Tes2Mod:Quest hacking guide

Important Note Before Beginning
This document was created assuming you know the basics of hex editing and programming (not much), or, for the more technically minded. If you aren't one of these, you may not wish to read further. 

All field/attribute definitions are given with conventional C types, a platform-independent byte representation in parenthesis, and the field's name.  
Field names will always be defined with PascalCaseConvention, and the field's name should be considered similar to a #typedef.  Array field definitions will include the element count within square brackets, such as "Foo[10]" to indicate field Foo has ten elements.  Instances of a field, the values of a particular file or record, are noted in camelCaseConvention and are enclosed in the &lt;var&gt;&hellip;&lt;/var&gt; mark-up for "variable", such as " [7]".  Remember that arrays start with element 0. So  [6] would actually be the 7th element of the array  , which corresponds to field definition Foo, which was above defined to be 10 elements (valid indexes range 0-9).  

Byte sequences which are SPACE separated are in file-order, such as "76 A4" is equal to the two byte sequence "0xa476".  File-order notation is always expressed in hexadecimal.  

The marker "(confirmed)" indicates exhaustive testing and verification has been performed, and the marker "(unconfirmed)" indicates speculation or conjecture.  A "(confirmed)" mark indicates that all quest file have been looked at, including the CompUSA ones.  The absence of a marker does not necessarily imply speculation; sometimes documentation lags behind development considerably.  The marker "(observed)" is synonymous with the marker "(known)", and indicates that while no other values have been found in the intrinsic and CompUSA quests, it seems plausible there are other valid values which the Daggerfall Quest Subsystem can handle, but merely have not been applied in the released, official quests.

Quest Filename Format
Individual quests are composed of two different files found in the ARENA2 Daggerfall directory, the QRC and the QBN file. Each set of QRC/QBN files appear to contain only one quest, which may have different parts. The name of these files affects several aspects of the quest such as which guild the quest belongs to etc... This format is followed by all quests except for ones which begin with $, _, or S. The almost complete filename format of quest files can be found below.

; [Byte 0] 
: Represents which guild the quest belongs to. See Appendix B for a complete list of guild filenames.
; [Byte 1] 
: Always a '0' (0x30)
; [Byte 2] 
: The PC's status relative to guild. 

; [Byte 3] 
: The minimum reputation (in ASCII representation) with the quest giver required to receive the quest, or minimum player level for certain guilds.  Values can range from '0' (0x30) to '9' (0x39) although it is recommended that you not exceed '7' (0x37) for the majority of quests.  A value of '5' (0x35) would indicate the quest can only be received by characters with at least 50 reputation.  
; [Byte 4] 
: Usually '0' (0x30). If 'X' or 'Y' (0x58 or 0x59), the quest is unavailable with ChildGuard on.
; [Byte 5] 
: Method in which the quest is given to the PC. 

; [Bytes 6 and 7] 
: Any valid filename characters, usually a two-digit number.

The QRC Files
Each QRC files contains all the text data needed for that quest. The format of these files appears to be completely understood.  
The file contains variable amounts and variable lengths of data, but the file is nothing more than a Text Record Database; there are no other data elements.  
Since these files are simply text record databases, modification and enhancement have proved trivial.  
Because individual TextRecord structures support multiple TextSubrecord structures, a great variety of text can be associated with each type of message or log entry for the quest, which offers to the player considerably variety and diversity.  

To briefly summarize, the file opens with a TextRecordDatabaseHeader (at the file's start, Byte 0) which implies how many TextRecord structures the file contains.  Following this is a standard TextRecordHeaderList which indicates the TextRecordId and file position for each TextRecord within the file.  The remainder of the file is dedicated to the TextRecord structures.  

Well-Known TextRecordId Values
There are some well-known (and indeed appear to be Magic Numbers for the Daggerfall Engine) TextRecordId values.  The "get quest" button in the UI, for example, depends on the presence of a TextRecord with an ID# of 0x03e8.  While there are numerous OpCodes for displaying (and controlling the display) of any defined TextRecord, these appear to be "Magic Numbers"; they are required for proper function of the engine.  



These "well-known" values are not necessarily absolute.  The "Quest Log Entry" row, for example, is not absolute but merely "most often used"; any TextRecord can be recorded to the player's log via a set of OpCodes depending on various states and events (record an entry when the player meets a specific NPC, or when he acquires a specific item, etc.).  More research is necessary with the set of "Magic Numbers".  As it stands, the only values of which we are certain are the 0x03e8-0x03eb, 0x03ed-0x03ee, and 0x0415; the remainder seem to be defined on a quest-by-quest basis.

Text Variables
There are certain sequences of text which the Daggerfall Quest Subsystem will regard as "variables".  When a TextSubrecord is displayed, these "variables" are replaced by appropriate text.  In essence, they behave like mark-up (wiki, html, sprintf(), etc).  

;[% ] 
: Any string preceded with a '%' indicates some sort of variable is to be inserted there. '%pcf' indicates the characters full name, '%pcn' only the first name, etc... A much more complete listing of these can be found in Appendix A at the end of this document.
;[= _] 
;[== _] 
;[=== _] 
;[_ _]
;[__ _]
;[___ _]
;[____ _]
: Any string preceded by and followed with a '_' or '=' indicates some sort of location/item, probably a randomly generated one. This can be a house, dungeon, castle, fort, or some gold, a magic item, etc... 
: A list of all known underscore-prefixed text variables (and their associated hashes) can be found in the Text Variable Hashes article.
: The number of _'s and ='s preceding the string determines how the location type is to be displayed.  This is similar to "most specific" or "smallest size" through "most general" or "largest size".  There is some overlap, and one would be wise to study and experiment with the quest file sources to determine the effect on a variable-by-variable basis.  


That basically concludes the description of the QRC files, which appears to be very much complete and well understood. We still need, however, a better understanding of the %string variables, including a complete listing of them all (see Appendix A and Text Variable Hashes.

Using TextRecords
Since a TextRecord is a list of one or more TextSubrecord elements, and a   follows a well-known format, some pseudo-code for reading/manipulating TextSubrecord entries is possible.  
   
The above exemplifies one means of translating a TextRecord into an array of strings (one for each TextSubrecord).  Care should be taken when reading the file.  If your language of choice offers 7-bit ASCII mode, the EOL, EOP, and SEP characters might not be read correctly (they each have their 8 -bit set TRUE) while reading files in this mode.  If your language of choice offers utf-8 and unicode-16 "auto-detection", the file might not be read correctly at all since the unicode Byte-Order Mark (BOM), 0xfeff, is a valid sequence in a TextRecord.  It is suggested when/if creating an editor one reads the data as bytes, and translates into system-characters as per: 
  
public static String[] GetSubrecords( fileStream, length ) { 
    Byte[] bytes = fileStream.ReadBytes( length );
    Char[] chars = new Char[ length ];
    for ( System.Int32 i = 0; i   
This example will eliminate most languages' attempts at "translating" 8-bit bytes into 16-bit unicode chars, thus preserving our 7-bit ASCII chars (the TextSubrecord text) and the 8-bit SEP (0xff) char.  

Naturally getting a TextRecord is dependent on reading the TextRecordHeader entry from the file's TextRecordHeaderList.  The following code would prove functional: 
  
public struct TextRecordHeader { 
    UInt16 RecordId;
    UInt32 Offset;
}
public static String[] GetSubrecords( fileStream, length, textRecordHeader ) { 
    Int32 oldPosition = fileStream.Position;
    fileStream.Seek( textRecordHeader.Offset );
    Byte[] bytes = fileStream.ReadBytes( length );
    Char[] chars = new Char[ length ];
    for ( System.Int32 i = 0; i   
Of course the best solution would be to use a set of Regular Expressions.  And that concludes our section on reading/writing the TextRecord file elements.

The QBN Files
The QBN quest files are the heart and soul of the quest.  It is they which tell Daggerfall what kind of quest, quest rewards, location, monsters, items, etc... Unfortunately, discovering the complete format of the QBN file has proved difficult since this file is completely numeric Hex data.  The method involves hacking a byte, running Daggerfall to get the quest, and then seeing what, if anything, has changed; definitely a very slow method but significant progress has been made.  

QBN Header
Fortunately there is a regular format to these binary files.  Each contains a header preamble, and then a series of "sections".  Each section itself contains one or more records, and the format of these records is mostly understood.  

;[Bytes 0-1] unsigned short (UInt16) QuestId
: Reserved, set to 0.
;[Bytes 2-3] unsigned short (UInt16) FactionId
: Reserved, set to 0.
;[Bytes 4-5] unsigned short (UInt16) ResourceId
: Reserved, set to 0.
;[Bytes 6-14] unsigned char[9] (UInt8[9]) ResourceFilename
: Reserved, set to 0.
;[Byte 15] unsigned char (UInt8) HasDebugInfo
: Non-zero value indicates the presence Text Variable Section, at the end of the file (confirmed). Usually 0.
;[Bytes 16-35] unsigned short[10] (UInt16[10]) SectionRecordCount[10]
: This is a list of ten ushorts (20 bytes total length), each indicating the count of records contained in the corresponding section.  
: That is to say,  [4] indicates how many records are contained in the fifth Section (remember: 0 is the root ordinal in counting, not 1).  
: If  [ ] is 0x0000, then Section[ ] is empty (no entries), and the corresponding  [ ] can be safely ignored.  
: Valid value range for a  [ ] element is 0x0000-0x00fd, due to the way the various OpCodes interpret Section elements.  
;[Bytes 36-57] unsigned short[11] (UInt16[11]) SectionOffset[11]
: This is a list of 11 ushorts (22 bytes total length), indicating the offsets (from the start of the file) to each Section.  
: As with the SectionRecordCount list, this array is associative by index (the  [5] reports the offset to the sixth Section).  
: If  [ ] is 0, then  [ ] may be ignored.  
: Only 7 QBN files contain a valid offset for the 11th section ( [10]).  
;[Bytes 58-59] unsigned short (UInt16) Null2
: Always 0x0000 (confirmed).  

The indexes used in the above SectionOffset and SectionRecordCount arrays are always in the following order: 


Therefore,  [6] will report the count of records in the Timers Section, and  [3] will report the offset (from the start of the file) to the start of the Npcs Section.  

The file up to this point is always the same in structure. What follows depends on the  [ ] and  [ ] values, because each Section is of variable length and some may even be empty (not all quests have an Items Section, for example).

QBN Section Descriptions
Each Section's record size varies, but the list below reports the size (in bytes) for each Record of each Section.  

;Items Section
: 0x13 Bytes per Record
;Section 1
: 0x5e Bytes per Record
;Section 2
: 0x22 Bytes per Record
;NPCs Section
: 0x14 Bytes per Record
;Locations Section
: 0x18 Bytes per Record
;Section 5
: 0x10 Bytes per Record
;Timers Section
: 0x21 Bytes per Record
;Mobs Section
: 0x0e Bytes per Record
;OpCodes Section
: 0x57 Bytes per Record
;States Section
: 0x08 Bytes per Record
;Text Variables Section
: 0x1b Bytes per Record


Sections 1, 2, and 5 always have a   of 0 (confirmed). The 11th section, Text Variables Section, is contained in only 7 QBN files.  There is no associated   for the Text Variables Section (a standard "C-Style" array) and that Section is always the last Section in the file (by  ) and continues to the end of the file (EOF), terminated by the usual null string element.  


Items Section
The Items Section (starting at  [0]) describes each of the items specific to the quest (deliverable inventory items such as "drugs", or the infamous "finger", etc).  
There are  [0] records in this section, each 0x13 bytes long.  
Thus, the total length for the Items Section is ( 19 &times;  [0] ) bytes long.  

;[ [0] - 0x13 Bytes Long per record] 
:;[Byte 0-1] signed short (Int16) ItemIndex
:: This is the index number for the item.  Some OpCodes will add or remove items from the character's inventory, or "drop" them at certain locations.  
:: Valid value range is 0x0000-00fd (0 through 253).  (confirmed)
:;[Byte 2] unsigned byte (UInt8) Reward
:: This appears to be an enumeration, since the values below appear to be the only valid values.  
:: While this is related to the base type of reward (such as being paid   gold for successfully completing a quest), each item record must have a value even if it is not a reward, such as items the player must recover from a dungeon or deliver to another NPC.  
::
:;[Bytes 3-4] unsigned long (UInt16) ItemCategory
:: This value defines the gross category of the item, such as Plant Ingredients, or Drugs.    
:: Valid values are a valid Daggerfall Item Category number ( 0x0000-0x001c ) and 0xffff.  
:;[Bytes 5-6] unsigned short (UInt16) ItemCategoryIndex
:: Valid values are a valid Daggerfall Item Category Index number and 0xffff.  
:: This value specifies exactly which type of item within the above category, such as Aloe from the Plant Ingredients.  
:: There is no means to specify the material component for any items (if the item can be made from differing materials, such as Iron or Silver). The material of manufacture is determined randomly by the character's level.  
:: If   is 0xffff and   is 0x0000, then this is interpreted as "No Reward", such as the various "Kill the rats" Fighters' Guild quests.  
:: If   is 0xffff and   is 0xffff, then this is interpreted as a random reward.  In this mode the   field determines the type of item.  
::;  is 0x02
::: A positive random amount of gold.  
::;  is 0x01
::: A single item, selected at random.  
::;  is 0x00
::: A single artifact, selected at random.  
:;[Bytes 7-10] unsigned long (UInt32) TextVariableHash 
:: This is the hash value of the variable used in the QRC section.  
:: If the variable "_reward_" should refer to this item, one would supply the value of 0x00001b14.  
:: See the list of list of Text Variable Hashes for the list of known predefined variable hash values.  
:;[Bytes 11-14] unsigned long (UInt32) Null
:: Always 0x00000000.  
:;[Bytes 15-16] unsigned short (UInt16) TextRecordId1
:: A valid   from the associated quest's QRC file, or 0x0000.  
:: If 0x0000, then there is no TextRecord directly associated with this item (although it may still be referenced by the various "display text" OpCodes).  
:: If a valid  , this message is displayed when the item is received.  
:;[Bytes 17-18] unsigned short (UInt16) TextRecordId2
:: A valid   from the associated quest's QRC file, or 0x0000.  
:: If 0x0000, then there is no TextRecord directly associated with this item (although it may still be referenced by the various "display text" OpCodes).  
:: If a valid  , this message is displayed when the item is "used" or "examined" from within the character's inventory screen.  This is commonly used for letters, but could be used for anything (such as adding quest-flavour text to mundane quest items).

NPCs Section
This Section describes all the NPCs (flats) required by the quest, such as those met in Dungeons or Taverns or Temples and so-forth.  
Each of the  [5] elements is 0x14 bytes long.  

; [ [3] - 0x14 Bytes per record] 
:;[Bytes 0-1] signed short (Int16) NpcIndexNumber (confirmed)
:: This index number uniquely identifies the NPC within the quest.
:: OpCodes which refer to an NPC will specify which NPC by  , just as items are identified/accessed/associated by their index number.
:: Valid value range is 0x0000-00fd (0 through 253).  (confirmed)
:;[Byte 2] unsigned char (UInt8) Gender
:: Valid values may be 0x00ff, 0x01, 0x00, or 0x8c.
:: If 0xff, the   of the NPC will be randomly determined.  (confirmed)
:: If 0x01, the   of the NPC will be Female.  (confirmed)
:: If 0x00, the   of the NPC will be Male.  (confirmed)
:: Value 0x008c only appears in quest C0B10Y07, and is not understood.  (unknown)
:;[Byte 3] unsigned char (UInt8) FacePictureIndex
:: This is the index number for the image of the NPC's face in dialog/escort.  
:: It is not completely understood from where the image will be retrieved (FACES.CIF, or TFAC00I0.RCI, or some other source).  
:: It is also not known if the data specified in FLATS.CFG and FACTION.TXT have an effect.  
:;[Bytes 4-5] unsigned short (UInt16) Unknown1
:: Some purposes of this field are unknown, but observed values are indicative of an enumeration.  
::;Observed values
:::;0x0000, 0x0003, 0x0009, 0x000a-0x000c, 0x000e-0x0012, 0x0014, 0x0015, 0xfff8-0xfffd, 0xffff
:::: (unknown)
:::;0xfffe
:::: The Npc is a Daedra Prince, specified by the FactionIndex field.  
:;[Bytes 6-7] unsigned short (UInt16) FactionIndex (confirmed)
:: A valid faction number (see FACTION.TXT) or 0x0000.  
:: A value of 0x0000 implies this NPC is not affiliated with any particular faction.
:: A valid faction number indicates to which faction this NPC is loyal.
:: Also corresponds to values found in the SAVEVARS.DAT in each save game directory.  
:: If   is 0xfffe, then   determines which Daedra Prince.  (confirmed)
::;  is 0xfffe and   is 0x0000
::: The Npc is a random Prince.  
::;  is 0xfffe and   is a valid Daedra faction number
::: The Npc is the Daedra specified by  
:;[Bytes 8-11] unsigned long (UInt32) TextVariableHash (confirmed)
:: This is the hash of the text variable to whom this NPC refers.  
:: Ex: If this NPC should be associated with the variable "_patsy_", then one would specify 0x00000d37
:: See the list of list of Text Variable Hashes for the list of known predefined variable hash values.  
:;[Bytes 12-15] unsigned long (UInt32) Null
:: Always 0x00000000 (confirmed).
:;[Bytes 16-17] unsigned short (UInt16) TextRecordId1 (confirmed)
:: A valid   from the quest's QRC file, or 0x0000.
:: If a valid  , this Npc will have an entry in the "Tell Me About" conversation topic list.
:;[Bytes 18-19] unsigned short (UInt16) TextRecordId2 (confirmed)
:: A valid   from the quest's QRC file, or 0x0000.
:: If a valid  , this Npc will have an entry in the "Tell Me About" conversation topic list.

Locations Section
This Section describes all the locations which are required for the quest.  
This includes everything from Taverns and Houses inside towns (same or different), to Dungeons and Shrines and Covens.  

;[ [4] - 0x18 Bytes per record]
:;[Bytes 0-1] unsigned short (UInt16) LocationIndex (confirmed)
:: This is the index number of the location, by which other sections of the file will refer to this Location.  
:: Valid value range is 0x00-fd (0 through 253).  (confirmed)
:;[Byte 2] unsigned char (UInt8) Flags
:: Reserved, set to 0.
:;[Byte 3] unsigned char (UInt8) GeneralLocation 
:: This field specifies the overland map locale for the Location record.  
:: Valid (observed) values are from 0x00 through 0x02.  
:: If 0x02, this location is outside of the current town (a Dungeon, or another Town).
:: If 0x01, this location is inside the current town (such as found in the "Kill the monster in the house" quest).  
:: If the value is 0x00, then this location is a specific (not pseudo-random) Location (the storyline quests follow this pattern).  
:;[Bytes 4-5] unsigned short (UInt16) FineLocation
:: This field is related to the previous, where this determines the Location within the town map.  
:: If the value is 0x0000, then the location is a building within a town.
:: If the value is 0x0001, then the location is a Dungeon.
:: If the GeneralLocation is 0, this is the higher 16 bits of the location's ObjectID.
:: Only the storyline quests have values within the range 0xc3-ff.  (confirmed)
:;[Bytes 6-7] short (Int16) LocationType
:: Building or dungeon type (-1 means random).
:: If the GeneralLocation is 0, this is the lower 16 bits of the location's ObjectID.
:;[Bytes 8-9] short (Int16) DoorSelector
:: If the value is -1, use any suitable location.
:: If the value is 0, consider only the doors having a 0x4000 flag set.
:: If the value is 1, consider only the doors having a 0x1000 flag set.
:;[Bytes 10-11] unsigned short (UInt16) Unknown2
:: An unknown value. 
:;[Bytes 12-15] (long) TextVariableHash (confirmed)
:: This is the hash of the text variable with which this location should be associated.  
:: Ex: If one wanted to associate the text variable "_mondun_" with this location, one would specify 0x00001ae8 for this value.  
:: See the Text Variable Hashes article for the known values.  
:;[Bytes 16-19] unsigned long (UInt32) ObjPtr
:: Reserved, set to 0.
:;[Bytes 20-21] unsigned short (UInt16) TextRecordId1 (confirmed)
:: A valid   or 0x0000.  
:: If a valid   this location will be available in the "Tell Me About" conversation dialog.  (confirmed)
:;[Bytes 22-23] unsigned short (UInt16) TextRecordId2 (confirmed)
:: A valid   or 0x0000.  
:: If a valid  , then this location will be available in the "Tell Me About" conversation dialog.  (confirmed)

Timers Section
This Section deals with all the timers, intervals, and durations in the quest (such as "you have 22 days to return with the item").  This Section is also the least understood.  

; [ [6] - 33 Bytes per record] 
:;[Bytes 0-1] signed short (Int16) TimerIndex
:: This is the index number by which other sections (particularly the OpCodes) may access the timer (starting/stopping it).  
:: Valid value range is 0x0000-00fd (0 through 253).  (confirmed)
:;[Bytes 2-3] unsigned short (UInt16) Flags
:: Various flags controlling the timer arguments and its current state.
:;[Byte 4] unsigned char (UInt8) Type
:: Type of the timer. Possible values:

:;[Bytes 5-8] signed long (Int32) Minimum
:: Minimum time value in game minutes.  
:;[Bytes 9-12] signed long (Int32) Maximum
:: Maximum time limit as above (or 0).  
:;[Bytes 13-16] unsigned long (UInt32) Started
:: Reserved. Set to 0.
:;[Bytes 17-20] unsigned long (UInt32) Duration
:: Reserved. Set to 0.
:;[Bytes 21-24] (long) (Int32) Link1 
:: The 1st NPC or a location Id associated with this timer
:;[Bytes 25-28] (long) (Int32) Link2 
:: The 2nd NPC or a location associated with this timer
:;[Bytes 29-32] unsigned long (UInt32) TextVariableHash 
:: The name of the state this timer controls.
:: Ex: To associate the state "traveltime" with this timer, one would specify a value of 0x0001c1e3 for this field.  
:: See the Text Variable Hash article for full list of Text Variables and their associated hashes.  

A great deal of research is still required to accurately use this Section when authoring quests, but this is the last remaining section of any great mystery.

Mobs Section
This section defines all the quest-specific mobs found in the quest.  First, a "mob" is a "mobile", which comes from the MUD community, which basically means any of the computer controlled monsters.  Secondarily, this doesn't impact the random monsters found in a dungeon (that is determined by the player's level); it only relates to quest-specific mobs (such as "assassinate the knight" or "kill the rats" quests).  

;[ [7] - 0x0e Bytes per record] 
:;[Byte 0] unsigned char (UInt8) MobIndex (confirmed)
:: The value of this index is how other sections will refer to the mobile defined by this record, analogous to ItemIndex or NpcIndex.  
:: Valid value range is 0x00-fd (0 through 253).  (confirmed)
:;[Bytes 1-2] unsigned short (UInt16) Null1
:: Always 0x0000 (confirmed)
:;[Byte 3] unsigned char (UInt8) MobType (confirmed)
:: This value specifies the type of mob (such as a rat or a monk).  
:: Valid values are 0x00-0x28, 0x80-0x8d, which are Daggerfall Mobile Type values.  
:;[Bytes 4-5] unsigned short (UInt16) MobCount (confirmed)
:: The count of mobiles defined for this index.  
:: Valid value range is 0x01-06.  
:;[Bytes 6-9] unsigned long (UInt32) TextVariableHash (confirmed)
:: This is the hash of the text variable with which this location should be associated. 
:: Ex: If one wanted to associate the text variable "_knight_" with this Mob record, one would specify 0x00001a68 for this value. 
:: See the Text Variable Hashes article for the known values. 
:;[Bytes 10-13] unsigned long (UInt32) Null2
:: Always 0x00000000 (confirmed)

OpCodes Section
This Section actually defines a set of OpCodes which the Daggerfall Quest Subsystem executes in a manner very similar to a Virtual Machine.  While this is not as advanced as the Java Virtual Machine, or the .Net Runtime Engine, it has proved to be quite extensible and fairly complete for all quest needs.  In simplest terms, it would seem the Daggerfall Quest Subsystem creates an array of function pointers "under the hood", and use the OpCode as the index of the function to execute, passing a pointer to the record (each 0x57 bytes long) as an argument.  There are several dozen understood OpCodes, all of which are used by at least one quest within the game's intrinsic quests or CompUSA quests.  

; [ [8] - 0x57 Bytes per record] 
: See the special section for complete documentation on this Section.  As the "brain" of the quest, it tells the game things like what Mobs to add, when to add log entries, so-on and so-forth.

States Section
State records describe state/flag variables used by the Daggerfall Quest Subsystem for tracking events throughout the quest.  For example, slaying a Mob might trigger one state variable to be set TRUE, or meeting an NPC might reset another state variable to FALSE.  Some OpCodes even offer rather complex if/else decision branching based on one or more state variable values.  Many of the Dark Brotherhood and Vampire quests, for example, make use of around 20 different state variables to offer some of the richest and complex quests.  

This entire Section has been confirmed.  

;[ [9] - 0x08 Bytes per record] 
:;[Bytes 0-1] signed short (Int16) FlagIndex
:: This is the index number of the quest's state variable, and it is by this index number the OpCodes section may refer to a state.  
:: Valid value range is 0x0000-00fd (0 through 253).  (confirmed)
:;[Byte 2] unsigned byte (UInt8) IsGlobal
:: This value indicates if this quest variable is accessible outside the current quest scope (from another quest).  
:: This value may be treated as a boolean (0 would be FALSE, and any other value TRUE).  
:: This is usually 0 except for storyline quests, where such permanency of state is necessary to offer a continuous story.  
:;[Byte 3] unsigned byte (UInt8) GlobalIndex
:: If   is TRUE, this value is the index of the Global state variable to which this quest state variable should be linked.  
:;[Bytes 4-7] unsigned long (UInt32) TextVariableHash
:: This is the hash of the text variable with which this state should be associated.  
:: Ex: If this NPC should be associated with the variable "_oneday_", then one would specify 0x00001ab3 for this field.  
:: See the list of list of Text Variable Hashes for the list of known predefined variable hash values.

Text Variables Section
This (optional) Section is only included in 7 files: 80C00Y00.QBN, A0C00Y04.QBN, A0C00Y06.QBN, N0C00Y01.QBN, O0B10Y00.QBN, P0B1XL08.QBN, and R0C40Y23.QBN.  
This Section is a list of several variable names. Since these define TextVariable objects, valid character range is 0x30-39 and 0x61-7a (TextVariables are always lower-case).  
If present, this Section always exists at the end of the QBN file and continues through to the file's end (EOF).  
A variable name beginning with the null-terminator token indicates no more strings follow.  

;[ [10] - 0x1b Bytes per record]
:;[Bytes 0-19] 7-bit ASCII string TextVariable
:: This is a standard "C-style" string, where the string is represented as a character array (char[ 20 ]).  The end of the string is identified by the null-termination token (0x00).  
:;[Byte 20] unsigned char (UInt8) SectionId
:;[Bytes 21-22] unsigned short (UInt16) RecordId
:: The record which is labeled with this variable.
:;[Bytes 23-26] unsigned int (UInt32) RecordPtr
:: Reserved; set to 0.
: When a QBN file has a Text Variable Section, the table contains all TextVariables whose hash values are used in file's other Section records.  
: See the Text Variable Hashes article for the algorithm to compute a TextVariableHash from a TextVariable.

Credits
I could not have done all this without much help from the many other Daggerfall addicts out there (list is in no particular order).
; Peggy Hanks - [mailto:df4@juno.com df4@juno.com] : For donating much new information for the quest file formats.
; Lord Phoenix - [mailto:gozer@esoterica.pt gozer@esoterica.pt] : For donating information on the files formats as well.
; Michael Schneider - [mailto:michael@cybermagician.com michael@cybermagician.com] : Maintains a Quest Hacking guide on Daggerweb and has also created a quest editor for Windows, and of course has provided much new information.
; Glen Wright - [mailto:glen@skatter.usask.ca glen@skatter.usask.ca] : Provided some more very useful information on the structure of the QBN files. 
; Skeleton Man : Has the most experience in actually editing and creating quests.
; Thomas Hautesserres - [mailto:hautesse@cert.fr hautesse@cert.fr] : Author of the fabulous WinQEdit which has helped deciphering QBN format a great deal.
If I've forgotten anyone I can assure you it's not on purpose. Just e-mail me and we'll clear things up in a jiffy (anyone know how long that is perchance?).  
If you'd like to help out in some way, feel free to make it known to me as I'm sure I could find something you could do. Just e-mail me at [mailto:aj589@freenet.carleton.ca aj589@freenet.carleton.ca]. I'll take suggestions for the quest editor, comments on this document, and of course any data on the quest formats.
Quest Related Programs
Many useful files can be found in the Daggerfall Files article.  At the moment there are only two Daggerfall quest editors, but they are all you really need.
; WINQEdit 
: A great QBN editor for windows. Requires knowledge of hex-editing and the quest format. Can be downloaded  .
; DMPQuest 
: A great QRC editor for windows. Easy to use since it does not require any hex-editing. Can be downloaded  .

Appendixes
Appendix A
Listing of %string Variables==

{| style="margin-left:25px; margin-top:-5px;"
! Variable !! Description !!   !! Variable !! Description !!   !! Variable !! Description
|-
| %1am || 1st + Magnitude ||   || %fx2 || Another faction in news ||   || %olf || What happened to %ol1
|-
| %1bm || 1st base Magnitude ||   || %g || He/She etc... ||   || %oth || An oath (listed in TEXT.RSC)
|-
| %1com || Greeting (?) ||   || %g1 || He/She ??? ||   || %pcf || Character's first name
|-
| %1hn || ? ||   || %g2 || Him/Her etc... ||   || %pcn || Character's full name
|-
| %2am || 2nd + Magnitude ||   || %g2self || Himself/Herself etc... ||   || %pct || Character's title in guild
|-
| %2bm || 2nd Base Magnitude ||   || %g3 || His/Hers/Theirs etc... ||   || %pdg || Days in jail
|-
| %2com || ? ||   || %gii || Amount of gold in hand ||   || %pen || Prison sentence
|-
| %2hn || ? ||   || %god || Some god (listed in TEXT.RSC) ||   || %per || Amount of Personality
|-
| %3hn || ? ||   || %gtp || Fine ||   || %plq || Place of something in log.
|-
| %a || Cost of something. ||   || %hea || HP Modifier ||   || %pnq || Person of something in log
|-
| %ach || + Chance per ||   || %hmd || Healing rate modifier ||   || %pqn || Potential Quest Giver
|-
| %adr || + Duration per ||   || %hnr || Your title? ||   || %pqp || Potential Quest Giver's Location
|-
| %agi || Amount of Agility ||   || %hnt || Direction of location. ||   || %ptm || An enemy of the current region (?)
|-
| %ark || Considered for stat ||   || %hol || Holiday ||   || %q1 to %q5 || Effects of questions answered in bio.
|-
| %arm || Armor ||   || %hrg || ? ||   || %qdt || Quest date in log
|-
| %ba || Book Author ||   || %hs || Holding Soul type ||   || %qot || The log comment
|-
| %bch || Base chance ||   || %htwn || ? ||   || %qua || Condition
|-
| %bdr || Base Duration ||   || %int || Amount of Intelligence ||   || %r1 || Commoners rep
|-
| %bt || Book title ||   || %it || Item ||   || %r2 || Merchants rep
|-
| %clc || Per level (Chance) ||   || %jok || A joke ||   || %r3 || Scholars rep
|-
| %cld || Per level (Duration) ||   || %key || A location (?) ||   || %r4 || Nobilities rep
|-
| %clm || Per level (Magnitude) ||   || %key2 || Another location ||   || %r5 || Underworld rep
|-
| %cn || Current City ||   || %kg || Weight of items ||   || %ra || Player's race
|-
| %cpn || Current shop name ||   || %kno || Appears to be a guild name  ||   || %reg || Region
|-
| %cri || Accused crime ||   || %lev || Rank in guild that you are in. ||   || %rn || Regent's Name
|-
| %crn || Current Region ||   || %ln || Random lastname ||   || %rt || Regent's Title
|-
| %dae || A daedra ||   || %loc || Location marked on map {||   || %spc || Current Spell Points};
|-
| %dam || Damage modifier ||   || %lt1 || Title of %fl1 ||   || %scn || Total Spell Points
|-
| %dat || Date ||   || %ltn || In the eyes of the law you are....... ||   || %ski || Skill
|-
| %di || Direction ||   || %luc || Luck ||   || %spd || Speed
|-
| %dip || ? ||   || %mad || Resistance ||   || %str || Amount of strength
|-
| %dng || Dungeon ||   || %map || A location on the main map {||   || %t || Regent's Title};
|-
| %dts || Daedra ||   || %mat || Material ||   || %tcn || Travel to city
|-
| %enc || Encumbrance ||   || %mit || Item ||   || %thd || Combat odds
|-
| %end || Amount of Endurance ||   || %mn || Random First(?) name (Male?) ||   || %tim || Time
|-
| %fcn || Another city ||   || %mn2 || Same as %mn (?) ||   || %vam || Vampire Name
|-
| %fl1 || Lord of %fx1 ||   || %mod || Modification ||   || %vcn || Vampire's Clan
|-
| %fl2 || Lord of %fx2 ||   || %mpw || Magic powers ||   || %wdm || Weapon damage
|-
| %fn || Random first(?) name (Female?) ||   || %n || A random person/Person you are talking to. ||   || %wep || Weapon
|-
| %fn2 || Same as %mn2 (?) ||   || %nam || Came up empty for me ||   || %wil || Amount of Willpower
|-
| %fon || Name of Knightly Order/Guild/Temple (?) ||   || %nrn || Noble of the current region ||   || %wpn || Poison (?)
|-
| %fx1 || A faction in news ||   || %ol1 || Old lord of %fx1 ||   || %wth || Worth
|}
Many thanks to James Dean ([mailto:james@rygannon.force9.co.uk james@rygannon.force9.co.uk]) for donating many of the string variables and descriptions.

Appendix B
Listing of Guild Quest Filenames

Below is a complete list of all types of quest file names contributed by several people. The character under the Filename heading represents the first character of a QRC or QBN file.