Appendix B: Notes 2D1F00 is Terra's portrait. 2D2220 is Locke's portrait. Some commands are merely spells. Health is Cure 2. It can be reflected, and if it is, the spell turns green again! 020E91: Begin truncation at... (default: 10000) 020E96: Truncated damage value (default: 9999) 03A72C:AE = Eternal battle in overworld (fight as soon as possible, screws up event triggers) 03A727:AE + above = press Y for airship (don't use too long, screws up controls, graphics, and event triggers) C3A52C:AE and C3A527:AE = CPU addresses of above 0208B9 = Zombie ailment's HP STZ commands 0211B0 = Item's load status commands 021728:AA = Sketch's special effect 021796:A4 = Steal's special effect 02191B:82 = Shock's attack stats pointer 02191F:2E = Health's attack stats pointer 0219EF:A0 = Possess' special effect 021B20:A2 = GP Rain's special effect 021B3E:08 = Morph's status part 4 021B8C:A6 = Control's special effect 021BA2:A8 = Leap's special effect 022D54:AC = Debilitator's special effect 022D58:AE = Air Anchor's special effect 0239B8 = GP Rain's special effect (beginning w/ loading GP) 023FCD = Special effect pointers 02400B = Dischord's special effect pointer 023B78 = Dischord's special effect beginning 023B7C:5E = Dischord's special effect's LSR instruction (1Eh = ASL absolute indexed, X) 023EC9 = Pep Up doubles caster's MP when used 02524D = Poison ailment's elemental 025930 = opcode that loads Magic aim 026669 = Big chunk of empty space! >:) Disassembly for Chain Saw, Debilitator, and Air Anchor: C2/2B33: 29 03 AND #$03 C2/2B35: D0 16 BNE $2B4D ;the test for instant death. I know, incomplete, yes it is. C2/2B37: A9 08 LDA #$08 ;if instant death Chain Saw, I believe this is first! C2/2B39: 85 B6 STA $B6 ;sets the graphic. C2/2B3B: 9C A6 11 STZ $11A6 ;set Chain Saw's power to 0. C2/2B3E: A9 80 LDA #$80 C2/2B40: 0C AA 11 TSB $11AA ;load up death status. C2/2B43: A9 10 LDA #$10 C2/2B45: 8D A4 11 STA $11A4 ;load up Stamina factor. C2/2B48: A9 02 LDA #$02 C2/2B4A: 0C A2 11 TSB $11A2 ;set bit 1 in 3rd byte (instant death protection). C2/2B4D: A9 20 LDA #$20 ;branch straight to this if !instant death. C2/2B4F: 0C A2 11 TSB $11A2 ;set bit 5 in 3rd byte (ignore defense). C2/2B52: 60 RTS ;return from subroutine (I'd sure like to know where it goes). C2/2B53: A9 AC LDA #$AC ;Debilitator. C2/2B55: 80 02 BRA $2B59 ;branch past this next instruction. C2/2B57: A9 AE LDA #$AE ;Air Anchor. C2/2B59: 8D A9 11 STA $11A9 ;used for both. See the branch above? C2/2B5C: 60 RTS ;return from subroutine. Miscellaneous crap after Air Anchor's RTS... C2/2B5D: A9 40 LDA #$40 C2/2B5F: 0C A2 11 TSB $11A2 ;set No Split Damage bit in 3rd byte C2/2B62: 60 RTS ;tell me what the hell this is all for, and get a cookie. :) c2/03a1 C1/7C75 C2/275F <- last place for STA $BB search. Throw stuff: C2/2A44: A9 21 LDA #$21 C2/2A46: 8D A2 11 STA $11A2 ;sets that nasty ignore defense and physical damage! Grr.. :) C2/2A49: A9 22 LDA #$22 C2/2A4B: 8D A3 11 STA $11A3 ;bleh. Byte 4 crap. C2/2A4E: A9 20 LDA #$20 C2/2A50: 8D A4 11 STA $11A4 ;unblockable. C2/2A53: 90 09 BCC $2A5E C2/2A55: BD 2C 3B LDA $3B2C,X C2/2A58: 8D AE 11 STA $11AE C2/2A5B: 20 21 2C JSR $2C21 Item (incomplete): C2/2720: C2 10 REP #$10 C2/2722: AA TAX C2/2723: BF 0E 50 D8 LDA $D8500E,X C2/2727: 85 BB STA $BB C2/2729: BF 15 50 D8 LDA $D85015,X C2/272D: 89 C2 BIT #$C2 C2/272F: D0 04 BNE $2735 C2/2731: A9 08 LDA #$08 C2/2733: 14 BA TRB $BA C2/2735: BF 12 50 D8 LDA $D85012,X C2/2739: E2 10 SEP #$10 C2/273B: 60 RTS Joker Doom stuff: C2/36A6: A9 02 LDA #$02 C2/36A8: 0C 46 3A TSB $3A46 C2/36AB: 1C A2 11 TRB $11A2 C2/36AE: A9 20 LDA #$20 C2/36B0: 0C A4 11 TSB $11A4 C2/36B3: A9 00 LDA #$00 C2/36B5: 8D 29 3A STA $3A29 C2/36B8: A9 55 LDA #$55 C2/36BA: 60 RTS Partial trace dump on casting Dischord: $C2/3883: AE A9 11 LDX $11A9 [$7E:11A9] A:3201 X:0000 Y:000E D:0000 DB:7E S:15E5 P:envMXdIzc HC:1190 VC:163 $C2/3886: FC CD 3D JSR ($3DCD,X) [$C2:3978] A:3201 X:003E Y:000E D:0000 DB:7E S:15E5 P:envMXdIzc HC:1222 VC:163 $C2/3E0B: 78 39 PTR $3978 [$C2:3978] $C2/3978: BB TYX A:3201 X:003E Y:000E D:0000 DB:7E S:15E3 P:envMXdIzc HC:1304 VC:163 $C2/3979: FE 18 3B INC $3B18,X [$7E:3B26] A:3201 X:000E Y:000E D:0000 DB:7E S:15E3 P:envMXdIzc HC:1322 VC:163 $C2/397C: 5E 18 3B LSR $3B18,X [$7E:3B26] A:3201 X:000E Y:000E D:0000 DB:7E S:15E3 P:envMXdIzc HC:006 VC:164 $C2/397F: 60 RTS A:3201 X:000E Y:000E D:0000 DB:7E S:15E3 P:envMXdIzc HC:052 VC:164 RAM crap: 7E3EC8 = ForceField's nulled elementals 7E331C-D = Character 1 Status 1-2 immunity, goes down for players then monsters (XOR'ed) 7E3330-1 = Character 1 Status 3-4 immunity, goes down for players then monsters (XOR'ed) Terii Senshi's finds: C2/2B63 - Magic Damage Calculation C2/2B9D - Physical Damage Calculation C2/6198 - Level Up Bonuses - Y register determines which stat is raised, X register determines if it's raised by 1 or 2. Battle theme stuff: 50910-????? = ? If you don't know already, I have been trying to hack the Summon command and make it usable. These are my finds and results so far: 1. I can make the game say "Failed!!" upon missing with anything. However, if I hit, ZSNES crashes. This was an accidental find when messing with the Flag Register, which always screws up everything if I do ANYTHING with it. In this case, it showed me something interesting. If you want to see it, use this: C2/297D: E2 20 SEP #$20 Set 22B7E to 00 and you can see it. Be sure you use something that will miss or you'll crash the emu. I have no idea how to undummy this completely, though. 2. If I set the Randomize Target bit in an Esper, it can get around the problem Summon creates and still aim properly. However, for Ragnarok this means you can't control who you hit, so it's not a real fix. Bahamut and the like won't act any different from normal though. 3. Summon is coded like Shock, Health, and Possess. In fact, it has the same pointer value. More on this in a minute, but this means my search for a fix shall extend into Shock and the like. 4. I can now crash your game whenever you hit any button besides up or down in battle, and even prevent you from confirming any attacks (I found some code pointers for player actions!). How kewl is that? :P 5. The root of the problem lies in 7E:7A84. It's never written to by Summon, and that's where the aim is controlled. Before any command is picked, the game writes FFh to 7E:7A84 and 7E:7A85. If you use the PAR code 7E7A8461, you can completely control the Esper aim with Summon, perhaps any command (dunno about Crusader, Merton and the like). This would be an easy fix, but I have no idea if aiming is even written to the RAM before it checks for and uses the aiming byte. After it tests it, it writes to 00:00BB and moves all of the stats for the action to 7E:11A0 through a MVN opcode. However, these appear to be fine if you look at them when Summon is used. 6. To add on to #3: I have found the player command pointers! Location=17EE9 Size=2 bytes These pointers dictate where in the code a command goes. You could turn Summon into Magitek, Throw into Slot, etc. Have fun. >:) Fight - 17EE9 Item - 17EEB Magic - 17EED Morph - 17EEF Revert - 17EF1 Steal - 17EF3 Capture - 17EF5 SwdTech - 17EF7 Throw - 17EF9 Tools - 17EFB Blitz - 17EFD Runic - 17EFF Lore - 17F01 Sketch - 17F03 Control - 17F05 Slot - 17F07 Rage - 17F09 Leap - 17F0B Mimic - 17F0D Dance - 17F0F Row - 17F11 Def - 17F13 Jump - 17F15 X-Magic - 17F17 GP Rain - 17F19 Summon - 17F1B Health - 17F1D Shock - 17F1F Possess - 17F21 MagiTek - 17F23 [Blank] - 17F25 Remember to look up the pointer value for the command you want before just throwing it anywhere, because these point to the code itself. Throwing a command in some random hellhole would result in a nasty glitch or something.