Code reference · FinalCheat

01

.psv

Cheatfile structure

Manual p. 3

Name the file after the game's Title ID, for example PCSH00297.psv, and place it in ux0:vitacheat/db/. Check the Title ID and version in sce_sys/param.sfo.

A file contains game information, entry names, and code lines. Consecutive code lines under one entry form a single cheat.

Field	Meaning	Details
#	Game information or comment	Include the Title ID, game name, and version.
_V0 name	Entry OFF by default	This is the original VitaCheat file meaning.
_V1 name	Entry ON by default	Overlay reads the flag but never automatically enables it in a new session.
$	Start of a code line	Followed by the operation, address, and value fields.

Example file

# PCSH00297 Ys VIII CHT 1.02
_V0 EXTRA MAX
$A100 8124D8C6 0000BF00
_V1 SP Max
$3201 8148A1F0 00048240
$3300 00000000 00002710

Start each entry with _V0 or _V1. The following $ lines belong to that entry.

02

$AAAA BBBBBBBB CCCCCCCC

Anatomy of a code line

Manual p. 4

Separate the three hexadecimal fields with spaces. AAAA has four digits; the other fields have eight each. Pad them even when writing only one byte.

The opcode determines what each field means. A copy uses the third field as a source address; a compressed write uses a parameter line for count and strides.

$AAAA BBBBBBBB CCCCCCCC

Field	Meaning	Details
AAAA	Operation field	Code family, width, controlled line count, or pointer depth.
BBBBBBBB	Address field	Usually the destination; may also be a base address, mode, or stride.
CCCCCCCC	Value field	Usually the value; may also be a source address, offset, or button mask.
X = 0 / 1 / 2	Common width selector	8 / 16 / 32 bits. A 32-bit field can also store a floating-point bit pattern.

A 32-bit value

$0200 81481280 05F5E0FF

Opcode 0200 is a direct 32-bit write. 05F5E0FF is decimal 99,999,999.

03

$0X00

Direct writes

Manual p. 5

Write one 8-, 16-, or 32-bit value to a data address. There is no parameter line.

$0X00 BBBBBBBB CCCCCCCC

Field	Meaning	Details
X	Write width	`0` = 8 bits; `1` = 16 bits; `2` = 32 bits.
00	Associated lines	Always 00.
BBBBBBBB	Destination	The valid memory address to write.
CCCCCCCC	Value	Use the low 2 hex digits for 8 bits, the low 4 for 16 bits, or all 8 for 32 bits.

16-bit write

_V0 bait 990
$0100 83823288 000003DE

Write 0x3DE (decimal 990) as a 16-bit value at 0x83823288.

32-bit write

_V1 OR 99999999
$0200 81481280 05F5E0FF

Write the 32-bit encoding of decimal 99,999,999 at the destination.

04

$5X00

Memory copies

Manual p. 6

Read a value from the source and write it to the destination. The third field is an address, not a literal value.

$5X00 BBBBBBBB CCCCCCCC

Field	Meaning	Details
X	Copy width	`0` / `1` / `2` select 8 / 16 / 32 bits.
00	Associated lines	Always 00.
BBBBBBBB	Destination	The value is written here.
CCCCCCCC	Source	The value is read here.

16-bit copy

_V0 Infinite Health
$5100 821F4FB8 821F4FB6

Read 16 bits at 0x821F4FB6 and copy them to 0x821F4FB8.

05

$4X01

Compressed writes

Manual p. 7

Express repeated writes in two lines. The first supplies the initial address and value; the second supplies the count and both strides. Do not interpret the parameter line as an independent opcode.

$4X01 BBBBBBBB CCCCCCCC
$NNNN SSSSSSSS VVVVVVVV

Field	Meaning	Details
X	Write width	`0` / `1` / `2` select 8 / 16 / 32 bits.
01	Associated lines	Exactly one parameter line follows.
BBBBBBBB / CCCCCCCC	Initial address / value	The first write uses these values.
NNNN	Count	The hexadecimal number of writes.
SSSSSSSS	Address stride	The difference between consecutive destinations, in bytes.
VVVVVVVV	Value stride	The increment after each write; 0 keeps the same value.

Four consecutive writes

_V1 Unlock Galley
$4101 82CDE530 000000FF
$0004 00000006 00000001

Write four 16-bit values. Increase the address by 6 and the value by 1 each time.

Equivalent to these writes:

$0100 82CDE530 000000FF
$0100 82CDE536 00000100
$0100 82CDE53C 00000101
$0100 82CDE542 00000102

06

$3XZZ

Pointer writes

Manual p. 8–9

Read a pointer at the base, add an offset, and repeat at each level. The final destination depends on the pointer values; it is not the sum of all offsets added to the base.

$3XZZ BBBBBBBB OOOOOOO1
$3X00 00000000 OOOOOOO2
…
$3300 00000000 CCCCCCCC

Field	Meaning	Details
X	Final write width	`0` / `1` / `2` select 8 / 16 / 32 bits.
ZZ	Pointer depth	The number of pointer lines, excluding the final `3300` line.
BBBBBBBB	Base address	Where the first pointer is read.
OOOOOOOn	Offsets	Add each offset after reading that level's pointer.
3300	Final write line	The second field is 0; the third is the value to write.

Address resolution

P1 = read32(8632AE30) + EA20
P2 = read32(P1) + 100
destination = read32(P2) + C4

A three-level pointer

_V1 CP 99,999
$3203 8632AE30 0000EA20
$3200 00000000 00000100
$3200 00000000 000000C4
$3300 00000000 0001869F

Read through the chain with offsets EA20, 100, and C4, then write decimal 99,999 as a 32-bit value.

07

$8XZZ / $8YZZ

Pointer copies

Manual p. 10–12

Resolve separate destination and source pointer chains, then copy the value between their final addresses. End the two chains with 8800 and 8900.

$8XZZ BBBBBBBB OOOOOOO1
$8X00 00000000 OOOOOOO2
…
$8800 00000000 00000000
$8YZZ DDDDDDDD PPPPPPP1
$8Y00 00000000 PPPPPPP2
…
$8900 00000000 00000000

Field	Meaning	Details
X = 0 / 1 / 2	Destination width	8 / 16 / 32 bits respectively.
Y = 4 / 5 / 6	Source width marker	8 / 16 / 32 bits respectively.
ZZ	Depth of each chain	Each chain supplies its depth and offsets.
8800	End of destination chain	The second and third fields are both 0.
8900	End of source chain	The second and third fields are both 0.

Three-level, 16-bit pointer copy

_V0 INFINITE MAGIC USAGE
$8103 8789C5E4 00047E80
$8100 00000000 00000004
$8100 00000000 000002E8
$8800 00000000 00000000
$8503 8789C5E8 00000010
$8500 00000000 00000014
$8500 00000000 000002EC
$8900 00000000 00000000

The destination offsets are 47E80 → 4 → 2E8; the source offsets are 10 → 14 → 2EC. Copy the final 16-bit value.

08

$7XYY / $77ZZ

Compressed pointer writes

Manual p. 13–16

Combine a pointer chain with repeated writes. Repetition can change the base, an intermediate level, or the final level; it does not always change only the final destination.

$7XYY BBBBBBBB OOOOOOO1
$7X00 00000000 OOOOOOO2
…
$77ZZ 00000000 CCCCCCCC
$NNNN SSSSSSSS VVVVVVVV

Field	Meaning	Details
X	Write width	`0` / `1` / `2` select 8 / 16 / 32 bits.
YY	Pointer depth	The number of pointer lines, excluding `77ZZ` and the parameter line.
ZZ	Level to advance	`0 ≤ ZZ ≤ YY`: 0 advances the base; YY advances the last level.
CCCCCCCC	Initial value	Its width is selected by X in the first line.
NNNN	Repeat count	The hexadecimal number of writes.
SSSSSSSS / VVVVVVVV	Address / value strides	Advance the selected level and increment the write value.

Repeat at the final level

_V1 CP 99,999
$7203 85C0B048 00000100
$7200 00000000 000000D4
$7200 00000000 00000008
$7703 00000000 447A0000
$0004 00000008 00000000

A three-level chain with ZZ=3. The last offset is 8, 10, 18, then 20 (hexadecimal). Write the same 32-bit value each time.

Repeat at the first level

_V0 ITEM 96+
$7003 85C0B048 00010100
$7000 00000000 00000FD4
$7000 00000000 00000008
$7701 00000000 00000060
$0005 00000004 00000001

A three-level chain with ZZ=1. The first offset is 10100, 10104, 10108, 1010C, then 10110. Write 8-bit values 60 through 64, resolving the remaining chain again each time.

Repeat at the base

_V1 TP 9,999
$7104 82E40F10 00000000
$7100 00000000 00000E50
$7100 00000000 00000018
$7100 00000000 0000000C
$7700 00000000 0000270F
$0006 00000010 00000000

With ZZ=0, the bases are 82E40F10, 82E40F20, 82E40F30, 82E40F40, 82E40F50, and 82E40F60. Follow the four-level chain and write 16-bit 270F each time.

09

$AX00

Instruction writes

Manual p. 17

Patch instructions in the text segment. The manual defines 16- and 32-bit writes; choose the address and length for the actual ARM or Thumb instruction boundary.

$AX00 BBBBBBBB CCCCCCCC

Field	Meaning	Details
X = 1 / 2	Write width	16 / 32 bits respectively.
00	Associated lines	Always 00.
BBBBBBBB	Destination	The instruction address to modify.
CCCCCCCC	Instruction bit pattern	Use the low 4 hex digits for 16 bits or all 8 for 32 bits.

16-bit Thumb NOP

_V0 EXTRA MAX
$A100 8114C8A2 0000BF00

Write halfword BF00; its bytes in memory are 00 BF. This example is a Thumb NOP.

32-bit instruction pattern

_V1 Branch Test
$A200 81132EA8 BE12F075

Write numeric value BE12F075; the memory bytes are 75 F0 12 BE. Interpret the instruction using the actual instruction set and address.

10

$B2XX

Module-relative addressing

Z06 site §4.7

Z06 extends B2 to select a module index and segment. Relative addresses in following codes use that segment's current base, reducing dependence on a fixed load address.

$B2XX 0000000Y 00000000

Field	Meaning	Details
XX	Module index	The hexadecimal index in the low two opcode digits. It is not a module UID.
Y = 0	seg0	Usually the text segment.
Y = 1	seg1	Usually the data segment.
Final field	Reserved	Use `00000000`.

Module 0, text-segment patch

_V0 Max Gil After Using
$B200 00000000 00000000
$A100 001CD8C4 0000BF00

Write a 16-bit patch at module 0's seg0 base plus 001CD8C4.

Module 0, repeated data writes

_V0 All Item 99
$B200 00000001 00000000
$4001 00FFF96C 00000063
$006F 00000001 00000000

Select seg1, start at relative offset 00FFF96C, and write 8-bit 63 for 6F iterations with address stride 1.

11

$C2AA

Button conditions

Manual p. 18

The condition controls the next AA code lines. Combine button values with bitwise OR; for example, L + R is 00000300.

$C2AA 0000MMMM CCCCCCCC

Field	Meaning	Details
AA	Controlled line count	The hexadecimal number of following controlled code lines.
MMMM	Historical device mode	The Z04 definitions appear below. This is a version-dependent field.
CCCCCCCC	Button mask	Combine individual button values with bitwise OR.

Button masks

Button	Hexadecimal value
SELECT	00000001
START	00000008
↑ Up	00000010
→ Right	00000020
↓ Down	00000040
← Left	00000080
L	00000100
R	00000200
△ Triangle	00001000
○ Circle	00002000
× Cross	00004000
□ Square	00008000
No buttons	00000000

Run three lines while holding L + R

_V0 EXTRA MAX
$C203 00000001 00000300
$0100 8109C5E4 00003846
$0100 8789C5E6 000000BF
$0200 8789C5E8 07F16307

Run the next three lines when the button condition matches; otherwise skip the controlled lines.

12

$DXAA

Memory comparisons

Manual p. 19

Read a value and compare it with the supplied value to decide whether the next AA lines run. X selects both the relation and the width, giving 12 combinations.

$DXAA BBBBBBBB CCCCCCCC

Field	Meaning	Details
X	Relation / width	Select a combination from the table below.
AA	Controlled line count	The hexadecimal number of following controlled lines.
BBBBBBBB	Address to compare	Where the value is read.
CCCCCCCC	Comparison value	A hexadecimal value or bit pattern of the selected width.

Comparison selectors

Relation	8 bits	16 bits	32 bits
Equal	X = 0	X = 1	X = 2
Not equal	X = 3	X = 4	X = 5
Greater than	X = 6	X = 7	X = 8
Less than	X = 9	X = A	X = B

Write when a byte equals 5

_V0 GP999,999,999
$D001 81504000 00000005
$0200 81504780 3B9AC9FF

If the 8-bit value at 81504000 equals 5, write decimal 999,999,999 as 32 bits at 81504780. The write opcode corrects a typo in the original PDF.

13

Z04 → Z06 → Overlay

Version differences and errata

Manual and Z06 updates

This guide covers the original PDF's file structure, line layout, and all nine code families, plus the Z06 B2 update. Page references use the printed manual numbering; the PDF page index is one greater.

Field	Meaning	Details
Encoding	Z04 → Z06	ANSI belongs to Z04. The Z06 site specifies UTF-8; Overlay supports UTF-8 / GBK.
Automatic enabling	Original → Overlay	Original `_V1` starts ON. New Overlay sessions start with every entry OFF.
Capacity	Version-specific	The PDF mentions 50 descriptions / 200 lines. The Z06 site specifies 50 groups with up to 200 lines each. Overlay uses separate limits.
B2	Z06 addition	The module index is XX; the second field's Y selects the segment. Do not exchange them.
Pointer copies	Z04 restriction	The manual requires equal chain depths and widths; this alone does not define later implementations.
Device mode	Z04 table and later behavior	Keep the old mode table as a reference. Z06 / Overlay match the complete button mask.

The code reference.