User blog comment:Fredy-san/address safebook BC/@comment-9091559-20160403115423/@comment-24659969-20160403144820

Using SBGh.

0 = normal form, 1 = evolved form, 2 = true form. So switch only one cat form and search until only one value left. Sometimes, there is 2 ~ 5 addresses with same values which keep following, just keep changing the form and re-search the value.

The -800 offset is from the start of form select table to end unlock table. It could random a bit more or less but should not be far. Due to that, I recommend you to use normal cat such as Axe cat or Tank cat since those two are at the very beggining of the form select table.

Example, you got the form of Axe Cat address is 456789AC

The -800 offset would be 456781AC. You can simply do this in SBGh by hold-tap the form value > Memory tools > AddrCalc (The 3rd tab from left), then insert -800 as offset then hit calc, the result address can be added into the list. From the added address, hold-tap > view nearby memory and scrolls to top until you found like a big field of address in row with only 0 and 1 like there are more than 40 address in that pattern of only 0 and 1 (or all 0 if you haven't unlocked anything). 0 = locked, 1 = unlocked. So tap on address with 0 and add it to list for modification.

PS: As with more cats added, the offset value will get larger. That is why the offset value keeps getting updated, currently it should be around -81C if I am correct...

Also when modifying the value, do it phase by phase, you can modify like 250++ addresses of all units in one go, even trying to modify more than 70 addresses at once will crash your device usually due to app limitation.