SNES逆汗解析･改造入門#

アセンブラに関する資料は見かけるものの、 具体的な解析手法を公開しているサイトはほとんど見ないので作ってみました。 まー私自身大した知識や技術があるわけではないので、逆汗初心者向けです。

この文章について

この文章はSNESのROMを対象にして逆汗解析をしたり改造をしたりするためには
作業をどのように進めていけば良いのか、を具体的に説明することを目的としています。
前提的知識としては ゲイムのお部屋の「2から始める ...

Writing Your First SNES Program

Now it is time to get your hands dirty. You will be making your first SNES ASM program today. It's about time, huh. So let's get on with it!

What this program will do:

Well it will basically fill then entire screen with one color. MAN is that EXciting ...

This was very large and I had to write more sections in different parts of the tutorial, so please tell me if anything is confusing. I have not proofread any of this.

Sprites are important to every game. They are coined after the objects that move in a game, and there are ALOT of moving objects i ...

Initializing the SNES takes LOTS OF CODE. Now, resources for SNES are hard to come by, so I forced myself to dive into Neviksti and Marc's initialization files. Now, believe me, it's a lot to deal with, so what I'll do is try to provide you with some important things that Neviksti's Init SNES file d ...

Transferring Data from ROM to the SNES APU The method of transferring data to the sound module of the SNES is a bit screwy, but it works. I've read many docs, looked at a lot of code, and nothing I've seen seems to explain the method to this madness in a straightforward way. I'm hoping I can shed s ...

SNES Development Hardware / Software

• [[Sluggo III]]

Psygnosis PSY-Q Development System for SuperNES

To enter a diagnostics mode, hold the Left Trigger + Right Trigger + Start + Select and a diagnostics screen will appear.

The cart PCB has the following labels:

• SNES Cart v ...

##SNES Development & Production PCB IDs##

• SHVC-2Q5B - EP 4

• SHVC-4PV5B - EP 7

• SHVC-8PV5B - EP 10

• SHVC-4RB3B7S - EP 20

• SHVC-2QW5B-01 - DSP1-B

• SHVC-4QW5B-10 - DSP1

• SHVC-1RA3B6S-01 - SuperFX GSU1A

• SHVC-1P0N - Single EPROM Board

• SHVC-2P3B - Double EPROM Boar ...

Basic ca65 Usage for SNES Programming

First Example

The first example is a minimal example of setting up the ROM header, vectors, etc.

Usage:

ca65 ca65.s
ld65 -C lorom128.cfg -o ca65.smc ca65.o

lorom128.cfg

# ca65 linker config for 128K SMC
 ...

This is good if you want to understand the actual graphics format the SNES uses, well 1 way anyways. I guess it's not really necessary, but it doesn't hurt.

I am going to use a great explanation from a Gameboy document. Why? Because the original Gameboy's were also 2BPP, but were only 4 different ...

Introduction to DMA

Most computer systems have some form of Direct Memory Access controller, which is basically a piece of hardware that allows I/O devices to copy to and from main memory independently of CPU control. In the SNES, as usual, Nintendo came up with an odd design for their DMA ...

SNES developer, hacker and author of BSNES. ...

:category: people SNES Developer Blog ...

Ye old purpose and disclaimers

The Window Mask and Color Addition/Subtraction registers are pretty poorly documented, so here's what I've figured out through trial and error. Note that my trial and error was in an emulated SNES environment, so if ZSNES has it wrong then I probably do too. ...

The text is taken from the video pages.

Part 1

This is just a little experiment and totally unrelated to sd2snes.

I was asked to figure out the text compression used in Dragon View (Drakkhen II). Another user suggested that I record the process to show him the way I approach something l ...

The first SNES CD hardware by Sony.

Technical Documentation

[[SuperDisc Memory Map]]

[[SuperDisc Registers]] ...

17 years old "Expert" SNES ROM Hacker. Also known as LuigiBlood and KiiroBomber. ...

:category: people

Your <s>friendly</s> quasi-friendly neighborhood SNES quasi-expert. ...

:category: people

AKA Damien Good, Console Hacker, Programmer, Enthusiast.

His SNES Hardware Page ...

Creator of the (actually legible) SNES schematics and an FPGA-based NES/SNES emulation developer. For more direct information check out his emulation sites, VeriNES or [VeriSNES](https://r ...

So far all of our programs have been using a SlowROM model. However, ROM access can be increased from 2.56Mhz to 3.58Mhz. There is more to it than just telling the SNES to run faster though.

There are several steps involved in getting your rom to work correctly with FastROM enabled. I've only don ...

SA-1 (Expansion Coprocessor Chip)

Overview

The SA-1 is a coprocessor capable of running at four times the base speed of the SNES main CPU when access does not conflict with that of SNES CPU, DMA or HDMA processing. It provides ad ...

Below is an example of using Xkas to patch an existing game. The game is Super Mario World and the patch was coded by Videogamer555, you can also view the original thread.

Firstly you need the [S ...

Bubsy in Claws Encounters of the Furred Kind

ROM Map

| Offset | Category | Description | |-------------------|--------------------------------|----------------------------- ...

Ok, here is my explanation on pointers. Some documents out there don't make any sense what so ever so I'm writing my own. This document is exclusively on Low-ROM SNES pointers and related. It is suggested that you become familiar with basic rom hacking before you read any further. If you begin to re ...

[[!redirects Expansion Chips (Meta)]] This section is for SNES Expansion chips found in various games.

[[Super FX]]

[[Capcom Cx4 - Hitachi HG51B169]]

[[DSP-n]] Series

• DSP-1
• DSP-2 / Dungeon Master
• DSP-3 / [SD Gundam GX](http://super ...

[[!redirects Writing the Header]] Before writing your actual program's code, you need a header to describe WLA the SNES' memorymap. This is basically just a file you will include into your source. It contains all of the basic information about your ROM. The following is a basic header file for a 2 ...

Useful Ruby Snippets

These are useful code snippets I've used when working with SNES data and don't want to forget them. Some examples are not optimized as much as they could be in order to help keep the functionality clear.

Command Line Script Template

Useful for running a script fro ...

[[!redirects SNES Memory Mapping]] [[!redirects SNES Memory Map]] [[!redirects LoROM]] [[!redirects HiROM]] This is a document intended to describe the SNES memory map. It will NOT include information on the MAD-1 or any other address decoder.

Hardware

The SNES has one 8-bit data b ...

Just like the NES, the SNES has a special area of memory called the OAM, that stores the attributes of sprites. For the NES using sprites is pretty straight forward:

1. During the main game routine, write sprites to an OAM buffer.

2. At the end of the main game routine, move the unused sprite ...

Before you dive into writing Super Nintendo programs, you need the necessary utilities and other things that will simplify your journey of learning how to program this beast.

Documents

1. One great assortment of files was gathered by Qwertie, it contains documents on the cpu, graphics, ...

Translucency is a cool effect, an example would be the water effects in Secret of Mana. I'm just not in the mood to chat, so let's get right into it.

We normally set things to the Main Screen register ($212C) in order to see them on the screen. ...

You really need to know fixed point complementary math for this one. Now time for a trig overview. In the 'real' world, we have 360 degrees of rotation, and the results of sin and cos of any angle fall in the range of -1 to 1. Now this works a little differently on the SNES, at least the way I ende ...

The transparency on the SNES, while documented properly, made me have some headaches understanding how it works. Now that I've figured the truth (or at least I'm pretty damn close to), I'm writing a small document to spare someone else the headaches I've had if if could be useful to someone wanting ...

I trust that you have learned some other kind of assembly language. If you have not, I'm afraid that learning 65816 as your first assembly language may be extremely hard. However, I won't stop you from trying. You will need other 65816 documents, because I do not teach much in this tutorial. These t ...

Super Flash Cart 64M for NTSC/PAL SNES

The Super Flash Cart 64M (SFC) is an 8MB SNES cartridge with flash memory and battery RAM. It comes with a separate programmer. I obtained the following information by hot-swapping the cartridge into an already-powered SNES running probing programs, and ...

Now in this part of the series, we'll actually be.. Working with VRAM. :)

What We're Covering

Now we're going to actually upload data to the Video RAM. Now, there's 2 things that need to go to VRAM, and that's the tile data itself, and the tile map, which says where specific tiles will be di ...

Earlier we made an interrupt table which assigned addresses for the SNES interrupts. We assigned the address to an empty handler that just returned for every interrupt except the NMI (VBLANK) interrupt. This interrupt occurs whenever the T.V.'s tracer is not tracing to the screen, making it safe to ...

Introduction

Due to the requests of several people, the lack of documentation in this area, and a hope to spring the SNES emulation "scene" forward, I am going to try to describe the BRR encoding scheme in this doc. Everything here, I either read in publicly available documentation, or disc ...

DMA, or "direct memory access" is found in a number of computer systems, not just the Super Nintendo. It's basically a way for a peripheral or coprocessor to read data directly from memory, instead of requiring the main CPU to do a number of reads and writes. This is typically faster, if o ...

SA-1 Write Registers

Register	Address	Name	Notes
SA-1 CPU Control ...

When you have finished this tutorial, you will have written a small game. Things you have to know before you start:

• 65816 assembly
• Interrupts (What are NMI and VBlank)
• What is VRAM, CGRAM, and their basic structures
• What is DMA and how to use it
• Video modes (mode 0), using backgroun ...

This is a document intended to describe various aspects of SNES timing. It will probably not be useful unless you already know a good bit about the SNES.

BTW, special credit to byuu for the critical observation that the SNES returns to a known timing position on reset. Thus, a deterministic ROM ( ...

About the Super Nintendo Development Wiki

Welcome to the SNES Development wiki. For many years information has been literally scattered across the world, in old text files, in aging and now disappearing web sites, in dead forums, in some wiki's that never quite made it happen, in books... b ...

[[!redirects Running your programming on Hardware]]

Once you've programmed a game or other bit of data for SNES, you'll probably want to try to, well, test it.

Methods

Although for most software these choices are, mostly, about preference. Most games which require [[Expansion Chips]] o ...

Emulation History

The decompression was completely cracked on Saturday, July 19th, 2008.

[[DecompTest0.c:file]] [[DecompTest1.c:file]] [[DecompTest2.c:file]]

SPC7110 Info, Reverse Engineered by & (c) Dark Force 

New data added by The Dumper 


SPC71 ...

BG Modes

The SNES has 7 background modes, two of which have major variations. The modes are selected by bits 0-2 of register $2105. The variation of Mode 1 is selected by bit 3 of $2105, and the variation of Mode 7 is selected by bit 6 of $2133.

Mode    # Colors for BG
         ...

So... you want to make a block that freezes Mario only when he's small? Or perhaps make a block that kills him if he has zero coins because you've played through SMW and well, there are no more gimmicks? Well... with ASM, you can easily create these type of blocks - ASM basically lets you do custom ...

In this tutorial, you'll learn to read the joypad registers and react to player input ;). We're going to need to store the player's input somewhere, so we'll declare some variables in the system's RAM ($0000-$1FFF). If you make your own variables later in this part of RAM, keep in mind that the st ...

xkas (acronym for: cross-knight assembler) is a cross-assembler for the WDC G65816 processor, specifically tailored for use with SFC/SNES programming and translations but also supports GBA Thumb CPU (ARM7TDMI Thumb). The documentation below is for the most recent version of xkas.

Features

• S ...

Bung Game Doctor SF3, SF6, SF7 Headers

Version 1.0 - Copyright 2003: The Dumper

The Game Doctor SF3/SF6/SF7 backup units for the SNES use a 512 byte header.

The format is as follows (all numbers are hexadecimal):

0000-000F

`47 41 4D 45 20 44 4F 43 54 4F 52 20 53 46 20 33 ...

The SNES has 128 independent sprites. The sprite definitions are stored in Object Attribute Memory, or OAM.

OAM

OAM consists of 544 bytes, organized into a low table of 512 bytes and a high table of 32 bytes. Both tables are made up of 128 records. OAM is accessed by setting the word add ...

[[!redirects Ports & Pinouts]] [[!redirects SNES Ports]] This is a document intended to describe the various hardware ports on the SNES. It will not describe how these ports are used by what may be plugged into them.

In the doc below, "active", "1", "logic-1", and ...

<Seru-kun> Anyway, want to see a working Satellaview homebrew on video ? <Kiddo> Sure, although the ROM'd probably be quicker. <Seru-kun> http://www.youtube.com/watch?v=3zDirQXD8Cw -Seru-kun- DCC Send SatellaviewTest2Working.rar (82.249.178.174)

• Seru-kun has offered SatellaviewTest2Working.rar ...

SPC-700

System Overview

CPU

8-bit SPC700, runs at ~1Mhz ...with the effective speed being half (each instruction takes a minimum of 2 cycles)

Memory

64KB (NOT 32KB), shared with everything.

Communication

4 8-bit I/O ports to transfer data to/from the ...

Introduction

This is a tutorial on 65816 ASM used in the SNES, made easy for dumb people to understand (sorta). In case you are wondering, I don't program in this language, so it is possible that I will write something incorrectly in this tutorial. If so, you can e-mail me at tennj@yahoo.com, ...

SPC

SPC is an audio format for playing native SNES audio.

SPC File Format

| | Offset | Size | Description | |:--------------------------|:--------:|------:|:-------------------------------------- ...

Sluggo III SNES Memory Emulator

[[sluggo-1.jpg:pic]]

[[sluggo-2.jpg:pic]]

[[sluggo-3.jpg:pic]]

Apple II RoundTable: Sluggo III - Nintendo Development System for the Apple IIgs

Real Time Conference Transcript

Guest: Bill Heineman, Programmer

Company: Interplay ...

As stated in the title, this document try to document the S-DD1 chip's algorithm and, up to certain point, the chip itself, but you have to take in mind that the main target is to describe the algorithm, not his implementation. Due to that, there are details that obviously have to be present in a re ...

Address Bus B Registers

TODO: note on fast access time

Register	Address	Name	Style	Access	Timing
Screen Display ...

Space Funky B.O.B.

Space Funky B.O.B. Source Code

This was originally posted on eludevisibility.org when I ([[Matthew Callis]]) originally bought these disks off eBay, but I'm consolidating all SNES related things down to superfamicom.org.

...

The header will be at 0x7xxx (for LoROM) or 0xFxxx (for HiROM).

xFB0-xFB1 = ID
xFB2      = ?? Unknown, gets compared to 0001
xFC0-xFCF = Title
xFD0-xFD3 = Block Allocation flags (for 32 blocks of 128Kbytes each bit, 32Mbits max)
xFD4-xFD5 = Limited Starts
xFD6     ...

Controllers

The SNES has 2 controller ports on the front of the unit, and an "expansion port" on the bottom. Little is known about the expansion port.

A number of peripherals could be plugged into the controller ports:

• Joypads
• The Multitap: Also know ...

:category: game-specific

Zelda - A Link to the Past Decompression Code

Commented by Peekin - Feburary 22nd, 2001

; 65816 SNES Disassembler   v2.0a (C)opyright 1994 by John Corey
; Begin: $00e7a3  End: $ ...

This article has Japanese translations that need to be checked for correctness and have the Japanese portion removed.

This explains the structure of the SNES Capcom Sequence format / Capcom SPC format. Used by many Capcom games, this document focuses on [Mega Man X](https://superfamicom.org/inf ...

GD Leen

Below is a decompressor and recompressor for GD Leen. This has been updated to compile with GCC, below that is the original unmodified file.

//------------------------------------------------//
// Decompressor and  ...

[[!redirects CX4]] [[!redirects C4]] A DSP chip from Capcom; it is actually a Hitachi HG51B169 as confirmed by decapping. There are 1024K words of 24-bit instructions, running as 20.000MHz. and it is used in 2 games:

• Mega Man X 2 / [Rockman X 2](htt ...

N-SPC Player is a common SPC player included in many SNES games. The actual player N-SPC itself seems to vary slightly from game to game. Secret of Mana's internal music format can be thought of as a counterpart to N-SPC, as can [Seiken Densetsu 3]( ...

[[!include asm_hacking_sidebar]]

Introduction ### {: #introduction}

This document was written for the aspiring ROM hacker with little to no experience in 65c816 programming. The basics have been thoroughly covered and I believe this should prove a significant aid to anyone interested in 65c8 ...

This is a guide to the Secret of Evermore SRAM, the section of memory in the Secret of Evermore cartridge used to save your progress.

SRAM Basics

[Secret of Evermore](http://superfamic ...

The BS-X cartridge has a MMIO included in Memory 00-0f:5000. (Info taken from bsnes and sd2snes' verilog source)

They all do different things to the Memory, and is NECESSARY, to run games, and other stuff.

We will call them from r00 to r0f. Those have only one bit that can be set.

MCC ...

Kirby Super Star

Also known as Hoshi no Kirby Super Deluxe and Kirby's Fun Pak. The information below is fr ...

This is information pertaining to hacking or translating Daikaijuu Monogatari 2.

Compression Methods

Complex and not well explained by default and so many (only more compressed code)

色々と複雑でうまく説明で無いので省略(圧縮符号の詳細のみ)

Data length, Addr ...

Final Fantasy 5

ROM Map

Offset	Description	Info
043DAA	Audio / Sample Indexes
100200 - 102FFF?	[Enemy Data]( ...

Players

$11/F995-$11/FAE8 Lower word of each portrait pointer (2 bytes per player; ordered by player value).
$11/FAE9-$11/FC3C Upper word (bank byte) of each portrait pointer (2 bytes per player; A bank byte in RAM ($7F) means the portrait is compressed).

Notes: Each player portrait ...

Internal Registers

Mnemonic	Friendly Name	Description
A	Accumulator	The accumulator. This is the math register. It stores one of two operands or the result of most arithmetic and logical operations.
X, Y	Index	The i ...