I've spend the afternoon heavily studying the header hidden in some commecial ROMs to see if I could make a sense out of it.
This header is commonly located at $ffe0 at the end of the last PRG-ROM bank.
- About half of games I've checked actually have such an header
- The header contains the name of the game and some other information
- Not all games that have an header have a complete header. Some only have the name, some only the information, some have incomplete information (with either $00 of $ff filling the gaps).
- Dragon Warrior 3, 4 and Dragon Quest 4 are special : They have headers in all of their 32 PRG banks. The headers of banks 7, 15, 23 and 31 are unique, and all the other banks shares the same header.
- The names can also be shorted, or even be replaced by their Nintendo's code.
- Information found in headers is not always correct. SMB3 and Earthbound prototype has incorrect PRG/CHR size, and SSome Konami games, Castlevania 2, Gradius 2, Contra (J) and maybe more says they have CHR-RAM when in fact they have CHR-ROM.
Name is commonly located at $ffe0-$ffef, but it sometimes starts sooner (Dragon Warrior II), and when less than 16 bytes it can be aligned either left or right and gaps are filled with $00s or $20s.
At $fff0 and $fff1 appear to be some kind of checksums. This is the only bytes that changes between the header in Faxanadu (J), Faxananu (U) and Faxanadu (E) which is what leads me to that conclusion.
$fff2 and $fff3 are most often $00, but not always.
$fff4 seems to indicate the PRG and CHR size of the game. Altough some games from Nintendo (SMB2, SMB3, Startropics 1 and 2) have incorrect info, it would work for all other games I checked.
I suspect $fff6 is a version number or something, as it's always $01 (when it's not $ff). Nintendo didn't change the header between the (PRG0) and (PRG1) version of SMB3, but it may be their lazyness - like for SMB2.
$fff2, $fff3, $fff6, $fff7, and $fff9 seems to contain other game-specific info, but I have no idea what it is yet. I'm currently inverstigating it, it seems $fff6 = 04 or 02, and $fff7 = 01 comes most often, no matter the mapper or size of the games.
EDIT : I'm editing this post as I make new discoverings, and I might continue to edit it.
EDIT 2 : About SMB2 being called Zelda, it's fun, but it has the exact same header as zelda, INCLUDING the Reset & IRQ vectors (but it's a different NMI vector, and it's the only difference between both headers).
This header is commonly located at $ffe0 at the end of the last PRG-ROM bank.
- About half of games I've checked actually have such an header
- The header contains the name of the game and some other information
- Not all games that have an header have a complete header. Some only have the name, some only the information, some have incomplete information (with either $00 of $ff filling the gaps).
- Dragon Warrior 3, 4 and Dragon Quest 4 are special : They have headers in all of their 32 PRG banks. The headers of banks 7, 15, 23 and 31 are unique, and all the other banks shares the same header.
- The names can also be shorted, or even be replaced by their Nintendo's code.
- Information found in headers is not always correct. SMB3 and Earthbound prototype has incorrect PRG/CHR size, and SSome Konami games, Castlevania 2, Gradius 2, Contra (J) and maybe more says they have CHR-RAM when in fact they have CHR-ROM.
Name is commonly located at $ffe0-$ffef, but it sometimes starts sooner (Dragon Warrior II), and when less than 16 bytes it can be aligned either left or right and gaps are filled with $00s or $20s.
At $fff0 and $fff1 appear to be some kind of checksums. This is the only bytes that changes between the header in Faxanadu (J), Faxananu (U) and Faxanadu (E) which is what leads me to that conclusion.
$fff2 and $fff3 are most often $00, but not always.
$fff4 seems to indicate the PRG and CHR size of the game. Altough some games from Nintendo (SMB2, SMB3, Startropics 1 and 2) have incorrect info, it would work for all other games I checked.
Code:
$fff4 High nybble = prg size (0=64kb, 2=32kb, 3=128kb, 4=256kb or 512kb, 5=512kb)
$fff4 Low nybble = chr size (0 or 8 = 8kb of RAM, 1=16kb, 2=32kb 3=128kb, 4=256kb)
$fff5 = Mirroring. ($04 = mapper controlled, $02 = hardwired to vertical, $81 or $82 = harwired to horizontal
$fff8 = maker's code, the same used for the FDS, GB, GBC and SNES headers. $01 = Nintendo, $08 = Capcom, etc...
$fff4 Low nybble = chr size (0 or 8 = 8kb of RAM, 1=16kb, 2=32kb 3=128kb, 4=256kb)
$fff5 = Mirroring. ($04 = mapper controlled, $02 = hardwired to vertical, $81 or $82 = harwired to horizontal
$fff8 = maker's code, the same used for the FDS, GB, GBC and SNES headers. $01 = Nintendo, $08 = Capcom, etc...
I suspect $fff6 is a version number or something, as it's always $01 (when it's not $ff). Nintendo didn't change the header between the (PRG0) and (PRG1) version of SMB3, but it may be their lazyness - like for SMB2.
$fff2, $fff3, $fff6, $fff7, and $fff9 seems to contain other game-specific info, but I have no idea what it is yet. I'm currently inverstigating it, it seems $fff6 = 04 or 02, and $fff7 = 01 comes most often, no matter the mapper or size of the games.
EDIT : I'm editing this post as I make new discoverings, and I might continue to edit it.
EDIT 2 : About SMB2 being called Zelda, it's fun, but it has the exact same header as zelda, INCLUDING the Reset & IRQ vectors (but it's a different NMI vector, and it's the only difference between both headers).