Hacking The general VC rom injection thread (NES,GB/C/A etc.)

[lps]

they have to be under 3 seconds long

I cut file to 2,75 sec but it still plays incorrect :/

 

[gamesquest1]

I cut file to 2,75 sec but it still plays incorrect :/

try a few different wav files i think it can be a bit picky on formatting also try to different conversion tools....one of the online ones works, but im not sure exactly what kinds of input it wants....just mess about try different sampling rates and such.
have a read here
http://3dbrew.org/wiki/BCWAV

 

[einstein95]

The menu jingles are stereo, 24.0 KHz. Converted using SDK tool and it works fine.

Borders to put the VC titlescreen in for added authenticity to your icons
http://i.imgur.com/SG3bfIH.png http://i.imgur.com/WKEgRrU.png

And through trial+error, I have updated my TNES doc and now includes all mappers from 0-6, including MMC2 and MMC4, needed for Punch-Out!! and Fire Emblem/Famicom Wars.
http://pastebin.com/KLeWt2W3
Note: The mirroring is correct, the doc linked on the first post incorrectly states the mirroring for games where there is none (where it's controlled my the mapper). I personally use MESS's softwarelist for reference: https://raw.githubusercontent.com/mamedev/mame/master/hash/nes.xml

 

[KJ1]

Can I ask what this actually does and on which firmware it works? Thanks for the reply.

 

[bobmcjr]

http://gbatemp.net/threads/gbc-vc-generator.371819/page-7#post-5148680

 

[einstein95]

After buying (yes, shock horror, buying) and decrypting The Mysterious Murasame Castle, I have a slightly better knowledge on the format used for FDS VC games. We have the TNES header using mapper 0x64 and 2 of the unknown values, an interesting 0x2000 byte block and the ROM in .qd format as seen in the GC Animal Crossing and the Wii VC games (SMB Lost Levels, some JP games).

Edit: So apparently the 0x2000 block is a modified/hacked FDS BIOS, unsurprisingly.

Edit 2: In today's "Hacker Does What Nintendon't", hacker patches 3DS VC Murasame's Castle to English

 

[einstein95]

delete me

 

[Stepik]

After buying (yes, shock horror, buying) and decrypting The Mysterious Murasame Castle, I have a slightly better knowledge on the format used for FDS VC games. We have the TNES header using mapper 0x64 and 2 of the unknown values, an interesting 0x2000 byte block and the ROM in .qd format as seen in the GC Animal Crossing and the Wii VC games (SMB Lost Levels, some JP games).

Famicom Disk System games all in japanese?

 

[einstein95]

Famicom Disk System games all in japanese?

Yes, the FDS VC games (like overseas release of Mysterious Murasame Castle) are still in Japanese. They can be hacked by modifying the relatively same bytes the .fds English translations change.

 

[Yoshi9288]

How can i do an Multirom VC Game? i have named Super Mario Land 1 into SUPERMA1.f11 and Super Mario Land 2 into SUPERMA2.f11 but the VC loads only Super Mario Land 1.

 

[Normmatt]

I have a tool to decrypt and decompress them... I'll have to get around to making it recompress and encrypt them before I release it though.

Just make sure to keep the same file names (as they are used for the encryption).

Download

 

[st4rk]

Just make sure to keep the same file names (as they are used for the encryption).

Download

Did you tried other games like Sonic & Knuckles ?

 

[hippy dave]

Just make sure to keep the same file names (as they are used for the encryption).

Download

Thanks! Any chance of source? Would like to try for a mac build.

 

[bobmcjr]

Just make sure to keep the same file names (as they are used for the encryption).

Download

I was not aware of the filename requirement. Finally got Battletoads working (albeit without sound, and obviously no 3D).

TiTAN Overdrive boots, but freezes on the first 3D part.

 

[st4rk]

I was not aware of the filename requirement. Finally got Battletoads working (albeit without sound, and obviously no 3D).

TiTAN Overdrive boots, but freezes on the first 3D part.

I wanna try with Sonic 2, i hope it work fine

 

[bobmcjr]

I wanna try with Sonic 2, i hope it work fine

Yes, but again no sound, and 2 glitchy rows of pixels at the bottom.

 

[davhuit]

Hello. I tried to inject a NES rom but it failed.

Does we also use "Pokemon Crystal" for NES roms or something else? (From what I read, it was working using "Pokemon Crystal").

I got a NES roms with the same mapper (NES.Open.Tournament.Golf.NES.VC.USA.3DS-BigBlueBox.3ds) as the game I want to inject. I drag 'n drop it on "prepare.bat" but it says :

Error, program id mismatch. Wrong key?
Unknown file

In the "tempfold", I only have "exh.bin" (2kb) when on the gameboy one (I sucessfully injected several gb/gbc roms), I have :

banner.bin
code.bin
exh.bin
icon.bin

and a "romfs" sub-directory.

Thanks a lot!

Edit : I just saw there are two methods in the first post, I'll try the other one to see (Retail encrypted VC games)

Edit 2 : Perfect. Just managed to replace "Nes Open Golf" with "Maniac Mansion" Now I just need to do banner and icon like I do for GB ones.

Only weird thing though is that there don't seem to be any savestate function like others VC games, is it normal? (maybe some games don't have any?) Or do I have to activate a flag somewhere? (I just double checked and my Zelda 2 bought on Eshop have one). I'll try the original unedited rom to check.

Edit 3 : I tested the unedited rom and it don't have any savestate function. So, I'll use another NES VC rom as a base (I assume it won't change anything, as long as the header I use is correct).

Edit 4 : What is weird is my legit Zelda 2 have a savestate function and the one found on internet don't have one. Is there several versions of those eshop games?

Edit 5 : Okay, it seems there are some "v2" of the roms. Metroid (v2) have the savestate function so I'll retry with this rom.

Edit 6 : By the way, I found that in Metroid rom, if it can interest some people : NESMT0A.032.patch

[Title Flash]
Mode = 1
Address = 0xACD
Fixcode = a8: 11 11 11 01 01 01 01 01
 
[Mother Flash]
Mode = 1
Address = 0xDE5D
Fixcode = a3: EA EA EA
 
[Mother Brain Flash]
Mode = 2
Type = 1
Address = 0xDE5D

Edit 6 : Everything is okay, thanks for the tutorial

 

[davhuit]

I'm doing a double post, feel free to merge them if you want, it's just to have it more clear, as I did severa edit to my previous posts that might already have been read by most people.

So, I tried to understand more precisely how mapper works and here's what I understood, thanks to those two links, http://pastebin.com/KLeWt2W3 & http://tuxnes.sourceforge.net/nesmapper.txt :

Header template : 54 4E 45 53 (A) (B) (C) (D) (E) (F) 00 00 00 00 00 00

54 4E 45 53 01 20 00 01 00 01 00 00 00 00 00 00

So, there are six values to change (A, B, C, D, E, F).

(A) : Header

Type/Value

NROM => 00
MMC1 => 01
MMC2 => 02
MMC3 => 03
MMC4 => 04
MMC5 => 05
UNROM => 06

(B) : PRG Size.

Size/Value

16k => 02
32k => 04
64k => 08
128k => 10
256k => 20
512k => 40
1024k => 80

(C) : CHR Size
0 => 00
8 => 01
16 => 02
32 => 04
64 => 08
128 => 10
256 => 20
512 => 40
1024 => 80

(D) : WRAM

No => 00
Yes => 01

(E) : Mirroring

None => 00
Horizontal : 01
Vertical : 02

(F) : VRAM

No => 00
Yes => 01

I have a few questions, still.

How do we know if the game need WRAM? It sometimes seems to be used for games with battery, but not everytime, and the list I copy-pasted the link don't mention it.

Same for VRAM.

Thanks a lot!

This tool seems to be able to give most infos about the rom header : http://www.romhacking.net/utilities/683/ (it include the VRAM value, so only remaining one is WRAM. Would that be the battery flag?)

It even give a list of some others roms that share the same settings in "example roms".

 

[einstein95]

This tool seems to be able to give most infos about the rom header : http://www.romhacking.net/utilities/683/ (it include the VRAM value, so only remaining one is WRAM. Would that be the battery flag?)

Yes, WRAM seems to indicate whether the game has WRAM or battery-backed WRAM not just if the game has save.

 

[davhuit]

And how can we know if a game use wram if it don't use a battery? Is there a tool who can give us the info? I know there is a tool to auto-fix the header, but as the only one I did myself worked perfectly and the ones I did with the tool had some problems, I prefer to try to do them manually if I can.