11/26/13
infidelity

CNROM CHR to MMC3 CHR

From what i have seen, 1 byte will represent all of $0-$1FFFppu.

When you want to find the byte(s), using FCEUX, set a write breakpoint for $8000-$FFFF, and look for the A value that gets stored when the debugger snaps.

I've come across CNROM roms, that will take the A value, perform a TAY, and use that value to read within a CHR table. CNROM's i've come across use different byte values from one another, but they do the same job/load pages the same. Here is an example.

	A value, then TAY, the Y value will read within the CHR table. 
	Adventure Island uses 30,31,32,33 as it's CHR table
	Kung-Fu Heroes uses FC,FD,FE as it's CHR table

Here is a cheat sheet for the above examples, for MMC3

CNROM		MMC3
CHR #			CHR #
----------		--------
30			00,02,04,05,06,07
31			08,0A,0C,0D,0E,0F
32			10,12,14,15,16,17
33			18,1A,1C,1D,1E,1F

So when I locate the area that writes the CNROM CHR page value into A, i then JSR to my MMC3 CHR Routine, and perform a series of CMP's for whatever values the CNROM game uses, and perform an LDY #$ depending on the A value to determine how far to read into my MMC3 CHR table, then once i load the proper Y value to read within the table, i begin storing the proper MMC3 values.

Here is an example from Kung-Fu Heroes...

1. A9FC 200080
2. C9FC F008 C9FD F009 C9FE F00A A000 4C7FA6 A002 4C7FA6 A004 4C7FA6 A900 8D0080 98 B9D0A6 8D0180 A901 8D0080 B9D0A6 38 6901 8D0180 A902 8D0080 98 B9D1A6 8D0180 A903 8D0080 B9D1A6 38 6900 8D0180 A904 8D0080 B9D1A6 38 6901 8D0180 A905 8D0080 B9D1A6 38 6902 8D0180 60 (chr table = 00 04 08 0C 10 14)

	The 00, stores pages 00-03 within $0-$FFFppu
	The 04, stores pages 04-07 within $1000-$1FFFppu

The bold C9FC, since FC is page 00, i have it branch to A000, which is LDY #$00, which then loads the LDA,Y of my chr table, which brings you to 00,04

Now, if it was C9FD, it would branch to A002, which is LDY #$02, and then instead of 00,04 being loaded, it would be 08,0C that would get loaded.

-infidelity