User Tools

Site Tools


ZZT 4.0 (Unofficial)

ZZT 4.0 is a hex edit of ZZT 3.2 created by WiL for widespread use. The executable was released on November 25th, 2004.

Note that the non-NoMsg variant is unstable/buggy - see below.


While there is nothing stopping this ZZT hex edit from running on pre-80386 machines - including Zeta - at face value, it has been compressed with UPX without enabling the –8086 flag; as such, to run it on an 8086/80186/80286-class machine or Zeta, it must be decompressed first with upx -d.


The major changes here:

ZZT's notorious 20k board limit has now been increased to a healthier 32k.
ZZT's equally notorious bottomw-row placement bug has been fixed.
ZZT's annoying water-glink sound effect is now removed.
ZZT is now 39k, smaller than the original executable.

Minor changes include:

Textual changes - also, untitled.zzt, temp.brd, and saved.sav will no longer be the default. Now by >default you must put in a name of your own. This means no more angst over accidentally saving over your >last board, saved game, or ZZT project.

In addition, ZZT 4.0 came with a separate NoMsg variant, additionally changing:

* in-game messages and sound effects (that i have found so far) removed: Except the invisible wall message and sound effect. I coudln't justify removing that one. And the key and door messages.
* No yellow borders.


Some of the documented changes are inaccurate with regards to the in-executable changes.


  • The IoTmpBuf allocation calls have been patched to allocate a size of 0xFFFF (65535) rather than 0x4E20 (20000) bytes (offset 0x2387, 0x23E8).
  • The flag name SECRET is replaced with EDITED (offset 0x9651).
  • The Y < 25 requirement from OopExecute's #PUT handling is replaced with Y < 26, fixing the #PUT bottom row bug (offset 0xC9E1).


Description Location Original string Modified string
Configuration screen, second line (shareware) 0x1C44 Shareware version 3.2' New! ZZT Version 4.0
Configuration screen, second line (registered) 0x1C7A Version  3.2 Version  4.0
Copyright notice 0x1CA9 Created by Tim Sweeney By Tim Sweeney and WiL
Copyright notice 0x1D42 Copyright (c) 1991 Epic MegaGames, Press ... to abort' Public Domain since 1997.  ZZT 4.0 released in 2004,       ... to quit '
Shutdown notice (registered) 0x217F  Registered version -- Thank you for playing ZZT.  Thanks for playing!  ZZT 4.0 made by WiL.      .


Description Location Original string Modified string
Default save filename 0x2173 SAVED Empty (length set to 0)
Default exported board filename 0x2179 TEMP Empty (length set to 0)
Energizer pickup message 0x4468 Energizer - You are invincible Empty (length set to 0)
Default object name 0x4EF4 (ElementObjectTick), 0xBF4D (OopExecute) Interaction Empty (length set to 0)
Ammunition pickup message 0x56C5 Ammunition - 5 shots per container. Empty (length set to 0)
Gem pickup message 0x5750 Gems give you Health! Empty (length set to 0)
Fake wall message 0x5D8B A fake wall - secret passage! A fake wall - secret passage!U
Editor board name prompt 0x7AC0 Room's Title:, Board Name: (length edited)
Sidebar - default world name 0x109C1 Untitled Empty (length set to 0)
  • The fake wall message change seems to be an accident - the string length is incremented by one, causing the first byte of ElementFakeTouch's code to be added to the string.


Description Location Original Modified Comment
Water step sound 0x5F40 #64#1#80#1 Empty (length set to 0)


Location Original Modified Comment
0x5BE0 0x00 0x2E This makes ElementPusherTick remove 46 bytes from the stack every time it is called, causing a stack underflow and a crash after exactly seven pusher ticks if nothing else is done. The intent of adding this seems to be a misplaced hex edit pertaining to the torch's pickup message, which immediately follows said method.

Changes (NoMsg variant)

  • The following messages have their lengths set to 0:
    • Bomb activated! (offset 0x3E38),
    • A path is cleared through the forest. (offset 0x5D0A),
    • A fake wall - secret passage! (offset 0x5D8B),
    • Your way is blocked by water. (offset 0x5F45),
    • Game over  -  Press ESCAPE (offset 0x6183),
    • Can't shoot in this place! (offset 0x619F).
  • The following sounds have their lengths set to 0:
    • Energizer melody (offset 0x43F7 - pickup, 0x625C - running out),
    • Scroll pickup (offset 0x54D0),
    • Key pickup failure (offset 0x5597),
    • Key pickup success (offset 0x55B4),
    • Ammo pickup (offset 0x56BE),
    • Gem pickup (offset 0x5747),
    • Door open success (offset 0x5815),
    • Door open failure (offset 0x5835),
    • Torch pickup (offset 0x5C0F),
    • Torch burnout (offset 0x6255),
    • Running out of time (offset 0x6280).
  • The yellow border tile definition is replaced with a white-on-black Empty (offset 0x175FE).
  • The misplaced torch pickup message hex edit is undone, removing the Pusher stack underflow crash bug (but not the message!).
release/zzt40.txt · Last modified: 2021/02/28 23:36 by asie