TTYD - Coin Address Hunting

Let's take a look at how we can find the address of a value. We'll try something that's very easy to change and see immediately if it works: coins.

Open the Cheats Manager, go to Start New Cheat Search. Accept the default range and click 'New Search'.

Go to a shop. Make a save state here. The game actually re-calculates the addresses where coins are stored between areas and even saves, so we want to eliminate any variation. You will be using this save state every time you want to investigate the coin mystery.

Note how many coins you have. In my case, I have 61. Convert that to hex. 61 in hex is 0x3d. Write that down somewhere, as we will want to have easy access to this value.

For our magic trick, we need to change the value of the coins by a known amount. I will buy an item that is 5 coins, so I will end up with 56 coins. That's 0x38 in hex. Write your final amount in hex somewhere. Now, don't buy anything yet.

Go back to the cheat search. Search for the amount of coins you currently have in hex. You can see here I am searching for 3d. Click 'search and filter.'

This will return a lot of addresses that are currently storing your value - 413 in my case. We can't possible look through all of these! So what we're going to do is change the amount of coins we have to a known value (56, as I mentioned earlier), and then filter within these addresses for ones that have changed to the new value. That should dramatically narrow the amount of addresses to investigate.

Let's decrease our coin count. Buy the item. I bought a 5-coin Point Swap to bring me down to 56 coins.

Check your status and you'll see that the coin amount changed.

Go back to the cheat search where you had all those hundreds of addresses. In the search bar, enter the hex value of your new coin amount. In my case, 38. Click 'search and filter'. In my case, of all those addresses that we had, only one of them updated to '38', and that is... 0x80d1eba4! We found something! You can double click the empty 'description' space to write something to help you find it again. I wrote 'coin', for example. Mark this address in the same document where you're marking the hex values for your coins.

(NOTE: if this does not work, try the whole thing over again. Click 'reset results'. Filter for memory addresses whose current value is 38. Buy another item, convert the value to hex, and then filter again. Sometimes the address doesn't appear for reasons beyond my current ken, and buying an item again causes it to appear.)

Let's look for the address in Memory. Go to the Memory tab. What's with the dashes? Turns out you cannot see the values in the memory addresses while the game is running. Probably because half of them would be constantly changing. Click the 'pause' button.

Now that we are paused, we can see the hex values in memory. Nice! The game, of course, will not be running. Let us look for the address we had stored: 0x80d1eba4

On the right hand side, where you see 'import export', there is an empty box and next to it, it says 'offset'. Copy/paste your address there. you will be taken to the address.

Look!! You can see the 38 there. Let's try to change it...

I've decided I want 100 (0x64) coins. Let's double click, enter the value, then enter. Go back to the game and unpause.

Hmm? Nothing happened. In fact if you walk around a bit, open the menu, prepare to sell something but don't actually sell, you will notice that the value actually resets. Looks like something may be overwriting this value. But what does this value control?

Let's try something else. Talk to the merchant and offer to sell something. Pause the game.

let's go back and change it to FF. rerun the program...

It starts at the value we want and then cycles back to 56! Something is definitely overwriting this value. It looks like this value controls things like the display of the coins when buying stuff, but not the actual amount of coins we have. Seems to be used for triggering animations. But how can we find the original value? We will discuss this in the next article.