cartridge (U)/OVERVIEW.md`
|
||
|
||
### 15. NES PowerPad Test Card (U)
|
||
- **Folder:** `NES PowerPad Test Card (U)/`
|
||
- **ROM:** `rom.nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (8,842 lines)
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
|
||
- **Vectors:** NMI → $E06E (`NmiHandler`), RESET → $E000 (`Reset`), IRQ → $E000 (reuses `Reset`)
|
||
- **Key subsystems:** Minimal NMI-driven test cartridge — NMI reads PowerPad via $4016, processes transitions, updates score/lives display; APU at $4015=$0F; 7.2% code coverage
|
||
- **Build fix:** None needed; byte-identical out of the box
|
||
- **Pass 3 symbols (2026-10-19):** **89 hardware operands** substituted from `symbols.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Details:** `NES PowerPad Test Card (U)/OVERVIEW.md`
|
||
|
||
### 16. MUSCLE (U)
|
||
- **Folder:** `MUSCLE (U)/`
|
||
- **ROM:** `M.U.S.C.L.E. (U).nes` (24,592 bytes); `copilot/rom.nes` is a relative symlink `../M.U.S.C.L.E. (U).nes`
|
||
- **Source:** `copilot/prg.s` (Pass 1/2/3 output, with 42 bytecode listings above the `.byte` data)
|
||
- **Linker:** HEADER at $0000 (16 bytes), **PRG at $8000 (16 KB)**, CHR at $0000 (8 KB) — the one ROM in the set mapped *low*
|
||
- **Vectors:** NMI → $86CB (`NmiHandler`), RESET → $8000 (`Reset`), IRQ → $8764 (a bare `RTI` that doubles as the NMI epilogue). Vectors themselves sit in the $C000 mirror at $FFFA.
|
||
- **Key subsystems:** bytecode VM — 40 opcodes at `$C8-$EF` handled through a table at `$9237`, everything else a literal operand. Gameplay dispatches through three jump tables plus two zero-page `jmp (zp)` calls a static descender cannot follow: 38-entry token-program pointer table at `$8CEF`, 40-entry opcode handler table at `$9237`, 16-entry handler table at `$9F2B`, 3-entry per-level VRAM-writer table at `$AC35`. Compressed-VRAM RLE decoder at `$AC82` with a 12-byte fill table at `$ACBD`; division by 20 restored at `$82AC`; four-channel sound engine with per-channel state in zero page `$C4-$EF`.
|
||
- **Build fix:** the skeleton's `$C000` linker assumption was wrong — RESET is `$8000`, so `linker.cfg` had to move. `copilot/Makefile` tool paths were `../../../_tools/` while in `_wip/`; promotion to top-level required `../../_tools/`. `make regen` (pass1→pass2→pass3) reproduces `prg.s` byte-for-byte.
|
||
- **Pass 3 symbols (2026-10-19):** **220 operands substituted** (91 single-name + 129 hardware) from `symbols.inc`/`locals.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Details:** `MUSCLE (U)/OVERVIEW.md`
|
||
|
||
### 17. Lunar Pool (U)
|
||
- **Folder:** `Lunar Pool (U)/` (promoted out of `_wip/` 2026-10-18 by `git mv`, so the relative `copilot/rom.nes` symlink is live and tool paths are `../../_tools/`)
|
||
- **ROM:** `Lunar Pool (U).nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (5,300 instructions, 67.6% code / 11,077 bytes; 705 labels, zero `Label_` residue, 38 semantic zero-page aliases + 66 neutral, 33 named data tables)
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
|
||
- **Vectors:** NMI → $FF65 (`NmiHandler`), RESET → $E80C (non-$C000 entry), IRQ → $FF64 (bare `rti`, adjacent to NMI)
|
||
- **Key subsystems:** NMI-driven frame loop with PPU command queue and VRAM transfers; main loop at $E80C; side-scrolling / pool gameplay; audio engine; print-inline-string helper at $CBDC/$CBC9
|
||
- **Build fix:** Promotion from `_wip/` added `header.s`, `chr.s`, HEADER/PRG/CHR `linker.cfg`, and whole-ROM `cmp`; rebuilt from Mesen CDL capture (10,028 bytes Code). **Pass 1/2/3 complete** — byte-identical at whole-ROM level.
|
||
- **Pass 3 symbols (2026-10-19):** **45 operands substituted** (18 single-name + 27 hardware) from `symbols.inc`/`locals.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Details:** `Lunar Pool (U)/OVERVIEW.md`
|
||
|
||
### 18. Donkey Kong (JU)
|
||
- **Folder:** `Donkey Kong (JU)/` (promoted out of `_wip/` 2026-10-19 by `git mv`, so the relative `copilot/rom.nes → ../Donkey Kong (JU).nes` symlink survived)
|
||
- **ROM:** `Donkey Kong (JU).nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (6,014 instructions, 76.3% code / 12,505 bytes; 1,015 labels with **zero `Label_` residue**, 145 zero-page slots with neutral `ZpXX` names, 10 named data regions)
|
||
- **Linker:** HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
|
||
- **Vectors:** NMI → $C85F (`NmiHandler`), RESET → $C79E (non-$C000 entry, like DK Jr.), IRQ → $FFF0 (vector-page padding, unused)
|
||
- **Key subsystems:** reset enters at $C79E; NMI-driven frame loop; dispatchers at $C807/$C815/$C823/$C831/$C847 load 16-bit pointers from `ObjectPtrTable` ($C03C) and from `$C4A7,x`; large level-data pointer block $C044–$C79D; sound engine over `MusicDataTable` ($F55B), `APUDataTable` ($FAE6), `SfxDataTable` ($FE59)
|
||
- **Pass 2 (2026-10-19):** all 919 `Label_XXXX` definitions named — 102 new semantic routine names + 217 `SubC<addr>` entry names (honest residue) + 600 derived `<Routine>_Block[_n]` internal branch targets; `jsr`/`jmp` operands stay numeric (`Wild Gunman (U)` style). Applied with `_tools/pass2.py apply`; `make` still byte-identical
|
||
- **Build fix:** none at PRG level — it was PRG-identical in `_wip/` and stayed byte-identical through Pass 3. Promotion added `header.s`, `chr.s`, a HEADER/PRG/CHR `linker.cfg`, the `rom.nes` symlink, and the whole-ROM `cmp`; no `_tools` path change (the Makefile never referenced `_tools/`) and no `make regen` target. Mirroring was recorded as Vertical in the project OVERVIEW but header byte 6 = $00 says **Horizontal** — corrected at promotion
|
||
- **Pass 3 symbols (2026-10-19):** **75 operands substituted** (17 single-name + 58 hardware) from `symbols.inc`/`locals.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Pass 3 symbols (2026-10-19):** **75 operands substituted** (17 single-name + 58 hardware) from `symbols.inc`/`locals.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Details:** `Donkey Kong (JU)/OVERVIEW.md`
|
||
|
||
### 36. Urban Champion (JU)
|
||
- **Folder:** `Urban Champion (JU)/`
|
||
- **ROM:** `Urban Champion (JU).nes` (24,592 bytes)
|
||
- **Source:** `copilot/prg.s` (~4,000 lines)
|
||
- **Linker:** PRG at $C000, 16 KB; single segment
|
||
- **Vectors:** NMI → $CA91 (`NmiHandler`), RESET → $CA00 (`Reset`), IRQ → $CA00 (reuses `Reset`)
|
||
- **Key subsystems:** NMI-driven frame loop with simple fight game logic; minimal code (33.9%)
|
||
- **Build fix:** None needed; byte-identical out of the box
|
||
- **Pass 3 symbols (2026-10-19):** **70 operands substituted** (4 single-name + 66 hardware) from `symbols.inc`/`locals.inc` via `_tools/apply_symbols.py` — zero residue. Rebuild stays byte-identical.
|
||
- **Details:** `Urban Champion (JU)/OVERVIEW.md`
|
||
|
||
---
|
||
|
||
## `_wip/` Projects
|
||
|
||
These 17 ROMs are listed as rows 19-35 of the Project Inventory above, so their
|
||
vectors and mirroring are in one place rather than a second table that can drift.
|
||
|
||
Each carries a real disassembly, not a skeleton: 4,482–17,180 lines of `prg.s`
|
||
with 192–971 address-based `Label_` definitions apiece — 11,126 in total.
|
||
Fifteen of the seventeen also carry canonical `; CPU:$xxxx PRG:xxxx AA BB`
|
||
audit comments; the two exceptions predate
|
||
that convention — `Golf (JU)` uses `; C007: AD 02 20` and `Pyramid (U)` a
|
||
`; PRG:$172E 48` form. **They verify at PRG level only** — their Makefiles run
|
||
`cmp reconstructed_prg.bin prg.bin`, not a whole-ROM compare, which is why the
|
||
inventory marks them `PRG-IDENTICAL` rather than `BYTE-IDENTICAL`. None keeps the
|
||
header/CHR as linkable source: `copilot/` holds the raw `header.bin`/`chr.bin`
|
||
splits, with no `header.s`, `chr.s` or HEADER/PRG/CHR `linker.cfg`. Promoting one
|
||
to the top level therefore means adding a `copilot/rom.nes` (a relative symlink
|
||
survives the `git mv`), adding those three files (copy the shape from
|
||
`Burger Time (U)/copilot/`), switching the Makefile to a whole-ROM compare, and
|
||
moving the `../../../_tools/` paths to `../../_tools/`. `Lunar Pool (U)` went
|
||
through exactly that on 2026-10-18 and `Donkey Kong (JU)` on 2026-10-19 (Pass 3
|
||
done, whole ROM byte-identical); DK (JU) needed no `_tools` path change because
|
||
its Makefile never referenced `_tools/`.
|
||
|
||
Pass 1 is done in all 17, and the inventory rows give the authoritative
|
||
per-project status. **No `_wip` project is Pass 2 complete.** The furthest
|
||
along are Pinball (180 of 681 label definitions named, plus 40 Pass 3 data
|
||
regions drafted but unapplied) and Mario Bros (262 call entry points named —
|
||
39 semantic + 223 `SubCxxxx`), and both still carry hundreds of address-based
|
||
`Label_` definitions; the other 15 are Pass 1 with partial or no semantic
|
||
naming, and none has semantic zero-page aliases. Five headers that read
|
||
"Pass 2 complete" before 2026-10-19 (Donkey Kong Jr. Math, Duck Hunt, Ice
|
||
Climber (JE), Ice Climber (U), Pinball) had counted their draft maps' rows
|
||
rather than the names actually present in `prg.s`; those claims are corrected,
|
||
and the maps themselves are stale and unapplied (audited per project — see each
|
||
project's `OVERVIEW.md`). All 17 currently build cleanly at the PRG level.
|
||
**Each project also owes a real power-on flow `OVERVIEW.md`** — the 2026-10-19
|
||
sweep corrected their status headers to match the actual sources, but most still
|
||
lack the flow analysis the top-level projects carry.
|
||
|
||
Notable vector/header observations for Pass 1 work:
|
||
- **Pac-Man (U)** RESET at `$FF00` (vector-page tail), while the Tengen variant RESETs at `$C033` — different builds confirmed (PRG bytes differ).
|
||
- **Lunar Pool (U)** NMI `$FF65` / IRQ `$FF64` are adjacent in the vector page; RESET `$E80C`.
|
||
- **NES PowerPad Test Card (U)** — *at Pass 2/3*: minimal code (~7.2%), data-heavy test cartridge. RESET at $E000 (non-$C000 entry). NMI handler reads controllers via shift register, processes pad transitions, draws score/lives. See `NES PowerPad Test Card (U)/OVERVIEW.md`.
|
||
- **Lunar Pool (U)** — *Pass 2 and Pass 3 complete; promoted to the top level 2026-10-18*: RESET at `$E80C` (not `$C000`), NMI `$FF65`, IRQ `$FF64` (a bare `rti` just before the NMI handler, so IRQs are ignored). There is **no** `jmp ($7961)` RAM-pointer gate (an earlier claim): those three sites fell out of decoding two bytes into the word "player". `$CBDC`/`$CBC9` is a print-inline-string-and-return-after-it helper, so a `jsr $CBDC` is always followed by a `$81`-prefixed, `$00`-terminated string ("player", "shot", "game over", "hi`score__", "perfect_"). The split was re-derived from a Mesen CDL capture (10,028 bytes Code): now **5,300 instructions / 11,077 bytes (67.6%)**, 5,301 data bytes and the six vector bytes as `.word`. Pass 2 named all **705** labels — `Label_<addr>` is gone from the file — and Pass 3 named 33 tables plus the zero-page aliases (38 semantic, 66 neutral, ten former phantom aliases deleted). Residue, recorded rather than guessed: 73 bytes of *reachable* code are still `.byte` (`$EA9A`, `$EADC`, `$EAE5`, `$EAED`, `$EB04`, `$EB16-$EB4F` — the CDL capture never fetched them), another 75 bytes of ending-screen code sit at `$F5F9-$F643`, and ~206 bytes of unreached-but-clearly-code stubs stay data. The full 24,592-byte ROM (header + PRG + CHR) rebuilds byte-identically. See `Lunar Pool (U)/OVERVIEW.md`.
|
||
- **Ice Climber (JE) vs (U)**: byte-identical PRG *and* header — only the CHR differs (~regional title graphic).
|
||
- **Popeye (JU) PRG 0 vs PRG 1**: different PRG binaries (and mirroring); same vectors.
|
||
- **Raid on Bungeling Bay (U) vs [a2]**: `[a2]` differs in mirroring only per header, but PRGs differ — separate builds.
|
||
- **Pyramid (U)** — *already at Pass 1*: interesting unlicensed Sachen boot ($4100 mapper pokes, "AV" stack-byte check, two queued-event dispatchers). See its `OVERVIEW.md`.
|
||
- **CIRCUS** — *at Pass 2/3*: full recursive disassembly complete. NMI-driven frame state machine (main loop is a spin loop at $C057). Menu text at $C763 ("CONTINUE", "STAGE", "SELECT", "PLAY"). Object state machine at $DC3F–$FE7B. Audio sequence data at $FABB–$FFFB. See `CIRCUS/OVERVIEW.md`.
|
||
- **Joypad Test Cartridge (U)** — *Pass 3 complete*: minimal code (23.4%), data-heavy test cartridge. Data region `$CF06–$FFFF` broken into 20 named sub-blocks; VRAM command stream opcode set decoded via `RetAddrUpdate` return-address modification trick at `$CDC8`. See `Joypad Test Cartridge (U)/OVERVIEW.md`.
|
||
- **Wild Gunman (U)** — *Pass 1 redone, Pass 2/3 complete*: NMI-driven frame loop. Gates its code behind runtime computed-goto tables — see the `prg.s` header block and its `OVERVIEW.md`.
|
||
- **Mario Bros (JU)** — *Pass 1 complete (72.2% code), Pass 2 substantial*: 262 call entry points named (39 semantic + 223 `SubCxxxx` address-based) — verified 2026-10-19; the earlier "252 (90 + 165)" was wrong; 667 internal `Label_Cxxxx` branch targets remain. Code is gated behind stack-based indirect dispatch at `$CD9E` and a 20-entry `JSR` thunk table at `$C5A3`. Audio routines in `$F8xx-$F9xx` clearly identifiable from APU register writes. See `_wip/Mario Bros (JU)/OVERVIEW.md`.
|
||
|
||
## Common Patterns Across All Projects
|
||
|
||
### Memory Map
|
||
Every project uses a single 16 KB PRG bank mapped at CPU **$C000–$FFFF**, with 8 KB CHR. All builds are NROM (no bank switching).
|
||
|
||
### Interrupt Structure
|
||
All projects follow the same NES interrupt pattern:
|
||
- **NMI** fires once per frame and is the real-time heartbeat — handles OAM DMA, PPU updates, controller reading, and audio.
|
||
- **RESET** performs cold-start hardware init, RAM clearing, and enters the main loop.
|
||
- **IRQ** is almost always unused (either `rti` or a self-loop).
|
||
|
||
Two exceptions worth noting from branches of this family:
|
||
- **Excitebike** uses a state-dispatch table at $C000 rather than a conventional inline main loop, and its IRQ vector points into a data region (unused).
|
||
- **Donkey Kong Jr.** is the extreme case: its reset path idles forever in a PRNG-advance loop, and the *entire* frame state machine (title, attract, gameplay, sound) executes inside the NMI handler itself. Its reset entry is also at $C66E rather than $C000.
|
||
|
||
### Build Toolchain
|
||
All projects use the same toolchain:
|
||
- **ca65** (6502 assembler)
|
||
- **ld65** (linker with `.cfg` memory map)
|
||
- All rebuilds are verified **byte-identical** to the original `prg.bin` / ROM PRG bank.
|
||
|
||
### Disassembly Style
|
||
All sources are "Pass-1" style disassemblies:
|
||
- Every instruction annotated with PRG offset, CPU address, and emitted bytes
|
||
- Inline `.byte`/`.word`/`.res` data blocks interleaved with code
|
||
- Address-based labels where semantics are not yet resolved: `Label_Cxxxx` (unrenamed internal targets), `SubC<addr>` / `Sub_Cxxxx` (unnamed entry points), `<Routine>_Block[_n]` (internal blocks under a named parent routine)
|
||
- Zero-page symbol files (`locals.inc`) and hardware symbol files (`symbols.inc`)
|
||
|
||
---
|
||
|
||
## Navigation
|
||
|
||
Each project folder contains:
|
||
- `copilot/` — disassembly source, build config, and build artifacts
|
||
- `OVERVIEW.md` (at the project folder root) — detailed per-project power-on execution flow analysis
|
||
- `<rom>.nes` — original NES ROM image (for reference)
|
||
|
||
To rebuild any project:
|
||
```bash
|
||
cd /home/tmerritt/Projects/disassembly/<Project>/copilot
|
||
make
|
||
```
|
||
|
||
To verify byte-identity:
|
||
```bash
|
||
make verify # (where supported by the Makefile)
|
||
```
|
||
|
||
---
|
||
|
||
## Pass 1 methodology note (2026-10-16)
|
||
|
||
The original Pass 1 disassembler had two limitations that silently understated
|
||
code coverage. Both are worth knowing before trusting a coverage percentage:
|
||
|
||
1. **Documented opcodes only.** Its table held the 151 documented 6502 opcodes.
|
||
These ROMs also use the 54 undocumented opcodes and the 26 unofficial NOPs
|
||
as 2/3-byte padding; a tracer that halts on them strands the real code behind.
|
||
2. **No runtime dispatch.** It followed only vectors and direct `jsr`/`jmp`/branch
|
||
targets. Games here dispatch through computed jumps — `jmp ($0014)`, the
|
||
`pla`-based inline-table gotos in Wild Gunman (`Label_C341`), and task tables
|
||
like Donkey Kong Jr.'s `DeferredTaskHandlerTable` at $BFFE.
|
||
|
||
Effect measured per project (old tracer → complete-opcode dispatch-aware tracer):
|
||
|
||
| Project | Old | Complete | Action taken |
|
||
|---------|-----|----------|--------------|
|
||
| NES PowerPad Test Card (U) | 546 instr | 559 | Pass 1 already sound |
|
||
| Joypad Test Cartridge (U) | 282 instr | **1,773** | Pass 1 redone (23.4% code); Pass 2 complete; Pass 3 complete |
|
||
| Wild Gunman (U) | 1,600 instr | **4,083** | Pass 1 redone (49.3% code) |
|
||
| Balloon Fight (JU) | 5,216 instr | 5,277 | hand-done file was already better |
|
||
| Donkey Kong Jr. (JU) | 6,135 instr | 6,135 | file already complete |
|
||
|
||
**Joypad Test Cartridge (U) was the last project carrying the old, truncated
|
||
Pass 1, and has now been redone.** Its recorded "3.5% code" was really 23.4%: the
|
||
tracer stopped at `$C09E` on `DCP $3C20` (`$CF`), an undocumented opcode used as
|
||
ordinary code, and 3,256 bytes of real code were filed as `.byte` data. Redoing it
|
||
also invalidated its Pass 3, which had described `$C09E–$C173` and `$C17F–$CCF6` as
|
||
data — both are code. Pass 3 is now the outstanding work.
|
||
|
||
The fix generalises: `nesdis.py --undocumented` decodes all 105 undocumented NMOS
|
||
opcodes. It is **default off** so that projects whose `prg.s` is already
|
||
regen-stable keep reproducing byte-for-byte under `make regen`.
|
||
|
||
`_tools/verify_pass1.py` checks the **19 top-level projects** — it selects folders
|
||
that carry a `copilot/rom.nes`, so the 17 `_wip/` projects are not covered (they
|
||
are checked by plain `make` at the PRG level). Current run, 2026-10-19: every
|
||
project builds, **all canonical**, and **no truncated or unfaithful Pass 1**. The
|
||
last two carryovers are gone — Joypad Test Cartridge, the last project holding an
|
||
old truncated Pass 1, was redone, and Excitebike, the last source with uncommented
|
||
instructions, was commented.
|
||
|
||
The comment-spelling report used to claim that **no project follows the canonical
|
||
`; CPU:$xxxx PRG:xxxx AA BB` convention**. That was a bug in the checker, not a fact
|
||
about the sources: the `canonical` pattern ends with `$` but was compiled without
|
||
`re.MULTILINE`, so it could only ever match once — at end of file — and every
|
||
project fell through to whichever laxer spelling matched most lines. Fixed with
|
||
`re.M`, the true split was 8 canonical / 3 `pipe` / 2 `short` / `rom` / `bytes` /
|
||
`colon` / `slash`; the 2026-10-19 standardization (`_tools/audit_comment_tool.py`
|
||
over 9 projects, plus hand fixes to CIRCUS and Excitebike) closed it out, so the
|
||
checker now reports **all canonical**.
|
||
|
||
Inside `_wip/`, 15 of the 17 also use the canonical spelling; the two stragglers
|
||
are `Golf (JU)` (`; C007: AD 02 20`) and `Pyramid (U)` (`; PRG:$172E 48`).
|
||
Bringing those two up to canonical is Pass 2 work for them, not a build problem.
|
||
|
||
The old claim that "Excitebike and Pac-Man carry no byte comments at all" is stale
|
||
on both counts. Pac-Man (USA) (Namco) is complete (4,695/4,695 instructions
|
||
commented), and Excitebike's 1,013-line gap was closed on 2026-10-19 — all 5,376
|
||
instruction lines now carry a canonical comment.
|
||
|
||
The earlier-reported re-trace crash on `MUSCLE (U)` / `Donkey Kong Jr. (JU)`
|
||
(`ValueError: invalid literal for int() with base 16: ':$0010'`) was a false alarm:
|
||
`nesdis.operand_value()` already strips the emitter's `a:` prefix via
|
||
`token.removeprefix("a:").lstrip("$")`, so re-tracing all 19 top-level projects is
|
||
clean.
|
||
|
||
### Resolved — audit comments for Excitebike and Pac-Man (2026-10-19)
|
||
|
||
Both were hand-written sources with semantic labels but no byte-identity audit
|
||
trail. Both now carry canonical `; CPU:$xxxx PRG:xxxx AA BB` comments on every
|
||
instruction, and `verify_pass1.py` reports all-canonical across the top level, so
|
||
this section is closed.
|
||
|
||
The `ca65 -l` listing route described here was abandoned, for the reason recorded
|
||
in `AGENTS.md`: the listing carries no source line numbers, so entries cannot be
|
||
keyed back to source lines. The comment tooling went through the tracer instead
|
||
(`_tools/audit_comment_tool.py`, tracer as ground truth). The invariant still
|
||
holds and is the check to keep: after inserting comments, `make` must still print
|
||
`Byte-identical ROM verified.`, and each comment's byte list must match `prg.bin`
|
||
at the stated offset — a wrong offset that still assembles is the failure mode.
|
||
|
||
---
|
||
|
||
## Summary
|
||
|
||
The 19 numbered projects below are promoted out of `_wip/` and rebuild **byte-identical**
|
||
to their original ROMs (rows 1-18 plus row 36 — Urban Champion kept its tail number
|
||
when it was promoted). The 17 `_wip/` projects (rows 19-35) verify at PRG level only —
|
||
see "`_wip/` Projects" below.
|
||
|
||
| # | Project | Build Status | Pass 3 |
|
||
|---|---------|--------------|--------|
|
||
| 1 | Balloon Fight (JU) | BYTE-IDENTICAL | complete; symbols applied 2026-10-19 (16 `$13` operands left numeric) |
|
||
| 2 | Baseball (UE) | BYTE-IDENTICAL | complete; symbols applied 2026-10-19 (121 operands) |
|
||
| 3 | Bomberman (U) | BYTE-IDENTICAL | complete |
|
||
| 4 | Burger Time (U) | BYTE-IDENTICAL | complete |
|
||
| 5 | Clu Clu Land (JU) | BYTE-IDENTICAL | complete |
|
||
| 6 | Defender 2 (U) | BYTE-IDENTICAL | complete |
|
||
| 7 | Excitebike (JU) | BYTE-IDENTICAL | complete |
|
||
| 8 | Tennis (JU) | BYTE-IDENTICAL | complete; symbols applied 2026-10-19 (18 operands) |
|
||
| 9 | Pac-Man (USA) (Namco) | BYTE-IDENTICAL | complete; symbols applied 2026-10-19 (524 operands; 727 multi-alias residues) |
|
||
| 10 | Donkey Kong 3 (JUE) | BYTE-IDENTICAL | complete |
|
||
| 11 | Donkey Kong Jr. (JU) | BYTE-IDENTICAL | complete (Pass 1 verified) |
|
||
| 12 | CIRCUS | BYTE-IDENTICAL | complete; symbols applied 2026-10-19 (118 operands; 23 multi-alias residues) |
|
||
| 13 | Wild Gunman (U) | BYTE-IDENTICAL | complete (Pass 1 redone); symbols applied 2026-10-19 (76 operands) |
|
||
| 14 | Joypad Test Cartridge (U) | BYTE-IDENTICAL | Pass 3 complete; symbols applied 2026-10-19 (47 operands) |
|
||
| 15 | NES PowerPad Test Card (U) | BYTE-IDENTICAL | complete; symbols applied 2026-10-19 (89 operands) |
|
||
| 16 | MUSCLE (U) | BYTE-IDENTICAL | complete; symbols applied 2026-10-19 (220 operands) |
|
||
| 17 | Lunar Pool (U) | BYTE-IDENTICAL | complete (tables named); symbols applied 2026-10-19 (45 operands) |
|
||
| 18 | Donkey Kong (JU) | BYTE-IDENTICAL | complete (Pass 2/3, promoted 2026-10-19); symbols applied 2026-10-19 (75 operands) |
|
||
| 36 | Urban Champion (JU) | BYTE-IDENTICAL | complete; symbols applied 2026-10-19 (70 operands) |
|
||
|
||
Rows 19-35 (`_wip/`) all rebuild cleanly at PRG level. All 17 have Pass 1 done and
|
||
several are at Pass 2 (see the rows above); promotion into the numbered inventory,
|
||
CDL-backed reclassification of the remaining data, and a real power-on flow
|
||
`OVERVIEW.md` per project are the open work for them.
|
||
|
||
Use `_tools/verify_pass1.py` to re-check any of this at any time; it rebuilds each
|
||
project and re-traces it, and reports `TRUNCATED` when a project's committed split
|
||
claims less code than the tracer can reach.
|