A Game Boy ROM image is the cartridge ROM byte for byte, so file offsets are the addresses the console’s processor sees in the first bank. This page follows Pan Docs, the community’s reference for Game Boy hardware, which documents what the console’s boot ROM checks and what licensed games contain. The one 16-bit number in the header, the global checksum, is big-endian.
The ROM and its banks
The processor sees 32 KiB of cartridge ROM at a time. Addresses
0x0000–0x3FFF always show bank 0, the first 16 KiB of the
file. Addresses 0x4000–0x7FFF show one switchable bank, chosen
through the cartridge’s memory bank controller (MBC). Bank n is at file offset
n × 0x4000. A 32 KiB game without an MBC (“ROM ONLY”) is simply
banks 0 and 1. The file size should equal the ROM size coded at 0x148.
| Address | Size | Contents |
|---|---|---|
0x0000–0x003F | 64 | The eight restart vectors, 8 bytes apart, where the RST $00 to RST $38 instructions jump. |
0x0040 | 8 | V-blank interrupt handler. |
0x0048 | 8 | LCD STAT interrupt handler. |
0x0050 | 8 | Timer interrupt handler. |
0x0058 | 8 | Serial interrupt handler. |
0x0060 | 8 | Joypad interrupt handler. |
0x0068–0x00FF | 152 | Not used by the hardware; the game may put anything here. |
0x0100–0x014F | 80 | The cartridge header, below. |
0x0150– | — | The rest of the game. |
The vectors are only conventions of the processor; a game that does not use an interrupt or restart can put anything there.
Header fields
| Address | Size | Field | Meaning |
|---|---|---|---|
0x100 | 4 | Entry point | Where the boot ROM hands over to the game. Most commercial games put a nop here followed by jp $0150, a jump past the header. |
0x104 | 48 | Nintendo logo | The bitmap shown while the console starts. It must equal the bytes below or the boot ROM locks up. |
0x134 | 16 | Title | The game’s name in upper-case ASCII, padded with 0x00. Later cartridges reuse the last bytes, leaving 15 or 11 characters. |
0x13F | 4 | Manufacturer code | On newer cartridges, four upper-case ASCII characters (in older ones, part of the title). What they were for is not known. |
0x143 | 1 | CGB flag | Game Boy Color support; see CGB flag. On older cartridges, the last character of the title. |
0x144 | 2 | New licensee code | Two ASCII characters naming the publisher, used only when the old licensee code is 0x33. See new licensee codes. |
0x146 | 1 | SGB flag | 0x03: the game uses Super Game Boy functions. Any other value, normally 0x00: the Super Game Boy ignores the game’s command packets. |
0x147 | 1 | Cartridge type | The memory bank controller and other hardware on the cartridge. See cartridge types. |
0x148 | 1 | ROM size | Normally 32 KiB × 2value. See ROM sizes. |
0x149 | 1 | RAM size | Cartridge RAM; 0 when the cartridge type has no RAM. See RAM sizes. |
0x14A | 1 | Destination code | 0x00: sold in Japan (and possibly elsewhere). 0x01: sold outside Japan only. |
0x14B | 1 | Old licensee code | The publisher on older cartridges; 0x33 means “see the new licensee code”. See old licensee codes. |
0x14C | 1 | Mask ROM version | The game’s revision, usually 0x00; a revised printing has 0x01 and so on. |
0x14D | 1 | Header checksum | An 8-bit checksum of 0x134–0x14C; see checksums. The boot ROM refuses to start the game if it is wrong. |
0x14E | 2 | Global checksum | The 16-bit sum of every byte of the ROM except these two, big-endian. Not checked by the console. |
Nintendo logo
The 48 bytes at 0x104–0x133 must be exactly:
CE ED 66 66 CC 0D 00 0B 03 73 00 83 00 0C 00 0D
00 08 11 1F 88 89 00 0E DC CC 6E E6 DD DD D9 99
BB BB 67 63 6E 0E EC CC DD DC 99 9F BB B9 33 3E
Each nibble is four pixels, most significant bit leftmost. The first 24 bytes
(0x104–0x11B) are the top half of the logo and the last 24 the
bottom half. The original Game Boy compares all 48 bytes; the Game Boy Color and later
models compare only the top half. The monochrome models draw the logo at twice its
size.
Title and manufacturer code
Newer cartridges reuse the end of the title area, so three layouts exist:
| Layout | Title | Manufacturer code | CGB flag |
|---|---|---|---|
| Older cartridges | 0x134–0x143, 16 characters | — | — |
| 15-character title | 0x134–0x142 | — | 0x143 |
| 11-character title | 0x134–0x13E | 0x13F–0x142 | 0x143 |
A reader cannot always tell which layout a game uses; checking whether
0x143 is 0x80 or 0xC0 is the usual test for the CGB
flag.
CGB flag
| Value | Meaning |
|---|---|
0x80 | The game uses Game Boy Color features but also runs on earlier models. |
0xC0 | The game works on the Game Boy Color only. The hardware ignores bit 6, so in practice this works the same as 0x80. |
| other, bit 7 clear | Not a Color game: the Game Boy Color runs it in monochrome compatibility mode. (On older cartridges the byte is part of the title.) |
Setting bit 7 also makes the Color boot ROM write the byte to its KEY0
register.
SGB flag
The Super Game Boy accepts the game’s command packets only when 0x146 is
0x03; with any other value (normally 0x00) it ignores them.
Pan Docs’ “Unlocking SGB functions” adds that the old licensee code at
0x14B must also be 0x33.
Checksums
Header checksum
The byte at 0x14D is calculated over the 25 bytes 0x134 to
0x14C:
x = 0
for address = 0x134 to 0x14C:
x = (x − rom[address] − 1) AND 0xFF
Because each of the 25 steps subtracts one extra, this is the same as −(sum of the 25 bytes + 25), modulo 256. The boot ROM of every model calculates it and locks up if it does not match.
Global checksum
The two bytes at 0x14E are the sum of every byte in the ROM except these
two, kept to 16 bits, high byte first. No Game Boy checks it; Pan Docs knows of only one
program that does, the “GB Tower” emulator inside Pokémon Stadium.
Worked example
A 32 KiB game titled HELLO with no MBC, no RAM, Japanese destination,
old licensee 0x01 (Nintendo) and version 0. The header from
0x134:
0134 48 45 4C 4C 4F 00 00 00 00 00 00 00 00 00 00 00 title "HELLO", zero padded
0144 00 00 new licensee: unused
0146 00 SGB flag: no SGB functions
0147 00 cartridge type: ROM ONLY
0148 00 ROM size: 32 KiB, 2 banks
0149 00 RAM size: none
014A 00 destination: Japan
014B 01 old licensee: Nintendo
014C 00 version 0
014D 72 header checksum
The 25 bytes add up to 0x48 + 0x45 + 0x4C + 0x4C + 0x4F + 0x01 = 373.
373 + 25 = 398, and −398 modulo 256 is 114, so the checksum is 0x72. With
the version byte changed to 0x01 the sum rises by one and the checksum
becomes 0x71.
Sources
- The Cartridge Header – Pan Docs: every field, the logo bytes, the CGB and SGB flags and both checksums
- Memory Map – Pan Docs: the ROM banks, restart and interrupt addresses
- Interrupt Sources – Pan Docs: which interrupt uses which address
- Unlocking SGB functions – Pan Docs: the two header bytes the Super Game Boy needs
Nintendo’s own documentation for the header is not public; Pan Docs is the community’s reconstruction of it.