Back to Index | Back to Tutorials


Hacking Loops in RAM Tutorial

This is a slightly updated version of my old ram hacking tutorial. I'd recommend trying SnesAdvance Tools first (if a game can be hacked in the way specified here, they'll probably work).

How To Hack Loops in RAM

You need this guide if the ROM address you find crashes the SNESAdvance builder (usually looking like FXXXXXXX, which if you think about it isn't a valid ROM address now is it?)

Alright, if you're reading this I assume you know the basics.

Step 1) For this tutorial we'll use Final Fantasy 5 (Translated) - the hash should be 17444605, if it's not, your numbers won't exactly match mine (but you'll still be able to follow this). You'll need a hex editor, I recommend Hex Workshop (but any hex editor with a search feature will do).

Step 2) Now we'll be looking for a loop like usual. Right at the title screen I noticed the following loop:

Now as you know, normally we'd change that to 42FC. However, the ROM address for D0FC is given as F9FC1FAD, which is obviously incorrect. This means that the code is being run from RAM. Whee!!!

Step 3) Well, what we need to do is find where in the ROM that code is loaded from, and patch that. Switch to 32bit mode (if you're not already there) and you'll see:

See the line FCD007A5? That's what we're looking for. However, we'll need to reverse it, so it becomes A507D0FC.

Step 4) Open up Final Fantasy 5 (Translated).smc in your hex editor, and search for that hex string (A507D0FC). You should find it, and notice that it's the only occurrence of that string in the file.

Step 5) Now move your cursor or whatever so you're looking at the address of D0. 0x389BB; that's what you need to patch. However, since SNESAdvance doesn't take the SMC header into account, we need to subtract 512 bytes, or $200. So $389BB-$200=387BB.

That's your address, you know how to patch, it's 387BB=42DC. Goodnight folks.

-sephiroth2k


Back to Top | Back to Index | Back to Tutorials