Famicom Network System (aka Famicom Modem) Investigations

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

lidnariq
Posts: 10095
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by lidnariq » Sat Jan 09, 2021 1:37 pm

Yeah, that.

The only reference I've found is this one about BT telephone lines: https://www.britishtelephones.com/howtele.htm

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Sat Jan 09, 2021 2:06 pm

Thanks for the info and the link. I am a little nervous about it still but I will see what I can come up with.

Edit:
I wonder if I can use a VoIP adapter? This is probably going to generate a North America style dial tone but maybe that's OK?? I am looking into it.

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Sat Jan 09, 2021 7:00 pm

Looking more at the byte counts of the first 2 columns of connection data:
byte counts.png
The byte count of the top one is 0x13, and the bottom one is 0x20. Assuming that it is a 16-bit little-endian byte count, shown are selections of this size. The top one is for some reason 2 extra bytes and the bottom one 1 extra byte. This coincides with the number of % symbols in each. Suggesting that % may be a delimiter or escape sequence token.

"B1", at the beginning of the selection in each, happens to be a Modem AT command, as seen here:

https://michaelgellis.tripod.com/modem.html

In that case the command would be "Select Bell 212A (1200 bps)". Coincidentally, this is a 1200 baud modem if I am not mistaken.

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Mon Jan 11, 2021 8:05 pm

I improved my register capture gizmo tonight. Before, it was totally asynchronous, so at any time the address bus was changing, there was a chance I would get triggers. To fix that, I put my output through an additional 74LS74 D-flip-flop, which will pass address matches through only on the rising edge of M2. I found that I needed an additional delay on M2 rising edge in order for /ROMSEL to fully propagate through my existing logic. To do this, I used a circuit similar to krzysiobal's "Fixing Chinese SMB2J" RAM /CE circuit:

Code: Select all

M2 --+--|<|---+---+-- 74LS74 Clock Input
     |        |   |
     +--7.5k--+  56p
                  |
                 GND
This gives a delay of ~100nsec and prevents trips when executing code at $CxD0 when set to trigger $4xD0. It seems to work very well with these modifications. When I wanted to trigger only on writes, I was able to set my scope with logic trigger with this signal and CPU R/W both low to trigger, and that worked really well.

-----

I am finding very different messages being sent when PiT Motorboat Race makes and breaks connections:
PiT Motorboat Race wrote:Option Right, Right, 1111111111
Connect:
69 0A 00 00 04 14 1D 28 80 00 30 26 21 00 00
Disconnect:
64 01 00 02 A9 31

Option Right, Left, 2222, 1111111111
Connect:
69 0A 00 00 04 14 1D 28 80 00 30 26 21 00 00
Disconnect:
64 01 00 02 A9 32

Option Left, Right, 1111111111
Connect:
69 0A 00 00 04 14 1D 28 80 00 30 26 21 00 00
Disconnect:
64 01 00 02 A9 30

Option Left, Left, 2222, 1111111111
Connect:
69 0A 00 00 04 14 1D 28 80 00 30 26 21 00 00
Disconnect:
64 01 00 02 A9 30

These don't translate well into ASCII, unlike Super Mario Club. I have to say, I am surprised how very different the message is and not yet sure what to make of it.

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Tue Jan 12, 2021 8:31 pm

Here are more connect/disconnect sequences:
Heart no Benrikun Mini wrote: Connect:
00 13 00 42 31 20 36 33 57 30 36 30 33 31 33 35 38 35 35 24 67 25 37 31
ASCII: "...B1 63W0603135855$g%71"

Disconnect:
65 02 00 02 00 20
ASCII: "e.... "
This one blows away the theory about the byte counts not including %'s. This one's byte count is 2 larger than the number of bytes sent, and there is only 1 percent. I double-checked the "$" and also retriggered the scope again to make sure.

I was going to try finding JRA-PAT's sequences but I forgot to bring my microwire EEPROM and the game won't boot up past an error screen without that.

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Wed Jan 13, 2021 5:37 pm

JRA-PAT rev 05 wrote: Connect:
00 0F 00 88 30 42 30 20 36 34 32 35 36 34 36 36 36 24
ASCII: "...ˆ0B0 642564666$"

Disconnect:
01 01 00 01 30 42
ASCII: "....0B"
I find that this part of the connect message comes directly from the microwire EEPROM data:
0 642564666

This is either range 0x13-1C or 0x23-2C of the EEPROM, with that space added after the first digit. I tried modifying each line in the EEPROM data to see which one it is and JRA-PAT detects that as a corrupted EEPROM. Modifying just 1 digit the same in both lines still detects corrupted EEPROM, so maybe there is a checksum or range check, etc. In that mode, I get a configuration screen:
jra_config.jpg
I entered values:
11111111
2222
3333
44
55
6666666666

When I connect this way:
JRA-PAT rev 05 wrote: Connect:
00 0F 00 42 36 20 36 36 36 36 36 36 36 36 36 24 67 25
ASCII: "...B6 666666666$g%"

Disconnect:
01 01 00 01 30 42
ASCII: "....0B"
JRA-PAT is also adding that space after the first digit again like it did compared to the original microwire EEPROM data.

The Japanese text of the 6's translates as "Registration Center Number". The EEPROM does not get written back to when attempting this. Maybe it has to have a successful connection before writing it.

lidnariq
Posts: 10095
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by lidnariq » Wed Jan 13, 2021 5:44 pm

Apparently I've accidentally learned enough kanji/hanzi to recognize what you entered as 3333 44 55 as marking Year Month Day. ... apparently they used birthdate as an extra authentication factor? feels bad in a modern security context.

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Wed Jan 13, 2021 10:12 pm

That's pretty funny. Back then that probably literally WAS secure to do things like that and trust your 8-bit Nintendo to your bank account and gambling addictions. Those were the days.

I have been thinking more about how I saw constant activity when looking at the control signals going to the RF5A18's RAM. I like to think that there is a processor running in there, that would be pretty cool. I want to snoop the address and data bus connected to that RAM chip and record some stuff. It may well be that pins 15,16,17 are in fact A13, A14, A15 potentially revealing a full 16-bit address bus. I would be pretty intrigued to see it accessing internal ROM data (i.e. RAM /CE high with data on the bus...) As it is, the only external thing connected to that separate address and data bus is U6: 8kbyte SRAM chip. Thank goodness they didn't use a DRAM like the FDS. It will also be interesting to see if the messages being sent over through $40D0,1,2,3 (i.e. the stuff I have been sharing lately) is being written into the RAM, and if so at what addresses. That will probably be next week due to a snow storm coming here tomorrow.

Fiskbit
Posts: 239
Joined: Sat Nov 18, 2017 9:15 pm

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Fiskbit » Thu Jan 14, 2021 1:04 am

According to this article, the modem did have some reasonable security functionality (public key encryption), but it went unused.

Also included in that article is a block diagram of the modem. I don't know how accurate it is, but it does show LSI-1 (the RF5A18?) having a CPU in it. I've attached a copy of the diagram for preservation purposes.
Attachments
fig_2.jpg

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Thu Jan 14, 2021 11:27 am

Wow, that is really great info. LSI-1 is the RF5A18, sure enough with internal CPU. Interesting to see LSI-2 (RF5C66) containing "Disk Drive Interface". There have been a few things found very similar to FDS. Though I don't see the RAM or ROM necessary for FDS unless it is lurking somewhere inside the 5C66, or intended to be in a card. I have wondered if one of the expansion pins is an input that "enables" FDS mode somehow. Lots of unknowns there but neat to think about.

There are quite a few logic pins tied directly low or high on the 5A18. It will be neat to see if one of them can turn the address bus as input and make the internal ROM dumpable. Hopefully it is a 6502 CPU or at least something common. I have not yet gotten this chip fully hooked up for bench test. If it is a 6502 and uses any indirect pointer like LDA ($0000),Y, I can probably build something to fudge that RAM $00,01 to grab from anywhere in memory and get a dump byte-by-byte that way. But I am getting WAY ahead of myself. I need to start with just looking what is on the address and data bus of the RAM and go from there.

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Mon Jan 18, 2021 10:24 pm

Very interesting stuff found tonight.

With one of my test programs running on the Famicom modem, I found NO activity on the address bus of the 5A18, which was extremely discouraging. I then reflashed the card to PiT Motorboat Race and it did come to life. There must be a signal from the 5C66 that enables the CPU to run in the 5A18. (probably held in reset)

Right away, I found it fetching its own reset vector from its own internal ROM at addresses $FFFC, FFFD. That was exciting. Since my scope is only 16-bit logic analyzer, I borrowed another one from nearby so that I can trigger them the same and read 32 bits data. (i.e. entire address and data bus). Those 3 extra pins 15,16,17 of the 5A18 are in fact A13, A14, A15, thank goodness. I used EXP 16 as master clock. This clock is 2x the instruction clock. (It acts just like M2 of the Famicom but toggling twice as many times per instruction.) Here is the data that I was able to get so far:

Code: Select all

ROM data observed:

F36F: A9
F370: CF 85 FF 78 D8 A9 00 8D 2F 41 64 FE 64 FD A9 00
F380: A2 20 A0 FC 91 FD 88 D0 FB E6 FE CA D0 F6 20 7D
F390: FD

FD7D: A9 E0 85
FD80: 01 64 00 64 83 64 82 A0 00 18 85 83 71 00 85 83
FD90: A5 82 69 00 85 82 C8 D0 F0 E6 01 D0 EC 60

FFFC: 6F F3 (Reset Vector)


Disassembled:

At $F36F:
A9 CF     LDA #$6F
85 FF     STA $00FF
78        SEI
D8        CLD
A9 00     LDA #$00
8D 2F 41  STA $412F  ; Unknown register write
64 FE     STZ $00FE  ; which indeed wrote $00 to RAM address $00FE, indicating this is a 65C816
64 FD     STZ $00FD
A9 00     LDA #$00
A2 20     LDX #$20
A0 FC     LDY #$FC
loop1:
91 FD     STA ($00FD),Y
88        DEY
D0 FB     BNE loop1
E6 FE     INC $00FE
CA        DEX
D0 F6     BNE loop1

20 7D FD  JSR $FD7D  ; Wrote return address to stack $F3 -> $01FA, $90 -> $01F9


At $FD7D:
A9 E0     LDA #$E0
85 01     STA $0001
64 00     STZ $0000
64 83     STZ $0083
64 82     STZ $0082
A0 00     LDY #$00
loop2:
18        CLC
85 83     STA $0083
71 00     ADC ($0000),Y
85 83     STA $0083
A5 82     LDA $0082
69 00     ADC #$00
85 82     STA $0082
C8        INY
D0 F0     BNE loop2
E6 01     INC $0001
D0 EC     BNE loop2
60        RTS        ; <-- Can modify stack so that it returns from this point to an arbitrary location to run ROM dump code and test for registers, etc.
It uses the op-code $64 (STZ), which tells us this is actually a 65C816 or something, pretty wild to see that happen. I have enough code dumped here to:
  • Know where the first JSR is, and where it wrote that in the stack
  • Know that I need value $00 at RAM location $0001 to exit the last loop
  • Know where the RTS is
This information will allow me to build a ROM in such a way as to to replace the RAM chip. The ROM can contain an arbitrary address hard-coded in the stack, which can point to some arbitrary code. (i.e. As soon as it hits that RTS, it will jump to the arbitrary code.) That code can then just sequentially read all memory in a loop. I can set my address catcher gizmo to any starting point and trigger the scope. This may take a lot of triggers to get all the data, but it should be possible to get it all this way. My scope has "Event Table" option that will allow me to save the data to CSV file. There will be lots of op-codes mixed in, but since it will be always the same pattern, I can build an Excel spreadsheet that filters out all the opcodes, etc, leaving only the data remaining.

So my next steps:
  • Disable RAM U6, either with /OE high or +CE low (those pins normally tied to rails)
  • Add ROM chip socket to the interface board I made for the logic analyzer
  • /CE from RAM (5A18.21) goes to /CE of this ROM
  • /WR (5A18.20) better disable the ROM when low to prevent bus conflict (probably invert and connect to /OE)
  • RF5A18 Test program

Edit:
Come to think of it, I probably need $FF at RAM location $0001 in order to exit the loop. (Inc value FF => 00, 0 exits loop.)

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Tue Jan 19, 2021 11:34 pm

My plan to replace the RAM with ROM did end up successful. I can dump $800 bytes at a time this way. My code is very verbatim so as to have easy cycle counts which makes it easier to filter out op-codes in Excel. My scope can only capture 100,000 cycles. I also found that 5A18 pin 23 is the "M2" of this CPU. Here is my test code:

Code: Select all

START_ADDR EQU $4800

org $0000
fillvalue $FF
pad $01F9 ; return address location in stack

DW $0200 ; injected return address

fillvalue $FF
pad $0200

arbitrary_entry:
    lda $0000  ; Scope Trigger

    lda START_ADDR + $0000
    lda START_ADDR + $0001
    lda START_ADDR + $0002
    lda START_ADDR + $0003
    lda START_ADDR + $0004
    lda START_ADDR + $0005
    lda START_ADDR + $0006
    lda START_ADDR + $0007
    lda START_ADDR + $0008
    lda START_ADDR + $0009
    lda START_ADDR + $000A
    lda START_ADDR + $000B
    lda START_ADDR + $000C
    lda START_ADDR + $000D
    lda START_ADDR + $000E
    lda START_ADDR + $000F
    lda START_ADDR + $0010
    lda START_ADDR + $0011
    lda START_ADDR + $0012
    lda START_ADDR + $0013
    lda START_ADDR + $0014
    lda START_ADDR + $0015
    lda START_ADDR + $0016
    lda START_ADDR + $0017
    lda START_ADDR + $0018
    lda START_ADDR + $0019
    lda START_ADDR + $001A
    lda START_ADDR + $001B
    lda START_ADDR + $001C
    lda START_ADDR + $001D
    lda START_ADDR + $001E
    lda START_ADDR + $001F
    lda START_ADDR + $0020
    lda START_ADDR + $0021
    lda START_ADDR + $0022
    lda START_ADDR + $0023
    lda START_ADDR + $0024
    lda START_ADDR + $0025
    lda START_ADDR + $0026
    lda START_ADDR + $0027
    lda START_ADDR + $0028
    lda START_ADDR + $0029
    lda START_ADDR + $002A
    lda START_ADDR + $002B
    lda START_ADDR + $002C
    lda START_ADDR + $002D
    lda START_ADDR + $002E
    lda START_ADDR + $002F
    lda START_ADDR + $0030
    lda START_ADDR + $0031
    lda START_ADDR + $0032
    lda START_ADDR + $0033
    lda START_ADDR + $0034
    lda START_ADDR + $0035
    lda START_ADDR + $0036
    lda START_ADDR + $0037
    lda START_ADDR + $0038
    lda START_ADDR + $0039
    lda START_ADDR + $003A
    lda START_ADDR + $003B
    lda START_ADDR + $003C
    lda START_ADDR + $003D
    lda START_ADDR + $003E
    lda START_ADDR + $003F
    lda START_ADDR + $0040
    lda START_ADDR + $0041
    lda START_ADDR + $0042
    lda START_ADDR + $0043
    lda START_ADDR + $0044
    lda START_ADDR + $0045
    lda START_ADDR + $0046
    lda START_ADDR + $0047
    lda START_ADDR + $0048
    lda START_ADDR + $0049
    lda START_ADDR + $004A
    lda START_ADDR + $004B
    lda START_ADDR + $004C
    lda START_ADDR + $004D
    lda START_ADDR + $004E
    lda START_ADDR + $004F
    lda START_ADDR + $0050
    lda START_ADDR + $0051
    lda START_ADDR + $0052
    lda START_ADDR + $0053
    lda START_ADDR + $0054
    lda START_ADDR + $0055
    lda START_ADDR + $0056
    lda START_ADDR + $0057
    lda START_ADDR + $0058
    lda START_ADDR + $0059
    lda START_ADDR + $005A
    lda START_ADDR + $005B
    lda START_ADDR + $005C
    lda START_ADDR + $005D
    lda START_ADDR + $005E
    lda START_ADDR + $005F
    lda START_ADDR + $0060
    lda START_ADDR + $0061
    lda START_ADDR + $0062
    lda START_ADDR + $0063
    lda START_ADDR + $0064
    lda START_ADDR + $0065
    lda START_ADDR + $0066
    lda START_ADDR + $0067
    lda START_ADDR + $0068
    lda START_ADDR + $0069
    lda START_ADDR + $006A
    lda START_ADDR + $006B
    lda START_ADDR + $006C
    lda START_ADDR + $006D
    lda START_ADDR + $006E
    lda START_ADDR + $006F
    lda START_ADDR + $0070
    lda START_ADDR + $0071
    lda START_ADDR + $0072
    lda START_ADDR + $0073
    lda START_ADDR + $0074
    lda START_ADDR + $0075
    lda START_ADDR + $0076
    lda START_ADDR + $0077
    lda START_ADDR + $0078
    lda START_ADDR + $0079
    lda START_ADDR + $007A
    lda START_ADDR + $007B
    lda START_ADDR + $007C
    lda START_ADDR + $007D
    lda START_ADDR + $007E
    lda START_ADDR + $007F
    lda START_ADDR + $0080
    lda START_ADDR + $0081
    lda START_ADDR + $0082
    lda START_ADDR + $0083
    lda START_ADDR + $0084
    lda START_ADDR + $0085
    lda START_ADDR + $0086
    lda START_ADDR + $0087
    lda START_ADDR + $0088
    lda START_ADDR + $0089
    lda START_ADDR + $008A
    lda START_ADDR + $008B
    lda START_ADDR + $008C
    lda START_ADDR + $008D
    lda START_ADDR + $008E
    lda START_ADDR + $008F
    lda START_ADDR + $0090
    lda START_ADDR + $0091
    lda START_ADDR + $0092
    lda START_ADDR + $0093
    lda START_ADDR + $0094
    lda START_ADDR + $0095
    lda START_ADDR + $0096
    lda START_ADDR + $0097
    lda START_ADDR + $0098
    lda START_ADDR + $0099
    lda START_ADDR + $009A
    lda START_ADDR + $009B
    lda START_ADDR + $009C
    lda START_ADDR + $009D
    lda START_ADDR + $009E
    lda START_ADDR + $009F
    lda START_ADDR + $00A0
    lda START_ADDR + $00A1
    lda START_ADDR + $00A2
    lda START_ADDR + $00A3
    lda START_ADDR + $00A4
    lda START_ADDR + $00A5
    lda START_ADDR + $00A6
    lda START_ADDR + $00A7
    lda START_ADDR + $00A8
    lda START_ADDR + $00A9
    lda START_ADDR + $00AA
    lda START_ADDR + $00AB
    lda START_ADDR + $00AC
    lda START_ADDR + $00AD
    lda START_ADDR + $00AE
    lda START_ADDR + $00AF
    lda START_ADDR + $00B0
    lda START_ADDR + $00B1
    lda START_ADDR + $00B2
    lda START_ADDR + $00B3
    lda START_ADDR + $00B4
    lda START_ADDR + $00B5
    lda START_ADDR + $00B6
    lda START_ADDR + $00B7
    lda START_ADDR + $00B8
    lda START_ADDR + $00B9
    lda START_ADDR + $00BA
    lda START_ADDR + $00BB
    lda START_ADDR + $00BC
    lda START_ADDR + $00BD
    lda START_ADDR + $00BE
    lda START_ADDR + $00BF
    lda START_ADDR + $00C0
    lda START_ADDR + $00C1
    lda START_ADDR + $00C2
    lda START_ADDR + $00C3
    lda START_ADDR + $00C4
    lda START_ADDR + $00C5
    lda START_ADDR + $00C6
    lda START_ADDR + $00C7
    lda START_ADDR + $00C8
    lda START_ADDR + $00C9
    lda START_ADDR + $00CA
    lda START_ADDR + $00CB
    lda START_ADDR + $00CC
    lda START_ADDR + $00CD
    lda START_ADDR + $00CE
    lda START_ADDR + $00CF
    lda START_ADDR + $00D0
    lda START_ADDR + $00D1
    lda START_ADDR + $00D2
    lda START_ADDR + $00D3
    lda START_ADDR + $00D4
    lda START_ADDR + $00D5
    lda START_ADDR + $00D6
    lda START_ADDR + $00D7
    lda START_ADDR + $00D8
    lda START_ADDR + $00D9
    lda START_ADDR + $00DA
    lda START_ADDR + $00DB
    lda START_ADDR + $00DC
    lda START_ADDR + $00DD
    lda START_ADDR + $00DE
    lda START_ADDR + $00DF
    lda START_ADDR + $00E0
    lda START_ADDR + $00E1
    lda START_ADDR + $00E2
    lda START_ADDR + $00E3
    lda START_ADDR + $00E4
    lda START_ADDR + $00E5
    lda START_ADDR + $00E6
    lda START_ADDR + $00E7
    lda START_ADDR + $00E8
    lda START_ADDR + $00E9
    lda START_ADDR + $00EA
    lda START_ADDR + $00EB
    lda START_ADDR + $00EC
    lda START_ADDR + $00ED
    lda START_ADDR + $00EE
    lda START_ADDR + $00EF
    lda START_ADDR + $00F0
    lda START_ADDR + $00F1
    lda START_ADDR + $00F2
    lda START_ADDR + $00F3
    lda START_ADDR + $00F4
    lda START_ADDR + $00F5
    lda START_ADDR + $00F6
    lda START_ADDR + $00F7
    lda START_ADDR + $00F8
    lda START_ADDR + $00F9
    lda START_ADDR + $00FA
    lda START_ADDR + $00FB
    lda START_ADDR + $00FC
    lda START_ADDR + $00FD
    lda START_ADDR + $00FE
    lda START_ADDR + $00FF
    lda START_ADDR + $0100
    lda START_ADDR + $0101
    lda START_ADDR + $0102
    lda START_ADDR + $0103
    lda START_ADDR + $0104
    lda START_ADDR + $0105
    lda START_ADDR + $0106
    lda START_ADDR + $0107
    lda START_ADDR + $0108
    lda START_ADDR + $0109
    lda START_ADDR + $010A
    lda START_ADDR + $010B
    lda START_ADDR + $010C
    lda START_ADDR + $010D
    lda START_ADDR + $010E
    lda START_ADDR + $010F
    lda START_ADDR + $0110
    lda START_ADDR + $0111
    lda START_ADDR + $0112
    lda START_ADDR + $0113
    lda START_ADDR + $0114
    lda START_ADDR + $0115
    lda START_ADDR + $0116
    lda START_ADDR + $0117
    lda START_ADDR + $0118
    lda START_ADDR + $0119
    lda START_ADDR + $011A
    lda START_ADDR + $011B
    lda START_ADDR + $011C
    lda START_ADDR + $011D
    lda START_ADDR + $011E
    lda START_ADDR + $011F
    lda START_ADDR + $0120
    lda START_ADDR + $0121
    lda START_ADDR + $0122
    lda START_ADDR + $0123
    lda START_ADDR + $0124
    lda START_ADDR + $0125
    lda START_ADDR + $0126
    lda START_ADDR + $0127
    lda START_ADDR + $0128
    lda START_ADDR + $0129
    lda START_ADDR + $012A
    lda START_ADDR + $012B
    lda START_ADDR + $012C
    lda START_ADDR + $012D
    lda START_ADDR + $012E
    lda START_ADDR + $012F
    lda START_ADDR + $0130
    lda START_ADDR + $0131
    lda START_ADDR + $0132
    lda START_ADDR + $0133
    lda START_ADDR + $0134
    lda START_ADDR + $0135
    lda START_ADDR + $0136
    lda START_ADDR + $0137
    lda START_ADDR + $0138
    lda START_ADDR + $0139
    lda START_ADDR + $013A
    lda START_ADDR + $013B
    lda START_ADDR + $013C
    lda START_ADDR + $013D
    lda START_ADDR + $013E
    lda START_ADDR + $013F
    lda START_ADDR + $0140
    lda START_ADDR + $0141
    lda START_ADDR + $0142
    lda START_ADDR + $0143
    lda START_ADDR + $0144
    lda START_ADDR + $0145
    lda START_ADDR + $0146
    lda START_ADDR + $0147
    lda START_ADDR + $0148
    lda START_ADDR + $0149
    lda START_ADDR + $014A
    lda START_ADDR + $014B
    lda START_ADDR + $014C
    lda START_ADDR + $014D
    lda START_ADDR + $014E
    lda START_ADDR + $014F
    lda START_ADDR + $0150
    lda START_ADDR + $0151
    lda START_ADDR + $0152
    lda START_ADDR + $0153
    lda START_ADDR + $0154
    lda START_ADDR + $0155
    lda START_ADDR + $0156
    lda START_ADDR + $0157
    lda START_ADDR + $0158
    lda START_ADDR + $0159
    lda START_ADDR + $015A
    lda START_ADDR + $015B
    lda START_ADDR + $015C
    lda START_ADDR + $015D
    lda START_ADDR + $015E
    lda START_ADDR + $015F
    lda START_ADDR + $0160
    lda START_ADDR + $0161
    lda START_ADDR + $0162
    lda START_ADDR + $0163
    lda START_ADDR + $0164
    lda START_ADDR + $0165
    lda START_ADDR + $0166
    lda START_ADDR + $0167
    lda START_ADDR + $0168
    lda START_ADDR + $0169
    lda START_ADDR + $016A
    lda START_ADDR + $016B
    lda START_ADDR + $016C
    lda START_ADDR + $016D
    lda START_ADDR + $016E
    lda START_ADDR + $016F
    lda START_ADDR + $0170
    lda START_ADDR + $0171
    lda START_ADDR + $0172
    lda START_ADDR + $0173
    lda START_ADDR + $0174
    lda START_ADDR + $0175
    lda START_ADDR + $0176
    lda START_ADDR + $0177
    lda START_ADDR + $0178
    lda START_ADDR + $0179
    lda START_ADDR + $017A
    lda START_ADDR + $017B
    lda START_ADDR + $017C
    lda START_ADDR + $017D
    lda START_ADDR + $017E
    lda START_ADDR + $017F
    lda START_ADDR + $0180
    lda START_ADDR + $0181
    lda START_ADDR + $0182
    lda START_ADDR + $0183
    lda START_ADDR + $0184
    lda START_ADDR + $0185
    lda START_ADDR + $0186
    lda START_ADDR + $0187
    lda START_ADDR + $0188
    lda START_ADDR + $0189
    lda START_ADDR + $018A
    lda START_ADDR + $018B
    lda START_ADDR + $018C
    lda START_ADDR + $018D
    lda START_ADDR + $018E
    lda START_ADDR + $018F
    lda START_ADDR + $0190
    lda START_ADDR + $0191
    lda START_ADDR + $0192
    lda START_ADDR + $0193
    lda START_ADDR + $0194
    lda START_ADDR + $0195
    lda START_ADDR + $0196
    lda START_ADDR + $0197
    lda START_ADDR + $0198
    lda START_ADDR + $0199
    lda START_ADDR + $019A
    lda START_ADDR + $019B
    lda START_ADDR + $019C
    lda START_ADDR + $019D
    lda START_ADDR + $019E
    lda START_ADDR + $019F
    lda START_ADDR + $01A0
    lda START_ADDR + $01A1
    lda START_ADDR + $01A2
    lda START_ADDR + $01A3
    lda START_ADDR + $01A4
    lda START_ADDR + $01A5
    lda START_ADDR + $01A6
    lda START_ADDR + $01A7
    lda START_ADDR + $01A8
    lda START_ADDR + $01A9
    lda START_ADDR + $01AA
    lda START_ADDR + $01AB
    lda START_ADDR + $01AC
    lda START_ADDR + $01AD
    lda START_ADDR + $01AE
    lda START_ADDR + $01AF
    lda START_ADDR + $01B0
    lda START_ADDR + $01B1
    lda START_ADDR + $01B2
    lda START_ADDR + $01B3
    lda START_ADDR + $01B4
    lda START_ADDR + $01B5
    lda START_ADDR + $01B6
    lda START_ADDR + $01B7
    lda START_ADDR + $01B8
    lda START_ADDR + $01B9
    lda START_ADDR + $01BA
    lda START_ADDR + $01BB
    lda START_ADDR + $01BC
    lda START_ADDR + $01BD
    lda START_ADDR + $01BE
    lda START_ADDR + $01BF
    lda START_ADDR + $01C0
    lda START_ADDR + $01C1
    lda START_ADDR + $01C2
    lda START_ADDR + $01C3
    lda START_ADDR + $01C4
    lda START_ADDR + $01C5
    lda START_ADDR + $01C6
    lda START_ADDR + $01C7
    lda START_ADDR + $01C8
    lda START_ADDR + $01C9
    lda START_ADDR + $01CA
    lda START_ADDR + $01CB
    lda START_ADDR + $01CC
    lda START_ADDR + $01CD
    lda START_ADDR + $01CE
    lda START_ADDR + $01CF
    lda START_ADDR + $01D0
    lda START_ADDR + $01D1
    lda START_ADDR + $01D2
    lda START_ADDR + $01D3
    lda START_ADDR + $01D4
    lda START_ADDR + $01D5
    lda START_ADDR + $01D6
    lda START_ADDR + $01D7
    lda START_ADDR + $01D8
    lda START_ADDR + $01D9
    lda START_ADDR + $01DA
    lda START_ADDR + $01DB
    lda START_ADDR + $01DC
    lda START_ADDR + $01DD
    lda START_ADDR + $01DE
    lda START_ADDR + $01DF
    lda START_ADDR + $01E0
    lda START_ADDR + $01E1
    lda START_ADDR + $01E2
    lda START_ADDR + $01E3
    lda START_ADDR + $01E4
    lda START_ADDR + $01E5
    lda START_ADDR + $01E6
    lda START_ADDR + $01E7
    lda START_ADDR + $01E8
    lda START_ADDR + $01E9
    lda START_ADDR + $01EA
    lda START_ADDR + $01EB
    lda START_ADDR + $01EC
    lda START_ADDR + $01ED
    lda START_ADDR + $01EE
    lda START_ADDR + $01EF
    lda START_ADDR + $01F0
    lda START_ADDR + $01F1
    lda START_ADDR + $01F2
    lda START_ADDR + $01F3
    lda START_ADDR + $01F4
    lda START_ADDR + $01F5
    lda START_ADDR + $01F6
    lda START_ADDR + $01F7
    lda START_ADDR + $01F8
    lda START_ADDR + $01F9
    lda START_ADDR + $01FA
    lda START_ADDR + $01FB
    lda START_ADDR + $01FC
    lda START_ADDR + $01FD
    lda START_ADDR + $01FE
    lda START_ADDR + $01FF
    lda START_ADDR + $0200
    lda START_ADDR + $0201
    lda START_ADDR + $0202
    lda START_ADDR + $0203
    lda START_ADDR + $0204
    lda START_ADDR + $0205
    lda START_ADDR + $0206
    lda START_ADDR + $0207
    lda START_ADDR + $0208
    lda START_ADDR + $0209
    lda START_ADDR + $020A
    lda START_ADDR + $020B
    lda START_ADDR + $020C
    lda START_ADDR + $020D
    lda START_ADDR + $020E
    lda START_ADDR + $020F
    lda START_ADDR + $0210
    lda START_ADDR + $0211
    lda START_ADDR + $0212
    lda START_ADDR + $0213
    lda START_ADDR + $0214
    lda START_ADDR + $0215
    lda START_ADDR + $0216
    lda START_ADDR + $0217
    lda START_ADDR + $0218
    lda START_ADDR + $0219
    lda START_ADDR + $021A
    lda START_ADDR + $021B
    lda START_ADDR + $021C
    lda START_ADDR + $021D
    lda START_ADDR + $021E
    lda START_ADDR + $021F
    lda START_ADDR + $0220
    lda START_ADDR + $0221
    lda START_ADDR + $0222
    lda START_ADDR + $0223
    lda START_ADDR + $0224
    lda START_ADDR + $0225
    lda START_ADDR + $0226
    lda START_ADDR + $0227
    lda START_ADDR + $0228
    lda START_ADDR + $0229
    lda START_ADDR + $022A
    lda START_ADDR + $022B
    lda START_ADDR + $022C
    lda START_ADDR + $022D
    lda START_ADDR + $022E
    lda START_ADDR + $022F
    lda START_ADDR + $0230
    lda START_ADDR + $0231
    lda START_ADDR + $0232
    lda START_ADDR + $0233
    lda START_ADDR + $0234
    lda START_ADDR + $0235
    lda START_ADDR + $0236
    lda START_ADDR + $0237
    lda START_ADDR + $0238
    lda START_ADDR + $0239
    lda START_ADDR + $023A
    lda START_ADDR + $023B
    lda START_ADDR + $023C
    lda START_ADDR + $023D
    lda START_ADDR + $023E
    lda START_ADDR + $023F
    lda START_ADDR + $0240
    lda START_ADDR + $0241
    lda START_ADDR + $0242
    lda START_ADDR + $0243
    lda START_ADDR + $0244
    lda START_ADDR + $0245
    lda START_ADDR + $0246
    lda START_ADDR + $0247
    lda START_ADDR + $0248
    lda START_ADDR + $0249
    lda START_ADDR + $024A
    lda START_ADDR + $024B
    lda START_ADDR + $024C
    lda START_ADDR + $024D
    lda START_ADDR + $024E
    lda START_ADDR + $024F
    lda START_ADDR + $0250
    lda START_ADDR + $0251
    lda START_ADDR + $0252
    lda START_ADDR + $0253
    lda START_ADDR + $0254
    lda START_ADDR + $0255
    lda START_ADDR + $0256
    lda START_ADDR + $0257
    lda START_ADDR + $0258
    lda START_ADDR + $0259
    lda START_ADDR + $025A
    lda START_ADDR + $025B
    lda START_ADDR + $025C
    lda START_ADDR + $025D
    lda START_ADDR + $025E
    lda START_ADDR + $025F
    lda START_ADDR + $0260
    lda START_ADDR + $0261
    lda START_ADDR + $0262
    lda START_ADDR + $0263
    lda START_ADDR + $0264
    lda START_ADDR + $0265
    lda START_ADDR + $0266
    lda START_ADDR + $0267
    lda START_ADDR + $0268
    lda START_ADDR + $0269
    lda START_ADDR + $026A
    lda START_ADDR + $026B
    lda START_ADDR + $026C
    lda START_ADDR + $026D
    lda START_ADDR + $026E
    lda START_ADDR + $026F
    lda START_ADDR + $0270
    lda START_ADDR + $0271
    lda START_ADDR + $0272
    lda START_ADDR + $0273
    lda START_ADDR + $0274
    lda START_ADDR + $0275
    lda START_ADDR + $0276
    lda START_ADDR + $0277
    lda START_ADDR + $0278
    lda START_ADDR + $0279
    lda START_ADDR + $027A
    lda START_ADDR + $027B
    lda START_ADDR + $027C
    lda START_ADDR + $027D
    lda START_ADDR + $027E
    lda START_ADDR + $027F
    lda START_ADDR + $0280
    lda START_ADDR + $0281
    lda START_ADDR + $0282
    lda START_ADDR + $0283
    lda START_ADDR + $0284
    lda START_ADDR + $0285
    lda START_ADDR + $0286
    lda START_ADDR + $0287
    lda START_ADDR + $0288
    lda START_ADDR + $0289
    lda START_ADDR + $028A
    lda START_ADDR + $028B
    lda START_ADDR + $028C
    lda START_ADDR + $028D
    lda START_ADDR + $028E
    lda START_ADDR + $028F
    lda START_ADDR + $0290
    lda START_ADDR + $0291
    lda START_ADDR + $0292
    lda START_ADDR + $0293
    lda START_ADDR + $0294
    lda START_ADDR + $0295
    lda START_ADDR + $0296
    lda START_ADDR + $0297
    lda START_ADDR + $0298
    lda START_ADDR + $0299
    lda START_ADDR + $029A
    lda START_ADDR + $029B
    lda START_ADDR + $029C
    lda START_ADDR + $029D
    lda START_ADDR + $029E
    lda START_ADDR + $029F
    lda START_ADDR + $02A0
    lda START_ADDR + $02A1
    lda START_ADDR + $02A2
    lda START_ADDR + $02A3
    lda START_ADDR + $02A4
    lda START_ADDR + $02A5
    lda START_ADDR + $02A6
    lda START_ADDR + $02A7
    lda START_ADDR + $02A8
    lda START_ADDR + $02A9
    lda START_ADDR + $02AA
    lda START_ADDR + $02AB
    lda START_ADDR + $02AC
    lda START_ADDR + $02AD
    lda START_ADDR + $02AE
    lda START_ADDR + $02AF
    lda START_ADDR + $02B0
    lda START_ADDR + $02B1
    lda START_ADDR + $02B2
    lda START_ADDR + $02B3
    lda START_ADDR + $02B4
    lda START_ADDR + $02B5
    lda START_ADDR + $02B6
    lda START_ADDR + $02B7
    lda START_ADDR + $02B8
    lda START_ADDR + $02B9
    lda START_ADDR + $02BA
    lda START_ADDR + $02BB
    lda START_ADDR + $02BC
    lda START_ADDR + $02BD
    lda START_ADDR + $02BE
    lda START_ADDR + $02BF
    lda START_ADDR + $02C0
    lda START_ADDR + $02C1
    lda START_ADDR + $02C2
    lda START_ADDR + $02C3
    lda START_ADDR + $02C4
    lda START_ADDR + $02C5
    lda START_ADDR + $02C6
    lda START_ADDR + $02C7
    lda START_ADDR + $02C8
    lda START_ADDR + $02C9
    lda START_ADDR + $02CA
    lda START_ADDR + $02CB
    lda START_ADDR + $02CC
    lda START_ADDR + $02CD
    lda START_ADDR + $02CE
    lda START_ADDR + $02CF
    lda START_ADDR + $02D0
    lda START_ADDR + $02D1
    lda START_ADDR + $02D2
    lda START_ADDR + $02D3
    lda START_ADDR + $02D4
    lda START_ADDR + $02D5
    lda START_ADDR + $02D6
    lda START_ADDR + $02D7
    lda START_ADDR + $02D8
    lda START_ADDR + $02D9
    lda START_ADDR + $02DA
    lda START_ADDR + $02DB
    lda START_ADDR + $02DC
    lda START_ADDR + $02DD
    lda START_ADDR + $02DE
    lda START_ADDR + $02DF
    lda START_ADDR + $02E0
    lda START_ADDR + $02E1
    lda START_ADDR + $02E2
    lda START_ADDR + $02E3
    lda START_ADDR + $02E4
    lda START_ADDR + $02E5
    lda START_ADDR + $02E6
    lda START_ADDR + $02E7
    lda START_ADDR + $02E8
    lda START_ADDR + $02E9
    lda START_ADDR + $02EA
    lda START_ADDR + $02EB
    lda START_ADDR + $02EC
    lda START_ADDR + $02ED
    lda START_ADDR + $02EE
    lda START_ADDR + $02EF
    lda START_ADDR + $02F0
    lda START_ADDR + $02F1
    lda START_ADDR + $02F2
    lda START_ADDR + $02F3
    lda START_ADDR + $02F4
    lda START_ADDR + $02F5
    lda START_ADDR + $02F6
    lda START_ADDR + $02F7
    lda START_ADDR + $02F8
    lda START_ADDR + $02F9
    lda START_ADDR + $02FA
    lda START_ADDR + $02FB
    lda START_ADDR + $02FC
    lda START_ADDR + $02FD
    lda START_ADDR + $02FE
    lda START_ADDR + $02FF
    lda START_ADDR + $0300
    lda START_ADDR + $0301
    lda START_ADDR + $0302
    lda START_ADDR + $0303
    lda START_ADDR + $0304
    lda START_ADDR + $0305
    lda START_ADDR + $0306
    lda START_ADDR + $0307
    lda START_ADDR + $0308
    lda START_ADDR + $0309
    lda START_ADDR + $030A
    lda START_ADDR + $030B
    lda START_ADDR + $030C
    lda START_ADDR + $030D
    lda START_ADDR + $030E
    lda START_ADDR + $030F
    lda START_ADDR + $0310
    lda START_ADDR + $0311
    lda START_ADDR + $0312
    lda START_ADDR + $0313
    lda START_ADDR + $0314
    lda START_ADDR + $0315
    lda START_ADDR + $0316
    lda START_ADDR + $0317
    lda START_ADDR + $0318
    lda START_ADDR + $0319
    lda START_ADDR + $031A
    lda START_ADDR + $031B
    lda START_ADDR + $031C
    lda START_ADDR + $031D
    lda START_ADDR + $031E
    lda START_ADDR + $031F
    lda START_ADDR + $0320
    lda START_ADDR + $0321
    lda START_ADDR + $0322
    lda START_ADDR + $0323
    lda START_ADDR + $0324
    lda START_ADDR + $0325
    lda START_ADDR + $0326
    lda START_ADDR + $0327
    lda START_ADDR + $0328
    lda START_ADDR + $0329
    lda START_ADDR + $032A
    lda START_ADDR + $032B
    lda START_ADDR + $032C
    lda START_ADDR + $032D
    lda START_ADDR + $032E
    lda START_ADDR + $032F
    lda START_ADDR + $0330
    lda START_ADDR + $0331
    lda START_ADDR + $0332
    lda START_ADDR + $0333
    lda START_ADDR + $0334
    lda START_ADDR + $0335
    lda START_ADDR + $0336
    lda START_ADDR + $0337
    lda START_ADDR + $0338
    lda START_ADDR + $0339
    lda START_ADDR + $033A
    lda START_ADDR + $033B
    lda START_ADDR + $033C
    lda START_ADDR + $033D
    lda START_ADDR + $033E
    lda START_ADDR + $033F
    lda START_ADDR + $0340
    lda START_ADDR + $0341
    lda START_ADDR + $0342
    lda START_ADDR + $0343
    lda START_ADDR + $0344
    lda START_ADDR + $0345
    lda START_ADDR + $0346
    lda START_ADDR + $0347
    lda START_ADDR + $0348
    lda START_ADDR + $0349
    lda START_ADDR + $034A
    lda START_ADDR + $034B
    lda START_ADDR + $034C
    lda START_ADDR + $034D
    lda START_ADDR + $034E
    lda START_ADDR + $034F
    lda START_ADDR + $0350
    lda START_ADDR + $0351
    lda START_ADDR + $0352
    lda START_ADDR + $0353
    lda START_ADDR + $0354
    lda START_ADDR + $0355
    lda START_ADDR + $0356
    lda START_ADDR + $0357
    lda START_ADDR + $0358
    lda START_ADDR + $0359
    lda START_ADDR + $035A
    lda START_ADDR + $035B
    lda START_ADDR + $035C
    lda START_ADDR + $035D
    lda START_ADDR + $035E
    lda START_ADDR + $035F
    lda START_ADDR + $0360
    lda START_ADDR + $0361
    lda START_ADDR + $0362
    lda START_ADDR + $0363
    lda START_ADDR + $0364
    lda START_ADDR + $0365
    lda START_ADDR + $0366
    lda START_ADDR + $0367
    lda START_ADDR + $0368
    lda START_ADDR + $0369
    lda START_ADDR + $036A
    lda START_ADDR + $036B
    lda START_ADDR + $036C
    lda START_ADDR + $036D
    lda START_ADDR + $036E
    lda START_ADDR + $036F
    lda START_ADDR + $0370
    lda START_ADDR + $0371
    lda START_ADDR + $0372
    lda START_ADDR + $0373
    lda START_ADDR + $0374
    lda START_ADDR + $0375
    lda START_ADDR + $0376
    lda START_ADDR + $0377
    lda START_ADDR + $0378
    lda START_ADDR + $0379
    lda START_ADDR + $037A
    lda START_ADDR + $037B
    lda START_ADDR + $037C
    lda START_ADDR + $037D
    lda START_ADDR + $037E
    lda START_ADDR + $037F
    lda START_ADDR + $0380
    lda START_ADDR + $0381
    lda START_ADDR + $0382
    lda START_ADDR + $0383
    lda START_ADDR + $0384
    lda START_ADDR + $0385
    lda START_ADDR + $0386
    lda START_ADDR + $0387
    lda START_ADDR + $0388
    lda START_ADDR + $0389
    lda START_ADDR + $038A
    lda START_ADDR + $038B
    lda START_ADDR + $038C
    lda START_ADDR + $038D
    lda START_ADDR + $038E
    lda START_ADDR + $038F
    lda START_ADDR + $0390
    lda START_ADDR + $0391
    lda START_ADDR + $0392
    lda START_ADDR + $0393
    lda START_ADDR + $0394
    lda START_ADDR + $0395
    lda START_ADDR + $0396
    lda START_ADDR + $0397
    lda START_ADDR + $0398
    lda START_ADDR + $0399
    lda START_ADDR + $039A
    lda START_ADDR + $039B
    lda START_ADDR + $039C
    lda START_ADDR + $039D
    lda START_ADDR + $039E
    lda START_ADDR + $039F
    lda START_ADDR + $03A0
    lda START_ADDR + $03A1
    lda START_ADDR + $03A2
    lda START_ADDR + $03A3
    lda START_ADDR + $03A4
    lda START_ADDR + $03A5
    lda START_ADDR + $03A6
    lda START_ADDR + $03A7
    lda START_ADDR + $03A8
    lda START_ADDR + $03A9
    lda START_ADDR + $03AA
    lda START_ADDR + $03AB
    lda START_ADDR + $03AC
    lda START_ADDR + $03AD
    lda START_ADDR + $03AE
    lda START_ADDR + $03AF
    lda START_ADDR + $03B0
    lda START_ADDR + $03B1
    lda START_ADDR + $03B2
    lda START_ADDR + $03B3
    lda START_ADDR + $03B4
    lda START_ADDR + $03B5
    lda START_ADDR + $03B6
    lda START_ADDR + $03B7
    lda START_ADDR + $03B8
    lda START_ADDR + $03B9
    lda START_ADDR + $03BA
    lda START_ADDR + $03BB
    lda START_ADDR + $03BC
    lda START_ADDR + $03BD
    lda START_ADDR + $03BE
    lda START_ADDR + $03BF
    lda START_ADDR + $03C0
    lda START_ADDR + $03C1
    lda START_ADDR + $03C2
    lda START_ADDR + $03C3
    lda START_ADDR + $03C4
    lda START_ADDR + $03C5
    lda START_ADDR + $03C6
    lda START_ADDR + $03C7
    lda START_ADDR + $03C8
    lda START_ADDR + $03C9
    lda START_ADDR + $03CA
    lda START_ADDR + $03CB
    lda START_ADDR + $03CC
    lda START_ADDR + $03CD
    lda START_ADDR + $03CE
    lda START_ADDR + $03CF
    lda START_ADDR + $03D0
    lda START_ADDR + $03D1
    lda START_ADDR + $03D2
    lda START_ADDR + $03D3
    lda START_ADDR + $03D4
    lda START_ADDR + $03D5
    lda START_ADDR + $03D6
    lda START_ADDR + $03D7
    lda START_ADDR + $03D8
    lda START_ADDR + $03D9
    lda START_ADDR + $03DA
    lda START_ADDR + $03DB
    lda START_ADDR + $03DC
    lda START_ADDR + $03DD
    lda START_ADDR + $03DE
    lda START_ADDR + $03DF
    lda START_ADDR + $03E0
    lda START_ADDR + $03E1
    lda START_ADDR + $03E2
    lda START_ADDR + $03E3
    lda START_ADDR + $03E4
    lda START_ADDR + $03E5
    lda START_ADDR + $03E6
    lda START_ADDR + $03E7
    lda START_ADDR + $03E8
    lda START_ADDR + $03E9
    lda START_ADDR + $03EA
    lda START_ADDR + $03EB
    lda START_ADDR + $03EC
    lda START_ADDR + $03ED
    lda START_ADDR + $03EE
    lda START_ADDR + $03EF
    lda START_ADDR + $03F0
    lda START_ADDR + $03F1
    lda START_ADDR + $03F2
    lda START_ADDR + $03F3
    lda START_ADDR + $03F4
    lda START_ADDR + $03F5
    lda START_ADDR + $03F6
    lda START_ADDR + $03F7
    lda START_ADDR + $03F8
    lda START_ADDR + $03F9
    lda START_ADDR + $03FA
    lda START_ADDR + $03FB
    lda START_ADDR + $03FC
    lda START_ADDR + $03FD
    lda START_ADDR + $03FE
    lda START_ADDR + $03FF
    lda START_ADDR + $0400
    lda START_ADDR + $0401
    lda START_ADDR + $0402
    lda START_ADDR + $0403
    lda START_ADDR + $0404
    lda START_ADDR + $0405
    lda START_ADDR + $0406
    lda START_ADDR + $0407
    lda START_ADDR + $0408
    lda START_ADDR + $0409
    lda START_ADDR + $040A
    lda START_ADDR + $040B
    lda START_ADDR + $040C
    lda START_ADDR + $040D
    lda START_ADDR + $040E
    lda START_ADDR + $040F
    lda START_ADDR + $0410
    lda START_ADDR + $0411
    lda START_ADDR + $0412
    lda START_ADDR + $0413
    lda START_ADDR + $0414
    lda START_ADDR + $0415
    lda START_ADDR + $0416
    lda START_ADDR + $0417
    lda START_ADDR + $0418
    lda START_ADDR + $0419
    lda START_ADDR + $041A
    lda START_ADDR + $041B
    lda START_ADDR + $041C
    lda START_ADDR + $041D
    lda START_ADDR + $041E
    lda START_ADDR + $041F
    lda START_ADDR + $0420
    lda START_ADDR + $0421
    lda START_ADDR + $0422
    lda START_ADDR + $0423
    lda START_ADDR + $0424
    lda START_ADDR + $0425
    lda START_ADDR + $0426
    lda START_ADDR + $0427
    lda START_ADDR + $0428
    lda START_ADDR + $0429
    lda START_ADDR + $042A
    lda START_ADDR + $042B
    lda START_ADDR + $042C
    lda START_ADDR + $042D
    lda START_ADDR + $042E
    lda START_ADDR + $042F
    lda START_ADDR + $0430
    lda START_ADDR + $0431
    lda START_ADDR + $0432
    lda START_ADDR + $0433
    lda START_ADDR + $0434
    lda START_ADDR + $0435
    lda START_ADDR + $0436
    lda START_ADDR + $0437
    lda START_ADDR + $0438
    lda START_ADDR + $0439
    lda START_ADDR + $043A
    lda START_ADDR + $043B
    lda START_ADDR + $043C
    lda START_ADDR + $043D
    lda START_ADDR + $043E
    lda START_ADDR + $043F
    lda START_ADDR + $0440
    lda START_ADDR + $0441
    lda START_ADDR + $0442
    lda START_ADDR + $0443
    lda START_ADDR + $0444
    lda START_ADDR + $0445
    lda START_ADDR + $0446
    lda START_ADDR + $0447
    lda START_ADDR + $0448
    lda START_ADDR + $0449
    lda START_ADDR + $044A
    lda START_ADDR + $044B
    lda START_ADDR + $044C
    lda START_ADDR + $044D
    lda START_ADDR + $044E
    lda START_ADDR + $044F
    lda START_ADDR + $0450
    lda START_ADDR + $0451
    lda START_ADDR + $0452
    lda START_ADDR + $0453
    lda START_ADDR + $0454
    lda START_ADDR + $0455
    lda START_ADDR + $0456
    lda START_ADDR + $0457
    lda START_ADDR + $0458
    lda START_ADDR + $0459
    lda START_ADDR + $045A
    lda START_ADDR + $045B
    lda START_ADDR + $045C
    lda START_ADDR + $045D
    lda START_ADDR + $045E
    lda START_ADDR + $045F
    lda START_ADDR + $0460
    lda START_ADDR + $0461
    lda START_ADDR + $0462
    lda START_ADDR + $0463
    lda START_ADDR + $0464
    lda START_ADDR + $0465
    lda START_ADDR + $0466
    lda START_ADDR + $0467
    lda START_ADDR + $0468
    lda START_ADDR + $0469
    lda START_ADDR + $046A
    lda START_ADDR + $046B
    lda START_ADDR + $046C
    lda START_ADDR + $046D
    lda START_ADDR + $046E
    lda START_ADDR + $046F
    lda START_ADDR + $0470
    lda START_ADDR + $0471
    lda START_ADDR + $0472
    lda START_ADDR + $0473
    lda START_ADDR + $0474
    lda START_ADDR + $0475
    lda START_ADDR + $0476
    lda START_ADDR + $0477
    lda START_ADDR + $0478
    lda START_ADDR + $0479
    lda START_ADDR + $047A
    lda START_ADDR + $047B
    lda START_ADDR + $047C
    lda START_ADDR + $047D
    lda START_ADDR + $047E
    lda START_ADDR + $047F
    lda START_ADDR + $0480
    lda START_ADDR + $0481
    lda START_ADDR + $0482
    lda START_ADDR + $0483
    lda START_ADDR + $0484
    lda START_ADDR + $0485
    lda START_ADDR + $0486
    lda START_ADDR + $0487
    lda START_ADDR + $0488
    lda START_ADDR + $0489
    lda START_ADDR + $048A
    lda START_ADDR + $048B
    lda START_ADDR + $048C
    lda START_ADDR + $048D
    lda START_ADDR + $048E
    lda START_ADDR + $048F
    lda START_ADDR + $0490
    lda START_ADDR + $0491
    lda START_ADDR + $0492
    lda START_ADDR + $0493
    lda START_ADDR + $0494
    lda START_ADDR + $0495
    lda START_ADDR + $0496
    lda START_ADDR + $0497
    lda START_ADDR + $0498
    lda START_ADDR + $0499
    lda START_ADDR + $049A
    lda START_ADDR + $049B
    lda START_ADDR + $049C
    lda START_ADDR + $049D
    lda START_ADDR + $049E
    lda START_ADDR + $049F
    lda START_ADDR + $04A0
    lda START_ADDR + $04A1
    lda START_ADDR + $04A2
    lda START_ADDR + $04A3
    lda START_ADDR + $04A4
    lda START_ADDR + $04A5
    lda START_ADDR + $04A6
    lda START_ADDR + $04A7
    lda START_ADDR + $04A8
    lda START_ADDR + $04A9
    lda START_ADDR + $04AA
    lda START_ADDR + $04AB
    lda START_ADDR + $04AC
    lda START_ADDR + $04AD
    lda START_ADDR + $04AE
    lda START_ADDR + $04AF
    lda START_ADDR + $04B0
    lda START_ADDR + $04B1
    lda START_ADDR + $04B2
    lda START_ADDR + $04B3
    lda START_ADDR + $04B4
    lda START_ADDR + $04B5
    lda START_ADDR + $04B6
    lda START_ADDR + $04B7
    lda START_ADDR + $04B8
    lda START_ADDR + $04B9
    lda START_ADDR + $04BA
    lda START_ADDR + $04BB
    lda START_ADDR + $04BC
    lda START_ADDR + $04BD
    lda START_ADDR + $04BE
    lda START_ADDR + $04BF
    lda START_ADDR + $04C0
    lda START_ADDR + $04C1
    lda START_ADDR + $04C2
    lda START_ADDR + $04C3
    lda START_ADDR + $04C4
    lda START_ADDR + $04C5
    lda START_ADDR + $04C6
    lda START_ADDR + $04C7
    lda START_ADDR + $04C8
    lda START_ADDR + $04C9
    lda START_ADDR + $04CA
    lda START_ADDR + $04CB
    lda START_ADDR + $04CC
    lda START_ADDR + $04CD
    lda START_ADDR + $04CE
    lda START_ADDR + $04CF
    lda START_ADDR + $04D0
    lda START_ADDR + $04D1
    lda START_ADDR + $04D2
    lda START_ADDR + $04D3
    lda START_ADDR + $04D4
    lda START_ADDR + $04D5
    lda START_ADDR + $04D6
    lda START_ADDR + $04D7
    lda START_ADDR + $04D8
    lda START_ADDR + $04D9
    lda START_ADDR + $04DA
    lda START_ADDR + $04DB
    lda START_ADDR + $04DC
    lda START_ADDR + $04DD
    lda START_ADDR + $04DE
    lda START_ADDR + $04DF
    lda START_ADDR + $04E0
    lda START_ADDR + $04E1
    lda START_ADDR + $04E2
    lda START_ADDR + $04E3
    lda START_ADDR + $04E4
    lda START_ADDR + $04E5
    lda START_ADDR + $04E6
    lda START_ADDR + $04E7
    lda START_ADDR + $04E8
    lda START_ADDR + $04E9
    lda START_ADDR + $04EA
    lda START_ADDR + $04EB
    lda START_ADDR + $04EC
    lda START_ADDR + $04ED
    lda START_ADDR + $04EE
    lda START_ADDR + $04EF
    lda START_ADDR + $04F0
    lda START_ADDR + $04F1
    lda START_ADDR + $04F2
    lda START_ADDR + $04F3
    lda START_ADDR + $04F4
    lda START_ADDR + $04F5
    lda START_ADDR + $04F6
    lda START_ADDR + $04F7
    lda START_ADDR + $04F8
    lda START_ADDR + $04F9
    lda START_ADDR + $04FA
    lda START_ADDR + $04FB
    lda START_ADDR + $04FC
    lda START_ADDR + $04FD
    lda START_ADDR + $04FE
    lda START_ADDR + $04FF
    lda START_ADDR + $0500
    lda START_ADDR + $0501
    lda START_ADDR + $0502
    lda START_ADDR + $0503
    lda START_ADDR + $0504
    lda START_ADDR + $0505
    lda START_ADDR + $0506
    lda START_ADDR + $0507
    lda START_ADDR + $0508
    lda START_ADDR + $0509
    lda START_ADDR + $050A
    lda START_ADDR + $050B
    lda START_ADDR + $050C
    lda START_ADDR + $050D
    lda START_ADDR + $050E
    lda START_ADDR + $050F
    lda START_ADDR + $0510
    lda START_ADDR + $0511
    lda START_ADDR + $0512
    lda START_ADDR + $0513
    lda START_ADDR + $0514
    lda START_ADDR + $0515
    lda START_ADDR + $0516
    lda START_ADDR + $0517
    lda START_ADDR + $0518
    lda START_ADDR + $0519
    lda START_ADDR + $051A
    lda START_ADDR + $051B
    lda START_ADDR + $051C
    lda START_ADDR + $051D
    lda START_ADDR + $051E
    lda START_ADDR + $051F
    lda START_ADDR + $0520
    lda START_ADDR + $0521
    lda START_ADDR + $0522
    lda START_ADDR + $0523
    lda START_ADDR + $0524
    lda START_ADDR + $0525
    lda START_ADDR + $0526
    lda START_ADDR + $0527
    lda START_ADDR + $0528
    lda START_ADDR + $0529
    lda START_ADDR + $052A
    lda START_ADDR + $052B
    lda START_ADDR + $052C
    lda START_ADDR + $052D
    lda START_ADDR + $052E
    lda START_ADDR + $052F
    lda START_ADDR + $0530
    lda START_ADDR + $0531
    lda START_ADDR + $0532
    lda START_ADDR + $0533
    lda START_ADDR + $0534
    lda START_ADDR + $0535
    lda START_ADDR + $0536
    lda START_ADDR + $0537
    lda START_ADDR + $0538
    lda START_ADDR + $0539
    lda START_ADDR + $053A
    lda START_ADDR + $053B
    lda START_ADDR + $053C
    lda START_ADDR + $053D
    lda START_ADDR + $053E
    lda START_ADDR + $053F
    lda START_ADDR + $0540
    lda START_ADDR + $0541
    lda START_ADDR + $0542
    lda START_ADDR + $0543
    lda START_ADDR + $0544
    lda START_ADDR + $0545
    lda START_ADDR + $0546
    lda START_ADDR + $0547
    lda START_ADDR + $0548
    lda START_ADDR + $0549
    lda START_ADDR + $054A
    lda START_ADDR + $054B
    lda START_ADDR + $054C
    lda START_ADDR + $054D
    lda START_ADDR + $054E
    lda START_ADDR + $054F
    lda START_ADDR + $0550
    lda START_ADDR + $0551
    lda START_ADDR + $0552
    lda START_ADDR + $0553
    lda START_ADDR + $0554
    lda START_ADDR + $0555
    lda START_ADDR + $0556
    lda START_ADDR + $0557
    lda START_ADDR + $0558
    lda START_ADDR + $0559
    lda START_ADDR + $055A
    lda START_ADDR + $055B
    lda START_ADDR + $055C
    lda START_ADDR + $055D
    lda START_ADDR + $055E
    lda START_ADDR + $055F
    lda START_ADDR + $0560
    lda START_ADDR + $0561
    lda START_ADDR + $0562
    lda START_ADDR + $0563
    lda START_ADDR + $0564
    lda START_ADDR + $0565
    lda START_ADDR + $0566
    lda START_ADDR + $0567
    lda START_ADDR + $0568
    lda START_ADDR + $0569
    lda START_ADDR + $056A
    lda START_ADDR + $056B
    lda START_ADDR + $056C
    lda START_ADDR + $056D
    lda START_ADDR + $056E
    lda START_ADDR + $056F
    lda START_ADDR + $0570
    lda START_ADDR + $0571
    lda START_ADDR + $0572
    lda START_ADDR + $0573
    lda START_ADDR + $0574
    lda START_ADDR + $0575
    lda START_ADDR + $0576
    lda START_ADDR + $0577
    lda START_ADDR + $0578
    lda START_ADDR + $0579
    lda START_ADDR + $057A
    lda START_ADDR + $057B
    lda START_ADDR + $057C
    lda START_ADDR + $057D
    lda START_ADDR + $057E
    lda START_ADDR + $057F
    lda START_ADDR + $0580
    lda START_ADDR + $0581
    lda START_ADDR + $0582
    lda START_ADDR + $0583
    lda START_ADDR + $0584
    lda START_ADDR + $0585
    lda START_ADDR + $0586
    lda START_ADDR + $0587
    lda START_ADDR + $0588
    lda START_ADDR + $0589
    lda START_ADDR + $058A
    lda START_ADDR + $058B
    lda START_ADDR + $058C
    lda START_ADDR + $058D
    lda START_ADDR + $058E
    lda START_ADDR + $058F
    lda START_ADDR + $0590
    lda START_ADDR + $0591
    lda START_ADDR + $0592
    lda START_ADDR + $0593
    lda START_ADDR + $0594
    lda START_ADDR + $0595
    lda START_ADDR + $0596
    lda START_ADDR + $0597
    lda START_ADDR + $0598
    lda START_ADDR + $0599
    lda START_ADDR + $059A
    lda START_ADDR + $059B
    lda START_ADDR + $059C
    lda START_ADDR + $059D
    lda START_ADDR + $059E
    lda START_ADDR + $059F
    lda START_ADDR + $05A0
    lda START_ADDR + $05A1
    lda START_ADDR + $05A2
    lda START_ADDR + $05A3
    lda START_ADDR + $05A4
    lda START_ADDR + $05A5
    lda START_ADDR + $05A6
    lda START_ADDR + $05A7
    lda START_ADDR + $05A8
    lda START_ADDR + $05A9
    lda START_ADDR + $05AA
    lda START_ADDR + $05AB
    lda START_ADDR + $05AC
    lda START_ADDR + $05AD
    lda START_ADDR + $05AE
    lda START_ADDR + $05AF
    lda START_ADDR + $05B0
    lda START_ADDR + $05B1
    lda START_ADDR + $05B2
    lda START_ADDR + $05B3
    lda START_ADDR + $05B4
    lda START_ADDR + $05B5
    lda START_ADDR + $05B6
    lda START_ADDR + $05B7
    lda START_ADDR + $05B8
    lda START_ADDR + $05B9
    lda START_ADDR + $05BA
    lda START_ADDR + $05BB
    lda START_ADDR + $05BC
    lda START_ADDR + $05BD
    lda START_ADDR + $05BE
    lda START_ADDR + $05BF
    lda START_ADDR + $05C0
    lda START_ADDR + $05C1
    lda START_ADDR + $05C2
    lda START_ADDR + $05C3
    lda START_ADDR + $05C4
    lda START_ADDR + $05C5
    lda START_ADDR + $05C6
    lda START_ADDR + $05C7
    lda START_ADDR + $05C8
    lda START_ADDR + $05C9
    lda START_ADDR + $05CA
    lda START_ADDR + $05CB
    lda START_ADDR + $05CC
    lda START_ADDR + $05CD
    lda START_ADDR + $05CE
    lda START_ADDR + $05CF
    lda START_ADDR + $05D0
    lda START_ADDR + $05D1
    lda START_ADDR + $05D2
    lda START_ADDR + $05D3
    lda START_ADDR + $05D4
    lda START_ADDR + $05D5
    lda START_ADDR + $05D6
    lda START_ADDR + $05D7
    lda START_ADDR + $05D8
    lda START_ADDR + $05D9
    lda START_ADDR + $05DA
    lda START_ADDR + $05DB
    lda START_ADDR + $05DC
    lda START_ADDR + $05DD
    lda START_ADDR + $05DE
    lda START_ADDR + $05DF
    lda START_ADDR + $05E0
    lda START_ADDR + $05E1
    lda START_ADDR + $05E2
    lda START_ADDR + $05E3
    lda START_ADDR + $05E4
    lda START_ADDR + $05E5
    lda START_ADDR + $05E6
    lda START_ADDR + $05E7
    lda START_ADDR + $05E8
    lda START_ADDR + $05E9
    lda START_ADDR + $05EA
    lda START_ADDR + $05EB
    lda START_ADDR + $05EC
    lda START_ADDR + $05ED
    lda START_ADDR + $05EE
    lda START_ADDR + $05EF
    lda START_ADDR + $05F0
    lda START_ADDR + $05F1
    lda START_ADDR + $05F2
    lda START_ADDR + $05F3
    lda START_ADDR + $05F4
    lda START_ADDR + $05F5
    lda START_ADDR + $05F6
    lda START_ADDR + $05F7
    lda START_ADDR + $05F8
    lda START_ADDR + $05F9
    lda START_ADDR + $05FA
    lda START_ADDR + $05FB
    lda START_ADDR + $05FC
    lda START_ADDR + $05FD
    lda START_ADDR + $05FE
    lda START_ADDR + $05FF
    lda START_ADDR + $0600
    lda START_ADDR + $0601
    lda START_ADDR + $0602
    lda START_ADDR + $0603
    lda START_ADDR + $0604
    lda START_ADDR + $0605
    lda START_ADDR + $0606
    lda START_ADDR + $0607
    lda START_ADDR + $0608
    lda START_ADDR + $0609
    lda START_ADDR + $060A
    lda START_ADDR + $060B
    lda START_ADDR + $060C
    lda START_ADDR + $060D
    lda START_ADDR + $060E
    lda START_ADDR + $060F
    lda START_ADDR + $0610
    lda START_ADDR + $0611
    lda START_ADDR + $0612
    lda START_ADDR + $0613
    lda START_ADDR + $0614
    lda START_ADDR + $0615
    lda START_ADDR + $0616
    lda START_ADDR + $0617
    lda START_ADDR + $0618
    lda START_ADDR + $0619
    lda START_ADDR + $061A
    lda START_ADDR + $061B
    lda START_ADDR + $061C
    lda START_ADDR + $061D
    lda START_ADDR + $061E
    lda START_ADDR + $061F
    lda START_ADDR + $0620
    lda START_ADDR + $0621
    lda START_ADDR + $0622
    lda START_ADDR + $0623
    lda START_ADDR + $0624
    lda START_ADDR + $0625
    lda START_ADDR + $0626
    lda START_ADDR + $0627
    lda START_ADDR + $0628
    lda START_ADDR + $0629
    lda START_ADDR + $062A
    lda START_ADDR + $062B
    lda START_ADDR + $062C
    lda START_ADDR + $062D
    lda START_ADDR + $062E
    lda START_ADDR + $062F
    lda START_ADDR + $0630
    lda START_ADDR + $0631
    lda START_ADDR + $0632
    lda START_ADDR + $0633
    lda START_ADDR + $0634
    lda START_ADDR + $0635
    lda START_ADDR + $0636
    lda START_ADDR + $0637
    lda START_ADDR + $0638
    lda START_ADDR + $0639
    lda START_ADDR + $063A
    lda START_ADDR + $063B
    lda START_ADDR + $063C
    lda START_ADDR + $063D
    lda START_ADDR + $063E
    lda START_ADDR + $063F
    lda START_ADDR + $0640
    lda START_ADDR + $0641
    lda START_ADDR + $0642
    lda START_ADDR + $0643
    lda START_ADDR + $0644
    lda START_ADDR + $0645
    lda START_ADDR + $0646
    lda START_ADDR + $0647
    lda START_ADDR + $0648
    lda START_ADDR + $0649
    lda START_ADDR + $064A
    lda START_ADDR + $064B
    lda START_ADDR + $064C
    lda START_ADDR + $064D
    lda START_ADDR + $064E
    lda START_ADDR + $064F
    lda START_ADDR + $0650
    lda START_ADDR + $0651
    lda START_ADDR + $0652
    lda START_ADDR + $0653
    lda START_ADDR + $0654
    lda START_ADDR + $0655
    lda START_ADDR + $0656
    lda START_ADDR + $0657
    lda START_ADDR + $0658
    lda START_ADDR + $0659
    lda START_ADDR + $065A
    lda START_ADDR + $065B
    lda START_ADDR + $065C
    lda START_ADDR + $065D
    lda START_ADDR + $065E
    lda START_ADDR + $065F
    lda START_ADDR + $0660
    lda START_ADDR + $0661
    lda START_ADDR + $0662
    lda START_ADDR + $0663
    lda START_ADDR + $0664
    lda START_ADDR + $0665
    lda START_ADDR + $0666
    lda START_ADDR + $0667
    lda START_ADDR + $0668
    lda START_ADDR + $0669
    lda START_ADDR + $066A
    lda START_ADDR + $066B
    lda START_ADDR + $066C
    lda START_ADDR + $066D
    lda START_ADDR + $066E
    lda START_ADDR + $066F
    lda START_ADDR + $0670
    lda START_ADDR + $0671
    lda START_ADDR + $0672
    lda START_ADDR + $0673
    lda START_ADDR + $0674
    lda START_ADDR + $0675
    lda START_ADDR + $0676
    lda START_ADDR + $0677
    lda START_ADDR + $0678
    lda START_ADDR + $0679
    lda START_ADDR + $067A
    lda START_ADDR + $067B
    lda START_ADDR + $067C
    lda START_ADDR + $067D
    lda START_ADDR + $067E
    lda START_ADDR + $067F
    lda START_ADDR + $0680
    lda START_ADDR + $0681
    lda START_ADDR + $0682
    lda START_ADDR + $0683
    lda START_ADDR + $0684
    lda START_ADDR + $0685
    lda START_ADDR + $0686
    lda START_ADDR + $0687
    lda START_ADDR + $0688
    lda START_ADDR + $0689
    lda START_ADDR + $068A
    lda START_ADDR + $068B
    lda START_ADDR + $068C
    lda START_ADDR + $068D
    lda START_ADDR + $068E
    lda START_ADDR + $068F
    lda START_ADDR + $0690
    lda START_ADDR + $0691
    lda START_ADDR + $0692
    lda START_ADDR + $0693
    lda START_ADDR + $0694
    lda START_ADDR + $0695
    lda START_ADDR + $0696
    lda START_ADDR + $0697
    lda START_ADDR + $0698
    lda START_ADDR + $0699
    lda START_ADDR + $069A
    lda START_ADDR + $069B
    lda START_ADDR + $069C
    lda START_ADDR + $069D
    lda START_ADDR + $069E
    lda START_ADDR + $069F
    lda START_ADDR + $06A0
    lda START_ADDR + $06A1
    lda START_ADDR + $06A2
    lda START_ADDR + $06A3
    lda START_ADDR + $06A4
    lda START_ADDR + $06A5
    lda START_ADDR + $06A6
    lda START_ADDR + $06A7
    lda START_ADDR + $06A8
    lda START_ADDR + $06A9
    lda START_ADDR + $06AA
    lda START_ADDR + $06AB
    lda START_ADDR + $06AC
    lda START_ADDR + $06AD
    lda START_ADDR + $06AE
    lda START_ADDR + $06AF
    lda START_ADDR + $06B0
    lda START_ADDR + $06B1
    lda START_ADDR + $06B2
    lda START_ADDR + $06B3
    lda START_ADDR + $06B4
    lda START_ADDR + $06B5
    lda START_ADDR + $06B6
    lda START_ADDR + $06B7
    lda START_ADDR + $06B8
    lda START_ADDR + $06B9
    lda START_ADDR + $06BA
    lda START_ADDR + $06BB
    lda START_ADDR + $06BC
    lda START_ADDR + $06BD
    lda START_ADDR + $06BE
    lda START_ADDR + $06BF
    lda START_ADDR + $06C0
    lda START_ADDR + $06C1
    lda START_ADDR + $06C2
    lda START_ADDR + $06C3
    lda START_ADDR + $06C4
    lda START_ADDR + $06C5
    lda START_ADDR + $06C6
    lda START_ADDR + $06C7
    lda START_ADDR + $06C8
    lda START_ADDR + $06C9
    lda START_ADDR + $06CA
    lda START_ADDR + $06CB
    lda START_ADDR + $06CC
    lda START_ADDR + $06CD
    lda START_ADDR + $06CE
    lda START_ADDR + $06CF
    lda START_ADDR + $06D0
    lda START_ADDR + $06D1
    lda START_ADDR + $06D2
    lda START_ADDR + $06D3
    lda START_ADDR + $06D4
    lda START_ADDR + $06D5
    lda START_ADDR + $06D6
    lda START_ADDR + $06D7
    lda START_ADDR + $06D8
    lda START_ADDR + $06D9
    lda START_ADDR + $06DA
    lda START_ADDR + $06DB
    lda START_ADDR + $06DC
    lda START_ADDR + $06DD
    lda START_ADDR + $06DE
    lda START_ADDR + $06DF
    lda START_ADDR + $06E0
    lda START_ADDR + $06E1
    lda START_ADDR + $06E2
    lda START_ADDR + $06E3
    lda START_ADDR + $06E4
    lda START_ADDR + $06E5
    lda START_ADDR + $06E6
    lda START_ADDR + $06E7
    lda START_ADDR + $06E8
    lda START_ADDR + $06E9
    lda START_ADDR + $06EA
    lda START_ADDR + $06EB
    lda START_ADDR + $06EC
    lda START_ADDR + $06ED
    lda START_ADDR + $06EE
    lda START_ADDR + $06EF
    lda START_ADDR + $06F0
    lda START_ADDR + $06F1
    lda START_ADDR + $06F2
    lda START_ADDR + $06F3
    lda START_ADDR + $06F4
    lda START_ADDR + $06F5
    lda START_ADDR + $06F6
    lda START_ADDR + $06F7
    lda START_ADDR + $06F8
    lda START_ADDR + $06F9
    lda START_ADDR + $06FA
    lda START_ADDR + $06FB
    lda START_ADDR + $06FC
    lda START_ADDR + $06FD
    lda START_ADDR + $06FE
    lda START_ADDR + $06FF
    lda START_ADDR + $0700
    lda START_ADDR + $0701
    lda START_ADDR + $0702
    lda START_ADDR + $0703
    lda START_ADDR + $0704
    lda START_ADDR + $0705
    lda START_ADDR + $0706
    lda START_ADDR + $0707
    lda START_ADDR + $0708
    lda START_ADDR + $0709
    lda START_ADDR + $070A
    lda START_ADDR + $070B
    lda START_ADDR + $070C
    lda START_ADDR + $070D
    lda START_ADDR + $070E
    lda START_ADDR + $070F
    lda START_ADDR + $0710
    lda START_ADDR + $0711
    lda START_ADDR + $0712
    lda START_ADDR + $0713
    lda START_ADDR + $0714
    lda START_ADDR + $0715
    lda START_ADDR + $0716
    lda START_ADDR + $0717
    lda START_ADDR + $0718
    lda START_ADDR + $0719
    lda START_ADDR + $071A
    lda START_ADDR + $071B
    lda START_ADDR + $071C
    lda START_ADDR + $071D
    lda START_ADDR + $071E
    lda START_ADDR + $071F
    lda START_ADDR + $0720
    lda START_ADDR + $0721
    lda START_ADDR + $0722
    lda START_ADDR + $0723
    lda START_ADDR + $0724
    lda START_ADDR + $0725
    lda START_ADDR + $0726
    lda START_ADDR + $0727
    lda START_ADDR + $0728
    lda START_ADDR + $0729
    lda START_ADDR + $072A
    lda START_ADDR + $072B
    lda START_ADDR + $072C
    lda START_ADDR + $072D
    lda START_ADDR + $072E
    lda START_ADDR + $072F
    lda START_ADDR + $0730
    lda START_ADDR + $0731
    lda START_ADDR + $0732
    lda START_ADDR + $0733
    lda START_ADDR + $0734
    lda START_ADDR + $0735
    lda START_ADDR + $0736
    lda START_ADDR + $0737
    lda START_ADDR + $0738
    lda START_ADDR + $0739
    lda START_ADDR + $073A
    lda START_ADDR + $073B
    lda START_ADDR + $073C
    lda START_ADDR + $073D
    lda START_ADDR + $073E
    lda START_ADDR + $073F
    lda START_ADDR + $0740
    lda START_ADDR + $0741
    lda START_ADDR + $0742
    lda START_ADDR + $0743
    lda START_ADDR + $0744
    lda START_ADDR + $0745
    lda START_ADDR + $0746
    lda START_ADDR + $0747
    lda START_ADDR + $0748
    lda START_ADDR + $0749
    lda START_ADDR + $074A
    lda START_ADDR + $074B
    lda START_ADDR + $074C
    lda START_ADDR + $074D
    lda START_ADDR + $074E
    lda START_ADDR + $074F
    lda START_ADDR + $0750
    lda START_ADDR + $0751
    lda START_ADDR + $0752
    lda START_ADDR + $0753
    lda START_ADDR + $0754
    lda START_ADDR + $0755
    lda START_ADDR + $0756
    lda START_ADDR + $0757
    lda START_ADDR + $0758
    lda START_ADDR + $0759
    lda START_ADDR + $075A
    lda START_ADDR + $075B
    lda START_ADDR + $075C
    lda START_ADDR + $075D
    lda START_ADDR + $075E
    lda START_ADDR + $075F
    lda START_ADDR + $0760
    lda START_ADDR + $0761
    lda START_ADDR + $0762
    lda START_ADDR + $0763
    lda START_ADDR + $0764
    lda START_ADDR + $0765
    lda START_ADDR + $0766
    lda START_ADDR + $0767
    lda START_ADDR + $0768
    lda START_ADDR + $0769
    lda START_ADDR + $076A
    lda START_ADDR + $076B
    lda START_ADDR + $076C
    lda START_ADDR + $076D
    lda START_ADDR + $076E
    lda START_ADDR + $076F
    lda START_ADDR + $0770
    lda START_ADDR + $0771
    lda START_ADDR + $0772
    lda START_ADDR + $0773
    lda START_ADDR + $0774
    lda START_ADDR + $0775
    lda START_ADDR + $0776
    lda START_ADDR + $0777
    lda START_ADDR + $0778
    lda START_ADDR + $0779
    lda START_ADDR + $077A
    lda START_ADDR + $077B
    lda START_ADDR + $077C
    lda START_ADDR + $077D
    lda START_ADDR + $077E
    lda START_ADDR + $077F
    lda START_ADDR + $0780
    lda START_ADDR + $0781
    lda START_ADDR + $0782
    lda START_ADDR + $0783
    lda START_ADDR + $0784
    lda START_ADDR + $0785
    lda START_ADDR + $0786
    lda START_ADDR + $0787
    lda START_ADDR + $0788
    lda START_ADDR + $0789
    lda START_ADDR + $078A
    lda START_ADDR + $078B
    lda START_ADDR + $078C
    lda START_ADDR + $078D
    lda START_ADDR + $078E
    lda START_ADDR + $078F
    lda START_ADDR + $0790
    lda START_ADDR + $0791
    lda START_ADDR + $0792
    lda START_ADDR + $0793
    lda START_ADDR + $0794
    lda START_ADDR + $0795
    lda START_ADDR + $0796
    lda START_ADDR + $0797
    lda START_ADDR + $0798
    lda START_ADDR + $0799
    lda START_ADDR + $079A
    lda START_ADDR + $079B
    lda START_ADDR + $079C
    lda START_ADDR + $079D
    lda START_ADDR + $079E
    lda START_ADDR + $079F
    lda START_ADDR + $07A0
    lda START_ADDR + $07A1
    lda START_ADDR + $07A2
    lda START_ADDR + $07A3
    lda START_ADDR + $07A4
    lda START_ADDR + $07A5
    lda START_ADDR + $07A6
    lda START_ADDR + $07A7
    lda START_ADDR + $07A8
    lda START_ADDR + $07A9
    lda START_ADDR + $07AA
    lda START_ADDR + $07AB
    lda START_ADDR + $07AC
    lda START_ADDR + $07AD
    lda START_ADDR + $07AE
    lda START_ADDR + $07AF
    lda START_ADDR + $07B0
    lda START_ADDR + $07B1
    lda START_ADDR + $07B2
    lda START_ADDR + $07B3
    lda START_ADDR + $07B4
    lda START_ADDR + $07B5
    lda START_ADDR + $07B6
    lda START_ADDR + $07B7
    lda START_ADDR + $07B8
    lda START_ADDR + $07B9
    lda START_ADDR + $07BA
    lda START_ADDR + $07BB
    lda START_ADDR + $07BC
    lda START_ADDR + $07BD
    lda START_ADDR + $07BE
    lda START_ADDR + $07BF
    lda START_ADDR + $07C0
    lda START_ADDR + $07C1
    lda START_ADDR + $07C2
    lda START_ADDR + $07C3
    lda START_ADDR + $07C4
    lda START_ADDR + $07C5
    lda START_ADDR + $07C6
    lda START_ADDR + $07C7
    lda START_ADDR + $07C8
    lda START_ADDR + $07C9
    lda START_ADDR + $07CA
    lda START_ADDR + $07CB
    lda START_ADDR + $07CC
    lda START_ADDR + $07CD
    lda START_ADDR + $07CE
    lda START_ADDR + $07CF
    lda START_ADDR + $07D0
    lda START_ADDR + $07D1
    lda START_ADDR + $07D2
    lda START_ADDR + $07D3
    lda START_ADDR + $07D4
    lda START_ADDR + $07D5
    lda START_ADDR + $07D6
    lda START_ADDR + $07D7
    lda START_ADDR + $07D8
    lda START_ADDR + $07D9
    lda START_ADDR + $07DA
    lda START_ADDR + $07DB
    lda START_ADDR + $07DC
    lda START_ADDR + $07DD
    lda START_ADDR + $07DE
    lda START_ADDR + $07DF
    lda START_ADDR + $07E0
    lda START_ADDR + $07E1
    lda START_ADDR + $07E2
    lda START_ADDR + $07E3
    lda START_ADDR + $07E4
    lda START_ADDR + $07E5
    lda START_ADDR + $07E6
    lda START_ADDR + $07E7
    lda START_ADDR + $07E8
    lda START_ADDR + $07E9
    lda START_ADDR + $07EA
    lda START_ADDR + $07EB
    lda START_ADDR + $07EC
    lda START_ADDR + $07ED
    lda START_ADDR + $07EE
    lda START_ADDR + $07EF
    lda START_ADDR + $07F0
    lda START_ADDR + $07F1
    lda START_ADDR + $07F2
    lda START_ADDR + $07F3
    lda START_ADDR + $07F4
    lda START_ADDR + $07F5
    lda START_ADDR + $07F6
    lda START_ADDR + $07F7
    lda START_ADDR + $07F8
    lda START_ADDR + $07F9
    lda START_ADDR + $07FA
    lda START_ADDR + $07FB
    lda START_ADDR + $07FC
    lda START_ADDR + $07FD
    lda START_ADDR + $07FE
    lda START_ADDR + $07FF
    ;lda START_ADDR + $0800


    jmp arbitrary_entry


fillvalue $FF
pad $2000
I was able to dump its complete internal ROM in "CPU 2" address range $E000-FFFF. There are registers at $41xx that drive the data bus. I found at least these registers drive the bus when reading:

$4103
$4110
$4112
$4113
$4120
$4121
$4122
$4123
$4124
$4125
$4126
$4128
$412F
$4134

I can make that list better by applying pull-ups and pull-downs on the data bus.

Here is a crude memory map:

$0000-1FFF: RAM
$2000-3FFF: (untested)
$4000-4FFF: Has those registers listed above
$5000-7FFF: (untested)
$8000-87FF: open bus
$8800-CFFF: (untested)
$D000-DFFF: open bus
$E000-FFFF: Internal ROM

As long as I don't use any RAM, I can inject any code I want to read/write those registers. That should be pretty fun.


Edit:
I found a very charming easter egg:
Takao Sawano.png

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Wed Jan 20, 2021 9:47 pm

I have a question for you guys, something strange I am seeing. I went ahead and dumped the full address range $2000-FFFF, once with 1k pull-ups on the data bus and once again with pull-downs. I was expecting to find a lot of open bus, which would show up as FF vs. 00 in these dumps. However, I only found that behavior in range $C000-DFFF. In the entire range $2000-BFFF (other than the $41xx registers), I found the MSB of the address on the data bus. This happens to also be the previous byte read from the LDA $XXxx instruction. It isn't because of a weak pull-up resistor; I looked at this with an analog probe and the data line is clearly driven flat straight through where I would have expected open bus.

Why would the CPU keep driving the previous byte instead of open bus in certain regions? The address bus does change correctly for the fetch. I don't think it can be my test ROM talking because that would be just grabbing some random op-code or something, not holding the same value. Is this something anyone is familiar with? Could it be a 65C816 thing?

Code: Select all

$0000
    SRAM chip (i.e. replaced with ROM in my test)
$2000
    Address MSB returned
$4100
    Control Registers
$4200
    Address MSB returned
$C000
    Open bus
$E000
    Internal ROM
$10000
Anyone interested to poke around in the internal ROM, feel free to send me a PM. I have yet to parse out the data I took from the full $2000-FFFF dumps today but I will be sure to compare it to my previous dump to verify.

I am thinking that 5A18 pin 27 is a reset input, driven by 5C66 pin 68, controlled by register bit $40B1.3. This is my theory how commercial software brings CPU2 out of reset, but I have not verified that.

lidnariq
Posts: 10095
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by lidnariq » Wed Jan 20, 2021 11:28 pm

I already thought it a little weird that it drove the external bus with the internal registers. Maybe the data driver thinks that there's an internal device in every address above $2000 and copies the internal open bus to the external bus there?

You could change your unrolled loop to install use LDA $nnnn,X with X=255 to see if it is the upper byte of the address (in which case, the instruction LDA $60FF,X would read $60 from $61FE)

User avatar
Ben Boldt
Posts: 708
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Thu Jan 21, 2021 2:01 am

I will try that lidnariq.

I think I jumped the gun a little calling this a 65C816. I base that only on seeing the STZ instruction. After some more googling tonight, this might indicate that it is merely a 65C02. As I look into this some more, I will learn and find out.

Post Reply