Fandom

Final Fantasy Wiki

Damage overflow glitch in Final Fantasy VII

20,540 pages on
this wiki
Add New Page
Talk0 Share

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.

VII

The glitch in action by 4-8Productions

Damage overflow is a glitch in Final Fantasy VII. It's an instance of the more general overflow glitch present in various games.

The basics Edit

In Final Fantasy VII the integer numbers are encoded in 32 bits. Since they need to be signed integers, the two's complement representation is used. In this encoding the leftmost bit is negative weighted, while all the others have a positive value. Given 2^n, the sum of all the powers of 2 with the exponent in the range (0, n - 1) is equal to (2^n) - 1. This means the lower and upper bounds for in-game integers are

-2^{31} = -2,147,483,648

and

2^{31} - 1 = 2,147,483,647

If, at any point, the computation of some value results in a number which is out of those bounds, an overflow occurs and the game exhibits abnormal behavior.

Description Edit

There are several instances of integer overflows. The best known one is the damage overflow glitch, which triggers when the game has to deal with a number out of the aforementioned bounds during the computation of the damage formula.

Unless a heal overflow and/or multiple overflows are triggered, the most evident effect of the glitch is the instant defeat of the target of an attack which overflowed. Graphically, random symbols are displayed instead of the usual damage digits, although it's possible that up to 4 random digits are rendered as if the overflow never happened.

Because of its notoriety, the glitch is often referred as "The overflow glitch", despite the fact that it is not the only kind of overflow possible in Final Fantasy VII.

The damage formula Edit

The general damage formula is

Damage = BD * PVMs * RVM * PoVMs

BD is the so called Base Damage, calculated as

(POWM * DEFM * ATKM) / (16 * 512)

where DEFM is the defense multiplier:

512 - TDEF

with the target Defense stat expressed as TDEF.

ATKM is the attack multiplier:

((LV + ATK)/32) * ((LV * ATK)/32)

where LV is the attacker's Level (max 99) and ATK is the attacker's Attack stat. The latter is the sum of the attacker's Strength and the equipped weapon attack bonus. ATK is capped at 255, but during a battle it can be temporarily increased up to 510 by the usage of 4 Hero Drinks. In particular the first 3 Hero Drinks give +30% and the last one +10%. Even if ATK is < 510 after 4 Hero Drinks, further use does not increase it further.

POWM is the power multiplier, which depends on TPOW (the Technique Power) and the equipped weapon. For most of the in-game weapons POWM is

TPOW / 16

but each final weapon has its own POWM formula, which includes TPOW along with other parameters.

TPOW is 16 for physical attacks, while all the commands/spells/summons have their own values.

As for Limits, they ignore any ultimate weapon power modifier, as they force POWM to be

LMUL * (TPOW / 16)

where LMUL is a Limit-specific multiplier: for instance, every Omnislash hit has 0.75. Limits may have other properties (like auto-critical for Omnislash), but they are considered in other steps of the damage computation.

PVMs is the product of the sequence of Pre-Variance Multipliers, which are

Critical: x2 if a critical hit occurs, x1 otherwise.
Berserk: x1.5 if the attacker is in Berserk, x1 otherwise.
Row: x1 if the attacker and the target are both in the front row, x0.5 in all the other cases.
Defend: x0.5 if the target is in defend mode, x1 otherwise.
Back: x2 (x4 for Air Buster and x8 for Acrophies) if the target is attacked on the back, x1 otherwise.
Frog: x0.25 if the attacker is in Frog status, x1 otherwise.
Sadness: x0.7 if the target is in Sadness status, x1 otherwise.
Split: x2/3 if the attack hits multiple targets, x1 otherwise.
Barrier: x0.5 if the target is in Barrier status, x1 otherwise.
Mini: x0 if the target is in Mini status, x1 otherwise.

As for Mini, a rescaling makes 1 HP the minimum damage one can deal (without it the damage would be 0, since the Mini multiplier itself is 0).

RVM is the Random Variance modifier: the game selects a random number between 0 and 255 (including the bounds), and adds it to 3841 to get RVMN, the RVM numerator, which spans from 3841 to 4096 by construction. A this point the random variance is applied by means of

PoRVD = (PRVD * RVMN) / 4096

being PoRVD the post random variance damage, PRVD the pre random variance damage and 4096 the fixed denominator of RVM. For this reason the random variance can be technically expressed as

RVMN/4096

even though that fraction is never actually computed.

Finally PoVMs is the product of the sequence of Post-Variance Multipliers, which are the target elemental affinities w.r.t. the attack element and some special modifiers like Aeris's Princess Guard multiplier. The result is the actual damage dealt to the target, capped at 9999.

The overflow Edit

During the calculation, being the floating point division a time consuming operation, whenever the divisor (denominator) is a power of 2, the operation is performed by means of a right shift of the bits by n = log {2}({divisor}), resulting in an integer division (the n rightmost bits are lost). The game parses the chain of operations to calculate and first computes as many products as possible, then performs the right shift(s).

Thus, there are two points where the partial results can go out of bounds: while computing the numerator of BD and after multiplying PRVD by RVNM. When the positive bound has been exceeded the leftmost bit becomes "1", turning the number into a negative integer. For instance,

(2^{31} - 1) + 1 =overflow= - 2^{31}

or, visualizing the bits:

 0111 1111 1111 1111 1111 1111 1111 1111 + 1 =

1000 0000 0000 0000 0000 0000 0000 0000

The division by means of right shifts do not alter the result sign, since the n bits lost to the left are added to the right by leveraging the sign extension rule: if the leftmost bit is "0", then the number is left-padded with "0"s, otherwise with "1"s. This preserves both the number value and its sign, while re-extending it on 32 bits. For instance, being 8 the logarithm in base 2 of 256,

(2^{31} - 1) / 256  =integer= 2^{23} - 1

 0111 1111 1111 1111 1111 1111 1111 1111 >> 8 =

 0000 0000 0111 1111 1111 1111 1111 1111

while

(-2^{32} + 5) / 256  =integer= -2^{23}

1000 0000 0000 0000 0000 0000 0000 0101 >> 8 =

1111 1111 1000 0000 0000 0000 0000 0000

which means a negative numerator will remain negative even after the divisions (right shifts), resulting in negative damage. Final Fantasy VII does not treat negative damage as healing, since for it there is a special flag between the elemental modifiers (all the restorative spells/items have the Restorative element, and all the characters/enemies, except for the undeads, absorb that element). Instead the game thinks the final damage overflowed (despite the overflow occurring at an earlier stage of the computation) by going beyond 2^31 - 1. Since no target in the game has enough HP to survive such damage, the game mechanics kill the target.

To sum up, the overflow condition is

(POWM * DEFM * ATKM) > 2^{31} - 1

or

(PRVD * RVMN) > 2^{31} - 1

Post-Variance Multipliers are not going to help when trying to trigger the glitch, since they are applied at a point where it's impossible to get large enough partial results anymore. This rules out the elemental affinities and some special weapons modifiers.

Multiple overflows Edit

Since there are two possible point in which an overflow can take place, a composition between overflows may happen. In the base damage calculation, if the potentially overflowable value could be extended to a sufficiently large enough number of bits to avoid the overflow, the result would always be a positive integer. However, while applying random variance, it is possible that the first factor (PRVD) is negative due to a base damage overflow. In this condition, the same extension procedure would always yield a negative integer (as expected from the product between two numbers with different signs). To explain all the possible cases, one can imagine the extended base damage numerator as a quantity to deplete in different steps on a circuit. The circuit begins at step 0 and goes through all the natural numbers up to step 2^31 - 1. The successive step is step -2^31 and, then, the circuit continues until step 0, where a lap is considered completed, being step 0 the starting point. The extended numerator starts traveling through the circuit and, at every step, subtracts 1 from itself. When the numerator value becomes 0 the procedure ends. The correspondent circuit value is what the game considers the base damage numerator. The number of times the extended numerator went from step 2^31 - 1 to step -2^31 is the number of base damage overflows (BDOV), where the numerator becomes negative, while the number of completed laps is the number of base damage anti-overflows (BDAOV), where the numerator becomes non-negative.
During random variance application, if the extended numerator is positive, the very same procedure can be employed to calculate PoRVD and the number of random variance overflows (RVOV) and anti-overflows (RVAOV). If the extended numerator is negative, the lap goes in the opposite direction: it begins at step 0 down to step -2^31, after that it continues at step 2^31 - 1, down to step 0 again. The extended numerator adds 1 to itself at every step. The finishing point is still the extended numerator becoming 0. In this situation the ending point is PoRVD, the number of times the extended numerator travels from step -2^31 to step 2^31 - 1 is RVOV, and the number of times it travels from step 0 to step -1 is RVAOV.
The number of overflows and anti-overflow combine in this way:

BDFOV = BDOV - BDAOV
RVFOV = RVOV - RVAOV
FOV = BDFOV + sign(BDFOV) * RVFOV

FOV, by construction, can only be 0 or 1. In the former case, a global overflow (in the sense of negative final damage) won't happen and the damage inflicted will be in the range 1-9999. In the latter case a global overflow will take place. The game will kill the target only if the final damage is in the negative range. Sometimes, instead of weird symbols, the game displays a number between 1 and 9999 when the attack is performed and kills the enemy anyway; it's possible for the game to display digits instead of random symbols, even when the resulting damage is negative.

Overflow examples Edit

The most famous instance of the damage overflow glitch involves the Death Penalty. Its POWM is

((TPOW * (K/128))/16) + 10

where K is the number of enemies killed by Vincent, capped at 65535. Since the division by 16 is a 4 bits right shift, the maximum POWM (regarding a certain TPOW) is reached as soon as Vincent has killed 65408 enemies.

Barret's Missing Score can overflow damage if it is powered up by equipping large amounts of AP (the upper bound being eight mastered Knights of Round Materia) and also having other relevant stats sufficiently high. In particular the POWM for the Missing score is

((TPOW * (nAP/10000))/16) + 1

where nAP is the total number of AP contained in the Materia pieces equipped on the weapon. Each Materia piece has a cap, consisting in the AP amount needed to become master. The Missing Score always treats the Underwater Materia as if it had 0 AP, regardless the actual AP on it.

Vincent and Barret are the two best known characters for triggering the overflow glitch, but most characters can do it if they consume enough Hero Drinks and get the best outcome from the pre random variance modifiers. For instance, Red XIII can overflow with Cosmo Memory and Yuffie with All Creation; however the maximum target defense stat for the overflow to be possible is lower than the ones allowed for Barret and Vincent. Furthermore, Vincent has the highest upper bound on the target defense stat for the overflow to be possible (421) because the maxed Death Penalty has the highest POWM for all the possible TPOW values. Only Ruby Weapon has a defense stat over 421 (480, to be precise), making it the only non-overflowable enemy in the game.

Aeris cannot overflow without cheating, since her final weapon modifier is applied after the random variance without altering the POWM calculation, leading to the impossibility to get a high enough partial result during the computation. If one wants to cheat, it's possible to revive Aeris on disc 2 or 3 and overflow against an Acrophies by leveraging his x8 back attack multiplier. However, an additional cheat is required, since the Acrophies enemy normally cannot be encountered in a pre-emptive attack or side attack.

Healing overflow Edit

Healing Overflow by XeroKynos

If an attacker causes an overflow while attacking a target with an element he absorbs, the overflow effect is reversed and the target's HP are fully restored.

If an overflow happens with an attack linked in some way to HP Absorb or MP Absorb, the attacking character will be killed in the former case or deprived of all his/her MP in the latter one.

Combining the two properties, if a character who is equipped with HP Absorb or MP Absorb causes an overflow while attacking a target with an element he absorbs, the character will get either his/her HP completely restored, or his/her MP restored by a large amount, which depends on the pre-cap damage value. The target's HP are still fully restored.

External links Edit

  • A simulator of the Final Fantasy VII damage system, including overflow(s), is available here.

Also on Fandom

Random Wiki