A Technical Guide to Arbitrary Code Execution

# A Technical Guide to Arbitrary Code Execution

### Final Fantasy Crystal Chronicles: Echoes of Time

- Arbitrary Code Execution works on English localizations of the game
- Addresses mentioned in this guide come from the American DS version

---

## Definitions

### Keyword functions

```
typedef struct Keyword_Functions
{
    [+0x00] void (* function_0) (void);
}
Keyword_Functions;

[0x02136104] struct Keyword_Functions * keyword_functions;
```

### Text variables

```
typedef struct Text_Variables
{
    [+0x0c] char16_t buffer[63];
    [+0x8a] char16_t blank_0;
    [+0x8c] char16_t blank_1;
    [+0x8e] uint16_t length_total;
    [+0x90] uint16_t length_white;
    [+0x92] uint16_t length_limit;
}
Text_Variables;

[0x02136060] struct Text_Variables text_variables;
```

### Friend code entry

```
typedef struct Friend_Code_Entry
{
    uint32_t unknown;
    uint64_t friend_code;
}
Friend_Code_Entry;
```

### Friend code list

```
typedef struct Friend_Code_List
{
    [+0x0c] struct Friend_Code_Entry friend_code_entries[SIZE];
}
Friend_Code_List;

[0x021309dc] struct Friend_Code_List friend_code_list;
```

### Transition amount

```
[0x021309bc] uint8_t transition_amount_0;
[0x021309bd] uint8_t transition_amount_1;
[0x021309be] uint8_t transition_amount_2;
[0x021309bf] uint8_t transition_amount_3;
```

### Metadata

```
[0x0211c1b0] uint64_t large_seed_copy_0;
[0x0211c1b8] uint32_t small_seed_copy_0;
[0x02121c20] uint64_t large_seed_copy_1;
[0x02121c28] uint32_t small_seed_copy_1;
```

### Transition variables

```
[0x0211678f] uint8_t transition_type;
[0x02116790] uint8_t transition_id;
[0x02116791] uint8_t transition_slot;
```

---

## Buffer overflow

### Offset

- Write 61 **typewriter apostrophes**
- Confirm the text

### L-dialing

- Write either **L** or **l**
- Open the keyword menu
- Touch "**let's do this**"
- Turn to the next page
- Move from "**lift**" to "**Lian**"
- Move from "**Lian**" to "**level**"
- Move from "**level**" to "**let's go**"
- Turn to the next page
- Move from "**Lilty**" to "**list**"
- Confirm the keyword

### Memory corruption

- Write a **right square bracket**
- Erase characters until the end of the text reads **listLAg**
- Write the lower part of the address
- Write the upper part of the address

---

## General rules

### Branching

- Branching to an **even** address switches to **ARM**
- Branching to an **odd** address switches to **Thumb**

### Credits warp

- Transition to a menu uses **transition_type == 2**
- Transition to the credits uses **transition_id == 9**

### Leaving keyword menu

- **keyword_functions** is loaded into a register
- **keyword_functions->function_0** is loaded into a register
- **keyword_functions->function_0** is called as a subroutine

### Loading

- Considering **0x12345678** written at an address **A = 4 * N**
- Loading from **A + 0** returns **0x12345678**
- Loading from **A + 1** returns **0x78123456**
- Loading from **A + 2** returns **0x56781234**
- Loading from **A + 3** returns **0x34567812**

### Metadata

- The variables **large_seed** and **small_seed** are randomly generated
- The seeds are generated when the **Friend Roster / Options** are erased
- The seeds are saved on the cartridge and are thus persistent
- The **large_seed** can only be generated once per boot
- The seeds are written at **0x021302D0** in multiplayer mode

---

## Standard run

### Gold

- Acquire the **Guardian Bangle**
- Acquire two coins with attribute **30**
- Go to the Town
- Sell the **Guardian Bangle**

### Heap

- Hire two characters at the guild
- Go to the Town entrance
- Drop 23 coins
- Drop a coin with attribute **531**
- **0x00000213** is written at **0x0231022C**

### Transition amount

- The following ARM code is written at **0x021309BC**

```
+-----------------------+----------+
| LDRNE r1, [r5, -#515] | 15151515 |
+-----------------------+----------+
```

### Friend codes

- Write the following Friend Codes
- The following ARM code is written at **0x021309E8**

```
+-------------------------+-------------+----------------+
| MOVNE   r0, #02000000   | 05-13a00402 | 0218-0409-0370 |
+-------------------------+-------------+----------------+
| MOVNE   r1, r4, LSR #11 | 6f-11a018a4 | 4770-3707-4596 |
+-------------------------+-------------+----------------+
| LDRNE   r2, [PC, #1c]   | 32-159f201c | 2151-1111-4780 |
+-------------------------+-------------+----------------+
| STMIANE r2, {r0-r1}^    | 6f-18c20003 | 4771-5673-7027 |
+-------------------------+-------------+----------------+
| BXNE    LR              | 71-1120001e | 4856-1861-4302 |
+-------------------------+-------------+----------------+
| ADDR    0x0211678c      | 0a-0211678c | 0429-8436-8012 |
+-------------------------+-------------+----------------+
```

### Buffer overflow

- Lower part of the address: **0x022E** (umbrella)
- Upper part of the address: **0x0231** (squared question mark)
- **0x0231022E** is written at **0x02136104**

### Execution

- Write one of the bottom-left arrows
- Erase characters until **length < 63**
- Write a common letter
- Open the keyword menu
- Touch the top-right button

---

## NewGame+ run

### Weapon

- Acquire a 3-slot weapon with attribute **0x02123D25**

```
+----+---------------+
| 25 | Fire Stone 1  |
| 3d | Time Stone 1  |
| 12 | Guard Stone 6 |
| 02 | Level 3 + 0/8 |
+----+---------------+
```

### Accessories

- Acquire and order accessories such that their attributes read as follows

```
+----+-------------------+
| 02 | Strength Stone 2  |
| 49 | Holy Stone 1      |
| 02 | Strength Stone 2  |
| 20 | Level 1 + 1/8     |
+----+-------------------+
| 08 | Magic Stone 2     |
| 70 | Anti-Dark Stone 4 |
| 09 | Magic Stone 3     |
| 20 | Level 1 + 1/8     |
+----+-------------------+
| 48 | Dark Stone 6      |
| 70 | Anti-Dark Stone 4 |
| 70 | Anti-Dark Stone 4 |
| 47 | Level 8 + 2/8     |
+----+-------------------+
| 8f | Wisdonium         |
| 67 | Anti-Time Stone 1 |
| 11 | Guard Stone 5     |
| 02 | Level 3 + 0/8     |
+----+-------------------+
```

- The following Thumb code is written at **0x02123D24**

```
+-------------------+------+---------------------+
| LDR  r1, [PC, #8] | 4902 | 01001 001 00000010  |
+-------------------+------+---------------------+
| MOV  r0, #2       | 2002 | 00100 000 00000010  |
| STRB r0, [r1, #0] | 7008 | 01110 00000 001 000 |
+-------------------+------+---------------------+
| MOV  r0, #9       | 2009 | 00100 000 00001001  |
| STRB r0, [r1, #1] | 7048 | 01110 00001 001 000 |
+-------------------+------+---------------------+
| BX   LR           | 4770 | 01000 11101 110 000 |
+-------------------+------+---------------------+
| ADDR 0x____678f   | 678f | 0110 0111 1000 1111 |
| ADDR 0x0211____   | 0211 | 0000 0010 0001 0001 |
+-------------------+------+---------------------+
```

### Heap

- Before completing the Forest, in the Village
- Drop 22 coins
- Drop the equipment with attribute **0x02123D25**
- **0x02123D25** is written at **0x02310088**

### Buffer overflow

- Lower part of the address: **0x0088** (caret / circumflex)
- Upper part of the address: **0x0231** (squared question mark)
- **0x02310088** is written at **0x02136104**

### Execution

- Write one of the bottom-left arrows
- Erase characters until **length < 63**
- Write a common letter
- Open the keyword menu
- Touch the top-right button

A Technical Guide to Equipment Transmutation

# A Technical Guide to Equipment Transmutation

### Final Fantasy Crystal Chronicles: Echoes of Time

- Equipment Transmutation works on all versions of the game
- Addresses mentioned in this guide come from the Japanese DS version

---

## Definitions

### Menu graph

```
[Main Menu]-+-[Status]-+-[Equipment]-+-[Weapons]
            |          |             |
            |          |             +-[Head_Armor]
            |          |             |
            |          |             +-[Body_Armor]
            |          |             |
            |          |             +-[Accessories]
            |          |
            |          +-[Equipped_Bonuses]
            |          |
            |          +-[Abilities]
            |          |
            |          +-[AI_Settings]
            |
            +-[Chronicles]
            |
            +-[Items]-+-[Weapons]
            |         |
            |         +-[Head_Armor]
            |         |
            |         +-[Body_Armor]
            |         |
            |         +-[Accessories]
            |         |
            |         +-[Materials]
            |         |
            |         +-[Jewels]
            |         |
            |         +-[Scrolls]-+-[Weapons]
            |         |           |
            |         |           +-[Head_Armor]
            |         |           |
            |         |           +-[Body_Armor]
            |         |           |
            |         |           +-[Accessories]
            |         |           |
            |         |           +-[Materials]
            |         |
            |         +-[Money]
            |
            +-[Scratch_Cards]
```

### Equipment attributes

```
typedef struct Equipment_Attributes
{
	uint8_t jewel_1;
	uint8_t jewel_2;
	uint8_t jewel_3;
	uint8_t level;
}
Equipment_Attributes;
```

### Equipment lists

```
#define SIZE 50

typedef struct Equipment_List
{
	struct Undefined *          undefined;
	uint32_t                    length;
	uint16_t *                  id[SIZE];
	struct Equipment_Attributes attributes[SIZE];
}
Equipment_List;

[0x021236cc] struct Equipment_List Weapons;
[0x02123864] struct Equipment_List Body_Armor;
[0x021239fc] struct Equipment_List Head_Armor;
[0x02123b94] struct Equipment_List Accessories;

struct Equipment_List *type[4] =
{
	&Weapons,
	&Head_Armor,
	&Body_Armor,
	&Accessories
};
```

### Characters

```
typedef struct Character
{
	[+0x94] uint16_t *                  id_weapon;
	[+0x98] uint16_t *                  id_head_armor;
	[+0x9c] uint16_t *                  id_body_armor;
	[+0xa0] uint16_t *                  id_accessory;
	[+0xa4] struct Equipment_Attributes attributes_weapon;
	[+0xa8] struct Equipment_Attributes attributes_head_armor;
	[+0xac] struct Equipment_Attributes attributes_body_armor;
	[+0xb0] struct Equipment_Attributes attributes_accessory;
}
Character;

[0x02122dd8] struct Character char_0;
[0x02123014] struct Character char_1;
[0x02123250] struct Character char_2;
[0x0212348c] struct Character char_3;

struct Character *characters[4] =
{
	&char_0,
	&char_1,
	&char_2,
	&char_3
};

[0x02125f4c] uint32_t current_character;
```

### Menu variables

```
typedef struct Menu_Variables
{
	[+0x04] uint32_t                    flag;
	[+0x44] uint32_t                    equipment_index;
	[+0x91] uint8_t                     submenu_index_scrolls;
	[+0x93] uint8_t                     submenu_index_equipment;
	[+0x94] uint8_t                     submenu_index_items;
	[+0xa4] struct Equipment_List *     equipment_list;
	[+0xa8] uint16_t *                  equipment_id;
	[+0xac] struct Equipment_Attributes equipment_attributes;
}
Menu_Variables;

[0x02135734] struct Menu_Variables menu_variables;
```

---

## Flag behavior

The flag determines whether some variables should be updated

### The flag is set upon:

- Opening the menu
- Closing the preview of a Scratch Card

### The flag is cleared upon:

- Closing the menu
- Opening the preview of a Scratch Card

### The flag is not set back when a Scratch Card is discarded

- Main reason the glitch exists

---

## Updates requiring (flag == 1)

### Opening [Main Menu] for the first time

```
equipment_list = &Weapons;
equipment_id = characters[current_character]->id_weapon;
equipment_attributes = characters[current_character]->attributes_weapon;
```

### Highlighting an equipment from [Equipment]

```
equipment_list = type[submenu_index_equipment];
equipment_id = characters[current_character]->id_any;
equipment_attributes = characters[current_character]->attributes_any;
```

### Closing [Equipment]

```
equipment_list = &Weapons;
equipment_id = characters[current_character]->id_weapon;
equipment_attributes = characters[current_character]->attributes_weapon;
```

### Opening [Equipment] - [Any]

```
equipment_list = type[submenu_index_equipment];
```

### Highlighting an equipment from [Equipment] - [Any]

```
equipment_id = equipment_list->id[equipment_index];
equipment_attributes = equipment_list->attributes[equipment_index];
```

### Closing [Equipment] - [Any]

```
equipment_id = equipment_list->id[0];
equipment_attributes = equipment_list->attributes[0];
```

Note: these modifications are overridden as [Equipment] is then opened

### Opening [Items] - [Any]

```
equipment_list = type[submenu_index_items];
```

### Highlighting an equipment from [Items] - [Any]

```
equipment_id = equipment_list->id[equipment_index];
equipment_attributes = equipment_list->attributes[equipment_index];
```

### Closing [Items] - [Any]

```
equipment_id = equipment_list->id[0];
equipment_attributes = equipment_list->attributes[0];
```

### Opening [Scrolls] - [Any]

```
equipment_list = type[submenu_index_scrolls];
```

Note: highlighting a scroll updates other variables regardless of the flag

---

## General rules

### Highlighting an equipment

- **equipment_index** ranges from **0** to **equipment_list->length - 1**

### Discarding an equipment

- Discarded equipments use **equipment_id** and **equipment_attributes**
- Clears entry **equipment_index** from the list the equipment would come from
- Crashes the game if **equipment_id == NULL**

---

## Main applications

### Transmutation from the first equipment of a list

- Open [Equipment] or [Items] - [Any_0]
- Discard a Scratch Card from [Scratch_Cards]
- Discard equipments from [Items] - [Any_1]

### Transmutation from a scroll

- Discard a Scratch Card from [Scratch_Cards]
- Highlight a scroll from [Scrolls] - [Any_0]
- Discard equipments from [Items] - [Any_1]

### Infinite transmutation from a scroll

- Considering [Any_1] different from either [Weapons] or [Any_0] respectively
- Open [Equipment], [Items] - [Any_0], or [Scrolls] - [Any_0]
- Discard a Scratch Card from [Scratch_Cards]
- Highlight a scroll from [Scrolls] - [Any_1]
- Discard equipments from [Items] - [Any_2]

FFCC Echoes of Time Equipment Transmutation / Duplication

When discarding a Scratch Card, the game stops correctly updating some pointers regarding the Equipment Submenus.  
Relevant for Transmutation/Duplication, these pointer references to what Equipment, including Level and Jewels, gets discarded.  
This effect is cancelled when fully closing the Menu.

-----

# Equipment Transmutation:
- Copies the First Item of an Equipment Submenu
- The Current Equipments can be used as well. First Item of that is the Weapon
- Transmutates only from the same Submenu
- Step 1 can be skipped if selecting the same submenu as last time (Default: Weapon)

1. Go into the Item Menu and open an Equipment Submenu to do transmutation in.
2. Return to the Base Menu, open the Scratch Cards Menu and drop any 1 Scratch Card.
3. Return to the Base Menu, open the Item Menu and go into any Equipment Submenu.
4. Drop any Item you wish to Transmutate.

__Alternative First Step:__
- Go into the Status Menu and Open the Equipment Submenu.
 - This Selects the currently Equipped Weapon for duplication and the Weapon Item Submenu to Transmutate from

-----

# Scroll and Infinite Transmutation:
- Requires 1 Scratch Card
- Copies the result of an Equipment Scroll
- Can skip Step 1 if selecting the last selected Submenu again (Default: Weapon)
- Can go to Step 4 after either an Equip or Scroll Transmutation to continue quicker

1. Go into the Item Menu and Open any Equipment Submenu with Items in it.
2. Return to the Base Menu, open the Scratch Cards Menu and drop any 1 Scratch Card.
3. Return to the Base Menu, open the Item Menu and go into the Scrolls Submenu.
4. Highlight whichever Equipment Scroll you wish to create.
5. Drop any Equipment Items you wish to turn into the Crafted Item.

__Additional Info__
- If the Created Equipment is from a different Submenu, The Item from that Submenu in the chosen Item Slot will be discarded.
- You will be able to discard further, even if there are no more Items in that Submenu at the chosen Item Slot. In this case you will turn nothing to something.

-----

## Common Issues:
- Fully closing out of the Menu Cancels the Glitch.
- **THE GAME CRASHES** if the last Item or Scroll Page you opened while Marking what you want to create was empty.

-----

Thanks to Priestess Emilia for bringing this Glitch up in the Discord.
There is so much more info on how this works on a more technical level on the discord that is fully skipped over for this guide!


Website with a lot of info

Vallnoir Found this website from someone who put a lot of work in Adding Info about about everything.
One of the best resources around this game we've found so far.

http://sephirosuy.blogspot.com/2009/03/ffcc-eot-game-guide-walkthrough.html

WIP Guide, Currently Game Start till after Aqueducts 1

New Guide I work on (Keeping this on for now due to it having more detailed information then this guide has at this point):
[https://docs.google.com/document/d/1pk8H9Y_JkTwUmXl4PUSvLL_cNqvA3bGm7OiRRQgZJVg/edit#heading=h.hdw8uhr9cwb](https://docs.google.com/document/d/1pk8H9Y_JkTwUmXl4PUSvLL_cNqvA3bGm7OiRRQgZJVg/edit#heading=h.hdw8uhr9cwb)

Techniques

- Walk Attack Cancels (WAC): Walking after a melee attack reduces the time before another melee attack. Only used in early game.
- Charge Attack Cancels (CAC): Hold the Attack button just a bit before releasing. Release once you see the white Aura around your weapon.
- Charge Walk (CW): Slightly faster walking speed. Faster for medium to longer distances.
- Ignore Level Entry Charge: You can hold Attack exiting a level to start a charge immediately without reentering the level. Useful for earlier **[CW]**. Easier on DS compared to Wii.
- Stack Jumps (SJ): Stack Characters, then jump starting with the lowest one. More effective with Selkies as they can double jump. If you move while **[SJ]**, stop before character change or you run off.
- Dungeon Exit (Exit): While in a dungeon, **[Start > Door (Bottem Center) > Lower Option]**, will exit you to the World Map or the Town you entered the dungeon through.

# Notes

- Pick up everything you can without losing time, espacially direct Gil.
- Count the amount of Boss Rings you get, they are 500Gil each.
- If you struggle with a jump, **[Start > Bag (Bottom Left) > Money (Bottom Right) > Discard]** gives you a small platform. Can spam for a staircase.  

# Run Start

---

# Character Creation

- Selkie. Shorter Names are a few frames faster, but doesn't matter to much.
- A female Selkie will have a different character image then a male one we get as part of the run, so if you rely on visuals for distinction, chose female.
---

# Village

- 1 Cutscene Skip
- Spam away Text
- Try to double jump in a way that you don't get landing stuns.
- Leave through the top right Exit.
---

# Forest

### Room 1

- 1 Textbox, Wait, 1 Textbox, Decline on touchsceen (lower option)
- Fire + 2 Melee on Squirrel at start
- Put in Keystone
- Fire + Melees to kill the Quirrel + Bat before continuing.

### Room 2

- Go straight to the end
- Fight the Moblins using Fire + Melee, level up after first kill.
- Switch to Ice before continuing

### Boss

- 1 Cutscene Skip
- Attack the boss a few times to get off the helmet.
- Head is the weekpoint. Try to stay on the armor around his head, using **[WAC]** is hard as it's easy to fall off or walk onto the head.
- Use Ice to stop the Boss from throwing you off. The boss has 2 attacks that throw you off, "Arm Spin" and "Energy Blast from Head"

### Post Boss

- 1 Cutscene Skip, mash through 3 Text Boxes
- Return to the Boss Arena (Down Right), **[Exit]**
---

# Village

- 1 Cutscene Skip, Leave through bottom left.
---

# Map

- Go to town with a **[CW]**.
---

# Town

- Sections in any order.

### East Town

- Talk to the recruiter.
- Add 1 Selkie and 2 Yuke (Party should be 2 Selkie, 2 Yuke)

### North Town

- Go to the Library
- Skip 3 Cutscenes, 3 Textboxes, Decline Magic Tutorial, 2 Textboxes.
- **[Exit]**, then talk to the Green Head Lilty at the fountain in front of the Library.

### Optional Shopping

- Can skip one phase with perfect **[CAC]** on the Aqueducts Boss
- Go to the left Shop on the Market and buy the top most ring for your main Selkie.
---

# Map

- Go to Aqueducts, no **[CW]**.
---

# Aqueducts

### Room 1

- Start a **[CW]**, move Up and immediately Up Right. (You'll get the position to evade the stun eventually)
- Grab the block ignoring the Sqiurrels, pull it out.
- Switch Magic to Thunder and leave.

### Room 2

- **[CW]** to the Attack Pole and Release on it.
- **[CW]** to Button and leave.

### Room 3

- Walk up to the Thunder Receiver and Thunder it.
- Hit the Button and leave.

### Room 4

- Push the Grey Block to be half above the Water, then jump into the water.
- Swim under the block and jump, the block stays on your head.
- (This is the only block that we have found that works like this.)
- Carry it to the Button, Switch Character and use Party Call to let the block drop.
- Continue

### Room 5

- (This will only cover the glitched, slightly inconsistent way of doing the room)
- Fall into the hole in the center of the first section with one of your selkies.
- Walk down left. Switch to Up Right and Single Jump at the same time.
- If successful, you'll just walk through the gate.
- Repeat for the 2nd Section.
- Switch Magic to Ice and Ice the Lizard.
- Push the Button Pillar, change to the other Selkie and leave.

### Room 4.1

- Leave through the Down Left Exit.

### Room 6

- Kill enemies.
- Charge Attack kills elementals.
- Use Charge Attacks and **[CAC]** to kill Lizards.
- Keystone drops into the center of the room.
- Continue

### Room 2.1

- **[CW]** to the Left Exit

### Room 7

- Charge Attack the Attack Pole to the Up Right of the entrance.
- Get the Box from the Upper Elevator and try to put it onto the button right next to it.
- Walk back to the Attack Pole and push walk the box on the way onto the button.
- Attack the Pole.
- Get the Box from the Left Elevator and put it onto the button right next to it.
- Put the remaining boxes onto the Buttons that they are next to, ending as far up right as possible.
- Leave through the Up Right Exit

### Room 6.1

- **[CW]** and Get the Key.
- Leave through the bottom Exit.

### Room 2.2

- **[CW]** to the Left Exit

### Room 7.2

- Run to the Golden Key Gate in the middle of the Elevators.
- Start > Status (Top Left) > AI Settings (Lowest) > Everyone to "Don't use Magic" (3rd Option)
- Fully back out of the menu.
- Switch Magic to Ice.
- Walk past the save crystal.
- Push the buttons either starting on either side.
- Always push the outer button first and use Character Switching to cut down on movement when possible.

### Boss

- Skip Cutscene
- Move to the other side of the boss compared to your party.
- Ice the boss, Switch to fire, Fire the boss.
- Attack the week point using **[CAC]**, ideally with your party there, but it's not worth it to call them.
- Go to a chest in the right or left corner and heal your party.
- Can fit a few attacks in while he has armor.
- Repeat till death.
- Crystal spawn: In the Center there is a darker patch of floor. It spawns at the down most side on the most right. Stand with your char fully on the patch.
---

# A bunch of sections I don't want to split up because only one thing happens in all of them.

- To Town, no **[CW]**
- Go to the Library in the North Part of Town.
- Speak to Librarian, mash the text, then **[Exit]**.
- Exit the Town and go to Village with **[CW]**.
- Speak with Cat Girl, mash Text, skip 2 Cutscenes.
- Exit the Village and go to the Town with **[CW]**.
- Go to the Library in the North Part of Town.
- Mash Text, Skip 1 Cutscene, Mash Text **[Exit]**
- **Go to the Left Shop and buy the 225 Gil Paddle for your main Selkie.**
- Exit the Town and go to Ice Mountain with **[CW]**

Name	Autor
A Technical Guide to Arbitrary Code Execution	Priestess_Emilia 1 year ago
A Technical Guide to Equipment Transmutation	Priestess_Emilia 1 year ago
FFCC Echoes of Time Equipment Transmutation / Duplication	Mian_K 1 year ago
Website with a lot of info	Mian_K 6 years ago
WIP Guide, Currently Game Start till after Aqueducts 1	Mian_K 2 years ago