Fascinating.

http://msx.hansotten.com/technical-info/tms9918/
The specific document being:
http://msx.hansotten.com/uploads/files/198x%20Super%20Pattern%20Graphics%20Mode%20(Mode%202).pdf

The simple routines I poke into memory and call:
4000: 2 writes to C0F1 to set an address, reading C0F1 first to make sure we reset the address register
It's a register write if the second byte has the hi byte set.
4014: same routine as 4000
It's an address write if the second byte has bit 6 set, bit 6 clear if just to read.
4028: write to C0F0, write DATA register
403C: read from C0F0, read DATA register
]CALL -151
*4000L
4000- AD F1 C0 LDA $C0F1
4003- A9 0F LDA #$0F
4005- 8D F1 C0 STA $C0F1
4008- A9 87 LDA #$87
400A- 8D F1 C0 STA $C0F1
400D- 60 RTS
400E- 00 BRK
400F- 00 BRK
4010- 00 BRK
4011- 00 BRK
4012- 00 BRK
4013- 00 BRK
4014- AD F1 C0 LDA $C0F1
4017- A9 00 LDA #$00
4019- 8D F1 C0 STA $C0F1
401C- A9 78 LDA #$78
401E- 8D F1 C0 STA $C0F1
4021- 60 RTS
4022- 00 BRK
4023- 00 BRK
*L
4024- 00 BRK
4025- 00 BRK
4026- 00 BRK
4027- 00 BRK
4028- A9 78 LDA #$78
402A- 8D F0 C0 STA $C0F0
402D- 60 RTS
402E- 00 BRK
402F- 00 BRK
4030- 00 BRK
4031- 00 BRK
4032- 00 BRK
4033- 00 BRK
4034- 00 BRK
4035- 00 BRK
4036- 00 BRK
4037- 00 BRK
4038- 00 BRK
4039- 00 BRK
403A- 00 BRK
*L
403B- 00 BRK
403C- AD C0 C0 LDA $C0C0
403F- 8D 4E 40 STA $404E
4042- 60 RTS
4043- 00 BRK
4044- 00 BRK
4045- 00 BRK
4046- 00 BRK
4047- 00 BRK
4048- 00 BRK
4049- 00 BRK
404A- 00 BRK
404B- 00 BRK
404C- 00 BRK
404D- 00 BRK
404E- 00 BRK
404F- 00 BRK
4050- 00 BRK
4051- 00 BRK
4052- 00 BRK
4030- A9 00 LDA #$00 4032- 8D C3 C0 STA $C0C3 4035- A9 40 LDA #$40 4037- 8D C3 C0 STA $C0C3 403A- A9 00 LDA #$00 403C- AA TAX 403D- 8A TXA 403E- 20 C1 FB JSR $FBC1 4041- A0 00 LDY #$00 4043- 48 PHA 4044- B1 28 LDA ($28),Y 4046- 8D C2 C0 STA $C0C2 4049- 68 PLA 404A- C8 INY 404B- C0 20 CPY #$20 404D- 30 F4 BMI $4043 404F- E8 INX 4050- E0 18 CPX #$18 4052- 30 E9 BMI $403D 4054- 60 RTS









