diff --git a/artifacts/ddraw.ini b/artifacts/ddraw.ini
index 3c5adf54..0b39ff14 100644
--- a/artifacts/ddraw.ini
+++ b/artifacts/ddraw.ini
@@ -812,6 +812,7 @@ SkipSizeCheck=0
 DontDeleteProtos=0
 
 ;Set to 1 to give scripts direct access to Fallout's address space, and to make arbitrary calls into Fallout's code
+;Set to 2 to also disable the memory address check in unsafe script functions
 ;Does not require sfall debugging mode
 AllowUnsafeScripting=0
 
diff --git a/sfall/Modules/Scripting/Handlers/Memory.cpp b/sfall/Modules/Scripting/Handlers/Memory.cpp
index 28f135c8..9cd49a67 100644
--- a/sfall/Modules/Scripting/Handlers/Memory.cpp
+++ b/sfall/Modules/Scripting/Handlers/Memory.cpp
@@ -30,6 +30,8 @@ namespace script
 #define START_VALID_ADDR    0x410000
 #define END_VALID_ADDR      0x6B403F
 
+bool checkValidMemAddr = true;
+
 void __declspec(naked) op_read_byte() {
 	__asm {
 		_GET_ARG_INT(error);
@@ -107,10 +109,13 @@ void __declspec(naked) op_write_byte() {
 		cmp  cx, VAR_TYPE_INT;
 		jnz  end;
 		// check valid addr
+		cmp  checkValidMemAddr, 0;
+		jz   noCheck;
 		cmp  eax, START_VALID_ADDR;
 		jb   end;
 		cmp  eax, END_VALID_ADDR;
 		ja   end;
+noCheck:
 		and  esi, 0xFF;
 		push esi;
 		push eax;
@@ -134,10 +139,13 @@ void __declspec(naked) op_write_short() {
 		cmp  cx, VAR_TYPE_INT;
 		jnz  end;
 		// check valid addr
+		cmp  checkValidMemAddr, 0;
+		jz   noCheck;
 		cmp  eax, START_VALID_ADDR;
 		jb   end;
 		cmp  eax, END_VALID_ADDR;
 		ja   end;
+noCheck:
 		and  esi, 0xFFFF;
 		push esi;
 		push eax;
@@ -161,10 +169,13 @@ void __declspec(naked) op_write_int() {
 		cmp  cx, VAR_TYPE_INT;
 		jnz  end;
 		// check valid addr
+		cmp  checkValidMemAddr, 0;
+		jz   noCheck;
 		cmp  eax, START_VALID_ADDR;
 		jb   end;
 		cmp  eax, END_VALID_ADDR;
 		ja   end;
+noCheck:
 		push esi;
 		push eax;
 		call SafeWrite32;
@@ -201,10 +212,13 @@ next:
 		// ecx - type, esi - value
 		// edx - type, eax - addr
 		// check valid address
+		cmp  checkValidMemAddr, 0;
+		jz   noCheck;
 		cmp  eax, START_VALID_ADDR;
 		jb   end;
 		cmp  eax, END_VALID_ADDR;
 		ja   end;
+noCheck:
 		push ebx; // script
 		push esi; // str value
 		mov  edx, ecx; // type
diff --git a/sfall/Modules/Scripting/Handlers/Memory.h b/sfall/Modules/Scripting/Handlers/Memory.h
index 3cfb90fa..72499efc 100644
--- a/sfall/Modules/Scripting/Handlers/Memory.h
+++ b/sfall/Modules/Scripting/Handlers/Memory.h
@@ -23,6 +23,8 @@ namespace sfall
 namespace script
 {
 
+extern bool checkValidMemAddr;
+
  // memory_reading_funcs
 
 void __declspec() op_read_byte();
diff --git a/sfall/Modules/Scripting/Opcodes.cpp b/sfall/Modules/Scripting/Opcodes.cpp
index 3edbd64c..0144c15d 100644
--- a/sfall/Modules/Scripting/Opcodes.cpp
+++ b/sfall/Modules/Scripting/Opcodes.cpp
@@ -274,7 +274,8 @@ void InitNewOpcodes() {
 		ForceEncounterRestore(); // restore if the encounter did not happen
 	};
 
-	if (iniGetInt("Debugging", "AllowUnsafeScripting", 0, ::sfall::ddrawIni)) {
+	if (int unsafe = iniGetInt("Debugging", "AllowUnsafeScripting", 0, ::sfall::ddrawIni)) {
+		if (unsafe == 2) checkValidMemAddr = false;
 		dlogr("  Unsafe opcodes enabled.", DL_SCRIPT);
 		opcodes[0x1cf] = op_write_byte;
 		opcodes[0x1d0] = op_write_short;