GameHacking.org Weekly Hacking Target (06-12-11) - The Legend of Zelda [NES]

[rimsky82]

Is it common for the write addresses to be outside the bound of the game genie? I believe this is the first game I've seen to have it's write to ram address outside the bounds. Maybe it's just a small rom.

This is also my first time seeing it, but I guess that doesn't mean it's not common. Maybe they did it because of an inconsistency with the mapper or something, I dunno.

Invincible
APVLZLEY

Invincible (RAM)
7AF2 10

EDIT: I didn't notice that nolberto82 already hacked an invin code (7B3A 60). I don't know which is better or worse, or if they have the same effect.

[nuomega457]

The best I have found so far:

Bombs explode without delay
OZKYUPSP

I was trying to find another infinite bombs cheat (one that works [with the ROM I have, anyway]), and I've surely found the correct addresses, but the GG conversion will not work for some reason. Here they are:

0658=?? - infinite bombs (same as Phil The Hammer found)

7106=AD (freeze bomb count decrease)
-or-
7107=00 (set bomb decrease factor to zero)

Of course, what I was really looking for was a "bombs destroy all blocks" type of code, but my few weeks experience with this subject is not enough, I guess

Nice job BeyondTheStatic. Your GG code "Bombs explode without delay" works with the ROM I have. And it is just one code as where my version (in this thread) uses three par codes. I have been working on other bomb codes but haven't made much progress.

[BeyondTheStatic]

Genie alters ROM instructions, in the address range $8000-$FFFF.
...
To find the address in ROM, put a write breakpoint on one of those addresses and restart the game. You'll notice it breaks right away. Go up a line, and you'll see the ROM address it's pulling from. That's the correct address for the genie code.

Ah, for some reason I wasn't getting it, thanks! That should help with other codes I've been struggling with (maybe SMB3 should be voted for soon; I've found some interesting addresses Data Crystal doesn't mention). I'll make sure to go over the GG guides again.

Infinite Bombs
KZNZVOVK
[B]NOTE: You must restart the game for it to take effect.[/B]

Another one, not sure about its usefulness:

Bombs Instantly Destroy All Hidden Caves in Rocks
ALEAVNAI
[B]NOTE: There will be minor graphical artifacts present in some places.[/B]

And this one is derived from Rick N. Bruns' "Rock Man" code:

Touch Any Wall to Produce Ghosts in Overworld
SZUXLZXX

[BeyondTheStatic]

Nice job BeyondTheStatic. Your GG code "Bombs explode without delay" works with the ROM I have. And it is just one code as where my version (in this thread) uses three par codes. I have been working on other bomb codes but haven't made much progress.

Thanks! Yeah, bomb codes are difficult. I was able to zero right in when I was making the SMB2 "bombs break all blocks" codes, but this game is tougher. I think the hidden entrances in rocks are treated as a type of enemy or something...

[BeyondTheStatic]

Hi,

An idea occurred to me earlier when I saw some sketchy movements in the sword beam. What if you could manipulate it somehow? I investigated the matter and came up with these addresses:

0098: Link's facing direction
00A6: sword beam state
	=00: explosion state?
	=02: SB image facing left (explosion doesn't stop)
	=E8: SB image facing up (finishes)
	=??: and so on

And then found this:

Sword Beam Changes Direction with Link's Movements
SZNNTLSL
SXOYGLSL
NOTE: You can now alter your sword beam's trajectory mid-flight.

Hope it's fun

[OldSchoolGamer]

Bombs explode without delay
OZKYUPSP

I use that code along with this Infinite Bombs code (SZNZVOVK) as a powerful weapon against enemies. Exploding bombs on enemies is the most powerful weapon you can use on an enemy I believe. And you also don't have to worry about shooting those knights in the back or side because when you use a bomb on them, it automatically hits/effects them.
So I do like your "bombs explode without delay" code

[BeyondTheStatic]

Thank you OldSchoolGamer. I was hoping it would come in handy, even more so if one of us can find a cheat that allows any wall to be destroyed (might be a red herring, but that Rock Man code makes me think it's still possible).

[nuomega457]

I am wondering if there is any code(s) that messes around with what treasures enemies drop when you kill them. Maybe where they always drop something, nothing, only blue rupies, arrows, etc... Maybe even where whatever board you are on, a fairly always appear? Maybe more than one fairy? Just an idea that I have been looking into today.

[nuomega457]

I am wondering if there is any code(s) that messes around with what treasures enemies drop when you kill them. Maybe where they always drop something, nothing, only blue rupies, arrows, etc... Maybe even where whatever board you are on, a fairly always appear? Maybe more than one fairy? Just an idea that I have been looking into today.

I think I discovered something. While looking for a fairy always appear on any board you are on, I found this.

Hex range 0350:?? to 0359:??

Using all of them changes and adds more enemies on the board. It is a bit glitchy, i.e you go in a cave and there is nothing (can't get the wooden sword), you can kill the enemies using the codes below, but they keep coming back, besides other game glitches.

I found that using:
10 - Red sand creature
11 - Zora
20 - a Rock
21 - Ghost
28 - Red Armor Guy
30 - Blue Armor Guy
40 - A fire

Now, when I use 35, a pattern of coins appears and you can keep collecting them and they reappear.

Isn't this weird?

[nuomega457]

Thank you OldSchoolGamer. I was hoping it would come in handy, even more so if one of us can find a cheat that allows any wall to be destroyed (might be a red herring, but that Rock Man code makes me think it's still possible).

Thanks BeyondTheStatic for finding that bombs explode instantly code. I revisited the ones I found for this particular code and I found that I only needed 0038:00 to get the same effect and didn't need the other two I found. So I guess there is more than one way of doing it?

[BeyondTheStatic]

Thanks BeyondTheStatic for finding that bombs explode instantly code. I revisited the ones I found for this particular code and I found that I only needed 0038:00 to get the same effect and didn't need the other two I found. So I guess there is more than one way of doing it?

YW, nuomega. I'm guessing there's one address for the bomb counter and another for the bomb state, though I did use $0038 for mine.

Here's another code:

Sword Beam Doesn't Stop After Hitting Enemies
ESSYGLSL

Mixed with the remote-control sword beam (and also the wand, evidently), it's pretty cool, as the beam will continue to do damage:

Remote Control Sword And Wand Beams
SZNNTLSL
SXOYGLSL
ESSYGLSL
NOTE: You can alter the sword or wand beam's trajectory mid-flight using the D-pad. The beam will continue to exist until hitting the edge of the screen.

Unfortunately, I found that it also changes the image for the minotaurs sword (and presumably the wizzrobe's beam) As a fix, I thought I'd try my very first hijack (not counting the SMB3 hacking tut):

Sword Beam Image Changes With Link's Movements
EKAYPL
NNAYZU
SXGYEY
EOGYON
SEGYXY
VXGYUY
AXGYKY
YXGYSY
ANGYVY
AVGYNY

It works wonderfully, except now the "Sword Beam Doesn't Stop After Hitting Enemies" cheat is sometimes ineffective. I have no idea why, apart from the possibility that I didn't tie up the loose ends correctly...

Maybe I'll try out remote control boomerangs and arrows next

[BeyondTheStatic]

I just couldn't let it go. Some feedback would be great if any of you could test these:

edit: I've converted these to 8-character codes for better compatibility

Perfect Remote Control Sword and Wand Beams:
ESSYGLSL
KUSYIUKZ
EKEYPLYZ
NNEYZLAN
SXKYENNY
EOKYONNN
SEKYXNNY
VXKYUNNY
AXKYKNNY
YXKYSNNY
ANKYVNNY
AVKYNNNY
[B]NOTE: You can alter the sword or wand beam's trajectory mid-flight using the D-pad. The beam will continue to exist until hitting the edge of the screen.[/B]

What would be nice is to have 8 digit versions for all of these. But since the 1st two are JSR redirects and the others are hanging out in freespace, I just don't know what to use for compare values

[nuomega457]

WOW BeyondThe Static! How do you find these codes? I use FCEUX and look at the ram searcher for any changes that look relevant and try and work from there using the various filters (number of changes, not equal to, etc...). For example, the enemy movement speed I found I noticed in those addresses to value is either 0 or some other number. 0 I noticed is when the enemy is standing still and the other number was when the enemy was moving. So I just I told FCEUX to write a specific hex value/number for those addresses and it made the enemy move faster or slower. I look at the debugger and set break points for something I think I am looking for, but when it breaks I see stuff in the debugger which I don't quite understand. So what I do is take existing codes for an effect and work backwards to see how it works together. Many of the codes I found are state changes I think? Still new to all of this, LOL! I did look at the beginners guide to NES Hacking tutorials at http://gamehacking.org/?s=faqs#section12 to get a feel for how it works. What I am curious about is how do you see something in the debugger and work through it to find a code? Basically when you see something of importance, how do you go step by step in ending up with a code? Also, some effects require 2 or more codes so how do they all tie in together for a desired effect?

[BeyondTheStatic]

WOW BeyondThe Static! How do you find these codes?

Thanks! I'm fairly new to all this myself I find these codes pretty much the same way you do, by first looking for changes with the cheat search.

For this particular one I initially found the address holding Link's facing direction, and then the state of the sword beam. That was enough to get going. To do this I used the cheat search and looked at the hex editor to make sure I had the correct addresses.

Then I opened up the trace logger and made a full dump of Link throwing his sword beam. These dumps are pretty big, and I tend to view them with Firefox which has a nice word search. I try to get in and out as quickly as possible so as to not create too big a file (under 20MBs is optimal).

Then, with that trace log I searched for $0098 or $98, which is Link's facing direction. If my findings were implicated with $00A6 or $A6 (sword beam state), I would try all compatible operations (using a 6502 reference) until I hit upon something that worked. I lucked out, as the trajectory of the sword beam was (for some strange reason) always tied together with Link's current orientation. Before I knew it, I had the base code for remote-control sword beams.

But that was not enough, as the sword beam image was always facing the same direction. I searched for any code controlling the sword beam state, and hit upon the section to alter the sprite's image, which was also tied to $0098.

Next, I wanted the sword beam to keep passing through enemies, so I used the code/data logger in conjunction with the trace logger, and ran the game until no more new code was being executed, then threw the sword beam into something that would cease to make it be, and found the code controlling how the beam was being destroyed by looking at both dumps.

The next part was a leap of faith, because when I found out how the minotaurs' swords reacted to my own movements, I had to set it right somehow. This is where the SMB3 hacking tutorial by DarkHackerBoy comes in, as it taught me how to hijack code and begin writing my own subroutines. I altered the best available JSR address, which was the sword trajectory code. I made it jump to a place in freespace, which is where I wrote my new subroutine. This was a complete rewrite of the sword beam sprite orientation code. I made sure to make it jump back to where the original code was heading in the first place, and to also finish_it_with_an_RTS_operation. That one stumped me, because I figured when you set a JSR, it ended there. It doesn't; you must always finish it off with a return from subroutine operation.

So that's basically it. There's more to say, but this ended up being kind of long. I think I conveyed all of the essentials

[OldSchoolGamer]

Remote Control Sword And Wand Beams
SZNNTLSL
SXOYGLSL
ESSYGLSL

I don't see the difference between the above set of codes and the below set of codes. They seem to do the same thing except the below set of codes is obviously alot more lines of codes to enter in. What is the difference between these two sets? The above set seems to work fine. By the way, this code is cool as hell.

Perfect Remote Control Sword and Wand Beams:
SZNNTLSL
KUSYIUKZ
ESSYGLSL
EKAYPL
NNAYZU
SXGYEY
EOGYON
SEGYXY
VXGYUY
AXGYKY
YXGYSY
ANGYVY
AVGYNY