Introduction

Mr. Hexadecimal: Your new best friend

NESticle

Graphical Hacking

Altering Text

Palette Modification

IPS Patches

Resources

ROM Hacking, simply, is a process of altering existing computer code, although the application of it usually involves messing around with old console games stored on modern computer systems, called ROMs (Read Only Memory, a reference to the data chips inside the cartridges that console computers used for over 2 decades.).

What this means is that you can change the games themselves, such as the graphics, colors, sound, and level layouts. Even more complex things can be changed if you have the (Extremely advanced.) knowledge to do so, such as making Mario be 3 times  taller than normal, shooting Koopa Troopa's out of his ass while making a jingly sound every time he takes a step.

However, such complex techniques are far beyond the scope of this document. It assumes that you're basically new to this whole ROM Hacking thing, so anyone that knows what they're doing will gain absolutely no insight from this whatsoever. However, if you've got an idea of how to change a game, and just don't know where to start, hopefully this document will help you get started on the path to realizing it.

We'll be sticking to the very basic concepts of ROM Hacking, in particular hacking games that are for the Nintendo Entertainment System, a console that'll always hold a special place in my heart, or something.

We're going to start with the most essential, and also kind of complicated at first, concept in ROM Hacking: The Hexadecimal System..

(Back to the Table of Contents)

Hexadecimal is a way of representing computer data in a way other than the actual source code or in binary. It's a number system that is Base 16, rather than Base 10 like decimal (The number system we use in everyday life.).

The best way to think of how the base of a number system works is to look at it like this:

Firstly, all numbers can be thought of as being comprised of two "columns": The left column and the right column. The left column can be any amount of digits, but the right column is always just the rightmost digit in the number. Sounds weird, but here's an example:
 

As you can see, when you're dealing with one digit numbers, you need to imagine there's a zero in front of it, so that you have a left column.

Ok, now to explain the concept of bases.

The decimal system has the digits 0 through 9. Ten digits. When you count in decimal, count up to the biggest single digit number available, 9. In order to go higher than this, you have to add 1 to the left column, and reset the right column to zero, like so:

9-10, 19-20, 199-200, 9999-10000, 999999-1000000
(Remember to imagine that there's a zero in front of the 9)

See the how this works? Since this column shift always happens after a ten number sequence (10 digits to count with.), decimal is said to be a Base Ten number system.

Hexadecimal, on the other hand, is a Base Sixteen system. It contains 0 through 9 like decimal, but also includes 6 more digits; A, B, C, D, E, and F, for a total of sixteen digits. So to reach a column shift, you have to add 16 digits into the right column, like so:

0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, 10

Got it? I know this can be a mind-twister when you first start getting into it, but with practice hexadecimal will start making a whole lot of sense to you. However, when you've got a ROM open in a hex editor, you don't need to imagine a zero in front of the one digit numbers, as it displays it. To show you one more example of how counting in hex compares to decimal, look at this example:

Red: Hexadecimal, Yellow: Decimal

19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31
25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

Now since you're probably not going to want to count number by number to figure out what the decimal equivalent of a hexadecimal number is, a really big help to you is available if you have Windows 95 or higher. Windows's calculator can convert regular decimal numbers to hex. Just type in the number, and click the circle that says Hex. It should show the number in it's hex equivalent. The awesome hex editor, Hex Workshop also has a utility, the Base Converter, than can do this for you as well.

So you may be wondering, "What the hell does any of this have to do with ROM Hacking?".

Everything.

All the information in the ROM can be represented in hexadecimal when you're editing it, from the graphics, to the music, to how Mega Man behaves when he jumps, etc. Getting familiar with hex will help greatly with basic hacking, and will also open up the doors to more advanced levels of it.

Anyway, I hope that this really rudimentary explanation of hexadecimal helps you out. Now that you have a vague understanding of it, we'll start to get into ROM hacking itself.

(Back to the Table of Contents)

NESticle... sure, it can't run alot of games, has a crappy palette, and hasn't been updated in ages, but when it comes to ROM hacking, this is one of the best damn tools you can get, and for two reasons: The Magical F2 and F4 Buttons. Using F2 has many useful purposes, from graphics editing to getting hex values for text and tiles. F4 let's you view the palettes that are currently being used, which I'll go into later in this document. You're gonna need this program for most of the procedures below, so do a search for it on the net, or get it from  the Resources section. Note: If you're one of the Windows XP/2000/NT people out there, you'll probably want the Windows version of NESticle. The last version to have a Win32 executable was 0.42.

Now it's time to get into actual ROM hacking, starting with...

(Back to the Table of Contents)

Changing a games graphics can be fun and tedious at the same time, especially if you have limited artistic abilities (such as myself). There are two main ways of going about this: using NESticle's F2 button to bring up the Pattern Tables, or by using a kick ass program called Tile Layer. Here's the pros and cons of each:

NESticle:

Pros:
1:Allows you to do real time editing, so you can see the changes as you do them on screen.

Cons:
1:You can't save your changes unless the game has VROM (Video ROM).

2:You're screwed if the game can't be emulated by NESticle.

Tile Layer:

Pros:
1:Let's you save your changes on ANY game, regardless if it has VROM or not.

2:Allows you to arrange the tiles in order so you can see them as they appear in the game. (more on this in a minute).

3:Allows you to open two ROMs at once, so you can cut and paste graphics from one into the other.

4:Also let's you edit Gameboy, Sega Master System, Virtual Boy, and Super NES ROMs.

Cons:
1:You can't edit in real time, so you have to make your changes, then load the ROM to see what it looks like.
 

That's about it. A conjunction of the two is the best way to get what you want done, so get Tile Layer as well. Once again, the Resources section at the bottom of this document contains a link to the program.

Ok, now we're gonna start some actual ROM hacking by screwing around with some of the graphics in Super Mario Brothers

What you need:

NESticle
Tile Layer
A ROM of Super Mario Brothers

Load NESticle, then click on File, then click Load ROM. You'll be given a listing of the directories in your computer. Go to where your Super Mario Brothers ROM is located and load it. Now, hit F2, and you should see a screen like this come up.

This may look like a bunch of garbled shite to you, but this is actually the graphics being used by the game. (In Super Mario Brothers, these are actually ALL the graphics in the entire game.) This is what is known as the Pattern Tables, the space in the NES's RAM that holds the game's graphics. The ones on the left are the sprite tiles, such as Mario and all the enemies. The ones on the right are the background tiles. See, most ROMs don't store their graphics in order, but have their tiles jumbled around. Tile Layer can help with that, but I'll get into that in a second. Anyway, click on the very first tile on the left side, which you might be able to tell is the back of Mario's head. Another screen like this should pop up.

This is where you can edit the graphics, in this case the back of Mario's head. (The hexadecimal numbers at the top aren't important for this kind of stuff, but will be useful later on when you get into text editing.) The tile is composed of an 8x8 grid with 4 colors, which are the boxes on the right. (Note that the top color is transparent.) You can right click on the tile or the pattern tables to change the colors shown, although usually NESticle doesn't show the correct palette. The best thing to do is to get the graphic you want to change, such as Mario standing, on the screen, pause the game, then get into the Pattern Tables and start messing around with a tile that's a part of Mario standing. You'll be able to see the changes as you do them, which is useful as hell. As far as editing the tile, just pick your color by left clicking on it, then start painting like any other paint program. Once you've done the back of Mario's head, click on some more tiles and mess around if you want.

Ok, so now you've changed some crap, but there's still one more important thing left to do. Go to File, then click Write VROM. This'll save your work to the ROM.

However, there are alot of ROMs that don't have VROM, such as Final Fantasy and The Legend of Zelda, so any graphics you change in NESticle won't be able to be saved. And maybe all those jumbled tiles are confusing the hell out of you. What if you're wanting to hack a game with no VROM, or want to see the tiles like they appear in the game? Easy, it's time to break out Tile Layer.

For the sake of making things slightly easier, put your Mario ROM into the same directory as you have Tile Layer. If you're using Win95\98, you need to go into MS-DOS Prompt. Go to the directory where Tile Layer's at and type

tlayer.exe xxx.nes   (xxx is the name of the ROM)

You should now see this:

Yup, more garbled crap. However, this isn't the game's graphics. Hit either down on the arrow keys or page down a few times until you see the jumbled tiles, which in Super Mario Brothers is at the very bottom of the file. Here's where one of Tile Layer's coolest features comes into play. Click on the back of Mario's head, then go over to the clip board and hit right click on your mouse. The tile should now be on the clipboard. Now click the front of Mario's head and put it in front of the tile of the back of his head. Doing this you can arrange the tiles to where they actually look like they do in the game, like this.

Doing this makes it a hell of a lot easier to do graphic hacks. The way it works is identical to NESticle's tile editor. Just remember that you have to re-insert the tiles back to where they came from. Such as if you changes Mario's face, you need to left click the altered tile on the clipboard, go over to the left screen where the ROM data is, then right click it over the original tile of Mario's face. As always, remember to save before you quit!

That about covers basic graphic hacking. But wait, what's that? You'd like to know how to change words and such in a game? Well, that's a whole new subject, which is covered in...

(Back to the Table of Contents)

Changing a game's text is a little more complicated than you would think at first. Changing the graphics of the letters in the Pattern Tables or Tile Layer into other letters is definitely not the way to go, as it doesn't change the order of the letters, and makes most of the words become gibberish. Some real damn bad examples of this can be found in some of the earliest NES ROM hacks. Also, opening up a ROM in a text editor like Notepad typically won't accomplish anything either, since most NES games don't use the ASCII standard to store text. So how do you do it? First you need to get a program called Thingy, which you can also find in the Resources section at the bottom of this document. You don't need to do anything with it yet however.  It's time to fire up NESticle again, and for this example we're going to use a more text heavy game than Super Mario Brothers,  Dragon Warrior 1.

What you need:

NESticle
Thingy
A Dragon Warrior 1 ROM
A text editor, such as Notepad

Load Dragon Warrior in NESticle, and hit F2 to bring up the pattern tables. On the left pattern table you'll see 0 through 9 and all the letters of the alphabet. Click on 0. It'll say #00 on the top of the tile grid, just like the one with Mario's head from earlier. Remember how I said they weren't important for graphic hacking? Well, they're important now. Open up Notepad or whatever text editor you have (although programs like WordPad and Wordperfect are probably bad ideas. Stick with crap that does plain ASCII, like DOS EDIT or Notepad.) and type this:

00=0

Or if you're using a non multitasking OS like MS-DOS, just write it down on paper for now. Keep clicking the other numbers and letters and keep writing down the numbers that show up on the blue bar above the tile grid. These are the hexadecimal values for the letters and numbers as they're stored in the game. Once you get all the values down, (including the ones for punctuation, and the one that means space, which in Dragon Warrior is 5F) you should have a list that looks something like this:

00=0
01=1
02=2
03=3
04=4
05=5
06=6
07=7
08=8
09=9
0A=a
0B=b
 

And so on...  If you've been typing this into a text editor, then save it as dw1.tbl
If you've been writing it down on paper, open up your text editor and put all the values down just like shown above, then save it as dw1.tbl

What you've just made is a table file for use with Thingy, a program that'll save you countless hours of hassle.  As mentioned before, NES games almost never use the ASCII system to store their text, so viewing them in a text editor won't show them at all. What this tbl file you just made does is it tells Thingy what hexadecimal values stand for what letter, so you can see them in plain text, which is alot better than searching for 37 11 18 1D (Thou in Dragon Warrior) in a hex editor and replacing each letter byte by byte with other hex values, unless you LIKE doing that crap. When I first started messing around with ROM hacking years ago, that was the only way, by god, and it sucked in the worst of ways.

Anyway, put the Dragon Warrior ROM and dw1.tbl in the same directory that you put Thingy in. Run Thingy. You'll be prompted for your file's name: just type in what your Dragon Warrior ROM's name is, with the extension, such as dragw1.nes
Then it'll ask you for your table's name. Type dw1.tbl
When it says Second Table, just hit enter. You should now be in the main program, which'll look like this.

The left screen is the hexadecimal values of the information in the ROM, and the right screen is what your table file has listed as meaning for those hex bytes. Hit S, and type in art and hit escape.

You'll see something like this. (some of the byte definitions are missing because I didn't feel like writing out the whole table, but you get the idea.)

You can now actually see the words as they are, instead of as hex bytes. Here's how this same part of the ROM would look without a table in Thingy, or in any hex editor for that matter.

Pretty heinous. Now you see why Thingy kicks so much ass. But before you start changing anything there's a few things you need to know about text hacking. For one thing, most games use pointers, which is a subject I'm not going to go into in this document. Basically what it means is that you can't make a line of text any longer than it already is without screwing up something, unless you remap it to somewhere else, which is a bitchy process. So sticking with the set length of your text lines is the best thing to do at first, at least until you start to learn more about ROM hacking. Here's an example of what I'm talking about.

Let's say you've got a line of text that says  I'm the king of Dank Land!

That gives you a total of 26 bytes to work with, since you count the spaces too.
Putting more than 26 letters, numbers, etc, in this line will cause strange and weird shit to happen more than likely, so here would be a few examples that would and wouldn't work.

Things that would work:

So now we must journey.  23 bytes long.
Bleah, you make me sick! 24 bytes long.
Today sucks. 12 bytes long.

Things that wouldn't work:
I'm going to run really fast now. 33 bytes long.
Mmmmm, frozen cow pies! Yeah! 29 bytes long.

You get the idea. Ok, now to change some text. (Finally!)

Hit J, which is Jump to Position in Rom. Hit enter on Manual Address, and type in 0. You should now be back at the beginning of the file. Hit S, and type listen then hit escape.

You'll be at the line of text at the beginning of the game where King Lorik is talking to you, shown here.

Alright, now to change what the king's saying. Move your arrow keys until you've highlighted the first letter of listen. Click space. Now move and highlight the last letter of words, and hit space again. You'll now be in a screen where it'll ask you to type in your text. The cool thing about this is that it won't let you go over your byte limit. Let's type in something like, I want my Rage CD back
Now hit escape, and hit q. Now load the Dragon Warrior ROM up in NESticle and start a new game. When Lorik speaks to you, it'll look like this now.

There you go, you now know how to change a ROM's text. Just remember to stick to the original length for now, and you'll be ok.

However, there's one more thing we need to cover in the area of text hacking.. Since NESticle can't run alot of NES games, you can't get the values for the letters and numbers from the Pattern Tables from games it can't handle. Also, if you go on to hack games for other systems, you're going to need to an alternative to finding letters' hex values.

What you need is a Relative Searcher, a program that tries to identify text in a ROM. The program we'll use is called Hexposure, a nice program very similar to Thingy, which you can snag in the Resources section.

What you need

Hexposure
FCE Ultra
A Pinbot ROM

Pinbot is one of the games that NESticle absolutely cannot run. However, the NES emulator FCE Ultra (Resources section, blah) CAN run it. Unzip Hexposure and FCE Ultra into a folder with Pinbot. Open FCE Ultra, set it up however you like, and then load Pinbot. Since this game isn't exactly too text-heavy, we'll look at the title screen, shown here: You'll see this screen come up:

Well then, lets pick a word from here.. Let's go with PATENT. Close FCE Ultra, and now run Hexposure. You'll see this screen come up:

Highlight your Pinbot ROM, and hit enter. Now you'll be presented with this screen:

Ok, now to find some text.

Hit escape, which will bring you to the menu at the top of the screen. Go over to Search, and then choose Relative from the drop down menu.

A box will come up that says Search Relative. Where it says Text:, type PATENT into it, and hit enter. Hexposure will ask you if you want to build a font table based on the results. Hit Y.

Ding ding ding! We've got a match. Now hit escape, go to File, and choose Save .TBL. A box that says Save Font Table will pop up. Pick a name for your table file (And don't forget to type the .tbl at the end of it.), and hit enter. You now have an automagically generated table file for the game.

However, the relative search only turned up the values for the letters (If we were dealing with a game that had lower case letters as well, they probably wouldn't have turned up either.), not the punctuation and numbers. For the numbers you could do a relative search again for 1988 or 1986, but the punctuation won't be so easy. The best thing to do is look at the words we just found. See how there's a comma after RARE and COIN-IT? Look at the byte at the end of these two words in Hexposure, in the left window. Both of them have 2C at the end, so 2C must be our value for comma. Looking at the ROM like this will allow you to find the rest of the punctuation, or the numbers as well. Enter these values you find into your table file with Notepad, or whatever.

You're table is now ready. You can use it with Thingy, or with any other Hex Editor that supports .tbl files, Hexposure included.

Moving on, were going to the next subject this document will cover..
 
 

(Back to the Table of Contents)

What's palette hacking? Well, when you're hacking a game's graphics, sometimes you might want to make your new graphics use different colors than the ones they already are using. For the sake of you not having to go on another ROM hunt, we're going to change some color palettes in Super Mario Brothers.

What you need.

NESticle
A Hex Editor
A Super Mario Brothers ROM

Load up Super Mario Brothers in NESticle. Press start, and pause it as soon as you start on World 1-1. Now is where the other Magical Button in NESticle comes into play, the F4 key. Hitting it will bring up a screen that looks like this.

These are the colors currently being used by the game. They way this is set up is that each palette is a set of four colors, with two rows of four palettes each. Here's where we're gonna change some things around. See the first palette on the second row, the one that's light blue, red, rust, and brown? This's the palette Mario uses when he's in regular or Super form. Click on each of the colors and write down the hex values it'll show, which will be 22 16 27 18. Close NESticle now, and open your Mario ROM in your hex editor. (you can even use Thingy without a table as a hex editor if you want.) Now search for 22162718, that's right, don't use any spaces between the values. When you find it, change the 16 to 0C and the 27 to 2A. Save the file and reopen it in NESticle. Mario's colors will now look like this.

You've now changed Mario's palette. There's a side effect to this though. Any other sprite using this same palette will also have it's colors changed, like Lakitu, I think. Another thing to remember is that in alot of games the first match won't be the palette you're looking for, as the same thing might be in the ROM multiple times. So when it comes to this, you need to use trial and error, changing each one until you find the right palette. Remember to make frequent backups though!

One more note about palette hacking, sometimes the ROM won't list the first color (which is the transparent one), so say if you weren't finding any matches for 22 16 27 28 in the ROM, try searching for 16 27 28.

Also, the NES has a total of 64 colors, which are shown here with their hex values on this chart. You might want to save this to your hard drive for future reference, as it's a big help in finding what colors you can use.
 

(I can't take credit for this image. I think Toma created it. Hopefully he doesn't mind me using it.)

That's it for palette hacking. Finally, there's one more thing we need to cover to get the basics out of the way, and that is..

(Back to the Table of Contents)

So you've hacked the hell out of a ROM and you'd like the whole world to check it out. How should you go about doing this?

IPS stands for International Patching System, and is the preferred method of distributing ROM hacks over the internet. See, that nice little ROM you've been hacking is a copyrighted piece of intellectual property, and passing a modified version of it around will most likely piss the owners of it off, since, you know, it's theirs. An IPS patch contains ONLY the changes you've made to the game, which can be applied to an original copy of the ROM by someone else to change it into your hacked version. Since it's only your changes, you're not passing around the original copyrighted code that's in the game, plus the file size is drastically smaller than the entire hacked ROM. A program called SNES-Tool can make one of these patches, which, yes, is in the Resources section.

What you need.

SNES-Tool
Your hacked ROM
An unaltered copy of the ROM you've hacked

Unzip SNES-Tool into a folder with your hacked ROM, and your unaltered ROM. Run SNES-Tool, and you'll be presented with this menu:

Highlight the option that says Create IPS, and hit enter. The program will ask you to select your UNCHANGED file. Highlight it from the menu on the left (In this case, Faxanadu.nes), and hit enter.

Now SNES-Tool will ask you to pick the Changed file, which is your hacked version of the ROM (In this case, Kittykat.nes). Highlight it, and hit enter. A message saying IPS File Created will show up in the Info: box. Now there should be a file in your folder called xxx.ips (Where xxx is the name of your hacked ROM.). You now have a nice IPS file that you can zip up with a Readme or something, and put on the internet so other people can enjoy your hard work and effort. SNES-Tool can also apply these files to ROMs, by using the Use IPS option.

Well, that about covers the basics of NES ROM Hacking. Hopefully this document has helped you out somewhat, and you can now start on a pretty fun and rewarding hobby.

Happy Hacking.
 
 

(Back to the Table of Contents)

Oh yeah, if you need to ask a question about something, you can email me at this address.