For PSP

For PC

For Mobile

Prologue

First of all, don't forget that for codes we should use hexadecimal count system, it means we should count like 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, 10, 11, 12... An address will always take seven digits! P1 and P2 have the same kind of addresses, distance between P1 and P2 is 0x930 bytes. For example if you see a P1 address 0407A08 then the same address for P2 will be 0408338 (because 0407A08 + 930 = 0408338)

Basics

Usually, we use two kinds of lines to make codes:
"constant" - when you write to memory.
"condition" - when you read memory.
Let's use these words as terms. For example
Constant is 0x20407A08 0x00000217 means "on address 0407A08 value must be 217".
Condition is 0xE0XX0217 0x00407A08 means "if the value on 0407A08 is 217".
This "XX" in the middle of the first part means how many next lines will work if this condition is "true".

For example for one line
0xE0010217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX

Or for two lines
0xE0020217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX

Or for five lines
0xE0050217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX

You can combine them like this:
0xE0020217 0x00407A08
0xE0010512 0x00408338
0xXXXXXXXX 0xXXXXXXXX

But don't use the same address two times:
0xE01D0217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xE0010512 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
It makes no sense! I often write "1D" because it's the max number of lines in one cheat code. But i do it only if i'm sure that this condition must work for all code lines and it will not conflict with other conditions.

Data type

There are three kinds of addresses - 8bit, 16bit and 32bit.
32bit addresses contain 8 digits in value and end with 0, 4, 8 or C.
16bit addresses contain 4 digits in value and end with 0, 2, 4, 6, 8, A, C or E.
8bit addresses contain 2 digits in value and end with any digit.
Another important thing is the digit that you use in the beginning of a constant line, it regulates how many digits in the value will work.
0x2 means all eight digits will work.
0x1 means four digits will work.
0x0 means two digits will work.

!You can use 0x2 only for 32bit addresses!
!You can use 0x1 only with 32bit and 16bit addresses!

For example 0407A08 is 32bit address, so you can use all three digits before address, see how it will work:
0x20407A08 0x12345678 - you write to memory "12345678"
0x10407A08 0x12345678 - you write to memory only "5678", the rest will be ignored.
0x00407A08 0x12345678 - you write to memory only "78", all the rest will be ignored.

You can write one 32bit address as two 16bit addresses
0x10407A08 0x00005678
0x10407A0A 0x00001234
Or you can write it as four 8bit addresses
0x00407A08 0x00000078
0x00407A09 0x00000056
0x00407A0A 0x00000034
0x00407A0B 0x00000012

And the same thing for conditions, 0xE0 means 16bit condition, 0xE1 means 8bit condition
0xE0XX5678 0x00407A08
0xE0XX1234 0x00407A0A
Is the same to
0xE1XX0078 0x00407A08
0xE1XX0056 0x00407A09
0xE1XX0034 0x00407A0A
0xE1XX0012 0x00407A0B

Getting some experience

Each code usually starts with the "condition of a character".
Address which shows the number of the P1 is 04078B4, so the code line must be
0xE0XX00YY 0x004078B4 - YY is the number of character
To get value for YY open CWCheat / "Cheat searcher" / "Changes finder".
Type 004078B4 After this choose your character as P1 and see the value, for example number of Yoshimitsu is 04.
To get some experience let's change a hit rank.
The address which regulates hit rank of P1's moves is 0407A08.
General values are:

512 - High
217 - Mid
10F - Low

So, if you want Yoshimitsu to have all moves as Mid, you should make such code.
_C0 Hit Rank, test1
_L 0xE0010004 0x004078B4 // if Yoshi
_L 0x20407A08 0x00000217 // then hit rank is Mid

Alternatively, you can change only specific hit rank
_C0 Hit Rank, test2
_L 0xE0020004 0x004078B4 // if Yoshi
_L 0xE0010217 0x00407A08 // if hit rank is Mid
_L 0x20407A08 0x0000010F // then hit rank is Low
This code will change for Yoshimitsu all Mid moves to Low, but High moves will work as usual.

If you want to change hit rank only for a specific move you should add "condition of a move".
We use 0407A18 to set a condition of an ordinal move number.
Don't confuse it with 0407A08. It's different addresses.
It's like a move identification which shows which move is going.
To get a value from this address we should repeat all steps like we did with number of characters, but now we need to get four digits
Open CWCheat / "Cheat searcher" / "Changes finder".
Type 00407A18
Press Square button to set 16bit (because we need four digits).
If a character does not perform a move, you see the value is "8001".
Let's try to change rank for Yoshimitsu's f+3.
We need to get a value before a move hits an opponent.
Open CWCheat / "Settings".
Set the "Controller check delay" to 0, it allows to open CWCheat immediately.
While f+3 you see the value is 01DE, so now we can make such code
_C0 Hit Rank, test3
_L 0xE0020004 0x004078B4 // if Yoshi
_L 0xE00101DE 0x00407A18 // if during f+3
_L 0x20407A08 0x00000217 // then hit rank is Mid
This code will change hit rank only for Yoshimitsu's f+3 but all the rest moves will work as usual.

Modifying moves

To modify moves we use two groups of addresses.
Both groups show the same values, the difference is only in time.
The first group shows values during the whole move (from the first to the last frame).
The second group shows values only from the moment when you press button(s) to the moment when this move starts, it's very fast.
Addresses of the first group:
0407A18 - ordinal move number
0407964 - pointer to the current move
Addresses of the second group:
0407D1C - ordinal move number
0407D24 - pointer to move
The main address which regulates which move P1 performs is 0407D24.
But since the second group shows values very fast we have to use a "double-address" from the first group, it's 0407964
Let's try to modify a Jin's move, for example forcing him to perform EWHF.
Choose Jin vs Paul (it's important) and do EWHF.
Now we need to get eight digits.
Open CWCheat while Jin does EWHF but before it hits an opponent / "Cheat searcher" / "Changes finder".
Type 00407964
Press Square button to set 32bit.
When you get back to the game, you see the value is "0870B274".
Let's make a simple code with it.
_C0 Modify move, test1
_L 0xE0010009 0x004078B4 // if Jin (number of Jin is 09)
_L 0x20407D24 0x0870B274 // performs EWHF
You see Jin performs EWHF all the time. We cannot control him anymore and he even does not react on opponent's attacks.
To make it work properly we need to add "condition of a move" as a limiter, for example ordinal move number.
We can use both addresses which show ordinal move number, as from the first group as from the second.
But since 0407D24 is from the second group let's use move number address from the second group too, it's 0407D1C.
And the same like we did with 0407D24 we have to use one address in the code but take values from another.
Do a move which you want to be changed to EWHF, for example d/f+2, it will work like a trigger event.
Open CWCheat / "Cheat searcher" / "Changes finder".
Type 00407A18
When you do d/f+2, you see that ordinal move number of this move is 024B, so now we already can make such code.
_C0 Modify move, test2
_L 0xE0020009 0x004078B4 - if Jin
_L 0xE001024B 0x00407D1C - if d/f+2 starts
_L 0x20407D24 0x0870B274 - performs EWHF
Now Jin will perform EWHF when you press d/f+2, but this code is not stable yet.
Disable these codes and Choose Jin vs Alisa (it's important).
Do EWHF and take a look at the value on 0407964. You see it's not 0870B274 anymore, now it's 087B6E74.
Tekken 6 has a feature, all move pointers have two variants.
It happens because P1 and P2 locate their move bases in two places.
Who has a bigger character's number that locates their move base in the first place, another - in the second place.
Paul has number 0 (very first), Alisa has number 29 (the last).
So if you choose your character vs Paul that it will have the first variant of pointers, if vs Alisa - the second variant.
To make codes work stable we should consider it.
Address which shows which variant of pointer P1 has is 04078E0.
If it's the first variant then the value is 086A8800, the second variant - 08754400.
We can use it for recognition
_C0 Modify move, test3
_L 0xE0050009 0x004078B4 // if Jin
_L 0xE004024B 0x00407D1C // if d/f+2 starts
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B6E74 // performs EWHF vs Alisa
Now this code works stable.
You can also make it using 0407A18 but since 0407A18 and 0407D24 are in different time groups EWHF will start only when d/f+2 will completely end.
To fix it we have to use an address which regulates when following move must start during the current one, it's 0407D10.
And code will look like this.
_C0 Modify move, test3a
_L 0xE0060009 0x004078B4 // if Jin
_L 0xE005024B 0x00407A18 // if during d/f+2
_L 0x20407D10 0x00000000 // then immediately
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B6E74 // performs EWHF vs Alisa
You can experiment with value for 0407D10 and set any delay what you want.
d/f+2 hits an opponent on 15th frame (15 in dec = 0F in hex).
So if you change value for 0407D10 to 0F then d/f+2 will hit an opponent two times, as original d/f+2 and as EWHF.
_C0 Modify move, test3b
_L 0xE0060009 0x004078B4 // if Jin
_L 0xE005024B 0x00407A18 // if during d/f+2
_L 0x20407D10 0x0000000F // then on 15th frame (in dec)
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B6E74 // performs EWHF vs Alisa

And by the same way we can make a custom string.
Let's take for example Jin's 3,1 now, the ordinal move number of 3,1 is 1E0 (see on 0407A18).
We can continue it for example with WS+1,2 (so in result we will have 3,1,2).
To do it we need to add a condition of button press, the 8bit address which shows what the button we press is 0407D3C.
1 - LP
2 - RP
4 - LK
8 - RK
We will do it with the RP button.
And also we need to limit the time when a user can press this button.
Address which shows the current frame of the current move is 0407940.
3,1 hits an opponent on the 14th frame (in hex).
But if we add such condition 0xE0XX0014 0x00407940 we will have a justframe input 3,1:2
To fix it we should use another option in a condition line.
0xE0XX0014 0xZ0407940 - instead of Z use:

0 - if value is equal to 0014
1 - if value is not equal to 0014
2 - if value is less than 0014
3 - if value is greater than 0014

A user must have time for pressing a button from the 1st to the 14th frame, so the condition line must be 0xE0XX0014 0x20407940
And in result the code will look like this
_C0 Modify move, test4
_L 0xE0080009 0x004078B4 // if Jin
_L 0xE00701E0 0x00407A18 // if during 3,1
_L 0xE0060014 0x20407940 // if this move is less 14 frames (in hex)
_L 0xE1050002 0x00407D3C // if press RP button
_L 0x20407D10 0x00000014 // then on 14th frame (in hex)
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x08708D54 // performs WS+1,2 vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B4954 // performs WS+1,2 vs Alisa

We can continue this string further but since we added 3,1,2 in a custom way we face a problem. Value on 0407A18 is 0000 now, we cannot use only this address to identify our move. We have to use other move features while P1 performs it, for example pointer on 0407964. Though move pointers are different vs Paul and vs Alisa, the last two digits are always the same. For example both pointers of WS+1,2 ends with 54 we can use it as 8bit condition for 0407964.
Let's continue 3,1,2 with f+4
_C0 Modify move, test5
_L 0xE0090009 0x004078B4 // if Jin
_L 0xE0080000 0x00407A18 // if during a custom move
_L 0xE1080054 0x00407964 // if move pointer ends with "54"
_L 0xE0060016 0x20407940 // if this move is less 16 frames (in hex)
_L 0xE1050008 0x00407D3C // if press RK button
_L 0x20407D10 0x00000016 // then on 16th frame (in hex)
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x087098AC // performs f+4 vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B54AC // performs f+4 vs Alisa

What is a pointer

A pointer is a special kind of value. In this case it does not write anything to memory directly. The value becomes a "link" which leads to another memory area. Let's start with a simple example, take a look at the value on address 0407F98.
Open CWCheat / "Cheat searcher" / "Disassembler" and scroll to 0407F98.
You see, the value is 08C07860, this is a link.
To get the area which it links to, you must subtract 08800000 (08C07860 - 08800000 = 00407860) and scroll to this address.
Let's try to change the hit rank using this pointer.
There are special code lines we must use for this:
_L 0x6AAAAAAA 0xVVVVVVVV
_L 0x000Y000T 0xSSSSSSSS
These lines must always be together. Never separate them! Especially when you pick a number for the middle of the first part of a Condition line.
AAAAAAA - is the address which has a pointer value (in our example it's 0407F98).
VVVVVVVV - is the value you want to be written in the result (in our example it's 217).
Y - represents the datatype of the value, where 0 indicates an 8-bit value, 1 indicates a 16-bit value, and 2 indicates a 32-bit value. Since our value 217 is a 3-digit value, we must use either a 16-bit or a 32-bit.
T - is the number of "steps" in this pointer (we have only one here)
SSSSSSSS - is an offset, i.e. it's a distance from the link address (0407860) to the address which we want (0407A08), so 0407A08 - 0407860 = 1A8
Thus in result the code will look like this
_C0 Hit Rank, test4
_L 0x60407F98 0x00000217
_L 0x00020001 0x000001A8
This is absolutely the same to _L 0x20407A08 0x00000217.
In messages and posts we often describe pointer's steps like "0407F98=>1A8". Just to say it faster.
It means - take a value that you see at 0407F98 (for example 08C07860) and increase it by 1A8

Structure of a move

You might already understand that values which we use for 0407964/68 and for 0407D24 are links too. They point to the structure of a move. If we recreate this structure somewhere in an empty area of the game we can use it as a custom move. In Tk6 one move takes 0x58 bytes, it's the same for all characters. There is an empty area in Tk6 starting from 0884000, so if you wanna build a custom move there then it must look like this:

_C0 Building custom move
_L 0x20884000 0x08B98190 // pointer to the name of the move (not in use in Tk6)
_L 0x20884004 0x08B98190 // pointer to the name of the animation (not in use in Tk6)
_L 0x20884008 0x08F51FC8 // pointer to animation (list of common animations)
_L 0x2088400C 0x00000842 // body state for opponent's attacks (842 means body stands, no block)
_L 0x20884010 0x00000217 // hit rank (217 means mid)
_L 0x20884014 0x08E41530 // pointer to recovery/strings
_L 0x20884018 0x00008001 // visual recovery (8001 means default stance)
_L 0x2088401C 0x00000000 // technical id (not necessary)
_L 0x20884020 0x08E413F8 // pointer to reactions/damage
_L 0x20884024 0x0000004A // length of move (74 frames in DEC)
_L 0x20884028 0x00000000 // midair state "from" (not necessary)
_L 0x2088402C 0x00000000 // midair state "to" (not necessary)
_L 0x20884030 0x00000000 // frame of ground fall (not necessary)
_L 0x20884034 0x00000000 // pointer to base hit/block sounds (not necessary)
_L 0x20884038 0x00000000 // pointer to audio/visual effects (not necessary)
_L 0x2088403C 0x00000000 // pointer to effects which work just before the move starts (not necessary)
_L 0x20884040 0x00000000 // pointer to effects which work just after the move ends (not necessary)
_L 0x20884044 0x08000000 // extra properties of body
_L 0x20884048 0x0000000D // attacking limb (list of all limbs)
_L 0x2088404C 0x00000023 // the frame of attack "from"
_L 0x20884050 0x00000024 // the frame of attack "to"
_L 0x20884054 0x00000000 // extra properties, like movement of body in the air, displacement of colliders (rare using).
(red values are important, you can't set zeros for them)

So, all these values together are one move. When i say "move" i also mean a stance, a throw, a reaction, a cutscene, etc. They all are moves. To apply this move you must increase the first address by 08800000 (0884000 + 08800000 = 09084000) and add conditions as before.
_C0 JIN u/f+1+2 custom move
_L 0xE0020009 0x004078B4 // if Jin
_L 0xE00102FC 0x00407D1C // if u/f+1+2
_L 0x20407D24 0x09084000 // custom move
For custom moves you don't have to get values vs Paul and vs Alisa but if you use "recovery/string" pointer or "reactions/damage" pointer from a character then you have to.

To get better understanding how moves are organized open http://sadamitsu.ru/cwcheat/movefinder.htm, type a move and click on result to see its structure

Prologue

First of all, don't forget that for codes we should use hexadecimal count system, it means we should count like 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, 10, 11, 12... Addresses and values for PSP and for ppsspp are the same when you make a code, but addresses are different for searching, the difference is 08800000. For example if in PSP an address is 0407A08 then in ppsspp this address is 08C07A08 (because 0407A08 + 08800000 = 08C07A08). We must make codes in PSP format, so an address will always take seven digits! P1 and P2 have the same kind of addresses, distance between P1 and P2 is 0x930 bytes. For example if you see a P1 address 0407A08 then the same address for P2 will be 0408338 (because 0407A08 + 930 = 0408338)

Basics

Usually, we use two kinds of lines to make codes:
"constant" - when you write to memory.
"condition" - when you read memory.
Let's use these words as terms. For example
Constant is 0x20407A08 0x00000217 means "on address 0407A08 value must be 217".
Condition is 0xE0XX0217 0x00407A08 means "if the value on 0407A08 is 217".
This "XX" in the middle of the first part means how many next lines will work if this condition is "true".

For example for one line
0xE0010217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX

Or for two lines
0xE0020217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX

Or for five lines
0xE0050217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX

You can combine them like this:
0xE0020217 0x00407A08
0xE0010512 0x00408338
0xXXXXXXXX 0xXXXXXXXX

But don't use the same address two times:
0xE01D0217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xE0010512 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
It makes no sense! I often write "1D" because it's the max number of lines in one cheat code (PSP standart). But i do it only if i'm sure that this condition must work for all code lines and it will not conflict with other conditions.

Data type

There are three kinds of addresses - 8bit, 16bit and 32bit.
32bit addresses contain 8 digits in value and end with 0, 4, 8 or C.
16bit addresses contain 4 digits in value and end with 0, 2, 4, 6, 8, A, C or E.
8bit addresses contain 2 digits in value and end with any digit.
Another important thing is the digit that you use in the beginning of a constant line, it regulates how many digits in the value will work.
0x2 means all eight digits will work.
0x1 means four digits will work.
0x0 means two digits will work.

!You can use 0x2 only for 32bit addresses!
!You can use 0x1 only with 32bit and 16bit addresses!

For example 0407A08 is a 32bit address, so you can use all three digits before address, see how it will work:
0x20407A08 0x12345678 - you write to memory "12345678"
0x10407A08 0x12345678 - you write to memory only "5678", the rest will be ignored.
0x00407A08 0x12345678 - you write to memory only "78", all the rest will be ignored.

You can write one 32bit address as two 16bit addresses
0x10407A08 0x00005678
0x10407A0A 0x00001234
Or you can write it as four 8bit addresses
0x00407A08 0x00000078
0x00407A09 0x00000056
0x00407A0A 0x00000034
0x00407A0B 0x00000012

And the same thing for conditions, 0xE0 means 16bit condition, 0xE1 means 8bit condition
0xE0XX5678 0x00407A08
0xE0XX1234 0x00407A0A
Is the same to
0xE1XX0078 0x00407A08
0xE1XX0056 0x00407A09
0xE1XX0034 0x00407A0A
0xE1XX0012 0x00407A0B

Getting some experience

Each code usually starts with the "condition of a character".
Address which shows the number of the P1 is 04078B4 (08C078B4 in ppsspp), so the code line must be
0xE0XX00YY 0x004078B4 - YY is the number of character.
To get value for YY in ppsspp open "Debug" / "Memory View" (or press Ctrl+M).
Type in the "Goto" 08C078B4 and press Enter.
After this choose your character as P1 and see the value, for example number of Yoshimitsu is 04.
To get some experience let's change a hit rank.
The address which regulates hit rank of P1's moves is 0407A08 (08C07A08 in ppsspp).
General values are:

512 - High
217 - Mid
10F - Low

So, if you want Yoshimitsu to have all moves as Mid, you should make such code
_C0 Hit Rank, test1
_L 0xE0010004 0x004078B4 // if Yoshi
_L 0x20407A08 0x00000217 // then hit rank is Mid

Alternatively, you can change only specific hit rank
_C0 Hit Rank, test2
_L 0xE0020004 0x004078B4 // if Yoshi
_L 0xE0010217 0x00407A08 // if hit rank is Mid
_L 0x20407A08 0x0000010F // then hit rank is Low
This code will change for Yoshimitsu all Mid moves to Low, but High moves will work as usual.

If you want to change hit rank only for a specific move you should add "condition of a move".
We use 0407A18 to set a condition of an ordinal move number.
Don't confuse it with 0407A08. It's different addresses.
It's like a move identification which shows which move is going.
To get a value from this address we should repeat all the steps we did with the number of characters.
but now we need to get four digits.
Open "Debug" / "Memory View" (or press Ctrl+M).
Type in the "Goto" 08C07A18 and press Enter.
If a character does not perform a move, you see the value is "01 80".
It's how the emulator shows values, to use it in a code you have to turn it backwards by two digits.
Therefore, in result you will get "8001".
Let's try to change rank for Yoshimitsu's f+3.
We need to get a value before a move hits an opponent.
Press F8 to pause the game.
While f+3 you see the value is 01DE, so now we can make such code.
_C0 Hit Rank, test3
_L 0xE0020004 0x004078B4 // if Yoshi
_L 0xE00101DE 0x00407A18 // if during f+3
_L 0x20407A08 0x00000217 // then hit rank is Mid
This code will change hit rank only for Yoshimitsu's f+3 but all the rest moves will work as usual.

Modifying moves

To modify moves we use two groups of addresses.
Both groups show the same values, the difference is only in time.
The first group shows values during the whole move (from the first to the last frame).
The second group shows values only from the moment when you press button(s) to the moment when this move starts, it's very fast.
Addresses of the first group:
0407A18 - ordinal move number.
0407964 - pointer to the current move.
Addresses of the second group:
0407D1C - ordinal move number.
0407D24 - pointer to move.
The main address which regulates which move P1 performs is 0407D24 (08C07D24 in ppsspp).
But since the second group shows values very fast we have to use a "double-address" from the first group, it's 0407964 (08C07964 in ppsspp).
Let's try to modify a Jin's move, for example forcing him to perform EWHF.
Choose Jin vs Paul (it's important) and do EWHF.
Now we need to get eight digits.
Press F8 while Jin does EWHF but before it hits an opponent.
Open "Debug" / "Memory View" (or press Ctrl+M).
Type in the "Goto" 08C07964 and press Enter.
You see the value is "74 B2 70 08", when you turn it backwards, you get "0870B274".
Let's make a simple code with it
_C0 Modify move, test1
_L 0xE0010009 0x004078B4 // if Jin (number of Jin is 09)
_L 0x20407D24 0x0870B274 // performs EWHF
You see Jin performs EWHF all the time. We cannot control him anymore and he even does not react on opponent's attacks.
To make it work properly we need to add "condition of a move" as a limiter, for example ordinal move number.
We can use both addresses which show ordinal move number, as from the first group as from the second.
But since 0407D24 is from the second group let's use move number address from the second group too, it's 0407D1C (08C07D1C in ppsspp).
And the same like we did with 0407D24 we have to use one address in the code but take values from another.
Do a move which you want to be changed to EWHF, for example d/f+2, it will work like a trigger event.
Open "Debug" / "Memory View" (or press Ctrl+M).
Type in the "Goto" 08C07A18 and press Enter.
When you do d/f+2, you see that ordinal move number of this move is 024B, so now we already can make such code.
_C0 Modify move, test2
_L 0xE0020009 0x004078B4 - if Jin
_L 0xE001024B 0x00407D1C - if d/f+2 starts
_L 0x20407D24 0x0870B274 - performs EWHF
Now Jin will perform EWHF when you press d/f+2, but this code is not stable yet.
Disable these codes and Choose Jin vs Alisa (it's important).
Do EWHF and take a look at the value on 0407964. You see it's not 0870B274 anymore, now it's 087B6E74.
Tekken 6 has a feature, all move pointers have two variants.
It happens because P1 and P2 locate their move bases in two places.
Who has a bigger character's number that locates their move base in the first place, another - in the second place.
Paul has number 0 (very first), Alisa has number 29 (the last).
So if you choose your character vs Paul that it will have the first variant of pointers, if vs Alisa - the second variant.
To make codes work stable we should consider it.
Address which shows which variant of pointer P1 has is 04078E0 (08C078E0 in ppsspp)
If it's the first variant then the value is 086A8800, the second variant - 08754400.
We can use it for recognition
_C0 Modify move, test3
_L 0xE0050009 0x004078B4 // if Jin
_L 0xE004024B 0x00407D1C // if d/f+2 starts
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B6E74 // performs EWHF vs Alisa
Now this code works stable.
You can also make it using 0407A18 but since 0407A18 and 0407D24 are in different time groups EWHF will start only when d/f+2 will completely end.
To fix it we have to use an address which regulates when following move must start during the current one, it's 0407D10 (08C07D10 in ppsspp).
And code will look like this
_C0 Modify move, test3a
_L 0xE0060009 0x004078B4 // if Jin
_L 0xE005024B 0x00407A18 // if during d/f+2
_L 0x20407D10 0x00000000 // then immediately
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B6E74 // performs EWHF vs Alisa
You can experiment with value for 0407D10 and set any delay what you want.
d/f+2 hits an opponent on 15th frame (15 in dec = 0F in hex).
So if you change value for 0407D10 to 0F then d/f+2 will hit an opponent two times, as original d/f+2 and as EWHF
_C0 Modify move, test3b
_L 0xE0060009 0x004078B4 // if Jin
_L 0xE005024B 0x00407A18 // if during d/f+2
_L 0x20407D10 0x0000000F // then on 15th frame (in dec)
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B6E74 // performs EWHF vs Alisa

And by the same way we can make a custom string.
Let's take for example Jin's 3,1 now, the ordinal move number of 3,1 is 1E0 (see on 08C07A18).
We can continue it for example with WS+1,2 (so in result we will have 3,1,2)
To do it we need to add a condition of button press, the 8bit address which shows what the button we press is 0407D3C (08C07D3C in ppsspp).
1 - LP
2 - RP
4 - LK
8 - RK
We will do it with the RP button.
And also we need to limit the time when a user can press this button.
Address which shows the current frame of the current move is 0407940 (08C07940 in ppsspp).
3,1 hits an opponent on the 14th frame (in hex).
But if we add such condition 0xE0XX0014 0x00407940 we will have a justframe input 3,1:2
To fix it we should use another option in a condition line
0xE0XX0014 0xZ0407940 - instead of Z use:

0 - if value is equal to 0014
1 - if value is not equal to 0014
2 - if value is less than 0014
3 - if value is greater than 0014

A user must have time for pressing a button from the 1st to the 14th frame, so the condition line must be 0xE0XX0014 0x20407940
And in result the code will look like this
_C0 Modify move, test4
_L 0xE0080009 0x004078B4 // if Jin
_L 0xE00701E0 0x00407A18 // if during 3,1
_L 0xE0060014 0x20407940 // if this move is less 14 frames (in hex)
_L 0xE1050002 0x00407D3C // if press RP button
_L 0x20407D10 0x00000014 // then on 14th frame (in hex)
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x08708D54 // performs WS+1,2 vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B4954 // performs WS+1,2 vs Alisa

We can continue this string further but since we added 3,1,2 in a custom way we face a problem. Value on 0407A18 is 0000 now, we cannot use only this address to identify our move. We have to use other move features while P1 performs it, for example pointer on 0407964. Though move pointers are different vs Paul and vs Alisa, the last two digits are always the same. For example both pointers of WS+1,2 ends with 54 we can use it as 8bit condition for 0407964.
Let's continue 3,1,2 with f+4
_C0 Modify move, test5
_L 0xE0090009 0x004078B4 // if Jin
_L 0xE0080000 0x00407A18 // if during a custom move
_L 0xE1080054 0x00407964 // if move pointer ends with "54"
_L 0xE0060016 0x20407940 // if this move is less 16 frames (in hex)
_L 0xE1050008 0x00407D3C // if press RK button
_L 0x20407D10 0x00000016 // then on 16th frame (in hex)
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x087098AC // performs f+4 vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B54AC // performs f+4 vs Alisa

What is a pointer

A pointer is a special kind of value. In this case it does not write anything to memory directly. The value becomes a "link" which leads to another memory area. Let's start with a simple example, take a look at the value on address 0407F98.
Open "Debug" / "Memory View" (or press Ctrl+M).
(0407F98 + 08800000 = 08C07F98) Type in the "Goto" 08C07F98 and press Enter.
You see, the value is 08C07860, this is a link.
To get the area which it links to, type it in the "Goto" also.
Let's try to change the hit rank using this pointer.
There are special code lines we must use for this:
_L 0x6AAAAAAA 0xVVVVVVVV
_L 0x000Y000T 0xSSSSSSSS
These lines must always be together. Never separate them! Especially when you pick a number for the middle of the first part of a Condition line.
AAAAAAA - is the address which has a pointer value (in our example it's 0407F98).
VVVVVVVV - is the value you want to be written in the result (in our example it's 217).
Y - represents the datatype of the value, where 0 indicates an 8-bit value, 1 indicates a 16-bit value, and 2 indicates a 32-bit value. Since our value 217 is a 3-digit value, we must use either a 16-bit or a 32-bit.
T - is the number of "steps" in this pointer (we have only one here) (and btw. ppsspp supports only one "step").
SSSSSSSS - is an offset, i.e. it's a distance from the link address (0407860) to the address which we want (0407A08), so 0407A08 - 0407860 = 1A8
Thus in result the code will look like this
_C0 Hit Rank, test4
_L 0x60407F98 0x00000217
_L 0x00020001 0x000001A8
This is absolutely the same to _L 0x20407A08 0x00000217.
In messages and posts we often describe pointer's steps like "0407F98=>1A8". Just to say it faster.
It means - take a value that you see at 0407F98 (for example 08C07860) and increase it by 1A8

Structure of a move

You might already understand that values which we use for 0407964 and for 0407D24 are links too. They point to the structure of a move. If we recreate this structure somewhere in an empty area of the game we can use it as a custom move. In Tk6 one move takes 0x58 bytes, it's the same for all characters. There is an empty area in Tk6 starting from 0884000, so if you wanna build a custom move there then it must look like this:

_C0 Building custom move
_L 0x20884000 0x08B98190 // pointer to the name of the move (not in use in Tk6)
_L 0x20884004 0x08B98190 // pointer to the name of the animation (not in use in Tk6)
_L 0x20884008 0x08F51FC8 // pointer to animation (list of common animations)
_L 0x2088400C 0x00000842 // body state for opponent's attacks (842 means body stands, no block)
_L 0x20884010 0x00000217 // hit rank (217 means mid)
_L 0x20884014 0x08E41530 // pointer to recovery/strings
_L 0x20884018 0x00008001 // visual recovery (8001 means default stance)
_L 0x2088401C 0x00000000 // technical id (not necessary)
_L 0x20884020 0x08E413F8 // pointer to reactions/damage
_L 0x20884024 0x0000004A // length of move (74 frames in DEC)
_L 0x20884028 0x00000000 // midair state "from" (not necessary)
_L 0x2088402C 0x00000000 // midair state "to" (not necessary)
_L 0x20884030 0x00000000 // frame of ground fall (not necessary)
_L 0x20884034 0x00000000 // pointer to base hit/block sounds (not necessary)
_L 0x20884038 0x00000000 // pointer to audio/visual effects (not necessary)
_L 0x2088403C 0x00000000 // pointer to effects which work just before the move starts (not necessary)
_L 0x20884040 0x00000000 // pointer to effects which work just after the move ends (not necessary)
_L 0x20884044 0x08000000 // extra properties of body
_L 0x20884048 0x0000000D // attacking limb (list of all limbs)
_L 0x2088404C 0x00000023 // the frame of attack "from"
_L 0x20884050 0x00000024 // the frame of attack "to"
_L 0x20884054 0x00000000 // extra properties, like movement of body in the air, displacement of colliders (rare using).
(red values are important, you can't set zeros for them)

So, all these values together are one move. When i say "move" i also mean a stance, a throw, a reaction, a cutscene, etc. They all are moves. To apply this move you must increase the first address by 08800000 (0884000 + 08800000 = 09084000) and add conditions as before.
_C0 JIN u/f+1+2 custom move
_L 0xE0020009 0x004078B4 // if Jin
_L 0xE00102FC 0x00407D1C // if u/f+1+2
_L 0x20407D24 0x09084000 // custom move
For custom moves you don't have to get values vs Paul and vs Alisa but if you use "recovery/string" pointer or "reactions/damage" pointer from a character then you have to.

To get better understanding how moves are organized open http://sadamitsu.ru/cwcheat/movefinder.htm, type a move and click on result to see its structure

Prologue

First of all, don't forget that for codes we should use hexadecimal count system, it means we should count like 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, 10, 11, 12... An address will always take seven digits! P1 and P2 have the same kind of addresses, distance between P1 and P2 is 0x930 bytes. For example if you see a P1 address 0407A08 then the same address for P2 will be 0408338 (because 0407A08 + 930 = 0408338)

Basics

Usually, we use two kinds of lines to make codes:
"constant" - when you write to memory
"condition" - when you read memory
Let's use these words as terms. For example
Constant is 0x20407A08 0x00000217 means "on address 0407A08 value must be 217".
Condition is 0xE0XX0217 0x00407A08 means "if the value on 0407A08 is 217".
This "XX" in the middle of the first part means how many next lines will work if this condition is "true".

For example for one line
0xE0010217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX

Or for two lines
0xE0020217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX

Or for five lines
0xE0050217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX

You can combine them like this:
0xE0020217 0x00407A08
0xE0010512 0x00408338
0xXXXXXXXX 0xXXXXXXXX

But don't use the same address two times:
0xE01D0217 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
0xXXXXXXXX 0xXXXXXXXX
0xE0010512 0x00407A08
0xXXXXXXXX 0xXXXXXXXX
It makes no sense! I often write "1D" because it's the max number of lines in one cheat code (for PSP). But i do it only if i'm sure that this condition must work for all code lines and it will not conflict with other conditions.

Data type

There are three kinds of addresses - 8bit, 16bit and 32bit.
32bit addresses contain 8 digits in value and end with 0, 4, 8 or C.
16bit addresses contain 4 digits in value and end with 0, 2, 4, 6, 8, A, C or E.
8bit addresses contain 2 digits in value and end with any digit.
Another important thing is the digit that you use in the beginning of a constant line, it regulates how many digits in the value will work.
0x2 means all eight digits will work
0x1 means four digits will work
0x0 means two digits will work

!You can use 0x2 only for 32bit addresses!
!You can use 0x1 only with 32bit and 16bit addresses!

For example 0407A08 is 32bit address, so you can use all three digits before address, see how it will work:
0x20407A08 0x12345678 - you write to memory "12345678"
0x10407A08 0x12345678 - you write to memory only "5678", the rest will be ignored.
0x00407A08 0x12345678 - you write to memory only "78", all the rest will be ignored.

You can write one 32bit address as two 16bit addresses
0x10407A08 0x00005678
0x10407A0A 0x00001234
Or you can write it as four 8bit addresses
0x00407A08 0x00000078
0x00407A09 0x00000056
0x00407A0A 0x00000034
0x00407A0B 0x00000012

And the same thing for conditions, 0xE0 means 16bit condition, 0xE1 means 8bit condition
0xE0XX5678 0x00407A08
0xE0XX1234 0x00407A0A
Is the same to
0xE1XX0078 0x00407A08
0xE1XX0056 0x00407A09
0xE1XX0034 0x00407A0A
0xE1XX0012 0x00407A0B

Getting some experience

Each code usually starts with the "condition of a character".
Address which shows the number of the P1 is 04078B4, so the code line must be
0xE0XX00YY 0x004078B4 - YY is the number of character:
00 - Paul
01 - Law
02 - Lei
03 - King
04 - Yoshimitsu
05 - Nina
06 - Hwoarang
07 - Xiaoyu
08 - Christie
09 - Jin
0A - Julia
0B - Kuma
0C - Bryan
0D - Heihachi
0E - Kazuya
0F - Lee
10 - Steve
11 - Marduk
12 - Jack
13 - Roger
14 - Anna
15 - Wang
16 - Ganryu
17 - Asuka
18 - Bruce
19 - Baek
1A - Devil Jin
1B - Raven
1C - Feng
1D - Armor King
1E - Lili
1F - Dragunov
20 - Panda
21 - Eddy
22 - Bob
23 - Zafina
24 - Miguel
25 - Leo
26 - Azazel
27 - Nancy
28 - Lars
29 - Alisa
To get some experience let's change a hit rank.
Address which regulates hit rank of P1's moves is 0407A08
General values are:

512 - High
217 - Mid
10F - Low

So, if you want Yoshimitsu to have all moves as Mid, you should make such code
_C0 Hit Rank, test1
_L 0xE0010004 0x004078B4 // if Yoshi
_L 0x20407A08 0x00000217 // hit rank is Mid

Alternatively, you can change only specific hit rank
_C0 Hit Rank, test2
_L 0xE0020004 0x004078B4 // if Yoshi
_L 0xE0010217 0x00407A08 // if hit rank is Mid
_L 0x20407A08 0x0000010F // then hit rank is Low
This code will change for Yoshimitsu all Mid moves to Low, but High moves will work as usual

If you want to change hit rank only for a specific move you should add "condition of a move"
We use 0407A18 to set a condition of an ordinal move number.
Don't confuse it with 0407A08. It's different addresses.
It's like a move identification which shows which move is going.
To get the value, open http://sadamitsu.ru/cwcheat/movefinder.htm and type the move description, for example "f+3".
Let's try to change rank for Yoshimitsu's f+3
You can see the move number for Yoshimitsu's f+3 is 01DE, so now we can make such code
_C0 Hit Rank, test3
_L 0xE0020004 0x004078B4 // if Yoshi
_L 0xE00101DE 0x00407A18 // if during f+3
_L 0x20407A08 0x00000217 // then hit rank is Mid
This code will change hit rank only for Yoshimitsu's f+3 but all the rest moves will work as usual

Modifying moves

To modify moves we use two groups of addresses.
Both groups show the same values, the difference is only in time.
The first group shows values during the whole move (from the first to the last frame).
The second group shows values only from the moment when you press button(s) to the moment when this move starts, it's very fast.
Addresses of the first group:
0407A18 - ordinal move number
0407964 - pointer to the current move
Addresses of the second group:
0407D1C - ordinal move number
0407D24 - pointer to move
The main address which regulates which move P1 performs is 0407D24.
Let's try to modify a Jin's move, for example forcing him to perform EWHF.
Type in the Movefinder "EWHF".
The move pointers of EWHF are 0870B274 / 087B6E74 (vs Paul and vs Alisa).
Let's make a simple code with it.
_C0 Modify move, test1
_L 0xE0010009 0x004078B4 // if Jin (number of Jin is 09)
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
Paste the code into Tekken 6, choose Jin vs Paul and test it.
You see Jin performs EWHF all the time. We cannot control him anymore and he even does not react on opponent's attacks.
To make it work properly we need to add "condition of a move" as a limiter, for example ordinal move number.
Since we use 0407D24 to perform the move, which is from the second group, let's use move number address from the second group too, it's 0407D1C
But Tekken 6 has got a feature, all the original move pointers have two variants, depending on who is your opponent.
It happens because P1 and P2 locate their move bases in two places.
Who has a bigger character's number that locates their move base in the first place, another - in the second place.
Paul has number 0 (very first), Alisa has number 29 (the last).
So if you choose your character vs Paul, it will have the first variant of pointers, if vs Alisa - the second variant.
To make codes work stable we should consider it.
Address which shows which variant of pointer P1 has is 04078E0.
If it's the first variant then the value is 086A8800, the second variant - 08754400.
We can use it for recognition.
Well, let's find the move which will be changed to EWHF, for example d/f+2.
Type in the Movefinder "d/f+2", this move will work like a trigger event.
The move number of d/f+2 for Jin is 24B, so the code will be
_C0 Modify move, test2
_L 0xE0050009 0x004078B4 // if Jin
_L 0xE004024B 0x00407D1C // if d/f+2 starts
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B6E74 // performs EWHF vs Alisa
Now this code works stable.
You can also make it using 0407A18 but since 0407A18 and 0407D24 are in different time groups EWHF will start only when d/f+2 will completely end.
To fix it we have to use an address which regulates when the following move must start during the current one, it's 0407D10.
And code will look like this
_C0 Modify move, test2a
_L 0xE0060009 0x004078B4 // if Jin
_L 0xE005024B 0x00407A18 // if during d/f+2
_L 0x20407D10 0x00000000 // then immediately
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B6E74 // performs EWHF vs Alisa
You can experiment with value for 0407D10 and set any delay what you want
d/f+2 hits an opponent on 15th frame (15 in dec = 0F in hex)
So if you change value for 0407D10 to 0F then d/f+2 will hit an opponent two times, as original d/f+2 and as EWHF
_C0 Modify move, test2b
_L 0xE0060009 0x004078B4 // if Jin
_L 0xE005024B 0x00407A18 // if during d/f+2
_L 0x20407D10 0x0000000F // then on 15th frame (in dec)
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x0870B274 // performs EWHF vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B6E74 // performs EWHF vs Alisa

And by the same way we can make a custom string
Let's take for example Jin's 3,1 now, the ordinal move number of "3,1" is 1E0.
We can continue it for example with WS+1,2 (so in result we will have 3,1,2)
To do it we need to add a condition of button press,
The 8bit address which shows what the button we press is 0407D3C.
1 - LP
2 - RP
4 - LK
8 - RK
We will do it with the RP button.
And also we need to limit the time when a user can press this button.
Address which shows the current frame of the current move is 0407940.
3,1 hits an opponent on the 14th frame (in hex)
But if we add such condition 0xE0XX0014 0x00407940 we will have a justframe input 3,1:2
To fix it we should use another option in a condition line
0xE0XX0014 0xZ0407940 - instead of Z use:

0 - if VVVV is equal to 0014
1 - if value is not equal to 0014
2 - if value is less than 0014
3 - if value is greater than 0014

A user must have time for pressing a button from the 1st to the 14th frame, so the condition line must be 0xE0XX0014 0x20407940
And in result the code will look like this
_C0 Modify move, test3
_L 0xE0080009 0x004078B4 // if Jin
_L 0xE00701E0 0x00407A18 // if during 3,1
_L 0xE0060014 0x20407940 // if this move is less 14 frames (in hex)
_L 0xE1050002 0x00407D3C // if press RP button
_L 0x20407D10 0x00000014 // then on 14th frame (in hex)
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x08708D54 // performs WS+1,2 vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B4954 // performs WS+1,2 vs Alisa

We can continue this string further but since we added 3,1,2 in a custom way we face a problem. Value on 0407A18 is 0000 now, we cannot use only this address to identify our move. We have to use other move features while P1 performs it, for example pointer on 0407964. Though move pointers are different vs Paul and vs Alisa, the last two digits are always the same. For example both pointers of WS+1,2 ends with 54 we can use it as 8bit condition for 0407964
Let's continue 3,1,2 with f+4
_C0 Modify move, test4
_L 0xE0090009 0x004078B4 // if Jin
_L 0xE0080000 0x00407A18 // if during a custom move
_L 0xE1080054 0x00407964 // if move pointer ends with "54"
_L 0xE0060016 0x20407940 // if this move is less 16 frames (in hex)
_L 0xE1050008 0x00407D3C // if press RK button
_L 0x20407D10 0x00000016 // then on 16th frame (in hex)
_L 0xE001086A 0x004078E2 // if first variant
_L 0x20407D24 0x087098AC // performs f+4 vs Paul
_L 0xE0010875 0x004078E2 // if second variant
_L 0x20407D24 0x087B54AC // performs f+4 vs Alisa

What is a pointer

A pointer is a special kind of value. In this case it does not write anything to memory directly.
The value becomes a "link" which leads to another memory area.
To understand what the area it leads we should subtract 08800000
For example there is an address 0407F98 which always shows value 08C07860.
It's a pointer to P1 area, because 08C07860 - 08800000 = 0407860
Let's try to change the hit rank using this pointer.
There are special code lines we must use for this:
_L 0x6AAAAAAA 0xVVVVVVVV
_L 0x000Y000T 0xSSSSSSSS
These lines must always be together. Never separate them! Especially when you pick a number for the middle of the first part of a Condition line.
AAAAAAA - is the address which has a pointer value (in our example it's 0407F98).
VVVVVVVV - is the value you want to be written in the result (in our example it's 217).
Y - represents the datatype of the value, where 0 indicates an 8-bit value, 1 indicates a 16-bit value, and 2 indicates a 32-bit value. Since our value 217 is a 3-digit value, we must use either a 16-bit or a 32-bit.
T - is the number of "steps" in this pointer (we have only one here) (and btw. ppsspp supports only one "step").
SSSSSSSS - is an offset, i.e. it's a distance from the link address (0407860) to the address which we want (0407A08), so 0407A08 - 0407860 = 1A8
Thus in result the code will look like this
_C0 Hit Rank, test4
_L 0x60407F98 0x00000217
_L 0x00020001 0x000001A8
This is absolutely the same to _L 0x20407A08 0x00000217.
In messages and posts we often describe pointer's steps like "0407F98=>1A8". Just to say it faster.
It means - take a value that you see at 0407F98 (for example 08C07860) and increase it by 1A8.

Structure of a move

You might already understand that values which we use for 0407964/68 and for 0407D24 are links too. They point to the structure of a move. If we recreate this structure somewhere in an empty area of the game we can use it as a custom move. In Tk6 one move takes 0x58 bytes, it's the same for all characters. There is an empty area in Tk6 starting from 0884000, so if you wanna build a custom move there then it must look like this:

_C0 Building custom move
_L 0x20884000 0x08B98190 // pointer to the name of the move (not in use in Tk6)
_L 0x20884004 0x08B98190 // pointer to the name of the animation (not in use in Tk6)
_L 0x20884008 0x08F51FC8 // pointer to animation (list of common animations)
_L 0x2088400C 0x00000842 // body state for opponent's attacks (842 means body stands, no block)
_L 0x20884010 0x00000217 // hit rank (217 means mid)
_L 0x20884014 0x08E41530 // pointer to recovery/strings
_L 0x20884018 0x00008001 // visual recovery (8001 means default stance)
_L 0x2088401C 0x00000000 // technical id (not necessary)
_L 0x20884020 0x08E413F8 // pointer to reactions/damage
_L 0x20884024 0x0000004A // length of move (74 frames in DEC)
_L 0x20884028 0x00000000 // midair state "from" (not necessary)
_L 0x2088402C 0x00000000 // midair state "to" (not necessary)
_L 0x20884030 0x00000000 // frame of ground fall (not necessary)
_L 0x20884034 0x00000000 // pointer to base hit/block sounds (not necessary)
_L 0x20884038 0x00000000 // pointer to audio/visual effects (not necessary)
_L 0x2088403C 0x00000000 // pointer to effects which work just before the move starts (not necessary)
_L 0x20884040 0x00000000 // pointer to effects which work just after the move ends (not necessary)
_L 0x20884044 0x08000000 // extra properties of body
_L 0x20884048 0x0000000D // attacking limb (list of all limbs)
_L 0x2088404C 0x00000023 // the frame of attack "from"
_L 0x20884050 0x00000024 // the frame of attack "to"
_L 0x20884054 0x00000000 // extra properties, like movement of body in the air, displacement of colliders (rare using).
(red values are important, you can't set zeros for them)

So, all these values together are one move. When i say "move" i also mean a stance, a throw, a reaction, a cutscene, etc. They all are moves. To apply this move you must increase the first address by 08800000 (0884000 + 08800000 = 09084000) and add conditions as before.
_C0 JIN u/f+1+2 custom move
_L 0xE0020009 0x004078B4 // if Jin
_L 0xE00102FC 0x00407D1C // if u/f+1+2
_L 0x20407D24 0x09084000 // custom move
For custom moves you don't have to get values vs Paul and vs Alisa but if you use "recovery/string" pointer or "reactions/damage" pointer from a character then you have to.

To get better understanding how moves are organized type in the Movefinder a move and click on result to see its structure