Picking apart Skyrim's pickpocketing

I was recently the willful accomplice victim of a successful plot to pull me back into Skyrim. I put hundreds of hours ¹ I'd argue that my Steam playtime is inflated by leaving it open on my laptop, but not sure that would hold up in court. Still, I've probably spent a month in worse ways. Wait, a month? into the game back in high school ² Okay, and a little bit in college too. And maybe a little bit after graduation when playing around with the VR mods. And obviously now. Don't worry about it. but had mostly escaped — until my friend ³ So-called. Who would do this to someone they call a friend. texted me when I was sick.

Really funny Wikipedia read for Heraclitus. Personal highlights are "The main source for the life of Heraclitus is the doxographer Diogenes Laërtius. Although most of the information provided by Laertius is unreliable...", "[Heraclitus] praised a man named Hermodorus as the best among the Ephesians, who he says should all kill themselves for exiling him", and the countless references to how obscured his writing style was (to which he would have said "skill issue").

Different river too ⁴

I am unfortunately but a man, and within the day I was engulfed back into the world of Tamriel as an Argonian. ⁵ Lizard guy. Breathes underwater. Bad at wearing clothes (seen here wearing a patchwork of stolen clothing from the Thief and Assassin guilds) — Derek would tear him apart. While I'd fortunately forgotten enough of the plotlines and dungeon layouts to once again be amused by Dwemer and Nordic ruins ⁶ This faded after the third identical dungeon killing interchangeable hordes of Falmer and Draugr respectively. what I unfortunately did remember, deep in my subconscious, was how to speed level.

Making games boring

"Many players cannot help approaching a game as an optimization puzzle. What gives the most reward for the least risk? What strategy provides the highest chance—or even a guaranteed chance—of success? Given the opportunity, players will optimize the fun out of a game."
- Soren Johnson, 2011

Sure, you could crouch and attack people from the shadows with your bow or your daggers, and slowly level up your sneak as you progress through the main quests. Orrrr you could hit the tutorial guy in the back for 10 minutes and hit level 100 before you leave the first cave. There's a lot of downsides to this (most enemies scale to your level, so you'll get one-hit killed by a lot of marauding bandits) but can you really resist? ⁷ From the same article, talking about Morrowind, a prequel to Skyrim: "...[P]layers will trade time for safety, but they risk undervaluing their own time to the point that they are undermining their own enjoyment of the game. A classic example is the skill system from Morrowind, which rewards players for repeating any activity. Running into a wall for hours increases the Athletics skill while jumping over and over again increases the Acrobatics skill. Many players couldn’t stop themselves from spending hours doing mindless activities for these cheap rewards." Oh look, it's me!

While I tried to hold myself back, a disturbing amount was muscle memory, ⁸ Why do I need to remember how to out-of-bounds skip to get under the Whiterun forge? And what have I lost to keep that? and there are admittedly some benefits that are hard to give up—given that I hoard gear in these games like I'll be charged for using consumables, the "Extra Pockets" perk ⁹ Sidenote, I really love the constellation UI in this game (even if the stars look nothing like the hand that's drawn around them). in the Pickpocketing skill tree that gives 100 extra carrying capacity is a godsend.

If we're gonna abuse some game mechanics to get to level 50 in pickpocketing quickly, what's the best approach?

Abusing game mechanics and discovering a bug

There are a lot of ways to do this. One character in a jail can be repeatedly pickpocketed with no consequences. Another approach is to pay someone to teach you to pickpocket, paralyze them, and pickpocket the money back with no skill check. But a more universal approach (and the only one I remembered how to do) is to put gold in someone's pocket and then steal it back, allowing you to control the value of what you steal. ¹⁰ Your experience gain is directly based on this value. How directly? We'll get to it, stop being impatient! The success of any pickpocket action is capped at 90% though, so this approach benefits from "save-scumming" (quicksaving before pickpocketing, and quickreloading if it fails). ¹¹ This is a classic example of needing to protect players from themselves. It's fast so of course people do it, but if you had to sit through the load screens to do it in a real save no one would bother. Alas, another sacrifice of fun at the altar of efficiency.

When doing this I kept noticing that the probability to place the gold on someone and the probability to steal it back from them in the UI is the same...but while I often got caught stealing it I almost never got caught placing it. What's up with that?

37% to place, but it almost always succeeds... ...and 37% to steal, which feels more accurate

This felt like a bug. I checked the wiki page on Pickpocketing but while it provided a full formula for pickpocket success rate (helpfully replete with no sources at all) it didn't mention this.

Good that it has no sources, because the formula is also wrong

In the old days ¹² A year ago. I really hope this is a sigmoid. I would boot up a disassembler like Ghidra and start decompiling the TESV.exe file. Nowadays I can just throw Astra at it with a usage reset and call it a day. ¹³ This is certainly less interesting (and the topic of Bryce Bostwick's recent video "This Filename Breaks iOS, And That's Boring Now", the guy who restarted my interest in reverse engineering). It's a very unstable time, both for the industry and for hobby programming, and while I have a lot of thoughts I'll save them for another post. Let's at least make it followable.

How pickpocketing chances are calculated

My TESV.exe game file is version 1.9.32.0. ¹⁴ SHA-256 69362F77BC56BF17570A33106D020B6C67FD8F32A294B82F8B687B9CF71EFC72 if you're trying to replicate this for other versions. And there's a lot of versions. Ï ¹⁵ I'm using Ï to denote the 'royal we' of me plus an agent. It's not just me doing it (how involved can you really be spamming Enter for "yeah, run that incredibly convoluted Python command, that seems safe" and occasionally saying "that seems irrelevant, refocus on X") but it's also not just the AI. Mostly though it reads clunkily to name a specific AI, especially when I'm using multiple. This is a test run of me taking inspiration from bastardizing The New Yorker's style guide — we'll see if it sticks. used Steamless to unpack the game file for analysis with Ghidra. At 0x00598DB0 we can find the function that gives the chance of pickpocket success:

Some have said the formula is unknown for how much can be successfully pickpocketed:

Specifically for gold there is an unknown formula for maximum gold value that can be pick-pocketed based on the level of the character's Pickpocket skill and which perks they have. This can result in situations where even a small change in gold value can result in huge swings in percentage chance of success. ¹⁶ *EXTREMELY LOUD INCORRECT BUZZER NOISE* - @SPYBUG96 on StackExchange

Let's make it known.

Base formula

There's a lot of constants, which are configured both in the code and by the Skyrim.esm game file (with the latter taking precedence). Here are the relevant ones for this function.

The 1 multipliers and 0 bases drop out, leaving the function a little simpler (-25 if you're detected).

$$ P_{base} = 40 + L_{player} - \frac{L_{target}}{4} - \frac{Value}{10} - 4 * Weight \color{#888} - 25 $$

Player level and target level

The player level, or \(L_{player}\), is straightforward: it's just what your pickpocket level is. The target's pickpocket level, or \(L_{target}\), is a bit more complicated. It can be a fixed score or a derived score based on the class, race, and level of the NPC ¹⁷ Non-Player Character, in contrast to the Player Character (PC) that you control. The term dates back to Dungeons & Dragons, though it's been recently picked up by Gen Z. (with the level either fixed or scaled based on the PC's current level). I originally explained the derivation in this post but it quickly spiraled in complexity, so I'm saving it for a followup post of its own.

Value

A function at 0x00476900 calculates the eligible value, and it takes in four params: the target, the inventory stack, the count, and a boolean flag for includeUnowned.

For our purposes the function is called in two places: 0x00849C20 that handles the UI, and 0x00746A20 that handles actually placing or pickpocketing an item. Both callsites correctly pass in the target and stack, but they differ in count and includeUnowned.

Count

The UI calculates the chance for one item in a stack, whereas when you actually pickpocket it uses however many of the item you're stealing or placing. The exception is if the stack is weightless (gold, arrows, or lockpicks ¹⁸ There are other weightless items (keys, notes, letters, and certain quest items) but they're all valueless, so we're ignoring them. ), in which case the UI passes in the full count for the stack.

That's why the UI thinks that placing lots of gold is impossible, but a stack of valuable items with weights of 0.4 is fine:

4200 gold, with a 0% chance to place \(350 * 12 = 4200\) total value, but a 90% chance to place just one

includeUnowned

includeUnowned is more complicated. If it's false, then the value is the sum of the items owned by the target. If it's true, then it's the sum of the items owned by the target or without an owner (hence "include unowned"). But how does ownership work in this context? Answer: really nonintuitively!

Gold has no ownership. ¹⁹ No serial numbers on a septim: maybe Bruno Hauptmann would have gotten away with his kidnapping in Skyrim. Items that you buy, or come across normally, or are even in an NPC inventory also have no ownership tags. Instead ownership is only set ²⁰ Citation needed. This is what Ï found, but I could be wrong. when you move an item between inventories. If you place an item on someone, it's tagged with your Base ID. ²¹ Base ID is the unique reference to something (like "Bandit"), whereas Ref ID is an individual instance (this "Bandit" at the camp next to you that you're about to rob blind), at least according to this StackExchange answer. Likewise if you steal an item from someone, it's tagged with their Base ID. Oddly the "owned by target" check for value uses the Ref ID, so stealing an item, placing it back on the victim, and trying to steal it again will be "owned", but not by the target, so its value is 0.

Originally unowned, so the value counts as negative (\(\frac{110}{10} = -11\) points) When placing it back it now has a non-target owner tag, so the value doesn't count It still has a non-target owner tag, so there's no value difficulty for restealing

When you pickpocket someone, includeUnowned is set to true. However when you place something it's set to false. Regardless of which you're doing though, the UI always passes the flag as true. ²² It's the 0x1 value at 0x00849D24. Even though it's the last argument, it's pushed to the stack first because x86 args are pushed on right-to-left.

This explains the bug I was looking into! Let's take this clothing item that I bought. It's originally unowned, ²³ Despite buying it. Like I said, ownership is nonintuitive. so when the UI passes includeUnowned it thinks the value counts, and says it'll fail. The real placement treats it as having a value of 0 and will succeed 90% of the time. After I place it the ownership is set to me, so the UI and pickpocketing chances now agree that it's "Owned by Other" and the value is 0, making it easy to pickpocket back.

Despite 0% odds in the UI, placing succeeds 90% of the time Now the odds in the UI are 90%, matching the real pickpocket rate

Okay, bug identified. What's left for the formula for maximum pickpocketable gold?

Weight

The UI calculation only uses the weight of one item in the stack, where the actual pickpocket call scales it by the number of items (though this is irrelevant for gold because it has no weight).

Equipment, and potions, and perks (oh my!)

All of the above is enough to calculate the base rate, but it's still modified by the titular equipment, potions, and perks. ²⁴ Will I ever get sick of this format? Survey says no! Equipment is relatively straightforward, with the ability to enchant necklaces, gloves, rings, and boots with Fortify Pickpocket (ranging from 15% up to 40% per item). ²⁵ 15% for an item of Minor Deft Hands, and 40% for an item of Peerless Deft Hands (or something like the Blackguard's Boots). This can get a lot higher if you're enchanting your own gear and/or taking advantage of one of the most broken Skyrim glitches — the Fortify Restoration loop.

900 gold for a measly 15%, what has the world come to?

Potions are similar, providing a 60-second boost to pickpocketing, ranging from a potion up through an elixir. ²⁶ The tier rankings go potion, draught, philter, elixir. Get some tinctures or serums in here!

Nothing like nordic barnacles and slaughterfish eggs to get your fingers light! (This is using the Fortify Restoration loop glitch).

A potion gives 20% Whereas an elixir gives 50% Or, making one yourself can take you a lot farther ²⁷

Both of these apply in the same way, by multiplying based on the percentage:

$$ = Base \cdot (1 + \frac{\sum Equipment}{100}) \cdot (1 + \frac{Potion}{100}) $$

As an example if you have a ring of 15% and boots of 40%, and take a draught of 30% pickpocketing then you would multiply your base by \((1 + \frac{15 + 40}{100}) \cdot (1 + \frac{30}{100}) = 1.55 \cdot 1.3 = 2.015\). This is where some of the weird behavior that people have flagged around how Fortify Pickpocket works comes into play:

"Fortify Pickpocket works differently on different items and their chance to be successfully pickpocketed. Chances of stealing gold goes up, while items with weight (such as a weapon or animal pelt) go way down." (UESP)

"Fortify Pickpocket enchants and potions have the reverse effect and lower your chances of a successful pickpocket." (Elder Scrolls Fandom)

"There is unfortunately a bug in Skyrim where wearing more than one piece of apparel with the fortify pickpocket enchantment does reduce the chance to pickpocket. A single piece of apparel will increase your chance but any more makes it harder." (Reddit)

None of this describes the real problem—if the base is negative, then multiplying will make it even lower. This triggers more often for high weight items because each additional weight drops the percentage by 4 points, making it easy to drag the base negative (especially at low skill levels).

Perks

The perks work differently (or rather how you would actually expect) by adding flat bonuses after the multiplication happens. ²⁸ Mostly. Keymaster just sets the final value to 100 for keys (which gets capped at 90%). This makes it so that +25% chance actually means your percentage chance is +25%.

Light Fingers adds between 0% and 100% depending on level Night Thief adds 25% if the target is sleeping Cutpurse adds 50% for gold

Ataxia

There's one more odd case, which is Ataxia, a disease that can be contracted from slaughterfish, frostbite spiders, skeevers, and traps. ²⁹ And the very deadly player.addspell 000b877c if you're in a hurry. It causes lockpicking and pickpocketing to become 25% harder until cured, but it's not applied as a flat modifier like a perk. Instead it's applied in the equipment sum, as if you were wearing a piece of -25% gear. This weirdly makes it beneficial if the base value is negative.

This is a real illness, unlike Rockjoint or Witbane

Pull it all together

Finally we can put this all in one big equation!

$$ \begin{gathered} =\bigg(40 + L_{player} - \frac{L_{target}}{4} - \frac{Value}{10} - 4 * Weight \textcolor{#888}{- 25 } (\text{Detected})\bigg) \end{gathered}\newline \text{x } \bigg(1 + \frac{\sum Equipment}{100}\bigg)\newline \text{x } \bigg(1 + \frac{Potion}{100}\bigg)\newline \textcolor{#888}{\text{+ }\{0, 20, 40, 60, 80, 100\}\text{ }} (\text{Light Fingers})\newline \textcolor{#888}{\text{+ 25 }} (\text{Night Thief})\newline \textcolor{#888}{\text{+ 50 }} (\text{Cutpurse})\newline $$

Now we can figure out how much gold we can successfully steal off someone! We need our level to be the highest it can be (100) and their level to be the lowest it can be (the other post ³⁰ Coming soon.™ goes into this more, but a number of NPCs have a skill of 5, with the shopkeepers who run Arnleif and Sons' Trading Company shop in Markarth, Imedhnain and Lisbet, ³¹ Fun fact, she's secretly a cannibal. being the easiest to consistently find).

We need to not be detected, we need max levels in Light Fingers (+100), the target needs to be sleeping (+25), and we need to have Cutpurse (+50 for gold). Finally the chance needs to round up to 1%, so it needs to be > 0.5. If we plug that all in we get this:

$$ \bigg(138.75 - \frac{Gold}{10}\bigg) * Equipment * Potion + 175 > 0.5 $$

We want enough gold to turn our base rate negative, which means equipment and potions will hurt rather than help. But because of the way that Ataxia is applied, if we contract the disease our equipment multiplier becomes \((1 + \frac{-25}{100}) = 0.75\), which weirdly helps. Plugging that in and reorganizing we get that \(Gold < 3,714.1\bar{6}\). And this works!

And I can confirm it's possible, although it took me 84 quicksaving attempts to do it.

3,715 has a 0% chance of stealing But 3,714 has a 1% chance, the maximum value! ³²

XP

The skill XP you gain for successfully pickpocketing (or placing) is based solely on the value of the items:

$$ XP = 8.1 * Value^{0.8} * Multipliers $$

This is why stealing gold and light items is best—higher weight makes it harder to steal but doesn't reward you with more XP. It's also why placing gives so little XP: it ignores unowned items making the calculated 'value' 0, which it rounds up to 1 to give 8.1 XP no matter how much gold you place.

To level up your pickpocketing skill to the next level you need \(\big(250 + \frac{L^{1.95}}{4}\big)\) XP, needing 87,350.5 total XP to get from level 15 up to 100. Let's say I make my own luck ³³ and can win any coinflip. If I have all of the equipment and potions and multipliers ³⁴ Being Well Rested (sleeping in a bed you own for x1.1) and having Lover's Comfort (sleeping with a spouse for x1.15) can be combined along with two standing stones using the Aetherial Crown from the Dawnguard DLC: the Thief Stone (x1.2) and the Lover Stone (x1.15) for a total peak multiplier of 1.7457. I want, how quickly can Ï do it? It turns out you can do this in only 15 steals, and you don't even need good gear to do it (just a ring of 15% and an elixir for the first pickpocket). ³⁵ If you're curious, to maximize value you need to get your perks to sum to over 50 as quickly as possible to allow you to use Ataxia with a negative base. The lowest skill level to do that is 30: two levels of Light Fingers and Night Thief (+65). Because all you need to do is get to skill 30 in as few steals as possible, and even with infinite multipliers it takes 3 steals, you can pare back the 3 steals to only require 1.63x gear, and only for the first one.

In conclusion

We have our answer! As with all deep dives it started with one idle thought ("that percentage seems wrong") and spiraled into something a good deal more convoluted. But the best part of all? To put together the writeup I started using console commands which broke any sense of progression I had tied to my character. For now, at least, my curse is lifted.