Damage overflow glitch in Final Fantasy VII

In Final Fantasy VII all the integer numbers are encoded in 32 bits. Since they need to be signed integers, the two's complement representation is used. In this encoding the leftmost bit is negative weighted, while all the others have a positive value. Given 2^n, the sum of all the powers of 2 with the exponent in the range (0, n - 1) is equal to (2^n) - 1. This means the lower and upper bounds for in-game integers are

$$-2^{32} = -2,147,483,648$$

and

$$2^{31} - 1 = 2,147,483,647$$

If, at any point, the computation of some value results in a number which is out of those bounds, an overflow occurs and the game exhibits abnormal behaviors when this happens.

In Final Fantasy VII there are several instances of integer overflows. The most important and known one is the damage overflow glitch which is triggered when the game has to deal with a number greater than the aforementioned upper bound during the computation of the damage formula. Graphically random symbols are shown instead of the usual damage digits.

In Final Fantasy VII the general damage formula is

$$Damage = BD * PVMs * RVM * PoVMs$$

BD is the so called Base Damage, calculated as

$$(POWM * DEFM * ATKM) / (16 * 512)$$

where DEFM is the defense multiplier:

$$512 - TDEF$$

with the target defense stat expressed as TDEF.

ATKM is the attack multiplier:

$$((LV + ATK)/32) * ((LV * ATK)/32)$$

where LV is the attacker's level (max 99) and ATK is the attacker's Attack stat. The latter is the sum of the attacker's Strength and the equipped weapon attack bonus. ATK is capped at 255, but during a battle it can be temporarily increased up to 510 by the usage of 4 Hero Drinks. In particular the first 3 hero drinks give +30% and the last one +10%. Even if ATK is < 510 after 4 Hero Drinks, further usages of the item do not increase it anymore.

POWM is the power multiplier, which depends on TPOW (the Technique Power) and the equipped weapon. For most of the in-game weapons POWM is

$$TPOW / 16$$

but each final weapon has its own POWM formula which includes TPOW along with other parameters. TPOW is 16 for physical attacks, while all the command/spell/summon have their own values.

PVMs is the product of the sequence of Pre-Variance Multipliers, which are

Critical: x2 if a critical hit occurs, x1 otherwise. Berserk: x1.5 if the attacker is in Berserk, x1 otherwise. Row: x1 if the attacker and the target are both in the front row, x0.5 in all the other cases. Defense: x0.5 if the target is in defense mode, x1 otherwise. Back: x2 (x4 for Air Buster and x8 for Acrophies) if the target is attacked on the back, x1 otherwise. Frog: x0.25 if the attacker is in frog status, x1 otherwise. Sadness: x0.7 if the target is in sadness status, x1 otherwise. Split: x2/3 if the attack hits multiple targets, x1 otherwise. Barrier: x0.5 if the target is in barrier status, x1 otherwise. Mini: x0 if the target is in mini status, x1 otherwise.

As for mini, a rescaling makes 1 hp the minimum damage one can deal (without it the damage would be 0, since the mini multiplier itself is 0).

RVM is the Random Variance modifier: the game selects a random number between 0 and 255 (including the bounds), and adds it to 3841 in order to get RVMN, the RVM numerator, which spans from 3841 to 4096 by construction. A this point the random variance is applied by means of

$$PoRVD = (PRVD * RVMN) / 4096$$

being PoRVD the post random variace damage, PRVD the pre random variance damage and 4096 the fixed denominator of RVM. For this reason the random variance can be technically expressed as

$$RVMN/4096$$

even though that fraction is never actually computed.

Finally PoVMs is the product of the sequence of Post-Variance Multipliers which are the target elemental affinities w.r.t. the attack element and some special modifiers like Aerith's Princess Guard multiplier. The result is the actual damage dealt to the target, capped at 9999.

During the calculation, being the floating point division a time consuming operation, whenever the divisor (denominator) is a power of 2, the operation is performed by means of a right shift of the bits by $$n = log_{2}({divisor})$$, resulting in an integer division (the n rightmost bits are lost). The game parses the chain of operations to calculate and first computes as many products as possible, then performs the right shift(s). For this reason, there are two points where the partial results can go beyond 2^31 - 1: while computing the numerator of BD and after multiplying PRVD by RVNM. When the positive bound has been exceeded the leftmost bit becomes "1", turning the number into a negative integer. For instance,

$$(2^{31} - 1) + 1 =overflow= - 2^{32}$$

or, visualizing the bits:

$$ 0111 1111 1111 1111 1111 1111 1111 1111 + 1 =$$

$$1000 0000 0000 0000 0000 0000 0000 0000$$

The division by means of right shifts do not alter the result sign, since the n bits lost to the left are added to the right by leveraging the sign extension rule: if the leftmost bit is "0", then the number is left-padded with "0"s, otherwise with "1"s. This preserves both the number value and its sign, while re-extending it on 32 bits. For instance, being 8 the logarithm in base 2 of 256,

$$(2^{31} - 1) / 256 =integer= 2^{23} - 1$$

$$ 0111 1111 1111 1111 1111 1111 1111 1111 >> 8 =$$

$$ 0000 0000 0111 1111 1111 1111 1111 1111$$

while

$$(-2^{32} + 5) / 256 =integer= -2^{23}$$

$$1000 0000 0000 0000 0000 0000 0000 0101 >> 8 =$$

$$1111 1111 1000 0000 0000 0000 0000 0000$$

which means a negative numerator will remain negative even after the divisions (right shifts), resulting in negative damage. Final Fantasy VII does not treat negative damage as healing, since for it there is a special flag between the elemental modifiers (basically all the restorative spells/items have the "restorative" element, and all the characters/enemies, except for the undeads, absorb that element). Instead the game thinks the final damage overflowed (despite the overflow occurring at an earlier stage of the computation) by going beyond 2^32 - 1. Since no target in the game has enough HP to survive such damage, the game mechanics kill the target.

To sum up, the overflow condition is

$$(POWM * DEFM * ATKM) > 2^{31} - 1$$

or

$$(PRVD * RVMN) > 2^{31} - 1$$

Furthermore, in both cases, if the number is so big that not only it overflows (let's call the overflow "OV"), to negative, but it travels all the way to the positive numbers range, an "anti-overflow" (let's call it AOV) happens and the damage dealt becomes positive again. Since, depending on the numerators, OVs and AOVs may happen multiple times at both Base Damage calculation and Random Variance application stages, they compose in the following way:

$$FOV = X + Y$$

where X is the number of overflows and Y the number of anti-overflows which have happened. If FOV is an odd number, the final result is an overflow, while if FOV is even (including zero), the overflow (in the sense of negative final damage) won't happen and the damage inflicted will be in the range 1-9999. It's important to note that the game will kill the target only if the final damage is in the negative range. Sometimes, instead of weird symbols, the game displays a number between 1 and 9999 when the attack is performed and kills the enemy anyway. This is not in contraddiction with what said above, since it's perfectly possible for the game to show actual digits instead of random symbols, even when the resulting damage is negative.

The most famous instance of the damage overflow glitch involves the Death Penalty. Its POWM is

$$((TPOW * (K/128))/16) + 10$$

where K is the number of enemies killed by Vincent, capped at 65535. Since the division by 16 is a 4 bits right shift, the maximum POWM (regarding a certain TPOW) is reached as soon as Vincent has killed 65408 enemies.

Barret's Missing Score can overflow damage if it is powered up by equipping large amounts of AP (the upper bound being eight mastered Knights of Round Materia) and also having other relevant stats sufficiently high. In particular the POWM for the Missing score is

$$((TPOW * (nAP/10000))/16) + 1$$

where nAP is the total number of AP contained in the materias equipped on the weapon. Each materia has a cap, consisting in the AP amount needed to become master. Finally, the Missing Score always treats the Underwater Materia as if it had 0 AP, regardless the actual AP on it.

Vincent and Barret are the two best known characters for triggering the overflow glitch, but most characters can do it if they consume enough Hero Drinks and get the best outcome from the pre random variance modifiers. For instance, Red XIII can overflow with Cosmo Memory and Yuffie with All Creation; however the maximum target defense stat for the overflow to be possible is lower than the ones allowed for Barret and Vincent. Furthermore, Vincent is the character who has the highest upper bound on the target defense stat for the overflow to be possible (421). The reason is that the maxed Death Penalty is the in-game weapon with the highest POWM for all the possible TPOW values. Only Ruby Weapon has a defense stat over 421 (480, to be precise), making it the only non-overflowable target in the game. Aeris cannot possibly overflow, since her final weapon modifier is applied after the random variance without altering the POWM calculation, leading to the impossibility to get a high enough partial result during the computation.



Finally, if an overflow happens with an attack linked in some way to HP Absorb or MP Absorb, the attacking character will be killed in the former case or deprived of all his/her MP in the latter one. This is called Healing Overflow.