Chrono Compendium

Enhasa Halls - Chrono Series Analysis => Other Topics and the Prerelease => Topic started by: uzerzero on January 16, 2012, 02:00:09 am

Title: Chrono Cross Memory Dump Analysis
Post by: uzerzero on January 16, 2012, 02:00:09 am
Wow, I realized that it's been over five years since I've been on these forums. I bought CT for the iPhone a week or so ago and I've enjoyed replaying that, which then led to me picking up Chrono Cross again, and ultimately to me tearing apart the inner workings of Chrono Cross and sinning against the nature of the game.

I thought I'd post my discoveries, for anybody else who's interested in fiddling around with their game. All you really need is an emulator that can create save states and a hex editor. I'll get to a brief run through of that later.

Why would you even care about stuff like this? Well, I personally enjoy dissecting games like this. I love being able to manipulate it so I can do things that aren't normally possible. In the case of CC, I've found a number of interesting things to do so far. For instance, you can allocate Kid's techs to anybody else you want. So Lynx can use Pillage to steal while Kid/Fargo aren't around. Or he can even Doppelgang, although I think Sprigg still has to "learn" the monsters before they can be used by other characters. You can also allocate Elements that are restricted to innate characters, place Elements that are locked in one level in another (like Nostrums), or give yourself multiple copies of techs. The possibilities really are quite endless, at least to the point of having 96 slots maximum and 291 player elements (I haven't figured out the codes for enemy techs yet).

Just a quick sidenote before we get started that I realized after reading utunnels post below. There are technically two types of memory dumps - an in-game dump that allows you to view/edit values on the fly, and a save state dump that is created by emulators like PCSX and ePSXe. The former is universal, but I only know of one PC emulator that allows you to view dumps on the fly (Zebra or something, I think). The latter is a dump of the memory generated by the emulator with a header attached to it, making it slightly larger than the real dump. This is then compressed (usually gzip) and saved to your hard drive. Since the majority of people using emulators are using PCSX or one of its variants, almost all the save states should have the same header, ultimately differing from the actual dump by 36,896 bytes. So if you are viewing an in-game dump (I'm using PCSXbox because it offers a decent in-game editor), simply subtract 0x9020 from any of the offsets I've listed below.

On that note, I'll add some info later on how to actually get the memory dump out of the save state and mess around with it.

But first, let's take a look at the character blocks. I can't confirm if the offsets are identical in different games as I only messed around with my current game today. However, Serge/Lynx is located at offset 0x77BFC. If you don't find it there, just search for his max HP converted to hex in little endian. In other words if he has an HP of 382, then search for 7E 01 (0x17E flipped). Before that should be a 16-bit value of either 01 40 or 01 80. There are a total of 44 character blocks, each 204 bytes long, with the last being Pip at offset 0x79E40. They're listed in the order you find them in the game menu (Serge, Kid, Guile, Norris, etc.). Interestingly enough, the game updates the statistics of characters who aren't even available at the moment (like when everybody hates you after the Serge/Lynx switcheroo) and also those who are unable to be recruited because you took a different path (i.e., Glenn, Pierre, etc.). I haven't looked into it too deeply yet, but I would imagine that it is possible to "activate" characters that you're not supposed to have at the moment. You can also just switch out the models, so you can visibly be whoever you want. Anyways, the following table is the generic format of the character block as far as I've deciphered it to be. If you don't understand what offsets, bits, bytes, words, or little endian are or why it goes from 9 to A, you should probably take a look at some info about hexadecimal representations of binary files, although I'll try to give a brief overview in here somewhere.

On that note, I should mention that all the values are in little endian format, except for the 8-bit values in the beginning of course.

OffsetWhat's thereOffsetWhat's there
0x01 Gender flag? 0x8F End of elements, usually 7B 00 32 14, although some end in 0A
0x03 HP 0x93 Padding
0x05 Strength 0x95 Unknown, but 00 04 40 00 seems to be present in available characters
0x06 Resistance 0x99 Padding
0x07 Accuracy The following stats seem to be identical to those first listed, except the 8-bit stats are now 16-bit, possibly for use in battle to allow for buffs
0x08 Agility 0xA5 HP
0x09 Magic 0xA7 Blank
0x0A Magic Resistance 0xA9 HP
0x0B Unknown 0xAB Strength
0x0C Stamina Regeneration 0xAD Accuracy
0x0D Weapon slot 0xAF Unknown
0x0F Armor slot 0xB1 Resistance
0x11 Accessory slots (3 of em) 0xB3 Agility
0x17 Padding 0xB5 Magic
0x19 Character ID, linked to 3D model and profile info 0xB7 Magic Resistance
0x1B Possibly a recruitment/availability flag? 0xB9 Unknown
0x1D Unknown, but seems to only be composed of a select few 16-bit values. I thought it might indicate grid layout, but that didn't seem to fit. 0xBB Seems to usually be 00 00, but can sometimes be 00 01
0x2D Elements (00 00 indicates an unfilled slot, 00 40 indicates a spot that hasn't been made available yet 0xBD Padding
0x8D Padding 0xCC End

Offset 0x19 is a character model and info ID. In other words, each 16-bit value corresponds to a specific 3D model (both on the map and in battle), as well as their profile (visible in the status menu). Replacing them is as simple as replacing the current value with a new one. To save time, I'll just go ahead and tell you that the character model values proceed in the exact same order as how the characters are listed in the menu. Serge is 00 00, Kid is 00 01, all the way up to Pip at 00 2B. Pip's other forms cover the values 00 2C to 00 30, and the Lynx model is at 00 31. Here's a screenshot of two Lynxes fighting alongside Harle:
You can see how the second Lynx (3rd party member) is named Lynx in battle, but in the character menu it is still listed as Starky. Now unfortunately, as far as I can determine, you can only have two copies of the model in your party. I tried putting in three Kids, but the game crashed as soon as I entered battle.

Another point of interest on our tour of the memory dump is found at offset 0x7A780 where we find the Element stockpile. A theoretical total of 192 different Elements can be stored here, which is strange because there are only 126 Elements that are capable of being allocated. Beyond that, we reach 0x7A900, to discover the quantities of stockpiled Elements. While you can change the 8-bit value to 0xFF (255) and the game will reflect it if you go into the menu, it will soon reset itself to 0x63 (99) of the Element. This block is fairly straightforward, as the quantities are simply recorded in the same order as the stockpile. So if your first three Elements stockpiled are 5xFireball (07 00), 2xUplift (13 00), and 1xGravityBlow (1F 00), then the quantity block would simply read 05 02 01.

On the topic of Elements, let's bounce back to our character block. At offset 0x2D, I indicated that this was where the Elements started. There is no distinction between grid levels. The most common values you'll see are "00 00", which indicates an unfilled slot, and "00 40", which indicates a slot that hasn't yet been unlocked due to star level. To add new elements to the grid, simply replace 00 00, 00 40, or xx 00 (where x is an element value) with one from the table below. There are a few Elements that require all 16-bits, including the seven "forgotten" Elements that The Cutting Room Floor identified. To read the table, the x-axis represents the first digit in the value, while the y-axis indicates the second digit. So the ChronoCross element would be 7 on the x-axis, and E on the y-axis, making it 7E. All of these are 16-bit values as well, meaning they're followed by 00, except where noted. Elements with a "*" before them are Summons, those with a "!" before them are Traps, and those with a "@" before them are Techs.


The following table is the same format as above, but with 01 as the second byte in the 2-byte value. So @HairCutter is 17 01, not 17 00
E@HPShuffle@SisterHoodsFrom here on down,
F@SwordTrick@Pounce modifiers for Elements

The Cutting Room Floor points out that the "EL_127" Elements are placeholders for Pip's transformations (source (

The following -lengthy- table lists all the monster techs that are available. Unless otherwise noted, all of these are techs (preceded by the little teardrop symbol). I think *Golem and [Trap]???? are the only two exceptions. The format of this table is just like the ones above it, except that the second 8-bit value is 01 for all of them. So "Slots" is 6601, not 6600 (WhiteOut). Also, some may have a two letter abbreviation in parentheses after it. This is to indicate an Elemental color where there are multiple techs of the same name or when the monster tech differs from a player tech (such as 5901, Dash&Slash). The abbreviations are as follows: BL = blue, RD = red, GR = green, YL = yellow, WH = white, and BK = black. The handful of techs that are bold-faced are unused techs in the game, as noted by TCRF ( Finally, where you see "-----", it means that an empty Element was found there, by which I mean an Element that fills a slot in your grid but has no name or description. Some of them do list single foe and all foes as their targets though. Once allocated, monster techs can be removed but not reallocated.


Just a few notes of interest about monster techs before we wrap up the Elements section (hopefully). All of these can be used in combat, but many of them may be broken because you're obviously not the monster the animation or effects was made for. Interestingly enough, *Golem (6801) has no level, innate, or full field requirements so it can be cast at any time. However, it failed when I attempted to do so, possibly because the field wasn't all yellow. ModeChange (9401), the tech SunOfAGun uses to go from creepy happy baby sun to creepy angry baby sun, is able to be cast on any enemy. Obviously it won't work because your character is incapable of going from creepy happy to creepy angry (at least visually...), but the interesting part is that some sort of debug text pops up briefly in the upper left hand side of the screen. I tried to grab a screenshot of it, but it appears very rapidly. Some of the techs have double entries, my only guess as to why is that they're different animations.

Going back to character block, starting at 0x0D we have the equipment slots. You can also find your stored equipment at offset 0x7A300 and their corresponding quantities at 0x7A600. They're virtually identical to the elemental stockpile and quantities. All of the equipment values are are 16-bit, even though they only go up to FF 00. The following table is in the same format as the one for the Elements, with the x-axis being the first digit and the y-axis the second. Where you see a "-", it means that there is nothing there. Values that are indicated by a "?" mean that there is no in-game name for it, but a description of "?" is given in the equipment menu. The few equipment names that have a "*" after them are unused equipment, also pointed out by The Cutting Room Floor. Also, all the values from 80-8F have been omitted because there's nothing there.

0Blank@SeedSea SwallowPorcelain RodEinlanzer (2x)Bone AxeSteelerangLadle Fe26
1@Bone@Shiny EmberCopper SwallowBrass RodSlasherBronze AxeSilverangFrypan Ag47
2@Copper@Shiny DewSteel SwallowIron RodFerrous GunIron AxeRockerangSaucepan SiO2
3@Iron@Shiny LeafSilver SwallowMythril RodArgent GunSilver AxePrismarangCrystalpan C6
4@Mythril@Shiny SandStone SwallowDenadorite RodDenadorite GunStone Axe--
5@Denadorite@Shiny SaltSpectra SwallowRainbow RodSpectral GunRainbow AxeBone Shot*Bone Glove
6@Rainbow Shell@Shiny SootMastermuneFloral RodShockwave Gun-Bronze ShotBronze Glove
7@Eyeball-Ivory DaggerBone SwordPlasma PistolGreat HammerSteel ShotIron Glove
8@Humour-Bronze DaggerBronze SwordPorcelain PickMaster HammerSilver ShotMythril Glove
9@Feather-Iron DaggerSteel SwordBrass PickBronze LureStone ShotGranite Glove
A@Scale-Mythril DaggerSilver SwordIron PickIron LurePrism PelletsSpectral Glove
B@Fur-Denadorite DaggerStone SwordMythril PickMythril LurePrivate Deck-
C@Leather-Prism DaggerSpectral SwordPebble PickStone LurePack of Lies-
D@Fang-Silver StaffHero's BladePrism PickPrism Lure--
E@Carapace-Stone StaffViper's VenomCarrot-Spatula Ca20-
F@Screw-Spectral StaffEinlanzer (1x)Betta CaroteneBronzerang*Besome Cu29-

0-Stone VestEnergizer SuitHero's MedalThird EyeEarring of LightWhite Brooch
1-Prism VestGhetz's Shirt*Hero's ShieldKnee PadEarring of HopeBlack Brooch[td/]
2-Blue Plate?Ivory HelmetElbow PadStamina RingDreamer's Scarf
3-Red Plate?Bronze HelmetWaist PadStamina BeltDreamer's Sash
4-Green Plate?Iron HelmetSilver PendantResistance RingTrashy Tiara
5-Yellow Plate?Mythril HelmetGold PendantResistance BeltGolden Tiara
6Ivory MailWhite Plate?Stone HelmetMemento PendantSea CharmProfiteer Purse
7Bronze MailBlack Plate?Prism HelmetDancing ShoesFlame CharmMoonglasses
8Iron MailFeathery Dress-Power GloveKung-fu ShoesForest CharmSunglasses
9Mythril MailScaley Dress-Dragoon GauntletWinged ShoesEarth CharmPendragon Sigil C
AStone MailCarapace DressOzzie PantsPower SealDragoon's HonorAngel CharmPendragon Sigil B
BPrism MailScrewy DressFlea VestMagic RingDragoon's GloryDaemon CharmPendragon Sigil A
CIvory VestDiva DressAntitoxinal CapSky Djinn RingDefenderBlue BroochForget-me-not Pot
DBronze VestWisp CapePoultice CapMagic SealDefender PlusRed BroochStar Fragment
EIron VestCloud CapePlaster CapSilver LoupeSilver EarringGreen BroochDreamer's Sarong
FMythril VestStardust CapeAntiviral CapSight ScopeGold EarringYellow Brooch?

This is just a little tidbit of information that I had sitting in my notes and forgot to put in. It's only useful in battle and therefore, only useful if you have some way of poking values into the memory while the game is running (basically what a GameShark does). So all of these offsets pertain to an in-game dump rather than a save-state dump (although you can save in the middle of a battle). At offset 0xDDF60, 0xDDF62, and 0xDDF64 are the current HPs for character slot 1, 2, and 3 respectively. And just down the street at 0xDDF68, 0xDDF6A, and 0xDDF6C are their max HPs in the same order. The only use for this data is in creating GameShark/PAR-like cheats that force the game to never change those values. However, I'm hoping that with a little more digging, I can find where things like stamina level, current Element level, and status effects are stored.

An actually useful bit of info that I managed to dig up (with thanks to utunnels), is the location of your star level. I'm fairly certain that this is actually consistent across all games. The offset for max stars is found at 0x7AC94, while current stars is at 0x7AC96. I also found at 0x7AC98 is your current gold, which is stored in a (gasp) 32-bit value. Finally taking advantage of the full power of the PSX...

Oh, and one last thing that I pulled out of a cheat database. At offset 0xEB218 is a 16-bit value that is a save-point flag. If you are standing on a Record of Fate, at the world map, or changing discs, the value is set to 0000. But if none of the above requirements are met, it is set to 0100 which locks out the save option in the menu. Most emulators support cheatfiles which allow you to trick the game into always setting the flag to 0000 so you can save anywhere. However, you can't use the Teleporter or Smith Spirit because the save flag is only triggered when you open the menu and go to the Save/Load function.

Now this is an interesting little tidbit (no nerdy pun intended). The following offsets are given in context of an in-game dump because they're pretty much worthless outside of battle. At offset 0xDBD34 you'll find the "monster block" for monster A. 1080 bytes down from there (add 438 to the offset), you get monster B, and so on. I think the max number of monsters in battle is five, although I could be mistaken. Anyways, the structure of the block is almost identical to that of the character blocks. And those "-"s listed in the equipment table? Those are for enemy weapons and armor. One of the major differences in monster blocks and character blocks is that the first 16-bit value is either 0080 or 0040, leading me to believe that the 0180 or 0140 in the character blocks indicates that the character is an ally (most likely it's actually two 8-bit values, the first being an ally flag, the second a gender flag). Another difference is in their elemental grid. In the character block, most of the Elements are in the format xx00, while monsters' are in the format xx40. And finally, there's a ton of extra info, 876 bytes worth. The only thing of interest I've found in the extra info is that at offset 0xB5 (starting from the 0080/40 value) you find the monster's current HP. Also, you can't use monster models for characters (at least as far as I know). The game defaults to Serge in the status menu, but crashes on the field screen. And it would have been so nice to be able to play as Lavos.

Title: Re: Chrono Cross Memory Dump Analysis
Post by: utunnels on January 16, 2012, 03:48:15 am
Star related stuff:

71C74 -- max stars (2 bytes, for some reason)
71C76 -- current stars
Title: Re: Chrono Cross Memory Dump Analysis
Post by: uzerzero on January 16, 2012, 01:23:43 pm
Star related stuff:

71C74 -- max stars (2 bytes, for some reason)
71C76 -- current stars

Do you have any contextual info? Like what's around it? Because those offsets didn't match in mine. But thanks for the info!
Title: Re: Chrono Cross Memory Dump Analysis
Post by: utunnels on January 16, 2012, 08:22:00 pm
It has been a long time since I took the note.
I'll check when I have time.


Here's what's behind 71c70

00 00 00 00 50 00 50 00 02 04 00 00 FC 03 FC 03
FC 03 F8 03 F0 01 E0 01 E0 01 E0 01 FC 03 FC 03