Hacking NES Music?
Hacking NES Music?
Version 1.0
Yes, it is possible, and it doesn't require knowledge of ASM. I spent the better part of 3 months hacking the music in Dragon Warrior last year (And I'm in the process now of figuring out Ghosts 'N Goblins's format), and got a system down that, while not easy, should let you hack the music for pretty much any NES game, that is, if an NSF is available for it.
Note: Creating an NSF file DOES require knowledge of ASM, since an NSF file is really the actual sound code ripped from an NES ROM, which is a bitchy process so I hear. So be thankful to the people who took the time and effort to ASM hack the music, as this process would be infinitly harder without the aid of NSF files.
Also, using ASM to hack music would be MUCH easier than the process this document explains, (which is half assed to say the least.) but you're on your own learning assembly code, as I have next to no knowledge of it myself.
Step one: Get the NSF file for the game you're interested in hacking, and an NSF player.
A pretty large database of these can be found at Zophar's Domain.
(http://www.zophar.net)
As far as players go, I recommend GNSF, or Nosefart, for reasons mentioned later on.
Step two: Random file corruption.
FIRST OF ALL MAKE A BACKUP OF THE ORIGINAL NSF FILE!
There's two ways you can go about this. One is to use a program called ROM Corrupter, which will let you insert random hexadecimal values in a defined area of the NSF. The other way is to do it by hand in a hex editor, which is much slower, but gives you a little more control over what you're doing.
Either way, corrupt a section of data in the NSF file, (Typically don't do it near the beginning of the file, as the data there is usually not music.) and load it up in your NSF player. Check and see if any of the music sounds different, or doesn't even play at all.
If not, keep corrupting data until something like this happens. If so, take your unaltered copy of your NSF file , overwrite the one you changed, open it up again in whatever program you're doing the corrupting with, and go to the starting offset that you started changing data at. Try corrupting 16 bytes at a time, checking each time until you get the changes you did before. Now you should have isolated a piece of the music data. If it's not at the beginning of the song/sound, try and corrupt data upward from this location until you find it. Doing this will make it alot easier to understand the format you're about to crack, as most games I've looked at have some kind of pointers/control codes at the beginning of the data string.
From here, the process gets murky, as almost no two NES games use the same format to produce sound. By now you should know what byte is the first note in the song. Opend up the NSF in a hex editor, and try changing this one byte's value to see what effect it produces. This is easily the most tedious aspect of music hacking. Depending on the way the format is laid out, a byte could signify a note, a rest, etc. Or it could be something I call a "control byte", which has some other effect on the data afterwards.
An example of this can be found in Dragon Warrior's music format, parts of which work like this. The values 01-7F are rests. The values 80-BF are notes. The byte FB followed by a value is a control byte that determines the tone of the notes following it. (Example FB7F) This can produce stacatto notes, or notes that continuously sound (Like a wind instrument), ect. The byte F7 followed by a hex value determines the tempo of the channel. FE followed by two hex values is some kind of pointer telling the song to jump to another section of code.(I never really figured this aspect out too much.) FD seems to determine the repeat of certain sections.
Now, the game you're hacking will most likely not use a system anything like this, I'm just showing you this example to give you an idea of what you're trying to look for. However, with few exceptions, most NES game music I've messed with has the data for each of the 5 sound channels (Square 1, Square 2, Triangle, Noise, and PCM) stored seperatly. With Nosefart or GNSF, you can bring up a screen that'll show you each of the channels playing, with the option of turning off channels to hear through the clutter for your changes, as well as letting you know which channel's data you've altered. Trial and error, extreme patience, and alot of free time will get the format cracked and ready for hacking eventually.
Step 3 Insertion into the actual ROM.
Once you've gotten the format figured out, and you've hacked your own music into the NSF file, now you'll want to put it in the ROM itself. The easiest way to do this is as follows.
Open up the UNALTERED NSF file you have, and go to the offset where the beginning data for whatever music you've made is at in the NSF you've been hacking. Open up the ROM, and search for the values from your unaltered NSF. You should get a match. Now all you have to do is take the music data from your hacked NSF, and overwrite the data in the ROM with your own.
!!!!!!!!!
!WARNING!
!!!!!!!!!
This may not be as easy as you'd think. I mentioned pointer controls earlier in this document, and they can cause problems with insertion. The pointer values are going to be different due to the data being stored at a different location in the NSF as compared to the ROM. If you've figured out how the pointer system works already, all you'd have to do is compensate for the different data address. If you don't, then you're going to need to figure it out. Once this is done, play the game and see if the music works right.
I know this info is vauge and sketchy, but this is how I hack NES music, so it's about the only way I can tell you. Rememeber, hacking NES music is an aggravating, sometimes mind numbing experience, but if you can pull it off, the results are more than worth the hassle.
Sliver X
28/June/2001
