Spy Hunter: Spy Hunter CNROM to MMC3 Hack

Here is a patch that will convert the Spy Hunter mapper from CNROM to MMC3.

11/30/13
infidelity

Converting Spy Hunter From CNROM to MMC3

$8000-$FFFF (CHR)
-----------------------
This is done in a strange way. Example from Power On.

A:F4 X:01 Y:00 S:FF P:nvubdIZC $8168:A9 03 LDA #$03
A:03 X:01 Y:00 S:FF P:nvubdIzC $816A:20 8F 89 JSR $898F
A:03 X:01 Y:00 S:FD P:nvubdIzC $898F:AA TAX
A:03 X:03 Y:00 S:FD P:nvubdIzC $8990:18 CLC
A:03 X:03 Y:00 S:FD P:nvubdIzc $8991:69 A4 ADC #$A4
A:A7 X:03 Y:00 S:FD P:NvubdIzc $8993:9D 00 80 STA $8000,X @ $8003 = #$A7

Opened rom in TLP. I scrolled down 7 chr pages. A7 is the equivilant of 07, because when A7 is loaded a Power On, it contains the title screen gfx. And the 7th page scrolling down in TLP, has the title screen gfx. So A0-A7 represents 00-07

Now regarding free space, there is none. However, there is a giant palette table within $7D80 - $7FFF (280 bytes) Now, there is a hard coded Low/High byte address to load this table, and its located at $8CC.



CHANGES
------------
$7D80 (New Palette Location)

$1000C (Reset Vector Pointer) = 70FD
$FD80 (MMC3 Setup Routine) = A901 8D00A0 A900 8D0080 8D0180 8D01A0 8D00C0 8D01C0 8D00E0 A205 8E0080 BD9AFD 8D0180 CA 10F4 4C0081 00 02 04 05 06 07
$FDB0 (Bankswap Routine) (20A0FD) = 48 0A 48 A906 8D0080 68 8D0180 0901 48 A907 8D0080 68 8D0180 68 60

$FDCA (MMC3 CHR Engine) = C9A0 F01C C9A1 F01D C9A2 F01E C9A3 F01F C9A4 F020 C9A5 F021 C9A6 F022 C9A7 F023 A000 4C02FE A002 4C02FE A004 4C02FE A006 4C02FE A008 4C02FE A00A 4C02FE A00C 4C02FE A00E 4C02FE A900 8D0080 98 B953FE 8D0180 A901 8D0080 B953FE 38 6901 8D0180 A902 8D0080 98 B954FE 8D0180 A903 8D0080 B954FE 38 6900 8D0180 A904 8D0080 B954FE 38 6901 8D0180 A905 8D0080 B954FE 38 6902 8D0180 60
$FE63 (MMC3 CHR Table) = 0004080C1014181C2024282C3034383C
$9A3 = 20BAFD

$8D2 (High Byte Palette Address) = BD
$CFC4 (JMP to Palette Engine ASM Bankswap) = 4C63FE 00000000000000
$FE73 (Palette Engine ASM Bankswap) = A901 20A0FD 2065BD A900 20A0FD 60
$7D75 (Palette Engine ASM) = B110 99E005 C8 C020 D0F6 60

OK, after all of this, the game will not boot in Nintendulator. Turns out i have to insert $10-$3FFF into $8000-$BFFF, so what i will do is insert a bankswap within the reset vector.

$1000C = 71FE
$FE81 = A900 20A0FD 4C70FD

DONE! Spy Hunter is now MMC3! :-D
-infidelity


Spy Hunter (USA).nes - NOINTRO
CRC32: 1E060AE0
MD5: 9EB7DED08C29C6933D5BEC7A185FEEFA
SHA-1: 18365FE8E037A50D2127129F81CE291CAB4C1A3E
SHA-256: FE4FE0E869CF299E9A72B4A1D268C65329B0C304A3A661FAE773947AEC197E2B