Lady Abaxa (ladyabaxa) wrote,
Lady Abaxa
ladyabaxa

  • Music:

Dark Wizard Savestate Hacking

Dark Wizard savestate hacking - note that this is with a savesate generated by Kega Fusion 3.43

I uploaded the savestate I did most of the testing for these notes to Mediafire. Armer & Marie's spell lists have been altered but other changes that I made were reversed.

Update 2/3/11: I added some more stuff like hacking the hiring/summoning lists.
Update 2/21/11: a couple minor edits to items while trying to figure out what exactly Fan Letters do
Update: 2/26/12: fixed a case of swapped entries in the item list, added a few notes here and there
Update: 3/1/12: got hacking summon lists mostly sorted out by ruler
Update: 4/20/13: added stats for the other rulers, clarifications here and there, added monster/special unit summoning requirements, stats, and flags
Update: 4/21/2013: checked griffin riders and tempering, results added, had to move unit stats
Update 2/07/2014: deleted the leader stats and calender sections to move them to dedicated posts
Update 5/27/2014: update to status effects and where text gets loaded for various things
Update 5/29/2014: update to the spell list, some work understanding how the game loads and generates summoned monsters, figured out max mobility, located enemy ruler summons tables
Update 6/07/2014: moved most of the summoning/hiring stuff except the enemy ruler tables to a separate post, moved all the status stuff to stay together on here, added portrait headers and text loaded into RAM during game setup that might be part of debugger
Update 8/12/2014: formatted enemy ruler summons tables to something more readable

0x34b8: names of all allied units are stored here, used in Party menus

0x582e: unit name string storage during character creation

0x595d: origin and race strings stored here when needed followed by status and move/terrain labels

0x6a32: status labels are stored here for the Party screen
        NORML, NORML, NORML, GUARD, SERCH, KICK, KICK, CONFS, GOAT, PARLY, FROZN
        STONE, DEAD, TRAIN, UNPLC, GUARD, SERCH, KICK

0x69ad8: leader command stats, 7 bytes

0x1e793: some text used in the Strength screen is loaded to this region
         (it's a fairly big block of RAM)

0x1e7fc: thar be stage tilemapping here

0xedf3: money! expressed in 4 bytes up to max of 4967295 gold
    --this value is used when in the intermission screen & is only temporary

0x349a: money 'master' value used elsewhere, this will overwrite the previous variable, 4 bytes
        display in town can go up to 777215 gold, but just displays as A on standard HUD
        the game really isn't programmed to handle such huge numbers and gets glitchy if
        you try to use all the memory actually read

0xee06: health of unit 1 expressed as 2 2-byte sets for current and maximum
     (if current is set higher then maximum it will be truncated to
      maximum on the status screen but otherwise works)
--30 bytes per character 'block'
health of unit 2: 0xee24

0xf2b2: list of items currently held in the intermission inventory
        add $01 to the value of any item in the inventory list below to know what's here because $00 = empty
        (this entire region of RAM is written to in battle which is why the game is programmed to not let the player leave the intermission if it isn't 0)



0x31932: list of all player units (looks like a temporary storage place)

0x32a94: number of player units in the roster? (changing produced no visible results)

0x32a72: maximum and current MP used to calculate spell costs
         max is 1st 2 byte set, current is 2nd (display values elsewhere, this is just for the math)
         this is reset at the beginning of each player turn based on the ruler's calculated MP

0x32a76: income per turn, 2 bytes

0x32a78: current cash, 4 bytes

0x32a7c: Armer's Domain spell list: 3d 44 4a 4b 4e 50 56
         changing these values immediately changes available spells
         the list is generated when a new battle loads based on character class

0x32ab3: 2, 2-byte sets, enemy ruler MP?
         when Velonese has 1800 MP he seems to stay within that for spellcasting and
         summoning new minions
         if I zero it out Velonese stops casting spells entirely until I end turn a second time then this value is reloaded and Velonese can cast again
         zeroing it out also prevents Velonese from casting Call Undead on the Avisis map however it is obviously getting updated at the start of PLAYER turns and resets
         player MP is calculated based on castles/cities held and command stats, I assume the AI has something similar but these values aren't being reduced during enemy turns so these aren't being used for the math part (display but no reason to display enemy MP?)

0x32abc: list of enemy ruler's domain spells

Velonese at Demi $3d, 3e, 3f, 41, 42, 43, 44, 45, 46, 47, 4a, 4e, 4f, 56, 58

----

UNIT DATA BLOCK  (note: enemies start at 0x33772)

Note: the game appears to hold the second and third data slots for that ruler's lieutenants as empty so they can easily be slotted in if recruited
  ingame in a new starter stage savestate the game slots Robin in slot 1, skips 2 slots,
  then comes her starter soldier yet by all other indications there is no number skip

unit 1 0x32af2: alignment

00 = lawful
01 = neutral
02 = chaotic
03 = undead
repeat cycle

alignment doesn't seem all that straight-forward though

unit 1 0x32af3: race

00 = human
01 = elf
02 = dwarf
03 = hobbit
repeat cycle

unit 1 0x32af4: Unit number

      Unit 01 is $00 and counts upward
      if you give a unit a number already taken by a party member the unit that was edited will take on their name, all gear will be unequipped, and the Party menu will become confused and loads the second unit instead of the first
      a Ruler edited this way otherwise still functions as they normally would
      the character's stats can still be viewed by using the Strength menu instead
      --assigning them the number of a unit that doesn't exist wipes their name and causes the Party menu to think they're a zombie hobbit

0x32af5 character class [or occupation] reported on Strength menu and party status
      as accessed in battle, entering and exiting the Party menu causes the game to reload all sprites and will update the changed character
      sets class level as well and changes the character portrait
      a ruler whose class level is altered from the normal 5 loses the ability to use magic!
      --the magic list appears empty but the magic command still appears until the battle ends THEN all spells are permanently locked out
      changing to a different ruler's class does not change their spell list (yet) or origin
      does not change race, no matter what portrait appears
      if the character gains enough experience to class up, the graphics will be glitchy on the class-selection menu but the process works
      does not change alignment
      the class byte is what determines what palette a unit will use in the strength screen

00 = peasant, human, cl 1
01 = peasant, human, cl 1
02 = peasant, human, cl 1
03 = peasant, elf, cl 1
04 = peasant, elf, cl 1
05 = peasant, elf, cl 1
06 = peasant, dwarf, cl 1
07 = peasant, dwarf, cl 1
08 = peasant, dwarf, cl 1
09 = peasant, hobbit, cl 1
0a = peasant, hobbit, cl 1
0b = peasant, hobbit, cl 1

[lawful classes]

0c = soldier, fighter, cl 2
0d = soldier, knight, cl 3
0e = soldier, paladin, cl 4
0f = priest, priest, cl 2
10 = priest, bishop, cl 3
11 = priest, cleric, cl 4
12 = mage, mage, cl 2
13 = mage, magician, cl 3
14 = mage, sorceror, cl 4

[neutral classes]

15 = soldier, archer, cl 2
16 = soldier, sniper, cl 3
17 = soldier, ranger, cl 4
18 = priest, priest, cl 2
19 = priest, monk, cl 3
1a = priest, druid, cl 4
1b = mage, mage, cl 2
1c = mage, wizard, cl 3
1d = mage, enchanter, cl 4

[chaos classes]

1e = soldier, wildman, cl 2
1f = soldier, berserker, cl 3
20 = soldier, warlord, cl 4
21 = priest, priest, cl 2
22 = priest, bishop, cl 3
23 = priest, black bishop, cl 4
24 = mage, mage, cl 2
25 = mage, warlock, cl 3
26 = mage, necromancer, cl 4

[undead types, these DO change race]
monster types drop the origin/occupation line, inventory, and set ATT/DEF based on the character's level according to the stat growth table
viewing the character's stats through the Party menu shows their original stats so the Strength menu must be generating its numbers for monsters as it is loaded, special attack strength isn't generated with this
--the special attack ability itself is set by class

27 = skeleton, cl 1
28 = skeletal soldier, cl 2
29 = skeleton knight, cl 3
2a = skeleton warrior, cl 4
2b = ghost, cl 1
2c = wraith, cl 2
2d = lich, cl 3
2e = great lich, cl 4

[dragons]

2f = dragon pup, cl 1 (law)
30 = dragon, cl 2 (law)
31 = wyrm, cl 3 (law)
32 = fire dragon, cl 4 (law)
33 = dragon pup, cl 1 (neutral)
34 = dragon, cl 2 (neutral)
35 = wyrm, cl 3 (neutral)
36 = ice dragon, cl 4 (neutral)
37 = dragon pup, cl 1 (chaos)
38 = dragon, cl 2 (chaos)
39 = wyrm, cl 3 (chaos)
3a = wyvern, cl 4 (chaos)
3b = dragon pup, cl 1 (undead)
3c = zombie dragon, cl 2 (undead)
3d = death wyrm, cl 3 (undead)
3e = death dragon, cl 4 (undead)

[other monsters]

3f = serpent, cl 2 (law)
40 = great serpent, cl 4 (law)
41 = hydra, cl 2 (chaos)
42 = great hydra, cl 4 (chaos)
43 = unicorn, cl 1 (law)
44 = winged horse, cl 3 (law)
45 = manticore, cl 1 (neutral)
46 = giant manticore, cl 3 (neutral)
47 = hypogriff, cl 1 (neutral)
48 = griffin, cl 3 (neutral)
49 = chimera, cl 1 (chaos)
4a = gold chimera, cl 3 (chaos)
4b = centaur, cl 2 (neutral)
4c = charon, cl 3 (neutral)
4d = cockatrice, cl 2 (chaos)
4e = basilisk, cl 3 (chaos)
4f = hell hound, cl 2 (undead)
50 = cerberus, cl 3 (undead)
51 = roc, cl 1 (law)
52 = phoenix, cl 2 (law)
53 = lesser harpy, cl 1 (chaos)
54 = harpy, cl 2 (chaos)

[beast rider classes]
beast riders retain their inventory & occupation
dragon riders inherit the special attack of their dragon

55 = dragon rider, cl 4 (law)
56 = dragon rider, cl 5 (law)
57 = dragon rider, cl 4 (neutral)
58 = dragon rider, cl 5 (neutral)
59 = dragon rider, cl 4 (chaos)
5a = dragon rider, cl 5 (chaos)
5b = dragon rider, cl 4 (undead)
5c = dragon rider, cl 5 (undead)
5d = winged rider, cl 4 (law)
5e = winged rider, cl 5 (law)
5f = griffin rider, cl 4 (law)
60 = griffin rider, cl 5 (law)
61 = griffin rider, cl 4 (neutral)
62 = griffin rider, cl 5 (neutral)
63 = griffin rider, cl 4 (chaos)
64 = griffin rider, cl 5 (chaos)
65 = ninja, cl 4 (red palette) -law
66 = ninja, cl 5 (red palette)
67 = ninja, cl 4 (green palette) -neutral
68 = ninja, cl 5 (green palette)
69 = ninja, cl 4 (blue palette) -chaos
6a = ninja, cl 5 (blue palette)

NOTE: turns out you can make law and chaotic griffin riders using paladins/warlords so they don't share the dragonrider/winged horse rider limit that alignment must be same still seeing some variance in resulting unit's HP/ATT/DF that needs to be narrowed down even hired a warlord, changed zie to undead and it accepted that although in battle scenes said rider's alignment shows as chaotic and it has those stats also uses chaotic equipment but that's unsurprising since the game will conflate U and C elsewhere such as with Amon and undead!Susan
ALSO: really need to run through an alignment-changing script to figure out where/how it's generating and storing the alignment shifts

[sub-generals]

6b = soldier, Dianna, cl 3
6c = soldier, Dianna, cl 4
6d = mage, Marie, cl 3
6e = mage, Marie, cl 4
6f = soldier, David, cl 3
70 = soldier, David, cl 4
71 = priest, Kail, cl 3
72 = priest, Kail, cl 4
73 = soldier, Andrew, cl 3
74 = soldier, Andrew, cl 4
75 = mage, Susan, cl 3
76 = mage, Susan, cl 4
77 = mage, Susan, cl 4
78 = mage, Marcus, cl 3
79 = soldier, Marcus, cl 4
7a = soldier, Katrina, cl 3
7b = priest, Katrina, cl 4

[rulers]
the occupation line is swapped for origin, which doesn't seem to change from whatever the unit was originally, changes to correct value in the Party window
the ruler's portrait story-wise won't be updated but their spell list will be corrected when a new battle loads

7c = prince, Armer IX, cl 5
7d = cavalry, Robin, cl 5
7e = vampire, Amon, cl 5
7f = sorceress, Krystal, cl 5

going any higher causes the game to crash on trying to load the Strength menu
I put their individual spell lists in the unit stats file

80 = Velonese
81 = Arliman 1
82 = Arliman 2
83 = Karmak
84 = Aqua 
85 = Sheena
86 = Aracna
87 = Warlord
88 = goat
89 = petrify/frozen unit sprites
8a = same as before
this really is the end of the index

the goat is from when you get polymorphed
has battle animations except the game will crash if the goat attacks/casts on something with battle scenes enabled because the animations are incomplete

0x32af6: movement type & terrain, default of 00 is Ground

Move/Terrain
00 = Ground/Ground
01 = Ground/Desert
02 = Ground/Air
03 = Ground/Water
04 = Forest/Ground
05 = Forest/Desert
06 = Forest/Air
07 = Forest/Water
08 = Desert/Ground
09 = Desert/Desert
0a = Desert/Air
0b = Desert/Water
0c = Giant/Ground
0d = Giant/Desert
0e = Giant/Air
0f = Giant/Water
10 = Low Alt/Ground
11 = Low Alt/Desert
12 = Low Alt/Air
13 = Low Alt/Water
14 = Mid Alt/Ground
15 = Mid Alt/Desert
16 = Mid Alt/Air
17 = Mid Alt/Water
18 = Hi Alt/Ground
19 = Hi Alt/Desert
1a = Hi Alt/Air
1b = Hi Alt/Water
1c = Water/Ground
1d = Water/Desert
1e = Water/Air
1f = Water/Water
20 = Ninja/Ground
21 = Ninja/Desert
22 = Ninja/Air
23 = Ninja/Water
24 = Mership/Ground
25 = Mership/Desert
26 = Mership/Air
27 = Mership/Water
28 = Ninja/Ground
29 = Ninja/Desert
2a = Ninja/Air
2b = Ninja/Water
2c = DF Kick/Ground (movement over plains very limited, move over forest & water)
2d = DF Kick/Desert
2e = DF Kick/Air
2f = DF Kick/Water
the df kick label is listed on the disc's terrain label list, likely a placeholder that ended up not being used

The ninja set gets repeated. From checking guides the H20 Spider can apparently set its holder's movement to a Ninja type. This is something I"ll have to check later.

0x32af7: mobility value, Max: 18
               if the value is too high the game will crash when they try to move

0x32af8-fb health of unit 1 as displayed on the in-battle strength screen
      also 2 bytes in 2 sets for current and maximum, display caps at 999
      this is NOT the value used in battle scenes and the overworld battle map
      it IS used to determine whether or not a unit has died (the display will not roll under 0)

Dianna, displaying 0 health

 0x32afc-fd Base attack power, 2 bytes, this is added to the attack value of the equipped weapon to reach the value shown on the Strength screen, NOTE: ghosts always have zero attack power!

0x32afe-ff 2 bytes, special attack strength, only displayed for monsters

0x32b00-01 2 bytes, base defense strength before armor is added

0x32b02-03 2 bytes, current experience value
                     the experience needed per level is set by class

0x32b04 current level, changing this should force monsters to recalculate stats

0x32b05-0a known spells, the Ruler classes override this with their spell lists, 6 bytes, $FF = empty
             --if hacking a character's spell list in battle the list won't be updated until the map reloads, going into any town will do the trick

00 = Fire
01 = Fire Arrow
02 = Fire Ball
03 = Wildfire
04 = Fire Storm
05 = Cold
06 = Freeze
07 = Ice Arrow
08 = Blizzard
09 = Ice Storm
0a = Thunder
0b = Lightning
0c = Lightning Bolt
0d = Thunder Storm
0e = Lightning Storm
0f = Tremor
10 = Earthquake
11 = Eruption
12 = Volcano
13 = Cataclysm
14 = Summon Fire
15 = Summon Water
16 = Summon Wind
17 = Summon Earth
18 = Breath
19 = Blow
1a = Blow Off
1b = Tornado
1c = Holy Wind
1d = Disorder
1e = Confusion
1f = Fear
20 = Panic
21 = Hysteria
22 = Goat
23 = Capricorn
24 = Transform
25 = Polymorph
26 = Metamorph
27 = Treat
28 = Cure
29 = Heal
2a = Restore
2b = Regenerate
2c = Zap
2d = Solar Ray
2e = Star Sword
2f = Starstorm
30 = Meteor Strike
31 = Slow
32 = Stun
33 = Paralyze
34 = Megaparalyze
35 = Stoptime
36 = Shield
37 = Shield Wall
38 = Wall
39 = Force Shield
3a = Force Wall
3b = Rebirth
3c = Resurrect

[domain spells]

3d = Fire Bolt
3e = Hellfire
3f = Ice Blade
40 = Blizzard Breath
41 = Wind Bolt
42 = Vortex
43 = Lavaflow
44 = Melt Earth
45 = Vampire
46 = Beast Talk (Beast Voice)
47 = Blade Storm
48 = Web (does nothing? pulling wrong tiles for the animation, costs 200 MP, AI will not use)
49 = Call Undead (can only target nearby enemies, gave demons rezzed message, costs 300 MP)
                 (didn't actually resurrect any demons, awarded 7xp for casting)
4a = Mass Heal
4b = Megaheal
4c = Cure Paralysis
4d = De-Stone
4e = Refresh
4f = Megarestore
50 = Sacrifice
51 = Swap Soul
52 = Confuse
53 = Silence ("%Target's magic has been blocked.", only target straight down, costs 50 MP)
             (pulls a junk string for the status label, AI will not use)
54 = Defense Drain
55 = Shackle ("%Target's movements are slowed", can only target straight down, costs 50 MP,
              junk label)
             (common AI casters can use this but it ends up targeting themselves)
             (ally units have Move command locked out, AI units have movement reduced a bit)
56 = Protect
57 = Night Shield
58 = Resist Magic

this is the end of the magic list but the game lists one spell after Resist Magic in the main "large" list: Black Hole
all attempts to hack Black Hole into a spell list have thus far failed, the "name" is a glitchy mass of junk, the spell cannot be cast and if it is the only spell in the list the game thinks the character doesn't know any spells at all and won't load the MAGIC command, it's help window text is blank, and it doesn't appear in the text list of useable spells in the spirit duels
whatever it was intended to be it apparently didn't get beyond a concept although since the one list it appears on is right in front of several caster staff names it isn't clear if it is supposed to be a domain spell or an item effect

--monsters can be given magic and they can cast it, the AI seems to always stick with special attacks if one is available

0x32b0b: unknown function, # of special modifier items in character's inventory?
         changes when things like Fan Letters/H20 Spiders are moved around
         for example passing a Fan Letter to an adjacent character makes this decrease by 1
         it can also roll under to $FF but that seemed to have no ill effect

0x32b0c: byte that controls whether items in inventory appear to be equipped
         has no effect on ACTUALLY equipping/removing anything

this is a bit operation as mapped below:

00 = none equipped
01 = slot 1 equipped
02 = slot 2 equipped
04 = slot 3 equipped
08 = slot 4 equipped
10 = slot 5 equipped
20 = slot 6 equipped
7f = all equipped

NOTE: it is actually impossible to have more then 3 items equipped

0x32b0d unit 1: 6 bytes, inventory slots, $FF = empty

00 = Short Sword
01 = Staff
02 = Shinobi Knife
03 = Assassin Sword
04 = Long Sword
05 = Scimitar
06 = Broad Sword
07 = Great Sword
08 = Dragon Sword
09 = Sultis Sword
0a = Traegar
0b = Black Sword
0c = Silver Sword
0d = Slayer
0e = Fire Sabre
0f = Spear
10 = Pilum
11 = Javelin
12 = Glaive
13 = Lance
14 = Pike
15 = Powered Spear
16 = Partisan
17 = Trident
18 = Short Bow
19 = Long Bow
1a = Rapid Bow
1b = Light Crossbow
1c = Crossbow
1d = Great Bow
1e = Arbalest
1f = Elven Bow
20 = Wind Shot
21 = Stone Axe
22 = Hatchet
23 = Battle Axe
24 = Swift Axe
25 = War Axe
26 = Halberd
27 = Mad Axe
28 = Gold Axe
29 = Silver Axe
2a = Gold-Plated Axe
2b = Silver-Plated Axe
2c = Scepter
2d = Mace
2e = War Mace
2f = Maul
30 = Flail
31 = Morning Star
32 = Holy Mace
33 = Hobbit's Rod
34 = Crystal Mace
35 = Susan's Staff
36 = Wizard Staff
37 = Power Staff
38 = Priest's Staff
39 = Sorceror's Staff
3a = Living Power Staff
3b = Judge's Stick
3c = Cloth Armor
3d = Leather Armor
3e = Hard Leather Armor
3f = Chain Mail
40 = Ring Mail
41 = Plate Mail
42 = Splint Mail
43 = Magic Armor
44 = Plate Armor
45 = Dragon Mail
46 = Armor of Retribution
47 = Gaia Armor                      user's movetype becomes desert (maybe a bug)
48 = Hero Armor
49 = Robe
4a = Leather Robe
4b = Barbarian Robe
4c = Holy Cloth
4d = Mysterious Robe
4e = Angel Robe
4f = Holy Robe
50 = Priest's Robe
51 = Ninja Costume                  bug causes it to shut off the effect of an H20 Spider
52 = Wood Shield
53 = Leather Shield
54 = Small Shield
55 = Large Shield
56 = Soldier's Shield
57 = Kite Shield
58 = Magic Shield
59 = Mirror Shield
5a = Shadow Shield
5b = Ninja Guantlet   (works as advertised, increasing defense by 18)
5c - 63 = not valid items, displays an error message/glitched tiles due to lack of terminator tags
     can see MES93 - MES100 in windows
     equip window lists them at 092 - 099 with 0 attack power & cannot be equipped/used
     they aren't listed in Party/Strength menus and cannot be sold in the intermission
     hacking one into equipment and then sending that character out in a search party has odd
     behavior while in town the game thinks it's an Herb and treats it as such
64 = Herb
65 = Balm
66 = Salve
67 = Silver Leaf
68 = Power Potion
69 = Super Power Potion
6a = Stone-Skin Potion
6b = Steel-Skin Potion
6c = Speed Potion
6d = Haste Potion
6e = Holy Dust
6f = Amulet
70 = Magic Stone
71 = Evil Claw
72 = Holy Water
73 = Goddess' Teardrops
74 = Mirror of Darkness
75 = Eye of Darkness
76 = Scapegoat
77 = Medusa's Head
78 = Gorgon's Tail
79 = Holy Drink
7a = Crow's Cloak
7b = Cursed Ring
7c = Athena's Orb
7d = Blood Candle
7e = Merman-Ship
7f = Funeral Bell
80 = Marathon's Shoes
81 = Demon Chime             "Demon Chime: Chaos; Casts Capricorn" 12.5k sell value
                             "The enemy turned into a goat" but didn't let me target anyone
                             must have chaotic mage to use, doesn't do anything or end turn, 10xp
82 = Healing Ring
83 = Dream Clock
84 = Talisman
85 = Sharktan Talisman
86 = Dragon Ring
87 = Flying Robe
88 = Flying Saddle
89 = Goblet of Solma
8a = Blue Crystal
8b = Elf-In-A-Bottle
8c = Elf Tears
8d = Light Jewel
8e = Mermaid's Harp
8f = Fog Chime
90 = Fire Staff
91 = Water Necklace                0 gold value, cannot be sold
92 = Water Mirror
93 = Granny's Letter
94 = Wind Drops
95 = Tea
96 = Earthen Bowl
97 = Leather Water Skin
98 = Sun Stone
99 = Moon Stone
9a = Small Package
9b = Old Scroll
9c = Statue of Vulcan
9d = Light Staff
9e = Letter of Introduction
9f = Exorcism Crystal
a0 = Bracelet
a1 = Medicine
a2 = Sinorg's Medicine
a3 = Small Shoe [Kid's Shoes]             10 gold value
a4 = Isam's Medicine
a5 = Rosebud Fruit
a6 = Poison Frog
a7 = Diarmuid's Potion
a8 = Restore Potion
a9 = Spring Moss                         "Moss from the spring: B", 10 gold value
aa = Memory Potion                       10 gold value
ab = Wood Bowl [Wood Pot]                10 gold value
ac = Magic Water                         10 gold value
ad = Magic Bracelet
ae = Champion's Staff                    10 gold value
af = Jewelry [Shining Jewelry]
b0 = Katrina's Ring                      name string has programming error
b1 = Magic Ring                          "Contain's Katrina's magic powers"
b2 = Bella Donna (sic)                   10 gold value
b3 = Lave Donna                          10 gold value
b4 = Dozen's Medicine                    10 gold value
b5 = True Mirror [Truth Mirror]
b6 = Pine Oil
b7 = Elf Shoes
b8 = Elf Mirror
b9 = Elf Ring
ba = Sharktan Whip
bb = Talisman of Repulsion
bc = Talisman of Attraction
bd = Water Spider                        adding/deleting this item directly from inventory produces no change
                                         must be a subroutine writing to an unknown bit of memory
be = Fan-Shaped Letter                   checked around in guides and this increases holder's mobility by 1
                                         does not stack with other movement modifiers
bf = Gun Powder
c0 = Ghost Scythe
c1 = Hero Shield
c2 = Rusty Weapon
c3 = Seal of Demons
--end of items

the Elf Ring says it increases range, might mean it increases an elf's casting/ranged attack range
something to test later

weapon special properties don't appear to be written anywhere to this block of memory
maybe it just looks it up in the weapon table whenever you attack someone?

I conjured up a Fire Staff in an end-game savestate, gave it to an Enchanter who didn't know Summon Fire and went to see if Afreet was home (having successfully completed the duel with him using a different character earlier in the game). The Fire Staff could be used but it just popped up a 'nothing is here' message.

Also noteworthy is that the only item with a higher value then the Rusty Weapon is the Seal of Demons.

The Rusty Weapon can be tempered by the smith (the only item that can be tempered) except for the Seal of Demons which can be tempered due to a programming error. Perhaps it is an operand error where the game is told to reject any value less then c2 at the blacksmith?
CHECK: Hack in an item with a value greater then c3 to see if the blacksmith will take it
RESULT: some values work, others do not but that is to be expected
  some values will temper but require a HUGE amount of cash and then the result vanishes
  c9 is fun, that tempers to Traeger and costs nothing, BEST BLACKSMITH EVER

0x32b13: 3 bytes
         equipped items, the hex value will match what is equipped
         if these values do NOT exactly match what's in the equipment bytes that causes those items to be unequipped on returning to the intermission
         note that attack/defense/etc. are re-calculated for every unit when returning to the intermission
         they must be in order and slots that are not equipped are marked by $FF

0x32b16 "unit has acted" flag if $81, will take effect if the sprites are reloaded by
                entering and exiting the Party menu
                $A2 if the unit selected 'Rest'
                the high byte is a status flag?
                returning to the intermission sets this to $80 for the leaders of each side, respectively
                enemy units are set to $81 (they're still in memory for awhile)
                player characters are set to $8E
                some ally units set next byte to $0f or $40
                when enemy units die this is set to $CC 0f, slapping this on a player unit
                makes it so the AI can't target them, counterattack them, and doesn't check for their presence during movement
                $04 = out in search party
move command locked out

Cast a successful Shackle on a Death Dragon (index starting at 0x33a40)
        set 0x33a66 to $c6 and 0x33a67 to $02
        --copied these values to Marie's status bytes and forced a data reload
        Marie became paralyzed and her Strength screen showed status as DF KIC2
        on the next turn she could act again but couldn't move! (move command didn't appear)

Cast a successful Silence on an Enchanter (index starting at 0x33810)
        set 0x33836 to $c5 and 0x33837 to $02, could still cast spells
        beginning of next player turn the values are $c5 and $01
        --copied these values to Marie's status bytes and forced a data reload
        Marie became paralyzed and her Strength screen showed status as DF KIC2
        she "recovered" next turn and her spellcasting wasn't affected

       cast again on an enemy unit then took a savestate just as the enemy turn started
       value is $E5 01

UPDATE: tried copying these values to Armer's status bytes: $c5 04
        in the Strength screen his status showed up as DF KIC4 but status on the battle
        map didn't change and he could cast spells
        ended turn, next turn Armer's Strength screen showed his status as DF KIC3
        and he could still cast spells
        then I went into the Party screen, looked at his stats, came back and suddenly
        the game has locked out his 'Move' option and changed his status to a junk string

        reloaded the savestate and went straight into the Party menu, came out and Armer's
        turn had been ended, on the next turn again couldn't move
        Regenerate can't remove this status
   
        $bf 04 = guard
        $c0 - c2 04 = shackled
        $c3 04 = guard
        $c4 04 = search
        $c5 04 = shackled
        $c6 04 = shackled
        $c7 04 = confused
        $c8 04 = goat status
        $c9 04 = paralysis
        $ca 04 = frozen
        $cb 04 = stone
        $cc 04 = dead, Armer was removed from the battlefield when leaving the Party screen
                 went to game over screen as soon as I hit end turn
        $cd 04 = training, shows up as rest on the battlefield map but removes sprite
                 character is still there, can be attacked, but can't be selected or act
        $ce 04 = unplaced, removes sprite, still there, Velonese became confused with these
                 two and stopped casting spells until Armer 'recovered' and appeared again
                 (the AI very obviously determines priority by unit number so not surprising)
        $cf 04 = guard, see above
        $d0 04 = shows as normal in party/strength but again locks out movement

0x32b18 unit 1: coordinates on the map, 2 bytes, vertical & horizontal, respectively
                starts at $0, $0 in the top left and increments 1 per cell on the hexmap

0x32b1a unknown function, usually $00, enemies usually have this all set to the same value
        depending on the map (maybe so the game can keep track of what bank to reference back to?)

0x32b33 unit 1 attack bonus from equipped weapon, if $00 nothing is equipped

0x32b35 unit 1 defense bonus from equipped armor, if $00 nothing is equipped
        this is both armor & shield

0x32b36: resting at an inn in town changed this value to $01
         the camp option in an inn changed this value to $02

0x32b37: these 2 bytes mark the end of used data? always $FF or $FF FF

There is often data written after this but the function of it is unknown.

0x32b41 End of unit 1's stat block (?), total size: 80 bytes


0x32b42 Start of unit 2's stat block

had bishop cast Force Wall on himself (index starting at 0x32e60)
       byte at 0x32e86 changed to $81 (appears to be 'unit has moved' flag)
       [byte at 0x32e87 was already set at $40 and didn't change]
       byte at 0x32e8b changed to $82
       at the beginning of the next turn it dropped to $81 then vanished on 2nd turn
       when the wall effect fades this returns to $00 but next byte is still $02
       --this is definitely working as the timer, when it hits $80 the effect fades
       byte at 0x32e8c changed to $02
       --nothing resets this back to $00?

hacked in the Shield spell for Marie (index starting at 0x32b40)
       cast shield, 0x32b6a = $03, 0x32b6b = $82
       beginning of next turn it was $03 $81
       beginning of the 3rd turn 0x32b6b ticked down to $80 and was reset to $00
couldn't get Hysteria to work on anyone, I guess it uses a value currently 0 to determine success

---

0x33770 beginning of enemy stat blocks, same format, space in memory appears to be limited to a maximum of 80 units, enemy units already have the unit # set even if the entry is blank, the numbering system keeps counting up from player units

---

at 0x358f0 the player character stats are repeated in the same format as before?
   --changes did not show up with my in-battle savestate, will have to save this for later
   --Marie's spell list duplicated here was written to when she went into town

at 0xa57f0 duplicated again! battle HUD, temporary values

---

TEMP: 0xedff: # of characters in the roster
--adding to this adds nameless characters with the following stats

(U) Peasant
Race: Hobbit
CL/LV: 1/0
HP/Max: 0/0
Att Str: 80
Def Str: 0
Mobility: 1
Move Type: Ground
Terrain: Ground
Salary: 10G
Magic: 6x Fire
Inventory: 6x Short Sword
--they are listed as Guard under Status, can be named and show up as humans on the naming screen
--choosing to advance wipes them from the roster


0x34a4-34a5: current mana, 2 bytes
0x34aa-34ab: maximum mana, 2 bytes

display can go all the way up to the max 2 bytes can hold: 65535
this will stay between turns in battle but is recalcuated when you leave a battle map

0x34a8: # of castles you control
0x34a9: # of towns you control
--value will be updated when you end your turn

0x34ac-34ad: current income level, is recalculated each turn

------

ENEMY RULER SUMMONS TABLES

SUMMONS TABLES

RULER | START ADDRESS | SUMMON ENTRIES
-----------------------------------------------------------------------------------------------
VELONESE | 0x4076c    | 00 | 92 | 3e | 3e | 3e | 2a | 2e | 42 | 50 | 3d | 4c | 48 | 4a | 2d |
           (uncertain)  46 | 54 | 29 | 54 | 29 | 29 | 29 | 29 | 29 | 29
-----------------------------------------------------------------------------------------------
ARLIMAN | 0x40785     | 00 | 3e | 3e | 3a | 2a | 2e | 42 | 50 | 4a | 54 | 50 | 4a | 54 | 50 |
                        4a | 54 | 54
-----------------------------------------------------------------------------------------------
KARMAK | 0x40797      | 00 | 3e | 3e | 2e | 2a | 50 | 3d | 4e | 2d | 29 | 2d | 3c | 2c | 4f |
                        4d | 4f | 4d | 4f | 4d | 4f | 4d
-----------------------------------------------------------------------------------------------
AQUA  | 0x407ad       | 00 | 4e | 35 | 4a | 41 | 41 | 54 | 4d | 34 | 41 | 4d | 41 | 49 | 41 | 
                        34 | 49 | 41 | 33 | 53 | 33 | 53 | 33 | 53 | 33
-----------------------------------------------------------------------------------------------
SHEENA | 0x407c6      | 3a | 3a | 3a | 2a | 39 | 46 | 48 | 29 | 54 | 38 | 49 | 45 | 37 | 47 |
                        53 | 37 | 47 | 53 | 37 | 47 | 53
-----------------------------------------------------------------------------------------------
ARACNA | 0x407dc      | 2e | 3d | 4c | 2d | 46 | 2c | 3c | 4b | 28 | 45 | 27 | 2b | 4c | 2b |
                        45 | 3b | 45 | 2b
-----------------------------------------------------------------------------------------------
WARLORD | 0x407ef     | 00 | 2e | 2e | 3a | 3a | 3a | 3a | 4a | 47 | 29 | 2d | 38 | 28 | 49 |
                        45 | 53 | 27 | 53 | 27 | 53 | 27
-----------------------------------------------------------------------------------------------
WARLORD | 0x40805     | 00 | 38 | 28 | 38 | 28 | 38 | 45 | 28 | 49 | 27 | 45 | 53 | 49 | 27 |
(Quentin only)          37 | 49 | 27 | 45 | 53 | 27 | 53 | 27


RULER     | START ADDRESS
----------------------------------------------------------------------
VELONESE  | 0x4076c          | ARLIMAN   | 0x40785

3e | death dragon            | 3e | death dragon
3e | death dragon            | 3e | death dragon
3e | death dragon            | 3a | wyvern
2a | skeleton warrior        | 2a | skeleton warrior
2e | great lich              | 2e | great lich
42 | great hydra             | 42 | great hydra
50 | cerberus                | 50 | cerberus
3d | death wyrm              | 4a | gold chimera
4c | charon                  | 54 | harpy
48 | griffin                 | 50 | cerberus
4a | gold chimera            | 4a | gold chimera
2d | lich                    | 54 | harpy
46 | giant manticore         | 50 | cerberus
54 | harpy                   | 4a | gold chimera
29 | skeleton knight         | 54 | harpy
54 | harpy                   | 54 | harpy
29 | skeleton knight         | 
29 | skeleton knight         | 
29 | skeleton knight         | 
29 | skeleton knight         | 
29 | skeleton knight         | 
29 | skeleton knight         | 

----------------------------------------------------------------------
KARMAK    | 0x40797          | AQUA      | 0x407ad

3e | death dragon            | 4e | basilisk
3e | death dragon            | 35 | wyrm (N)
2e | great lich              | 4a | gold chimera
2a | skeleton warrior        | 41 | hydra
50 | cerberus                | 41 | hydra
3d | death wyrm              | 54 | harpy
4e | basilisk                | 4d | cockatrice
2d | lich                    | 34 | dragon (N)
29 | skeleton knight         | 41 | hydra
2d | lich                    | 4d | cockatrice
3c | zombie dragon           | 41 | hydra
2c | wraith                  | 49 | chimera
4f | hell hound              | 41 | hydra
4d | cockatrice              | 34 | dragon (N)
4f | hell hound              | 49 | chimera
4d | cockatrice              | 41 | hydra
4f | hell hound              | 33 | dragon pup (N)
4d | cockatrice              | 53 | lesser harpy
4f | hell hound              | 33 | dragon pup (N)
4d | cockatrice              | 53 | lesser harpy
                             | 33 | dragon pup (N)
                             | 53 | lesser harpy
                             | 33 | dragon pup (N)

----------------------------------------------------------------------
SHEENA    | 0x407c6          | ARACNA    | 0x407dc

3a | wyvern                  | 2e | great lich
3a | wyvern                  | 3d | death wyrm
3a | wyvern                  | 4c | charon
2a | skeleton warrior        | 2d | lich
39 | wyrm (C)                | 46 | giant manticore
46 | giant manticore         | 2c | wraith
48 | griffin                 | 3c | zombie dragon
29 | skeleton knight         | 4b | centaur
54 | harpy                   | 28 | skeletal soldier
38 | dragon (C)              | 45 | manticore
49 | chimera                 | 27 | skeleton
45 | manticore               | 2b | ghost
37 | dragon pup (C)          | 4c | charon
47 | hypogriff               | 2b | ghost
53 | lesser harpy            | 45 | manticore
37 | dragon pup (C)          | 3b | dragon pup (U)
47 | hypogriff               | 45 | manticore
53 | lesser harpy            | 2b | ghost
37 | dragon pup (C)          | 
47 | hypogriff               | 
53 | lesser harpy            | 

----------------------------------------------------------------------
WARLORD   | 0x407ef          | WARLORD   | 0x40805     (Quentin only)

2e | great lich              | 38 | dragon (C)
2e | greath lich             | 28 | skeletal soldier
3a | wyvern (C)              | 38 | dragon (C)
3a | wyvern (C)              | 28 | skeletal soldier
3a | wyvern (C)              | 38 | dragon (C)
3a | wyvern (C)              | 45 | manticore
4a | gold chimera            | 28 | skeletal soldier
47 | hypogriff               | 49 | chimera
29 | skeleton knight         | 27 | skeleton
2d | lich                    | 45 | manticore
38 | dragon (C)              | 53 | lesser harpy
28 | skeletal soldier        | 49 | chimera
49 | chimera                 | 27 | skeleton
45 | manticore               | 37 | dragon pup (C)
53 | lesser harpy            | 49 | chimera
27 | skeleton                | 27 | skeleton
53 | lesser harpy            | 45 | manticore
27 | skeleton                | 53 | lesser harpy
53 | lesser harpy            | 27 | skeleton
27 | skeleton                | 53 | lesser harpy
                             | 27 | skeleton

----------------------------------------------------------------------


CALL UNDEAD observations

at Avisis just end turn and grab a savestate just as Velonese starts to cast the spell
loades full name list to 0x97624
loads class help descriptions to overwrite the ZMSCMDM22DAT sector that was loaded at the beginning of the stage with the opening dialogue at 0x9d8f0

General notes: order was adhered to exactly as listed, there is nothing random in what the game chooses to summon, it just goes down a small section of the list although it starts at/near the bottom, going up (and increasing the number of "slots"
activated) as the player deploys units and those units class up

the exact mechanic controlling this is not yet known

the music played during enemy phases never changed

out of sheer curiosity I made a hard save, reset and reloaded it and the game had saved the class change for Aqua

------

0x2b0f0: MDLTBL__DAT list of disc file names

0x2c0f2: M_COMED1STM instructions then list of disc file names

0x8cc7e: this region of RAM is used for several things, quite a lot of data is written here when each phase starts

0x8dbd7: some odd little table loaded here when in town

0x97eab - 0x0x97f17: status label strings get stored here

0x97624: in a beginning savestate with Krystal all class names are loaded here all the way through the generals, rulers, enemies, and goat
         name strings used in hire/summon menus but not used for the names of the units generated by those commands


0x9cb99: 5 bytes long, Armer's starter set: $2f, 3f, 43, 4b, 51
0x9cb9f: 8 bytes, Armer's upgraded set: $2f, 30, 3f, 43, 44, 4b, 51, 52
         mana cost is generated based on the classes of the monsters

Monster summoning lists, 2 per ruler, the byte ahead of each address tells the game
     how many entries per listing in the table it should read, values count up from $00

Armer could summon seemingly without restriction based on alignment but couldn't summon anything class level 3+ or the upgraded versions of monsters with only 1 class up in a savestate prior to taking Cheshire and even with 65535 mana
in a savestate post Cheshire Armer could summon class level 3 monsters

list reset upon leaving a battle map and entering a new one


0x9cba9: Robin's starter set: $33, 3f, 47, 4b, 51
0x9cbaf: Robin's upgraded list?

0x9cbb9: looks like Amon's set, 7 bytes
0x9cbc1: looks like Amon's upgraded set, 12 bytes

0x9cbcf: looks like Krystal's starter set, 5 bytes
0x9cbd5: looks like Krystal's upgraded set, 8 bytes

-------------

0x98213 - 0x98213: main window labels, terrain labels, time of day, month

0x985fb - 0x99865: main player commands

0x99975 - 0x99d7d: hire/summon commands

0x99ded - 0x9a791: main window messages, battle results
   
0x9bd60 - 0x9c4d0: TOURLA battle, main window spell names stored here

0x9b9c0 - 0x9c078: item name strings stored here when in town
         $ff = end of entry

0x9c0c8 - 0x9cbb4: fortune teller hints stored here when in town
                   $ff = page break, $fe = end of entry, $00 = space between words

0x9cd41 - 0x9eea1: list of all item descriptions stored here when in town
          used in shops in town and the item description window for the character
         $fe = end of entry, $ff = line break, $f8 = start of new entry

0x9d40d - 0xa0167: item and spell descriptions for the main game
          use table 4 for this because the $08s used for interleaving throw off other tables

0xa0180 - 0xa254e: long class descriptions, actually ever displayed?


0xa2936: list of all player unit names stored here when a stage begins
         $fe = empty space to not display, each 8 bytes long

         grabbed a savestate of Krystal at the very beginning of the game (normal)
         listed Krystal (followed by 17 spaces) then fighter, priest, mage, 4 spaces
         l harpy, drag pup, hydra, chimera, coktrice, jmb king, jmb king
  
         Amon has fighter, priest, mage, l harpy, drag pup, hydra, manticor, hell hnd,
         ghost, skeleton

         Armer has fighter, priest, mage, roc, drag pup, serpent, centaur, unicorn,
         jmb king, jmb king

         Robin has fighter, priest, mage, roc, drag pup, serpent, hippogri, centaur,
         jmb king, jmb king

        the jmb king entries for the others are likely placeholders but these are the
         names of all player units to be generated depending on the difficulty
         Amon is the only ruler to generate a starting army of 11 units total, including
         Amon himself, on Easy making it 7 monsters for him to start with
         they ARE in the master list on the disc itself

0xb2f70 - 0xb38ad: item list used in the intermission shop
         item names are stored here followed by all place names
         (short names for items)
         castle names come first, followed by town names
         obvious gap between Loa and Nautia


0xb7a2e: names of all classes stored here when needed

0xc4b67: text loaded when searching the "woodland" scene tile in God's Castle
         0xc4b67 - 0xc9b93
         also loaded a YOU DIDN'T FIND ANYTHING message to 0xe26f5

0xcaa9b - 0xcadeb: a duplicate list of race/class names ending w/ninja

0xcb77b - 0xcd147:
         spell names (name storage appears to be 1 byte per letter, but letters
                      are each spaced with $00 gaps)
         followed by another item list w/obvious 8 item gap in the middle
         then followed by a unit name list (starts with 12 PEASANTs)
         that includes all allied leaders at the end

0xd58da: names of all sub-generals listed here (each twice) when in town
         loads ALL the lieutenant names, not just those for the chosen ruler

0xd59b0: lists Unicorn, Griffin, Ninja in that order
-----------

0xe26f2: stores the explanation for the item sub-menu in town

0xe26f5: stores the string 'Where would you like to go?' when a town loads
         also stores the current item description when you look at your inventory
         in a town - 0xe274f

0xe27f5: stores the Y E S and N O options for leaving town

---------

0x10c93b - 0x10caaa: table listing map region names, 16 bytes each
           loaded during initial ruler selection and game setup
           QUENTIN, INSENIOR, TOURLA, BARTH, CARBIE, JHELYLE, SILKA, CHESHIRE, ALGAIN,
           GRACILDO, ASAI, LOMSAIRE, SAGE, EURESKA, BALKANDI, FLAYRONA, NBALTRK,
           BALTRIK, SBALTRK, NAUTIA, DEMIA, DORG, AVISIS


0x10d5db - 0x10d6b9: menu text that gets loaded when the game is in ruler/difficulty select and waiting for the player to confirm so it can start
           MODE, MAKE, EDIT, CHAR, NO, UNIT, NO, LEVEL, MAGIC, ITEM, RACE, ALMENT, YES
           NO, UNIT, MAX, HUMAN, ELF, DWARF, HOBBIT, LAWFUL, NEUTRAL, CHAOS
           that's as best as I can make the words out
           debugger for generating characters on demand?
           there's no point in the game where the word alignment is ever spelled out as ALMENT it's always (L/N/C/U) in menus (obviously not all those slashes, just the one letter for that character)

---------

GAME OVER

0x9f135 - 0x9fc7d: table I still can't make heads or tails of

0xb21b1 - 0xb2809: game over messages

0xd74bf: stores the strings 'new game' and 'continue' (table 3)

0xe26f3: stores the text string to be displayed when the player gets a game over


COMBAT

0xdd8f2: MSCMDM00DAT followed by a large table of unknown use


RETREAT

0xc246d - 0xcbb01: a big block of event/retreat text is loaded here

PORTRAIT HEADERS

at the beginning of the large, main window text scrolls there is a single byte that
determines what portrait will be displayed, if the game can't find the specific
portrait it is probably because the file loaded for that stage doesn't know where
to find it, the game might hang or eventually give up on dialogue and progress
to the stage itself

00 = armer ix
01 = robin
02 = amon as a vampire?
03 = krystal
04 = amon as armer viii
05 = aqua?
0a = warlord commander
0b = allied soldier
0c = arliman, coded as this in God's Castle

4d = line break
Tags: dark wizard
Subscribe

Recent Posts from This Journal

  • Post a new comment

    Error

    Anonymous comments are disabled in this journal

    default userpic

    Your reply will be screened

  • 2 comments