65c816 Assembly Tutorial

[randoguy101]

Why isn't this is Mario General? Because ASM hacking is universal for the SNES, even allowing one to make a game from scratch. However, SMW will play a big role in this, with many tools developed for it to make adding things such as sprites and blocks easier, and a majority of the ROM already decoded.

Some general tools you'll need for this tutorial:
A Super Mario World ROM, which I will not link to because linking to ROMs is illegal and you can easily find one yourself.
Xkas v0.08, a patching tool that allows you to patch ASM code to a ROM.
Lunar Magic 1.82, which allows one to edit the levels and overworld of aforementioned ROM. Neccisary if you're creating code that won't normally appear in the game (IE a custom sprite).
SMWDisC, a wonderful disassembly of SMW put together by the kind folks at SMWCentral. Sadly, the project was never completed, but a majority of code was commented that can be used as sort of a testing reference.
SMWCentral's ROM and RAM maps, while also not complete, are being pieced together by the community as we speak, so they're a great reference.

Now that we have all that out of the way, let's get hacking!

To start, we need to understand exactly how the processor works. The 65c816 is a 16-bit processor developed as an extension to the 6502, used to run the NES and Atart 2600, among other things. Because the 65816 was built upon the 6502, most of the basic terminoligy of the 6502 remains intact.

For those that don't even know how assembly works, you're essentially writing EXACTLY how the program runs, at the cost of simplicity. Unfortunately for ambitious ROM hackers, all console games are written in their respective system's assembly language. That's what these tutorials are for.

To get things started, open up SMWDisC and prepare to feel confused. Don't worry, the top of the file is just a bad first impression, made up of the more complex code (setting up sound and graphics, etc.). To start, let's make a minor modification to the ROM, such as I guess making the player start with 69 lives. To start, bring up SMWCentral's ever expanding ROM map, and Ctrl+F related words such as "life" or "lives". Eventually, one will find this:

$00:9E25	1 byte	Misc.	Amount of lives to start with.

Oh man, so I just go there in SMWDisC and change it?
Not quite. Open up a new instance of Notepad (ASM usually requires at least 5 tabs, 2 instances of Notepad, and a SNES emulator be open), and type the following:

header
lorom

org $009E25

Woah what the hell did you just type? Well, let's explain this using comments (if you don't know what comments are, gtfo they're lines of text placed after a symbol(s) that are ignored by the code. In this case, anything placed after a semicolon will not be added to the ROM).

header	;typing this let's the game know your ROM has a header (which it should by the way, if the ROM isn't 513KiB, it's not the right kind of ROM)
lorom	;lorom is essentially the way our ROM is formatted (all SMW ROMs are lorom, don't worry)

org $009E25	;org is a command that jumps straight to an area of the code, in this case area $009E25. Yes the dollar sign is neccisary, as you will see later.

So now we get to look in SMWDisC to clarify exactly what we're editing. Simply Ctrl+F 009E25, and make sure what is written there corresponds with the ROM map. If it can't find the area, try shifting up or down and search for 009E24 or 009E26.

What we'll find is this:

CODE_009E24:        A9 04         LDA.B #$04                
CODE_009E26:        9D B4 0D      STA.W RAM_PlayerLives,X

Woah, it says PlayerLives there! Surely it's right! But that thing above it says 4, and in SMW you start with 5 lives!

If you just thought that, let's explain hexadecimals. In the world of computing, hexadecimals represent exactly one byte of data, and a hexadecimal number can technically represent anything. That #$04 up there could mean 4, 5 or even -124! It all depends on how the number is used.

Hexadecimal is used for this because, no matter what the number represents, it will look the same as any other number, typically ranging from 00 to FF.
Wait, what? FF? Yeah, in hexadecimal, along with 0-9, a digit can go from A-F. Once a number reaches FF, it loops back to 0. A simple example is shown below:

0, 1, 2, 3 ... 8, 9, A, B, C, D, E, F, 10, 11 ... 18, 19, 1A, 1B, 1C, 1D, 1E, 1F, 20, 21 ... 9D, 9E, 9F, A0, A1, A2 ... FE, FF, 0, 1, 2 ...

In 65c816, all hexadecimal numbers are denoted with a dollar sign. $1000 is a hexadecimal number, while 1000 is a decimal. Simple, right? Well, it can get a bit complicated as you'll see later on, but for now, just know this:
If a number is 2 or 4 digits long, and has a # in front of it (#$10), it's a value, and you cannot change it alone to trigger actions in the game.
If there isn't a # ($10), it's a part of the RAM, and you can change it to trigger events within the ROM.
If it's 6 digits long ($048810), it's a part of the ROM you can jump to to reach an area of the code.

But now we're getting off topic. Where were we?

CODE_009E24:        A9 04         LDA.B #$04                
CODE_009E26:        9D B4 0D      STA.W RAM_PlayerLives,X

Ah, yes. As you can see, SMWDisC shows that the area of the ROM $009E25 does, in fact, change how many lives a player starts with. Why did we check this? Because it's always a good idea to check a more reliable source. People make mistakes, and mistakes can mistakenly be added to the ROM map by mistaken people. SMWDisC shows the game's code directly, so while not a very user-friendly source, it's plenty more reliable.

Back to our more bland text document we recently created, under "org $009E25", write:

DB $44	;Remember, the lives are in hexadecimal. To convert a decimal to a hexadecimal, use Windows Calculator under Programmer mode.

DB is a pseudocommand that writes a hexadecimal number directly to the ROM, without requiring you to specify any commands. DB itself isn't added to the ROM, it just lets the assembler know that there's no command needed, and to directly write $44. Without DB, the assembler would get confused, not knowing what to do with this number as there is no command before it. A DB can write multiple numbers to the ROM as well:

DB $44,$B2,$14,$1A	;However, we only need to change one value, so don't add this to your code.

Now we're done. We just made the player start with 69 lives.
Oh, you want to play it?
Well, I didn't know you would want to play such a sexually deviated game as this, but if you must, make a copy of your ROM, and place it in the same folder as the Xkas program you downloaded at the start of the thread. Now, move the txt you just saved into the same folder.
Ready? Good, open up Xkas v0.08, and follow the instructions, typing in the name of the ROM file and code file respectively.

If the file successfully patches, congrats!
Oh, but does it really work? After all, a computer can not sense if a human will be able to complete the game, as long at the program runs it's assumed to work.

Open the ROM you just added the code to in a SNES emulator (any is fine). Keep tapping B until you get to the overworld and...!
If Mario started with 69 lives, congratulations, you just hacked the game! An insignificant mod, but a mod nonetheless. In the following days I will go over more commands like ORG and DB, and get into more complex topics about ROM hacking as whole. Until next time, see ya!

[NismoZ]

I figured this was the best place to ask for help.

I made a patch to keep the sprites on screen when you press a button on the title screen. Following instructions on the SMWC ROM Map, I made this code:

header
LOROM

org $009C9F
DB $EA,$EA,$EA,$EA

The patch works perfectly fine; the only problem is the information upon loading:

"SUPER MARIOWORLD" [bad checksum] Lo
ROM, 8Mbits, Type: ROM+RAM+BAT, Mode
: 20, TV: NTSC, S-RAM: 2KB ROMId: -
--- Company: 01 CRC32: D8DAEB00

Now my ROM didn't come with the correct name, meaning I don't know if it's headered or not. So I got rid of header, and this happened:



So I know the original code is correct, but I just want to prevent a checksum fail.

EDIT: After downloading a patch from SMWC, I found that I always get a checksum fail when I patch. >_<

[randoguy101]

Rule Number 1: You will ALWAYS get a Checksum fail upon editing a ROM (Lunar Magic automatically fixes the checksum upon game save)
Rule Number 2: NEVER delete the header. EVER.

Checksum fails are actually not a bad thing as long as you're using an emulator anyway so don't worry about it

[NismoZ]

So I have a couple of issues at the moment. First, I can't get LevelASM to work on a clean ROM. It crashes it when I select a file. When I deleted the default code that came with level 105, the title screen circle doesn't appear and I can't advance. Also, I found a Lakithunder on SMWC, but I don't know enough ASM to turn it into a boss battle. Basically I need a boss finish and then yellow switch blocks to be spat out on the map screen. (and of course the yellow blocks appearing in he levels)

[randoguy101]

Originally Posted by NismoZ

I can't get LevelASM to work on a clean ROM. It crashes it when I select a file. When I deleted the default code that came with level 105, the title screen circle doesn't appear and I can't advance.

Did you remember to set the freespace at the top of the file? If you didn't, there's a good chance you overwrote another patch's code.

Originally Posted by NismoZ

Also, I found a Lakithunder on SMWC, but I don't know enough ASM to turn it into a boss battle. Basically I need a boss finish and then yellow switch blocks to be spat out on the map screen. (and of course the yellow blocks appearing in he levels)

I don't know how to do that either
(and thus I lost 50 peoples' respect)

[NismoZ]

Originally Posted by randoguy101

Did you remember to set the freespace at the top of the file? If you didn't, there's a good chance you overwrote another patch's code.

Well, it doesn't seem to do anything in my hack; only on a clean ROM (in which case it crashes). And I left the freespace at the default $1D8000, which I would assume be empty.

I don't know how to do that either
(and thus I lost 50 peoples' respect)
Well, uh, would you know how to make a door or whatever spawn? That works too.

[randoguy101]

http://www.smwcentral.net/download.p...239&type=tools
Download this program (instructions in readme.txt) and see if $1D8000 lands there. More importantly, see how much size is allowed in $1D8000. If there isn't about D00 free bytes there, it's not freespace.

ALSO, $1D8000 only exists in a ROM edited by Lunar Magic, so of course it would crash a clean ROM. You should only test patches and programs on ROMs ALREADY EDITED BY LUNAR MAGIC, due to the important upgrades it adds to the ROM.