Tweet
A document detailing a method for editing NES music using NSF files.
By Sliver X
Hacking NES Music?
Version 1.0
Yes, it is possible, and it doesn't require knowledge of ASM. I spent the
better part of 3 months hacking the music in Dragon Warrior last year
(And I'm in the process now of figuring out Ghosts 'N Goblins's format),
and got a system down that, while not easy, should let you hack the music
for pretty much any NES game, that is, if an NSF is available for it.
Note: Creating an NSF file DOES require knowledge of ASM, since
an NSF file is really the actual sound code ripped from an NES ROM,
which is a bitchy process so I hear. So be thankful to the people who took
the time and effort to ASM hack the music, as this process would be infinitely
harder without the aid of NSF files.
Also, using ASM to hack music would be MUCH easier than the
process this document explains, (which is half assed to say the least.)
but you're on your own learning assembly code, as I have next to no
knowledge of it myself.
Step one: Get the NSF file for the game you're interested in hacking, and an
NSF player.
A pretty large database of these can be found at Zophar's Domain.
( http://www.zophar.net )
As far as players go, I recommend GNSF, or Nosefart, for reasons mentioned
later on.
Step two: Random file corruption.
FIRST OF ALL MAKE A BACKUP OF THE ORIGINAL NSF FILE!
There's two ways you can go about this. One is to use a program called ROM
Corrupter, which will let you insert random hexadecimal values in a defined
area of the NSF. The other way is to do it by hand in a hex editor, which is
much slower, but gives you a little more control over what you're doing.
Either way, corrupt a section of data in the NSF file, (Typically don't do
it near the beginning of the file, as the data there is usually not music.)
and load it up in your NSF player. Check and see if any of the music sounds
different, or doesn't even play at all.
If not, keep corrupting data until
something like this happens. If so, take your unaltered copy of your NSF file
, overwrite the one you changed, open it up again in whatever program you're
doing the corrupting with, and go to the starting offset that you started
changing data at. Try corrupting 16 bytes at a time, checking each time until
you get the changes you did before. Now you should have isolated a piece of
the music data. If it's not at the beginning of the song/sound, try and
corrupt data upward from this location until you find it. Doing this will
make it a lot easier to understand the format you're about to crack, as most
games I've looked at have some kind of pointers/control codes at the beginning
of the data string.
From here, the process gets murky, as almost no two NES
games use the same format to produce sound. By now you should know what byte
is the first note in the song. Open up the NSF in a hex editor, and try
changing this one byte's value to see what effect it produces. This is
easily the most tedious aspect of music hacking. Depending on the way the
format is laid out, a byte could signify a note, a rest, etc. Or it could be
something I call a "control byte", which has some other effect on the data
afterwards.
An example of this can be found in Dragon Warrior's music format,
parts of which work like this. The values 01-7F are rests. The values 80-BF
are notes. The byte FB followed by a value is a control byte that determines
the tone of the notes following it. (Example FB7F) This can produce staccato
notes, or notes that continuously sound (Like a wind instrument), etc. The
byte F7 followed by a hex value determines the tempo of the channel. FE
followed by two hex values is some kind of pointer telling the song to jump
to another section of code.(I never really figured this aspect out too much.)
FD seems to determine the repeat of certain sections.
Now, the game you're
hacking will most likely not use a system anything like this, I'm just showing
you this example to give you an idea of what you're trying to look for.
However, with few exceptions, most NES game music I've messed with has the
data for each of the 5 sound channels (Square 1, Square 2, Triangle, Noise,
and PCM) stored separately. With Nosefart or GNSF, you can bring up a screen
that'll show you each of the channels playing, with the option of turning off
channels to hear through the clutter for your changes, as well as letting you
know which channel's data you've altered. Trial and error, extreme patience,
and a lot of free time will get the format cracked and ready for hacking
eventually.
Step 3 Insertion into the actual ROM.
Once you've gotten the format figured out, and you've hacked your own music
into the NSF file, now you'll want to put it in the ROM itself. The easiest
way to do this is as follows.
Open up the UNALTERED NSF file you have, and go
to the offset where the beginning data for whatever music you've made is at
in the NSF you've been hacking. Open up the ROM, and search for the values
from your unaltered NSF. You should get a match. Now all you have to do is
take the music data from your hacked NSF, and overwrite the data in the ROM
with your own.
!!!!!!!!!
!WARNING!
!!!!!!!!!
This may not be as easy as you'd think. I mentioned
pointer controls earlier in this document, and they can cause problems with
insertion. The pointer values are going to be different due to the data being
stored at a different location in the NSF as compared to the ROM. If you've
figured out how the pointer system works already, all you'd have to do is
compensate for the different data address. If you don't, then you're going
to need to figure it out. Once this is done, play the game and see if the
music works right.
I know this info is vague and sketchy, but this is how I hack NES music, so
it's about the only way I can tell you. Remember, hacking NES music is an
aggravating, sometimes mind numbing experience, but if you can pull it off,
the results are more than worth the hassle.
Sliver X
28/June/2001
By Sliver X
Hacking NES Music?
Version 1.0
Yes, it is possible, and it doesn't require knowledge of ASM. I spent the
better part of 3 months hacking the music in Dragon Warrior last year
(And I'm in the process now of figuring out Ghosts 'N Goblins's format),
and got a system down that, while not easy, should let you hack the music
for pretty much any NES game, that is, if an NSF is available for it.
Note: Creating an NSF file DOES require knowledge of ASM, since
an NSF file is really the actual sound code ripped from an NES ROM,
which is a bitchy process so I hear. So be thankful to the people who took
the time and effort to ASM hack the music, as this process would be infinitely
harder without the aid of NSF files.
Also, using ASM to hack music would be MUCH easier than the
process this document explains, (which is half assed to say the least.)
but you're on your own learning assembly code, as I have next to no
knowledge of it myself.
Step one: Get the NSF file for the game you're interested in hacking, and an
NSF player.
A pretty large database of these can be found at Zophar's Domain.
( http://www.zophar.net )
As far as players go, I recommend GNSF, or Nosefart, for reasons mentioned
later on.
Step two: Random file corruption.
FIRST OF ALL MAKE A BACKUP OF THE ORIGINAL NSF FILE!
There's two ways you can go about this. One is to use a program called ROM
Corrupter, which will let you insert random hexadecimal values in a defined
area of the NSF. The other way is to do it by hand in a hex editor, which is
much slower, but gives you a little more control over what you're doing.
Either way, corrupt a section of data in the NSF file, (Typically don't do
it near the beginning of the file, as the data there is usually not music.)
and load it up in your NSF player. Check and see if any of the music sounds
different, or doesn't even play at all.
If not, keep corrupting data until
something like this happens. If so, take your unaltered copy of your NSF file
, overwrite the one you changed, open it up again in whatever program you're
doing the corrupting with, and go to the starting offset that you started
changing data at. Try corrupting 16 bytes at a time, checking each time until
you get the changes you did before. Now you should have isolated a piece of
the music data. If it's not at the beginning of the song/sound, try and
corrupt data upward from this location until you find it. Doing this will
make it a lot easier to understand the format you're about to crack, as most
games I've looked at have some kind of pointers/control codes at the beginning
of the data string.
From here, the process gets murky, as almost no two NES
games use the same format to produce sound. By now you should know what byte
is the first note in the song. Open up the NSF in a hex editor, and try
changing this one byte's value to see what effect it produces. This is
easily the most tedious aspect of music hacking. Depending on the way the
format is laid out, a byte could signify a note, a rest, etc. Or it could be
something I call a "control byte", which has some other effect on the data
afterwards.
An example of this can be found in Dragon Warrior's music format,
parts of which work like this. The values 01-7F are rests. The values 80-BF
are notes. The byte FB followed by a value is a control byte that determines
the tone of the notes following it. (Example FB7F) This can produce staccato
notes, or notes that continuously sound (Like a wind instrument), etc. The
byte F7 followed by a hex value determines the tempo of the channel. FE
followed by two hex values is some kind of pointer telling the song to jump
to another section of code.(I never really figured this aspect out too much.)
FD seems to determine the repeat of certain sections.
Now, the game you're
hacking will most likely not use a system anything like this, I'm just showing
you this example to give you an idea of what you're trying to look for.
However, with few exceptions, most NES game music I've messed with has the
data for each of the 5 sound channels (Square 1, Square 2, Triangle, Noise,
and PCM) stored separately. With Nosefart or GNSF, you can bring up a screen
that'll show you each of the channels playing, with the option of turning off
channels to hear through the clutter for your changes, as well as letting you
know which channel's data you've altered. Trial and error, extreme patience,
and a lot of free time will get the format cracked and ready for hacking
eventually.
Step 3 Insertion into the actual ROM.
Once you've gotten the format figured out, and you've hacked your own music
into the NSF file, now you'll want to put it in the ROM itself. The easiest
way to do this is as follows.
Open up the UNALTERED NSF file you have, and go
to the offset where the beginning data for whatever music you've made is at
in the NSF you've been hacking. Open up the ROM, and search for the values
from your unaltered NSF. You should get a match. Now all you have to do is
take the music data from your hacked NSF, and overwrite the data in the ROM
with your own.
!!!!!!!!!
!WARNING!
!!!!!!!!!
This may not be as easy as you'd think. I mentioned
pointer controls earlier in this document, and they can cause problems with
insertion. The pointer values are going to be different due to the data being
stored at a different location in the NSF as compared to the ROM. If you've
figured out how the pointer system works already, all you'd have to do is
compensate for the different data address. If you don't, then you're going
to need to figure it out. Once this is done, play the game and see if the
music works right.
I know this info is vague and sketchy, but this is how I hack NES music, so
it's about the only way I can tell you. Remember, hacking NES music is an
aggravating, sometimes mind numbing experience, but if you can pull it off,
the results are more than worth the hassle.
Sliver X
28/June/2001