Fixed at 0xFFFF. Used to identify code as running on the SA-1 chip, by reading via $0000 (from which the SNES returns 0x0000 instead).

Used as a 24-bit pointer by the SNES to give the SA-1 chip a routine to execute. Controlled by $300A.

Flag to tell the SNES to run the pointer written in $3008. If negative, the SA-1 will jump to the routine specified there (assuming it is not already busy with other things). Set to 0x00 when the SA-1 finishes execution.

Used as a 24-bit pointer by the SA-1 chip to give the SNES a routine to execute. Controlled by $300E.

Flag to tell the SNES to run the pointer written in $300C. If negative, the SNES will jump to the routine specified there (assuming it is not already busy with other things). Set to 0x00 when the SNES finishes execution.

Flag to wait for NMI. Cleared by the SA-1 chip at the end of the frame, then set to 1 by the SNES after it finishes NMI.

24-bit pointer for where to next write decompressed data in $7E2000.

Starting index to the circular VRAM upload buffer at $7E0100.

Ending index to the circular VRAM upload buffer at $7E0100.

Current total NMI execution load.
If this value exceeds the amount in $301B, a lag frame should be injected to empty pending DMAs.

Maximum NMI execution load; seems to always be set to 0x11C8.
If $3019 is about to pass over this amount, a lag frame should be injected so that NMI doesn't overflow.

Current NMI execution load for DMAs queued to $0900. After an injected lag frame, $3019 should be set to this value, as the $0900 buffer will not be emptied until a true end of frame.

Current length of the VRAM DMA queue at $0900.

Layer 1 X position. Mirror of SNES register $210D.

Layer 2 X position. Mirror of SNES register $210F.

Layer 3 X position. Mirror of SNES register $2111.

Layer 1 Y position. Mirror of SNES register $210E.

Layer 2 Y position. Mirror of SNES register $2110.

Layer 3 Y position. Mirror of SNES register $2112.

Handles screen brightness and force blank. Format: f---bbbb.
f = force blank flag, bbbb = brightness setting.
Mirror of SNES register $2100.

Sprite tile size and graphical address in VRAM. Format: sssnnbbb
sss = sprite tile sizes, nn = distance between page 0 and page 1 (>>12), bbb = VRAM address pf page 0 (>>14)
Mirror of SNES register $2101.

Background mode. Format: 4321pmmm.
4321 = Layer 1/2/3/4 uses 8x8 tiles when clear, 16x16 tiles when set; p = Layer 3 absolute priority (only in background mode 1); mmm = background mode (0-7).
Mirror of SNES register $2105.

Current mosaic pixel size. Mirror of SNES register $2106.

Layer 1 tilemap VRAM address and size. Format: aaaaaayx
aaaaaa = tilemap VRAM address (>>10); y = 2x height; x = 2x width
Mirror of SNES register $2107.

Layer 2 tilemap VRAM address and size. Format: aaaaaayx
aaaaaa = tilemap VRAM address (>>10); y = 2x height; x = 2x width
Mirror of SNES register $2108.

Layer 3 tilemap VRAM address and size. Format: aaaaaayx
aaaaaa = tilemap VRAM address (>>10); y = 2x height; x = 2x width
Mirror of SNES register $2109.

Layer 4 tilemap VRAM address and size. Format: aaaaaayx
aaaaaa = tilemap VRAM address (>>10); y = 2x height; x = 2x width
Mirror of SNES register $210A.

Base VRAM address for Layer 1/2 GFX files. Format: bbbbaaaa
aaaa = address for Layer 1 (>>13), bbbb = address for Layer 2 (>>13)
Mirror of SNES register $210B.

Base VRAM address for Layer 3/4 GFX files. Format: ddddcccc
cccc = address for Layer 3 (>>13), dddd = address for Layer 4 (>>13)
Mirror of SNES register $210C.

Layer 1/2 window mask settings. Format: bbbbaaaa
aaaa = Layer 1 window settings; bbbb = Layer 2 window settings
Mirror of SNES register $2123.

Layer 3/4 window mask settings. Format: ddddcccc
cccc = Layer 3 window settings; dddd = Layer 4 window settings
Mirror of SNES register $2124.

Object and color window mask settings. Format: ffffeeee
ffff = color window settings; eeee = object window settings
Mirror of SNES register $2125.

Window 1 left position. Mirror of SNES register $2126.

Window 1 right position. Mirror of SNES register $2127.

Window 2 left position. Mirror of SNES register $2128.

Window 2 right position. Mirror of SNES register $2129.

Window mask logic for Layer 1/2/3/4. Format: 44332211
Each layer has 4 possible values: 00 = OR; 01 = AND ; 10 = XOR; 11 = XNOR
Mirror of SNES register $212A.

Window mask logic for sprites/color. Format: ----ccoo
Each layer has 4 possible values: 00 = OR; 01 = AND ; 10 = XOR; 11 = XNOR
Mirror of SNES register $212B.

Main screen designation. Format: ---o4321
Mirror of SNES register $212C.

Sub screen designation. Format: ---o4321
Mirror of SNES register $212D.

Window mask designation for the main screen. Format: ---o4321
Mirror of SNES register $212E.

Window mask designation for the sub screen. Format: ---o4321
Mirror of SNES register $212F.

Color addition settings. Format: ccmm--sd.
cc = where to clip colors to black; mm = where to prevent math; s = add subscreen rather than fixed color; d = direct color mode for 8bpp backgrounds.
Mirror of SNES register $2130.

CGADSUB settings. Format: shbo4321.
s = add (0) or subtract (1); h = half-color enable; bo4321 = affected layers (backdrop/sprites/4/3/2/1)
Mirror of SNES register $2131.

Background color, as three mirrors of SNES register $2132.
Note that the componnent bits (the top three bits, in the order bgr) also need to be included with this.

Mode 7 settings. Format: rc----yx
r = field size (1024x1024 vs larger); c = empty space fill when using a larger field (0 = transparent, 1 = fill with 0), x/y = horz/vert mirroring
Mirror of SNES register $211A.

Mode 7 matrix parameter A. Mirror of SNES register $211B.

Mode 7 matrix parameter B. Mirror of SNES register $211C.

Mode 7 matrix parameter C. Mirror of SNES register $211D.

Mode 7 matrix parameter D. Mirror of SNES register $211E.

Mode 7 center X position. Mirror of SNES register $211F.

Mode 7 center Y position. Mirror of SNES register $2120.

Interrupt enable flags. Format: n-yx---a
n = nmi, y/x = irq (corresponding to $4209, $4207), a = auto-joypad read
Mirror of SNES register $4200.

HDMA channel enable. Masked out by $3093, then stored to SNES register $420C every frame.

HDMA channel mask. Any bits set to 0 here will have the corresponding HDMA channel completely disabled.

24-bit pointer to the current IRQ routine to run. Known values are:
$0084BB - No routine.
$01EA1F - In-level status bar
Unknown if any other values are used.

Some sort of flag to deal with the timing of SA-1 and SNES's NMI execution (for handling lag?). SA-1 sets this value to 1, while the SNES clears it.
Needs further research.

Mirror of $305F, next frame (which is in turn a hardware mirror of $2100, the screen brightness). This address seems to get copied there each frame.

Mirror of $305F, current frame (which is in turn a hardware mirror of $2100, the screen brightness).

Mirror of $3072, current frame (which is in turn a hardware mirror of $212C, the main screen designation).

OAM table; handles all sprite tiles on-screen. Each tile gets 4 bytes: xxxxxxxx yyyyyyyy tttttttt yxppccct
$32A4-$32C3 handles the high X bit and size of each tile.

Controller 1 input, held. Format (16-bit): byetUDLR axlr----
a/b/x/y/l/r = respective buttons, e = select, t = start, UDLR = directional inputs

Controller 2 input, held. Format (16-bit): byetUDLR axlr----
a/b/x/y/l/r = respective buttons, e = select, t = start, UDLR = directional inputs

Mirror of $32C4 (controller 1 input), on frames when $7E0036 is reset. On any other frame, this address is 0x0000.

Mirror of $32C6 (controller 2 input), on frames when $7E0038 is reset. On any other frame, this address is 0x0000.

Controller 1 input, first frame only. Format (16-bit): byetUDLR axlr----
a/b/x/y/l/r = respective buttons, e = select, t = start, UDLR = directional inputs

Controller 2 input, first frame only. Format (16-bit): byetUDLR axlr----
a/b/x/y/l/r = respective buttons, e = select, t = start, UDLR = directional inputs

Value to indicate which of the alternative palettes to use for the FG/BG/sprites. If negative (or 7), then the standard palette at $7E0500 is used; else, it uses the corresponding alternative palettes.

Generally, the alternative palettes are used for darker versions of the sprite palettes, in order to perform pseudo-color math on them. As such, you can effectively consider this address to be the brightness of the sprites on a scale of 0 (darkest) to 7 (brightest).

If set to a positive value, used as an index to $0083E6, whose values are used to form an HDMA source address for channel 7. Only values 0 and 1 seem to be valid. Needs more research.

Something related to HDMA channel 7; if non-zero, this value gets stored directly as its source address, and the HDMA channel is enabled.
Needs more research.

Currently active subgame.
00 - Spring Breeze
01 - Dyna Blade
02 - Gourmet Race
03 - The Great Cave Offensive
04 - Revenge of Meta-Knight
05 - Milky Way Wishes
06 - The Arena
07 - Sound Test
08 - Guide / Minigame
09 - Unused?
0A - Unused?

Planet ID for Milky Way Wishes.
00 - Floria
01 - Hotbeat
02 - Skyhigh
03 - Cavios
04 - Aqualiss
05 - Mecheye
06 - Halfmoon
07 - [?]
08 - Nova
09 - [?] (unused duplicate?)

Internal timer A underflow flag. When an underflow occurs, gets set to 0xFF.

Internal timer B underflow flag. When an underflow occurs, gets set to 0xFF.

Internal timer C underflow flag. When an underflow occurs, gets set to 0xFF.

Internal timer A; decrements once per frame, looping from 0000 to FFFF. When it reaches 0000, 0xFF is stored to $33CE.

Internal timer B; decrements once per frame, looping from 0000 to FFFF. When it reaches 0000, 0xFF is stored to $33CF.

Internal timer C; decrements once per frame, looping from 0000 to FFFF. When it reaches 0000, 0xFF is stored to $33D0.

DEBUG: Temporary storage used for the "wrapped" palette when cycling palettes in the VRAM viewer.

DEBUG: Current page number for the VRAM viewer.

DEBUG: Current palette number for the VRAM viewer.

Used as temporary storage for data to be entered into the circular DMA buffer at $7E0100 or DMA queue at $7E0900.
Specifically, intended for the routines at $00875A or $008CD0. Values are:
$3731 - Index (+3) to the table at $00869D for controlling the DMA.
$3732 - 16-bit size
$3734 - 24-bit source
$3737 - 16-bit destination VRAM address

Current RNG seed for the routine at $008AC1.

Scratch RAM.
$3749, $374B, and $374D are often used for storing arguments from A/X/Y passed into function calls.

SA-1 program stack. Allocated space may be larger or smaller than currently specified; ends at $37FF.

Scratch RAM intended for 24-bit pointers.

Partner ID; 0xFFFF if no partner is active. Seems to be only used as a flag?

Currently selected song ID in the sound test.

Currently selected sound effect ID in the sound test.

Kirby's powerup image, current frame. Valid images are 01-20; all other values will turn Kirby's image white instead. See this for a list of values.

Kirby's powerup image, previous frame.
If $7386 is zero, this is effectively a mirror of $7384; else, it is $7386 + 0x20. Used to determine whether to update the image.

Partner status bar icon, current frame. Valid values are 01-15; all other values will turn the icon white. See this for a list of values.

Partner status bar icon, previous frame. Used to determine whether to update the image.

Kirby's powerup image override, current frame. If non-zero, overrides the player's powerup image with a special icon (for e.g. taking damage). Valid values are 01-0D; all others will just result in a white box. See this for a list of values.

Kirby's powerup image override, previous frame. Used to determine whether to update the image.

Timer for how long to maintain the image override in $7388; when it hits 0, it will clear that address. If the timer is never set, however, $7388 will not be automatically cleared.

Flag for the partner being kidnapped by T.A.C, which in turn causes the partner image at $7386 to be set to 0x15.
The high byte of this address being negative prevents the partner image from being updated at all; it must be manually cleared to reenable updating the image.

Game mode. Only actually used when explicitly switching game modes; writing to this value normally has no effect. The following values are valid:
00 - Main title screen/opening cutscene
01 - Subgame select screen
02 - Subgame tutorial
03 - Subgame level (including Nova fight)
04 - Game Over
05 - Subgame title screen
06 - Subgame map (Dynablade, Meta-Knight, Milky Way)
07 - Subgame opening cutscene
08 - Subgame credits (including Gourmet Race score tally)
09 - Dynablade cannon game, Milky Way level end room
0A - Sound test
0B - Minigame (Metaton/Samurai)
0C - The Arena
0D - Dynablade powerup room
0E - Dynablade overworld enemy battle
0F - Main titlescreen subgame preview
10 - Main titlescreen minigame preview
A value of 11 or more will hardlock the game.

Kirby's powerup. Only values 00-18 are valid.

Partner ID. Only values 01-13 are valid.

Character image to use for the textboxes in Revenge of Meta-Knight. A value of 0xFF is also used to indicate no textbox is active.
Values 0x00-0x0F are valid images; using 0x10-0xFE will display a black box instead.

Mirror of $7A23, to detect when the character image needs to be updated.

Sub screen designation for the status bar. Format: ---o4321
Mirror of SNES register $212D.

Main screen designation for the status bar. Format: ---o4321
Mirror of SNES register $212C.

Contains the timer used by Gourmet Race and Revenge of Meta-Knight. $7A2D counts milliseconds, $7A2E counts seconds, and $7A2F counts minutes.

Save file 1 data.

Save file 2 data.

Save file 3 data.

Fixed at 0x0000. Used to identify code as running on the SNES, by reading via $0000 (from which the SA-1 returns 0xFFFF instead).

SA-1 command wait loop, copied from $00818C.

When jumped to, waits until both a message is received from the chip (via $2300) and a negative value is stored to $300F, at which point it jumps to the routine pointed to by $300C (24-bit). This routine should be RTL-ended; after completing execution, it will return back to the start of this routine.

SA-1 response wait loop, copied from $0081A3.

When jumped to, waits until both a message is received from the chip (via $2300) and a positive 16-bit value is stored to $300A (note: $300A is not automatically initialized), at which point it simply returns back to the caller.

Timer tied to new inputs on controller 1. If the input this frame differs from the previous, this address gets set to 0x14. Else, it decrements by 1 per frame; if it reaches 0, it gets reset to 0x6.
If this address gets reset, then $32CC will be set to the input on that frame. Else, $32CC will be clear.

Timer tied to new inputs on controller 2. If the input this frame differs from the previous, this address gets set to 0x14. Else, it decrements by 1 per frame; if it reaches 0, it gets reset to 0x6.
If this address gets reset, then $32CE will be set to the input on that frame. Else, $32CE will be clear.

Table used as part of an indirect HDMA to the screen brightness register ($2100), starting at scanline 0x9B. Specifically, it's used for the "fade to black" effect at the bottom of the level.

VWF text character width, in pixels. Setting to FFFF will have the characters use a dynamic width rather than monospace.

VWF text colors for the current tile. Format: ----bbff
ff - Foreground color.
bb - Background color.

Flag for the VWF text to show the blinking cursor in the bottom right of the window.

Flag for the VWF text to include the secondary color of each character (i.e. the "shadow"). 00 = no secondary color, 01 = include secondary color.

Current index to the VWF text pointer stack at $0085.

Subtext pointer stack, with the current position in $0083.
Whenever subtext is jumped to (with VWF command $0E), a 24-bit return address is written here. When that message ends (with VWF command $00), the last 24-bit value in the stack is pulled and the text pointer is set to there.
Exact size of this table may be smaller than indicated currently.

24-bit pointer to VWF text data. Although this is a 24-bit pointer, the bank byte is always 0xCB (0x16).

Currently loaded song. Valid values are 01-42.

Currently loaded sample bank for the music. Valid values are 01-09.

Which status bar menu is currently active. Typically, values are:
00 - No partner, no boss
02 - Has partner, no boss
04 - No partner, has boss
06 - Has partner, has boss
08 - Textbox (for Revenge of Meta-Knight)

Circular VRAM upload buffer, emptied every frame (except during force-blank). The index to the start of the buffer is in $3015, while the end is in $3017.
Each entry has 8 bytes, but depending on the first two, there are two different formats.

If the first two bytes are 0000, then it is a single entry write. In this case, bytes 2/3 are used as the destination VRAM address and 4/5 as value to write (6/7 are unused).
Otherwise, all the bytes are used as settings for a DMA:
0 - Index (+3) to the table at $00869D for controlling the DMA.
1 - 16-bit size
3 - 24-bit source
6 - 16-bit destination VRAM address

After writing either, update $3017. While writing the data, if it's about to overflow past $0500, just loop back to $0100.

Standard palette. All colors are stored in sequence and uploaded to CGRAM during NMI, unless one of the alternative palettes is being used, indicated by $32DC.

Even if one of the alternative palettes is being used, the first 0x4 FG/BG colors ($0500-$0507) and the first 0x30 sprite colors ($0600-$065F) are still pulled from this table.

Alternative FG/BG palette 0. This is written to colors $04-$7F.

Alternative sprite palette 0. This is written to colors $B0-$FF.

VRAM DMA queue; unlike $7E0100, this one is only emptied on non-lag frames, i.e. a true "end of frame".
To use, first get the next index from $301F. Then write 8 bytes for the DMA:
0 - Unused? (always FF?)
1 - 16-bit size
3 - 24-bit source
6 - 16-bit destination VRAM address
Finally, update $301F by adding 8 to it.
Size of this table is uncertain; will need to adjust later.

Palette for the status bar, written to colors $04-$7F (other colors are maintained from the level's actual palette).
Due to an error on HAL's part, the 4 bytes after this table also end up written to colors $80 and $81.

Tile numbers for the entire Layer 2 tilemap of the status bar.

YXPCCCTT for the entire Layer 2 tilemap of the status bar.

SNES program stack. Allocated space may be larger or smaller than currently specified; ends at $1FFF.

Decompressed data buffer. Data gets decompressed to here as necessary for usage by DMAs. The index for where to write the next DMA can be obtained from $3012, which gets reset at the end of every frame.

The entire (?) Layer 1 Map24 tilemap for the level. Two bytes per tile.

Tiles appear to be laid on in full strips from the left edge of the level to the right edge. As such, the number of tiles per row varies depending on the size of the level.

DEBUG: For the VRAM viewer, the first 0x1000 bytes of this are used as the raw tilemap to be uploaded into VRAM.

VWF text buffer, where each line of character data gets drawn into before being uploaded to VRAM. Consists of a 32x2 strip of 8x8 tiles.

Some sort of table/buffer used by routine at $01E7E7. Unclear on what it actually represents. Size is probably not accurate, but it is the maximum allowable index given by the game's code.

Alternative FG/BG palette 1. This is written to colors $04-$7F.

Alternative sprite palette 1. This is written to colors $B0-$FF.

Alternative FG/BG palette 2. This is written to colors $04-$7F.

Alternative sprite palette 2. This is written to colors $B0-$FF.

Alternative FG/BG palette 3. This is written to colors $04-$7F.

Alternative sprite palette 3. This is written to colors $B0-$FF.

Alternative FG/BG palette 4. This is written to colors $04-$7F.

Alternative sprite palette 4. This is written to colors $B0-$FF.

Alternative FG/BG palette 5. This is written to colors $04-$7F.

Alternative sprite palette 5. This is written to colors $B0-$FF.

Alternative FG/BG palette 6. This is written to colors $04-$7F.

Alternative sprite palette 6. This is written to colors $B0-$FF.