free space: 7d2e-7d6d,9613-9652,9718-980f,9a1a-9a4f,9c2d-9d0f,cccd-cd0f,dccd-dd0f,e240-e28f,e650-e78f,f70d-f78f
fe53/fe63-fe81

d0 holds money's 1s digit. d1 the 10s digit. d2 the 100s digit. d3 the 1000s digit. d4 the 10000s digit.
d5 holds XP's 10s digit. d6 is 100s digit. d7 is 1000s digit. d8 is 10000s digit. d9 is 100,000s digit. da is 1,000,000s digit. $26 is value for blank/empty.
00c0 current HP, 00c4 max HP. b9 is player level
00c2-3 current MP, 00c6 max MP
$160-F stores inventory, odd bytes store # of uses; $170-F stores backup loaded when Continuing;
$138 stores equipped weapon, $139 its slot; $036 contains sprite armor version; $E9 affected by equipping armor;
$E3 stores equipped spell, $E2 stores eqipped item slot#



write $C0 to $A001 to write protect NVRAM, write $80 to clear protection; MMC3's NVRAM is $6000-$7fff
joy1 data written to $24. $0E contains last frame's input. EOR of the two then stored in $26. $04 is select, $08 start


password input on continue screen stored at $120-$131, values $0-$23. also populated in inn. $13A set to #$01 upon saving so Continue autocontinues

bank switching:
fccf sends #05,#09;04,08;03,04;02,03;01,1C;00,14 to 8000,8001 every frame during gameplay
fda9 sends #06,0C;07,0D at boot
fe2c sends #05,14 at boot

07/0D:A000->02:A000
07/00:A000->00:A000
06/0C:8000->02:8000
06/00:8000->00:8000/0010



$fd5e/fd6e runs initialization at boot
on boot, initialize MMC3's mirror register to Horizontal & SRAM area to active:
@fd68/fd78:	jsr $fd40
		20 40 FD
@fd40/fd50	lda #$01	sta $A000	lda #$C0	sta #A001	jsr fe72	rts
		A9 01		8D 00 A0	A9 C0		8D 01 A0	20 72 FE	60


code to change bank 6, then JSR to start of ROM; switches bank 6 back after returning:
@fd1e/fd2e-fd5d/fd6d=64B
lda #06	sta $8000	lda #$00	sta $8001	stx $0151	jsr 8000	php	pha	lda #$06	
A9 06	8D 00 80	A9 00		8D 01 80	8E 51 01	20 00 80	08	48	A9 06		

sta $8000	lda #$0C	sta $8001	ldx $0151	pla	plp	RTS
8D 00 80	A9 0C		8D 01 80	AE 51 01	68	28	60


subroutine switch based on entry point:
@8000/10
	tsx	lda $0103,X	cmp #$78	beq $18h	cmp #$16	beq $74h	cmp #BB	bne +3
	BA	BD 03 01	C9 78		F0  18		C9 16		F0 74		C9 BB	D0 03

	jmp $80d0	cmp #05		bne +3	jmp $8100	jmp $8130
	4C D0 80	C9 05		D0 03	4C 00 81	4C 30 81
@8130/140
	cmp #$56	bne +3	jmp $8150	jmp $8110
	C9 56		D0 03	4C 50 81	4C 10 81

deda/5eea is subroutine in safehouse to create password, called @ CB76/CB86. redirect to FD1E/FD2E
save password and character data to NVRAM:
@8020/30
	(jsr $deda	lda #$80;	sta $A001;	ldx #$5f;	lda $0120,X;	cmp $6000,X	beq +3
	20 DA DE	A9 80		8D 01 A0	A2 5F		BD 20 01	DD 00 60	F0 03

	sta $6000,X;	dex;		bpl -14;	cpx $60ff	beq +3		stx $60ff;	lda $36
	9D 00 60	CA		10 F2		EC FF 60	F0 03		8E FF 60	A5 36

	cmp $6080	beq +3		sta $6080	lda $E9		cmp $6081	beq +3		sta $6081
	CD 80 60	F0 03		8D 80 60	A5 E9		CD 81 60	F0 03		8D 81 60

	lda $E3		cmp $6082	beq +3		sta $6082	lda $d0		cmp $6083	beq +3
	A5 E3		CD 82 60	F0 03		8D 82 60	A5 D0		CD 83 60	F0 03

	sta $6083	lda $d5		cmp $6084	beq +3		sta $6084	lda #$C0;	sta $A001;
	8D 83 60	A5 D5		CD 84 60	F0 03		8D 84 60	A9 C0		8D 01 A0

	RTS
	60


load save from NVRAM:
@B014/B024
	jsr fd1e	bne +03	to assist with pass screen override
	20 1E FD	D0 03

@8080/90
	lda $40		cmp #$01	beq +33h	lda $24		and #$0B	cmp #$0B	beq +43dec	
	A5 40		C9 01		F0 33		A5 24		29 0B		C9 0B		F0 2B		

	ldx $60ff
	AE FF 60

	bpl +38dec	ldx #$5f;	lda $6000,X;	sta $0120,X;	dex;		bpl -9;		lda $6080
	10 26		A2 5F		BD 00 60	9D 20 01	CA		10 F7		AD 80 60

	sta $36		lda $6081	sta $e9		lda $6082	sta $e3		lda $6083	sta $d0
	85 36		AD 81 60	85 E9		AD 82 60	85 E3		AD 83 60	85 D0

	lda #$02	sta $40		lda #$00	RTS		lda #$01	sta $40		RTS
	A9 02		85 40		A9 00		60		A9 01		85 40		60


save and continue at Game Over screen:
@b7b9/b7c9	jsr $fd1e	runs once, leads to 80d0
		20 1E FD

@80D0/E0			saves game
	ldx #$0F	lda $160,X	sta $170,X	dex		bpl -9
	A2 0F		BD 60 01	9D 70 01	CA		10 F7

	jsr $dd84	jsr $ddc4	jsr $de04	jsr $8020	displaced jsr	rts
	20 74 DD	20 B4 DD	20 F4 DD	20 20 80	20 B1 D3	60

@b7fa/b80a			only leave game over screen when press Start, then jump to continue game
	and #$08	bne $b808	rts	nops	displaced	jsr $d57f	jsr $ac14	jmp $b014
	29 08		D0 0A		60	EA x5	20 7F D5 60	20 7F D5	20 14 AC	4C 14 B0


select Continue if savegame present:
ac9a/acaa	lda $60FF
		AD FF 60

prevents money's ones digit from being overwritten after loading:
@d717-8	EA EA
@e0a7-8 EA EA


load XP's tens digit if loading game:
@e0cb/e0db	jsr fd66	nop
		20 4E FD	EA

@fd4e/fd5e	lda $c4		sta $c0		lda $40		cmp #$02	bne +5	lda $6084	sta $d5	rts
		A5 C4		85 C0		A5 40		C9 02		D0 05	AD 84 60	85 D5	60



spells only blink if you can't cast them once (instead of twice):
@c13c/c14c	EA EA EA EA


valkyrie's direction updates every 2 frames:
@bda6/bdb6	01


dungeon light doesn't dim if blue lantern in inventory:
@ba96/baa6	jsr fe53
		20 53 FE

@fe53/fe63	ldx #$0e	ldy #$00	lda $160,X	cmp #$02	bne +1	dey	dex	dex	
		A2 0E		A0 00		BD 60 01	C9 02		D0 01	88	CA	CA	

		bpl -12d	tya		bne +3		displaced	rts
		10 F4		98		D0 03		20 A7 D5	60



retain helmet if blue helmet equipped:
@f9e6/f9f6	jsr fd1e
		20 1E FD

@8100/0110	lda $0150	and #$01	beq +01		rts	jsr $dccc	rts
		AD 50 01	29 01		F0 01		60	20 CC DC	60


retain cape if blue cape equipped:
@fa03/fa13	jsr fd1e
		20 1E FD

@8110/0120	lda $0150	and #$02	beq +01		rts	jsr $dccc	rts
		AD 50 01	29 02		F0 01		60	20 CC DC	60


OR $0150 with #$01 if equipping blue helmet, #$02 if equipping blue cape:
@c754/c764	jsr fd1e
		20 1E FD

@8150/0160	ldx $0151	lda $015F,X	cmp #$14	bne +08		lda $0150	ora #$01	
		AE 51 01	BD 5F 01	C9 14		D0 08		AD 50 01	09 01		

sta $0150	cmp #$12	bne +08		lda $0150	ora #$02	sta $0150	lda $0160,X	rts
8D 50 01	C9 12		D0 08		AD 50 01	09 02		8D 50 01	BD 60 01	60


make blue helmet/blue cape single use:
@9b94/9ba4	01	blue cape
@9b98/9ba8	01	blue helmet



make thieves steal 2x level in money instead of items:
@f113/f123	lda $b9		asl	tay	ldx #$00	jsr $d4f9	inc $0152
		A5 B9		0A	A8	A2 00		20 F9 D4	EE 52 01


get money back when thief killed, if money had been stolen:
@f14a/f15a	lda $0152	beq +c	lda $b9		asl	tay	ldx #$00	jsr $d4af	dec $0152  rts
		AD 52 01	F0 0C	A5 B9		0A	A8	A2 00		20 AF D4	CE 52 01   60


remove inventory requirements when using time key:
@e785/e795	bne +46
		D0 46


e77f/e78f triggered when using time key at keyhole, checks inventory for chromatic sword (0f), then blue cape (12), then blue helmet (14), then Sandra soul (10)


$31 is seconds counter, lantern extinguishes when it goes from 7f to 00. ba31/ba41 resets to 00
c77a-b/c78a-b store jmp address for blue lantern effects.
ba96 jsrs to d5a7 for palette update when lantern dims
01,!2a,!2b,4e,!31a,!31b,341-3,608 no change within dungeon, change outside


f13a wipes slot for stolen item; $0150-f stores stolen inventory;$053e,054e etc. stores 4 if thief carrying anything;f0ff-f149 touch/steal subroutine;f14a-f163 helper code when kill thief (called from f0fc);f164-f223 thief AI subroutine


d4af increases gold; X holds offset from $D0, Y holds quantity to increase by
d4f9 decreases gold; X holds offset from $D0, Y holds quantity to decrease by

c6c1 writes to e9 for equipping cape/c6d0 writes to e9 for helmet
f9aa runs every hit;f9f3 removes helmet when it breaks ($e9 & $36); fa10 removes cape; dependent on $0114=$00
e8,f9 on stack for helmet;	05,fa for cape

9b70/9b80? offset by item number*2 is data table for number of uses for each item

37d6 sets $36 to #$05 after death; 37eb then sets to #$00
d57f/558f wipes 000-0ff,200-5ff
game over screen joyread: b7f8/3808

deda dependant on $140-149, only functions properly when they're populated
dd74->140-1;	ddb4->142-3;	ddf4->140-9
c9e9 copies inventory to backup at inn (and writes inn UI), d57f wipes RAM, ac14 does setup


select at menu, switches $3c between $10 and $00.
3c reads: fc12,fc79,abc3,ad55,abb5
26 reads: aed4,aee3,af16,@char creation,
26 reads: b05d,b068,b09c,@password screen
26 reads: acee,ad2f,@main menu
ppu_address calls: @menu:fcab
@menu->char select: d34e,d78f
@char select:fc30,fcab
@menu->pass screen: d34e,d78f,fcab
@pass screen: too late



palettes read from 06c0-df
fd89 loads full palette into VRAM upon boot ($80f3)
ac89 loads full palette into RAM upon boot, after exiting game over screen ($80f3)
d5a7 loads background palette into RAM, called after char select, pass entry, low health, death, lantern dim ($81a3)
b7df/b7ef loads full palette into RAM upon entering game over screen ($8133)
fc9e loads full palette into VRAM (from 6c0) upon starting game from password screen (before d5a7)
c60f loads palette when using lantern/blue lantern
d3e7 palette reload sub? ac89 & b7df

test password:
000008010000000015160110020200000101
$3F00 	$10 	BG Palette
$3F10 	$10 	Sprite Palette 
palette when starting game:
0F2716200F2414290F3821290F271929
0F0F36200F0527200F01262B0F20100C

blue gargoyles		10xp 1-10gp
blue cavemen		10xp 1-10gp
blue imps		20xp 1-10gp
blue alligator		80xp
venus flytrap		80xp
red cavemen		40xp
red gargoyles		40xp
red imps		60xp
red alligator		320xp
black cavemen		60xp
black alligator		720xp
black imp		90xp
black SO tridents	240xp
green minotaur		160xp
red venus flytrap	240xp
living flame		300xp
blue mask		240xp
red minotaur		300xp
blue golem		360xp
red golem		960xp
black golem		1800xp
thief			10xp
black venus flytrap	480xp
red scorpion		2400xp
red mask		450xp
black mask		720xp
red snake boss		1440xp
blue scorpion		1280xp
black snake boss	2240xp
black vulture		480xp
blue vulture		160xp
red vulture		300xp
blue frowner		160xp
shovel cat		480xp
blue tentacle		240xp
blue bull		1280xp
red bull		2400xp
black frowner		480xp
two-headed boss		2240xp
white snake		2550xp
white golem		2550xp