reverse-engineering

Files about reading, annotating, and explaining existing code at a system level.

• Game Annotation Series — narrating already-disassembled code at a layer the comments don’t reach
• TIA Reference — Atari 2600 chip docs distilled for source-reading
• NES Research — PPU/APU/Mappers references distilled for source-reading
• Transpilation as a Grounding Strategy — the RE payoff: bytecode→C transpile (Nobunaga’s Sea-16 VM) as the general technique, COBOL modernization as the application
• APU Reference (NES) — Load-bearing facts about the Audio Processing Unit (integrated into the Ricoh 2A03) for reading NES sound code.
• NES Mappers Reference — The cartridge logic that extends the NES beyond its base 32 KiB PRG / 8 KiB CHR address space.
• PPU Reference (NES) — Load-bearing facts about the Picture Processing Unit (Ricoh 2C02) for reading NES source code.
• KOEI AI & combat evolution (5-decompiler study)
• L’Empereur — the two-tier turn (NES→SNES design hinge)
• Breaking Down an SNES Cart — the teardown method — the SNES analog of the NES chip references: header/mapping/memory-map/subsystems, grounded in the SNESdev wiki
• SNES teardown — snes-decompiler — process-table pointer for the target-agnostic SNES teardown substrate (verified header/mapper tools)
• KOEI’s portable VM (SNES ROTK2 reversal) — first KOEI SNES title reversed; byte-for-byte portable bytecode VM, faithful port + facelift (NES↔SNES comparison)
• DREAM — goto-free control-flow structuring — reaching-conditions (not node splitting) resolve shared tails; the decompiler-output experiment
• The Rosetta Stone Method — learn new hardware by anchoring the unknown machine against a portable program you already understand (KOEI’s cross-platform VM as the exemplar)
• Gemfire (SNES) fully decompiled
• Nobunaga’s Ambition (SNES) compiled native — no VM — native-65816 exception proven 3 ways (no fetch loop / no dispatch table / native main); reachability walk 0 conflicts; built a native 65816→C decompiler reusing the DREAM structurer
• NA1 NES↔SNES — grading two blind reverse-engineerings — SNES-derived vs NES-derived, all 5 sections converge (record bytes, Grow formula, event cadence, weakest-neighbour AI, 8-stat combat table); create-then-check method
• Battlezone (1980) — 3D Without a Multiply Instruction — a complete third-party disassembly read as a specimen: what the pipeline actually does, verified against the listing (no software mul/div exists anywhere in the ROM), with cycle counts derived rather than assumed
• Arithmetic Scarcity and the 3D Problem — hub for the 3D-under-scarcity specimens; Battlezone grounded from primary source, Elite/Doom/Ultima marked as unwalked stubs so the grounding gap stays visible
• Stellar 7 (1983) — The Same Game Without the Coprocessor — the control specimen for the arithmetic-scarcity hub; reading the source overturned the hub’s own strategy-2 claim (software 3D does not preserve geometric freedom — it constrains the representation)
• Arithmetic as a Purchase — Sixty Years of Paying for Multiply — uses the vault’s own decompiled evidence as a specimen: KOEI’s $C1:F800 32-bit math library wrapping the SNES hardware mul/div registers, read off a real ROM rather than a spec sheet
• Bandit Kings of Ancient China (NES) — Game 6 in the KOEI NES decompiler family — decompile order, not release order.
• Gemfire (NES, 1992) — Game 7 in the KOEI NES decompiler family (decompile order, not release order — L’Empereur is
• Gemfire (SNES) — The second KOEI SNES title reversed — and the pass that exposed the trampoline bug in
• Genghis Khan (NES) — Design clock 1987; Famicom port 1989-04-20.
• KOEI tools — the shared engine toolchain — Tools node, not a title index. One studio, one bytecode-VM engine lineage, two consoles.
• L’Empereur (NES, 1991) — Game 8 in the KOEI NES decompiler family.
• LADS — byte-exact reconstruction — A reconstruction of LADS, the memory-resident 6502 assembler from Richard Mansfield’s
• Lowering Atlas — Sibling tooling to the NA1 decompiler, in the same repo: compile known C control-flow
• NA1 — Nobunaga’s Ambition (NES) — The bytecode-VM decompiler that outgrew annotation and became the series’ crucible.
• NES / Famicom — system node — The 6502 + PPU substrate and every title decompiled on it.
• NES system tools — rendering & emulator integration — The target-agnostic NES tooling: rendering, and Mesen (emulator) integration.
• ROTK1 — Sangokushi (NES) — The earliest title in the KOEI NES decompiler family, and the baseline the other four are read
• ROTK2 — Sangokushi II (NES) — Design clock 1989; Famicom port 1990.
• ROTK2 — Sangokushi II (SNES) — The first KOEI SNES title reversed, and the title that proved the portable VM from both sides.
• SNES system tools — snes-decompiler — The target-agnostic substrate for taking apart any SNES cart: 65C816, LoROM/HiROM detection,
• The comparison studies — paired deep-reads — The four titles the series started as, organized in paired comparisons.
• Aerobiz (SNES) — The third KOEI SNES title, and the first one that isn’t a port of a decompiled NES game.
• An AI Speedruns NES Zelda — the Harness, the Journal, and What Transfers — RAM as eyes, ROM tables decoded, disassembly read; the instrument-not-the-game lessons
• The AI Decomp Wave — Outside Confirmation — agent decompilation’s “answer key” = the vault’s correctness oracle; flashy ports/mods vs. mechanics; idea/expression legality
• REA (Reverse Engineer Anything) — Candidate Tool and Harness Teardown — MCP harness driving Ghidra/IDA; teardown vs. our harness (borrow: evidence records, unknowns registry); blocked on MOO1 because half of STARMAP is an FBOV overlay; 8-bit = raw 6502 only
• zappatic — Reverse Engineering MOO1 — stream digest: data-first DOS RE, save/RAM layout, caps, diplomacy, events; cross-checked vs 1oom
• Data-First RE — name the data first when the static↔runtime address join is broken (DOS real mode); the oracle ladder
• MOO1 Diplomacy — Three-Way Cross-Check — stream × OSG × 1oom, diplomacy mechanics
• MOO1 Random Events — Three-Way Cross-Check — stream × OSG × 1oom, random events
• moo1-re — MOO1 DOS v1.3 reverse engineering: dual save decoder, EXE table verifier
• The RE Build Tool — draft: an LLM verb surface over emu-harness plus a phase plan with a gate per phase, the CyborgDJ controller pattern applied to disassembly projects
• RE Build Tool Lessons — ~90 disassembly-method lessons from the memory store, vault and title repos, sorted by phase with sources
• Taking emu-harness to the other three — plan for 2600 / Intellivision / Atari 800 harness passes
• Mappy (Famicom) — mappy-decompiler — pointer to the Mappy code repo; the first title through all nine emu-harness phases
• The Legend of Zelda (NES) — Zelda1-decompiler — pointer to the Zelda 1 repo: a skeleton on the standard layout (the overworld, EXACT 128/128); the first banked native title