--------------------------------------------------------------------------------
| Ultima: Quest of the Avatar
| Save State Hacking Guide
| by John Ratliff
|
| The most recent version of this guide can always be found at
|
http://games.technoplaza.net/hack4u/sram-hacking.txt
|
| Copyright (C) 2004-2005 emuWorks (
http://games.technoplaza.net/)
| Permission is granted to copy, distribute and/or modify this document
| under the terms of the GNU Free Documentation License, Version 1.2
| or any later version published by the Free Software Foundation;
| with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
| Texts. A copy of the license can be found at
|
http://www.gnu.org/licenses/fdl.html
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
| Table of Contents
--------------------------------------------------------------------------------
1.0 Introduction
2.0 Revision History
3.0 Credits & Thanks
4.0 Copyright
5.0 SRAM Offsets
5.1 Phases of the Moon
5.2 The Hero's Name
5.3 Virtues
5.4 Party Members
5.5 Stones & Runes
5.6 Magic
5.7 Herbs, Gold, & Tools
5.8 Inventory
5.9 Character Stats
5.10 Starting Location
5.11 Pirate Ships & The Balloon
5.12 The Whirlpool
5.13 Treasure Offsets
5.14 Miscellaneous Offsets
6.0 The Sanity Algorithm
7.0 Contact Information
--------------------------------------------------------------------------------
| 1.0 Introduction
--------------------------------------------------------------------------------
This document is a guide to hacking the save state (SRAM or battery backed
RAM) of Ultima: Quest of the Avatar for the Nintendo Entertainment System.
Ultima: Quest of the Avatar was released for the NES in 1990. The copyrights
are attributed to Origin Systems (creators of the Ultima series) in 1985 for
the original version, and to FCI and Pony Canyon in 1990 for the NES version.
This guide refers to the NES version released in the US in 1990. I do not know
if it was released in Japan or Europe. If it was, this information may or may
not apply to those games. Since I only owned the US version, I can only
comment on that version.
This guide is not specific to any one NES emulator. It modifies the SRAM
(aka battery backed RAM, non-volatile RAM, etc.) that the game used
internally to save the game on the real cartridge. Because of this, these
methods should work on any emulator that supports SRAM. Any decent emulator
should do this. A short list includes FCE Ultra, Nester, Nestopia, Nesten. I
have never used Jnes, Fakenes, or VirtuaNES, but I would guess they do this
also as they are highly regarded.
I have only tested this information with FCE Ultra, which is the emulator I
use. This is primarily because FCE Ultra is one of two current emulators that
runs in Windows and includes a nice debugger which is very useful for finding
the information here.
Modifying the information directly (by hand with a hex editor for instance) is
difficult because of a complicated sanity algorithm Ultima uses to check the
integrity of the SRAM. Because the original battery in the cartridge can only
last so long, it was necessary to develop an algorithm they were sure would
confirm the data in the SRAM was legit. Unfortunately, it is not a simple
algorithm to compute by hand. Fortunately, I've written a nice program that
will do it for you. You may be reading this guide as part of that program, but
if not, you can find it at
http://games.technoplaza.net/hack4u/. It is
available for Windows, Linux, Mac OS X, and FreeBSD.
The sanity algorithm is described in section 6.0.
--------------------------------------------------------------------------------
| 2.0 Revision History
--------------------------------------------------------------------------------
Version 1.2 - March 21, 2006
- minor typo corrections
- updated the Ultima alphabet table
- added information on joined party members
- added information on starting location
- added information on the balloon location
- added information on the pirate ship locations
- added information on the whirlpool location
- added information on treasure offsets
Version 1.1 - August 3, 2005
- minor corrections (typos mostly)
Version 1.0 - December 4, 2004
- initial version of this guide
--------------------------------------------------------------------------------
| 3.0 Credits & Thanks
--------------------------------------------------------------------------------
This guide would not be possible without the work of several people I feel
should be awarded much accolates for their efforts.
- Tony Hedstrom
Without Tony, I would have never discovered the sanity algorithm used by
the game. I had originally given up on it until I talked with him about
it.
- Xodnizel
Creator of FCE Ultra. Without FCE Ultra's debugger, it is quite likely I
wouldn't have been able to find most of the offsets that lead to this
guide and certainly not the sanity algorithm. It's a shame Xodnizel
doesn't intend to continue FCE Ultra's development.
- Julian Smart, Vadim Zeitlin, Robert Roebling, and all the wxWidgets authors
Without wxWidgets, hack4u would have been written in Java. While it would
have been just as nice IMO, many people dislike Java and it wouldn't be as
useful to people.
In addition, Vadim and Julian have been invaluable resources in learning
the wxWidgets nuances and I wouldn't have gotten very far without their
guidance.
- sp, bbitmaster, DahrkDaiz, and Vystrix Nexoth
Creators of FCEUXD SP. The PPU viewer was very helpful in learning the
remainder of the Ultima character alphabet.
--------------------------------------------------------------------------------
| 4.0 Copyrights
--------------------------------------------------------------------------------
It really disgusts me when authors of documents like this say you can't post
their stuff, or that you can do so only with their prior approval. Maybe this
is solely because they want to make sure their guide is up-to-date in all the
distributed locations, but I suspect far more evil intent.
Since I can't do anything about their copyrights, I'll just have to lead by
example.
This document is Copyright (C) 2004-2006 emuWorks
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.2
or any later version published by the Free Software Foundation;
with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
Texts. A copy of the license can be found at
http://www.gnu.org/licenses/fdl.html
Basically, it is free documentation in much the same way software under the
GNU General Public License is free software. You can modify it, redistribute
it, sell it, publish it, etc.
--------------------------------------------------------------------------------
| 5.0 SRAM Offsets
--------------------------------------------------------------------------------
Finally, we get to the good stuff.
Ultima: Quest of the Avatar for the NES included, like many games for the NES,
an SRAM (aka battery backed RAM).
This SRAM was a portion of writable memory inside the cartridge that when the
NES was off was saved by a battery also contained inside the cartridge. This
is similar the way a PC saves it's CMOS information today. That's the reason
your PC's clock still works when your computer is off.
The SRAM was an area of memory $2000 bytes long. All numbers in this guide
that begin with a $ are hex numbers, i.e. numbers in the hexadecimal number
system, base 16. Decimal numbers, like we use in practice, are base 10. I
don't plan to include a decimal->hex tutorial here, so if you don't understand
hex, you'll probably need to find one. There are many on the web.
Fortunately, the parts of the SRAM we care about are in three small $200 byte
sections, and 9 other bytes contained elsewhere.
The NES accessed the SRAM at the CPU addresses $6000-$7FFF. When I refer to
the CPU address, it will always be in this range. The SRAM address with be in
the range $0000-$1FFF. $0000 SRAM = $6000 CPU.
The SRAM was used by Ultima to save three different games. Each game used
$200 (512) bytes of memory. The three SRAM addresses start at $1A00, $1C00,
and $1E00. They end at $1BFF, $1DFF, and $1FFF. The nine other bytes are used
to sanity check the SRAM, and will be discussed later.
Since each game is identical in storage location, I will use relative SRAM
offsets. In other words, if I refer to address $27 in game 1, I really mean
SRAM address $1A27. Just add the start address + the relative offset to get
the SRAM address. You can then add the starting CPU address if you want the
actual CPU address, but this is probably not useful unless you're just
curious.
Here are the relative offsets in the SRAM that I know about. There are many
bytes unaccounted for. Some may be unused, and some may just be
uninteresting for purposes of save state hacking. There will be a more
detailed explanation after I present the list.
$00 Sanity Byte
$01 Moon Phases
$02-$06 Hero's Name
$0B Characters Who've Agreed to Join the Party
$0C-$13 Virtues
$14 Avatarhood
$15-$18 Party Members
$19 Stones
$1A Runes
$1B-$1E Magic
$1F-$26 Herbs
$27-$28 Gold
$29 Torches
$2A Gems
$2B Key
$2C Oil
$2D Sextant
$2E Scale
$2F Flute
$30 Candle
$31 Book
$32 Bell
$33 Wheel
$34 Horn
$35 Skull
$36 Key of Truth
$37 Key of Courage
$38 Key of Love
$39-$3E Mage Inventory
$3F-$44 Bard Inventory
$45-$4A Fighter Inventory
$4B-$50 Druid Inventory
$51-$56 Tinker Inventory
$57-$5C Paladin Inventory
$5D-$62 Ranger Inventory
$63-$68 Shepherd Inventory
$69-$70 Levels
$71-$80 Current HP
$81-$90 Max HP
$91-$98 Current MP
$99-$A0 Max MP
$A1-$A8 Strength
$A9-$B0 Intelligence
$B1-$B8 Dexterity
$B9-$C8 Experience
$D2-DD Found Treasure
$ED Capture Pirate Ships
$EE Next Pirate Ship to Overwrite
$F0-$F1 Balloon Location
$F2-$F3 Whirlpool Location
$F4-$FB Pirate Ship Location(s)
$107 Starting Location
These are all the ones I know about, or cared enough to make a note of anyway.
I haven't noted the spells you can learn in Spells Unlimited. I thought it was
enough just to have the spells.
--------------------------------------------------------------------------------
| 5.1 Phases of the Moon
--------------------------------------------------------------------------------
There are two moons in the world of Ultima: Trammel and Felucca. Trammel is
the one on the left, while Felucca is on the right. Respectively, they
determine where the Moongate is, and where it will lead.
There are $18 (24 = 8 cities * 3 destinations each) possible phases. The
relative offset $01 determines which of these it is.
Here are all the possible values the offset $01 can have and their meanings.
$00 Moonglow - Moonglow (Black Stone)
$01 - Britain
$02 - Jhelom
$03 Britain - Yew
$04 - Minoc
$05 - Trinsic
$06 Jhelom - Skara Brae
$07 - Magincia
$08 - Moonglow
$09 Yew - Britain
$0A - Jhelom
$0B - Yew
$0C Minoc - Minoc (Shrine of Spirituality)
$0D - Trinsic
$0E - Skara Brae
$0F Trinsic - Magincia
$10 - Moonglow
$11 - Britain
$12 Skara Brae - Jhelom
$13 - Yew
$14 - Minoc
$15 Magincia - Trinsic
$16 - Skara Brae
$17 - Magincia
This value is not that useful since the moon phases change often enough it is
usually easier to wait for a specific phase in-game than to alter the state.
--------------------------------------------------------------------------------
| 5.2 The Hero's Name
--------------------------------------------------------------------------------
In Ultima, like most RPG's, you have a Hero and several supporting characters.
The Hero is the only character that can have a name selected by the player.
The game determines that the person who leads the party is the Hero. Other
than that, the Hero is just like any of the other character classes. If your
hero is the Paladin class, then the game's built-in Paladin (Dupre) will not
join you. This is because the game stores information according to class, not
according to individual player.
Well, enough about the hero, how do you change his (or her) name.
The offsets $02-$06 (5 characters) will do this. You can also use $07 for a
sixth character (like the name Mariah for the built-in Mage), but the game
will only allow you to give the character 6. Some number of offsets past $07
can also be used for the hero, but this will mess up the status screen, so I
don't recommend more than 6, 5 if you want to stay within the game's limits,
but the only real reason I see for this is that there's no space between the
last character in the name and the status info in battle. The mage Mariah has
this problem, too, so it doesn't seem to hurt the game any.
Ultima's alphabet for names is simple. I will list all the symbols I know, but
some may not be valid for names. The legitimate alphabet for character names
includes the letters A-Z and the lowercase a-z, the numbers 0-9, the dash -,
the exclamation point !, a space (represented by an underscore _), and the
NUL character which signifies termination of a name with less than 5
characters. My save state editor program hack4u limits you to the game
provided character alphabet.
Legitimate character alphabet:
A-Z = $91-$AA
a-z = $D1-$EA
- = $D0
! = $90
_ = $BC (SPC in the game becomes an underscore)
NUL = $00 (this signifies a name with less than 5 (or 6) characters).
Other possible symbols:
Circle (small) = $BF
/ = $C0
. = $C1
, = $C2
Dot = $C3
" = $C4
Degree mark (circle) = $C5
, = $C6
Key symbol = $C7
Star = $C8
+ (Plus Symbol) = $C9
Ankh Symbol = $CA
x (not the same as alphabet x) = $CB
: = $CC
; = $CD
Status Screen Alphabet:
These are the capital letters used on the status screen to indicate class,
MP, HP, and status ailments. These letters are distinct from the name
slphabet.
N = $63
E = $64
S (Shepherd) = $65
W = $66
G = $67
P (Paladin or Poison) = $68
D (Druid) = $69
M (Mage or MP) = $6A
B (Bard) = $6B
F (Fighter) = $6C
H (HP) = $6D
T (Tinker) = $6E
R (Ranger) = $6F
I'm not sure what N, E, W, and G are used for. The other letters may have
additional uses I'm unaware of.
I always name my hero either Dominic or Liam, depending upon how many
characters I'm allowed. Since we are restricted to 5, Liam it is.
Liam is spelled $9C $D9 $D1 $DD $00. That fills the offsets $02-$06.
--------------------------------------------------------------------------------
| 5.3 Virtues
--------------------------------------------------------------------------------
The virtue system in Ultima introduced with Quest of the Avatar was extremely
popular and unique.
There are eight virtues: Honesty, Compassion, Valor, Justice, Sacrifice,
Honor, Spirituality, and Humility. They are always numbered from 0-7.
The game represents everything in refernece to these eight virtues. The cities
Moonglow, Britain, Jhelom, Yew, Minoc, Trinsic, Skara Brae, and Maginicia. The
cities are always numbered 0-7, too. The characters Mage, Bard, Fighter,
Druid, Tinker, Paladin, Ranger, and Shepherd are also represented 0-7. All
these values are tied together. Moonglow is the city of Honesty and Mages.
The virtues are tracked all throughout the game in the offsets $0C-$13.
$0C = Honesty, $13 = Humility. Here is the full list:
$0C Honesty
$0D Compassion
$0E Valor
$0F Justice
$10 Sacrifice
$11 Honor
$12 Spirituality
$13 Humility
I'm not 100% what the exact values represent, but the higher the number, the
better (more moral) your character is.
I believe the values range between $00-$64 (0-100). $64 means you have partial
avatarhood, $63 is the best you can be without having partial avatarhood,
$32 (50) is where you start, and so on.
However, avatarhood is measured two ways (probably for simplicitiy in the
program). Offset $14 is also used to measure partial avatarhood in a virtue.
Offset $14 is what is known as a bit list or flagset, etc. It has many names.
Basically, $14 is a single byte, which has 8 bits of data. Since there are
eight virtues, this is perfect. We can turn a bit on (1) to represent you have
partial avatarhood in this virtue, and off (0) to represent you do not have
partial avatarhood in this virtue.
Bits are represented from right to left. So if we have a list of bits
10011010, the bit 7 is on (1), and bit 0 is off (0). Knowing that virtues are
represented 0-7, we know that Honesty is bit 0, and Humility is bit 7.
If all the bits are on, you are the avatar. But if you virtue values don't
correspond, you will lose your avatar status very easily. My program,
hack4u, will keep both values in sync automatically.
Let's say the game has just started. You have $32 (50) in offsets $0C-$13 and
$0 (no partial avatarhoods) in $14. To give yourself partial avatarhood in
honesty, we can change $0C to $64 and $14 to $1. If after that, we want to get
partial avatarhood in Honor, we can set offset $11 to $64 and offset $14 to
$21.
Here is how I got the value for $14.
Starting value = $1 (%00000001 in binary -- binary numbers start with % signs)
We want to turn on bit 5 (honor = 5). So we binary OR the starting value with
(1 LSH 5 = %00100000). Then we get %00100001 which is $21 in hex. If you don't
understand binary math operations, you should look for a tutorial, or just
use my program. That's even easier.
--------------------------------------------------------------------------------
| 5.4 Party Members
--------------------------------------------------------------------------------
Ultima IV can support four characters in your party as one time. The
characters are one of the following: Mage, Bard, Fighter, Druid, Tinker,
Paladin, Ranger, and Shepherd. You can also have no one in your party at a
certain location, but to avoid confusing the game, it's best if the empty
slots are at the end.
If you read the section on Virtues, you know that the characters, like the
virtues are always numbered 0-7 (Mage - Shepherd). But as a special case where
there can be no one, 0 becomes no one. So each number is shifted up by 1.
Mage = 1, Bard = 2, ..., Shepherd = 8.
The first member is the hero, so $15 not just the leader, but is also the
hero. You cannot rearrange the hero's location. If you put the hero's
character in another slot, he (or she) will stop being the hero and will lose
their hero abilities such as being able to equip Exotic Armor or Sword of
Paradise if they are the Avatar.
You can also have more than one of the same character in your party. However,
they are all tracked with the same stats. This means if one character dies,
they all die. But on the plus side, if one gains experience, they all gain
experience. Other than this quirk, I didn't notice any adverse affects in the
game, but that doesn't mean there aren't any. There are generally some issues
to be expected when the game is forced to use invalid data it never expected
was possible.
Since members in your party are not tracked by the same value as people who
have agreed to join you, if you put characters who have not joined your party
in your formation, you will see them in their hometowns. You can even ask them
to join you as if they were not already in your party. If your party is not
full and they agree to join you, you will have a duplicate in your party. If
your party is full, they will go to the hostel in Castle Britannia. But since
that member is already in your party, they won't really be there.
In addition, if you part with people at the hostel who didn't join you, they
will not show up in the hostel until you've asked them to join you in their
hometown. However, if you split with them, they will appear in the hostel
until you leave the room and can rejoin your party immediately.
Just set the values to 0-8 (0 = no one, 1-8 = Mage - Shepherd)
$15 First Member (Hero)
$16 Second Member
$17 Third Member
$18 Fourth Member
As for members who have agreed to join your party, this is tracked by another
flagset variable, $0B. Since no one is not an option here, we go back to the
standard values 0-7 Mage - Shepherd. This affects which characters will appear
in their hometown or in the hostel if they are not in your party. Assuming you
had picked the Mage as your hero, and asked Iolo (Bard), Dupre (Paladin), and
Jaana (Druid) to join you, $0B would have a value of $2B.
--------------------------------------------------------------------------------
| 5.5 Stones & Runes
--------------------------------------------------------------------------------
As with character's, virtues, and towns, there are eight stones and eight
runes. They all correspond to a particular virtue.
Blue Stone of Honesty
Yellow Stone of Compassion
Red Stone of Valor
Green Stone of Justice
Orange Stone of Sacrifice
Purple Stone of Honor
White Stone of Spirituality
Black Stone of Humility
The stones are at offset $19 while the runes are at offset $1A. Just like
partial avatarhood, they are represented by a bitlist. You can read more about
bitlists in the Virtues section 5.3.
--------------------------------------------------------------------------------
| 5.6 Magic
--------------------------------------------------------------------------------
Magic in the game is tracked using four bitlists at $1B, $1C, $1D, and $1E.
They can each hold eight spells, but only some values are used. You can read
more about bitlists in the Virtues section 5.3.
Offset $1B represents the following spells:
Bit 0 Light
Bit 1 Missile
Bit 2 Awaken
Bit 3 Cure
Bit 4 Wind
Bit 5 Heal
Bit 6 Fire
Bit 7 Exit
Offset $1C
Bit 0 Dispel
Bit 1 View
Bit 2 Protect
Bit 3 Ice
Bit 4 Blink
Bit 5 Energy
Bit 6 Quick
Bit 7 (Unused)
Offset $1D
Bit 0 Sleep
Bit 1 Reflect
Bit 2 Negate
Bit 3 (Unused)
Bit 4 Destroy
Bit 5 Jinx
Bit 6 Squish
Bit 7 Gate
Offset $1E
Bit 0 Tremor
Bit 1 Life
Bit 2 (Unused)
Bit 3 Defeat
Bit 4 (Unused)
Bit 5 (Unused)
Bit 6 (Unused)
Bit 7 (Unused)
If you think I've missed a spell or this information is incorrect, please
contact me.
--------------------------------------------------------------------------------
| 5.7 Herbs, Gold, & Tools
--------------------------------------------------------------------------------
The number of herbs you can have is represented in the offsets $1F-$26. There
are eight herbs: Ash, Ginseng, Garlic, Silkweb, Moss, Pearl, Fungus, and
Manroot. Ash = $1F, Manroot = $26. The rest are in-between, respectively.
Just change the number to how much you want. $00 = 0, $63 = 99. This is the
most the game would normally let you have, though I haven't seen any adverse
affect if you have more, say $FF = 255.
Gold is one of the more difficult values because it's one of the few values
that is represented by a word (2 bytes = 16 bits). Anytime you have a value
greater than a single byte (usually), you start needing a way to store such
a number in memory. There are two primary ways of doing this. They are known
as little-endian, and big-endian. The NES (MOS 6502) and the PC (Intel x86)
are little-endian. Macs (MC68000 and PPC) and Suns (Sparc) are big-endian.
What is endian? It's how you store a multi-byte number. Do you store the most
significant part first (like humans do normally, 8001), which is big-endian,
or do you store the least significant part first, which is little-endian.
Though I would personally prefer big-endian since it looks more correct for
us, the NES used little-endian, and we can't do anything about that now.
So, if the NES has a word value (2 bytes) starting at $26, it might read
something like $9001 ($27 = $90, $28 = $01). Now, $0190 is 400, the amount of
gold you start with. So, to look correct for us, we need to swap $27 and $28.
So, if we want 9999 gold, which is $270F hex, we want to put $0F in $27 and
$27 in $28.
Complexities like this are just another reason to use my hack4u program.
Tools come in two formats, have/have not, and quantity. The quantity tools
are torches, gems, and oil. You can have 0 (none) up to 99 (max). You might
be able to have 255 like Herbs, but we haven't tested it.
So, for the three quantity tools, just change the offset to the number you
want, $00 - $63 (or possibly $FF).
$29 = Torches, $2A = Gems, and $2C = Oil
All the other tools are have/have not tools. You either have them, or you
don't. If you don't have them, there's a $0 value in the offset. If you have
them, there is a $1.
The have/have not tools are $2B, and $2D-$38. You can look them up in section
5.0.
--------------------------------------------------------------------------------
| 5.8 Inventory
--------------------------------------------------------------------------------
In Ultima, there are eight characters. Each ones inventory is tracked
separately. They can have 6 items (weapons, bows, and armors) and they can
have one of each kind equipped.
So there are six offsets for each character, and they start at $39. Refer to
section 5.0 for the full list for each character.
Here are the possible values.
$00 Nothing
$01 Sling
$02 Bow
$03 X-Bow
$04 +1 Bow
$05 Dagger (Has nyone ever heard of this? I haven't)
$06 Staff
$07 Club
$08 Axe
$09 Sword
$0A +1 Sword
$0B +2 Sword
$0C +1 Axe
$0D Wand
$0E +2 Axe (Axe of Legend)
$0F Sword of Paradise
$10 Cloth
$11 Leather
$12 Chain
$13 Ring
$14 +1 Cloth
$15 Plate
$16 +1 Chain
$17 +1 Plate
$18 Robe
$19 Exotic Armor
That will give your character the item. If you want it equipped, add $80 to
the value. $81 = Equipped Sling. $99 = Equipped Exotic Armor.
--------------------------------------------------------------------------------
| 5.9 Character Stats
--------------------------------------------------------------------------------
Character stats include current level, current/max HP, current/max MP,
strength, intelligence, dexterity and experience.
Of those values, current/max HP and experience are word values. See section
5.7 on Gold for more information on the implications of word values as opposed
to single byte values.
For each range of offset, they apply to the characters in sequence Mage,
Bard, Fighter, Druid, Tinker, Paladin, Ranger, and Shepherd. This means
the level offset for the Mage is $69, for Bard $6A, for Fighter, $6B, etc.
I'm not entirely sure, but I believe valid HP values are between 200 and 800,
while valid experience values are between 0 and 9999. All the rest of the
values range between 0 and 99. Going outside these ranges may yield
unexpected results.
--------------------------------------------------------------------------------
| 5.10 Starting Location
--------------------------------------------------------------------------------
The starting location value determines in which town the player starts out.
There are eight inns in the game, one for each city of virtue except Magincia,
and the village of Vesper.
Offset $107
Moonglow = $05
Britain = $06
Jhelom = $07
Yew = $08
Minoc = $09
Trinsic = $0A
Skara Brae = $0B
Vesper = $0E
Any other value puts you in Britain's inn.
--------------------------------------------------------------------------------
| 5.11 Pirate Ships & The Balloon
--------------------------------------------------------------------------------
In Ultima, you can find a balloon to fly in, and steal ships from pirates. The
game has one balloon, and keeps track of up to 4 stolen pirate ships you've
comandeered. For each ship after 4 you take, one will vanish. You may lose all
your ships if you travel by moongate or use the Gate spell. I'm not sure
exactly when the game erases your ships during gate travel.
The locations of the balloon and the pirate ships are stored in two bytes
using the game's internal latitude and longitude coordinates.
Balloon Longitude = $F0
Balloon Latitude = $F1
The Balloon will go back to its starting location anytime you exit the dungeon
Hyloth from the Britannia entrance. The starting location is at (243,233).
The four pirate ship locations are stored as follows:
Ship 1 = ($F4,$F5) (Longitude,Latitude)
Ship 2 = ($F6,$F7)
Ship 3 = ($F8,$F9)
Ship 4 = ($FA,$FB)
Because there are four potential comandeered pirate ships, there are some
extra offsets for pirate ships. To have one of the ships, the offset $ED must
have one of it's lower 4 bits set. For ship 1 to exist, bit 0 must be on, ship
2 is bit 1, and so on for the four possible ships.
The offset $EE keeps track of the next ship. In other words, if you already
have ship 1, then the next ship you steal should be ship 2. This number varies
between 0 and 3 for the 4 possible pirate ships.
--------------------------------------------------------------------------------
| 5.12 The Whirlpool
--------------------------------------------------------------------------------
There are three ways to get to the village Cove in the game. One is the
balloon. Another is by ship without a whirlpool (yes, there are places you can
catch a pirate ship and sail to Cove sans whirlpool). Finally, there is taking
your ship into the Whirlpool.
Before today, I had never seen the whirlpool, though I've heard of it. I've
always used one of the other two methods for getting to Cove.
I'm not entirely sure how the whirlpool works. It moves, but it has a starting
location that may or may not change. Since I've never seen it before, I don't
know if it changes or not. I assume that it does because it seems stupid to
save a value in SRAM that never changes.
The starting location of the whirlpool is at ($F2,$F3) (Longitude, Latitude).
It moves around this spot, but doesn't seem to stray very far. I'm not sure
how useful it is to change the location or if there are any side effects. I
didn't notice any when I tested it. But I only tried it out for a short time.
--------------------------------------------------------------------------------
| 5.13 Treasure Offsets
--------------------------------------------------------------------------------
Treasure offsets determine whether or not a found item will be there when you
go to look for it. For example, if you've already found the rune of honor,
then it won't be there if you research the field in Trinsic. Nearly every
treasure has a single bit that tracks whether it will be there or not. The
only exceptions I have found are the three keys.
Rune of Honesty = $D4 bit 4
Rune of Compassion = $D4 bit 5
Rune of Valor = $D4 bit 6
Rune of Justice = $D4 bit 7
Rune of Sacrifice = $D5 bit 0
Rune of Honor = $D5 bit 1
Rune of Spirituality = $D5 bit 2
Rune of Humility = $D5 bit 3
Blue Stone = $D6 bit 7
Yellow Stone = $D7 bit 0
Red Stone = $D7 bit 1
Green Stone = $D7 bit 2
Orange Stone = $D7 bit 3
Purple Stone = $D7 bit 4
White Stone = $D7 bit 5
Black Stone = $D7 bit 6
Horn = $D6 bit 3
Flute = $D5 bit 5
Scale = $D5 bit 4
Candle of Love = $D5 bit 7
Book of Truth = $D6 bit 0
Bell of Courage = $D6 bit 1
Mondain's Skull = $D6 bit 4
Sword of Paradise = $DD bit 7
Exotic Armor = $DE bit 0
Robe = $D5 bit 6
Gave Scale to Zircon = $D2 bit 3
Axe of Legend = $D2 bit 5
--------------------------------------------------------------------------------
| 5.14 Miscellaneous Offsets
--------------------------------------------------------------------------------
These offsets don't seem to fit in anywhere else. I'm not sure how useful they
are, but here they are anyway.
Dungeon Keeper's Wall Smashed:
For each of the 6 dungeons that have stones (all except Hyloth), there is a
guardian who keeps the stone behind a wall. If you answer the question
correctly, the wall crumbles. These offsets track whether the wall is still
present or not.
Deceit (Honesty) = $DD bit 1
Despise (Compassion) = $DD bit 2
Destard (Valor) = $DD bit 3
Wrong (Justice) = $DD bit 4
Covetous (Sacrifice) = $DD bit 5
Shame (Honor) = $DD bit 6
--------------------------------------------------------------------------------
| 6.0 The Sanity Algorithm
--------------------------------------------------------------------------------
Because the battery can wear out, the SRAM values cannot be trusted. They may
not retain their proper values, which would result in invalid or corrupt
saves. Unfortunately, there is no way to prevent it. But we can attempt to
detect is by using what are known as sanity algorithms. Sometimes they are
called checksums, CRCs, MD5 sums, etc, but each of those other names is
specific to unique process. None of these processes are used by ultima. They
did something far more complex.
To keep the game thinking the SRAM is good, since it doesn't let you play the
game if it thinks it's not, we need to duplicate the process it uses to
create sanity values that it can check. Here is how it works.
Take the $200 bytes used by the particular save game.
You need a value which will be the sanity byte. Set this value to 0. You also
need a counter value. Set this value to 0.
For every byte $001 to $1FF ($200 bytes = $000 - $1FF), do the following
1) XOR (binary exclusive OR) this number with one of the following numbers
$55, $AA, $33, $CC, $A5, $5A, $BB, $99. The number depends upon your
counter. Counter at 0 = $55, Counter at 7 = $99.
2) Add the XORed value to the sanity value.
3) If the sanity value exceeds $FF (255), drop the higher numbers.
$123 = $23. $1FE = $FE. etc.
4) Increment the counter.
5) If the counter is > 7, set the counter to 0.
6) Repeat steps 1-5 for each byte $001 - $1FF
Once you are done, you will have the primary sanity value. This value should
be stored in the SRAM at offset $00.
But you're not done yet. We need two secondary sanity values. To get the
first, XOR the primary with $AA. To get the second, XOR the primary with $55.
Now, you have three sanity values. For game one, store then in the SRAM at
addresses $1900, $1903, and $1906. For game two, it's $1901, $1904, and $1907.
For game three, it's $1902, $1905, and $1908. These are the nine bytes thar
are not part of the $200 byte game data.
If you want to hack the SRAM, but don't want to generate the SRAM values, you
can use this program I wrote. It will take an NES Ultima SRAM file, generate
the sanity values and write them to the SRAM file. Then you can see your
modifications. Of course I would recommend my hack4u program as a complete
solution, but if you want to play with values you can't modify with hack4u,
this is a good alternative.
------------------------------ begin sanity.c ----------------------------------
/*
* sanity
* Copyright (C) 2004 emuWorks
*
http://games.technoplaza.net/
*
* sanity is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* sanity is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with sanity; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include <stdio.h>
#define SRAM_SIZE 0x2000
#define SANITY_OFFSET 0x1900
#define GAME_SIZE 0x200
#define GAME_OFFSET 0x1A00
static const unsigned char SANITY_XORS[] = {
0x55, 0xAA, 0x33, 0xCC,
0xA5, 0x5A, 0xBB, 0x99
};
unsigned char getSanity(const char *game) {
int counter = 0;
int offset;
unsigned char sanity = 0;
/* For every byte $001 to $1FF, do the following */
for (offset = 1; offset < GAME_SIZE; offset++) {
/* XOR the number with one of the following numbers */
char xor = (game[offset] ^ SANITY_XORS[counter]);
/* Add the XORed value to the sanity value */
sanity += xor;
/* If the sanity value exceeds $FF, drop the higher numbers */
/* this is done automatically since our sanity value is a char */
/* increment the counter */
counter++;
/* if the counter > 7, set the counter to 0 */
counter &= 0x7;
/* repeat steps 1-5 for each byte */
}
return sanity;
}
int main(int argc, char *argv[]) {
FILE *f;
char sram[SRAM_SIZE], *game;
int game_number;
unsigned char primary, first, second;
/* check for the SRAM argument */
if (argc != 2) {
fprintf(stderr, "syntax: sanity ultima_sram_file\n");
fprintf(stderr, "example: sanity ultima.sav\n");
return -1;
}
/* make sure we can open the file for reading */
if ((f = fopen(argv[1], "rb")) == NULL) {
fprintf(stderr, "error: unable to open %s for reading.\n", argv[1]);
return -1;
}
/* make sure we were able to read a full SRAM file */
if (fread(sram, SRAM_SIZE, 1, f) != 1) {
fprintf(stderr, "error: unable to read SRAM file data.\n");
fclose(f);
return -1;
}
fclose(f);
/* print the three sanity values for each game */
for (game_number = 0; game_number < 3; game_number++) {
/* find the game data within the SRAM */
game = (sram + GAME_OFFSET + (game_number * GAME_SIZE));
/* generate sanity values */
primary = getSanity(game);
first = (primary ^ 0xAA);
second = (primary ^ 0x55);
/* alter the SRAM with the new sanity values */
game[0] = primary;
*(sram + SANITY_OFFSET + game_number) = primary;
*(sram + SANITY_OFFSET + game_number + 3) = first;
*(sram + SANITY_OFFSET + game_number + 6) = second;
/* display those sanity values */
printf("primtary sanity for game %d = $%02X\n",
(game_number + 1), (unsigned int)primary);
printf("first sanity check for game %d = $%02X\n",
(game_number + 1), (unsigned int)first);
printf("second sanity check for game %d = $%02X\n",
(game_number + 1), (unsigned int)second);
if (game_number < 2) {
printf("\n");
}
}
/* write these values back to the save file */
if ((f = fopen(argv[1], "wb")) == NULL) {
fprintf(stderr, "error: unable to open %s for writing.\n", argv[1]);
return -1;
}
if (fwrite(sram, SRAM_SIZE, 1, f) != 1) {
fprintf(stderr, "error: unable to write SRAM file data.\n");
fclose(f);
return -1;
}
fclose(f);
return 0;
}
-------------------------------- end sanity.c ----------------------------------
Written in ANSI C and under the GNU GPL, it should compile under any platform.
I have put up a windows binary at
http://games.technoplaza.net/hack4u/sanity.zip
--------------------------------------------------------------------------------
| 7.0 Contact Information
--------------------------------------------------------------------------------
The author, John Ratliff, can be contact at
http://www.technoplaza.net/feedback.php.
