SNES逆汗解析・改造入門

SNES逆汗解析・改造入門#

アセンブラに関する資料は見かけるものの、 具体的な解析手法を公開しているサイトはほとんど見ないので作ってみました。 まー私自身大した知識や技術があるわけではないので、逆汗初心者向けです。

この文章について

この文章はSNESのROMを対象にして逆汗解析をしたり改造をしたりするためには
作業をどのように進めていけば良いのか、を具体的に説明することを目的としています。
前提的知識としては ゲイムのお部屋の「2から始める ...

SNES Sprites

This was very large and I had to write more sections in different parts of the tutorial, so please tell me if anything is confusing. I have not proofread any of this.

Sprites are important to every game. They are coined after the objects that move in a game, and there are ALOT of moving objects i ...

Initializing the SNES

Initializing the SNES takes LOTS OF CODE. Now, resources for SNES are hard to come by, so I forced myself to dive into Neviksti and Marc's initialization files. Now, believe me, it's a lot to deal with, so what I'll do is try to provide you with some important things that Neviksti's Init SNES file d ...

Writing Your First SNES Program

Writing Your First SNES Program

Now it is time to get your hands dirty. You will be making your first SNES ASM program today. It's about time, huh. So let's get on with it!

What this program will do:

Well it will basically fill then entire screen with one color. MAN is that EXciting ...

SNES Development Hardware and Software

SNES Development Hardware / Software

  • [[Sluggo III]]

Psygnosis PSY-Q Development System for SuperNES

To enter a diagnostics mode, hold the Left Trigger + Right Trigger + Start + Select and a diagnostics screen will appear.

The cart PCB has the following labels:

  • SNES Cart v ...

Transferring Data from ROM to the SNES APU

Transferring Data from ROM to the SNES APU The method of transferring data to the sound module of the SNES is a bit screwy, but it works. I've read many docs, looked at a lot of code, and nothing I've seen seems to explain the method to this madness in a straightforward way. I'm hoping I can shed s ...

SNES Development Boards

##SNES Development & Production PCB IDs##

  • SHVC-2Q5B - EP 4

  • SHVC-4PV5B - EP 7

  • SHVC-8PV5B - EP 10

  • SHVC-4RB3B7S - EP 20

  • SHVC-2QW5B-01 - DSP1-B

  • SHVC-4QW5B-10 - DSP1

  • SHVC-1RA3B6S-01 - SuperFX GSU1A

  • SHVC-1P0N - Single EPROM Board

  • SHVC-2P3B - Double EPROM Boar ...

Basic ca65 Usage for SNES Programming

Basic ca65 Usage for SNES Programming

First Example

The first example is a minimal example of setting up the ROM header, vectors, etc.

Usage:

ca65 ca65.s
ld65 -C lorom128.cfg -o ca65.smc ca65.o

lorom128.cfg

# ca65 linker config for 128K SMC
 ...

Grog's Guide to DMA and HDMA on the SNES

Introduction to DMA

Most computer systems have some form of Direct Memory Access controller, which is basically a piece of hardware that allows I/O devices to copy to and from main memory independently of CPU control. In the SNES, as usual, Nintendo came up with an odd design for their DMA ...

Learning the GFX Format - 2BPP Gameboy and SNES

This is good if you want to understand the actual graphics format the SNES uses, well 1 way anyways. I guess it's not really necessary, but it doesn't hurt.

I am going to use a great explanation from a Gameboy document. Why? Because the original Gameboy's were also 2BPP, but were only 4 different ...

ikari_01's SNES Debugging - Drakkhen II Text Compression

The text is taken from the video pages.

Part 1

This is just a little experiment and totally unrelated to sd2snes.

I was asked to figure out the text compression used in Dragon View (Drakkhen II). Another user suggested that I record the process to show him the way I approach something l ...

Writing the Header

[[!redirects Writing the Header]] Before writing your actual program's code, you need a header to describe WLA the SNES' memorymap. This is basically just a file you will include into your source. It contains all of the basic information about your ROM. The following is a basic header file for a 2 ...

byuu

SNES developer, hacker and author of BSNES. ...

Setting Up a Programming Environment

Before you dive into writing Super Nintendo programs, you need the necessary utilities and other things that will simplify your journey of learning how to program this beast.

Documents

  1. One great assortment of files was gathered by Qwertie, it contains documents on the cpu, graphics, ...

Testing Code

[[!redirects Running your programming on Hardware]]

Once you've programmed a game or other bit of data for SNES, you'll probably want to try to, well, test it.

Methods

Although for most software these choices are, mostly, about preference. Most games which require [[Expansion Chips]] o ...

Super Disc (Meta)

The first SNES CD hardware by Sony.

Technical Documentation

[[SuperDisc Memory Map]]

[[SuperDisc Registers]] ...

Aaendi

:category: people SNES Developer Blog ...

Seru-kun

17 years old "Expert" SNES ROM Hacker. Also known as LuigiBlood and KiiroBomber. ...

GD Leen

GD Leen

Below is a decompressor and recompressor for GD Leen. This has been updated to compile with GCC, below that is the original unmodified file.

//------------------------------------------------//
// Decompressor and  ...

MathOnNapkins

:category: people

Your <s>friendly</s> quasi-friendly neighborhood SNES quasi-expert. ...

SA-1

SA-1 (Expansion Coprocessor Chip)

Overview

The SA-1 is a coprocessor capable of running at four times the base speed of the SNES main CPU when access does not conflict with that of SNES CPU, DMA or HDMA processing. It provides ad ...

Mode 7 - Rotation

You really need to know fixed point complementary math for this one. Now time for a trig overview. In the 'real' world, we have 360 degrees of rotation, and the results of sin and cos of any angle fall in the range of -1 to 1. Now this works a little differently on the SNES, at least the way I ende ...

Bit Rate Reduction (BRR)

Introduction

Due to the requests of several people, the lack of documentation in this area, and a hope to spring the SNES emulation "scene" forward, I am going to try to describe the BRR encoding scheme in this doc. Everything here, I either read in publicly available documentation, or disc ...

SPC and RSN File Format

SPC

SPC is an audio format for playing native SNES audio.

SPC File Format

| | Offset | Size | Description | |:--------------------------|:--------:|------:|:-------------------------------------- ...

How to display sprites

Just like the NES, the SNES has a special area of memory called the OAM, that stores the attributes of sprites. For the NES using sprites is pretty straight forward:

  1. During the main game routine, write sprites to an OAM buffer.

  2. At the end of the main game routine, move the unused sprite ...

jwdonal

Creator of the (actually legible) SNES schematics and an FPGA-based NES/SNES emulation developer. For more direct information check out his emulation sites, VeriNES or [VeriSNES](https://r ...

Tototek Flash Cart

Super Flash Cart 64M for NTSC/PAL SNES

The Super Flash Cart 64M (SFC) is an 8MB SNES cartridge with flash memory and battery RAM. It comes with a separate programmer. I obtained the following information by hot-swapping the cartridge into an already-powered SNES running probing programs, and ...

HomePage

About the Super Nintendo Development Wiki

Welcome to the SNES Development wiki. For many years information has been literally scattered across the world, in old text files, in aging and now disappearing web sites, in dead forums, in some wiki's that never quite made it happen, in books... bas ...

Memory Mapping

[[!redirects SNES Memory Mapping]] [[!redirects SNES Memory Map]] [[!redirects LoROM]] [[!redirects HiROM]] This is a document intended to describe the SNES memory map. It will NOT include information on the MAD-1 or any other address decoder.

Hardware

The SNES has one 8-bit data b ...

Polling Controller Input

In this tutorial, you'll learn to read the joypad registers and react to player input ;). We're going to need to store the player's input somewhere, so we'll declare some variables in the system's RAM ($0000-$1FFF). If you make your own variables later in this part of RAM, keep in mind that the st ...

xkas

xkas (acronym for: cross-knight assembler) is a cross-assembler for the WDC G65816 processor, specifically tailored for use with SFC/SNES programming and translations but also supports GBA Thumb CPU (ARM7TDMI Thumb). The documentation below is for the most recent version of xkas.

Features

  • S ...

Programming with FastROM

So far all of our programs have been using a SlowROM model. However, ROM access can be increased from 2.56Mhz to 3.58Mhz. There is more to it than just telling the SNES to run faster though.

There are several steps involved in getting your rom to work correctly with FastROM enabled. I've only don ...

Making a Small Game - Tic-Tac-Toe

When you have finished this tutorial, you will have written a small game. Things you have to know before you start:

  • 65816 assembly
  • Interrupts (What are NMI and VBlank)
  • What is VRAM, CGRAM, and their basic structures
  • What is DMA and how to use it
  • Video modes (mode 0), using backgroun ...

SA-1 Registers

SA-1 Write Registers

Register Address Name Notes
SA-1 CPU Control ...

Using the NMI-VBLANK

Earlier we made an interrupt table which assigned addresses for the SNES interrupts. We assigned the address to an empty handler that just returned for every interrupt except the NMI (VBLANK) interrupt. This interrupt occurs whenever the T.V.'s tracer is not tracing to the screen, making it safe to ...

Transparency

The transparency on the SNES, while documented properly, made me have some headaches understanding how it works. Now that I've figured the truth (or at least I'm pretty damn close to), I'm writing a small document to spare someone else the headaches I've had if if could be useful to someone wanting ...

Expansion Chips

[[!redirects Expansion Chips (Meta)]] This section is for SNES Expansion chips found in various games.

[[Super FX]]

[[Capcom Cx4 - Hitachi HG51B169]]

[[DSP-n]] Series

  • DSP-1
  • DSP-2 / Dungeon Master
  • DSP-3 / [SD Gundam GX](http://super ...

Schematics, Ports, and Pinouts

[[!redirects Ports & Pinouts]] [[!redirects SNES Ports]] This is a document intended to describe the various hardware ports on the SNES. It will not describe how these ports are used by what may be plugged into them.

In the doc below, "active", "1", "logic-1", and ...

Pointers

Ok, here is my explanation on pointers. Some documents out there don't make any sense what so ever so I'm writing my own. This document is exclusively on Low-ROM SNES pointers and related. It is suggested that you become familiar with basic rom hacking before you read any further. If you begin to re ...

DMA & HDMA

DMA, or "direct memory access" is found in a number of computer systems, not just the Super Nintendo. It's basically a way for a peripheral or coprocessor to read data directly from memory, instead of requiring the main CPU to do a number of reads and writes. This is typically faster, if o ...

Working with VRAM - Initializing Tiles and Tile Maps

Now in this part of the series, we'll actually be.. Working with VRAM. :)

What We're Covering

Now we're going to actually upload data to the Video RAM. Now, there's 2 things that need to go to VRAM, and that's the tile data itself, and the tile map, which says where specific tiles will be di ...

Useful Ruby Snippets

Useful Ruby Snippets

These are useful code snippets I've used when working with SNES data and don't want to forget them. Some examples are not optimized as much as they could be in order to help keep the functionality clear.

Command Line Script Template

Useful for running a script fro ...

SPC7110

Emulation History

The decompression was completely cracked on Saturday, July 19th, 2008.

[[DecompTest0.c:file]] [[DecompTest1.c:file]] [[DecompTest2.c:file]]

SPC7110 Info, Reverse Engineered by & (c) Dark Force 

New data added by The Dumper 


SPC71 ...

Timing

This is a document intended to describe various aspects of SNES timing. It will probably not be useful unless you already know a good bit about the SNES.

BTW, special credit to byuu for the critical observation that the SNES returns to a known timing position on reset. Thus, a deterministic ROM ( ...

Game Doctor

Bung Game Doctor SF3, SF6, SF7 Headers

Version 1.0 - Copyright 2003: The Dumper

The Game Doctor SF3/SF6/SF7 backup units for the SNES use a 512 byte header.

The format is as follows (all numbers are hexadecimal):

0000-000F

`47 41 4D 45 20 44 4F 43 54 4F 52 20 53 46 20 33 ...

Learning 65816 Assembly

I trust that you have learned some other kind of assembly language. If you have not, I'm afraid that learning 65816 as your first assembly language may be extremely hard. However, I won't stop you from trying. You will need other 65816 documents, because I do not teach much in this tutorial. These t ...

Translucency

Translucency is a cool effect, an example would be the water effects in Secret of Mana. I'm just not in the mood to chat, so let's get right into it.

We normally set things to the Main Screen register ($212C) in order to see them on the screen. ...

S-DD1

As stated in the title, this document try to document the S-DD1 chip's algorithm and, up to certain point, the chip itself, but you have to take in mind that the main target is to describe the algorithm, not his implementation. Due to that, there are details that obviously have to be present in a re ...

ASM Tutorial Part 1

So... you want to make a block that freezes Mario only when he's small? Or perhaps make a block that kills him if he has zero coins because you've played through SMW and well, there are no more gimmicks? Well... with ASM, you can easily create these type of blocks - ASM basically lets you do custom ...

SPC700 Reference

SPC-700

System Overview

CPU

8-bit SPC700, runs at ~1Mhz ...with the effective speed being half (each instruction takes a minimum of 2 cycles)

Memory

64KB (NOT 32KB), shared with everything.

Communication

4 8-bit I/O ports to transfer data to/from the ...

BS-X Satellaview Header

The header will be at 0x7xxx (for LoROM) or 0xFxxx (for HiROM).

xFB0-xFB1 = ID
xFB2      = ?? Unknown, gets compared to 0001
xFC0-xFCF = Title
xFD0-xFD3 = Block Allocation flags (for 32 blocks of 128Kbytes each bit, 32Mbits max)
xFD4-xFD5 = Limited Starts
xFD6     ...

Sluggo III

Sluggo III SNES Memory Emulator

[[sluggo-1.jpg:pic]]

[[sluggo-2.jpg:pic]]

[[sluggo-3.jpg:pic]]

Apple II RoundTable: Sluggo III - Nintendo Development System for the Apple IIgs

Real Time Conference Transcript

Guest: Bill Heineman, Programmer

Company: Interplay ...

Sprites

The SNES has 128 independent sprites. The sprite definitions are stored in Object Attribute Memory, or OAM.

OAM

OAM consists of 544 bytes, organized into a low table of 512 bytes and a high table of 32 bytes. Both tables are made up of 128 records. OAM is accessed by setting the word add ...

Controllers

Controllers

The SNES has 2 controller ports on the front of the unit, and an "expansion port" on the bottom. Little is known about the expansion port.

A number of peripherals could be plugged into the controller ports:

Backgrounds

BG Modes

The SNES has 7 background modes, two of which have major variations. The modes are selected by bits 0-2 of register $2105. The variation of Mode 1 is selected by bit 3 of $2105, and the variation of Mode 7 is selected by bit 6 of $2133.

Mode    # Colors for BG
         ...

Registers

Address Bus B Registers

TODO: note on fast access time

Register Address Name Style Access Timing
Screen Display ...

Nintendo Music Format (N-SPC)

N-SPC Player is a common SPC player included in many SNES games. The actual player N-SPC itself seems to vary slightly from game to game. Secret of Mana's internal music format can be thought of as a counterpart to N-SPC, as can [Seiken Densetsu 3]( ...

Space Funky B.O.B.

Space Funky B.O.B.

Space Funky B.O.B. Source Code

This was originally posted on eludevisibility.org when I ([[Matthew Callis]]) originally bought these disks off eBay, but I'm consolidating all SNES related things down to superfamicom.org.

...

Capcom Cx4 - Hitachi HG51B169

[[!redirects CX4]] [[!redirects C4]] A DSP chip from Capcom; it is actually a Hitachi HG51B169 as confirmed by decapping. There are 1024K words of 24-bit instructions, running as 20.000MHz. and it is used in 2 games:

Capcom Music Format

This article has Japanese translations that need to be checked for correctness and have the Japanese portion removed.

This explains the structure of the SNES Capcom Sequence format / Capcom SPC format. Used by many Capcom games, this document focuses on [Mega Man X](https://superfamicom.org/inf ...

Jay's ASM Tutorial

Introduction

This is a tutorial on 65816 ASM used in the SNES, made easy for dumb people to understand (sorta). In case you are wondering, I don't program in this language, so it is possible that I will write something incorrectly in this tutorial. If so, you can e-mail me at tennj@yahoo.com, ...

ASM Hacking for Dummies

[[!include asm_hacking_sidebar]]

Introduction ### {: #introduction}

This document was written for the aspiring ROM hacker with little to no experience in 65c816 programming. The basics have been thoroughly covered and I believe this should prove a significant aid to anyone interested in 65c8 ...

NBA Jam Tournament Edition

Players

$11/F995-$11/FAE8 Lower word of each portrait pointer (2 bytes per player; ordered by player value).
$11/FAE9-$11/FC3C Upper word (bank byte) of each portrait pointer (2 bytes per player; A bank byte in RAM ($7F) means the portrait is compressed).

Notes: Each player portrait ...

Daikaijuu Monogatari 2

This is information pertaining to hacking or translating Daikaijuu Monogatari 2.

Compression Methods

Complex and not well explained by default and so many (only more compressed code)

色々と複雑でうまく説明で無いので省略(圧縮符号の詳細のみ)

Data length, Addr ...

65816 Reference

Internal Registers

Mnemonic Friendly Name Description
A Accumulator The accumulator. This is the math register. It stores one of two operands or the result of most arithmetic and logical operations.
X, Y Index The i ...