Finding Cheats in VisualBoyAdvance – By AH
Motivation:
I have noticed many posts on forums asking how to find cheats
Why would you want to cheat in a game, where’s the challenge?:
Well most of the time, people like to cheat because they have invested hours into a game, and they are just plain stuck. Others will have beaten a game, and now it is boring to them, so cheating can spice it up a bit. Others are just terrible at games and they need all the help they can get. If you have ever done this before a game UP UP DOWN DOWN LEFT RIGHT LEFT RIGHT B A START Then this manual is for you!
What sort of things can you do with cheats?
• • • When there is a boss you can’t beat, give yourself unlimited health, or give him 0 levels that have time limits, you can turn them off Games that limit your power/money you can now have unlimited. For example, Spiderman will no longer run out of webbing, Metroid will no longer run out of missiles and in Advance Wars you will no longer run out of cash, so build all the Neo Tanks you want!!
So how is this done?
First you need to have the VisualBoyAdvance emulator, found here http://vba.ngemu.com/
Example 1 – Metroid Fusion – Unlimited Health
I will start by showing some simple things with Metroid Fusion.
So I am at the very beginning of the game here, and my player is very weak. So how do I give myself unlimited health? In VBA, open up “Search for cheats”. As shown below, I want to look for a Specific value, and think its Data size is 8 bits, I want to look for all the values in RAM that have a value Equal to 83, and I think it is an unsigned value.
Below shows a typical message that will pop up. What this message is saying is, the number 83, appeared in RAM 1815 times.
This does not mean that we cannot cheat here, it simply means that VBA will not display 1815 memory locations. Thus we need to refine/improve our search since currently, there are 1815 possible locations that hold Metroids Energy. Well the easiest way to find this “needle in a hay stack”, is to change our energy value. So I have jumped into the enemy on purpose an my energy is now at 67. Now I will open up cheats again, but this time I will search for the value 67.
Success!! The number 67 only exists in RAM at one location. Also since “Update values” is checked, it shows me what the old value was, which was 83. This is definitely where Metroids Energy is stored. Now pressing the “Add cheat” button. Enter 99 for the health and for the description I will choose “Energy Level”.
Now like magic I have full Energy. As shown above I am now purposefully jumping on the enemy but it is not hurting me anymore. NOTE: This same approach can be applied to any numerical value in the game, i.e. number of missiles, power bombs etc.
Example 2 – Metroid Fusion – No Time Limit
In Metroid Fusion, you are given different endings based on how long it took you to beat the game. The first time I beat the game it took over 6 hours. However, had I beaten it in under 2 hours, I would be given a different (more special) ending. Now I am the sort of player that likes to explore. This of course eats up time, and I am penalized for it in this game. Therefore I would like to turn off the timer, so I can have my cake and eat it too.
Every time you save the game, it records how much time has elapsed. As you can see from the screenshot on the right, currently I have been playing for 5 minutes (00:05). So how do I go about finding the time in RAM? This can be very tricky since time can be stored in a few formats. 1. The programmers may choose to store the time as one large number that simply counts up the minutes. For instance, they may have that 538 minutes have passed. Then to convert to hours and minutes, they divide that number by 60 (since 60 minutes in an hour), to get 8.96666 hours. The .9666 means 58 minutes, so 538 minutes means 8 hours and 58 minutes. This variable will often be held in a 32 bit unsigned. 2. Another approach programmers may use is to have separate variables for the minutes and hours. For instance from the example above, there would be a variable somewhere in RAM that holds the number 8 (for hours) and a variable somewhere in RAM that holds the number 58 (minutes). When 58 increments to 60, it gets reset to 0, and the hours variable will increment to 9. These variables will often be held in two separate 8 bit unsigned. Either way my approach will be the same. If I can find where the 5 minutes is currently being stored, I can stop it from counting. If the variable is a 32 bit number, I will only be
modifying the lower 8 bits. If it is in two variables I will prevent the minute variable from counting, and thus the hour variable should never increment.
So here I am now looking for all the RAM locations that hold the number 5. This did not return 1815 locations like last time, but it is still too many to play around with, so I need to refine/improve this search.
So I will run around in the game a little until I another minute passes, and then I will save the game again. Now open the “Search for Cheats” again, but this time I will do a search for the number 6.
The result is interesting since there were fewer locations returned, but there are still about 15 locations. So how do we refine this more? Well as long as “Update values” is checked, these RAM addresses shown above will be updated with their current values each time we open “Search for cheats” dialog box. So simply run around in the game a little, and then re-open “Search for Cheats”.
Notice above the RAM values have changed. I did not do any further searching here, they all changed on their own. So what happened? Well first of all, notice that all the “6” values are in the “Old Value” column now. They were new last time we opened “Search for Cheats”, but they are old this time. Next notice that the “New Value” column has drastically changed. There are still a few “6” values that I can see, but many of the others have changed. Our “Time Limit” value is in there somewhere, but just what are the other values you may be wondering? Well consider that each enemy in the game has a current location, current health, certain attributes etc. RAM is used to hold all of this information. It could be that the current ycoordinate of many enemies happened to be 6, right when I searched for that number. However since I waited a few seconds before re-opening “Search for Cheats”, those enemies have moved and the RAM locations have reflected that change. What hasn’t changed is the number of minutes passed, which is still 6. Therefore I can further refine my search by once again searching for 6. As shown below, from our original search, to now, only 3 locations remain. Now I could continue whittling it down but here is a good chance to show you some trial and error hacking. Since I have 3 locations left, I will just try the first location and see what happens.
I will also add this cheat using the “Cheat list” approach to show you another way. Here I press “Code”, and then I enter the RAM address in hexadecimal, a quote, and then the value I would like to place there. So below I have entered 020382E5:01. If this works, the amount of minutes that have passed in the game will be set to 1 forever.
To test this out, I will save my game and then try to reload it. Yikes, as you can see below, it looks like it didn’t work.
Should you be scared at this? No, not at all. The VBA provides a very safe hacking environment for the GBA. All this means now is that the time limit must be at one of the other two remaining addresses. Looking back at RAM, we can see that the first location is 1, which is the one I changed. The second location is unchanged at 8, and the third location is now at 1. Ironically when the Metroid game “used previous data”, it set the amount of minutes that have passed to 1, which was the last time I had correctly saved the game.
Thus I don’t even have to guess at which of the final two locations is the actual time limit, it is definitely the last one. So I better disable my old attempt, by going into the “Cheat list” as shown below and unchecking my “Minutes” cheat.
So as shown above, I have unchecked my first “Minutes”, and then using the “Code” button as shown previously, I enter 03000BA2:01. Now I have gone out and grabbed the missiles upgrade (took about 5 minutes), came back and saved my game, then reloaded it as shown below. Voila, apparently only 1 minute has passed. Looks like I will be seeing that special ending after all.
Example 3 – Super Ghouls’n Ghosts– Trial and Error
I received this game last Christmas as a gift, and it had to be one of the hardest games I have ever played (second only to Mega Man Zero). This was surprising to me since when I played it and beat it many times back on the Sega Genesis (or even in the arcade), I did not find it this hard.
The first thing to do, which should be very easy for you if you looked at the first 2 examples is to give yourself more lives. The only trick here is, even though 2 lives are shown, sometimes programmers will store the value as 3. What they mean by this is, you are currently on your 3rd life, and you have 2 left (as shown in the top left corner). Therefore this is a good chance to show you a more advanced way to look for cheats.
Based on my argument above, I want to look for the value 3 or less. Therefore in the “Compare type”, I choose “Less or equal”. This of course produces many results and I again need to refine my search. Thus I need to lose some lives.
Now that I have lost a life, let’s go back into the “Search for Cheats” dialog box.
This time though, under “Search type” select “Old Value”. This is because before we found all the values that were 3 or less (i.e. 3,2,1 and 0). Now if we have lost a life, this number will be smaller by 1. Therefore the VBA will now show us all the memory locations that use to be 3 or less, that are now smaller. Looking above at the first two results, you can see that, the old value was 1, the new value was 0. The old value was 2 the new value was 0. Notice that both of these results fit our search criteria since we asked the VBA to search for values that were “Less than” the old value. It is too bad you cannot do a search in memory for values that are “Less than by 1”, because this would make finding cheats way easier. So let’s simply lose one more life and then come back in, and once again look for values that are “Less than”.
Now we can see that we have really narrowed it down. Three of those values are possible choices. If my suspicion is correct that my lives are stored as “currently on life 1” with no lives left, then address 03005ABB above is our life variable. However if this game is like most, and stores the number of lives left directly, then either address 02005F1C or 03005C3D is the life variable. We can narrow this down one more time by simply starting the game over again. This will give us back all of our lives, which means one of the above locations will change to a 2 or 3.
Ok so we are back, so lets open up “Search for Cheats”.
So I am lucky in that only one of the addresses has a 2 in it and this must be my life variable. Obviously it cannot be 0, 10 or 234. So I will now “Add a Cheat” and give myself 9 lives.
HOWEVER looking at the above screen it seems like it didn’t work? Well to test this I will lose a life again, and see what happens.
Voila! Above you can see that I now have 8 lives left. So even though the display told me I had 2 lives left, I really had 9, since when I lost one, I am left with 8. NOTE: Video Games do not always update the display with current information. They usually only update the screen when necessary. Since normally when you play this game it is impossible for you to just gain an extra life, obviously there is no need to update this value all the time. However when you lose a life and start the level again, this is a logical time to update the lives. So my original suspicion of how the lives were stored in memory was wrong. However this was a good example to show a different way to search for values in RAM.
Example 4 – Super Ghouls’n Ghosts– Trial and Error (Advanced)
So far I have really only showed you easy things to search for. That is they all had numbers and they were quite easy to find. Now what about games where you are not told how much energy you have left as a number, but instead you only have a health bar? Well these are considerably harder to find, and they often require Trial and Error, luck and a lot of patience. To show this, I will look in RAM for where my Armor is kept in Super Ghouls’n Ghosts. This is hard because, you start off wearing “Steel Armor”, and then by finding magic chests, you upgrade to “Bronze Armor” and then “Golden Armor” (see pg.12 of the instruction booklet). Once you get hit, you lose your armor and sort of run around in boxer shorts.
Now this information is not displayed in the game except that you can visually see that Author is wearing one form of the armor. So how do you go about finding this in RAM? Well to begin, you have to try and think like the programmers. If you were going to design this yourself, how would you keep track of this information? Well my approach would be, store a 0 if you are not wearing armor, store 1 if you have Steel, 2 if you have Bronze, and 3 if you have Golden. Therefore since you start with Steel armor I will search for 1 in RAM. (This however is just a guess)
So I will search RAM for the value 1, which as expected will produce too many results to display at this time. Now I will get hit on purpose to lose my steel armor and go down to boxer shorts. Thus I presume that the variable will now have the value 0. So I will search for that as shown below.
There are still too many possible locations, so I will simply kill the player and then start again, which should give me Steel armor once more.
The screenshot on the left shows the “Search for Cheats” dialog when I just open it. You can see that already many of those locations have changed. Now by searching again for 1, I can narrow down the search some more as shown in the right screenshot. Now I get hit again, and repeat the search looking for 0. Followed by starting the level again to get my Steel armor and search for 1.
I do this over and over again until the results will not narrow down any further.
Finally I am stuck at this screen, and it seems I cannot narrow down the search any more. So at this point, simply guess work is involved. Again, I don’t really know if what I am looking for has been found. I guessed originally that the armor was stored in this fashion. I may or may not be proved wrong here. So at this point, I will simply add a cheat for all of these guys, and put 1 in for all the values.
Well this has had a very strange effect. I still have no armor, but I cannot die either. Every time I get hit, it looks like my armor is exploding off of me, yet I am never wearing any.
So what have I learned? Well I am definitely on the right track. My original suspicion must have been close. I am now going to change all of the 1’s to 2’s and see what happens.
Well this had no drastic change, other than when I picked up a new weapon, it behaved as though I had the gold armor!! Thus I am really close here, but something is wrong since I can’t see the armor.
Therefore I will first try dying and see if that changes anything. No affect. How about enabling and only individual cheat addresses one at a time?
Success! In turns out that location 020214BA holds your current armor status.
Since we can have up to gold armor, let’s put a 3 there.
It made not difference, so let’s try a 4.
Perfect. Now I have the Golden Armor.
But why did this work. Why did 3 not work but 4 did? Well not to bore some people with programming and binary jargon, but this is typical. In a nutshell, the way binary numbers are represented, i.e. as 1’s and 0’s, it is sometimes easier and more convenient to test for 1’s inside of a number, known as testing whether the bit is high. Quick Example * 4 in binary is 00000100 3 in binary is 00000011 * Notice that where the 3rd bit is (the asterisk), in the number 4, there is a 1, but in the number 3 there is a 0. Thus in programming you can often test this single bit location faster than say, testing the two 1’s that are present in the binary representation of 3. This is known as masking. As well consider this 1 in binary is 00000001 2 in binary is 00000010 4 in binary is 00000100 Steel Armor Bronze Armor Golden Armor
Notice that in all of the above cases, the one is simply shifted? This is also a convenient and fast programming trick known as bit shifting. It is always faster than addition and subtraction. RECAP: When hunting in RAM for values, try 0,1,2,3 etc, but if that doesn’t work, try looking for 1,2,4,8,16,32 etc, because the programmers may be using masking and bit shifting. (This is very similar to the fact that RAM on your PC comes in 128, 256, 512 etc). Now what are the other 3 addresses for if I have already found the Armor? Well here was a surprise to me as well. Look at the following screen shots.
I went from Golden Armor to dead in only one hit. This is usually impossible. It turns out that one of the other numbers is for “Number of hits till dead”. I am not sure why the programmers needed a second variable for this, but nevertheless it exists.
So above shows my final cheat codes for this game, found in a trial and error approach. I never did figure out what the other two addresses were for, but I did find my objective which was to enable my armor. As shown below, every time I get hit and lose my armor, it comes right back!
That concludes this manual on finding cheats with the VisualBoyAdvance.