Atari 2600

1.1 6507 reset sequence

The 6507 is a pin-reduced NMOS 6502 die (28-pin DIP, A0–A12 only; no IRQ, no NMI, no SYNC, no RDY brought out on most cart designs). Reset behavior is identical to the NMOS 6502 because the core is the same.

• Reset takes 7 cycles. The first two are internal microcode. Cycles 3–5 are fake stack pushes — the address bus is driven to $01FD, $01FE, $01FF in turn but the R/W line is forced to read, not write. Cycles 6–7 fetch the reset vector from $FFFC (low) and $FFFD (high). See pagetable.com — "Internals of BRK/IRQ/NMI/RESET on a MOS 6502".
• A, X, Y are undefined on real hardware. Stella's M6502.cxx initializes them to 0 by convention so runs are reproducible; real silicon reflects metastable latches. See NESDev wiki — CPU power-up state.
• Stack pointer S is decremented three times by the reset microcode (same path as BRK/IRQ, writes converted to reads). On hardware that powered up with S=$00, this yields S=$FD after reset. The initial SP is itself undefined on NMOS: NESDev forum puts it bluntly: "A 6502 has no boot state. Even in a cold boot you can not rely upon anything having a fixed value."
• Processor flags P: Only the I flag is set by reset. The D flag is undefined on NMOS — this is why every well-written reset routine opens with SEI; CLD.

Reset assertion to first opcode fetch7 CPU cycles (≈ 5.9 µs at 1.193 MHz NTSC).

1.2 RIOT RAM ($0080–$00FF, 128 bytes) at power-on

The hardware does not clear RAM. The 6532 RIOT contains 128 bytes of static SRAM; at power-up the cells settle to whatever pattern the latches resolved to as Vcc rose — effectively random with strong die-dependent biases.

Stella's default is to zero-fill RAM, but the randomize_ram option toggles a deterministic-but-nonzero pattern designed to expose games that depend on specific uninitialized values (see Stella source repository). A static-recomp runtime that hard-zeros RAM at boot will hide bugs in lifted games that happened to assume specific uninitialized values. Adopt Stella's randomization policy by default.

This is why every commercial game opens with the equivalent of CLEAN_START. From the DASM macro file at github.com/munsie/dasm/.../macro.h, the macro revision history records: "1.03 23/JUN/2003 — CLEAN_START macro added — clears TIA, RAM, registers" (current file is at rev 1.07, 19/JAN/2020). The macro itself, by Andrew Davie:

MAC CLEAN_START
SEI
CLD
LDX #0
TXA
TAY
.CLEAR_STACK
DEX
TXS
PHA
BNE .CLEAR_STACK    ; loop $00-$FF; SP ends at $FF, A=X=Y=0
ENDM

The clever piecePHA writes A=0 to $01FF, $01FE, … working backwards through the stack page, which mirrors RIOT RAM at $0080–$00FF, and simultaneously writes through TIA mirrors at $00–$3F (A12=0, A7=0). One 256-iteration loop zeroes RAM, the stack image, and every TIA write register.

1.3 First-frame timing budget

After CLEAN_START (~270 cycles), most games drop into the VERTICAL_SYNC macro

MAC VERTICAL_SYNC
LDA #$02
STA WSYNC        ; finish current line
STA VSYNC        ; VSYNC on
STA WSYNC
STA WSYNC
STA WSYNC        ; 3 lines of VSYNC
LSR
STA VSYNC        ; VSYNC off (A=0)
ENDM

Cold boot to first visible scanline3 (VSYNC) + 37 (VBLANK) = 40 scanlines × 76 = 3,040 CPU cycles of "blanking before pixels," exclusive of init. First "rendered frame" reachable ≈ 3,300 cycles after reset (≈ 2.8 ms). A static-recomp runtime will not see meaningful TIA write traffic until VBLANK ends and the kernel loop begins.

2.1 NTSC frame structure

Per SPG §3.1, each scanline is 228 TIA color clocks = 76 CPU cycles (3:1; TIA is the master 3.58 MHz colorburst clock, the 6507 runs at /3). Each scanline begins with 68 color clocks of horizontal blank (HBLANK) followed by 160 visible color clocks. See Stella Programmer's Guide (HTML).

2.2 WSYNC ($02)

Writing any value to WSYNC strobes RDY low to the 6507, halting the CPU until the next leading edge of horizontal blank (SPG §3.2). Skipping WSYNC is safe only when you've cycle-counted the kernel to exactly 76 cycles per line; the moment you slip a single cycle, the beam position drifts and any subsequent RESPx strobe positions the sprite at a different column.

2.3 RESPx + HMOVE positioning

The canonical positioning subroutine (Andrew Davie / R. Mundschau, RandomTerrain review cycle):

PosObject SUBROUTINE
sta WSYNC          ; 00  align to start of scanline
sec                ; 02
.divideby15
sbc #15            ; 04  consume the necessary time
bcs .divideby15    ; 06/07  at 11/16/21/26/31/36/41/46/51/56/61/66
tay                ; 13
lda fineAdjustTable,y ; 5 cycles guaranteed (page crossing)
sta HMP0,x
sta RESP0,x        ; coarse position; pixel ≈ 6502_cycle * 3
rts

Three things bite static recompilation here

1. The subtract loop's cycle count IS the position. A lifter that strength-reduces or unrolls the loop changes the timing and breaks every sprite.
2. The page-crossing dummy fetch (lda fineAdjustTable,y) is deliberately +1 cycle. A linker that moves the table to a page-aligned address skips the cycle and shifts all sprites by 3 pixels.
3. **STA RESP0,X is a 4-cycle indexed write with the side effect at the last cycle.** The C runtime must commit the RESPx strobe at the same intra-instruction cycle position real hardware does.

2.4 RESP0 strobe offset

When RESP0 is strobed at TIA color-clock position X (measured from start of scanline, including the 68-clock HBLANK), the player position counter is set such that the first pixel of the player appears at column X + offset. The community argued +4 vs +5 for years. Andrew Towers' TIA Hardware Notes describes the counter as latching one clock late due to strobe propagation, and Stella's TIA.cxx models the player emission as beginning +5 color clocks after the strobe (during the visible portion with no HMOVE active); +4 for missile and ball.

The disagreement between SPG ("object will begin its serial graphics at the time of a horizontal line at which the reset address occurs", reading as +0) and Stella's +5 is a documentation gap in SPG, not a Stella bug. Use +5 for player, +4 for missile/ball, mirroring Stella. The Stella debugger's Pixel Pos field reflects this convention, as confirmed in the AtariAge thread on "Fine player positioning: Stella 'Pixel Pos' value is different from P0 Pos. at RESP0".

2.5 HMOVE blank stripe ("the comb")

Runtime obligation

/* On any scanline where HMOVE was strobed during HBLANK
* (specifically, within the first ~3 CPU cycles after WSYNC release):
*   1. Force pixels 0..7 of visible scanline to background color = 0 (black)
*   2. Shift effective object emission point by +8 color clocks for that line
* Late HMOVEs (after HBLANK has ended) — the illegal HMOVE — produce partial
* combs and stuff clock pulses into mid-line counters; this is what Cosmic
* Ark's starfield exploits. */

2.6 Score kernel vs. play-field kernel

The playfield kernel is the inner loop running for 192 lines (or 2 × 96, or 4 × 48 with line-doubling), updating GRP0/GRP1/PF0/PF1/PF2 each scanline. The score kernel is the bottom-of-screen 10–20-line band where CTRLPF.D1 (SCORE bit) is set so each playfield half takes its color from COLUP0/COLUP1 — score digits drawn as PF1/PF2 patterns then appear in player-0 and player-1 colors. Ships/lives indicators use GRP0/GRP1 with VDELP0/VDELP1=1 so each graphics register has a one-line shadow latch, allowing two updates per two-line band without flicker.

For static recompilation the score-kernel pattern is highly stereotyped: the STA PF1 ; STA PF2 ; STA PF1 ; STA PF2 cadence over a 10-line tail of the visible kernel is a reliable score-band detector for automated invariant checks (§10.3).

3.1 Demo-loop detection idioms

"No input yet" detection in 1981-era code is uniformly one of

• TIM64T countdown: write a value to TIM64T ($0296), poll INTIM ($0284) until it underflows.
• SWCHA edge-detect: read SWCHA ($0280), XOR against the prior-frame snapshot in zero page; nonzero means a stick moved.
• INPT4/INPT5 polling: read $003C/$003D. Bit 7=1 means no press (active-low, internal pull-up).

3.2 SWCHB ($0282) console-switch bits

From SPG §4.1

Active-low for both buttons. The LSR ; BCS NotReset idiom is universal — see SpiceWare's "Let's Make a Game" Step 8. Unused bits D2/D4/D5 read back as whatever was last written if SWBCNT configures those bits as output — no$2k6 specs records: "the three unused bits could be configured as output, the respective SWCHB bits can be then used to store 3 bits of custom read/writeable data (as done by Combat)."

3.3 Indirect-JMP-via-zero-page dispatch

The static-recomp killer. Asteroids uses JMP (mE3) at $D00B (computerarcheology.com Asteroids disassembly). The target byte $E3 is overwritten by the kernel state machine itself — STA $E3 #$83 at $D01B and $D07C, STA $E3 #$C0 at $D09A, etc. — producing a 4-target dispatch at minimum.

Static disassembly cannot resolve this without abstract interpretation of the writers' value sets. The realistic answer: identify every STA zp whose target is later read by JMP (zp), collect the constant set written across both banks, and emit a C switch over those constants with a fallthrough trap. Asteroids is tractable because every observed STA $E3 is immediate-mode literal; games that compute the dispatch arithmetically require manual annotation.

4.1 13-bit address bus consequences

The 6507 brings out only A0–A12. From no$2k6 specs: "All memory is mirrored in steps of 2000h." Concretely:

• Cartridge area is the 4 KB window $1000–$1FFF (A12=1). Also appears at $3000, $5000, $7000, $9000, $B000, $D000, $F000. The reset vector at $FFFC/$FFFD is read through the $F000 mirror, which is why nearly every commercial ROM places its reset code with ORG $F000 even though it physically lives at cart offset $0000.
• TIA: A12=0, A7=0 — 16 mirrors of 64-byte register block in the 4 KB low half.
• RIOT RAM: A12=0, A9=0, A7=1 — 128 bytes at $0080, mirrored at $0180 (the stack page).
• RIOT I/O: A12=0, A9=1, A7=1 — $0280–$029F.

There is no IRQ pin on the 6507 in standard cart wiring; the input is not routed. There is no NMI pin (the die has the pad but the package doesn't). A lifter can safely refuse to emit IRQ/NMI dispatch code, but must still handle BRK because BRK is reachable from RAM-resident code in some games.

4.2 JMP indirect page-boundary bug

JMP ($XXFF) reads the low byte of the target from $XXFF and the high byte from $XX00 (NOT $(XX+1)00). The 6507 has this NMOS bug. From masswerk.at 6502 instruction set reference: "For example if address $3000 contains $40, $30FF contains $80, and $3100 contains $50, the result of JMP ($30FF) will be a transfer of control to $4080 rather than $5080." Asteroids' JMP (mE3) is safe (low byte $E3 is well clear of any $xxFF boundary), but a general lifter must emulate the bug exactly when the indirect operand's low byte is $FF.

4.3 BRK without IRQ wiring

BRK fires the standard 6502 microcodepushes PC+2 and P|0x10 (B flag set in pushed copy), then reads the IRQ vector from $FFFE/$FFFF. On a cart without IRQ logic, $FFFE/$FFFF is just whatever the cart ROM has there. Most carts place a BRK trap or simply set $FFFE/$FFFF = $F000 so a stray BRK restarts the game.

4.4 Undocumented opcodes used by commercial games

NMOS 6502 illegal opcodes are stable in their NMOS form. Useful subset known to appear in Atari 2600 commercial and homebrew ROMs — Andrew Davie comments on pagetable.com: "As a 'modern' 2600 programmer, I make use of the undefined opcodes when applicable; LAX and SAX are quite common; DCP is handy."

The SHA/SHX/SHY "AND with (high byte of address + 1)" semantics are page-crossing dependent. From the Preterhuman wiki, undocumented opcodes list: "The observation of the function 'AND with the high byte of the argument + 1' (from Adam Vardy's list) seems to be correct." When the indexed address crosses a page, the high byte fed into the AND is the new high byte.

Commercial Atari 2600 titles known to use illegals: I could not locate a definitive published per-title catalogue from a primary source. Community statements (Davie on pagetable; the comp.sys.apple2 thread) confirm LAX, SAX, and DCP appear in homebrew and "some" commercial titles. Treat as: implement LAX/SAX/DCP/SLO/SRE/ALR/ARR/RLA/RRA/ISC at minimum, AHX/SHX/SHY at low priority, JAM as a runtime fatal.

5.1 Position counters

Five position counters (P0, P1, M0, M1, BL). They are continuously clocked during the visible portion of every scanline at the color-clock rate, wrapping modulo 160. When the counter wraps through zero, the corresponding object opens its graphics emission window. Writing to RESPx/RESMx/RESBL forces the counter to a state that will next wrap at "now + offset" where the offset is +5 (player), +4 (missile/ball) per §2.4. The counter is not zeroed; it is set to a value producing the wrap at the desired moment, so subsequent HMOVE adjustments remain relative to the current counter.

5.2 HMOVE comb

See §2.5. The 8-pixel left-edge stripe and the +8-clock object shift on the line where HMOVE is strobed during HBLANK.

5.3 Mid-frame RESPx re-strobe

Pitfall! and Asteroids' attract-mode multi-ship animation rely on re-strobing RESPx mid-frame. The position counter resets on every strobe, so a kernel can draw a player at column 30 across lines 50–80, then re-strobe RESP0 at column 100 in the HBLANK before line 81 and the same GRP0 byte renders a second copy at column 100 for lines 81–120. The lifter must NOT coalesce or eliminate RESPx writes — every one is a side-effecting hardware operation tied to the cycle at which it executes.

5.4 Collision latches

Eight 1-bit latches read at $30–$37. Latches set during pixel rendering when two objects emit pixels at the same color clock; cleared by any write to CXCLR ($2C).

Lower 6 bits of each latch register read as data-bus residue (no storage); most games mask to bits 6/7. Stella's changelog records repeated "Fixes for collision corner cases (during HBlank)" — collisions during HBLANK are an edge case where two counters' wrap points overlap. For tier-1/tier-2 model collisions only during the visible portion (color clocks 68–227); revisit if a specific ROM depends on HBLANK collisions.

5.5 Audio

Per SPG §11 and no$2k6 specs

• AUDCx (5-bit channel-control, $15/$16): 0=silence, 1=4-bit poly, 4=div-by-2 pure, 6=div-by-31 pure, 12=div-by-6 pure, 15=poly5+poly4. Common pure-tone codes: 4, 6, 12.
• AUDFx (5-bit divider, $17/$18): output frequency ≈ 30 kHz / (AUDFx + 1) for pure modes; AUDF=0 ≈ 30 kHz, AUDF=31 ≈ 937 Hz.
• AUDVx (4-bit volume, $19/$1A): 0 = true silence (output transistor pulled off), 1 = lowest, 15 = max. Hard cliff at AUDV=0 — a linear-volume runtime will produce audible hum.

6.1 INTIM countdown

From no$2k6 specs

• Writes to TIM1T ($0294), TIM8T ($0295), TIM64T ($0296), T1024T ($0297) load the 8-bit counter AND select the prescaler (1, 8, 64, 1024 CPU cycles per tick).
• "The timer is decremented once immediately after writing." Write $0A to TIM64T, INTIM reads $09 next cycle.
• While non-zero, the timer decrements at the prescaler rate. On underflow, the timer decrements every CPU cycle and INSTAT ($0285) bit 7 goes high. Reading INSTAT clears bit 6 but not bit 7; writing a new TIMxT value clears bit 7.

A lifter needs a true cycle-counted timer model — not frame-grain. Many state machines (Davie's "Advanced Timeslicing", RandomTerrain review cycle) measure exact post-VBLANK time remaining by reading INTIM after underflow.

6.2 SWCHA, SWCHB internal pull-ups

Both ports have internal pull-ups; unconnected input pins read 1, active-low for both joystick directions and console switches. SWCHA bit layout: D7=P0 up, D6=P0 down, D5=P0 left, D4=P0 right, D3–D0 same for P1. Pressed direction reads 0; released reads 1.

Static-recomp failure modea runtime returning 0 from any unmapped MMIO read makes every game think every joystick direction is held simultaneously. Default SWCHA = $FF, SWCHB = $3F (RESET and SELECT not pressed, both difficulties = amateur, color mode).

6.3 DDR registers

SWACNT ($0281) and SWBCNT ($0283) configure pins as input (0) or output (1). Rarely written by commercial code. Combat writes SWBCNT to expose the three unused SWCHB bits as readable scratch. Default both DDRs to 0 (input); model writes only on observation.

6.4 RAM mirroring and stack-share

128 bytes, visible at $0080–$00FF (primary), $0180–$01FF (stack page — same physical bytes), and repeated at every $0400 boundary up through the 8 KB address space.

Stack and zero-page variables share 128 bytes. A program that uses $80–$BF for variables and lets the stack grow from $FF fails catastrophically if SP descends below $C0. The lifter MUST model this aliasing — do not allocate two C arrays for "zero page" and "stack page".

All hotspot addresses below from Kevin Horton's "Mostly Inclusive Atari 2600 Mapper / Selected Hardware Document" (v1.00, 03/04/12). Cross-checked against 6502ts/resources/stella/mappers.txt.

7.1 DEEP coverage

F8 (Atari 8K)

• ROM: 2 × 4K banks. Hotspots: $1FF8 (bank 0), $1FF9 (bank 1).
• Any access — read, write, RMW — triggers. Horton: "ANY kind of access will trigger the switching."
• Power-on bank: hardware undefined; Stella's CartF8.cxx initializes to the second bank. Practical convention: dual-bank stubs at identical addresses in both banks.
• Bank-switch-while-PC-in-window: instruction containing the hotspot access completes from the old bank (opcode and operand already latched); the next opcode fetch is from the new bank. The dual-bank trampoline below MUST exist at the same address in both banks.
• RMW on hotspot (e.g., INC $1FF8): triggers the switch in the middle of the instruction's read-modify-write sequence. No commercial game does this; trap in lifter.
• Detection: Stella autodetects by scanning for LDA $1FF8/LDA $1FF9/BIT $1FF8/BIT $1FF9 patterns in the image; an 8 KB ROM with these patterns and no other hotspot patterns is F8.
• Marquee: Asteroids (CX2649), Defender (CX2609), Space Invaders (CX2632), Pac-Man (CX2646), Battlezone (CX2681).

F6 (Atari 16K)

• ROM: 4 × 4K banks. Hotspots: $1FF6/$1FF7/$1FF8/$1FF9 (banks 0/1/2/3).
• Edge cases identical to F8.
• Marquee: Crystal Castles, Donkey Kong Junior, Star Wars: Empire Strikes Back, Pete Rose Baseball, Solaris, Crossbow.

F4 (Atari 32K)

• ROM: 8 × 4K banks. Hotspots: $1FF4–$1FFB.
• Marquee: Fatal Run.

FA (CBS RAM Plus, 12K + 256 RAM)

• ROM: 3 × 4K banks. Hotspots: $1FF8/$1FF9/$1FFA.
• RAM: 256 bytes — write port $1000–$10FF, read port $1100–$11FF. RMW on this RAM is broken by design (read reads from the write port = open bus). No commercial game does RMW on FA RAM; trap in lifter.
• Marquee: Omega Race, Tunnel Runner, Mountain King.

FE (Activision 8K, "Subroutine Controlled Bank Select")

• ROM: 2 × 4K banks. Hotspot is not an address — the mapper sniffs the data bus for $20 (JSR) and $60 (RTS) opcodes plus stack accesses in $0100–$01FF, latching bit 5 of the value pushed/pulled. From Horton: "It watches for 20 (JSR) and 60 (RTS), and accesses to 100-1ff … latch D5. This is the NEW bank we need to be in."
• Design constraint: every JSR/RTS target must be in either $Fxxx (bit 5 of high byte = 1) or $Dxxx (bit 5 = 0).
• Lifter implementation: Track JSR/RTS by opcode (decoded anyway). At each JSR site emit bank = (target_high_byte >> 5) & 1; at each RTS return emit the same using the pulled high byte. Horton's emulator-cheat: "A13 can be used to simply select which 8K bank to be in." If the runtime sees A13 on every fetch, JSR/RTS sniffing is unnecessary.
• Marquee: Decathlon, Robot Tank, prototype Thwocker — the only three FE titles.

E0 (Parker Bros 8K)

• ROM: 8 × 1K banks. Four 1K slots:
  • $1000–$13FF via hotspots $1FE0–$1FE7 (banks 0–7)
  • $1400–$17FF via $1FE8–$1FEF
  • $1800–$1BFF via $1FF0–$1FF7
  • $1C00–$1FFF fixed to bank 7 (last 1K of ROM — the boot/handler slot)
• Power-on: slot 3 is hardwired so the reset vector at $FFFC/$FFFD comes from the last 1K. Slots 0–2 start indeterminate; the fixed slot initializes them.
• Marquee: Frogger II, Star Wars: Empire Strikes Back, Montezuma's Revenge, Tooth Protectors (the only non-PB E0 title).

E7 (M-Network 16K + RAM)

• Slots: $1000–$17FF selectable (ROM banks 0–6 via $1FE0–$1FE6, or 1K RAM via $1FE7); $1800–$19FF 256-byte windowed RAM (4 banks via $1FE8–$1FEB); $1A00–$1FFF fixed to last 1.5K ROM.
• RAM: 1K at lower slot (write port $1000–$13FF, read port $1400–$17FF); 256B windowed at $1800–$19FF (write $1800–$18FF, read $1900–$19FF).
• Per Kevin Horton's sizes.txt, BurgerTime is the only cart to actually activate the 2 K of RAM available in the E7 scheme. A frequently repeated community claim that BurgerTime copies subroutines to RAM during VBLANK has not been independently sourced to a disassembly; treat as community lore pending verification.
• Marquee: BurgerTime, Bump 'N' Jump, Masters of the Universe.

3F (Tigervision 8K)

• Slots: $1000–$17FF selectable 2K (any of up to 4 ROM banks; homebrew extends to 256); $1800–$1FFF fixed to last 2K.
• Hotspot: write to $003F — any value selects bank N. Overlaps TIA write range but $3F is unused on TIA; reads still hit TIA mirrors. Bank-select is by STA $3F only.
• Static-recomp implication: the only common mapper whose hotspot lives in zero-page TIA mirror space. A lifter that elides stores to TIA write space as no-ops will break Tigervision. Special-case: every store decoded to $003F must dispatch to the bank-switch handler.
• Marquee: Espial, Miner 2049er, Polaris, Springer, River Patrol.

7.2 Bank-switch-while-PC-in-window — the dual-bank trampoline

; Bank 0 at $1FF6:
StartBank0  STA $1FF9        ; operand fetched from OLD bank,
; bank flips at end of access
; Bank 1 at $1FF9:
EntryBank1  JMP NewBankCode  ; opcode fetched from NEW bank

The store completes (4-cycle absolute STA) with the old bank still mapped — operand bytes have already been fetched. The very next opcode fetch comes from the new bank. The post-bank-switch entry label must exist at the same address in both bank versions.

7.3 LDA-from-hotspot and RMW-on-hotspot

LDA $1FF8 is the typical bank-select form. Fetches opcode, operand-low, operand-high, then reads $1FF8; the bank flips at this read. The byte loaded into A is undefined in practice (games never use it). INC $1FF8 (5-cycle RMW) flips the bank mid-instruction, causing the write phases to land in the new bank. No commercial game does this; lifter must trap.

7.4 STUB enumeration

The reference ROM is an 8192-byte F8 cartridge. Authoritative SHA-1 hashes are recorded in Stella's stella.pro properties file under "Asteroids" — query github.com/stella-emu/stella for the specific entry. Multiple ROM variants exist (Rev 1, Rev 7; PAL builds).

The community disassembly at computerarcheology.com maps bank 0 at $D000–$DFFF and bank 1 at $F000–$FFFF. The disassembly header notes: "The code is designed to run in 2 4K bank-switch mode or flat 8K mode (in 12K map ... D000 to FFFF)."*

8.1 Boot

F8 powers up with the second (upper) bank mapped — bank 1 in the disassembly's labelling, containing $F000-$FFFF source. The reset vector is therefore read from bank 1's $FFFC/$FFFD. The bank-0 view begins at $D000 with:

D000: 4C DA F9    JMP $F9DA      ; jump to reset vector in Bank 1
; (also valid for flat 8K layout)

That is, the bank-0 reset stub immediately transfers to the bank-1 reset entry Reset1 at $F9DA. Real init lives in bank 1: CLEAN_START–style zero pass, RNG seed prep ($B9 is bumped every frame for odd/even task-switching per the disassembly header), then drop into the main attract-mode entry. Zero-page allocation per the disassembly's RAM comment:

• $B9 — frame parity counter
• $E4/E5, $E6/E7 — pointers into $D0xx/$D1xx (kernel jump-target pages)
• $EC–$F3 — asteroid picture pointers
• $F4/F5 — digit-font pointer
• $F6–$FB — six score digit values
• $FC–$FF — assembled digit-image bytes for the score kernel

8.2 Visible-frame kernel (bank 0, $D003)

D003: 85 02       STA WSYNC
D005: 85 2A       STA HMOVE
D007: 85 1C       STA GRP1
D009: 86 05       STX NUSIZ1
D00B: 6C E3 00    JMP (mE3)      ; INDIRECT DISPATCH via zero-page $E3

The indirect at $D00B is dispatched through zero-page byte $E3, which is overwritten by the kernel state machine itself at multiple sites in bank 0 alone:

The bank-0 visible-frame state machine cycles between approximately 4 immediate-mode targets ($D083, $D0C0, and adjacent labels reachable via fallthrough). Static-recomp resolution: collect every STA $E3 immediate-mode constant across both banks, emit a runtime switch over the constant set at the JMP (mE3) site with a fallthrough trap. The constant set is small (≤ 8 addresses) and fully recoverable by static analysis because every observed writer uses immediate-mode literals.

8.3 Bank-1 ↔ Bank-0 swap pattern

The disassembly contains explicit "Switch to Bank 1" and "Switch to Bank 0" stubs near the top of each bank. Canonical F8 idiom:

; In bank 0:
SwitchTo1   LDA $1FF9            ; hotspot read — bank 1 mapped after this
JMP EntryInBank1     ; opcode fetched from bank 1

Both banks contain SwitchTo0/SwitchTo1 stubs at identical addresses, ensuring the JMP's opcode fetch lands on valid code regardless of which bank is mapped during the transition. In Asteroids these swaps cluster around: score rendering (bank 0 holds digit font + score kernel; bank 1 holds main game logic + reset), collision sound-table lookups, and the attract-mode demo path (bank 1 demo AI alternating with bank 0 rendering kernel).

8.4 Attract mode → gameplay

Per the Atari CX2649 Asteroids manual: "ASTEROIDS includes 66 game variations for 1 or 2 players." GAME RESET (SWCHB bit 0 → 0) starts gameplay; GAME SELECT (SWCHB bit 1 → 0) cycles through the 66 variations. The attract demo plays a simulated game with internal joystick AI; the demo terminates on a GAME RESET low-edge.

8.5 Known indirect-JMP-via-zero-page sites

For Asteroids the dispatch table is fully recoverable; for games that compute dispatch arithmetically, manual annotation is unavoidable.

8.6 Variants — sidebar

Rev 1 (the common dump) and Rev 7 (later revision with bug fixes around saucer AI and demo timing) share kernel structure; only minor differences in attract-mode timing and variation table. Treat as the same execution-flow class; emit a per-variant constant table if needed. Out of scope further.

9.1 Self-modifying code

ROM is not writable on stock carts. True SMC of code-bearing cart bytes is impossible. But

• RAM-resident routines exist in FA, E7, and SARA games. Per Kevin Horton's sizes.txt, only BurgerTime among E7 carts actually activates the 2 K RAM, and at least some E7/FA titles execute small subroutines copied into RAM (the often-cited claim that BurgerTime does so during VBLANK is unsourced community lore — confirm with a disassembly before relying on it).
• The Supercharger (AR mapper) is entirely RAM; every commercial Starpath release is SMC by construction. The Supercharger bootloader in Kevin Horton's mappers.txt is a self-modifying CMP whose operand is overwritten before execution.

For F8/F6/F4 carts the lifter can assume code immutability. Detect RAM-execution by tracking PC against $0080–$00FF at lift time; if no reachable PC lands in RAM, no SMC handling is needed.

9.2 PC-relative idioms defeating recursive descent

• ROM jump tables: LDA tbl_lo,X / STA $E3 / LDA tbl_hi,X / STA $E4 / JMP ($E3). Recursive descent never enters tbl_lo/tbl_hi (data). The lifter must read the table at lift time and emit an N-way switch.
• PHA-PHA-RTS dispatch: push (target-1) >> 8, push (target-1) & 0xFF, RTS. Common in state machines. Pattern-match LDA #imm / PHA / LDA #imm / PHA / RTS and emit the goto directly.
• JMP (zp) with stored constants: tractable when stores are immediate-mode (Asteroids); requires abstract interpretation otherwise.

9.3 The .byte $2C / .byte $24 skip trick

The single most pervasive code-flow hazard. From the Dominant Amber byte-saving writeup on hackaday.io:

lda ScreenSaverPosition
cmp #65
beq DontIncScreenSaverPosition
inc ScreenSaverPosition
.byte $2C            ; BIT abs — eats next 2 bytes as operand
DontIncScreenSaverPosition
dec ScreenSaverOffset

When fallthrough reaches $2C, the next byte is BIT abs (3-byte). BIT executes against the address formed by the next two bytes — which are the opcode + operand of DEC ScreenSaverOffset. So the dec is skipped (executed as a no-op data fetch). Entering from the beq target executes the dec normally. $24 (BIT zp) skips 1 byte the same way. $04/$0C (undocumented NOP zp / NOP abs) likewise. Pole Position uses BIT abs in its road-rendering setup.

Lifter implications:

1. Mark BOTH the BIT abs operand bytes (as a non-instruction read) AND any branch target landing inside that BIT (as a real instruction entry). Single-pass linear sweep fails immediately.
2. Lift both interpretations as separate basic blocks even though they occupy overlapping byte ranges. Two C functions: one entered via fallthrough through the BIT, one entered via branch into the DEC.
3. Detect: any branch landing in the middle of a previously-decoded instruction is a guaranteed skip trick. Restart decoding from the landing point.

9.4 Cycle-counting taxonomy

The C runtime should expose cycle accounting as a per-instruction 64-bit counter increment; the TIA model computes cycles % 228 to derive color-clock-within-line and dispatches HBLANK/visible behavior. Do not attempt frame-grain cycle accuracy — sprite positioning will fail.

9.5 What breaks if WSYNC/VSYNC are faked

If the runtime no-ops WSYNC

• Sprites won't position (RESPx timing decoupled from beam).
• Score won't render (depends on mid-line PF1/PF2 writes).
• Anything beam-synced fails.

But state-machine progression survives if (a) TIM64T fakes the prescaler in some unit (simulated CPU cycles), (b) VSYNC/VBLANK still mark frame fences, (c) inputs default to pull-up high. "Fake timer + frame fence + ignore beam" gets games to attract mode and through demo loops. Useful as the tier-1 milestone for headless invariant testing.

9.6 Other landmines

• Mirror decoding: A lifter MUST decode every memory access through the full A12/A9/A7 rules before dispatching to a C runtime hook. Don't pattern-match on literal $0002 — pattern-match on the decoded register. The same TIA register is reachable through dozens of address values.
• Reads from TIA write registers: TIA write addresses ($00–$2C) are write-only by SPG. Stella returns open-bus / address-bus residue. BIT $02 (a WSYNC strobe via BIT) incidentally reads the write address; modelling: return data-bus residue, not zero.
• Open-bus on cart range: Outside the 4K cart window, reads return open bus. Within mirrored cart space, the cart drives the bus. Model per address-decode rules.

10.1 Minimum side-effect-accurate register set

To get a typical commercial title to gameplay (not just attract mode), the C runtime MUST model

The RIOT timer model is the unsung load-bearing piece — without it, the attract-mode state machine never advances on most games.

10.2 Common false-GREEN failure modes

These are "the test harness says PPU writes look active but the game state never advances" symptoms. Each is a specific runtime bug:

1. Timer never fires → TIM64T not modeled or INTIM not decrementing → attract state machine wedged.
2. SWCHA reads 0 → Pull-ups not modeled → every direction reads as "held"; demo or input filtering loops forever.
3. INPT4/INPT5 read 0 (not $80) → Same pull-up issue → button reads as held; title screen skips or hangs.
4. Frame counter doesn't increment → VSYNC frame-fence missing → RNG sequence identical every "frame."
5. Collision latches don't clear → CXCLR ignored → death loop after first collision.
6. WSYNC doesn't stall → CPU free-runs through kernel → RESPx at wrong cycle → sprites at wrong column or off-screen.
7. HMOVE comb not modeled → Visible artifact only; tier-3 priority.
8. TIM64T pre-decrement not modeled → Game writes $0A, reads $0A back expecting $09 → off-by-one in state-machine timing.

10.3 Per-game smoke-test invariants

Beyond clean exit, lifted ROMs should pass per-title invariants

• Score increment: Trace PF0/PF1/PF2 writes in the score-band kernel; assert digit values change after a staged input sequence.
• Player sprite column change: Trace RESP0 strobe column over 30 frames with steady left-stick; assert monotonic leftward column.
• Audio on collisions: Stage a collision; assert AUDC0 or AUDC1 write within 8 frames.
• Asteroids attract-mode CRC delta: Snapshot the assembled framebuffer at 60-frame intervals; the rotating-ships animation produces continuous monotonic CRC change (~1 revolution per 2 seconds). Static CRC = VSYNC fence missing or kernel not running.
• Bank-flip count: For F8 carts count $1FF8/$1FF9 accesses per frame. Asteroids in attract does 2–6 swaps/frame; zero means the bank decoder is broken.

10.4 Suggested milestone gates

• Tier 1 (headless attract): TIM64T + SWCHA/SWCHB pull-ups + VSYNC frame fence + INPT4/5 pull-ups. Most games reach attract mode and animate state-machine RNG.
• Tier 2 (rendered attract): T1 + cycle-accurate WSYNC stall + RESPx +5/+4 offsets + GRP0/GRP1 + VDELP shadowing + PF0/PF1/PF2 + reflect bit + HMOVE comb. Asteroids visibly animates rotating ships.
• Tier 3 (gameplay): T2 + collision latches + full audio register model + illegal opcode subset (LAX/SAX/DCP/SLO/SRE/ALR/ARR/RLA/RRA/ISC) + illegal-HMOVE class. Most non-custom-chip commercial titles run.
• Tier 4 (custom carts): FA/E7/SARA RAM ports + FE stack-watch bank switch + Supercharger emulation + DPC fetchers. Out of MVP scope.