diff --git a/bad-apple/.cargo/config.toml b/bad-apple/.cargo/config.toml
new file mode 100644
index 0000000..6dfb735
--- /dev/null
+++ b/bad-apple/.cargo/config.toml
@@ -0,0 +1,8 @@
+[build]
+target = "riscv32i-unknown-none-elf"
+
+[target.riscv32i-unknown-none-elf]
+rustflags = [
+  "-C", "link-arg=-Tmemory.x",
+  "-C", "link-arg=-Tlink.x",
+]
diff --git a/bad-apple/.gitignore b/bad-apple/.gitignore
new file mode 100644
index 0000000..5ad8f69
--- /dev/null
+++ b/bad-apple/.gitignore
@@ -0,0 +1,3 @@
+/target
+text.bin
+rodata.bin
diff --git a/bad-apple/.vscode/settings.json b/bad-apple/.vscode/settings.json
new file mode 100644
index 0000000..1f30ed8
--- /dev/null
+++ b/bad-apple/.vscode/settings.json
@@ -0,0 +1,5 @@
+{
+    "rust-analyzer.check.allTargets": false,
+    "rust-analyzer.cargo.allTargets": false,
+    "rust-analyzer.cargo.target": "riscv32i-unknown-none-elf"
+}
diff --git a/bad-apple/Cargo.lock b/bad-apple/Cargo.lock
new file mode 100644
index 0000000..c948292
--- /dev/null
+++ b/bad-apple/Cargo.lock
@@ -0,0 +1,121 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "bad-apple"
+version = "0.1.0"
+dependencies = [
+ "lwcpu",
+ "riscv",
+ "riscv-rt",
+]
+
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "embedded-hal"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "361a90feb7004eca4019fb28352a9465666b24f840f5c3cddf0ff13920590b89"
+
+[[package]]
+name = "lwcpu"
+version = "0.1.0"
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "riscv"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ea8ff73d3720bdd0a97925f0bf79ad2744b6da8ff36be3840c48ac81191d7a7"
+dependencies = [
+ "critical-section",
+ "embedded-hal",
+ "paste",
+ "riscv-macros",
+ "riscv-pac",
+]
+
+[[package]]
+name = "riscv-macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f265be5d634272320a7de94cea15c22a3bfdd4eb42eb43edc528415f066a1f25"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "riscv-pac"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8188909339ccc0c68cfb5a04648313f09621e8b87dc03095454f1a11f6c5d436"
+
+[[package]]
+name = "riscv-rt"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "753f1bd7eb4e0003cec5e2fb60ea8e253a71d0b041bc7d1ba0fffe22e3c0294d"
+dependencies = [
+ "riscv",
+ "riscv-pac",
+ "riscv-rt-macros",
+]
+
+[[package]]
+name = "riscv-rt-macros"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30f19a85fe107b65031e0ba8ec60c34c2494069fe910d6c297f5e7cb5a6f76d0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c786062daee0d6db1132800e623df74274a0a87322d8e183338e01b3d98d058"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
diff --git a/bad-apple/Cargo.toml b/bad-apple/Cargo.toml
new file mode 100644
index 0000000..1e9b0b9
--- /dev/null
+++ b/bad-apple/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "bad-apple"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+riscv = "0.12.1"
+riscv-rt = { version = "0.13.0", features=["single-hart"] }
+lwcpu = { path = "../lwcpu" }
+
+# https://docs.rust-embedded.org/book/unsorted/speed-vs-size.html
+[profile.release]
+# symbols are nice and they don't increase the size on Flash
+debug = true
+codegen-units = 1
+opt-level = "z"
+
+[profile.dev.package."*"]
+codegen-units = 1
+opt-level = "z"
diff --git a/bad-apple/Makefile b/bad-apple/Makefile
new file mode 100644
index 0000000..ece420d
--- /dev/null
+++ b/bad-apple/Makefile
@@ -0,0 +1,20 @@
+NAME=bad-apple
+
+default: extract
+
+build:
+	cargo build --release
+
+extract: build
+	riscv32-elf-objcopy -O binary --only-section=.text "target/riscv32i-unknown-none-elf/release/${NAME}" /tmp/text.bin
+	riscv32-elf-objcopy -O binary --only-section=.rodata "target/riscv32i-unknown-none-elf/release/${NAME}" /tmp/rodata.bin
+
+size: extract
+	cargo size --release -- -A
+
+disassemble: extract
+	riscv32-elf-objdump -Cd "target/riscv32i-unknown-none-elf/release/${NAME}" | less
+
+clean:
+	cargo clean
+	rm /tmp/text.bin /tmp/rodata.bin
diff --git a/bad-apple/build.rs b/bad-apple/build.rs
new file mode 100644
index 0000000..c941735
--- /dev/null
+++ b/bad-apple/build.rs
@@ -0,0 +1,14 @@
+// build.rs
+use std::env;
+use std::fs;
+use std::path::PathBuf;
+
+fn main() {
+    let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
+
+    // Put the linker script somewhere the linker can find it.
+    fs::write(out_dir.join("memory.x"), include_bytes!("memory.x")).unwrap();
+    println!("cargo:rustc-link-search={}", out_dir.display());
+    println!("cargo:rerun-if-changed=memory.x");
+    println!("cargo:rerun-if-changed=build.rs");
+}
diff --git a/bad-apple/media/bad-apple.bin b/bad-apple/media/bad-apple.bin
new file mode 100644
index 0000000..69430ed
Binary files /dev/null and b/bad-apple/media/bad-apple.bin differ
diff --git a/bad-apple/memory.x b/bad-apple/memory.x
new file mode 100644
index 0000000..1c24f2c
--- /dev/null
+++ b/bad-apple/memory.x
@@ -0,0 +1,14 @@
+MEMORY
+{
+  INST  : ORIGIN = 0x00000000, LENGTH = 256K
+  IO    : ORIGIN = 0x10000000, LENGTH = 1K
+  CONST : ORIGIN = 0x20000000, LENGTH = 16K
+  RAM   : ORIGIN = 0x40000000, LENGTH = 16K
+}
+
+REGION_ALIAS("REGION_TEXT", INST);
+REGION_ALIAS("REGION_RODATA", CONST);
+REGION_ALIAS("REGION_DATA", RAM);
+REGION_ALIAS("REGION_BSS", RAM);
+REGION_ALIAS("REGION_HEAP", RAM);
+REGION_ALIAS("REGION_STACK", RAM);
diff --git a/bad-apple/src/main.rs b/bad-apple/src/main.rs
new file mode 100644
index 0000000..8a642ea
--- /dev/null
+++ b/bad-apple/src/main.rs
@@ -0,0 +1,47 @@
+#![no_std]
+#![no_main]
+
+use core::fmt::Write;
+use core::panic::PanicInfo;
+use lwcpu::{Audio, CharDisplay, NumberDisplay, Screen, ScreenMode};
+use riscv_rt::entry;
+
+#[panic_handler]
+fn panic_handler(_info: &PanicInfo) -> ! {
+    NumberDisplay::display_number(0xDEADC0DE);
+    let mut text = CharDisplay {};
+    let _ = write!(text, "Panic: {}", _info.message());
+    loop {}
+}
+
+const DATA_RAW: &[u8] = include_bytes!("../media/bad-apple.bin");
+const LEN: usize = DATA_RAW.len() / 4;
+const DATA: [u32; LEN] = to_u32_array(DATA_RAW);
+
+const fn to_u32_array(bytes: &[u8]) -> [u32; LEN] {
+    let mut result = [0u32; LEN];
+    let mut i = 0;
+    while i < LEN {
+        let idx = i * 4;
+        result[i] = u32::from_le_bytes([
+            bytes[idx + 0],
+            bytes[idx + 1],
+            bytes[idx + 2],
+            bytes[idx + 3],
+        ]);
+        i += 1;
+    }
+    return result;
+}
+
+#[entry]
+fn main() -> ! {
+    NumberDisplay::display_number(0);
+    Screen::init(ScreenMode::Buffered);
+    for index in (0..LEN).step_by(2) {
+        Audio::play_upper(DATA[index]);
+        Audio::play_lower(DATA[index + 1]);
+    }
+    Audio::stop();
+    loop {}
+}
diff --git a/lwcpu/src/lib.rs b/lwcpu/src/lib.rs
index 49bdacf..9a97b27 100644
--- a/lwcpu/src/lib.rs
+++ b/lwcpu/src/lib.rs
@@ -11,6 +11,7 @@ pub const KEYBOARD_OFFSET        : u32 = 0x10;
 pub const CHAR_CONTROL_OFFSET    : u32 = 0x20;
 pub const SCREEN_CONTROL_OFFSET  : u32 = 0x22;
 pub const CHAR_DISPLAY_OFFSET    : u32 = 0x24;
+pub const AUDIO_MAIN_OFFSET      : u32 = 0x30;
 pub const SCREEN_OFFSET          : u32 = 0x80;
 
 pub const NUMBER_DISPLAY_POINTER : *mut u32 = (BASE_POINTER + NUMBER_DISPLAY_OFFSET) as *mut u32;
@@ -20,6 +21,7 @@ pub const CHAR_DISPLAY_POINTER   : *mut u8  = (BASE_POINTER + CHAR_DISPLAY_OFFSE
 pub const KEYBOARD_POINTER       : *mut u32 = (BASE_POINTER + KEYBOARD_OFFSET)       as *mut u32;
 pub const SCREEN_CONTROL_POINTER : *mut u16 = (BASE_POINTER + SCREEN_CONTROL_OFFSET) as *mut u16;
 pub const CHAR_CONTROL_POINTER   : *mut u16 = (BASE_POINTER + CHAR_CONTROL_OFFSET)   as *mut u16;
+pub const AUDIO_MAIN_POINTER     : *mut u32 = (BASE_POINTER + AUDIO_MAIN_OFFSET)     as *mut u32;
 pub const SCREEN_POINTER         : *mut u32 = (BASE_POINTER + SCREEN_OFFSET)         as *mut u32;
 
 
@@ -181,3 +183,27 @@ impl Buttons {
         return unsafe { read_volatile(BUTTONS_POINTER.byte_offset(3)) };
     }
 }
+
+pub struct Audio {}
+impl Audio {
+    #[inline]
+    pub fn play_upper(notes: u32) {
+        unsafe {
+            write_volatile(AUDIO_MAIN_POINTER, notes);
+        }
+    }
+    #[inline]
+    pub fn play_lower(notes: u32) {
+        unsafe {
+            write_volatile(AUDIO_MAIN_POINTER.offset(1), notes);
+        }
+    }
+    #[inline]
+    pub fn stop() {
+        unsafe {
+            write_volatile(AUDIO_MAIN_POINTER.offset(0), 0);
+            write_volatile(AUDIO_MAIN_POINTER.offset(1), 0);
+        }
+    }
+
+}