Here are the changes to make Frog Mario's palette red as an ASM patch:
Codelorom
org $21EF11
;This word is part of a table located at $21EF09-$21EF1A
dw $88A0 ;Pointer to Frog Mario's palette on the map (Normally $88E0)
org $29C7EB
;This word is part of a table located at $29C7E3-$29C7F0
dw $88A0 ;Pointer to Frog Mario's palette at level load (Normally $88E0)
org $23C483
;This code is in the middle of a subroutine located at $23C467
cmp #$05 ;Normally cmp #$02
bcs $C48A ;Normally bpl $C48A
As a bonus, here are the relevant ROM locations for Mario and Luigi's palettes in SMB3 (PC locations are in [square brackets]):
Code21EF09-21EF1A [10EF09-10EF1A] 16-bit Pointers to palettes of Mario's forms, map screen; bank byte is hardcoded as $3C
88A0 00: Small
88A0 01: Super
8920 02: Fire
88A0 03: Raccoon
88E0 04: Frog Suit
88C0 05: Tanooki Suit
8900 06: Hammer Suit
8800 07: Jugem's Cloud
88A0 08: P-Wing
21EF1B-21EF2C [10EF1B-10EF2C] 16-bit Pointers to palettes of Luigi's forms, map screen; bank byte is hardcoded as $3C
88E0 00: Small
88E0 01: Super
8940 02: Fire
88E0 03: Raccoon
88E0 04: Frog Suit
88C0 05: Tanooki Suit
8900 06: Hammer Suit
8800 07: Jugem's Cloud
88E0 08: P-Wing
29C7E3-29C7F0 [14C7E3-14C7F0] 16-bit Pointers to palettes of Mario's forms, upon level load (1); bank byte is hardcoded as $3C
88A0 00: Small
88A0 01: Super
8920 02: Fire
88A0 03: Raccoon
88E0 04: Frog Suit
88C0 05: Tanooki Suit
8900 06: Hammer Suit
29C7F1-29C7FE [14C7F1-14C7FE] Pointers to palettes of Luigi's forms, upon level load (1); bank byte is hardcoded as $3C
88E0 00: Small
88E0 01: Super
8940 02: Fire
88E0 03: Raccoon
88E0 04: Frog Suit
88C0 05: Tanooki Suit
8900 06: Hammer Suit
23C451-23C462 [11C451-11C462] Pointers to palettes of Mario and Luigi's forms, upon level load (2) and transforming in a level;
bank byte is hardcoded as $3C
88A0 00: Small Mario/Super Mario/Raccoon Mario
88E0 01: Small Luigi/Super Luigi/Raccoon Luigi
8920 02: Fire Mario
88A0 03: Mario (not used)
88E0 04: Frog Mario/Frog Luigi
88C0 05: Tanooki Mario/Tanooki Luigi
8900 06: Hammer Mario/Hammer Luigi
88C0 07: Tanooki Statue Mario/Tanooki Statue Luigi
8940 08: Fire Luigi
This is an incomplete disassembly of the subroutine at $23C467 [11C463], which is responsible for selecting and loading Mario or Luigi's palette while in a level:
Code23C467 ldy #$07 ;Load #$07 into Y index register (value of Tanooki Statue palette)
23C469 lda $0726 ;Load active player value (#$00=Mario, #$01=Luigi)
23C46C beq $C477 ;Branch if zero (Mario)
23C46E lda $BB ;Current player (Luigi)'s powerup state
23C470 cmp #$02 ;Check if 02 (Fire)
23C472 bne $C477 ;Branch if not Fire
23C474 iny ;Y contains #$07, so by incrementing, we get #$08, Fire Luigi's palette
23C475 bra $C48A ;Branch to pushing X onto stack
23C47C lda $BB ;Load current player's powerup state into accumulator
23C47E tay ;Transfer (copy) accumulator to Y
23C47F cmp #$03 ;Check if 03 (Raccoon)
23C481 beq $C487 ;If Raccoon, skip to code where player value is used to determine palette
23C483 cmp #$02 ;Check if 02 (Fire)
23C485 bpl $C48A ;If greater, skip loading player value
23C487 ldy $0726 ;Load active player value (#$00=Mario, #$01=Luigi)
23C48A phx ;Push X index register onto stack
23C48B rep #$30 ;Make A, X, and Y 16-bit
23C48D tya ;Transfer Y to A
23C48E and #$00FF ;Clear upper 8 bits
23C491 asl ;Shift bits left by 1 to double the value
23C492 tax
23C493 lda $23C451,x
...