Hi. Actually it's very easy, and should make for excellent practice in case you wanted to get into assembly hacking. The idea is really nice, if you don't mind I'll use it in a tutorial I'm planning to write later.
So in datacrystal's RAM Map for NES SMB3 (credits to whoever did that and saved me the hassle of doing a cheat search for the relevant address), we have this:
RAM adress $00ED
Current form (to set, use 0578): 00-Small, 01-Super, 02-Fire, 03-Raccoon, 04-Frog, 05-Tanooki, 06-Hammer
RAM adress $0578
Change Mario form. Modes 1-7 can be changed at will (same as ED value+1). Flag-like values combine with ANY mode (so you can get e.g. small Mario in statue form). Modes: 01=small, 02=big, 03=fire, 04=raccoon, 05=frog, 06=tanooki, 07=hammer. Flags: 10=Enable statue, 40=Enable swimming (causes splash on land), 80=Enable Kuribos boot. No idea how to CLEAR the flags, probably not possible here.
Using the following:
ROM (shouldn't matter much since Nintendo rearranging memory drastically for localized versions isn't very likely - even though it happens sometimes): Super Mario Bros. 3 (USA) (Rev A)
I start W1-1, stand below the mushroom block, make a savestate just in case (for quick testing) and then pause the emulator (setting a pause hotkey is handy here).
Then I open Debug>Debugger.
Under Breakpoints>Add, I put 0578 and check "write", so that the emulator snaps whenever that address gets overwritten.
Now try to get that mushroom.
Emulator snaps. (in case you wanted the game to resume, disable the breakpoint (double-click) and press Run)
And then look at the assembly instructions on the left.
First instruction was the one behind what happened, and it's:
00:A8A0:8D 78 05 STA $0578 = #$00
00:A8A0 = where this programming instruction is, just in case you wanted to hex-edit it and change the programming to your liking
8D 78 05 = how this instruction is written in hex. Three bytes in our case.
STA $0578 = the instruction in a more human-readable form
Just a quick reminder about 6502 assembly instructions:
To store some value XX to an address YYYY, we first store it a temporary memory called the accumulator (A) with an instruction called LDA (LDA #$XX , XX being the value).
Then we use the instruction STA (STA $YYYY) to put whatever value is in the accumulator (so XX in our case) in the address $YYYY.
We have our STA, we need to find the last thing (LDA, that is) that modified the contents of the register.
And sure enough, if we scroll just a little bit to the top, enough to see the instruction immediately above (before) our STA $0578, we'll find...
00:A89E:A9 02 LDA #$02
So in hex this appears A9 02. As you may have guessed from the above 02 is the value. And in the RAM Map doc, 02 happens to be the value for Big Mario.
We could change that byte to something else, like 01 (in case we wanted to make a mushroom forcing small Mario state... oh by the way a poison mushroom shouldn't be hard to implement either) or 05 for Frog Form... oooor 82 for Kuribo's Shoe with Big Mario.
So that instruction (which is located, as the debugger helpfully points out, in address $A89E) which is written A9 02 must be changed to A9 05.
You can double-click on the highlighted line under Breakpoints. One "E" letter (standing for Enabled) should disappear, which would be helpful since we don't need the emulator to snap right now.
We have something to try after all
Normally you do this with a good old hex editor (take care to add $10 to any offset you want to go to though).
But since it's FCEUX and it's newbie-friendly you have a button with "Rom Patcher" on it.
Our instruction needing to be modified is located in A89E.
Type it under Offset, and click Edit This Offset.
What should appear is the hex data with a quick disassembly (the English-readable stuff) below.
A9 02 8D 78 05 AD 77 05
Disassembled: 00:A89E:A9 02 LDA #$02
And we can clearly see our A9 02.
Under Patch Data, write your new instruction.
You need Frog state (05) instead of Super Mushroom state (02), so you need to put
Note this change is applied to the copy of the ROM the emulator loaded to memory so that it can run. If you want it applied to your actual ROM file, use "Save ROM File".
Try your new hack, and enjoy
But that's not all! There's more for you to try on your own.
Like modding all other block types to exclusively give frog suits. And the items you can get in Toad Houses too must be taken care of in the exact same way.
And then with Crystaltile2 you'll need to edit all tiles for these powerups to have the frog powerup graphic.