Persistent NES-ROM hacking for profit and fun (Stage 3)

Stage 3: Patch!

In our previous sessions, we pinpointed the memory location where the “life” count is stored and identified the patch needed to start the game with 30 lives. In short, we need to remove the line 07:C465: F0 02 BEQ $C469 and replace it with an instruction that does nothing.

The Anatomy of the Instruction

Let’s take a closer look at 07:C465: F0 02 BEQ $C469. The code you see is an instruction for the processor to perform a specific action. The actual code fed to the processor is F0 02. The rest, 07:C465, is just the location on the ROM where this instruction is located, and BEQ $C469 is the corresponding assembly code for F0 02. These parts are added by FCEUX to make it easier for us. The instruction itself is two bytes long, with each part being one byte.

Do nothing / Don’t do anything

We can’t simply delete the line and call it a day. It might work sometimes, but it’s not a reliable method. Instead, we will replace the F0 02 with an instruction that tells the processor to do nothing.

Let’s proceed with the patch! The instruction we are looking for is the NOP with the corresponding opcode EA. We need to overwrite both F0 02 with EA.

NOPing it

Fire up the Hex Editor and open the ROM. To locate the specific instruction we want to modify, we’ll need to search for the hexadecimal string F0 02. However, since there could be many instances of F0 02 in the ROM, we’ll need a more precise method to find the exact location. One effective trick is to search for the nearby strings as well. For example in our code

07:C463:A4 24 LDY $0024 = #$00
07:C465:F0 02 BEQ $C469
07:C467:A9 1D LDA #$1D
07:C469:95 32 STA $32,X @ $0032 = #$00

We can search for A4 24 F0 02 A9 1D 95 32 as a whole. The likelihood of other lines with these exact strings appearing together is low, so this method should be reliable. With the Hex Editor replace the F0 02 with aforementioned EAs — to look like A4 24 EA EA A9 1D 95 32. After you are finished, save the file and reload it on FCEUX. Now the game starts with 30 lives, every time.