Editing ROM Instructions/ Creating Game Genie Codes?

I'd like to locate and edit certain RAM values for FF I, II, and III, but am not sure how to go about doing so. This question might be a bit complex so I apologize in advance!

Firstly, I'm not sure I understand exactly how Game Genie overwrites the values. Correct me if I'm wrong, but doesn't Game Genie only edit values in then RAM (as opposed to SRAM)? In other words, the Game Genie edits the loaded RAM values then once you save the game those values are updated in the SRAM?

Secondly, if I'm looking to modify specific values (e.g. for character stats) how can I locate them? I'm familiar with hexadecimal already, but I don't know how to find addresses that haven't already been documented. After I've found the address, then I can convert the hex into a custom Game Genie code, right?

Thirdly, from what I've read some people have said that you cannot change values from a loaded save file, but instead only from a new game.


I think the reason this was mentioned was because the example code they gave looks for the default value that's assigned to the address and thus wouldn't work once the value has been changed (by leveling up for example). However, if I generate a new Game Genie code to look for the updated value at the same address then that would still work, right?

Thank you in advance for your help!! ^^

I'm pretty sure that Game Genie codes modify ROM, not RAM.

I believe you are correct. But you might be able to intercept RAM values if the game cartridge maps RAM into $8000-$FFFF (although most cartridges don't do that).

So if that's the case, then I would have to input any stat-altering codes before starting a new game?

The game genie always inserts a 1 into bit 15 of the address ($8000). Not only can it only modify ROM, but it can't modify things in the 6000-7fff range, which can be mapped to ROM.

Which makes me wonder why Nintendo never made a "Genie-proof mapper" that maps everything into $4800-$7FFF.

This doesn't sound very promising... so what would the best course of action be?

Actually, MMC5 can map WRAM to banks above $8000. I guess, in theory you can modify RAM with a game genie.

Can you explain how please?

Are you asking how the MMC5 mapper works (very few games had...Castlevania 3 was one)? Or how game genie works?

Actually, scratch that. I'm suddenly reminded that MMC5 is buggy with the game genie, and you can't even see the game genie code entry screen.

Relevant discussion...

viewtopic.php?f=9&t=4964

He meant that MMC5 games have the ability to map RAM into the ROM area if they've been designed to do that. Modifying an existing game to do that would be a whole different thing, requiring an enormous hacking effort to completely reorganize the way the game engine works, way more work than it'd take to modify the game to implement just the cheat you wanted in the first place.

All I need to know is the best method for editing particular values. Step 1 would be finding the location of what I want to change (which I guess now would be a ROM address) and Step 2 would be at what point I need to activate my custom Game Genie code to change the located address (supposedly before starting a New Game)?

Ok.

First, have you tried any of the game specific tools over at Romhacking.net?

Such as...

https://www.romhacking.net/utilities/163/

Also, lots of info at the datacrystal database...

http://datacrystal.romhacking.net/wiki/ ... asy_Series

Click on the RAM MAP on each game.

But, to answer your question...
(I used to make game genie codes as a hobby.)

Basically, when the CPU reads a byte from a specific location in the ROM, instead of getting that byte, you can force it to see another byte.

like if the game code says...
Load the #5 and store it at the "lives left" RAM address, you can tell it to load a 6, or 7, or whatever.

So, step 1 is to figure out which RAM address you want to change, then to locate some code which modifies that RAM address. For me, I like to use a debugger, and set a breakpoint for writes to that address.

Then use a game genie encoder (FCEUX has one), and write a new value to be loaded to that address.

Other things you can do, are changing "conditional branches" to always skip some code, or always do some code.

You could change code to $ea to erase it. ea means NOP, no operation (ie, do nothing).

Lots of options.

I'm familiar with FF Hackster, but all the changes I want to make are going to be on real cartridges and only involve changing temporary things such as save file stats not actually overwriting any ROM data. The datacrystal information has what I need if I want to intercept the ROM values for FF I, however for FF II and FF III I still need to locate certain addresses which I don't know how to do.

Yes! I think this is more what I'm looking for. If you don't mind, could you link a good tutorial for using a debugger in FCEUX/ how to use breakpoints?

I discussed it in this video

https://youtu.be/d2XkJQFs0OQ

between 14 and 19 minutes. And I make a game genie code, but I don't explain how the code works, or how I know it will work. Sorry.

Just to make it clear: nothing permanently overwrites the ROM, the ROM will only appear different to the console as long as the Game Genie sits between the console and the cartridge and the codes are active.

Every time the CPU needs to read from the cartridge (which is hundreds of thousands of times per second), it tells the cartridge which address it needs to read, and the cartridge responds with the value. When the Game Genie is between the console and the cartridge, every time it received and address, it checks whether there are any cheat codes enabled for that address, and then decides whether to let the original value go through or respond with the value specified in the cheat code.

So after doing a bit of messing around in the debugger and I've found some offsets and values that I'm looking for, but that's about the extent to which I can use the debugger right now. I still don't understand how to use breakpoints, the (assembly?) code in the following column, or pretty much anything else in the debug menu. But based on what people have been saying I can edit any ROM address which writes to that RAM offset and still get my desired result? I just really need a thorough explanation of how to find the offsets for the instructions I need to edit ><

For example, in FF II Firion starts the game with 10 Strength. Thanks to this guide I know that the RAM address for this value is at 6120. So I open up the debugger, go to that address, and sure enough the value there is 0A in hex which is of course 10 in decimal. But now I'm at in-pass because I don't know which instructions right to that value. In this example if I knew where the code was which told the game to start Firion with 10 Strength then I could modify it to my desired value and translate it into a Game Genie code.

Thank you for the help so far though! I'm sure this process will become a lot easier once I learn more about it.

Put a write breakpoint on the address you say is $6120. Start your new game and watch for $0A to be written to the address. The breakpoint will stop execution whenever $6120 is written which it might be written to more than just once. You'll want to see when it has the value you want to replace being written. Then you'll need to scroll up in the disassembly window to see where it go your $0A value from. It's either in an instruction or data fetched from ROM. Once you find where the value came from you can create a Game Genie code to replace that value with whatever you choose.

I ran the Japanese rom and it reads and then writes here:

00:9C71:BD 80 8F LDA $8F80,X @ $8FA0 = #$0A
>00:9C74:9D 00 61 STA $6100,X @ $6120 = #$00

Which is part of a bigger sort of copying of data from ROM to PRG-RAM:

00:9C6F:A2 3F LDX #$3F
00:9C71:BD 80 8F LDA $8F80,X @ $8FA0 = #$0A
>00:9C74:9D 00 61 STA $6100,X @ $6120 = #$0A
00:9C77:BD 00 90 LDA $9000,X @ $9020 = #$05
00:9C7A:9D 40 61 STA $6140,X @ $6160 = #$05
00:9C7D:BD 80 90 LDA $9080,X @ $90A0 = #$0F
00:9C80:9D 80 61 STA $6180,X @ $61A0 = #$0F
00:9C83:BD 80 8F LDA $8F80,X @ $8FA0 = #$0A
00:9C86:9D C0 61 STA $61C0,X @ $61E0 = #$0A
00:9C89:BD C0 8F LDA $8FC0,X @ $8FE0 = #$00
00:9C8C:9D 00 62 STA $6200,X @ $6220 = #$00
00:9C8F:BD 40 90 LDA $9040,X @ $9060 = #$00
00:9C92:9D 40 62 STA $6240,X @ $6260 = #$00
00:9C95:BD C0 90 LDA $90C0,X @ $90E0 = #$00
00:9C98:9D 80 62 STA $6280,X @ $62A0 = #$00
00:9C9B:BD C0 8F LDA $8FC0,X @ $8FE0 = #$00
00:9C9E:9D C0 62 STA $62C0,X @ $62E0 = #$00
00:9CA1:CA DEX
00:9CA2:10 CD BPL $9C71

However modifying that $0A seems to get replaced by something that happens in the first battle. I think it comes from $6110. Which comes from $8F90 in ROM. So you need to use a Game Genie code like: AKOAENZA [ 0F90 40 0A ]

I hope this helps. In theory you should be able to alter any starting game stat in ROM.

Thank you for taking the time to write all this out!

I think I have a good grasp on how to use breakpoints now, but I don't understand any of the 6502 instructions. For example you said that the game reads and writes to >00:9C74:9D 00 61 STA $6100,X @ $6120 = #$00 but I can only give an educated guess as to what all that means. When I tested this myself I also noticed the value is written to again when the first battle starts. You said it (the value?) comes from $6110 (the instruction?) which comes from $8F90, how do you know this?

Also did you mean for the Game Genie code to write to address $0F90 or was that a typo? The list you provided definitely seems to load all Firion's starting stats and weapon levels, but I'm not sure how you knew those were all part of the same list. If I want to use a code to change each and every single stat at the start of the game will the GG even be able to deal with that many codes at once? Finally, for values that I don't know the offsets for (that have yet to be documented), how can I locate them on my own?

I apologize in advance for asking so many questions ^^,

LDA is the instruction Load Accumulator. It is the primary register on the 6502 cpu family. STA is Store Accumulator.

X and Y are Index registers which can be used to access a memory location plus the value of the index. This way you can access a string or array of values by adding the index to the start of the data. That's why it is doing LDA $8F80,X.

The big block of addresses and instructions is just copied from FCEUX. So it tells you the ROM bank, Address, instruction bytes, the disassembled instruction, and then the effective address and what value is located there.

So the reason I knew where that value came from is I assigned an execution breakpoint further up in code execution so I could see where the value that was being written came from. So When it trips the write breakpoint for $6120 during the first battle I just scrolled up to see where I should put my code execution breakpoint so I could watch what was happening. By doing so you can see that the value eventually written to $6120 came from $6110.

If you look at the big block I posted you can clearly see where it's loading values from in ROM and where it is writing them into RAM. That's how you can use Game Genie to alter the values.

The address having a 0 in the first section was due to the online Game Genie code encoder I used. I did not test the code but merely provided it for you to try. The address as you know is supposed to be 8F90, with 40 being a replacement value, and 0A being the "compare" value. The Game Genie code letters should be correct for this. Hopefully you can learn from this. Maybe try making some codes for other games to learn more. Basic assembly code knowledge will help a great deal. You don't have to know very much for basic cheats.