NES Game Genie Technical Notes

[dlevere]

NES Game Genie Technical Notes
by The Mighty Mike Master

with thanks to [email protected] for
helping me figure out the NES Game Genie codes.

The NES Game Genie from Galoob is a device that allows a player to enter a
variety of codes into a Nintendo Entertainment System game in order to cause
the game to do things it would not normally do, e.g., grant the player extra
(or fewer) lives at startup, give the player extra items, change the gameplay,
or just cause crazy things to happen.

The NES Game Genie works by allowing the player to plug an NES game cartridge
into it and then plug the Game Genie into the NES console in place of the
cartridge. The Game Genie then allows the player to enter a code which consists
entirely of letters. The codes come in two flavors: 6- and 8- character. The
codes translate into addresses and data in a game's program space (upper
half of address space, 0x8000-0xFFFF) which the Game Genie fools the CPU into
using rather than the byte which is supposed to be there. Because of this
method, there is no limit to the number of Game Genie codes that can be discovered.

6-Character Codes

6-character NES Game Genie codes translate into a 15-bit (not 16-bit) address
and an 8-bit data byte. The address is 15-bit because address bit 15 is always
set to 1 in order to reference the top half of the CPU address space. When the
CPU attempts to read the memory address specified by the Game Genie code, the
Game Genie apparently intercepts the read and substitutes the byte from the
Game Genie code in place of the actual ROM byte.

To decode an NES Game Genie code, first translate each character into its
hexadecimal equivalent using the following table:

        A  0x0
        P  0x1
        Z  0x2
        L  0x3
        G  0x4
        I  0x5
        T  0x6
        Y  0x7
        E  0x8
        O  0x9
        X  0xA
        U  0xB
        K  0xC
        S  0xD
        V  0xE
        N  0xF

Then comes the tricky part. There is a lot of convoluted bit shifting that
occurs in order to get the address and data from a Game Genie. This is
probably to make the Game Genie codes seem more magical. After all, given
2 Game Genie codes, one that granted 5 lives on startup and another code that
granted 9 lives, and the only difference between the 2 codes was one
character, even a novice player could probably figure out that modifying that
one character to any of the acceptable letter characters would grant between
1 and 16 lives on startup.

In order to decode the 6-character NES Game Genie code, name the 6 characters/hex
values [n0 .. n5]. Follow the pseudocode (which assumes you
know the C-style operators for bitwise AND (&amp, bitwise OR (|), and the << and
>> bit shift operators):

        address=0x8000 + 
              ((n3 & 7) << 12)
            | ((n5 & 7) << 8) | ((n4 & 8) << 8)
            | ((n2 & 7) << 4) | ((n1 & 8) << 4)
            |  (n4 & 7)       |  (n3 & 8);

The algorithm simply combines the lower 3 bits from one 4-bit nibble and the
top bit from another nibble and puts the resulting nibble somewhere else. Here
is the data algorithm:

        data =
             ((n1 & 7) << 4) | ((n0 & 8) << 4)
            | (n0 & 7)       |  (n5 & 8);

Example:
The code is GOSSIP (amazing coincidence that it happens to also be an English
word). This works in Capcom's Ghosts 'n Goblins to start your player with a
really funky weapon. Work through the code by hand to see if understand the
decoding algorithm.

           n0   n1   n2   n3   n4   n5
           G    O    S    S    I    P
          0x4  0x9  0xD  0xD  0x5  0x1
         0100 1001 1101 1101 0101 0001

         address=0xD1DD, data=0x14

Therefore, whenever the CPU reads from address 0xD1DD, the Game Genie will
intercept the read and return the byte 0x14.

8-Character Codes

8-character NES Game Genie codes are similar to the 6-character variety
except that there is also a compare byte value that needs to be decoded as
well. This is most likely due to the fact that many games use memory mappers
in order to increase the amount of code and data they can use. Since the game
might be swapping program (PRG) banks in and out of the CPU address space, the
Game Genie can't just return the code data value when the CPU reads from a
particular address. Instead, when the CPU reads from the cartridge, the Game
Genie checks if the address in the cartridge equals the compare value and
returns the code data value if it does; otherwise, it returns the real value
in the cartridge.

The algorithm for decoding the address of an 8-character code is the same as
decoding the address for a 6-character code. The algorithm for decoding the
data byte changes a little:

        data =
             ((n1 & 7) << 4) | ((n0 & 8) << 4)
            | (n0 & 7)       |  (n7 & 8);

And the algorithm for decoding the compare value is as follows:

        compare =
             ((n7 & 7) << 4) | ((n6 & 8) << 4)
            | (n6 & 7)       |  (n5 & 8);

Example: The code is ZEXPYGLA. This works on Dr. Mario in order to clear
a row or column with only 3 colors in a line, rather than 4. Work through
the code by hand to see if understand the decoding algorithm.

           n0   n1   n2   n3   n4   n5   n6   n7
           Z    E    X    P    Y    G    L    A
          0x2  0x8  0xA  0x1  0x7  0x4  0x3  0x0
         0010 1000 1010 0001 0111 0100 0011 0000

         address=0x94A7, data=0x02, compare=0x03

Therefore, when the CPU reads from address 0x94A7 and the real byte at that
address is 0x03, then the Game Genie will return 0x02 instead of 0x03. If the
byte is something other than 0x03, then that byte will be returned.

- The Mighty Mike Master