New member - need help learning how to write my own ASM hacks

[Doval]

Hi all, new member here. I'd like to hack the hell out of this game, but I'm finding it difficult to find the right information - it seems to be spread all over the forum and wiki. I've already read the Beginner tutorial to ASM hacking and ASM tutorial 2. I'm a computer engineering student so I was already familiar with Hex values, bitwise operators, assembly code, etc. So, I've got a good grip on writing ASM code, but...where do I start writing it?

As an example, I'd like to change the bare hands formula from:
PA * PA * Brave/100
to
PA * (Naked PA) * Brave/100
Where Naked PA is basically the base PA of the character without any equipment or stat-altering abilities. The basic idea is for equipment and Accumulate to increase bare fists damage linearly instead of exponentially by only affecting one instance of PA in the formula (similar to how Charge/Aim works.)

Right now I don't have the slightest clues what file I would be editing, what part of the file I'd insert my new ASM code into, and how I'd go about retrieving or calculating the Naked PA. The Formula Hacking article in the Wiki has this value: "0x0030 Original PA" which is probably what I'm looking for, but I don't know how to interpret that list of offsets and values. Please help! I just need someone to point me in the right directions - I'm willing to do my own homework.

[Pickle Girl Fanboy]

I don't know, but I want this too.

[Pride]

For inbattle stuff, the main file you will be dealing with is Battle.Bin. I'm attaching secondadvent's notes below which documents a good portion of the formula related stuff (among other things) in fft. I'll assist you in writing it if you would like.

To get to the ISO value of Battle.Bin, subtract 0x67000 from the RAM offset (so RAM 0x18A514 is 0x123514 in the battle.bin file). Normally we take a section of battle.bin when writing some asms that are too large to fit into a section of code (the list can be found here: http://ffhacktics.com/wiki/Allocated_space) but I've heard that its at the end of the Kanji table and there is no more space to be given...

[Doval]

I'll assist you in writing it if you would like.

Yes, please. I'm still feeling a little lost. From your last post I understood that I need to edit Battle.BIN (which I would rip from the game using CDMage, right?) and that Battle.Bin is loaded into memory at address 0x67000 (and thus the offsets within Battle.bin = Memory Offset - 0x67000.) The file Battle.bin Data.txt seems to contain the ASM code inside of Battle.Bin along with some extra comments explaining the code, but not sure what to do with that yet. I could interpret the RAM->File part of Data locations.txt but I don't know what to make of everything below that. Looking at Main Formula Data.txt, I can see that this is the portion of Battle.Bin that contains the weapon formulas - I imagine the offsets in this file are memory offsets and not Battle.Bin offsets? As for SCUS RAM.txt, I don't know what this file has. The stuff about Allocated Space and the Kanji table went over my head as well.

That's about it...still not sure how to proceed from here. Thanks, by the way. I wasn't expecting such a quick reply. I really appreciate it.

[Glain]

I suppose I'll jump in and add a few things. I also started with formulas...

As far as the formula hacking article: What's being listed there are offsets from a pointer to unit data. A few useful memory locations when you're dealing with formulas:

0x80192d94 "Caster" unit (the one using the ability)
0x80192d98 Target unit

So for example, if you see code like:

lui r3,0x8019
lw r3,0x2d98(r3)

r3 is now a pointer to the target unit of the ability. Then if you see something like this:

lbu r2,0x0030(r3)

r2 now contains the "Original PA" that you mentioned in the first post, of the target unit. (0x0030 offset from target unit pointer).

For a lot of the "data locations", they're just memory locations and what they contain. One of the difficult parts of analyzing ASM is that you'll see stuff like... well, look at my r3 example from earlier.

r3 = memory at 0x80192d98? If I don't know what that is, then it's just... okay? No idea what to make of it. r3 equals some memory somewhere! Lovely!

So the listing of data locations basically helps you figure out where the game is storing certain variables. It's always the same. If I know 0x80192d98 is a pointer to the target unit, suddenly it makes sense.

There are three main program files in FFT:
SCUS_942.21: Main program. Always in memory, but delegates most of its tasks to the other two programs. (The SCUS text file refers to routines within this file)
BATTLE.BIN: Program for battles/pre-battles/cutscenes.
WORLD.BIN: Program for the world map/formation screen/etc.

BATTLE.BIN and WORLD.BIN are never loaded at the same time. At least I'm pretty sure. PSX doesn't have enough RAM to hold them both and SCUS.

As far as applying your own ASM, I'd actually do it with XML patches and FFTorgASM - then you don't have to worry about CDMage and extracting, etc. If you look at the format of those XMLs, it should be simple enough to figure out. The PSX expects ASM instructions in little endian byte order, but, of course, I wouldn't encode any ASM commands into hex by hand, not when we have programs like MassHexASM! (Sorry, shameless plug; but it is useful.)

[Pride]

That is correct, you'd rip it with CDMage.

Yes, please. I'm still feeling a little lost.

Okay thanks to the notes, you don't have to run a search for the section of battle.bin that loads the weapon xa, its already discovered and documented. So lets go find it... (We'll also need the Data Locations.txt and opening this: http://www.mrc.uidaho.edu/mrc/people/jff/digital/MIPSir.html will help in understanding what some of the commands do)

spoiler: "Weapon XA Calculation"

Weapon XA Calculation
00185a9c: 3c028019 lui r2,0x8019
00185aa0: 904238d8 lbu r2,0x38d8(r2)      Load Used Weapon ID
00185aa4: 27bdffe8 addiu r29,r29,0xffe8
00185aa8: afbf0014 sw r31,0x0014(r29)
00185aac: afb00010 sw r16,0x0010(r29)
00185ab0: 00021840 sll r3,r2,0x01      ID * 2
00185ab4: 00621821 addu r3,r3,r2      ID * 3
00185ab8: 00031880 sll r3,r3,0x02      ID * 12
00185abc: 3c018006 lui r1,0x8006
00185ac0: 00230821 addu r1,r1,r3      80060000 + ID * 12
00185ac4: 90242ebd lbu r4,0x2ebd(r1)      Load Used Weapon Item Type
00185ac8: 3c028019 lui r2,0x8019
00185acc: 8c422d94 lw r2,0x2d94(r2)      Load Attacker's Data Pointer
00185ad0: 308300ff andi r3,r4,0x00ff      r3 = Used Weapon Item Type
00185ad4: 90500036 lbu r16,0x0036(r2)      Load Attacker's PA
00185ad8: 90460037 lbu r6,0x0037(r2)      Load Attacker's MA
00185adc: 90450024 lbu r5,0x0024(r2)      Load Attacker's Brave
00185ae0: 14600014 bne r3,r0,0x00185b34      Branch if a weapon is equipped
00185ae4: 00b00018 mult r5,r16         Brave * PA
00185ae8: 00001812 mflo r3         r3 = Brave * PA
00185aec: 3c0251eb lui r2,0x51eb
00185af0: 3442851f ori r2,r2,0x851f
00185af4: 00620018 mult r3,r2         Brave * PA * 0.32
00185af8: 3c018019 lui r1,0x8019
00185afc: a43038ce sh r16,0x38ce(r1)      Store XA = PA
00185b00: 00031fc3 sra r3,r3,0x1f
00185b04: 00001010 mfhi r2         r2 = Brave * PA * 0.32
00185b08: 00021143 sra r2,r2,0x05      Brave * PA * 0.32 / 32 (or Brave * PA / 100)
00185b0c: 00431823 subu r3,r2,r3
00185b10: 00031400 sll r2,r3,0x10      Brave * PA / 100 * 65536
00185b14: 3c018019 lui r1,0x8019
00185b18: a42338d0 sh r3,0x38d0(r1)      Store YA = Brave * PA / 100
00185b1c: 14400058 bne r2,r0,0x00185c80      Branch if YA > 0
00185b20: 24620001 addiu r2,r3,0x0001      r2 = YA + 1 (minimum of 1 YA)
00185b24: 3c018019 lui r1,0x8019
00185b28: a42238d0 sh r2,0x38d0(r1)      Store YA = 1
00185b2c: 08061720 j 0x00185c80         Jump to end
00185b30: 00000000 nop
00185b34: 3c028019 lui r2,0x8019
00185b38: 90423902 lbu r2,0x3902(r2)      Load WP
00185b3c: 3c018019 lui r1,0x8019
00185b40: a42238d0 sh r2,0x38d0(r1)      YA = WP
00185b44: 34020003 ori r2,r0,0x0003      r2 = 3
00185b48: 10620007 beq r3,r2,0x00185b68      Branch if Used Weapon is a Sword
00185b4c: 3402000b ori r2,r0,0x000b      r2 = b
00185b50: 10620005 beq r3,r2,0x00185b68      Branch if Used Weapon is a Crossbow
00185b54: 34020007 ori r2,r0,0x0007      r2 = 7
00185b58: 10620003 beq r3,r2,0x00185b68      Branch if Used Weapon is a Rod
00185b5c: 3402000f ori r2,r0,0x000f      r2 = f
00185b60: 14620005 bne r3,r2,0x00185b78      Branch if Used Weapon is not a Polearm
00185b64: 2482ffff addiu r2,r4,0xffff      Used Weapon Type - 1
00185b68: 3c018019 lui r1,0x8019
00185b6c: a43038ce sh r16,0x38ce(r1)      Store XA = PA
00185b70: 08061720 j 0x00185c80         Jump to End
00185b74: 00000000 nop
00185b78: 2c420002 sltiu r2,r2,0x0002
00185b7c: 14400005 bne r2,r0,0x00185b94      Branch if Used Weapon is a Knife/Ninja Blade
00185b80: 3402000c ori r2,r0,0x000c      r2 = c
00185b84: 10620003 beq r3,r2,0x00185b94      Branch if Used Weapon is a Bow
00185b88: 34020020 ori r2,r0,0x0020      r2 = 20
00185b8c: 14620007 bne r3,r2,0x00185bac      Branch if Used Weapon is not a Thrown Weapon
00185b90: 2482fffc addiu r2,r4,0xfffc      Used Weapon Type - 4
00185b94: 3c028019 lui r2,0x8019
00185b98: 8c422d94 lw r2,0x2d94(r2)      Load Attacker's Data Pointer
00185b9c: 00000000 nop
00185ba0: 90420038 lbu r2,0x0038(r2)      Load Target's SP
00185ba4: 0806171d j 0x00185c74
00185ba8: 02021021 addu r2,r16,r2      PA + SP
00185bac: 2c420002 sltiu r2,r2,0x0002
00185bb0: 10400010 beq r2,r0,0x00185bf4      Branch if Used Weapon is a Knight Sword/Katana
00185bb4: 00b00018 mult r5,r16         Brave * PA
00185bb8: 00001812 mflo r3         r3 = Brave * PA
00185bbc: 3c0251eb lui r2,0x51eb
00185bc0: 3442851f ori r2,r2,0x851f
00185bc4: 00620018 mult r3,r2         Brave * PA * 0.32
00185bc8: 00031fc3 sra r3,r3,0x1f
00185bcc: 00001010 mfhi r2         r2 = Brave * PA * 0.32
00185bd0: 00021143 sra r2,r2,0x05      Brave * PA * 0.32 / 32 (or Brave * PA / 100)
00185bd4: 00431823 subu r3,r2,r3
00185bd8: 3c018019 lui r1,0x8019
00185bdc: a42338ce sh r3,0x38ce(r1)      Store XA = Brave * PA / 100
00185be0: 00031400 sll r2,r3,0x10      Brave * PA / 100 * 65536
00185be4: 14400026 bne r2,r0,0x00185c80      Branch if XA > 0
00185be8: 24620001 addiu r2,r3,0x0001      r2 = XA + 1 (min XA of 1)
00185bec: 0806171e j 0x00185c78
00185bf0: 00000000 nop
00185bf4: 34020008 ori r2,r0,0x0008      r2 = 8
00185bf8: 10620003 beq r3,r2,0x00185c08      Branch if Used Weapon is a Staff
00185bfc: 34020010 ori r2,r0,0x0010      r2 = 10
00185c00: 14620005 bne r3,r2,0x00185c18      Branch if Used Weapon is not a Pole
00185c04: 34020006 ori r2,r0,0x0006      r2 = 6
00185c08: 3c018019 lui r1,0x8019
00185c0c: a42638ce sh r6,0x38ce(r1)      Store XA = MA
00185c10: 08061720 j 0x00185c80
00185c14: 00000000 nop
00185c18: 10620005 beq r3,r2,0x00185c30      Branch if Used Weapon is an Axe
00185c1c: 34020009 ori r2,r0,0x0009      r2 = 9
00185c20: 10620003 beq r3,r2,0x00185c30      Branch if Used Weapon is a Flail
00185c24: 34020011 ori r2,r0,0x0011      r2 = 11
00185c28: 1462000b bne r3,r2,0x00185c58      Branch if Used Weapon is not a Bag
00185c2c: 2482fff3 addiu r2,r4,0xfff3      r2 = Used Weapon Type - 13 (d)
00185c30: 0c063ba8 jal 0x0018eea0      Random Process
00185c34: 00000000 nop
00185c38: 02020018 mult r16,r2         PA * 0->7fff
00185c3c: 00001012 mflo r2         r2 = PA * Random
00185c40: 04410002 bgez r2,0x00185c4c      Branch if PA * Random >= 0
00185c44: 00000000 nop
00185c48: 24427fff addiu r2,r2,0x7fff      Make result positive
00185c4c: 000213c3 sra r2,r2,0x0f      PA * 0->7fff / 8000h (0->PA - 1)
00185c50: 0806171e j 0x00185c78
00185c54: 24420001 addiu r2,r2,0x0001      r2 += 1 (1->PA)
00185c58: 2c420002 sltiu r2,r2,0x0002
00185c5c: 14400004 bne r2,r0,0x00185c70      Branch if Used Weapon is not an Instrument/Book
00185c60: 30c200ff andi r2,r6,0x00ff      r2 = MA
00185c64: 34020012 ori r2,r0,0x0012      r2 = 12
00185c68: 14620005 bne r3,r2,0x00185c80      Branch if Used Weapon is not a Cloth
00185c6c: 30c200ff andi r2,r6,0x00ff      r2 = MA
00185c70: 02021021 addu r2,r16,r2      PA * MA
00185c74: 00021043 sra r2,r2,0x01      PA * ?? / 2 (MA or SP, depending on Weapon)
00185c78: 3c018019 lui r1,0x8019
00185c7c: a42238ce sh r2,0x38ce(r1)      Store XA = PA * ?? / 2
00185c80: 8fbf0014 lw r31,0x0014(r29)
00185c84: 8fb00010 lw r16,0x0010(r29)
00185c88: 27bd0018 addiu r29,r29,0x0018
00185c8c: 03e00008 jr r31
00185c90: 00000000 nop

And for the section of this code that is in particular interest for you...

00185acc: 8c422d94 lw r2,0x2d94(r2)      Load Attacker's Data Pointer
00185ad0: 308300ff andi r3,r4,0x00ff      r3 = Used Weapon Item Type
00185ad4: 90500036 lbu r16,0x0036(r2)      Load Attacker's PA
00185ad8: 90460037 lbu r6,0x0037(r2)      Load Attacker's MA
00185adc: 90450024 lbu r5,0x0024(r2)      Load Attacker's Brave
00185ae0: 14600014 bne r3,r0,0x00185b34      Branch if a weapon is equipped
00185ae4: 00b00018 mult r5,r16         Brave * PA
00185ae8: 00001812 mflo r3         r3 = Brave * PA
00185aec: 3c0251eb lui r2,0x51eb
00185af0: 3442851f ori r2,r2,0x851f
00185af4: 00620018 mult r3,r2         Brave * PA * 0.32
00185af8: 3c018019 lui r1,0x8019
00185afc: a43038ce sh r16,0x38ce(r1)      Store XA = PA
00185b00: 00031fc3 sra r3,r3,0x1f
00185b04: 00001010 mfhi r2         r2 = Brave * PA * 0.32
00185b08: 00021143 sra r2,r2,0x05      Brave * PA * 0.32 / 32 (or Brave * PA / 100)
00185b0c: 00431823 subu r3,r2,r3
00185b10: 00031400 sll r2,r3,0x10      Brave * PA / 100 * 65536
00185b14: 3c018019 lui r1,0x8019
00185b18: a42338d0 sh r3,0x38d0(r1)      Store YA = Brave * PA / 100
00185b1c: 14400058 bne r2,r0,0x00185c80      Branch if YA > 0
00185b20: 24620001 addiu r2,r3,0x0001      r2 = YA + 1 (minimum of 1 YA)
00185b24: 3c018019 lui r1,0x8019
00185b28: a42238d0 sh r2,0x38d0(r1)      Store YA = 1
00185b2c: 08061720 j 0x00185c80         Jump to end
00185b30: 00000000 nop

Now you'll notice at 0x00185ad8 the attacker's current PA is being loaded, so we'll have to load the original value on our own and rewrite a bit of this ugly code to save space and the trouble of jumping to a different section of battle.bin. And we'll need to figure out where we will begin...

00185aec: 3c0251eb lui r2,0x51eb

This will work because the code above it we will need since its beginning the multiplication we'll use. And now to write our own.

lbu r4,0x0030(r2)   Load the attacker's "original PA" to register 4. Note that the attacker's data is still loaded into r2
ori r2,r0,0x0064   Set register 2 to 0x64 or 100. We will use this number for our division.
div r3,r2      Divide PA * Brave (what is located in register 3) / 100
mflo r3         Move the LO to register 3 (or the result of dividing R3/R2)
lui r1,0x8019      We're setting up to store our values now
sh r4,0x38ce(r1)   Store the contents of R4 (The "original PA") into 0x801938ce (which we call as XA)
bne r3,r0,0x00185b10   We're keeping what the original code wanted to do, which is make sure that PA * Brave / 100 cannot be 0. This branch will check if the result is 0 and branch if it is not 0
nop                           "nop" is just an empty command. the output is always 00000000. After many branches and jumps you'll use this command.
addiu r3,r3,0x0001   YA + 1
sh r3,0x38d0(r1)   Store the contents of R3 (PA * Brave / 100) into 0x801938d0 (which we call as YA)
j 0x00185c80      Jump to the end of the routine.
nop         

Now that we have the code we want to use, we need to turn it into the hex we will need to put it in the game. Glain has created a program to do just that, which can be found here. http://ffhacktics.com/smf/index.php?topic=7758.0

Giving us the output of...

30004490
64000234
1A006200
12180000
1980013C
CE3824A4
02006014
00000000
01006324
D03823A4
20170608
00000000

This is the code we'll add to the offset 0x0011EAEC (or 0x00185aec in RAM)... which you would test the asm (it does work btw, I tested it to make sure =P) and debug it if there were any issues.

I'm not sure what emulator you are using but I would strongly recommend you download pSX as it contains a debugger that epsxe does not have. That way you can manipulate the code as you work.

Also 0x0030 says original PA, this is the original PA before /any/ PA boosting stuff is used. That includes PA boosting moves as well as equipment... I think.

[Doval]

Oh wow, I'm totally blown away. There's no way in hell I could've figured all of this out on my own. I've still got some questions, but I've got the gist of it now.

Now you'll notice at 0x00185ad8 the attacker's current PA is being loaded, so we'll have to load the original value on our own and rewrite a bit of this ugly code to save space and the trouble of jumping to a different section of battle.bin.

Don't you mean at 0x00185ad4? 0x00185ad8 says MA on the code comments.

00185aec: 3c0251eb lui r2,0x51eb

This will work because the code above it we will need since its beginning the multiplication we'll use. And now to write our own.

So basically, you chose this point because that's when the formula stopped being redundant with our own, right? I.e. The calculations above that line were useful to us, but not the ones below. Another question: when we insert our own code at this point, are we literally inserting it at that position and pushing the rest of the code down, or are we overwriting the lines of code that were already there? Are there any special precautions I need to observe when inserting code into files?

Is this the correct way to put the code into MassHexASM? I.e. Little Endian checked and use the RAM offset? At least, that's how I got it to produce the same hex as what you posted. I find it strange that it would use the RAM offset and not the file offset. What about in FFTOrgASM? Would I use the RAM or file offset in the XML?

Thanks a lot to the both of you. You've been a tremendous help.

[Glain]

Glad to have been helpful

Looks like you figured out how to produce the correct hex, and it does indeed have to use the RAM offset. The code has to refer to the correct addresses at runtime, and it's run from RAM. What we're doing at this step is producing the right code -- it doesn't matter how the code gets into RAM.

(The RAM starting address is important for encoding the ASM, because certain branch instructions are encoded as a branch over a certain number of statements, rather than to an absolute address, so the same statement would actually branch to a different location if it was elsewhere in the code.)

FFTorgASM patches the files, so it wants the file offsets. This is where you use the BATTLE.BIN offset.

EDIT: And yeah, PSX wants little endian encoding.

[Pride]

Oh wow, I'm totally blown away. There's no way in hell I could've figured all of this out on my own. I've still got some questions, but I've got the gist of it now.Don't you mean at 0x00185ad4? 0x00185ad8 says MA on the code comments.

Yes that was an error in my haste.

So basically, you chose this point because that's when the formula stopped being redundant with our own, right? I.e. The calculations above that line were useful to us, but not the ones below.

Yes I choose that point because the code above it (loading the stats, branching if a weapon is held, and the multiplication) were necessary so we don't affect anything else and the multiplication was going to be done anyways.

Another question: when we insert our own code at this point, are we literally inserting it at that position and pushing the rest of the code down, or are we overwriting the lines of code that were already there? Are there any special precautions I need to observe when inserting code into files?

You always overwrite the code. Inserting and pushing the code down will cause the game to simple not work as the file will be too large now, messing up not only battle.bin but many other files. The only precaution is to make sure you do not write over code you need ^_^'

Thanks a lot to the both of you. You've been a tremendous help.

Glad to help!

[Doval]

All right, so far so good, I've understood everything the both of you have thrown at me. Haven't had much time to play around with the patched ISO but I figure I might as well ask this now because I know it's going to come up:

What do I do when I want to insert so much ASM that it's impossible not to overwrite code I need? Obviously I would need to put the code somewhere else and add jumps to and from it in Battle.Bin, but...where do you put it?

While we're at it, what are the precautions and I need to take when patching code in various ways? My goal is have FFT Complete with most of the Japanese/WotL differences (increased JP costs, higher job unlock requirements, nerfed SMN, etc) and a couple of my own ASM hacks (like the bare hands nerf.) That means applying a combination of PPF-o-Matic (for FFT Complete), FFT Patcher (for the easy value changes), TacText (to fix job and spell descriptions after I change their values) and FFTorgASM (for my own ASM code.) That's a lot of patching and I don't know if some parts need to be done in sequence or if most of the changes are independent of the rest.

When I was looking into FFT Complete I read that PPF patches should only be applied to clean ISOs, so that's always going to be the first in the patching process. FFT Patcher seems to be able to patch a "dirty" ISO without trouble - presumably because it's not adding new code, only altering values - so no problem there.  Is it safe for me to assume that whatever I do in TacText targets completely different pieces of code than most ASM hacks? I.e. I can apply TacText patches and ASM hacks in any order as long as my ASM code isn't overwriting necessary code?

[RavenOfRazgriz]

Yup.  All FFT OrgASM does is automatically apply stuff you can do with a Hex Editor, and all FFTPatcher does is change some hex values around, not add/remove code.  FFTacText is similar, it's not really adding or removing code, just altering what's already there.  Anything you "remove" is just going to be turned into 00s, so the end space used is always the same.  A .ppf should always be applied first to a Vanilla ISO (unless intended for use on a non-Vanilla ISO, which is stupid rare) because all a .ppf contains is the changes between your original and your final value. (So, if you made a .ppf between a Vanilla ISO and an ISO that only had your Fist Edit, for example, the only code your .ppf would contain would be the minor edit you made to change Fists.)  This is why you always apply it first - since it only carries changes, if the target ISO isn't what the .ppf expects, weird things can occur because it won't compensate for things it expects to be "Vanilla" but aren't.

[Pickle Girl Fanboy]

So do we now have a hack to accomplish this?

[Doval]

@RavenOfRazgriz: Thanks! That all makes sense.

@Pickle Girl Fanboy: Pride says his code works. I haven't confirmed it myself yet, so give it a shot and see what happens.

If someone could answer this particular question I'd be very grateful!

What do I do when I want to insert so much ASM that it's impossible not to overwrite code I need? Obviously I would need to put the code somewhere else and add jumps to and from it in Battle.Bin, but...where do you put it?

[Pride]

Normally we take a section of battle.bin when writing some asms that are too large to fit into a section of code (the list can be found here: http://ffhacktics.com/wiki/Allocated_space) but I've heard that its at the end of the Kanji table and there is no more space to be given...

So if the asm does not fit into the section of code you are manipulating, you would normally jump to a new section of battle.bin (which is a huge section of data that is unused in the english iso, the kanji table) and jump back to the original routine (or change the code in a manner where you do not need to return to the original routine)

[formerdeathcorps]

So do we now have a hack to accomplish this?

It depends.  The "base PA" that's in the unit RAM section is increased by A Save, and thus, A Save will still increase your damage quadratically.