From 090d86a5546139eec513676400dc4e996859cd81 Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 01:27:45 -0700
Subject: [PATCH 01/23] launcher: expose HD Rendering as an opt-in mod

Internal resolution and texture upscaling were reachable only through
game.toml, a CLI flag, or an environment variable. This puts them on the
Mods page next to Adaptive Widescreen and Prime Controls, where a player
will actually find them.

One feature, "HD Rendering", with two choice options:
- Internal resolution: 1x (native), 2x, 3x, 4x. Sample density of the 3D
  engine only; the 2D layers stay native, exactly as the hardware draws
  them.
- Texture upscaling: Off, 2x, 4x. Filters each decoded DS texture once as
  it enters the cache, so higher internal resolution shows detail rather
  than larger texels.

Disabled by default, and the launcher passes
--internal-resolution 1 --texture-upscale 1 while it is off, so anyone who
never opens the Mods page gets the faithful native output. Defaults are 2x
and 2x once enabled rather than the 4x maximum, since the cost scales
roughly with the square of both.

Attribution for the upscaler (Hyllian xBR-lv2, MIT) is carried on the
feature's source fields so it is visible in the UI.

Settings round-trip through mods.ini as hd_rendering, internal_resolution,
and texture_upscale, all validated on load so a hand-edited file cannot
hand the runner a scale it will refuse to start on.

Test: feature count 2 -> 3, plus coverage that HD is off by default, that
both options reject values outside their choice lists, and that all three
settings survive a save/load round trip. Index 1 is still Prime Controls,
so the existing assertions are unaffected.

Requires the ndsrecomp runner changes on branch hd-internal-resolution.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 launcher/recomp-ui/launcher_main.cpp          | 161 +++++++++++++++++-
 .../tests/launcher_mod_provider_test.cpp      |  64 ++++++-
 2 files changed, 218 insertions(+), 7 deletions(-)

diff --git a/launcher/recomp-ui/launcher_main.cpp b/launcher/recomp-ui/launcher_main.cpp
index d4fadc3..8b948d2 100644
--- a/launcher/recomp-ui/launcher_main.cpp
+++ b/launcher/recomp-ui/launcher_main.cpp
@@ -17,6 +17,13 @@ namespace {
 
 struct ModState {
     bool adaptive_widescreen = true;
+    // HD rendering. Off by default: it costs GPU time and VRAM, and the
+    // faithful native output stays the reference. internal_resolution
+    // multiplies 3D sample density; texture_upscale filters each decoded DS
+    // texture once on a cache miss. Both are inert when hd_rendering is off.
+    bool hd_rendering = false;
+    int internal_resolution = 2;
+    int texture_upscale = 2;
     bool mouse_aim = true;
     int mouse_sensitivity = 30;
     bool mouse_invert_y = false;
@@ -94,6 +101,24 @@ struct ModState {
     std::string last_error;
 };
 
+struct HdChoice {
+    int value;
+    const char* label;
+};
+
+constexpr std::array<HdChoice, 4> kInternalResolutionChoices{{
+    {1, "1x (native)"},
+    {2, "2x"},
+    {3, "3x"},
+    {4, "4x"},
+}};
+
+constexpr std::array<HdChoice, 3> kTextureUpscaleChoices{{
+    {1, "Off"},
+    {2, "2x"},
+    {4, "4x"},
+}};
+
 struct SensitivityChoice {
     int percent;
     const char* label;
@@ -328,6 +353,19 @@ void load_mod_state(ModState& state) {
                 settings_version = static_cast<int>(parsed);
         } else if (key == "adaptive_widescreen") {
             state.adaptive_widescreen = value != "false";
+        } else if (key == "hd_rendering") {
+            state.hd_rendering = value == "true";
+        } else if (key == "internal_resolution") {
+            char* end = nullptr;
+            const long parsed = std::strtol(value.c_str(), &end, 10);
+            if (end && *end == 0 && parsed >= 1 && parsed <= 4)
+                state.internal_resolution = static_cast<int>(parsed);
+        } else if (key == "texture_upscale") {
+            char* end = nullptr;
+            const long parsed = std::strtol(value.c_str(), &end, 10);
+            if (end && *end == 0 &&
+                (parsed == 1 || parsed == 2 || parsed == 4))
+                state.texture_upscale = static_cast<int>(parsed);
         } else if (key == "mouse_aim") {
             state.mouse_aim = value != "false";
         } else if (key == "mouse_sensitivity") {
@@ -410,6 +448,10 @@ bool save_mod_state(ModState& state) {
         file << "settings_version=2\n"
              << "adaptive_widescreen="
              << (state.adaptive_widescreen ? "true" : "false") << '\n'
+             << "hd_rendering="
+             << (state.hd_rendering ? "true" : "false") << '\n'
+             << "internal_resolution=" << state.internal_resolution << '\n'
+             << "texture_upscale=" << state.texture_upscale << '\n'
              << "mouse_aim=" << (state.prime_controls ? "true" : "false")
              << '\n'
              << "mouse_sensitivity=" << state.mouse_sensitivity << '\n'
@@ -446,12 +488,12 @@ bool save_mod_state(ModState& state) {
 // directly under the controller card. Only the two real gameplay mods
 // remain here.
 int mod_feature_count(void*) {
-    return 2;
+    return 3;
 }
 
 int mod_feature_get(void* context, int index,
                     RecompLauncherCModFeature* output) {
-    if (!context || !output || index < 0 || index > 1) return 0;
+    if (!context || !output || index < 0 || index > 2) return 0;
     const auto* state = static_cast<const ModState*>(context);
     std::memset(output, 0, sizeof(*output));
     if (index == 0) {
@@ -469,6 +511,27 @@ int mod_feature_get(void* context, int index,
         copy_text(output->status,
                   state->adaptive_widescreen ? "Enabled" : "Disabled");
         output->enabled = state->adaptive_widescreen ? 1 : 0;
+    } else if (index == 2) {
+        copy_text(output->id, "hd-rendering");
+        copy_text(output->package_id, "mph-hd-rendering");
+        copy_text(output->package_version, "0.1.0");
+        copy_text(output->package_name, "MPH HD Rendering");
+        copy_text(output->name, "HD Rendering");
+        copy_text(output->author, "ndsrecomp");
+        copy_text(
+            output->description,
+            "Renders the 3D engine above one sample per DS pixel and "
+            "filters decoded textures, so the widescreen image gains detail "
+            "instead of just area. The 2D layers stay native, exactly as the "
+            "hardware draws them.");
+        copy_text(output->source_name, "Hyllian xBR-lv2 (MIT)");
+        copy_text(output->source_url,
+                  "https://github.com/libretro/glsl-shaders");
+        copy_text(output->group, "Display enhancements");
+        copy_text(output->status,
+                  state->hd_rendering ? "Enabled" : "Disabled");
+        output->enabled = state->hd_rendering ? 1 : 0;
+        output->option_count = 2;
     } else {
         copy_text(output->id, "prime-controls");
         copy_text(output->package_id, "mph-prime-controls");
@@ -512,6 +575,11 @@ int mod_feature_enable(void* context, const char* package_id,
         state->mouse_aim = state->prime_controls;
         return 1;
     }
+    if (std::strcmp(package_id, "mph-hd-rendering") == 0 &&
+        std::strcmp(feature_id, "hd-rendering") == 0) {
+        state->hd_rendering = enabled != 0;
+        return 1;
+    }
     return 0;
 }
 
@@ -528,6 +596,41 @@ int mod_feature_option_get(void* context, const char* package_id,
                            RecompLauncherCModOption* output) {
     if (!context || !package_id || !feature_id || !output || index < 0)
         return 0;
+    if (std::strcmp(package_id, "mph-hd-rendering") == 0 &&
+        std::strcmp(feature_id, "hd-rendering") == 0) {
+        if (index > 1) return 0;
+        const auto* hd = static_cast<const ModState*>(context);
+        std::memset(output, 0, sizeof(*output));
+        if (index == 0) {
+            copy_text(output->id, "internal-resolution");
+            copy_text(output->label, "Internal resolution");
+            copy_text(output->description,
+                      "Sample density of the 3D engine. Costs GPU time and "
+                      "VRAM; 2D layers are unaffected.");
+            copy_text(output->group, "Resolution");
+            std::snprintf(output->value, sizeof(output->value), "%d",
+                          hd->internal_resolution);
+            copy_text(output->default_value, "2");
+            output->type = RECOMP_MOD_OPTION_CHOICE;
+            output->choice_count =
+                static_cast<int>(kInternalResolutionChoices.size());
+            return 1;
+        }
+        copy_text(output->id, "texture-upscale");
+        copy_text(output->label, "Texture upscaling");
+        copy_text(output->description,
+                  "Filters each decoded DS texture once when it enters the "
+                  "cache, so higher internal resolution shows detail rather "
+                  "than larger texels.");
+        copy_text(output->group, "Textures");
+        std::snprintf(output->value, sizeof(output->value), "%d",
+                      hd->texture_upscale);
+        copy_text(output->default_value, "2");
+        output->type = RECOMP_MOD_OPTION_CHOICE;
+        output->choice_count =
+            static_cast<int>(kTextureUpscaleChoices.size());
+        return 1;
+    }
     if (std::strcmp(package_id, "mph-prime-controls") != 0 ||
         std::strcmp(feature_id, "prime-controls") != 0 ||
         index >= 4 + static_cast<int>(kBindingOptions.size()) +
@@ -615,6 +718,30 @@ int mod_feature_choice_get(void*, const char* package_id,
                            int index, RecompLauncherCModChoice* output) {
     if (!package_id || !feature_id || !option_id || !output || index < 0)
         return 0;
+    if (std::strcmp(package_id, "mph-hd-rendering") == 0 &&
+        std::strcmp(feature_id, "hd-rendering") == 0) {
+        if (std::strcmp(option_id, "internal-resolution") == 0) {
+            if (index >= static_cast<int>(kInternalResolutionChoices.size()))
+                return 0;
+            std::memset(output, 0, sizeof(*output));
+            const HdChoice& choice = kInternalResolutionChoices[index];
+            std::snprintf(output->value, sizeof(output->value), "%d",
+                          choice.value);
+            copy_text(output->label, choice.label);
+            return 1;
+        }
+        if (std::strcmp(option_id, "texture-upscale") == 0) {
+            if (index >= static_cast<int>(kTextureUpscaleChoices.size()))
+                return 0;
+            std::memset(output, 0, sizeof(*output));
+            const HdChoice& choice = kTextureUpscaleChoices[index];
+            std::snprintf(output->value, sizeof(output->value), "%d",
+                          choice.value);
+            copy_text(output->label, choice.label);
+            return 1;
+        }
+        return 0;
+    }
     if (std::strcmp(package_id, "mph-prime-controls") != 0 ||
         std::strcmp(feature_id, "prime-controls") != 0) {
         return 0;
@@ -663,6 +790,30 @@ int mod_feature_set_option(void* context, const char* package_id,
                            const char* value) {
     if (!context || !package_id || !feature_id || !option_id || !value)
         return 0;
+    auto* hd_state = static_cast<ModState*>(context);
+    if (std::strcmp(package_id, "mph-hd-rendering") == 0 &&
+        std::strcmp(feature_id, "hd-rendering") == 0) {
+        char* hd_end = nullptr;
+        const long hd_parsed = std::strtol(value, &hd_end, 10);
+        if (!hd_end || *hd_end != 0) return 0;
+        if (std::strcmp(option_id, "internal-resolution") == 0) {
+            for (const HdChoice& choice : kInternalResolutionChoices) {
+                if (choice.value != hd_parsed) continue;
+                hd_state->internal_resolution = static_cast<int>(hd_parsed);
+                return 1;
+            }
+            return 0;
+        }
+        if (std::strcmp(option_id, "texture-upscale") == 0) {
+            for (const HdChoice& choice : kTextureUpscaleChoices) {
+                if (choice.value != hd_parsed) continue;
+                hd_state->texture_upscale = static_cast<int>(hd_parsed);
+                return 1;
+            }
+            return 0;
+        }
+        return 0;
+    }
     if (std::strcmp(package_id, "mph-prime-controls") != 0 ||
         std::strcmp(feature_id, "prime-controls") != 0) {
         return 0;
@@ -919,6 +1070,12 @@ bool launch_runner(const std::filesystem::path& game_dir, const char* rom,
             : L"stacked") +
         L" --adaptive-widescreen " +
         (adaptive ? L"top" : L"none") +
+        // Inert unless the HD mod is on, so the faithful native output stays
+        // the default for anyone who never opens the Mods page.
+        L" --internal-resolution " +
+        std::to_wstring(mods.hd_rendering ? mods.internal_resolution : 1) +
+        L" --texture-upscale " +
+        std::to_wstring(mods.hd_rendering ? mods.texture_upscale : 1) +
         L" --supersampling " + std::to_wstring(supersampling) +
         L" --antialiasing " + std::to_wstring(antialiasing) +
         L" --relative-mouse-touch " +
diff --git a/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp b/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp
index 638b4f5..3dd2f13 100644
--- a/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp
+++ b/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp
@@ -41,9 +41,11 @@ int main() {
 
     if (!require(provider.feature_count != nullptr, "feature_count callback"))
         return 3;
-    // Two gameplay mods; the online identity is a dashboard card, not a mod.
+    // Three gameplay mods; the online identity is a dashboard card, not a
+    // mod. Index 1 stays prime controls so the assertions below are
+    // unaffected by HD rendering being added at index 2.
     const int feature_count = provider.feature_count(provider.ctx);
-    if (!require(feature_count == 2, "feature_count == 2")) return 4;
+    if (!require(feature_count == 3, "feature_count == 3")) return 4;
 
     RecompLauncherCModFeature feature{};
     if (!require(provider.feature_get(provider.ctx, 1, &feature),
@@ -261,9 +263,9 @@ int main() {
 
     // The online identity is NOT a mod feature: it lives on the dashboard
     // ONLINE card (GameInfo.has_player_name + the NDS "identity" panel).
-    // Exactly the two gameplay mods remain.
-    if (!require(!provider.feature_get(provider.ctx, 2, &feature),
-                 "exactly two mod features (identity is not a mod)")) {
+    // Exactly the three gameplay mods remain; index 3 must not resolve.
+    if (!require(!provider.feature_get(provider.ctx, 3, &feature),
+                 "exactly three mod features (identity is not a mod)")) {
         return 37;
     }
 
@@ -312,5 +314,57 @@ int main() {
         std::filesystem::remove(saved.settings_path);
     }
 
+    // HD rendering: off by default, so a player who never opens the Mods
+    // page gets the faithful native output.
+    {
+        RecompLauncherCModFeature hd{};
+        if (!require(provider.feature_get(provider.ctx, 2, &hd),
+                     "feature_get hd rendering")) return 60;
+        if (!require(std::strcmp(hd.id, "hd-rendering") == 0,
+                     "hd feature id")) return 61;
+        if (!require(std::strcmp(hd.package_id, "mph-hd-rendering") == 0,
+                     "hd package id")) return 62;
+        if (!require(hd.enabled == 0, "hd disabled by default")) return 63;
+        if (!require(hd.option_count == 2, "hd option count")) return 64;
+
+        // Both options must reject values outside their choice list, so a
+        // hand-edited mods.ini cannot hand the runner a scale it refuses.
+        if (!require(provider.feature_set_option(
+                         provider.ctx, "mph-hd-rendering", "hd-rendering",
+                         "internal-resolution", "4") == 1,
+                     "hd internal resolution accepts 4")) return 65;
+        if (!require(provider.feature_set_option(
+                         provider.ctx, "mph-hd-rendering", "hd-rendering",
+                         "internal-resolution", "8") == 0,
+                     "hd internal resolution rejects 8")) return 66;
+        if (!require(provider.feature_set_option(
+                         provider.ctx, "mph-hd-rendering", "hd-rendering",
+                         "texture-upscale", "3") == 0,
+                     "hd texture upscale rejects 3")) return 67;
+        if (!require(provider.feature_set_option(
+                         provider.ctx, "mph-hd-rendering", "hd-rendering",
+                         "texture-upscale", "4") == 1,
+                     "hd texture upscale accepts 4")) return 68;
+
+        ModState hd_saved{};
+        hd_saved.settings_path =
+            std::filesystem::temp_directory_path() /
+            "mph_mod_provider_hd_settings.ini";
+        hd_saved.hd_rendering = true;
+        hd_saved.internal_resolution = 3;
+        hd_saved.texture_upscale = 4;
+        if (!require(save_mod_state(hd_saved), "hd save")) return 69;
+        ModState hd_loaded{};
+        hd_loaded.settings_path = hd_saved.settings_path;
+        load_mod_state(hd_loaded);
+        if (!require(hd_loaded.hd_rendering, "hd enable round trip"))
+            return 70;
+        if (!require(hd_loaded.internal_resolution == 3,
+                     "hd internal resolution round trip")) return 71;
+        if (!require(hd_loaded.texture_upscale == 4,
+                     "hd texture upscale round trip")) return 72;
+        std::filesystem::remove(hd_saved.settings_path);
+    }
+
     return 0;
 }

From 3b26101aa112d07d2e149a96f0b45795bbcacb9e Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 01:50:22 -0700
Subject: [PATCH 02/23] release: v0.4.0-alpha

Adds the opt-in HD Rendering mod: internal resolution up to 4x plus
texture upscaling, off by default and configured from the Mods page.

Gate status at cut time, recorded rather than glossed:
- G1 firmware suite 6/8. download_play_shutdown and pictochat_room_a fail
  on ARM7 IRQ/instruction divergence against the oracle. Both are
  PRE-EXISTING: building the merge-base 80bfd07 in a detached worktree
  reproduces byte-identical failure numbers, so they are not caused by
  this release's changes. Tracked as beads-yjp.24.
- MPH VB300/VB1800 checkpoints byte-identical to the pre-change baseline
  with HD off, including every instruction and cycle counter, so the
  default path is unchanged.
- Launcher mod-provider test passes in both the mingw and release builds.
- Texture upscaling has NOT had visual validation across DS texture
  formats, tiled surfaces, or cutout alpha edges. It is off by default and
  behind an explicit opt-in for that reason. Tracked as beads-yjp.22.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CMakeLists.txt |  2 +-
 README.md      | 17 ++++++++++++-----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 7f7ea40..eaec98a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.20)
-project(MetroidPrimeHuntersRecomp VERSION 0.3.0 LANGUAGES C CXX)
+project(MetroidPrimeHuntersRecomp VERSION 0.4.0 LANGUAGES C CXX)
 
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
diff --git a/README.md b/README.md
index c22a26e..080945d 100644
--- a/README.md
+++ b/README.md
@@ -20,32 +20,39 @@ Click the image to watch the gameplay preview on YouTube.
 ## Current Release
 
 Latest release:
-**[v0.3.0-alpha](https://github.com/mstan/MetroidPrimeHuntersRecomp/releases/tag/v0.3.0-alpha)**.
+**[v0.4.0-alpha](https://github.com/mstan/MetroidPrimeHuntersRecomp/releases/tag/v0.4.0-alpha)**.
 
 Downloads:
 
 - Windows:
-  `MetroidPrimeHuntersRecomp-windows-x64-v0.3.0.zip`
+  `MetroidPrimeHuntersRecomp-windows-x64-v0.4.0.zip`
 - Linux:
-  `MetroidPrimeHuntersRecomp-linux-x86_64-v0.3.0.AppImage`
+  `MetroidPrimeHuntersRecomp-linux-x86_64-v0.4.0.AppImage`
 
 This is the first release line in the ndsrecomp ecosystem and it is still very
 early. Campaign entry, widescreen output, Prime-style controls, gamepad support,
 and Wiimmfi lobby connectivity have all seen active bring-up, but this should
 still be treated as an alpha test build rather than a polished game release.
 
+New in v0.4.0: an opt-in **HD Rendering** mod on the Mods page. It raises the
+3D engine above one sample per DS pixel (up to 4x) and filters decoded
+textures, so the widescreen image gains detail rather than just area. The 2D
+layers stay native, exactly as the hardware draws them. It is off by default;
+enable it under Mods and pick the internal resolution and texture upscaling
+that suit your GPU.
+
 ## Quick Start
 
 Windows:
 
-1. Download and fully extract the `v0.3.0-alpha` Windows ZIP.
+1. Download and fully extract the `v0.4.0-alpha` Windows ZIP.
 2. Put your own Metroid Prime Hunters USA revision-0 `.nds` ROM next to
    `MetroidPrimeHuntersRecomp.exe`.
 3. Run `MetroidPrimeHuntersRecomp.exe` and press Play.
 
 Linux:
 
-1. Download the `v0.3.0-alpha` AppImage.
+1. Download the `v0.4.0-alpha` AppImage.
 2. Put your own Metroid Prime Hunters USA revision-0 `.nds` ROM next to the
    AppImage.
 3. Run the AppImage.

From 5abcfee6187d572e752985ede2364f165d62dd6a Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 20:10:12 -0700
Subject: [PATCH 03/23] Persist MPH Wi-Fi profiles across launches

---
 README.md                                     |   6 +
 game.toml                                     |   2 +-
 launcher/recomp-ui/launcher_main.cpp          |  50 ++-
 .../tests/launcher_mod_provider_test.cpp      |  28 ++
 tools/mph_screens.py                          |   2 +
 tools/probe_mph_online_first_run.py           | 361 ++++++++++++++++++
 tools/probe_mph_wfc.py                        |  28 +-
 7 files changed, 466 insertions(+), 11 deletions(-)
 create mode 100644 tools/probe_mph_online_first_run.py

diff --git a/README.md b/README.md
index 080945d..69c6afa 100644
--- a/README.md
+++ b/README.md
@@ -146,6 +146,12 @@ Nintendo WFC / Wiimmfi support is experimental. The current validated state is
 lobby connectivity: Metroid Prime Hunters can authenticate through Wiimmfi and
 reach a Friends and Rivals lobby where a locally hosted game is visible.
 
+The launcher keeps the console firmware profile in
+`%APPDATA%\MetroidPrimeHuntersRecomp`. Wi-Fi settings, console/game-card
+pairing, and WFC updates survive both the in-game system shutdown flow and a
+normal window close. Confirming the WFC settings shutdown prompt closes the
+application automatically.
+
 Actually joining a match and playing in-game online is not guaranteed. It may
 fail to connect, disconnect, or desync.
 
diff --git a/game.toml b/game.toml
index 5bc7202..0a116fd 100644
--- a/game.toml
+++ b/game.toml
@@ -61,7 +61,7 @@ size = 0x00028464
 
 [framework]
 path = "../ndsrecomp"
-pin = "46b12e6c18dea47f87d2c1f98c3054149dcbca5d"
+pin = "6c6a03bdcf99093f64555c4d05d16e522dc58634"
 branch = "main"
 
 [reference.mphread]
diff --git a/launcher/recomp-ui/launcher_main.cpp b/launcher/recomp-ui/launcher_main.cpp
index 8b948d2..8258166 100644
--- a/launcher/recomp-ui/launcher_main.cpp
+++ b/launcher/recomp-ui/launcher_main.cpp
@@ -321,6 +321,27 @@ std::string read_identity_mac(const std::filesystem::path& bios_dir) {
     return text;
 }
 
+std::filesystem::path firmware_state_path(
+    const std::filesystem::path& settings_path, bool generated) {
+    return settings_path.parent_path() /
+        (generated ? "firmware-generated.bin" : "firmware-retail.bin");
+}
+
+std::string read_firmware_state_mac(const std::filesystem::path& path) {
+    std::ifstream file(path, std::ios::binary);
+    if (!file) return {};
+    file.seekg(0x36, std::ios::beg);
+    unsigned char mac[6]{};
+    file.read(reinterpret_cast<char*>(mac), sizeof(mac));
+    if (file.gcount() != static_cast<std::streamsize>(sizeof(mac)) ||
+        (mac[0] & 0x01u))
+        return {};
+    char text[32];
+    std::snprintf(text, sizeof(text), "%02X:%02X:%02X:%02X:%02X:%02X",
+                  mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+    return text;
+}
+
 template <size_t N>
 void copy_text(char (&target)[N], const char* source) {
     std::snprintf(target, N, "%s", source ? source : "");
@@ -1059,6 +1080,8 @@ bool launch_runner(const std::filesystem::path& game_dir, const char* rom,
             std::filesystem::create_directories(bios, error);
         }
     }
+    const std::filesystem::path firmware_state = firmware_state_path(
+        mods.settings_path, no_dumps_mode);
 
     std::wstring command =
         quote(runner.wstring()) + L" " + quote(bios.wstring()) +
@@ -1096,6 +1119,7 @@ bool launch_runner(const std::filesystem::path& game_dir, const char* rom,
         // a player launching through the UI expects Nintendo WFC to work,
         // so the launcher turns it on and points it at Wiimmfi.
         L" --network on --wfc on --wfc-provider wiimmfi";
+    append_arg(command, L"--firmware-state-path", firmware_state.wstring());
     // beads-yjp.16: the firmware console nickname. Passed only when the
     // player both configured a name and left the identity feature on;
     // otherwise the runner leaves the firmware's own name alone (a retail
@@ -1162,15 +1186,31 @@ int main(int argc, char** argv) {
     copy_text(settings.bios_path, mod_state.bios_path.c_str());
     copy_text(settings.player_name, mod_state.player_name.c_str());
 
-    // Read-only identity detail for the dashboard ONLINE card. Captured once
-    // at startup: the MAC only changes on the first-ever no-dump launch.
-    const std::string identity_mac = read_identity_mac(
+    // Read-only identity detail for the dashboard ONLINE card. Prefer the
+    // mutable profile once it has been seeded; generated mode falls back to
+    // the installation identity before that first launch.
+    const std::filesystem::path selected_bios =
         mod_state.bios_path.empty()
             ? mod_state.default_bios_dir
-            : bios_dir_from_setting(mod_state.bios_path.c_str()));
+            : bios_dir_from_setting(mod_state.bios_path.c_str());
+    bool generated_identity = false;
+    if (mod_state.bios_path.empty()) {
+        bool conventional_dumps = true;
+        for (const NdsDump& dump : kNdsDumps) {
+            if (!std::filesystem::is_regular_file(selected_bios / dump.file))
+                conventional_dumps = false;
+        }
+        generated_identity = !conventional_dumps;
+    }
+    std::string identity_mac = read_firmware_state_mac(firmware_state_path(
+        mod_state.settings_path, generated_identity));
+    if (identity_mac.empty() && generated_identity)
+        identity_mac = read_identity_mac(selected_bios);
     const std::string identity_detail =
         !identity_mac.empty()
-            ? "Console MAC: " + identity_mac + " (generated identity)"
+            ? "Console MAC: " + identity_mac +
+                  (generated_identity
+                       ? " (generated identity)" : " (firmware profile)")
             : std::string("Console MAC: from the firmware dump, or created "
                           "on the first no-dump launch.");
 
diff --git a/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp b/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp
index 3dd2f13..80e8a1b 100644
--- a/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp
+++ b/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp
@@ -13,6 +13,34 @@ bool require(bool condition, const char* label) {
 }  // namespace
 
 int main() {
+    {
+        const std::filesystem::path root =
+            std::filesystem::temp_directory_path() /
+            "mph_firmware_state_launcher_test";
+        const std::filesystem::path settings = root / "mods.ini";
+        const std::filesystem::path generated =
+            firmware_state_path(settings, true);
+        const std::filesystem::path retail =
+            firmware_state_path(settings, false);
+        if (!require(generated.filename() == "firmware-generated.bin",
+                     "generated firmware state path")) return 85;
+        if (!require(retail.filename() == "firmware-retail.bin",
+                     "retail firmware state path")) return 86;
+        std::filesystem::create_directories(root);
+        std::vector<unsigned char> bytes(128u * 1024u, 0xFFu);
+        const unsigned char mac[6] = {0x00, 0x09, 0xBF, 0x12, 0x34, 0x56};
+        std::memcpy(bytes.data() + 0x36, mac, sizeof(mac));
+        {
+            std::ofstream file(generated, std::ios::binary);
+            file.write(reinterpret_cast<const char*>(bytes.data()),
+                       static_cast<std::streamsize>(bytes.size()));
+        }
+        if (!require(read_firmware_state_mac(generated) ==
+                         "00:09:BF:12:34:56",
+                     "firmware state identity display")) return 87;
+        std::filesystem::remove_all(root);
+    }
+
     {
         ModState legacy_state{};
         legacy_state.settings_path =
diff --git a/tools/mph_screens.py b/tools/mph_screens.py
index f1f9eb5..df0e01f 100644
--- a/tools/mph_screens.py
+++ b/tools/mph_screens.py
@@ -34,6 +34,8 @@
     # red cross on the right, both ringed in orange.
     "dialog_yes": (98, 302, 120, 324),
     "dialog_no": (138, 302, 160, 324),
+    # Single green check used by pairing/update notices and acknowledgements.
+    "dialog_ok": (116, 300, 140, 326),
     # Friends/Rivals lobby, top screen: the ARENA thumbnail. Flat dark green
     # while no game row is selected, a lit photo of the arena once a row is
     # selected and the host's settings have been pulled down (measured: 0
diff --git a/tools/probe_mph_online_first_run.py b/tools/probe_mph_online_first_run.py
new file mode 100644
index 0000000..dab370a
--- /dev/null
+++ b/tools/probe_mph_online_first_run.py
@@ -0,0 +1,361 @@
+#!/usr/bin/env python3
+"""Validate MPH Wiimmfi setup and persistence across real process restarts.
+
+The runner stays in interactive mode. Navigation, screenshots, and lifecycle
+control all use its TCP debug surface; input/checkpoint primitives come from
+fuzz_mph_gameplay. The source ROM, save, and identity are copied/read-only.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import random
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+from typing import Any
+
+from PIL import Image
+
+SCRIPT_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(SCRIPT_DIR))
+
+import capture_mph_checkpoints as capture_lib  # noqa: E402
+import fuzz_mph_gameplay as input_lib  # noqa: E402
+import mph_screens  # noqa: E402
+from add_mph_friend import MENU_PATH  # noqa: E402
+from run_mph_friend_match import DIALOG_YES, FRIENDS_AND_RIVALS  # noqa: E402
+from run_mph_wfc_instances import FILTERS  # noqa: E402
+
+INPUT_FUZZ = random.Random()
+
+
+def sha256(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def wait_frames(
+    client: capture_lib.DebugClient,
+    process: subprocess.Popen[bytes],
+    count: int,
+    timeout: float = 300.0,
+) -> None:
+    start = input_lib.event_counts(client)["vblank9"]
+    target = start + count
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        if process.poll() is not None:
+            raise RuntimeError(f"runner exited with code {process.returncode}")
+        if input_lib.event_counts(client)["vblank9"] >= target:
+            return
+        time.sleep(0.025)
+    raise TimeoutError(f"runner did not advance {count} frames")
+
+
+def tap(
+    client: capture_lib.DebugClient,
+    process: subprocess.Popen[bytes],
+    x: int,
+    y: int,
+    wait: int,
+) -> None:
+    fuzzed_x = max(0, min(255, x + INPUT_FUZZ.randint(-2, 2)))
+    fuzzed_y = max(0, min(191, y + INPUT_FUZZ.randint(-2, 2)))
+    client.command("touch", x=fuzzed_x, y=fuzzed_y, down=True)
+    wait_frames(client, process, INPUT_FUZZ.randint(8, 14))
+    client.command("touch", x=fuzzed_x, y=fuzzed_y, down=False)
+    wait_frames(client, process, wait)
+
+
+def press(
+    client: capture_lib.DebugClient,
+    process: subprocess.Popen[bytes],
+    key: str,
+    wait: int,
+) -> None:
+    bit = input_lib.KEY_BITS[key]
+    client.command("keys", mask=input_lib.RELEASED_KEYS & ~(1 << bit))
+    wait_frames(client, process, INPUT_FUZZ.randint(8, 14))
+    client.command("keys", mask=input_lib.RELEASED_KEYS)
+    wait_frames(client, process, wait)
+
+
+class InteractiveSession:
+    def __init__(
+        self,
+        args: argparse.Namespace,
+        name: str,
+        port: int,
+        profile: Path,
+    ) -> None:
+        self.output = args.out / name
+        self.output.mkdir(parents=True, exist_ok=True)
+        self.report: list[dict[str, Any]] = []
+        self.stdout = (self.output / "runner.stdout.log").open("wb")
+        self.stderr = (self.output / "runner.stderr.log").open("wb")
+        command = [
+            str(args.runner), str(profile / "bios"), "--interactive",
+            "--port", str(port), "--rom", str(args.rom),
+            "--config", str(args.config), "--save-path",
+            str(profile / "Metroid Prime Hunters.sav"),
+            "--firmware-state-path", str(profile / "firmware-generated.bin"),
+            "--startup-mode", "automatic", "--network", "on",
+            "--network-backend", "slirp", "--wfc", "on",
+            "--wfc-provider", args.wfc_provider, "--freebios",
+            "--generated-firmware", "--boot", "direct",
+        ]
+        self.process = subprocess.Popen(
+            command, cwd=args.runner.parent, stdout=self.stdout,
+            stderr=self.stderr,
+            creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
+        )
+        capture_lib.wait_for_server(port, self.process)
+        self.client = capture_lib.DebugClient(port, timeout=600.0)
+
+    def save(self, label: str) -> dict[str, Any]:
+        item = input_lib.save_checkpoint(
+            self.client, self.output, len(self.report), label
+        )
+        self.report.append(item)
+        return item
+
+    def close_handles(self) -> None:
+        try:
+            self.client.close()
+        except OSError:
+            pass
+        self.stdout.close()
+        self.stderr.close()
+        (self.output / "report.json").write_text(
+            json.dumps(self.report, indent=2) + "\n", encoding="utf-8"
+        )
+
+    def force_cleanup(self) -> None:
+        if self.process.poll() is None:
+            self.process.terminate()
+            try:
+                self.process.wait(timeout=10)
+            except subprocess.TimeoutExpired:
+                self.process.kill()
+                self.process.wait()
+        self.close_handles()
+
+
+def reach_wfc_menu(session: InteractiveSession) -> None:
+    wait_frames(session.client, session.process, 7800)
+    session.save("title")
+    for label, x, y, wait in MENU_PATH[:4]:
+        tap(session.client, session.process, x, y, wait)
+        session.save(label)
+
+
+def setup_and_power_off(session: InteractiveSession) -> dict[str, Any]:
+    reach_wfc_menu(session)
+    route = (
+        ("wfc-setup-root", 128, 36, 600),
+        ("settings-tile", 85, 100, 220),
+        ("slot1", 43, 35, 220),
+        ("search-for-ap", 128, 37, 1600),
+        ("test-connection", 192, 36, 2400),
+        ("save-settings", 190, 177, 600),
+    )
+    for label, x, y, wait in route:
+        tap(session.client, session.process, x, y, wait)
+        session.save(label)
+    press(session.client, session.process, "b", 600)
+    session.save("setup-root-after-back")
+    press(session.client, session.process, "b", 600)
+    prompt = session.save("system-will-shut-down")
+
+    rings = {
+        name: session.client.command("net_ring_dump", max=256, filter=name)
+        for name in FILTERS
+    }
+    counts = {
+        name: len(value.get("events", [])) if isinstance(value, dict) else 0
+        for name, value in rings.items()
+    }
+    if counts.get("dhcp", 0) == 0 or counts.get("backend_error", 0) != 0:
+        raise RuntimeError(f"connection test did not succeed cleanly: {counts}")
+
+    # The green check confirms the firmware's terminal shutdown prompt.
+    session.client.command("touch", x=128, y=128, down=True)
+    try:
+        session.process.wait(timeout=30)
+    except subprocess.TimeoutExpired as exc:
+        raise RuntimeError("guest power-off left the application open") from exc
+    if session.process.returncode != 0:
+        raise RuntimeError(
+            f"guest power-off returned {session.process.returncode}"
+        )
+    session.close_handles()
+    stderr_text = (session.output / "runner.stderr.log").read_text(
+        encoding="utf-8", errors="replace"
+    )
+    if "[sdl] guest requested power-off; closing" not in stderr_text:
+        raise RuntimeError("runner did not report the guest power-off exit")
+    return {"prompt": prompt, "net_counts": counts, "returncode": 0}
+
+
+def direct_online(
+    session: InteractiveSession,
+    require_no_notice_pages: bool,
+) -> dict[str, Any]:
+    reach_wfc_menu(session)
+    tap(session.client, session.process, *FRIENDS_AND_RIVALS, 240)
+    session.save("friends-rivals")
+
+    arrow_pages = 0
+    yes_pages = 0
+    ok_pages = 0
+    for index in range(8):
+        item = session.save(f"dialog-{index}")
+        image = Image.open(session.output / str(item["image"])).convert("RGB")
+        ok_bright = mph_screens.bright_count(
+            image, mph_screens.BOXES["dialog_ok"]
+        )
+        if mph_screens.bright_count(
+                image, mph_screens.BOXES["dialog_arrow"]) > 40:
+            arrow_pages += 1
+            tap(session.client, session.process, 190, 120, 240)
+        elif mph_screens.is_connect_dialog(image):
+            yes_pages += 1
+            tap(session.client, session.process, *DIALOG_YES, 240)
+        elif 40 < ok_bright < 200:
+            ok_pages += 1
+            tap(session.client, session.process, 128, 128, 240)
+        elif ok_bright >= 200:
+            # The animated connection badge shares the acknowledgement's
+            # screen region. Leave it alone and wait for authentication.
+            break
+        else:
+            break
+    wait_frames(session.client, session.process, 2400)
+    final = session.save("post-connect")
+    rings = {
+        name: session.client.command("net_ring_dump", max=256, filter=name)
+        for name in FILTERS
+    }
+    counts = {
+        name: len(value.get("events", [])) if isinstance(value, dict) else 0
+        for name, value in rings.items()
+    }
+    if counts.get("tls_record", 0) == 0 or counts.get("backend_error", 0) != 0:
+        raise RuntimeError(f"Wiimmfi authentication failed: {counts}")
+    if require_no_notice_pages and (arrow_pages != 0 or ok_pages != 0):
+        raise RuntimeError(
+            "returning profile repeated pairing/update pages: "
+            f"arrow={arrow_pages}, ok={ok_pages}"
+        )
+
+    response = session.client.command("frontend_exit")
+    if not isinstance(response, dict) or not response.get("requested"):
+        raise RuntimeError(f"frontend_exit was not accepted: {response!r}")
+    session.process.wait(timeout=30)
+    if session.process.returncode != 0:
+        raise RuntimeError(
+            f"normal window close returned {session.process.returncode}"
+        )
+    session.close_handles()
+    return {
+        "final": final,
+        "arrow_pages": arrow_pages,
+        "yes_pages": yes_pages,
+        "ok_pages": ok_pages,
+        "net_counts": counts,
+        "returncode": 0,
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--runner", type=Path, required=True)
+    parser.add_argument("--rom", type=Path, required=True)
+    parser.add_argument("--config", type=Path, required=True)
+    parser.add_argument("--source-save", type=Path, required=True)
+    parser.add_argument("--source-identity", type=Path, required=True)
+    parser.add_argument("--out", type=Path, required=True)
+    parser.add_argument("--port", type=int, default=21020)
+    parser.add_argument("--wfc-provider", default="wiimmfi")
+    parser.add_argument("--input-fuzz-seed", type=int, default=0x4D5048)
+    parser.add_argument(
+        "--resume-after-setup", action="store_true",
+        help="reuse an existing profile after a successful setup/power-off run",
+    )
+    args = parser.parse_args()
+    INPUT_FUZZ.seed(args.input_fuzz_seed)
+    for key in ("runner", "rom", "config", "source_save", "source_identity"):
+        setattr(args, key, getattr(args, key).resolve())
+    args.out = args.out.resolve()
+    args.out.mkdir(parents=True, exist_ok=True)
+    profile = args.out / "profile"
+    (profile / "bios").mkdir(parents=True, exist_ok=True)
+
+    source_hashes = {
+        "save": sha256(args.source_save),
+        "identity": sha256(args.source_identity),
+    }
+    if not args.resume_after_setup:
+        shutil.copy2(args.source_save, profile / "Metroid Prime Hunters.sav")
+        shutil.copy2(
+            args.source_identity, profile / "bios" / "generated-identity.bin"
+        )
+    elif not (profile / "firmware-generated.bin").is_file():
+        parser.error("--resume-after-setup requires an existing profile state")
+
+    summary: dict[str, Any] = {
+        "input_fuzz_seed": args.input_fuzz_seed,
+        "source_hashes": source_hashes,
+    }
+    sessions: list[InteractiveSession] = []
+    try:
+        state = profile / "firmware-generated.bin"
+        cartridge = profile / "Metroid Prime Hunters.sav"
+        if not args.resume_after_setup:
+            first = InteractiveSession(
+                args, "01-setup-poweroff", args.port, profile
+            )
+            sessions.append(first)
+            summary["setup"] = setup_and_power_off(first)
+            summary["state_after_setup"] = {
+                "size": state.stat().st_size, "sha256": sha256(state)
+            }
+            summary["save_after_setup"] = sha256(cartridge)
+        else:
+            summary["setup"] = "resumed"
+
+        online_port = args.port + (0 if args.resume_after_setup else 1)
+        second = InteractiveSession(args, "02-first-online", online_port, profile)
+        sessions.append(second)
+        summary["first_online"] = direct_online(second, False)
+        summary["state_after_first_online"] = sha256(state)
+        summary["save_after_first_online"] = sha256(cartridge)
+
+        third = InteractiveSession(args, "03-returning-online", online_port + 1, profile)
+        sessions.append(third)
+        summary["returning_online"] = direct_online(third, True)
+        summary["state_after_returning_online"] = sha256(state)
+        summary["save_after_returning_online"] = sha256(cartridge)
+    finally:
+        for session in sessions:
+            if session.process.poll() is None:
+                session.force_cleanup()
+
+    if sha256(args.source_save) != source_hashes["save"] or \
+       sha256(args.source_identity) != source_hashes["identity"]:
+        raise RuntimeError("source save/identity changed during QA")
+    summary["sources_unchanged"] = True
+    summary["success"] = True
+    (args.out / "summary.json").write_text(
+        json.dumps(summary, indent=2) + "\n", encoding="utf-8"
+    )
+    print(json.dumps(summary, indent=2), flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/probe_mph_wfc.py b/tools/probe_mph_wfc.py
index 52c9c81..16619ba 100644
--- a/tools/probe_mph_wfc.py
+++ b/tools/probe_mph_wfc.py
@@ -148,6 +148,12 @@ def run(args: argparse.Namespace) -> dict[str, Any]:
         command.append("--no-save")
     if args.firmware_path:
         command.extend(["--firmware-path", str(args.firmware_path.resolve())])
+    if args.firmware_state_path:
+        command.extend([
+            "--firmware-state-path", str(args.firmware_state_path.resolve())
+        ])
+    if args.no_dumps:
+        command.extend(["--freebios", "--generated-firmware", "--boot", "direct"])
     if args.discover_static_misses:
         command.append("--discover-static-misses")
 
@@ -195,7 +201,12 @@ def run(args: argparse.Namespace) -> dict[str, Any]:
                         ("settings-tile", 85, 100, 220),
                         ("slot1", 43, 35, 220),
                         ("search-for-ap", 128, 37, 1600),
-                        ("ap-row", 50, 65, 220),
+                        # Generated firmware already advertises the runner's
+                        # ndsrecomp AP. Discovery selects it and returns to
+                        # Connection 1 Settings; the old probe tapped (50,65)
+                        # here, which is the SSID row and opened the keyboard.
+                        ("test-connection", 192, 36, 2400),
+                        ("save-settings", 190, 177, 600),
                     )
                 else:
                     if args.flow == "friends-rivals":
@@ -215,9 +226,12 @@ def run(args: argparse.Namespace) -> dict[str, Any]:
                     save(label)
 
                 if args.flow == "setup":
-                    input_lib.press_key(client, "a", 12)
-                    input_lib.advance_frames(client, 300)
-                    save("after-a-start-test")
+                    input_lib.press_key(client, "b", 12)
+                    input_lib.advance_frames(client, 600)
+                    save("setup-root-after-back")
+                    input_lib.press_key(client, "b", 12)
+                    input_lib.advance_frames(client, 600)
+                    save("exit-prompt")
 
                 if args.flow == "search-game":
                     for target in args.targets:
@@ -272,7 +286,7 @@ def run(args: argparse.Namespace) -> dict[str, Any]:
                     firmware = client.command("firmware_dump")
                     if not isinstance(firmware, dict):
                         raise RuntimeError("firmware_dump returned a non-object response")
-                    if int(firmware.get("size", 0)) != 262144:
+                    if int(firmware.get("size", 0)) not in (131072, 262144):
                         raise RuntimeError(
                             f"firmware_dump returned {firmware.get('size')} bytes"
                         )
@@ -313,6 +327,8 @@ def main() -> int:
     parser.add_argument("--config", type=Path, default=Path("game.toml"))
     parser.add_argument("--save-path", type=Path)
     parser.add_argument("--firmware-path", type=Path)
+    parser.add_argument("--firmware-state-path", type=Path)
+    parser.add_argument("--no-dumps", action="store_true")
     parser.add_argument("--firmware-out", type=Path)
     parser.add_argument("--discover-static-misses", action="store_true")
     parser.add_argument(
@@ -357,6 +373,8 @@ def main() -> int:
         parser.error("--port must be in 1..65535")
     if args.instance_index < 0 or args.instance_index > 255:
         parser.error("--instance-index must be in 0..255")
+    if args.no_dumps and args.firmware_path:
+        parser.error("--no-dumps and --firmware-path are mutually exclusive")
 
     summary = run(args)
     print(json.dumps(summary, indent=2), flush=True)

From 1932f626b86c2c8682fd93342ae2bac8fa8dbfd9 Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 23:49:25 -0700
Subject: [PATCH 04/23] Drive MPH friend matches across local peer routing

---
 game.toml                     |  2 +-
 tools/run_mph_friend_match.py | 56 +++++++++++++++++++++++++++++++++--
 2 files changed, 54 insertions(+), 4 deletions(-)

diff --git a/game.toml b/game.toml
index 0a116fd..d49545e 100644
--- a/game.toml
+++ b/game.toml
@@ -61,7 +61,7 @@ size = 0x00028464
 
 [framework]
 path = "../ndsrecomp"
-pin = "6c6a03bdcf99093f64555c4d05d16e522dc58634"
+pin = "302404ada0929528b680fa6808aad253b425c7a2"
 branch = "main"
 
 [reference.mphread]
diff --git a/tools/run_mph_friend_match.py b/tools/run_mph_friend_match.py
index 11bc52c..4946181 100644
--- a/tools/run_mph_friend_match.py
+++ b/tools/run_mph_friend_match.py
@@ -96,7 +96,9 @@
 # ...and that lands on SELECT HUNTER, the third setup tab. Only the first three
 # portraits are selectable; the leftmost is Samus.
 HUNTER_SAMUS = (27, 132)
+HOST_START_DISC = (240, 149)
 CONFIG_CAPTURE_FRAMES = (600, 1200, 2400)
+POST_JOIN_CAPTURE_FRAMES = (240, 240, 240, 240, 240, 240, 240, 240)
 
 
 @dataclass
@@ -140,10 +142,11 @@ def launch_instance(args: argparse.Namespace, index: int) -> Instance:
         "on",
         "--wfc-provider",
         args.wfc_provider,
-        # Prepared per-profile firmware carries the identity, so every instance
-        # keeps slot 0 and is differentiated by the injected image instead.
+        # Prepared per-profile firmware carries the console identity. The
+        # runner instance index is still useful for host-side networking:
+        # slirp uses it to place each emulated DS on a distinct virtual LAN.
         "--instance-index",
-        "0",
+        str(index),
         "--save-path",
         str(save_path),
     ]
@@ -516,6 +519,52 @@ def join_phase(instance: Instance) -> None:
 
     for_each(instances, join_phase)
 
+    post_join_log: list[dict[str, Any]] = []
+
+    def post_join_action(
+        label: str,
+        actor: Instance,
+        action: tuple[Any, ...],
+        capture_frames: tuple[int, ...] = POST_JOIN_CAPTURE_FRAMES,
+    ) -> None:
+        def input_step(instance: Instance) -> None:
+            assert instance.client is not None
+            beat(instance, action if instance is actor else None, 0)
+
+        for_each(instances, input_step)
+
+        for index, frames in enumerate(capture_frames):
+            for_each(
+                instances,
+                lambda instance, frames=frames: input_lib.advance_frames(
+                    instance.client, frames
+                ),
+            )
+            for instance in instances:
+                role = "host" if instance is host else "guest"
+                save_checkpoint(instance, f"{role}-postjoin-{label}-{index}")
+
+    if any(entry["joined"] for entry in join_log):
+        guest = next(instance for instance in instances if instance is not host)
+        post_join_action("guest-samus", guest, ("tap", *HUNTER_SAMUS))
+        post_join_action("guest-confirm", guest, ("key", "a"))
+        post_join_action("host-disc", host, ("tap", *HOST_START_DISC))
+        for instance in instances:
+            state = current_screen(instance)
+            post_join_log.append(
+                {
+                    "instance": instance.index,
+                    "screen": state,
+                    "final_image": instance.report[-1]["image"],
+                    "final_vblank9": instance.report[-1]["vblank9"],
+                }
+            )
+            print(
+                f"[post-join] instance {instance.index}: {state} "
+                f"{instance.report[-1]['image']}",
+                flush=True,
+            )
+
     for target in args.targets:
         for_each(
             instances,
@@ -579,6 +628,7 @@ def join_phase(instance: Instance) -> None:
         "wfc_provider": args.wfc_provider,
         "join_attempts": join_log,
         "joined": any(entry["joined"] for entry in join_log),
+        "post_join": post_join_log,
         "summaries": summaries,
         "backend_clean": all(s["backend_clean"] for s in summaries),
     }

From 413c616f134999b862051834155d9bcd9173f4a7 Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 18:58:12 -0700
Subject: [PATCH 05/23] launcher: remember the chosen ROM across relaunches

nds_persist_setup received the ROM path the user picked and discarded it
with (void)rom_path, persisting only bios_path. The path handed to
recomp_launcher_run_window was always the hardcoded bundled default next
to the exe, so anyone whose dump lives elsewhere re-picked it on every
launch and saw "ROM not found" each time.

The shared launcher does not cover for this: it writes rom.cfg sidecars
into three directories but never reads them back -- grepping recomp-ui's
src/ finds only writes, and the model's only ROM seed is the initial_rom
argument. Tracked separately as beads-0fu.1; owning the path here keeps
the fix independent of which recomp-ui build is linked.

- ModState gains rom_path; settings_version 2 -> 3.
- nds_persist_setup records it, and treats an empty callback value as
  "nothing selected right now" rather than a clear -- the callback also
  fires on BIOS browse, and clearing there would reintroduce the bug.
- initial_rom is the remembered path when it names an existing file, else
  the bundled default, so a moved or deleted ROM falls back rather than
  presenting a selection that cannot launch.
- The final selection is mirrored into mod_state before the save, matching
  how bios_path and player_name are already treated as authoritative
  (persistence is best-effort UX and PLAY can be pressed without the
  callback firing).

Regression test covers round trip, empty-callback-does-not-clear, a new
pick being recorded, a path containing '=' (the parser splits on the
first '='), and version-2 forward migration keeping bios_path and
player_name.

beads-lqa.3

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 launcher/recomp-ui/launcher_main.cpp          | 38 ++++++++--
 .../tests/launcher_mod_provider_test.cpp      | 72 +++++++++++++++++++
 2 files changed, 106 insertions(+), 4 deletions(-)

diff --git a/launcher/recomp-ui/launcher_main.cpp b/launcher/recomp-ui/launcher_main.cpp
index 8258166..780e3b9 100644
--- a/launcher/recomp-ui/launcher_main.cpp
+++ b/launcher/recomp-ui/launcher_main.cpp
@@ -79,6 +79,12 @@ struct ModState {
     std::string pad_weapon6 = "None";
     std::string pad_virtual_stylus = "None";
     std::string pad_menu = "Pad Start";
+    // Persisted ROM choice (beads-lqa.3). The shared launcher writes its own
+    // rom.cfg sidecars but never reads them back (beads-0fu.1), so the ROM the
+    // user picked was lost on every relaunch and the hardcoded bundled default
+    // was re-offered -- "ROM not found" for anyone whose dump lives elsewhere.
+    // Owning the path here keeps the fix independent of the recomp-ui build.
+    std::string rom_path;
     // Persisted BIOS choice, psxrecomp-style: any one of the three retail
     // dump files (its folder is used at launch). Empty = the built-in
     // FreeBIOS + generated firmware.
@@ -399,6 +405,11 @@ void load_mod_state(ModState& state) {
             state.mouse_invert_y = value == "true";
         } else if (key == "prime_controls") {
             state.prime_controls = value != "false";
+        } else if (key == "rom_path") {
+            // Kept verbatim. Existence is checked at use, not here: a dump on
+            // removable media that is absent this launch should not erase the
+            // remembered pick.
+            state.rom_path = value;
         } else if (key == "bios_path") {
             state.bios_path = value;
         } else if (key == "player_name_override") {
@@ -466,7 +477,7 @@ bool save_mod_state(ModState& state) {
             state.last_error = "Could not write launcher mod settings.";
             return false;
         }
-        file << "settings_version=2\n"
+        file << "settings_version=3\n"
              << "adaptive_widescreen="
              << (state.adaptive_widescreen ? "true" : "false") << '\n'
              << "hd_rendering="
@@ -483,6 +494,7 @@ bool save_mod_state(ModState& state) {
              << "virtual_stylus_sensitivity="
              << state.virtual_stylus_sensitivity << '\n'
              << "pad_aim_sensitivity=" << state.pad_aim_sensitivity << '\n'
+             << "rom_path=" << state.rom_path << '\n'
              << "bios_path=" << state.bios_path << '\n'
              << "player_name=" << state.player_name << '\n';
         for (const BindingOption& option : kBindingOptions)
@@ -994,9 +1006,14 @@ int nds_bios_verify(const char* bios_path, RecompLauncherCBiosVerify* out) {
 
 int nds_persist_setup(void* context, const char* rom_path,
                       const char* bios_path) {
-    (void)rom_path;
     if (!context) return 1;
     auto* state = static_cast<ModState*>(context);
+    // beads-lqa.3: the ROM path used to be discarded here, which is why the
+    // pick never survived a relaunch. An empty callback value means "no ROM
+    // selected right now", not "forget the remembered one" -- the launcher
+    // fires this on BIOS browse too, and clearing on those would resurrect the
+    // original bug.
+    if (rom_path && rom_path[0]) state->rom_path = rom_path;
     state->bios_path = bios_path ? bios_path : "";
     return save_mod_state(*state) ? 0 : 1;
 }
@@ -1234,8 +1251,17 @@ int main(int argc, char** argv) {
     game.persist_setup = nds_persist_setup;
     game.persist_setup_ctx = &mod_state;
 
-    const std::filesystem::path default_rom =
-        exe / "Metroid Prime Hunters.nds";
+    // beads-lqa.3: prefer the remembered pick, fall back to the bundled dump
+    // next to the exe. A remembered path whose file is gone falls back too,
+    // so a moved or deleted ROM presents the bundled default rather than a
+    // stale selection the user cannot launch.
+    std::filesystem::path default_rom = exe / "Metroid Prime Hunters.nds";
+    if (!mod_state.rom_path.empty()) {
+        std::error_code rom_error;
+        const std::filesystem::path remembered(mod_state.rom_path);
+        if (std::filesystem::is_regular_file(remembered, rom_error))
+            default_rom = remembered;
+    }
     char selected_rom[1024]{};
     const int result = recomp_launcher_run_window(
         "Metroid Prime Hunters - Launcher", &settings, &game,
@@ -1249,6 +1275,10 @@ int main(int argc, char** argv) {
     // The UI's final BIOS selection is authoritative for this launch even if
     // a persist callback was missed (persistence is best-effort UX).
     mod_state.bios_path = settings.bios_path;
+    // Same for the ROM (beads-lqa.3). PLAY can be pressed without the persist
+    // callback ever firing for the ROM, so treat what we are about to launch
+    // as the thing to remember.
+    if (selected_rom[0]) mod_state.rom_path = selected_rom;
     // Same for the ONLINE card's player name. An invalid entry is surfaced
     // and dropped rather than silently reshaped or allowed to block launch.
     {
diff --git a/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp b/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp
index 80e8a1b..fd209cb 100644
--- a/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp
+++ b/launcher/recomp-ui/tests/launcher_mod_provider_test.cpp
@@ -394,5 +394,77 @@ int main() {
         std::filesystem::remove(hd_saved.settings_path);
     }
 
+    // beads-lqa.3: the chosen ROM must survive a relaunch. It used to be
+    // discarded in nds_persist_setup, so every launch fell back to the bundled
+    // default path and anyone whose dump lived elsewhere saw "ROM not found"
+    // forever.
+    {
+        const std::filesystem::path settings_path =
+            std::filesystem::temp_directory_path() /
+            "mph_mod_provider_rom_settings.ini";
+
+        ModState saved{};
+        saved.settings_path = settings_path;
+        saved.rom_path = "D:\\Games\\NDS\\Metroid Prime Hunters.nds";
+        saved.bios_path = "D:\\Games\\NDS\\bios\\biosnds9.rom";
+        if (!require(save_mod_state(saved), "rom save")) return 73;
+
+        ModState loaded{};
+        loaded.settings_path = settings_path;
+        load_mod_state(loaded);
+        if (!require(loaded.rom_path == saved.rom_path,
+                     "rom path round trip")) return 74;
+
+        // The callback fires on BIOS browse too, with no ROM. An empty value
+        // means "nothing selected right now", never "forget the pick" --
+        // clearing here would reintroduce the original bug.
+        if (!require(nds_persist_setup(&loaded, "", "E:\\dumps\\biosnds7.rom")
+                         == 0,
+                     "persist_setup with empty rom succeeds")) return 75;
+        if (!require(loaded.rom_path == saved.rom_path,
+                     "empty persist_setup rom does not clear the pick"))
+            return 76;
+        if (!require(loaded.bios_path == "E:\\dumps\\biosnds7.rom",
+                     "persist_setup still updates bios")) return 77;
+
+        if (!require(nds_persist_setup(&loaded, "E:\\other\\MPH.nds", "") == 0,
+                     "persist_setup with a rom succeeds")) return 78;
+        if (!require(loaded.rom_path == "E:\\other\\MPH.nds",
+                     "persist_setup records a new rom pick")) return 79;
+
+        // A path containing '=' must survive: load_mod_state splits on the
+        // FIRST '=', so everything after it is the value.
+        ModState equals_saved{};
+        equals_saved.settings_path = settings_path;
+        equals_saved.rom_path = "D:\\ROMs\\a=b\\Metroid Prime Hunters.nds";
+        if (!require(save_mod_state(equals_saved), "rom save with equals"))
+            return 80;
+        ModState equals_loaded{};
+        equals_loaded.settings_path = settings_path;
+        load_mod_state(equals_loaded);
+        if (!require(equals_loaded.rom_path == equals_saved.rom_path,
+                     "rom path with '=' round trip")) return 81;
+
+        // A pre-existing version-2 file has no rom_path key. It must load
+        // cleanly with an empty pick and keep everything else.
+        {
+            std::ofstream file(settings_path, std::ios::trunc);
+            file << "settings_version=2\n"
+                    "bios_path=F:\\keepme\\biosnds9.rom\n"
+                    "player_name=Samus\n";
+        }
+        ModState migrated{};
+        migrated.settings_path = settings_path;
+        load_mod_state(migrated);
+        if (!require(migrated.rom_path.empty(),
+                     "version 2 settings have no remembered rom")) return 82;
+        if (!require(migrated.bios_path == "F:\\keepme\\biosnds9.rom",
+                     "version 2 migration keeps bios_path")) return 83;
+        if (!require(migrated.player_name == "Samus",
+                     "version 2 migration keeps player_name")) return 84;
+
+        std::filesystem::remove(settings_path);
+    }
+
     return 0;
 }

From 9d51f0ee01d0886a43a300ab400480975ff1ad2a Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 19:28:14 -0700
Subject: [PATCH 06/23] tools: report which ARM9 overlays a play route actually
 exercised

Decides what is worth recompiling ahead of time: maps every Tier-3
address from a coverage manifest or a fuzz/benchmark trace onto the
overlay table, and reports points and hits per overlay.

Collisions are computed by SPAN, not by load address. Judging by load
address is wrong and flatters the picture -- in MPH three overlays look
unshared by load address, but all eighteen overlap another by span
(overlay 4 loads at 0x0214C860; overlay 10 loads at 0x0214C940, 0xE0
bytes inside it). That matters because "pick an overlay with no
collision to handle yet" is the pilot step docs/overlay-strategy.md
section 4 recommends, and for MPH no such overlay exists.

Addresses outside every overlay are reported rather than dropped: ITCM,
ARM7 WRAM and the immutable main image all land there, and silently
discarding them would make a route look better covered than it is.

Measured so far, ARM9:
  200M-cycle direct boot, no input   ->  9 of 18 overlays
  4000 vblanks, automatic startup    -> 11 of 18 overlays
Overlay 0 dominates both (2695 points / 701470 hits on the longer run).
The seven still dark are the 0x0219DC20 group (5,6,7,17) plus 14,15,16,
which a boot-and-idle route never reaches.

beads-yjp.31

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 tools/overlay_coverage_report.py | 144 +++++++++++++++++++++++++++++++
 1 file changed, 144 insertions(+)
 create mode 100644 tools/overlay_coverage_report.py

diff --git a/tools/overlay_coverage_report.py b/tools/overlay_coverage_report.py
new file mode 100644
index 0000000..3f86169
--- /dev/null
+++ b/tools/overlay_coverage_report.py
@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""Report which ARM9 overlays a play route actually exercised.
+
+beads-yjp.31. Answers the question that decides what to recompile ahead of
+time: for a given route through the game, which overlays did the guest
+actually execute, and how hard?
+
+Takes any number of coverage sources and maps every Tier-3 address onto the
+overlay table:
+
+  * a coverage manifest written by the runner (--coverage-manifest, or the
+    `coverage_manifest` debug command), which has entry_points_arm9/arm7, or
+  * a fuzz/benchmark trace.json carrying a tier3_coverage block.
+
+Collisions are computed by SPAN, not by load address. Judging by load address
+alone is wrong and flatters the picture: in MPH three overlays look unshared
+by load address, but every one of the eighteen overlaps another by span (e.g.
+overlay 4 loads at 0x0214C860 and overlay 10 loads at 0x0214C940, 0xE0 bytes
+inside it).
+
+Addresses that fall outside every overlay are reported too, not dropped --
+ITCM, ARM7 WRAM and the immutable main image all show up there, and a silent
+drop would make a route look better covered than it is.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+
+def load_overlays(path: Path) -> list[dict]:
+    overlays = json.loads(path.read_text(encoding="utf-8"))
+    for entry in overlays:
+        entry["lo"] = int(entry["load_address"], 16)
+        # bss is zero-initialised at load and holds no code, so the executable
+        # span is size, not size + bss_size.
+        entry["hi"] = entry["lo"] + int(entry["size"])
+    return overlays
+
+
+def load_points(paths: list[Path]) -> tuple[list[tuple[int, int, str]], list[str]]:
+    """Return [(addr, hits, kind)] for ARM9, plus a note per source."""
+    points: list[tuple[int, int, str]] = []
+    notes: list[str] = []
+    for path in paths:
+        data = json.loads(path.read_text(encoding="utf-8"))
+        if data.get("kind") == "ndsrecomp-tier3-coverage":
+            entries = data.get("entry_points_arm9", [])
+            points += [(int(e["addr"], 16), int(e.get("hits", 0)),
+                        str(e.get("kind", "?"))) for e in entries]
+            notes.append(f"{path.name}: manifest, {len(entries)} ARM9 entries")
+            continue
+        block = data.get("tier3_coverage") or {}
+        entries = [e for e in block.get("entries", []) if int(e["cpu"]) == 9]
+        if entries:
+            kinds = {1: "root", 2: "call", 3: "indirect"}
+            points += [(int(e["pc"]), int(e.get("hits", 0)),
+                        kinds.get(int(e.get("kind", 0)), "?")) for e in entries]
+            notes.append(f"{path.name}: trace, {len(entries)} ARM9 entries")
+        else:
+            notes.append(f"{path.name}: NO ARM9 Tier-3 coverage found")
+    return points, notes
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("sources", nargs="+", type=Path,
+                        help="coverage manifests and/or trace.json files")
+    parser.add_argument("--overlays", type=Path,
+                        default=Path("generated/inputs/overlays.json"))
+    parser.add_argument("--json", type=Path, help="also write the report here")
+    args = parser.parse_args()
+
+    overlays = load_overlays(args.overlays)
+    points, notes = load_points(args.sources)
+    for note in notes:
+        print(f"  {note}")
+    if not points:
+        print("no ARM9 Tier-3 coverage in any source")
+        return 1
+    print()
+
+    rows = []
+    for entry in sorted(overlays, key=lambda o: (o["lo"], o["id"])):
+        inside = [p for p in points if entry["lo"] <= p[0] < entry["hi"]]
+        shares = [str(o["id"]) for o in overlays
+                  if o is not entry and o["lo"] < entry["hi"]
+                  and entry["lo"] < o["hi"]]
+        rows.append({
+            "id": entry["id"],
+            "lo": entry["lo"],
+            "hi": entry["hi"],
+            "kib": int(entry["size"]) // 1024,
+            "points": len(inside),
+            "hits": sum(p[1] for p in inside),
+            "shares_span_with": shares,
+        })
+
+    print(f"{'id':>3} {'span':<23} {'KiB':>5} {'points':>7} {'hits':>9}  shares span with")
+    for row in rows:
+        shared = ",".join(row["shares_span_with"]) or "-"
+        print(f"{row['id']:>3} 0x{row['lo']:08X}-0x{row['hi']:08X} "
+              f"{row['kib']:>5} {row['points']:>7} {row['hits']:>9}  {shared}")
+
+    covered = {p[0] for row, entry in zip(rows, sorted(overlays, key=lambda o: (o["lo"], o["id"])))
+               for p in points if entry["lo"] <= p[0] < entry["hi"]}
+    outside = [p for p in points if p[0] not in covered]
+    print()
+    print(f"addresses inside an overlay : {len(points) - len(outside)}")
+    print(f"addresses outside every one : {len(outside)}"
+          "   (ITCM / ARM7 WRAM / immutable main image)")
+    if outside:
+        buckets: dict[int, int] = {}
+        for addr, _hits, _kind in outside:
+            buckets[addr >> 16 << 16] = buckets.get(addr >> 16 << 16, 0) + 1
+        print("  by 64 KiB region:")
+        for base in sorted(buckets):
+            print(f"    0x{base:08X}  {buckets[base]}")
+
+    exercised = [r for r in rows if r["points"]]
+    print()
+    print(f"overlays exercised: {len(exercised)} of {len(rows)}")
+    if exercised:
+        best = max(exercised, key=lambda r: r["hits"])
+        print(f"highest-value target: overlay {best['id']} "
+              f"({best['points']} points, {best['hits']} hits)")
+
+    if args.json:
+        args.json.write_text(json.dumps({
+            "sources": [str(p) for p in args.sources],
+            "overlays": rows,
+            "points_total": len(points),
+            "points_outside_overlays": len(outside),
+        }, indent=2), encoding="utf-8", newline="\n")
+        print(f"\nwrote {args.json}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

From ab64ad8ac2eca7e181bb0f8c846e18260620087b Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 20:10:39 -0700
Subject: [PATCH 07/23] tools: offline-multiplayer route + end-to-end overlay
 coverage loop

Offline multiplayer against bots IS reachable with no peer DS, which makes
it a far better content lever than Adventure: the arena is chosen from a
menu (ARENA n/9 for Battle), bots supply the gameplay, and no navigation
skill is needed. The waiting room states it outright -- "YOU CAN WAIT FOR
MORE PLAYERS OR ADD BOTS" -- and ADD BOT fills the roster (Setya, KANBOT,
SAMBOT, SPIBOT). This is consistent with the vendored MphRead, which
carries PlayerAiData and BotLevel, and whose GameMode enum matches the
mode grid exactly (Battle/Survival/Bounty/Defender/PrimeHunter/Capture/
Nodes).

Route coordinates below are measured from captured frames, not estimated:
  main menu MULTIPLAYER   touch (160,92)   [ADVENTURE is (84,92)]
  nickname dialog         two A presses
  mode row     y~80       SINGLE-CARD x~50, MULTI-CARD x~128, WI-FI x~205
  create/join  y~80       CREATE x~50, JOIN x~128
  game mode    y~58       BATTLE x~50
  arena screen y~48       arrows left x~125 / right x~232, confirm (222,173)
  hunter                  Samus (27,132) then A
  waiting room            ADD BOT (222,173)

mph_overlay_route.py is the measurement loop: cold boot, replay a
scenario, dump the Tier-3 manifest over TCP, hand it to
overlay_coverage_report.py. It dumps via the debug command rather than
process exit because --serve never leaves its accept loop, so a
harness-killed run would lose everything it recorded.

Measured ARM9 overlay coverage by route:
  200M-cycle direct boot, no input      9 of 18   2085 entries
  4000 vblanks, automatic startup      11 of 18   3751 entries
  multiplayer setup to the bot lobby   11 of 18   5010 entries
The multiplayer route newly lights overlays 3 and 8, which every earlier
route left at zero. Still dark: 14, 15, 16 and the 0x0219DC20 group
(5, 6, 7, 17) -- almost certainly in-arena code, since the route stops in
the waiting room.

NOT DONE: the control that actually starts the match. START and A do not
launch it, and the tap at (105,133) hits a bot-level star control rather
than a ready toggle. Finding it is the next step and should unlock the
remaining overlays.

beads-yjp.31

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scenarios/multiplayer_battle_bots.json | 151 +++++++++++++++++++
 scenarios/multiplayer_probe.json       |  29 ++++
 tools/mph_overlay_route.py             | 195 +++++++++++++++++++++++++
 3 files changed, 375 insertions(+)
 create mode 100644 scenarios/multiplayer_battle_bots.json
 create mode 100644 scenarios/multiplayer_probe.json
 create mode 100644 tools/mph_overlay_route.py

diff --git a/scenarios/multiplayer_battle_bots.json b/scenarios/multiplayer_battle_bots.json
new file mode 100644
index 0000000..3e72ed0
--- /dev/null
+++ b/scenarios/multiplayer_battle_bots.json
@@ -0,0 +1,151 @@
+{
+  "description": "Offline multiplayer: BATTLE on arena 1/9 (Combat Hall) against 3 bots, no peer DS required. Reaches real gameplay far faster than the Adventure route and is the deterministic content lever for overlay coverage -- change only the arena arrow taps to select a different arena. Verified coordinates: main-menu MULTIPLAYER touch (160,92); the nickname dialog takes two A presses; mode row touch y~80 (SINGLE-CARD x~50, MULTI-CARD x~128, WI-FI x~205); CREATE/JOIN row touch y~80 (CREATE x~50, JOIN x~128); game-mode grid top row touch y~58 (BATTLE x~50); arena screen shows ARENA n/9 with arrows at touch y~48 (left x~125, right x~232) and confirm at touch (222,173); hunter Samus at touch (27,132) then A; the waiting room offers ADD BOT at touch (222,173).",
+  "actions": [
+    {
+      "kind": "touch",
+      "x": 160,
+      "y": 92
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 128,
+      "y": 80
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 50,
+      "y": 80
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 50,
+      "y": 62
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 27,
+      "y": 132
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 600
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 105,
+      "y": 133
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 600
+    },
+    {
+      "kind": "wait",
+      "frames": 600
+    }
+  ]
+}
\ No newline at end of file
diff --git a/scenarios/multiplayer_probe.json b/scenarios/multiplayer_probe.json
new file mode 100644
index 0000000..d2711ab
--- /dev/null
+++ b/scenarios/multiplayer_probe.json
@@ -0,0 +1,29 @@
+{
+  "description": "Discovery trace: Multiplayer -> MULTI-CARD -> CREATE GAME -> BATTLE -> confirm arena -> select hunter -> start, to establish whether a local match can begin with no peer DS present. Verified coordinates: main-menu MULTIPLAYER touch (160,92); nickname dialog takes two A presses; mode row touch y~80 (SINGLE-CARD x~50, MULTI-CARD x~128, WI-FI x~205); CREATE/JOIN row touch y~80 (CREATE x~50, JOIN x~128); game-mode grid top row touch y~58 (BATTLE x~50); arena screen shows ARENA n/9 with arrows at touch y~48 (left x~125, right x~232) and a confirm check at touch (222,173).",
+  "actions": [
+    { "kind": "touch", "x": 160, "y": 92 },
+    { "kind": "wait", "frames": 240 },
+    { "kind": "wait", "frames": 240 },
+    { "kind": "key", "key": "a" },
+    { "kind": "wait", "frames": 240 },
+    { "kind": "key", "key": "a" },
+    { "kind": "wait", "frames": 240 },
+    { "kind": "touch", "x": 128, "y": 80 },
+    { "kind": "wait", "frames": 300 },
+    { "kind": "wait", "frames": 300 },
+    { "kind": "touch", "x": 50, "y": 80 },
+    { "kind": "wait", "frames": 300 },
+    { "kind": "wait", "frames": 300 },
+    { "kind": "touch", "x": 50, "y": 62 },
+    { "kind": "wait", "frames": 300 },
+    { "kind": "wait", "frames": 300 },
+    { "kind": "touch", "x": 222, "y": 173 },
+    { "kind": "wait", "frames": 300 },
+    { "kind": "wait", "frames": 300 },
+    { "kind": "touch", "x": 27, "y": 132 },
+    { "kind": "wait", "frames": 300 },
+    { "kind": "key", "key": "a" },
+    { "kind": "wait", "frames": 600 },
+    { "kind": "wait", "frames": 600 }
+  ]
+}
diff --git a/tools/mph_overlay_route.py b/tools/mph_overlay_route.py
new file mode 100644
index 0000000..13dc2d1
--- /dev/null
+++ b/tools/mph_overlay_route.py
@@ -0,0 +1,195 @@
+#!/usr/bin/env python3
+"""Run a route and report which overlays it exercised.
+
+beads-yjp.31. The measurement loop: cold boot -> replay a scenario -> dump the
+Tier-3 coverage manifest over TCP -> map it onto the overlay table.
+
+The manifest dump is a debug command rather than an exit-path write because
+--serve never exits its accept loop, so a harness-killed session would
+otherwise lose everything it recorded. Dumping on demand also means a route
+can be sampled part-way through instead of only at the end.
+
+Screenshots are captured at every step so a route can be checked visually and
+so new screen predicates can be measured from real frames.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import socket
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+KEY_BITS = {
+    "a": 0, "b": 1, "select": 2, "start": 3, "right": 4, "left": 5,
+    "up": 6, "down": 7, "r": 8, "l": 9, "x": 10, "y": 11,
+}
+# Active-low, and the server's own default of 0x3FF would leave X and Y held.
+RELEASED = 0x0FFF
+
+
+class DebugClient:
+    def __init__(self, port: int, timeout: float = 1800.0) -> None:
+        self.sock = socket.create_connection(("127.0.0.1", port), timeout=timeout)
+        self.buf = b""
+
+    def cmd(self, name: str, **args: object) -> dict:
+        args["cmd"] = name
+        self.sock.sendall((json.dumps(args) + "\n").encode())
+        while b"\n" not in self.buf:
+            chunk = self.sock.recv(1 << 16)
+            if not chunk:
+                raise RuntimeError("debug server closed the connection")
+            self.buf += chunk
+        line, self.buf = self.buf.split(b"\n", 1)
+        reply = json.loads(line)
+        if isinstance(reply, dict) and "error" in reply:
+            raise RuntimeError(f"{name}: {reply['error']}")
+        return reply
+
+    def vblank(self) -> int:
+        return int(self.cmd("event_counts")["vblank9"])
+
+    def advance(self, frames: int) -> None:
+        target = self.vblank() + frames
+        reply = self.cmd("run_to_event", event="vblank9", count=target)
+        if reply.get("terminal"):
+            raise RuntimeError(f"runner halted: {reply.get('reason9')} / "
+                               f"{reply.get('reason7')}")
+        if reply.get("stalled"):
+            raise RuntimeError(f"stalled before vblank9 {target}")
+
+    def tap(self, x: int, y: int, hold: int) -> None:
+        self.cmd("touch", x=x, y=y, down=True)
+        self.advance(hold)
+        self.cmd("touch", x=0, y=0, down=False)
+
+    def press(self, key: str, hold: int) -> None:
+        bit = KEY_BITS[key]
+        self.cmd("keys", mask=RELEASED & ~(1 << bit))
+        self.advance(hold)
+        self.cmd("keys", mask=RELEASED)
+
+    def screenshot(self, path: Path) -> None:
+        try:
+            from PIL import Image
+        except ImportError:
+            return
+        frames = []
+        for engine in ("A", "B"):
+            fb = self.cmd("framebuffer", engine=engine)
+            raw = bytes.fromhex(fb["rgb"])
+            frames.append(Image.frombytes("RGB", (fb["w"], fb["h"]), raw))
+        combined = Image.new("RGB", (frames[0].width,
+                                     frames[0].height + frames[1].height))
+        combined.paste(frames[0], (0, 0))
+        combined.paste(frames[1], (0, frames[0].height))
+        combined.save(path)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--runner", type=Path, required=True)
+    parser.add_argument("--bios", type=Path, required=True)
+    parser.add_argument("--rom", type=Path, required=True)
+    parser.add_argument("--config", type=Path, required=True)
+    parser.add_argument("--actions", type=Path, required=True)
+    parser.add_argument("--out", type=Path, required=True)
+    parser.add_argument("--overlays", type=Path,
+                        default=Path("generated/inputs/overlays.json"))
+    parser.add_argument("--port", type=int, default=19890)
+    parser.add_argument("--start-vblank", type=int, default=7800)
+    parser.add_argument("--hold-frames", type=int, default=3)
+    parser.add_argument("--settle-frames", type=int, default=45)
+    parser.add_argument("--play-frames", type=int, default=0,
+                        help="hold forward this many frames after the route")
+    parser.add_argument("--no-shots", action="store_true")
+    args = parser.parse_args()
+
+    args.out.mkdir(parents=True, exist_ok=True)
+    actions = json.loads(args.actions.read_text(encoding="utf-8"))
+    if isinstance(actions, dict):
+        actions = actions.get("actions", [])
+
+    proc = subprocess.Popen(
+        [str(args.runner), str(args.bios), "--serve", "--port", str(args.port),
+         "--rom", str(args.rom.resolve()), "--config", str(args.config.resolve()),
+         "--no-save", "--startup-mode", "automatic"],
+        cwd=str(args.runner.parent),
+        stdout=(args.out / "runner.stdout.log").open("wb"),
+        stderr=(args.out / "runner.stderr.log").open("wb"))
+    print(f"runner pid={proc.pid} port={args.port}")
+
+    try:
+        client = None
+        for _ in range(240):
+            if proc.poll() is not None:
+                raise SystemExit(f"runner exited early rc={proc.returncode}")
+            try:
+                client = DebugClient(args.port)
+                break
+            except OSError:
+                time.sleep(0.5)
+        if client is None:
+            raise SystemExit("debug server never came up")
+
+        client.cmd("reset")
+        target = args.start_vblank
+        client.cmd("run_to_event", event="vblank9", count=target)
+        if not args.no_shots:
+            client.screenshot(args.out / f"0000-{target:05d}-title.png")
+        client.tap(128, 96, args.hold_frames)
+        client.advance(180)
+
+        for index, action in enumerate(actions, 1):
+            kind = action["kind"]
+            if kind == "touch":
+                client.tap(int(action["x"]), int(action["y"]), args.hold_frames)
+                label = f"touch-{action['x']}-{action['y']}"
+            elif kind == "key":
+                client.press(str(action["key"]), args.hold_frames)
+                label = f"key-{action['key']}"
+            elif kind == "wait":
+                client.advance(int(action["frames"]))
+                label = f"wait-{action['frames']}"
+            else:
+                raise SystemExit(f"unknown action kind {kind!r}")
+            client.advance(args.settle_frames)
+            if not args.no_shots:
+                client.screenshot(
+                    args.out / f"{index:04d}-{client.vblank():05d}-{label}.png")
+            print(f"[{index}/{len(actions)}] {label}")
+
+        if args.play_frames:
+            # Hold forward. Press-and-hold is state plus time advance; there is
+            # no hold-for-N command.
+            client.cmd("keys", mask=RELEASED & ~(1 << KEY_BITS["up"]))
+            client.advance(args.play_frames)
+            client.cmd("keys", mask=RELEASED)
+            if not args.no_shots:
+                client.screenshot(args.out / "9998-after-walk.png")
+            print(f"held forward {args.play_frames} frames")
+
+        print("static_coverage:", json.dumps(client.cmd("static_coverage")))
+        manifest = (args.out / "coverage.json").resolve()
+        res = client.cmd("coverage_manifest", path=manifest.as_posix())
+        print("coverage_manifest:", json.dumps(res))
+        print(f"\nmanifest: {manifest}")
+        print("now run:")
+        print(f"  py -3 tools/overlay_coverage_report.py {manifest} "
+              f"--overlays {args.overlays}")
+    finally:
+        proc.terminate()
+        try:
+            proc.wait(timeout=20)
+        except subprocess.TimeoutExpired:
+            proc.kill()
+        print(f"stopped pid={proc.pid}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

From 04498fdf8040f634674ae20c759e3fd2e999eb62 Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 20:49:13 -0700
Subject: [PATCH 08/23] tools: seed an overlay's recompiler config with
 proven-generation entry points

prepare_mph.py already writes a config per overlay, but deliberately with
NO entry points -- its docstring says real ones must come from Tier-3
coverage recorded while that exact overlay body was resident. Without
them the recompiler gets a single entry_pc seed into a 276 KB image and
discovers almost nothing.

Supplying them looked blocked. MPH reuses virtual addresses: all 18
overlays overlap another by span and overlay 0 shares its range with
eight. A Tier-3 record is {pc, caller, cpu, thumb, kind, hits} with no
overlay identity, and docs/BRINGUP.md calls combining entry points across
overlay generations unsound.

The coverage manifest already resolves it. It captures the 4 KiB code
pages the guest actually executed, verbatim, at execution time. Comparing
a captured page against each overlay's decompressed ROM image identifies
which overlay was resident when that page ran -- so no runtime change and
no new field are needed.

Measured on a real capture: of 65 captured ARM9 pages, 33 fell inside
some overlay and every one attributed to exactly ONE of them -- 28 to
overlay 0, 2 to overlay 1, 3 to overlay 4, zero ambiguous. Overlapping
spans do not produce collisions in practice.

Seeding overlay 0 from three captured routes: 29 pages proved resident,
8 pages inside its span were rejected as a different generation, 239
entry points dropped as unproven, 7162 dropped as kind=root (scheduler
resume points make poor seeds), leaving 212 seeds. The recompiler then
discovered 2313 functions (arm=2313 thumb=0, undefined=0) and emitted
2314 across 8 shards with the identity sha1 verified.

config/mph_arm9_ov000.toml is that seeded config, committed so the result
is reproducible.

beads-yjp.31

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 config/mph_arm9_ov000.toml          | 1288 +++++++++++++++++++++++++++
 scenarios/mp_bots_start.json        |  177 ++++
 scenarios/mp_singlecard_probe.json  |   59 ++
 scenarios/mp_start_probe.json       |  178 ++++
 tools/seed_overlay_from_coverage.py |  158 ++++
 5 files changed, 1860 insertions(+)
 create mode 100644 config/mph_arm9_ov000.toml
 create mode 100644 scenarios/mp_bots_start.json
 create mode 100644 scenarios/mp_singlecard_probe.json
 create mode 100644 scenarios/mp_start_probe.json
 create mode 100644 tools/seed_overlay_from_coverage.py

diff --git a/config/mph_arm9_ov000.toml b/config/mph_arm9_ov000.toml
new file mode 100644
index 0000000..a15fd76
--- /dev/null
+++ b/config/mph_arm9_ov000.toml
@@ -0,0 +1,1288 @@
+# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.
+# Entry points are Tier-3 observations whose containing 4 KiB page was
+# byte-identical to this overlay's decompressed ROM image at the time it
+# executed, so every seed below is provably from THIS overlay generation
+# and not from one of the overlays sharing its address range.
+
+[program]
+name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay 0"
+id = "mph_amhe0_arm9_ov000"
+load_address = 0x02102220
+size = 0x00045140
+entry_pc = 0x02103010
+authoritative_entry_points = false
+
+[identity]
+sha1 = "5983749ec5c2982e54a10e5f1107ef92b86342b0"
+
+[[entry_point]]
+addr = 0x02103010
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02103088
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02103184
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6715
+
+[[entry_point]]
+addr = 0x02103208
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021034E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x021034F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02103510
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021035CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021035F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02103740
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x021037AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02103834
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02103838
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210384C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02103868
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02103870
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02103974
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02103DD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02103FFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02106B5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02106C34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02106CE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02106D80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02106DAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02106E8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02112E80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02112F9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02112FB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02112FDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02114228
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02114AF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02115208
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02115260
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211527C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 32
+
+[[entry_point]]
+addr = 0x0211528C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24
+
+[[entry_point]]
+addr = 0x02115700
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x02115A5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02115A60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115A64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115A68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115A6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115A70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115A90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02115AA4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021168A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x021204D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02123980
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12272
+
+[[entry_point]]
+addr = 0x02123B2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02123C00
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02123C54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 60
+
+[[entry_point]]
+addr = 0x02123C78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02123E14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 403
+
+[[entry_point]]
+addr = 0x02123F30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 141
+
+[[entry_point]]
+addr = 0x02123F34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 788
+
+[[entry_point]]
+addr = 0x02123F58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 199
+
+[[entry_point]]
+addr = 0x02124040
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02124280
+mode = "arm"
+kind = "runtime_observed"
+# hits = 61
+
+[[entry_point]]
+addr = 0x02124284
+mode = "arm"
+kind = "runtime_observed"
+# hits = 102
+
+[[entry_point]]
+addr = 0x021242B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 35
+
+[[entry_point]]
+addr = 0x02124304
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021243D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021243E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02124AF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02124B18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02124DDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02124FE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02125018
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x0212511C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02125174
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02125294
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125350
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11696
+
+[[entry_point]]
+addr = 0x0212545C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6049
+
+[[entry_point]]
+addr = 0x0212549C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021254DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6049
+
+[[entry_point]]
+addr = 0x021254E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125548
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125554
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6049
+
+[[entry_point]]
+addr = 0x021255AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12098
+
+[[entry_point]]
+addr = 0x0212574C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8216
+
+[[entry_point]]
+addr = 0x02125798
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02125968
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125A3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23504
+
+[[entry_point]]
+addr = 0x02125A5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02125AAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02125B08
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02125B98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 189
+
+[[entry_point]]
+addr = 0x02125BDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02125C54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02125DF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125E50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125F30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02125FF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02126094
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02126160
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02126198
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x021261D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02126318
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021264F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02126604
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02126674
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021267B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28496
+
+[[entry_point]]
+addr = 0x02126874
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0212694C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12272
+
+[[entry_point]]
+addr = 0x02126A10
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12272
+
+[[entry_point]]
+addr = 0x02126C3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12174
+
+[[entry_point]]
+addr = 0x02126D2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12174
+
+[[entry_point]]
+addr = 0x02126E1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12174
+
+[[entry_point]]
+addr = 0x02126EC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12174
+
+[[entry_point]]
+addr = 0x02126F14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02126F28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7665
+
+[[entry_point]]
+addr = 0x02126F48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7665
+
+[[entry_point]]
+addr = 0x02127134
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12087
+
+[[entry_point]]
+addr = 0x021271F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6134
+
+[[entry_point]]
+addr = 0x021272A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6138
+
+[[entry_point]]
+addr = 0x02127350
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23502
+
+[[entry_point]]
+addr = 0x02127370
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021273AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 72419
+
+[[entry_point]]
+addr = 0x0212CD44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0212DD70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02131244
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02131288
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02131998
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021328DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213438C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 96819
+
+[[entry_point]]
+addr = 0x021343BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021343F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02134434
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02134494
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213468C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48408
+
+[[entry_point]]
+addr = 0x0213469C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021346B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x021346E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48409
+
+[[entry_point]]
+addr = 0x02134704
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02134718
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0213478C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 58520
+
+[[entry_point]]
+addr = 0x02134B34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14630
+
+[[entry_point]]
+addr = 0x021361F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48408
+
+[[entry_point]]
+addr = 0x02136254
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021363D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02136C7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021372AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x0213C18C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213DF58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18764
+
+[[entry_point]]
+addr = 0x0213DFB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4624
+
+[[entry_point]]
+addr = 0x0213E014
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13752
+
+[[entry_point]]
+addr = 0x0213E06C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13752
+
+[[entry_point]]
+addr = 0x0213E114
+mode = "arm"
+kind = "runtime_observed"
+# hits = 268
+
+[[entry_point]]
+addr = 0x0213E1EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 65460
+
+[[entry_point]]
+addr = 0x0213E230
+mode = "arm"
+kind = "runtime_observed"
+# hits = 306136
+
+[[entry_point]]
+addr = 0x0213E24C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15664
+
+[[entry_point]]
+addr = 0x0213E370
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15664
+
+[[entry_point]]
+addr = 0x0213E52C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15664
+
+[[entry_point]]
+addr = 0x0213E548
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2167
+
+[[entry_point]]
+addr = 0x0213E58C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6049
+
+[[entry_point]]
+addr = 0x0213E6FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0213E768
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7124
+
+[[entry_point]]
+addr = 0x0213E894
+mode = "arm"
+kind = "runtime_observed"
+# hits = 42701
+
+[[entry_point]]
+addr = 0x0213E8A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x0213E8DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213E90C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 786
+
+[[entry_point]]
+addr = 0x0213E91C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12117
+
+[[entry_point]]
+addr = 0x0213E960
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213E984
+mode = "arm"
+kind = "runtime_observed"
+# hits = 31
+
+[[entry_point]]
+addr = 0x0213E998
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213EA8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213EAB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 93470
+
+[[entry_point]]
+addr = 0x0213EACC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10
+
+[[entry_point]]
+addr = 0x0213ED80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213ED98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213EDB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213EE8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 96819
+
+[[entry_point]]
+addr = 0x0213EEA4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 377127
+
+[[entry_point]]
+addr = 0x0213EEE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213EF6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 169
+
+[[entry_point]]
+addr = 0x0213F44C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213F7A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11285
+
+[[entry_point]]
+addr = 0x02140240
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12116
+
+[[entry_point]]
+addr = 0x0214029C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02140500
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12117
+
+[[entry_point]]
+addr = 0x021406EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02140704
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6049
+
+[[entry_point]]
+addr = 0x021407D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12124
+
+[[entry_point]]
+addr = 0x0214081C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02140834
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0214089C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10
+
+[[entry_point]]
+addr = 0x021408AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02140D0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02140D34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02140D98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 776
+
+[[entry_point]]
+addr = 0x02140E74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02141050
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x0214144C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 268
+
+[[entry_point]]
+addr = 0x021414C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12117
+
+[[entry_point]]
+addr = 0x021414E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x021414FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02141548
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13875
+
+[[entry_point]]
+addr = 0x0214180C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 120664
+
+[[entry_point]]
+addr = 0x021418A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 241286
+
+[[entry_point]]
+addr = 0x02141964
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02141984
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02141A30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 270
+
+[[entry_point]]
+addr = 0x02141A58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 120664
+
+[[entry_point]]
+addr = 0x02141BFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5118
+
+[[entry_point]]
+addr = 0x02142258
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021423AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11385
+
+[[entry_point]]
+addr = 0x0214253C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12117
+
+[[entry_point]]
+addr = 0x0214266C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 38259
+
+[[entry_point]]
+addr = 0x021427A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 38259
+
+[[entry_point]]
+addr = 0x02142AAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02142BC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 34744
+
+[[entry_point]]
+addr = 0x02142BCC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 69488
+
+[[entry_point]]
+addr = 0x02142BE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 137474
diff --git a/scenarios/mp_bots_start.json b/scenarios/mp_bots_start.json
new file mode 100644
index 0000000..204cb1c
--- /dev/null
+++ b/scenarios/mp_bots_start.json
@@ -0,0 +1,177 @@
+{
+  "description": "Hypothesis test: a slot showing a green check is OPEN FOR A HUMAN PEER, not ready. Convert all three non-host slots to bots (star rating) so nothing waits on a peer, then START.",
+  "actions": [
+    {
+      "kind": "touch",
+      "x": 160,
+      "y": 92
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 128,
+      "y": 80
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 50,
+      "y": 80
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 50,
+      "y": 62
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 27,
+      "y": 132
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 600
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 133
+    },
+    {
+      "kind": "wait",
+      "frames": 180
+    },
+    {
+      "kind": "touch",
+      "x": 148,
+      "y": 60
+    },
+    {
+      "kind": "wait",
+      "frames": 180
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 60
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "key",
+      "key": "start"
+    },
+    {
+      "kind": "wait",
+      "frames": 600
+    },
+    {
+      "kind": "wait",
+      "frames": 600
+    },
+    {
+      "kind": "wait",
+      "frames": 600
+    }
+  ]
+}
\ No newline at end of file
diff --git a/scenarios/mp_singlecard_probe.json b/scenarios/mp_singlecard_probe.json
new file mode 100644
index 0000000..99a44bd
--- /dev/null
+++ b/scenarios/mp_singlecard_probe.json
@@ -0,0 +1,59 @@
+{
+  "description": "Probe: SINGLE-CARD PLAY branch, to test whether it is the offline-with-bots path rather than MULTI-CARD.",
+  "actions": [
+    {
+      "kind": "touch",
+      "x": 160,
+      "y": 92
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 50,
+      "y": 80
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    }
+  ]
+}
\ No newline at end of file
diff --git a/scenarios/mp_start_probe.json b/scenarios/mp_start_probe.json
new file mode 100644
index 0000000..4828b26
--- /dev/null
+++ b/scenarios/mp_start_probe.json
@@ -0,0 +1,178 @@
+{
+  "description": "Probe: at the 3-bot lobby, try each candidate start control in turn with a screenshot after each. Known DISPROVED already: START key, A key, touch (105,133) which is a bot-level star control.",
+  "actions": [
+    {
+      "kind": "touch",
+      "x": 160,
+      "y": 92
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 128,
+      "y": 80
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 50,
+      "y": 80
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 50,
+      "y": 62
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 27,
+      "y": 132
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "key",
+      "key": "a"
+    },
+    {
+      "kind": "wait",
+      "frames": 600
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 173
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 133
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 148,
+      "y": 60
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 60
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "touch",
+      "x": 20,
+      "y": 16
+    },
+    {
+      "kind": "wait",
+      "frames": 240
+    },
+    {
+      "kind": "key",
+      "key": "start"
+    },
+    {
+      "kind": "wait",
+      "frames": 400
+    }
+  ]
+}
\ No newline at end of file
diff --git a/tools/seed_overlay_from_coverage.py b/tools/seed_overlay_from_coverage.py
new file mode 100644
index 0000000..13d8eb5
--- /dev/null
+++ b/tools/seed_overlay_from_coverage.py
@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+"""Seed one overlay's recompiler config with provably-that-overlay entry points.
+
+beads-yjp.31. tools/prepare_mph.py deliberately emits overlay configs with NO
+entry points -- its own docstring says real entry points must come from Tier-3
+coverage recorded while that exact overlay body was resident. This produces
+them.
+
+THE ATTRIBUTION PROBLEM. MPH reuses virtual addresses across overlays: all 18
+overlap at least one other by span, and overlay 0 alone shares its range with
+eight. A Tier-3 coverage record is {pc, caller, cpu, thumb, kind, hits} and
+carries no overlay identity, so on its own it cannot say whether a PC executed
+while overlay 0 or overlay 9 was resident. docs/BRINGUP.md calls combining
+entry points across overlay generations unsound, and it is right.
+
+THE SOLUTION, and why no runtime change is needed. The coverage manifest also
+carries the 4 KiB code pages the guest actually executed, captured verbatim at
+execution time. Comparing a captured page against each overlay's decompressed
+ROM image at the corresponding offset identifies which overlay was resident
+when that page ran. Measured on a real capture: of 65 captured ARM9 pages, 33
+fell inside some overlay and every one attributed to exactly ONE overlay --
+28 to overlay 0, 2 to overlay 1, 3 to overlay 4, with zero ambiguity. The
+bytes are distinct enough that overlapping spans do not produce collisions.
+
+Only entry points sitting inside a page that byte-matched THIS overlay are
+emitted. Everything else is excluded and counted, never guessed at.
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import json
+from pathlib import Path
+
+PAGE = 4096
+# Roots are scheduler slice-resume points and usually land mid-function, which
+# makes them poor discovery seeds. Calls and indirect targets are real entries.
+GOOD_KINDS = {"call", "indirect"}
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__,
+                                     formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--overlay-id", type=int, required=True)
+    parser.add_argument("--overlays-dir", type=Path,
+                        default=Path("generated/inputs/overlays"))
+    parser.add_argument("--overlays-json", type=Path,
+                        default=Path("generated/inputs/overlays.json"))
+    parser.add_argument("--manifest", type=Path, nargs="+", required=True)
+    parser.add_argument("--out", type=Path, required=True)
+    parser.add_argument("--include-roots", action="store_true",
+                        help="also seed kind=root PCs (usually fragments code)")
+    args = parser.parse_args()
+
+    meta = {int(o["id"]): o
+            for o in json.loads(args.overlays_json.read_text(encoding="utf-8"))}
+    if args.overlay_id not in meta:
+        raise SystemExit(f"no overlay {args.overlay_id} in {args.overlays_json}")
+    entry = meta[args.overlay_id]
+    base = int(entry["load_address"], 16)
+    image = (args.overlays_dir / entry["file"]).read_bytes()
+    if len(image) != int(entry["size"]):
+        raise SystemExit(f"{entry['file']} is {len(image)} bytes, "
+                         f"overlays.json says {entry['size']}")
+    lo, hi = base, base + len(image)
+    print(f"overlay {args.overlay_id}: 0x{lo:08X}-0x{hi:08X} "
+          f"({len(image)} bytes) sha1 {entry['sha1']}")
+
+    # Which captured pages prove this overlay was resident?
+    resident: set[int] = set()
+    foreign = 0
+    points: list[dict] = []
+    for path in args.manifest:
+        data = json.loads(path.read_text(encoding="utf-8"))
+        if data.get("kind") != "ndsrecomp-tier3-coverage":
+            raise SystemExit(f"{path} is not a coverage manifest")
+        for page in data.get("pages", {}).get("entries", []):
+            if int(page["cpu"]) != 9:
+                continue
+            addr = int(page["addr"], 16)
+            if not (lo <= addr < hi):
+                continue
+            raw = base64.b64decode(page["data"])
+            off = addr - lo
+            if image[off:off + len(raw)] == raw:
+                resident.add(addr)
+            else:
+                foreign += 1
+        points += data.get("entry_points_arm9", [])
+
+    print(f"captured pages inside this overlay that MATCH its image: "
+          f"{len(resident)}")
+    print(f"captured pages inside its span from a DIFFERENT generation: "
+          f"{foreign}  (excluded)")
+    if not resident:
+        raise SystemExit("no page proved this overlay resident; nothing to seed")
+
+    kinds_ok = GOOD_KINDS | ({"root"} if args.include_roots else set())
+    seeds: dict[tuple[int, str], int] = {}
+    dropped_kind = dropped_unproven = 0
+    for point in points:
+        addr = int(point["addr"], 16)
+        if not (lo <= addr < hi):
+            continue
+        if (addr & ~(PAGE - 1)) not in resident:
+            dropped_unproven += 1
+            continue
+        if point.get("kind") not in kinds_ok:
+            dropped_kind += 1
+            continue
+        key = (addr, "thumb" if point.get("mode") == "thumb" else "arm")
+        seeds[key] = seeds.get(key, 0) + int(point.get("hits", 0))
+
+    print(f"entry points in span, dropped as unproven generation: "
+          f"{dropped_unproven}")
+    print(f"entry points dropped by kind filter                 : {dropped_kind}")
+    print(f"SEEDS EMITTED                                       : {len(seeds)}")
+    if not seeds:
+        raise SystemExit("no seeds survived; capture a route that runs this overlay")
+
+    ordered = sorted(seeds.items())
+    lines = [
+        "# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.",
+        "# Entry points are Tier-3 observations whose containing 4 KiB page was",
+        "# byte-identical to this overlay's decompressed ROM image at the time it",
+        "# executed, so every seed below is provably from THIS overlay generation",
+        "# and not from one of the overlays sharing its address range.",
+        "",
+        "[program]",
+        f'name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay {args.overlay_id}"',
+        f'id = "mph_amhe0_arm9_ov{args.overlay_id:03d}"',
+        f"load_address = 0x{lo:08X}",
+        f"size = 0x{len(image):08X}",
+        f"entry_pc = 0x{ordered[0][0][0]:08X}",
+        "authoritative_entry_points = false",
+        "",
+        "[identity]",
+        f'sha1 = "{entry["sha1"]}"',
+        "",
+    ]
+    for (addr, mode), hits in ordered:
+        lines += [
+            "[[entry_point]]",
+            f"addr = 0x{addr:08X}",
+            f'mode = "{mode}"',
+            'kind = "runtime_observed"',
+            f"# hits = {hits}",
+            "",
+        ]
+    args.out.parent.mkdir(parents=True, exist_ok=True)
+    args.out.write_text("\n".join(lines), encoding="utf-8", newline="\n")
+    print(f"wrote {args.out}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

From 4c651ab928ddb4476b80b554aee6240452156640 Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 21:31:30 -0700
Subject: [PATCH 09/23] config: seed overlays 0 and 1; measure where the win
 actually is

Seeded from five captured routes (boot, menus, multiplayer setup,
adventure-with-walking). Only overlays 0 and 1 have any proven-resident
pages; overlay 4 yields 2 seeds, and the other fifteen yield none because
no route I can currently drive ever loads them.

Overlay 0: 30 proven pages -> 222 seeds -> 2357 functions.
Overlay 1:  2 proven pages ->  23 seeds ->  389 functions.
Both identity-verified with zero undefined instructions.

A correction to an earlier reading: the span-based overlay report
over-attributes badly. It credited overlays 9 and 12 with 601 points and
152628 hits, but neither has a single proven-resident page -- those were
overlay 0's bytes, counted again through overlapping spans. Only the
page-proof attribution is trustworthy.

MEASURED, and the headline is smaller than the instruction counts suggest.
Boot-to-menu (run to vblank9 12000, serve mode, same route both sides):
    wall clock        100.2s -> 97.2s   -3.0%
    tier3_insns9   18,106,104 -> 10,621,633   -41%
    tier3_insns7  127,071,515 -> 127,071,515    0%
On the longer menu route, tier3_insns9 falls 112.1M -> 48.5M (-56.7%) but
wall clock does not move, because that route's duration is set by fixed
frame advances and harness round-trips rather than by emulation speed.

ARM7 IS NOW THE BOTTLENECK: 127M interpreted ARM7 instructions against
10.6M ARM9, i.e. 92% of all remaining interpreter work. More ARM9
overlays cannot pay much more than this -- overlay 1 on top of overlay 0
was worth 0.09%.

Two theories checked and DISPROVED, do not re-try: dispatch-cache
thrashing from the FMV bank and the overlay bank aliasing the same
addresses (cache_slow_lookup went DOWN, 1,047,293 -> 802,213), and a
provenance-granularity mismatch in the validation gate (the banks plainly
do validate and dispatch).

beads-yjp.31

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 config/mph_arm9_ov000.toml | 172 +++++++++++++++++++++++++------------
 config/mph_arm9_ov001.toml | 154 +++++++++++++++++++++++++++++++++
 2 files changed, 270 insertions(+), 56 deletions(-)
 create mode 100644 config/mph_arm9_ov001.toml

diff --git a/config/mph_arm9_ov000.toml b/config/mph_arm9_ov000.toml
index a15fd76..458e1b2 100644
--- a/config/mph_arm9_ov000.toml
+++ b/config/mph_arm9_ov000.toml
@@ -19,55 +19,61 @@ sha1 = "5983749ec5c2982e54a10e5f1107ef92b86342b0"
 addr = 0x02103010
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 16
 
 [[entry_point]]
 addr = 0x02103088
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 16
+
+[[entry_point]]
+addr = 0x02103154
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
 
 [[entry_point]]
 addr = 0x02103184
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6715
+# hits = 16277
 
 [[entry_point]]
 addr = 0x02103208
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 3
 
 [[entry_point]]
 addr = 0x021034E8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 5
+# hits = 15
 
 [[entry_point]]
 addr = 0x021034F4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 12
 
 [[entry_point]]
 addr = 0x02103510
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 9
 
 [[entry_point]]
 addr = 0x021035CC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 9
 
 [[entry_point]]
 addr = 0x021035F8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02103740
@@ -79,7 +85,7 @@ kind = "runtime_observed"
 addr = 0x021037AC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02103834
@@ -91,7 +97,7 @@ kind = "runtime_observed"
 addr = 0x02103838
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 9
 
 [[entry_point]]
 addr = 0x0210384C
@@ -103,31 +109,31 @@ kind = "runtime_observed"
 addr = 0x02103868
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02103870
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02103974
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02103DD0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02103FFC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 6
 
 [[entry_point]]
 addr = 0x02106B5C
@@ -157,13 +163,13 @@ kind = "runtime_observed"
 addr = 0x02106DAC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02106E8C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02112E80
@@ -193,13 +199,13 @@ kind = "runtime_observed"
 addr = 0x02114228
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02114AF4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 16
 
 [[entry_point]]
 addr = 0x02115208
@@ -235,48 +241,54 @@ kind = "runtime_observed"
 addr = 0x02115A5C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02115A60
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02115A64
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02115A68
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02115A6C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02115A70
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02115A90
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 3
 
 [[entry_point]]
 addr = 0x02115AA4
 mode = "arm"
 kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02115ABC
+mode = "arm"
+kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
@@ -291,11 +303,47 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
+[[entry_point]]
+addr = 0x02120D14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02120D18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02120EF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02121080
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02121160
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0212119C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
 [[entry_point]]
 addr = 0x02123980
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12272
+# hits = 28294
 
 [[entry_point]]
 addr = 0x02123B2C
@@ -325,7 +373,7 @@ kind = "runtime_observed"
 addr = 0x02123E14
 mode = "arm"
 kind = "runtime_observed"
-# hits = 403
+# hits = 705
 
 [[entry_point]]
 addr = 0x02123F30
@@ -403,7 +451,7 @@ kind = "runtime_observed"
 addr = 0x02124DDC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02124FE8
@@ -421,7 +469,7 @@ kind = "runtime_observed"
 addr = 0x0212511C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02125174
@@ -493,7 +541,7 @@ kind = "runtime_observed"
 addr = 0x02125798
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02125968
@@ -505,7 +553,7 @@ kind = "runtime_observed"
 addr = 0x02125A3C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 23504
+# hits = 23506
 
 [[entry_point]]
 addr = 0x02125A5C
@@ -541,7 +589,7 @@ kind = "runtime_observed"
 addr = 0x02125C54
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 27809
 
 [[entry_point]]
 addr = 0x02125DF8
@@ -625,7 +673,7 @@ kind = "runtime_observed"
 addr = 0x02126874
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x0212694C
@@ -709,7 +757,7 @@ kind = "runtime_observed"
 addr = 0x02127370
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x021273AC
@@ -721,37 +769,43 @@ kind = "runtime_observed"
 addr = 0x0212CD44
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 12
 
 [[entry_point]]
 addr = 0x0212DD70
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x02131244
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 3
 
 [[entry_point]]
 addr = 0x02131288
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 12
 
 [[entry_point]]
 addr = 0x02131998
 mode = "arm"
 kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02131A70
+mode = "arm"
+kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
 addr = 0x021328DC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 4
 
 [[entry_point]]
 addr = 0x0213438C
@@ -783,6 +837,12 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
+[[entry_point]]
+addr = 0x021344E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
 [[entry_point]]
 addr = 0x0213468C
 mode = "arm"
@@ -805,7 +865,7 @@ kind = "runtime_observed"
 addr = 0x021346E0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 48409
+# hits = 48425
 
 [[entry_point]]
 addr = 0x02134704
@@ -823,13 +883,13 @@ kind = "runtime_observed"
 addr = 0x0213478C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 58520
+# hits = 58524
 
 [[entry_point]]
 addr = 0x02134B34
 mode = "arm"
 kind = "runtime_observed"
-# hits = 14630
+# hits = 14646
 
 [[entry_point]]
 addr = 0x021361F4
@@ -841,19 +901,19 @@ kind = "runtime_observed"
 addr = 0x02136254
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x021363D4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x02136C7C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x021372AC
@@ -865,7 +925,7 @@ kind = "runtime_observed"
 addr = 0x0213C18C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x0213DF58
@@ -943,7 +1003,7 @@ kind = "runtime_observed"
 addr = 0x0213E6FC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 12
 
 [[entry_point]]
 addr = 0x0213E768
@@ -979,7 +1039,7 @@ kind = "runtime_observed"
 addr = 0x0213E91C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12117
+# hits = 12134
 
 [[entry_point]]
 addr = 0x0213E960
@@ -997,7 +1057,7 @@ kind = "runtime_observed"
 addr = 0x0213E998
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x0213EA8C
@@ -1015,25 +1075,25 @@ kind = "runtime_observed"
 addr = 0x0213EACC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 10
+# hits = 14
 
 [[entry_point]]
 addr = 0x0213ED80
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x0213ED98
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x0213EDB0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x0213EE8C
@@ -1051,7 +1111,7 @@ kind = "runtime_observed"
 addr = 0x0213EEE0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 8
 
 [[entry_point]]
 addr = 0x0213EF6C
diff --git a/config/mph_arm9_ov001.toml b/config/mph_arm9_ov001.toml
new file mode 100644
index 0000000..ffd087c
--- /dev/null
+++ b/config/mph_arm9_ov001.toml
@@ -0,0 +1,154 @@
+# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.
+# Entry points are Tier-3 observations whose containing 4 KiB page was
+# byte-identical to this overlay's decompressed ROM image at the time it
+# executed, so every seed below is provably from THIS overlay generation
+# and not from one of the overlays sharing its address range.
+
+[program]
+name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay 1"
+id = "mph_amhe0_arm9_ov001"
+load_address = 0x02102220
+size = 0x00003100
+entry_pc = 0x02103010
+authoritative_entry_points = false
+
+[identity]
+sha1 = "2f00682eea725221318d8f5ddff6541f10e5cba4"
+
+[[entry_point]]
+addr = 0x02103010
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x02103088
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x02103154
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02103184
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16277
+
+[[entry_point]]
+addr = 0x02103208
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021034E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x021034F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02103510
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x021035CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x021035F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02103740
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x021037AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02103834
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02103838
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x0210384C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02103868
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02103870
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02103974
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02103DD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02103FFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02104BB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02104BF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02104FDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6

From 638f6b32b09d6a8bf967320f415e93dba9ce8f79 Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 22:40:25 -0700
Subject: [PATCH 10/23] config: compile nine overlays; record the real
 bot-match start procedure

THE START PROCEDURE, from the owner playing it by hand -- this unblocks the
automated in-game loop. Use MULTI-CARD, never SINGLE-CARD: single-card does
not allow bots at all, its slots read AVAILABLE and accept only peer
consoles, which is the most misleading part of the flow. Then CREATE GAME ->
BATTLE -> confirm arena -> pick hunter -> ADD + until the roster is full ->
TAP THE GREEN CHECKBOX BESIDE EACH BOT -> a START BATTLE control appears,
tap it.

Those checkboxes are per-slot CONFIRM controls. I had read them as a
difficulty widget because confirming a bot is what reveals its star rating.
And the match is started by TAPPING an on-screen control, not by the START or
A key -- earlier automated attempts did correctly confirm all three bots and
then pressed the START key, which does nothing.

COVERAGE FROM REAL PLAY DWARFS SYNTHETIC ROUTES, and overturns an earlier
call. My routes captured 71-95 code pages; one adventure session captured
1724 and a multiplayer session 4172. Seedable overlays went from 2 to 9:

    id   seeds     hits      id   seeds     hits
     0     926  7032208       8      29    64756
     2     586  5718909       3      18    64692
     9     447  4421576      10      21    47568
    15      89   220117       4      90    34252
     1      68   138232

Overlay 2 is now near the top and my synthetic routes never loaded it once;
overlay 9 is multiplayer arena code. "Diminishing returns at two overlays"
was an artifact of weak test routes, not reality. So was the claim that ARM7
dominates and further ARM9 work could not pay: that came from a menus-only
headless route. In real play the split runs ARM9 44-55%.

All nine compile identity-verified, 12151 functions total. The finder reports
undefined=14 (ov000) and undefined=2 (ov002), but ZERO runtime_unimplemented_op
call sites are emitted in any generated file -- those counts come from the
scan pass over regions that never became functions, so no compiled function
can halt on one. Checked rather than assumed, since that trap calls nds_halt.

Boot-to-menu measurement is a weak proxy here (it is dominated by overlay 0):
103.0s -> 100.6s, tier3_insns9 18.1M -> 10.2M, only 4% better than the
two-overlay build. Overlays 2, 9 and 15 should pay in gameplay instead, which
needs a real session to measure.

beads-yjp.31

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 config/mph_arm9_ov000.toml             | 4810 ++++++++++++++++++++++--
 config/mph_arm9_ov001.toml             |  306 +-
 config/mph_arm9_ov002.toml             | 3532 +++++++++++++++++
 config/mph_arm9_ov003.toml             |  124 +
 config/mph_arm9_ov004.toml             |  556 +++
 config/mph_arm9_ov008.toml             |  190 +
 config/mph_arm9_ov009.toml             | 2698 +++++++++++++
 config/mph_arm9_ov010.toml             |  142 +
 config/mph_arm9_ov015.toml             |  550 +++
 scenarios/multiplayer_battle_bots.json |   24 +-
 10 files changed, 12616 insertions(+), 316 deletions(-)
 create mode 100644 config/mph_arm9_ov002.toml
 create mode 100644 config/mph_arm9_ov003.toml
 create mode 100644 config/mph_arm9_ov004.toml
 create mode 100644 config/mph_arm9_ov008.toml
 create mode 100644 config/mph_arm9_ov009.toml
 create mode 100644 config/mph_arm9_ov010.toml
 create mode 100644 config/mph_arm9_ov015.toml

diff --git a/config/mph_arm9_ov000.toml b/config/mph_arm9_ov000.toml
index 458e1b2..ed2367c 100644
--- a/config/mph_arm9_ov000.toml
+++ b/config/mph_arm9_ov000.toml
@@ -19,913 +19,4975 @@ sha1 = "5983749ec5c2982e54a10e5f1107ef92b86342b0"
 addr = 0x02103010
 mode = "arm"
 kind = "runtime_observed"
-# hits = 16
+# hits = 28
 
 [[entry_point]]
 addr = 0x02103088
 mode = "arm"
 kind = "runtime_observed"
-# hits = 16
+# hits = 28
+
+[[entry_point]]
+addr = 0x02103144
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
 
 [[entry_point]]
 addr = 0x02103154
 mode = "arm"
 kind = "runtime_observed"
-# hits = 11
+# hits = 68
+
+[[entry_point]]
+addr = 0x02103158
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5885
 
 [[entry_point]]
 addr = 0x02103184
 mode = "arm"
 kind = "runtime_observed"
-# hits = 16277
+# hits = 16999
 
 [[entry_point]]
 addr = 0x02103208
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3
+# hits = 2
+
+[[entry_point]]
+addr = 0x0210324C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33267
+
+[[entry_point]]
+addr = 0x021033DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33267
+
+[[entry_point]]
+addr = 0x0210346C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 104
+
+[[entry_point]]
+addr = 0x02103494
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x021034CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021034D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
 
 [[entry_point]]
 addr = 0x021034E8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 15
+# hits = 21
 
 [[entry_point]]
 addr = 0x021034F4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12
+# hits = 9
 
 [[entry_point]]
 addr = 0x02103510
 mode = "arm"
 kind = "runtime_observed"
-# hits = 9
+# hits = 10
 
 [[entry_point]]
-addr = 0x021035CC
+addr = 0x02103550
 mode = "arm"
 kind = "runtime_observed"
-# hits = 9
+# hits = 1
 
 [[entry_point]]
-addr = 0x021035F8
+addr = 0x021035CC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 6
 
 [[entry_point]]
-addr = 0x02103740
+addr = 0x021035F8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 5
 
 [[entry_point]]
-addr = 0x021037AC
+addr = 0x02103604
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 2
 
 [[entry_point]]
-addr = 0x02103834
+addr = 0x02103640
 mode = "arm"
 kind = "runtime_observed"
-# hits = 48
+# hits = 3
 
 [[entry_point]]
-addr = 0x02103838
+addr = 0x021036E8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 9
+# hits = 4
 
 [[entry_point]]
-addr = 0x0210384C
+addr = 0x0210372C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 48
+# hits = 5
 
 [[entry_point]]
-addr = 0x02103868
+addr = 0x02103740
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 13
 
 [[entry_point]]
-addr = 0x02103870
+addr = 0x021037AC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 14
 
 [[entry_point]]
-addr = 0x02103974
+addr = 0x02103834
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 48
 
 [[entry_point]]
-addr = 0x02103DD0
+addr = 0x02103838
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 6
 
 [[entry_point]]
-addr = 0x02103FFC
+addr = 0x0210384C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 48
 
 [[entry_point]]
-addr = 0x02106B5C
+addr = 0x02103868
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3562
+# hits = 14
 
 [[entry_point]]
-addr = 0x02106C34
+addr = 0x02103870
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3562
+# hits = 5
 
 [[entry_point]]
-addr = 0x02106CE4
+addr = 0x02103890
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3
+# hits = 15
 
 [[entry_point]]
-addr = 0x02106D80
+addr = 0x021038D4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 4
 
 [[entry_point]]
-addr = 0x02106DAC
+addr = 0x02103954
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 7
 
 [[entry_point]]
-addr = 0x02106E8C
+addr = 0x02103974
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 3
 
 [[entry_point]]
-addr = 0x02112E80
+addr = 0x02103994
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 4
 
 [[entry_point]]
-addr = 0x02112F9C
+addr = 0x021039E8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 48
+# hits = 17
 
 [[entry_point]]
-addr = 0x02112FB4
+addr = 0x02103AA0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 48
+# hits = 17
 
 [[entry_point]]
-addr = 0x02112FDC
+addr = 0x02103B58
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 15233
 
 [[entry_point]]
-addr = 0x02114228
+addr = 0x02103C04
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 15258
 
 [[entry_point]]
-addr = 0x02114AF4
+addr = 0x02103D2C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 16
+# hits = 615
 
 [[entry_point]]
-addr = 0x02115208
+addr = 0x02103DD0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 7
 
 [[entry_point]]
-addr = 0x02115260
+addr = 0x02103DF4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 2
 
 [[entry_point]]
-addr = 0x0211527C
+addr = 0x02103FFC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 32
+# hits = 4
 
 [[entry_point]]
-addr = 0x0211528C
+addr = 0x02104094
 mode = "arm"
 kind = "runtime_observed"
-# hits = 24
+# hits = 615
 
 [[entry_point]]
-addr = 0x02115700
+addr = 0x021040DC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 16
+# hits = 1
 
 [[entry_point]]
-addr = 0x02115A5C
+addr = 0x021040E0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 33
 
 [[entry_point]]
-addr = 0x02115A60
+addr = 0x021040F0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 60
 
 [[entry_point]]
-addr = 0x02115A64
+addr = 0x021040F8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 64
 
 [[entry_point]]
-addr = 0x02115A68
+addr = 0x02104100
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 446
 
 [[entry_point]]
-addr = 0x02115A6C
+addr = 0x02104354
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 2
 
 [[entry_point]]
-addr = 0x02115A70
+addr = 0x021043EC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 12
 
 [[entry_point]]
-addr = 0x02115A90
+addr = 0x0210463C
 mode = "arm"
 kind = "runtime_observed"
 # hits = 3
 
 [[entry_point]]
-addr = 0x02115AA4
+addr = 0x02104738
 mode = "arm"
 kind = "runtime_observed"
 # hits = 3
 
 [[entry_point]]
-addr = 0x02115ABC
+addr = 0x02104764
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x021168A8
+addr = 0x021047CC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 3
 
 [[entry_point]]
-addr = 0x021204D4
+addr = 0x021048A4
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x02120D14
+addr = 0x0210491C
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x02120D18
+addr = 0x02104928
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 14749
 
 [[entry_point]]
-addr = 0x02120EF0
+addr = 0x021049CC
 mode = "arm"
 kind = "runtime_observed"
 # hits = 4
 
 [[entry_point]]
-addr = 0x02121080
+addr = 0x021049FC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3
+# hits = 447
 
 [[entry_point]]
-addr = 0x02121160
+addr = 0x02104AB4
 mode = "arm"
 kind = "runtime_observed"
 # hits = 3
 
 [[entry_point]]
-addr = 0x0212119C
+addr = 0x02104B3C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 44
 
 [[entry_point]]
-addr = 0x02123980
+addr = 0x02104BB0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 28294
+# hits = 4
 
 [[entry_point]]
-addr = 0x02123B2C
+addr = 0x02104BF8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 4
 
 [[entry_point]]
-addr = 0x02123C00
+addr = 0x02104CAC
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x02123C54
+addr = 0x02104CFC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 60
+# hits = 648
 
 [[entry_point]]
-addr = 0x02123C78
+addr = 0x02104FDC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 7
+# hits = 15
 
 [[entry_point]]
-addr = 0x02123E14
+addr = 0x02104FE0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 705
+# hits = 2
 
 [[entry_point]]
-addr = 0x02123F30
+addr = 0x021050C8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 141
+# hits = 648
 
 [[entry_point]]
-addr = 0x02123F34
+addr = 0x02105198
 mode = "arm"
 kind = "runtime_observed"
-# hits = 788
+# hits = 15
 
 [[entry_point]]
-addr = 0x02123F58
+addr = 0x02105420
 mode = "arm"
 kind = "runtime_observed"
-# hits = 199
+# hits = 1
 
 [[entry_point]]
-addr = 0x02124040
+addr = 0x02105444
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 35876
 
 [[entry_point]]
-addr = 0x02124280
+addr = 0x02105468
 mode = "arm"
 kind = "runtime_observed"
-# hits = 61
+# hits = 9
 
 [[entry_point]]
-addr = 0x02124284
+addr = 0x02105508
 mode = "arm"
 kind = "runtime_observed"
-# hits = 102
+# hits = 1
 
 [[entry_point]]
-addr = 0x021242B0
+addr = 0x021055E8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 35
+# hits = 35812
 
 [[entry_point]]
-addr = 0x02124304
+addr = 0x021056C4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 451
 
 [[entry_point]]
-addr = 0x021243D0
+addr = 0x021056E0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 451
 
 [[entry_point]]
-addr = 0x021243E8
+addr = 0x02105790
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 447
 
 [[entry_point]]
-addr = 0x02124AF8
+addr = 0x021057D0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 15
+# hits = 14
 
 [[entry_point]]
-addr = 0x02124B18
+addr = 0x02105A64
 mode = "arm"
 kind = "runtime_observed"
-# hits = 15
+# hits = 431
 
 [[entry_point]]
-addr = 0x02124DDC
+addr = 0x02105A9C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 1
 
 [[entry_point]]
-addr = 0x02124FE8
+addr = 0x02105BFC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 15
+# hits = 35772
 
 [[entry_point]]
-addr = 0x02125018
+addr = 0x02105CD4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 15
+# hits = 430
 
 [[entry_point]]
-addr = 0x0212511C
+addr = 0x02105CF0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 4
 
 [[entry_point]]
-addr = 0x02125174
+addr = 0x02105D68
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 431
 
 [[entry_point]]
-addr = 0x02125294
+addr = 0x02105D7C
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x02125350
+addr = 0x02105F2C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 11696
+# hits = 431
 
 [[entry_point]]
-addr = 0x0212545C
+addr = 0x02105FB8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6049
+# hits = 430
 
 [[entry_point]]
-addr = 0x0212549C
+addr = 0x02106028
 mode = "arm"
 kind = "runtime_observed"
 # hits = 2
 
 [[entry_point]]
-addr = 0x021254DC
+addr = 0x02106098
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6049
+# hits = 2
 
 [[entry_point]]
-addr = 0x021254E8
+addr = 0x02106108
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x02125548
+addr = 0x02106204
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 50
 
 [[entry_point]]
-addr = 0x02125554
+addr = 0x02106248
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6049
+# hits = 447
 
 [[entry_point]]
-addr = 0x021255AC
+addr = 0x021062A8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12098
+# hits = 8
 
 [[entry_point]]
-addr = 0x0212574C
+addr = 0x02106444
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8216
+# hits = 447
 
 [[entry_point]]
-addr = 0x02125798
+addr = 0x02106460
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 4
 
 [[entry_point]]
-addr = 0x02125968
+addr = 0x021064BC
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x02125A3C
+addr = 0x021064DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 447
+
+[[entry_point]]
+addr = 0x02106508
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02106538
+mode = "arm"
+kind = "runtime_observed"
+# hits = 34
+
+[[entry_point]]
+addr = 0x0210661C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210664C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x021066A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021066B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02106788
+mode = "arm"
+kind = "runtime_observed"
+# hits = 45275
+
+[[entry_point]]
+addr = 0x02106790
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02106824
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210690C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02106A3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 878
+
+[[entry_point]]
+addr = 0x02106AB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 58
+
+[[entry_point]]
+addr = 0x02106B5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02106BB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02106C34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4584
+
+[[entry_point]]
+addr = 0x02106CE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02106D80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x02106DAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x02106E8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02106F04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 72458
+
+[[entry_point]]
+addr = 0x02106F9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 69566
+
+[[entry_point]]
+addr = 0x02106FE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021071D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23
+
+[[entry_point]]
+addr = 0x021071D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23
+
+[[entry_point]]
+addr = 0x021072E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021074A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021075A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021075D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 81
+
+[[entry_point]]
+addr = 0x021076E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 51230
+
+[[entry_point]]
+addr = 0x02107730
+mode = "arm"
+kind = "runtime_observed"
+# hits = 54674
+
+[[entry_point]]
+addr = 0x02107808
+mode = "arm"
+kind = "runtime_observed"
+# hits = 51586
+
+[[entry_point]]
+addr = 0x02107894
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02107B54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 89
+
+[[entry_point]]
+addr = 0x02107D80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02107F20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 38
+
+[[entry_point]]
+addr = 0x0211204C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 685
+
+[[entry_point]]
+addr = 0x021120B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021120D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021121D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 350
+
+[[entry_point]]
+addr = 0x0211232C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x02112518
+mode = "arm"
+kind = "runtime_observed"
+# hits = 636
+
+[[entry_point]]
+addr = 0x0211251C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 758
+
+[[entry_point]]
+addr = 0x02112520
+mode = "arm"
+kind = "runtime_observed"
+# hits = 70
+
+[[entry_point]]
+addr = 0x02112524
+mode = "arm"
+kind = "runtime_observed"
+# hits = 994
+
+[[entry_point]]
+addr = 0x02112528
+mode = "arm"
+kind = "runtime_observed"
+# hits = 137
+
+[[entry_point]]
+addr = 0x02112694
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2648
+
+[[entry_point]]
+addr = 0x021126B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2597
+
+[[entry_point]]
+addr = 0x021126CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2597
+
+[[entry_point]]
+addr = 0x021126DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2597
+
+[[entry_point]]
+addr = 0x021126E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2597
+
+[[entry_point]]
+addr = 0x021126E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2601
+
+[[entry_point]]
+addr = 0x021126F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x021126FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02112704
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211273C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 50
+
+[[entry_point]]
+addr = 0x02112888
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15224
+
+[[entry_point]]
+addr = 0x02112AD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02112BB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02112E80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02112F18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02112F9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02112FB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02112FDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02113134
+mode = "arm"
+kind = "runtime_observed"
+# hits = 36
+
+[[entry_point]]
+addr = 0x02113174
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211320C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211324C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211326C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02113298
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x021132B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021134B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5780
+
+[[entry_point]]
+addr = 0x02113568
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5302
+
+[[entry_point]]
+addr = 0x02113684
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1637
+
+[[entry_point]]
+addr = 0x02113700
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7692
+
+[[entry_point]]
+addr = 0x02113744
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021137AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 283
+
+[[entry_point]]
+addr = 0x02113848
+mode = "arm"
+kind = "runtime_observed"
+# hits = 816
+
+[[entry_point]]
+addr = 0x021138BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 220
+
+[[entry_point]]
+addr = 0x021138F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 839
+
+[[entry_point]]
+addr = 0x02113984
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9364
+
+[[entry_point]]
+addr = 0x02113B30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 582
+
+[[entry_point]]
+addr = 0x02113BE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02113C20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4500
+
+[[entry_point]]
+addr = 0x02113C24
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02113C80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 54528
+
+[[entry_point]]
+addr = 0x02113CD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 56533
+
+[[entry_point]]
+addr = 0x02113D58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10350
+
+[[entry_point]]
+addr = 0x02113DB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8494
+
+[[entry_point]]
+addr = 0x02113DCC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 849
+
+[[entry_point]]
+addr = 0x02113DF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9860
+
+[[entry_point]]
+addr = 0x02113E08
+mode = "arm"
+kind = "runtime_observed"
+# hits = 68469
+
+[[entry_point]]
+addr = 0x02113E3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 263519
+
+[[entry_point]]
+addr = 0x02113F58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9266
+
+[[entry_point]]
+addr = 0x02113FA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12545
+
+[[entry_point]]
+addr = 0x02114024
+mode = "arm"
+kind = "runtime_observed"
+# hits = 72391
+
+[[entry_point]]
+addr = 0x02114034
+mode = "arm"
+kind = "runtime_observed"
+# hits = 829
+
+[[entry_point]]
+addr = 0x02114044
+mode = "arm"
+kind = "runtime_observed"
+# hits = 266
+
+[[entry_point]]
+addr = 0x02114064
+mode = "arm"
+kind = "runtime_observed"
+# hits = 91531
+
+[[entry_point]]
+addr = 0x02114074
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x021140D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0211411C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02114228
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x021142E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021142F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021142F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021142FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211430C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02114310
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02114318
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02114320
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021144E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x0211452C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02114550
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02114648
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x021146B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 69692
+
+[[entry_point]]
+addr = 0x02114730
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2526
+
+[[entry_point]]
+addr = 0x02114780
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17834
+
+[[entry_point]]
+addr = 0x021147C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 47714
+
+[[entry_point]]
+addr = 0x02114814
+mode = "arm"
+kind = "runtime_observed"
+# hits = 910
+
+[[entry_point]]
+addr = 0x02114AB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12777
+
+[[entry_point]]
+addr = 0x02114AF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 27
+
+[[entry_point]]
+addr = 0x02114B1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02114B2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9178
+
+[[entry_point]]
+addr = 0x02114C34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02114F2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16354
+
+[[entry_point]]
+addr = 0x02115000
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16904
+
+[[entry_point]]
+addr = 0x02115014
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021150E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2705
+
+[[entry_point]]
+addr = 0x0211511C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17
+
+[[entry_point]]
+addr = 0x02115124
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211512C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 96
+
+[[entry_point]]
+addr = 0x02115168
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2705
+
+[[entry_point]]
+addr = 0x0211516C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02115208
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02115260
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211527C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 32
+
+[[entry_point]]
+addr = 0x0211528C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24
+
+[[entry_point]]
+addr = 0x02115308
+mode = "arm"
+kind = "runtime_observed"
+# hits = 94
+
+[[entry_point]]
+addr = 0x021153B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 760
+
+[[entry_point]]
+addr = 0x0211540C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02115490
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021154F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02115554
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2764
+
+[[entry_point]]
+addr = 0x02115700
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x021157CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 95841
+
+[[entry_point]]
+addr = 0x021157D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021158C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021158EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115A5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02115A60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02115A64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02115A68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02115A6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02115A70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02115A90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02115A94
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02115A98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AA4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02115ABC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02115AC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AC8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115ACC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02115B04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02115B08
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02115B0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02115B18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02115DB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16637
+
+[[entry_point]]
+addr = 0x02115F88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115FB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021161FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02116404
+mode = "arm"
+kind = "runtime_observed"
+# hits = 910
+
+[[entry_point]]
+addr = 0x02116458
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021164F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02116514
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02116520
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10
+
+[[entry_point]]
+addr = 0x021165D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021166F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 77
+
+[[entry_point]]
+addr = 0x021167A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 771
+
+[[entry_point]]
+addr = 0x02116814
+mode = "arm"
+kind = "runtime_observed"
+# hits = 165
+
+[[entry_point]]
+addr = 0x0211685C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5488
+
+[[entry_point]]
+addr = 0x021168A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x021168C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 21224
+
+[[entry_point]]
+addr = 0x02116980
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20127
+
+[[entry_point]]
+addr = 0x02116A14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12918
+
+[[entry_point]]
+addr = 0x02116A44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2489
+
+[[entry_point]]
+addr = 0x02116AB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 25823
+
+[[entry_point]]
+addr = 0x02116ACC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 26423
+
+[[entry_point]]
+addr = 0x02116AE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x02116BFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5171
+
+[[entry_point]]
+addr = 0x02116C18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5459
+
+[[entry_point]]
+addr = 0x02116C34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 853
+
+[[entry_point]]
+addr = 0x02116C84
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1703
+
+[[entry_point]]
+addr = 0x02116CA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1895
+
+[[entry_point]]
+addr = 0x02116CBC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20164
+
+[[entry_point]]
+addr = 0x02116D38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02116DD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 80220
+
+[[entry_point]]
+addr = 0x02116E10
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02116E50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 111636
+
+[[entry_point]]
+addr = 0x0211B004
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0211B1F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211B270
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211B28C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211B8E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0211B8F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 245
+
+[[entry_point]]
+addr = 0x0211B904
+mode = "arm"
+kind = "runtime_observed"
+# hits = 284
+
+[[entry_point]]
+addr = 0x0211BAC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 208
+
+[[entry_point]]
+addr = 0x0211BCC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211BCFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211BD84
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211BDB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211BF60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2614
+
+[[entry_point]]
+addr = 0x0211BFE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1432
+
+[[entry_point]]
+addr = 0x0211C070
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211C08C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 403
+
+[[entry_point]]
+addr = 0x0211C120
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C12C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x0211C13C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C148
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0211C154
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C188
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13
+
+[[entry_point]]
+addr = 0x0211C18C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211C1A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211C1B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211C1BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211C1C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211C22C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C27C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211C318
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10
+
+[[entry_point]]
+addr = 0x0211C388
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C4DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211C518
+mode = "arm"
+kind = "runtime_observed"
+# hits = 77585
+
+[[entry_point]]
+addr = 0x0211C59C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x0211C5B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1432
+
+[[entry_point]]
+addr = 0x0211C6B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x0211C764
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211C7C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211C830
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0211C8A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0211C8E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1432
+
+[[entry_point]]
+addr = 0x0211CA18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0211CA34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 110
+
+[[entry_point]]
+addr = 0x0211CA50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 30
+
+[[entry_point]]
+addr = 0x0211CA60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5728
+
+[[entry_point]]
+addr = 0x0211CAB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5728
+
+[[entry_point]]
+addr = 0x0211CB80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5728
+
+[[entry_point]]
+addr = 0x0211CC04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211CC6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211CE64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 19820
+
+[[entry_point]]
+addr = 0x0211D244
+mode = "arm"
+kind = "runtime_observed"
+# hits = 151254
+
+[[entry_point]]
+addr = 0x0211D4B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16178
+
+[[entry_point]]
+addr = 0x0211D59C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211D5C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211D690
+mode = "arm"
+kind = "runtime_observed"
+# hits = 109174
+
+[[entry_point]]
+addr = 0x0211D704
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6837
+
+[[entry_point]]
+addr = 0x0211D774
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5728
+
+[[entry_point]]
+addr = 0x0211DCD8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23116
+
+[[entry_point]]
+addr = 0x0211DD2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211E41C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2705
+
+[[entry_point]]
+addr = 0x0211E428
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211E438
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x0211E444
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2753
+
+[[entry_point]]
+addr = 0x0211E4A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2764
+
+[[entry_point]]
+addr = 0x0211E4C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211E548
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11354
+
+[[entry_point]]
+addr = 0x0211E560
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211E568
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0211E56C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 39
+
+[[entry_point]]
+addr = 0x0211E588
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0211E598
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10051
+
+[[entry_point]]
+addr = 0x0211E5BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211E64C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211E764
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10051
+
+[[entry_point]]
+addr = 0x0211E79C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211E7A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 30153
+
+[[entry_point]]
+addr = 0x0211E854
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10051
+
+[[entry_point]]
+addr = 0x0211E8A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211E8F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211E994
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2295
+
+[[entry_point]]
+addr = 0x0211E9A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211E9B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211E9C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211EA50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211EC48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211EE90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0211EF0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211EFE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F128
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F1F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F2A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F2A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211F3B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F7B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02120138
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021204D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02120C00
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02120D14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02120D18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02120DD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02120E14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02120EF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02121080
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02121160
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0212119C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02121778
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021217C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212182C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021219A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021219D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021219F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02121C40
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02121DAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02121E0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02121EC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212213C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02122160
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02122170
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02122180
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021221D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02122454
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0212258C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x021228F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02123058
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x021230C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x021231C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x02123754
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x02123824
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02123980
+mode = "arm"
+kind = "runtime_observed"
+# hits = 52288
+
+[[entry_point]]
+addr = 0x02123B2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02123BBC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02123C00
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02123C54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 164
+
+[[entry_point]]
+addr = 0x02123C78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02123E14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 791
+
+[[entry_point]]
+addr = 0x02123F30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 141
+
+[[entry_point]]
+addr = 0x02123F34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 788
+
+[[entry_point]]
+addr = 0x02123F58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 199
+
+[[entry_point]]
+addr = 0x02124004
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02124040
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02124280
+mode = "arm"
+kind = "runtime_observed"
+# hits = 61
+
+[[entry_point]]
+addr = 0x02124284
+mode = "arm"
+kind = "runtime_observed"
+# hits = 102
+
+[[entry_point]]
+addr = 0x021242B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 35
+
+[[entry_point]]
+addr = 0x02124304
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021243D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021243E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02124AF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02124B18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02124DDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02124FE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02125018
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x0212511C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02125174
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02125294
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125350
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11696
+
+[[entry_point]]
+addr = 0x0212545C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6049
+
+[[entry_point]]
+addr = 0x0212549C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021254DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6049
+
+[[entry_point]]
+addr = 0x021254E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125548
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125554
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6049
+
+[[entry_point]]
+addr = 0x021255AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12098
+
+[[entry_point]]
+addr = 0x0212574C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8216
+
+[[entry_point]]
+addr = 0x02125798
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02125968
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02125A3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23512
+
+[[entry_point]]
+addr = 0x02125A5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02125AAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02125B08
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02125B98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 189
+
+[[entry_point]]
+addr = 0x02125BDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02125C54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 46200
+
+[[entry_point]]
+addr = 0x02125DF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125E50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02125F30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02125FF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02126094
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02126160
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02126198
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x021261D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02126318
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021264F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02126604
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02126674
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021267B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28496
+
+[[entry_point]]
+addr = 0x02126874
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0212694C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12272
+
+[[entry_point]]
+addr = 0x02126A10
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12272
+
+[[entry_point]]
+addr = 0x02126C3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12174
+
+[[entry_point]]
+addr = 0x02126D2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12174
+
+[[entry_point]]
+addr = 0x02126E1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12174
+
+[[entry_point]]
+addr = 0x02126EC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12174
+
+[[entry_point]]
+addr = 0x02126F14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02126F28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7665
+
+[[entry_point]]
+addr = 0x02126F48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7665
+
+[[entry_point]]
+addr = 0x02127134
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12087
+
+[[entry_point]]
+addr = 0x021271F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6134
+
+[[entry_point]]
+addr = 0x021272A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6138
+
+[[entry_point]]
+addr = 0x02127350
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23502
+
+[[entry_point]]
+addr = 0x02127370
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x021273AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 72419
+
+[[entry_point]]
+addr = 0x0212753C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0212AC40
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x0212AC78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212ACB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212ACBC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0212AEE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x0212AF20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212AF58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x0212AF5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212AF60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0212B1B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212B3CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212B4F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0212B544
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0212CD44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0212DC54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212DCE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212DD70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0212DF5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E060
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0212E210
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E2BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E3B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E740
+mode = "arm"
+kind = "runtime_observed"
+# hits = 32339
+
+[[entry_point]]
+addr = 0x0212E744
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0212E970
+mode = "arm"
+kind = "runtime_observed"
+# hits = 32307
+
+[[entry_point]]
+addr = 0x0212EA18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212EBAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212EBB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212ECAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0212ED0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212ED48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212EE40
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0212F760
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212FCAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212FCE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02131244
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02131258
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02131278
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02131288
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0213198C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02131998
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02131A70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02131AD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02131B74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02131BD8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02131DE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20
+
+[[entry_point]]
+addr = 0x021327C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02132820
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02132878
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021328D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021328DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02133060
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02133108
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021331CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0213326C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x02133310
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x02133374
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x021336D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x021337D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x021337EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02133820
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02133854
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02133888
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x021338B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021338F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021338FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02133900
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02133904
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02133984
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x021339D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17106
+
+[[entry_point]]
+addr = 0x021339F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02133A60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x02133D2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1404
+
+[[entry_point]]
+addr = 0x02133D48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 645
+
+[[entry_point]]
+addr = 0x02133D58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 220
+
+[[entry_point]]
+addr = 0x0213413C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02134158
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021341C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02134324
+mode = "arm"
+kind = "runtime_observed"
+# hits = 93
+
+[[entry_point]]
+addr = 0x0213438C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 96819
+
+[[entry_point]]
+addr = 0x021343BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021343F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02134434
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02134494
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021344E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 74
+
+[[entry_point]]
+addr = 0x021345B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x0213468C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 64767
+
+[[entry_point]]
+addr = 0x0213469C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021346B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x021346C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x021346E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 127921
+
+[[entry_point]]
+addr = 0x02134704
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02134718
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0213478C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 130504
+
+[[entry_point]]
+addr = 0x021348C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17127
+
+[[entry_point]]
+addr = 0x021348D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02134934
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02134990
+mode = "arm"
+kind = "runtime_observed"
+# hits = 899
+
+[[entry_point]]
+addr = 0x02134A90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1428
+
+[[entry_point]]
+addr = 0x02134AB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02134B00
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17127
+
+[[entry_point]]
+addr = 0x02134B34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24778
+
+[[entry_point]]
+addr = 0x02134B44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 54421
+
+[[entry_point]]
+addr = 0x02134B78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6524
+
+[[entry_point]]
+addr = 0x02134B7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 627
+
+[[entry_point]]
+addr = 0x02134B80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6711
+
+[[entry_point]]
+addr = 0x02134B8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 189
+
+[[entry_point]]
+addr = 0x02134BC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 272
+
+[[entry_point]]
+addr = 0x02134BD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02134BF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17127
+
+[[entry_point]]
+addr = 0x02134C50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10720
+
+[[entry_point]]
+addr = 0x02134C54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4527
+
+[[entry_point]]
+addr = 0x02134C5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 135
+
+[[entry_point]]
+addr = 0x02134C64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1020
+
+[[entry_point]]
+addr = 0x02134C80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1649
+
+[[entry_point]]
+addr = 0x02134C84
+mode = "arm"
+kind = "runtime_observed"
+# hits = 829
+
+[[entry_point]]
+addr = 0x02134C9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02134E68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02135020
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x02135108
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x02135154
+mode = "arm"
+kind = "runtime_observed"
+# hits = 30
+
+[[entry_point]]
+addr = 0x021351B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 30
+
+[[entry_point]]
+addr = 0x021351CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 60
+
+[[entry_point]]
+addr = 0x02135408
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213548C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021354E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02135524
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02135588
+mode = "arm"
+kind = "runtime_observed"
+# hits = 27
+
+[[entry_point]]
+addr = 0x0213560C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02135898
+mode = "arm"
+kind = "runtime_observed"
+# hits = 19
+
+[[entry_point]]
+addr = 0x02135950
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x02135BCC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02135C20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02135C88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02135DAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02135F20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02136014
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02136034
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02136074
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0213613C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 756
+
+[[entry_point]]
+addr = 0x021361C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 92
+
+[[entry_point]]
+addr = 0x021361F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 51352
+
+[[entry_point]]
+addr = 0x02136254
+mode = "arm"
+kind = "runtime_observed"
+# hits = 70
+
+[[entry_point]]
+addr = 0x021362D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02136304
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02136358
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021363D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02136428
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213645C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021364A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021364D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213653C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213655C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213658C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213660C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4302
+
+[[entry_point]]
+addr = 0x02136668
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8160
+
+[[entry_point]]
+addr = 0x02136748
+mode = "arm"
+kind = "runtime_observed"
+# hits = 790
+
+[[entry_point]]
+addr = 0x021367AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1044
+
+[[entry_point]]
+addr = 0x0213688C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213693C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10720
+
+[[entry_point]]
+addr = 0x0213696C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02136A34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2753
+
+[[entry_point]]
+addr = 0x02136A80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x02136AC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2753
+
+[[entry_point]]
+addr = 0x02136B10
+mode = "arm"
+kind = "runtime_observed"
+# hits = 84350
+
+[[entry_point]]
+addr = 0x02136B20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23792
+
+[[entry_point]]
+addr = 0x02136B24
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7730
+
+[[entry_point]]
+addr = 0x02136B44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9064
+
+[[entry_point]]
+addr = 0x02136B50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1404
+
+[[entry_point]]
+addr = 0x02136B54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 26214
+
+[[entry_point]]
+addr = 0x02136B58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 359
+
+[[entry_point]]
+addr = 0x02136B5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9627
+
+[[entry_point]]
+addr = 0x02136B70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8913
+
+[[entry_point]]
+addr = 0x02136C1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02136C3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 135954
+
+[[entry_point]]
+addr = 0x02136C7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02136CA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18898
+
+[[entry_point]]
+addr = 0x02136EE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17127
+
+[[entry_point]]
+addr = 0x02136F74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02136FE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02137084
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021371B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02137254
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02137284
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021372AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x0213786C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23598
+
+[[entry_point]]
+addr = 0x021378DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213790C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17106
+
+[[entry_point]]
+addr = 0x02137BE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02137DE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x02137F6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x021380BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x02138168
+mode = "arm"
+kind = "runtime_observed"
+# hits = 604
+
+[[entry_point]]
+addr = 0x021383E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x021387FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213881C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213883C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213885C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02138868
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02138874
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02138880
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021389BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021389F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5338
+
+[[entry_point]]
+addr = 0x02138AE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 272
+
+[[entry_point]]
+addr = 0x02138C8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5081
+
+[[entry_point]]
+addr = 0x02138E50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02138E58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02138E60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02138F28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02138F38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 31749
+
+[[entry_point]]
+addr = 0x02139054
+mode = "arm"
+kind = "runtime_observed"
+# hits = 31749
+
+[[entry_point]]
+addr = 0x0213911C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02139274
+mode = "arm"
+kind = "runtime_observed"
+# hits = 620
+
+[[entry_point]]
+addr = 0x021394E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 272
+
+[[entry_point]]
+addr = 0x021395E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 862
+
+[[entry_point]]
+addr = 0x0213966C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9366
+
+[[entry_point]]
+addr = 0x021398B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9366
+
+[[entry_point]]
+addr = 0x021398DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 53277
+
+[[entry_point]]
+addr = 0x0213998C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021399C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02139A30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02139A34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02139A38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02139A58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02139A74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1524
+
+[[entry_point]]
+addr = 0x02139A78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02139AA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13204
+
+[[entry_point]]
+addr = 0x02139AD8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17105
+
+[[entry_point]]
+addr = 0x02139D40
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17105
+
+[[entry_point]]
+addr = 0x02139D5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3684
+
+[[entry_point]]
+addr = 0x02139D8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4768
+
+[[entry_point]]
+addr = 0x0213A1E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3200
+
+[[entry_point]]
+addr = 0x0213A204
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4542
+
+[[entry_point]]
+addr = 0x0213A2E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 57
+
+[[entry_point]]
+addr = 0x0213A318
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3012
+
+[[entry_point]]
+addr = 0x0213A348
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x0213A378
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x0213A390
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3206
+
+[[entry_point]]
+addr = 0x0213A3A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 26
+
+[[entry_point]]
+addr = 0x0213A480
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0213A4B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3240
+
+[[entry_point]]
+addr = 0x0213A4C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9682
+
+[[entry_point]]
+addr = 0x0213A4F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 56
+
+[[entry_point]]
+addr = 0x0213A510
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3240
+
+[[entry_point]]
+addr = 0x0213A528
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10047
+
+[[entry_point]]
+addr = 0x0213A540
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0213A558
+mode = "arm"
+kind = "runtime_observed"
+# hits = 46
+
+[[entry_point]]
+addr = 0x0213A570
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0213A588
+mode = "arm"
+kind = "runtime_observed"
+# hits = 46
+
+[[entry_point]]
+addr = 0x0213A5B8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 23506
+# hits = 15
 
 [[entry_point]]
-addr = 0x02125A5C
+addr = 0x0213A5E8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 52
 
 [[entry_point]]
-addr = 0x02125AAC
+addr = 0x0213A618
 mode = "arm"
 kind = "runtime_observed"
-# hits = 5
+# hits = 4376
 
 [[entry_point]]
-addr = 0x02125B08
+addr = 0x0213AE98
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3
+# hits = 2
 
 [[entry_point]]
-addr = 0x02125B98
+addr = 0x0213AFB4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 189
+# hits = 1
 
 [[entry_point]]
-addr = 0x02125BDC
+addr = 0x0213AFB8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3562
+# hits = 1
 
 [[entry_point]]
-addr = 0x02125C54
+addr = 0x0213AFBC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 27809
+# hits = 1
 
 [[entry_point]]
-addr = 0x02125DF8
+addr = 0x0213AFD0
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x02125E50
+addr = 0x0213AFD4
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x02125F30
+addr = 0x0213B064
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 1
 
 [[entry_point]]
-addr = 0x02125FF0
+addr = 0x0213B104
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3562
+# hits = 730
 
 [[entry_point]]
-addr = 0x02126094
+addr = 0x0213B128
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3562
+# hits = 4896
 
 [[entry_point]]
-addr = 0x02126160
+addr = 0x0213B318
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3562
+# hits = 447
 
 [[entry_point]]
-addr = 0x02126198
+addr = 0x0213B340
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3562
+# hits = 134
 
 [[entry_point]]
-addr = 0x021261D8
+addr = 0x0213B344
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 271
 
 [[entry_point]]
-addr = 0x02126318
+addr = 0x0213B354
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 42
 
 [[entry_point]]
-addr = 0x021264F4
+addr = 0x0213B43C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 10936
 
 [[entry_point]]
-addr = 0x02126604
+addr = 0x0213B510
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 5162
 
 [[entry_point]]
-addr = 0x02126674
+addr = 0x0213B538
 mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
 [[entry_point]]
-addr = 0x021267B4
+addr = 0x0213B53C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 28496
+# hits = 2038
 
 [[entry_point]]
-addr = 0x02126874
+addr = 0x0213B54C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 3123
 
 [[entry_point]]
-addr = 0x0212694C
+addr = 0x0213B750
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12272
+# hits = 5176
 
 [[entry_point]]
-addr = 0x02126A10
+addr = 0x0213B774
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12272
+# hits = 5793
 
 [[entry_point]]
-addr = 0x02126C3C
+addr = 0x0213B78C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12174
+# hits = 3
 
 [[entry_point]]
-addr = 0x02126D2C
+addr = 0x0213B790
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12174
+# hits = 2361
 
 [[entry_point]]
-addr = 0x02126E1C
+addr = 0x0213B7A0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12174
+# hits = 3429
 
 [[entry_point]]
-addr = 0x02126EC4
+addr = 0x0213B96C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12174
+# hits = 11251
 
 [[entry_point]]
-addr = 0x02126F14
+addr = 0x0213BCCC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 3418
 
 [[entry_point]]
-addr = 0x02126F28
+addr = 0x0213BE04
 mode = "arm"
 kind = "runtime_observed"
-# hits = 7665
+# hits = 1398
 
 [[entry_point]]
-addr = 0x02126F48
+addr = 0x0213BE6C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 7665
+# hits = 3425
 
 [[entry_point]]
-addr = 0x02127134
+addr = 0x0213BEB0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12087
+# hits = 11383
 
 [[entry_point]]
-addr = 0x021271F0
+addr = 0x0213BEC4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6134
+# hits = 1327
 
 [[entry_point]]
-addr = 0x021272A0
+addr = 0x0213BEE8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6138
+# hits = 4527
 
 [[entry_point]]
-addr = 0x02127350
+addr = 0x0213BFF0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 23502
+# hits = 18
 
 [[entry_point]]
-addr = 0x02127370
+addr = 0x0213C024
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 10711
 
 [[entry_point]]
-addr = 0x021273AC
+addr = 0x0213C178
 mode = "arm"
 kind = "runtime_observed"
-# hits = 72419
+# hits = 8
 
 [[entry_point]]
-addr = 0x0212CD44
+addr = 0x0213C18C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12
+# hits = 14
 
 [[entry_point]]
-addr = 0x0212DD70
+addr = 0x0213C198
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 3200
 
 [[entry_point]]
-addr = 0x02131244
+addr = 0x0213C328
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3
+# hits = 5828
 
 [[entry_point]]
-addr = 0x02131288
+addr = 0x0213C34C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12
+# hits = 5942
 
 [[entry_point]]
-addr = 0x02131998
+addr = 0x0213C3D4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 2
+# hits = 3404
 
 [[entry_point]]
-addr = 0x02131A70
+addr = 0x0213C3E4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 397
 
 [[entry_point]]
-addr = 0x021328DC
+addr = 0x0213C400
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 4057
 
 [[entry_point]]
-addr = 0x0213438C
+addr = 0x0213C41C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 96819
+# hits = 4057
 
 [[entry_point]]
-addr = 0x021343BC
+addr = 0x0213C468
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 22513
 
 [[entry_point]]
-addr = 0x021343F4
+addr = 0x0213C484
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3
+# hits = 22704
 
 [[entry_point]]
-addr = 0x02134434
+addr = 0x0213C504
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 2826
 
 [[entry_point]]
-addr = 0x02134494
+addr = 0x0213C954
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 11569
 
 [[entry_point]]
-addr = 0x021344E0
+addr = 0x0213C960
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 1
 
 [[entry_point]]
-addr = 0x0213468C
+addr = 0x0213C970
 mode = "arm"
 kind = "runtime_observed"
-# hits = 48408
+# hits = 18213
 
 [[entry_point]]
-addr = 0x0213469C
+addr = 0x0213C980
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 8798
 
 [[entry_point]]
-addr = 0x021346B0
+addr = 0x0213C9A4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 18960
 
 [[entry_point]]
-addr = 0x021346E0
+addr = 0x0213CA48
 mode = "arm"
 kind = "runtime_observed"
-# hits = 48425
+# hits = 2556
 
 [[entry_point]]
-addr = 0x02134704
+addr = 0x0213CA64
 mode = "arm"
 kind = "runtime_observed"
-# hits = 1
+# hits = 6400
 
 [[entry_point]]
-addr = 0x02134718
+addr = 0x0213CAAC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 5
+# hits = 2
 
 [[entry_point]]
-addr = 0x0213478C
+addr = 0x0213CC10
 mode = "arm"
 kind = "runtime_observed"
-# hits = 58524
+# hits = 916
 
 [[entry_point]]
-addr = 0x02134B34
+addr = 0x0213CC7C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 14646
+# hits = 4973
 
 [[entry_point]]
-addr = 0x021361F4
+addr = 0x0213CCBC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 48408
+# hits = 5
 
 [[entry_point]]
-addr = 0x02136254
+addr = 0x0213CCC4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 70382
 
 [[entry_point]]
-addr = 0x021363D4
+addr = 0x0213CCE4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 3
 
 [[entry_point]]
-addr = 0x02136C7C
+addr = 0x0213D6B4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 43
 
 [[entry_point]]
-addr = 0x021372AC
+addr = 0x0213DE84
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12102
+# hits = 53485
 
 [[entry_point]]
-addr = 0x0213C18C
+addr = 0x0213DE88
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 16854
 
 [[entry_point]]
 addr = 0x0213DF58
@@ -969,6 +5031,12 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 306136
 
+[[entry_point]]
+addr = 0x0213E234
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
 [[entry_point]]
 addr = 0x0213E24C
 mode = "arm"
@@ -997,13 +5065,19 @@ kind = "runtime_observed"
 addr = 0x0213E58C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6049
+# hits = 18722
+
+[[entry_point]]
+addr = 0x0213E5A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
 
 [[entry_point]]
 addr = 0x0213E6FC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12
+# hits = 24
 
 [[entry_point]]
 addr = 0x0213E768
@@ -1011,6 +5085,12 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 7124
 
+[[entry_point]]
+addr = 0x0213E7D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 180
+
 [[entry_point]]
 addr = 0x0213E894
 mode = "arm"
@@ -1039,7 +5119,7 @@ kind = "runtime_observed"
 addr = 0x0213E91C
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12134
+# hits = 12215
 
 [[entry_point]]
 addr = 0x0213E960
@@ -1057,7 +5137,7 @@ kind = "runtime_observed"
 addr = 0x0213E998
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 14
 
 [[entry_point]]
 addr = 0x0213EA8C
@@ -1069,31 +5149,31 @@ kind = "runtime_observed"
 addr = 0x0213EAB0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 93470
+# hits = 93535
 
 [[entry_point]]
 addr = 0x0213EACC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 14
+# hits = 69
 
 [[entry_point]]
 addr = 0x0213ED80
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 14
 
 [[entry_point]]
 addr = 0x0213ED98
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 14
 
 [[entry_point]]
 addr = 0x0213EDB0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 14
 
 [[entry_point]]
 addr = 0x0213EE8C
@@ -1105,13 +5185,13 @@ kind = "runtime_observed"
 addr = 0x0213EEA4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 377127
+# hits = 377150
 
 [[entry_point]]
 addr = 0x0213EEE0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 14
 
 [[entry_point]]
 addr = 0x0213EF6C
@@ -1125,12 +5205,48 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 4
 
+[[entry_point]]
+addr = 0x0213F4D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12076
+
+[[entry_point]]
+addr = 0x0213F4F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
 [[entry_point]]
 addr = 0x0213F7A4
 mode = "arm"
 kind = "runtime_observed"
 # hits = 11285
 
+[[entry_point]]
+addr = 0x0213F9C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12389
+
+[[entry_point]]
+addr = 0x0213FE98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213FF58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8841
+
+[[entry_point]]
+addr = 0x02140168
+mode = "arm"
+kind = "runtime_observed"
+# hits = 163
+
 [[entry_point]]
 addr = 0x02140240
 mode = "arm"
@@ -1197,6 +5313,12 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 2
 
+[[entry_point]]
+addr = 0x02140D18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5862
+
 [[entry_point]]
 addr = 0x02140D34
 mode = "arm"
@@ -1221,6 +5343,12 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 7
 
+[[entry_point]]
+addr = 0x02141114
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5597
+
 [[entry_point]]
 addr = 0x0214144C
 mode = "arm"
@@ -1249,7 +5377,7 @@ kind = "runtime_observed"
 addr = 0x02141548
 mode = "arm"
 kind = "runtime_observed"
-# hits = 13875
+# hits = 14055
 
 [[entry_point]]
 addr = 0x0214180C
@@ -1293,6 +5421,24 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 5118
 
+[[entry_point]]
+addr = 0x02141EC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1320
+
+[[entry_point]]
+addr = 0x02141EFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 217
+
+[[entry_point]]
+addr = 0x02141F28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8295
+
 [[entry_point]]
 addr = 0x02142258
 mode = "arm"
@@ -1311,6 +5457,12 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 12117
 
+[[entry_point]]
+addr = 0x021425F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 43
+
 [[entry_point]]
 addr = 0x0214266C
 mode = "arm"
@@ -1329,6 +5481,18 @@ mode = "arm"
 kind = "runtime_observed"
 # hits = 1
 
+[[entry_point]]
+addr = 0x02142B18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9323
+
+[[entry_point]]
+addr = 0x02142B68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
 [[entry_point]]
 addr = 0x02142BC4
 mode = "arm"
@@ -1346,3 +5510,63 @@ addr = 0x02142BE8
 mode = "arm"
 kind = "runtime_observed"
 # hits = 137474
+
+[[entry_point]]
+addr = 0x02142C4C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3390
+
+[[entry_point]]
+addr = 0x02142C68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 954
+
+[[entry_point]]
+addr = 0x02142C6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1436
+
+[[entry_point]]
+addr = 0x02142C70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 184
+
+[[entry_point]]
+addr = 0x02142C80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 816
+
+[[entry_point]]
+addr = 0x02142E80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5040
+
+[[entry_point]]
+addr = 0x02142ED4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1159
+
+[[entry_point]]
+addr = 0x02142ED8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1669
+
+[[entry_point]]
+addr = 0x02142EDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1080
+
+[[entry_point]]
+addr = 0x02142EEC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1132
diff --git a/config/mph_arm9_ov001.toml b/config/mph_arm9_ov001.toml
index ffd087c..e0ee93f 100644
--- a/config/mph_arm9_ov001.toml
+++ b/config/mph_arm9_ov001.toml
@@ -19,73 +19,151 @@ sha1 = "2f00682eea725221318d8f5ddff6541f10e5cba4"
 addr = 0x02103010
 mode = "arm"
 kind = "runtime_observed"
-# hits = 16
+# hits = 28
 
 [[entry_point]]
 addr = 0x02103088
 mode = "arm"
 kind = "runtime_observed"
-# hits = 16
+# hits = 28
+
+[[entry_point]]
+addr = 0x02103144
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
 
 [[entry_point]]
 addr = 0x02103154
 mode = "arm"
 kind = "runtime_observed"
-# hits = 11
+# hits = 68
+
+[[entry_point]]
+addr = 0x02103158
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5885
 
 [[entry_point]]
 addr = 0x02103184
 mode = "arm"
 kind = "runtime_observed"
-# hits = 16277
+# hits = 16999
 
 [[entry_point]]
 addr = 0x02103208
 mode = "arm"
 kind = "runtime_observed"
-# hits = 3
+# hits = 2
+
+[[entry_point]]
+addr = 0x0210324C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33267
+
+[[entry_point]]
+addr = 0x021033DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33267
+
+[[entry_point]]
+addr = 0x0210346C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 104
+
+[[entry_point]]
+addr = 0x02103494
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x021034CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021034D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
 
 [[entry_point]]
 addr = 0x021034E8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 15
+# hits = 21
 
 [[entry_point]]
 addr = 0x021034F4
 mode = "arm"
 kind = "runtime_observed"
-# hits = 12
+# hits = 9
 
 [[entry_point]]
 addr = 0x02103510
 mode = "arm"
 kind = "runtime_observed"
-# hits = 9
+# hits = 10
+
+[[entry_point]]
+addr = 0x02103550
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
 
 [[entry_point]]
 addr = 0x021035CC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 9
+# hits = 6
 
 [[entry_point]]
 addr = 0x021035F8
 mode = "arm"
 kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02103604
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02103640
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021036E8
+mode = "arm"
+kind = "runtime_observed"
 # hits = 4
 
+[[entry_point]]
+addr = 0x0210372C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
 [[entry_point]]
 addr = 0x02103740
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 13
 
 [[entry_point]]
 addr = 0x021037AC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 14
 
 [[entry_point]]
 addr = 0x02103834
@@ -97,7 +175,7 @@ kind = "runtime_observed"
 addr = 0x02103838
 mode = "arm"
 kind = "runtime_observed"
-# hits = 9
+# hits = 6
 
 [[entry_point]]
 addr = 0x0210384C
@@ -109,46 +187,238 @@ kind = "runtime_observed"
 addr = 0x02103868
 mode = "arm"
 kind = "runtime_observed"
-# hits = 8
+# hits = 14
 
 [[entry_point]]
 addr = 0x02103870
 mode = "arm"
 kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02103890
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x021038D4
+mode = "arm"
+kind = "runtime_observed"
 # hits = 4
 
+[[entry_point]]
+addr = 0x02103954
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
 [[entry_point]]
 addr = 0x02103974
 mode = "arm"
 kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02103994
+mode = "arm"
+kind = "runtime_observed"
 # hits = 4
 
+[[entry_point]]
+addr = 0x021039E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17
+
+[[entry_point]]
+addr = 0x02103AA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17
+
+[[entry_point]]
+addr = 0x02103B58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15233
+
+[[entry_point]]
+addr = 0x02103C04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15258
+
+[[entry_point]]
+addr = 0x02103D2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 615
+
 [[entry_point]]
 addr = 0x02103DD0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 4
+# hits = 7
+
+[[entry_point]]
+addr = 0x02103DF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
 
 [[entry_point]]
 addr = 0x02103FFC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 4
+
+[[entry_point]]
+addr = 0x02104094
+mode = "arm"
+kind = "runtime_observed"
+# hits = 615
+
+[[entry_point]]
+addr = 0x021040DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021040E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33
+
+[[entry_point]]
+addr = 0x021040F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 60
+
+[[entry_point]]
+addr = 0x021040F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 64
+
+[[entry_point]]
+addr = 0x02104100
+mode = "arm"
+kind = "runtime_observed"
+# hits = 446
+
+[[entry_point]]
+addr = 0x02104354
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021043EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0210463C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02104738
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02104764
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021047CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021048A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210491C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02104928
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14749
+
+[[entry_point]]
+addr = 0x021049CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021049FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 447
+
+[[entry_point]]
+addr = 0x02104AB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02104B3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 44
 
 [[entry_point]]
 addr = 0x02104BB0
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 4
 
 [[entry_point]]
 addr = 0x02104BF8
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 4
+
+[[entry_point]]
+addr = 0x02104CAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02104CFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 648
 
 [[entry_point]]
 addr = 0x02104FDC
 mode = "arm"
 kind = "runtime_observed"
-# hits = 6
+# hits = 15
+
+[[entry_point]]
+addr = 0x02104FE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
diff --git a/config/mph_arm9_ov002.toml b/config/mph_arm9_ov002.toml
new file mode 100644
index 0000000..f363a2a
--- /dev/null
+++ b/config/mph_arm9_ov002.toml
@@ -0,0 +1,3532 @@
+# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.
+# Entry points are Tier-3 observations whose containing 4 KiB page was
+# byte-identical to this overlay's decompressed ROM image at the time it
+# executed, so every seed below is provably from THIS overlay generation
+# and not from one of the overlays sharing its address range.
+
+[program]
+name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay 2"
+id = "mph_amhe0_arm9_ov002"
+load_address = 0x02102220
+size = 0x00020C20
+entry_pc = 0x02103010
+authoritative_entry_points = false
+
+[identity]
+sha1 = "4a9a988e66776b9491651ef50efd68ab3f65e240"
+
+[[entry_point]]
+addr = 0x02103010
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x02103088
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x02103144
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02103154
+mode = "arm"
+kind = "runtime_observed"
+# hits = 68
+
+[[entry_point]]
+addr = 0x02103158
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5885
+
+[[entry_point]]
+addr = 0x02103184
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16999
+
+[[entry_point]]
+addr = 0x02103208
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0210324C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33267
+
+[[entry_point]]
+addr = 0x021033DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33267
+
+[[entry_point]]
+addr = 0x0210346C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 104
+
+[[entry_point]]
+addr = 0x02103494
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x021034CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021034D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x021034E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 21
+
+[[entry_point]]
+addr = 0x021034F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x02103510
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10
+
+[[entry_point]]
+addr = 0x02103550
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021035CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x021035F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02103604
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02103640
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021036E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210372C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02103740
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13
+
+[[entry_point]]
+addr = 0x021037AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02103834
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02103838
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0210384C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02103868
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02103870
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02103890
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x021038D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02103954
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02103974
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02103994
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021039E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17
+
+[[entry_point]]
+addr = 0x02103AA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17
+
+[[entry_point]]
+addr = 0x02103B58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15233
+
+[[entry_point]]
+addr = 0x02103C04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15258
+
+[[entry_point]]
+addr = 0x02103D2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 615
+
+[[entry_point]]
+addr = 0x02103DD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02103DF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02103FFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02104094
+mode = "arm"
+kind = "runtime_observed"
+# hits = 615
+
+[[entry_point]]
+addr = 0x021040DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021040E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33
+
+[[entry_point]]
+addr = 0x021040F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 60
+
+[[entry_point]]
+addr = 0x021040F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 64
+
+[[entry_point]]
+addr = 0x02104100
+mode = "arm"
+kind = "runtime_observed"
+# hits = 446
+
+[[entry_point]]
+addr = 0x02104354
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021043EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0210463C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02104738
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02104764
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021047CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021048A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210491C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02104928
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14749
+
+[[entry_point]]
+addr = 0x021049CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021049FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 447
+
+[[entry_point]]
+addr = 0x02104AB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02104B3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 44
+
+[[entry_point]]
+addr = 0x02104BB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02104BF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02104CAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02104CFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 648
+
+[[entry_point]]
+addr = 0x02104FDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02104FE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021050C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 648
+
+[[entry_point]]
+addr = 0x02105198
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02105420
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02105444
+mode = "arm"
+kind = "runtime_observed"
+# hits = 35876
+
+[[entry_point]]
+addr = 0x02105468
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x02105508
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021055E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 35812
+
+[[entry_point]]
+addr = 0x021056C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 451
+
+[[entry_point]]
+addr = 0x021056E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 451
+
+[[entry_point]]
+addr = 0x02105790
+mode = "arm"
+kind = "runtime_observed"
+# hits = 447
+
+[[entry_point]]
+addr = 0x021057D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02105A64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 431
+
+[[entry_point]]
+addr = 0x02105A9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02105BFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 35772
+
+[[entry_point]]
+addr = 0x02105CD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 430
+
+[[entry_point]]
+addr = 0x02105CF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02105D68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 431
+
+[[entry_point]]
+addr = 0x02105D7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02105F2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 431
+
+[[entry_point]]
+addr = 0x02105FB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 430
+
+[[entry_point]]
+addr = 0x02106028
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02106098
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02106108
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02106204
+mode = "arm"
+kind = "runtime_observed"
+# hits = 50
+
+[[entry_point]]
+addr = 0x02106248
+mode = "arm"
+kind = "runtime_observed"
+# hits = 447
+
+[[entry_point]]
+addr = 0x021062A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02106444
+mode = "arm"
+kind = "runtime_observed"
+# hits = 447
+
+[[entry_point]]
+addr = 0x02106460
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021064BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021064DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 447
+
+[[entry_point]]
+addr = 0x02106508
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02106538
+mode = "arm"
+kind = "runtime_observed"
+# hits = 34
+
+[[entry_point]]
+addr = 0x0210661C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210664C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x021066A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021066B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02106788
+mode = "arm"
+kind = "runtime_observed"
+# hits = 45275
+
+[[entry_point]]
+addr = 0x02106790
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02106824
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210690C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02106A3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 878
+
+[[entry_point]]
+addr = 0x02106AB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 58
+
+[[entry_point]]
+addr = 0x02106B5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3562
+
+[[entry_point]]
+addr = 0x02106BB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02106C34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4584
+
+[[entry_point]]
+addr = 0x02106CE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02106D80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x02106DAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x02106E8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02106F04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 72458
+
+[[entry_point]]
+addr = 0x02106F9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 69566
+
+[[entry_point]]
+addr = 0x02106FE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021071D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23
+
+[[entry_point]]
+addr = 0x021071D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23
+
+[[entry_point]]
+addr = 0x021072E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021074A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021075A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021075D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 81
+
+[[entry_point]]
+addr = 0x021076E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 51230
+
+[[entry_point]]
+addr = 0x02107730
+mode = "arm"
+kind = "runtime_observed"
+# hits = 54674
+
+[[entry_point]]
+addr = 0x02107808
+mode = "arm"
+kind = "runtime_observed"
+# hits = 51586
+
+[[entry_point]]
+addr = 0x02107894
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02107B54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 89
+
+[[entry_point]]
+addr = 0x02107D80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02107F20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 38
+
+[[entry_point]]
+addr = 0x0210843C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021086C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02108E10
+mode = "arm"
+kind = "runtime_observed"
+# hits = 906
+
+[[entry_point]]
+addr = 0x02108FD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 906
+
+[[entry_point]]
+addr = 0x0210A568
+mode = "arm"
+kind = "runtime_observed"
+# hits = 50
+
+[[entry_point]]
+addr = 0x0210A600
+mode = "arm"
+kind = "runtime_observed"
+# hits = 50
+
+[[entry_point]]
+addr = 0x0210A9CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0210AA84
+mode = "arm"
+kind = "runtime_observed"
+# hits = 82996
+
+[[entry_point]]
+addr = 0x0210ABE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210AD58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3899
+
+[[entry_point]]
+addr = 0x0210AFB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210B2C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210B5EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6888
+
+[[entry_point]]
+addr = 0x0210B5F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6824
+
+[[entry_point]]
+addr = 0x0210B87C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210B8C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4004
+
+[[entry_point]]
+addr = 0x0210BA44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2820
+
+[[entry_point]]
+addr = 0x0210BAD8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210BC6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0210BF98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210C1D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9718
+
+[[entry_point]]
+addr = 0x0210C24C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210C27C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9426
+
+[[entry_point]]
+addr = 0x0210C418
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0210C494
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33
+
+[[entry_point]]
+addr = 0x0210CA1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0210CB34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210CF2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12028
+
+[[entry_point]]
+addr = 0x0210D024
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210D0C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210D434
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6888
+
+[[entry_point]]
+addr = 0x0210D48C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0210D6A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6824
+
+[[entry_point]]
+addr = 0x0210DC64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0210DC68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0210E234
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210E534
+mode = "arm"
+kind = "runtime_observed"
+# hits = 47202
+
+[[entry_point]]
+addr = 0x0210E6A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 31685
+
+[[entry_point]]
+addr = 0x0210E79C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 33267
+
+[[entry_point]]
+addr = 0x0210E7DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0210EEB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0210F104
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211006C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021100C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 188528
+
+[[entry_point]]
+addr = 0x02110128
+mode = "arm"
+kind = "runtime_observed"
+# hits = 101150
+
+[[entry_point]]
+addr = 0x0211014C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 254
+
+[[entry_point]]
+addr = 0x021101D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 107424
+
+[[entry_point]]
+addr = 0x02110308
+mode = "arm"
+kind = "runtime_observed"
+# hits = 227860
+
+[[entry_point]]
+addr = 0x02110494
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x021104E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02110528
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02110530
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02110568
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02110570
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021105A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02110610
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x02110630
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211064C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02110690
+mode = "arm"
+kind = "runtime_observed"
+# hits = 98568
+
+[[entry_point]]
+addr = 0x0211070C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x021107A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x02110834
+mode = "arm"
+kind = "runtime_observed"
+# hits = 77585
+
+[[entry_point]]
+addr = 0x02110844
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x02110860
+mode = "arm"
+kind = "runtime_observed"
+# hits = 77585
+
+[[entry_point]]
+addr = 0x021108B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02110BD8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x02110D58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x02110DA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02110DC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02110E44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 124
+
+[[entry_point]]
+addr = 0x02110E54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02110EE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02110F20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02110F28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021110F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02111190
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1394
+
+[[entry_point]]
+addr = 0x02111214
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x02111298
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x02111320
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211133C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02111354
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02111388
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20164
+
+[[entry_point]]
+addr = 0x02111418
+mode = "arm"
+kind = "runtime_observed"
+# hits = 54
+
+[[entry_point]]
+addr = 0x02111478
+mode = "arm"
+kind = "runtime_observed"
+# hits = 523
+
+[[entry_point]]
+addr = 0x021114BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 785
+
+[[entry_point]]
+addr = 0x0211151C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x02111558
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211155C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02111560
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0211156C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24658
+
+[[entry_point]]
+addr = 0x02111614
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02111680
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20164
+
+[[entry_point]]
+addr = 0x02111718
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021118B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02111A78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02111C8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20164
+
+[[entry_point]]
+addr = 0x02111CA4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 25343
+
+[[entry_point]]
+addr = 0x02111CF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4649
+
+[[entry_point]]
+addr = 0x02111D4C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20164
+
+[[entry_point]]
+addr = 0x02111D80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 169017
+
+[[entry_point]]
+addr = 0x02111DF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02111E10
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02111EBC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 89241
+
+[[entry_point]]
+addr = 0x02111EF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 65270
+
+[[entry_point]]
+addr = 0x02111F20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24658
+
+[[entry_point]]
+addr = 0x02111F48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20164
+
+[[entry_point]]
+addr = 0x02111FA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 834
+
+[[entry_point]]
+addr = 0x0211204C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 685
+
+[[entry_point]]
+addr = 0x021120B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021120D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021121D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 350
+
+[[entry_point]]
+addr = 0x0211232C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x02112518
+mode = "arm"
+kind = "runtime_observed"
+# hits = 636
+
+[[entry_point]]
+addr = 0x0211251C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 758
+
+[[entry_point]]
+addr = 0x02112520
+mode = "arm"
+kind = "runtime_observed"
+# hits = 70
+
+[[entry_point]]
+addr = 0x02112524
+mode = "arm"
+kind = "runtime_observed"
+# hits = 994
+
+[[entry_point]]
+addr = 0x02112528
+mode = "arm"
+kind = "runtime_observed"
+# hits = 137
+
+[[entry_point]]
+addr = 0x02112694
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2648
+
+[[entry_point]]
+addr = 0x021126B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2597
+
+[[entry_point]]
+addr = 0x021126CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2597
+
+[[entry_point]]
+addr = 0x021126DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2597
+
+[[entry_point]]
+addr = 0x021126E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2597
+
+[[entry_point]]
+addr = 0x021126E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x021126F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2601
+
+[[entry_point]]
+addr = 0x021126F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x021126FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02112704
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211273C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 50
+
+[[entry_point]]
+addr = 0x02112888
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15224
+
+[[entry_point]]
+addr = 0x02112AD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02112BB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02112E80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02112F18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02112F9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02112FB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48
+
+[[entry_point]]
+addr = 0x02112FDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02113134
+mode = "arm"
+kind = "runtime_observed"
+# hits = 36
+
+[[entry_point]]
+addr = 0x02113174
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211320C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211324C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211326C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02113298
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x021132B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021134B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5780
+
+[[entry_point]]
+addr = 0x02113568
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5302
+
+[[entry_point]]
+addr = 0x02113684
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1637
+
+[[entry_point]]
+addr = 0x02113700
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7692
+
+[[entry_point]]
+addr = 0x02113744
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021137AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 283
+
+[[entry_point]]
+addr = 0x02113848
+mode = "arm"
+kind = "runtime_observed"
+# hits = 816
+
+[[entry_point]]
+addr = 0x021138BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 220
+
+[[entry_point]]
+addr = 0x021138F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 839
+
+[[entry_point]]
+addr = 0x02113984
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9364
+
+[[entry_point]]
+addr = 0x02113B30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 582
+
+[[entry_point]]
+addr = 0x02113BE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02113C20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4500
+
+[[entry_point]]
+addr = 0x02113C24
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02113C80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 54528
+
+[[entry_point]]
+addr = 0x02113CD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 56533
+
+[[entry_point]]
+addr = 0x02113D58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10350
+
+[[entry_point]]
+addr = 0x02113DB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8494
+
+[[entry_point]]
+addr = 0x02113DCC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 849
+
+[[entry_point]]
+addr = 0x02113DF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9860
+
+[[entry_point]]
+addr = 0x02113E08
+mode = "arm"
+kind = "runtime_observed"
+# hits = 68469
+
+[[entry_point]]
+addr = 0x02113E3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 263519
+
+[[entry_point]]
+addr = 0x02113F58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9266
+
+[[entry_point]]
+addr = 0x02113FA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12545
+
+[[entry_point]]
+addr = 0x02114024
+mode = "arm"
+kind = "runtime_observed"
+# hits = 72391
+
+[[entry_point]]
+addr = 0x02114034
+mode = "arm"
+kind = "runtime_observed"
+# hits = 829
+
+[[entry_point]]
+addr = 0x02114044
+mode = "arm"
+kind = "runtime_observed"
+# hits = 266
+
+[[entry_point]]
+addr = 0x02114064
+mode = "arm"
+kind = "runtime_observed"
+# hits = 91531
+
+[[entry_point]]
+addr = 0x02114074
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x021140D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0211411C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02114228
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x021142E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021142F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021142F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021142FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211430C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02114310
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02114318
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02114320
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021144E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x0211452C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02114550
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02114648
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x021146B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 69692
+
+[[entry_point]]
+addr = 0x02114730
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2526
+
+[[entry_point]]
+addr = 0x02114780
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17834
+
+[[entry_point]]
+addr = 0x021147C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 47714
+
+[[entry_point]]
+addr = 0x02114814
+mode = "arm"
+kind = "runtime_observed"
+# hits = 910
+
+[[entry_point]]
+addr = 0x02114AB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12777
+
+[[entry_point]]
+addr = 0x02114AF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 27
+
+[[entry_point]]
+addr = 0x02114B1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02114B2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9178
+
+[[entry_point]]
+addr = 0x02114C34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02114F2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16354
+
+[[entry_point]]
+addr = 0x02115000
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16904
+
+[[entry_point]]
+addr = 0x02115014
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021150E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2705
+
+[[entry_point]]
+addr = 0x0211511C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17
+
+[[entry_point]]
+addr = 0x02115124
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211512C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 96
+
+[[entry_point]]
+addr = 0x02115168
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2705
+
+[[entry_point]]
+addr = 0x0211516C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02115208
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02115260
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211527C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 32
+
+[[entry_point]]
+addr = 0x0211528C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24
+
+[[entry_point]]
+addr = 0x02115308
+mode = "arm"
+kind = "runtime_observed"
+# hits = 94
+
+[[entry_point]]
+addr = 0x021153B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 760
+
+[[entry_point]]
+addr = 0x0211540C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02115490
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021154F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02115554
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2764
+
+[[entry_point]]
+addr = 0x02115700
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x021157CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 95841
+
+[[entry_point]]
+addr = 0x021157D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021158C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021158EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115A5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02115A60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02115A64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02115A68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02115A6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02115A70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02115A90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02115A94
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02115A98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AA4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02115ABC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02115AC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AC8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115ACC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115AFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02115B04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02115B08
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02115B0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02115B18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02115DB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16637
+
+[[entry_point]]
+addr = 0x02115F88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02115FB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021161FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02116404
+mode = "arm"
+kind = "runtime_observed"
+# hits = 910
+
+[[entry_point]]
+addr = 0x02116458
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021164F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02116514
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02116520
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10
+
+[[entry_point]]
+addr = 0x021165D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021166F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 77
+
+[[entry_point]]
+addr = 0x021167A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 771
+
+[[entry_point]]
+addr = 0x02116814
+mode = "arm"
+kind = "runtime_observed"
+# hits = 165
+
+[[entry_point]]
+addr = 0x0211685C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5488
+
+[[entry_point]]
+addr = 0x021168A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x021168C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 21224
+
+[[entry_point]]
+addr = 0x02116980
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20127
+
+[[entry_point]]
+addr = 0x02116A14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12918
+
+[[entry_point]]
+addr = 0x02116A44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2489
+
+[[entry_point]]
+addr = 0x02116AB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 25823
+
+[[entry_point]]
+addr = 0x02116ACC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 26423
+
+[[entry_point]]
+addr = 0x02116AE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2595
+
+[[entry_point]]
+addr = 0x02116BFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5171
+
+[[entry_point]]
+addr = 0x02116C18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5459
+
+[[entry_point]]
+addr = 0x02116C34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 853
+
+[[entry_point]]
+addr = 0x02116C84
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1703
+
+[[entry_point]]
+addr = 0x02116CA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1895
+
+[[entry_point]]
+addr = 0x02116CBC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20164
+
+[[entry_point]]
+addr = 0x02116D38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02116DD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 80220
+
+[[entry_point]]
+addr = 0x02116E10
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02116E50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 111636
+
+[[entry_point]]
+addr = 0x02117360
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23181
+
+[[entry_point]]
+addr = 0x021173B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20983
+
+[[entry_point]]
+addr = 0x02117408
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021174D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9797
+
+[[entry_point]]
+addr = 0x0211770C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x02117748
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02117750
+mode = "arm"
+kind = "runtime_observed"
+# hits = 653
+
+[[entry_point]]
+addr = 0x02117790
+mode = "arm"
+kind = "runtime_observed"
+# hits = 795
+
+[[entry_point]]
+addr = 0x021177B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x021177D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15225
+
+[[entry_point]]
+addr = 0x02117810
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02117864
+mode = "arm"
+kind = "runtime_observed"
+# hits = 463
+
+[[entry_point]]
+addr = 0x0211790C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10
+
+[[entry_point]]
+addr = 0x021179C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15518
+
+[[entry_point]]
+addr = 0x021179F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021180F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 56050
+
+[[entry_point]]
+addr = 0x02118210
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021185FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211862C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211864C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02118844
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021188EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 63103
+
+[[entry_point]]
+addr = 0x02118960
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02118C50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 129670
+
+[[entry_point]]
+addr = 0x02118D90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1904
+
+[[entry_point]]
+addr = 0x02118D94
+mode = "arm"
+kind = "runtime_observed"
+# hits = 790
+
+[[entry_point]]
+addr = 0x02118D98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20653
+
+[[entry_point]]
+addr = 0x02118D9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 91235
+
+[[entry_point]]
+addr = 0x02118DA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18974
+
+[[entry_point]]
+addr = 0x02118DA4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 887
+
+[[entry_point]]
+addr = 0x02118DA8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2399
+
+[[entry_point]]
+addr = 0x02118F90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3168
+
+[[entry_point]]
+addr = 0x02118F94
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2190
+
+[[entry_point]]
+addr = 0x02118F98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 80604
+
+[[entry_point]]
+addr = 0x02118F9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 82477
+
+[[entry_point]]
+addr = 0x02118FA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10778
+
+[[entry_point]]
+addr = 0x02118FA4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1892
+
+[[entry_point]]
+addr = 0x02118FA8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 26642
+
+[[entry_point]]
+addr = 0x021191A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4681
+
+[[entry_point]]
+addr = 0x021191A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 527
+
+[[entry_point]]
+addr = 0x021191A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16777
+
+[[entry_point]]
+addr = 0x021191AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 95823
+
+[[entry_point]]
+addr = 0x021191B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15636
+
+[[entry_point]]
+addr = 0x021191B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 400
+
+[[entry_point]]
+addr = 0x021191B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5146
+
+[[entry_point]]
+addr = 0x02119274
+mode = "arm"
+kind = "runtime_observed"
+# hits = 49491
+
+[[entry_point]]
+addr = 0x02119370
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x021193B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021193E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 37887
+
+[[entry_point]]
+addr = 0x0211943C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211953C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13772
+
+[[entry_point]]
+addr = 0x02119630
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02119784
+mode = "arm"
+kind = "runtime_observed"
+# hits = 55323
+
+[[entry_point]]
+addr = 0x02119A1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 37997
+
+[[entry_point]]
+addr = 0x0211A56C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 75994
+
+[[entry_point]]
+addr = 0x0211A65C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13772
+
+[[entry_point]]
+addr = 0x0211A6EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 48270
+
+[[entry_point]]
+addr = 0x0211A720
+mode = "arm"
+kind = "runtime_observed"
+# hits = 84501
+
+[[entry_point]]
+addr = 0x0211A7E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211A830
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10719
+
+[[entry_point]]
+addr = 0x0211A868
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211A878
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211A884
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13652
+
+[[entry_point]]
+addr = 0x0211A8B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211A8D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211AA20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0211AC00
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211ACF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211AE68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211AFD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211B004
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0211B1F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211B270
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211B28C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211B8E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0211B8F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 245
+
+[[entry_point]]
+addr = 0x0211B904
+mode = "arm"
+kind = "runtime_observed"
+# hits = 284
+
+[[entry_point]]
+addr = 0x0211BAC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 208
+
+[[entry_point]]
+addr = 0x0211BCC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211BCFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211BD84
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211BDB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211BF60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2614
+
+[[entry_point]]
+addr = 0x0211BFE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1432
+
+[[entry_point]]
+addr = 0x0211C070
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211C08C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 403
+
+[[entry_point]]
+addr = 0x0211C120
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C12C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x0211C13C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C148
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0211C154
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C188
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13
+
+[[entry_point]]
+addr = 0x0211C18C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211C1A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211C1B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211C1BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211C1C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211C22C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C27C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211C318
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10
+
+[[entry_point]]
+addr = 0x0211C388
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211C4DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211C518
+mode = "arm"
+kind = "runtime_observed"
+# hits = 77585
+
+[[entry_point]]
+addr = 0x0211C59C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15517
+
+[[entry_point]]
+addr = 0x0211C5B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1432
+
+[[entry_point]]
+addr = 0x0211C6B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x0211C764
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211C7C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211C830
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0211C8A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0211C8E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1432
+
+[[entry_point]]
+addr = 0x0211CA18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0211CA34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 110
+
+[[entry_point]]
+addr = 0x0211CA50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 30
+
+[[entry_point]]
+addr = 0x0211CA60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5728
+
+[[entry_point]]
+addr = 0x0211CAB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5728
+
+[[entry_point]]
+addr = 0x0211CB80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5728
+
+[[entry_point]]
+addr = 0x0211CC04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0211CC6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211CE64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 19820
+
+[[entry_point]]
+addr = 0x0211D244
+mode = "arm"
+kind = "runtime_observed"
+# hits = 151254
+
+[[entry_point]]
+addr = 0x0211D4B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16178
+
+[[entry_point]]
+addr = 0x0211D59C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211D5C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211D690
+mode = "arm"
+kind = "runtime_observed"
+# hits = 109174
+
+[[entry_point]]
+addr = 0x0211D704
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6837
+
+[[entry_point]]
+addr = 0x0211D774
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5728
+
+[[entry_point]]
+addr = 0x0211DCD8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23116
+
+[[entry_point]]
+addr = 0x0211DD2C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211E41C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2705
+
+[[entry_point]]
+addr = 0x0211E428
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211E438
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x0211E444
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2753
+
+[[entry_point]]
+addr = 0x0211E4A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2764
+
+[[entry_point]]
+addr = 0x0211E4C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211E548
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11354
+
+[[entry_point]]
+addr = 0x0211E560
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211E568
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0211E56C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 39
+
+[[entry_point]]
+addr = 0x0211E588
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0211E598
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10051
+
+[[entry_point]]
+addr = 0x0211E5BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211E64C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211E764
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10051
+
+[[entry_point]]
+addr = 0x0211E79C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211E7A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 30153
+
+[[entry_point]]
+addr = 0x0211E854
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10051
+
+[[entry_point]]
+addr = 0x0211E8A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0211E8F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0211E994
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2295
+
+[[entry_point]]
+addr = 0x0211E9A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211E9B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211E9C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211EA50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0211EC48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211EE90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0211EF0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0211EFE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F128
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F1F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F2A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F2A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0211F3B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0211F7B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
diff --git a/config/mph_arm9_ov003.toml b/config/mph_arm9_ov003.toml
new file mode 100644
index 0000000..c1e726d
--- /dev/null
+++ b/config/mph_arm9_ov003.toml
@@ -0,0 +1,124 @@
+# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.
+# Entry points are Tier-3 observations whose containing 4 KiB page was
+# byte-identical to this overlay's decompressed ROM image at the time it
+# executed, so every seed below is provably from THIS overlay generation
+# and not from one of the overlays sharing its address range.
+
+[program]
+name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay 3"
+id = "mph_amhe0_arm9_ov003"
+load_address = 0x0212C600
+size = 0x000034C0
+entry_pc = 0x0212DC54
+authoritative_entry_points = false
+
+[identity]
+sha1 = "747bab89f0972cedae5232c4ae543fa5d10b5558"
+
+[[entry_point]]
+addr = 0x0212DC54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212DCE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212DD70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0212DF5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E060
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0212E210
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E2BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E3B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E740
+mode = "arm"
+kind = "runtime_observed"
+# hits = 32339
+
+[[entry_point]]
+addr = 0x0212E744
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0212E970
+mode = "arm"
+kind = "runtime_observed"
+# hits = 32307
+
+[[entry_point]]
+addr = 0x0212EA18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212EBAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212EBB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212ECAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0212ED0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212ED48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212EE40
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
diff --git a/config/mph_arm9_ov004.toml b/config/mph_arm9_ov004.toml
new file mode 100644
index 0000000..e4640b1
--- /dev/null
+++ b/config/mph_arm9_ov004.toml
@@ -0,0 +1,556 @@
+# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.
+# Entry points are Tier-3 observations whose containing 4 KiB page was
+# byte-identical to this overlay's decompressed ROM image at the time it
+# executed, so every seed below is provably from THIS overlay generation
+# and not from one of the overlays sharing its address range.
+
+[program]
+name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay 4"
+id = "mph_amhe0_arm9_ov004"
+load_address = 0x0214C860
+size = 0x0004C460
+entry_pc = 0x021513E0
+authoritative_entry_points = false
+
+[identity]
+sha1 = "9a5beb990abe48f91f13e91cdd6bf2098e213ea7"
+
+[[entry_point]]
+addr = 0x021513E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02152608
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0215296C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24
+
+[[entry_point]]
+addr = 0x0216B524
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0216B528
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0216BA8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216BB30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0216BBC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216BCBC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216BD28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216BD74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216BDD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216BDF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0216BE58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216BE88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 37
+
+[[entry_point]]
+addr = 0x0216BF6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C000
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0216C004
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C008
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C00C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C010
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C018
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C044
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216C0AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2976
+
+[[entry_point]]
+addr = 0x0216C218
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C250
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0216C254
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C258
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C25C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C260
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C268
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C34C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10332
+
+[[entry_point]]
+addr = 0x0216C3E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C4B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C4C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C4D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C4E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10236
+
+[[entry_point]]
+addr = 0x0216C524
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216C528
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216C5FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216C618
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C630
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216C75C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x0216C804
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C810
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C8A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C8D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0216C924
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0216CA24
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216CA58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CB50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216CB7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216CC44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CCFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CD38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CD4C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216CD50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CD9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216CEB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0216D028
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D20C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D234
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10236
+
+[[entry_point]]
+addr = 0x0216D398
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D3F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D414
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D878
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216DA88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0217AA14
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217AA38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0217AC3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0217ADB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217AE00
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217AF00
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217AF3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0217AF4C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0217AFE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217B084
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217B110
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217B1A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0217B3DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0217B40C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0217B470
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0217B48C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13
+
+[[entry_point]]
+addr = 0x0217B4B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217B4BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217B510
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217B518
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0217B538
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0217B564
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0217B580
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
diff --git a/config/mph_arm9_ov008.toml b/config/mph_arm9_ov008.toml
new file mode 100644
index 0000000..969062a
--- /dev/null
+++ b/config/mph_arm9_ov008.toml
@@ -0,0 +1,190 @@
+# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.
+# Entry points are Tier-3 observations whose containing 4 KiB page was
+# byte-identical to this overlay's decompressed ROM image at the time it
+# executed, so every seed below is provably from THIS overlay generation
+# and not from one of the overlays sharing its address range.
+
+[program]
+name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay 8"
+id = "mph_amhe0_arm9_ov008"
+load_address = 0x0212C600
+size = 0x000063C0
+entry_pc = 0x0212DC54
+authoritative_entry_points = false
+
+[identity]
+sha1 = "a3abc6c9d468ca0a362e71f0d4a4a7c582395093"
+
+[[entry_point]]
+addr = 0x0212DC54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212DCE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212DD70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0212DF5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E060
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0212E210
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E2BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E3B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212E740
+mode = "arm"
+kind = "runtime_observed"
+# hits = 32339
+
+[[entry_point]]
+addr = 0x0212E744
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0212E970
+mode = "arm"
+kind = "runtime_observed"
+# hits = 32307
+
+[[entry_point]]
+addr = 0x0212EA18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212EBAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212EBB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212ECAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0212ED0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0212ED48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0212EE40
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02131244
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02131258
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02131278
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02131288
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0213198C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02131998
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02131A70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02131AD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02131B74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02131BD8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02131DE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20
diff --git a/config/mph_arm9_ov009.toml b/config/mph_arm9_ov009.toml
new file mode 100644
index 0000000..f0779a6
--- /dev/null
+++ b/config/mph_arm9_ov009.toml
@@ -0,0 +1,2698 @@
+# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.
+# Entry points are Tier-3 observations whose containing 4 KiB page was
+# byte-identical to this overlay's decompressed ROM image at the time it
+# executed, so every seed below is provably from THIS overlay generation
+# and not from one of the overlays sharing its address range.
+
+[program]
+name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay 9"
+id = "mph_amhe0_arm9_ov009"
+load_address = 0x02133060
+size = 0x00019860
+entry_pc = 0x0213413C
+authoritative_entry_points = false
+
+[identity]
+sha1 = "d094aad7e063aeb5a2856b695d8e7916609b5ded"
+
+[[entry_point]]
+addr = 0x0213413C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02134158
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021341C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02134324
+mode = "arm"
+kind = "runtime_observed"
+# hits = 93
+
+[[entry_point]]
+addr = 0x0213438C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 96819
+
+[[entry_point]]
+addr = 0x021343BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021343F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02134434
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02134494
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021344E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 74
+
+[[entry_point]]
+addr = 0x021345B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x0213468C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 64767
+
+[[entry_point]]
+addr = 0x0213469C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021346B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x021346C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x021346E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 127921
+
+[[entry_point]]
+addr = 0x02134704
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02134718
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0213478C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 130504
+
+[[entry_point]]
+addr = 0x021348C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17127
+
+[[entry_point]]
+addr = 0x021348D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02134934
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02134990
+mode = "arm"
+kind = "runtime_observed"
+# hits = 899
+
+[[entry_point]]
+addr = 0x02134A90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1428
+
+[[entry_point]]
+addr = 0x02134AB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02134B00
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17127
+
+[[entry_point]]
+addr = 0x02134B34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24778
+
+[[entry_point]]
+addr = 0x02134B44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 54421
+
+[[entry_point]]
+addr = 0x02134B78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6524
+
+[[entry_point]]
+addr = 0x02134B7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 627
+
+[[entry_point]]
+addr = 0x02134B80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6711
+
+[[entry_point]]
+addr = 0x02134B8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 189
+
+[[entry_point]]
+addr = 0x02134BC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 272
+
+[[entry_point]]
+addr = 0x02134BD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02134BF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17127
+
+[[entry_point]]
+addr = 0x02134C50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10720
+
+[[entry_point]]
+addr = 0x02134C54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4527
+
+[[entry_point]]
+addr = 0x02134C5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 135
+
+[[entry_point]]
+addr = 0x02134C64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1020
+
+[[entry_point]]
+addr = 0x02134C80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1649
+
+[[entry_point]]
+addr = 0x02134C84
+mode = "arm"
+kind = "runtime_observed"
+# hits = 829
+
+[[entry_point]]
+addr = 0x02134C9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02134E68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02135020
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x02135108
+mode = "arm"
+kind = "runtime_observed"
+# hits = 28
+
+[[entry_point]]
+addr = 0x02135154
+mode = "arm"
+kind = "runtime_observed"
+# hits = 30
+
+[[entry_point]]
+addr = 0x021351B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 30
+
+[[entry_point]]
+addr = 0x021351CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 60
+
+[[entry_point]]
+addr = 0x02135408
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213548C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021354E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02135524
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02135588
+mode = "arm"
+kind = "runtime_observed"
+# hits = 27
+
+[[entry_point]]
+addr = 0x0213560C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02135898
+mode = "arm"
+kind = "runtime_observed"
+# hits = 19
+
+[[entry_point]]
+addr = 0x02135950
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x02135BCC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02135C20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02135C88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02135DAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02135F20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02136014
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02136034
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02136074
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0213613C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 756
+
+[[entry_point]]
+addr = 0x021361C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 92
+
+[[entry_point]]
+addr = 0x021361F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 51352
+
+[[entry_point]]
+addr = 0x02136254
+mode = "arm"
+kind = "runtime_observed"
+# hits = 70
+
+[[entry_point]]
+addr = 0x021362D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x02136304
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02136358
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021363D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02136428
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213645C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021364A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021364D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213653C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213655C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213658C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213660C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4302
+
+[[entry_point]]
+addr = 0x02136668
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8160
+
+[[entry_point]]
+addr = 0x02136748
+mode = "arm"
+kind = "runtime_observed"
+# hits = 790
+
+[[entry_point]]
+addr = 0x021367AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1044
+
+[[entry_point]]
+addr = 0x0213688C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213693C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10720
+
+[[entry_point]]
+addr = 0x0213696C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02136A34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2753
+
+[[entry_point]]
+addr = 0x02136A80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x02136AC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2753
+
+[[entry_point]]
+addr = 0x02136B10
+mode = "arm"
+kind = "runtime_observed"
+# hits = 84350
+
+[[entry_point]]
+addr = 0x02136B20
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23792
+
+[[entry_point]]
+addr = 0x02136B24
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7730
+
+[[entry_point]]
+addr = 0x02136B44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9064
+
+[[entry_point]]
+addr = 0x02136B50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1404
+
+[[entry_point]]
+addr = 0x02136B54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 26214
+
+[[entry_point]]
+addr = 0x02136B58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 359
+
+[[entry_point]]
+addr = 0x02136B5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9627
+
+[[entry_point]]
+addr = 0x02136B70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8913
+
+[[entry_point]]
+addr = 0x02136C1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02136C3C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 135954
+
+[[entry_point]]
+addr = 0x02136C7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x02136CA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18898
+
+[[entry_point]]
+addr = 0x02136EE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17127
+
+[[entry_point]]
+addr = 0x02136F74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02136FE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02137084
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021371B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02137254
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02137284
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021372AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x0213786C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23598
+
+[[entry_point]]
+addr = 0x021378DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213790C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17106
+
+[[entry_point]]
+addr = 0x02137BE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02137DE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x02137F6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x021380BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x02138168
+mode = "arm"
+kind = "runtime_observed"
+# hits = 604
+
+[[entry_point]]
+addr = 0x021383E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x021387FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213881C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213883C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213885C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02138868
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02138874
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02138880
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021389BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021389F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5338
+
+[[entry_point]]
+addr = 0x02138AE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 272
+
+[[entry_point]]
+addr = 0x02138C8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5081
+
+[[entry_point]]
+addr = 0x02138E50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x02138E58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02138E60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02138F28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02138F38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 31749
+
+[[entry_point]]
+addr = 0x02139054
+mode = "arm"
+kind = "runtime_observed"
+# hits = 31749
+
+[[entry_point]]
+addr = 0x0213911C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02139274
+mode = "arm"
+kind = "runtime_observed"
+# hits = 620
+
+[[entry_point]]
+addr = 0x021394E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 272
+
+[[entry_point]]
+addr = 0x021395E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 862
+
+[[entry_point]]
+addr = 0x0213966C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9366
+
+[[entry_point]]
+addr = 0x021398B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9366
+
+[[entry_point]]
+addr = 0x021398DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 53277
+
+[[entry_point]]
+addr = 0x0213998C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021399C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02139A30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x02139A34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x02139A38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02139A58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02139A74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1524
+
+[[entry_point]]
+addr = 0x02139A78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02139AA0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13204
+
+[[entry_point]]
+addr = 0x02139AD8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17105
+
+[[entry_point]]
+addr = 0x02139D40
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17105
+
+[[entry_point]]
+addr = 0x02139D5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3684
+
+[[entry_point]]
+addr = 0x02139D8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4768
+
+[[entry_point]]
+addr = 0x0213A1E0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3200
+
+[[entry_point]]
+addr = 0x0213A204
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4542
+
+[[entry_point]]
+addr = 0x0213A2E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 57
+
+[[entry_point]]
+addr = 0x0213A318
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3012
+
+[[entry_point]]
+addr = 0x0213A348
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x0213A378
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x0213A390
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3206
+
+[[entry_point]]
+addr = 0x0213A3A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 26
+
+[[entry_point]]
+addr = 0x0213A480
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0213A4B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3240
+
+[[entry_point]]
+addr = 0x0213A4C8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9682
+
+[[entry_point]]
+addr = 0x0213A4F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 56
+
+[[entry_point]]
+addr = 0x0213A510
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3240
+
+[[entry_point]]
+addr = 0x0213A528
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10047
+
+[[entry_point]]
+addr = 0x0213A540
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0213A558
+mode = "arm"
+kind = "runtime_observed"
+# hits = 46
+
+[[entry_point]]
+addr = 0x0213A570
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0213A588
+mode = "arm"
+kind = "runtime_observed"
+# hits = 46
+
+[[entry_point]]
+addr = 0x0213A5B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x0213A5E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 52
+
+[[entry_point]]
+addr = 0x0213A618
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4376
+
+[[entry_point]]
+addr = 0x0213AE98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213AFB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213AFB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213AFBC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213AFD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213AFD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213B064
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213B104
+mode = "arm"
+kind = "runtime_observed"
+# hits = 730
+
+[[entry_point]]
+addr = 0x0213B128
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4896
+
+[[entry_point]]
+addr = 0x0213B318
+mode = "arm"
+kind = "runtime_observed"
+# hits = 447
+
+[[entry_point]]
+addr = 0x0213B340
+mode = "arm"
+kind = "runtime_observed"
+# hits = 134
+
+[[entry_point]]
+addr = 0x0213B344
+mode = "arm"
+kind = "runtime_observed"
+# hits = 271
+
+[[entry_point]]
+addr = 0x0213B354
+mode = "arm"
+kind = "runtime_observed"
+# hits = 42
+
+[[entry_point]]
+addr = 0x0213B43C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10936
+
+[[entry_point]]
+addr = 0x0213B510
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5162
+
+[[entry_point]]
+addr = 0x0213B538
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213B53C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2038
+
+[[entry_point]]
+addr = 0x0213B54C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3123
+
+[[entry_point]]
+addr = 0x0213B750
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5176
+
+[[entry_point]]
+addr = 0x0213B774
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5793
+
+[[entry_point]]
+addr = 0x0213B78C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0213B790
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2361
+
+[[entry_point]]
+addr = 0x0213B7A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3429
+
+[[entry_point]]
+addr = 0x0213B96C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11251
+
+[[entry_point]]
+addr = 0x0213BCCC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3418
+
+[[entry_point]]
+addr = 0x0213BE04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1398
+
+[[entry_point]]
+addr = 0x0213BE6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3425
+
+[[entry_point]]
+addr = 0x0213BEB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11383
+
+[[entry_point]]
+addr = 0x0213BEC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1327
+
+[[entry_point]]
+addr = 0x0213BEE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4527
+
+[[entry_point]]
+addr = 0x0213BFF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x0213C024
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10711
+
+[[entry_point]]
+addr = 0x0213C178
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0213C18C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0213C198
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3200
+
+[[entry_point]]
+addr = 0x0213C328
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5828
+
+[[entry_point]]
+addr = 0x0213C34C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5942
+
+[[entry_point]]
+addr = 0x0213C3D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3404
+
+[[entry_point]]
+addr = 0x0213C3E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 397
+
+[[entry_point]]
+addr = 0x0213C400
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4057
+
+[[entry_point]]
+addr = 0x0213C41C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4057
+
+[[entry_point]]
+addr = 0x0213C468
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22513
+
+[[entry_point]]
+addr = 0x0213C484
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22704
+
+[[entry_point]]
+addr = 0x0213C504
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2826
+
+[[entry_point]]
+addr = 0x0213C954
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11569
+
+[[entry_point]]
+addr = 0x0213C960
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213C970
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18213
+
+[[entry_point]]
+addr = 0x0213C980
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8798
+
+[[entry_point]]
+addr = 0x0213C9A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18960
+
+[[entry_point]]
+addr = 0x0213CA48
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2556
+
+[[entry_point]]
+addr = 0x0213CA64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6400
+
+[[entry_point]]
+addr = 0x0213CAAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213CC10
+mode = "arm"
+kind = "runtime_observed"
+# hits = 916
+
+[[entry_point]]
+addr = 0x0213CC7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4973
+
+[[entry_point]]
+addr = 0x0213CCBC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0213CCC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 70382
+
+[[entry_point]]
+addr = 0x0213CCE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0213D6B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 43
+
+[[entry_point]]
+addr = 0x0213DE84
+mode = "arm"
+kind = "runtime_observed"
+# hits = 53485
+
+[[entry_point]]
+addr = 0x0213DE88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16854
+
+[[entry_point]]
+addr = 0x0213DF58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18764
+
+[[entry_point]]
+addr = 0x0213DFB8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4624
+
+[[entry_point]]
+addr = 0x0213E014
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13752
+
+[[entry_point]]
+addr = 0x0213E06C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13752
+
+[[entry_point]]
+addr = 0x0213E114
+mode = "arm"
+kind = "runtime_observed"
+# hits = 268
+
+[[entry_point]]
+addr = 0x0213E1EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 65460
+
+[[entry_point]]
+addr = 0x0213E230
+mode = "arm"
+kind = "runtime_observed"
+# hits = 306136
+
+[[entry_point]]
+addr = 0x0213E234
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213E24C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15664
+
+[[entry_point]]
+addr = 0x0213E370
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15664
+
+[[entry_point]]
+addr = 0x0213E52C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15664
+
+[[entry_point]]
+addr = 0x0213E548
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2167
+
+[[entry_point]]
+addr = 0x0213E58C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18722
+
+[[entry_point]]
+addr = 0x0213E5A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213E6FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24
+
+[[entry_point]]
+addr = 0x0213E768
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7124
+
+[[entry_point]]
+addr = 0x0213E7D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 180
+
+[[entry_point]]
+addr = 0x0213E894
+mode = "arm"
+kind = "runtime_observed"
+# hits = 42701
+
+[[entry_point]]
+addr = 0x0213E8A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x0213E8DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0213E90C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 786
+
+[[entry_point]]
+addr = 0x0213E91C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12215
+
+[[entry_point]]
+addr = 0x0213E960
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213E984
+mode = "arm"
+kind = "runtime_observed"
+# hits = 31
+
+[[entry_point]]
+addr = 0x0213E998
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0213EA8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213EAB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 93535
+
+[[entry_point]]
+addr = 0x0213EACC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 69
+
+[[entry_point]]
+addr = 0x0213ED80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0213ED98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0213EDB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0213EE8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 96819
+
+[[entry_point]]
+addr = 0x0213EEA4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 377150
+
+[[entry_point]]
+addr = 0x0213EEE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x0213EF6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 169
+
+[[entry_point]]
+addr = 0x0213F44C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0213F4D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12076
+
+[[entry_point]]
+addr = 0x0213F4F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213F7A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11285
+
+[[entry_point]]
+addr = 0x0213F9C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12389
+
+[[entry_point]]
+addr = 0x0213FE98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0213FF58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8841
+
+[[entry_point]]
+addr = 0x02140168
+mode = "arm"
+kind = "runtime_observed"
+# hits = 163
+
+[[entry_point]]
+addr = 0x02140240
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12116
+
+[[entry_point]]
+addr = 0x0214029C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02140500
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12117
+
+[[entry_point]]
+addr = 0x021406EC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02140704
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6049
+
+[[entry_point]]
+addr = 0x021407D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12124
+
+[[entry_point]]
+addr = 0x0214081C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02140834
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0214089C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10
+
+[[entry_point]]
+addr = 0x021408AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02140D0C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02140D18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5862
+
+[[entry_point]]
+addr = 0x02140D34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12102
+
+[[entry_point]]
+addr = 0x02140D98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 776
+
+[[entry_point]]
+addr = 0x02140E74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02141050
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x02141114
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5597
+
+[[entry_point]]
+addr = 0x0214144C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 268
+
+[[entry_point]]
+addr = 0x021414C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12117
+
+[[entry_point]]
+addr = 0x021414E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x021414FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02141548
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14055
+
+[[entry_point]]
+addr = 0x0214180C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 120664
+
+[[entry_point]]
+addr = 0x021418A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 241286
+
+[[entry_point]]
+addr = 0x02141964
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02141984
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02141A30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 270
+
+[[entry_point]]
+addr = 0x02141A58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 120664
+
+[[entry_point]]
+addr = 0x02141BFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5118
+
+[[entry_point]]
+addr = 0x02141EC0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1320
+
+[[entry_point]]
+addr = 0x02141EFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 217
+
+[[entry_point]]
+addr = 0x02141F28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8295
+
+[[entry_point]]
+addr = 0x02142258
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x021423AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11385
+
+[[entry_point]]
+addr = 0x0214253C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12117
+
+[[entry_point]]
+addr = 0x021425F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 43
+
+[[entry_point]]
+addr = 0x0214266C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 38259
+
+[[entry_point]]
+addr = 0x021427A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 38259
+
+[[entry_point]]
+addr = 0x02142AAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02142B18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9323
+
+[[entry_point]]
+addr = 0x02142B68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02142BC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 34744
+
+[[entry_point]]
+addr = 0x02142BCC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 69488
+
+[[entry_point]]
+addr = 0x02142BE8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 137474
+
+[[entry_point]]
+addr = 0x02142C4C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3390
+
+[[entry_point]]
+addr = 0x02142C68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 954
+
+[[entry_point]]
+addr = 0x02142C6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1436
+
+[[entry_point]]
+addr = 0x02142C70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 184
+
+[[entry_point]]
+addr = 0x02142C80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 816
+
+[[entry_point]]
+addr = 0x02142E80
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5040
+
+[[entry_point]]
+addr = 0x02142ED4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1159
+
+[[entry_point]]
+addr = 0x02142ED8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1669
+
+[[entry_point]]
+addr = 0x02142EDC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1080
+
+[[entry_point]]
+addr = 0x02142EEC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1132
+
+[[entry_point]]
+addr = 0x02143C28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 37
+
+[[entry_point]]
+addr = 0x02143FC8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9323
+
+[[entry_point]]
+addr = 0x02144AB0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02144B78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9323
+
+[[entry_point]]
+addr = 0x02144C4C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02144FE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1651
+
+[[entry_point]]
+addr = 0x02145054
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1537
+
+[[entry_point]]
+addr = 0x021451C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1523
+
+[[entry_point]]
+addr = 0x02145368
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02145718
+mode = "arm"
+kind = "runtime_observed"
+# hits = 732
+
+[[entry_point]]
+addr = 0x0214571C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 790
+
+[[entry_point]]
+addr = 0x0214659C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 790
+
+[[entry_point]]
+addr = 0x02146604
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02146608
+mode = "arm"
+kind = "runtime_observed"
+# hits = 57
+
+[[entry_point]]
+addr = 0x02146620
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15
+
+[[entry_point]]
+addr = 0x02146630
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02146638
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
+
+[[entry_point]]
+addr = 0x0214663C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02146658
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x0214665C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 46
+
+[[entry_point]]
+addr = 0x02146660
+mode = "arm"
+kind = "runtime_observed"
+# hits = 11
+
+[[entry_point]]
+addr = 0x02146664
+mode = "arm"
+kind = "runtime_observed"
+# hits = 42
+
+[[entry_point]]
+addr = 0x02146668
+mode = "arm"
+kind = "runtime_observed"
+# hits = 34
+
+[[entry_point]]
+addr = 0x02146670
+mode = "arm"
+kind = "runtime_observed"
+# hits = 30
+
+[[entry_point]]
+addr = 0x02146680
+mode = "arm"
+kind = "runtime_observed"
+# hits = 51
+
+[[entry_point]]
+addr = 0x02146684
+mode = "arm"
+kind = "runtime_observed"
+# hits = 40
+
+[[entry_point]]
+addr = 0x021466B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021466BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 7
+
+[[entry_point]]
+addr = 0x021466D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 101
+
+[[entry_point]]
+addr = 0x021466D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 92
+
+[[entry_point]]
+addr = 0x0214672C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x02146730
+mode = "arm"
+kind = "runtime_observed"
+# hits = 38
+
+[[entry_point]]
+addr = 0x02146768
+mode = "arm"
+kind = "runtime_observed"
+# hits = 49
+
+[[entry_point]]
+addr = 0x02146794
+mode = "arm"
+kind = "runtime_observed"
+# hits = 31
+
+[[entry_point]]
+addr = 0x02146798
+mode = "arm"
+kind = "runtime_observed"
+# hits = 62
+
+[[entry_point]]
+addr = 0x0214679C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14
+
+[[entry_point]]
+addr = 0x021467A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 20
+
+[[entry_point]]
+addr = 0x021474C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 70382
+
+[[entry_point]]
+addr = 0x021474E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021474F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0214754C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x0214755C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x021475B0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1523
+
+[[entry_point]]
+addr = 0x02147654
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17105
+
+[[entry_point]]
+addr = 0x02147660
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x02147678
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17105
+
+[[entry_point]]
+addr = 0x021477D4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 35732
+
+[[entry_point]]
+addr = 0x021479BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 84734
+
+[[entry_point]]
+addr = 0x02147A8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23212
+
+[[entry_point]]
+addr = 0x02147DF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23212
+
+[[entry_point]]
+addr = 0x02147EF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x02147EFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17105
+
+[[entry_point]]
+addr = 0x02147F68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0214807C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 71905
+
+[[entry_point]]
+addr = 0x021480BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02148624
+mode = "arm"
+kind = "runtime_observed"
+# hits = 57
+
+[[entry_point]]
+addr = 0x021486AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17127
+
+[[entry_point]]
+addr = 0x02148C30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1339
+
+[[entry_point]]
+addr = 0x02148C64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 19
+
+[[entry_point]]
+addr = 0x02148C88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x02148C98
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18
+
+[[entry_point]]
+addr = 0x02148EA4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 70
+
+[[entry_point]]
+addr = 0x02148F18
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1571
+
+[[entry_point]]
+addr = 0x02149018
+mode = "arm"
+kind = "runtime_observed"
+# hits = 328
+
+[[entry_point]]
+addr = 0x02149030
+mode = "arm"
+kind = "runtime_observed"
+# hits = 100
+
+[[entry_point]]
+addr = 0x02149090
+mode = "arm"
+kind = "runtime_observed"
+# hits = 411
+
+[[entry_point]]
+addr = 0x021490A8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 161
+
+[[entry_point]]
+addr = 0x021490D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3572
+
+[[entry_point]]
+addr = 0x0214917C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 168
+
+[[entry_point]]
+addr = 0x021494D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 126
+
+[[entry_point]]
+addr = 0x0214957C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 303
+
+[[entry_point]]
+addr = 0x02149580
+mode = "arm"
+kind = "runtime_observed"
+# hits = 118
+
+[[entry_point]]
+addr = 0x02149590
+mode = "arm"
+kind = "runtime_observed"
+# hits = 26
+
+[[entry_point]]
+addr = 0x021495A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 103
+
+[[entry_point]]
+addr = 0x02149AD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 126
+
+[[entry_point]]
+addr = 0x02149AE0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 47
+
+[[entry_point]]
+addr = 0x02149AE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 39
+
+[[entry_point]]
+addr = 0x02149AF4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 40
+
+[[entry_point]]
+addr = 0x02149B50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 23040
+
+[[entry_point]]
+addr = 0x02149B5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6404
+
+[[entry_point]]
+addr = 0x02149B60
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5568
+
+[[entry_point]]
+addr = 0x02149B64
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5199
+
+[[entry_point]]
+addr = 0x02149B68
+mode = "arm"
+kind = "runtime_observed"
+# hits = 168
+
+[[entry_point]]
+addr = 0x02149B6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 168
+
+[[entry_point]]
+addr = 0x02149B70
+mode = "arm"
+kind = "runtime_observed"
+# hits = 168
+
+[[entry_point]]
+addr = 0x02149B74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5029
+
+[[entry_point]]
+addr = 0x02149B78
+mode = "arm"
+kind = "runtime_observed"
+# hits = 168
+
+[[entry_point]]
+addr = 0x02149B7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 168
+
+[[entry_point]]
+addr = 0x02149BD0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0214A390
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0214A400
+mode = "arm"
+kind = "runtime_observed"
+# hits = 144
+
+[[entry_point]]
+addr = 0x0214A548
+mode = "arm"
+kind = "runtime_observed"
+# hits = 84
+
+[[entry_point]]
+addr = 0x0214A5DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 132
+
+[[entry_point]]
+addr = 0x0214A650
+mode = "arm"
+kind = "runtime_observed"
+# hits = 264
+
+[[entry_point]]
+addr = 0x0214A72C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 144
+
+[[entry_point]]
+addr = 0x0214A7E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 252
+
+[[entry_point]]
+addr = 0x0214A90C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 686
+
+[[entry_point]]
+addr = 0x0214A95C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15225
+
+[[entry_point]]
+addr = 0x0214A978
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0214A9A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15225
+
+[[entry_point]]
+addr = 0x0214AB94
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2009
+
+[[entry_point]]
+addr = 0x0214AC50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 604
+
+[[entry_point]]
+addr = 0x0214ACF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 15225
+
+[[entry_point]]
+addr = 0x0214AF38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 40431
+
+[[entry_point]]
+addr = 0x0214AF54
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0214AF90
+mode = "arm"
+kind = "runtime_observed"
+# hits = 231
+
+[[entry_point]]
+addr = 0x0214B1BC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0214B3C4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0214B510
+mode = "arm"
+kind = "runtime_observed"
+# hits = 18825
+
+[[entry_point]]
+addr = 0x0214B620
+mode = "arm"
+kind = "runtime_observed"
+# hits = 17106
+
+[[entry_point]]
+addr = 0x0214B688
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0214B6A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 8
+
+[[entry_point]]
+addr = 0x0214B7A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 16
diff --git a/config/mph_arm9_ov010.toml b/config/mph_arm9_ov010.toml
new file mode 100644
index 0000000..6c090cd
--- /dev/null
+++ b/config/mph_arm9_ov010.toml
@@ -0,0 +1,142 @@
+# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.
+# Entry points are Tier-3 observations whose containing 4 KiB page was
+# byte-identical to this overlay's decompressed ROM image at the time it
+# executed, so every seed below is provably from THIS overlay generation
+# and not from one of the overlays sharing its address range.
+
+[program]
+name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay 10"
+id = "mph_amhe0_arm9_ov010"
+load_address = 0x0214C940
+size = 0x0001C1E0
+entry_pc = 0x0214E504
+authoritative_entry_points = false
+
+[identity]
+sha1 = "d22d5c9a22f870c62f13b2122d7d62a485f4a553"
+
+[[entry_point]]
+addr = 0x0214E504
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0214FC34
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02152608
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0215296C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 24
+
+[[entry_point]]
+addr = 0x021536F0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021537CC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 47506
+
+[[entry_point]]
+addr = 0x021549E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02154D30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02155698
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02156CAC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02158334
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0215AE04
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0215D5AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0215EEF8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021604DC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021620A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02162B5C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021645A0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02164E1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216577C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x02166198
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
diff --git a/config/mph_arm9_ov015.toml b/config/mph_arm9_ov015.toml
new file mode 100644
index 0000000..1d5ae36
--- /dev/null
+++ b/config/mph_arm9_ov015.toml
@@ -0,0 +1,550 @@
+# AUTO-GENERATED by tools/seed_overlay_from_coverage.py; do not commit.
+# Entry points are Tier-3 observations whose containing 4 KiB page was
+# byte-identical to this overlay's decompressed ROM image at the time it
+# executed, so every seed below is provably from THIS overlay generation
+# and not from one of the overlays sharing its address range.
+
+[program]
+name = "Metroid Prime Hunters (USA rev 0) ARM9 overlay 15"
+id = "mph_amhe0_arm9_ov015"
+load_address = 0x02168B20
+size = 0x00008FE0
+entry_pc = 0x0216933C
+authoritative_entry_points = false
+
+[identity]
+sha1 = "1c4f5ba3145dcba0a3fe2e02ff91e19f519d161e"
+
+[[entry_point]]
+addr = 0x0216933C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x021695C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3444
+
+[[entry_point]]
+addr = 0x021695E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x021696B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3412
+
+[[entry_point]]
+addr = 0x02169ED0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216A0B4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216A210
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216A6D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 13
+
+[[entry_point]]
+addr = 0x0216A9E4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 65787
+
+[[entry_point]]
+addr = 0x0216AAEC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216ACE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 65659
+
+[[entry_point]]
+addr = 0x0216AFC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216B524
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0216B528
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0216BA8C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216BB30
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0216BBC4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216BCBC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216BD28
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216BD74
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216BDD4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216BDF0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0216BE58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216BE88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 37
+
+[[entry_point]]
+addr = 0x0216BF6C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C000
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0216C004
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C008
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C00C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C010
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C018
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C044
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216C0AC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2976
+
+[[entry_point]]
+addr = 0x0216C218
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C250
+mode = "arm"
+kind = "runtime_observed"
+# hits = 22
+
+[[entry_point]]
+addr = 0x0216C254
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C258
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C25C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C260
+mode = "arm"
+kind = "runtime_observed"
+# hits = 12
+
+[[entry_point]]
+addr = 0x0216C268
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C34C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10332
+
+[[entry_point]]
+addr = 0x0216C3E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C4B8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C4C0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C4D0
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C4E8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10236
+
+[[entry_point]]
+addr = 0x0216C524
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216C528
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216C5FC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216C618
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C630
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216C75C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 9
+
+[[entry_point]]
+addr = 0x0216C804
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216C810
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C8A4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216C8D8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0216C924
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0216CA24
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216CA58
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CB50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216CB7C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216CC44
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CCFC
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CD38
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CD4C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216CD50
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216CD9C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216CEB4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 6
+
+[[entry_point]]
+addr = 0x0216D028
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D20C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D234
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10236
+
+[[entry_point]]
+addr = 0x0216D398
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D3F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D414
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216D878
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216DA88
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216E52C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216EDA8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2690
+
+[[entry_point]]
+addr = 0x0216F100
+mode = "arm"
+kind = "runtime_observed"
+# hits = 2
+
+[[entry_point]]
+addr = 0x0216F208
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216F41C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 5
+
+[[entry_point]]
+addr = 0x0216F59C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 3
+
+[[entry_point]]
+addr = 0x0216F5F8
+mode = "arm"
+kind = "runtime_observed"
+# hits = 14230
+
+[[entry_point]]
+addr = 0x0216F6F4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 4
+
+[[entry_point]]
+addr = 0x0216F914
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10236
+
+[[entry_point]]
+addr = 0x0216F994
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216FA1C
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10236
+
+[[entry_point]]
+addr = 0x0216FAE4
+mode = "arm"
+kind = "runtime_observed"
+# hits = 1
+
+[[entry_point]]
+addr = 0x0216FC40
+mode = "arm"
+kind = "runtime_observed"
+# hits = 10236
diff --git a/scenarios/multiplayer_battle_bots.json b/scenarios/multiplayer_battle_bots.json
index 3e72ed0..2a101e1 100644
--- a/scenarios/multiplayer_battle_bots.json
+++ b/scenarios/multiplayer_battle_bots.json
@@ -1,5 +1,5 @@
 {
-  "description": "Offline multiplayer: BATTLE on arena 1/9 (Combat Hall) against 3 bots, no peer DS required. Reaches real gameplay far faster than the Adventure route and is the deterministic content lever for overlay coverage -- change only the arena arrow taps to select a different arena. Verified coordinates: main-menu MULTIPLAYER touch (160,92); the nickname dialog takes two A presses; mode row touch y~80 (SINGLE-CARD x~50, MULTI-CARD x~128, WI-FI x~205); CREATE/JOIN row touch y~80 (CREATE x~50, JOIN x~128); game-mode grid top row touch y~58 (BATTLE x~50); arena screen shows ARENA n/9 with arrows at touch y~48 (left x~125, right x~232) and confirm at touch (222,173); hunter Samus at touch (27,132) then A; the waiting room offers ADD BOT at touch (222,173).",
+  "description": "Offline multiplayer BATTLE against bots -- no peer console required. This is the standard in-game measurement route: no navigation skill needed, and the arena is a menu-selected variable (Battle offers ARENA n/9), so swapping content is one pair of arrow taps. USE MULTI-CARD, NOT SINGLE-CARD: single-card play does not allow bots at all -- its slots read AVAILABLE and only accept peer consoles -- which is the most misleading thing about this flow. Coordinates, measured from captured frames: main-menu MULTIPLAYER (160,92) [ADVENTURE is (84,92)]; nickname dialog = two A presses; mode row y~80 (SINGLE-CARD x~50, MULTI-CARD x~128, WI-FI x~205); CREATE/JOIN row y~80 (CREATE x~50, JOIN x~128); game-mode grid top row y~58 (BATTLE x~50); arena arrows y~48 (left x~125, right x~232), confirm (222,173); hunter Samus (27,132) then A; waiting room ADD + at (222,173). START SEQUENCE -- what earlier attempts got wrong: after adding bots with ADD +, TAP THE GREEN CHECKBOX BESIDE EACH BOT to confirm it. Those checkboxes are per-slot CONFIRM controls, not a ready toggle and not a difficulty widget; confirming is what reveals a bot's star rating, which is why tapping one looked like a difficulty selector. Once every bot is confirmed a START BATTLE control becomes available -- TAP IT. The match starts by tapping an on-screen control, NOT via the START or A key; pressing those does nothing, which stalled every earlier automated attempt. The actions below stop after confirming the bots; the final START BATTLE tap coordinate still needs measuring from a captured frame.",
   "actions": [
     {
       "kind": "touch",
@@ -132,20 +132,34 @@
     },
     {
       "kind": "touch",
-      "x": 105,
+      "x": 222,
       "y": 133
     },
     {
       "kind": "wait",
-      "frames": 300
+      "frames": 180
+    },
+    {
+      "kind": "touch",
+      "x": 148,
+      "y": 60
     },
     {
       "kind": "wait",
-      "frames": 600
+      "frames": 180
+    },
+    {
+      "kind": "touch",
+      "x": 222,
+      "y": 60
     },
     {
       "kind": "wait",
-      "frames": 600
+      "frames": 300
+    },
+    {
+      "kind": "wait",
+      "frames": 300
     }
   ]
 }
\ No newline at end of file

From 905ffab20ecd0d9c3c1017fb757aec73c435a1ad Mon Sep 17 00:00:00 2001
From: Matthew Stanley <1379tech@gmail.com>
Date: Sun, 16 Aug 2026 23:06:43 -0700
Subject: [PATCH 11/23] tools: resume run_to_event when the round budget is
 exhausted

Reaching the title screen needs more than the 50M default max_rounds, so
the initial advance silently under-ran and every subsequent tap landed at
the wrong moment. Verified this was harness-side, not a build regression:
all three runner builds stop at exactly vblank 6461.

beads-yjp.31

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 tools/mph_overlay_route.py | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/tools/mph_overlay_route.py b/tools/mph_overlay_route.py
index 13dc2d1..05a7ce4 100644
--- a/tools/mph_overlay_route.py
+++ b/tools/mph_overlay_route.py
@@ -53,14 +53,30 @@ def cmd(self, name: str, **args: object) -> dict:
     def vblank(self) -> int:
         return int(self.cmd("event_counts")["vblank9"])
 
+    def advance_to(self, target: int) -> None:
+        """Advance to an absolute vblank, resuming when the round budget runs out.
+
+        run_to_event caps at max_rounds and returns exhausted=True having gone
+        only part way -- reaching the title screen alone needs more than the
+        50M default. Not resuming silently under-ran every route: the boot
+        stopped at vblank 6461 instead of 7800 and every subsequent tap landed
+        at the wrong moment, which looked exactly like a regression in the
+        build under test. It was not; all builds stop at the same vblank.
+        """
+        for _ in range(200):
+            reply = self.cmd("run_to_event", event="vblank9", count=target,
+                             max_rounds=50_000_000)
+            if reply.get("terminal"):
+                raise RuntimeError(f"runner halted: {reply.get('reason9')} / "
+                                   f"{reply.get('reason7')}")
+            if reply.get("stalled"):
+                raise RuntimeError(f"stalled before vblank9 {target}")
+            if self.vblank() >= target:
+                return
+        raise RuntimeError(f"could not reach vblank9 {target}")
+
     def advance(self, frames: int) -> None:
-        target = self.vblank() + frames
-        reply = self.cmd("run_to_event", event="vblank9", count=target)
-        if reply.get("terminal"):
-            raise RuntimeError(f"runner halted: {reply.get('reason9')} / "
-                               f"{reply.get('reason7')}")
-        if reply.get("stalled"):
-            raise RuntimeError(f"stalled before vblank9 {target}")
+        self.advance_to(self.vblank() + frames)
 
     def tap(self, x: int, y: int, hold: int) -> None:
         self.cmd("touch", x=x, y=y, down=True)
@@ -138,7 +154,7 @@ def main() -> int:
 
         client.cmd("reset")
         target = args.start_vblank
-        client.cmd("run_to_event", event="vblank9", count=target)
+        client.advance_to(target)
         if not args.no_shots:
             client.screenshot(args.out / f"0000-{target:05d}-title.png")
         client.tap(128, 96, args.hold_frames)

From b926c5ff21954119a8515a8d8fac3ee27204489a Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:20:25 +0900
Subject: [PATCH 12/23] Make game.toml runtime-generic

---
 game.toml | 46 ++++++++--------------------------------------
 1 file changed, 8 insertions(+), 38 deletions(-)

diff --git a/game.toml b/game.toml
index 1d99a24..8a5e338 100644
--- a/game.toml
+++ b/game.toml
@@ -1,17 +1,9 @@
 [game]
 name = "Metroid Prime Hunters"
-id = "AMHE"
-region = "USA"
-revision = 0
-status = "ROM-gated main banks enter Celestial Archives gameplay with interpreter fallback"
-rom = "Metroid Prime Hunters.nds"
-rom_size = 0x04000000
-sha1 = "90164d1ac127ee5f9815ea4ae7de798c7b5fc629"
-sha256 = "7d0a98ff98e1b7c985d1f3d89b01730af1b2115061a4dfea847612d217a8b855"
+status = "Generic multi-ROM runtime config; ROM version is selected by the executable-compatible runtime detector"
 
 [display]
-# Prime Hunters uses both screens heavily. Keep them independently presentable
-# from the beginning, matching the established SM64DS host layout.
+# Prime Hunters uses both screens heavily. Keep them independently presentable.
 screen_layout = "separate"
 supersampling = 1
 antialiasing = 0
@@ -19,47 +11,25 @@ antialiasing = 0
 # The shared host-side adaptive renderer expands only the upper 3D viewport to
 # 21:9. The lower touchscreen remains native 256x192 and independently
 # clickable. Runtime executable compatibility, not whole-ROM SHA-1, gates the
-# title-owned projection/culling patch.
+# title-owned projection/culling patch for all supported revisions.
 adaptive_widescreen = "top"
 adaptive_capability = "top"
 adaptive_width = 448
-# SM64DS needs a cylindrical-sky repair heuristic. Prime Hunters does not opt
-# into that title-specific treatment; uncovered geometry remains visible
-# during the MPH projection/culling audit.
 adaptive_skybox_fill = false
-# Gameplay enables three transparent text-tile planes for the visor and HUD.
-# Anchor their authored left/center/right bands over the widened 3D world
-# instead of falling back to a pillarboxed native composite.
 adaptive_hud_anchor = true
-# MPH's centered location banner and energy assembly are wider than the
-# framework's conservative 64-pixel default. Preserve source X=64..191 as one
-# centered unit so text and bars never cross an anchor seam.
 adaptive_hud_center_width = 128
 
 [system]
-# Exercise the authentic BIOS/firmware/card path and automatically launch the
-# inserted cartridge after the normal firmware sequence.
+# The ROM-free launcher uses FreeBIOS/generated firmware with direct boot.
+# Other callers may override the boot path through CLI options.
 startup_mode = "automatic"
 
 [cartridge]
-# melonDS ROMList entry AMHE: SaveMemType 5 (256 KiB flash).
+# Metroid Prime Hunters uses the same 256 KiB flash save geometry across the
+# supported retail revisions.
 save_type = "flash"
 save_size = 262144
 
-[arm9]
-rom_offset = 0x00004000
-entry_pc = 0x02004800
-load_address = 0x02004000
-compressed_size = 0x0007e6c4
-decompressed_size = 0x000dd9d8
-overlay_count = 18
-
-[arm7]
-rom_offset = 0x0013aa00
-entry_pc = 0x02380000
-load_address = 0x02380000
-size = 0x00028464
-
 [framework]
 path = "../ndsrecomp"
 pin = "6c6a03bdcf99093f64555c4d05d16e522dc58634"
@@ -68,4 +38,4 @@ branch = "main"
 [reference.mphread]
 url = "https://github.com/NoneGiven/MphRead.git"
 pin = "26cd8a6fe93dc5e525d1a1bb304fe96001111e55"
-use = "AMHE0-aware gameplay, save, room/entity, model, animation, collision, audio, and file-format research"
+use = "MPH gameplay, save, room/entity, model, animation, collision, audio, and file-format research"

From a174aae8c5a0ed97fe18b41868cdc6f561569eca Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:20:53 +0900
Subject: [PATCH 13/23] Share generic game config across content profiles

---
 config/mph_rom_profiles.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/mph_rom_profiles.json b/config/mph_rom_profiles.json
index 838996a..169bc4e 100644
--- a/config/mph_rom_profiles.json
+++ b/config/mph_rom_profiles.json
@@ -146,7 +146,7 @@
       "sha1": "bdcd1dea293e24c98d4c481430e90d21198985a5",
       "program_id": "mph_amhp1",
       "coverage": "coverage/eu11-bootstrap-entry-points.json",
-      "game_config": "config/game-eu11.toml",
+      "game_config": "game.toml",
       "fmv_runtime": false,
       "fmv_runtime_bank": "mph_amhp1_arm9_fmv_runtime",
       "launcher_default_rom": "Metroid Prime Hunters (Europe Rev 1).nds",

From 9b220992e294445e39a8e96ff97210c603902177 Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:21:20 +0900
Subject: [PATCH 14/23] Validate shared generic frontend config

---
 tools/check_mph_multirom_profiles.py | 60 +++++++++++++++++++++-------
 1 file changed, 46 insertions(+), 14 deletions(-)

diff --git a/tools/check_mph_multirom_profiles.py b/tools/check_mph_multirom_profiles.py
index eee8dc5..d117b51 100755
--- a/tools/check_mph_multirom_profiles.py
+++ b/tools/check_mph_multirom_profiles.py
@@ -2,9 +2,9 @@
 """Validate the current multi-ROM schema, then run the legacy deep checks.
 
 The legacy checker predates the all-version Adaptive Widescreen address table
-and intentionally asserted EU1_1=false plus three runtime fields. Preserve its
-broad coverage on a compatibility view while validating the new scale fields
-against melonPrimeDS on the real registry.
+and the shared runtime-generic frontend config. Preserve its broad coverage on
+a temporary compatibility view while validating the current scale fields and
+generic config contract against the real registry.
 """
 
 from __future__ import annotations
@@ -66,15 +66,27 @@ def validate_scale_registry(repo: Path, table: Path | None) -> None:
     profiles = registry.get("profiles")
     if not isinstance(profiles, dict):
         die("content profiles missing")
+
+    # Runtime frontend policy is shared by every exact-content profile. Exact
+    # ROM SHA/header identity belongs in this registry and generated bank/cache
+    # provenance, not in one region-specific game TOML.
+    shared_config = repo / "game.toml"
+    if not shared_config.is_file():
+        die("shared runtime frontend config is missing: game.toml")
+    shared_text = shared_config.read_text(encoding="utf-8")
+    if 'adaptive_widescreen = "top"' not in shared_text or 'adaptive_capability = "top"' not in shared_text:
+        die("shared game.toml does not expose top-screen Adaptive Widescreen")
+    for forbidden in ("\nid =", "\nregion =", "\nrevision =", "\nrom =", "\nrom_size =", "\nsha1 ="):
+        if forbidden in shared_text:
+            die(f"shared game.toml still contains exact-content identity field: {forbidden.strip()}")
+
     for key, profile in profiles.items():
         if not isinstance(profile, dict):
             die(f"{key}: invalid content profile")
         if profile.get("adaptive_widescreen") is not True:
             die(f"{key}: Adaptive Widescreen must remain exposed for known content profiles")
-        config_path = repo / str(profile.get("game_config", ""))
-        text = config_path.read_text(encoding="utf-8")
-        if 'adaptive_widescreen = "top"' not in text or 'adaptive_capability = "top"' not in text:
-            die(f"{key}: game config does not expose top-screen Adaptive Widescreen")
+        if profile.get("game_config") != "game.toml":
+            die(f"{key}: content profiles must share the generic game.toml frontend config")
 
     if table:
         text = table.read_text(encoding="utf-8")
@@ -97,6 +109,7 @@ def validate_scale_registry(repo: Path, table: Path | None) -> None:
 
 
 def legacy_compat_view(repo: Path, destination: Path) -> Path:
+    """Synthesize the old per-profile config shape only for the legacy checker."""
     target = destination / "repo"
     shutil.copytree(
         repo, target,
@@ -108,13 +121,32 @@ def legacy_compat_view(repo: Path, destination: Path) -> Path:
         runtime = item["runtime"]
         for field in SCALE_FIELDS:
             runtime.pop(field, None)
-    registry["profiles"]["EU1_1"]["adaptive_widescreen"] = False
-    registry_path.write_text(json.dumps(registry, indent=2) + "\n", encoding="utf-8")
 
-    eu_config = target / "config" / "game-eu11.toml"
-    lines = eu_config.read_text(encoding="utf-8").splitlines()
-    lines = [line for line in lines if not line.startswith("adaptive_widescreen =")]
-    eu_config.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    # The old checker expects exact identity duplicated into each game config
+    # and also expects the historical EU1.1 widescreen-disable state. Generate
+    # those files only inside the temporary compatibility copy so production
+    # source keeps one generic game.toml.
+    for key, profile in registry["profiles"].items():
+        legacy_rel = f"config/.legacy-{key}.toml"
+        profile["game_config"] = legacy_rel
+        adaptive = profile.get("adaptive_widescreen") is True
+        if key == "EU1_1":
+            adaptive = False
+            profile["adaptive_widescreen"] = False
+        lines = [
+            "[game]",
+            f'id = "{profile["game_code"]}"',
+            f'revision = {profile["revision"]}',
+            f'rom_size = {profile["rom_size"]}',
+            f'sha1 = "{profile["sha1"]}"',
+            "",
+            "[display]",
+        ]
+        if adaptive:
+            lines.append('adaptive_widescreen = "top"')
+        (target / legacy_rel).write_text("\n".join(lines) + "\n", encoding="utf-8")
+
+    registry_path.write_text(json.dumps(registry, indent=2) + "\n", encoding="utf-8")
     return target
 
 
@@ -131,7 +163,7 @@ def main() -> None:
     with tempfile.TemporaryDirectory(prefix="mph-multirom-check-") as temp:
         compat = legacy_compat_view(repo, Path(temp))
         legacy.validate_registry(compat, table)
-    print("OK: Adaptive Widescreen address/capability checks passed for all seven MPH revisions")
+    print("OK: seven-version runtime tables and shared generic game.toml are consistent")
 
 
 if __name__ == "__main__":

From 9aea3fbb33d849a4c039a23a6959d863a9e03c92 Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:21:29 +0900
Subject: [PATCH 15/23] Remove obsolete EU1.1-specific game config

---
 config/game-eu11.toml | 34 ----------------------------------
 1 file changed, 34 deletions(-)
 delete mode 100644 config/game-eu11.toml

diff --git a/config/game-eu11.toml b/config/game-eu11.toml
deleted file mode 100644
index f1e62d5..0000000
--- a/config/game-eu11.toml
+++ /dev/null
@@ -1,34 +0,0 @@
-[game]
-name = "Metroid Prime Hunters"
-id = "AMHP"
-region = "Europe"
-revision = 1
-status = "EU1.1 bootstrap: ROM-header main banks with interpreter fallback"
-rom = "Metroid Prime Hunters (Europe Rev 1).nds"
-rom_size = 0x04000000
-sha1 = "bdcd1dea293e24c98d4c481430e90d21198985a5"
-
-[display]
-screen_layout = "separate"
-supersampling = 1
-antialiasing = 0
-# melonPrimeDS and mphCodex identify the revision-specific projection,
-# 3D-to-2D projection and Q12 culling-aspect locations for every retail MPH
-# revision. The runner applies those writes only after authoritative executable
-# checksum validation, so EU1.1 can expose the same 21:9 feature as US1.0.
-adaptive_widescreen = "top"
-adaptive_capability = "top"
-adaptive_width = 448
-adaptive_skybox_fill = false
-adaptive_hud_anchor = true
-adaptive_hud_center_width = 128
-
-[system]
-startup_mode = "automatic"
-
-[cartridge]
-# Metroid Prime Hunters uses the same 256 KiB flash save geometry across the
-# retail revisions tracked by the project. Keep this game-owned rather than a
-# shared-runner default.
-save_type = "flash"
-save_size = 262144

From bd2fed348827b5ca1e2d92d40a6a8c3a1bb83688 Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:32:30 +0900
Subject: [PATCH 16/23] Update multi-ROM bring-up notes for latest upstream
 sync

---
 docs/EU1_1_BRINGUP.md | 105 ++++++++++++++++++++++++------------------
 1 file changed, 61 insertions(+), 44 deletions(-)

diff --git a/docs/EU1_1_BRINGUP.md b/docs/EU1_1_BRINGUP.md
index 0871764..fc36f3c 100644
--- a/docs/EU1_1_BRINGUP.md
+++ b/docs/EU1_1_BRINGUP.md
@@ -2,9 +2,9 @@
 
 This document describes the current multi-ROM architecture in this branch.
 It supersedes the earlier whole-ROM-SHA-1-driven runtime-profile design and
-includes the upstream Wi-Fi firmware-state persistence work integrated from
-`mstan/MetroidPrimeHuntersRecomp` commit
-`5abcfee6187d572e752985ede2364f165d62dd6a`.
+tracks upstream `mstan/MetroidPrimeHuntersRecomp` through commit
+`905ffab20ecd0d9c3c1017fb757aec73c435a1ad`. Upstream title-specific changes
+are integrated without restoring its US1.0-only runtime identity assumptions.
 
 ## 1. Status
 
@@ -25,14 +25,17 @@ Adaptive Widescreen is also statically address-mapped for all seven base
 revisions. It is no longer hidden for EU1.1. Actual guest code/data writes are
 still fail-closed and require an authoritative executable checksum.
 
-Exact build/capture content profiles currently exist for:
+The ROM-free generic runner can execute supported revisions through the
+reference/Tier-3 path without a revision-specific native title bank. Exact
+build/capture profiles are still useful for optimized AOT/JIT/cache provenance.
+Current exact content profiles are:
 
 - `US1_0` clean retail ROM
 - `EU1_1` clean retail ROM
 
-The other retail revisions and individual modified ROMs still require their own
-exact-content build/capture profile, coverage and generated artifacts before
-they can be called fully supported.
+The other retail revisions and individual modified ROMs can run through the
+runtime detector, but still need their own exact-content optimization coverage
+before a content-specific native cache/bank can be reused safely.
 
 ## 2. Sources of truth
 
@@ -108,6 +111,7 @@ Whole-ROM SHA-1 identifies the exact content used to generate or validate:
 - runtime coverage
 - checkpoints
 - FMV/runtime captures
+- future persistent optimization caches
 
 This identity is not the runtime-address selector.
 
@@ -217,12 +221,13 @@ Canonical clean profiles reserve the seven base keys. Example:
   "known_clean": true,
   "game_code": "AMHE",
   "revision": 0,
-  "sha1": "...exact clean whole-ROM SHA-1..."
+  "sha1": "...exact clean whole-ROM SHA-1...",
+  "game_config": "game.toml"
 }
 ```
 
 A future exact mod profile must use a distinct key and reference the compatible
-base layout:
+base layout. Frontend policy remains the shared runtime-generic `game.toml`:
 
 ```json
 "US1_0_LAST_RAVEN": {
@@ -233,7 +238,7 @@ base layout:
   "sha1": "...exact Last Raven whole-ROM SHA-1...",
   "program_id": "mph_amhe0_last_raven",
   "coverage": "coverage/last-raven-entry-points.json",
-  "game_config": "config/game-last-raven.toml",
+  "game_config": "game.toml",
   "fmv_runtime": false,
   "fmv_runtime_bank": "mph_amhe0_last_raven_arm9_fmv_runtime",
   "launcher_default_rom": "Metroid Prime Hunters - Last Raven.nds",
@@ -256,6 +261,7 @@ Current clean EU1.1 profile:
 - revision: `1`
 - whole-ROM SHA-1: `bdcd1dea293e24c98d4c481430e90d21198985a5`
 - default launcher ROM: `Metroid Prime Hunters (Europe Rev 1).nds`
+- shared frontend config: `game.toml`
 - Adaptive Widescreen: exposed and revision-aware
 - FMV runtime bank: disabled until an EU1.1-specific capture is validated
 
@@ -267,12 +273,21 @@ Reserved EU1.1 runtime bank identity:
 
 No US1.0 FMV runtime capture is reused for EU1.1.
 
-## 9. Upstream Wi-Fi firmware-state persistence
+## 9. Latest upstream launcher / Wi-Fi integration
 
-The branch integrates the upstream `5abcfee` Wi-Fi persistence behavior while
-preserving the multi-ROM launcher generation and SHA policy.
+The branch tracks upstream title changes through `905ffab` while preserving the
+multi-ROM launcher generation and runtime detector.
 
-The launcher now assigns mutable firmware state under:
+Relevant upstream additions now carried here include:
+
+- persistent mutable firmware/WFC state from `5abcfee`
+- local WFC peer routing support through ndsrecomp `302404ad...`
+- friend-match QA continuation from `1932f6`
+- persisted user-selected ROM path from `413c61`
+- offline multiplayer/bot coverage tooling and overlay-generation utilities
+- the `run_to_event` exhaustion fix in `905ffab`
+
+The launcher assigns mutable firmware state under:
 
 `%APPDATA%\MetroidPrimeHuntersRecomp`
 
@@ -285,17 +300,19 @@ The selected state file is passed to the runner through
 `--firmware-state-path`. Wi-Fi settings, WFC updates and console/game-card
 pairing can therefore persist across normal launches and guest shutdowns.
 
-The dashboard console-MAC display prefers the persisted mutable firmware state
-after it exists, falling back to the generated installation identity on the
-first generated-firmware launch.
+The launcher also remembers the selected ROM path. A remembered ROM is offered
+on the next launch only if it still exists. The multi-ROM launcher-generation
+layer adds a further guard so a missing conventional ROM filename is never
+presented to recomp-ui as an already-selected cartridge.
 
-This required updating the pinned ndsrecomp revision to:
+The pinned ndsrecomp revision is now:
 
-`6c6a03bdcf99093f64555c4d05d16e522dc58634`
+`302404ada0929528b680fa6808aad253b425c7a2`
 
-The new upstream runner still contains old US1.0 SHA/address assumptions in its
-baseline source, so the local multi-ROM patch stack remains authoritative and
-replaces them during the build.
+That revision adds per-instance slirp/local WFC peer routing. The upstream
+runner still contains US1.0 assumptions in title-specific baseline code, so the
+local multi-ROM patch stack remains authoritative and replaces those assumptions
+during the build.
 
 ## 10. Preparing an exact content profile
 
@@ -323,7 +340,7 @@ python tools/prepare_mph.py \
 It then extracts ARM9, ARM7 and overlays and emits content-specific seed
 configs.
 
-## 11. Coverage and capture safety
+## 11. Coverage, overlays and capture safety
 
 Static and runtime promotion is profile/content aware.
 
@@ -338,6 +355,14 @@ not reused from US1.0 constants.
 FMV/runtime capture promotion verifies exact content provenance. A capture from
 one content SHA must not be promoted into another content profile.
 
+The latest upstream sync also carries validated US1.0 overlay seed configs for
+overlays `0, 1, 2, 3, 4, 8, 9, 10, 15`, plus
+`tools/seed_overlay_from_coverage.py`, `tools/overlay_coverage_report.py` and
+`tools/mph_overlay_route.py`. These are **US1.0 exact-content optimization
+assets**, not runtime profiles and not generic multi-ROM banks. They must never
+be reused for another ROM content identity merely because that ROM shares the
+same runtime layout. The ROM-free Nightly still does not link these title banks.
+
 ## 12. CI and runtime safety tests
 
 CI downloads the current melonPrimeDS `develop_hud` detector/address table and
@@ -360,36 +385,28 @@ produce the canonical melonPrimeDS executable checksums. It verifies:
 - patched `title_patches.cpp`, `frontend.cpp` and `main.cpp` compile against the
   pinned runner
 - US1.0/EU1.1 launcher generation and exact-content ROM checkers compile
+- upstream launcher/tests and the imported overlay QA tools remain pinned to the
+  audited upstream title commit
 
-At the time of this update, `MPH Multi-ROM Static Checks` run #72 passes every
-main validation step.
-
-## 13. Remaining work for full multi-ROM support
+`MPH Multi-ROM Static Checks` #123 passed after the upstream `905ffab` / ndsrecomp
+`302404ad...` integration.
 
-The detector/address architecture is prepared for all seven base revisions, but
-full player-facing support still requires exact content work per ROM:
+## 13. Remaining optimization work
 
-1. add verified clean content profiles for US1.1, EU1.0, JP1.0, JP1.1 and KR1.0
-2. prepare/extract each exact ROM
-3. capture deterministic coverage and promote it under that exact SHA
-4. generate revision-specific ARM9/ARM7/overlay banks
-5. validate boot, Adventure, pause, save/load and multiplayer-menu paths
-6. validate Prime Controls, Direct Mouse Aim and Adaptive Widescreen semantics
-   on real execution
-7. compare checkpoints against reference/native execution
-8. capture revision-specific FMV runtime code only where interpreter fallback
-   needs optimization
-9. regression-test US1.0 after each new profile
+Runtime execution is available through the generic ROM-free runner, but
+content-specific native optimization remains separate work per exact ROM.
 
-For a modified ROM, additionally:
+For another retail revision or modified ROM:
 
-1. compute the exact whole-ROM SHA-1
+1. compute/record the exact whole-ROM SHA-1 for cache/provenance identity
 2. compute the melonPrimeDS-compatible header+ARM9+ARM7 CRC32
 3. determine and validate its runtime base layout
 4. if code-modified, register the executable checksum only after Aim/Morph/
    Widescreen address compatibility is established
-5. add a distinct content profile with `base_profile`
-6. generate/promote coverage and banks under that mod's exact content identity
+5. add a distinct exact content profile when persistent optimization artifacts
+   are required
+6. generate/promote coverage and banks/cache entries under that exact content
+   identity
 
 Do not guess an unknown mod as US1.0 simply because its filename, region or
 header resembles US1.0.

From d6914728d1db039a929169e1e3f4c57260bae02d Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:40:53 +0900
Subject: [PATCH 17/23] Fix generic config adaptive capability gate

---
 game.toml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/game.toml b/game.toml
index 4089e6b..ac25d18 100644
--- a/game.toml
+++ b/game.toml
@@ -13,7 +13,11 @@ antialiasing = 0
 # clickable. Runtime executable compatibility, not whole-ROM SHA-1, gates the
 # title-owned projection/culling patch for all supported revisions.
 adaptive_widescreen = "top"
-adaptive_capability = "top"
+# Do not declare display.adaptive_capability here. ndsrecomp intentionally
+# requires an exact game.sha1 for TOML-declared title capabilities. This shared
+# config has no exact content identity, so the MPH runtime patch grants TOP
+# capability only after the executable-compatible detector selects a supported
+# base profile. Unknown/header-only content remains fail-closed.
 adaptive_width = 448
 adaptive_skybox_fill = false
 adaptive_hud_anchor = true

From f4bf870ec75c437a441890a60ab32b7f19d22a8b Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:41:17 +0900
Subject: [PATCH 18/23] Grant adaptive capability after MPH runtime detection

---
 ...patch_ndsrecomp_mph_adaptive_capability.py | 66 +++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 tools/patch_ndsrecomp_mph_adaptive_capability.py

diff --git a/tools/patch_ndsrecomp_mph_adaptive_capability.py b/tools/patch_ndsrecomp_mph_adaptive_capability.py
new file mode 100644
index 0000000..9e811f0
--- /dev/null
+++ b/tools/patch_ndsrecomp_mph_adaptive_capability.py
@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""Grant MPH adaptive output capability after executable validation.
+
+The shared ROM-free game.toml intentionally has no exact [game].sha1 because
+runtime base selection supports all seven MPH revisions and compatible mods.
+ndsrecomp correctly rejects TOML-declared display.adaptive_capability without
+an exact SHA, so the generic config must not declare that capability itself.
+
+Instead, this patch runs after the MPH runtime detector/widescreen patch and
+marks TOP adaptive output as supported only when the detector has selected MPH
+and the executable checksum is authoritative enough to permit host code/data
+writes. Header-only fallback therefore remains fail-closed.
+"""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+
+MARKER = "MPH_MULTIROM_RUNTIME_ADAPTIVE_CAPABILITY"
+INSERT_BEFORE = "    // MPH_MULTIROM_WIDESCREEN_GATE: a header-only base-profile hint is\n"
+
+
+def patch(framework_root: Path) -> None:
+    main_cpp = framework_root / "runner" / "src" / "main.cpp"
+    if not main_cpp.is_file():
+        raise SystemExit(f"runner source missing: {main_cpp}")
+
+    text = main_cpp.read_text(encoding="utf-8")
+    if MARKER in text:
+        print("MPH runtime adaptive capability patch already applied")
+        return
+    if INSERT_BEFORE not in text:
+        raise SystemExit(
+            "Refusing to patch main.cpp: MPH widescreen gate marker was not found; "
+            "apply patch_ndsrecomp_mph_widescreen.py first"
+        )
+
+    block = (
+        "    // MPH_MULTIROM_RUNTIME_ADAPTIVE_CAPABILITY: the shared game.toml has\n"
+        "    // no exact SHA-1, so ndsrecomp cannot safely grant title capability\n"
+        "    // during config parsing. Grant TOP only after the executable-compatible\n"
+        "    // MPH detector has authorized host code/data access.\n"
+        "    if (nds_title_patches_mph_detected() &&\n"
+        "        nds_title_patches_mph_host_writes_compatible()) {\n"
+        "        frontend_options.adaptive_supported |= NDS_ADAPTIVE_TOP;\n"
+        "        frontend_options.adaptive_max_width[0] = 448;\n"
+        "    }\n"
+    )
+    main_cpp.write_text(text.replace(INSERT_BEFORE, block + INSERT_BEFORE, 1),
+                        encoding="utf-8")
+    print("Patched MPH adaptive capability to follow runtime executable validation")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--framework-root", type=Path, required=True)
+    # Kept for compatibility with the shared patch-stack argument list.
+    parser.add_argument("--profiles", type=Path, required=False)
+    args = parser.parse_args()
+    patch(args.framework_root.resolve())
+
+
+if __name__ == "__main__":
+    main()

From 5e2b053b4cd85f2a210a3dd4d3ad16d42660aa52 Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:41:26 +0900
Subject: [PATCH 19/23] Apply runtime adaptive capability patch

---
 tools/patch_ndsrecomp_mph_runtime.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/patch_ndsrecomp_mph_runtime.py b/tools/patch_ndsrecomp_mph_runtime.py
index 4034b1d..d858d33 100755
--- a/tools/patch_ndsrecomp_mph_runtime.py
+++ b/tools/patch_ndsrecomp_mph_runtime.py
@@ -3,7 +3,8 @@
 
 The core detector is kept separately so upstream-facing additions can be layered
 without weakening its whole-ROM/content identity rules. The later stages add
-the melonPrimeDS/mphCodex profile-aware 21:9 projection/culling patch, make
+the melonPrimeDS/mphCodex profile-aware 21:9 projection/culling patch, grant
+adaptive TOP capability only after authoritative MPH executable detection, make
 that patch re-eligible after an in-process guest reset, and finally add
 end-user startup diagnostics plus the ROM-free multi-ROM content-gate policy.
 """
@@ -21,6 +22,7 @@ def main() -> None:
     for script in (
         here / "patch_ndsrecomp_mph_runtime_core.py",
         here / "patch_ndsrecomp_mph_widescreen.py",
+        here / "patch_ndsrecomp_mph_adaptive_capability.py",
         here / "patch_ndsrecomp_mph_widescreen_reset.py",
         here / "patch_ndsrecomp_mph_diagnostics.py",
     ):

From b425f986095dfbc2d689749f53886d8528225227 Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:42:07 +0900
Subject: [PATCH 20/23] Smoke-test generic frontend config on Linux

---
 .github/workflows/build-linux.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index 2445098..769dfb9 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -105,6 +105,28 @@ jobs:
             exit 1
           fi
 
+      - name: Smoke-test generic frontend config
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/mph-generic-config-smoke
+          set +e
+          output="$(../ndsrecomp/runner/build-mph-nightly/nds_runner \
+            /tmp/mph-generic-config-smoke \
+            --rom /tmp/mph-generic-config-smoke/missing.nds \
+            --config "$PWD/game.toml" \
+            --freebios --generated-firmware --boot direct 2>&1)"
+          status=$?
+          set -e
+          printf '%s\n' "$output"
+          test "$status" -ne 0
+          if grep -q 'invalid frontend config' <<<"$output"; then
+            echo 'Generic game.toml was rejected by the runner frontend parser' >&2
+            exit 1
+          fi
+          grep -q 'cartridge image is missing or truncated' <<<"$output"
+          grep -q 'MPH_MULTIROM_RUNTIME_ADAPTIVE_CAPABILITY' \
+            ../ndsrecomp/runner/src/main.cpp
+
       - name: Install pinned AppImage packaging tools
         run: |
           set -euo pipefail

From 9b1159e8fe7aae6b5e3e845f875c60a590f83f29 Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:42:31 +0900
Subject: [PATCH 21/23] Smoke-test generic frontend config on Windows

---
 .github/workflows/build-windows.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index 8c32a16..07062a2 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -142,6 +142,29 @@ jobs:
             exit 1
           fi
 
+      - name: Smoke-test generic frontend config
+        shell: msys2 {0}
+        run: |
+          set -euo pipefail
+          mkdir -p .ci-generic-config-smoke
+          set +e
+          output="$(../ndsrecomp/runner/build-mph-nightly/nds_runner.exe \
+            "$PWD/.ci-generic-config-smoke" \
+            --rom "$PWD/.ci-generic-config-smoke/missing.nds" \
+            --config "$PWD/game.toml" \
+            --freebios --generated-firmware --boot direct 2>&1)"
+          status=$?
+          set -e
+          printf '%s\n' "$output"
+          test "$status" -ne 0
+          if grep -q 'invalid frontend config' <<<"$output"; then
+            echo 'Generic game.toml was rejected by the runner frontend parser' >&2
+            exit 1
+          fi
+          grep -q 'cartridge image is missing or truncated' <<<"$output"
+          grep -q 'MPH_MULTIROM_RUNTIME_ADAPTIVE_CAPABILITY' \
+            ../ndsrecomp/runner/src/main.cpp
+
       - name: Build and test launcher
         shell: msys2 {0}
         run: |

From 4baff5b8be2187c411d5b081a91b0092691915a7 Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:43:33 +0900
Subject: [PATCH 22/23] Validate runtime-granted adaptive capability

---
 tools/check_mph_multirom_profiles.py | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/tools/check_mph_multirom_profiles.py b/tools/check_mph_multirom_profiles.py
index d117b51..efaada2 100755
--- a/tools/check_mph_multirom_profiles.py
+++ b/tools/check_mph_multirom_profiles.py
@@ -74,8 +74,25 @@ def validate_scale_registry(repo: Path, table: Path | None) -> None:
     if not shared_config.is_file():
         die("shared runtime frontend config is missing: game.toml")
     shared_text = shared_config.read_text(encoding="utf-8")
-    if 'adaptive_widescreen = "top"' not in shared_text or 'adaptive_capability = "top"' not in shared_text:
-        die("shared game.toml does not expose top-screen Adaptive Widescreen")
+    if 'adaptive_widescreen = "top"' not in shared_text:
+        die("shared game.toml does not request top-screen Adaptive Widescreen")
+    # ndsrecomp deliberately requires an exact [game].sha1 when a TOML grants
+    # display.adaptive_capability. The generic seven-version config has no exact
+    # SHA, so capability must be granted later by the executable-compatible
+    # runtime detector instead of being declared here.
+    if 'adaptive_capability = "top"' in shared_text:
+        die("shared game.toml must not declare SHA-gated adaptive_capability")
+    capability_patch = repo / "tools" / "patch_ndsrecomp_mph_adaptive_capability.py"
+    if not capability_patch.is_file():
+        die("runtime adaptive capability patch is missing")
+    capability_text = capability_patch.read_text(encoding="utf-8")
+    for required in (
+        "nds_title_patches_mph_host_writes_compatible()",
+        "frontend_options.adaptive_supported |= NDS_ADAPTIVE_TOP",
+        "MPH_MULTIROM_RUNTIME_ADAPTIVE_CAPABILITY",
+    ):
+        if required not in capability_text:
+            die(f"runtime adaptive capability patch lost required guard: {required}")
     for forbidden in ("\nid =", "\nregion =", "\nrevision =", "\nrom =", "\nrom_size =", "\nsha1 ="):
         if forbidden in shared_text:
             die(f"shared game.toml still contains exact-content identity field: {forbidden.strip()}")

From cad67185955079f380ca6b4c309fffec1d0fe658 Mon Sep 17 00:00:00 2001
From: Zection6V <zection6vmph@gmail.com>
Date: Mon, 17 Aug 2026 18:43:47 +0900
Subject: [PATCH 23/23] Check adaptive capability patch syntax in CI

---
 .github/workflows/build.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ec8b778..f37332d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,6 +24,8 @@ jobs:
         run: |
           set -euo pipefail
           python -m py_compile \
+            tools/patch_ndsrecomp_mph_runtime.py \
+            tools/patch_ndsrecomp_mph_adaptive_capability.py \
             tools/patch_ndsrecomp_rom_free_release.py \
             tools/patch_recomp_ui_mph_multirom.py \
             tools/ci/check_rom_free_release_sources.py \