disasm/OVERVIEW.md

Disassembly Project Index — /home/tmerritt/Projects/disassembly/

This document provides a consolidated overview of all NES disassembly projects in this directory. Each project has its own folder containing a copilot/ subdirectory with the full source, build tooling, and an individual OVERVIEW.md (at the project folder root) with a detailed power-on execution flow analysis.

---

Project Inventory

#	Project	Region/Version	PRG Size	CHR Size	Mirroring	Build Status	Vectors (NMI / RESET / IRQ)
1	Balloon Fight (JU)	Japan	16 KB	8 KB	Horizontal	BYTE-IDENTICAL (Pass complete)	$C094 / $C000 / $C0F7
2	Baseball (UE)	USA/Europe	16 KB	8 KB	Horizontal	BYTE-IDENTICAL (Pass complete)	$C046 / $C40B / $C43E
3	Bomberman (U)	USA	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass complete)	$C01A / $C000 / $FFF9
4	Burger Time (U)	USA	16 KB	8 KB	Horizontal	BYTE-IDENTICAL (Pass complete)	$FF7F / $FD24 / $FD24
5	Clu Clu Land (JU)	Japan	16 KB	8 KB	Horizontal	BYTE-IDENTICAL (Pass complete)	$C1F1 / $C196 / $C196
6	Defender 2 (U)	USA	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass complete)	$CAA1 / $C983 / $CA9E
7	Excitebike (JU)	Japan	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass complete)	$C23B / $C184 / $FFF0
8	Tennis (JU)	Japan	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass complete)	$C07D / $C000 / $C000
9	Pac-Man (USA) (Namco)	—	16 KB	8 KB	Horizontal	BYTE-IDENTICAL (Pass complete)	$C10E / $C033 / $C17E
10	Donkey Kong 3 (JUE)	Japan / USA / Europe	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass complete)	$C08D / $C000 / $C000
11	Donkey Kong Jr. (JU)	Japan	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass complete)	$C6E6 / $C66E / $FFF0
12	CIRCUS	—	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass complete)	$C05A / $C000 / $4CB7
13	Wild Gunman (U)	USA	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass Pass 1 redone)	$C086 / $C000 / $C000
14	Joypad Test Cartridge (U)	USA	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass 3 complete)	$CCF7 / $C000 / $C000
15	NES PowerPad Test Card (U)	USA	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass complete)	$E06E / $E000 / $E000
16	MUSCLE (U)	USA	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass complete)	$86CB / $8000 / $8764
17	Lunar Pool (U)	USA	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass 2 complete, Pass 3 tables named)	$FF65 / $E80C / $FF64
18	Donkey Kong (JU)	Japan	16 KB	8 KB	Horizontal	PRG-IDENTICAL (Pass 2 complete, 76.3% code)	$C85F / $C79E / $FFF0
19	Donkey Kong Jr. Math (U)	USA	16 KB	8 KB	Vertical	PRG-IDENTICAL (Pass 2 complete, 81.9% code)	$C4A9 / $C41E / $FFF0
20	Duck Hunt (JUE)	Japan / USA / Europe	16 KB	8 KB	Horizontal	PRG-IDENTICAL (Pass 2 complete, 37.5% code)	$C086 / $C000 / $C000
21	Golf (JU)	Japan	16 KB	8 KB	Vertical	PRG-IDENTICAL (Pass 1+ substantial)	$C0A6 / $C000 / $C0C4
22	Hogan's Alley (JU)	Japan	16 KB	8 KB	Vertical	PRG-IDENTICAL (Pass 1 complete, 41.8% code, needs CDL reclass)	$C088 / $C000 / $C000
23	Ice Climber (JE)	—	16 KB	8 KB	Horizontal	PRG-IDENTICAL (Pass 2 complete, 74.7% code)	$C076 / $C014 / $FFF0
24	Ice Climber (U)	USA	16 KB	8 KB	Horizontal	PRG-IDENTICAL (Pass 2 complete, 74.7% code)	$C076 / $C014 / $FFF0
25	Lode Runner (U)	USA	16 KB	8 KB	Vertical	PRG-IDENTICAL (Pass 1 complete, 52.6% code)	$C02C / $C000 / $FFF9
26	Mario Bros (JU)	Japan	16 KB	8 KB	Vertical	PRG-IDENTICAL (Pass 1 complete, Pass 2 substantial)	$C07D / $C000 / $C000
27	Millipede (U)	USA	16 KB	8 KB	Vertical	PRG-IDENTICAL (Pass 1 complete, 74.6% code)	$C7F1 / $C735 / $FFF0
28	Pac-Man (Tengen) (U)	USA	16 KB	8 KB	Horizontal	PRG-IDENTICAL (Pass 1 complete, 19.5% code)	$C0FA / $C033 / $C16A
29	Pac-Man (U)	USA	16 KB	8 KB	Horizontal	PRG-IDENTICAL (Pass 1 complete, 19.6% code)	$C0FA / $FF00 / $C16A
30	Pinball (JU)	Japan	16 KB	8 KB	Horizontal	PRG-IDENTICAL (Pass 2 complete, 59.5% code)	$C1ED / $C000 / $C1ED
31	Popeye (JU) (PRG 0)	—	16 KB	8 KB	Vertical	PRG-IDENTICAL (Pass 1 complete, 72.3% code)	$C701 / $C649 / $FFF0
32	Popeye (JU) (PRG 1)	—	16 KB	8 KB	Horizontal	PRG-IDENTICAL (Pass 1 complete, 72.3% code)	$C701 / $C649 / $FFF0
33	Pyramid (U)	USA	16 KB	8 KB	Vertical	PRG-IDENTICAL (Pass 1 done)	$D72E / $FF00 / $FF00
34	Raid on Bungeling Bay (U)	USA	16 KB	8 KB	Vertical	PRG-IDENTICAL (Pass 1 complete, 64.6% code)	$C04C / $C000 / $C2C0
35	Raid on Bungeling Bay (U) [a2]	—	16 KB	8 KB	Horizontal	PRG-IDENTICAL (Pass 1 complete, 64.3% code)	$C04C / $C000 / $C2C0
36	Urban Champion (JU)	Japan	16 KB	8 KB	Vertical	BYTE-IDENTICAL (Pass 3 complete, 33.9% code)	$CA91 / $CA00 / $CA00

All 36 are mapper 0 / 16 KB PRG / 8 KB CHR, battery-backed, no trainer.

Rows 1-17 are BYTE-IDENTICAL: make compares the whole reconstructed ROM against copilot/rom.nes. Rows 18-36 are PRG-IDENTICAL: their Makefiles compare only reconstructed_prg.bin against prg.bin, so header and CHR are not yet proven to rebuild. Treat those as unverified outside the PRG.

How to read this table. The vectors are the three little-endian words at the end of the 16 KB PRG ($FFFA-$FFFF in the $C000 mirror) — not fields in the iNES header, whose bytes 0-9 carry only sizes, mirroring and mapper. Regenerate the whole column with:

python3 - <<'EOF'
import os
for p in sorted(d for d in os.listdir('.') if os.path.isdir(os.path.join(d, 'copilot'))):
    rom = open(f"{p}/copilot/rom.nes", 'rb').read()
    prg = rom[16:16 + rom[4]*16384]; vo = len(prg) - 6
    v = [prg[vo+i] | (prg[vo+i+1] << 8) for i in (0, 2, 4)]
    print(f"{p:30s} {'Vertical' if rom[6] & 1 else 'Horizontal':10s} "
          + " / ".join("$%04X" % x for x in v))
EOF

Five rows were wrong before this pass, all from copy-paste duplication of a neighbouring row's vectors, and are corrected above:

Project	Was	Actually
Burger Time (U)	$C046 / $C40B / $C43E (Baseball's)	$FF7F / $FD24 / $FD24
Clu Clu Land (JU)	$C1F1 / $C000 / $FFF9	$C1F1 / $C196 / $C196
Excitebike (JU)	$C1F1 / $FD24 / $FD24	$C23B / $C184 / $FFF0
Pac-Man (USA) (Namco)	$C10E / $C000 / $C17E	$C10E / $C033 / $C17E
Donkey Kong 3 (JUE)	$C07D / $C000 / $C000	$C08D / $C000 / $C000

Donkey Kong Jr.'s mirroring was also wrong (Horizontal, actually Vertical). Odd vector targets are not mistakes: Burger Time's $FF7F NMI and CIRCUS's $4CB7 IRQ point into unused/data space, which is common in this set — see "Notes" under Per-Project Details.

Region/Version comes from the folder-name suffix (JU/U/UE/JUE); these mapper-0 headers do not encode region, so CIRCUS — whose folder carries no suffix — is left as — rather than guessed.

---

Per-Project Details

1. Balloon Fight (JU)

• Folder: Balloon Fight (JU)/
• ROM: balloon.nes (24,592 bytes)
• Source: copilot/prg.s (8,538 lines)
• Linker: PRG at $C000, 16 KB; single segment
• Vectors: NMI → $C094 (NmiHandler), RESET → $C000 (Reset), IRQ → $C0F7 (IrqHandler, self-loop)
• Key subsystems: NMI-driven frame loop with PPU command buffer, round spawner ($C790), bonus objects ($CB74), carrier/rescue sequence ($C6F9), particle system ($CDAA), sound driver ($FFF7 banked)
• Build fix: None needed; byte-identical out of the box. Pass 1 verified complete 2026-10-16 — 5,303 instructions / 11,260 code bytes (68.7%), which is more than the complete-opcode static tracer finds (5,277 / 11,202); the 166 tracer-only bytes are genuine data (command scripts at $D437/$D45A, the $C3B5 pointer table, the arithmetic table at $FBCA), not missed code. The last two .incbin spans were converted to explicit classified bytes (TrailingFillBeforeApuTables at $F4C5, SoundEngineTailBytes at $F5FC), so no ROM byte is hidden
• Details: Balloon Fight (JU)/OVERVIEW.md

2. Baseball (UE)

• Folder: Baseball (UE)/
• ROM: baseball.nes (24,592 bytes)
• Source: copilot/prg.s (21,624 lines — largest source)
• Linker: PRG at $C000, 16 KB; single segment
• Vectors: NMI → $C046 (NMI), RESET → $C40B (Reset), IRQ → $C43E (IRQ, rti)
• Key subsystems: Queued event system ($EB66–$EB9C) as the main frame driver, round/state machine ($C5FE), batting/pitching ($C6044–$C6414), object sorting ($C339), sound driver ($F9D0–$FE2x)
• Build fix: None needed; byte-identical out of the box
• Details: Baseball (UE)/OVERVIEW.md

3. Bomberman (U)

• Folder: Bomberman (U)/
• ROM: bomberman.nes (24,592 bytes)
• Source: copilot/main.s (8,070 lines)
• Linker: HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
• Vectors: NMI → $C01A (NmiHandler), RESET → $C000 (Reset), IRQ → $FFF9 (IrqHandler, rti)
• Key subsystems: NMI-driven PPU command queue and VRAM transfers, main loop at $C368 with state dispatch table ($C75D), bomb/object object slots (80 slots at $03E6), sound driver ($E642–$FE2x) with dispatch table ($E6AD)
• Build fix: One-byte mismatch at CPU $E70C (dec $E4 vs dec $54) — resolved by adding RandomStateAlt = $E4 to locals.inc alongside RandomState0 = $54 (zero-page reuse); also renamed ControllerState → ControllerState1, Main_HandleControl_C368 → MainGameLoop, Gameplay_HandleControl_C79D → GameplayUpdate, Sound_HandleControl_E65F → SoundUpdate
• Details: Bomberman (U)/OVERVIEW.md

4. Burger Time (U)

• Folder: Burger Time (U)/
• ROM: Burger Time (U) [!].nes (24,592 bytes)
• Source: copilot/prg.s (9,323 lines), copilot/header.s, copilot/chr.s
• Linker: HEADER, PRG at $C000 (0x3FFA), VECTORS at $FFFA, CHR
• Vectors: NMI → $FF7F (points into the vector page itself — not a real handler; NMI is effectively unused), RESET → $FD24 (ResetHandler, sei prologue), IRQ → $FD24 (reuses Reset)
• Key subsystems: Event-driven main loop via CommonEngineExit ($EB6A) and queued events ($EB9D), title screen / round state machine ($C5FE), object arrays ($03E6 state, $0436/$0486 position), audio engine ($F9D0–$FE2x) with music sequencer ($FD34)
• Build fix: None needed; byte-identical. Requires symlink burger_time.nes → "../Burger Time (U) [!].nes" due to spaces in ROM filename
• Details: Burger Time (U)/OVERVIEW.md

5. Clu Clu Land (JU)

• Folder: Clu Clu Land (JU)/
• ROM: rom.nes (24,592 bytes)
• Source: copilot/main.s (9,150 lines)
• Linker: PRG at $C000, 16 KB; single segment (no separate HEADER/CHR segments in cfg, but CHR data is embedded inline at end of prg.s)
• Vectors: NMI → $C1F1 (NMIHandler), RESET → $C196 (ResetEntry, shared with the IRQ handler), IRQ → $C196 (IrqHandler, reuses Reset)
• Key subsystems: State-machine main loop via dispatch table at $C000–$C00D, NMI-driven PPU command queue + VRAM transfers, object pools ($03E6 state, $0436/$0486 position), sound driver ($E642–$F7C0) with dispatch table ($E6AD)
• Build fix: One bpl branch to undefined label at CPU $FAB4 — replaced with bne *-$1B to produce original d0 e3 bytes (disassembler mislabeled bne as bpl)
• Details: Clu Clu Land (JU)/OVERVIEW.md

6. Defender 2 (U)

• Folder: Defender 2 (U)/
• ROM: Defender 2 (U).nes (24,592 bytes)
• Source: copilot/prg.s (11,905 lines)
• Linker: HEADER at $0000 (16 bytes), PRG at $C000 (0x3FFA), VECTORS at $FFFA, CHR at $0000
• Vectors: NMI → $CAA1 (NmiHandler), RESET → $C983 (ResetHandler), IRQ → $CA9E (IrqHandler, reuses Reset)
• Key subsystems: Event-driven main loop (UpdateSideScrollingGameplay_CA6A at $CA6A) waiting on NMI flag, side-scrolling gameplay ($C073–$C324 family), PPU streaming ($F20B–$F7C0), audio engine ($E642–$F7C0) with dispatch table ($E6AD)
• Build fix: Same bpl → bne *-$1B fix at CPU $E811 as Clu Clu Land (disassembler mislabeled bne as bpl)
• Details: Defender 2 (U)/OVERVIEW.md

7. Excitebike (JU)

• Folder: Excitebike (JU)/
• ROM: rom.nes (24,592 bytes)
• Source: copilot/prg.s (14,111 lines)
• Linker: PRG at $C000, 16 KB; single segment
• Vectors: NMI → $C23B (NMI), RESET → $C184 (Reset), IRQ → $FFF0 (points into audio data region — likely placeholder/unused)
• Key subsystems: NMI-driven state machine with dispatch table at $C000–$C00D (14 states), title/menu system ($C346–$C454), gameplay update chain ($C99A), race update ($C8D6), audio engine ($F8DE) with 4 channels + SFX, serial I/O over controller port $4016
• Build fix: Same bpl → bne *-$1B fix at CPU $FAB4 (same pattern as Clu Clu Land/Defender 2)
• Details: Excitebike (JU)/OVERVIEW.md

8. Tennis (JU)

• Folder: Tennis (JU)/
• ROM: Tennis (JU).nes (24,592 bytes)
• Source: copilot/prg.s (9,268 lines)
• Linker: PRG at $C000, 16 KB; single segment
• Vectors: NMI → $C07D (NmiHandler), RESET → $C000 (Reset), IRQ → $C000 (Reset reused)
• Key subsystems: NMI-synchronized main loop (MainLoop at $C04F), game state machine via MainStateHandlerTable ($C101, 12 states), game mode state machine via GameModeStateTable ($CAD7, 8 states), object/sprite system with fixed-point physics, audio engine ($F8DE) with serial I/O over controller port
• Build fix: None needed; byte-identical out of the box
• Details: Tennis (JU)/OVERVIEW.md

9. Pac-Man (USA) (Namco)

• Folder: Pac-Man (USA) (Namco)/
• ROM: rom.nes (24,592 bytes)
• Source: copilot/prg.s (9,268 lines)
• Linker: PRG at $C000, 16 KB; single segment
• Vectors: NMI → $C10E (NmiHandler), RESET → $C033 (Reset; locals.inc defines ResetOffset = $C033), IRQ → $C17E (IrqHandler)
• Key subsystems: NMI-synchronized main loop (MainLoop at $C04F), game state machine via MainStateHandlerTable ($C101, 12 states), game mode state machine via GameModeStateTable ($CAD7, 8 states), object/sprite system with fixed-point physics, audio engine ($F8DE) with serial I/O over controller port
• Build fix: None needed; byte-identical out of the box
• Details: Pac-Man (USA) (Namco)/OVERVIEW.md

10. Donkey Kong 3 (JUE)

• Folder: Donkey Kong 3 (JUE)/
• ROM: Donkey Kong 3 (JUE).nes (24,592 bytes)
• Source: copilot/prg.s (9,952 lines)
• Linker: HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
• Vectors: NMI → $C08D (NmiHandler; the prg.s header block records it as "Pass 2 control-flow entry at CPU $C08D"), RESET → $C000 (Reset), IRQ → $C000 (Reset reused)
• Key subsystems: Main loop with object/game state management at $C02E–$C18D, object movement and geometry calculations ($C28E–$C683), audio engine ($F8DE+) with sound channels ($F0–$FF), PPU command buffer streaming ($C3F4+)
• Build fix: Build split main.s into header.s, prg.s, chr.s; added RandomStateAlt = $E4 for dec $E4 at CPU $E71B (zero-page reuse with RandomState0 = $54). 2026-10-16 — one-byte branch-target bug fixed: the project was recorded as BYTE-IDENTICAL but had never built byte-identical. The bne at CPU $C14C (PRG $014C) was annotated D0 12 (target $C160) but assembled as D0 0D, because it was labelled StoreSelectedPlayerAndScreenFlags ($C15B) instead of the routine actually at $C160. Retargeted to ClearAudioSetGameMode — which is also the semantically correct target for a "mode != $01" test. cmp now passes.
• Details: Donkey Kong 3 (JUE)/copilot/OVERVIEW.md

11. Donkey Kong Jr. (JU)

• Folder: Donkey Kong Jr. (JU)/
• ROM: Donkey Kong Jr. (JU).nes (24,592 bytes)
• Source: copilot/prg.s (12,807 lines; 6,135 instructions, 266 routines, 68 data labels, 0 conflicts)
• Linker: HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
• Vectors: NMI → $C6E6 (NmiHandler), RESET → $C66E (ResetHandler), IRQ → $FFF0 (stray byte, effectively unused)
• Key subsystems: Reset idles in a PRNG-advance loop — the entire frame state machine (title/attract/gameplay/sound) runs inside the NMI handler; VRAM/event queue at $0300 with dispatch table at $BFFE; 8-byte PRNG at $18–$1F; sound timers at $F1AF
• Build fix: None needed; byte-identical out of the box (make in copilot/). Pass 1 verified complete 2026-10-16 — a full byte-accounting audit of prg.s confirms all 16,384 PRG bytes are emitted exactly once (6,199 instructions + 3,889 .byte + 16 .word), every emitted value equals the ROM byte, and there are zero audit-comment mismatches or duplicate addresses. No .incbin remains. A complete-opcode static tracer independently reaches 6,135 instructions / 12,358 code bytes (75.4%) — every one of which is already present in the file, and the file carries 121 further code bytes the tracer does not find (reached via the DeferredTaskHandlerTable dispatch at $BFFE). Pass 2/3 naming is complete; Pass 3 tables are named (DeferredTaskHandlerTable, HudDigitDescriptorTable, …)
• Details: Donkey Kong Jr. (JU)/OVERVIEW.md

12. CIRCUS

• Folder: CIRCUS/
• ROM: rom.nes (24,592 bytes)
• Source: copilot/prg.s (~12,755 lines)
• Linker: HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
• Vectors: NMI → $C05A (NmiHandler), RESET → $C000 (Reset), IRQ → $4CB7 (outside mapped space — effectively unused)
• Key subsystems: NMI-driven frame state machine — main loop is a spin loop at $C057, all per-frame work runs in NMI; main state dispatcher at $C0D0 with 16-state pointer table; controller input with edge flags at $09; menu system with text table at $C763 ("CONTINUE", "STAGE", "SELECT", "PLAY"); palette/screen transfer via descriptor streams; VRAM queue processing; variant object state machine at $DC3F–$FE7B; audio engine with sequence data at $FABB–$FFFB
• Build fix: None needed; byte-identical out of the box (make in copilot/). Pass 1/2/3 complete — full code/data classification, semantic routine naming, and data table naming all done
• Details: CIRCUS/OVERVIEW.md

13. Wild Gunman (U)

• Folder: Wild Gunman (U)/
• ROM: rom.nes (24,592 bytes)
• Source: copilot/prg.s (~3,000 lines with routine headers)
• Linker: HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
• Vectors: NMI → $C086 (NmiHandler), RESET → $C000 (Reset), IRQ → $C000 (reuses Reset)
• Key subsystems: NMI-driven frame loop — main loop is a spin loop waiting on NMI phase flag ($20); NMI handler does OAM DMA ($4014), PPU updates, and calls game logic subroutines ($C29F, $C233, $C3AC, $C265); main state dispatcher at $C0B3 based on GameMode ($30); reset copies sprite/OAM data from $C844 to $05F0; APU enabled via $4015 = $0F
• Build fix: None needed; byte-identical out of the box (make in copilot/). Pass 1 redone 2026-10-16 — the original tracer followed only RESET/NMI/IRQ and jsr/jmp/branch targets and knew just the 151 documented opcodes, so it missed Wild Gunman's runtime dispatch (Label_C341's pla-based computed goto puts the jump table inline right after each jsr $C341) and filed ~4.9 KB of real code as .byte data. Code coverage went 1,597 instr / 3,352 B (20.5%) → 3,956 instr / 8,085 B (49.3%). Pass 2 partial — routine headers and semantic naming for key routines (Reset, NmiHandler, MainStateDispatch, MainLoopBody, etc.); zero-page aliases in locals.inc (GameMode=$30, NmiPhase=$20, NmiFlag=$22, Timer2F=$2F, etc.). Pass 3 pending (no data tables named yet)
• Details: Wild Gunman (U)/OVERVIEW.md

14. Joypad Test Cartridge (U)

• Folder: Joypad Test Cartridge (U)/
• ROM: rom.nes (24,592 bytes)
• Source: copilot/prg.s (4,401 lines; 202 routines, all with described headers)
• Linker: HEADER at $0000 (16 bytes), PRG at $C000 (16 KB), CHR at $0000 (8 KB)
• Vectors: NMI → $CCF7 (NmiHandler), RESET → $C000 (Reset), IRQ → $C000 (reuses Reset)
• Key subsystems: NMI-driven frame loop — main loop spins waiting on NMI phase; NMI handler does OAM DMA ($4014), PPU scroll/control latch, and burst VRAM writes from table at $0302; VramPtrWrite ($CD3F) uses a return-address modification trick at RetAddrUpdate ($CDC8) for runtime-computed dispatch; VramWrite ($CDEE) sets PPU address and writes data to PPUDATA; reset clears RAM, initializes PPU ($2000=$10, $2001=$00), triggers OAM DMA, and enters main loop
• Build fix: Byte-identical out of the box, but Pass 1 was badly truncated and has been redone. It claimed 282 instructions / 580 bytes (3.5%); the tracer halted at $C09E on DCP $3C20 ($CF), an undocumented opcode used as ordinary code, and filed 3,256 bytes of real code as .byte. Now 1,773 instructions / 3,836 bytes (23.4%), verified against a fresh trace. nesdis.py --undocumented supplies the 105 undocumented NMOS opcodes; ca65 V2.19 encodes none of them, so the 4 affected instructions are emitted as explicit .byte with the disassembly in the comment. Pass 2 then renamed all 202 labels (zero Label_Cxxxx left) and rewrote all 202 routine headersr all labels, semantic naming for key routines, zero-page aliases in locals.inc (VramPtrLo=$00, PpuCtrlShadow=$EF, FrameCounterLo=$53, etc.)
• Details: Joypad Test Cartridge (U)/OVERVIEW.md

16. MUSCLE (U)

• Folder: MUSCLE (U)/
• ROM: M.U.S.C.L.E. (U).nes (24,592 bytes); copilot/rom.nes is a relative symlink ../M.U.S.C.L.E. (U).nes
• Source: copilot/prg.s (Pass 1/2/3 output, with 42 bytecode listings above the .byte data)
• Linker: HEADER at $0000 (16 bytes), PRG at $8000 (16 KB), CHR at $0000 (8 KB) — the one ROM in the set mapped low
• Vectors: NMI → $86CB (NmiHandler), RESET → $8000 (Reset), IRQ → $8764 (a bare RTI that doubles as the NMI epilogue). Vectors themselves sit in the $C000 mirror at $FFFA.
• Key subsystems: bytecode VM — 40 opcodes at $C8-$EF handled through a table at $9237, everything else a literal operand. Gameplay dispatches through three jump tables plus two zero-page jmp (zp) calls a static descender cannot follow: 38-entry token-program pointer table at $8CEF, 40-entry opcode handler table at $9237, 16-entry handler table at $9F2B, 3-entry per-level VRAM-writer table at $AC35. Compressed-VRAM RLE decoder at $AC82 with a 12-byte fill table at $ACBD; division by 20 restored at $82AC; four-channel sound engine with per-channel state in zero page $C4-$EF.
• Build fix: the skeleton's $C000 linker assumption was wrong — RESET is $8000, so linker.cfg had to move. copilot/Makefile tool paths were ../../../_tools/ while in _wip/; promotion to top-level required ../../_tools/. make regen (pass1→pass2→pass3) reproduces prg.s byte-for-byte.
• Details: MUSCLE (U)/OVERVIEW.md

---

_wip/ Projects

These 19 ROMs are listed as rows 18-36 of the Project Inventory above, so their vectors and mirroring are in one place rather than a second table that can drift.

Each is a Pass-0 skeleton (default_project.tar.gz): copilot/ holds the split prg.bin/header.bin/chr.bin and a symbolic prg.s. They verify at PRG level only — their Makefiles run cmp reconstructed_prg.bin prg.bin, not a whole-ROM compare, which is why the inventory marks them PRG-IDENTICAL rather than BYTE-IDENTICAL. Promoting one to the top level means adding a copilot/rom.nes (a relative symlink survives the git mv), switching the Makefile to a full-ROM compare, and moving the ../../../_tools/ paths to ../../_tools/. Lunar Pool (U) went through exactly that on 2026-10-18, and it needed header.s, chr.s and a HEADER/PRG/CHR linker.cfg before make could compare a whole ROM — a Pass-0 skeleton has none of the three.

Pyramid (U) is the only one with Pass 1 done. All 19 currently build cleanly.

Notable vector/header observations for Pass 1 work:

• Pac-Man (U) RESET at $FF00 (vector-page tail), while the Tengen variant RESETs at $C033 — different builds confirmed (PRG bytes differ).
• Lunar Pool (U) NMI $FF65 / IRQ $FF64 are adjacent in the vector page; RESET $E80C.
• NES PowerPad Test Card (U) — at Pass 2/3: minimal code (~7.2%), data-heavy test cartridge. RESET at $E000 (non-$C000 entry). NMI handler reads controllers via shift register, processes pad transitions, draws score/lives. See NES PowerPad Test Card (U)/OVERVIEW.md.
• Lunar Pool (U) — Pass 2 and Pass 3 complete; promoted to the top level 2026-10-18: RESET at $E80C (not $C000), NMI $FF65, IRQ $FF64 (a bare rti just before the NMI handler, so IRQs are ignored). There is no jmp ($7961) RAM-pointer gate (an earlier claim): those three sites fell out of decoding two bytes into the word "player". $CBDC/$CBC9 is a print-inline-string-and-return-after-it helper, so a jsr $CBDC is always followed by a $81-prefixed, $00-terminated string ("player", "shot", "game over", "hiscore__", "perfect_"). The split was re-derived from a Mesen CDL capture (10,028 bytes Code): now **5,300 instructions / 11,077 bytes (67.6%)**, 5,301 data bytes and the six vector bytes as .word. Pass 2 named all **705** labels — Label_is gone from the file — and Pass 3 named 33 tables plus the zero-page aliases (38 semantic, 66 neutral, ten former phantom aliases deleted). Residue, recorded rather than guessed: 73 bytes of *reachable* code are still.byte ($EA9A, $EADC, $EAE5, $EAED, $EB04, $EB16-$EB4F— the CDL capture never fetched them), another 75 bytes of ending-screen code sit at$F5F9-$F643, and ~206 bytes of unreached-but-clearly-code stubs stay data. The full 24,592-byte ROM (header + PRG + CHR) rebuilds byte-identically. See Lunar Pool (U)/OVERVIEW.md`.
• Ice Climber (JE) vs (U): byte-identical PRG and header — only the CHR differs (~regional title graphic).
• Popeye (JU) PRG 0 vs PRG 1: different PRG binaries (and mirroring); same vectors.
• Raid on Bungeling Bay (U) vs [a2]: [a2] differs in mirroring only per header, but PRGs differ — separate builds.
• Pyramid (U) — already at Pass 1: interesting unlicensed Sachen boot ($4100 mapper pokes, "AV" stack-byte check, two queued-event dispatchers). See its OVERVIEW.md.
• CIRCUS — at Pass 2/3: full recursive disassembly complete. NMI-driven frame state machine (main loop is a spin loop at $C057). Menu text at $C763 ("CONTINUE", "STAGE", "SELECT", "PLAY"). Object state machine at $DC3F–$FE7B. Audio sequence data at $FABB–$FFFB. See CIRCUS/OVERVIEW.md.
• Joypad Test Cartridge (U) — Pass 3 complete: minimal code (23.4%), data-heavy test cartridge. Data region $CF06–$FFFF broken into 20 named sub-blocks; VRAM command stream opcode set decoded via RetAddrUpdate return-address modification trick at $CDC8. See Joypad Test Cartridge (U)/OVERVIEW.md.
• Wild Gunman (U) — Pass 1 redone, Pass 2 partial, Pass 3 pending: NMI-driven frame loop. Gates its code behind runtime computed-goto tables — see the prg.s header block and its OVERVIEW.md.
• Mario Bros (JU) — Pass 1 complete (72.2% code), Pass 2 substantial: 252 subroutine entry points named (90 semantic + 165 SubCxxxx address-based); 667 internal Label_Cxxxx branch targets remain. Code is gated behind stack-based indirect dispatch at $CD9E and a 20-entry JSR thunk table at $C5A3. Audio routines in $F8xx-$F9xx clearly identifiable from APU register writes. See _wip/Mario Bros (JU)/OVERVIEW.md.

Common Patterns Across All Projects

Memory Map

Every project uses a single 16 KB PRG bank mapped at CPU $C000–$FFFF, with 8 KB CHR. All builds are NROM (no bank switching).

Interrupt Structure

All projects follow the same NES interrupt pattern:

• NMI fires once per frame and is the real-time heartbeat — handles OAM DMA, PPU updates, controller reading, and audio.
• RESET performs cold-start hardware init, RAM clearing, and enters the main loop.
• IRQ is almost always unused (either rti or a self-loop).

Two exceptions worth noting from branches of this family:

• Excitebike uses a state-dispatch table at $C000 rather than a conventional inline main loop, and its IRQ vector points into a data region (unused).
• Donkey Kong Jr. is the extreme case: its reset path idles forever in a PRNG-advance loop, and the entire frame state machine (title, attract, gameplay, sound) executes inside the NMI handler itself. Its reset entry is also at $C66E rather than $C000.

Build Toolchain

All projects use the same toolchain:

• ca65 (6502 assembler)
• ld65 (linker with .cfg memory map)
• All rebuilds are verified byte-identical to the original prg.bin / ROM PRG bank.

Disassembly Style

All sources are "Pass-1" style disassemblies:

• Every instruction annotated with PRG offset, CPU address, and emitted bytes
• Inline .byte/.word/.res data blocks interleaved with code
• Address-based labels (Label_Cxxxx, Sub_Cxxxx, EngineRoutine_Cxxxx) where semantics are not yet resolved
• Zero-page symbol files (locals.inc) and hardware symbol files (symbols.inc)

---

Navigation

Each project folder contains:

• copilot/ — disassembly source, build config, and build artifacts
• OVERVIEW.md (at the project folder root) — detailed per-project power-on execution flow analysis
• <rom>.nes — original NES ROM image (for reference)

To rebuild any project:

cd /home/tmerritt/Projects/disassembly/<Project>/copilot
make

To verify byte-identity:

make verify   # (where supported by the Makefile)

---

Pass 1 methodology note (2026-10-16)

The original Pass 1 disassembler had two limitations that silently understated code coverage. Both are worth knowing before trusting a coverage percentage:

1. Documented opcodes only. Its table held the 151 documented 6502 opcodes. These ROMs also use the 54 undocumented opcodes and the 26 unofficial NOPs as 2/3-byte padding; a tracer that halts on them strands the real code behind.
2. No runtime dispatch. It followed only vectors and direct jsr/jmp/branch targets. Games here dispatch through computed jumps — jmp ($0014), the pla-based inline-table gotos in Wild Gunman (Label_C341), and task tables like Donkey Kong Jr.'s DeferredTaskHandlerTable at $BFFE.

Effect measured per project (old tracer → complete-opcode dispatch-aware tracer):

Project	Old	Complete	Action taken
NES PowerPad Test Card (U)	546 instr	559	Pass 1 already sound
Joypad Test Cartridge (U)	282 instr	1,773	Pass 1 redone (23.4% code); Pass 2 complete; Pass 3 complete
Wild Gunman (U)	1,600 instr	4,083	Pass 1 redone (49.3% code)
Balloon Fight (JU)	5,216 instr	5,277	hand-done file was already better
Donkey Kong Jr. (JU)	6,135 instr	6,135	file already complete

Joypad Test Cartridge (U) was the last project carrying the old, truncated Pass 1, and has now been redone. Its recorded "3.5% code" was really 23.4%: the tracer stopped at $C09E on DCP $3C20 ($CF), an undocumented opcode used as ordinary code, and 3,256 bytes of real code were filed as .byte data. Redoing it also invalidated its Pass 3, which had described $C09E–$C173 and $C17F–$CCF6 as data — both are code. Pass 3 is now the outstanding work.

The fix generalises: nesdis.py --undocumented decodes all 105 undocumented NMOS opcodes. It is default off so that projects whose prg.s is already regen-stable keep reproducing byte-for-byte under make regen.

_tools/verify_pass1.py now checks all 36 projects. All are faithful; none is truncated. Its comment-spelling report used to claim that no project follows the canonical ; CPU:$xxxx PRG:xxxx AA BB audit-comment convention. That was a bug in the checker, not a fact about the sources: the canonical pattern ends with $ but was compiled without re.MULTILINE, so it could only ever match once — at end of file — and every project fell through to whichever laxer spelling matched most lines. Fixed. With re.M the true split across the 17 top-level projects is 8 canonical (CIRCUS, Excitebike, Joypad Test Cartridge, Lunar Pool, MUSCLE, NES PowerPad Test Card, Pac-Man (USA) (Namco), Wild Gunman), 3 pipe, 2 short, and one each of rom, bytes, colon and slash — so the checker sees seven distinct spellings across the repo, six of them non-canonical, with canonical dominant.

The old claim that "Excitebike and Pac-Man carry no byte comments at all" is stale too. Pac-Man (USA) (Namco) is complete (4,695/4,695 instructions commented); the two _wip/Pac-Man folders are 12-line .incbin Pass-0 skeletons with no disassembly to comment. The one real gap is Excitebike: 1,013 of its 5,376 instruction lines carry no audit comment, and that is now the whole of item 3 below.

Separately, verify_pass1.py's re-trace half crashes on MUSCLE (U) and Donkey Kong Jr. (JU) with ValueError: invalid literal for int() with base 16: ':$0010' (and ':$0002'). nesdis.trace() parses an emitted operand with int(text[1:], 16), but the a: prefix that the emitter adds to ABS/ABSY/ABSX/IND operands with a $00 high byte makes the text a:$0010 — so the slice starts on the colon. Any project containing jmp ($00xx) / jsr/jmp $00xx hits it. Not fixed here because nesdis.py feeds make regen, and MUSCLE's regen output must stay byte-stable.

TODO — audit comments for Excitebike and Pac-Man

Both are hand-written sources with semantic labels but no byte-identity audit trail, so a source line cannot be mapped back to exact ROM bytes without re-assembling. Everything else in this repo carries such a comment.

The approach that was going to be used, and the reason it was abandoned:

• Addresses come from ca65 -l. That part works — the listing prints the segment offset and the emitted bytes, and the offset indexes prg.bin directly. Byte values must be read from prg.bin rather than the listing, because ca65 prints rr rr for relocatable words.
• The blocker: ca65's listing contains no source line numbers. It emits <offset>r <n> <bytes> <source text> and nothing that ties an entry back to a line number, so entries cannot be keyed to source lines directly.

Remaining options, none of them free:

1. Lockstep text alignment — walk the listing and prg.s together, matching each listing entry's trailing source text against the next source line. Needs care: the listing may truncate long lines, and blank or comment-only source lines may not appear at all, so the two streams are not obviously 1:1.
2. Re-derive offsets by decoding prg.s independently — re-implement enough of ca65's layout to walk directives, macros and expression evaluation. High risk of disagreeing with ca65, and a disagreement would corrupt offsets silently while still assembling.
3. Emit an intermediate from a known-good tracer — regenerate both projects through nesdis.py for the comments only, then transplant the comments onto the hand-written source. Also needs a line-to-line correspondence.

Whichever is chosen, the check is the same and must not be skipped: after inserting comments, make must still print Byte-identical ROM verified., and the comment's byte list must match prg.bin at the stated offset for every line. A wrong offset that still assembles is the failure mode to watch for.

---

Summary

The 16 numbered projects below are promoted out of _wip/ and rebuild byte-identical to their original ROMs. The 20 _wip/ projects (rows 17-36) verify at PRG level only — see "_wip/ Projects" below.

#	Project	Build Status	Pass 3
1	Balloon Fight (JU)	BYTE-IDENTICAL	complete (Pass 1 verified)
2	Baseball (UE)	BYTE-IDENTICAL	complete
3	Bomberman (U)	BYTE-IDENTICAL	complete
4	Burger Time (U)	BYTE-IDENTICAL	complete
5	Clu Clu Land (JU)	BYTE-IDENTICAL	complete
6	Defender 2 (U)	BYTE-IDENTICAL	complete
7	Excitebike (JU)	BYTE-IDENTICAL	complete
8	Tennis (JU)	BYTE-IDENTICAL	complete
9	Pac-Man (USA) (Namco)	BYTE-IDENTICAL	complete
10	Donkey Kong 3 (JUE)	BYTE-IDENTICAL	complete
11	Donkey Kong Jr. (JU)	BYTE-IDENTICAL	complete (Pass 1 verified)
12	CIRCUS	BYTE-IDENTICAL	complete
13	Wild Gunman (U)	BYTE-IDENTICAL	pending (Pass 1 redone)
14	Joypad Test Cartridge (U)	BYTE-IDENTICAL	Pass 3 complete
15	NES PowerPad Test Card (U)	BYTE-IDENTICAL	complete
16	MUSCLE (U)	BYTE-IDENTICAL	complete

Rows 17-36 (_wip/) all rebuild cleanly at PRG level. Pyramid (U) is the only one with Pass 1 done. Pass 1 work and promotion into the numbered inventory is future work for all of them.

Use _tools/verify_pass1.py to re-check any of this at any time; it rebuilds each project and re-traces it, and reports TRUNCATED when a project's committed split claims less code than the tracer can reach.