You might see something like this as the breakpoint is hit four times (On Geiger Snes9x, hit the 'Run' button to get to the next breakpoint).Open the menu - this should set off the breakpoint.Set an execution breakpoint at $C90717.Prepare things so that it will only take 1 more button press to get into the menu you want.Open the ROM in a debugging emulator (I use Geiger's Snes9x debugging version).In this case, our X coordinate is 21 ($15), the Y coordinate is 16 ($10), and the width (including borders) is 9 ($09). Convert these values to hexadecimal and write them down.

Remember that these coordinates are in tiles, so you have to find the coordinate (or width) in pixels and then divide that number by 8.

Open the screenshot in a paint program, and find out the X coordinate, Y coordinate, and width.

As an example, let's try the gold box that appears when you open the main menu.

Open the menu you want, and take a screenshot of it.

What if the menu you want to expand (or contract!) isn't listed above?

$3036C-$3036D: Change Message Speed menu (opened from Tactics).

$300FC-$300FD: Gold menu, associated with the main walkabout menu.

$30024-$30025: Main walkabout menu (contains Talk, Spell, Item, Search, Status, Tactics).

$30378-$30379: Change Message Speed menu (opened from introductory menu).

$30348-$30349: Introductory menu (contains Begin a New Quest, Continue Quest, Copy Quest, etc., etc.).

Menu content string pointers are stored elsewhere. Note again that this controls only menu width and position. Here are a few menu size values that I have found. Thus, the YYYX XXXX byte comes first in the ROM, then the 1WWW WWYY byte. Like almost everything else on the SNES, this data is in low-endian format. This is done internally by the drawing code for each individual menu.

There is no value to determine the height of a menu. XXXXX = horizontal tile offset from left of screen.

YYYYY = vertical tile offset from top of screen.

WWWWW = menu width (not just usable space, this includes the edge characters).

Menu size data is stored in the following binary format: I've given a few examples below that already do this.Īlmost every menu has a 16-bit (2-byte) value that determines its starting position (X/Y coordinates) and its width. Therefore, if you want to use one of these ROM offsets as a breakpoint, you should add $C00000 to it. Note that the ROM is mapped into the SNES address space starting at $C00000. If there is a header present, you will have to add 512 ($200) to each offset lister here to get the correct offset in the ROM file.

They assume that a 512-byte copier header is not present.

Dragon quest iii snes rom