Super Mario Bros. 2 (USA) (Rev 1)

Super Mario Bros. 2 (USA) (Rev 1) is on a MMC3 board with 131,072 bytes of program. A crawl of 8,000 steps from power-on kept 222 paths that found new code. Played back over 416,922 frames, they executed 19,286 bytes of it, 15 percent.

What the rules named

The 253 routines the runs entered

Every place the game's code was entered, by a call, an interrupt or a jump through a table. The ones a rule named come first, with what the rule saw, and their names in the listing say what they are: a poll, an engine, a drain.

atits name in the listingentered bytimeswhat it is, and the evidence
$E125 (bank 15)b15_engine_E125a call1,321,242
The jump engine: tables 13, jumps through them 1,321,242
$9AB9 (bank 2)b2_compare_9AB9a call1,022,381
Where two things are compared: instructions 2, pairs of bytes 8, bytes in all 12, times compared 26,110, X positions at $002C,$002D,$0041,$00FD,$04C0,$04D0, Y positions at $0036,$0037,$004D,$00CB,$04DC,$0533
$8214 (bank 2)b2_random_8214a call1,018,724
The random byte: frames it ran in 113,276, bytes $05AD, rotates 1, exclusive-ors 1
$F67E (bank 15)b15_poll_F67Ea call399,118
The poll: port $4016, reads a frame 16, strobes a frame 4
The poll: port $4017, reads a frame 16, strobes a frame 4
$FF85 (bank 15)b15_bank_FF85a call301,613
The bank switch: writes 1,206,405, in the blank 4,251, while drawing 1,202,154
$EB94 (bank 15)b15_nmieach frame (NMI)205,381
The scroll writer: frames it ran in 205,612, writes in the blank 397,111
$FF73 (bank 15)b15_bank_FF73a call205,381
The bank switch: writes 2,464,524, in the blank 2,464,524, while drawing 0
$EC82 (bank 15)b15_bank_EC82a call205,379
The bank switch: writes 821,412, in the blank 621,622, while drawing 199,790
$FF88 (bank 15)b15_bank_FF88a call205,379
The bank switch: writes 821,483, in the blank 780,099, while drawing 41,384
$8361 (bank 4)b4_sound_8361a call205,371
The sound driver: frames it ran in 192,303, writes 743,594
$ECE4 (bank 15)b15_drain_ECE4a call127,460
The palette writers: frames it ran in 127,460, writes 9,952
The picture writer: frames it ran in 127,460, writes 823,000, in the blank 823,000, while drawing 0
$BD95 (bank 3)b3_compare_BD95a call121,484
Where two things are compared: instructions 1, pairs of bytes 33, bytes in all 16, times compared 238,234, X positions at $0028,$0029,$0040,$0041,$04AE,$04CF,$04D0, Y positions at $0032,$0036,$0037,$004A,$004B,$004D,$04D9,$04DA,$04DC
$9CF6 (bank 2)b2_sprites_9CF6a call121,229
The sprite writers: frames it ran in 73,724, writes to the sprite page 1,283,021
$8894 (bank 2)b2_compare_8894a call117,938
Where two things are compared: instructions 1, pairs of bytes 2, bytes in all 3, times compared 20, X positions at $0041,$00FD,$04D0
$88E8 (bank 2)b2_compare_88E8a call117,938
Where two things are compared: instructions 3, pairs of bytes 3, bytes in all 5, times compared 14, X positions at $0041,$00FD,$04D0, Y positions at $0036,$00CB
$89B9 (bank 2)b2_dispatch_89B9a table115,897
The sprite writers: frames it ran in 75,359, writes to the sprite page 2,100
$ECA6 (bank 15)b15_sprites_ECA6a call114,091
The sprite writers: frames it ran in 114,045, writes to the sprite page 7,298,517
$F31A (bank 15)b15_sprites_F31Aa call113,555
The sprite writers: frames it ran in 113,555, writes to the sprite page 2,216,297
$BE0B (bank 3)b3_sprites_BE0Ba call113,460
The sprite writers: frames it ran in 113,460, writes to the sprite page 907,566
$9471 (bank 2)b2_dispatch_9471a table84,718
The random byte: frames it ran in 59,821, bytes $0040,$0041,$0068,$0069, rotates 10, exclusive-ors 3
$ED0C (bank 15)b15_palette_ED0Ca call72,028
The palette writers: frames it ran in 72,028, writes 17,408
$9E3F (bank 2)b2_compare_9E3Fa call18,207
Where two things are compared: instructions 1, pairs of bytes 6, bytes in all 7, times compared 319, X positions at $0028,$002C,$002D,$0040,$0041,$04CF,$04D0
$BD82 (bank 3)b3_compare_BD82a call13,147
Where two things are compared: instructions 1, pairs of bytes 10, bytes in all 9, times compared 13,239, X positions at $0028,$002C,$002D,$0040,$0041,$0043,$04CF,$04D0,$04D2
$BA95 (bank 3)b3_compare_BA95a call5,581
Where two things are compared: instructions 2, pairs of bytes 10, bytes in all 12, times compared 7,850, X positions at $0028,$002C,$0040,$0041,$04CF,$04D0, Y positions at $0032,$0037,$004A,$004B,$04D9,$04DA
$971D (bank 2)b2_dispatch_971Da table5,471
The sprite writers: frames it ran in 5,471, writes to the sprite page 17,913
$9135 (bank 2)b2_dispatch_9135a table2,616
The sprite writers: frames it ran in 2,616, writes to the sprite page 9,468
$FFA0 (bank 15)b15_bank_FFA0a call524
The bank switch: writes 524, in the blank 0, while drawing 524
$EC90 (bank 15)b15_sprites_EC90a call455
The sprite writers: frames it ran in 910, writes to the sprite page 29,120
$9A3D (bank 0)b0_palette_9A3Da call222
The palette writers: frames it ran in 18,712, writes 7,168
The sprite writers: frames it ran in 18,712, writes to the sprite page 70,016
$FF50 (bank 15)b15_resetpower-on222
The bank switch: writes 444, in the blank 444, while drawing 0
$E288 (bank 15)b15_sprites_E288a call206
The sprite writers: frames it ran in 28,894, writes to the sprite page 28,576
$820E (bank 2)a call1,018,724
$823D (bank 2)a call1,018,724
$820D (bank 2)a table900,786
$97D6 (bank 6)a call769,472
$8C04 (bank 6)a call478,258
$9890 (bank 6)a call472,284
$BA4E (bank 1)a call426,065
$BA71 (bank 1)a call426,065
$92AA (bank 0)a call425,587
$92C1 (bank 0)a call425,587
$924F (bank 0)a call385,095
$8643 (bank 4)a call338,133
$9053 (bank 0)a call308,076
$FAFE (bank 15)a call235,319
$8000 (bank 4)a call205,371
$8078 (bank 4)a call204,720
$8138 (bank 4)a call204,720
$82A2 (bank 4)a call204,720
$82FD (bank 4)a call204,720
$EC6E (bank 15)a call199,488
$F661 (bank 15)a call199,488
$9816 (bank 6)a call192,368
$9818 (bank 6)a call192,368
$981A (bank 6)a call192,368
$981C (bank 6)a call192,368
$8488 (bank 0)a call190,704
$B58C (bank 3)a call169,436
$BB87 (bank 3)a call169,436
$BBE2 (bank 3)a call169,436
$BC2E (bank 3)a call169,436
$BD6B (bank 3)a call169,436
$EAB1 (bank 15)a call169,209
$BD29 (bank 3)a call168,659
$BD4C (bank 3)a call168,659
$8FB2 (bank 0)a call154,038
$8FB5 (bank 0)a call154,038
$8FF5 (bank 0)a call136,958
$8FF8 (bank 0)a call136,958
$8010 (bank 2)a call113,555
$F0E9 (bank 15)a call113,555
$F228 (bank 15)a call113,555
$F47C (bank 15)a call113,460
$FACA (bank 15)a call113,460
$8256 (bank 2)a call113,276
$9885 (bank 6)a call107,518
$BDC5 (bank 3)a call94,168
$8A57 (bank 2)a call92,805
$8083 (bank 0)a call90,538
$F17E (bank 15)a call90,538
$F494 (bank 15)a call90,538
$F4C3 (bank 15)a call90,457
$82ED (bank 2)a table90,341
$997E (bank 2)a call88,426
$98D1 (bank 2)a call87,311
$9E4F (bank 2)a call85,834
$9E54 (bank 2)a call85,816
$B4FD (bank 3)a call84,718
$B5AC (bank 3)a call84,718
$9B1F (bank 2)a call83,996
$8577 (bank 2)a call83,775
$8A02 (bank 0)a call82,054
$8EA4 (bank 0)a call78,036
$8A41 (bank 0)a table77,019
$8B35 (bank 0)a call77,019
$8C1A (bank 0)a call77,019
$8CD9 (bank 0)a call77,019
$8D6F (bank 0)a call77,019
$8DC0 (bank 0)a call77,019
$8EA6 (bank 0)a call77,019
$8EFA (bank 0)a call77,019
$8FFD (bank 0)a call77,019
$9316 (bank 0)a call77,019
$8D2C (bank 0)a call65,222
$9878 (bank 6)a call56,362
$97E2 (bank 6)a call48,092
$967B (bank 6)a call41,930
$910C (bank 0)a call40,686
$828F (bank 0)a call37,295
$8629 (bank 4)a call30,560
$8634 (bank 4)a call29,301
$895D (bank 0)a call27,656
$873F (bank 4)a call24,335
$82E2 (bank 0)a call24,171
$833E (bank 0)a call23,841
$9844 (bank 6)a call23,452
$86C1 (bank 4)a call23,175
$85EC (bank 0)a call23,017
$F11E (bank 15)a call23,017
$F2C2 (bank 15)a call23,017
$8264 (bank 2)a table22,935
$86BA (bank 4)a call20,803
$86CE (bank 4)a call20,442
$9608 (bank 0)a call19,713
$8743 (bank 4)a call15,269
$82BE (bank 0)a call13,462
$F6C0 (bank 15)a call12,620
$9BB7 (bank 2)a call10,942
$823D (bank 0)a call10,387
$8000 (bank 0)a call10,160
$846A (bank 0)a call9,897
$8925 (bank 0)a call9,840
$EAAD (bank 15)a call9,272
$8311 (bank 2)a call7,176
$8412 (bank 0)a call6,257
$8138 (bank 2)a call6,105
$B6F9 (bank 3)a call5,658
$B5CC (bank 3)a call5,629
$B761 (bank 3)a table5,616
$84AC (bank 0)a call5,280
$9370 (bank 6)a call4,981
$8812 (bank 0)a call4,920
$8898 (bank 6)a call3,602
$938A (bank 6)a call3,516
$827D (bank 2)a call3,280
$98A8 (bank 6)a call3,196
$8BB3 (bank 6)a table2,864
$8500 (bank 0)a call2,460
$87AA (bank 0)a call2,460
$8872 (bank 0)a call2,460
$88FE (bank 6)a call2,336
$84FA (bank 2)a table2,041
$8BF1 (bank 0)a table1,879
$8A87 (bank 0)a table1,828
$ECB4 (bank 15)a call1,365
$8A5C (bank 0)a table1,328
$883C (bank 0)a call1,230
$8901 (bank 0)a call1,230
$88D8 (bank 6)a call1,186
$EAA9 (bank 15)a call1,167
$88B5 (bank 6)a call1,146
$EA31 (bank 15)a call1,055
$E9A4 (bank 15)a call1,021
$8A0B (bank 6)a call984
$9690 (bank 6)a call984
$96A1 (bank 6)a call984
$95D4 (bank 6)a call865
$8CAF (bank 6)a table858
$EA94 (bank 15)a call850
$8314 (bank 0)a call759
$86C8 (bank 4)a call717
$9020 (bank 6)a table654
$98BC (bank 6)a call654
$8451 (bank 10)a call593
$96B2 (bank 6)a table492
$96BB (bank 6)a table492
$95AF (bank 0)a call490
$E1F4 (bank 15)a call484
$E198 (bank 15)a call425
$8441 (bank 2)a call420
$845D (bank 2)a call405
$8A53 (bank 6)a table328
$93A4 (bank 6)a call293
$950C (bank 0)a call288
$86EE (bank 0)a call286
$933A (bank 6)a call286
$946D (bank 0)a call286
$94CA (bank 0)a call286
$950E (bank 6)a call286
$9567 (bank 6)a call286
$95E6 (bank 6)a call286
$9728 (bank 6)a call286
$98DC (bank 6)a call286
$F754 (bank 15)a call286
$8C56 (bank 6)a table246
$8D95 (bank 6)a table246
$90D3 (bank 6)a table246
$E15B (bank 15)a call231
$E166 (bank 15)a call231
$E17F (bank 15)a call231
$9604 (bank 0)a call224
$FE41 (bank 15)a call224
$FE6E (bank 15)a call221
$FE57 (bank 15)a call206
$FE16 (bank 15)a call198
$8327 (bank 10)a call196
$E228 (bank 15)a call196
$F218 (bank 15)a call196
$E1FA (bank 15)a call192
$94DC (bank 0)a table190
$9561 (bank 0)a call190
$F704 (bank 15)a call185
$8C99 (bank 0)a call181
$8B4E (bank 6)a table164
$8B77 (bank 6)a table164
$96CA (bank 6)a table164
$96E3 (bank 6)a call164
$96F0 (bank 6)a table164
$970B (bank 6)a table164
$9712 (bank 6)a table164
$BA48 (bank 1)a call152
$9143 (bank 0)a call132
$9216 (bank 0)a table132
$B964 (bank 1)a call132
$B9E3 (bank 1)a call132
$BB10 (bank 1)a call132
$F6DA (bank 15)a call99
$9514 (bank 0)a table96
$F1AE (bank 15)a call95
$F6A1 (bank 15)a call95
$856A (bank 0)a call82
$8CED (bank 6)a table82
$8D13 (bank 6)a table82
$96B4 (bank 6)a table82
$96BE (bank 6)a table82
$96CD (bank 6)a table82
$971A (bank 6)a table82
$BC1F (bank 3)a call59
$81A2 (bank 0)a call25
$B71D (bank 3)a table22
$E9EB (bank 15)a call21
$934F (bank 0)a call20
$9EAD (bank 2)a call20
$B95C (bank 3)a table20
$B9EB (bank 1)a call20
$BA5D (bank 3)a call20
$95D4 (bank 2)a call18
$EBAE (bank 15)a call17
$8461 (bank 2)a call15
$81D6 (bank 0)a call7
$81FE (bank 0)a call7
$E9FA (bank 15)a call4
$F1E1 (bank 15)a call4

Where it waits

Loops a rule named that sit inside a routine and are not themselves a place the code is entered.

atits name in the listingwhat it is, and the evidence
$961A (bank 0)b0_wait_961A
The wait for the frame: waits on the byte at $00EB, times entered 19,927, turns 89,607,497, writes of it under the frame interrupt 410,757, frames in all 206,502
$EAC3 (bank 15)b15_wait_EAC3
The wait for the frame: waits on the byte at $00EB, times entered 179,840, turns 612,079,230, writes of it under the frame interrupt 410,757, frames in all 206,502

The tables it jumps through

A table of addresses the game picks one from. Some sit right after a call to a jump engine; others are anywhere in the cartridge, and we find them by where the address the game jumped through was loaded from. Some games jump by pushing an address and returning to it, and some keep a table as two, the low bytes of its addresses in one place and the high bytes in another; both are found the same way. An entry is counted as far as the runs saw one taken; the true table may be longer. The last column is the byte of memory whose value picked the entry, where we could follow it: the game's mode, or what one of its objects is doing.

atreachedentriestakenchosen by the byte at
$8A2F (bank 0)after a call94$0050, $0546, $0082
$920E (bank 0)after a call11
$94D0 (bank 0)after a call22$0534
$8242 (bank 2)after a call33$0051, $0052, $0053, $0054
$8260 (bank 2)after a call22$00EC
$83B3 (bank 2)after a call211$0094, $0093
$8A5C (bank 2)after a call83$0094, $0093, $0098, $0096
$B713 (bank 3)after a call53
$889B (bank 6)after a call134
$88B8 (bank 6)after a call164
$88DE (bank 6)after a call73
$9693 (bank 6)after a call75
$96A4 (bank 6)after a call65

The memory its routines share

1,634 bytes of memory were written by one routine and read by another, and 105 places were reached through an index, which is what a table or a set of object slots in memory looks like.

004080C0$0000$0100$0200$0300$0400$0500$0600$07001↓+XY→222Y2→222222→22233↓33333333333Y44Y
The console's 2,048 bytes of memory, one row for each 256. A numbered span is a column of one of the object tables drawn below, counted in the same order, as long as the table and filled as it is there. Where a table's columns overlap, its things lie one after another, each with all its properties, so the table is one outline with a mark where each property starts. A dark square is a position a rule saw compared. A tick under a row is one of the 24 busiest shared bytes. The second row is the page the processor keeps its stack in. Reaches through an index that belong to no table are not drawn: the loops that clear memory reach nearly every byte.

Reaches through an index: those that hold positions, then the longest

frombytes reachedinstructionspositions it holds
$000025621 across, 1 down
$003C1163 across
$00281144 across
$04CB1133 across
$00479141 down
$04D6923 down
$0032823 down
$0046622 down
$0531421 down
$02002536
$02032016
$02012015

What travels with a position

Arrays that at least two routines step through together with an array of positions, across the same range. That is what a table of the things on the screen looks like in memory: one array for each property, one slot for each thing. We can say which arrays hold positions, which of the others get added into them, which is what a speed does, which pick the way through a jump table, which is what a state or a kind does, and which are only ever counted down, which is what a timer does. What the rest hold is not named yet.

012345678910$0014↓$001E+$0028X$0032Y$003CX$0046Y$005A$008F→$00A7↓$0407+$04CBX
Table 1: 11 arrays of up to 11 slots that 8 routines step through together. Each column is an array at its address and each row a slot, so one thing on the screen is one row across all of them. X and Y are positions, and the darker squares are the slots a rule saw compared. + is added into a position, which is what a speed does. → chose a jump, which is what a state or a kind does. ↓ is only ever counted down, which is what a timer does. A plain outline travels with them and is not named yet.
012345678$0033$003D+8$0047Y$0051→$005B$0065$006F$0079$0086$0090→$009F$00A8$00B1
Table 2: 13 arrays of up to 9 slots that 12 routines step through together. Each column is an array at its address and each row a slot, so one thing on the screen is one row across all of them. A number under a column is how many more bytes that array was reached across than the table is long. X and Y are positions, and the darker squares are the slots a rule saw compared. + is added into a position, which is what a speed does. → chose a jump, which is what a state or a kind does. ↓ is only ever counted down, which is what a timer does. A plain outline travels with them and is not named yet.
012345678$042F$0438↓$044A$0453$045C$0465$046E$0477$0480$0489$0492$04CC+8$04D6Y
Table 3: 13 arrays of up to 9 slots that 4 routines step through together. Each column is an array at its address and each row a slot, so one thing on the screen is one row across all of them. A number under a column is how many more bytes that array was reached across than the table is long. X and Y are positions, and the darker squares are the slots a rule saw compared. + is added into a position, which is what a speed does. → chose a jump, which is what a state or a kind does. ↓ is only ever counted down, which is what a timer does. A plain outline travels with them and is not named yet.
0123$04E7$0531Y
Table 4: 2 arrays of up to 4 slots that 2 routines step through together. Each column is an array at its address and each row a slot, so one thing on the screen is one row across all of them. X and Y are positions, and the darker squares are the slots a rule saw compared. + is added into a position, which is what a speed does. → chose a jump, which is what a state or a kind does. ↓ is only ever counted down, which is what a timer does. A plain outline travels with them and is not named yet.
slotsarraysroutinespositions acrosspositions downadded into themchoosing a jumpcounted downtravelling with them
11118$0028, $003C, $04CB$0032, $0046$001E, $0407$008F$0014, $00A7$0014, $001E, $005A, $008F, $00A7, $0407
91312$0047$0051, $0090$0033, $003D, $0051, $005B, $0065, $006F, $0079, $0086, $0090, $009F, $00A8, $00B1
9134$04D6$0438$042F, $0438, $044A, $0453, $045C, $0465, $046E, $0477, $0480, $0489, $0492, $04CC
422$0531$04E7

The 24 busiest shared bytes

bytereads and writesroutines writingroutines reading
$000113,424,58566
$00F511,167,74546
$00008,796,90466
$00028,256,55266
$000A4,975,48366
$00074,910,23666
$000B4,881,83466
$00034,154,24866
$00EC3,909,18326
$00123,172,72666
$000C3,164,02466
$00512,852,68316
$00A82,542,50216
$00E62,523,02066
$00902,363,24016
$00F02,032,70363
$00F12,032,68263
$00291,951,80416
$000F1,879,43366
$04001,736,85224
$00281,725,66366
$00141,663,83546
$00331,632,14816
$00321,606,68766

This page shows none of the game's bytes. The listing these figures were read from stays with the cartridge.

All the games