===================================================== IN ORDER TO USE THIS DOCUMENT ===================================================== This document lists the hex addresses of the decrypted EBOOT.BIN file from Final Fantasy IV - The Complete Collection on PSP. The EBOOT file contains most of the data for FFIV and the Interlude chapter, but does not contain much, if any, data from The After Years. The easiest way to get a decrypted EBOOT.BIN file is to use PPSSPP. Go into [Settings > Tools > Developer Tools] and check the box for "Dump decrypted EBOOT.BIN on game boot". Then, launch the game. After it launches, exit PPSSPP, and go into whichever folder is configured to save PPSSPP data (on my Windows computer, it is "My Documents). Go to the folders [PSP > SYSTEM > DUMP] and your decrypted BIN file will be waiting there. Copy this to a safe location, and rename it to EBOOT.BIN. When you are done with your changes, you can re-insert the EBOOT.BIN file using UMDGen. ===================================================== SPELL LISTS ===================================================== There are 2 types of spell lists in Final Fantasy IV. "Initial" lists are written to a character from, as far as I can tell, the beginning of the game. These lists contain 1 byte per spell. "Learned" lists are spells that are learned upon level up, and contain 3 or 4 bytes per level. Note for hackers: The GBA and PSP versions of the spell lists are identical. However, since the PSP Eboot contains data for both the original FFIV and FFIV ~ Interlude, the PSP has 13 additional spell lists sandwiched in-between the GBA data for the Interlude characters. It should also be noted that the spell lists between FFIV and FFIV ~ Interlude are identical. The reason they are stored differently is because characters start at Level 30+. Thus, spells are transferred from the character's "Learned" list to their "Initial" list. NUMBER Offset* Character Type Color Game [01] 283B7A Cecil Paladin Initial White FFIV [02] 283B7C Cecil Paladin Learned White FFIV [03] 283B8C Cecil Paladin Initial White Interlude [04] 283B93 Rosa Initial White FFIV [05] 283B99 Rosa Learned White FFIV [06] 283BCE Rosa Initial White Interlude [07] 283BE0 Rosa Learned White Interlude [08] 283BF6 Rydia Initial Summon FFIV [09] 283BF8 Rydia (Child) Learned White FFIV [10] 283C02 Rydia Learned Black FFIV [11] 283C3F Rydia Initial Summon Interlude [12] 283C4A Rydia Initial Black Interlude [13] 283C5C Rydia Learned Black Interlude [14] 283C7C Tellah Initial White FFIV [15] 283C82 Tellah Initial Black FFIV [16] 283C82 Palom Initial Black FFIV [17] 283C88 Palom Learned Black FFIV [18] 283CC0 Palom Initial Black Interlude [19] 283CD3 Palom Learned Black Interlude [20] 283CE6 Porom Initial White FFIV [21] 283CEC Porom Learned White FFIV [22] 283D24 Porom Initial White Interlude [23] 283D37 Porom Learned White Interlude [24] 283D4A Edge Initial Ninjutsu FFIV [25] 283D4C Edge Learned Ninjutsu FFIV [26] 283D56 Edge Initial Ninjutsu Interlude [27] 283D5D FuSoYa Initial White FFIV [28] 283D76 FuSoYa Initial Black FFIV [29] 283D8F Rydia? (Adult) Initial Black Interlude [30] 283D9E Rydia? (Adult) Learned Black Interlude *Note: Offsets are listed by their actual address in a hex editor. The EBOOT file has a header that is C0 bytes in size, so the game treats each of these as if they were C0 less. Example, 283B7A is the actual hex address of Cecil's initial magic, but the hex address, as far as the game is concerned, is 283ABA. ===================================================== MAGIC LIST POINTERS ===================================================== Each character has 2 pointer blocks. The first pointer block is for their initial magic, the second for their magic learned at level up. Each block contains 16 bytes of data, 4 for each type of magic. Take Rydia's learned block for example. OFFSET: 28/3FF0 38 3B 28 00 <--This is where her White Magic learned list begins (28/3BF8) 42 3B 28 00 <--This is where her Black Magic learned list begins (28/3C02) 00 00 00 00 <--If Rydia learned Summon Magic at level-up, the pointer would go here.* 00 00 00 00 <--If Rydia learned Ninjutsu at level-up, the pointer would go here. *Interestingly, there are no characters that learn Summon Magic at level-up. INITIAL MAGIC 283DC0 - Cecil Dark Knight 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283DD0 - Kain 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283DE0 - Rosa D3 3A 28 00 > 283B93 00 00 00 00 00 00 00 00 00 00 00 00 283DF0 - Rydia Child 00 00 00 00 00 00 00 00 36 3B 28 00 > 283BF6 00 00 00 00 283E00 - Cid 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283E10 - Tellah B5 3B 28 00 > 283C7C BC 3B 28 00 > 283C82 00 00 00 00 00 00 00 00 283E20 - Edward 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283E30 - Yang 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283E40 - Palom 00 00 00 00 C2 3B 28 00 > 283C82 00 00 00 00 00 00 00 00 283E50 - Porom 26 3C 28 00 > 283CE6 00 00 00 00 00 00 00 00 00 00 00 00 283E60 - Edge 00 00 00 00 00 00 00 00 00 00 00 00 8A 3C 28 00 > 283D4A 283E70 - FuSoYa 9D 3C 28 00 > 283D5D B6 3C 28 00 > 283D76 00 00 00 00 00 00 00 00 283E80 - Cecil Paladin BA 3A 28 00 > 283B7A 00 00 00 00 00 00 00 00 00 00 00 00 283E90 - Rydia Adult 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Interlude initial 283EA0 - Cecil Dark Knight (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283EB0 - Kain (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283EC0 - Rosa Interlude 0E 3B 28 00 00 00 00 00 00 00 00 00 00 00 00 00 283ED0 - Rydia Child Interlude? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283EE0 - Cid Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283EF0 - Tellah (Dummy) B5 3B 28 00 BC 3B 28 00 00 00 00 00 00 00 00 00 283F00 - Edwary (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283F10 - Yang Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283F20 - Palom Interlude 00 00 00 00 00 3C 28 00 00 00 00 00 00 00 00 00 283F30 - Porom Interlude 64 3C 28 00 00 00 00 00 00 00 00 00 00 00 00 00 283F40 - Edge Interlude 00 00 00 00 00 00 00 00 00 00 00 00 96 3C 28 00 283F50 - FuSoYa (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283F60 - Cecil Paladin Interlude CC 3A 28 00 00 00 00 00 00 00 00 00 00 00 00 00 283F70 - Rydia Adult (Dummy) 00 00 00 00 8B 3B 28 00 7F 3B 28 00 00 00 00 00 283F80 - Golbez or Tellah 2?(Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283F90 - Rydia? Interlude 00 00 00 00 CF 3C 28 00 00 00 00 00 00 00 00 00 283FA0 - Monk A Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283FB0 - Monk B Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 LEARNED MAGIC 283FC0 - Cecil Dark Knight 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283FD0 - Kain 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 283FE0 - Rosa D9 3A 28 00 00 00 00 00 00 00 00 00 00 00 00 00 283FF0 - Rydia Child 38 3B 28 00 42 3B 28 00 00 00 00 00 00 00 00 00 284000 - Cid 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284010 - Tellah 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284020 - Edward 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284030 - Yang 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284040 - Palom 00 00 00 00 C8 3B 28 00 00 00 00 00 00 00 00 00 284050 - Porom 2C 3C 28 00 00 00 00 00 00 00 00 00 00 00 00 00 284060 - Edge 00 00 00 00 00 00 00 00 00 00 00 00 8C 3C 28 00 284070 - FuSoYa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284080 - Cecil Paladin BC 3A 28 00 00 00 00 00 00 00 00 00 00 00 00 00 284090 - Rydia Adult 00 00 00 00 42 3B 28 00 00 00 00 00 00 00 00 00 INTERLUDE 2840A0 - Cecil Dark Knight (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2840B0 - Kain (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2840C0 - Rosa Interlude 20 3B 28 00 00 00 00 00 00 00 00 00 00 00 00 00 2840D0 - Rydia (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2840E0 - Cid Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2840F0 - Tellah (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284100 - Edward (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284110 - Yang Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284120 - Palom Interlude 00 00 00 00 13 3C 28 00 00 00 00 00 00 00 00 00 284130 - Porom Interlude 77 3C 28 00 00 00 00 00 00 00 00 00 00 00 00 00 284140 - Edge Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284150 - FuSoYa (Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284160 - Cecil Paladin Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284170 - Rydia Adult Interlude 00 00 00 00 9C 3B 28 00 00 00 00 00 00 00 00 00 284180 - Golbez or Tellah 2?(Dummy) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 284190 - Rydia? Interlude 00 00 00 00 DE 3C 28 00 00 00 00 00 00 00 00 00 2841A0 - Monk A Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2841B0 - Monk B Interlude 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ====================================================== SPELLS IN EACH LIST ====================================================== For initial spell lists, 1 byte is given per spell, with no level data. The list is ended with an "FF". So Palom's initial black list reads 1D 20 23 29 1C FF Meaning that Palom starts with Fire (1D), Blizzard (20), Thunder (23), Sleep (29), and Poison (1C). For learned spell list, 3 or 4 bytes are given per level that a spell is learned at. Byte 1 contains the level where the character learns the spell, byte 2 contains the index number of the spell, and byte 3 contains "00", indicating "end of list". For example, take the following hex data from Cecil's list: 03 17 00 The first byte, 03, indicates that Cecil learns a spell at level 3. The second byte, 17, indicates that he learns spell 17 (Sight). The third byte, 00, says that this is the end of the list for level 3. There are 3 cases where a character will learn 2 spells at level up. In that case, there are 4 bytes of hex data. The 1st is the level, the 2nd and 3rd are the 2 spells, and the fourth is 00, indicating the end of the list. SPELL INDEX WHITE MAGIC BLACK MAGIC SUMMON MAGIC 01 Hold 19 Toad 31 Goblin 02 Silence 1A Pig 32 Bomb 03 Confuse 1B Warp 33 Cockatrice 04 Blink 1C Poison 34 Mind Flayer 05 Protect 1D Fire 35 Chocobo 06 Shell 1E Fira 36 Shiva 07 Slow 1F Firaga 37 Ramuh 08 Haste 20 Blizzard 38 Ifrit 09 Berserk 21 Blizzara 39 Titan 0A Reflect 22 Blizzaga 3A Dragon 0B Holy 23 Thunder 3B Sylph 0C Dispel 24 Thundara 3C Odin 0D Scan 25 Thundaga 3D Leviathan 0E Cure 26 Bio 3E Asura 0F Cura 27 Tornado 3F Bahamut 10 Curaga 28 Quake 11 Curaja 29 Sleep TWIN MAGIC 12 Esuna 2A Break 40 Comet 13 Life 2B Death 41 Pyroblast 14 Full-Life 2C Stop 15 Mini 2D Drain NINJUTSU 16 Teleport 2E Osmose 42 Flame 17 Sight 2F Meteor 43 Flood 18 Float 30 Flare 44 Blitz 45 Smoke 49 Heal* 48 Mage Arrow* 46 Shadowbind 4A Basuna* 4C Dancing Dagger* 47 Mirage 4B Poisona* *Heal, Basuna, Poisona, Mage Arrow, and Dancing Dagger are Black and White spells cast by using equipped staves and rods as items. When hacked into the game, they function correctly--they have correct menu names, effects, and targeting data--but they cost 0MP and have no associated help text. These spells cannot be hacked in with the GBA version of the game. ADDITIONAL NINJUTSU From 4D to FF, enemy attacks and items exist within the code. These can all be hacked into the game, and will function on whatever list you put them on. However, they will cost 0MP, show no text or the wrong text when learned, and often don't have correct targeting data, since the enemies will always target your party. One block of commands seems to add in Ninjutsu Spells from The After Years. With additional hacking, these spells could potentially be completed and added to characters. DF Flame EB Tremor E0 Flood EC Flash E1 Shock ED Stealth Kill E2 Gale EE Payback Wave E3 Heal Pill E4 Heal Salve Note that "Frost" is nowhere to be found E5 Restore Weed E6 Smelling Salts ===================================================== ACTUAL SPELL LISTS ===================================================== [01] Cecil Paladin - Initial White (FFIV) 0E Cure FF END [02] Cecil Paladin - Learned White (FFIV) 03 17 00 03 Sight 08 0D 00 08 Scan 0F 0F 00 15 Cura 13 16 00 19 Teleport 18 12 00 24 Esuna FF END [03] Cecil Paladin - Initial White (Interlude) Note: Cecil starts with all of his spells in the Interlude. 0E Cure 17 Sight 0D Scan 0F Cura 16 Teleport 12 Esuna FF END [04] Rosa - Initial White (FFIV) 0E Cure 01 Hold 0D Scan 07 Slow 17 Sight FF END [05] Rosa - Learned White (FFIV) 0B 13 00 11 Life 0C 05 00 12 Protect 0D 0F 00 13 Cura 0F 02 00 15 Silence 12 12 00 18 Esuna 14 09 00 20 Berserk 17 04 00 23 Blink 18 03 00 24 Confuse 1D 06 00 29 Shell 1E 10 15 00 30 Curaga/Mini 1F 0C 00 31 Dispel 21 08 00 33 Haste 23 18 00 35 Float 24 0A 00 36 Reflect 26 11 00 38 Curaja 2D 14 00 45 Full-Life 37 0B 00 55 Holy FF END [06] Rosa - Initial White (Interlude) 0E Cure 01 Hold 0D Scan 07 Slow 17 Sight 13 Life 05 Protect 0F Cura 02 Silence 12 Esuna 09 Berserk 04 Blink 03 Confuse 06 Shell 10 Curaga 15 Mini 16 Teleport FF END [07] Rosa - Learned White (Interlude) 1F 0C 00 31 Dispel 21 08 00 33 Haste 23 18 00 35 Float 24 0A 00 36 Reflect 26 11 00 38 Curaja 2D 14 00 45 Full-Life 37 0B 00 55 Holy FF END [08] Rydia - Initial Summon (FFIV) NOTE: Rydia does not learn summons through level up. She only learns them through events and items. 35 Chocobo FF END [09] Rydia (Child) - Learned White (FFIV) 03 0E 00 3 Cure 04 17 00 4 Sight 07 01 00 7 Hold FF END [10] Rydia (Child) - Learned Black (FFIV) NOTE: Rydia also gains the spells Fire, Fira, Blizzara, and Thundara through events NOTE: In GBA version, this list is used for both Child and Adult Rydia 02 20 00 2 Blizzard 05 23 00 5 Thunder 08 29 00 8 Sleep 0A 1C 00 10 Poison 0C 1B 00 12 Warp 0D 19 00 13 Toad 0F 2C 00 15 Stop 14 1A 00 20 Pig 1A 26 00 26 Bio 20 2E 00 32 Osmose 24 2D 00 36 Drain 27 22 00 39 Blizzaga 2A 1F 00 42 Firaga 2D 25 00 45 Thundaga 2F 28 00 47 Quake 31 2A 00 49 Break 33 27 00 51 Tornado 34 2B 00 52 Death 37 30 00 55 Flare 3C 2F 00 60 Meteor FF END [11] Rydia - Initial Summon (Interlude) 35 Chocobo 3A Dragon 39 Titan 36 Shiva 37 Ramuh 38 Ifrit 3B Sylph 3C Odin 3D Leviathan 3E Asura 3F Bahamut FF END [12] Rydia - Initial Black (Interlude) 20 Blizzard 23 Thunder 29 Sleep 1C Poison 1B Warp 19 Toad 2C Stop 1A Pig 26 Bio 2E Osmose 2D Drain 22 Blizzaga 1D Fire 1E Fira 21 Blizzara 24 Thundara FF END [13] Rydia - Learned Black (Interlude) 2A 1F 00 42 Firaga 2D 25 00 45 Thundaga 2F 28 00 47 Quake 31 2A 00 49 Break 33 27 00 51 Tornado 34 2B 00 52 Death 37 30 00 55 Flare 3C 2F 00 60 Meteor FF END [14] Tellah - Initial White (FFIV) NOTE: Tellah later learns every White Magic Spell through an event 0F Cura 03 Confuse 04 Blink 12 Esuna 13 Life 16 Teleport FF END [15] Tellah - Initial Black (FFIV) NOTE: Tellah later learns every Black Magic Spell through an event 1D Fire 20 Blizzard 23 Thunder 2C Stop 2E Osmose FF END [16] Palom - Initial Black (FFIV) 1D Fire 20 Blizzard 23 Thunder 29 Sleep 1C Poison FF END [17] Palom - Learned Black (FFIV) 0B 21 1A 00 11 Blizzara/Pig 0C 1E 00 12 Fira 0D 24 00 13 Thundara 0E 2C 00 14 Stop 13 26 00 19 Bio 16 19 00 22 Toad 17 28 00 23 Quake 1A 2D 00 26 Drain 1D 1B 00 29 Warp 20 22 00 32 Blizzaga 21 1F 00 33 Firaga 22 25 00 34 Thundaga 24 2A 00 36 Break 28 2E 00 40 Osmose 2E 2B 00 46 Death 30 27 00 48 Tornado 32 2F 00 50 Meteor 34 30 00 52 Flare FF END [18] Palom - Initial Black (Interlude) 1D Fire 20 Blizzard 23 Thunder 29 Sleep 1C Poison 21 Blizzara 1A Pig 1E Fira 24 Thundara 2C Stop 26 Bio 19 Toad 28 Quake 2D Drain 1B Warp 22 Blizzaga 1F Firaga 25 Thundaga FF END [19] Palom - Learned Black (Interlude) 24 2A 00 36 Break 28 2E 00 40 Osmose 2E 2B 00 46 Death 30 27 00 48 Tornado 32 2F 00 50 Meteor 34 30 00 52 Flare FF END [20] Porom - Initial White (FFIV) 0E Cure 01 Hold 0D Scan 07 Slow 17 Sight FF END [21] Porom - Learned White (FFIV) 0B 13 00 11 Life 0C 05 00 12 Protect 0D 0F 00 13 Cura 0F 02 00 15 Silence 12 09 00 18 Berserk 13 16 00 19 Teleport 14 12 00 20 Esuna 17 04 00 23 Blink 19 03 00 25 Confuse 1D 06 00 29 Shell 1F 15 0C 00 31 Mini/Dispel 21 10 00 33 Curaga 26 08 00 38 Haste 28 18 00 40 Float 2C 0A 00 44 Reflect 30 11 00 48 Curaja 34 0B 00 52 Holy 38 14 00 56 Full-Life FF END [22] Porom - Initial White (Interlude) 0E Cure 01 Hold 0D Scan 07 Slow 17 Sight 13 Life 05 Protect 0F Cura 02 Silence 09 Berserk 16 Teleport 12 Esuna 04 Blink 03 Confuse 06 Shell 15 Mini 0C Dispel 10 Curaga FF END [23] Porom - Learned White (Interlude) 26 08 00 38 Haste 28 18 00 40 Float 2C 0A 00 44 Reflect 30 11 00 48 Curaja 34 0B 00 52 Holy 38 14 00 56 Full-Life FF END [24] Edge - Initial Ninjutsu (FFIV) 42 Flame FF END [25] Edge - Learned Ninjutsu (FFIV) 1B 46 00 27 Shadowbind 21 45 00 33 Smoke 26 47 00 38 Mirage FF END [26] Edge - Initial Ninjutsu (Interlude) Note: Edge starts with all of his spells in the Interlude. 42 Flame 46 Shadowbind 45 Smoke 47 Mirage 43 Flood 44 Blitz FF END [27] FuSoYa - Initial White (FFIV) Note: FuSoYa knows every White Magic Spell 01 Hold 02 Silence 03 Confuse 04 Blink 05 Protect 06 Shell 07 Slow 08 Haste 09 Berserk 0A Reflect 0B Holy 0C Dispel 0D Scan 0E Cure 0F Cura 10 Curaga 11 Curaja 12 Esuna 13 Life 14 Full-Life 15 Mini 16 Teleport 17 Sight 18 Float FF END [28] FuSoYa - Initial Black (FFIV) Note: FuSoYa knows every Black Magic Spell 19 Toad 1A Pig 1B Warp 1C Poison 1D Fire 1E Fira 1F Firaga 20 Blizzard 21 Blizzara 22 Blizzaga 23 Thunder 24 Thundara 25 Thundaga 26 Bio 27 Tornado 28 Quake 29 Sleep 2A Break 2B Death 2C Stop 2D Drain 2E Osmose 2F Meteor 30 Flare FF END [29] Rydia? (Adult) - Initial Black (Interlude) 20 Blizzard 23 Thunder 29 Sleep 1C Poison 1B Warp 19 Toad 2C Stop 1A Pig 26 Bio 2E Osmose 1D Fire 1E Fira 21 Blizzara 24 Thundara FF END [30] Rydia? (Adult) - Learned Black (Interlude) 24 2D 00 36 Drain 27 22 00 39 Blizzaga 2A 1F 00 42 Firaga 2D 25 00 45 Thundaga 2F 28 00 47 Quake 31 2A 00 49 Break 33 27 00 51 Tornado 34 2B 00 52 Death 37 30 00 55 Flare 3C 2F 00 60 Meteor FF END