"THE ROM HACKERS BIBLE v0.2" By SeRiAlKLR RomHackers Inc. (c) 1997 ,.=椺` `=- The Rom Hackers Bible -=椺` `=., TABLE OF CONTENTS I. Introduction 1. Preface 2. Introduction 3. Disclaimer II. Tools A) Nes Tools 1. NESticle 2. Hex editor 3. Xchar v1 4. Xlate v1 5. Romhack B) Snes Tools 1. Ctool 2. Kill Them 3. SnesTool 4. Xchar v2 5. Xlate v2 6. CartDisk 7.RipGrfx III. The process 1. The ROM 2. Changing graphics 3. Changing text IV. The Nintendo 1. General Architecture 2. Interrupts 3. I/O Ports 4. PPU Memory 5. Hit/VBlank Bits 6. Joysticks 7. Sprites 8. Memory Mappers a) Sequential b) Konami c) VROM Switch d) 5202 Chip e) Others V. Sample walkthrough VI. The Big Credits and Thanks section!! ,.=椺` `=- Section I. -=椺` `=., I. Introduction --------------- A. Preface This document was written due to the general lack of thourough rom hacking documents. Although there are a few available they arent as thourough as I needed. Therefore I wrote this to help all "would be" rom hackers. I also copied extracts of various text on certain tools, and I added credit to the author's when due, all other text is by me and I hope you find this useful. Also I will not cover pasofami hacking due to the fact that ines format is more popular. B. Introduction Hacking a ROM in its simplest form is easy. It does, even then, require alot of time depending on the complexity of the hack you are doing. For the truly daring you can even learn how to hack the rom completely, by this I mean "change the colors, etc.. even make a whole new game" This information is in chapter IV. Using this document you "may" learn how to be a great rom hacker although I'm not promissing anything. The "information" is here, it's how you use it that makes the difference. C. Disclaimer 1) The author is not responsible for any illegal activities related with this document. 2) The author is not affiliated in any way with any programs or companies mentioned within this document. 3) The author takes no responsibility in any damage done to your system by running the mentioned programs. 3) This document MAY be copied and transmitted electronically, so long as everything included is INTACT and NOT MODIFIED. 4) This document MAY NOT be distributed as any hard copy. This includes paper, books, or magazines. 5) This document MAY NOT be modified to another format, such as HTML or Adobe's PostScript, without prior written consent by the author. ,.=椺` `=- Section II. -=椺` `=., II. Tools --------- (A) NES ROM HACKING TOOLS 1. NESticle To edit patterns, goto the View/Pattern table, then click on a pattern and edit it.Right clicking on a pattern will change its attribute (palette), to aid in drawing. If you wish, you can save the changes with File/Write VROM, and the VROM will be written directly to the .NES file, so make back-up copies!!. ( nesticle homepage http://www2.southwind.net/~bldlust/NESticle.html ) 2. Hex editor Depending on the rom your hacking it may or may not have text in it to edit. Generally use this for simple hacks, but also use it for major rom hacking as described later in the document. 3. Xchar X-Char is a tile data editor for Nintendo systems. Tile data is both the tile and sprite data of the cartridge. This tool allows the user to modify the data to their liking, it sports an easy to use interface, simple enough for even the most uninitiated in the ways of ROM editting. If you can use a paint program, you can use this.(Planet X Software) Version 2 allows you to edit roms for many emulator formats: a) *.nes b) *.gb c) *.smc note: It may support more but the above are all that i've tried. 4. Xlate what xlate does is take a table file (created by you) of byte equivalencies to characters defined by the rom (companies rarely used ascii standards for their text encoding). with a normal hexeditor, you can't see jack shit of text in a rom. with xlate, you can manipulate what bytes define the characters, so you can see the text by the way it was meant to be seen in the rom. let's take a segment from ff2j, for example. 8F AC AA AB B7 under a normal hexeditor (ascii), it would look like crap. ż+ to be exact. but as i said, squaresoft didn't use standard ascii codes for their text. 8F means F, AC means i, etc.. it's xlate's job to reallign the text codes into something that looks right. the format for creating a xlate 1.00 table is like this : 8F F F AA g g AB h h AC i i B7 t t ... A: column A is the byte addressed. B: column B is the key you press to call the letter in column C. C: column C is the text displayed to us while in xlate, in place of the byte in column A. so, in xlate, when bytes 8F,AC,AA,AB,B7 are addressed, they look like 'Fight '. ( Extract from Demi's romhacking text ) 5. Romhack RomHack starts with the File Requester. From there you may choose the rom file you want to see. Actually, you can read ANY file, but RomHack comes handy only with roms! Chosen the rom, the main screen displaying a BITwise dump of that rom will pop up. On the bottom of the screen the rom filename is displayed. On the top right, we have: the POSition indicator into the rom (referred to the first pixel shown on the top-left of the screen), the total LENgth of the ROM and the MODulus (or sprites size) value. The modulus is very important, since it's the key to display things like character-sets and sprites. The Y modulus works togheter with the X one to help display graphics with aligned bytes (sprites). The key of sprites dumping is, anyway, the SPRITES mode. The sprites mode displays bytes in the following format: byte 1 byte 9 byte 2 byte 10 byte 3 byte 11 byte 4 byte 12 byte 5 byte 13 byte 6 byte 14 byte 7 byte 15 byte 8 byte 16 byte 17 byte 25 byte 18 byte 26 byte 19 byte 27 byte 20 byte 28 byte 21 byte 29 byte 22 byte 30 byte 23 byte 31 byte 24 byte 32 ... and so on It looks like many roms store sprites this way. Of course the X and Y size of sprites can be fully customizable. Another neat feature of RomHack is Dump. You can have a real-time dump of the ROM in HEX, ASCII and 6502 DISASSEMBLY. (Fabrizio Zavagli) (B) SNES ROM HACKING TOOLS 1. Ctool v1.62 A) What it can do: * A whole NEW algorithm to verify SNES checksum!! Old versions of CTOOL only could handle 2,4,8,16 and 32 MBit cartridges. Now CTOOL V1.62 can calculate checksum of 10,12,20 and 24 Mbit carts! * Verify option shows blocks left and percentage of process. * Split option aborts if destination size equals original size. Old versions of CTOOL created a copy of the file. Fixed! * Join option shows the name of the files being joined. * When splitting SMC files, the cartridge mode byte -if present- is copied to the last file. Reversely, when joining SMC files, the mode byte of the last file is copied onto the new file. * Transfer option sends cartridge mode byte to SWC !!!! This means that we can now send High ROM games to our beloved Wild Card and also avoid SRAM protections by changing the header appropiately! * Transfer routine has been recoded so that SWC will not get locked when the console is powered off. Old versions of CTOOL sometimes needed an unlocking program like RESETPRT.COM to bring SWC back alive. * Transfer option shows file name, blocks left and percentage of files being sent to the SWC. * Another NEW option /m activates "Multi File mode" !! Now you don't need to join your files in a full sized one. CTOOL can now handle multi splitted SMC files when verifying and sending to the copier! If /m flag is not set, smart detection asks you to choose it if needed. * Maker ID's identification optimized to half size, as old codes were all compatible with new ones. No longer needed to have 2 tables in memory! * Some new Maker ID's included and some old ones fixed to real names. * Japanese letter 'little tsu' now appears as (k). (Black Hole) B) How do I use it: It is menu driven figure it out. 2. Kill Them A) What is it : With this tool you are able to remove up to 95% of all present and up- coming PAL, NTSC and SLOWROM Protections! The best'n fastest available Fixer 4 your PC! Don't believe it? Just test and make sure. B) How do I use it: Just type at the commandline: KILLEM31 /