FE10 RAM Hacking Question (with Answer and Info)

[darkkfan]

I searched around and found two almost identical topics (http://serenesforest.net/forums/index.php?showtopic=36271 and http://serenesforest.net/forums/index.php?showtopic=36218), but both suggested two different fixes and neither one ended up working. I followed the instructions in those topics on when to apply the codes with no success. I am using an NTSC ISO so it should be possible. Any ideas on how to get this code to work in Dolphin?:

Make all Enemies Played Controlled (works in all Chapters and all Difficulties)
Wii Remote g6flavor [shadowX39]
283D78DA 0000xxxx
2066B828 702E7468
0066B844 00000000
E0000000 80008000
283D78DA 0000XXXX
2066B828 702E7468
0066B844 00000001
E0000000 80008000

I get that the xxxx line is a button modifier and needs to be removed, but the topics suggest removing other lines too, which doesn't seem to work either. Can someone who has gotten this code to work successfully offer any tips?

Sorry for asking this question seeing as it has been asked before, but IIRC neither of those codes worked in the topics in question and they didn't work for me either.

Edited August 13, 2013 by Walmart

[shadowofchaos]

Here's what I suggest then.

Open up Dolphin with the "/d" argument to put it in debug mode.

(Press the pause button if it's paused by default... debug mode does that.)

Load a savestate.

Make sure it fully loads and you can see the frame for that savestate.

And then click the dump MRAM... (dump both if you want just in case)

It should end up being a file named ram.raw somewhere in the user folder... like where you find your savestates.

I'll port the code for you manually. I have no idea why the previous suggestions wouldn't work for you because that part of the memory is usually fixed on system related functions for the map.

[Vicious Sal]

Codes only work in 4:3 Setting I believe. Is dolphin set to 16;9?

Or Vice versa? I'll look up if I have the same code. ;o

[Poctiboro]

I used the codes a long time ago when i was into hacking FE10, unfortunatelly, i tried to make them work for around 4 hours yesterday with no success so... sorry that can't contribute more

[darkkfan]

Codes only work in 4:3 Setting I believe. Is dolphin set to 16;9?

Or Vice versa? I'll look up if I have the same code. ;o

I tried changing the widescreen setting with no luck. I did read that in other places when I was searching around, though. Thanks, though, and please post here if you happen to find the code you used!

I used the codes a long time ago when i was into hacking FE10, unfortunatelly, i tried to make them work for around 4 hours yesterday with no success so... sorry that can't contribute more

Ok, that's no problem. Thanks anyway, it is helpful to know that they are at least possible with the emulator.

Here's what I suggest then.

Open up Dolphin with the "/d" argument to put it in debug mode.

(Press the pause button if it's paused by default... debug mode does that.)

Load a savestate.

Make sure it fully loads and you can see the frame for that savestate.

And then click the dump MRAM... (dump both if you want just in case)

It should end up being a file named ram.raw somewhere in the user folder... like where you find your savestates.

I'll port the code for you manually. I have no idea why the previous suggestions wouldn't work for you because that part of the memory is usually fixed on system related functions for the map.

Thanks a lot! I'll try that soon and post here with the results. I really appreciate it!

Interestingly, it might not be the button modifiers that is causing the problem, since I can get the end chapter code to work ONLY with the modifiers, so perhaps I should try the original code again?

[Vicious Sal]

Make All Enemies Player Controlled, push 1&+ ON,1&- OFF v2* [g6flavor]

283D02FA 00000210

20697784 01000000

00697784 00000000

E0000000 80008000

283D02FA 00001200

20697784 00000000

00697784 00000001

E0000000 80008000

* If v1 doesn't work on your version of FE, try v2

Push A+B then end move to End Chapter [g6flavor]

283D02FA 00000C00

003C3A1C 00000004

E0000000 80008000

There is ONE catch though... these are the codes for a PAL Iso/game. I believe the amount you have to add/substract to change the code to NTSC is known though. The button modifiers are 1 & 2 for the wiimote (vertical) settings.

[darkkfan]

Make All Enemies Player Controlled, push 1&+ ON,1&- OFF v2* [g6flavor]

283D02FA 00000210

20697784 01000000

00697784 00000000

E0000000 80008000

283D02FA 00001200

20697784 00000000

00697784 00000001

E0000000 80008000

* If v1 doesn't work on your version of FE, try v2

Push A+B then end move to End Chapter [g6flavor]

283D02FA 00000C00

003C3A1C 00000004

E0000000 80008000

There is ONE catch though... these are the codes for a PAL Iso/game. I believe the amount you have to add/substract to change the code to NTSC is known though. The button modifiers are 1 & 2 for the wiimote (vertical) settings.

Ok, thanks, that should be helpful! I can use the calculator thing from one of the topics in the OP to convert it and try that code. I might as well try the NTSC code again with modifiers too.

Like I said, the version of the end chapter code I have works fine, which is weird because I was under the impression that button modifiers weren't supported.

[shadowofchaos]

I guess the newer Dolphin does now? xD

[Poctiboro]

The code that Vicious Sal posted worked in a pal version of the game unmodified and with the button activators, though i had to mash 1 and + over and over until all of the sudden Purgo and his bandits were blue

I tried again in the NTSC version but i couldn't make it work

[darkkfan]

The code that Vicious Sal posted worked in a pal version of the game unmodified and with the button activators, though i had to mash 1 and + over and over until all of the sudden Purgo and his bandits were blue

I tried again in the NTSC version but i couldn't make it work

Hmm... I could switch to the PAL version i guess, but I'd rather not since I've already hacked the NTSC ISO. I can't find info on how to convert the working PAL code, so hopefully someone can post the offset so I can at least try that before doing the ram dump (if that offer still stands).

Assuming the offer does stand (it's understandable if it doesn't), and i can't find an alternative in the next couple days, i'll post the ram dump here (i have an eleven hour flight coming up in a few days and getting these codes working so i can start my run would help immensely).

[darkkfan]

Double Post for RAM info, hopefully I dumped it correctly. I really appreciate the help.

http://www.dropbox.com/s/qrxa1r2mwyw3l2h/ram.raw

http://www.dropbox.com/s/dj4u1z7terxjig5/aram.raw

[shadowofchaos]

It really does look like your addresses are shifted somehow.

Did you try dumping the RAM while you were on a map?

Can you give me some values? Like someone's HP?

Like this is mine for example:

Edited August 9, 2013 by shadowofchaos

[darkkfan]

Thanks for responding SoC! If it's ok, I moved this conversation to PM so we aren't continually bumping this topic to the top.

[shadowofchaos]

I think it's completely fine to keep the discussion here... in case anyone else can help... but...

Wat.

It's the right address.

Try this... get Dolphin in debug mode again.

Load that savestate.

Go in to the memory menu as shown in the screeshots.

Go to that address and see if it's similar to the window on the left side of the first screenshot.

If the values are... enter "00000000" to replace the "01000000" and click Set Value.

See if what happens is like the second screenshot.

If it does, that just means the cheats you enter as gecko codes aren't working in the emulator (the cheat engine) and the code (address) itself is fine.

Make sure you have "Enable Cheats" on the config menu, just in case.

Edited August 9, 2013 by shadowofchaos

[darkkfan]

I think it's completely fine to keep the discussion here... in case anyone else can help... but...

Wat.

It's the right address.

Try this... get Dolphin in debug mode again.

Load that savestate.

Go in to the memory menu as shown in the screeshots.

Go to that address and see if it's similar to the window on the left side of the first screenshot.

If the values are... enter "00000000" to replace the "01000000" and click Set Value.

See if what happens is like the second screenshot.

If it does, that just means the cheats you enter as gecko codes aren't working in the emulator (the cheat engine) and the code (address) itself is fine.

Make sure you have "Enable Cheats" on the config menu, just in case.

Yep, the replace value worked (it switched from 01000000 to 00000000) and cheats are enabled, but still no luck getting the code to work. Then does that mean it is an emulator issue? Perhaps I am entering/applying them incorrectly or something, I don't really know? This just keeps getting stranger.

Could I perhaps just change that address manually every time I wanted to apply the code and just run in debug mode all the time? It wouldn't be much more of a hassle than applying a regular gecko code.

Edited August 9, 2013 by Walhart

[shadowofchaos]

Hmmm....

Did you ever try this code by itself?

00697784 00000000

That's the actual write code. The others are the "Check if they're pressing the button" condition.

(As in start the game and IMMEDIATELY load the savestate instead of waiting for the game to load)

The effect of the code should still apply.

http://geckocodes.org/index.php?arsenal=1

Codetype documentation is there, so you can see what the heck the code is actually doing... and modify it appropriately according to your Dolphin needs.

Sadly, Dolphin is not supported at the WiiRD forums... so we're actually on our own when using Gecko Codes with the emulator.

Edited August 10, 2013 by shadowofchaos

[darkkfan]

http://geckocodes.org/index.php?arsenal=1

Codetype documentation is there, so you can see what the heck the code is actually doing... and modify it appropriately according to your Dolphin needs.

Sadly, Dolphin is not supported at the WiiRD forums... so we're actually on our own when using Gecko Codes with the emulator.

It quickly became apparent how simple the Gecko codes really are when I realized from your last example that they are just an address followed by a write string, but thanks for the link!

Hmmm....

Did you ever try this code by itself?

00697784 00000000

That's the actual write code. The others are the "Check if they're pressing the button" condition.

(As in start the game and IMMEDIATELY load the savestate instead of waiting for the game to load)

The effect of the code should still apply.

I tried putting that code in as quickly as possible, no luck. I had to change the compiler to interpreter to get the game to load slowly enough for me to switch the savestate first, so would that affect it at all?

When I checked the savestate this time for the memory, it looked like this:

It looks like you were probably right the first time about the address being shifted (I have no idea why it looks different now then before), since the value of 00697784 is 00830000 for some reason. Maybe I did make a hex editing mistake after all. Is it obvious to you if there is an offset (or should I do the dump one more time or something?). Unfortunately, since the only thing I changed is boss growths, there is no way to test if the hex editing was done correctly without the working control enemy code, however the fact that the edited ISO loads seems to suggest there is no fatal error related to the hacking I did, but it remains a possibility.

I tried to manually change that address in the savestate using the debugger so it takes effect in the game, but apparently this isn't good because it causes the savestate to crash (probably because of the above reason).

Edit: In case these look different:

https://www.dropbox.com/s/34mhrhpu90c7wst/aram3.raw

https://www.dropbox.com/s/tx2fcjridi9pkoz/ram3.raw

Edited August 10, 2013 by Walhart

[shadowofchaos]

Well... I'm an idiot. I copy pasted the wrong address from that.

Try this code:

0066B844 00000000

I copied and pasted:

00697784 00000000

Instead of the regular NTSC address.

Try it again >_>;

Edited August 12, 2013 by shadowofchaos

[darkkfan]

Well... I'm an idiot. I copy pasted the wrong address from that.

Try this code:

0066B844 00000000

I copied and pasted:

Instead of the regular NTSC address.

Try it again >_>;

Well, using 0066B844 00000000 as the code still doesn't work, but if I change 0066B844 to 00000000 manually in the debugger and hit save, the units become player controlled and that's good enough for me! Doing it manually doesn't take much longer (if at all) and running in the debugger is no problem.

So yeah, we can consider this one more or less solved!

Thanks a lot for your help (and sorry again that I kept bugging you about it). I can begin my next project now!

Just out of curiosity, how did you find out that 0066B844 was the enemy unit address in the first place? I don't recall reading it in the FE10 hacking topic, and it's a pretty impressive accomplishment since I'd imagine it was pretty hard to find!

Edited August 12, 2013 by Walmart

[shadowofchaos]

Just out of curiosity, how did you find out that 0066B844 was the enemy unit address in the first place? I don't recall reading it in the FE10 hacking topic, and it's a pretty impressive accomplishment since I'd imagine it was pretty hard to find!

It's a hell of a lot easier than you'd think.

Player control codes is an address for each individual unit that says "player", "enemy", "other", "partner".

Player Controlled: 8066B830

Enemy Controlled: 8066B83C

NPC Controlled (Green): 8066B848

Ally Controlled (Yellow): 8066B854

Invisible: 8066B86C

...see anything familiar?

0066B844 00000000

They were pretty close.

So basically, mess around with the value that it's pointing to.

It only took like... 3 freezes. Though Goldie found it WAY before me.

I used to be big into hacking until Waifu Emblem came into the picture.

And then I shifted into being a translator.

Stuff like this for FE10:

Battle Animation Modding:

At Address:

803C9BE0 [Very beginning of battle data]

Each value is an action of "Attacker" and "Defender" model for each battle, with the 32 bit value at 803C9BE0 being "active" determining the flow of the battle. As in what command is being currently executed. Most pokes to it will just result in the battle ending.

A wrong COMMAND however, will probably result in freezing in the battle as the character misses during an attack and is just there indefinitely waiting for a command.

Example Format of one "attack":

2M000000 (Determines who moves? M = Attacker: 5 Defender:6 )

7?00000? (Don't Mess with) (74000001 = Moves "Attacker" to Opponent?)(Usually 73000001)

0?0000?? (Example: 0F000062)

75000002 (Usually before a Hit command or HP Absorb/Counter/Aurora command)

SS000000 SS = Skill Values

[0900HHHH] (If health absorbing, Value = 0xHHHH)

1400VVVV (VVVV = 0xFFFF - [Damage displayed during hit]) Note: It's a "09000000" during a Miss.

XX000000 (Hit, Miss, Critical) No Damage: 6D Hit: 6E Critical: 6F Miss: 70

2A000000 (???) [End attack?]

24000000 (???) [To simply just end the battle, have this as a 00000000]

...

etc. etc.

Skill Values:

0A = Nihil (Beginning of Battle) [skill value before anything]

15 & 1C = (Defender) Nihil (Beginning of Battle) [skill value before anything]

3D = Parity (Beginning of Battle) [skill value before anything]

3E = ???

3F = (Defender) Vantage (Beginning of Battle) [skill value before anything]

40 = Gamble (Beginning of Battle) [skill value before anything]

41 = Flourish

42 = Astra

43 = Sol

44 = Aether

45 = Adept

46 = Resolve

47 = (Defender) Resolve

48 = Deadeye

49 = Wrath

4A = Impale

4B = Luna

4C = Eclipse

4D = Flare

4E = Corona

4F = Bane

50 = Lethality

51 = Colossus

52 = Roar

53 = Rend

54 = Savage

55 = Tear

56 = Ire

57 = Howl

58 = Quickclaw

5A = Maelstrom

5B = Corrosion

5C = Disarm

5D = Cancel

5E = Pavise

5F = Miracle

60 = Mercy

6A = Mantle

69 = Aurora (Same format as Sol)

(Example "No Damage" critical with Mantle and no flinch)

6A000000 [Mantle Skill]

6D000000 [No Damage]

75000002 (Required)

14000000 (Required)

6F000000 [Critical]

(Sol, Counter, and Aurora Example)

69000000 [Aurora]

75000002 (Required)

0900DDDD [DDDD = 0xFFFF - (Damage - 1)] (For Sol, it's health gained)

6E000000 (Hit)

2A000000

24000000 (Required wait stuff)

End of Battle Stuff:

0B000000 = Attacker Falls

16000000 = Defender Falls

EXP after Battle Commands:

2D00BBBB [0xBBBB = EXP Before]

2E00AAAA [0xAAAA =EXP Add]

310000SS [0xSS = Level Up To]

UU00GGGG

0xUU: Stat value

32 = HP

33 = Str

34 = Mag

35 = Skl

36 = Spd

37 = Lck

38 = Def

GGGG = Stats to grow

2A000000 00000000 or 2B000000 00000000 = End Battle Animation Data

to pull off crap like this:

Edited August 12, 2013 by shadowofchaos

[darkkfan]

It's a hell of a lot easier than you'd think.

Player control codes is an address for each individual unit that says "player", "enemy", "other", "partner".

Player Controlled: 8066B830

Enemy Controlled: 8066B83C

NPC Controlled (Green): 8066B848

Ally Controlled (Yellow): 8066B854

Invisible: 8066B86C

...see anything familiar?

They were pretty close.

So basically, mess around with the value that it's pointing to.

It only took like... 3 freezes. Though Goldie found it WAY before me.

I used to be big into hacking until Waifu Emblem came into the picture.

And then I shifted into being a translator.

Stuff like this for FE10:

Battle Animation Modding:

At Address:

803C9BE0 [Very beginning of battle data]

Each value is an action of "Attacker" and "Defender" model for each battle, with the 32 bit value at 803C9BE0 being "active" determining the flow of the battle. As in what command is being currently executed. Most pokes to it will just result in the battle ending.

A wrong COMMAND however, will probably result in freezing in the battle as the character misses during an attack and is just there indefinitely waiting for a command.

Example Format of one "attack":

2M000000 (Determines who moves? M = Attacker: 5 Defender:6 )

7?00000? (Don't Mess with) (74000001 = Moves "Attacker" to Opponent?)(Usually 73000001)

0?0000?? (Example: 0F000062)

75000002 (Usually before a Hit command or HP Absorb/Counter/Aurora command)

SS000000 SS = Skill Values

[0900HHHH] (If health absorbing, Value = 0xHHHH)

1400VVVV (VVVV = 0xFFFF - [Damage displayed during hit]) Note: It's a "09000000" during a Miss.

XX000000 (Hit, Miss, Critical) No Damage: 6D Hit: 6E Critical: 6F Miss: 70

2A000000 (???) [End attack?]

24000000 (???) [To simply just end the battle, have this as a 00000000]

...

etc. etc.

Skill Values:

0A = Nihil (Beginning of Battle) [skill value before anything]

15 & 1C = (Defender) Nihil (Beginning of Battle) [skill value before anything]

3D = Parity (Beginning of Battle) [skill value before anything]

3E = ???

3F = (Defender) Vantage (Beginning of Battle) [skill value before anything]

40 = Gamble (Beginning of Battle) [skill value before anything]

41 = Flourish

42 = Astra

43 = Sol

44 = Aether

45 = Adept

46 = Resolve

47 = (Defender) Resolve

48 = Deadeye

49 = Wrath

4A = Impale

4B = Luna

4C = Eclipse

4D = Flare

4E = Corona

4F = Bane

50 = Lethality

51 = Colossus

52 = Roar

53 = Rend

54 = Savage

55 = Tear

56 = Ire

57 = Howl

58 = Quickclaw

5A = Maelstrom

5B = Corrosion

5C = Disarm

5D = Cancel

5E = Pavise

5F = Miracle

60 = Mercy

6A = Mantle

69 = Aurora (Same format as Sol)

(Example "No Damage" critical with Mantle and no flinch)

6A000000 [Mantle Skill]

6D000000 [No Damage]

75000002 (Required)

14000000 (Required)

6F000000 [Critical]

(Sol, Counter, and Aurora Example)

69000000 [Aurora]

75000002 (Required)

0900DDDD [DDDD = 0xFFFF - (Damage - 1)] (For Sol, it's health gained)

6E000000 (Hit)

2A000000

24000000 (Required wait stuff)

End of Battle Stuff:

0B000000 = Attacker Falls

16000000 = Defender Falls

EXP after Battle Commands:

2D00BBBB [0xBBBB = EXP Before]

2E00AAAA [0xAAAA =EXP Add]

310000SS [0xSS = Level Up To]

UU00GGGG

0xUU: Stat value

32 = HP

33 = Str

34 = Mag

35 = Skl

36 = Spd

37 = Lck

38 = Def

GGGG = Stats to grow

2A000000 00000000 or 2B000000 00000000 = End Battle Animation Data

to pull off crap like this:

Oh, I get it. Since each enemy unit points to that enemy address, changing the enemy address to the same value of the player address means all the enemies point to the player value, effectively changing the units to player controlled.

That's really cool that you can change the battle animations and specific in-battle moves, I had no idea that was possible so thanks for showing it to me.

Did you specialize mostly in RAM codes and the such when you did FE10 hacking or did you do some ROM hacking too?

[shadowofchaos]

Mostly RAM hacking.

ROM hacking documentation for FE10 was mostly Vincent's doing.

[darkkfan]

Mostly RAM hacking.

ROM hacking documentation for FE10 was mostly Vincent's doing.

Hmmm... Ok then I have a last quick question for you (you've been more than enough help already so don't feel obligated to answer it if you don't want to):

I'm trying to do a 0% growths boss run and due to FE10's rule that you must always get one stat up, I have to assign either 100% str or mag growth depending on whether the unit uses str or mag as an attacking stat. Well, since boss growths can be hard to identify, it is inevitable that I will mess up and give 100% str to a physical unit or 100% mag to a magic unit.

This leads me to my question: Assuming I do mess up and a player controlled boss gains a stat he isn't supposed to, is there a way to reset this without redoing the hex editing? That is, is there an easy way to change stat additions to bosses in the RAM?

Actually, now that I think about it (I know I said only one more question, sorry), I'm also going to have to change the current turn in order to preserve turncounts. Do you know where the current turn is stored in the RAM?

[shadowofchaos]

This leads me to my question: Assuming I do mess up and a player controlled boss gains a stat he isn't supposed to, is there a way to reset this without redoing the hex editing? That is, is there an easy way to change stat additions to bosses in the RAM?

This would involve finding the boss in the ram where you are currently... so you're on your own on that >_>;

HOWEVER, if you do find it, it's the section of the character slot right after their affinity. Where stats are kept track of. The stats they gained in addition to their base stats. Simply reset those to zero.

Like here:

http://serenesforest.net/forums/index.php?showtopic=18280&p=1045017

The first image.

Basically, if you find out his UNIQUE character alliance address, that means you can mess with his stats.

If changing any instances of 8066B83C to 8066B830 makes him blue, you've found the boss.

Just add +24 (Hex) to that address... then you can mess with their Affinity...max HP... Str...mag...skill... etc.

The distance between each characters slot is 3F0 (Hex).

Actually, now that I think about it (I know I said only one more question, sorry), I'm also going to have to change the current turn in order to preserve turncounts. Do you know where the current turn is stored in the RAM?

Remember the chapter warping code?

Chapter Warping [shadowX39]

043CAAC8 XX000001

They're together

XX is the chapter. The 01 is turn 1.

So just modify that.

Or use this code:

003CAACB 000000TT

Where TT = Turn count.

Edited August 12, 2013 by shadowofchaos

[darkkfan]

This would involve finding the boss in the ram where you are currently... so you're on your own on that >_>;

HOWEVER, if you do find it, it's the section of the character slot right after their affinity. Where stats are kept track of. The stats they gained in addition to their base stats. Simply reset those to zero.

Like here:

http://serenesforest.net/forums/index.php?showtopic=18280&p=1045017

The first image.

Basically, if you find out his UNIQUE character alliance address, that means you can mess with his stats.

If changing any instances of 8066B83C to 8066B830 makes him blue, you've found him.

Thanks for the info. I'm getting the hang of finding the bosses in the hex, but I have no idea how to do so in the ROM so I guess I'll have to modify the growths again if someone gets a bad stat (I can work back from portrait pointers to find the growths if I have to). The thing is, even if I did find the address in the RAM, the boss in question would already be blue since I am recruiting the bosses, so I couldn't go by that really (of course, I could always do the reverse and turn him red).

That post you linked to is pretty interesting and it seems to me like it could potentially be used to remove character's built in immunities (something I thought I needed to know for FE9 Ashnard at one point but it turned out I could circumvent that by killing him with a red dragon), so I'll keep that handy in case I ever need it.

Remember the chapter warping code?

Chapter Warping [shadowX39]

043CAAC8 XX000001

They're together

XX is the chapter. The 01 is turn 1.

So just modify that.

Or use this code:

003CAACB 000000TT

Where TT = Turn count.

Thanks, I'll make note of those two addresses and their respective syntax for when I need to change the turn. The chapter one is useful too.

Last question I promise, is there a current phase address that I could change to make it always player phase, or will I have to use the chapter warp/turn one to stop it from changing the phase off of player phase?

Edited August 12, 2013 by Walmart