Zsnes savestate file format

[Oziphantom]

well the order was all of the registers I posted above, so add all of the numbers at the end up. + 128K for WRAM and then you have the 64K of VRAM.
Take a game you know and what the settings are. i.e tiles at X map size and starting locations etc. I would start with looking for the tile map, as you know where the palette data is, you can just start scrolling through the data set byte by byte and you will find it given you have a rough starting location. From there you will know where the every else is in VRAM based upon the known settings you have, which will the allow you to map and find the rest of the data. From there you can just start looking through the memory in the "sndrot" offsets until you find the values you expect. Then test on other states to make sure you have the correct values and not "values that just so happen to equal".

Should be fairly straight forward

[AnisSaouliBH]

Thanks a lot for your help

[creaothceann]

vSNES can load ZSNES savestates, and other (older) formats like SNES9x 1.43. It was inspired by the DOS program bgmapper.

ZSNES savestates (at least the old format, dunno about the version linked above) are very simple:

Code: Select all

;ZSNES Savestate Format:
; Thanks to ZsKnight for it!
; Meant to be compiled with NASM.
; Obtained from http://members.tripod.com/FDwR/snes.htm
;
; This portion does not contain any part of the SPC
; information, FX chip or SA-1 registers, or extra any
; additional cartridge memory. It does include all the
; 65816c registers, PPU registers, sprites (OAM), palette
; (CGRAM), DMA channels, VRAM, and main memory.
; Altogether, that accounts for 199699 bytes of it.

zsmesg  db 'ZSNES Save State File V0.6',26
versn   db 60   ; version #/100
curcyc  db 0    ; cycles left in scanline
curypos dw 0    ; current y position
cacheud db 1    ; update cache every ? frames
ccud    db 0    ; current cache increment
intrset db 0    ; interrupt set
cycpl   db 0    ; cycles per scanline
cycphb  db 0    ; cycles per hblank
spcon   db 0    ; SPC Enable (1=enabled)
stackand dw 01FFh ; value to and stack to keep it from going to the wrong area
stackor  dw 0100h ; value to or stack to keep it from going to the wrong area

; 65816 registers
xat      dw 0
xdbt     db 0
xpbt     db 0
xst      dw 0
xdt      dw 0
xxt      dw 0
xyt      dw 0
xp       db 0
xe       db 0
xpc      dw 0
xirqb    db 0           ; which bank the irqs start at
debugger db 0              ; Start with debugger (1=yes,0=no)
Curtableaddr  dd 0                 ; Current table address
curnmi   db 0           ; if in NMI(1) or not(0)
cycpbl  dd 110  ; percentage left of CPU/SPC to run  (3.58 = 175)
cycpblt dd 110  ; percentage of CPU/SPC to run

; ...

"curcyc db 0" means there's a byte-sized variable named curcyc that is initialized with zero. "dw" defines a word (16 bits) and "dd" would define a double word (32 bits).

"zst_frmt.txt" defines the first part of the savestate, and "zst_spc.txt" defines the audio variables following the first part. There may be additional data after that, if the game uses coprocessor chips. At the end of the savestate is the preview picture, 64x56 pixels @ 2 bytes per pixel, not sure if it was 555 or 565 bits per channel. This preview is not included for movie files.

EDIT: There's also "zstfrmt_add.txt" for a slight format documentation update.