Address range detected for [Hero]'s Magic score: $7e1025

Breakpoint activated the moment "[Hero]'s Level Up!" window was confirmed.

Trace results for Magic increasing at level-up (I still have both of these logs if more data is required):

$02/879F AD 9E 00 LDA $009E [$02:009E] A:0028 X:D325 Y:004E P:envmxdizc

$02/87A2 85 14 STA $14 [$00:1014] A:002C X:D325 Y:004E P:envmxdizc

$02/87A4 E2 20 SEP #$20 A:002C X:D325 Y:004E P:envmxdizc

$02/87A6 C2 10 REP #$10 A:002C X:D325 Y:004E P:envMxdizc

$02/87A8 A5 10 LDA $10 [$00:1010] A:002C X:D325 Y:004E P:envMxdizc

$02/87AA 8D A2 04 STA $04A2 [$02:04A2] A:0002 X:D325 Y:004E P:envMxdizc

$02/87AD A5 1B LDA $1B [$00:101B] A:0002 X:D325 Y:004E P:envMxdizc

$02/87AF 38 SEC A:0003 X:D325 Y:004E P:envMxdizc

$02/87B0 ED A0 04 SBC $04A0 [$02:04A0] A:0003 X:D325 Y:004E P:envMxdizC

$02/87B3 18 CLC A:0002 X:D325 Y:004E P:envMxdizC

$02/87B4 65 10 ADC $10 [$00:1010] A:0002 X:D325 Y:004E P:envMxdizc

$02/87B6 85 1B STA $1B [$00:101B] A:0004 X:D325 Y:004E P:envMxdizc

$02/87B8 4E A0 04 LSR $04A0 [$02:04A0] A:0004 X:D325 Y:004E P:envMxdizc

$02/87BB 4E A2 04 LSR $04A2 [$02:04A2] A:0004 X:D325 Y:004E P:envMxdiZC

$02/87BE A5 1C LDA $1C [$00:101C] A:0004 X:D325 Y:004E P:envMxdizc

$02/87C0 38 SEC A:0001 X:D325 Y:004E P:envMxdizc

$02/87C1 ED A0 04 SBC $04A0 [$02:04A0] A:0001 X:D325 Y:004E P:envMxdizC

$02/87C4 18 CLC A:0001 X:D325 Y:004E P:envMxdizC

$02/87C5 6D A2 04 ADC $04A2 [$02:04A2] A:0001 X:D325 Y:004E P:envMxdizc

$02/87C8 85 1C STA $1C [$00:101C] A:0002 X:D325 Y:004E P:envMxdizc

$02/87CA 4E A0 04 LSR $04A0 [$02:04A0] A:0002 X:D325 Y:004E P:envMxdizc

$02/87CD 4E A2 04 LSR $04A2 [$02:04A2] A:0002 X:D325 Y:004E P:envMxdiZc

$02/87D0 A5 1D LDA $1D [$00:101D] A:0002 X:D325 Y:004E P:envMxdiZC

$02/87D2 38 SEC A:0000 X:D325 Y:004E P:envMxdiZC

$02/87D3 ED A0 04 SBC $04A0 [$02:04A0] A:0000 X:D325 Y:004E P:envMxdiZC

$02/87D6 18 CLC A:0000 X:D325 Y:004E P:envMxdiZC

$02/87D7 6D A2 04 ADC $04A2 [$02:04A2] A:0000 X:D325 Y:004E P:envMxdiZc

$02/87DA 85 1D STA $1D [$00:101D] A:0000 X:D325 Y:004E P:envMxdiZc

$02/87DC E6 4C INC $4C [$00:104C] A:0000 X:D325 Y:004E P:envMxdiZc

$02/87DE E6 4C INC $4C [$00:104C] A:0000 X:D325 Y:004E P:envMxdizc

$02/87E0 E6 4C INC $4C [$00:104C] A:0000 X:D325 Y:004E P:envMxdizc

$02/87E2 E6 4D INC $4D [$00:104D] A:0000 X:D325 Y:004E P:envMxdizc

$02/87E4 E6 4D INC $4D [$00:104D] A:0000 X:D325 Y:004E P:envMxdizc

$02/87E6 E6 4E INC $4E [$00:104E] A:0000 X:D325 Y:004E P:envMxdizc

$02/87E8 E6 4E INC $4E [$00:104E] A:0000 X:D325 Y:004E P:envMxdizc

$02/87EA E6 4F INC $4F [$00:104F] A:0000 X:D325 Y:004E P:envMxdizc

$02/87EC A2 26 10 LDX #$1026 A:0000 X:D325 Y:004E P:envMxdizc

$02/87EF A0 04 00 LDY #$0004 A:0000 X:1026 Y:004E P:envMxdizc

$02/87F2 BD 00 00 LDA $0000,x[$02:1026] A:0000 X:1026 Y:0004 P:envMxdizc

$02/87F5 C9 63 CMP #$63 A:0007 X:1026 Y:0004 P:envMxdizc

$02/87F7 90 02 BCC $02 [$87FB] A:0007 X:1026 Y:0004 P:eNvMxdizc

$02/87FB 9D 00 00 STA $0000,x[$02:1026] A:0007 X:1026 Y:0004 P:eNvMxdizc

$02/87FE E8 INX A:0007 X:1026 Y:0004 P:eNvMxdizc

$02/87FF 88 DEY A:0007 X:1027 Y:0004 P:envMxdizc

$02/8800 D0 F0 BNE $F0 [$87F2] A:0007 X:1027 Y:0003 P:envMxdizc

$02/87F2 BD 00 00 LDA $0000,x[$02:1027] A:0007 X:1027 Y:0003 P:envMxdizc

$02/87F5 C9 63 CMP #$63 A:0006 X:1027 Y:0003 P:envMxdizc

$02/87F7 90 02 BCC $02 [$87FB] A:0006 X:1027 Y:0003 P:eNvMxdizc

$02/87FB 9D 00 00 STA $0000,x[$02:1027] A:0006 X:1027 Y:0003 P:eNvMxdizc

$02/87FE E8 INX A:0006 X:1027 Y:0003 P:eNvMxdizc

$02/87FF 88 DEY A:0006 X:1028 Y:0003 P:envMxdizc

$02/8800 D0 F0 BNE $F0 [$87F2] A:0006 X:1028 Y:0002 P:envMxdizc

$02/87F2 BD 00 00 LDA $0000,x[$02:1028] A:0006 X:1028 Y:0002 P:envMxdizc

$02/87F5 C9 63 CMP #$63 A:0008 X:1028 Y:0002 P:envMxdizc

$02/87F7 90 02 BCC $02 [$87FB] A:0008 X:1028 Y:0002 P:eNvMxdizc

$02/87FB 9D 00 00 STA $0000,x[$02:1028] A:0008 X:1028 Y:0002 P:eNvMxdizc

$02/87FE E8 INX A:0008 X:1028 Y:0002 P:eNvMxdizc

$02/87FF 88 DEY A:0008 X:1029 Y:0002 P:envMxdizc

$02/8800 D0 F0 BNE $F0 [$87F2] A:0008 X:1029 Y:0001 P:envMxdizc

$02/87F2 BD 00 00 LDA $0000,x[$02:1029] A:0008 X:1029 Y:0001 P:envMxdizc

$02/87F5 C9 63 CMP #$63 A:000A X:1029 Y:0001 P:envMxdizc

$02/87F7 90 02 BCC $02 [$87FB] A:000A X:1029 Y:0001 P:eNvMxdizc

$02/87FB 9D 00 00 STA $0000,x[$02:1029] A:000A X:1029 Y:0001 P:eNvMxdizc

$02/87FE E8 INX A:000A X:1029 Y:0001 P:eNvMxdizc

$02/87FF 88 DEY A:000A X:102A Y:0001 P:envMxdizc

$02/8800 D0 F0 BNE $F0 [$87F2] A:000A X:102A Y:0000 P:envMxdiZc

$02/8802 A5 4C LDA $4C [$00:104C] A:000A X:102A Y:0000 P:envMxdiZc

$02/8804 85 26 STA $26 [$00:1026] A:000A X:102A Y:0000 P:envMxdizc

$02/8806 18 CLC A:000A X:102A Y:0000 P:envMxdizc

$02/8807 65 2A ADC $2A [$00:102A] A:000A X:102A Y:0000 P:envMxdizc

$02/8809 85 22 STA $22 [$00:1022] A:000A X:102A Y:0000 P:envMxdizc

$02/880B A5 4D LDA $4D [$00:104D] A:000A X:102A Y:0000 P:envMxdizc

$02/880D 85 27 STA $27 [$00:1027] A:0008 X:102A Y:0000 P:envMxdizc

$02/880F 65 2B ADC $2B [$00:102B] A:0008 X:102A Y:0000 P:envMxdizc

$02/8811 85 23 STA $23 [$00:1023] A:000E X:102A Y:0000 P:envMxdizc

$02/8813 A5 4E LDA $4E [$00:104E] A:000E X:102A Y:0000 P:envMxdizc

$02/8815 85 28 STA $28 [$00:1028] A:000A X:102A Y:0000 P:envMxdizc

$02/8817 65 2C ADC $2C [$00:102C] A:000A X:102A Y:0000 P:envMxdizc

$02/8819 85 24 STA $24 [$00:1024] A:000A X:102A Y:0000 P:envMxdizc

$02/881B A5 4F LDA $4F [$00:104F] A:000A X:102A Y:0000 P:envMxdizc

$02/881D 85 29 STA $29 [$00:1029] A:000B X:102A Y:0000 P:envMxdizc

$02/881F 65 2D ADC $2D [$00:102D] A:000B X:102A Y:0000 P:envMxdizc

**$02/8821 85 25 STA $25 [$00:1025] A:000B X:102A Y:0000 P:envMxdizc**

$02/8823 E2 20 SEP #$20 A:000B X:102A Y:0000 P:envMxdizc

$02/8825 C2 10 REP #$10 A:000B X:102A Y:0000 P:envMxdizc

$02/8827 A5 10 LDA $10 [$00:1010] A:000B X:102A Y:0000 P:envMxdizc

$02/8829 4A LSR A A:0002 X:102A Y:0000 P:envMxdizc

$02/882A 18 CLC A:0001 X:102A Y:0000 P:envMxdizc

$02/882B 69 4B ADC #$4B A:0001 X:102A Y:0000 P:envMxdizc

$02/882D 85 40 STA $40 [$00:1040] A:004C X:102A Y:0000 P:envMxdizc

$02/882F 2B PLD A:004C X:102A Y:0000 P:envMxdizc

$02/8830 22 02 9B 00 JSL $009B02[$00:9B02] A:004C X:102A Y:0000 P:envMxdizc

"7E:" wasn't found anywhere, so either I screwed it up (likely) or the notation's different. Otherwise just as you said, in fact it looks like it's using both operations o_o.

Before I go looking for EXP (will have to use current XP, XP to level is the very thing I'm having hell finding ;_; ), very basic newb question: is there a document available that'll give me a quick rundown on how to read this output? I understand these are assembly opcodes/etc., but I just need a little nudge to tell me how to translate that into data I can find on the ROM.

Thank you for suggesting this, btw; I would never've thought I'd need to do something like tracing just to find stat data -_-.

Hmm...(*goes to check out the WayBack Machine*)

EDIT: ah, "$02/8807" translates to $10a07 when looking at it in a hex editor. Couldn't find anything at the WayBack Machine.

EDIT 2: ...oh, no :/. I'm noticing the INC(rement) opcodes up there...they match -perfectly- with the number added to each stat (3/2/2/1) at that level. So level up stats seem to be relative; I need to be able to insert more INC operations in order to make the stats go up at a different rate. This sounds like something that might not be feasible for me to do

. I guess find whatever's pointing to $1099f, change it to point somewhere that's full of freespace/expand the ROM, copy the whole block of code over to that new location, then mess around with how many INC operations it uses? Maybe I can simply change which stats get which of the set increments (so I could do, say, (1/2/2/3), making a magic-biased hero)...

EDIT 3: Should I try to remedy this using a JMP instruction, instead? I've never done assembly level hacking before so I don't know the most efficient/effective way to go about this.