General ASM Help topic

Conn wrote:I got a hack request by Spane for "Prophet of Chaos" to get the pots destroyed also with Sword L2-L4, so I decided to open a single hack collection thread similar to the encyclopedia, where people can post their (credit)free single hacks they find nifty, so that other can merge them with their own work. But be careful that these hacks don't overwrite your own code.

Legend:

Hack: Name of the hack here
Author(s): People who made the hack
Information: The type of hack, basic information
Rom: which rom they work with
Code Addresses: pc address without header where the code is located
Screenshots: Self-Explanatory
Latest version: Complete, demo or N/A
IPS URL: Where to get it / website URL


Hack: pot destroy by L2-L4 Sword
Authors: Spane, Conn
Information: destroys pots with Sowrd L2-L4
Rom: ALTTP (US), without header
Code Addresses:
$0x0DABD: Jump to unused region at $0x77B70
$0x77B70 - 0x77B9B: code to implement feature
Screenshots:


IPS URL: http://bszelda.zeldalegends.net/stuff/Con/pott_l2sword.zip

ASM:

Code:

; This is a ASM FrontEnd Code for Zelda ALTTP (US, no header) to destroy pots with L2 -L4 sword.

lorom

org $01dabd

 jmp.l $0EFB70
 nop
 nop
nop
nop

org $0EFB70

 LDA $0301  
 AND #$0002 ; check if hammer is used            
 BEQ $04    
 JMP.l $01DAC5
 LDA $0354  
 AND #$0027  ; check if sword is used        
 BNE $04    
 JMP.l $01DAB6
 LDA $7EF359
AND #$00FF              
 CMP #$0001  ; check sword level            
 BNE $04    
 JMP.l $01DAB6
 JMP.l $01DAC5

This is very cool, though can't you distribute the .asm file instead? I think that would be a lot better.

If not, then can you please explain what you mean by "$00/DABD" and "$07/7B70 - 07/7B9B"? I understand they're offsets, though the / is what confuses me.

Oh I usually directly hack the rom... never really dealt with asm files, sorry. The addresses translate to: $07/7B70 = 0x77B9B; I changed this in above post

This is great! I've hex decoded this (as usual). Now everyone can implement it via hex. All addresses are for No header. If you have a header, just go 32 lines down from the given address. This is 512 bytes in dec or 200 in hex.
 
First part of the code is at 0xDABD
 
old code is
AD 01 03 29 02 00 F0 F1
 
new code is
5C 70 FB 0E EA EA EA EA
 
 
MAIN code is at 0x77B70
AD 01 03 29 02 00 F0 04 5C C5 DA 01 AD 54 03 29 27 00 D0 04 5C B6 DA 01 AF 59 F3 7E 29 FF 00 C9 01 00 D0 04 5C B6 DA 01 5C C5 DA 01 FF
 
old values = empty space
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
----------------------
 

Potentialing wrote:
This is very cool, though can't you distribute the .asm file instead? I think that would be a lot better.

If not, then can you please explain what you mean by "$00/DABD" and "$07/7B70 - 07/7B9B"? I understand they're offsets, though the / is what confuses me.

 
You don't rally need Asm or Ips here, since the changes are not that big. Bringing in the actual code is the matter of copy and paste in hex (this is just my way of doing it, since this is the "actual" thing the way the machine understands it). But some actually prefer IPS, while others ASM. So this is just a matter of style.
 
Regarding your question. I think the hex analysis actually answers it. $00/DABD is where the pointers have changed. I usually write this as 0xDABD, or simply DABD. The actual new code is at $07/7B70 or 0x77B70 or 77B70.
 
But you know Conn is a coder. Every coder will write an address in way, so that the first global bank is separated. So 77B70 is actually first global bank 07, and then offset 7B70 in the bank. The machine sees it this way to. It defines the global bank first (and the global bank has 8000 bytes). Then it searches for the offset in the bank.

Thanks Puzzledude

I also wrote and added the asm to my first post, I'll repeat it here, too:

Code:

; This is a ASM FrontEnd Code for Zelda ALTTP (US, no header) to destroy pots with L2 -L4 sword.

lorom

org $01dabd

   jmp.l $0EFB70
   nop
   nop   
   nop   
   nop

org $0EFB70
   LDA $0301 
   AND #$0002 ; check if hammer is used           
   BEQ $04   
   JMP.l $01DAC5
   LDA $0354 
   AND #$0027  ; check if sword is used       
   BNE $04   
   JMP.l $01DAB6
   LDA $7EF359
   AND #$00FF             
   CMP #$0001  ; check sword level           
   BNE $04   
   JMP.l $01DAB6
   JMP.l $01DAC5

I hope people will post other nice hacks they made, too

This is incredible, I have no idea how you found those values to hijack, because they seriously confuse me. (Very curious how you got tile interaction to work, I'd love to make the ice rod attack interact with the swimming tiles to overwrite them to ice blocks.)

If you could share how you found those values, that'd be awesome, but regardless, thank you for the patch!

Thanks a lot  
Well, let me explain that by my history: I never learned programming but was forced to develop AST and bszelda due to the absense of professional hackers. So I teached me coding through learning by doing.
So my approach to find addresses is rather intuitive and creative than professional. In this special case, I was making some trace logs with geiger and looked first for the sfx (when destroying a pot to have a first address to start searching; STA $2142).
Then I made some more trace logs when interacting with pots - this is hammer use and pick up. Then I found that there is a cmp with $70 which is when you are in front of a pot. The rest was easy, was looking which value is affected when sword is used and this was a 27 at 7E/0354.

I do not know which swimming tiles you mean, but if there is an interaction with other items, there's a good chance to get your desired patch work.
I also have the suspection that opening the entrance of Skull Forest with the fire rod has a similar asm background.

ASM to HEX conversion
 
org $01dabd = address
 
jmp.l $0EFB70  = 5C 70 FB 0E
 
nop  =  EA
nop  =  EA
nop  =  EA
nop  =  EA
--------------------------------
 
LDA $0301 = AD 01 03
AND #$0002 = 29 02 00
and so on
 
Knowing this we can actually do ASM by using hex. Interesting isn't it. Of course this process is done by assembler, like xkas, when we "apply" the Asm patch. Understanding the above, we can see, that it is really not applying, more like converting into the language, for the CPU to read. This is why I use hex, since the code is actually in its final state. Of course having ASM is also vital, if someone want to examine and understand the code as it was originally written.
---------------------------------
 
Regarding the ice rod freezing water. This is probably much more difficult to do, since in the braking pots code, the new code is somehow refering to the same effect on the pot as the hammer would have it. But freezing water is something brand new.
 
Plus, if the ice should be slippery to walk on is also hard to achieve, since these tiles is more for indoor ice floor. No idea, how SePH managed to make slippery ice on the overworld in PW. I guess this is, where we should start. Make a water region, with the ice blocks first and then find a way, how to make a special tile to be able to "switch" between the two.

ah, now I understand what is meant by swimming tiles. This is indeed much harder...
If it is possible to get the tiles on the overworld, I would start tracing with zora's flippers: which values are affected that Link can swim when touching water. Then I would check what happens when icing a tile like a monster (but background tiles are better suitable than sprites, but I'd not remember right now a bg tile that can be iced).

I logged a couple of things for my own use, but I figure I may as well share it with you guys.

Regarding the current topic: I've got a hunch on the ice tile interaction:

Code:

$0348[0x02] -   (Player)
    
    Bitfield for interaction with icy floor tiles
    
    uuuuuuuu jjjjiiii
    
    u - free ram
    i - icy tile 1
    j - icy tile 2 (distinction is not quite understood right now)
    
    Update: It appears that the 'i' tiles aren't actually .... ice? If they are
    used for something else, or at all, we'll have to find that out eventually.

^Ice tile interactions, and:

Code:

CODE_07D7B0:        9C 48 03      STZ $0348                 ; |

^The moment when the rom clears all ice tile interactions every frame, which can be hijacked to avoid the condition.

So I at least found out how to make Link slip even though he's not truly on ice. I've also found that I can find if the Ice Rod Shot exists on the screen by looking for #$0B in the first $0A bytes from $0C4A (The 10 "special" sprites in the memory bank)... as for singling out the one that's hovering over water, I don't think there's any flag for checking that. Even if I found that, I still need to find out how to replace the tile itself....

On an un-related note, I'm planning on hi-jacking Link's movement behavior under specific conditions (I'm specifically going to prevent him from using the ladder while using the Roc's Feather I'm coding), and I found Link's movement code in wii's disassembly:

Code:

CODE_00F567:        AD 58 04      LDA $0458                 ;\ If we are in a dark room with no latern return
CODE_00F56A:        F0 FA         BEQ CODE_00F566          ;/
CODE_00F56C:        A5 11         LDA $11      ;\
CODE_00F56E:        C9 14         CMP #$14                  ; | If we have fallen down a hole and re spawned somewhere return
CODE_00F570:        F0 F4         BEQ CODE_00F566        ;/
CODE_00F572:        C2 30         REP #$30                  ; A, X, Y = 16-bit
CODE_00F574:        A5 2F         LDA $2F                ;\
CODE_00F576:        29 FF 00      AND #$00FF                ; | Get the direction link is facing and store it to $00
CODE_00F579:        85 00         STA $00          ;/
CODE_00F57B:        AA            TAX      ; Put link's facing direction in X                  
CODE_00F57C:        A5 6C         LDA $6C        ;\
CODE_00F57E:        29 FF 00      AND #$00FF                ; | Check if we are in a doorway, if not branch
CODE_00F581:        F0 2F         BEQ CODE_00F5B2        ;/
CODE_00F583:        29 FE 00      AND #$00FE      ;\            
CODE_00F586:        0A            ASL A                     ; | See which type of doorway we are standing in (vertical doorway, horizontal doorway)
CODE_00F587:        AA            TAX                       ;/
CODE_00F588:        F0 15         BEQ CODE_00F59F           ; If its a vertical doorway brnach
CODE_00F58A:        A5 00         LDA $00        ;\
CODE_00F58C:        C9 04 00      CMP #$0004                ; | If link is facing left or right branch
CODE_00F58F:        B0 0B         BCS CODE_00F59C          ;/
CODE_00F591:        A5 22         LDA $22        ;\
CODE_00F593:        18            CLC                       ; | Otherwise add #$08 to link's X coordinate
CODE_00F594:        69 08 00      ADC #$0008                ; |
CODE_00F597:        29 FF 00      AND #$00FF                ;/ Don't mess up the high byte
CODE_00F59A:        80 0F         BRA CODE_00F5AB  
  
CODE_00F59C:        AA            TAX                    ;\ Put link's direction in X and move on    
CODE_00F59D:        80 13         BRA CODE_00F5B2    ;/
    
CODE_00F59F:        A5 00         LDA $00        ;\
CODE_00F5A1:        C9 04 00      CMP #$0004                ; | If link is facing up or down
CODE_00F5A4:        90 F6         BCC CODE_00F59C          ;/
CODE_00F5A6:        A5 20         LDA $20        ;\
CODE_00F5A8:        29 FF 00      AND #$00FF                ; | If link's Y pos (low) is less than #$0080 branch
CODE_00F5AB:        C9 80 00      CMP #$0080                ; |

CODE_00F5AE:        90 02         BCC CODE_00F5B2           ;/
CODE_00F5B0:        E8            INX                  ;\ X+2      
CODE_00F5B1:        E8            INX                       ;/
CODE_00F5B2:        E0 04 00      CPX #$0004                ;\ If X is greater than #$0004 branch
CODE_00F5B5:        B0 49         BCS CODE_00F600           ;/

This is a completely different part of the code, but I thought it might be related to Link's movement as well:

Code:

CODE_0ABB98:        A5 F0         LDA $F0                   ;\
CODE_0ABB9A:        29 0C         AND #$0C                  ; | Get the direction we are pressing (up or down)
CODE_0ABB9C:        AA            TAX                       ;/
CODE_0ABB9D:        C2 20         REP #$20                  ;
CODE_0ABB9F:        A5 E6         LDA $E6                   ;\
CODE_0ABBA1:        DF D6 BA 0A   CMP.l DATA_0ABAD6,x       ; | If we can't go the direction we want to go (because we are touching the screen boundaries X-wise), branch
CODE_0ABBA5:        F0 0E         BEQ CODE_0ABBB5           ;/
CODE_0ABBA7:        18            CLC                       ;\
CODE_0ABBA8:        7F C6 BA 0A   ADC.l DATA_0ABAC6,x       ; |
CODE_0ABBAC:        85 E6         STA $E6                   ; | Otherwise move us that direction
CODE_0ABBAE:        18            CLC                       ; |
CODE_0ABBAF:        69 00 01      ADC #$0100                ; |
CODE_0ABBB2:        8D 3A 06      STA $063A                 ;/
CODE_0ABBB5:        E2 20         SEP #$20                  ;
CODE_0ABBB7:        A5 F0         LDA $F0                   ;\
CODE_0ABBB9:        29 03         AND #$03                  ; |
CODE_0ABBBB:        0A            ASL A                     ; | Get the direction we are pressing (left or right)
CODE_0ABBBC:        1A            INC A                     ; |
CODE_0ABBBD:        0A            ASL A                     ; |
CODE_0ABBBE:        AA            TAX                       ;/
CODE_0ABBBF:        C2 20         REP #$20                  ;
CODE_0ABBC1:        A5 E0         LDA $E0                   ;\
CODE_0ABBC3:        DF D6 BA 0A   CMP.l DATA_0ABAD6,x       ; | If we are touching the screen boundaries (Y-wise), branch
CODE_0ABBC7:        F0 07         BEQ CODE_0ABBD0           ;/
CODE_0ABBC9:        18            CLC                       ;\
CODE_0ABBCA:        7F C6 BA 0A   ADC.l DATA_0ABAC6,x       ; | Otherwise move us the direction we want to go
CODE_0ABBCE:        85 E0         STA $E0                   ;/
CODE_0ABBD0:        E2 20         SEP #$20                  ;
CODE_0ABBD2:        20 66 BF      JSR CODE_0ABF66           ; Handle sprites
CODE_0ABBD5:        6B            RTL                       ;

Hopefully this isn't getting too off-topic, but I'll be sure to post some actual, useable codes after I make enough discoveries to get stuff done. (Actually, at this point I think I can fix up 80% of the problems I had with my Roc's Feather. https://www.youtube.com/watch?v=K2LUg2sYXfc

EDIT: [quote="Conn"]I also have the suspection that opening the entrance of Skull Forest with the fire rod has a similar asm background.
That is... actually a very good idea! I'm going to look into that.. though I am probably going to have a very struggling time looking for a way to replace the drawn tiles on the screen (temporarily until Link moves off-screen, even). If I could get assistance with that, that would be very much appreciated.. but I'll try regardless. Thank you for the advice, by the way!

EDIT2:

Code:

$0333[0x01] -  Stores the tile type that the lantern fire or fire rod shot is
                currently interacting with.

^I just memory watched this value using the Fire Rod and found that:
Shallow water = #$09
Deep Water = #$08
Ice tiles (in-dungeon) = #$0F
Bush Tiles = #$50 (Actually, maybe I should make a patch that burns bush tiles whenever it passes by one)

$03E8 is the Ice Rod version of $0333.

Yes, it is going a bit off-topic. Maybe SePH can split this topic so that, as initially thought, people can share their hacks here.

Your progress with the rock's feather looks amazing, this opens many options to built in further riddles

I wonder whether I can help you with the ice layer request... best were if you have a rom with a pool half of water, half of ice layers. As these tiles are so far only indoor tiles I cannot make such a rom myself. Or maybe PW helps since it is already implemented in this rom? But if I can hack it in PW it won't help you I guess.

$03E8 is the Ice Rod version of $0333.

Great finding, it's not hard to get your code I think. Just need to hack a code to lda $03e8 cmp #$08 and if yes, swap bg tile... similar to the pots that change when destroyed.

A topic split would be nice, actually. This is definitely turning into a very useful thread.

Regarding the discussion: You know what? We know that $0333 is the tile that the lamp is burning on. I just logged 3 frames of lighting up a torch. Maybe this can help us?

https://dl.dropboxusercontent.com/u/163148125/lttp.log

Potentialing wrote:
Bush Tiles = #$50 (Actually, maybe I should make a patch that burns bush tiles with the fire rod whenever it passes by one.

 
I think everyone would very much appreciate this. It's a fine idea, can easily be spoted as a mod, (since we know you can not do this in Alttp), and it is hopefully not that difficult to achieve.

Puzzledude wrote:

Potentialing wrote:
Bush Tiles = #$50 (Actually, maybe I should make a patch that burns bush tiles with the fire rod whenever it passes by one.

 
I think everyone would very much appreciate this. It's a fine idea, can easily be spoted as a mod, (since we know you can not do this in Alttp), and it is hopefully not that difficult to achieve.

If you need a specific tile value, you can actually use SNES9X (I'm using rerecording v1.51 v6 svn113)

Regarding drawing tiles, I just asked Math on IRC (Me: "By the way, if you happen to know how to draw/replace tiles in-game, that'd be awesome to know how to do."), and they claimed this:

MathOnNapkins wrote: You do that by writing to the arrays at $7e2000 and $7e4000 (for bg1)
and updating the tile attributes too $7f2000-3000
That's for indoors
That's not enough though, you have schedule a dma transfer to do the actual change in vram during NMI
I have a system that I worked on that can do that sort of thing, but it still needs work
(e.g. for making a chest appear, or a block ,etc)
What I was really trying to do was rewrite the object system from scratch
The ones used in dungeon rooms
To make it all flexible and stuff

I'm going to have some serious headaches to identify which tiles I'm supposed to replace. I think I know how now, but it's still very mind-boggling. (Find the right room the player is on, find the X/Y position of the Ice Rod Shot to calculate which tile to replace, find the tile on the table so it can be restored off-screen... ugh)

I do understand what Math is meaning. You know the graphics are displayed usually in a 2 way system: (1) load tiles from rom into ram, (2) load tiles from ram into vram with dma.
So you'd need to transfer the ice tiles, when the ice rod touches water into ram and then make then a vram transfer to display them.

Conn wrote:I do understand what Math is meaning. You know the graphics are displayed usually in a 2 way system: (1) load tiles from rom into ram, (2) load tiles from ram into vram with dma.
So you'd need to transfer the ice tiles, when the ice rod touches water into ram and then make then a vram transfer to display them.

The thing is, I need to find a/the system that loads up the correct values of that table, then find an automated way to replace it on the fly whenever the ice rod touches a water tile.

Don't worry, it should be doable. The coordinates are somewhere (the game must know the coordinates when $03E8 get'sa 08). With these coordinates it is possible to replace the tile correctly in ram. And a vram transfer (if it isn't done automatically yet, can be coded as well.

How about doing it without the vram transfer first. For instance use the ice rod on a water tile, to simply change its atributes as MoN said. Then you could "walk on water", just to test how this part is done.

Puzzledude wrote:How about doing it without the vram transfer first. For instance use the ice rod on a water tile, to simply change its atributes as MoN said. Then you could "walk on water", just to test how this part is done.

That's the problem I'm having though, I don't know how to find out which tile I'm supposed to update, and I can't seem to find the table in wii's dissembly, either.

I did find this though:

Code:

CODE_008BCF:        A4 14        LDY $14              ;\ If its not time to update the tile map, branch
CODE_008BD1:        F0 20        BEQ CODE_008BF3          ;/
CODE_008BD3:        B9 7A 93      LDA.w CODE_00937A,y      ;\
CODE_008BD6:        85 00        STA $00                  ; |
CODE_008BD8:        B9 83 93      LDA.w DATA_009383,y      ; | Get tilemap address in $00-$02
CODE_008BDB:        85 01        STA $01                  ; |
CODE_008BDD:        B9 8C 93      LDA.w DATA_00938C,y      ; |
CODE_008BE0:        85 02        STA $02                  ;/
CODE_008BE2:        20 A1 92      JSR CODE_0092A1         ; Update tilemap
CODE_008BE5:        A5 14        LDA $14              ;\
CODE_008BE7:        C9 01        CMP #$01                  ; | If $14 is not #$01, branch
CODE_008BE9:        D0 06        BNE CODE_008BF1          ;/
CODE_008BEB:        9C 00 10      STZ $1000            ;
CODE_008BEE:        9C 01 10      STZ $1001                ;
CODE_008BF1:        64 14        STZ $14            ; Update the tilemap only once 
CODE_008BF3:        A5 19        LDA $19              ;\ If $19 is zero, branch
CODE_008BF5:        F0 2B        BEQ CODE_008C22          ;/
CODE_008BF7:        8D 17 21      STA $2117            ;\
CODE_008BFA:        C2 10        REP #$10                  ; |
CODE_008BFC:        A2 80 00      LDX #$0080                ; |
CODE_008BFF:        8E 15 21      STX $2115                ; | This will will trigger a transfer from $7FXXXX to vram address $YY00
CODE_008C02:        A2 01 18      LDX #$1801                ; | XXXX is specified by variable $0118
CODE_008C05:        8E 00 43      STX $4300                ; | YY is specified by this variable
CODE_008C08:        AE 18 01      LDX $0118                ; |
CODE_008C0B:        8E 02 43      STX $4302                ; |
CODE_008C0E:        A9 7F        LDA #$7F                  ; |
CODE_008C10:        8D 04 43      STA $4304                ; |
CODE_008C13:        A2 00 02      LDX #$0200                ; |
CODE_008C16:        8E 05 43      STX $4305                ; |
CODE_008C19:        A9 01        LDA #$01                  ; |
CODE_008C1B:        8D 0B 42      STA $420B                ;/
CODE_008C1E:        64 19        STZ $19              ; Only run transfer once      
CODE_008C20:        E2 10        SEP #$10                 ;   

I think first the new ice tile must be transferred into vram (so that it also available on the overworld). This is maybe most difficult since I do not know which tile can be replaced. Then it is needed to understand what must be done to change bg tiles. I assume a simple map change. This can be traced by watching what happens when you destroy a pot, both the pot, as well as the removed pot are bg.

I'm not sure whether it is needed to hack a "walk on water". When the correct bg tile is replaced (which you can normally also walk on) it is possible that the attributes do not change then. E.g. you cannot walk on a pot, but as soon it is replaced, the new tile allows to walk on it.
If this won't work, I remember that I once changed the tiles attributes in AST. The torches were in front of sprites or so. So it is possible to hack directly into tiles' attributes as well.

At which post do you guys want me to split the topics?

SePH wrote:At which post do you guys want me to split the topics?

I propose immediately after the first post, because it pretty much got off-topic after that. This is a wonderful discussion for ASM help, though.

Math wrote: The ice shot has: jsr $8981 in its code
It is that routine (the one at $40981) that does the collision check and writes to $03e8 ($03e4, x)
right around the line.... jsr Entity_GetTileAttr
in that routine
right after that is where it writes to $03e4, x

I'm gonna investigate this. If I find out how to do this, I think I have enough information to put this hack into play.

Potentialing wrote:

SePH wrote:At which post do you guys want me to split the topics?

I propose immediately after the first post, because it pretty much got off-topic after that.

 
I don't know about this, since the hex decoding is still a part of pot braking directly. And that post is number 4. So this is not connected with the Ice rod topic.
 
 
I think it would be best to split after number 8. Then a new topic would start with Conn's post about the swimming tiles, this is post 9, while post 10 is clearly a separate issue. Post 4 is on topic, 5 is connected with 4, so is 6 and 7. In the 8th I still had the pot-breaking in mind, when traversing from Asm to Hex.
 
So braking the pot topic and all comments connected with it are roughly to post 8, later on it is the Ice rod topic (parts of it are still in previous posts though!).
 
It is really hard to say where the actual line is. First post only would be possible if all of those patches would be gathered together as one posts only, with no comments.

At which post do you guys want me to split the topics?

I'd also suggest to split directly after the first post, so people can directly post their hacks below.
post #2 ff. are only explanations and stuff how to improve the first post like adding an asm.

I'm gonna investigate this. If I find out how to do this, I think I have enough information to put this hack into play.

great, if you need help tracing some addresses or so let me know, you can also email me (con.s@gmx.de) and I'll help as best as I can

Here ya go

I've created a general ASM topic with the split and edited Potentialing first post to include Conn's original post! That way well keep the other thread for the asm/hex hacks database! Please keep the same posting format as Conn for the other thread and it should be all good!

Perfect solution, thank you

Found something:

Code:

$00/884A BF 00 20 7E LDA $7E2000,x[$7E:2AAA] A:0AAA X:0AAA Y:0002 P:envmxdizC
$00/884E 0A          ASL A                   A:02CD X:0AAA Y:0002 P:envmxdizC
$00/884F 0A          ASL A                   A:059A X:0AAA Y:0002 P:envmxdizc
$00/8850 85 06       STA $06    [$00:0006]   A:0B34 X:0AAA Y:0002 P:envmxdizc
$00/8852 A5 00       LDA $00    [$00:0000]   A:0B34 X:0AAA Y:0002 P:envmxdizc
$00/8854 29 08 00    AND #$0008              A:0D5D X:0AAA Y:0002 P:envmxdizc
$00/8857 4A          LSR A                   A:0008 X:0AAA Y:0002 P:envmxdizc
$00/8858 4A          LSR A                   A:0004 X:0AAA Y:0002 P:envmxdizc
$00/8859 04 06       TSB $06    [$00:0006]   A:0002 X:0AAA Y:0002 P:envmxdizc
$00/885B A5 02       LDA $02    [$00:0002]   A:0002 X:0AAA Y:0002 P:envmxdiZc
$00/885D 29 01 00    AND #$0001              A:00EA X:0AAA Y:0002 P:envmxdizc
$00/8860 05 06       ORA $06    [$00:0006]   A:0000 X:0AAA Y:0002 P:envmxdiZc
$00/8862 0A          ASL A                   A:0B36 X:0AAA Y:0002 P:envmxdizc
$00/8863 AA          TAX                     A:166C X:0AAA Y:0002 P:envmxdizc
$00/8864 BF 00 80 0F LDA $0F8000,x[$0F:966C] A:166C X:166C Y:0002 P:envmxdizc
$00/8868 85 06       STA $06    [$00:0006]   A:1DFE X:166C Y:0002 P:envmxdizc
$00/886A 29 FF 01    AND #$01FF              A:1DFE X:166C Y:0002 P:envmxdizc
$00/886D AA          TAX                     A:01FE X:166C Y:0002 P:envmxdizc
$00/886E BF 59 94 0E LDA $0E9459,x[$0E:9657] A:01FE X:01FE Y:0002 P:envmxdizc
$00/8872 E2 30       SEP #$30                A:0008 X:01FE Y:0002 P:envmxdizc
$00/8874 C9 10       CMP #$10                A:0008 X:00FE Y:0002 P:envMXdizc
$00/8876 90 0F       BCC $0F    [$8887]      A:0008 X:00FE Y:0002 P:eNvMXdizc
$00/8887 6B          RTL                     A:0008 X:00FE Y:0002 P:eNvMXdizc


$08/8A53 FA          PLX                     A:0008 X:00FE Y:0002 P:eNvMXdizc
$08/8A54 80 07       BRA $07    [$8A5D]      A:0008 X:0004 Y:0002 P:envMXdizc
$08/8A5D 9D E4 03    STA $03E4,x[$08:03E8]   A:0008 X:0004 Y:0002 P:envMXdizc

You see at the start of above code:
$00/884A BF 00 20 7E LDA $7E2000,x[$7E:2AAA]
Here the tile for the bg is loaded which results in a water tile 08 to be stored at $08:03E8 at the end of above code!
If I manipulate this by cheating with e.g. 7E2AAA 0B you get this:



you can walk on that tile! So if you change this to an ice tile you'll walk on that, too

Unfortunately this takes only effect when leaving and reenter the screen, so a re-enabling of the dma transfer that displays the background when entering the screen must be implemented when using the icerod (usually a simple jsl to the dma routine will do the job).

But first you need to get the ice tile to the overworld so it can be accessed by  LDA $7E2000,x

So the code will look like:
start here: $08/8A5D 9D E4 03    STA $03E4,x[$08:03E8]  
then hack:
cmp #$08
if yes:
write a code to get again the x value so that  in this case the new ice layer is stored to ,x[$7E:2AAA]
reenable the dma transfer... and that's it