Super Mario Bros. 3 (USA) (Rev 1)

Super Mario Bros. 3 (USA) (Rev 1) is on a MMC3 board with 262,144 bytes of program. A crawl of 6,400 steps from power-on kept 160 paths that found new code. Played back over 337,580 frames, they executed 26,553 bytes of it, 10 percent.

What the rules named

The 264 routines the runs entered

Every place the game's code was entered, by a call, an interrupt or a jump through a table. The ones a rule named come first, with what the rule saw, and their names in the listing say what they are: a poll, an engine, a drain.

atits name in the listingentered bytimeswhat it is, and the evidence
$FE99 (bank 31)b31_engine_FE99a call665,700
The jump engine: tables 26, jumps through them 665,700
$FF12 (bank 31)b31_poll_FF12a call645,037
The poll: port $4016, reads a frame 16, strobes a frame 8
The poll: port $4017, reads a frame 16, strobes a frame 8
$FC6F (bank 31)b31_bank_FC6Fa call272,042
The bank switch: writes 1,087,584, in the blank 444,508, while drawing 643,076
$F486 (bank 31)b31_nmieach frame (NMI)164,787
The bank switch: writes 1,644,876, in the blank 1,381,116, while drawing 263,760
The scroll writer: frames it ran in 164,933, writes in the blank 337,383
$FFAD (bank 31)b31_bank_FFADa call164,787
The bank switch: writes 1,976,913, in the blank 1,976,913, while drawing 0
$E34F (bank 31)b31_sound_E34Fa call164,317
The sound driver: frames it ran in 163,985, writes 441,159
$F795 (bank 31)b31_irqan interrupt (IRQ)164,264
The bank switch: writes 1,041,437, in the blank 0, while drawing 1,041,437
$B293 (bank 26)b26_drain_B293a call162,225
The palette writers: frames it ran in 160,953, writes 386,958
The picture writer: frames it ran in 160,953, writes 784,082, in the blank 719,936, while drawing 64,146
$9984 (bank 30)b30_random_9984a call160,679
The random byte: frames it ran in 160,679, bytes $0781,$0782,$0783,$0784, rotates 4, exclusive-ors 1
$FFC2 (bank 31)b31_bank_FFC2a call136,931
The bank switch: writes 273,813, in the blank 3,984, while drawing 269,829
$A41A (bank 9)b9_sprites_A41Aa call117,854
The sprite writers: frames it ran in 58,932, writes to the sprite page 25,948
$A9D3 (bank 9)b9_sprites_A9D3a call113,562
The sprite writers: frames it ran in 57,648, writes to the sprite page 911,386
$FD84 (bank 31)b31_sprites_FD84a call104,161
The sprite writers: frames it ran in 104,017, writes to the sprite page 13,324,022
$B117 (bank 9)b9_sprites_B117a call98,058
The sprite writers: frames it ran in 42,214, writes to the sprite page 784,075
$B5E2 (bank 9)b9_sprites_B5E2a call58,932
The sprite writers: frames it ran in 58,932, writes to the sprite page 471,105
$B9AA (bank 11)b11_sprites_B9AAa call45,720
The sprite writers: frames it ran in 5,715, writes to the sprite page 365,338
$B754 (bank 24)b24_sprites_B754a call44,841
The sprite writers: frames it ran in 10,094, writes to the sprite page 23,982
$B5BE (bank 11)b11_dispatch_B5BEa table44,174
The sprite writers: frames it ran in 22,087, writes to the sprite page 399,487
$C3C3 (bank 10)b10_sprites_C3C3a call43,740
The sprite writers: frames it ran in 43,740, writes to the sprite page 252
$B20B (bank 24)b24_sprites_B20Ba call38,755
The sprite writers: frames it ran in 19,385, writes to the sprite page 1,154,351
$B36E (bank 24)b24_sprites_B36Ea call33,048
The sprite writers: frames it ran in 16,524, writes to the sprite page 2,565
$AF44 (bank 24)b24_sprites_AF44a call32,947
The sprite writers: frames it ran in 32,947, writes to the sprite page 2,108,608
$AE7C (bank 11)b11_dispatch_AE7Ca table22,087
Where two things are compared: instructions 1, pairs of bytes 2, bytes in all 3, times compared 234, Y positions at $0075,$0076,$0502
$CDCA (bank 10)b10_dispatch_CDCAa table20,893
Where two things are compared: instructions 2, pairs of bytes 2, bytes in all 4, times compared 166, X positions at $0079,$007A, Y positions at $0075,$0076
The sprite writers: frames it ran in 20,893, writes to the sprite page 376,181
$C52B (bank 10)b10_sprites_C52Ba call16,447
The sprite writers: frames it ran in 16,447, writes to the sprite page 164,385
$B7D6 (bank 24)b24_sprites_B7D6a call14,947
The sprite writers: frames it ran in 10,094, writes to the sprite page 358,728
$AC35 (bank 24)b24_dispatch_AC35a table13,292
The sprite writers: frames it ran in 20,200, writes to the sprite page 60,076
$FFD1 (bank 31)b31_bank_FFD1a call9,930
The bank switch: writes 19,860, in the blank 1,736, while drawing 18,124
$9BD5 (bank 30)b30_bank_9BD5a call7,180
The bank switch: writes 14,360, in the blank 1,738, while drawing 12,622
$B6EE (bank 24)b24_sprites_B6EEa call6,299
The sprite writers: frames it ran in 3,030, writes to the sprite page 61,846
$B820 (bank 11)b11_dispatch_B820a table5,842
Where two things are compared: instructions 2, pairs of bytes 3, bytes in all 5, times compared 8,763, X positions at $0079,$00B1,$0722, Y positions at $0075,$00B2
$B50C (bank 24)b24_dispatch_B50Ca table5,705
Where two things are compared: instructions 1, pairs of bytes 1, bytes in all 2, times compared 5,165, X positions at $008B,$008C
The sprite writers: frames it ran in 5,705, writes to the sprite page 58,010
$C6C4 (bank 10)b10_dispatch_C6C4a table4,953
The sprite writers: frames it ran in 4,953, writes to the sprite page 2,622
$B58C (bank 24)b24_dispatch_B58Ca table4,476
The sprite writers: frames it ran in 4,476, writes to the sprite page 52,378
$B4C0 (bank 24)b24_dispatch_B4C0a table4,309
The sprite writers: frames it ran in 4,309, writes to the sprite page 42,202
$A859 (bank 24)b24_palette_A859a call4,164
The palette writers: frames it ran in 300, writes 9,600
$B5AE (bank 24)b24_dispatch_B5AEa table2,204
The sprite writers: frames it ran in 2,204, writes to the sprite page 22,829
$94CD (bank 30)b30_bank_94CDa call1,546
The bank switch: writes 3,092, in the blank 0, while drawing 3,092
$B600 (bank 24)b24_dispatch_B600a table1,389
Where two things are compared: instructions 1, pairs of bytes 1, bytes in all 2, times compared 264, X positions at $0085,$008C
$B7BE (bank 9)b9_sprites_B7BEa call1,289
The sprite writers: frames it ran in 1,289, writes to the sprite page 10,307
$B628 (bank 24)b24_sprites_B628a call1,013
The sprite writers: frames it ran in 1,013, writes to the sprite page 10,307
$B568 (bank 24)b24_dispatch_B568a table976
The sprite writers: frames it ran in 976, writes to the sprite page 9,790
$CF29 (bank 10)b10_sprites_CF29a call910
The sprite writers: frames it ran in 910, writes to the sprite page 18,057
$B5D9 (bank 24)b24_dispatch_B5D9a table804
The sprite writers: frames it ran in 804, writes to the sprite page 7,966
$CB84 (bank 10)b10_dispatch_CB84a table710
The sprite writers: frames it ran in 142, writes to the sprite page 93,720
$FFBF (bank 31)b31_bank_FFBFa call612
The bank switch: writes 1,224, in the blank 0, while drawing 1,224
$94BB (bank 30)b30_bank_94BBa call369
The bank switch: writes 738, in the blank 0, while drawing 738
$96CE (bank 30)b30_sprites_96CEa call332
The sprite writers: frames it ran in 824, writes to the sprite page 84,992
$CAA2 (bank 10)b10_dispatch_CAA2a table284
The sprite writers: frames it ran in 142, writes to the sprite page 37,488
$B9F4 (bank 11)b11_compare_B9F4a call254
Where two things are compared: instructions 2, pairs of bytes 3, bytes in all 5, times compared 762, X positions at $0079,$00B1,$0722, Y positions at $0075,$00B2
$9ABA (bank 30)b30_bank_9ABAa call225
The bank switch: writes 446, in the blank 0, while drawing 446
$F4F0 (bank 31)b31_bank_F4F0a call201
The bank switch: writes 2,009, in the blank 1,377, while drawing 632
$FF40 (bank 31)b31_resetpower-on160
The bank switch: writes 1,244, in the blank 800, while drawing 444
Where two things are compared: instructions 1, pairs of bytes 1, bytes in all 2, times compared 19,700, X positions at $00B1,$0722
The sprite writers: frames it ran in 110,242, writes to the sprite page 5,285
$D1AC (bank 10)b10_sprites_D1ACa call144
The sprite writers: frames it ran in 144, writes to the sprite page 19,008
$C7A0 (bank 10)b10_dispatch_C7A0a table127
The sprite writers: frames it ran in 127, writes to the sprite page 2,622
$B599 (bank 9)b9_dispatch_B599a table30
The sprite writers: frames it ran in 30, writes to the sprite page 240
$CA2B (bank 10)b10_dispatch_CA2Ba table16
The sprite writers: frames it ran in 16, writes to the sprite page 432
$A996 (bank 9)a call1,257,258
$AD1B (bank 9)a call707,184
$B8D0 (bank 9)a call707,184
$B89C (bank 9)a call396,626
$AB30 (bank 9)a call307,912
$AB4D (bank 9)a call286,871
$A7D2 (bank 9)a call209,543
$E785 (bank 31)a call201,466
$A000 (bank 28)a call164,745
$A661 (bank 28)a call164,427
$A2AB (bank 28)a call164,343
$A449 (bank 28)a call164,343
$A0A1 (bank 28)a call164,342
$FEBE (bank 31)a call160,679
$B327 (bank 9)a call150,624
$B265 (bank 9)a call150,535
$B9D4 (bank 11)a call137,160
$B071 (bank 24)a call128,794
$B2DC (bank 26)a call121,769
$A0A7 (bank 9)a call117,864
$A4A8 (bank 9)a table111,828
$B890 (bank 9)a call111,828
$96E5 (bank 30)a call111,519
$B3E6 (bank 26)a call107,411
$E2C0 (bank 31)a call105,103
$B24D (bank 9)a call98,053
$B34F (bank 9)a call98,053
$A9B5 (bank 9)a call97,715
$B98B (bank 11)a call91,440
$B035 (bank 9)a call89,338
$AD3B (bank 9)a table88,361
$B87E (bank 9)a call85,689
$B884 (bank 9)a call85,689
$B027 (bank 9)a call77,297
$AF04 (bank 9)a call76,320
$AF7F (bank 9)a call76,320
$AFB9 (bank 9)a table76,320
$9734 (bank 30)a call60,912
$A1A7 (bank 9)a call59,013
$A018 (bank 9)a call58,932
$A026 (bank 9)a call58,932
$A09C (bank 9)a call58,932
$A106 (bank 9)a call58,932
$A2C1 (bank 9)a table58,932
$A2E5 (bank 9)a table58,932
$A3F1 (bank 9)a call58,932
$AB94 (bank 9)a call58,932
$ACF6 (bank 9)a call58,932
$B789 (bank 9)a call58,932
$AA4E (bank 9)a call58,918
$9705 (bank 30)a call56,592
$A806 (bank 24)a call53,268
$B8F3 (bank 11)a call45,720
$BC29 (bank 11)a call44,518
$C4E0 (bank 10)a call44,376
$ADF5 (bank 11)a call44,174
$B58D (bank 11)a call44,174
$BA8A (bank 11)a call44,174
$B0C1 (bank 24)a call39,310
$B76E (bank 24)a call38,695
$A9B4 (bank 24)a call37,674
$AF6D (bank 24)a call33,048
$AFF8 (bank 24)a call33,048
$B0A0 (bank 24)a call33,048
$B340 (bank 24)a call33,048
$AA7D (bank 24)a call31,871
$B421 (bank 24)a call26,162
$B0AC (bank 24)a call24,003
$B776 (bank 24)a call24,003
$C4FA (bank 10)a table22,416
$ADBD (bank 11)a call22,087
$B53B (bank 11)a call22,087
$BB6D (bank 11)a call22,087
$ADF4 (bank 11)a table21,970
$B03C (bank 26)a call21,486
$B073 (bank 26)a call21,470
$B175 (bank 26)a call21,470
$AF9D (bank 26)a call21,468
$B256 (bank 26)a call21,468
$B44A (bank 26)a call21,468
$D1FE (bank 10)a call20,753
$D280 (bank 10)a call20,743
$B691 (bank 24)a call20,421
$AEC5 (bank 24)a call19,655
$B3C3 (bank 24)a call19,655
$AAB2 (bank 24)a table16,524
$AB81 (bank 24)a call16,524
$C506 (bank 10)a table16,447
$B6AD (bank 24)a call15,960
$AB9A (bank 24)a table13,855
$E33B (bank 31)a call13,333
$B78E (bank 24)a call13,292
$E756 (bank 31)a call11,050
$B556 (bank 24)a table9,849
$B501 (bank 9)a table9,697
$B583 (bank 9)a call9,369
$E835 (bank 31)a call7,895
$E7BF (bank 31)a call7,494
$A9CF (bank 24)a table7,448
$9C78 (bank 30)a call7,180
$E831 (bank 31)a call6,624
$B76C (bank 11)a call4,953
$D369 (bank 10)a call4,096
$ACD1 (bank 26)a call4,025
$AD68 (bank 26)a call4,025
$ABDC (bank 26)a call3,563
$E7AB (bank 31)a call3,297
$B45A (bank 24)a table3,030
$B444 (bank 24)a table2,028
$A77B (bank 9)a table1,734
$FDC7 (bank 31)a call1,382
$B878 (bank 9)a call1,289
$B431 (bank 24)a table1,241
$AD76 (bank 26)a table1,068
$A459 (bank 9)a table1,048
$C54A (bank 10)a table1,016
$C566 (bank 10)a call1,016
$CA8C (bank 10)a call994
$ADBB (bank 26)a table987
$E7B2 (bank 31)a call987
$ADA6 (bank 26)a table985
$ADD6 (bank 26)a table985
$9935 (bank 30)a call972
$A1AC (bank 28)a call762
$ABAD (bank 24)a table756
$FDBF (bank 31)a call691
$ABF7 (bank 24)a table646
$A070 (bank 26)a call636
$AB9B (bank 24)a table621
$FDA9 (bank 31)a call610
$9A49 (bank 30)a call567
$C42C (bank 14)a table567
$C576 (bank 14)a table567
$AB26 (bank 24)a call515
$FD97 (bank 31)a call448
$FCD8 (bank 31)a call432
$A40E (bank 26)a table406
$9A75 (bank 30)a call405
$C489 (bank 14)a table405
$ABC0 (bank 24)a table296
$ABCA (bank 24)a table295
$968E (bank 30)a call286
$AC2A (bank 26)a call236
$951B (bank 30)a call225
$ABA3 (bank 26)a call223
$AC69 (bank 26)a call223
$B83F (bank 27)a call223
$E7B9 (bank 31)a call214
$AB5E (bank 24)a call197
$AC1A (bank 9)a call187
$AC8C (bank 9)a table187
$A990 (bank 24)a call162
$B0C4 (bank 26)a call162
$B108 (bank 26)a call162
$C5AB (bank 14)a table162
$C5B8 (bank 14)a table162
$A8AF (bank 24)a call160
$B7A8 (bank 24)a call158
$A756 (bank 11)a table157
$A40E (bank 12)a call144
$A45D (bank 12)a call144
$FCBF (bank 31)a call144
$E82B (bank 31)a call143
$AC1A (bank 24)a table142
$AAF4 (bank 24)a table138
$A2C4 (bank 26)a table136
$A399 (bank 26)a call136
$C2C4 (bank 10)a call132
$C34D (bank 10)a call132
$A1D8 (bank 11)a call130
$A299 (bank 11)a call130
$ACBB (bank 24)a table130
$B792 (bank 11)a table127
$B363 (bank 11)a call117
$C9E5 (bank 10)a table117
$B3E8 (bank 24)a call102
$A398 (bank 26)a table100
$B818 (bank 9)a call96
$9553 (bank 30)a call83
$9A1D (bank 30)a call81
$A200 (bank 9)a table81
$A23C (bank 9)a table81
$B805 (bank 9)a call81
$C408 (bank 14)a table81
$C5F2 (bank 14)a table81
$FDB1 (bank 31)a call81
$B409 (bank 24)a table68
$A0CF (bank 26)a table64
$ACC2 (bank 9)a call61
$B30F (bank 9)a call60
$ABE4 (bank 24)a table51
$A328 (bank 26)a call36
$A3B1 (bank 26)a table18
$A3CD (bank 26)a table18
$B31B (bank 9)a call18
$B40A (bank 24)a table17
$B41B (bank 24)a table17
$A118 (bank 26)a table16
$AC20 (bank 26)a call16
$ACAA (bank 26)a call16
$B43B (bank 11)a call16
$A092 (bank 26)a table14
$A383 (bank 9)a call5
$B39D (bank 11)a call5
$AC13 (bank 24)a table4
$A181 (bank 9)a call2
$A522 (bank 26)a call2

Where it waits

Loops a rule named that sit inside a routine and are not themselves a place the code is entered.

atits name in the listingwhat it is, and the evidence
$A81C (bank 24)b24_wait_A81C
The wait for the frame: waits on the byte at $0010, times entered 53,258, turns 221,261,149, writes of it under the frame interrupt 329,192, frames in all 169,160
$A04B (bank 28)b28_wait_A04B
The wait for the frame: waits on the byte at $04E0, times entered 4, turns 4, writes of it under the frame interrupt 5,597, frames in all 169,160
$96FB (bank 30)b30_wait_96FB
The wait for the frame: waits on the byte at $0010, times entered 111,474, turns 339,706,037, writes of it under the frame interrupt 329,192, frames in all 169,160

The tables it jumps through

A table of addresses the game picks one from. Some sit right after a call to a jump engine; others are anywhere in the cartridge, and we find them by where the address the game jumped through was loaded from. Some games jump by pushing an address and returning to it, and some keep a table as two, the low bytes of its addresses in one place and the high bytes in another; both are found the same way. An entry is counted as far as the runs saw one taken; the true table may be longer. The last column is the byte of memory whose value picked the entry, where we could follow it: the game's mode, or what one of its objects is doing.

atreachedentriestakenchosen by the byte at
$A1F0 (bank 9)after a call22$0075
$A224 (bank 9)after a call111
$A2CD (bank 9)after a call111
$A44B (bank 9)after a call33
$AC5E (bank 9)after a call11
$AD33 (bank 9)after a call43
$AD89 (bank 9)after a call31
$C4B2 (bank 10)after a call26$0729
$C500 (bank 10)after a call33$0728
$CA92 (bank 10)after a call42$03E1
$AE0E (bank 11)after a call122
$B59C (bank 11)after a call171
$B772 (bank 11)after a call32$008B
$C447 (bank 14)after a call21$0706
$C496 (bank 14)after a call43$000E, $0706
$A9BF (bank 24)after a call76$00DE
$AB86 (bank 24)after a call108$00EE
$B3FD (bank 24)after a call63
$B425 (bank 24)after a call66
$B55E (bank 24)after a call55$00DD
$A088 (bank 26)after a call55$03E6
$A3A1 (bank 26)after a call83$03E5
$AD6E (bank 26)after a call44$044F

The memory its routines share

1,127 bytes of memory were written by one routine and read by another, and 148 places were reached through an index, which is what a table or a set of object slots in memory looks like.

004080C0$0000$0100$0200$0300$0400$0500$0600$07001YX+↓2X22+↓22→3Y3↓333↓3
The console's 2,048 bytes of memory, one row for each 256. A numbered span is a column of one of the object tables drawn below, counted in the same order, as long as the table and filled as it is there. Where a table's columns overlap, its things lie one after another, each with all its properties, so the table is one outline with a mark where each property starts. A dark square is a position a rule saw compared. A tick under a row is one of the 24 busiest shared bytes. 9 of those are in memory on the cartridge and are not on this map. The second row is the page the processor keeps its stack in. Reaches through an index that belong to no table are not drawn: the loops that clear memory reach nearly every byte. 3 labels are left out where columns sit too close to name each one; the drawings below name them all.

Reaches through an index: those that hold positions, then the longest

frombytes reachedinstructionspositions it holds
$0075129192 down
$00A51621 across, 1 down
$05001481 down
$00876151 across
$00792122 across
$0722261 across
$0084231 across
$008C211 across
$020125316
$020025315
$020325310
$00002464

What travels with a position

Arrays that at least two routines step through together with an array of positions, across the same range. That is what a table of the things on the screen looks like in memory: one array for each property, one slot for each thing. We can say which arrays hold positions, which of the others get added into them, which is what a speed does, which pick the way through a jump table, which is what a state or a kind does, and which are only ever counted down, which is what a timer does. What the rest hold is not named yet.

0481216202428$0075Y+97$0077$0079X$0084X$0085$008CX$008D$0095+$00B7$00CB↓$0722X$0724$0736$073E
Table 1: 14 arrays of up to 129 slots that 16 routines step through together. Each column is an array at its address and each row a slot, so one thing on the screen is one row across all of them. The first 32 of 129 slots are drawn. A number under a column is how many more bytes that array was reached across than the table is long. X and Y are positions, and the darker squares are the slots a rule saw compared. + is added into a position, which is what a speed does. → chose a jump, which is what a state or a kind does. ↓ is only ever counted down, which is what a timer does. A plain outline travels with them and is not named yet.
012345$0077$0087X$008F$0097+↓$009F$00D2$00D8→$051F
Table 2: 8 arrays of up to 6 slots that 16 routines step through together. Each column is an array at its address and each row a slot, so one thing on the screen is one row across all of them. X and Y are positions, and the darker squares are the slots a rule saw compared. + is added into a position, which is what a speed does. → chose a jump, which is what a state or a kind does. ↓ is only ever counted down, which is what a timer does. A plain outline travels with them and is not named yet.
012345678910111213$0500Y$050F↓$051E$052D$053C↓$0782
Table 3: 6 arrays of up to 14 slots that 6 routines step through together. Each column is an array at its address and each row a slot, so one thing on the screen is one row across all of them. X and Y are positions, and the darker squares are the slots a rule saw compared. + is added into a position, which is what a speed does. → chose a jump, which is what a state or a kind does. ↓ is only ever counted down, which is what a timer does. A plain outline travels with them and is not named yet.
slotsarraysroutinespositions acrosspositions downadded into themchoosing a jumpcounted downtravelling with them
1291416$0079, $0084, $008C, $0722$0075$0095$00CB$0077, $0085, $008D, $0095, $00B7, $00CB, $0724, $0736, $073E
6816$0087$0097$00D8$0097$0077, $008F, $0097, $009F, $00D2, $00D8, $051F
1466$0500$050F, $053C$050F, $051E, $052D, $053C, $0782

The 24 busiest shared bytes

bytereads and writesroutines writingroutines reading
$000030,868,27566
$000129,115,72766
$000E9,318,01566
$00028,850,62366
$000F6,232,38466
$00034,510,84766
$000C3,186,12866
$69102,176,06866
$00051,705,67666
$00061,395,81666
$00071,395,01366
$00041,173,13666
$68CB1,006,63945
$6814997,84266
$6813981,54966
$00F7948,34433
$68CA890,52056
$7E98855,84424
$0015793,31246
$6824717,31556
$6825715,61956
$0075706,63266
$00F8679,38834
$6836679,33166

This page shows none of the game's bytes. The listing these figures were read from stays with the cartridge.

All the games