HUGE thanks to VampTY. The table she shared opened up my eyes to some of the other values I was looking for. I was so excited I created an account to share what I've learned.
The 10 "main" characters you create in the starting screen are stored first, as per that table. Immediately after them are stored the characters registered at the Guild (either pre-made or that you register yourself). Looks like a total of 100 character slots.
The data for each character's section is 508 bytes long (0x1FC) - so if you find one value for one character, you can add/subtract from that address in increments of 0x1FC to find it for others.
Example: the Female Porklu "main" character data begins at offset 0x061286E0. Her HP is at 0x061286F8 per the table, so the health offset is +0x018. The Female Porklu happens to be the "last" main character in the series, so the very first Guild-registered character can be found right after her at (0x061286E0 + 0x1FC) = 0x061288DC. For me this was a pre-made Male Human Fighter named Alex, so Alex's current HP was at (0x061288DC +0x018) = 0x061288F4.
Spell points were a bit tricker but I found them. Instead of one pool of mana, technically each character has 16 pools of mana. (And it's not exactly mana, more like number of available casts I guess). In memory, these Spell points are stored in 4-bit increments (nibbles), spread accross 16 bytes; the first 8 for the Mage spellbook, and the next 8 for the Priest spellbook. For each entry, both Current MP and Max MP are stored as two nibbles of the same byte as follows (Little-Endian):
- Bits 0-3: Current MP
- Bits 4-7: Max MP
Example: My level 8 Priest has 7/5/4/2/0/0/0/0 in her spell screen. This shows up in her byte array as 77 55 44 22. If I have her cast Torch Light (lvl 1 spell) once, that leaves her with 6 casts remaining and her byte array updates to 76 55 44 22.
In summary, here are the offsets I found, relative to the start of each character block:
- STR: +0x000E (Value type: all six stats are 1 byte each)
- INT: +0x000F
- PIE: +0x0010
- VIT +0x0011
- AGI +0x0012
- LUC +0x0013
- Level +0x0014 (Value type: 1 byte)
- Max HP*: +0x0016 (Value type: two bytes)
- Current HP: +0x0018 (Value type: two bytes)
- Gold: +0x0020 (Value type: 4 bytes)
- Exp: +0x0024 (Value type: 4 bytes)
- The Mage spell points begin at +0x0174 (Value type: binary, Size: 4, bits 0-3 are Current MP, bits 4-7 Max MP).
- The Priest spell points begin at +0x017C (Value type: binary, Size: as above).
- The character name is at +0x01BA (Value type: string, Size: 6 bytes).
*It seems the Max HP here is some kind of base value, though it does work. Increasing the value at this offset will increase your Max HP, but the number might not match exactly. Example: My level 8 priest has 51 hit points according to memory, but in-game she shows 54. When I increased it to 99, the game showed 105. I'm sure there are other modifiers going on but I didn't really look further.
Female Porklu values:
0x061286E0: [Start]
0x061286EE: INT
...
0x061286F6: Max HP
0x061286F8: Current HP
0x06128854: Mage Tier 1 Max/Current SP
...
0x0612885B: Mage Tier 8 Max/Current SP
0x0612885C: Priest Tier 1 Max/Current SP
...
0x06128863: Priest Tier 8 Max/Current SP
0x0612889A: Name of character
Remember, just add or subtract 508 bytes (0x1FC) from these locations to find the same values for your other characters.
Again, wouldn't have spotted these without VampTY's head start. Thank you!