Many people have trouble finding this type of data. There are several ways of doing it: random corruption, using table files, using Nesticle and of course, the fast way. I'm going to throw a few basic concepts regarding NES graphics before jumping into the (short) action.

This document is aimed for beginner romhackers. You'll get in touch with the feared/overrated "ASM" as well.

The NES system palette is composed of 64 colors, each one of them represented by a numeric value. Use this chart for reference:

There are two types of palettes:

- Background Palettes (4)
- Sprite Palettes (4)

Each palette is made of 4 colors.

This data is stored in the Video Ram at $3F00. The only way to access this area is via the hardware register $2007.

1) An NES rom (preferably, Super Mario Bros)
2) FCEUd (http://www.dragoneyestudios.net)
3) A hex editor (http://www.hexworkshop.com)

Fire up FCEUd and load the rom.

Bring up the debugger (press F1) [FIG. 1]

Press 'Add...' in the BreakPoints frame.

Type 3F00 in the first box, select 'PPU Mem' in the memory frame and check 'Write' [FIG. 2]. Press 'Ok'.

Reset the game (F11) and the debugger will snap shortly after that with the following code in it:

$2007 is the hardware register that provides I/O access to the Video Ram. So, we know something is being written to the PPU. Let's figure out the place it's coming from. Scroll up a few bytes:

As you can tell, the data is taken from the address highlighted in green ($8CCB). To find that block of data in the rom follow these steps:

Type the found address in the 'Seek To:' box and press the button.

The debugger will move to the specified memory address and you'll end up with something like this:

Copy the highlighted bytes and look them up in your hex editor [0F291A0F0F36170F0F]

ROM Address: CDBh
CPU Address: $8CCB

You can also take the RAM address and subtract 0x7FF0 to get the corresponding rom address (for 32K PRG roms, only).

Modify the found data (alter 3 or 4 bytes) using the color chart provided earlier in this doc.

Reload your rom (not just reset) and test.

Indeed. If you want to learn more about the NES' hardware and its processor (6502), I recommend the following documents:

http://www.zophar.net/tech/files/6502.txt

http://www.6502.org

http://www.zophar.net/tech/files/ndox200.zip

Have fun,
TFG