NSF ripper Guide Level 2


Level 0   Level 1   Level 2   Level 3   Level 4  

Level 5   Level 6   Level 7   Level 8   Level 9

Level 10   Level 11   Level 12   Level 13   Level 14


LEVEL 2 DATA EAST Glory of Hercules 2 (Herakles no Eikou 2)

Now we are going to get down and dirty with some hex hacking and a lot of these techniques you will use over and over
again. First you will use nes2nsf to extract the bank and then load up the NSF in a hex editor. You will learn to make a
boostrap code and arrange the tunes. Also you you learn learn about some of the guidelines of NSF ripping.

What are you waiting for go ahead and rip the bank from the rom with nes2nsf. Sometimes more then one bank will be
outputted, however you will only get one bank with the default settings and that's the right bank. The bank 013 and this
bank will be 16KB and already has a header prepended so you're ready to rock.

First try to play the NSF and you will notice that you don't get any sound or with other players you may get some bleeps
and that's it. So load the NSF up in a hex editor, we need to fix this problem. You will see tons of numbers and is rather
confusing if you don't normally do hex editing. However we will make some sense of this today. If you remember the NSF
header is 128 bytes and the range of the header viewable in a hex editor is 0h - 7Fh , the actual PRG area that you
extracted will be 80h - 4080h. So you are going to look right after the header and you will see a series of 9 bytes. These
bytes are code and mean something. So you see these bytes 4C 11 80 4C 1C 81 4C B4 81 are the first bytes you see after the
header and like I said they do mean something. This is code and so 4C means JMP, JMP is a opcode that jumps to a certain
address. In this case you have the bytes 4C 11 80 , So you have JMP $8011, jump to address $8011. And yes with addresses
you have to switch the bytes like I just did. This is a format used by many CPU's. What I'm going to do is translate the
data for you and assign addresses for each operation so it's easy to understand.

Address Data Opcode Operand $8000 4C 11 80 JMP $8011 $8003 4C 1C 81 JMP $811C $8006 4C B4 81 JMP $81B4

What you want to do now is change the addresses in the header because the NSF doesn't play yet. The load address is at
offset 08h - 09h and is 2 bytes, remember always that a PRG address is always 2 bytes. The Load address in the header is
the origin of the program and that tells the NSF player where to start loading the data. In this case the load will be at
$8000 in CPU memory and starts at offset 80h in the NSF. The 2 bytes in the header at 0Ch - 0Dh are the play address.
The play address is what updates the audio hardware and is called thousands of times. The 2 bytes at 0Ah - 0Bh is the
init address. The init address is the code that changes the tune and initializes memory addresses and sets up data blocks
sometimes. This address is called once before the tune plays.

The current addresses in the header are 8000(load)/8003(play)/8000(init). However the NSF doesn't play so you have to
change them. Looking at the code I translated for you, you can change the addresses based on the code I have there. Leave
the load address the same and don't change it. Just switch the play and init addresses. If you change the init to $8003 and
the play to $8006 then you will get something and these are just sound effects. You can switch the tunes in your NSF player
and you will never run into music, just sound effects. So I will show you what to do about that. You have to write some
code and it's easy once you get used to it. I will tell you what the bytes are and then after this you will need to look
the opcodes up in the reference data that I have provided in Level 0.

48 PHA ; Push Accumulator to the stack (you save A so it doesn't get changed) 20 00 80 JSR $8000 ; jump save return to bootstrap code 68 PLA ; Pull Accumulator from stack (you bring back the number you saved) 4C 03 80 JMP $8003 ; jump to init

Next you want to know where to place the code. Since you have a 16K bank extracted and not the entire 32K you can place
the code at the end of the bank. Note you cannot exceed this area if you have a 32K bank unless you have bankswitching. If
you have a 32K bank then you must find free space somewhere in the NSF.

We can place the code at offset 4080h in the NSF. This is at the end of the bank. If you have Hex Workshop you have to be
in insert mode to add bytes to the end of the file. Type in the following bytes at that offset 48 20 00 80 68 4C 03 80 and
you are about ready to try the NSF. However you must change the address in the header because you had to use code before
going to the real init address.

I have a simple formula for figuring out the address of the code based on what offset you placed the code. Offset
-80(header) + load address. You placed the code at 4080h in the NSF. So you subtract 80 and so you get 4000. Next you add
8000 to this because that's your load address. The final address is $C000. So put 00C0 in the header at the init address
place. So now you fire up the NSF, and what the heck the sound effects are still there, keep switching the tunes and you
will run into the music tunes. Listen to them abit if you want, however you can't leave the tunes at the back of the NSF.
You have to arrange the tunes and I will show you how to do this as well.

First of all start playing the NSF and go to the first music tune and write down the number of each tune that you play on
notepad or something like it. You need to do this because there is some sound effects and silence spaces in the NSF and so
you have to get those out of there. So you put the tunes in the front and sound effects to the back of the NSF, this is a
guideline of the format and should be followed. I eliminate the sound effects myself. However I shall show you how to add
them as well.

The order of the tunes is as follows: 28-39,41-43,45-46. The order of the sound effects is as follows: 6-25,40,44,47. What
you do is open a calculator and make sure it's in decimal mode and convert the number to hex and subtract one from it
because the tunes actually start at 00 that is loaded into the accumulator. And now you have to write some code and you
place this code once again at $C000 (4080h in the NSF). It's ok you can overwrite the code I gave you before because I'm
going to integrate the bootstrap into the tune arrangement code.

TAX LDA $C00C,X ; load tune index that you arranged, point this address to the tune index. PHA JSR $8000 PLA JMP $8003 .db 1B,1C,1D,1E,1F,20,21,22,23,24,25,26,28,29,2C,2D,05,06,ETC.

You see this code here. I will explain it some so that it doesn't completely confuse you. You have the tune arrangement
code and then the bootstrap right after this. You also have a line here that starts with .db and has bytes listed after it.
These are the tune numbers that you arranged. Make sure that you don't type .db in the hex editor lol. So you would type in
the following bytes at the CPU address $C000 in the NSF or 4080h offset. AA,BD,0C,C0,48,20,00,80,68,4C,03,80,1B,1C,1D,1E,1F,
20,ETC.

Now play the NSF and you will notice this is some really nice music and soothing. And the tunes are in order and the sound
effects are to the back. However you need to do one more thing and that's to fill out the header information. The Title of
the NSF(game name),Artist or composer,and Company name that programmed the game. You need to get a relative search program
or get a hex editor with table file support to search the game for text. I will not get into how to make a table file or
using the programs as that's covered really well elsewhere. Bring the header specs up that I showed you in Level 0 and find
the offsets for the title,composer,company and fill in the data. You can only type in so much and you cant type so far
that you mess up the next entry in the header so be careful.

Most Data East games have the music driver stored like this and usually that bootstrap code that I showed you is actually
called from the reset interrupt code, more about that later.

This is a level that was written completely by me Gil Galad. I ripped this NSF awhile back and you can't submit it yourself.
All rips in this guide have already been submitted.