This is how I found some of the codes I have found. I'll probably add more to this and for a few other games too over time. I'm posting this in the hopes that anybody could learn from this, because finding some codes isn't hard to do. It's quite easy. I don't know much of anything, and I still find stuff. Many people should be giving it a try, you'd be surprised by how many useful things you can find just guessing, because I know I'm surprised by how much I find by guessing.



I don't know how some people start finding codes, I'm figuring out some blind ways of starting off though that tend to lead me to things. 1 that has recently lead me to some goodies while crashing games far less than I expected is searching for branches that only skip a few lines. The order I search for is like this:

"0008 ble"
"000C ble"
"0010 ble"
"0014 ble"

"0008 bge"
"000C bge"
"0010 bge"
"0014 bge"

"0008 blt"
"000C blt"
"0010 blt"
"0014 blt"

"0008 bgt"
"000C bgt"
"0010 bgt"
"0014 bgt"

I hunt down every instance of these in that order and change them to "nop" with the value "60000000". These are good to do because many things that have limits in games are usually just a branch like these that rarely skip more than a few lines. Every code I have found for Silent Hill Homecoming was found because of these 6 lines:

"0008 ble"
"000C ble"
"0010 ble"
"0008 bge"
"000C bge"
"0010 bge"

From what I recall of Disgaea 3, the majority of those codes could have been found using this method too.




Another thing I search for is floats, mainly of "1" which is "3F800000". They are created with "lis" operations. These are all possibilities:

3C003F80
3C203F80
3C403F80
3C603F80
3C803F80
3CA03F80
3CC03F80
3CE03F80
3D003F80
3D203F80
3D403F80
3D603F80
3D803F80
3DA03F80
3DC03F80
3DE03F80
3E003F80
3E203F80
3E403F80
3E603F80
3E803F80
3EA03F80
3EC03F80
3EE03F80
3F003F80
3F203F80
3F403F80
3F603F80
3F803F80
3FA03F80
3FC03F80
3FE03F80

I change the "3F80" part to "0000" and then try it out. These seem to crash a game about as much as the branches way does. Everything I found for Infamous 1 and nearly everything I found for Dead Space 2 was because I started using this method.




Dead Space 2 - Infinite Use Of Med Packs & Stasis Packs
I don't know if this will lead anywhere, but I'm looking at Skiller's code for max credits upon gaining credits at address 0x00216AC4. I searched for "blr" above it to see where the function starts. It starts at address 0x00216878 and ends at address 0x00216F04. I change it from:

00216878: 7B970020	rldicl	r23,r28,0,1

to:

00216878: 4E800020	blr

The effects I notice:
1. When I pick up credits, the game freezes.
2. When I heal myself, the game freezes.
3. When I restore my stasis with a stasis pack, the game freezes.

I'm interested in #2 and #3.
I then change address 0x00216878 back to what it was:

00216878: 7B970020	rldicl	r23,r28,0,1

I'm thinking to cancel all store operations, so I do:

002168C8: 90010074	stw	r0,116(r1)

002168D8: 91210080	stw	r9,128(r1)

002168E8: F8410028	std	r2,40(r1)

0021692C: F8410028	std	r2,40(r1)

00216950: F8410028	std	r2,40(r1)

00216990: 90010074	stw	r0,116(r1)

002169A0: 9121007C	stw	r9,124(r1)

002169B0: F8410028	std	r2,40(r1)

00216A58: 90010074	stw	r0,116(r1)

00216A68: 91210070	stw	r9,112(r1)

00216A78: F8410028	std	r2,40(r1)

00216AD4: 906B0028	stw	r3,40(r11)

00216B20: F8410028	std	r2,40(r1)

00216B34: 93F90260	stw	r31,608(r25)

00216C00: F8410028	std	r2,40(r1)

00216C58: F8410028	std	r2,40(r1)

00216C90: 900100C0	stw	r0,192(r1)

00216C9C: 912100C4	stw	r9,196(r1)

00216CA8: 900100C8	stw	r0,200(r1)

00216CB0: 914100CC	stw	r10,204(r1)

00216CDC: D00300F0	stfs	f0,240(r3)

00216CFC: F821FE81	stdu	r1,-384(r1)

00216D04: FB410150	std	r26,336(r1)

00216D08: FBA10168	std	r29,360(r1)

00216D18: FBC10170	std	r30,368(r1)

00216D24: FB610158	std	r27,344(r1)

00216D28: FBE10178	std	r31,376(r1)

00216D2C: FB010140	std	r24,320(r1)

00216D30: FB210148	std	r25,328(r1)

00216D34: FB810160	std	r28,352(r1)

00216D38: F8010190	std	r0,400(r1)

00216D8C: D0010080	stfs	f0,128(r1)

00216D9C: D1A10084	stfs	f13,132(r1)

00216DA4: D0010088	stfs	f0,136(r1)

00216DA8: 9001008C	stw	r0,140(r1)

00216E28: F8010070	std	r0,112(r1)

00216E50: F8410028	std	r2,40(r1)

00216E90: 900100A0	stw	r0,160(r1)

00216EC0: 915F0000	stw	r10,0(r31)

I change all 39 of them to do nothing:

002168C8: 60000000	nop

002168D8: 60000000	nop

002168E8: 60000000	nop

0021692C: 60000000	nop

00216950: 60000000	nop

00216990: 60000000	nop

002169A0: 60000000	nop

002169B0: 60000000	nop

00216A58: 60000000	nop

00216A68: 60000000	nop

00216A78: 60000000	nop

00216AD4: 60000000	nop

00216B20: 60000000	nop

00216B34: 60000000	nop

00216C00: 60000000	nop

00216C58: 60000000	nop

00216C90: 60000000	nop

00216C9C: 60000000	nop

00216CA8: 60000000	nop

00216CB0: 60000000	nop

00216CDC: 60000000	nop

00216CFC: 60000000	nop

00216D04: 60000000	nop

00216D08: 60000000	nop

00216D18: 60000000	nop

00216D24: 60000000	nop

00216D28: 60000000	nop

00216D2C: 60000000	nop

00216D30: 60000000	nop

00216D34: 60000000	nop

00216D38: 60000000	nop

00216D8C: 60000000	nop

00216D9C: 60000000	nop

00216DA4: 60000000	nop

00216DA8: 60000000	nop

00216E28: 60000000	nop

00216E50: 60000000	nop

00216E90: 60000000	nop

00216EC0: 60000000	nop

I tested it, and my health and stasis still increased when I used a med pack or stasis pack, so nothing in this function writes to either of them. I did notice that when I used a med pack or stasis pack, they didn't disappear from my inventory, and I could keep using them. This didn't affect ammo or nodes though, and I could still normally move or sell any item. Considering when you use a med pack or stasis pack, you lose 1 of them. So I must be looking for a subtraction operation that subtacts 1 from something. So I make a copy of the unmodified EBOOT.ELF because that's quicker than manually undoing everything, and look for all subtraction operations that subtract 1:

00216AEC: 3BEBFFFF	subi	r31,r11,1

I guess that's the only 1. Now I just remove it:

00216AEC: 60000000	nop

I try that out, and they were still removed from my inventory. It must be some other subtraction operation, so I find the rest of them:

002168B8: 3869FFF0	subi	r3,r9,16

00216980: 3869FFF0	subi	r3,r9,16

00216A00: 3863FFF0	subi	r3,r3,16

00216A48: 3863FFF0	subi	r3,r3,16

00216B48: 3863FFF0	subi	r3,r3,16

00216DEC: 3889FFF0	subi	r4,r9,16

I remove all 6 of them:

002168B8: 60000000	nop

00216980: 60000000	nop

00216A00: 60000000	nop

00216A48: 60000000	nop

00216B48: 60000000	nop

00216DEC: 60000000	nop

I try that, and the game froze when I tried to heal or get more stasis. I'm just going to go get another copy of the EBOOT.ELF and go back to all of those store operations, and try the ones that aren't the max credits one or don't store things on the stack, which is always register $r1:

00216B34: 93F90260	stw	r31,608(r25)

00216CDC: D00300F0	stfs	f0,240(r3)

00216EC0: 915F0000	stw	r10,0(r31)

I remove those 3:

00216B34: 60000000	nop

00216CDC: 60000000	nop

00216EC0: 60000000	nop

I try that out, and the effect is back. I doubt it's a float like address 0x00216CDC stores, so I'll try the first 1 only:

00216B34: 93F90260	stw	r31,608(r25)

That becomes:

00216B34: 60000000	nop

The effect is still there, so I found a code.



Infinite Use Of Med Packs & Stasis Packs
00216B34 60000000
ORIGINAL PATTERN: 93F90260
PATTERN: 60000000



I mess with that a little, return address 0x00216B34 to normal, check what happens before it or branches close to it.

00216AE4: 419E0050	beq-	cr7,0x216b34

I force the branch to always go:

00216AE4: 48000050	b	0x216b34

The effect is gone, so I remove it:

00216AE4: 60000000	nop

The effect is still gone, so I go to the next branch after it:

00216AF8: 409D0008	ble-	cr7,0x216b00

I first force this branch:

00216AF8: 48000008	b	0x216b00

The effect is still gone. I then remove the branch:

00216AF8: 60000000	nop

The effect is back. I then check to see what wasn't skipped:

00216AFC: 7C1F0378	mr	r31,r0

That's just copying whatever register $r0 is to register $r31. I then look to see where it came from:

00216AF0: 800900B0	lwz	r0,176(r9)

Register $r0 is 4 bytes from offset $00B0 of register $r9. I check to see what made register $r9. 2 Lines above it:

00216AE8: 8139000C	lwz	r9,12(r25)

That just kind of ends my curiosity.










Disgaea 3 - Enemy Level Modifier
I found that by looking for all instances of "270F	cmpwi" in programmer's notepad 2. I set all instances values from "270F" to "0000" using HxD. I noticed every enemy I encountered was at level 9999. Here is every instance, and the few I marked:

00035FEC: 2F8A270F	cmpwi	cr7,r10,9999
00036C88: 2F8A270F	cmpwi	cr7,r10,9999
000373D0: 2F89270F	cmpwi	cr7,r9,9999
00037610: 2F8A270F	cmpwi	cr7,r10,9999
000391FC: 2F83270F	cmpwi	cr7,r3,9999
000393B8: 2F83270F	cmpwi	cr7,r3,9999
0004197C: 2F89270F	cmpwi	cr7,r9,9999
Main area characters replaced with me.

00041B30: 2F89270F	cmpwi	cr7,r9,9999
000452F8: 2F80270F	cmpwi	cr7,r0,9999
0005007C: 2F83270F	cmpwi	cr7,r3,9999
000501A8: 2F83270F	cmpwi	cr7,r3,9999
000552AC: 2F80270F	cmpwi	cr7,r0,9999
0006FC20: 2F83270F	cmpwi	cr7,r3,9999
all enemies at level 9999.

0007ADF8: 2F87270F	cmpwi	cr7,r7,9999
000C14C8: 2F80270F	cmpwi	cr7,r0,9999
000C14D8: 2F80270F	cmpwi	cr7,r0,9999
000C1790: 2F9F270F	cmpwi	cr7,r31,9999
000C3E34: 2F80270F	cmpwi	cr7,r0,9999
000C3E74: 2F80270F	cmpwi	cr7,r0,9999
000C6294: 2F8B270F	cmpwi	cr7,r11,9999
000C7648: 2F84270F	cmpwi	cr7,r4,9999
000EE0BC: 2F9F270F	cmpwi	cr7,r31,9999
000EE46C: 2F9F270F	cmpwi	cr7,r31,9999
000EE85C: 2F9F270F	cmpwi	cr7,r31,9999
000EF568: 2F9D270F	cmpwi	cr7,r29,9999
000FC0BC: 2F8B270F	cmpwi	cr7,r11,9999
00106724: 2F80270F	cmpwi	cr7,r0,9999
001102A0: 2F89270F	cmpwi	cr7,r9,9999
00110DF0: 2F80270F	cmpwi	cr7,r0,9999
001149D4: 2F84270F	cmpwi	cr7,r4,9999
00116258: 2F80270F	cmpwi	cr7,r0,9999
001163C4: 2F9F270F	cmpwi	cr7,r31,9999
00116F14: 2F9F270F	cmpwi	cr7,r31,9999
0012FF04: 2F80270F	cmpwi	cr7,r0,9999
001303DC: 2F80270F	cmpwi	cr7,r0,9999
0013116C: 2F80270F	cmpwi	cr7,r0,9999
001325E4: 2F80270F	cmpwi	cr7,r0,9999
00134B5C: 2F80270F	cmpwi	cr7,r0,9999
00134E28: 2F80270F	cmpwi	cr7,r0,9999
00135088: 2F80270F	cmpwi	cr7,r0,9999
0013564C: 2F80270F	cmpwi	cr7,r0,9999
00135C9C: 2F80270F	cmpwi	cr7,r0,9999
00135F1C: 2F80270F	cmpwi	cr7,r0,9999
0013BDE4: 2F80270F	cmpwi	cr7,r0,9999
0013E32C: 2F89270F	cmpwi	cr7,r9,9999
001421EC: 2F89270F	cmpwi	cr7,r9,9999
0015C230: 2F80270F	cmpwi	cr7,r0,9999
00170B88: 2F8A270F	cmpwi	cr7,r10,9999
001732C8: 2F87270F	cmpwi	cr7,r7,9999
001748E8: 2F86270F	cmpwi	cr7,r6,9999
00174938: 2F86270F	cmpwi	cr7,r6,9999
001ABD6C: 2F89270F	cmpwi	cr7,r9,9999

I tried these all at the same time. There may have been many effects from these that I didn't notice that might have been useful. The way I determined it from the rest was by only setting half of them to 0000.

1. There is 52 of them, so I checked the first 26 (0x00035FEC to 0x000FC0BC) by changing all of them from "270F" to "0000". Everyone was still at level 9,999, so it was within those first 26 results.

2. I then tried changing the first 13 (0x00035FEC to 0x0006FC20) from "270F" to "0000". Everyone was still at level 9,999, so it was within those first 13 results.

3. I then tried changing the first 7 (0x00035FEC to 0x0004197C) from "270F" to "0000". Things were back to normal, so it wasn't any of the first 7 results.

4. 6 results are left. I then tried changing the next 3 (0x00041B30 to 0x0005007C) from "270F" to "0000". Things were still normal, so it wasn't any of those 3.

5. 3 results are left. I tried the next 2 (0x000501A8 & 0x000552AC) and changed them from "270F" to "0000". Things were still normal.

6. There is only 1 result left, and that is address 0x0006FC20. Just to verify it, I changed it from "270F" to "0000", and everyone was back to level 9,999.

It only took 7 tests to find that code. Total time was less than 30 minutes.







Disgaea 3 - Starting HP Modifiers For Enemies & Objects
I looked at the already found code called "Infinite HP", which is at address 0x000C2DA0 with value 0x60000000. Value 0x60000000 is the NOP command, which deletes a single line of code. I went to address 0x000C2DA0 in programmer's notepad 2. I saw these 3 lines:
000C2D98: E9290008	ld	r9,8(r9)
000C2D9C: 7C090050	sub	r0,r0,r9
000C2DA0: F80B09C0	std	r0,2496(r11)
To sum that up, it loads a 16 digit value called "r9", subtracts "r9" from "r0", and then stores the 16 digit value "r0". Since the 3rd line was erased to prevent HP from decreasing, I see it was normally storing that 16 digit value at offset $09C0. That offset told me what to look for in programmer's notepad 2. Also, it was a hunch since I found the same infinite HP code for Disgaea 1 & 2, but I recalled the HP maximum capacity to be just 8 bytes past the current HP address. I changed the code like this to test it:
000C2D98: E9290008	ld	r9,8(r9)
000C2D9C: E80B09D0	ld	r0,2512(r11)
000C2DA0: F80B09C0	std	r0,2496(r11)
Anything that was struck instantly had its HP refilled to its maximum capacity, so when I was hit and didn't already have my unit at full HP, it was now full HP.
I now know to search for offset $09C0 for the current HP of things, and offset $09D0 is the maximum HP capacity of things.
From there, I did a crumb of thinking. When my units start a stage, they start with whatever their HP was from the last stage if I didn't heal them. But no matter where you go, enemies and objects ALWAYS started with full HP. That made me think that the code for their starting HP amount would most likely be 1 line of code that is a "LD" of offset $09D0 followed by 1 line of "STD" of offset $09C0. So I now went into programmers notepad 2 and searched for all instances of:
"09D0	LD"
I looked for every instance I saw that had this instance after it:
"09C0	STD"
There are a bunch of instances of that. From there I would change this line:
00??????: E???09D0	ld	r?,2512(r?)
Into a LI code that uses the same register and set a specific value so I can set it apart from other lines I changed. Here is every last instance so you can't get confused:

0004538C: E80909D0	ld	r0,2512(r9)
00045390: F80909C0	std	r0,2496(r9)

00055208: E80909D0	ld	r0,2512(r9)
0005520C: F80909C0	std	r0,2496(r9)

00055324: E80909D0	ld	r0,2512(r9)
00055328: F80909C0	std	r0,2496(r9)

0006D674: E81F09D0	ld	r0,2512(r31)
0006D678: F81F09C0	std	r0,2496(r31)

0006EB20: E81B09D0	ld	r0,2512(r27)
0006EB24: F81B09C0	std	r0,2496(r27)

0006EE34: E81F09D0	ld	r0,2512(r31)
0006EE38: F81F09C0	std	r0,2496(r31)

0006F19C: E81F09D0	ld	r0,2512(r31)
0006F1A0: F81F09C0	std	r0,2496(r31)

000765A4: E81F09D0	ld	r0,2512(r31)
000765A8: F81F09C0	std	r0,2496(r31)

00076868: E81F09D0	ld	r0,2512(r31)
0007686C: F81F09C0	std	r0,2496(r31)

0007AF38: E80909D0	ld	r0,2512(r9)
0007AF3C: F80909C0	std	r0,2496(r9)

00080344: E81D09D0	ld	r0,2512(r29)
00080348: F81D09C0	std	r0,2496(r29)

000B36D8: E80A09D0	ld	r0,2512(r10)
000B36DC: F80A09C0	std	r0,2496(r10)

000C6E14: E80909D0	ld	r0,2512(r9)
000C6E18: F80909C0	std	r0,2496(r9)

000C6EEC: E80909D0	ld	r0,2512(r9)
000C6EF0: F80909C0	std	r0,2496(r9)

000C6FC0: E80909D0	ld	r0,2512(r9)
000C6FC4: F80909C0	std	r0,2496(r9)

000C7108: E88909D0	ld	r4,2512(r9)
000C710C: F88909C0	std	r4,2496(r9)

000EF06C: E80909D0	ld	r0,2512(r9)
000EF070: F80909C0	std	r0,2496(r9)

000EF76C: E80909D0	ld	r0,2512(r9)
000EF770: F80909C0	std	r0,2496(r9)

00100C78: E80909D0	ld	r0,2512(r9)
00100C7C: F80909C0	std	r0,2496(r9)

00116C10: E80909D0	ld	r0,2512(r9)
00116C14: F80909C0	std	r0,2496(r9)

00117684: E80909D0	ld	r0,2512(r9)
00117688: F80909C0	std	r0,2496(r9)

00121548: E80909D0	ld	r0,2512(r9)
0012154C: F80909C0	std	r0,2496(r9)

001397C8: E80909D0	ld	r0,2512(r9)
001397CC: F80909C0	std	r0,2496(r9)

0013BE60: E80909D0	ld	r0,2512(r9)
0013BE64: F80909C0	std	r0,2496(r9)

00142928: E80909D0	ld	r0,2512(r9)
0014292C: F80909C0	std	r0,2496(r9)

00142A4C: E80909D0	ld	r0,2512(r9)
00142A50: F80909C0	std	r0,2496(r9)

001616B0: E80909D0	ld	r0,2512(r9)
001616B4: F80909C0	std	r0,2496(r9)

001A1664: E80909D0	ld	r0,2512(r9)
001A1668: F80909C0	std	r0,2496(r9)

001AC0D4: E80909D0	ld	r0,2512(r9)
001AC0D8: F80909C0	std	r0,2496(r9)

All I did with these now is change the load operations into operations to create a specific value so I could see which address each code was at. They all end up like this now:

0004538C: 38000001	li	r0,1
00045390: F80909C0	std	r0,2496(r9)

00055208: 38000003	li	r0,3
0005520C: F80909C0	std	r0,2496(r9)

00055324: 38000005	li	r0,5
00055328: F80909C0	std	r0,2496(r9)

0006D674: 38000007	li	r0,7
0006D678: F81F09C0	std	r0,2496(r31)

0006EB20: 38000009	li	r0,9
0006EB24: F81B09C0	std	r0,2496(r27)

0006EE34: 3800000B	li	r0,11
0006EE38: F81F09C0	std	r0,2496(r31)

0006F19C: 3800000D	li	r0,13
0006F1A0: F81F09C0	std	r0,2496(r31)

000765A4: 3800000F	li	r0,15
000765A8: F81F09C0	std	r0,2496(r31)

00076868: 38000011	li	r0,17
0007686C: F81F09C0	std	r0,2496(r31)

0007AF38: 38000013	li	r0,19
0007AF3C: F80909C0	std	r0,2496(r9)

00080344: 38000015	li	r0,21
00080348: F81D09C0	std	r0,2496(r29)

000B36D8: 38000017	li	r0,23
000B36DC: F80A09C0	std	r0,2496(r10)

000C6E14: 38000019	li	r0,25
000C6E18: F80909C0	std	r0,2496(r9)

000C6EEC: 3800001B	li	r0,27
000C6EF0: F80909C0	std	r0,2496(r9)

000C6FC0: 3800001D	li	r0,29
000C6FC4: F80909C0	std	r0,2496(r9)

000C7108: 3804001F	li	r4,31
000C710C: F88909C0	std	r4,2496(r9)

000EF06C: 38000021	li	r0,33
000EF070: F80909C0	std	r0,2496(r9)

000EF76C: 38000023	li	r0,35
000EF770: F80909C0	std	r0,2496(r9)

00100C78: 38000025	li	r0,37
00100C7C: F80909C0	std	r0,2496(r9)

00116C10: 38000027	li	r0,39
00116C14: F80909C0	std	r0,2496(r9)

00117684: 38000029	li	r0,41
00117688: F80909C0	std	r0,2496(r9)

00121548: 3800002B	li	r0,43
0012154C: F80909C0	std	r0,2496(r9)

001397C8: 3800002D	li	r0,45
001397CC: F80909C0	std	r0,2496(r9)

0013BE60: 3800002F	li	r0,47
0013BE64: F80909C0	std	r0,2496(r9)

00142928: 38000031	li	r0,49
0014292C: F80909C0	std	r0,2496(r9)

00142A4C: 38000033	li	r0,51
00142A50: F80909C0	std	r0,2496(r9)

001616B0: 38000035	li	r0,53
001616B4: F80909C0	std	r0,2496(r9)

001A1664: 38000037	li	r0,55
001A1668: F80909C0	std	r0,2496(r9)

001AC0D4: 38000039	li	r0,57
001AC0D8: F80909C0	std	r0,2496(r9)

I open HxD and go to those addresses and give them the new values. Upon playing the game, I notice all of these things:

1. When I enter a mystery gate in an item world, the enemies have 3 HP.

2. When I enter an item world, geoblocks, treasure chests, and innocents have 11 HP.

3. The NPCs I can talk to outside of any map, like the people who sell me armors, weapons, items, heal my dead units and restore their HP and SP, the classroom representative, the heart bank lady, the dimension guide, the item world lady, the evilities guy, and those few NPCs all have 15 HP.

4. Class World Dropouts have 19 HP.

5. Item World Enemies have 33 HP.

6. For those few levels that have base panels for enemies, the enemies that came from the base panel had 39 HP.

7. When I went to any story mode levels, all of the enemies had 43 HP.

8. When I wanted to fight the homeroom representatives for denying something, they all had 55 HP.

From that, I knew exactly which addresses did what. There were probably more things I didn't notice, but I could still easily check for them with these results. This took a few hours to individually check all of them because I just played the game through and whenever I noticed the current codes weren't working for certain enemies or objects, I had to go through all of the results again to figure out which exact code worked.






Disgaea 3 - Starting SP Modifiers For Enemies & Objects
I looked at the already found code called "Infinite SP", which is at address 0x000C2DA0 with value 0x60000000. Value 0x60000000 is the NOP command, which deletes a single line of code. I went to address 0x000C2DA0 in programmer's notepad 2. I saw these 3 lines:
00132430: E80B09C8	ld	r0,2504(r11)
00132434: 7C090050	sub	r0,r0,r9
00132438: F80B09C8	std	r0,2504(r11)
The same setup as the "Infinite HP" code, just offset $09C8 instead of offset $09C0. I'd assume it also has the maximum SP capacity limit just 8 bytes after it, so I tested that again like this:
00132430: E80B09C8	ld	r0,2504(r11)
00132434: E80B09D8	ld	r0,2520(r11)
00132438: F80B09C8	std	r0,2504(r11)
I tested it and was correct. When I used my characters that didn't have full SP or just leveled up and had them do a special attack, their SP refilled to full. That tells me that offset $09C8 is 16 digits and the current amount of SP something has, offset $09D8 is 16 digits and the current maximum amount of SP something has, and that this area of code is executed when a special attack is executed.
I'm going with the same thinking I did for the "Starting HP Modifier" codes. No matter what area you go to, NPCs, object, and enemies all start with their SP filled to its maximum amount. That means I'm going to look for something that loads 8 bytes from offset $09D8 followed by the next line which stores those 8 bytes at offset $09C8. Just like "09D8	LD" followed by an instance of "09C8 STD".
I'll list every instance again.

0004539C: E80909D8	ld	r0,2520(r9)
000453A0: F80909C8	std	r0,2504(r9)

For item world mystery gate enemies.
00055218: E80909D8	ld	r0,2520(r9)
0005521C: F80909C8	std	r0,2504(r9)

00055334: E80909D8	ld	r0,2520(r9)
00055338: F80909C8	std	r0,2504(r9)

0006D67C: E81F09D8	ld	r0,2520(r31)
0006D680: F81F09C8	std	r0,2504(r31)

0006EB28: E81B09D8	ld	r0,2520(r27)
0006EB2C: F81B09C8	std	r0,2504(r27)

For item world geoblocks, treasure chests, and innocents.
0006EE3C: E81F09D8	ld	r0,2520(r31)
0006EE40: F81F09C8	std	r0,2504(r31)

0006F1A4: E81F09D8	ld	r0,2520(r31)
0006F1A8: F81F09C8	std	r0,2504(r31)

For Normal World NPCs. Heart banker, shops, item worlder, dimension guide, etc...
000765AC: E81F09D8	ld	r0,2520(r31)
000765B0: F81F09C8	std	r0,2504(r31)

00076870: E81F09D8	ld	r0,2520(r31)
00076874: F81F09C8	std	r0,2504(r31)

For Class World Dropouts.
0007AF44: E80909D8	ld	r0,2520(r9)
0007AF48: F80909C8	std	r0,2504(r9)

0008034C: E81D09D8	ld	r0,2520(r29)
00080350: F81D09C8	std	r0,2504(r29)

000B36E0: E80A09D8	ld	r0,2520(r10)
000B36E4: F80A09C8	std	r0,2504(r10)

000C6E20: E80909D8	ld	r0,2520(r9)
000C6E24: F80909C8	std	r0,2504(r9)

000C6EF8: E80909D8	ld	r0,2520(r9)
000C6EFC: F80909C8	std	r0,2504(r9)

000C6FCC: E80909D8	ld	r0,2520(r9)
000C6FD0: F80909C8	std	r0,2504(r9)

000C7150: E80909D8	ld	r0,2520(r9)
000C7154: F80909C8	std	r0,2504(r9)

For Item World enemies.
000EF078: E80909D8	ld	r0,2520(r9)
000EF07C: F80909C8	std	r0,2504(r9)

000EF778: E80909D8	ld	r0,2520(r9)
000EF77C: F80909C8	std	r0,2504(r9)

00100C84: E80909D8	ld	r0,2520(r9)
00100C88: F80909C8	std	r0,2504(r9)

For story mode level enemies from enemy base panels.
00116C1C: E80909D8	ld	r0,2520(r9)
00116C20: F80909C8	std	r0,2504(r9)

00117690: E80909D8	ld	r0,2520(r9)
00117694: F80909C8	std	r0,2504(r9)

For story mode enemies.
00121554: E80909D8	ld	r0,2520(r9)
00121558: F80909C8	std	r0,2504(r9)

001397D4: E80909D8	ld	r0,2520(r9)
001397D8: F80909C8	std	r0,2504(r9)

0013BE6C: E80909D8	ld	r0,2520(r9)
0013BE70: F80909C8	std	r0,2504(r9)

00142934: E80909D8	ld	r0,2520(r9)
00142938: F80909C8	std	r0,2504(r9)

00142A58: E80909D8	ld	r0,2520(r9)
00142A5C: F80909C8	std	r0,2504(r9)

001616C0: E80909D8	ld	r0,2520(r9)
001616C4: F80909C8	std	r0,2504(r9)

For homeroom representatives.
001A1670: E80909D8	ld	r0,2520(r9)
001A1674: F80909C8	std	r0,2504(r9)

001AC0DC: E80909D8	ld	r0,2520(r9)
001AC0E0: F80909C8	std	r0,2504(r9)

That is all of them again. Take note of the fact that all of these results are very close by the results I had for the starting HP modifiers. I noticed that after finding a few of them, and just started going back to the starting HP modifier locations and checking a few bytes past them for the instances of "09D8 ld" followed by "09C8	std". Using that, I found all of the starting SP modifiers and didn't need to bother changing the instances of "09D8 ld" into "???? li" like I did for checking the starting HP modifiers. I labeled all of them above. Considering I noticed all of these were right next to the starting HP modifiers, it only took less than a minute to make a package and test them.









Disgaea 3 - All Homeroom Representatives Love You
I honestly had no idea of how I would find this. All I could think of is that I found starting HP & SP modifiers for homeroom representatives, so I went to that area. Not knowing what to do, I just decided to "nop" any "bl" operations I found. Since the starting SP modifier for homeroom representatives is at address 0x001A1670, I went there and searched for "	bl	0x". I changed the 1st 4 results I had, which were:

001A16C8: 4BFF4F75	bl	0x19663c

001A16E0: 4BF08D55	bl	0xaa434

001A1750: 4BFF4EED	bl	0x19663c

001A1768: 4BF08CCD	bl	0xaa434

Branches always start with "	b". I cancelled them by changing the value to 0x60000000, which is "nop". So they became:

001A16C8: 60000000	nop

001A16E0: 60000000	nop

001A1750: 60000000	nop

001A1768: 60000000	nop

When I used these codes, all of the representatives on anything always loathed me, so that tells me that at least 1 of those 4 that I cancelled had something that determined how the representatives loved or loathed me. I checked them by doing 2 and then 1 of them.

1. I changed 0x001A16C8 to value 0x60000000, and 0x001A16E0 to 0x60000000. All of them still loathed me, so it's 1 of these 2.

2. I changed 0x001A16C8 to value 0x60000000. They still loathed me, so it was something in this branch that was doing it.

I went to address 0x0019663C and kind of glanced at the whole thing. I had no idea of what to do, but there were a large amount of branches. I started off by going to the 1st few branches and changing them to "nop" by giving them value 0x60000000. I kept doing that and playing the game to see what happened, and some things they liked me more, and others they hated me more. After getting sick of doing that because it wasn't telling me much, I just decided to skip past the 1st half that was loaded with branches and started just picking certain registers and setting all instances of them to 0. I ended up seeing register "r31" and only a few instances of it:

001967C8: 3BE00000	li	r31,0

00196808: 3BE00000	li	r31,0

00196810: 3BE00019	li	r31,25

I just changed their values like this:

001967C8: 3BE07FFF	li	r31,32767

00196808: 3BE07FFF	li	r31,32767

00196810: 3BE07FFF	li	r31,32767

I tested that and I guess that was what I was looking for, except it caused some representatives to loathe me instead of love me. From there, I wasn't sure of what to do, but I started with a copy of the unmodified EBOOT.ELF again. I checked that function again for any "store" operations and noticed there were none. I checked for register "r31" at the end of the function, and saw:

00196A34: 7FE3FB78	mr	r3,r31

That is transferring the value of register "r31" to register "r3". I then tried this:

00196A34: 38037FFF	li	r3,32767

That had no effect. I was still not sure of what to. I saw many instances of "	bl	0x96cbc". I thought to just remove that function. I went to address 0x00096CBC:

00096CBC: 786B0760	rldicl	r11,r3,0,59

I removed that entire function by changing it to "blr".

00096CBC: 4E800020	blr

I started the game, the main menu was weird, and I couldn't get to the game because it was trapped looping the new game story. So I undid that and changed it back to what it was. That meant I had to do it the longer way and "nop" all of the "bl"s in that function that went to that other function. I found these:

001967D0: 4BF004ED	bl	0x96cbc

001967EC: 4BF004D1	bl	0x96cbc

00196824: 4BF00499	bl	0x96cbc

00196840: 4BF0047D	bl	0x96cbc

00196868: 4BF00455	bl	0x96cbc

00196884: 4BF00439	bl	0x96cbc

001968AC: 4BF00411	bl	0x96cbc

001968C8: 4BF003F5	bl	0x96cbc

001968F0: 4BF003CD	bl	0x96cbc

0019690C: 4BF003B1	bl	0x96cbc

00196934: 4BF00389	bl	0x96cbc

00196950: 4BF0036D	bl	0x96cbc

00196978: 4BF00345	bl	0x96cbc

00196994: 4BF00329	bl	0x96cbc

001969BC: 4BF00301	bl	0x96cbc

001969D8: 4BF002E5	bl	0x96cbc

00196A00: 4BF002BD	bl	0x96cbc

00196A1C: 4BF002A1	bl	0x96cbc

That's all of those within the function. I changed them all to "nop".

001967D0: 60000000	nop

001967EC: 60000000	nop

00196824: 60000000	nop

00196840: 60000000	nop

00196868: 60000000	nop

00196884: 60000000	nop

001968AC: 60000000	nop

001968C8: 60000000	nop

001968F0: 60000000	nop

0019690C: 60000000	nop

00196934: 60000000	nop

00196950: 60000000	nop

00196978: 60000000	nop

00196994: 60000000	nop

001969BC: 60000000	nop

001969D8: 60000000	nop

00196A00: 60000000	nop

00196A1C: 60000000	nop

I did a few of those at a time and noticed certain monster type representatives always loved me, so I changed all of these and then all representatives loved me. Made another copy of my unmodified EBOOT.ELF and tried it again, and it didn't work. I remembered I had this at the same time too:

00196A34: 7FE3FB78	mr	r3,r31

I changed it back to this again:

00196A34: 38037FFF	li	r3,32767

I tried it and it was working again. I was happy the code was working but I thought this was a lot of lines and people like patterns, and this would have been a lot of patterns that would take forever to input. So I messed around just a little more because I knew that register "r3" was doing something. I went back to where the function was jumped to.

001A16C8: 4BFF4F75	bl	0x19663c

I decided to see if there were any store operations with register "r3". I saw this:

001A16F0: B07C0418	sth	r3,1048(r28)

I also saw this and decided to mess with it just because it was a nearby store operation:

001A170C: B01C0418	sth	r0,1048(r28)

I went to the lines before them and changed them to set a specific value. I went to these:

001A16EC: 3863FFFB	subi	r3,r3,5
001A16F0: B07C0418	sth	r3,1048(r28)

001A1708: 7C004A14	add	r0,r0,r9
001A170C: B01C0418	sth	r0,1048(r28)

And I changed them to these:

001A16EC: 38037FFF	li	r3,32767
001A16F0: B07C0418	sth	r3,1048(r28)

001A1708: 38007FFF	li	r0,32767
001A170C: B01C0418	sth	r0,1048(r28)

I tried that out, and noticed about half of the representatives loved me. So I went a little further down and saw the same exact thing again:

001A1774: 3863FFFB	subi	r3,r3,5
001A1778: B07C0418	sth	r3,1048(r28)

001A1790: 7C004A14	add	r0,r0,r9
001A1794: B01C0418	sth	r0,1048(r28)

I changed them the same way:

001A1774: 38037FFF	li	r3,32767
001A1778: B07C0418	sth	r3,1048(r28)

001A1790: 38007FFF	li	r0,32767
001A1794: B01C0418	sth	r0,1048(r28)

I played the game again, and everyone loved me. So I tested it again with an unmodified copy of the EBOOT.ELF.

001A16EC: 38037FFF	li	r3,32767
001A16F0: B07C0418	sth	r3,1048(r28)

001A1774: 38037FFF	li	r3,32767
001A1778: B07C0418	sth	r3,1048(r28)

I played again and there was no effect. I was thinking that should have done it. I then thought maybe by some chance it was the other 2, so I tested them with another copy of the unmodified EBOOT.ELF.

001A1708: 38007FFF	li	r0,32767
001A170C: B01C0418	sth	r0,1048(r28)

001A1790: 38007FFF	li	r0,32767
001A1794: B01C0418	sth	r0,1048(r28)

It worked. Another useful code found by accident, and it took a few hours of messing around to get it. Since I now know that offset $0418 is 2 bytes that determine how a representative likes me, I could probably find just 1 line of code to make this work by just searching for any instances of "0418	lhz	", but I'm fine with 2 lines of code. If somebody wants that, they should be able to easily find it themselves.







Disgaea 3 - Aptitudes Percent Modifier
Disgaea 3 - Elemental Resistances Modifier
Disgaea 3 - Move Range Modifier
Disgaea 3 - Jump Height Modifier
Disgaea 3 - Counter Attack Amount Modifier
Disgaea 3 - Lift/Throw Amount Modifier
Disgaea 3 - Attack Range Modifier
Disgaea 3 - EXP Multiplier/Max EXP
Disgaea 3 - Level Modifier
With all of these, they were things I stumbled upon by looking for something else. I did a search for many values in hopes that I would find some useful things that have limits. I did a search for the value 99,999,999 throughout the game in programmer's notepad. 99,999,999 is 0x05F5E0FF in hex. Since that is 8 digits, it takes 2 lines of code to make that value. Games usually use 1 line for "lis", and the next line is "ori". I did a search for all instances of "05F5	lis", and then checked to make sure the next line had "E0FF	ori". I checked the first 3 lines after those 2 lines to see if it was a "	cmpw	" line follwed by a "	ble-	" line. These are all of the instances I ended up with:

Looking for 99,999,999, which is 0x05F5E0FF.
00180278: 3D6005F5	lis	r11,1525
0018027C: 616BE0FF	ori	r11,r11,57599

0017FFEC: 3D2005F5	lis	r9,1525
0017FFF0: 6129E0FF	ori	r9,r9,57599

0015F344: 3F6005F5	lis	r27,1525
0015F348: 637BE0FF	ori	r27,r27,57599

001108B0: 3D2005F5	lis	r9,1525
001108B4: 6129E0FF	ori	r9,r9,57599

000CB62C: 3D2005F5	lis	r9,1525
000CB630: 6129E0FF	ori	r9,r9,57599

000CB3C4: 3D2005F5	lis	r9,1525
000CB3C8: 6129E0FF	ori	r9,r9,57599

000C3DF0: 3D2005F5	lis	r9,1525
000C3DF4: 6129E0FF	ori	r9,r9,57599

00072564: 3D2005F5	lis	r9,1525
00072568: 6129E0FF	ori	r9,r9,57599

0006E108: 3D2005F5	lis	r9,1525
0006E10C: 6129E0FF	ori	r9,r9,57599

0006DEA4: 3D2005F5	lis	r9,1525
0006DEA8: 6129E0FF	ori	r9,r9,57599

0006CEF8: 3D6005F5	lis	r11,1525
0006CEFC: 616BE0FF	ori	r11,r11,57599
All characters stats that weren't HP or SP were 0.

0006A994: 3D0005F5	lis	r8,1525
0006A998: 6108E0FF	ori	r8,r8,57599

0006A860: 3D2005F5	lis	r9,1525
0006A864: 6129E0FF	ori	r9,r9,57599
All characters HP & SP were less than 5.

0001D1A4: 3C0005F5	lis	r0,1525
0001D1A8: 6000E0FF	ori	r0,r0,57599

I have already marked those 2, and here is what I changed all of them to:

00180278: 3D600000	lis	r11,0
0018027C: 616B0001	ori	r11,r11,1

0017FFEC: 3D200000	lis	r9,0
0017FFF0: 61290003	ori	r9,r9,3

0015F344: 3F600000	lis	r27,0
0015F348: 637B0005	ori	r27,r27,5

001108B0: 3D200000	lis	r9,0
001108B4: 61290007	ori	r9,r9,7

000CB62C: 3D200000	lis	r9,0
000CB630: 61290009	ori	r9,r9,9

000CB3C4: 3D200000	lis	r9,0
000CB3C8: 6129000B	ori	r9,r9,11

000C3DF0: 3D200000	lis	r9,0
000C3DF4: 6129000D	ori	r9,r9,13

00072564: 3D200000	lis	r9,0
00072568: 6129000F	ori	r9,r9,15

0006E108: 3D200000	lis	r9,0
0006E10C: 61290011	ori	r9,r9,17

0006DEA4: 3D200000	lis	r9,0
0006DEA8: 61290013	ori	r9,r9,19

0006CEF8: 3D600000	lis	r11,0
0006CEFC: 616B0015	ori	r11,r11,21
All characters stats that weren't HP or SP were 0.

0006A994: 3D0005F5	lis	r8,0
0006A998: 61080017	ori	r8,r8,23

0006A860: 3D2005F5	lis	r9,0
0006A864: 61290019	ori	r9,r9,25
All characters HP & SP were less than 5.

0001D1A4: 3C0005F5	lis	r0,0
0001D1A8: 6000001B	ori	r0,r0,27

That told me exactly which one of those did those 2 effects.

Out of curiousity I noticed those 2 codes are within the same function. I decided to mess with anything else I saw as a limiting thing. The way to spot limits is they are usually either 2 lines like above that define that limit by using a "lis" followed by an "ori" followed by a "cmp" operation, or just 1 line that is "cmpwi" which has the value to compare something to, followed by the next line being a either "blt" for branch if less than, or "ble" for branch if less than or equal, or "bgt" for branch if greater than, or "bge" for branch if greater than or equal to, and that branch usually only skips a few of the next lines in most cases, and one of those lines that is skipped is a store operation if it's not in the next few lines that weren't skipped. That last sentence would probably just baffle you. I got to address 0x0006CEF8, and I search for the previous instance of "4E800020	blr" because that tells me where the previous function ended, so the next line is the start of the function that contains these 2 codes. I end up with:

0006A38C: 4E800020	blr

So this function starts at address 0x0006A390. I now search for the next instance of "4E800020	blr" so I know where this function ends. I end up with:

0006D108: 4E800020	blr

I now know this function starts at address 0x0006A390 and ends at 0x0006D108. So I go address 0x0006A390 and start searching for the instance "bl". If that seems odd to you, that's because the 2 branch types I'm looking for are "blt" and "ble". I'll end encountering many things that are not what I'm looking for, but I'll just try them all anyway. Here's the list of things that I ended up with:

0006A458: 419C0190	blt-	cr7,0x6a5e8

0006A4C8: 409D0094	ble-	cr7,0x6a55c

0006A640: 409D0008	ble-	cr7,0x6a648

0006A650: 409D0010	ble-	cr7,0x6a660

0006A734: 409D0008	ble-	cr7,0x6a73c

0006A7FC: 40FD0054	ble+	cr7,0x6a850

0006A86C: 409D0008	ble-	cr7,0x6a874

0006A8E8: 409D0134	ble-	cr7,0x6aa1c

0006A9D0: 409D0008	ble-	cr7,0x6a9d8

0006AA7C: 409D000C	ble-	cr7,0x6aa88

0006AA90: 409D0008	ble-	cr7,0x6aa98

0006AD00: 409D001C	ble-	cr7,0x6ad1c

0006AD40: 409D00A0	ble-	cr7,0x6ade0

0006ADAC: 409D0034	ble-	cr7,0x6ade0

0006AE94: 409D0008	ble-	cr7,0x6ae9c

0006AEDC: 409D0008	ble-	cr7,0x6aee4

0006AF0C: 409D0008	ble-	cr7,0x6af14

0006AF40: 409D0008	ble-	cr7,0x6af48

0006AF60: 409D000C	ble-	cr7,0x6af6c

0006AF74: 409D000C	ble-	cr7,0x6af80

0006AF88: 409D000C	ble-	cr7,0x6af94

0006AF9C: 409D000C	ble-	cr7,0x6afa8

0006AFB0: 409D000C	ble-	cr7,0x6afbc

0006B018: 409D0020	ble-	cr7,0x6b038

0006B0C4: 409D0008	ble-	cr7,0x6b0cc

0006B130: 409D0040	ble-	cr7,0x6b170

0006B28C: 409D0008	ble-	cr7,0x6b294

0006B29C: 409D0008	ble-	cr7,0x6b2a4

0006B310: 409D000C	ble-	cr7,0x6b31c

0006B43C: 409D0010	ble-	cr7,0x6b44c

0006B4E0: 409D0024	ble-	cr7,0x6b504

0006B4F8: 409D000C	ble-	cr7,0x6b504

0006B51C: 409D0024	ble-	cr7,0x6b540

0006B534: 409D000C	ble-	cr7,0x6b540

0006B558: 409D0024	ble-	cr7,0x6b57c

0006B570: 409D000C	ble-	cr7,0x6b57c

0006B594: 409D0030	ble-	cr7,0x6b5c4

0006B5DC: 409D0030	ble-	cr7,0x6b60c

0006B62C: 409D002C	ble-	cr7,0x6b658

0006B864: 419C0014	blt-	cr7,0x6b878

0006B9B4: 419C0014	blt-	cr7,0x6b9c8

0006BB20: 419C0014	blt-	cr7,0x6bb34

0006BDE8: 419C0014	blt-	cr7,0x6bdfc

0006BF38: 419C0014	blt-	cr7,0x6bf4c

0006BF98: 409D10D4	ble-	cr7,0x6d06c

0006C050: 409D000C	ble-	cr7,0x6c05c

0006C084: 409D0024	ble-	cr7,0x6c0a8

0006C09C: 409D000C	ble-	cr7,0x6c0a8

0006C174: 409D0030	ble-	cr7,0x6c1a4

0006C218: 409D051C	ble-	cr7,0x6c734

0006C264: 409D0030	ble-	cr7,0x6c294

0006C2AC: 409D0030	ble-	cr7,0x6c2dc

0006C2F4: 409D0440	ble-	cr7,0x6c734

0006C340: 409D0030	ble-	cr7,0x6c370

0006C388: 409D03AC	ble-	cr7,0x6c734

0006C3D4: 409D0030	ble-	cr7,0x6c404

0006C41C: 409D0318	ble-	cr7,0x6c734

0006C468: 409D02CC	ble-	cr7,0x6c734

0006C4B4: 409D0030	ble-	cr7,0x6c4e4

0006C4FC: 409D0238	ble-	cr7,0x6c734

0006C550: 409D0030	ble-	cr7,0x6c580

0006C598: 409D019C	ble-	cr7,0x6c734

0006C5E4: 409D0030	ble-	cr7,0x6c614

0006C62C: 409D0030	ble-	cr7,0x6c65c

0006C674: 409D0030	ble-	cr7,0x6c6a4

0006C6BC: 409D0030	ble-	cr7,0x6c6ec

0006C704: 409D0030	ble-	cr7,0x6c734

0006C7E8: 409D02E0	ble-	cr7,0x6cac8

0006C834: 409D0030	ble-	cr7,0x6c864

0006C868: 409D0260	ble-	cr7,0x6cac8

0006C890: 409D0238	ble-	cr7,0x6cac8

0006C8C8: 409D0200	ble-	cr7,0x6cac8

0006CA54: 409D000C	ble-	cr7,0x6ca60

0006CA80: 409D000C	ble-	cr7,0x6ca8c

0006CAAC: 409D000C	ble-	cr7,0x6cab8

0006CB68: 409D000C	ble-	cr7,0x6cb74

0006CBA4: 409D000C	ble-	cr7,0x6cbb0

0006CBDC: 409D000C	ble-	cr7,0x6cbe8

0006CC14: 409D000C	ble-	cr7,0x6cc20

0006CC4C: 409D000C	ble-	cr7,0x6cc58

0006CEF4: 409D001C	ble-	cr7,0x6cf10

0006CF08: 409D0008	ble-	cr7,0x6cf10

0006CF58: 409D0008	ble-	cr7,0x6cf60

0006CF9C: 409D000C	ble-	cr7,0x6cfa8

0006CFB0: 409D000C	ble-	cr7,0x6cfbc

0006CFC4: 409D000C	ble-	cr7,0x6cfd0

0006CFD8: 409D000C	ble-	cr7,0x6cfe4

0006D004: 409D0008	ble-	cr7,0x6d00c

0006D018: 409D00AC	ble-	cr7,0x6d0c4

0006D0BC: 409DE024	ble+	cr7,0x6b0e0

That's all of them, and that's exactly 90 results. From there, I just "nop" all of them so that anything that may be enforcing limits will just set everything to it's maximum value, and play the game to see what has changed. I get another copy of the unmodified EBOOT.ELF, open it up with HxD, and this is what I change all of them to:

0006A458: 60000000	nop

0006A4C8: 60000000	nop

0006A640: 60000000	nop

0006A650: 60000000	nop

0006A734: 60000000	nop

0006A7FC: 60000000	nop

0006A86C: 60000000	nop

0006A8E8: 60000000	nop

0006A9D0: 60000000	nop

0006AA7C: 60000000	nop

0006AA90: 60000000	nop

0006AD00: 60000000	nop

0006AD40: 60000000	nop

0006ADAC: 60000000	nop

0006AE94: 60000000	nop

0006AEDC: 60000000	nop

0006AF0C: 60000000	nop

0006AF40: 60000000	nop

0006AF60: 60000000	nop

0006AF74: 60000000	nop

0006AF88: 60000000	nop

0006AF9C: 60000000	nop

0006AFB0: 60000000	nop

0006B018: 60000000	nop

0006B0C4: 60000000	nop

0006B130: 60000000	nop

0006B28C: 60000000	nop

0006B29C: 60000000	nop

0006B310: 60000000	nop

0006B43C: 60000000	nop

0006B4E0: 60000000	nop

0006B4F8: 60000000	nop

0006B51C: 60000000	nop

0006B534: 60000000	nop

0006B558: 60000000	nop

0006B570: 60000000	nop

0006B594: 60000000	nop

0006B5DC: 60000000	nop

0006B62C: 60000000	nop

0006B864: 60000000	nop

0006B9B4: 60000000	nop

0006BB20: 60000000	nop

0006BDE8: 60000000	nop

0006BF38: 60000000	nop

0006BF98: 60000000	nop

0006C050: 60000000	nop

0006C084: 60000000	nop

0006C09C: 60000000	nop

0006C174: 60000000	nop

0006C218: 60000000	nop

0006C264: 60000000	nop

0006C2AC: 60000000	nop

0006C2F4: 60000000	nop

0006C340: 60000000	nop

0006C388: 60000000	nop

0006C3D4: 60000000	nop

0006C41C: 60000000	nop

0006C468: 60000000	nop

0006C4B4: 60000000	nop

0006C4FC: 60000000	nop

0006C550: 60000000	nop

0006C598: 60000000	nop

0006C5E4: 60000000	nop

0006C62C: 60000000	nop

0006C674: 60000000	nop

0006C6BC: 60000000	nop

0006C704: 60000000	nop

0006C7E8: 60000000	nop

0006C834: 60000000	nop

0006C868: 60000000	nop

0006C890: 60000000	nop

0006C8C8: 60000000	nop

0006CA54: 60000000	nop

0006CA80: 60000000	nop

0006CAAC: 60000000	nop

0006CB68: 60000000	nop

0006CBA4: 60000000	nop

0006CBDC: 60000000	nop

0006CC14: 60000000	nop

0006CC4C: 60000000	nop

0006CEF4: 60000000	nop

0006CF08: 60000000	nop

0006CF58: 60000000	nop

0006CF9C: 60000000	nop

0006CFB0: 60000000	nop

0006CFC4: 60000000	nop

0006CFD8: 60000000	nop

0006D004: 60000000	nop

0006D018: 60000000	nop

0006D0BC: 60000000	nop

I played the game, and these are all of the things I noticed:

Everything had 99,999,999 HP, SP, ATK, DEF, INT, RES, HIT, and SPD.
Everything was at level 9,999, and its EXP was at its max.
Everything had 32 MOV, 99 JMP, 9 Attack Range, 9 Counters, 9 Lift/Throw Range, 5% Critical, and 99% Fire, Wind, and Ice.
I couldn't create or reincarnate characters because a menu in the stuff didn't appear, and I couldn't back out of it either.
I selected an enemy and the game froze.
Nothing could be damaged, SP couldn't be decreased, and Counters couldn't be decreased.
All aptitudes were at 255%.

Since I know all of those values are the same for every character except for each character's max EXP amount, and I'm not sure about the Critical thing. I'll just check for those ones with specific max values first. Here were the ones that had instances of "0009	cmp", and a bit of explaining:

0006B56C: 2B800009	cmplwi	cr7,r0,9	It's comparing whatever value register "r0" is to the number 9.
0006B570: 409D000C	ble-	cr7,0x6b57c	If "r0" was less than or equal to 9, then skip the next 2 lines of code.
0006B574: 38000009	li	r0,9	"r0" was greater than 9, so set register "r0" to the value 9.
0006B578: 98180ACA	stb	r0,2762(r24)	"r0" was greater than 9, so store register "r0", which is now 9, to the offset $0ACA of register "r24".

0006CBD8: 2FA90009	cmpdi	cr7,r9,9	It's comparing whatever value register "r9" is to the number 9.
0006CBDC: 409D000C	ble-	cr7,0x6cbe8	If "r9" was less than or equal to 9, then skip the next 2 lines of code.
0006CBE0: 39200009	li	r9,9	"r9" was greater than 9, so set register "r9" to the value 9.
0006CBE4: 48000010	b	0x6cbf4	"r9" was greater than 9, and now it's going to jump to address 0x0006CBF4 and continue doing whatever.

0006CC10: 2FA90009	cmpdi	cr7,r9,9	It's comparing whatever value register "r9" is to the number 9.
0006CC14: 409D000C	ble-	cr7,0x6cc20	If "r9" was less than or equal to 9, then skip the next 2 lines of code.
0006CC18: 39200009	li	r9,9	"r9" was greater than 9, so set register "r9" to the value 9.
0006CC1C: 48000010	b	0x6cc2c	"r9" was greater than 9, and now it's going to jump to address 0x0006CC2C and continue doing whatever.

0006CF98: 2B800009	cmplwi	cr7,r0,9	It's comparing whatever value register "r0" is to the number 9.
0006CF9C: 409D000C	ble-	cr7,0x6cfa8	If "r0" was less than or equal to 9, then skip the next 2 lines of code.
0006CFA0: 38000009	li	r0,9	"r0" was greater than 9, so set register "r0" to the value 9.
0006CFA4: 98180AC9	stb	r0,2761(r24)	"r0" was greater than 9, so store register "r0", which is now 9, to the offset $0AC9 of register "r24".

0006CFAC: 2B800009	cmplwi	cr7,r0,9	It's comparing whatever value register "r0" is to the number 9.
0006CFB0: 409D000C	ble-	cr7,0x6cfbc	If "r0" was less than or equal to 9, then skip the next 2 lines of code.
0006CFB4: 38000009	li	r0,9	"r0" was greater than 9, so set register "r0" to the value 9.
0006CFB8: 98180ACA	stb	r0,2762(r24)	"r0" was greater than 9, so store register "r0", which is now 9, to the offset $0ACA of register "r24".

0006CFD4: 2B800009	cmplwi	cr7,r0,9	It's comparing whatever value register "r0" is to the number 9.
0006CFD8: 409D000C	ble-	cr7,0x6cfe4	If "r0" was less than or equal to 9, then skip the next 2 lines of code.
0006CFDC: 38000009	li	r0,9	"r0" was greater than 9, so set register "r0" to the value 9.
0006CFE0: 98180AD6	stb	r0,2774(r24)	"r0" was greater than 9, so store register "r0", which is now 9, to the offset $0AD6 of register "r24".

That's the 6 of them. This is how I'll change them:

0006B56C: 2B800009	cmplwi	cr7,r0,9
0006B570: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 9.
0006B574: 38000001	li	r0,1	I'm now setting register "r0" to always be 1.
0006B578: 98180ACA	stb	r0,2762(r24)

0006CBD8: 2FA90009	cmpdi	cr7,r9,9
0006CBDC: 60000000	nop	No more branching depending on whether register "r9" was less than or equal to 9.
0006CBE0: 39200003	li	r9,3	I'm now setting register "r9" to always be 3.
0006CBE4: 48000010	b	0x6cbf4

0006CC10: 2FA90009	cmpdi	cr7,r9,9
0006CC14: 60000000	nop	No more branching depending on whether register "r9" was less than or equal to 9.
0006CC18: 39200005	li	r9,5	I'm now setting register "r9" to always be 5.
0006CC1C: 48000010	b	0x6cc2c

0006CF98: 2B800009	cmplwi	cr7,r0,9
0006CF9C: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 9.
0006CFA0: 38000007	li	r0,7	I'm now setting register "r0" to always be 7.
0006CFA4: 98180AC9	stb	r0,2761(r24)

0006CFAC: 2B800009	cmplwi	cr7,r0,9
0006CFB0: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 9.
0006CFB4: 38000009	li	r0,9	I'm now setting register "r0" to always be 9.
0006CFB8: 98180ACA	stb	r0,2762(r24)

0006CFD4: 2B800009	cmplwi	cr7,r0,9
0006CFD8: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 9.
0006CFDC: 3800000B	li	r0,11	I'm now setting register "r0" to always be 11.
0006CFE0: 98180AD6	stb	r0,2774(r24)

So I tried all of these and ended up with these:

All Counter Attacks were 7.
All Lift/Throw Amounts were 9.
All Attack Ranges were 11.
I now know which codes these are.


Next up, the maximum MOV value was 32, so next is to search for the instances of "0020	cmp". These are all of them:

0006CFC0: 2B800020	cmplwi	cr7,r0,32	It's comparing whatever value register "r0" is to the number 32.
0006CFC4: 409D000C	ble-	cr7,0x6cfd0	If "r0" was less than or equal to 32, then skip the next 2 lines of code.
0006CFC8: 38000020	li	r0,32	"r0" was greater than 32, so set register "r0" to the value 32.
0006CFCC: 98180AC7	stb	r0,2759(r24)	"r0" was greater than 32, so store register "r0", which is now 32, to the offset $0AC7 of register "r24".

That's the only 1 I see. I'll just try setting it to 17 like this:

0006CFC0: 2B800020	cmplwi	cr7,r0,32
0006CFC4: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 9.
0006CFC8: 38000011	li	r0,17	I'm now setting register "r0" to always be 17.
0006CFCC: 98180AC7	stb	r0,2759(r24)

I tried it out, and now the MOV value of everything is 17, so I've now found that code too. Next up is the JUMP value and Elemental Resistance values. I'll search for comparisons to 99, which is "0063	cmp". These are what I find:


0006B288: 2F990063	cmpwi	cr7,r25,99	It's comparing whatever value register "r25" is to the number 99.
0006B28C: 409D0008	ble-	cr7,0x6b294	If "r25" was less than or equal to 99, then skip the next 1 line of code.
0006B290: 3B200063	li	r25,99	"r25" was greater than 99, so set register "r25" to the value 99.
0006B294: 9B380AC7	stb	r25,2759(r24)	Store register "r25", which is now 99, to the offset $0AC7 of register "r24".

0006B298: 2F9A0063	cmpwi	cr7,r26,99	It's comparing whatever value register "r26" is to the number 99.
0006B29C: 409D0008	ble-	cr7,0x6b2a4	If "r26" was less than or equal to 99, then skip the next 1 line of code.
0006B2A0: 3B400063	li	r26,99	"r26" was greater than 99, so set register "r26" to the value 99.
0006B2A4: 9B580AC5	stb	r26,2757(r24)	Store register "r26", which is now 99, to the offset $0AC5 of register "r24".

0006B4F4: 2B800063	cmplwi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006B4F8: 409D000C	ble-	cr7,0x6b504	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006B4FC: 38000063	li	r0,99	"r0" was greater than 99, so set register "r0" to the value 99.
0006B500: 98180AC7	stb	r0,2759(r24)	"r0" was greater than 99, so store register "r0", which is now 99, to the offset $0AC7 of register "r24".

0006B530: 2F800063	cmpwi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006B534: 409D000C	ble-	cr7,0x6b540	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006B538: 38000063	li	r0,99	"r0" was greater than 99, so set register "r0" to the value 99.
0006B53C: 98180AC5	stb	r0,2757(r24)	"r0" was greater than 9, so store register "r0", which is now 99, to the offset $0AC5 of register "r24".

0006C04C: 2B800063	cmplwi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006C050: 409D000C	ble-	cr7,0x6c05c	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006C054: 38000063	li	r0,99	"r0" was greater than 99, so set register "r0" to the value 99.
0006C058: 98180AC7	stb	r0,2759(r24)	"r0" was greater than 99, so store register "r0", which is now 99, to the offset $0AC7 of register "r24".

0006C098: 2B800063	cmplwi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006C09C: 409D000C	ble-	cr7,0x6c0a8	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006C0A0: 38000063	li	r0,99	"r0" was greater than 99, so set register "r0" to the value 99.
0006C0A4: 98180AC7	stb	r0,2759(r24)	"r0" was greater than 99, so store register "r0", which is now 99, to the offset $0AC7 of register "r24".

0006CA50: 2FA00063	cmpdi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006CA54: 409D000C	ble-	cr7,0x6ca60	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006CA58: 38000063	li	r0,99	"r0" was greater than 99, so set register "r0" to the value 99.
0006CA5C: 48000010	b	0x6ca6c	"r0" was greater than 99, and now it's going to jump to address 0x0006CA6C and continue doing whatever.

0006CA7C: 2FA00063	cmpdi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006CA80: 409D000C	ble-	cr7,0x6ca8c	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006CA84: 38000063	li	r0,99	"r0" was greater than 99, so set register "r0" to the value 99.
0006CA88: 48000010	b	0x6ca98	"r0" was greater than 99, and now it's going to jump to address 0x0006CA98 and continue doing whatever.

0006CAA8: 2FA00063	cmpdi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006CAAC: 409D000C	ble-	cr7,0x6cab8	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006CAB0: 38000063	li	r0,99	"r0" was greater than 99, so set register "r0" to the value 99.
0006CAB4: 48000010	b	0x6cac4	"r0" was greater than 99, and now it's going to jump to address 0x0006CAC4 and continue doing whatever.

0006CB64: 2FA00063	cmpdi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006CB68: 409D000C	ble-	cr7,0x6cb74	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006CB6C: 38000063	li	r0,99	"r0" was greater than 99, so set register "r0" to the value 99.
0006CB70: 48000010	b	0x6cb80	"r0" was greater than 99, and now it's going to jump to address 0x0006CB80 and continue doing whatever.

0006CBA0: 2FA00063	cmpdi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006CBA4: 409D000C	ble-	cr7,0x6cbb0	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006CBA8: 38000063	li	r0,99	"r0" was greater than 99, so set register "r0" to the value 99.
0006CBAC: 48000010	b	0x6cbbc	"r0" was greater than 99, and now it's going to jump to address 0x0006CBBC and continue doing whatever.

0006CC48: 2FA90063	cmpdi	cr7,r9,99	It's comparing whatever value register "r9" is to the number 99.
0006CC4C: 409D000C	ble-	cr7,0x6cc58	If "r9" was less than or equal to 99, then skip the next 2 lines of code.
0006CC50: 39200063	li	r9,99	"r9" was greater than 99, so set register "r9" to the value 99.
0006CC54: 48000010	b	0x6cc64	"r0" was greater than 99, and now it's going to jump to address 0x0006CC64 and continue doing whatever.

0006CF54: 2FA00063	cmpdi	cr7,r0,99	It's comparing whatever value register "r0" is to the number 99.
0006CF58: 409D0008	ble-	cr7,0x6cf60	If "r0" was less than or equal to 99, then skip the next 2 lines of code.
0006CF5C: F8E90000	std	r7,0(r9)	"r0" was greater than 99, so store whatever register "r7" is to the offset $0000 of register "r9".

I'm now just going to cancel the branches again and change the values of the "li" operations.

0006B288: 2F990063	cmpwi	cr7,r25,99
0006B28C: 60000000	nop	No more branching depending on whether register "r25" was less than or equal to 99.
0006B290: 3B200001	li	r25,1	I'm now setting register "r25" to always be 1.
0006B294: 9B380AC7	stb	r25,2759(r24)

0006B298: 2F9A0063	cmpwi	cr7,r26,99
0006B29C: 60000000	nop	No more branching depending on whether register "r26" was less than or equal to 99.
0006B2A0: 3B400003	li	r26,3	I'm now setting register "r26" to always be 3.
0006B2A4: 9B580AC5	stb	r26,2757(r24)

0006B4F4: 2B800063	cmplwi	cr7,r0,99
0006B4F8: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 99.
0006B4FC: 38000005	li	r0,5	I'm now setting register "r0" to always be 5.
0006B500: 98180AC7	stb	r0,2759(r24)

0006B530: 2F800063	cmpwi	cr7,r0,99
0006B534: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 99.
0006B538: 38000007	li	r0,7	I'm now setting register "r0" to always be 7.
0006B53C: 98180AC5	stb	r0,2757(r24)

0006C04C: 2B800063	cmplwi	cr7,r0,99
0006C050: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 99.
0006C054: 38000009	li	r0,9	I'm now setting register "r0" to always be 9.
0006C058: 98180AC7	stb	r0,2759(r24)

0006C098: 2B800063	cmplwi	cr7,r0,99
0006C09C: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 99.
0006C0A0: 3800000B	li	r0,11	I'm now setting register "r0" to always be 11.
0006C0A4: 98180AC7	stb	r0,2759(r24)

0006CA50: 2FA00063	cmpdi	cr7,r0,99
0006CA54: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 99.
0006CA58: 3800000D	li	r0,13	I'm now setting register "r0" to always be 13.
0006CA5C: 48000010	b	0x6ca6c

0006CA7C: 2FA00063	cmpdi	cr7,r0,99
0006CA80: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 99.
0006CA84: 3800000F	li	r0,15	I'm now setting register "r0" to always be 15.
0006CA88: 48000010	b	0x6ca98

0006CAA8: 2FA00063	cmpdi	cr7,r0,99
0006CAAC: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 99.
0006CAB0: 38000011	li	r0,17	I'm now setting register "r0" to always be 17.
0006CAB4: 48000010	b	0x6cac4

0006CB64: 2FA00063	cmpdi	cr7,r0,99
0006CB68: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 99.
0006CB6C: 38000013	li	r0,19	I'm now setting register "r0" to always be 19.
0006CB70: 48000010	b	0x6cb80

0006CBA0: 2FA00063	cmpdi	cr7,r0,99
0006CBA4: 60000000	nop	No more branching depending on whether register "r0" was less than or equal to 99.
0006CBA8: 38000015	li	r0,21	I'm now setting register "r0" to always be 21.
0006CBAC: 48000010	b	0x6cbbc

0006CC48: 2FA90063	cmpdi	cr7,r9,99
0006CC4C: 60000000	nop	No more branching depending on whether register "r9" was less than or equal to 99.
0006CC50: 39200017	li	r9,23	I'm now setting register "r9" to always be 23.
0006CC54: 48000010	b	0x6cc64

0006CF54: 2FA00063	cmpdi	cr7,r0,99
0006CF58: 38070019	li	r7,25	No more branching depending on whether register "r0" was less than or equal to 99, and I changed it to a "li" operation and gave register "r7" value 25.
0006CF5C: F8E90000	std	r7,0(r9)

I tried those out, and I noticed the elemental resistances were all 25%, and all JUMP values were now 3. Found 2 more codes. Next up is the aptitudes that were all 255%. I'll just search for ones that compared something to the value 255 and change them to remove the branch and set a custom value that will tell me which 1 is the correct code. Just search for instances of "00FF	cmp".

0006AE90: 2FA000FF	cmpdi	cr7,r0,255	It's comparing whatever value register "r0" is to the number 255.
0006AE94: 409D0008	ble-	cr7,0x6ae9c	If "r0" was less than or equal to 255, then skip the next 1 line of code.
0006AE98: F8E90000	std	r7,0(r9)	"r0" was greater than 255, so store whatever register "r7" is to the offset $0000 of register "r9".

I guess that's the only instance of it. I guess I'll just try giving it a value and hope it's the code for the aptitudes.

0006AE90: 2FA000FF	cmpdi	cr7,r0,255
0006AE94: 38070003	li	r7,3	No more branching depending on whether register "r0" was less than or equal to 255, and I changed it to a "li" operation and gave register "r7" value 3.
0006AE98: F8E90000	std	r7,0(r9)

I tried it, and all aptitudes were set to 3%. Another code found. Next up is the level modifier, which puts everything's level up to 9,999. I'm going to search for instances of "270F	cmp" again, remove the branches, and change or add a "li" operation to give it a certain value so I can tell which code does the effect.

Nevermind that, there isn't one. Instead, I'll now search for "2710	cmp". No result. Did a search for "270E	cmp", and ended up with 1 result that wasn't one of the ones we found with the first search of "blt" and "ble".

0006A430: 2F84270E	cmpwi	cr7,r4,9998
0006A434: 419D2C14	bgt-	cr7,0x6d048

Looking at this, it checks if something is larger than 9,998, and if it is, it jumps to address 0x006D048. I changed the 9,998 to 0 with:

0006A430: 2F840000	cmpwi	cr7,r4,0
0006A434: 419D2C14	bgt-	cr7,0x6d048

I tried that, and everyone was at level 9,999. I checked, and their actual EXP increased to its maximum amount, but my stats didn't increase, and I didn't unlock new special moves for my characters.

I then went to address 0x0006D048, which was where the code jumped to because unit levels were greater than 0. This is what was there:

0006D048: 3800270F	li	r0,9999	Register "r0" is now 9,999
0006D04C: B0180AAC	sth	r0,2732(r24)	Register "r0", which is 9,999, is 2 bytes and stored at offset $0AAC of register "r24".
0006D050: A0780AB4	lhz	r3,2740(r24)	Load 2 bytes at offset $0AB4 of register $r24.
0006D054: 7C630734	extsh	r3,r3	Don't know what this operation does. I'm guessing it's like the "mr" operation, but it sign extends a number.
0006D058: 3880270F	li	r4,9999	Register $r4 is now 9,999.
0006D05C: 4801DC31	bl	0x8ac8c	Branch and link to another function starting at address 0x0008AC8C.
0006D060: 60000000	nop
0006D064: F8780000	std	r3,0(r24)	Store 8 byte register $r3 at offset $0000 of register $r24.
0006D068: 4BFFD580	b	0x6a5e8	Jump to address 0x0006A5E8.

Still having the previous modification of changing the comparison operation to compare to 0 instead of 9,998, I then change this line:

0006D048: 3800270F	li	r0,9999	Register "r0" is now 9,999

I change it to 3:

0006D048: 38000002	li	r0,2	Register "r0" is now 2

I try that, and every unit is at level 2. That's another code found, but it doesn't seem to have the effects that come with the levels. Next up I'm going to find the code that gave me the max EXP. The part that makes this less easier than the rest is that different characters have different possible max amounts of EXP. However, we know that the amount of EXP a unit has determines its level, and we know a unit's level is 2 bytes at offset $0AAC, so we'll look close by for things that add a level. I'll search for a write to that offset with "0AAC	sth". These are the results:

0006A464: B1380AAC	sth	r9,2732(r24)

0006D04C: B0180AAC	sth	r0,2732(r24)

Only 2 results, and we already found the result at address 0x0006D04C is used to set the level 9,999 limit, so odds are the other result is for normal leveling. So I'm looking at this, and some of it was from the earlier level 9,999 code:

0006A428: A0180AAC	lhz	r0,2732(r24)	The level of a unit is 2 bytes and loaded to register $r0 from offset $0AAC of register $r24.
0006A42C: 7C040734	extsh	r4,r0	Don't know, but it seems to do the same thing as "mr", so now $r0 & $r4 are the same.
0006A430: 2F84270E	cmpwi	cr7,r4,9998	Comparing the unit's level to 9,998.
0006A434: 419D2C14	bgt-	cr7,0x6d048	If a unit's level is greater than 9,998, it branches to a function that sets it to 9,999.
0006A438: EBB80000	ld	r29,0(r24)	I don't know what this is, but it's 8 bytes.
0006A43C: A0780AB4	lhz	r3,2740(r24)	This thing is close to the offset of a character's level, but I don't know what it is.
0006A440: 38840001	addi	r4,r4,1	$r4 is the level, and this adds +1 to it.
0006A444: 7C630734	extsh	r3,r3	Don't know, but it's 2 bytes from offset $0AB4.
0006A448: 7C8407B4	extsw	r4,r4	I'm guessing this operation just sign extends things. Nothing important, $r4 is $r4.
0006A44C: 48020841	bl	0x8ac8c	Go to another function starting at address 0x0008AC8C, do stuff, return to address 0x0006A450.
0006A450: 60000000	nop
0006A454: 7FBD1800	cmpd	cr7,r29,r3	Compare $r29 to $r3, and it's 8 bytes.
0006A458: 419C0190	blt-	cr7,0x6a5e8	If $r29 is less than $r3, jump to address 0x0006A5E8.
0006A45C: A1380AAC	lhz	r9,2732(r24)	The level of a unit is 2 bytes and loaded to register $r9 from offset $0AAC of register $r24.
0006A460: 39290001	addi	r9,r9,1	This adds 1 to the current level of a unit.
0006A464: B1380AAC	sth	r9,2732(r24)	This stores the new level, which is $r9, to offset $0AAC of register $r24.

Looking at all of this, I'm guessing those last 5 lines compare EXP to the next amount of EXP required to level up, and adds a level if it gets high enough. I'm guessing that the "bl	0x8ac8c" goes to the code that calculates how much EXP is required for the next level up. To check this stuff, I changed this line:

0006A460: 39290001	addi	r9,r9,1

I gave it a specific value, 3.

0006A458: 38090003	li	r9,3

I tried the game with this, and when any leveled up, their level became 3 even if they were already higher than 3. I now know that comparison branch determines if you've reached the correct amount of EXP to level up. You level up if $r29 is greater than or equal to $r3, so $r29 must be the amount of EXP something has. I then changed that line back to what it was and then removed the branch:

0006A458: 419C0190	blt-	cr7,0x6a5e8

That became this:

0006A458: 60000000	nop

Every unit was leveled up to 9,999, their EXP was maxed out, and their stats increased. The only problem was I didn't get my new special moves. Something in this whole function gave me the specials, and I'm not sure of what to do. I'm going to find something that affects the EXP specifically rather than the level of a unit. From above, I learned that $r29 was my current EXP.

0006A438: EBB80000	ld	r29,0(r24)	I don't know what this is, but it's 8 bytes.
0006A43C: A0780AB4	lhz	r3,2740(r24)	This thing is close to the offset of a character's level, but I don't know what it is.
0006A440: 38840001	addi	r4,r4,1	$r4 is the level, and this adds +1 to it.
0006A444: 7C630734	extsh	r3,r3	Don't know, but it's 2 bytes from offset $0AB4.
0006A448: 7C8407B4	extsw	r4,r4	I'm guessing this operation just sign extends things. Nothing important, $r4 is $r4.
0006A44C: 48020841	bl	0x8ac8c	Go to another function starting at address 0x0008AC8C, do stuff, return to address 0x0006A450.
0006A450: 60000000	nop
0006A454: 7FBD1800	cmpd	cr7,r29,r3	Compare $r29 to $r3, and it's 8 bytes.
0006A458: 419C0190	blt-	cr7,0x6a5e8	If $r29 is less than $r3, jump to address 0x0006A5E8.

From the 1st line, $r29 is 8 bytes loaded from offset $0000 of register $r24. To test that's correct, I create a value and store it at that offset like this

0006A434: 381D0005	li	r29,5
0006A438: FBB80000	std	r29,0(r24)

I play the game, and everyone has exactly 5 EXP. So I now know offset $0000 is the offset for EXP, which sucks because that has to be the most commonly used offset of anything for every game on every console. Ignoring that, I'm going to check every instance of "0000	std" and hive them a specific value to store. These are what I find:

0006A5C0: F81B0000	std	r0,0(r27)

0006A844: F80B0000	std	r0,0(r11)

0006A85C: F80A0000	std	r0,0(r10)

0006A870: F92A0000	std	r9,0(r10)

0006A9C8: F80B0000	std	r0,0(r11)

0006A9D4: F90B0000	std	r8,0(r11)

0006ACCC: FB9D0000	std	r28,0(r29)

0006AD64: F8090000	std	r0,0(r9)

0006ADD0: F8090000	std	r0,0(r9)

0006AE14: F9490000	std	r10,0(r9)

0006AE58: F9490000	std	r10,0(r9)

0006AE98: F8E90000	std	r7,0(r9)

0006B1FC: F80B0000	std	r0,0(r11)

0006B484: F80B0000	std	r0,0(r11)

0006C0F0: F92B0000	std	r9,0(r11)

0006C148: F80B0000	std	r0,0(r11)

0006C910: F96A0000	std	r11,0(r10)

0006CCB0: F8090000	std	r0,0(r9)

0006CCF4: F8090000	std	r0,0(r9)

0006CD4C: F8090000	std	r0,0(r9)

0006CE5C: F92B0000	std	r9,0(r11)

0006CE68: F8CB0000	std	r6,0(r11)

0006CEEC: F8A90000	std	r5,0(r9)

0006CF0C: F9690000	std	r11,0(r9)

0006CF14: F80A0000	std	r0,0(r10)

0006CF5C: F8E90000	std	r7,0(r9)

0006CF70: F8090000	std	r0,0(r9)

0006D064: F8780000	std	r3,0(r24)

That's all 28 of them. Now I just create a "li" operation before all of them with a specific value and hope the game doesn't freeze or anything because I'm too lazy to check if I'm messing up something obvious.

0006A5C0: 60000000	nop

0006A844: 60000000	nop

0006A85C: 60000000	nop

0006A870: 60000000	nop

0006A9C8: 60000000	nop

0006A9D4: 60000000	nop

0006ACCC: 60000000	nop

0006AD64: 60000000	nop

0006ADD0: 60000000	nop

0006AE14: 60000000	nop

0006AE58: 60000000	nop

0006AE98: 60000000	nop

0006B1FC: 60000000	nop

0006B484: 60000000	nop

0006C0F0: 60000000	nop

0006C148: 60000000	nop

0006C910: 60000000	nop

0006CCB0: 60000000	nop

0006CCF4: 60000000	nop

0006CD4C: 60000000	nop

0006CE5C: 60000000	nop

0006CE68: 60000000	nop

0006CEEC: 60000000	nop

0006CF0C: 60000000	nop

0006CF14: 60000000	nop

0006CF5C: 60000000	nop

0006CF70: 60000000	nop

0006D064: 60000000	nop

I tried that out, and do things that normally increase a unit's EXP. So I kill an enemy with 1 unit, kill an enemy with a team attack, kill an enemy with a tower attack, heal something, create a new character, and reincarnate a character since those are the only things I can think of that increase EXP. I did that stuff, and nothing happened. Now I don't know what to do for sure. I looked at other codes, and Skiller found the code for max mana after a single unit kills anything. You get mana when you kill something, and you also get EXP when you kill something, so I'm hoping they are in the same area.

Max Mana After 1 Unit Kills Anything (Found by Skiller)
000C5210 7F890040

I first go to address 0x000C5210. I search for the 1st instance of "blr" above and below that address so I know the size of the entire function. So the function starts at 0x000C2ADC and ends at 0x000C73F4. So I go to address 0x000C2ADC and start searching for instances of "0000	std". These are what I encountered:

000C55A0: F81C0000	std	r0,0(r28)

000C55B4: F93C0000	std	r9,0(r28)

000C56E4: F8090000	std	r0,0(r9)

000C56F8: F9690000	std	r11,0(r9)

000C5708: F8090000	std	r0,0(r9)

000C5724: F9230000	std	r9,0(r3)

000C5734: F80B0000	std	r0,0(r11)

000C5750: F9230000	std	r9,0(r3)

000C5940: F81F0000	std	r0,0(r31)

000C5954: F93F0000	std	r9,0(r31)

000C5A84: F8090000	std	r0,0(r9)

000C5A98: F9690000	std	r11,0(r9)

000C5AA8: F8090000	std	r0,0(r9)

000C5AC4: F92B0000	std	r9,0(r11)

000C5AD4: F8090000	std	r0,0(r9)

000C5AF0: F92B0000	std	r9,0(r11)

000C5C0C: F81F0000	std	r0,0(r31)

000C5C20: F93F0000	std	r9,0(r31)

000C5D50: F8090000	std	r0,0(r9)

000C5D64: F9690000	std	r11,0(r9)

000C5D74: F8090000	std	r0,0(r9)

000C5D90: F92B0000	std	r9,0(r11)

000C5DA0: F80B0000	std	r0,0(r11)

000C5DBC: F92B0000	std	r9,0(r11)

000C6C94: F8090000	std	r0,0(r9)

000C6CA8: F9690000	std	r11,0(r9)

000C6CB8: F8090000	std	r0,0(r9)

000C6CD4: F92B0000	std	r9,0(r11)

000C6CE4: F80B0000	std	r0,0(r11)

000C6D00: F92B0000	std	r9,0(r11)

That's all 30 instances of that. Now I'm just going to nop all of them:

000C55A0: 60000000	nop

000C55B4: 60000000	nop

000C56E4: 60000000	nop

000C56F8: 60000000	nop

000C5708: 60000000	nop

000C5724: 60000000	nop

000C5734: 60000000	nop

000C5750: 60000000	nop

000C5940: 60000000	nop

000C5954: 60000000	nop

000C5A84: 60000000	nop

000C5A98: 60000000	nop

000C5AA8: 60000000	nop

000C5AC4: 60000000	nop

000C5AD4: 60000000	nop

000C5AF0: 60000000	nop

000C5C0C: 60000000	nop

000C5C20: 60000000	nop

000C5D50: 60000000	nop

000C5D64: 60000000	nop

000C5D74: 60000000	nop

000C5D90: 60000000	nop

000C5DA0: 60000000	nop

000C5DBC: 60000000	nop

000C6C94: 60000000	nop

000C6CA8: 60000000	nop

000C6CB8: 60000000	nop

000C6CD4: 60000000	nop

000C6CE4: 60000000	nop

000C6D00: 60000000	nop

I tried that, and my EXP didn't change when I killed anything or used something like heal. Looks like I found the right place. Now I just go to every address just above those and change whatever it is to a "li" operation with the same register and a specific value so I know know what which addresses are the correct ones.

000C559C: 38000001	r0,1

000C55B0: 38090003	r9,3

000C56E0: 38000005	r0,5

000C56F4: 380B0007	r11,7

000C5704: 38000009	r0,9

000C5720: 3809000B	r9,11

000C5730: 3800000D	r0,13

000C574C: 3809000F	r9,15

000C593C: 38000011	r0,17

000C5950: 38090013	r9,19

000C5A80: 38000015	r0,21

000C5A94: 380B0017	r11,23

000C5AA4: 38000019	r0,25

000C5AC0: 3809001B	r9,27

000C5AD0: 3800001D	r0,29

000C5AEC: 3809001F	r9,31

000C5C08: 38000021	r0,33

000C5C1C: 38090023	r9,35

000C5D4C: 38000025	r0,37

000C5D60: 380B0027	r11,39

000C5D70: 38000029	r0,41

000C5D8C: 3809002B	r9,43

000C5D9C: 3800002D	r0,45

000C5DB8: 3809002F	r9,47

000C6C90: 38000031	r0,49

000C6CA4: 380B0033	r11,51

000C6CB4: 38000035	r0,53

000C6CD0: 38090037	r9,55

000C6CE0: 38000039	r0,57

000C6CFC: 3809003B	r9,59

I try that out, and anything I do maxes out a unit to level 9,999 with the increased stats and EXP but none of the special attacks. I decide to check the codes I overwrote because I probably erased a bunch of branches that check things. These are the ones that had branches:

000C5594: E81C0000	ld	r0,0(r28)
000C5598: E90101F0	ld	r8,496(r1)
000C559C: 7C080214	add	r0,r8,r0
000C55A0: F81C0000	std	r0,0(r28)
000C55A4: 3D200100	lis	r9,256
000C55A8: 792907C6	rldcl	r9,r9,r0,62
000C55AC: 7FA04800	cmpd	cr7,r0,r9
000C55B0: 409D0008	ble-	cr7,0xc55b8
000C55B4: F93C0000	std	r9,0(r28)

000C56DC: E8090000	ld	r0,0(r9)
000C56E0: 7C110214	add	r0,r17,r0
000C56E4: F8090000	std	r0,0(r9)
000C56E8: 3D600100	lis	r11,256
000C56EC: 796B07C6	rldcl	r11,r11,r0,62
000C56F0: 7FA05800	cmpd	cr7,r0,r11
000C56F4: 409D0008	ble-	cr7,0xc56fc
000C56F8: F9690000	std	r11,0(r9)

000C5718: E8030000	ld	r0,0(r3)
000C571C: 7FA04800	cmpd	cr7,r0,r9
000C5720: 409D0034	ble-	cr7,0xc5754
000C5724: F9230000	std	r9,0(r3)

000C5744: E8030000	ld	r0,0(r3)
000C5748: 7FA04800	cmpd	cr7,r0,r9
000C574C: 409D0008	ble-	cr7,0xc5754
000C5750: F9230000	std	r9,0(r3)

000C5938: E81F0000	ld	r0,0(r31)
000C593C: 7C150214	add	r0,r21,r0
000C5940: F81F0000	std	r0,0(r31)
000C5944: 3D200100	lis	r9,256
000C5948: 792907C6	rldcl	r9,r9,r0,62
000C594C: 7FA04800	cmpd	cr7,r0,r9
000C5950: 409D0008	ble-	cr7,0xc5958
000C5954: F93F0000	std	r9,0(r31)

000C5A7C: E8090000	ld	r0,0(r9)
000C5A80: 7C190214	add	r0,r25,r0
000C5A84: F8090000	std	r0,0(r9)
000C5A88: 3D600100	lis	r11,256
000C5A8C: 796B07C6	rldcl	r11,r11,r0,62
000C5A90: 7FA05800	cmpd	cr7,r0,r11
000C5A94: 409D0008	ble-	cr7,0xc5a9c
000C5A98: F9690000	std	r11,0(r9)

000C5AB8: E80B0000	ld	r0,0(r11)
000C5ABC: 7FA04800	cmpd	cr7,r0,r9
000C5AC0: 409D0034	ble-	cr7,0xc5af4
000C5AC4: F92B0000	std	r9,0(r11)

000C5AE4: E80B0000	ld	r0,0(r11)
000C5AE8: 7FA04800	cmpd	cr7,r0,r9
000C5AEC: 409D0008	ble-	cr7,0xc5af4
000C5AF0: F92B0000	std	r9,0(r11)

000C5C04: E81F0000	ld	r0,0(r31)
000C5C08: 7C150214	add	r0,r21,r0
000C5C0C: F81F0000	std	r0,0(r31)
000C5C10: 3D200100	lis	r9,256
000C5C14: 792907C6	rldcl	r9,r9,r0,62
000C5C18: 7FA04800	cmpd	cr7,r0,r9
000C5C1C: 409D0008	ble-	cr7,0xc5c24
000C5C20: F93F0000	std	r9,0(r31)

000C5D48: E8090000	ld	r0,0(r9)
000C5D4C: 7C190214	add	r0,r25,r0
000C5D50: F8090000	std	r0,0(r9)
000C5D54: 3D600100	lis	r11,256
000C5D58: 796B07C6	rldcl	r11,r11,r0,62
000C5D5C: 7FA05800	cmpd	cr7,r0,r11
000C5D60: 409D0008	ble-	cr7,0xc5d68
000C5D64: F9690000	std	r11,0(r9)

000C5D84: E80B0000	ld	r0,0(r11)
000C5D88: 7FA04800	cmpd	cr7,r0,r9
000C5D8C: 409D0034	ble-	cr7,0xc5dc0
000C5D90: F92B0000	std	r9,0(r11)

000C5DB0: E80B0000	ld	r0,0(r11)
000C5DB4: 7FA04800	cmpd	cr7,r0,r9
000C5DB8: 409D0008	ble-	cr7,0xc5dc0
000C5DBC: F92B0000	std	r9,0(r11)

000C6C8C: E8090000	ld	r0,0(r9)
000C6C90: 7C030214	add	r0,r3,r0
000C6C94: F8090000	std	r0,0(r9)
000C6C98: 3D600100	lis	r11,256
000C6C9C: 796B07C6	rldcl	r11,r11,r0,62
000C6CA0: 7FA05800	cmpd	cr7,r0,r11
000C6CA4: 409D0008	ble-	cr7,0xc6cac
000C6CA8: F9690000	std	r11,0(r9)

000C6CC8: E80B0000	ld	r0,0(r11)
000C6CCC: 7FA04800	cmpd	cr7,r0,r9
000C6CD0: 409D0034	ble-	cr7,0xc6d04
000C6CD4: F92B0000	std	r9,0(r11)

000C6CF4: E80B0000	ld	r0,0(r11)
000C6CF8: 7FA04800	cmpd	cr7,r0,r9
000C6CFC: 409D0008	ble-	cr7,0xc6d04
000C6D00: F92B0000	std	r9,0(r11)

That's 15 of them. I undid those ones and tried the game with the other ones that didn't overwrite a branch. This is what I noticed:

1. A single unit killing another unit normally or with a special attack always had 45 EXP.

2. Units in a group attack or tower attack all got 13 EXP.

3. Units that used restorative special stuff like healing or espoir had 57 EXP.

Out of those, I didn't have the chance to find a place where I could open a treasure chest with EXP in it, but I know one of the other codes changed that too.