This seems like a pretty cute game.
When trying to make changes to a game that isn't that well documented, and especially if there aren't specific utilities designed for modifying aspects of a game, it can feel overwhelming trying to figure things out for oneself. However, that's pretty much how ROM hacking for any given game begins. You can make history for all those who enjoy kiwis!
First off, I normally just try to use Google to see if I can find any little bits of information here and there on the game, as there might be some dark corner of the Internet where there's someone else who enjoys a game that isn't so commonly hacked just as much as you do, and any amount of documented data can help one get started.
There does happen to be a page on The Cutting Room Floor
for this game, though there isn't much, but the information about changing 0x20000 to FF in the ROM is already more than we knew from the start!
So, after some more searching around, I couldn't find anything else when it comes to RAM addresses, ROM offsets, or anything else documented related to hacking the game. This is when we have to open up a copy of the game's ROM file in a special emulator like FCEUX
and, by accepting that there will be a whole lot of trial and error, if one is dedicated and patient enough, regardless of how much time it may take, anything is possible, and you can potentially find everything that you're looking for.
Being familiar with the game-play definitely helps with having an idea of variables and functions that you could be looking for. Being unfamiliar with this game, upon a first glance, I didn't really find much within the first few minutes. However, if I was to continue looking and testing out different bytes and seeing what changes, the solutions to any mysteries would most likely soon reveal themselves.
Here's a possible method of how you can get started. With FCEUXD, I started to run the Code/Data Logger from the title screen, and then pressed Start so that the game would load the first level. Once the level was loaded, I paused the emulator from the FCEUXD window with the F2 key, and then I stopped the Code/Data Logger. Next, by clicking in the hex editor, bytes now appear in blue for data, yellow for code, and green if both. (As an example, 0x1A010, which is A5, and also the beginning of a ROM bank, is actually highlighted in green.)
As a random test, I decided to use the Name Table Viewer to see if I could start out with how the game handles and determines which graphical tiles to draw to the first screen. I initially focused on the top of the large building with the cage (or whatever you want to call it - hopefully you know what I'm referring to). I saw that the tile for the line at the very top was 56. So, by searching through in the hex editor, I eventually found a highlighted 56 near the bottom of the PRG-ROM, at 0x1AFD8, that when changed to, for instance, 57, changed the tile drawn for that block at the top of the building. With the way that the bytes are highlighted in this area, it's safe to consider this area where the TSA data for the blocks is located.
Upon examination of the block at the very top-left of the screen, the 56 at PPU Address $21A4 is actually the bottom part of that block on the top of the building. So, that one block is made up like this:
Top-left corner: PPU Address $2184: Tile #$26
Top-right corner: PPU Address $2185: Tile #$26
Bottom-left corner: PPU Address $21A4: Tile #$56
Bottom-right corner: PPU Address $21A5: Tile #$56
Observing the groups of highlighted bytes, we can see that the following ROM offsets make up that one block (especially if you try changing the values and then reloading the level to see how the tiles that are displayed change, and how the block is visually affected):
0x1AED8: 26 - Top-left corner
0x1AF58: 26 - Top-right corner
0x1AFD8: 56 - Bottom-left corner
0x1B058: 56 - Bottom-right corner
So, the value of each corner of a tile is within one of four groups of 0x80 (in hex), or 128 bytes. However, the question is determining where the exact beginning of each group is, just to know for sure. This would be important information to know for determining how the object data for the level system works.
0x1AEB7 is 03, which seems to be the top-left corner of the ground blocks drawn to the screen. I guessed that, while in RAM, this would be RAM address $AEA7 (although, it could have been $CEA7 depending on how the game swaps ROM banks, which is why trial and error must be accepted, even with basic knowledge of how the NES works in general), and so I set a read breakpoint in the Debugger. Sure enough, I got a hit while the game was still running in the level.
$FA85 (0x1FA95 in ROM)
$FA85:B1 6E LDA ($6E),Y @ $AEA7 = #$03
So, it appears that at least one address for loading TSA data, at least for that one block, is stored at $6E in the zero page in RAM.
At $006E and $006F respectively, there is A5 and AE, or $AEA5 in reverse.
There are also these bits of code visible nearby in the Debugger window:
$FA88:B1 72 LDA ($72),Y @ $AFA7 = #$04
$FA91:B1 70 LDA ($70),Y @ $AF27 = #$03
$FA94:B1 74 LDA ($74),Y @ $B027 = #$04
Remember that Y is 02 with the game currently frozen, and the beginnings are actually 2 bytes before the addresses displayed, as found from the $6E, $70, $72, and $74 addresses stored in the zero page.
$AEA5 is 0x1AEB5 in the ROM.
$AF25 is 0x1AF35 in the ROM.
$AFA5 is 0x1AFB5 in the ROM.
$B025 is 0x1B035 in the ROM.
So, my conclusion at this point is that these are the ranges for the objects' TSA, at least for that section of it.
0x1AEB5 - 0x1AF34 (0x80) - Top-left corner tiles
0x1AF35 - 0x1AFB4 (0x80) - Top-right corner tiles
0x1AFB5 - 0x1B034 (0x80) - Bottom-left corner tiles
0x1B035 - 0x1B0B4 (0x80) - Bottom-right corner tiles
I'm questioning where the other 0x80 (in hex), or 128 bytes come in, while considering how SMB3 works with common objects shared between the multiple Object Sets, and each Object Set having its own respective half of TSA as well; however, as far as I know, this is probably the wrong assumption to have, as again, I'm truly not familiar with this game, and haven't bothered to do deeper digging to further analyze what exactly is going on in every single dark corner of the ROM. This post, again, was only meant to serve as a starting point for your hacking conquest, if you still so choose. I attempt to be a helpful and encouraging person, but even I understand as a hacker myself that when we choose to do a project, we have to commit to the majority of the work.
0x1B0B5 - 0x1B134 (0x80) appears to be the palette definitions for the tiles; which quarter of the 16-byte object palette that the tile uses (00, 01, 02, or 03).
I will stop here for now. Hopefully this will help you get started with finding even more out for hacking the levels and whatnot! Best of luck!