Advanced Hacking

The hard stuff is like activators, debug menus, cut scenes, walk thru walls, level modifiers, moon jumps, size modifiers, speed modifiers and Enabler codes.

Activators/Joker Commands

  An activator/joker command is a code that will activate another code at the touch of a button on the controller. These codes use the D/E prefixes. To hack an activator/joker, start a known value search on the game title screen. Take this search when NOT pushing any buttons on any controller. Next, hold the R Button for N64 or Tringle button on PSX, and push the freeze button while holding the button on the controller. Now search for the following values"

N64 - "16-d"
PSX - "16-d"      NORMAL
PSX - "4096-d"    REVERSE

  The two PSX versions are listed because some games use activator quantifiers that are different from the rest. The N64 activators are usually always the same. So if you do not find the Triangle button with value "32-d", try value "4096-d". When you find the code that you think it is, put the prefix to "D0" on the code. Then test it by putting any code after it.

  Here is a quick example. Start the game but do not touch any buttons after coming to the opening screen. Press and hold the "R" button and press the GS Button to freeze the game. Release the R button. Do a known search for the value 16 in decimal, which is the equivalent of 10 in hex base. After the search resume the game and then press and hold L while pressing the GS button again. Release the L button and do a known search for 32 in decimal, which is the equivalent of 20 in hex. You should be down to 4 or 5 possibilities. Now let us say we try one of them to test. Let's pretend the code is 80012345 0010 you choose first. First Change the first digit "8" to a "D" which tells the Game Shark to execute the code that follows this new code you made, D0012345 0010 once and only once each time you press the R button. Now we pretend the code we want to use is for selecting a certain weapon, gun, 80022222 0001. So by combining the two codes:

D0012345 0010
80022222 0001

  We get a code that turns the gun on every time we should press R. Now of course we must test the code to see if it works. If by chance you choose wrong, fear not, a matter of elimination of the other few possible codes will reveal the correct one. Once tested and proven you can read on for the next step.

  Now we illustrate how we could de-select gun. Well let us choose the 'L" button to do this. First, again we select the proper code to use as the activator as before. If you'd like to turn the gun code off, you can usually put another activator over the code you want turned off.

Example -
D0012345 0020
80022222 0000

  Now by putting the two pieces together you can make a double activator let Let's you turn the gun on and off.

D0012345 0010
80022222 0001
D0012345 0020
80022222 0000

Now, the 'd0' codes are the activators. the one on top is the R button, and the one on bottom is the L button. The '80' codes are 8-bit gun code. When you push R button you get the gun and when you push the L you loss the gun.

  This type of code can be used for many types of use. Image transformers, Size modifiers, Cut scenes, level modifiers, health and status modifiers, items modifiers... the list goes on and on. Activators come in 3 basic types. Odd or Normal type 1, even or Normal type 2 for the 8 bit type, and even or dual for the 16 bit type. In an odd 8-bit type the activator will always have the 8th digit as odd, where it will have the 8th digit for an even value. All 16-bit activators are even by definition simply by inspection that any two odd 8-bit values create a even number. The only difference in a 16 bit activator is the 2nd digit will be a "1", e.g., D1012346. A complete list of quantifiers concludes this section on activators.
Normal Activator 1 Quantity Digits Button Pressed to Activate

00 No Buttons 
01 Right Directional Pad 
02 Left Directional Pad 
04 Down Directional Pad 
08 Up Directional Pad 
10 Start Button 
20 Z Button 
40 B Button 
80 A Button

Multi Buttons to use any combination of buttons, like, press Right Directional and Z to enable the codes. Just add the two digits up for Right Directional and Z. 01 plus 21 equal 21, so 21 would enable the codes when you push Right Directional and Z on the Controller 1
Normal Activator 2 Quantity Digits Quantity Digits Button Pressed to Activate

00 No Buttons 
01 C Right Button 
02 C Left Button 
04 C Down Button 
08 C Up Button 
10 R Button 
20 L Button

N64 Activators - Quick Tips ~by Viper187

Here's 2 tips for finding activators in a hurry:

1. Use more than 1 controller. Press the same button(s) on 2 or even all 4 controllers. Then when you view possibilities after after searching, you should see a group (2-4 depending on how many controllers you used) of results that are 6 or 8 hex apart. In the 200 or so games I've hacked so far, all but maybe 1 has had both a set that was 8 apart and at least one set that was 6 apart. Most times, these even use the same numbers as the last digit of the address. i.e. in the the typical '8 apart' set P1-P4 would be D1022204, D102220C, D1022214, D102221C and in the typical '6 apart' set P1-P4 would be D1022200, D1022206, D102220C, D1022212. The last digit on each address being 4,C,4,C or 0,6,C,2 respectively.

1. Use a 32-Bit Known Value search (PC Utils, GSCC2k2, etc). If press, for example, L + R + Z (value 2030), on controller 1 then search for that value as a 32-Bit value by adding 0000 to the end (20300000) you'll usually end up with only activators as your results; there can be some junk results depending on the value (button combo) use use though. I've found that 60200000 (Z + B + L) tend to work rather well, as does 4030 (B + L + R). Don't move the control stick when doing this though. That's what the 0000 is. :)

N64 Activators - A Slightly More Techy Method ~by Viper187

  If you haven't noticed this yet, pretty much every N64 game has multiple sets of Button Activators in different areas of the RAM. There is 1 set that I refer to as the "good set" because each controllers' activator is seperated by a 32-Bit value, FF010401. This is how it's setup in respect to addresses:

81055840 FF01
81055842 0401
81055844 ???? - P1 Button Activator (44 would be Activator 1 and 45 Activator 2)
81055846 ???? - P1 Control Stick Activator
81055848 FF01
8105584A 0401
8105584C ???? - P2 Button Activator (44 would be Activator 1 and 45 Activator 2)
8105584E ???? - P2 Control Stick Activator
81055850 FF01
81055852 0401
81055854 ???? - P3 Button Activator (44 would be Activator 1 and 45 Activator 2)
81055856 ???? - P3 Control Stick Activator
81055858 FF01
8105585A 0401
8105585C ???? - P4 Button Activator (44 would be Activator 1 and 45 Activator 2)
8105585E ???? - P4 Control Stick Activator
81055860 FE00
81055862 0000

Notice the repeating value? if you're using the PC utils or anything that allows 32-Bit searches, search for "FF010401". The only possibilities you get should be a nice set like that that are 8 hex apart, and the activators for each of the controllers plugged in are between them. :)
Curious as to what those 'FF010401's actually are? It appears the game uses them to keep track of what controllers are plugged in and such.

Debug Menus

  This is NOT easy at all. You will need to search through MANY, MANY codes if you have no base to go on. If you are looking for a debug menu that is already known, just take a readout with the menu NOT activated then the second with it activated choose "greater than". The quantifiers should read "0000" & "0001". That wasn't so bad was it?

  Now it's time to hack the Debug Menus that have never been seen before! To pull this off, you must start playing the game and do a few million "equal to" searches. You will see MANY codes that have the values as "0000". Well, ONE off those "0000" codes MIGHT be a debug menu. That is, if there is a menu in the game, IN THAT SECTION OF THE GAME. This must be the hardest code there is to hack. Are you up to the challenge?

Cut-Scene Modifiers- (Submitted by SubDrag and macrox)

• Press the freeze button while a cut-scene is playing and start an Unknown Value search.
• Play the same cut-scene, do an "equal-to" search.
• Play a different cut-scene, search for "different-to" values.
• THROW OUT ALL CODES that have value "FF"... Look for everything else, turn all codes that are nor "FF" on(some of them at a time). Play a cut-scene, if you play the same cut-scene no matter where you are, turn off a few codes(WRITE THEM DOWN), until you get the activate codes that do not play the same cut scene. Eliminate those codes.
• Turn on one code at a time(that you've written down) until the cut-scene never changes.

  OK, now just play all the cut-scenes, press freeze button, write down digits, repeat until you get all the cut-scenes... If you have been through all cut-scenes and notice missing digits, try those missing digits in your new GameShark code. Sometimes the game will freeze with the missing digits, but you may find a hidden, or 'unfinished' cut-scene.

Cut-Scene Modifiers - Code Generator and Memory Editor Method -(submitted by Macrox)

• Press the GS button while the opening cut scene of game is playing.
• Do an unknown search.
• Wait till next cut scene and do greater than search
• Restart the game. Wait for opening cut scene. Do a less than search.
• Again wait until next cut scene and do greater than search.
• Wait for another new cut scene and do another greater than search.

You may have to do this for quite some time to get the possibilities down. If you feel you are not getting anywhere try the following:

• At the opening cut scene do a Known search of 0 or 1. Make an assumption.
• Wait until the next cut scene and search for values equal to 1 or 2 depending what you choose the step before this.
• Restart game and wait for opening cut scene. Do known search for 0 or 1.
• Again wait for next cut scene and do a search for 1 or 2.

Level Modifiers and Cut Scene Modifiers - by macrox

  Now for my secret. Many games are programmed where the level modifier is addressed close to the cut scene modifier. This is how Castlevania and Castlevania LOD level and cut scene modifiers were hacked.

• Start game and take initial unknown search on opening level.
• Either wait for interlevel or new level and take greater than search.
• Wait for next interlevel or new level and again take a greater than search.
• Play that level awhile and take an equal to search.
• Restart the game and take less than search on opening level.
• Codes should be dropping in number of possibilities now.
• Once you get the codes possibilities down to 20 or so write them down.
• Start the memory editor and look for the codes you have on your list. The codes you have should have values no greater than 3 or 4.
• Try changing the code value in the memory editor to something smaller or larger. For instance, if the value is 3 try changing it to 6. This should take you to a different level. Once it works you have the level modifier and interlevel modifier.

  Now that you have the level modifier you can find the cut scene modifier with the memory editor by inspection. Inspection means looking around by going up and down the address screen while a cut scene is playing for that level. Since most new levels run a cut scene this makes things easier. You should find the cut scene modifier rather quickly. Try changing the value after the current cut scene is done. WARNING! As I have often stated when submitting cut scene codes: Running cut scenes out of their natural location or level might cause the game to freeze or do weird things like have your character fall into empty space once the game resumes. I will say more about the memory editor again later.

Moon Jump codes- GLEE method

Be sure that you have an activator/joker code before you begin.

1. Start the game, while your character is ON THE GROUND, push the freeze button and start a 16-bit unknown search.
2. Move your character to a different location. With character on the ground, push the freeze button search for equal-to values.
3. Repeat above steps a couple more times.
4. Push the jump button(if you have no jump button, fall off of something really high). While your character is in the air, falling, push the freeze button and search for greater-than values.
5. When your character lands, and is on the ground, push the freeze button and search for less than values.
6. Repeat from step one until you narrow down the possibilities.
7. To test the codes available as a moon jump code, jump up in the air and push the freeze button while the character is going up(if you have no jump button, fall off of something really high, as your character falls, push the freeze button).
8. View possibilities. Disregard any codes with value "0". Activate all possible codes(you should have less than five before doing this). If your game doesn't have a jump button and you had to fall, activate all codes and change the values to "0".
9. Return to the game, If you character continues to go up(or is not falling, but is in the air), then one of those codes is the Moon Jump.
10. Test codes individually. When you have the one you want, find the best digits for it by making it a few numbers lower, or higher.(for the fallers, Check to see if the code has value of around "Cxxx" when falling. If so, use a value of around "4xxx".
11. A value too high will cause the character to fly into the sky too fast and may cause the game to freeze. A value too low will cause the character to rise unnoticeably slow.
12. To finish the code- Put an activator in front of the code, set the activator digits to a button you would like. Now test the code, hold the button you set it for, if your character doesn't move, but you have the right code, push the jump button or fall off of something while holding your Moon Jump button. The character should rise!
    

Skip these last steps if your code works with out falling off of something.

1. Try setting the activator to the jump button, this may help.
2. If it doesn't work, or you have no jump button, you need to find out what codes tell the game that the character is in the air. These codes are REALLY tricky.
3. You'll need to start an unknown value search while stationary, then one stationary, elsewhere(perform equal-to search), then fall from something and do a different-to search. Land, do different-to, move to another place, equal-to.
4. You get the idea. When you find the code that instructs that the character is in the air, use it on the Moon Jump code you made before, and put that on an activator as well.
5. Later we will show you how to use the memory editor to hasten the finding of the moon jump code and testing it. Which ever way you prefer always remember GLEE - , Greater, Less than, Equal, Equal. Good Luck!!

Moon Jumps - 32-Bit Signed Method - by Viper187

  If you're using GSCC2k2, you might've noticed the 32-Bit Signed search options. I'm going to show you a way to find Moon Jumps using this. I can't say if this method is faster than GLEE. It is a different, slightly advanced approach to Moon Jumps.

  Note that "Signed" searches read hex values somewhat differently. Values are compared ranging from 80000000 to 7FFFFFFF. Why start in the middle like that? Because it reads 800000000 as -2147483647, not 2147483648. That's right. Negative values. FFFFFFFF is now seen as -1, FFFFFFFE as -2, and so on. This is useful here, since most games use a negative value when you're falling and/or on the ground, and a positive value when you are going up -- typicly 4xxxxxxx at the peak of your jump. Now the actual searching method. Reason I wrote this is because of games like Banjo-Kazzoie. I noticed that the Moon Jump address on there is the usual 4xxxxxxxx when in the air, but when you're on the ground it's BF800000. Try doing a normal Greater/Less when you're in the air and on the ground with that one. I don't think it'd work out that well; someone apparently found a way to make it work though. ;)

If you can jump:

1. Get hooked up, start game, etc and start a 32-Bit Unknown search, Signed.
2. Now jump and as you start to go up, do Greater Than.
3. Then quickly resume and do Less Than as you start to fall.
4. You can then continue to do Less Than another time or 2 til you hit the ground.
5. Repeat until you get the results down a ways and you should know what to look for (Cxxxxxxx going down, 4xxxxxxx going up).
6. Freeze or set to activator to test using 4xxx. The first 16-Bit half of the 32-Bit value should be enough. Say it found 800448A0. To modify it as a 32-Bit code you'd have to use both 810448A0 and 810448A2. But with Moon Jumps, the first half (810448A0) is enough.
7. You'll notice I didn't say to do any Equal To searches there. If for some reason you just can't get the results down, you could try it, but it can also eliminate the result we're looking for. This is because some games have been known to change the MJ address when your character is resting. i.e. you feet are tapping, or your can't does some kind of bounce type thing while standing. This may not seem like a big deal, but an Equal To at the wrong time and you'll be starting from scratch.

If you can't jump:

1. Get hooked up, start game, etc and start a 32-Bit Unknown search, Signed.
2. Find the highest place you can and try to commit suicide (walk off). The point is to get as much time in free fall as you can.
3. As soon as you start moving downward (aaaah!) start doing Less Than over and over til you finally hit the ground. If you get the possibilities down enough to pick out the right one, good for you; otherwise head back up for some more frequent flyer miles.
4. Repeat until you get the results down a ways and you should know what to look for (Cxxxxxxx going down, 4xxxxxxx going up).
5. Freeze or set to activator to test using 4xxx. The first 16-Bit half of the 32-Bit value should be enough. Say it found 800448A0. To modify it as a 32-Bit code you'd have to use both 810448A0 and 810448A2. But with Moon Jumps, the first half (810448A0) is enough.

Size Modifiers

  This type of code can be considered moderate to hard to hack depending on whether or not the object in question normally changes size, e.g., flattens, or whether the object in question normally stays a constant size, e.g., gates, trees, rocks, doors etc. The former description would be intermediate difficult to hack while the latter hard to hard. Let us break up the two types of difficulty:

Objects can normally change shape: By Subdrag

• Start the game and identify the object you want to hack a size mod for.
• Do an unknown search
• Move around the screen, and even change the area you are in if possible.
• Do an equal to search to unload a lot of junk codes from the search.
• Now do whatever you have to do to get the object to normally change shape. Get hit, fall, flattened or flatten, squeeze...you get the idea.
• Before the object regains it normal shape do a less than search.
• Once the object regains it normal shape, take a greater than search.
• Repeat this several times for whatever time it takes to get the codes down reasonable number. Inspect the possibilities and look for those codes that have quantifiers (in hex base) in the range of 3C00 - 4200, which is the typical values used in N64 and PSX games. Another big hint is to look for groups of 3 codes close to each other and having close to if not the same quantifiers. The reason this works is simple. The N64 and PSX are using 3D objects, hence you need 3 codes, one for each dimension.

Objects that do not normally change shape: by macrox

  This type of code is harder than above to hack. You have very little to go on regarding using the code generator (search engine) with the Game Shark alone. We will also in conjunction with the PC hacking utilities use the memory editor further aid and organize our search. In fact our example will show how using the memory editor is a very powerful tool to use and will be our second example in using the memory editor to hack a code.

• Start your PC and start the hacking utilities. Insert the Game shark and game into N64 attached the cable. Turn the N64 on and do a detect on your PC.
• Start the game and identify the object you want to hack a size mod for. We will use an example from Castlevania and Castlevania LOD for this.
• We have identified we want to hack a size mod for Cornell the Werewolf. (We will be pleasantly surprised to find this will pan out for the other characters as well later.)
• Ok. Now. We already told you that N64 usually uses several types of values for size variables in their games. Typical values of 3F80 and 3C00 or 3DCC are not uncommon to see.
• Making an assumption that the value is one of the above may or may not pan out for the hacker. Patience, endurance and luck are the rule of the day here.
• Using the PC hacking utilities perform a known search for your value. We suggest you break down the search by ranges, such as 800XXXXX - 8010XXXX, then 8010XXXX - 8020XXXX, etc... ALSO use the range value 3C00 - 4200. Doing this will shorten your search time and minimize guess work.
• By inspection, look over the possibilities and observe is you see the group of 3 we mentioned before. If the results are not too large you might want to try changing 1 of 3 codes you see on your list. Observe if the object on the screen has changed by doing this. Using the process of elimination you will either exhaust your list or hit pay dirt. No pay dirt? Perform another search but change the address range in the search.
• Again, by inspection check for the group of 3.
• Eventually, you will find the code. NOW, the question is this, Is this code valid for any level in the game? If not you will have to repeat this process for each and every level and interlevel too perhaps. Knowing whether a constant offset exists for your game is VERY helpful and will save you tons of work. We discovered that we did not have constant offsets. So our search routine took us quite a while in a monotony that would have quite easily discouraged a beginner hacker. That is why we stress patience and endurance so much. Anything worthwhile is worth work to coin a phrase.
• Luck was with us in some regard doing this hack. We found that even though the size moderator code changed for our character for each level and interlevel...it was in fact the same value for all the other characters in the game as well. We only wish we had such luck hacking with moon jumps as they were different for all level/interlevel and characters as well.
• Finally, there is one more secret we would like to share. We have often noticed that size modifiers are usually close to location modifiers. Location modifiers being the spatial coordinates the object has while having its own size coordinates or modifier. This being the case one could hack first the location modifier for an object and once knowing that use the memory editor to inspect "look around" at nearby addresses for other groups of 3. Those without access to a PC or use of the hacking utilities can none-the-less still carry out the search but should be warned that this will usually be a rather longer process and might not yield expected results. Many hackers that use the memory editor have found many an unexpected code by simply looking around for "patterns" such as groupings of 3 for size mods, location mods etc. The memory editor has been very useful to inspect addresses close to known codes to see if that code could be further enhanced or whether a new code could be found nearby. We encourage the beginner to not give up in frustration but understand the hacking is not always going to hit pay dirt each time you search. Indeed, you will learn to appreciate the workings of game programming and find as time passes you will "know" the game code as it you wrote it yourself. A feeling for the game is a valuable but truly subjective experience for any hacker.

Finding X, Y, and Z Coordinates - by Viper187

  Coordinates are what the game uses to tell where exactly something is (i.e. Player 1). These are almost always found in a group of 3 32-Bit values, that we refer to as X,Y and Z. X and Z are for left/right & up/down location and Y is your vertical location. Y is NOT how high off the ground you are, but how high you are in general. Thus, if you go up a hill, you are at a higher.

  My method here requires hooking your shark to your PC and using 32-Bit Unknown Value searches with either Interact's old program or GSCC2k2. However, this should work about the same way with a 16-Bit Unknown search on the in-game code generator -- just might take longer to get the results down, and there's a question of which 16-Bits of the coordinate is changing as you move. If you're going to do this, just make sure you move a good couple feet at a time. This should keep the upper half of the value changing. If you only move a tiny step then you may end up rolling over the lower 16-Bits so it becomes less when you're still searching greater. Confused? by that? Ok. Take an X coordinate for example. It's 32-Bits, we'll say 3DE93376, now as you move, that increases or decreases depending on the direction you're going. Now what I mean by the 16-Bit thing, is when you're searching you want to move enough to change the 3DE9 (upper) half because as that changes the 3376 (lower half) could be anything from 1818 to A2B4. If it was 3ED9E02A when you started, it could end up 3ED9F5CC when you move, or 3F882046. Now you can see why I say we want to be careful of how much we're are moving, and why comparing the whole 32_bit value with the PC programs is easier than comparing the 16-Bit halves.

1. Get hooked up and into the game as usual.
2. Decide which coordinate you want to search for. Remember they're almost always found in that group of 3 anyway, so you should get them all from finding one. It's just a matter of what you're more comfortable searching for. I prefer X or Z, so I'll use that here...
3. Start a 32-Bit Unknown Value search
4. Now pick a direction (I'd go forward) and move that way a few steps or so, depending on how much room you have before you hit a wall. We want to be able to move the same direction at least a couple times, then change. Now once you've moved a few steps, search Greater Than. Next, move a few more and do Greater Than again. Repeat this as desired, then go to step 5.
5. After you've done a few Greater Thans, start moving in the opposite direction and do Less Than searches.
6. You should be able to get the possibilities down enough that way. If you need to though, you *could* stay in 1 place and do an Equal To or 2. I must warn you though, that you coordinates can change on a game even when you're not actually moving. Ever notice how your character on some games with sort of shuffle side to side or something? The coords could be changing as the character does this. Just a heads up :)
7. Once you ge tthe results down, test them. Either freeze the value and see if you can still move, or change it a lot and see if it moves you somewhere else. Some games may write the coords to fast for you to just change them in the mem editor, so if for some reason you find what you think should be the group of coords and they just keep changing back when you try to change them, this is way.
8. No coords? Do the same thing again but search the opposite directions (do Less Than where you did Greater and vice versa). This should take care of it. If for some reason you still can't find them, then you could try 16-Bit searches (maybe the game only uses 16-Bit -- like games with a real short range of movement), or you could try the same 32-Bit searches, but do them Signed.

  Coords are fairly easy to find on most games, once you get used to it, but as always there are problem games. If you find another strategy, don't hesitate to let us know. :)

How do I use the Memory Editor (GS)? (Submitted by Kamek)

  The most common question I see on the hacking boards is, "How do I hack with the memory editor?" I'm not the least bit surprised -- when you enter the Memory Editor, it looks like some kind of programmer's screen.
  First off, let me explain the big myth about the Memory Editor. Some people think that just by doing a text search, they can unlock special areas in the game. THIS IS NOT TRUE! The Memory Editor just doesn't work that way. Suppose you loaded up Zelda and searched for "Master Sword". You probably wouldn't find it, even though the Master Sword is in the game. A text search is just that -- a text search. Some games encode their text, so you might not always be able to come up with results in the text search. HOWEVER, you CAN use the Memory Editor to possibly unlock extra levels, characters, and other stuff. I'll explain more about that later.
Here is what the Memory Editor CAN do:

• You can use the Memory Editor to unlock game secrets that are accessible. If you have unlocked a certain character, then you can use an unknown search to find the memory address that tells the game you have that character. By changing nearby values, you can attempt to convince the game that you've found other characters that you haven't really found. BUT, you must have a memory address to start from. Plus, the character MUST be accessible. You probably won't be able to play as the Magikoopa in Mario Kart 64, because he was removed completely from the game. (You can't have a 4-player Grand Prix either, because the game wasn't programmed that way.)
• You can use the Memory Editor to find secret passwords. If you know a cheat password for a game, you might be able to find other codes. For example, the cheat "NOYELLOWSTUFF" in Diddy Kong Racing removes all the bananas. If you use the Memory Editor's text search to look for "NOYELLOWSTUFF" in memory, you might find other passwords nearby!

• You can use the Memory Editor to find weird stuff. Load up Zelda OOT and open the Memory Editor. Search for the word "light". You'll be amazed at what you find! Solid proof that Zelda 64 was originally designed for the 64DD!

Breakdown of the Memory Editor
 
 80010000: 00 00 00 00 00 00 00 00 ........
 80010008: 00 00 00 00 00 00 00 00 ........
 80010010: 00 00 00 00 00 00 00 00 ........
 etc..
 (Note: On some TV screens, the left and right parts of the Memory Editor are chopped off. Unless your TV has a Horizontal Size knob or an equivalent, there is no way to
 fix this.)

So what is all this mumbo-jumbo? Let's break it down..

80010000:

This first part of the line is the memory address you are viewing. Actually, you can chop off the "80" if you want, and you'll get the real memory address. (The 80 is just 
for reference)
00 00 00 00 00 00 00 00

These are the values in the memory. If the number on the left was 80010000, then the first value is the value in memory location 80010000, the second value is what's at
80010001, and so on.

 ........
You won't see dots, they'll probably be blanks, or strange characters. This is only useful when looking for text, and you can ignore it unless you're looking for text.

The N64 memory starts at 000000 and goes up to 3FFFFF, for your information. Now, first of all, I would not recommend using the Memory Editor to find codes from scratch. It's practically impossible to find a code from scratch. Here are some things you can do with the memory editor. Suppose you were going to hack a code to get all the characters for Super Smash Brothers. (It's been done, but this is just an example.) Let's say that after several unknown value searches, you find out that 800A4938 0008 gives you Ness. Open up the Memory Editor and go to location 800A4938. You'll get something that looks like this:

800A4900 xx xx xx xx xx xx xx 00 
800A4938 08 00 xx xx xx xx xx xx
800A4940 00 00 00 00 00 00 00 00

When searching for "got character" modifiers, common values are usually powers of 2. (2, 4, 8, hex 10, etc.) Since the game just takes the power of 2 out of whatever the value in memory is, you can usually set the value to FF and possibly get more characters. So make sure all codes are off, then change the 08 to FF:

800A4900 xx xx xx xx xx xx xx 00
800A4938 FF 00 xx xx xx xx xx xx
800A4940 00 00 00 00 00 00 00 00

Now, go back to the game and enter the Character Select screen. Wow, you've got Jigglypuff! (If you didn't already have Jigglypuff, and got Ness first, then you play too much SSB!!) Let's try nearby values to get Captain Falcon and Luigi as well.

800A4900 xx xx xx xx xx xx xx 00
800A4938 FF FF xx xx xx xx xx xx
800A4940 00 00 00 00 00 00 00 00

Change the value at 80AA4939 to FF and return to the game. The character select screen will need to be reloaded for the changes to take place, so exit and return. They're all there!
Now that is how you find extra characters. Hmm... But what if you change other values? Perhaps you could unlock a certain classic stage of the Mushroom Kingdom. Let's try some fiddling around in the memory editor.

800A4900 FF FF FF FF FF FF FF FF
800A4938 FF FF FF FF FF FF FF FF
800A4940 FF FF FF FF FF FF FF FF

Change them ALL to FF. This way, you'll know that if you find something, one of those values unlocks it! Quit the Memory Editor and check out other areas of the game. Go to Options -- the Sound Test is there! One of the values you changed is definitely a modifier to get the Sound Test!
Now, go back to the Memory Editor, and change everything back to 00. Then, start from the Ness/Jigglypuff Modifier and work your way backwards, changing each 00 to FF and reloading the options screen to see if you got the Sound Test. Or, you could start at 800A4939 and go upward. However, it just so happens that the Sound Test, Item Switch, and Mushroom Kingdom modifier is right before the Ness/Jigglypuff modifier!

800A4900 00 00 00 00 00 00 00 FF
800A4938 08 00 00 00 00 00 00 00
800A4940 00 00 00 00 00 00 00 00

Congratulations! You hacked your first Memory Editor code!

What else can the Memory Editor do? I'll explain how I found the Saffron City Pokemon Anti-Modifier and other codes.
I was playing with the Yoshi's Island "Stay on cloud forever" code on one day. I forgot and left it on, then played a game at Sector Z. Suddenly, the game froze. Somehow, the Yoshi cloud modifier was causing something to happen in Sector Z! Not all game freezes are bad -- sometimes it means you've stumbled upon something big!!
I wrote down the cloud modifier location (80131400 region), restarted without the Yoshi cloud code, then watched a CPU battle at Sector Z, going into the Memory Editor every now and then. Values in the Memory Editor changed as the Arwing entered and left the arena. I couldn't find any pattern, so I tried poking around that same area during a battle at Saffron City. That's when I noticed the timer.
Every time I went into the memory editor, there was this one memory location that kept decreasing. Then, when a Pokemon came out, it suddenly jumped to a higher value, then started over again. I found the Pokemon Timer! To test my theory, I changed the memory value at 13140E to 00 01, then resumed the game. A Pokemon came out!

You might not be as lucky when looking for codes, but if a code for a certain stage freezes the game on another stage, check out that area in the Memory Editor. You might find something good, or you might not. It all depends on how the game is programmed.
If you remember only one thing from this document, let it be that the Memory Editor is not magic. The magic is in you, and with some skill and a little bit of luck, you may stumble upon some great codes!
In summary:

• You can only unlock areas that were left in the game.
• Things that were either partially or completely deleted from the source code of the game probably can't be accessed.
• You can quickly find neighboring codes to unlock more characters than what you searched for in the Code Generator.
• You can find cheat codes, on some games.

One final warning. You must be careful with the Memory Editor. It's a ticking time bomb in some cases. If you put the wrong value in the wrong memory location, you could end up freezing up your game. In other cases, you might accidentally overwrite part of your game's SRAM and either lose saved games, or ruin the cart. But usually, if you stick to the areas of memory you find using the Code Generator, you won't have any problems.

Happy hacking!

How do I use the Text Editor? (Submitted by Sutaz)

I shall use the game Mortal Kombat 4 for an example.
I am playing with the fighter Fujin. When I win a round, it says on the screen "Fujin Wins". Well, what if I want it to say "Sutaz Wins"? Easy.

Press the GS button to get to the in-game menu. Choose memory editor.
Press A to get the search menu. Choose Text Search. Type in the name Fujin.
Press search. We come upon the first set of digits that spell the word Fujin but this text is in his biography screen. We don't want to alter that text now, we want the "Fujin Wins" text. So tap A again to continue searching for Fujin text. After 2 more searches, we come upon the group texts for all the characters that say "x person wins". Looking at the right of the screen and search for the term "Fujin Wins". Now we look to the left of the screen and see the location code for "Fujin Wins" which is 8004C0E8. In the middle of the screen, we see a set of 8 airs of numbers. What are these? ASCII digits. These are the numerical code for the letters in the text. There are 8 pairs per line of code. So, the line for "Fujin Wins" looks like this:

8004C0E8  -  46 75 6A 69 6E 20 57 69
8004C0F0  -  6E 73

46=F
75=U
6A=J
69=I
6E=N
20=(space)
57=W
69=I
6E=N
73=S

So, with the text editor, just look at the ASCII digit menu and choose the numbers to replace Fujin with Sutaz. Press Up-C or Down-C to cycle through the digits. With the text editor, the new phrase "Sutaz Wins" would look like this now:

8004C0E8  -  73 75 74 41 7A 20 57 69
8004C0F0  -  6E 73

73=S
75=U
74=T
41=A
7A=Z
20=(space)
57=W
69=I
6E=N
73=S

That would be the line to change the NS if you wanted. Now how to put this in your GameShark. Each line of code ends in a string numbering by 8's; 0,1,2,3,4,5,6,7 or 8,9,A,B,C,D,E,F. Each letter in the text "Fujin Wins" has its own separate code. Example;
To put "Sutaz Wins" as a code in your GameShark to replace "Fujin Wins":
8004C0E8 0073 = S 8004C0E9 0075 = U 8004C0EA 0074 = T 8004C0EB 0041 = A 8004C0EC 007A = Z
No need to enter the blank space for this example, or the term "Wins".
But let's say your name is longer than 5 digits and you need more space. You got two options; look at the last letter, which in this case is S, and see if there are more "free" or "empty" digits after it. Example: The line of code for the NS in "Fujin Wins" looks like this in the text editor:
8004C0F0 6E 73 00 00 53 68 69 6E
You see that you have two slots that are 00 00. Those are "text breaks". 00 or 20 are used to separate text. You could now use the 00 right after the 73 slot to spell a 6 letter word like Macrox. But if you use the second slot 00, you will run into the 53. Look at the text to the right and we see to conserve space, the programmers put another character's Wins text on this same line which is Shinnok. Look at the code above again; 53 68 69 6E are S H I N, obviously for Shinnok. Now if you want to, you could do option 2 for adding more space for bigger words by "bleeding" or running over into Shinnok's text. You could take all of his digits and spell bigger words like Darth Maul Wins. Here is the catch, if you choose to fight with Shinnok, his Wins text will not appear because Fujin has stolen it. Get it? You must turn all excess digits to 20 to create a blank space and you must leave at least one 00 between each character's beginning codes or you will bleed into their text.

Here is a table of ASCII - numerals used in the text editor:

A = 41/61    B = 42/62    C = 43/63    D = 44/64    E = 45/65    F = 46/66
G = 47/67    H = 48/68    I = 49/69    J = 4A/6A    K = 4B/6B    L = 4C/6C
M = 4D/6D    N = 4E/6E    O = 4F/6F    P = 50/70    Q = 51/71    R = 52/72
S = 53/73    T = 54/74    U = 55/75    V = 56/76    W = 57/77    X = 58/78
Y = 59/79    Z = 5A/7A    0 = 30       1 = 31       2 = 32       3 = 33
4 = 34       5 = 35       6 = 36       7 = 37       8 = 38       9 = 39 

    Other Symbols: 

@ = 40       " = 22       # = 23       $ = 24       % = 25       & = 26
' = 27       ( = 28       * = 2A       + = 2B       , = 2C       - = 2D
. = 2E       / = 2F       : = 3A       ; = 3B       = = 3D       ? = EF
[ = 5B       \ = 5C

How to hack Walk through walls (WTWs):
(Used by special permission from Code Master)

Information That Is Needed To Know Before Tackling This Code

While your character is walking, or while they are not walking, there is a value in RAM that tells the CPU whether or not you are able to walk at all. This value is used to tell the CPU whether or not to move your character on the screen. I call it the 'Collision Detection Address', because basically, the game checked to see if there was any structures or walls that you would 'collide' with and stores a value to the Collision Detection Address based on if there was or wasn't an object to collide with in the direction you are trying to go. The value of this address could be almost any-thing the developer wants to use. Most common is 0 (Cant Walk), and 1 (Can Walk). Although with the release of this FAQ, developers are going to get smarter and use different values.. :( But oh well, we can deal with it. Now that you know this info, on to the actual searching methods.
The Actual Searching Method!!

There are 2 ways to go about this, you can do the 'Known' value search method. Or the 'Unknown' value search method.

1. The 'Known' Value Search Method: This method, you are assuming the value is 0 for when you cant walk, and 1 when you can walk. Now, here's the critical part. This value changes based on whether or not you are moving, or if you are not moving. So, while you character is currently walking in a certain direction. (Character HAS to be moving!) Do a search for values Equal to 1. After that has finished the game will restart, keep walking in the same direction until you run into an object/wall. While holding down the direction the object is. (character will be moving their legs, but not going anywhere) Do a search for values Equal to 0. You should have a pretty good size of possibilities. So you do some more searches. Walk to the opposite direction that you are facing. While your character is 'Walking', do a search for values Equal to 1. Walk till you run into an object/wall, and while holding the direction of the object/wall, do a search for values Equal to 0. Then walk in the opposite direction till you run into an object/wall, do a search for values Equal to 0. (Why 0, because the value should be the same as before, meaning you couldn't walk then, and you cant walk now.) Keep repeating these methods, until you get a respectable amount of possibilities to search for. Once you start going thru the possibilities, your Walk Thru Walls code, will be the address and the last 4 digits of 0001. And once you put it in shark, it should work.

1. The 'Unknown' Value Search Method: This method is for use with games that Method 1 did not work in. This method, you don't assume what the values are, you just know that they are different based on whether you can walk, or can not walk. Same as before, do an Initial search when you are currently walking. (Character HAS to be moving!) Then when you run into an object/wall, do a different to search. Then walk in the opposite direction, do a different to search. Walk till you hit an object/wall, do another different to search. Then walk back in the opposite direction till you hit an object/wall, do an equal to search. (Because the value should be the same as before, meaning you couldn't walk then, and you cant walk now.) the previous search you took where you couldn't walk.) Keep repeating these methods, until you get a respectable amount of

possibilities to search for. Once you start going thru the possibilities, your Walk Thru Walls code, will be the address and the last 4 digits will be the value the code was when you were walking. And once you put it in shark, it should work.

3D Game Specification

Due to the nature of this method, it may or may not be possible to do with a 3D game. The logic behind it all is this: In a 2D game, you can move at the most in 4 directions, up/down/left/right. In a 3D game, you can move in 360 Degrees, so the developer has to cope with this as well, and probably will use different routines. The above method should still work, provided that when you are running into an object/wall, you are running into it 'Head On'. 'Head On' means, that while holding the direction of the object/wall, you're character doesn't turn, face, or go in any other direction. And in all reality, there's not many places you can do this. Sometimes, you can just hold 'Up' when you are directly facing a wall, and sometimes you cant. When you cant, I suggest trying a corner in a room. :)

Tips & Tricks Of The Trade

Now, there are some key tips to finding this type of code.

• You found the code that lets you walk thru walls, but only in left/right or up/down directions!! DOH!!! Here's what you need to do. Make a Joker Code for the game, and lets just say the code you made works in the 'Right' direction. Lets say, the Joker Code for this game was a normal Joker Code and the code was.

D0123456 ????
And the Walk Thru Walls code you made only worked in the 'Left/Right' directions. If you put in these codes:

D0123456 2000
80XXXXXX XXXX << Walk Thru Walls Code You Made Goes Here.
D0123456 8000
80XXXXXX XXXX << Walk Thru Walls Code You Made Goes Here.

It will now work in the 'Left/Right' directions, with no lock ups. And now, you need to find out the Walk Thru Walls code for the 'Up/Down' directions. So, repeat the searching method used to find the 'Left/Right' code, but this time, walk 'Up' and 'Down'.

• You cant get it down to a lower amount of possibilities. What I would do, is walk in one direction till I hit an object/wall, and do the appropriate search, then walk in the other direction till I hit an object/wall and do an Equal to search. Or even do an Equal to Search while your character is walking in opposite directions. Also, another key way to reduce possibilities, is to do an equal to search in different parts of the map. I.E. If you walked 'Right' till you hit an object/wall, did the appropriate search. Walk up some more on the map, and walk 'Right' till you hit an object/wall up there, and do an Equal to search. (This helps quite a bit usually. Try and make it not be part of the same object/wall though. If you are walking into a house, walk around in the town till you get to a different house, etc..)
• The above 2 methods didn't work. This means the game probably changes the value based on what direction you are heading. So,you need to use search for it in the same direction only. Like so: Initial search while walking 'Right', do an Initial search. Walk till you hit an object/wall, while holding 'Right', do a Different to search. Then walk to the left, and then back to the right till you hit an object/wall, while holding 'Right', do an Equal to search. Then walk to the left, and then back to the right, and while walking 'Right', do a Different to search. Keep repeating these steps only in the 'Right' direction.
• Last but not least, the code you found only works in Towns, or only works in the Overworld Map. Plain and simple almost ALL Walk Thru Walls codes will be like this. You just have to search again in the area where the code doesn't work.

How do you hack Speed Modifiers? (Submitted by Bleeding Gums Murphy)

You start by doing a time trial or something you don't have a time limit on.

1. Once you start, keep your speed at 0 and take an Unknown 16-bit search.
2. Now when it's finished, speed up a little bit.
3. Take a Greater than last search.
4. Now speed up a little more and take a greater than last search again.
5. Now speed up completely and take a greater than last.
6. Now slow down to about half speed and take a less than search.
7. Next speed up a little bit and take a greater than search.
8. Then go back to 0 speed(stop) and take a less than.

Repeat steps 2-8 until you get around 10-30 codes remaining margin. Speed up to the fullest and press the freeze button(the button on your gameshark itself). Try out each code one at a time until you do not slow down when you break. This is the speed mod.
Typically, for most racers, a value of around the 4800's is top speed you can control, but games like Rush 2047 isn't like that.
If one of the codes freezes the game, don't get angry, like I said before, Speed Mods are reletively easy, you'll just have to start again.
You may also like to know that speed mods can be hacked for non-racing games, but they don't help you as much as they should.

Hacking Timers (by Viper187)

Timers can be the easiest thing there is to hack, or the biggest pain in your @$$ since the school bully. It pretty much depends on the game, as to how much trouble a timer can be, since different games store and read their timers in different ways.
The easiest timers are usually the ones that are just a set of digits on the screen counting up or down. I'll give you the steps for a typical countdown timer. For counting up, just reverse the searches (Less <> Greater). This can also work for *some* clock type timers (i.e. "4:36:55"); in that case you'd most likely find one of the left two numbers in that time.

1. Get to the point in the game where the timer is running (duh).
2. Start an Unknown search (16-Bit recommended).
3. Return to the game and let the timer count down just a bit (2 seconds should be sufficient).
4. Now search Less Than.
5. Return to the game and let the timer countdown a bit more.
6. Search Less Than again.
7. If you can restart the timer somehow, do so, then search Greater Than. Otherwise just keep goin Less Than -- your call. When you get the possibilities down to a managable amount, start freezing them and see if your timer freezes. Note that you may want to write down the possibilities in case you freeze the entire game instead of just the timer. ;)
8. Did any of the possibilies work? If they didn't, or for some reason you ended up with none, try this method reversed (search Greater Than where you did Less Than before).
9. Still nothing? This is where things get intersting.

If you couldn't find the timer with the method above, then it may be a 32-Bit timer. These appear a lot on Racing games, but they are seen on other game genres as well. The only way to search for them using the in-game code generator is by using the method above with a small twist. Only do your searches in accordance with 1 part of the timer -- minutes or seconds, never milliseconds. There's a good chance you can find the timer like this. When you get the possibilies narrowed down in this case, look for ones ending in 0,4,8, or C and try them first. If one works then you found the upper 16-Bits of the timer. The part for milliseconds would be the next 16-Bit address (i.e. if 8104440C freezes the minutes/seconds, 8104440E would be for the milliseconds).
Now the easier way to find 32-Bit timers is by using the PC utils/GSCC2k2. What's the advantage? You can actually do 32-Bit searches. You'd just start 32-Bit Unknown value search and do Greater/Less Than in accordance with the -whole timer-. By that I mean, "4:44:50" is LESS than "4:45:20" even though that last part (milliseconds) appears to be Greater.
Think you found your timer code when you stopped the numbers on the screen from counting down? In a good deal of games, this is the case, but there are times when the on screen timer and "real" timer aren't the same thing. When this happens, you basicly have to start at square one and search for the "real timer" using the any and all methods necessary. Also, don't take for granted that the "real" timer will be the same type (32-Bit/16-Bit) or even count in the same direction!! The "real" timer on Starfox 64 eluded me for years because the on screen timer was 32-Bit and counted down, while the "real" timer was only 16-Bit and counted UP! Even the most seasoned hackers need to learn new tricks once in a while, I guess.
If all else fails, you could get creative and start tracing ASM. :-P
Good luck :-)

Hacking Quickstart/Skip Intro Codes (by HyperHacker)

As with certain other code types, the search methods for these are not set in stone. They should work for a lot of games, but don't be suprised if you have to get inventive once in a while.
The easy way is to look for a timer (usually 16-Bit) that counts during the intro. Keep doing Less Than or Greater Than until it restarts, then do the opposite once (if you were doing Less Than do Greater Than, then Less Than again).
The hard way (that works on a lot more games, mind you) only works if the game uses the same address to tell if it's in the intro or title you need to find the byte(s) and do the same as the timer method.
Once you find the timer/flag, you could do a simple ASM trace to find where it writes the intro's value and instead have it do the title, which probably would work a lot better if you could do it.
If all else fails, and you're into ASM, you could find the intro ASM and Jump over it.

Hacking Color Modifiers (by Goldenboy)

Method 1:

Let's say you wanted to modify the crosshair color. Take a screenshot of the game with your GS. Open the pic up in Paint (or whatever) and get the value of the color of the crosshair. Now search for the value with a 32 bit search.

Method 2:

In a game that has the color palette in front of you, like No Mercy... Put your cursor on the Black color and do a 16-bit search for 0000h. Now put your cursor on the white color and search for FFFFh. Then turn it into a 3-line 24 bit code (3 8-Bit codes for Red, Green, and Blue), since most games use 24-Bits for color.

Hacking Image Modifiers (Alternate) - by Icy Guy

This method of hacking image modifiers is used when you have the quantity digits for any image modifier in the game available.
Did that make sense?
If it didn't, read on. If it did, read on anyway.
There are two ways to hack image modifiers - with Unknown Value searches and with Known Value searches. The Unknown Value method is used when the case is just that - you don't know what the quantity digits for an image modifier are. The Known Value search is used when you know the quantity digits for ANY object's image modifier and you want to hack an image modifier for something else.
The Known Value method is covered in this tutorial, since I'm not entirely sure about how to hack image modifiers with the Unknown Value method. I know it involves searching when the image changes, but I'm not up on the specifics. Plus, all of the image mods I've hacked involve the Known Value method.
For this tutorial, I'll be using Banjo-Tooie as an example and I'll be hacking an image mod for Heggy on the Isle 'O Hags.

Here we go...

-Find a list of image modifier values for any object, preferably a complete list. (You can find a complete list starting here) Look at the list until you find the value that will turn an object into Heggy, which is 914 (the list says 0914, but same thing). Punch this number (914) into a calculator capable of converting between hex and decimal (e.g. Windows Calculator, in Scientific Mode), and convert it to decimal. You'll get 2324.
-When you've loaded up 'Tooie go to the Wooded Hollow on the Isle 'O Hags. Locate Heggy's Egg Shed and march on in.
-When Heggy appears on the screen, hit the GS Button to go to the In-Game Menu. Select the Code Generator. Do a 16-bit, Known Value search for 2324 (914 in decimal).
-Check your results. One of these codes SHOULD be the right one. If not, then the game is doing something crazy, like using random addresses for images. If that's the case, I can't help you.
-In this case, the code that turns out to be the correct one is 81132F44 ????.

So, to recap:

-Get a list (preferably complete) of image mod quantity digits for any object. Find the digit that would change the original object to the object you want to modify. Convert this digit to decimal.
-When the object that you want to modify shows up on the screen, do a 16-bit, Known Value search for its value in decimal.
-Check/test your results until you find a code that works.

A few parting notes...
-If you know the general location (in the game's memory) of other image modifiers, you can use those as guides as to where you might find your new code(s). Knowing this really comes in handy when you check your results, as it may eliminate almost all of the guesswork involved when you're trying to find the right code. You should test codes in that general area of memory first - you may not need to test any others after that.
-The locations of image mods differ between games, even if the games are in the same series or are made by the same developers. For example: Banjo-Kazooie stores images in the 803XXXXX area (usually 8035XXXX-8039XXXX), Perfect Dark stores them in the 801DXXXX (maybe even 801C?) area and up (in low-res, at least), and Banjo-Tooie stores them in the 8013XXXX area. Due to this fact, it may be harder to hack a code because the number of results is above 100, and the area of memory that has your code is too high to be displayed until more results are eliminated. Unless of course, you're using an emulator or PC utilities. ;)
-Some objects just can't have their images changed (like the Flibbits in Banjo-Kazooie). Period.
-You may need to exit and reenter a level to see a code's effect if you altered a memory address' value in the results screen.
-Sometimes a code won't work if you try to modify a 3D object's image with a 2D sprite. The reverse also applies.

Finding FF Enable Codes (For Hi-Res Games) by Viper187 & Parasyte

FF enable codes tell the GS where to store your active codes. This is sometimes needed because the shark's default store location is used by a game, which causes it to crash. FF enable codes can fix this. The only catch is, they weren't supported til GS Pro version 3.3.

Ok, to do this you need a hi-res RAM dump of the game that needs the enabler. You can get this in a few ways. The easiest way I've found is Nemu 0.8. When you have the game running in it, and have started a new game and such, go to Plugins > Memory. This looks a lot like the Memory Editor in GS Pro. Now that you're able to view the RAM, either with Nemu as stated or another way, look for a large block of 00s, 256 bytes minimum. The trick here is finding a block of 00s that actually stays 00s while playing, meaning the game doesn't use that area. ever! The address where this block of 00s starts can be your FF code (i.e. FF266610 0000). You'll just have to try it and see if the game will load with that and a code or two on.

source