The zero point of the ZST format is $C13, so for example the tempo byte is located at $1845 - $C13 + $7E0000 = $7E0C32 in the RAM. EDIT
: An additional copy of the song data can be found at $7EFC00. This is where the data is stored when the user is outside the music editor.
There are a bunch of instrument definitions starting at $254C in the SPC ARAM, copied from $18A130 in the ROM; the corresponding headerless LoROM address is $C2130, and you should be able to figure out other physical file positions from the SPC addresses. The data layout suggests that exactly 30 instruments are defined. (This table is not what N-SPC instruments actually look like.)
- $254C - $2569: SPC sample indices.
- $256A - $2587: Instrument volumes, FF is maximum.
- $2588 - $25A5: Instrument panning. The 6 lower bytes determine the pan direction from 0 (right) to 20 (left); bit 6/7 inverts right/left output respectively. (The N-SPC driver, including its early version in Super Mario World, also does the same thing.)
- $25A6 - $25C3: Relative offsets into the following note table.
- $25C4 - $2686: 15 N-SPC note tables, the lowest and highest notes are 80 and D3 respectively.
- $2687 - $26A4: Fine pitch, FF denotes an upward semitone. There is no downward detune.
- $26A5 - $26C2: maximum note duration in number of ticks.
After that there is still one table which points to N-SPC music frame data, the kind that Super Mario World doesn't have. It might point to complete songs or sound effects.
Every instrument only has 13 pitches, the 3 remaining are not so much placeholders as they are the results of out-of-bound array access.
Of the 15 note tables, 3 are unused, 3 more are used only by the unused instruments, and the following two do not follow the B1 - G3 order:
- B1 C2 D2 E2 G2 B2 D3 F3 A3 C4 G4 C5 C6, used by instrument 01 (Mushroom)
- A3 C4 D4 E4 F4 G4 G2 C3 G3 C4 E4 G4 C5, used by instrument 0C (Boat, the cymbal sample index seems to be hardcoded)
It is therefore theoretically possible to apply a key signature in Mario Paint during run-time, by manually overwriting the note tables for the melodic instruments. Accidentals still cannot be represented.
: This Lua 5.3 script
decodes a Mario Paint SRM file; the resulting music data can be located at 0xB800. To view the painting, open the generated binary file in Tile Molester, set the codec to "4bpp planer, composite (2x2bpp)", then change the canvas size to 32 x 22. The drawing is located at 0x6000, the animation at 0x0, and some animation path data from 0x5800 to 0x5FFF. The whole piece of data can be found at $7E4400 while running Mario Paint.