Rings of Power - Infinite HP & MP

[Whipon]

Hacking this game is a real pain in the...

My last try causes some little, but annoying, glitches when you start a new game and in some random places. I tough we finally beat it, but this game seems to be a real bitch when you try to hack it. I don't know if I writed the routine in the wrong way, but I suspect that reading I used to insert my code (It reads the spell list from your party and your enemies) is used in several places of the game and because that I found some glitches. I tried with other reads, when the game reads your HP or your MP, but I had no luck. Pressing the button does nothing.
Now I'll try hijacking the routine wich maxes out your hp & mp when you use the "Nectar" good. If that doesn't work I had experimented with the menues, I'll try to make the Goods submenu avalaible in the battle.
If you know of an alternate routine to implement the method, please let me know.
Thanks again for your help .
Whipon.

[Whipon]

An alternative solution

I managed an alternative solution:

The inventory is not avalaible normaly in the fight screen. So I enabled it to heal my party with the "Nectar". It completely heals your party and maxes out the mp of it.

Press right several times in the fight menu to access the inventory menu,

013CBA: 4267 4267 4267 => 4EF9 000F D0CC
(this instruction repeats continuously)

0FD0CC:
4203 Clear D3
3638 0008 Write 08 to D3
B679 00FF 0018 Compare FF0018 to D3
6608 If not equal branch to FD0E2
13F8 0010 00FF A7F8 write 10 to FFA7F8. If FF0018 is equal to D3, then this instruction will be executed
4203 Clear D3
4267 4267 4267 The replaced Instruction at 013CBA
4EF9 0001 3CC0 Jump back to 013CC0

I had to use the JMP method instead of the JSR one, because the game freezes if you use it.
The only problem I found: it seems to write to FFA7F8 (the address for the menues) randomly sometimes. I couldn't figure why.
C U ñ________ñ.
Whipon.

[Pugsy]

Looking at the above code...I'd say that you need to check that if you are dealing with byte values you only peek/poke byte values (.b not .w). I'm not sure why you are using D3 at all either.

I'd be wary about overwriting any stack instructions (a7) like clr.w -(a7) as well though...so you may need to change the code a bit later on and you may find that the JSR will work.

I'd probably try something like this (may crash and burn though....):-

013CC2: => 000F D0CC

0C39 0008 00FF 0018 cmpi.b #$8, $FF018.l (or maybe cmpi.b #$8, $0018.w 0C38 0008 0018 will work?)
6608 If not equal branch past next instruction
13FC 0010 00FF A7F8 move.b #$10, $FFA7F8.l
4EB9 0001 1C4A The replaced Instruction at 013CC2
4E75 Jump back to 013CC6

[Pugsy]

Obviously changing 013CC2 and RTSing back only works if the subroutine at 11C4A doesn't bugger about with the stack.....

[Whipon]

Thank you very much!!! .

I was a little confused with the compare opcodes. I was writing to D3 the value I needed to compare with FF0018.
So #$ means its just a number and a $ alone means its an address, right?.
Your routine worked very well, and it solved all my problems hacking this game and ended the long nights triying to beat his code .
However I had to alter a little your method. Using 013CC2 causes a little bug with the dialog boxes in the game. So I changed it this way:

Invincible Buc and Acess to the Main Menu in Battle,
00127A: 52B9 00FF 0010 => 4EB9 000F D0CC

0C39 0008 00FF 0018 Compare FF0018 with 08
6608 If not equal branch past next instruction
13FC 0000 00FF A7F8 Write 00 to FFA7F8
23FC 008C 2328 00FF 0304 Poke HP & MP of Buc (the only character with static ram addresses for his stats)
52B9 00FF 0010 The replaced instruction at 00127A
4E75 rts

Now I have only a little question: how do you find FF0018 (the generic location for the joypad) in other games?.

Thanks a lot, Pugsy. I owe you a lot!!!.

Whipon.

[Pugsy]

Yes # means the value not the address.

Finding the joypad location is an absolute doddle when you know what you are looking for.

The location will contain 00 when nothing is being pressed, as soon as you press a direction or a button it will change but then it will change back very quickly - generally in the same frame (so 1/50th or 1/60th of a second) so you will have to be bloody quick or just cheat.....


In HazeMD cheat menu

1. Start a new search, Lives=0 (when you are pressing NOTHING)
2. Hold down a direction and whilst still holding it down press P to pause HazeMD
3. Now, "Continue the search" and select "Slow but Sure"
4. Select "NOT EQUAL" and press enter
5. Unpause the game (press P again)
6. Whilst pressing no keys (you don't need to pause) select "Continue the search" with "Slow but Sure"
7. Select "EQUAL" and press enter
8. Repeat steps 2-7 till you have whittled down the locations
9. If you have more than one location you can press W on the results to place a watch on them to see them change...you are looking for locations that change bitwise when you press a SINGLE direction or SINGLE button - so 01 02 04 08 10 20 40 80 would be valid values.

[Whipon]

Much appreciatted!!!

Thanks a lot, Pugsy. Its very interesting. The joker method is very usefull to enable or disable non static hacks like the menues in ROP.
I will put it in practice right now.
Thank you very much .
Whipon.