A Guide to Ability Learning

Background: This is a tutorial based around the subject of Learning Abilities (in that who is to learn said abilities), the number of people in which can learn these abilities and changing Sabin's commands.

Info: This tutorial is broken up into two sections: Changing Who Learns What and Have More than One Character Learn Natural Magic.

Section One: Changing Who Learns What

Information: This section is devoted to changing who learns natural magic, swdtechs, blitzes and dances.

Most of the learning routines are pretty easy to edit, actually. It does not require INSANE hex editing. It generally just involves changing one or two bytes to point to a different character number.

Yes, it does mean you have to use a hex editor, but that's not as hard it seems.

The easiest ones to change are the Natural Learned skills (Terra & Celes' spells, Sabin's Blitzes, and Cyan's SwdTechs).

Here's the code addresses:
Teach Natural Abilities learned via Automatic Level-Up
C0/A17F: B90016 LDA $1600,Y (character ID)

C0/A182: C900 CMP #$00 (is character Terra? note there's no need for this CMP here)
C0/A184: F010 BEQ $A196 (branch if so)
C0/A186: C906 CMP #$06 (is character Celes?)
C0/A188: F02E BEQ $A1B8 (branch if so)
C0/A18A: C902 CMP #$02 (is character Cyan?)
C0/A18C: F04C BEQ $A1DA (branch if so)
C0/A18E: C905 CMP #$05 (is character Sabin?)
C0/A190: D003 BNE $A195 (branch if not)
C0/A192: 4C01A2 JMP $A201
C0/A195: 60 RTS

The CMP commands are what you need to change. See the bolded address? That points character 0, Terra (hex value $00). If you wanted someone else to learn Terra's magic, then you change the value from $00 to, for example, $0A (Mog, actor 10).

If you want Terra to learn SwdTechs, then simply change the
C0/A18A: C902 CMP #$02
from $C902 to $C900.

To find the address in a headered ROM (which is what you have if you've been using FF3usME at all), then you need to translate the C0/A18A address to its raw value. The simple way to do it is to read it as the "C" part becoming 00 in these conversions. And you have to add $200 (the length the header) to the A18A part (or whatever the value is) to make it A38A. So if you open your ROM with a hex editor (any editor will do) and search for the address 000A38A, you should see $C902.

WARNING: Each PC can only have ONE natural learning ability. So if you give Terra SwdTech, she can't have natural magic (you will have to assign it to someone else).

Part 2:
Okay, so now you've changed who learns what at recruitment. This second part is for level-ups. Again, you're only changing one or two bytes.

C2/61B9: C9 00 CMP #$00 (is it character #0, Terra?)
C2/61C0: C9 06 CMP #$06 (is it character #6, Celes?)
C2/61C7: C9 02 CMP #$02 (if it character #2, Cyan?)
C2/61E3: C9 05 CMP #$05 (is it character #5, Sabin?)

Just change the actor numbers to whomever you want.

Code:

00 Terra
01 Locke
02 Cyan
03 Shadow
04 Edgar
05 Sabin
06 Celes
07 Strago
08 Relm
09 Setzer
0A Mog
0B Gau
0C Gogo
0D Umaro

Changing Lore-learning:
C2/36E1: AC 07 30 LDY $3007
C2/36E4: 30 22 BMI $3708 (Exit if Strago not in party)

Change the bolded byte to whomever you want. Be careful about changing too much around here besides that. It's not as stable as the Natural Learning Abilities.

Changing Dance-learning:
C2/5EE5: AD 0A 30 LDA $300A
C2/5EE8: 30 16 BMI $5F00
C2/5EEA: AE E2 11 LDX $11E2 (get combat background)
C2/5EED: BF 5B 8E ED LDA $ED8E5B,X (get corresponding dance #)
Notice how this one isn't labeled? Yeah, this took forever to find. Change the bolded byte to whomever you want.

Changing Sabin's Blitz Commands:
This is the same principle as before. You are simply changing the bytes. Right here is the list of bytes (forgot the actual name) that signal the commands for the Blitzes. The offset is C4/7A40. Do note that the "A" and "B" buttons will be only used for "Accept" and "Cancel" for the input. The final byte is used to tell the game how many button presses there are. The formula for that is very simple; count how many button presses there are (including the "Accept" button) and multiply that by 2 (be sure to keep it in hex numbers, so 5x2 is not 10 it is 0A).

   0E 0A 0E 01 00 00 00 00 00 00 00 08 - Pummel
   08 07 0E 01 00 00 00 00 00 00 00 08 - Aurabolt
   03 04 08 0C 01 00 00 00 00 00 00 0A - Suplex
   0E 07 08 09 0A 01 00 00 00 00 00 0C - Fire Dance
   06 05 06 05 03 04 01 00 00 00 00 0E - Mantra
   0C 0B 0A 09 08 07 0E 01 00 00 00 10 - Air Blade
   06 05 03 04 0A 0E 01 00 00 00 00 0E - Spiraler
   0E 0D 0C 0B 0A 09 08 07 0E 01 00 14 - Bum Rush

   01 - A BUTTON
   02 - B BUTTON
   03 - X BUTTON
   04 - Y BUTTON
   05 - LEFT BUTTON
   06 - RIGHT BUTTON
   07 - DOWN/LEFT
   08 - DOWN
   09 - DOWN/RIGHT
   0A - RIGHT
   0B - UP/RIGHT
   0C - UP
   0D - UP/LEFT
   0E - LEFT

Section Two: Have More than One Character Learn Natural Magic

If you want both Terra and Cyan to learn the same set of spells naturally, you can have both branches point to Terra's Natural Spelllist subroutine.

That's slightly more difficult due to how branching works, but it is possible!

Since it's a cool idea, I'll try to walk you through it. (If you don't want to learn anything, just ignore this and steal the addresses.)

Branching works by basically counting a number of bytes to move forwards or backwards instead of simply jumping to a new offset (that's what a JMP/JSR is).

In our first example, we have a bunch of BEQs (Branch if Equal to value loaded by the CMP preceeding it). These BEQs point to the 4 PCs' different learning subrountines. If you want more than one PC to learn from the same subroutine, you'll have to point their BEQ command to -that- subroutine.

Teach Natural Abilities learned via Automatic Level-Up
C0/A17F: B90016 LDA $1600,Y (character ID)
C0/A182: C900 CMP #$00 (is character Terra? note there's no need for this CMP here)
C0/A184: F010 BEQ $A196 (branch if so)
C0/A186: C906 CMP #$06 (is character Celes?)
C0/A188: F02E BEQ $A1B8 (branch if so)
C0/A18A: C902 CMP #$02 (is character Cyan?)
C0/A18C: F04C BEQ $A1DA (branch if so)
C0/A18E: C905 CMP #$05 (is character Sabin?)
C0/A190: D003 BNE $A195 (branch if not)
C0/A192: 4C01A2 JMP $A201
C0/A195: 60 RTS

So Terra's natural subroutine starts at C0/A196 (000A396 raw), and Celes' starts at C0/A1B8 (000A396 raw). I'm not gonna bother with SwdTech and Blitz because only one person can -learn- those without causing problems (though anyone can -use- them at least!)

Notice that while the commentation notes that Terra's subroutine branches at $A196, the command actually says F0 10. The F0 is the BEQ command. The $10 (16 in regular decimal numbers) is how many bytes to branch forward if the value is equal.

So if you look at where the BEQ points to, it's literally just 16 bytes forward from where it started!
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16
C9 06 F0 2E C9 02 F0 4C C9 05 D0 03 4C 01 A2 60 XX-where the subroutine starts

However, let's say you wanted Cyan (or whoever you want learning things at offset $A18A) to learn Terra's magic skillset. If you just copied Terra's BEQ code into Cyan's space, it would -still- move 16 bytes forward, even though Cyan's branchpoint is further along in the code.

00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16
C9 05 D0 03 4C 01 A2 60 XX YY YY YY YY YY YY YY ZZ - middle of Terra's subrountine, world explodes, game crashes

Do you see the problem? Can you figure out how to fix it?

Clearly we don't want Cyan's branch to go 16 bytes, so we have to tell it to only go 8 bytes to start in the same XX location as Terra's.

So the new BEQ command should be $F0 08.

Using Terra's list:
Terra: $F0 10
Celes: $F0 0C
Cyan: $F0 08
Sabin: $4C 96 A1 (Sabin just jumps to this list since he's last in line~)

Using Celes's list:
Terra: $F0 2A
Celes: $F0 2E
Cyan: $F0 32
Sabin: $4C B8 A1 ($4C is the JMP command, B8 A1 is the offset backwards)

Warning: Don't do this for SwdTech and Blitz, you don't want more than one person learning those at a time anyway. (Generally, unless you really know what you're doing - in which case you probably aren't reading this.)

Part 2:
Same basic idea, but this time for the 'learn a new spell at level up' routine instead of 'at recruitment'.

C2/61B6: A2 00 00 LDX #$0000 (point to start of Terra's magic learned at
level up block)
C2/61B9: C9 00 CMP #$00 (is it character #0, Terra?)
C2/61BB: F0 3F BEQ $61FC (if yes, branch to see if she learns any spells)
C2/61BD: A2 20 00 LDX #$0020 (point to start of Celes' magic learned at
level up block)
C2/61C0: C9 06 CMP #$06 (is it character #6, Celes?)
C2/61C2: F0 38 BEQ $61FC (if yes, branch to see if she learns any spells)
C2/61C4: A2 00 00 LDX #$0000 (point to start of Cyan's SwdTechs learned
at level up block)
C2/61C7: C9 02 CMP #$02 (if it character #2, Cyan?)
C2/61C9: D0 15 BNE $61E0 (if not, check for Sabin)
C2/61CB: 20 22 62 JSR $6222 (are any SwdTechs learned at the current level?)
C2/61CE: F0 51 BEQ $6221 (if not, exit)
~
C2/61E0: A2 08 00 LDX #$0008 (point to start of Sabin's Blitzes learned
at level up block)
C2/61E3: C9 05 CMP #$05 (is it character #5, Sabin?)
C2/61E5: D0 3A BNE $6221 (if not, exit)
C2/61E7: 20 22 62 JSR $6222 (are any Blitzes learned at the current level?)
C2/61EA: F0 35 BEQ $6221 (if not, exit)

You'll notice this time that both Terra and Celes branch to same spot (bolded). This is because the value before the CMP prompt is telling the rom where to look for the spell tables: LDX #$0000 for Terra and LDX #$0020 for Celes. The learning subroutine for innate magic is obviously the same otherwise.

So how to rebranch things? Well, for Terra and Celes's slots, it's easy. Just change the LDX # to $00 00 or $00 20 (note that its backwards in the rom as $20 00).

For Cyan, change his preceeding LDX # to whichever spell list you want (default is $0000 because SwdTechs are listed just before Blitzes on Cyan/Sabin's table). But -then- you have repoint his JSR from the SwdTech learning routine to the magic learning routine. This doesn't even require math. You -know- the Magic learning routine starts at $61FC, so just change that JSR to a JMP $61FC (4C FC 61)!

Warning: This breaks the SwdTech learning routine, so no one can learn SwdTechs (until you beat Cyan's Dream, which auto-enables all SwdTechs). I would only suggest doing this if you're not using SwdTech at all in your hack, as there may be more things related to SwdTech that will try to call this subroutine and then crash your game. (But give it a try if you're brave and don't mind that you need to beat Cyan's Dream for a PC to learn their skillset... it might just work?)

Sabin: His branchpoint is a litte later in the code, but works on the same principle as Cyan's (Change his JSR to JMP $61FC (4C FC 61)). Note that if you make these changes, you -will- break the Blitz-learning routine and if you give a character Blitz, then they will have to meet Duncan before getting any of their skills (or the game will just crash).

Note that these two parts should match. If you have Celes learning Terra's magic at recruitment, you should have her learning Terra's list during the level-up check. I doubt the rom is stable enough to handle having a character learning different skills at recruitment than from level-ups.

For the brave: It -might- work. You're welcome to try on a copy of your rom. Could make for something interesting to have say, Sabin start with a few of Terra's early spells, but then he learns his later Blitzes upon levelling up. Note that anytime level averaging would occur (such as re-recruiting him in the WoR), he'll lose all his learned Blitzes and get more of Terra's spells. Of course, you can always get the Blitzes back by doing the Duncan scene. It's notable that this would only work with Natual Magic lists and something else (can't have both SwdTech and Blitz doing this), since there's actually a stable protocol in place for all PCs to learn Spells due to how Espers work.

Try it out, if you did what I said -should- work and something crashes upon level-up learning, you probably (mistyped something, or) need to add an RTS ($60) command after Cyan's or Sabin's JMP commands in part 2.

I hope that all made sense. It should if you're actually looking at it in a hex editor?

This tutorial is brought to you by Sutebenukun.
The information presented is from a three-way source: Sutebenukun, DjinnAndTonic and Lenophis.

You should probably add that the Blitz command editing can be done much more easily through LordJ's FF3usME ver 6.7B. No hex-editing required.

well, this tutorial is for those who wish to do it via Hex.

nice tutorial!

Nice tutorial but i am using windhex and i cant seem to figure out how to use the code addresses in windhex

Nice tutorial but i am using windhex and i cant seem to figure out how to use the code addresses in windhex

Do you mean that you can't display the offsets (address) like in the tutorial? If it's the case set the "Display as HiRom" option like in this image. You can also use the shortcut Ctrl+Alt+h.

It will then display C2XXXX instead of 02XXXX as an example.

Or were you saying you have a hard time understanding an offset?

And by the way, it's a really nice tutorial Sutebenu. I never really paid much attention to it until now... I didn't know you have some assembly skill and could understand the code that well.

Nice tutorial but i am using windhex and i cant seem to figure out how to use the code addresses in windhex

Do you mean that you can't display the offsets (address) like in the tutorial? If it's the case set the "Display as HiRom" option like in this image. You can also use the shortcut Ctrl+Alt+h.

It will then display C2XXXX instead of 02XXXX as an example.

Or were you saying you have a hard time understanding an offset?

well i sorta didnt understand both


but what i meant was i cant find it in windhex (offset/address) and i did the "Display as HiRom" but i am not sure what it did and i am pretty much a noob to hacking

Open windhex, then load the ROM.

then show us a picture of what you see.

Open windhex, then load the ROM.

then show us a picture of what you see.

ok heres the picture


ya know now that i look at it its somewhat different
i cant believe i didnt see the difference
so yeah though all i see is a very slight difference in the offset maybe
thats what it did anyways im gonna make a few edits to some Blue magic
in my hack until you reply to me

No using huge pictures, it blows the forum XD

From the picture, you can see a clear division between a column on the left and a column on the right, What is in the left columns are ROM addresses, what is at the right is the game's code.