diff --git a/src/main.rs b/src/main.rs
index 4de3ed6..ac70189 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -79,6 +79,7 @@ fn run_dbg(path: &str) {
     let mut cpu = Cpu::new();
     cpu.reset(&mut bus);
     let mut dumper = dump::Dumper::new();
+    let mut renderer = PpmRenderer::new();          // <-- add this
     let frames: u32 = 360;
 
     for f in 0..frames {
@@ -87,8 +88,9 @@ fn run_dbg(path: &str) {
             bus.tick_ppu(cycles as u64);
             if bus.take_nmi() { cpu.set_nmi(); }
         }
+        renderer.present(bus.framebuffer(), 256, 240);   // <-- and this
         dumper.snapshot(f, &bus, &cpu);
         bus.begin_frame();
     }
-    println!("wrote debug_out/ (state.txt + pctrace.txt), {frames} frames");
+    println!("wrote debug_out/ + renders/, {frames} frames");
 }
\ No newline at end of file
diff --git a/src/ppu.rs b/src/ppu.rs
index 85e537c..ae51098 100644
--- a/src/ppu.rs
+++ b/src/ppu.rs
@@ -238,10 +238,10 @@ impl Ppu {
                 let addr = 0x23C0
                     | (self.vram_addr & 0x0C00)
                     | ((self.vram_addr >> 4) & 0x38)
-                    | (self.vram_addr & 0x07);
+                    | ((self.vram_addr >> 2) & 0x07);
                 let byte = self.nametable_read(cart, addr);
                 // select the 2 bits for this tile's 2x2 block
-                let shift = ((self.vram_addr & 0x20) >> 3) | ((self.vram_addr & 0x01) << 1);
+                let shift = ((self.vram_addr & 0x40) >> 4) | (self.vram_addr & 0x02);
                 self.attr_latch = (byte >> shift) & 0x03;
             }
             4 => {