How did SMB1/Duck Hunt spare the space for a reset stub on its GNROM-compatible mapper?
That said, I think I know how to do it. First, you'll need to expand the PRG ROM to 65536 bytes, with the 8 KiB banks rearranged into the following order:
$8000, $A000, $C000, blank, $6000, blank, blank, $E000
Find 12 bytes somewhere in $E000-$FFF9 for the following (move a subroutine to $6000+ if needed):
Code:
lda #8
sta $8000
lsr a
sta $A000
jmp $6000
Then at $6000 is code to copy a table to mapper registers:
Code:
entry6000:
sei
ldx #0
stx $2001
stx $2000
loop:
lda bankconfig,x
stx $8000
sta $A000
inx
cpx #14
bcc loop
jmp $8000 ; entry point of SMB1
bankconfig:
.byt 0, 1, 2, 3, 4, 5, 6, 7 ; CHR banks for $0000-$1C00
.byt 4, 0, 1, 2 ; PRG banks for $6000-$C000
.byt 0 ; mirroring
.byt 0 ; disable mapper IRQ
; The subroutine you moved for the 12-byte stub can be put here