About the internal structure of NES games, this time I will talk about the research tools I use.
Most of what a researcher needs is already in the FCEUX emulator, which is well suited for debugging games. It is worthwhile to thoroughly study the section in the documentation Debug, each tool from there is useful to the researcher, and the ability to use them in conjunction with each other enhances the hacker’s capabilities.
However, I will not retell the documentation, but will focus on cases when the emulator’s capabilities are few and it is necessary to add new ones, or when there are unusual ways to find what you want in a ROM file directly, bypassing lengthy study of game code.
Using Lua scripts
Actually, the first method, an example of which is shown in the picture to attract attention, is to create auxiliary tools using the Lua script interpreter built into the emulator.In the example above, to study the game (and simply cheat, if desired), we use such scripting capabilities as displaying images on the screen on top of the picture drawn by the emulator.
In this way, the researcher can notice something that is inaccessible to an ordinary player, for example, in the screenshot above, of the three hidden diamonds, the player can only jump to the first two, and in no way can take the third one or even just guess about its existence. In DuckTales 2, there are even jewels that are generally placed outside the game level.
Another example of a script with additional data displayed on the screen is a compass to the nearest gem in The Jungle Book:
Naturally, visualizing information from RAM or game ROM is not the only possibility of scripts.
Another frequently used option is logging what is happening in the game code, for example, a script template for dumping unzipped data immediately after unpacking it (for SMD games, but the principle is also applicable for NES).
Well, no one forbids creating full-fledged utilities using Lua scripts, like the keystroke editor already included in the emulator TasEditor.
Also, in my opinion, the idea is underestimated partial rewriting of the game code using scripts, when game data is patched by a script on the fly to modify gameplay. Proof-of-concept of such a script that modifies enemies in “New Ghostbusters 2”:
However, for complex processing of a specific game or creating new hack methods, it is worth considering using the following method.
Modifying the emulator source code
There is room for your imagination to run wild here. different topics, not related to game research, such as adding support for achievements to emulators, 3D rendering or improved graphics, but I will try to stay within the scope of the article.One of the directions for expanding the emulator in order to improve the capabilities for reverse engineering is throwing as much as possible more its internal capabilities in the Lua library. In the second article of the series, I already showed how, by adding just a couple of new functions, it became possible to make a universal (suitable for researching any game) research tool.
Another simple and useful example, which is not yet available in the latest version of the emulator - Possibility of modification from the PPU memory script.
Modifying the emulator can also be used to embed an editor for a specific game into it with the ability to run it on the fly and check the changes made:
Scripts for static analysis of game code
The previous two categories of modifications concerned the dynamic analysis of the game during its execution. However, most of the research is a static analysis of the game's ROM file (or dumps of any data from it).The main program for such code analysis is the interactive disassembler IDA. It supports 6502 assembler, however requires both plugin to correctly load files in nes format, and set of scripts to automate routine actions to convert the downloaded file into neat code. A set of scripts specific to the study of NES games has been collected.
The scripts themselves for IDA can be written in the built-in command language idc or python , in any case, it is best to open them with a text editor and study them; in most cases, this helps to better understand the commands of the IDA itself, which will be useful in working with it and learn how to write such scripts yourself. This will be very useful when you need to carry out several hundred similar actions, such as combining bytes into pointers or allocating arrays according to certain rules.
Tools for static analysis of game data
IDA is a good tool for code analysis, so good that some game research gurus even believe that it alone is sufficient for researching and modifying games. However, even if you have a game that has been disassembled into compiled and commented sources, it is difficult to modify game data - levels, graphic cards, character animations. Unfortunately, the format of game data often differs greatly from game to game, making it difficult to create universal tools suitable for most games.Tile map editors
Graphic bank storage format (the most low level graphics storage) is standard for all NES games, so there are many tile map editors, however, among them I did not find a single library that would allow rendering these tiles in my application.With such programs you can edit graphics tiles in games with CHR-ROM - entire banks of graphics. Other games use CHR-RAM - the video memory of tiles in them is read in parts from a bank of data and code and copied into video memory (sometimes in quite cunning ways, but it would be better to talk about them in an article on data compression).
At a higher level, games differ so much that there are practically no common editing programs; at most, there are editors that cover several games on one engine. I will write about my attempts to make a universal level editor at the end of the article, but in the meantime I will give a few more general ideas on how to find data in games, and utilities that implement these ideas.
The implementation language I use is python because it allows you to quickly and easily check any guess, sometimes even directly in an interactive mode.
Corrupt ROM
Actually, it was just about this idea - if you go through everything possible options Changing one byte in the ROM and seeing how it affects the screen can help clarify the internal structure of the game. After this, it is even possible to create a simple version of the game editor - you need to prepare a set of top-level picture blocks from which the screen is built, without fully delving into how these pictures themselves are built from ROM data and display the array of these pictures detected by this method.Search for blocks
You can also go from the other side.The background that is displayed on the screen is set by an array of video memory tile indexes at a fixed PPU address - for the NES there are 4 screen pages, which, depending on the PPU settings, can different ways is displayed on the screen. It doesn’t matter what exactly will be on the screen, just grab some loaded page for analysis.
The first screen page (Name Table) is located at PPU addresses $2000-$23BF. Its contents in the emulator FCEUX can be seen in the window Debug → Name Table Viewer :
And also as bytes in the window Debug → Hex Editor, View → PPU Memory (go to $2000).
Here you can make a dump of the entire video memory, which will be useful to us for analysis ( File → Dump to File → PPU Memory ).
It's simply an array of 960 indexes of small 8x8 pixel video memory tiles. At the same time, after reverse large number games, it is known that game screens are often described as blocks bigger size, for example 16x16 or 32x32 pixels. Thus, if we assume a certain block size (first, let’s try the most standard ones - 2x2 tiles, highlighted in the screenshot with a red frame), then we can divide the data from the screen page into sections, each of which will contain a description of one block.
This produces a list of all the blocks that are present on the screen. Moreover, we have “pure” block descriptions, without information about character sprites (sprites are drawn in a different way), and independent of animation (background animations are almost always done by changing the palette or video memory itself, the tile numbers in the Name Table remain unchanged). However, we do not know the block numbers.
We have a description of the blocks on the screen, but we don't know the order in which they are stored in ROM. However, we can guess with some probability where exactly the block description is located. The algorithm for this is:
1. We go through the entire ROM and mark all the addresses at which a block is found, while saving its number (the real number may be different, it is important for us to note only the differences between the blocks from each other).
2. Find the area in ROM in which it is detected greatest number DIFFERENT blocks. Most likely this is the description of the blocks.
So we can find 2x2 blocks in games that store them sequentially.
This is already good, but there is a way to radically improve the results of the algorithm. The point is that there are a limited number of basic block sizes and ways to store them in ROM, and we can iterate over them all.
The main block sizes are 2x2, 4x2, 2x4 and 4x4, but other sizes can be easily added if necessary.
The way they are stored in ROM is a little more tricky; blocks can be stored either linearly or in arrays broken into pieces (Structure of Arrays, abbreviated SoA), i.e. First, an array of only the first parts of blocks is stored in ROM, followed by arrays with the next parts. Most often, such arrays are stored one after another, and the gap between the beginnings of the arrays is equal to the number of blocks. To find such SoA arrays in ROM, we need to find out their length, which can be done by searching through all the options (games often use 256 blocks, so it’s worth starting the check with this number and gradually decreasing it).
All this looks quite confusing, because we rely only on the probability that the game uses a certain type of blocks, but in practice the utility finds blocks in 80-90% of tested games!
In addition, it allows you to weed out games with an unusual structure (non-block structure) in order to study them more closely.
Comparison of CDL files
The FCEUX emulator is able to mark each instruction during emulation which bytes were interpreted as code and which bytes were interpreted as data (menu Debug → Code/Data Logger... ). This feature is useful in itself and is closely integrated with other debugging capabilities of the emulator - try enabling this mode and see how other debugging windows have changed. However, I want to talk about one particular application of it. If you save two such cdl files, one BEFORE the action under study, and the other immediately AFTER its completion, then the difference between the two such files will show only the data (or code) that was used during the action. With proper trimming, you can find the data you need just by correctly selecting two points in time between the measured events.Composing large game structures from basic tiles and eventually assembling an entire level is reminiscent of assembling a puzzle of thousands of pieces, and it gives the same pleasure when, finally, each piece ends up in its place.
In the next article there will not be such an abundance of technical information and I will give examples of assembling game levels with a non-standard structure or using unusual modifications of the standard block architecture. You can also name in the comments a game on the NES whose level format is interesting to you, perhaps I’ll explore that too.
Tags: Add tags
NES file is corrupted
If, after installing the required program from the list, you still cannot open a file with the NES extension, the reason may be that it is damaged. The solution may be to find a new copy of the NES file you are about to open
NES file extension not associated with corresponding application
In this case, the easiest way is to use the tools built into the operating system for connecting the NES file with applications to support it. Double click on the file you cannot open - the operating system will display a list of programs that are likely to work with your NES file. Select one of them, or indicate on the disk the location where you installed one of the offers from our list. Windows should open NES file using a pre-installed program.
The entry relating to the NES file in the "Windows System Registry" has been deleted or corrupted
NES file is infected with a virus
It may happen that a computer virus is attached to the NES file. In this case, it will probably not be possible to open such a file. Download any good antivirus program and scan the NES file. If the antivirus program detects dangerous data, this may indicate an NES file indication.
If you have installed on your computer antivirus program Can scan all files on your computer, as well as each file individually. You can scan any file by right-clicking on the file and selecting the appropriate option to scan the file for viruses.
For example, in this figure it is highlighted file my-file.nes, then you need to right-click on this file and select the option in the file menu "scan with AVG". When you select this option, AVG Antivirus will open and scan the file for viruses.
Sometimes an error may occur as a result incorrect software installation, which may be due to a problem encountered during the installation process. This may interfere with your operating system link your NES file to the correct application software, influencing the so-called "file extension associations".
Sometimes simple reinstalling Jnes may solve your problem by linking NES to Jnes correctly. In other cases, problems with file associations may result from bad software programming developer and you may need to contact the developer for further assistance.
Advice: Try updating Jnes to the latest version to ensure you have the latest patches and updates.
This may seem too obvious, but often The NES file itself may be causing the problem. If you received a file via an email attachment or downloaded it from a website and the download process was interrupted (such as a power outage or other reason), the file may become damaged. If possible, try getting a new copy of the NES file and try opening it again.
Carefully: A damaged file can cause collateral damage to previous or existing malware on your PC, so it is important to keep your computer up-to-date with an up-to-date antivirus.
If your NES file related to the hardware on your computer to open the file you may need update device drivers associated with this equipment.
This problem usually associated with media file types, which depend on successfully opening the hardware inside the computer, e.g. sound card or video card. For example, if you are trying to open an audio file but cannot open it, you may need to update sound card drivers.
Advice: If when you try to open a NES file you receive .SYS file error message, the problem could probably be associated with corrupted or outdated device drivers that need to be updated. This process can be made easier by using driver update software such as DriverDoc.
If the steps do not solve the problem and you are still having problems opening NES files, this may be due to lack of available system resources. Some versions of NES files may require a significant amount of resources (e.g. memory/RAM, processing power) to properly open on your computer. This problem is quite common if you are using fairly old computer hardware and at the same time a much newer operating system.
This problem can occur when the computer is having trouble keeping up with a task because the operating system (and other services running in the background) may consume too many resources to open a NES file. Try closing all applications on your PC before opening the Nintendo (NES) ROM File. Freeing up all available resources on your computer will provide the best conditions for attempting to open the NES file.
If you completed all the steps described above and your NES file still won't open, you may need to run equipment update. In most cases, even when using older versions of hardware, the processing power can still be more than sufficient for most user applications (unless you're doing a lot of CPU-intensive work such as 3D rendering, financial/scientific modeling, or intensive multimedia work). Thus, it is likely that your computer does not have enough memory(commonly called "RAM" or random access memory) to perform the task of opening a file.
Best emulator NES / Dendy And Famicom Disk System open source. Supports saves, joysticks, emulation of various controllers, archives (including 7z), movie recording, etc. It also has excellent compatibility. Ported to countless systems (old name FCE Ultra). Has built-in tools for creating tool-assisted superplay.
Size: 8.5 MiB | Downloads: 292188 | Download
Emulator NES / Famicom / Dendy And FDS open source. Many settings, various filters, support Kaillera, launching ROMs directly from the archive, the ability to autosave and excellent compatibility. Undoubtedly one of the most sophisticated and best NES emulators.
Date: 06/08/2008 | Size: 1.2 MiB | Downloads: 134522 | Download
Great emulator NES / Famicom And Famicom Disk System. Support large quantity mappers, saves, filters, emulation mode Dendy and other possibilities.
Not a bad emulator NES / Dendy from the author of Project64, written using the DirectX API. It supports a large number of mappers and is mainly focused on launching USA roms. Jnes has save support, also online play via Kaillera.
Date: 12/25/2016 | Size: 502 KiB | Downloads: 62747 | Download
Mednafen is an excellent multi-platform emulator that emulates the following platforms:
- Atari Lynx
- GameBoy (Color)
- Game Boy Advance
- Neo Geo Pocket (Color)
- Nintendo Entertainment System/Famicom
- PC Engine (CD)/TurboGrafx 16 (CD)/SuperGrafx
- PC-FX
- Sega Game Gear
- Sega Genesis/Mega Drive
- Sega Master System
- Sony PlayStation
- Super Nintendo Entertainment System/Super Famicom
- Virtual Boy
- WonderSwan
There is support for graphic filters.
Attention: the emulator starts only from command line. But you can use a shell: Mednaffe or MedGui Reborn.
To fully work with the emulator, you should familiarize yourself with. And also, don’t forget about the F1 key.
Date: 01-09-2015 | Size: 17.5 MiB | Downloads: 57456 | Download
An unofficial release of the famous emulator of the most famous eight-bit console from Nintendo. Fixed a bug causing a slow joystick reaction that appeared on some computers in the official release and some other annoying glitches.
Corrected build of Nestopia 1.37 (stable for recording movies). It now supports unlimited AVI dump video size as well as RGB32 color space.
Date: 2.09.2012 | Size: 866 KiB | Downloads: 5794 | Download
Quite advanced emulator NES/Dendy open source for Windows. Among its features: dandy mode (hybrid), debugger, video recording, color palette adjustment, game genie, ROM title editor, etc.
Date: 2019-01-02 | Size: 7.1 MiB | Downloads: 10958 | Download
Emulator NES for Windows. This is a concept emulator, main feature which is a reverse revision of the gameplay in real time (real-time rewind).
Date: 2012-03-12 | Size: 490 KiB | Downloads: 4923 | Download
Multisystem emulator consoles Sega Mega Drive, Sega Master System, Sega Game Gear, Nintendo Entertainment System and arcade machine Sega System E. It has an original 3D interface in the form of a game room with slot machines and TVs. There is also a built-in database of games and covers.
Date: 05/16/2011 | Size: 18.3 MiB | Downloads: 23823 | Download
One of the oldest, continuing development, emulators NES / Dendy. It has a graphical interface (in DOS style because... for a long time the emulator was for DOS), the ability to record and save the game, create a screenshot, support for game genie codes, saves from nesticle and archives. For lovers and nostalgics.
My sister recently called me and asked: “ Is it possible to play Dandy games on a computer?" Of course, I told her how to do this, and also decided to write a short article for you. After all, many people sometimes want to return to childhood for a while and play their favorite console. And for this it is not at all necessary to try to find it somewhere, and also to think about where else to get cartridges with games.
So how to play Dendy on a computer?
First we need download the games themselves on the Internet. All games for Dandy are a file with the extension .nes.
You have several options where to get games:
1) You can enter the phrase “games for dandy” in any search engine and dozens of sites will open in front of you where you can download them.
2) You can download games from a certain site that I recommend. Here is a link to it.
I like this site because everything on it is extremely simple and clear. You simply select the name of the console on the left (in our case Dendy) – then go to the “Games” section. Here all the toys are sorted alphabetically: select the desired letter - find the game - click on the name (or on the word “screenshots”). If this is really the toy you were looking for, download it by clicking on the link.
3) You can also download directly a small collection of the most popular games for Dendy, in my opinion, which I made myself. It includes: Battle City (tanks), Battletoads &Double_Dragon (battle frogs), Chip and Dale Rescue Rangers 2 (chip and dale), Darkwing Duck (black cloak), Double Dragon III (double dragon), GALAXIAN (flies), Jackie Chan, Super Mario Bros (super Mario), Teenage Mutant Ninja Turtles III (Teenage Mutant Ninja Turtles), Tiny Toon Adventures (rabbit): 
So, no matter where exactly you download the game, it will be an archive containing a file with the extension NES. I advise you to copy all downloaded archives with games into one folder and store them in it. Personally, I created it on my disk WITH folder games and collected all my favorite Dendy games into it: 
Now we need a special program emulator, through which we will launch all dandy games.
There are quite a lot of console emulator programs. But I suggest using perhaps the most popular of them - FCEUX. To avoid problems with launching games, it is better to download the latest version of the program and from the official website. You can download this version from me.
After downloading the archive with the program, unpack it somewhere on your computer. I extracted it to disk C:\fceux-2.2.2. The contents of this folder look like this: 
To run the emulator you need to find the file here fceux.exe and open it by double clicking.
If you wish (so as not to go into this folder every time), you can create a shortcut for this file on your desktop. To do this, click on the file fceux.exe right mouse button – select “Send” – “Desktop (create shortcut)”: 
So, the emulator is running: 
First of all, let’s set up the controls: select from the menu Config – Input:
We see the following window. Opposite here Port 1 press the button Configure:
Now we need to set up a key combination for control. Dandy can be played either on keyboard; or if you have joystick(or rather a gamepad), then using it. Both the keyboard and the joystick are configured in the same way.
The setup is very simple: click on the desired button in the window with the mouse and then twice Press the desired button on the keyboard (or joystick). Then we move on to the next button. 
Personally, I configured the buttons on my keyboard as follows:
Left, Up, Right, Down is arrows
Select - space
Start – Enter
Turbo B and Turbo A are A keys And S
B and A – Z keys And X
Having finished setting up all the buttons, exit here by clicking “Close”.
And finally, now launch the game through the emulator. As you remember, I have all downloaded games for Dandy stored on disk C in folder games. By the way, the FCEUX emulator can open games directly from the archive. Some other emulators will not see the game unless the file is first unzipped. Also FCEUX version 2.2.2 opens both zip and rar archives. But older versions of this program do not see rar archives.
So, in the menu we go to File – Open ROM:
Then we find the desired game on the computer, select it and click “Open”: 
That's all: the game is launched, and we can start playing with the keys that we configured in advance: 
And one more thing: the FCEUX emulator has a wonderful feature “ Save”, which was so lacking in childhood. Those. you can stop when you need to, and not be afraid that your entire progress will be lost.
You can use it as follows: during the game, click on the “File” menu – then “Savestate” – “Save State”: 
If we then need to start the game from the save location, then we launch the game as usual - then go to “File” - “Savestate” - “Load State”.
