Save State Hacking

• Introduction
• 1. About Save State Hacking
• 2. You may not need this guide!
• 3. Hacking Utility
• Basics
• 4. Hex Editing Basics
• 5. Hex Addresses
• 6. Hex Conversion
• Hacking!
• 7. Hacking RPG Money
• 8. Hacking RPG Stats
• 9. Hacking RPG Inventory
• More
• 10. Hacking Ramblings
• 11. Hacking Resources
• 12. Q: How can I hack PC or smartphone games?

1. About Save State Hacking

In this section I will introduce you to the magical wonders of save state hacking. But what can save state hacking do for you? Well well, I will tell you. Save state hacking gives you the power to change whatever number you desire during your progress through any game. When you're done going through this tutorial you will be able to hack into any game and change around any value you desire. For example, to change your lives from 3 to 99, your max HP to 9999, your gold pieces to the most you can hold, etc. stuff like that. The professional term for this is “hex editing”. It's so easy, and fun too! The game that will be our guinea pig for this tutorial is Chrono Trigger emulated by ZSNES.

• Note to Snes9X users - It is possible for you to use this guide to your advantage, but you need to do something extra. Snes9X saves its saves in “gzip” format. You'll need WinRAR or another unarchiving app to decompress those (or use 7-Zip since it's free). It's an annoying extra step so I recommend just using ZSNES.
• Note to ZSNES users - If you just want to hack a large number (i.e. money) in any RPG, you can just use ZSNES's cheat finder to do that. It's faster and easier than what this guide teaches.
• Note to Mac users - It is possible for you to use this guide to your advantage, but like Snes9X users you need to do something extra. Snes9X for Mac and all of Richard Bannister's video game emulators save their saves in “gzip” format. You can use Unarchiver to decompress those.

Back to top

2. You may not need this guide!

As much as I want you to read this tutorial that I put together with my blood, sweat, and tears, you actually may not need it! As I mentioned above, if you just want to hack a large number (i.e. money) in an RPG, it's much easier to just use ZSNES's cheat finder. Secondly, if you want to hack a popular RPG then you can just use a save state editor to change whatever you want with an easy graphical interface. Zophar.net seems to have all the editors that are available (as well as bombard you with annoying ads). Check out what they have...

• Zophar.net Genesis Utilities - Editors for Phantasy Star 2-4, Shining Force 1 & 2.
• Zophar.net SNES Utilities - Editors for 7th Saga, Breath of Fire 1 & 2, Chrono Trigger, Earthbound, Final Fantasy 4-6, Live-a-Live, Magic Knight Rayearth, Romancing SaGa 3, Secret of Evermore, Secret of Mana, Seiken Densetsu 3, Star Ocean, Super Mario RPG, and Tenchi Muyo RPG.

Cheats with PlayStation 1 emulation - DuckStation (the #1 PS1 emulator) is the easiest and best solution because it auto-downloads cheats. If you prefer ePSXe, in my ePSXe tutorial I guide you through downloading a zip file with Game Shark cheats for every game and how to use them.

Back to top

3. Hacking Utility

First things first, you need a hacking utility in order to hack. The program you need is a hex editor. There are several available off the internet. Some are really fancy and have tons of features. Sadly, all those fancy hex editors are not free and have a 30 day trial - but no worries! I have a free Windows hex editor here for you. The name of it is Cygnus. It's a simple hex editor with few features, but it's perfect for basic hex editing:

Note to Mac users - Refer to MacScene's forums for help finding a good hex editor because I'm not in the loop with the Mac world.

Back to top

4. Hex Editing Basics

Refer to the picture below. These are the first five lines of a Chrono Trigger save state brought up in a hex editor. Any file can be brought up in a hex editor and each one comes up as pages and pages of numbers and letters. Hex is like a special alphabet for computers. If you counted to 20 in hex it would be like this: 00, 01, 02, 03, 04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E, 0F, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1A, 1B, 1C, 1D, 1E, 1F, and 20. See the pattern? Hex pages are divided into 3 sections: the line numbers, the hex values (also called bytes or offsets), and the junk you can ignore. I conveniently circled the 3 different sections in red for you.

Back to top

5. Hex Addresses

A hex address tells you the exact location of a specific hex value. Knowing how to read a hex address is critical if you want to understand the save state hacking guides at GameFAQs or make your own save state hacking guide. Each column has an assigned number/letter; I show them in the picture below (0, 1, 2, 3, 5, 6, 7, 8, 9, A, B, C, D, E, F):

The line number of that picture is 822. You can ignore the zeroes at the beginning and end of it. Let's say you need to know the exact location of B6. B6's column is 2 so the exact location of it is 8222. All that I did was add the 2 at the end. And the location of C0 would be 822C. So whenever you see a hex location number (like 8222 or 822C), the first part of it is the row number and the very last digit is the column name. Do you get it now? I hope so.

Let's do a test! Look at this picture again:

Tell me the exact location of 93. Take your time. Did you find it yet? Oh, you did? What is it? 44? That's right! 4 is the line number and 4 is the column name. Now tell me where 1A is. Take your time. Did you find it yet? Oh, you did? What is it? 1A? That's right! 1A is 1A! 1 is the line number and A is the column name.

Back to top

6. Hex Conversion

An important part of hex editing is converting a regular number to hex so that we can fiddle with it. Let's say your character currently has 600 GP...

1. Bring up the Windows calculator.
   1. On Windows 10, click then .
   2. On Windows XP, click Start > Programs > Accessories > Calculator.
2. Now with the calculator open, we need to change its view.
   1. On Windows 10, click the hamburger icon then click Programmer.
   2. On Windows XP, click on the View menu then click Scientific.
3. Next, we need to punch in 600 to convert it to hex.
   1. On Windows 10, enter 600 and you'll be shown the hex.
   2. On Windows XP, enter 600 then put the bullet next to Hex.

The number has now changed to 258. Now get out a scratch piece of paper. Yes, a piece of paper and something to write with and follow the below animation.

1. Write down the number.
2. Underline each pair of numbers from right to left. Oh, this is an odd number and we can't evenly underline pairs of numbers when there isn't an even set of numbers. That means we need to add a zero. So the number has now changed to 0258.
3. ALWAYS REMEMBER THIS: hex values are reversed (only with video games). Reverse this number as pairs. The number has now changed to 5802.

And there we go! 600 GP is 5802 when converted to hex.

Back to top

7. Hacking RPG Money

Let's hack Chrono Trigger and max out Crono's money! Open up ZSNES and begin a new game with Chrono Trigger. Talk to Crono's mom so she can give you 300G. Now use ZSNES's save state feature and save your state. Crono currently has 600G. Read the section above about hex conversion to learn how to convert 600G to hex - which ends up as 5802.

Open up Cygnus and open your save state. If your Chrono Trigger ROM is called “chrono.smc” then the save state will be called “chrono.zst”. Click on the Edit menu then click on Find. Type in 5802 (it will automatically separate into pairs) and click on Find Next. Oh! Cygnus found it! But wait, we're not done yet. Press F3 to perform the search again. Oh! Cygnus found 5802 in another place. Press it two more times. Oh! Two more sets of 5802's. Press it again. Oh! Cygnus went back to the first 5802. That means there are 4 sets of 5802's in this Chrono Trigger save state. Which one will change how much money you have? Important values like money are usually in the middle of tons of 00's. Here's a screen shot of the very first 5802 that Cygnus found.

Out of the 4 sets of 5802's that Cygnus found, the first two are in the middle of tons of 00's so it has to be one of the two. Let's hack the first value! Hmm what should we change 600G to... how about 999,999G! It's settled then, we're going to change Crono's 600G to 999999G.

First we need to convert 999999 into hex. Bring up the Windows calculator, punch in 999999, and put the bullet next to Hex. We get F423F. Now follow my 3 conversion steps. Notice that F423F is not even. That means we need to add a zero again. So the number is now changed to 0F423F. Pair them up and switch them around! The number is now changed to 3F420F. So 999999 converted to hex is 3F420F. Now we can type that in! Type it starting at 58, like in the picture down there...

Now save it, go back to ZSNES, and load the state. If you saved your state while the status menu was open (like me) then you need to exit it and re-enter it so the hacked changes can take effect. If you saved your state without the status menu open then all you need to do is bring it up (which is more convenient). Oh, look! The first 5802 was the correct value for the money after all! CONGRATULATIONS! You have now successfully hacked into Chrono Trigger via save state hacking! Let's say you want to tell a fellow hacker the exact location of the values where you can change Crono's money. You would tell him, “The offset for the money in Chrono Trigger is 3866, 3867, 3868” since 386 is the row number and 6, 7, and 8 are the column names. You could also say, “The offset for the money in Chrono Trigger is 3866 and its 3 bytes long.”

Back to top

8. Hacking RPG Stats

Now let's hack several things at once! Let's max out Crono's HP and MP to 999 and his Power to 99. First we need to convert 999 and 99 into hex. Bring up the calculator and convert it to hex. Windows calculator gives you 3E7 so add a 0 to make it 03E7 then switch it around and it's E703. Punch in 99 and that's just 63. So 999 converted to hex it's E703 and 99 is 63. As seen in the screen shot, Crono's stats is HP 70/70, MP 8/8, and Power 5. So it's just three numbers and 70 converted to hex is 46, 8 is 08, and 5 is 05. When it comes to HP and MP, these values are (most of the time) two bytes meaning two pairs of two digits.

Before we begin hacking make sure Crono's current HP/max HP and current MP/max MP is the same (go to an Inn). Now bring up Cygnus and the Chrono Trigger save state and search for 46 00 46 00 (DO NOT add spaces because it will do that for you so just type in 46004600). Are you asking yourself why we're looking for 46 00 46 00? Like I said before, HP and MP are made up of two bytes. 46 stands for the 70 HP that Crono has now and the extra 00 will be taken up when Crono's HP grows. That's why we're searching for 46 00 46 00.

Cygnus has found two sets of 46 00 46 00. Let's try our luck and hack into the first one it found. Change it to E7 03 E7 03. Oh, and look right next to it! It's 08 00 08 00, which is Crono's current and max MP! Change that to 63 00 63 00. So line 3210 should have the following...

Now we need to change Crono's Power from 5 to 99. Since RPG stats are always grouped together, the hex value for Crono's Power is somewhere near his HP and MP. Oh no! There are 7 sets of 05! I circled them for you...

Do'h! Which one can it be? What can we do to figure out which one is which? Well let's look at the Chrono Trigger menu screen shot again. We are given 2 clues: Crono's Speed is to the right of Power and his Hit is right under it. So that means his Power must be somewhere near those numbers. Let's see, 13 converted to hex is 0D and 8 is 08. So let's look for 0D and 08 close to Crono's Power (05). AH there are too many 08's! OH, but there's just one 0D. I don't think Crono's speed is down there because Crono's Power is such an important value, it's usually right next to the HP and MP. Plus I've made a mistake. Did you see where my mistake is? I'll tell you! Crono is wearing the Bandana which increases his speed +1. Ah hah! So Crono's Speed is NOT 13--it's 12! You need to take things like this into consideration when you're hacking. So 12 converted to hex is 0C. Oh, I see a pattern! Do you see the pattern? Look after Crono's MP, you'll see 05, 08, 0C, 05, 08, and 08. Does that look familiar? It's Crono's stats! His Power, Speed, Hit, Evade, Magic, and Stamina! They're all in perfect order right after his HP and MP! Now let's change all of that to 63!!! Like in the following...

Now save it and bring up Chrono Trigger and load the save state. Awesome, look at the changes that have been made! We changed all of Crono's stats to 99 by changing their hex values to 63. By why are they showing up as stars? In Chrono Trigger, those stars mean that the number has exceeded the limit. Oh look! By raising Crono's stats, his strength went to 133 and his defense went to 107! Cool huh? If you were successful in following all of my directions then CONGRATULATIONS you have successfully hacked several of Crono's status alignments at one time! Now Crono has the power of a god!

Let's do some examining. Look at the top picture with all the hex values. Look at line 326 and tell me if you see a pattern when you look at this line and then Crono's HP/MP. You'll see 41 00 41 00 and 0C 00 0C 00. That kind of looks like Marle's HP/MP! And I bet Lucca's stats are after hers! See the pattern? That's the greatest thing about save state hacking! All you need is a couple values to see the whole pattern.

Back to top

9. Hacking RPG Inventory

Now we're going to do one more exercise. We're going change all of Crono's items to 99! Now I want you to enter the Millennium fair and buy 4 Tonics, 3 Heals, 2 Revives, and 1 Shelter. Save your state and open up it up in Cygnus. Let's jump to line 321 where Crono's HP/MP is so click on Edit then Go To and type in 3210 then click OK. The item list offsets should be around the stats somewhere. They would either be on top of the stats or under the stats. There are a three ways RPGs like to organize item lists...

Method #1: “Position 69”

BD	DD	F3	A1	4D	76	9D	52	21	00	00	00	00	00	00	00
00	00	00	00	00	00	00	00	00	00	00	00	00	00	00	00
01	02	03	07	12	0A	0D	02	01	00	00	00	00	00	00	00
00	00	00	00	00	00	00	00	00	00	00	00	00	00	00	00

Position 69 is tricky. Those hex values on the top line signify items. Like DB could be Cure and DD could be Elixir. The hex values in the third line is the amount of each item. So the items are on top and the item amounts are below them. Keep in mind that this is just an example. A ROM will list hundreds of items and then list the item amounts like 100 lines below.

Method #2: “Partners”

BD	01	DD	02	F3	03	A1	07	4D	12	76	0A	9D	0D	52	02
21	01	00	00	00	00	00	00	00	00	00	00	00	00	00	00

Partners is the most common method. I used the same values that I used in the first example, so do you see the pattern? The first value is the item and the next one is the item amount and so on. Item, item amount, item, item amount, item, item amount, item, item amount... get the idea?

Method #3: “On/Off”

01	00	00	00	00	00	00	00	00	03	00	00	00	00	00	00
00	00	00	01	00	00	00	00	00	00	00	00	00	0A	00	00
00	02	00	00	00	02	00	00	00	00	00	12	00	00	0D	00
00	12	00	00	00	00	00	00	07	00	00	00	00	00	00	00

So far I've only seen On/Off in Squaresoft's Front Mission and Treasure of the Rudras (a.k.a. Rudora no Hihou). I doubt you'll encounter it in any other games. Anyway, the “on/off” system does not require values to signify items. Let's say the above example is the full chunk of hex for all the items in a RPG. Each value (even the 00's) represents a different item. Let's say the very first value in the upper left represents 'Potion'. There's a '01' there so you currently have 1 Potion in your inventory. Each value that has a '00' means that you do not have any of that item. If you decide to hack each value and replace everything with '01' then you will have 1 of every item in the game. You cannot switch around which value "turns on" a different item. Each specific hex location will always represent that item.

Alright then, back to hacking. Crono's items should be under all the character stats or above them. Let's try looking above them. If Chrono Trigger uses method #1 then we're looking for 04 03 02 01, but if Chrono Trigger uses method #2 then we're looking for ?? 04 ?? 03 ?? 02 ?? 01 (we don't know the item offsets yet so for now they will be ??).

Oh, look what's on line 311! There we go! So Chrono Trigger uses method #1. That means the item offsets should be somewhere nearby. Let's look for them. Try looking above these hex values.

Back to top

10. Hacking Ramblings

RPGs are very easy to hack since you're given tons of numerical clues and there are little tricks you can do to figure out which values are which. Non-RPGs are a bitch to hack into like finding the Lives value in street fighting games. Hacking guides tell you where all the important values are. They've done all the work for you! And most hacking guides have lists of all the attacks, spells, items, etc. so that you can add whichever ones you want (and as many as you want) to your current game. Save state hacking is pretty much the best I can do. Other types of hacking are insane and require lots of patience, like changing around dialogues and graphics. Advanced hex editors offer many useful features to make difficult tasks like that much easier. So don't bother using Cygnus forever if you plan on doing some advanced hacking. Cygnus is just a free hex editor for basic little tasks like save state hacking. Refer to my next article for some resources.

You might be saying to yourself, "So I can hack into SNES save states... what about other systems??"

Well well, it just so happens that these techniques work with... almost every video game emulator. If you're unable to hack into any game saves for a specific emulator, then that most likely means that emulator uses a form of compression for its saves.

Here are some video game emulators that I've tested my techniques on and was successful:

• (NES) Nestopia save states
• (Genesis) Gens save states
• (Genesis) Gens Sega CD *.srm saves (NOTE: the values are not backwards!)
• (PSX) ePSXe memory card files
• (Gamboy/Color) BGB save states
• (TurboGrafx16/CD) MagicEngine save states

Back to top

11. Hacking Resources

Want to learn how to hack into ROMs and change whatever you want? Check out the hacking guides at RomHacking.net. Or how about the save state hacking guides that I've mentioned a couple times throughout this section, want to check some out? The following RPGs have save state hacking guides at GameFAQs:

• Chrono Trigger
• Final Fantasy 6
• Final Fantasy 5
• Earthbound
• Seiken Densetsu 3
• Tales of Phantasia
• Sailor Moon: Another Story
• Romancing SaGa 3

Those are links directly to the pages where you will find the save state hacking guides. Also keep in mind that I don't have all RPGs with hacking guides listed there. Those are just some that I managed to stumble upon when I went out looking for some.

Back to top

12. Q: How can I hack PC or smartphone games?

I have no idea. The methods I discuss in this guide only work with hacking video game emulator save states. Modern games are not programmed so simple that you can just load a save into a hex editor and change numbers around. If it were that easy then cheating would be much more common place.

Back to top