This same memory is used when equipping armor, so you can set the values while equipping, and they will stick when you leave the menu. Interestingly, the memory seems to be used for the equip menu, and is mirrored at 0x0b00, 0x1300, and 0x1b00 as well. For example, if the rapier is 04, then 84 means an equipped rapier. Each weapon and armor has a number and to be equipped is a matter of setting the highest bit. Here you can see a white wizard that I’ve given the first 3 spells of each level to (the repeating 01 02 03) and that has 9 / 9 casts for each level:Īnd the white wizard’s magic table in-game looks like:īy buying a rapier and then equipping/unequipping I found the equip memory to be at 0x0300, there are 16 bytes available, matching the 4 slots for each character. The last 16 bytes within the block are 2 bytes for each level, with the first byte being the current number of casts left for the level, with the 2nd byte being the max. White spells for a level are numbered 0-4 and black spells are 5-8. Each level gets 4 bytes, with the first 3 being the spell in that level’s slot, and the 4th byte being 0.
The first 32 bytes are what spells the character has for each level. What magic spells a character has, and the current/max number of spells per level are stored in blocks for each character starting at 0圆300: Address You can increase the character’s type value by 6 (the total number of character classes), and they will change to their adult version right away. Later in the game, after you get the Rat’s Tail, they become adults: knight, black wizard etc.
When you start the game, you characters are child versions of their classes: fighter, black mage, etc. Then I messed with the values and saw what changed. For instance, looking for my first character’s Str and Agl of 20, and 5 was a matter of looking for the hex values 14, 05 and finding them on the second line of the data block. I found many of the above locations by looking at the Stats section for a character and then looking for the hex converted values within the block. Some interesting locations within a character block: Address I named my first character ‘AAAA’ so searching through the Hex Editor in FCEUX for the hex “8a8a8a8a” brings us right to the first character’s block of data: You can see that a capital ‘A’ is mapped to 0x8A. The trick is finding the value associated with the letters, which you can do by looking at the PPU memory and determining what tile goes to what letter. I was able to find this by searching for my character’s names in RAM.
The character data is organized into four blocks, once for each character, one after the other starting at 0圆100. Note that values that need more than one byte are stored little-endian, so the lower byte shows up first in memory. Then I would use the Hex Editor tool to look at the NES RAM and try poking different locations. I searched in the RAM Search window for values, particularly as something in-game would change, such as when you buy a weapon or a spell, in order to track down the correct memory locations. I ended up losing most of the notes from a few years ago, so I went back and rediscovered the different memory locations and values to use again. I kept some notes on how I did it and thought others might find the process as interesting and fun as I did. I used fceux as my NES emulator, same as in the video and followed mostly the same patterns. I decided I wanted to hack Final Fantasy 1, one of my favorite games growing up, that I put in more than 100 hours playing. A few years ago I was inspired to hack around on some of my old favorite NES games after watching the video from Double Fine where the developer Brandon Dillon hacks around on the original Legend of Zelda.