Guides:Coin Case ACE: Difference between revisions
m
→TM Quantities to sell
No edit summary |
|||
| (52 intermediate revisions by 2 users not shown) | |||
Line 1:
{{Guides header|Coin Case glitch}}
This page serves as a repository for a Coin Case ACE setup for the English versions of Pokémon Gold & Silver. It is part of the [[Guides:TimoVM's_gen_2_ACE_setups|TimoVM's Gen 2 ACE setups]] set of guides.
The preparation is best done during daytime in-game. If needed, you can change the in-game clock with the help of [https://bl4cksh4rk.github.io/Pokemon-GSC-Clock-Password-Generator/ this tool].
'''Please make sure to fully read every step of the guide before executing them.'''
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the [https://discord.gg/EA7jxJ6 Glitch City Research Institute Discord].
=Setting up initial ACE=
When using the Coin Case while a Bellsprout/Machop's cry and specific newly loaded tiles are buffered in memory, the game will execute code in various places before finally ending up in the $FA98-$FA9B range, which is echo ram containing the stat exp data of party pokémon #3.
Using specific movement patterns in the Goldenrod Radio Tower, we can form a jump to $EEEE, which is echo ram for the second character of the last read mail. This gives us enough space to call the start of box names, then fix the side effects of using the Coin Case and return to normal game operation.
In practice, the initial Coin Case ACE setup will be created using the following general process:
# Obtain the Coin Case
# Give any pokémon a mail with specific content and set up a box name code
# Set up a specific movement pattern in the Goldenrod Radio Tower to be able to execute ACE
==Step 1: Obtaining everything needed for the setup==
# Catch any pokémon and nickname it "MAILWRITER".
# Go to Goldenrod City and obtain the Coin Case by picking it up in the Goldenrod Underground.
# After obtaining the Coin Case, go to the Game Corner.
#* If you do not have any coins yet, simply buy 100 coins.
#* If you already have coins stored in the coin case, make sure that the first digit of the total number of held coins equals "1".
# In the Goldenrod Dept. Store, buy a Flower Mail.
==Step 2: How to execute ACE using the Coin Case==
Now that we have the Coin Case, we'll need to set up everything needed to actually safely use it. Using a specific setup, we can force the Coin Case to execute code starting from the second character of the last read mail. From here, we need to ensure that we have the proper setup to execute box name codes.
* Prepare a mail to ensure that a box name code can be executed
* Prepare specific box names to run a simple test code.
===Finishing the setup===
#Arrange your party like the following:
## Any
## Any
## "MAILWRITER" nicknamed Pokémon
## Any
## Any
## Any
# Finally, give the "MAILWRITER" nicknamed pokémon a flower mail with the following content:
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Mail English GS V2.png]]
|}
Note: there is nothing unique about the MAILWRITER pokémon that requires it to be in the 3rd party slot. Later parts of the setup will, however, write data to the MAILWRITER pokémon, so it's convenient to keep it in the third party slot for now.
===Preparing a test box name code===
Rename the first box name to the following name. This box name code will be replaced later and is solely intended to verify if the setup is working correctly. Their only function is to safely exit ACE and return the game to normal:
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Coin Case ACE tester box name.png|frameless]]
|}
==Step 3: Using Coin Case ACE==
In order to use ACE, always perform the following steps:
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:EN Coin Case ACE start.png]]
||
[[File:EN Coin Case ACE end.png]]
|}
* '''Make sure to set box 1 as the current active box.'''
* Go to the Goldenrod Radio Tower and take the stairs up to the second floor. Move to the spot indicated by the above screenshot on the left. '''Save the game while you're still standing on this spot and reset the game.'''
* After reloading, take the following steps until you reach the spot indicated by the above screenshot on the left:
*# 3 steps rightwards
*# 2 steps upwards
*# 1 step leftwards
* Open the start menu, open the pokédex, then listen to the cry of Bellsprout.
* Go to the Pokémon menu and read the previously mentioned mail.
* Open the item bag, switch item pockets at least once, then use the Coin Case. This will execute ACE.
Make sure to test the setup by going through this process once. With the current box name setups, you can verify that the setup is working by checking the TM/HM pocket. The quantity of TM03 should now be 255. You can now continue to the next guide.
If the test code crashes, check the following:
* Did you correctly follow the previous steps?
* Is the current active box set to box 1?
* Make sure that the first digit of the total amount of coins is equal to "1". 100 is a good total for this setup.
* Is the box name code correctly entered?
* Is the content of the mail correct?
'''Anytime you wish to execute wrong pocket Coin Case ACE, you'll need to repeat the steps outlined at the beginning of this section. Always make sure the held mail was read before using the Coin Case and ensure that a valid box name code was prepared beforehand.'''
=Setting up an ACE environment=
While we now have a way to execute box name codes using ACE, the current setup has a few drawbacks:
* Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.
* Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.
To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.
To do that, we're going to use a box name code to obtain 255 copies of all TMs, then sell them in specific quantities to write out a program. Alongside that, the box name code will also add a TM25 to the main item pocket. Using this TM25, outside of the TM/HM pocket, will allow us to execute the Mail Writer at any time as long as a specific pokémon is kept in the second party slot.
The mail writer itself will be installed in the TM/HM pocket through the following two step process:
# Execute a box code using Coin Case ACE that sets the quantities of all 50 TMs to x255, as well as placing a TM25 in the main item pocket. On top of that, it will modify the data of party pokémon #3 so that they allow TM25 to be safely used, as long as it is kept in the second party slot.
# Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
==Step 4: Setting all TM quantities to x255==
* Rename box names to form the following. '''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''.
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Box English GS Setup V2.png]]
|}
* (only if you haven't done so in previous parts), catch any pokémon and nickname it "MAILWRITER". '''Put it in the third party slot'''. We'll alter this pokémon's stat experience to redirect TM25 execution to the TM/HM pocket.
* Ensure that you have everything set up for Coin Case ACE:
** "MAILWRITER" nicknamed pokémon holding mail in party slot #3
** Read the correct mail beforehand
** Perform all steps necessary to execute Coin Case ACE
* Use the Coin Case once. If the code was executed successfully, switch to the TM/HM pocket. '''It should now contain every TM at a quantity of x255. The code will also overwrite the first item in the main item pocket to be a TM25.'''
==Step 5: Selling TMs to form a program in the TM/HM pocket==
Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using.
The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:TM English GS.png]]
|}
===TM Quantities to sell===
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
! TM !! Final Quantity !! Sell value
|-
|TM01 DYNAMICPUNCH ||x17 ||357000
|-
|TM02 HEADBUTT ||x85 ||170000
|-
|TM03 CURSE ||x221 ||51000
|-
|TM04 ROLLOUT ||x213 ||42000
|-
|TM05 ROAR ||x213 ||21000
|-
|TM06 TOXIC ||x213 ||63000
|-
|TM07 ZAP CANNON ||x33 ||222000
|-
|TM08 ROCK SMASH ||x66 ||94500
|-
|TM09 PSYCH UP ||x98 ||78500
|-
|TM10 HIDDEN POWER ||x207 ||72000
|-
|TM11 SUNNY DAY ||x225 ||30000
|-
|TM12 SWEET SCENT ||x209 ||23000
|-
|TM13 SNORE ||x42 ||106500
|-
|TM14 BLIZZARD ||x254 ||1500
|-
|TM15 HYPER BEAM ||x80 ||262500
|-
|TM16 ICY WIND ||x56 ||298500
|-
|TM17 PROTECT ||x251 ||6000
|-
|TM18 RAIN DANCE ||x40 ||215000
|-
|TM19 GIGA DRAIN ||x10 ||367500
|-
|TM20 ENDURE ||x135 ||180000
|-
|TM21 FRUSTRATION ||x134 ||60500
|-
|TM22 SOLARBEAM ||x18 ||355500
|-
|TM23 IRON TAIL ||x19 ||354000
|-
|TM24 DRAGONBREATH ||x35 ||330000
|-
|TM25 THUNDER ||x129 ||126000
|-
|TM26 EARTHQUAKE ||x79 ||264000
|-
|TM27 RETURN ||x18 ||118500
|-
|TM28 DIG ||x24 ||231000
|-
|TM29 PSYCHIC ||x239 ||16000
|-
|TM30 SHADOW BALL ||x33 ||333000
|-
|TM31 MUD-SLAP ||x1 ||381000
|-
|TM32 DOUBLE TEAM ||x196 ||59000
|-
|TM33 ICE PUNCH ||x77 ||267000
|-
|TM34 SWAGGER ||x205 ||25000
|-
|TM35 SLEEP TALK ||x239 ||8000
|-
|TM36 SLUDGE BOMB ||x58 ||98500
|-
|TM37 SANDSTORM ||x27 ||228000
|-
|TM38 FIRE BLAST ||x205 ||50000
|-
|TM39 SWIFT ||x144 ||111000
|-
|TM40 DEFENSE CURL ||x55 ||100000
|-
|TM41 THUNDERPUNCH ||x189 ||99000
|-
|TM42 DREAM EATER ||x40 ||322500
|-
|TM43 DETECT ||x217 ||19000
|-
|TM44 REST ||x56 ||298500
|-
|TM45 ATTRACT ||x240 ||22500
|-
|TM46 THIEF ||x254 ||1500
|-
|TM47 STEEL WING ||x08 ||370500
|-
|TM48 FIRE PUNCH ||x200 ||82500
|-
|TM49 FURY CUTTER ||x24 ||346500
|-
|TM50 NIGHTMARE ||x242 ||13000
|}
===Running the newly written program===
# It is recommended to save before continuing.
# Put the pokémon that was nicknamed "MAILWRITER" into the 2nd party slot.
# Use TM25. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
# From now on, you can repeat this process at any time to start the mail writer.
Since we aren't planning on using the Coin Case anymore, the mail that was previously given to MAILWRITER can be removed. It is no longer relevant for the remainder of the setup.
If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for the "MAILWRITER" pokémon. This can be done using the box codes included a bit further below.
A note on the nicknamed pokémon: when running the box name code, we altered MAILWRITER's stat experience data to contain a redirect to the TM/HM pocket. You can safely deposit and withdraw it from the PC. '''Please note that this pokémon must never gain experience after this point, otherwise you'll need to reapply the setup.'''
==Step 6: Using the mail writer==
'''From now on, simply go through the necessary steps to use TM25 to start up the RAM writer.'''
The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
This will cause the mail writer to convert the newly written code into assembly. It will also '''print a checksum''' (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.
Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. '''If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.'''
Assembly can easily be converted to mail codes using [https://timovm.github.io/MailConverter/ TimoVM's MailConverter]. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
===Controls===
Between entering mail codes, the mail writer will ask for user input.
* '''Press SELECT''' to open a new mail and continue writing data.
* '''Press START''' to immediately jump to and start executing the newly written program. '''Only use this when you've finished every mail.'''
* '''Press any other button''' to go back one byte at a time to correct errors. '''If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail.''' This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
| [[File:Mail writer write mode.png|288px]] || [[File:Mail writer input mode.png|288px]]
|-
| Enter your mail code, then press "END". || It prints the checksum and waits for input.
|}
==What to do with the Mail writer==
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
* [[User:TimoVM/Mail Writer Codes|Mail codes]]: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..
* [[User:TimoVM/RAM Writer|RAM writer]]: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.
=Addendum: repairing the "MAILWRITER" pokémon=
In case something happens with the "MAILWRITER" nicknamed pokémon that causes it to no longer function, you can repair the pokémon without having to reset TM quantities using the following procedure:
* Arrange the party as follows:
*# Any
*# Any
*# "MAILWRITER" pokémon holding mail
*# Any
*# Any
*# Any
* Enter the following language-specific box name. '''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''.
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Reset box code GSEN.png]]
|}
* Read the mail held by the "MAILWRITER" pokémon.
* Go to the Goldenrod Radio Tower and follow the correct steps to finish the setup.
* Use the Coin Case to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly.
* If the code executes succesfully without crashing the game, the "MAILWRITER" nicknamed pokémon has now been repaired.
=Appendix=
==Plain text transcripts of codes==
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
! Language !! English
|-
! scope="row" | Mail
||
<pre>h h 's z 2 Pk 'l 0 9 ♀ . 9 Pk * ' ]
h 'd</pre>
|-
! scope="row" | Test box name
||
<pre>0 9 é A ♀ h 'd</pre>
|-
! scope="row" | Setup box name
||
Box 1: A p é 3 2 'v 9 5
Box 2: é 1 2 'v 'd é 6 2
Box 3: ? b é , 2 'v ♂ 5
Box 4: é 2 2 'v ? é 5 2
Box 5: ? E é ) 4 'v G 5
Box 6: é ♀ 2 é ; 4 0 9
Box 7: ♀ ♀ ♀ ♀ ♀ 's 5 5
Box 8: ? 'm é : 4 'v 4 5
Box 9: é y ♀ 'v - é 8 4
Box 10: 'v x é ( 4 'd
|-
! scope="row" | Reset box name
||
Box 1: A p 'v 6 é ) 4 5
Box 2: 'v G é ; 4 'v J 5
Box 3: é [ 4 'v x é ( 4
Box 4: H 'v z é : 4 h 'd
|}
==In-depth explanation of the setup==
===Effect of the Coin Case===
Activating the Coin Case causes arbitrary code execution from $E112 onward, which is echo ram for $C112. This region corresponds with sound data and can be manipulated by buffering pokémon cries.
Playing Bellsprout or Machop's cry will buffer $33 at $C117. This opcode increments the stack pointer, desyncing the stack.
The sound that plays when swapping item pockets clears some bad data around the $C16x region. It also places a $C1 at $C16E, popping a value from the stack to registers bc.
The sound that plays when confirming the use of the Coin Case places $80 A1 D0 at $C192. Due to prior opcodes setting the value of register bc to $0000, the condition for the return will always be true. Thanks to incrementing the stack pointer and popping the stack once, the next return address will redirect execution to $EB12, echo ram for $CB12.
From $CB12, the game will nopslide until $CC20 is reached. This region contains data on buffered tiles that are added when the player moves around . Due to our specific movement pattern within the Goldenrod Radio Tower, this results in the following data, starting from $CC20:
<pre>
At start, hl = $B2B2 and sp : $DFBC
39 add sp ; hl = $926E
39 add sp ; hl = $722A
39 add sp ; hl = $51E6
39 add sp ; hl = $31A2
39 add sp ; hl = $115E
39 add sp ; hl = $F11A
39 add sp ; hl = $D0D6
39 add sp ; hl = $B092
39 add sp ; hl = $904E
39 add sp ; hl = $700A
39 add sp ; hl = $4FC6
39 add sp ; hl = $2F82, carry flag set
30 31 jr nc, $31 ; Ignore thanks to previous carry
1A ld a, (de)
1B dec de
1A ld a, (de)
1B dec de
0A ld a, (bc)
0B dec bc
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 39 39 ld bc, $3939
39 add sp ; hl = $0F3E
39 add sp ; hl = $EEFA, desired result in h, zero flag set
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 00 00 ld bc, $0000
00 nop
00 nop
84 add h
9B sbc e
A4 and h
9B scb e ; The result of these arithmatic opcodes aren't relevant, but they do reset the zero flag
C4 9B E4 call nz, $E49B ; Corresponds to lower parts of screen tile data
</pre>
The main result of this region is to set h to $EE, followed by a call to screen tile data.
Before ACE is triggered, the game will already print the amount of coins on screen. In particular, a number of coins whose first digit is equal to 1 will lead to $F7 (rst30h) being printed to $C4E1. The region between $C49B and $C4E1 is filled with harmless data consisting of blank tiles ($7F), textbox tiles ($7A-$7C) and arithmatic opcodes for the "Coins:" text ($82 AE A8 AD B2 9C). The end result is that a is set to be equal to $EE, the value stored in h, right before rst30h is activated.
rst30h is technically an unused reset vector, but accidentally contains the last three bytes of JumpTable function, usually accessed by rst28h:
<pre>
6F ld l, a ; hl = $EEEE
D1 pop de ; Pops the return address to registers de
E9 jp hl ; Jump to $EEEE, the second character of the last read mail
</pre>
This allows us to finally reach the last read mail, a region of memory that we have a good amount of control over.
===Effect of the mail===
The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following:
<pre>
A7 and a ; Filler
A7 and a ; Reset carry flag
D4 B9 F8 call nc, $F8B9 ; Box names start at $D8BF/F8BF, setting the active box to box 1 will ensure we can safely slide through.
E1 pop hl ; Additional pop to clear return address of call to screen data
D1 pop de ; Set de to $0075, which holds value $00. Ensures that print function will end immediately after resuming
E8 FF add sp, -1 ; Fix the effect of increasing the stack pointer
F1 pop af ; a = $03
E0 9F ld ($FF9F), a ; Ensures return to ROM bank 3 after resuming execution
A7 and a ; Reset carry flag. Not strictly necessary, but added for safety for now
D0 ret nc
</pre>
===Effect of the test box name code===
Box name data starts from $D8BF onward. Converting the provided mail code to assembly results in the following:
<pre>
F6 FF or $FF ; Set a to $FF, set carry flag to 0.
EA 80 F5 ld (F580), a ; $F580 is an echo ram copy of $D580, which corresponds to TM03's quantity.
D0 ret nc ; Thanks to the preparatory work done by the mail, allow safe return to normal game operation.
</pre>
===Effect of the setup box name code===
Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.
The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.
Separately, this code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
Lastly, the value of the first item ID in the main item pocket is overwritten so that it becomes a TM25.
<pre>
Box 1: $D8BF
80 add a, b
AF xor a ; a = $00
EA F9 F8 ld ($F8F9), a
D6 FF sub $FF ; a = $01
FB ei
50 ld d, b
Box 2: $D8C8
EA F7 F8 ld ($F8F7), a
D6 D0 sub $D0 ; a = $31
EA FC F8 ld ($F8FC), a
50 ld d; b
Box 3: $D8D1
E6 A1 and $A1 ; a = $21
EA F4 F8 ld ($F8F4), a
D6 EF sub $EF ; a = $32
FB ei
50 ld d, b
Box 4: D8DA
EA F8 F8 ld ($F8F8), a
D6 E6 sub $E6 ; a = $4C
EA FB F8 ld ($F8FB), a
50 ld d, b
Box 5: $D8E3
E6 84 and $84 ; a = $04
EA 9B FA ld ($FA9B), a
D6 86 sub $86 ; a = $7E
FB ei
50 ld d, b
Box 6: $D8EC
EA F5 F8 ld ($F8F5), a
EA 9D FA ld ($FA9D), a
F6 FF or $FF ; a = $FF, reset carry flag
21
Box 7: $D8F5
7E F5 ld hl, wTMsHMs
01 32 00 ld bc, $0032
D4 4C 31 call nc, byteFill
50 ld d, b
Box 8: $D8FE
E6 D2 and $D2 ; a = $D2
EA 9C FA ld ($FA9C), a
D6 FA sub $FA ; a = $D8, TM25's item ID
FB ei
50 ld d, b
Box 9: $D907
EA B8 F5 ld (wItems), a ; Main item pocket, first item ID
D6 E3 sub $E3 ; a = $F5
EA 9E FA ld ($FA9E), a
50 ld d, b
Box 10: $D910
D6 B7 sub $B7 ; a = 3E, reset carry flag
EA 9A FA ld ($FA9A), a
D0 ret nc
50 ld d, b
Party pokémon #5's stat experience, starting from $DAFA
3E 04 ld a, $04
D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25
</pre>
===Effect of the TM code===
Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.
<pre>
11 55 DD ld de, $DD55
D5 push de
D5 push de ; .nextMail
D5 push de
21 42 62 ld hl, _ComposeMailMessage
CF rst08h, FarCall a:hl
E1 pop hl
D1 pop de
2A ldi a, (hl) ; .continue
FE 50 cp $50
38 FB jr c, .continue
28 0A jr z, .terminator
87 add a, a
86 add a, (hl)
12 ld (de), a
13 inc de
23 inc hl
81 add a, c
4F ld c, a
12 ld (de), a
18 EF jr .continue
21 01 C4 ld hl, $C401 ; .screenLoop
4D ld c, l
CD EF 3A call PrintBCDNumber.loop - 1
1B dec de ; .goBack
CD 90 37 call JoyTextDelay_ForcehJoyDown
BD cp a, l ; l = $04
28 D9 jr z, .nextMail
38 F0 jr c, .displayLoop
FE 08 cp $08
C8 ret z
18 F2 jr .goBack
</pre>
===Effect of the reset box name code===
Converting the characters from box names to assembly results in the following code. This code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
<pre>
Box 1: $D8BF
80 add a, b
AF xor a ; a = $00
D6 FC sub $FC ; a = $04
EA 9B FA ld ($FA9B), a
FB ei
50 ld d, b
Box 2: $D8C8
D6 86 sub $86 ; a = $7E
EA 9D FA ld ($FA9B), a
D6 89 sub $89 ; a = $F5
FB ei
50 ld d; b
Box 3: $D8D1
EA 9E FA ld ($FA9E), a
D6 B7 sub $D7 ; a = $3E
EA 9A FA ld ($FA9A), a
50 ld d, b
Box 4: D8DA
87 add a, a
D6 B9 sub $B9 ; a = $C3
EA 9C FA ld ($FA9C), a
A7 and a ; Reset carry flag
D0 ret nc
50 ld d, b
Party pokémon #3's stat experience, starting from $DA9A
3E 04 ld a, $04
C3 7E F5 jp wTMsHMs ; Carry and zero flag are both reset when using TM25
</pre>
[[Category:Guides]]
| |||