I agree with you, but that still doesn't solve my problem.

I know how the game draws its graphics, but I don't know how to go about using it. It's hard to explain, but I will try.

` 07:C975:A9 E8 LDA #$E8`

07:C977:85 FC STA $00FC = #$00

07:C979:A9 01 LDA #$01

07:C97B:0A ASL

07:C97C:8D DF 03 STA $03DF = #$00

07:C97F:4C 89 C9 JMP $C989

07:C982:A9 00 LDA #$00

07:C984:85 FC STA $00FC = #$00

07:C986:8D DF 03 STA $03DF = #$00

07:C989:BD CE E3 LDA $E3CE,X @ $E3CE = #$FE

07:C98C:85 00 STA $0000 = #$00

07:C98E:BD CF E3 LDA $E3CF,X @ $E3CF = #$C9

07:C991:85 01 STA $0001 = #$CA

07:C993:20 B3 C4 JSR $C4B3

07:C996:A9 00 LDA #$00

07:C998:85 FD STA $00FD = #$00

07:C99A:AD 02 20 LDA $2002 = #$00

07:C99D:A0 01 LDY #$01

07:C99F:B1 00 LDA ($00),Y @ $CA78 = #$FE

07:C9A1:8D 06 20 STA $2006 = #$00

07:C9A4:88 DEY

07:C9A5:B1 00 LDA ($00),Y @ $CA78 = #$FE

07:C9A7:8D 06 20 STA $2006 = #$00

07:C9AA:A2 00 LDX #$00

07:C9AC:A9 02 LDA #$02

07:C9AE:20 1B C7 JSR $C71B

07:C9B1:A0 00 LDY #$00

07:C9B3:B1 00 LDA ($00),Y @ $CA78 = #$FE

07:C9B5:C9 FF CMP #$FF

07:C9B7:F0 3E BEQ $C9F7

07:C9B9:C9 7F CMP #$7F

07:C9BB:F0 32 BEQ $C9EF

07:C9BD:A8 TAY

07:C9BE:10 1D BPL $C9DD

07:C9C0:29 7F AND #$7F

07:C9C2:85 02 STA $0002 = #$78

07:C9C4:A0 01 LDY #$01

07:C9C6:B1 00 LDA ($00),Y @ $CA78 = #$FE

07:C9C8:8D 07 20 STA $2007 = #$00

07:C9CB:C4 02 CPY $0002 = #$78

07:C9CD:F0 03 BEQ $C9D2

07:C9CF:C8 INY

07:C9D0:D0 F4 BNE $C9C6

07:C9D2:A9 01 LDA #$01

07:C9D4:18 CLC

07:C9D5:65 02 ADC $0002 = #$78

07:C9D7:20 1B C7 JSR $C71B

07:C9DA:4C B1 C9 JMP $C9B1

07:C9DD:A0 01 LDY #$01

07:C9DF:85 02 STA $0002 = #$78

07:C9E1:B1 00 LDA ($00),Y @ $CA78 = #$FE

07:C9E3:A4 02 LDY $0002 = #$78

>07:C9E5:8D 07 20 STA $2007 = #$00

07:C9E8:88 DEY

07:C9E9:D0 FA BNE $C9E5

07:C9EB:A9 02 LDA #$02

07:C9ED:D0 E8 BNE $C9D7

07:C9EF:A9 01 LDA #$01

07:C9F1:20 1B C7 JSR $C71B

07:C9F4:4C 9A C9 JMP $C99A

07:C9F7:A9 03 LDA #$03

07:C9F9:85 20 STA $002

07:C9FB:4C 84 C4 JMP $C484

07:C9FE:00 BRK

07:C9FF:20 78 00 JSR $0078

07:CA02:78 SEI

07:CA03:00 BRK

07:CA04:78 SEI

07:CA05:00 BRK

07:CA06:78 SEI

07:CA07:00 BRK

07:CA08:78 SEI

07:CA09:00 BRK

07:CA0A:78 SEI

07:CA0B:00 BRK

07:CA0C:78 SEI

07:CA0D:00 BRK

07:CA0E:78 SEI

07:CA0F:00 BRK

07:CA10:40 RTI

07:CA11:00 BRK

07:CA12:7F UNDEFINED

07:CA13:00 BRK

07:CA14:28 PLP

07:CA15:78 SEI

07:CA16:00 BRK

07:CA17:78 SEI

07:CA18:00 BRK

07:CA19:78 SEI

07:CA1A:00 BRK

07:CA1B:78 SEI

07:CA1C:00 BRK

07:CA1D:78 SEI

What the game is doing is reading and writing the graphics indirectly. For instance, the code above shortened, so you can see the real important parts:

` 07:C99A:AD 02 20 LDA $2002 = #$00`

07:C99D:A0 01 LDY #$01

07:C99F:B1 00 LDA ($00),Y @ $CA78 = #$FE

07:C9A1:8D 06 20 STA $2006 = #$00

07:C9A4:88 DEY

07:C9A5:B1 00 LDA ($00),Y @ $CA78 = #$FE

07:C9A7:8D 06 20 STA $2006 = #$00

07:C9C4:A0 01 LDY #$01

07:C9C6:B1 00 LDA ($00),Y @ $CA78 = #$FE

07:C9C8:8D 07 20 STA $2007 = #$00

07:C9CB:C4 02 CPY $0002 = #$78

07:C9CD:F0 03 BEQ $C9D2

07:C9CF:C8 INY

07:C9D0:D0 F4 BNE $C9C6

07:C9D2:A9 01 LDA #$01

07:C9D4:18 CLC

07:C9D5:65 02 ADC $0002 = #$78

07:C9D7:20 1B C7 JSR $C71B

07:C9DA:4C B1 C9 JMP $C9B1

07:C9DD:A0 01 LDY #$01

07:C9DF:85 02 STA $0002 = #$78

07:C9E1:B1 00 LDA ($00),Y @ $CA78 = #$FE

07:C9E3:A4 02 LDY $0002 = #$78

>07:C9E5:8D 07 20 STA $2007 = #$00

07:C9E8:88 DEY

07:C9E9:D0 FA BNE $C9E5

So, what you have to do is write to $00, $01, and $02.

$00 is addeded with what is in $01, which gives you the full address:

So, for instance, $00 = #$00, and $01 is #$80,

So, the full address is $8000.

Then, Y is loaded with what is in $02. So if I load Y with #$37,

I will get $8000 + #$37, which is $8037, and then the Y gets decremented. So it is reading the bytes in reverse, and writing them to the screen.

The titlescreen data is located in bank 01, at $BD00. The above code shows $CA78, but that is because it is reading something else. That code above was just to show where the PPU routine is. If you run the code a few times after the debugger snaps, $BD00 will show up.

The problem is, how do I ADD the bytes I want written in that $BD00 range? At first glance it doesn't seem like I can without screwing things up badly. I'm going to have to count the total number of bytes, and the study the PPU routine a bit more to figure out how what is exactly going on.

The other thing I have had trouble with, is if I add a JSR or JMP after all of this writing routine, or at a different point in the code, it screws up the game as well. I tried to manually write the indirect values into $00, $01, and $02, and JSRsing to the PPU writing routine, and I'm still getting problems.

It's a case of I know where the PPU tiles writing routine is, I've got a general idea of how it operates, but I don't know how to squeeze the data I want written in there.

So I just have to continue to meditate on this until the answer comes to me.

I hate games that do this, but I would like to know how to get around it. I believe Super Mario Bros. 2 (USA) did the same thing, which is why I was having problems with it. In fact, I couldn't figure it out with that game, so I just used sprites to display the titlescreen option box. But I would very much like to know how this works, so I can have the titlescreen I want.

I'm going to study the PPU writing routine a lot more, and see if I can learn more from it.

Thank you for the information Disch. I know you can only help up to a point, and I appreciate the information that you given me. I would feel good about myself if I can figure this out myself, so I will continue to try. I am not going to give up on this problem. For however long it takes I will make it my business to figure this problem out.

**March 09, 2016, 02:29:35 am - (Auto Merged - Double Posts are not allowed before 7 days.)**

I did it!

I was able to write my tiles to the titlescreen!

Now, I didn't exactly use the game's PPU routine. What I did instead was, I set a breakpoint of write to $2007, to bring up the game's PPU routine as I have done many times before. Only this time, I had the trace logger opened, and I logged the code of the titlescreen. I searched for the proper bankswitch to bank 01 (which I knew had the titlescreen tiles), and checked the trace logger and the debugger. I was able to find out where bank 1 was loaded right before it jumped to the ppu writing routine. So I jumped to some free space I had in the hardwired bank, loaded my free bank, and wrote the tiles manually. It worked like a charm!

Thanks for your help guys!