FCE Ultra Cheat Guide

Introduction

FCE Ultra allows cheating by the periodic "patching" of arbitrary addresses in the 6502's memory space with arbitrary values, as well as read substitution. "Read substitution" is the method that would be used on a real NES/Famicom, such as done by the Game Genie and Pro Action Replay. It is required to support GG and PAR codes, but since it is relatively slow when done in emulation, it is not the preferred method when a RAM patch will suffice. Also, in FCE Ultra, read substitution will not work properly with zero-page addressing modes(instructions that operate on RAM at $0000 through $00FF).

The RAM patches are all applied a short time before the emulated vertical blanking period. This detail shouldn't concern most people, though. However, this does mean that cheating with games that use bank-switched RAM may be problematic. Fortunately, such games are not very common (in relation to the total number of NES and Famicom games).

The cheat search comes with its own set of tools for finding addresses in memory to use for making cheats (or for monitoring the addresses in the memory watch window)

Cheat Files

By default cheat files (.cht) are stored in the "cheats" subdirectory under the base FCEUX. The files are in a simple plain-text format. Each line represents a one-byte memory patch. The format is as follows(text in brackets [] represents optional parameters):

   [S][C][:]Address(hex):Value(hex):[Compare value:]Description

Example:

   040e:05:Infinite super power.

A colon(:) near the beginning of the line is used to disable the cheat. "S" denotes a cheat that is a read-substitute-style cheat(such as with Game Genie cheats), and a "C" denotes that the cheat has a compare value.

Note:  When a game is loaded, FCEUX will load any accompanying saved .cht file automatically.

The default .cht file folder can be changed with the Directory Override menu.

The Cheat Search Menu

The cheat search interface consists of several components: a list of addresses and associated data for a search, several command buttons, and the search parameters.

All addresses listed in the cheat search windows are in unsigned 16-bit hexadecimal format and all values in these windows are in an unsigned 8-bit decimal format(the range for values is 0 through 255).

Active Cheats

The Active cheats window on the left contains the list of cheats for the currently loaded game. Existing cheats can be selected, edited, and updated using the "Update" button.

Each entry in the list is in the format of:  * Address = Value

The address is the location in the 6502's address space.  The * denotes that the current cheat is active (double clicking will toggle on/off).  Value is the value (in hex) that the addresses has been locked into.

You can add, delete, and update cheats in the active cheats window with the boxes below.

To find an address use the cheat search portion of the window.

There is also a right-click menu with the options Toggle Cheat, Poke Cheat Value, and Goto In Hex Editor.

Toggle Cheat is like Double Clicking. It enables or disables the cheat code.

Poke Cheat Value is like turning the cheat on, but in this case there's no off switch. If the code is on when you use this, then when the code is turned off, it will revert to the value last used. Good for one time life refills, if you want that sort of thing.

Goto in Hex Editor opens the Hex Editor window, and puts the cursor on the address shown. It's somewhat similar to how Bookmarks work in the Hex Editor.

Cheat Search

The cheat search is used to find a specific value in the games RAM by process of elimination.

The possibilities window is in the format of  Address:Original Value:Current Value

The address is the location in the 6502's address space, the original value is the value that was stored at this address when the search was reset, and the current value is the value that is currently stored at that address. Selecting an item in this list will automatically cause the "Address" field in the cheat information box on the right side of the window to be updated with the selected address.

The "Reset" button resets the search process; all valid addresses are displayed in the possibilities window and the data values at those addresses noted in both the left and right columns.  The number of possibilities is displayed at the top.  Resetting will set it to 2048 or 10240 depending on if the game uses "On cartridge ram" ($6000-$7FFF).  (See NES RAM)

The left column is the "previous value" and the right column is the "current value"

The "Known Value", "Equal", "Not Equal", Greater than" and Less than" buttons perform a search based on the search parameter and removes any non-matching addresses from the address list.   It then sets the "previous value" column to the contents of the "current value"

"Known Value" will search for all addresses that match the value in the box to the right (the value is in hex).

"Equal" will search for all addresses that have the same value now as the last search (or since reset was pressed, if there has not yet been a search).

"Not equal" will search for all addresses that have changed sine the last search (or since reset was pressed, if there has not yet been a search).

If the checkbox next to it is checked it will looks for values that have changed by the value in the number box to the right.  For instance, if it is checked and the number is 5, it will search for all values that are +- 5 from the previous value.

"Greater than" functions like "Not equal" except it only searches for values that have increased since the last search.

"Less than" functions like "Not equal" except it only searches for values that have decreased since the last search.

Using the Results

Any value in the possibilities list can be sent to memory watch by double clicking it.  

Highlighting it and hitting the "Add" button under the Active cheats window will automatically activate it as a cheat with the value set to its current value.

Example

Here is an example of cheat search in action.

Let's say I am playing Mega man 3 and I want to find Mega man's energy level in the game's ram.  I will start by opening the ROM and selecting a level.  At this point, I know Mega man's energy address is active.  So I will pause the game and open the cheat search and hit the reset button.  The game uses SRAM so the possibilities window will say 10240 "possibilities".  

Next I will frame advance (or briefly unpause) the game.  At this point I know Mega man's energy level is still the same as it was.  So I click the "equal" button.   Next I want to take damage.  I know for sure now that the energy level has decreased so after the "ouch" animation, I click the "Less than button".  This will cut the possibilities down significantly.  Next I will advance some more and click the "Equal" button since I know the value is still the previous value.  I will repeat this cycle until I am down to 1 or just a few values.  From there I can double click the values to send them to memory watch to monitor them more closely to weed them out.  (Note:  Mega man's energy is located in $00A2).

Context Menu

Right-clicking in the active cheats list brings up the context menu.

Toggle Cheat - does the same thing as double clicking

Poke cheat value - has a different affect that normal freezing, this makes a one time write of that value as opposed to freezing it temporarily to that value and having it restored later.  It has the same affect as typing in values in the Hex Editor.

Goto In Hex Editor - Opens the Hex editor dialog to the position of the selected RAM value.

Created with the Personal Edition of HelpNDoc: Easy CHM and documentation editor