(Link to AcmlmWiki) Offline: thank ||bass
Register | Login
Views: 13,040,846
Main | Memberlist | Active users | Calendar | Chat | Online users
Ranks | FAQ | ACS | Stats | Color Chart | Search | Photo album
05-15-24 06:22 PM
0 users currently in The Pit of Despair.
Acmlm's Board - I3 Archive - The Pit of Despair - Introduction to Hex New poll | | Thread closed
Pages: 1 2Add to favorites | Next newer thread | Next older thread
User Post
Tweaker

Red Koopa








Since: 11-18-05
From: Rochester, NY

Last post: 6296 days
Last view: 6295 days
Skype
Posted on 11-18-05 09:55 PM Link
Hey there, Tweaker here. Decided now that I decided to frequent here more, I should contribute a tad bit more.

Anyway, first off, you must realize that Hex stands for Hexadecimal, which is a base 16 number system. This is similar to decimal, which is a base 10 number system. So let's learn the numbers, shall we?

Decimal: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

------Hex: 0 1 2 3 4 5 6 7 8 9 A B C D E F 10

As you can see, counting to 16 in decimal is equvelant to counting to 10 in hex. Hex is pretty much decimal with six extra values tacked on to it.

Now, how do we hack Super Mario World with hex?

Well, as you may or may not know (hopefully may), everything on a computer is represented by binary code (AKA 001010101110, etc). Of course, editing and viewing ROMs -- or ANYTHING -- in binary alone is extremely impractical (unless you're dealing with bit-based compression algorthms and opcodes...). So as us humans oh-so-hate things being complicated when they don't have to be, we found a way to simplify binary; Using hexadecimal.

Hex is dealt with by the byte in most operations. In case you don't know your terminoligy, let's fix that right now:

Nybble - Half a byte, or a single digit. "A" would be a good example.

Byte - Full hexadecimal value, equal to 8 bits, and two digits. Something like "01" or "1C".

Word - Two bytes, or 16 bits. Need I really explain this more? "010A" or "1550" would be good examples.

Long(word) - Two words, or 4 bytes, or 32 bits. "00012345' would be a good example.

FYI, byte types are advanced in powers of 1,024. 1,024 bytes makes a kilobyte, 1,024 kilobytes makes a megabyte... etc etc down the whole damn chain.


Now that you know your basics, we can start editing and move on to pointers and such.

So first off, what is a pointer? Well, a pointer is pretty much what it's called -- a pointer. It's a hexadecimal string that lists an offset in ROM in which to locate data. (BTW, an offset is just the current byte in ROM that you're at. $012345 [out of $200000, though that bt's redundant] would be an offset.) Since the SNES' main processor is Little Endian, you need to read pointer backwards by the byte to get the offset to be located. For example, if my pointer read 56341200, first I'd split that into bytes. 56 34 12 00. Now I take the byte order and reverse it. This becomes 00 12 34 56, which I compress back into a longword - 00123456. So this pointer wants to locate data at offset 00123456 ($123456).

Let's make a practcal example. Let's say you wanted to edit Mario's art to add more frames to some animations (which you should edt mappings for later, but ). You can't add them to the current location because there is vital data after Mario's art. So what we should do is expand our ROM and add Mario's art to the end so we can add as many frames as we want.

We'll say (it isn't really) that the location for Mario's art is at offset $55439. However, we don't know where the pointer to his art is! So guess what? We're gonna find it. Remember how I said pointers are offsets byteswapped in ROM? Well, take the offset of Mario's art and byteswap it. Originally, 00055439, it becomes 39540500. Run a search for this in the ROM and you should get at least one result. We found our pointer!

Now we'll say the end of the ROM s offset $02000000. byteswap this and replace our pointer wth 00000020. This is telling the game to look for Mario's art at $2000000, rather than $55439. Now put Mario's art there and run the game -- It should work! You can even delete the old art and Mario will still be as good as new.


Hope this helps some people understand how to use a hex editor better. may add more examples if requested, but this should be enough to get you going on your own as a better hacker overall.
Deleted User
Banned


 





Since: 05-08-06

Last post: None
Last view: 6296 days
Posted on 11-18-05 10:07 PM Link
Very useful for the newbies, maybe this will be a sticky thread.
Heran_Bago

Bronto Burt








Since: 11-18-05

Last post: 6672 days
Last view: 6672 days
Posted on 11-19-05 02:48 AM Link
I really wish someone had given ME this explanation when I first picked up ROM hacking. I started with pallete hacking SMB, of course.

"1F? That is not a number! Wait, perhaps in this hex-o-decimal, you can use any character on the keyboard!"
Well, maybe that didn't happen, but I'm sure this guide would have helped.
blackhole89
Moronic Thread Bodycount: 17
(since 2006-08-21 09:50 EST)
F5 F5 F5 F5 F5


 





Since: 12-31-69
From: Dresden/SN/DE

Last post: 6297 days
Last view: 6295 days
Skype
Posted on 11-19-05 06:50 AM Link
Moved to basic SMW hacking and stickied.


(edited by Dei on 11-20-05 11:50 AM)
(edited by blackhole89 on 11-20-05 02:38 PM)
C:/xkas bio.asm
Compiled ASM code








Since: 11-17-05

Last post: 6296 days
Last view: 6295 days
Posted on 11-20-05 12:48 AM Link
here a link to the Learning ASM sticky from the archive: link


(edited by Bio on 11-19-05 11:48 PM)
(edited by Bio on 11-19-05 11:49 PM)
(edited by Bio on 11-19-05 11:49 PM)
spel werdz rite









Since: 11-19-05

Last post: 6296 days
Last view: 6295 days
Posted on 11-21-05 04:49 AM Link
How about some info on high and low byte data?
I'm working on data for Super Mario Bros, and I don't know much about high and low byte stuff.
Tweaker

Red Koopa








Since: 11-18-05
From: Rochester, NY

Last post: 6296 days
Last view: 6295 days
Skype
Posted on 11-21-05 05:39 PM Link
Originally posted by spel werdz rite
How about some info on high and low byte data?
I'm working on data for Super Mario Bros, and I don't know much about high and low byte stuff.

Hmm... Well, I was mainly intending this to be a very basic course, but I suppose I could also have this as a semi-help thread.

Tell me what you DO know about high and low byte data. Once we get that out of the way, we can work on teaching you the new stuff.
Kailieann



 





Since: 11-18-05

Last post: 6295 days
Last view: 6295 days
Posted on 11-21-05 09:13 PM Link
Byte order isn't exaclty a difficult concept to grasp.

If you have a two-byte value (also known as a word) (eg: x6A59; 27225 in decimal), then 6A is the upper/high/most significant byte, and 59 is the low byte.

And when you're dealing with most computer systems, the byte order is reversed. So, the value x6A59 is stored as $596A

The same goes for three-byte values, such as x7E010B, which would be stored as $0B017E.

And then four-byte values (Dword) like x39031816 [$16180339]


A more complicated matter is signed values, which allows for the use of negative numbers.

Basically, the value is broken down into bits, and if the highest bit is 0, the value is positive, and if the highest bit is 1, the value is negative, starting at xFF and counting down to x80.

For example, the value xCE, which in binary is %11001110 -- note that the bit on the left (the highest bit) is set.
If it's an unsigned value, then the decimal equivalent is 206, but if it's an unsigned value, then the decimal equivalent would be -50.

To test this, open the windows calculator, and make sure the view is set to scientific. Put in the number 206 in decimal mode, then switch to hex mode (F5), it will show up as xCE.
Now switch back to decimal and put in -50, and switch to hex again. If the size is set to byte it will show up as xCE again (with leading xFFs if the size is set to word, Dword, or Qword)
spel werdz rite









Since: 11-19-05

Last post: 6296 days
Last view: 6295 days
Posted on 12-05-05 02:32 AM Link
Thanks! I understanded enough to do what I need.
One more: How does "Jump to Subroutine" work? It's the last thing I need to know about ASM (pretty much )
Kailieann



 





Since: 11-18-05

Last post: 6295 days
Last view: 6295 days
Posted on 12-05-05 08:13 AM Link
JSR/JSL address - Go to address and do stuff there
RTS/RTL - Go back to where the jump was
spel werdz rite









Since: 11-19-05

Last post: 6296 days
Last view: 6295 days
Posted on 12-07-05 02:46 AM Link
Originally posted by Kailieann
JSR/JSL address - Go to address and do stuff there
RTS/RTL - Go back to where the jump was
Can you give an example, I'm a little hex-tarded in this area.
RAM or ROM addresses is my main question.
Pretty sure it's ROM, but I want to be sure, plus if it is, I still don't know how it works.
Kailieann



 





Since: 11-18-05

Last post: 6295 days
Last view: 6295 days
Posted on 12-07-05 08:44 AM Link
Okay, you're going to need Lunar Address for this.

Now, here's the cliff notes.

Say you wrote up some custom code, and wanted to put it into the rom. First you'd need to find some free space in the rom.
That's not too difficult, all you have to do is look for a bunch of 00s or FFs.
Now, let's say you found some blank space in the rom at hex offset x45A10 (it won't actually be blank, but we can pretend).
You would paste your code in at that offset (make sure it ends with an RTL), then open Lunar Address.
Set the ROM type to the first option (LoROM - PC), and check the PC on Left Side option.
Then type 45A10 in the PC File Address box, and it will give you the SNES address $08: D810. This is the address you'll be jumping to.

Now you go to the place in the code where you want to jump from, and put JSL 10D808 (remember the proper byte order).
Ta dah, there's the basics for a proper jump.


(edited by Kailieann on 12-07-05 07:45 AM)
spel werdz rite









Since: 11-19-05

Last post: 6296 days
Last view: 6295 days
Posted on 12-09-05 01:20 AM Link
I have a code at 11A6F0 in Super Mario All-Stars, I set the JSR at 113F99, what should I enter?
I tried what you said but the game just froze and I KNOW the code works normally so...
Kailieann



 





Since: 11-18-05

Last post: 6295 days
Last view: 6295 days
Posted on 12-09-05 08:23 AM Link
*sighs*

Originally posted by Kailieann
Okay, you're going to need Lunar Address for this.


Originally posted by Kailieann
Now, let's say you found some blank space in the rom at hex offset x11A6F0
You would paste your code in at that offset (make sure it ends with an RTL), then open Lunar Address.


Originally posted by Kailieann
Set the ROM type to the first option (LoROM - PC), and check the PC on Left Side option.
Then type 11A6F0 in the PC File Address box, and it will give you the SNES address $23:A4F0. This is the address you'll be jumping to.


Originally posted by Kailieann
Now you go to the place in the code where you want to jump from, and put JSL F0A423 (remember the proper byte order).


Next time try actually reading the post.
spel werdz rite









Since: 11-19-05

Last post: 6296 days
Last view: 6295 days
Posted on 12-10-05 03:00 PM Link
I did read the post, but LA won't open up for me. So I was asking for exactly what I needed, sorry.
Kailieann



 





Since: 11-18-05

Last post: 6295 days
Last view: 6295 days
Posted on 12-10-05 04:46 PM Link
Okay. Next time, say that first.
Then you have to do it manually. That's not too hard. Just set your windows calculator to hex mode (all numbers shown are hexadecimal)

ROM address = 11A6F0
-200 byte header = 11A4F0

SNES bank: 11A4F0/8000 = 23

Note that the calculator doesn't support decimals in hex mode, so it automatically rounds down.

Start of bank 23: 23 * 8000 = 118000
Bank address: 11A4F0 - 118000 + 8000 = A4F0

So, as my previous post showed, the SNES address is $23:A4F0
And, of course, Jump statements use reverse byte order, so the jump address becomes F0A423

And, to recap, here is how you convert from a ROM offset to an SNES address:

Most SNES ROMs have a 200 byte header. So, first you take the ROM address and subtract 200

SNES code is divided into 8000 byte banks. To find the bank number, divide the no-header address by 8000.

Finding the address of the code within the bank is a three-step process.
Step 1: Find the start of the bank (bank number times 8000)
Step 2: Find the offset of the code relative to the start of the bank (no-header address minus step 1)
Step 3: Add 8000. The actual game code is in the 8000-FFFF range within each bank. The purpose of the 0000-7FFF bank is a discussion that belongs in the advanced forum.

With this, you should be able to convert any address you need in the future.
And if you're half-decent with any programming/scripting languages, you should be able to whip up a replacement for LA without too much difficulty. I may make a PHP-based address converter myself sometime.
Deleted User
Banned


 





Since: 05-08-06

Last post: None
Last view: 6296 days
Posted on 12-10-05 05:55 PM Link
Originally posted by Bio
here a link to the Learning ASM sticky from the archive: link


The link of MarcThemer´s SNES ASM Tutorial don´t work

Edit:Oh, here´s the new link: http://snescentral.edgeemu.com/snesrpg/files/65816-htm.zip

Edit2:Ah, he encontrado unas guías de SNES ASM hecha por un hacker llamado Dark-N para los hackers que hablan español , aquí están los links:
http://www.nekein.com/tyh/archivos/guia_asm_cap1_html/Curso_ASM_SNES.htm
http://www.nekein.com/tyh/archivos/Curso_ASM_SNES_cap2.doc
http://www.nekein.com/tyh/archivos/Curso_ASM_SNES_cap3.doc
http://www.nekein.com/tyh/archivos/Curso_ASM_SNES_cap4.doc
http://www.nekein.com/tyh/archivos/Curso_ASM_SNES_cap5.doc

Edit3: He leído esas guías, pero aún sigo sin entender ASM (soy un "cabeza dura")


(edited by andres on 12-10-05 05:07 PM)
(edited by andres on 12-10-05 05:10 PM)
spel werdz rite









Since: 11-19-05

Last post: 6296 days
Last view: 6295 days
Posted on 12-12-05 02:04 AM Link
Originally posted by Kailieann
Okay. Next time, say that first.
Then you have to do it manually. That's not too hard. Just set your windows calculator to hex mode (all numbers shown are hexadecimal)

ROM address = 11A6F0
-200 byte header = 11A4F0

SNES bank: 11A4F0/8000 = 23

Note that the calculator doesn't support decimals in hex mode, so it automatically rounds down.

Start of bank 23: 23 * 8000 = 118000
Bank address: 11A4F0 - 118000 + 8000 = A4F0

So, as my previous post showed, the SNES address is $23:A4F0
And, of course, Jump statements use reverse byte order, so the jump address becomes F0A423

And, to recap, here is how you convert from a ROM offset to an SNES address:

Most SNES ROMs have a 200 byte header. So, first you take the ROM address and subtract 200

SNES code is divided into 8000 byte banks. To find the bank number, divide the no-header address by 8000.

Finding the address of the code within the bank is a three-step process.
Step 1: Find the start of the bank (bank number times 8000)
Step 2: Find the offset of the code relative to the start of the bank (no-header address minus step 1)
Step 3: Add 8000. The actual game code is in the 8000-FFFF range within each bank. The purpose of the 0000-7FFF bank is a discussion that belongs in the advanced forum.

With this, you should be able to convert any address you need in the future.
And if you're half-decent with any programming/scripting languages, you should be able to whip up a replacement for LA without too much difficulty. I may make a PHP-based address converter myself sometime.
Thanks for the info, two last questions and I'm ready to go out on my own.
1. How does it work for ExHi/LoROM Games?
2. How does it work for NES Games?
and on a side note, I know nothing about programming languages.
Lemon de man

150








Since: 11-17-05
From: Castle Koopa

Last post: 6393 days
Last view: 6297 days
Posted on 01-29-06 06:43 PM Link
*Super Bump*

Does anybody know what a RAM address is?
spel werdz rite









Since: 11-19-05

Last post: 6296 days
Last view: 6295 days
Posted on 02-04-06 03:58 AM Link
Damn! Bump a sticky! wtf

Anyways, RAM addresses are values that tell the game what to do.
(Super) Nintendo emulators are programmed to read hexadecimal values as ASM coding.
The ROM gives instructions on what RAM addresses should be under certain conditions.
That's how save states can save your exact position, it holds every RAM address value, and reinserts them once you load that save state.
So basically, RAM addresses are like a living thing, and the ROM is the DNA, a large set of instructions which tell us how to function under several certain conditions.

Do I need to be more specific, or does someone want to add to this?
Pages: 1 2Add to favorites | Next newer thread | Next older thread
Acmlm's Board - I3 Archive - The Pit of Despair - Introduction to Hex | Thread closed


ABII

Acmlmboard 1.92.999, 9/17/2006
©2000-2006 Acmlm, Emuz, Blades, Xkeeper

Page rendered in 0.055 seconds; used 455.90 kB (max 585.95 kB)