.SFC File Format – Internal header

SNES ROM image

Every SNES cartridge carries a header that the game’s developer wrote into the ROM, ending just before the processor’s interrupt vectors. It is visible to the console at $00FFC0–$00FFFF (the CPU’s bank 0) whatever the cartridge’s memory layout, so its place in the file depends on that layout. This page follows the SNESdev Wiki; offsets are given as the SNES addresses $FFB0–$FFFF, and numbers are little-endian, as on the 65816.

Where the header is

LayoutHow the ROM is mappedHeader in the fileCPU address
LoROM32 KiB banks, from $8000000x7FC0$00FFC0
HiROM64 KiB banks, from $C000000xFFC0$00FFC0
ExHiROM64 KiB banks from $C00000, continuing from $400000 after the first 4 MiB0x40FFC0$40FFC0

These offsets are for a file without a copier header; with one, add 512. The file does not say which layout it uses, so readers score each candidate location with the checks below. An optional expanded header sits in the 16 bytes before the main one ($FFB0–$FFBF).

Map mode ($FFD5)

The bits are 001smmmm: bit 4 (s) is the ROM speed, 0 slow and 1 fast, and the low four bits are the map mode.

Low nibbleMap modeSlow byteFast byte
$0LoROM$20$30
$1HiROM$21$31
$2S-DD1$22$32
$3SA-1$23$33
$5ExHiROM$25$35
$ASPC7110$2A$3A

The full bytes are worked out from the bit layout; the SNESdev Wiki lists the low-nibble values. Other low nibbles are not defined there.

Chipset ($FFD6)

Low nibbleHardware
$0ROM only.
$1ROM and RAM.
$2ROM, RAM and battery.
$3ROM and coprocessor.
$4ROM, coprocessor and RAM.
$5ROM, coprocessor, RAM and battery.
$6ROM, coprocessor and battery.

When the low nibble is 3 to 6, the high nibble names the coprocessor:

High nibbleCoprocessor
$0DSP (DSP-1, -2, -3 or -4).
$1GSU (Super FX).
$2OBC1.
$3SA-1.
$4S-DD1.
$5S-RTC.
$EOther (Super Game Boy, Satellaview).
$FCustom: the chip is named by the subtype at $FFBF.
$FFBFCustom chip
$00SPC7110.
$01ST010 or ST011.
$02ST018.
$10CX4.

Expanded header ($FFB0–$FFBF)

Present when the developer ID at $FFDA is $33.

AddressSizeFieldMeaning
$FFB02Maker codeTwo upper-case ASCII characters.
$FFB24Game codeFour upper-case ASCII characters; the last letter matches the country.
$FFB66ReservedZero.
$FFBC1Expansion flash size1 << N KiB.
$FFBD1Expansion RAM sizeRAM for the coprocessor, chiefly the GSU; see below.
$FFBE1Special versionUsually 0.
$FFBF1Chipset subtypeUsed when the chipset is $F0–$FF.
$FFBDExpansion RAM
$00None.
$0116 kbit.
$02Undefined (probably 32 kbit).
$0364 kbit.
$04Undefined (probably 64 kbit).
$05256 kbit.
$06512 kbit.
$071 Mbit.

SA-1 cartridges put $00 here and give their RAM size at $FFD8. Some early games treat $FFBF as valid only when the last title byte ($FFD4) is $00.

Country codes ($FFD9)

Codes $00 and $01 are NTSC; most others are PAL, though the SNESdev Wiki notes exceptions. The letter is the one used at the end of the expanded header’s game code.

CodeRegionGame code letter
$00JapanJ
$01North AmericaE
$02EuropeP
$03ScandinaviaW
$04Finland—
$05Denmark—
$06Europe (French)F
$07DutchH
$08SpanishS
$09GermanD
$0AItalianI
$0BChineseC
$0CIndonesia—
$0DSouth KoreaK
$0ECommonA
$0FCanadaN
$10Brazil; also Nintendo Gateway SystemB; G
$11AustraliaU
$12Other variationX
$13Other variationY
$14Other variationZ

Developer IDs other than $33 are not listed in the sources read for this page.

Checksum

  1. Set the checksum at $FFDE to $0000 and the complement at $FFDC to $FFFF (the header is included in the sum, and these two values always add up to the same total).
  2. Add every byte of the ROM, keeping 16 bits.
  3. Store the sum at $FFDE and the sum XOR $FFFF at $FFDC.

The sum is taken as if the ROM were the power-of-two size the header gives. A ROM of another size is treated as a larger power-of-two part followed by a smaller part that is repeated until it fills the same size as the first: for example a 3 MiB ROM sums as 2 MiB plus the last 1 MiB twice. Emulators disagree about padding in odd cases, so the SNESdev Wiki recommends power-of-two files. A copier header is never included.

Interrupt vectors ($FFE0–$FFFF)

Sixteen 16-bit addresses in bank 0. The 65816 uses the first set in native mode and the second in emulation mode.

AddressNative modeAddressEmulation mode
$FFE0–$FFE3not listed$FFF0–$FFF3not listed
$FFE4COP$FFF4COP
$FFE6BRK$FFF6reserved
$FFE8ABORT (not used by the SNES CPU)$FFF8ABORT (not used)
$FFEANMI$FFFANMI
$FFECreserved$FFFCRESET
$FFEEIRQ$FFFEIRQ and BRK

Finding the header

Checks the SNESdev Wiki suggests for scoring a candidate location:

  • The checksum and its complement add up to $FFFF.
  • The map mode matches the location (LoROM at 0x7FC0, HiROM at 0xFFC0, ExHiROM at 0x40FFC0).
  • The ROM size given is not smaller than the file.
  • The reset vector is $8000 or above.
  • The first instruction at the reset vector is a likely one (sei, clc, sec, stz, jmp, jml) rather than an unlikely one (brk, cop, stp, wdm, or $FF).
  • The ROM and RAM sizes are reasonable.
  • The title is ASCII (or JIS X 0201).

Sources

  • ROM header – SNESdev Wiki: locations, every field, map modes, chipset and subtypes, expanded header, country codes, checksum and the checks for finding the header
  • ROM file formats – SNESdev Wiki: how LoROM, HiROM and ExHiROM lay the ROM out in the file
  • CPU vectors – SNESdev Wiki: native and emulation mode vectors

Nintendo’s own documentation was not among the sources read.