Hacking in Rare Candies in Pokémon Fool's Gold

After rewatching my favourite streamer, Ray Narvaez Jr, talk about doing a hard run in Fool's Gold only if unlimited rare candies were available, I wondered how difficult it would be to figure out the hacks for it.

Below you'll find the GameShark codes for infinite rare candies as well as how to use mGBA to modify the game memory if you don't have access to use GameShark codes (such as with an EverDrive), then finally an explainer on why this works and why other codes or PkHex doesn't work.

These will be for version 1.3.2 (hotfix 1) as per the official website. This may not work for other versions as the internal layout could be different. The ones for vanilla Crystal will not work. Though there are codes for 1.3.1 at the very bottom.

To test the codes, I did some side content and beat the Pokémon League:

GameShark Codes

This will replace the first item in your bag with 99 rare candies. This is an easier version of the Memory Modification heading below - the outcome is the same, do this one if you can.

Use the following under Tools -> Cheats:

011F7CD8
01637DD8

Memory Modification

This will replace the first item in your bag with 99 rare candies. This has a similar outcome as GameShark method above. Whereas the GameShark code will constantly set the value to 99 rare candies in the background while you play, this will set it once meaning you can use them up - but it's easy enough to do this again later. Use this if you can't or don't want to use GameShark codes.

We'll be setting the value of the following memory addresses:

1. 0xD87C to 1F
2. 0xD87D to 63

There is a more in-depth guide in my Hacking in Rare Candies in Pokémon Crystal Legacy post, but here's a video of the whole process:

Explainers

Here onwards will be a much more in-depth look at this topic, specifically looking directory at memory. A long time ago I learned a lot when looking for how the water animation in Crystal worked by digging through pret/pokecrystal. Then I got really interested in the tutorials to add features to the game. My software background also helps.

Why Does This Work?

We modify two values: the item ID and the quantity.

Each item in the game has an ID and rare candy has a hex ID of 21.

The second is the quantity and we type in 63. Why not 99? That's because the number 99 is represented by 63 in hex.

If you want to know more about hex numbers you can start at the hexadecimal Wikipedia page, otherwise don't worry about it.

We are modifying the game while it's running which is why we use the memory window in mGBA. It's almost as if you picked up 99 rare candies off the ground.

And, if you had the know-how, you could do anything from here such as: changing the level of your Pokémon, giving yourself max money, and much more. Just gotta know the memory addresses.

Why Modify the First Item?

Technically, it can be any item in your bag. The first item being the first address for the bag makes it easy for us to find.

Why Not Just Add a New Item at the End?

The bag in the Game Boy Pokémon games has a separate record of how many items are in the bag and a terminator. If we just add a new item at the next free memory areas using the trick we learned, we wouldn't be able to scroll down to it because the game will stop us scrolling because it still thinks we have the old number of items in the bag. This is why we manipulate an already existing item, such that we don't run into this problem.

Why Not PKHex?

PKHex is a great Pokémon save editing tool for vanilla games. However, if you try to use PKHex to manipulate your bag, it may corrupt your save due to the custom memory layout in Fool's Gold. The IDs of items have also changed.

Why Not Existing Crystal GameShark Codes?

The items IDs have changed and so has the place in memory the bag usually is.

Why Not Modify the Save File Itself?

The save file contains the items in your bag and the quantity, so why not modify that instead of opening mGBA and running the game?

Pokémon Crystal, and thus Fool's Gold, has a checksum that checks the integrity of the saved data when we load the game. The checksum is calculated when you save the game. If the data is then changed and the checksum check when the game loads doesn't match, then the game will say your data is corrupted.

How Did I Find the Locations in Memory?

I already knew roughly how the bag in Crystal works via past experience and the Bulbapedia save data structure page, however the internal memory layout has changed from that. Using ImHex, I did a quick diff between three save files where the bag had slightly changed. I knew I was looking for a structure that is:

1. A number that represents the count of unique items in the bag, x
2. x number of pairs for item ID and count
3. An FF terminator

The first diff was between having a single potion and no potion. Where I immediately saw what I suspected was this at 0x0000160C onwards. Then a second diff with a potion and a berry in the bag. This incremented the count, kept the suspected potion count unchanged, added a new item with quantity 1, and moved the FF terminator.

Sadly I don't know enough about the memory offset of the save file vs the in-memory location. It seems to be offset by approx 0xC26E (49774), which is close to the offset of the 0xC000 for the 4-8 kiB of working ram. Regardless, the search for the 9C ID of the berry, and knowing the working ram addresses when using the memory inspector in mGBA, narrowed down my search space I found it pretty quickly.

Why the berry? When looking in ImHex the other item IDs were more commonly found in memory representing values for something else. It just so happened the 9C value appeared way less and made the search easy.

How Did I Find the Rare Candy ID?

Turns out it's not the original value of 0x20 which is now an X-Accuracy, but we can do some sleuthing. The potion has an original ID of 0x12 and in this game it's 0x11 so trying original rare candy value of 0x20 then subtracting 1 gives us 0x1F which works, luckily.

Luckily because when looking at the original berry ID of 0xAD and the new ID of 0x9C we now get a difference of 11. Meaning between the potion and the berry, 10 items have been squeezed in. Though I was absolutely willing to go through the IDs one by one.

Other Points

• This was my first time making a GameShark code
• All of this is based what I learned with the Pokémon Legacy games
• I had started a 1.3 save awhile back, but didn't get far before putting it down

Version 1.3.1 Cheats

If you're playing the 1.3.1 version only. They seem to work, but have not be tested with a full playthrough.

GameShark

011F7BD8
01637CD8

Memory Modification

1. 0xD87B to 1F
2. 0xD87C to 63

To Conclude

It was fun digging into this ROM hack. Peering behind the curtain and seeing what's changed vs the vanilla game is really interesting. Remember these codes may not work in the future if the internal memory layout changes.

Text in header from https://www.textstudio.com/