romhacking.txt 43 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128
  1. "THE ROM HACKERS BIBLE v0.2"
  2. By SeRiAlKLR
  3. <SeRiAlKLR@usa.net>
  4. RomHackers Inc. (c) 1997
  5. ¸,.�¬=椺²°`¯ ¯`°²º¤æ=- The Rom Hackers Bible -=椺²°`¯ ¯`°²º¤æ=¬�.,¸
  6. TABLE OF CONTENTS
  7. I. Introduction
  8. 1. Preface
  9. 2. Introduction
  10. 3. Disclaimer
  11. II. Tools
  12. A) Nes Tools
  13. 1. NESticle
  14. 2. Hex editor
  15. 3. Xchar v1
  16. 4. Xlate v1
  17. 5. Romhack
  18. B) Snes Tools
  19. 1. Ctool
  20. 2. Kill Them
  21. 3. SnesTool
  22. 4. Xchar v2
  23. 5. Xlate v2
  24. 6. CartDisk
  25. 7.RipGrfx
  26. III. The process
  27. 1. The ROM
  28. 2. Changing graphics
  29. 3. Changing text
  30. IV. The Nintendo
  31. 1. General Architecture
  32. 2. Interrupts
  33. 3. I/O Ports
  34. 4. PPU Memory
  35. 5. Hit/VBlank Bits
  36. 6. Joysticks
  37. 7. Sprites
  38. 8. Memory Mappers
  39. a) Sequential
  40. b) Konami
  41. c) VROM Switch
  42. d) 5202 Chip
  43. e) Others
  44. V. Sample walkthrough
  45. VI. The Big Credits and Thanks section!!
  46. ¸,.�¬=椺²°`¯ ¯`°²º¤æ=- Section I. -=椺²°`¯ ¯`°²º¤æ=¬�.,¸
  47. I. Introduction
  48. ---------------
  49. A. Preface
  50. This document was written due to the general lack of thourough
  51. rom hacking documents. Although there are a few available they arent as
  52. thourough as I needed. Therefore I wrote this to help all "would be"
  53. rom hackers. I also copied extracts of various text on certain
  54. tools, and I added credit to the author's when due, all other text is by
  55. me and I hope you find this useful. Also I will not cover pasofami hacking
  56. due to the fact that ines format is more popular.
  57. B. Introduction
  58. Hacking a ROM in its simplest form is easy. It does, even then,
  59. require alot of time depending on the complexity of the hack you are
  60. doing. For the truly daring you can even learn how to hack the rom
  61. completely, by this I mean "change the colors, etc.. even make a whole
  62. new game" This information is in chapter IV.
  63. Using this document you "may" learn how to be a great rom hacker
  64. although I'm not promissing anything. The "information" is here, it's
  65. how you use it that makes the difference.
  66. C. Disclaimer
  67. 1) The author is not responsible for any illegal activities related with
  68. this document.
  69. 2) The author is not affiliated in any way with any programs or
  70. companies mentioned within this document.
  71. 3) The author takes no responsibility in any damage done to your system by
  72. running the mentioned programs.
  73. 3) This document MAY be copied and transmitted electronically, so long as
  74. everything included is INTACT and NOT MODIFIED.
  75. 4) This document MAY NOT be distributed as any hard copy. This includes
  76. paper, books, or magazines.
  77. 5) This document MAY NOT be modified to another format, such as HTML or
  78. Adobe's PostScript, without prior written consent by the author.
  79. ¸,.�¬=椺²°`¯ ¯`°²º¤æ=- Section II. -=椺²°`¯ ¯`°²º¤æ=¬�.,¸
  80. II. Tools
  81. ---------
  82. (A) NES ROM HACKING TOOLS
  83. 1. NESticle
  84. To edit patterns, goto the View/Pattern table, then click
  85. on a pattern and edit it.Right clicking on a pattern will change
  86. its attribute (palette), to aid in drawing. If you wish, you can save
  87. the changes with File/Write VROM, and the VROM will be written directly
  88. to the .NES file, so make back-up copies!!.
  89. ( nesticle homepage http://www2.southwind.net/~bldlust/NESticle.html )
  90. 2. Hex editor
  91. Depending on the rom your hacking it may or may not have
  92. text in it to edit. Generally use this for simple hacks, but also
  93. use it for major rom hacking as described later in the document.
  94. 3. Xchar
  95. X-Char is a tile data editor for Nintendo systems. Tile
  96. data is both the tile and sprite data of the cartridge. This
  97. tool allows the user to modify the data to their liking, it
  98. sports an easy to use interface, simple enough for even the
  99. most uninitiated in the ways of ROM editting. If you can use
  100. a paint program, you can use this.(Planet X Software)
  101. Version 2 allows you to edit roms for many emulator formats:
  102. a) *.nes
  103. b) *.gb
  104. c) *.smc
  105. note: It may support more but the above are all that i've tried.
  106. 4. Xlate
  107. what xlate does is take a table file (created by you) of byte
  108. equivalencies to characters defined by the rom (companies rarely used ascii
  109. standards for their text encoding). with a normal hexeditor, you can't see
  110. jack shit of text in a rom. with xlate, you can manipulate what bytes define
  111. the characters, so you can see the text by the way it was meant to be seen
  112. in the rom. let's take a segment from ff2j, for example.
  113. 8F AC AA AB B7
  114. under a normal hexeditor (ascii), it would look like crap. ż¬½+ to be exact.
  115. but as i said, squaresoft didn't use standard ascii codes for their text.
  116. 8F means F, AC means i, etc.. it's xlate's job to reallign the text codes
  117. into something that looks right.
  118. the format for creating a xlate 1.00 table is like this :
  119. <A> <B> <C>
  120. 8F F F
  121. AA g g
  122. AB h h
  123. AC i i
  124. B7 t t
  125. ...
  126. A: column A is the byte addressed.
  127. B: column B is the key you press to call the letter in column C.
  128. C: column C is the text displayed to us while in xlate, in place of the byte
  129. in column A.
  130. so, in xlate, when bytes 8F,AC,AA,AB,B7 are addressed, they look like 'Fight
  131. '. ( Extract from Demi's romhacking text )
  132. 5. Romhack
  133. RomHack starts with the File Requester. From there you may choose
  134. the rom file you want to see. Actually, you can read ANY file, but RomHack
  135. comes handy only with roms! Chosen the rom, the main screen displaying a
  136. BITwise dump of that rom will pop up. On the bottom of the screen the rom
  137. filename is displayed. On the top right, we have: the POSition indicator
  138. into the rom (referred to the first pixel shown on the top-left of the
  139. screen), the total LENgth of the ROM and the MODulus (or sprites size) value. The modulus
  140. is very important, since it's the key to display things like character-sets
  141. and sprites. The Y modulus works togheter with the X one to help display
  142. graphics with aligned bytes (sprites). The key of sprites dumping is, anyway,
  143. the SPRITES mode. The sprites mode displays bytes in the following format:
  144. byte 1 byte 9
  145. byte 2 byte 10
  146. byte 3 byte 11
  147. byte 4 byte 12
  148. byte 5 byte 13
  149. byte 6 byte 14
  150. byte 7 byte 15
  151. byte 8 byte 16
  152. byte 17 byte 25
  153. byte 18 byte 26
  154. byte 19 byte 27
  155. byte 20 byte 28
  156. byte 21 byte 29
  157. byte 22 byte 30
  158. byte 23 byte 31
  159. byte 24 byte 32
  160. ... and so on
  161. It looks like many roms store sprites this way. Of course the X and Y
  162. size of sprites can be fully customizable.
  163. Another neat feature of RomHack is Dump. You can have a real-time dump
  164. of the ROM in HEX, ASCII and 6502 DISASSEMBLY. (Fabrizio Zavagli)
  165. (B) SNES ROM HACKING TOOLS
  166. 1. Ctool v1.62
  167. A) What it can do:
  168. * A whole NEW algorithm to verify SNES checksum!!
  169. Old versions of CTOOL only could handle 2,4,8,16 and 32 MBit cartridges.
  170. Now CTOOL V1.62 can calculate checksum of 10,12,20 and 24 Mbit carts!
  171. * Verify option shows blocks left and percentage of process.
  172. * Split option aborts if destination size equals original size.
  173. Old versions of CTOOL created a copy of the file. Fixed!
  174. * Join option shows the name of the files being joined.
  175. * When splitting SMC files, the cartridge mode byte -if present- is copied
  176. to the last file. Reversely, when joining SMC files, the mode byte of the
  177. last file is copied onto the new file.
  178. * Transfer option sends cartridge mode byte to SWC !!!!
  179. This means that we can now send High ROM games to our beloved Wild Card
  180. and also avoid SRAM protections by changing the header appropiately!
  181. * Transfer routine has been recoded so that SWC will not get locked when
  182. the console is powered off. Old versions of CTOOL sometimes needed an
  183. unlocking program like RESETPRT.COM to bring SWC back alive.
  184. * Transfer option shows file name, blocks left and percentage of files
  185. being sent to the SWC.
  186. * Another NEW option /m activates "Multi File mode" !!
  187. Now you don't need to join your files in a full sized one. CTOOL can now
  188. handle multi splitted SMC files when verifying and sending to the copier!
  189. If /m flag is not set, smart detection asks you to choose it if needed.
  190. * Maker ID's identification optimized to half size, as old codes were all
  191. compatible with new ones. No longer needed to have 2 tables in memory!
  192. * Some new Maker ID's included and some old ones fixed to real names.
  193. * Japanese letter 'little tsu' now appears as (k). (Black Hole)
  194. B) How do I use it:
  195. It is menu driven figure it out.
  196. 2. Kill Them
  197. A) What is it :
  198. With this tool you are able to remove up to 95% of all present and up-
  199. coming PAL, NTSC and SLOWROM Protections!
  200. The best'n fastest available Fixer 4 your PC! Don't believe it? Just
  201. test and make sure.
  202. B) How do I use it:
  203. Just type at the commandline: KILLEM31 <FILENAME> /<OPTION>
  204. The options look like this: /1 : for removing PAL-Protections at once
  205. /2 : for detecting PAL-Protections and
  206. creating an IPS file to remove 'em
  207. /3 : for removing NTSC-Protections at once
  208. /4 : for detecting NTSC-Protections and
  209. creating an IPS file to remove 'em
  210. /5 : for removing SLOW-Protections at once
  211. /6 : for detecting SLOW-Protections and
  212. creating an IPS file to remove 'em
  213. Use option 1 & 2 only for NTSC-Modules and option 3 & 4 only for PAL-
  214. Modules. Otherwise it can be that an NTSC game won't work on an NTSC
  215. Machine and the same with PAL. But the Utility automatically detects
  216. a NTSC or PAL game, so don't be shy! (Wonderboy)
  217. 3. SnesTool
  218. What it is: Multipurpose tool to modify snes roms(not grafix)
  219. How do I use it:
  220. *CONFIGURE
  221. This is important for adding headers, sending hi-rom games, and
  222. fixing headers.
  223. First the Printer port (1-4) is asked, if none set 1=default
  224. The function gets the port values from segment 40 (bios variables)
  225. Then it asks ya for 5 different style of copiers, press Y if you
  226. have the correct one, Double profighter works ok, Procom/Magicom also
  227. And the Profighter Q+ 32 mbit is ok as well, the others are NOT tested
  228. yet. So if Hi-rom sending does not work, try some other copiers
  229. instead, there are 5 different types of Hirom Sending.
  230. If you have made your choice, the fileselector gets active, then
  231. choose the SNESTOOL and press return, it will then patch the
  232. snestool.exe file to keep the values you entered.
  233. You can skip the patching, but why re-enter it everytime huh ?
  234. Changing your settings as many times as you like is no problem
  235. you can patch the Snestool.exe until you drop..
  236. *TAB
  237. Go to browsing mode, exit with Esc or <TAB> again.
  238. Use this to switch between File-Selector and Menu.
  239. *SPLIT
  240. Pick a snes file, then you can choose the split size for 4/8/12 mbit,
  241. with the arrow keys, press return to start.
  242. It will keep the 1st 8 letters name the extension to 1/2/3/etc..
  243. *JOIN
  244. Will only take *.1 files then renames the file to *.smc.
  245. Works on multiple files.
  246. *SLOWROMFIX
  247. Searches & patches the selected file for some standard fixes.
  248. Number of fixes will be displayed.
  249. Almost fixes the same ones as killem31.
  250. Killem is a little better however, but sometimes fixes a little
  251. too much...
  252. *PALFIX
  253. Search & patch standard protections for games which do not work on
  254. pal machines.
  255. *NTSCFIX
  256. Same but for games that do not work on NTSC machines.
  257. Once fixed it must work on both machines.
  258. *USE IPS
  259. Apply the International Patch Standard on a file.
  260. This type was invented by DAX and ME, we got a lot
  261. of success with it, because we released the programs
  262. on ATARI/AMIGA AND PC format at the same time.
  263. Pick an IPS file first, the the game to be patched.
  264. If IPS2 is detected, it will write a temporary file
  265. called TEMP.SMC then renames it back to the original.
  266. IPS2 files are ment to 'Cut' a file.
  267. Kill them fucking advertisement Intro's...
  268. *CREATE IPS
  269. Compares 2 files, then write the difference to a file called
  270. '2ndname.IPS'.
  271. *ADD HEADER
  272. Test the size, and if ok writes a TEMP.SMC, renaming it afterwoods.
  273. Works on multiple files.
  274. *REPAIR HEADER
  275. Auto detects multiple files, ask for S-ram on/off, Hirom yes/no,
  276. with wildcard selected, also for mode 24 (other place of S-ram).
  277. then patches all files accordingly.
  278. *REMOVE INTRO
  279. Tries to find and restore the original reset vector then cut's off
  280. the intro (if added to the end).
  281. Does NOT work on the latest Anthrox intro's, the ones who modify
  282. a lot of 'blanking instructions'.
  283. Does NOT work with the 'Hidden reset vector' stuff.
  284. *SEND & RUN
  285. Pick a file to send, make sure you have selected the correct
  286. configuration, else strange things might happen.
  287. It will detect multiple files and send the rest also.
  288. after loading 1 or 2 blocks a file info menu will pop up,
  289. containing some useful information about the game.
  290. Some company's could be wrong, because they use the incorrect company-
  291. value.
  292. Esc cancels the sending.
  293. *SLOWFIX ON/OFF
  294. If ON each loaded block is scanned for fixes, if found it will
  295. be patched in memory only, just before sending, at the end of
  296. sending, the number of fixes will be displayed in the same box.
  297. *FILEINFO
  298. Go to browsing mode by using <TAB> press return on a snes file to get
  299. your information, exit with <TAB> again or esc.
  300. *EXIT
  301. Press ESC in SELECTION mode to quit.
  302. *CHOOSE DRIVE
  303. press A or C to Z to choose another Harddisk or CD-Rom
  304. *DELETE
  305. In the file selector you can press the DELETE key to kill a file..
  306. *FILESELECTOR CONTROL KEYS
  307. Use the Cursor keys to Move Up and Down to select files
  308. and Left and Right to go in and out of Directories.
  309. *HOT-KEYS
  310. The HOT Keys are obvious since there Green and in Capitals.(Sledge & MCA)
  311. 4. Xchar version 2 - same description as as xchar v1 but
  312. it allows you to edit other roms.(nes/gb/smc/smd)
  313. 5. Xchar version 2 - same as above.
  314. 6. CartDisk
  315. A) What is it:
  316. Display the cartridge information (ROM/SRAM size, Title, Licensee,
  317. Country, Version, etc.) of the cartridge plugged into the interface.
  318. Browse through cartridge information contained in image files on disk(s).
  319. Copy the cartridge to disk (up to 32Mbits, including HiROM support).
  320. Load a cartridge image from disk *
  321. Compare a cartridge image with a cartridge in the interface.
  322. Copy, load and clear the Static RAM on any cartridge **
  323. Convert between image formats (SMC/SWC and Game Doctor)
  324. Split an image in half.
  325. Join two images together.
  326. *Pad an image which is not an even number of Mbits.
  327. *Destroy PAL/NTSC, SRAM protect and FastROM detect codes
  328. Use Game Genie, Gold Finger and Action Replay codes to cheat in games
  329. *Convert between Game Genie, Gold Finger and Action Replay codes.
  330. *Apply an IPS patch on an image.
  331. *Modify game information such as title, ROM/RAM size, Licensee, Country, etc.
  332. 7) RipGRFX
  333. WHat is it:
  334. This nifty tool allows you to rip the grafix out of snes
  335. games so you can do whatever u want with 'em. :)
  336. How do i use it:
  337. Ripgrfx <filename>.swc
  338. *must be in swc format!!
  339. ¸,.�¬=椺²°`¯ ¯`°²º¤æ=- Section III. -=椺²°`¯ ¯`°²º¤æ=¬�.,¸
  340. III. The process
  341. ----------------
  342. A. The ROM
  343. First of all, you have to choose a rom to hack. This ROM can be
  344. ines/pasofami/gameboy/snes/genesis format depending on the tool you use.
  345. Xchar version 2 allows you to edit several formats ( I'm hoping that
  346. they will improve the controls somewhat, but its a good tool )
  347. B. Changing graphics
  348. Here's where the fun part comes in. Load up your ROM and go to
  349. View --> Pattern tables. A window should pop up with funny looking graphics.
  350. Start your game and find a certain sprite, such as Link in Zelda 2. Now, your
  351. sprite and the palette in the pattern table are probably different, so right
  352. click the left or right side of the table until the table palette and the
  353. sprite palette are the same. Search through the table and find a part of your
  354. sprite. Click on it. Another window should pop up. Under this window, you have
  355. an enlarged tile of that part of your sprite. Click on a color and change the
  356. sprite around. When your done editing your sprites, you can save your changes
  357. by clicking on File --> Write VROM. Be sure to make a backup copy of the
  358. original ROM before writing the VROM. (Blackfury)
  359. Using Xchar is self explanatory. you simply scroll down until you
  360. find the character you wish to edit and press enter. This will bring up
  361. a closer view of the sprite and also a color table (only 4). Then u edit as
  362. you wish and press " S " to save it.
  363. How do I use Xchar? Easy use these commands:
  364. (1) Viewing mode:
  365. [~] Toggle SNES mode (NES mode by default)
  366. [space] Change bitdepth (SNES mode only)
  367. [\] Change byte offset (if tile appears disaligned, use this)
  368. [-] Shrink tile array x dimension by 1
  369. [+] Enlarge tile array x dimension by 1
  370. [[] Shrink tile array y dimension by 1
  371. []] Enlarge tile array y dimension by 1
  372. [pgup] Move up one page
  373. [pgdn] Move down one page
  374. [up] Move up one line
  375. [down] Move down one line
  376. [left] Move up one character
  377. [right] Move down one character
  378. [enter] Open tile array editor
  379. [s] Save editted rom
  380. [l] Reload rom
  381. [x] cut tile array
  382. [c] copy tile array
  383. [v] paste tile array
  384. [esc] Exit program
  385. (2) Editing mode:
  386. [esc] Return to view mode
  387. [+] Zoom in
  388. [-] Zoom out
  389. (3) Viewing mode:
  390. [mouse right] grab tile
  391. [mouse left] place tile/press button
  392. (4) Editing:
  393. [mouse right] grab color
  394. [mouse left] place color/press button
  395. Another tool that comes in handy for grafix is Romhack.
  396. (desciption above in section II ) this is used to find the grafix u
  397. want to edit then you press a key and presto you see the bytes
  398. in hex or ascii, which u can then edit with a hex editor. Rather nifty.
  399. (HomePage at http://www.ipsnet.it/netpages/room481)
  400. C. Changing text
  401. Changing text is a little more complicated than changing graphics.
  402. First you are going to need to make a text table. To do this, go to a part of
  403. a game where there is text. Then, load up your pattern tables and find where
  404. the letters are. In ZELDA 2, for instance, the number 0 is located at D0.
  405. Other numbers/letters follow, so our chart will look like this:
  406. 0 1 2 3 4 5 6 7 8 9 A B C D E F
  407. 0
  408. 1
  409. 2
  410. 3
  411. 4
  412. 5
  413. 6
  414. 7
  415. 8
  416. 9
  417. A
  418. B
  419. C
  420. D 0 1 2 3 4 5 6 7 8 9 A B C D E F
  421. E G H I J K L M N O P Q R S T U V
  422. F W X Y Z -
  423. Now, open up your hex editor and load the ROM. With given text from
  424. the game, search for it. For example, ZELDA in Zelda 2 would be F3DEE5DDDA in
  425. hex. If you do not understand any of this, then text editing is just not for
  426. you. Now, search through the ROM for your numbers. When you find them, just
  427. replace the old numbers with the new ones.
  428. NOTE: Do NOT make your word longer than the first word. Shorter is all right,
  429. if you replace the extra letters with spaces or something else. (Blackfury)
  430. ¸,.�¬=椺²°`¯ ¯`°²º¤æ=- Section IV. -=椺²°`¯ ¯`°²º¤æ=¬�.,¸
  431. IV. The Nintendo :
  432. (A) General Architecture :
  433. NES is based on the 6502 CPU, and a custom video controller known as PPU
  434. (Picture Processing Unit). The PPU's video memory is separated from the
  435. main CPU memory and can be read/written via special ports. Cartridges may
  436. contain both ROM appearing in the main CPU address space at $8000-$FFFF,
  437. and VROM or VRAM appearing in the PPU address space at $0000-$1FFF and
  438. containing the Pattern Tables (aka Tile Tables). In smaller cartridges,
  439. which only have 16kB ROM, it takes place at $C000-$FFFF leaving $8000-$BFFF
  440. area unused. Internal NES VRAM is located at addresses $2000-$3FFF in the
  441. PPU memory. Some cartridges also have RAM at $6000-$7FFF, which may or may
  442. not be battery-backed.
  443. CPU Memory Map
  444. --------------------------------------- $10000
  445. Upper Bank of Cartridge ROM
  446. --------------------------------------- $C000
  447. Lower Bank of Cartridge ROM
  448. --------------------------------------- $8000
  449. Cartridge RAM (may be battery-backed)
  450. --------------------------------------- $6000
  451. Expansion Modules
  452. --------------------------------------- $5000
  453. Input/Output
  454. --------------------------------------- $2000
  455. 2kB Internal RAM, mirrored 4 times
  456. --------------------------------------- $0000
  457. (B) Interrupts :
  458. NES uses non-maskable interrupts (NMIs) generated by PPU in the end of
  459. each frame (so-called VBlank interrupts). Maskable interrupts, or IRQs,
  460. can also be generated by circuitry in a cart, but most carts do not
  461. generate them. The VBlank interrupts can be enabled/disabled by writing
  462. 1/0 into 7th bit of $2000. When a VBlank interrupts occur, CPU pushes
  463. return address and the status register on stack, and jumps to the address
  464. stored at location $FFFA (ROM in NES). The interrupt handler is supposed
  465. to finish its execution with RTI command which returns CPU to the main
  466. program execution. More information on the interrupt handling can be found
  467. in a decent book on 6502 CPU.
  468. (C) I/O ports :
  469. NES internal I/O ports are mapped into the areas of $2000-$2007 and
  470. $4000-$4017. Some ports' usage is unknown or unclear, and any information
  471. is appreciated.
  472. I/O Ports Map
  473. ------+-----+---------------------------------------------------------------
  474. $2000 | RW | PPU Control Register 1
  475. | 0-1 | Name Table to show:
  476. | |
  477. | | +-----------+-----------+
  478. | | | 2 ($2800) | 3 ($2C00) |
  479. | | +-----------+-----------+
  480. | | | 0 ($2000) | 1 ($2400) |
  481. | | +-----------+-----------+
  482. | |
  483. | | Remember, though, that because of the mirroring, there are
  484. | | only 2 real Name Tables, not 4.
  485. | 2 | Vertical Write, 1 = PPU memory address increments by 32:
  486. | |
  487. | | Name Table, VW=0 Name Table, VW=1
  488. | | +----------------+ +----------------+
  489. | | |----> write | | | write |
  490. | | | | | V |
  491. | |
  492. | 3 | Sprite Pattern Table address, 1 = $1000, 0 = $0000
  493. | 4 | Screen Pattern Table address, 1 = $1000, 0 = $0000
  494. | 5 | Sprite Size, 1 = 8x16, 0 = 8x8
  495. | 6 | Hit Switch, 1 = generate interrupts on Hit (incorrect ???)
  496. | 7 | VBlank Switch, 1 = generate interrupts on VBlank
  497. ------+-----+---------------------------------------------------------------
  498. $2001 | RW | PPU Control Register 2
  499. | 0 | Unknown (???)
  500. | 1 | Image Mask, 0 = don't show left 8 columns of the screen
  501. | 2 | Sprite Mask, 0 = don't show sprites in left 8 columns
  502. | 3 | Screen Switch, 1 = show picture, 0 = blank screen
  503. | 4 | Sprites Switch, 1 = show sprites, 0 = hide sprites
  504. | 5-7 | Unknown (???)
  505. ------+-----+---------------------------------------------------------------
  506. $2002 | R | PPU Status Register
  507. | 0-5 | Unknown (???)
  508. | 6 | Hit Flag, 1 = PPU refresh has hit sprite #0
  509. | | This flag resets to 0 when VBlank starts, or CPU reads $2002
  510. | | (see "Hit/VBlank Bits").
  511. | 7 | VBlank Flag, 1 = PPU is generating a Vertical Blanking Impulse
  512. | | This flag resets to 0 when VBlank ends, or CPU reads $2002
  513. | | (see "Hit/VBlank Bits").
  514. ------+-----+---------------------------------------------------------------
  515. $2003 | W | Sprite Memory Address
  516. | | Used to set the address in the 256-byte Sprite Memory to be
  517. | | accessed via $2004. This address will increment by 1 after
  518. | | each access to $2004. The Sprite Memory contains coordinates,
  519. | | colors, and other attributes of the sprites (see "Sprites").
  520. ------+-----+---------------------------------------------------------------
  521. $2004 | RW | Sprite Memory Data
  522. | | Used to read/write the Sprite Memory. The address is set via
  523. | | $2003 and increments after each access. The Sprite Memory
  524. | | contains coordinates, colors, and other attributes of the
  525. | | sprites (see "Sprites").
  526. ------+-----+---------------------------------------------------------------
  527. $2005 | W | Background Scroll
  528. | | There are two scroll registers, vertical and horizontal,
  529. | | which are both written via this port. The first value written
  530. | | will go into the Vertical Scroll Register (unless it is >239,
  531. | | then it will be ignored). The second value will appear in the
  532. | | Horizontal Scroll Register. The Name Tables are assumed to be
  533. | | arranged in the following way:
  534. | |
  535. | | +-----------+-----------+
  536. | | | 2 ($2800) | 3 ($2C00) |
  537. | | +-----------+-----------+
  538. | | | 0 ($2000) | 1 ($2400) |
  539. | | +-----------+-----------+
  540. | |
  541. | | When scrolled, the picture may span over several Name Tables.
  542. | | Remember, though, that because of the mirroring, there are
  543. | | only 2 real Name Tables, not 4.
  544. ------+-----+---------------------------------------------------------------
  545. $2006 | | PPU Memory Address
  546. | | See "PPU Memory".
  547. ------+-----+---------------------------------------------------------------
  548. $2007 | | PPU Memory Data
  549. | | See "PPU Memory".
  550. ------+-----+---------------------------------------------------------------
  551. $4000-$4013 | Sound Registers
  552. | See "Sound".
  553. ------+-----+---------------------------------------------------------------
  554. $4014 | W | DMA Access to the Sprite Memory
  555. | | Writing a value N into this port, causes an area of CPU memory
  556. | | at address $100*N to be transferred into the Sprite Memory.
  557. ------+-----+---------------------------------------------------------------
  558. $4015 | W | Sound Switch
  559. | 0 | Channel 1, 1 = enable sound
  560. | 1 | Channel 2, 1 = enable sound
  561. | 2 | Channel 3, 1 = enable sound
  562. | 3 | Channel 4, 1 = enable sound
  563. | 4 | Channel 5, 1 = enable sound
  564. | 5-7 | Unused (???)
  565. ------+-----+---------------------------------------------------------------
  566. $4016 | RW | Joystick 1 + Strobe
  567. | 0 | Joystick 1 data
  568. | 1 | Joystick 1 presence, 0 = connected
  569. | 2-5 | Unused, set to 0 (???)
  570. | 6-7 | Unknown, set to 10 (???)
  571. | | See "Joysticks".
  572. ------+-----+---------------------------------------------------------------
  573. $4017 | R | Joystick 2
  574. | 0 | Joystick 2 data
  575. | 1 | Joystick 2 presence, 0 = connected
  576. | 2-5 | Unused, set to 0 (???)
  577. | 6-7 | Unknown, set to 10 (???)
  578. | | See "Joysticks".
  579. ------+-----+---------------------------------------------------------------
  580. (D) PPU Memory :
  581. In a real NES, reading/writing PPU memory should only be attempted
  582. during VBlank period. Many smaller ROMs have read-only memory (VROM) for
  583. the Pattern Tables. In this case, you won't be able to write into this
  584. memory. The $3F00 and $3F10 locations in VRAM mirror each other (i.e. it
  585. is the same memory cell) and define the background color of the picture.
  586. Writing to PPU memory:
  587. a) Write upper address byte into $2006
  588. b) Write lower address byte into $2006
  589. c) Write data into $2007. After each write, the address will
  590. increment either by 1 (bit 2 of $2000 is 0) or by 32 (bit 2 of
  591. $2000 is 1).
  592. Reading from PPU memory:
  593. a) Write upper address byte into $2006
  594. b) Write lower address byte into $2006
  595. c) Read data from $2007. The first byte read from $2007 will be
  596. invalid. Then, the address will increment by 1 after each
  597. read.
  598. Name Table contains tile numbers organized into 32 rows of 32 bytes
  599. each. Tiles are 8x8 pixels each. Therefore, the whole Name Table is 32x32
  600. tiles or 256x256 pixels. In the NTSC version of NES, upper and lower 16
  601. pixels are not shown, thus, the screen becomes 256x224 pixels. In the PAL
  602. version of NES, upper and lower 8 pixels are not show, thus, the screen
  603. becomes 256x240 pixels.
  604. Pattern Table contains tile images in the following format:
  605. Character Colors Contents of Pattern Table
  606. ...o.... 00010000 00010000 $10 +-> 00000000 $00
  607. ..O.O... 00202000 00000000 $00 | 00101000 $28
  608. .0...0.. 03000300 01000100 $44 | 01000100 $44
  609. O.....O. 20000020 00000000 $00 | 10000010 $82
  610. ooooooo. -> 11111110 11111110 $FE | 00000000 $00
  611. O.....O. 20000020 00000000 $00 | 10000010 $82
  612. 0.....0. 30000030 10000010 $82 | 10000010 $82
  613. ........ 00000000 00000000 $00 | 00000000 $00
  614. +---------+
  615. Note that only two bits for each pixel of a character are stored in the
  616. Pattern Table. Other two are taken from the Attribute Table. Thus, the total
  617. number of simultaneous colors on the NES screen is 16.
  618. Each byte in the Attribute Table represents a 4x4 group of tiles on the
  619. screen, which makes an 8x8 attribute table. Each 4x4 tile group is
  620. subdivided into four 2x2 squares as follows:
  621. (0,0) (1,0) 0| (2,0) (3,0) 1
  622. (0,1) (1,1) | (2,1) (3,1)
  623. --------------+----------------
  624. (0,2) (1,2) 2| (2,2) (3,2) 3
  625. (0,3) (1,3) | (2,3) (3,3)
  626. The attribute byte contains upper two bits of the color number for each
  627. 2x2 square (the lower two bits are stored in the Pattern Table):
  628. Bits Function Tiles
  629. --------------------------------------------------------------
  630. 7,6 Upper color bits for square 3 (2,2),(3,2),(2,3),(3,3)
  631. 5,4 Upper color bits for square 2 (0,2),(1,2),(0,3),(1,3)
  632. 3,2 Upper color bits for square 1 (2,0),(3,0),(2,1),(3,1)
  633. 1,0 Upper color bits for square 0 (0,0),(1,0),(0,1),(1,1)
  634. There are two 16-byte Palette Tables: the one at $3F00, used for the
  635. picture, and another one at $3F10, containing the sprite palette. The
  636. $3F00 and $3F10 locations in VRAM mirror each other (i.e. it is the same
  637. memory cell) and define the background color of the picture.
  638. There is only enough VRAM for 2 Name Tables and Attribute Tables. Two
  639. others are going to be mirrors of the first two, i.e. exact copies of them.
  640. Which pages are mirrored depends on the cartridge circuitry. With vertical
  641. mirroring, tables 2 and 3 are the mirrors of pages 0 and 1 appropriately.
  642. With horizontal mirroring, pages 1 and 3 are the mirrors of pages 0 and 2
  643. appropriately.
  644. PPU Memory Map
  645. --------------------------------------- $4000
  646. Empty
  647. --------------------------------------- $3F20
  648. Sprite Palette
  649. --------------------------------------- $3F10
  650. Image Palette
  651. --------------------------------------- $3F00
  652. Empty
  653. --------------------------------------- $3000
  654. Attribute Table 3
  655. --------------------------------------- $2FC0
  656. Name Table 3 (32x25 tiles)
  657. --------------------------------------- $2C00
  658. Attribute Table 2
  659. --------------------------------------- $2BC0
  660. Name Table 2 (32x25 tiles)
  661. --------------------------------------- $2800
  662. Attribute Table 1
  663. --------------------------------------- $27C0
  664. Name Table 1 (32x25 tiles)
  665. --------------------------------------- $2400
  666. Attribute Table 0
  667. --------------------------------------- $23C0
  668. Name Table 0 (32x25 tiles)
  669. --------------------------------------- $2000
  670. Pattern Table 1 (256x2x8, may be VROM)
  671. --------------------------------------- $1000
  672. Pattern Table 0 (256x2x8, may be VROM)
  673. --------------------------------------- $0000
  674. (E) Hit/VBlank Bits
  675. The VBlank flag is contained in the 7th bit of read-only location $2002.
  676. It indicates whether PPU is scanning the screen, or generating a vertical
  677. blanking impulse. It is set in the end of each frame (scanline 232), and
  678. stays on until the next screen refresh starts from the scanline 8. The
  679. program can reset this bit prematurely by reading from $2002.
  680. The Hit flag is contained in the 6th bit of read-only location $2002.
  681. It goes to 1 when PPU starts refreshing the first scanline where sprite#0
  682. is located. For example, if sprite#0's Y coordinate is 34, the Hit flag
  683. will be set in scanline 34. The Hit flag is reset when vertical blanking
  684. impulse starts. The program can reset this bit prematurely by reading from
  685. $2002.
  686. (F) Joysticks :
  687. There are two joysticks which are accessed via locations $4016 and
  688. $4017. To reset joysticks, write first 1, then 0 into $4016. This way, you
  689. will generate a strobe in the joysticks' circuitry. Then, read either from
  690. $4016 (for joystick 0) or from $4017 (for joystick 1). Each read will
  691. give you the status of a single button in the 0th bit (1 if pressed, 0
  692. otherwise):
  693. Read # | 1 2 3 4 5 6 7 8
  694. -------+---------------------------------------------------------
  695. Button | A B SELECT START UP DOWN LEFT RIGHT
  696. Bit 1 indicates whether joystick is connected to the port or not. It is
  697. set to 0 if the joystick is connected, 1 otherwise. Bits 6 and 7 of
  698. $4016/$4017 also seem to have some significance, which is not clear yet.
  699. The rest of bits is set to zeroes. Some games expect to get *exactly* $41
  700. from $4016/$4017, if a button is pressed, which has to be taken into
  701. account.
  702. (G) Sprites :
  703. There are 64 sprites, which can be either 8x8 or 8x16 pixels. Sprites
  704. patterns are stored in one of the Pattern Tables in the PPU Memory. Sprite
  705. attributes are stored in the Sprite Memory of 256 bytes, which is not a
  706. part of neither CPU nor PPU address space. The entire contents of Sprite
  707. Memory can be written via DMA transfer using location $4014 (see above).
  708. Sprite Memory can also be accessed byte-by-byte by putting the starting
  709. address into $2003 and then writing/reading $2004 (the address will be
  710. incremented after each access). The format of sprite attributes is as
  711. follows:
  712. Sprite Attribute RAM:
  713. | Sprite#0 | Sprite#1 | ... | Sprite#62 | Sprite#63 |
  714. | |
  715. +---- 4 bytes: 0: Y position of the left-top corner - 1
  716. 1: Sprite pattern number
  717. 2: Color and attributes:
  718. bits 1,0: two upper bits of color
  719. bits 2,3,4: Unknown (???)
  720. bit 5: if 1, display sprite behind background
  721. bit 6: if 1, flip sprite horizontally
  722. bit 7: if 1, flip sprite vertically
  723. 3: X position of the left-top corner
  724. Sprite patterns are fetched in the exactly same way as the tile patterns
  725. for the background picture. The only difference occurs in the 16x8
  726. sprites: the top half of the sprite is taken from the Sprite Pattern Table
  727. set in the $2000 port, while the bottom part is taken from the same
  728. location of the alternative Pattern Table. Therefore, if PPU is displaying
  729. a 16x8 sprite, and the Sprite Pattern Table is set to $1000, the bottom
  730. half of this sprite will be taken out of the $0000 Pattern Table, and vice
  731. versa.
  732. (H) Memory Mappers :
  733. There are many diffirent memory mappers (aka MMCs) used in the NES
  734. cartridges. They are used to switch ROM and VROM pages, and do some other
  735. tasks. I will only describe the MMCs I'm familiar with. Any new
  736. information on these and other MMCs is highly appreciated. The MMC
  737. numbers are given in terms of the .NES file field "Mapper Type".
  738. 1. Mapper #1, Sequential
  739. This is a sequential mapper used in many 256kB cartridges, such as
  740. Bomberman 2, Destiny Of The Emperor, Megaman 2, Airwolf, Operation Wolf,
  741. Castlevania 2, Silk Worm, Yoshi, Break Thru. It may be used to switch ROM
  742. and VROM. If there is no VROM, 8kB of VRAM is present at $0000. In some
  743. cases (mostly RPG games) such cartridges also contain battery-backed RAM
  744. at $6000-$7FFF. The mapper has four 5bit registers, which are accessed via
  745. following addresses:
  746. Register Address Range Function
  747. ---------------------------------------------------------------------------
  748. 0 $8000-$9FFF Mirroring and VROM Page Size select
  749. The 0th bit of this register selects the mirroring type (1 for
  750. horizontal, 0 for vertical). The 4th bit selects the size of
  751. VROM pages. When it is 1, two 4kB VROM pages can be switched
  752. independently at $0000 and $1000. Otherwise, there is a single
  753. 8kB VROM page at $0000.
  754. 1 $A000-$BFFF VROM page select
  755. This register sets either 8kB or 4kB VROM page at $0000,
  756. depending on the page size selected via register 0.
  757. 2 $C000-$DFFF Second VROM page select for 4kB pages
  758. If 4kB VROM pages selected via register 0, this register sets
  759. the VROM page at $1000. Otherwise, its value is ignored.
  760. 3 $E000-$FFFF ROM page select
  761. This register sets 16kB ROM page at $8000. The page at $C000 is
  762. always hardwired to the last ROM page in the cartridge. The
  763. cartridge starts with page 0 at $8000.
  764. ---------------------------------------------------------------------------
  765. In order to write to a mapper register, write $80 into any of the
  766. locations first. This will reset the mapper. Then write the value bit by
  767. bit into an appropriate address range. For example, the following assembly
  768. code will write $0C into register 3:
  769. lda #$80 ; Resetting mapper
  770. sta $8000 ;
  771. lda #$0C ; This is our value
  772. sta $EFD9 ; Writing bit 0
  773. lsr a ; Shifting
  774. sta $EFD9 ; Writing bit 1
  775. lsr a ; Shifting
  776. sta $EFD9 ; Writing bit 2
  777. lsr a ; Shifting
  778. sta $EFD9 ; Writing bit 3
  779. lsr a ; Shifting
  780. sta $EFD9 ; Writing bit 4
  781. 2. Mapper #2, Konami
  782. This is a quite simple mapper used in most Konami (Life Force,
  783. Castlevania, Metal Gear) and some other cartridges. It only switches the
  784. ROM. All cartridges with this mapper have 8kB VRAM at $0000 (i.e. no
  785. VROM). The mapper has a single 8bit register which can be written via
  786. locations $8000-$FFFF. It contains a number of 16kB ROM page at $8000.
  787. The page at $C000 is always hardwired to the last ROM page in the
  788. cartridge. The cartridge starts with page 0 at $8000.
  789. There is one more thing to note about this mapper: although any address
  790. in the $8000-$FFFF range can be used to access the mapper, most games
  791. prefer to use the address with the last digit equal to the value they
  792. write out. Thus, $07 can be written to $9FF7, $05 to $9FF5, and so forth.
  793. The reason for this is unknown.
  794. 3. Mapper #3, VROM Switch
  795. Mapper #3, also known as a VROM switch, is used in the Goonies series
  796. and many Japanese-only games. It only allows you to switch 8kB pages of
  797. VROM. The ROM is either 16kB or 32kB and is not paged. The mapper has a
  798. single 8bit register which can be written via locations $8000-$FFFF. It
  799. contains a number of 8kB VROM page at $0000.
  800. As with mapper #2, many games use locations with the last digit equal to
  801. the value being written. I do not know why.
  802. 4. Mapper #4, 5202 Chip (???)
  803. This mapper (or should I say 'an expansion chip'?) is used in many
  804. recent cartridges, such as Batman Returns, Super Contra, Vindicators,
  805. Silver Surfer, etc. It is an extremely complicated device, which is able
  806. to generate its own interrupts via IRQ line, and has a set of commands to
  807. switch ROM and VROM. VROM pages are 1kB, ROM pages appear to be 8kB. I do
  808. not completely understand how this mapper works, so any information is
  809. appreciated.
  810. The chip is controlled via following locations:
  811. Address Function
  812. ---------------------------------------------------------------------------
  813. $8000 A command number (0-7) is written here. Also, write to this
  814. register appears to reset the change made by a write into $E000.
  815. $8001 An value for command is written here.
  816. $A000 The 0th bit controls mirroring (1 = horizontal mirroring).
  817. $A001 Same as $8001 (???)
  818. $C000 Unknown
  819. $C001 Unknown
  820. $E000 The 5th bit appears to swap memory at $8000-$8FFF and
  821. $A000-$AFFF, when set to 1.
  822. $E001 Unknown
  823. ---------------------------------------------------------------------------
  824. In order to use the mapper, you should first write a command number
  825. into $8000, and then a value (page number) into $8001. Following commands
  826. exist:
  827. Cmd Function
  828. ---------------------------------------------------------------------------
  829. 0 Select 2 consequent 1kB VROM pages at $0000. The 0th bit of a value
  830. written into $8001 does not matter, i.e. 5 will always select pages
  831. 4 and 5.
  832. 1 Select 2 consequent 1kB VROM pages at $0800. The 0th bit of a value
  833. written into $8001 does not matter, i.e. 5 will always select pages
  834. 4 and 5.
  835. 2 Select a 1kB VROM page at $1000.
  836. 3 Select a 1kB VROM page at $1400.
  837. 4 Select a 1kB VROM page at $1800.
  838. 5 Select a 1kB VROM page at $1C00.
  839. 6 Select a 8kB ROM page at $8000. The initial value seems to be 0.
  840. 7 Select a 8kB ROM page at $A000. The initial value seems to be 1.
  841. ---------------------------------------------------------------------------
  842. Note that the ROM pages at $C000 and $E000 are hardwired to the last
  843. pages of the ROM, and can not be switched (they can be swapped via
  844. $E000 though).
  845. 5. Other mappers
  846. There are several other mappers, some of them very sophisticated. iNES
  847. partially supports them, but as this support either doesn't work
  848. correctly, or the mappers are uncommon (such as 100-in-1 cartridge mapper,
  849. I don't cover them here. (Marat Fayzullin)
  850. **Note : This is provided to help rom hackers understand the nintendo.
  851. Provided in the above is the sprite maps, which is most useful. :)
  852. ¸,.�¬=椺²°`¯ ¯`°²º¤æ=- Section V. -=椺²°`¯ ¯`°²º¤æ=¬�.,¸
  853. V. Sample walkthrough
  854. We're going to change Zelda 2 around a little bit. Load it up and
  855. start where the princess is sleeping. Go to View --> Pattern tables. In the
  856. tables, click on the left side of the table 3 times, or until the tiles are
  857. brown, tan, green, and black. Click on the upper left tile; this is Link's
  858. face. Click on the black color then click on where Link's eyes are. Black
  859. signifies that it is see through, so now you can see the background through
  860. Link's head. Now save it by clicking on File --> Write VROM. Now go to the
  861. first town. Talk to somebody. Now open your pattern tables again and locate
  862. the letters. In this case, 0 is D0, and so on as stated in the above table.
  863. Now load up a hex editor. Use the table to find a complete word (or two), with
  864. F4's being spaces in Zelda 2. Search for at least 7 letters in a word so you
  865. now you are editing the right thing. Replace those numbers with, say, F1, or
  866. 'X'. Save the ROM. Back in NESticle, load up your new ROM. Go back to that
  867. same person, and talk to him/her. Does his speech seem a little different?
  868. (Blackfury)
  869. ¸,.�¬=椺²°`¯ ¯`°²º¤æ=- Section VI. -=椺²°`¯ ¯`°²º¤æ=¬�.,¸
  870. VI. The Big Thanks and Credits:
  871. (A) Marat Fayzullin ( for letting us know how a nintendo works) ;)
  872. (B) Planet X Software ( for their great tools )
  873. (C) Nesticle ( for letting us relive the old days of nes )
  874. (D) Fabrizio Zavagli ( for Romhack )
  875. (E) Black Hole ( for Ctool )
  876. (F) WonderBoy ( for Kill them )
  877. <<<<<<<<<<<<<<<<< Where can u find us ? >>>>>>>>>>>>>>>>>>>>>>
  878. We have a homepage up at:
  879. Http://T3.great.sk/romhack/index.html
  880. and u can find us on IRC
  881. Who R We?
  882. SeRiAlKLR
  883. Corrosion
  884. FireWolf
  885. Blackfury
  886. XscrawlX
  887. Gargamel
  888. Gloone
  889. Thanks for using this. I hope you find it usefull..well until
  890. version 0.2 anyways. L8R
  891. -SK'97 (author)
  892. created on June 5th 1997
  893. <<<<<<<<<<<<<<<<<< And they all lived happily ever after >>>>>>>>>>>>>>>
  894. The end of "The Rom Hackers Bible v0.1"
  895. <<<<<<<<<<<<<<<<<< ROMHACKERS INC. (c) 1997 >>>>>>>>>>>>>>>>>>>>>>>>>>>