Guides:Coin Case ACE: Difference between revisions

From Glitch City Wiki
VisualWikitext
 
(68 intermediate revisions by 3 users not shown)
Line 1:
{{Guides header|Coin Case glitch}}
This page explains how to set up a Coin Case ACE setup that doesn't require a slide pokemon or Wooper/Quagsire. It instead makes use of a pokémon that has gained specific stat exp.
This page serves as a repository for a Coin Case ACE setup for the English versions of Pokémon Gold & Silver. It is part of the [[Guides:TimoVM's_gen_2_ACE_setups|TimoVM's Gen 2 ACE setups]] set of guides.
 
The preparation is best done during daytime in-game. If needed, you can change the in-game clock with the help of [https://bl4cksh4rk.github.io/Pokemon-GSC-Clock-Password-Generator/ this tool].
==Explanation==
 
'''Please make sure to fully read every step of the guide before executing them.'''
When using the modern Coin Case setup, where a Bellsprout/Machop's cry and specific newly loaded tiles are buffered in memory, the game will jump to the $FA98-$FA9B range, which is echo ram containing the stat exp data of party pokémon #3.
 
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the [https://discord.gg/EA7jxJ6 Glitch City Research Institute Discord].
Using specific stat exp values, we can form a jump to $CF00, which is located in the latter half of the current buffered mail. This gives us barely enough space to fix the stack and jump to the start of box names, resulting in a Coin Case ACE setup that is compatible with Wrong Pocket TM ACE box name codes.
 
=Setting up initial ACE=
This setup is specifically meant for new game scenarios, it is intended as a starting point for an easy setup, which can then be converted into a more universal Wrong Pocket TM setup.
 
When using the Coin Case while a Bellsprout/Machop's cry and specific newly loaded tiles are buffered in memory, the game will execute code in various places before finally ending up in the $FA98-$FA9B range, which is echo ram containing the stat exp data of party pokémon #3.
==Building the setup==
 
Using specific movement patterns in the Goldenrod Radio Tower, we can form a jump to $EEEE, which is echo ram for the second character of the last read mail. This gives us enough space to call the start of box names, then fix the side effects of using the Coin Case and return to normal game operation.
* Start the game as normal, you are free to pick any starter you want.
 
* When you arrive at route 34, catch any Drowzee.
*In Pick uppractice, the initial Coin Case afterACE yousetup arrivewill be created using the infollowing Goldenrodgeneral City.process:
# Obtain the Coin Case
* Using the Drowzee you caught, defeat only the following pokémon. '''The order in which they are beaten doesn't matter but the Drowzee has to defeat them by itself, without sharing experience with other party pokemon.'''
# Give any pokémon a mail with specific content and set up a box name code
{| class="wikitable sortable"
# Set up a specific movement pattern in the Goldenrod Radio Tower to be able to execute ACE
| Drowzee || Found on Route 34 with 50% spawn odds, any time of day.
 
==Step 1: Obtaining everything needed for the setup==
 
# Go to Goldenrod City and obtain the Coin Case by picking it up in the Goldenrod Underground.
# After obtaining the Coin Case, go to the Game Corner.
#* If you do not have any coins yet, simply buy 100 coins.
#* If you already have coins stored in the coin case, make sure that the first digit of the total number of held coins equals "1".
# In the Goldenrod Dept. Store, buy a Flower Mail.
# For this guide, '''ensure that the first item in the main item pocket is an item you do not need''', as we'll be overwriting it to a different item.
 
Now that we have the Coin Case, we'll need to set up everything needed to actually safely use it. Using a specific setup, we can force the Coin Case to execute code starting from the second character of the last read mail. From here, we need to ensure that we have the proper setup to execute box name codes.
 
* Prepare box names to execute a certain effect and return safely to normal game operations. For the purposes of this guide, we'll use the box name in the next section.
* Give any pokémon a flower mail with the following content:
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Mail English GS V2.png]]
|}
 
===Preparing the box name code===
 
Rename the first 10 box names to the following names. This box name will do the following when executed as code:
* Set quantities for all 50 TMs to x255
* Alter the first item in the main item pocket to a TM33, which can be used to trigger ACE
* Set up code so that using TM33 will execute the data stored in TM quantities
 
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Box English GS Setup.png]]
|}
 
==Step 2: Using Coin Case ACE==
 
In order to use Coin Case ACE, always perform the following steps:
 
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:EN Coin Case ACE start.png]]
||
[[File:EN Coin Case ACE end.png]]
|}
 
* '''Make sure to set box 1 as the current active box.'''
* Go to the Goldenrod Radio Tower and take the stairs up to the second floor. Move to the spot indicated by the above screenshot on the left. '''Save the game while you're still standing on this spot and reset the game.'''
* After reloading, take the following steps until you reach the spot indicated by the above screenshot on the left:
*# 3 steps rightwards
*# 2 steps upwards
*# 1 step leftwards
* Open the start menu, open the pokédex, then listen to the cry of Bellsprout.
* Go to the Pokémon menu and read the previously mentioned mail.
* Open the item bag, switch item pockets at least once, then use the Coin Case. ACE will be executed when the coin count displays on the screen.
 
With the current box name setups, you can verify that the setup is working by checking the TM/HM pocket. The first item in the main item pocket should be altered to a TM33, in the TM/HM pocket you can now find all TMs, each having a quantity of x255. '''Do not use this TM33 yet! This TM will allow us to execute the contents of the TM/HM pocket as code, but due to the specific quantities currently present it will be guaranteed to crash the game.'''
 
Anytime you wish to execute wrong pocket Coin Case ACE, you'll need to repeat the steps outlined at the beginning of this section. Always make sure the held mail was read before using the Coin Case and ensure that a valid box name code was prepared beforehand.
 
===Troubleshooting===
 
If the code crashes, check the following:
* Did you correctly follow the previous steps?
* Is the current active box set to box 1?
* Make sure that the first digit of the total amount of coins is equal to "1". 100 is a good total for this setup.
* Is the box name code correctly entered?
* Is the content of the mail correct?
 
===A small note on the box names===
 
Due to the limited characterset, the box name code rewrites part of itself to be able to achieve its effect. This will cause the box names to appear glitched after executing Coin Case ACE once.
 
While this looks weird, this is completely intentional and harmless. The code can still be used again if needed, you can easily fix this issue by renaming the box names to a normal name.
 
=Setting up an ACE environment=
 
While we have a way to execute box name codes using ACE, the current setup has a few drawbacks:
* Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.
* Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.
 
To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.
 
When TMs are used outside of the TM/HM pocket, the game will incorrectly attempt to search its item effect in the list of normal item effects. This causes the game to interpret garbage data as item effect pointers, for some TMs this allows us to execute ACE. This is known as Wrong Pocket TM ACE. The advantage of TM33 is that it can be used without requiring specific party/item/box/mail setups.
 
We've already given ourselves 255 copies of every TM, along with a method to execute the contents of the TM/HM contents in the form of TM33. In this part, we'll sell TMs in specific quantities to write out a program. Once this has been done, we can simply use TM33 to start up the MailWriter.
 
The mail writer itself will be installed through the following two step process:
# Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
# Use TM33 to activate the mail writer program, allowing us to quickly write out and execute a variety of ACE effects.
# improve the setup by executing a small code to move the mail writer program to unused memory, freeing up the TM pocket for our own use.
 
==Step 3: Selling TMs to form a program in the TM/HM pocket==
 
Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program.
 
The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
 
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:TM English GS.png]]
|}
 
===TM Quantities to sell===
 
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
! TM !! Final Quantity !! Sell value
|-
|TM01 DYNAMICPUNCH ||x17 ||357000
| Oddish || Found in Ilex Forest with 50% spawn odds, only during night time.
|-
|TM02 HEADBUTT ||x85 ||170000
| Nidoran♀ || Found on Route 35 with 30% spawn odds, any time of day.
|-
|TM03 CURSE ||x221 ||51000
| Nidoran♀ || Found on Route 35 with 30% spawn odds, any time of day.
|-
|TM04 ROLLOUT ||x213 ||42000
|-
|TM05 ROAR ||x213 ||21000
|-
|TM06 TOXIC ||x213 ||63000
|-
|TM07 ZAP CANNON ||x33 ||222000
|-
|TM08 ROCK SMASH ||x66 ||94500
|-
|TM09 PSYCH UP ||x98 ||78500
|-
|TM10 HIDDEN POWER ||x207 ||72000
|-
|TM11 SUNNY DAY ||x225 ||30000
|-
|TM12 SWEET SCENT ||x209 ||23000
|-
|TM13 SNORE ||x42 ||106500
|-
|TM14 BLIZZARD ||x254 ||1500
|-
|TM15 HYPER BEAM ||x80 ||262500
|-
|TM16 ICY WIND ||x56 ||298500
|-
|TM17 PROTECT ||x251 ||6000
|-
|TM18 RAIN DANCE ||x40 ||215000
|-
|TM19 GIGA DRAIN ||x10 ||367500
|-
|TM20 ENDURE ||x135 ||180000
|-
|TM21 FRUSTRATION ||x134 ||60500
|-
|TM22 SOLARBEAM ||x18 ||355500
|-
|TM23 IRON TAIL ||x19 ||354000
|-
|TM24 DRAGONBREATH ||x35 ||330000
|-
|TM25 THUNDER ||x129 ||126000
|-
|TM26 EARTHQUAKE ||x79 ||264000
|-
|TM27 RETURN ||x18 ||118500
|-
|TM28 DIG ||x24 ||231000
|-
|TM29 PSYCHIC ||x239 ||16000
|-
|TM30 SHADOW BALL ||x33 ||333000
|-
|TM31 MUD-SLAP ||x1 ||381000
|-
|TM32 DOUBLE TEAM ||x196 ||59000
|-
|TM33 ICE PUNCH ||x77 ||267000
|-
|TM34 SWAGGER ||x205 ||25000
|-
|TM35 SLEEP TALK ||x239 ||8000
|-
|TM36 SLUDGE BOMB ||x58 ||98500
|-
|TM37 SANDSTORM ||x27 ||228000
|-
|TM38 FIRE BLAST ||x205 ||50000
|-
|TM39 SWIFT ||x144 ||111000
|-
|TM40 DEFENSE CURL ||x55 ||100000
|-
|TM41 THUNDERPUNCH ||x189 ||99000
|-
|TM42 DREAM EATER ||x40 ||322500
|-
|TM43 DETECT ||x217 ||19000
|-
|TM44 REST ||x56 ||298500
|-
|TM45 ATTRACT ||x240 ||22500
|-
|TM46 THIEF ||x254 ||1500
|-
|TM47 STEEL WING ||x08 ||370500
|-
|TM48 FIRE PUNCH ||x200 ||82500
|-
|TM49 FURY CUTTER ||x24 ||346500
|-
|TM50 NIGHTMARE ||x242 ||13000
|}
* Buy any kind of mail (Flower Mail can be found in Goldenrod Dept. Store) and give it to your Drowzee with the following content:
[[File:Stack fixer.png|frameless]]
* Go to the Goldenrod pokémon center and rename the first box name to the following:
[[File:Coin Case ACE tester box name.png|frameless]]
* While still inside the Goldenrod pokémon center, make sure to save, then exit and take 4 steps to the right.
* Open the start menu, then listen to the cry of either Bellsprout/Machop.
* Go to the Pokémon menu and reread the abovementioned mail.
* Open the item bag, switch item pockets at least once, then use the Coin Case.
* You can verify that the setup works by checking the TM/HM pocket. The quantity of TM03 should now be 255.
 
==Using=Running the setupnewly written program===
 
# It is recommended to save before continuing.
# Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
# From now on, you can repeat this process at any time to start the mail writer.
 
Since we aren't planning on using the Coin Case anymore, the mail that was previously give to a pokémon can be removed. It is no longer relevant for the remainder of the setup.
 
===Troubleshooting & repairing TM33===
 
If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code:
 
'''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''.
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Reset box code GSEN.png]]
|}
 
To execute this box name code, repeat the process for Coin Case ACE:
* Read the mail previously given to a party pokémon.
* Go to the Goldenrod Radio Tower and follow the correct steps to finish the setup.
* Use the Coin Case to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly.
* If the code executes succesfully without crashing the game, TM33's functionality has now been repaired.
 
==Step 4: Using the mail writer==
 
'''From now on, simply use TM33 to start up the mail writer.'''
 
The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
 
This will cause the mail writer to convert the newly written code into assembly. It will also '''print a checksum''' (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.
 
Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. '''If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.'''
 
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Mail_English_GS_Rh.png]]
|}
 
Assembly can easily be converted to mail codes using [https://timovm.github.io/MailConverter/ TimoVM's MailConverter]. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
 
===Controls===
 
Between entering mail codes, the mail writer will ask for user input.
* '''Press SELECT''' to open a new mail and continue writing data.
* '''Press START''' to immediately jump to and start executing the newly written program. '''Only use this when you've finished every mail.'''
* '''Press any other button''' to go back one byte at a time to correct errors. '''If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail.''' This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
 
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
| [[File:Mail writer write mode.png|288px]] || [[File:Mail writer input mode.png|288px]]
|-
| Enter your mail code, then press "END". || It prints the checksum and waits for input.
|}
 
==Step 5: Improving the setup==
 
Since the mail writer is written using TM quantities, using or gaining TMs will break the mail writer. Because of this, we'll use the mail writer to execute a small code that achieves the following:
* Copies the mail writer to unused memory
* Overwrite the existing quantities in the TM/HM pocket to x1 for every TM
* Alter TM33's underlying code to execute the mail writer in unused memory
You can use the mail code converter page as follows:
* Copy the code in the table below
* Follow the link at the top of the table to the mail code converter
* Paste the code in the text box on the code converter's page
* Select the correct language and version
* Click on the "Run" button to display the mails you need to enter
 
{| class="wikitable"
|+ Codes to be used with [https://timovm.github.io/MailConverter/ TimoVM's MailConverter]
|-
! Language !! Gold & Silver
|-
! scope="row"| English
||
01 32 00 11 F2 D6 21 1B D4 73 23 72 3E 3E 12 13
3E 04 12 13 21 7E D5 E5 CD 1A 31 3E 01 0E 32 E1
C3 4C 31
|}
 
After executing this code, attempt to start up the mail writer. If you are able to open it and are able to successfully execute the following blank mail, the copy has finished successfully and you can save the game.
 
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Mail_English_GS_Rh.png]]
|}
 
==What to do with the Mail writer==
 
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
* [[User:TimoVM/Mail Writer Codes|Mail codes]]: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..
* [[User:TimoVM/RAM Writer|RAM writer]]: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it. WARNING: THE RAM WRITER SETUP FOR GOLD/SILVER IS CURRENTLY BEING REDESIGNED. PLEASE DO NOT INSTALL YET.
 
=Appendix=
 
==Plain text transcripts of codes==
 
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
! Language !! English
|-
! scope="row" | Mail
||
<pre>h h 's z 2 Pk 'l 0 9 ♀ . 9 Pk * ' ]
h 'd</pre>
|-
! scope="row" | Setup box name
||
Box 1: p 'v . é 'l 2 'v 1
Box 2: é 'd 2 'v 9 é 'v 2
Box 3: , , 'v D H H 'd 5
Box 4: ? E 's 'v 2 'v H 5
Box 5: 'v 9 é ♂ 2 ♀ 0 9
Box 6: 5 5 é ♀ ♀ * 8 p
Box 7: 'm 6 2 h 'm - 2 p
Box 8: 0 'm 's 'v 2 'v T H
Box 9: 's 'v 2 'v ; é y ♀
Box 10: 0 ♀ 'm 'v 2
|-
! scope="row" | Reset box name
||
Box 1: p 'v . é 'l 2 'v 1
Box 2: é 'd 2 'v 9 é 'v 2
Box 3: , , 'v D H H 'd 5
Box 4: ? E 's 'v 2 p 0 'm
Box 5: 's 'v 2 'v T 's 't 2
Box 6: p 0 ♀ 'm 'v 2
|}
 
==In-depth explanation of the setup==
 
===Effect of the Coin Case===
 
Activating the Coin Case causes arbitrary code execution from $E112 onward, which is echo ram for $C112. This region corresponds with sound data and can be manipulated by buffering pokémon cries.
 
Playing Bellsprout or Machop's cry will buffer $33 at $C117. This opcode increments the stack pointer, desyncing the stack.
 
The sound that plays when swapping item pockets clears some bad data around the $C16x region. It also places a $C1 at $C16E, popping a value from the stack to registers bc.
 
The sound that plays when confirming the use of the Coin Case places $80 A1 D0 at $C192. Due to prior opcodes setting the value of register bc to $0000, the condition for the return will always be true. Thanks to incrementing the stack pointer and popping the stack once, the next return address will redirect execution to $EB12, echo ram for $CB12.
 
From $CB12, the game will nopslide until $CC20 is reached. This region contains data on buffered tiles that are added when the player moves around . Due to our specific movement pattern within the Goldenrod Radio Tower, this results in the following data, starting from $CC20:
 
<pre>
At start, hl = $B2B2 and sp : $DFBC
 
39 add sp ; hl = $926E
39 add sp ; hl = $722A
39 add sp ; hl = $51E6
39 add sp ; hl = $31A2
39 add sp ; hl = $115E
39 add sp ; hl = $F11A
39 add sp ; hl = $D0D6
39 add sp ; hl = $B092
39 add sp ; hl = $904E
39 add sp ; hl = $700A
39 add sp ; hl = $4FC6
39 add sp ; hl = $2F82, carry flag set
30 31 jr nc, $31 ; Ignore thanks to previous carry
1A ld a, (de)
1B dec de
1A ld a, (de)
1B dec de
0A ld a, (bc)
0B dec bc
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 39 39 ld bc, $3939
39 add sp ; hl = $0F3E
39 add sp ; hl = $EEFA, desired result in h, zero flag set
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 00 00 ld bc, $0000
00 nop
00 nop
84 add h
9B sbc e
A4 and h
9B scb e ; The result of these arithmatic opcodes aren't relevant, but they do reset the zero flag
C4 9B E4 call nz, $E49B ; Corresponds to lower parts of screen tile data
</pre>
 
The main result of this region is to set h to $EE, followed by a call to screen tile data.
 
Before ACE is triggered, the game will already print the amount of coins on screen. In particular, a number of coins whose first digit is equal to 1 will lead to $F7 (rst30h) being printed to $C4E1. The region between $C49B and $C4E1 is filled with harmless data consisting of blank tiles ($7F), textbox tiles ($7A-$7C) and arithmatic opcodes for the "Coins:" text ($82 AE A8 AD B2 9C). The end result is that a is set to be equal to $EE, the value stored in h, right before rst30h is activated.
 
rst30h is technically an unused reset vector, but accidentally contains the last three bytes of JumpTable function, usually accessed by rst28h:
 
<pre>
6F ld l, a ; hl = $EEEE
D1 pop de ; Pops the return address to registers de
E9 jp hl ; Jump to $EEEE, the second character of the last read mail
</pre>
 
This allows us to finally reach the last read mail, a region of memory that we have a good amount of control over.
 
===Effect of the mail===
 
The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following:
 
<pre>
A7 and a ; Filler
A7 and a ; Reset carry flag
D4 B9 F8 call nc, $F8B9 ; Box names start at $D8BF/F8BF, setting the active box to box 1 will ensure we can safely slide through.
E1 pop hl ; Additional pop to clear return address of call to screen data
D1 pop de ; Set de to $0075, which holds value $00. Ensures that print function will end immediately after resuming
E8 FF add sp, -1 ; Fix the effect of increasing the stack pointer
F1 pop af ; a = $03
E0 9F ld ($FF9F), a ; Ensures return to ROM bank 3 after resuming execution
A7 and a ; Reset carry flag. Not strictly necessary, but added for safety for now
D0 ret nc
</pre>
 
===Effect of the setup box name code===
 
Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.
 
The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.
 
Separately, this code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
 
Lastly, the value of the first item ID in the main item pocket is overwritten so that it becomes a TM25.
 
<pre>
Box 1: $D8BF
AF xor a ; a = $00
D6 E8 sub $FF ; a = $18
EA D1 F8 ld ($F8D1), a
D6 F7 sub $F7 ; a = $21
50 ld d, b
 
Box 2: $D8C8
EA D0 F8 ld ($F8D0), a
D6 FF sub $FF ; a = $22
EA D6 F8 ld ($F8D6), a
21
 
Box 3: $D8D1
18 F4 ld hl, $F418
D6 83 sub $83 ; a = $9F
87 add a, a ; a = $3E, carry flag set
.write
22 ldi (hl), a
D0 ret nc ; Ignore on first pass, taken when .write called
FB ei
50 ld d, b
 
Box 4: D8DA
E6 84 and $84 ; a = $04
D4 D6 F8 call nc, .write
D6 87 sub $87 ; a = $7D
FB ei
50 ld d, b
 
Box 5: $D8E3
.loop
D6 FF sub $FF ; Increments a on each pass
EA EF F8 ld ($F8EF), a
F5 push af
F6 FF or $FF ; a = $FF
50 ld d, b
 
Box 6: $D8EC
FB ei
FB ei
EA xx F5 ld ($F5xx), a ; Ranges from $F57E to $F5AF, all 50 TMs
F1 pop af
FE AF cp $AF
50 ld d, b
 
 
Box 7: $D8F5
D2 FC F8 jp nc, .continue
A7 and a, a ; Reset carry flag
D2 E3 F8 jp nc, .loop
.continue
AF xor a, a
50 ld d, b
 
Box 8: $D8FE
F6 D2 and $D2 ; a = $D2, reset carry flag
D4 D6 F8 call nc, .write
D6 93 sub $93 ; a = $3F
87 add a, a ; a = $7E, reset carry flag
50 ld d, b
 
Box 9: $D907
D4 D6 F8 call nc, .write
D6 9D sub $9D ; a = $E1, TM33's item ID
EA B8 F5 ld (wItems), a ; Main item pocket, first item ID
50 ld d, b
 
Box 10: $D910
F6 F5 or $F5 ; a = $F5
D2 D6 F8 jp nc, .write
50 ld d, b
 
TM33 bootstrap, starting from $D418
3E 04 ld a, $04
D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25
</pre>
 
====Raw Assembly====
 
<pre>
AF D6 E8 EA D1 F8 D6 F7 50
EA D0 F8 D6 FF EA D6 F8 50
F4 F4 D6 83 87 87 D0 FB 50
E6 84 D4 D6 F8 D6 87 FB 50
D6 FF EA EF F8 F5 F6 FF 50
FB FB EA F5 F5 F1 FE AF 50
D2 FC F8 A7 D2 E3 F8 AF 50
F6 D2 D4 D6 F8 D6 93 87 50
D4 D6 F8 D6 9D EA B8 F5 50
F6 F5 D2 D6 F8 50 50 50 50
</pre>
 
===Effect of the TM code===
 
Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.
 
<pre>
11 55 DD ld de, $DD55
D5 push de
D5 push de ; .nextMail
D5 push de
21 42 62 ld hl, _ComposeMailMessage
CF rst08h, FarCall a:hl
E1 pop hl
D1 pop de
2A ldi a, (hl) ; .continue
FE 50 cp $50
38 FB jr c, .continue
28 0A jr z, .terminator
87 add a, a
86 add a, (hl)
12 ld (de), a
13 inc de
23 inc hl
81 add a, c
4F ld c, a
12 ld (de), a
18 EF jr .continue
21 01 C4 ld hl, $C401 ; .screenLoop
4D ld c, l
CD EF 3A call PrintBCDNumber.loop - 1
1B dec de ; .goBack
CD 90 37 call JoyTextDelay_ForcehJoyDown
BD cp a, l ; l = $04
28 D9 jr z, .nextMail
38 F0 jr c, .displayLoop
FE 08 cp $08
C8 ret z
18 F2 jr .goBack
</pre>
 
===Effect of the reset box name code===
 
Converting the characters from box names to assembly results in the following code. This code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
 
<pre>
Box 1: $D8BF
AF xor a ; a = $00
D6 E8 sub $FF ; a = $18
EA D1 F8 ld ($F8D1), a
D6 F7 sub $F7 ; a = $21
50 ld d, b
 
Box 2: $D8C8
EA D0 F8 ld ($F8D0), a
D6 FF sub $FF ; a = $22
EA D6 F8 ld ($F8D6), a
21
 
Box 3: $D8D1
18 F4 ld hl, $F418
D6 83 sub $83 ; a = $9F
.doubleAndWrite
87 add a, a ; a = $3E, carry flag set
.write
22 ldi (hl), a
D0 ret nc ; Ignore on first pass, taken when .write/.doubleAndWrite called
FB ei
50 ld d, b
 
Box 4: D8DA
E6 84 and $84 ; a = $04
D4 D6 F8 call nc, .write
AF xor a ; a = $00
F6 D2 or $D2 ; a = $D2
50 ld d, b
 
Box 5: $D8E3
D4 D6 F8 call nc, .write
D6 93 sub $93 ; a = $3F
D4 D5 F8 call nc, .doubleAndWrite
50 ld d, b
 
Box 6: $D8EC
AF xor a ; a = $00
F6 F5 or $F5 ; a = $F5
D2 D6 F8 jp nc, .write
50 ld d, b
 
TM33 bootstrap, starting from $D418
3E 04 ld a, $04
D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25
</pre>
 
====Raw Assembly====
 
<pre>
Now that you have set up everything, you should be able to use (nearly) all box name codes that are intended to be used with Wrong Pocket TM. In particular, you can use it to build and install a RAM writer program, which you can use to replace your current setup with one that can be used anywhere at any time.
AF D6 E8 EA D1 F8 D6 F7 50
EA D0 F8 D6 FF EA D6 F8 50
F4 F4 D6 83 87 87 D0 FB 50
E6 84 D4 D6 F8 AF F6 D2 50
D4 D6 F8 D6 93 D4 D5 F8 50
AF F6 E1 D2 D6 F8 50 50 50
</pre>
 
[[Category:Guides]]
In order to use the Coin Case ACE setup:
* Go to the Goldenrod pokémon center and rename box names according to the box name code you wish to execute.
* While still inside the Goldenrod pokémon center, make sure to save, then exit and take 4 steps to the right.
* Open the start menu, then listen to the cry of either Bellsprout/Machop.
* Go to the Pokémon menu and reread the abovementioned mail.
* Open the item bag, switch item pockets at least once, then use the Coin Case.

Latest revision as of 22:38, 4 July 2024

This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Coin Case glitch.

This page serves as a repository for a Coin Case ACE setup for the English versions of Pokémon Gold & Silver. It is part of the TimoVM's Gen 2 ACE setups set of guides.

The preparation is best done during daytime in-game. If needed, you can change the in-game clock with the help of this tool.

Please make sure to fully read every step of the guide before executing them.

If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.

Setting up initial ACE

When using the Coin Case while a Bellsprout/Machop's cry and specific newly loaded tiles are buffered in memory, the game will execute code in various places before finally ending up in the $FA98-$FA9B range, which is echo ram containing the stat exp data of party pokémon #3.

Using specific movement patterns in the Goldenrod Radio Tower, we can form a jump to $EEEE, which is echo ram for the second character of the last read mail. This gives us enough space to call the start of box names, then fix the side effects of using the Coin Case and return to normal game operation.

In practice, the initial Coin Case ACE setup will be created using the following general process:

  1. Obtain the Coin Case
  2. Give any pokémon a mail with specific content and set up a box name code
  3. Set up a specific movement pattern in the Goldenrod Radio Tower to be able to execute ACE

Step 1: Obtaining everything needed for the setup

  1. Go to Goldenrod City and obtain the Coin Case by picking it up in the Goldenrod Underground.
  2. After obtaining the Coin Case, go to the Game Corner.
    • If you do not have any coins yet, simply buy 100 coins.
    • If you already have coins stored in the coin case, make sure that the first digit of the total number of held coins equals "1".
  3. In the Goldenrod Dept. Store, buy a Flower Mail.
  4. For this guide, ensure that the first item in the main item pocket is an item you do not need, as we'll be overwriting it to a different item.

Now that we have the Coin Case, we'll need to set up everything needed to actually safely use it. Using a specific setup, we can force the Coin Case to execute code starting from the second character of the last read mail. From here, we need to ensure that we have the proper setup to execute box name codes.

  • Prepare box names to execute a certain effect and return safely to normal game operations. For the purposes of this guide, we'll use the box name in the next section.
  • Give any pokémon a flower mail with the following content:
 

Preparing the box name code

Rename the first 10 box names to the following names. This box name will do the following when executed as code:

  • Set quantities for all 50 TMs to x255
  • Alter the first item in the main item pocket to a TM33, which can be used to trigger ACE
  • Set up code so that using TM33 will execute the data stored in TM quantities
 

Step 2: Using Coin Case ACE

In order to use Coin Case ACE, always perform the following steps: 

 

 
  • Make sure to set box 1 as the current active box.
  • Go to the Goldenrod Radio Tower and take the stairs up to the second floor. Move to the spot indicated by the above screenshot on the left. Save the game while you're still standing on this spot and reset the game.
  • After reloading, take the following steps until you reach the spot indicated by the above screenshot on the left:
    1. 3 steps rightwards
    2. 2 steps upwards
    3. 1 step leftwards
  • Open the start menu, open the pokédex, then listen to the cry of Bellsprout.
  • Go to the Pokémon menu and read the previously mentioned mail.
  • Open the item bag, switch item pockets at least once, then use the Coin Case. ACE will be executed when the coin count displays on the screen.

With the current box name setups, you can verify that the setup is working by checking the TM/HM pocket. The first item in the main item pocket should be altered to a TM33, in the TM/HM pocket you can now find all TMs, each having a quantity of x255. Do not use this TM33 yet! This TM will allow us to execute the contents of the TM/HM pocket as code, but due to the specific quantities currently present it will be guaranteed to crash the game.

Anytime you wish to execute wrong pocket Coin Case ACE, you'll need to repeat the steps outlined at the beginning of this section. Always make sure the held mail was read before using the Coin Case and ensure that a valid box name code was prepared beforehand.

Troubleshooting

If the code crashes, check the following:

  • Did you correctly follow the previous steps?
  • Is the current active box set to box 1?
  • Make sure that the first digit of the total amount of coins is equal to "1". 100 is a good total for this setup.
  • Is the box name code correctly entered?
  • Is the content of the mail correct?

A small note on the box names

Due to the limited characterset, the box name code rewrites part of itself to be able to achieve its effect. This will cause the box names to appear glitched after executing Coin Case ACE once.

While this looks weird, this is completely intentional and harmless. The code can still be used again if needed, you can easily fix this issue by renaming the box names to a normal name.

Setting up an ACE environment

While we have a way to execute box name codes using ACE, the current setup has a few drawbacks:

  • Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.
  • Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.

To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.

When TMs are used outside of the TM/HM pocket, the game will incorrectly attempt to search its item effect in the list of normal item effects. This causes the game to interpret garbage data as item effect pointers, for some TMs this allows us to execute ACE. This is known as Wrong Pocket TM ACE. The advantage of TM33 is that it can be used without requiring specific party/item/box/mail setups.

We've already given ourselves 255 copies of every TM, along with a method to execute the contents of the TM/HM contents in the form of TM33. In this part, we'll sell TMs in specific quantities to write out a program. Once this has been done, we can simply use TM33 to start up the MailWriter.

The mail writer itself will be installed through the following two step process:

  1. Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
  2. Use TM33 to activate the mail writer program, allowing us to quickly write out and execute a variety of ACE effects.
  3. improve the setup by executing a small code to move the mail writer program to unused memory, freeing up the TM pocket for our own use.

Step 3: Selling TMs to form a program in the TM/HM pocket

Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program.

The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them. 

 

TM Quantities to sell

TM Final Quantity Sell value
TM01 DYNAMICPUNCH x17 357000
TM02 HEADBUTT x85 170000
TM03 CURSE x221 51000
TM04 ROLLOUT x213 42000
TM05 ROAR x213 21000
TM06 TOXIC x213 63000
TM07 ZAP CANNON x33 222000
TM08 ROCK SMASH x66 94500
TM09 PSYCH UP x98 78500
TM10 HIDDEN POWER x207 72000
TM11 SUNNY DAY x225 30000
TM12 SWEET SCENT x209 23000
TM13 SNORE x42 106500
TM14 BLIZZARD x254 1500
TM15 HYPER BEAM x80 262500
TM16 ICY WIND x56 298500
TM17 PROTECT x251 6000
TM18 RAIN DANCE x40 215000
TM19 GIGA DRAIN x10 367500
TM20 ENDURE x135 180000
TM21 FRUSTRATION x134 60500
TM22 SOLARBEAM x18 355500
TM23 IRON TAIL x19 354000
TM24 DRAGONBREATH x35 330000
TM25 THUNDER x129 126000
TM26 EARTHQUAKE x79 264000
TM27 RETURN x18 118500
TM28 DIG x24 231000
TM29 PSYCHIC x239 16000
TM30 SHADOW BALL x33 333000
TM31 MUD-SLAP x1 381000
TM32 DOUBLE TEAM x196 59000
TM33 ICE PUNCH x77 267000
TM34 SWAGGER x205 25000
TM35 SLEEP TALK x239 8000
TM36 SLUDGE BOMB x58 98500
TM37 SANDSTORM x27 228000
TM38 FIRE BLAST x205 50000
TM39 SWIFT x144 111000
TM40 DEFENSE CURL x55 100000
TM41 THUNDERPUNCH x189 99000
TM42 DREAM EATER x40 322500
TM43 DETECT x217 19000
TM44 REST x56 298500
TM45 ATTRACT x240 22500
TM46 THIEF x254 1500
TM47 STEEL WING x08 370500
TM48 FIRE PUNCH x200 82500
TM49 FURY CUTTER x24 346500
TM50 NIGHTMARE x242 13000

Running the newly written program

  1. It is recommended to save before continuing.
  2. Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
  3. From now on, you can repeat this process at any time to start the mail writer.

Since we aren't planning on using the Coin Case anymore, the mail that was previously give to a pokémon can be removed. It is no longer relevant for the remainder of the setup.

Troubleshooting & repairing TM33

If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code:

Please mind the differences between uppercase X ( ), lowercase x ( ) and multiplication symbol ( ). 

 

To execute this box name code, repeat the process for Coin Case ACE:

  • Read the mail previously given to a party pokémon.
  • Go to the Goldenrod Radio Tower and follow the correct steps to finish the setup.
  • Use the Coin Case to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly.
  • If the code executes succesfully without crashing the game, TM33's functionality has now been repaired.

Step 4: Using the mail writer

From now on, simply use TM33 to start up the mail writer.

The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.

This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.

Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer. 

 

Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.

Controls

Between entering mail codes, the mail writer will ask for user input.

  • Press SELECT to open a new mail and continue writing data.
  • Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
  • Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
   
Enter your mail code, then press "END". It prints the checksum and waits for input.

Step 5: Improving the setup

Since the mail writer is written using TM quantities, using or gaining TMs will break the mail writer. Because of this, we'll use the mail writer to execute a small code that achieves the following:

  • Copies the mail writer to unused memory
  • Overwrite the existing quantities in the TM/HM pocket to x1 for every TM
  • Alter TM33's underlying code to execute the mail writer in unused memory

You can use the mail code converter page as follows:

  • Copy the code in the table below
  • Follow the link at the top of the table to the mail code converter
  • Paste the code in the text box on the code converter's page
  • Select the correct language and version
  • Click on the "Run" button to display the mails you need to enter
Codes to be used with TimoVM's MailConverter
Language Gold & Silver
English 
01 32 00 11 F2 D6 21 1B D4 73 23 72 3E 3E 12 13
3E 04 12 13 21 7E D5 E5 CD 1A 31 3E 01 0E 32 E1
C3 4C 31

After executing this code, attempt to start up the mail writer. If you are able to open it and are able to successfully execute the following blank mail, the copy has finished successfully and you can save the game. 

 

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

  • Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..
  • RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it. WARNING: THE RAM WRITER SETUP FOR GOLD/SILVER IS CURRENTLY BEING REDESIGNED. PLEASE DO NOT INSTALL YET.

Appendix

Plain text transcripts of codes

Language English
Mail 
h h 's z 2 Pk 'l 0 9 ♀ . 9 Pk * ' ] 
h 'd
Setup box name 
Box 1: p 'v . é 'l 2 'v 1
Box 2: é 'd 2 'v 9 é 'v 2
Box 3: , , 'v D H H 'd 5
Box 4: ? E 's 'v 2 'v H 5
Box 5: 'v 9 é ♂ 2 ♀ 0 9
Box 6: 5 5 é ♀ ♀ * 8 p
Box 7: 'm 6 2 h 'm - 2 p
Box 8: 0 'm 's 'v 2 'v T H
Box 9: 's 'v 2 'v ; é y ♀
Box 10: 0 ♀ 'm 'v 2
Reset box name 
Box 1: p 'v . é 'l 2 'v 1
Box 2: é 'd 2 'v 9 é 'v 2
Box 3: , , 'v D H H 'd 5
Box 4: ? E 's 'v 2 p 0 'm
Box 5: 's 'v 2 'v T 's 't 2
Box 6: p 0 ♀ 'm 'v 2

In-depth explanation of the setup

Effect of the Coin Case

Activating the Coin Case causes arbitrary code execution from $E112 onward, which is echo ram for $C112. This region corresponds with sound data and can be manipulated by buffering pokémon cries.

Playing Bellsprout or Machop's cry will buffer $33 at $C117. This opcode increments the stack pointer, desyncing the stack.

The sound that plays when swapping item pockets clears some bad data around the $C16x region. It also places a $C1 at $C16E, popping a value from the stack to registers bc.

The sound that plays when confirming the use of the Coin Case places $80 A1 D0 at $C192. Due to prior opcodes setting the value of register bc to $0000, the condition for the return will always be true. Thanks to incrementing the stack pointer and popping the stack once, the next return address will redirect execution to $EB12, echo ram for $CB12.

From $CB12, the game will nopslide until $CC20 is reached. This region contains data on buffered tiles that are added when the player moves around . Due to our specific movement pattern within the Goldenrod Radio Tower, this results in the following data, starting from $CC20: 

At start, hl = $B2B2 and sp : $DFBC

39		add sp		; hl = $926E
39		add sp		; hl = $722A
39		add sp		; hl = $51E6
39		add sp		; hl = $31A2
39		add sp		; hl = $115E
39		add sp		; hl = $F11A
39		add sp		; hl = $D0D6
39		add sp		; hl = $B092
39		add sp		; hl = $904E
39		add sp		; hl = $700A
39		add sp		; hl = $4FC6
39		add sp		; hl = $2F82, carry flag set
30 31		jr nc, $31	; Ignore thanks to previous carry
1A		ld a, (de)
1B		dec de
1A		ld a, (de)
1B		dec de
0A		ld a, (bc)
0B		dec bc
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 39 39	ld bc, $3939
39		add sp		; hl = $0F3E
39		add sp		; hl = $EEFA, desired result in h, zero flag set
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 00 00	ld bc, $0000
00		nop
00		nop
84		add h
9B		sbc e
A4		and h
9B		scb e		; The result of these arithmatic opcodes aren't relevant, but they do reset the zero flag
C4 9B E4	call nz, $E49B	; Corresponds to lower parts of screen tile data

The main result of this region is to set h to $EE, followed by a call to screen tile data.

Before ACE is triggered, the game will already print the amount of coins on screen. In particular, a number of coins whose first digit is equal to 1 will lead to $F7 (rst30h) being printed to $C4E1. The region between $C49B and $C4E1 is filled with harmless data consisting of blank tiles ($7F), textbox tiles ($7A-$7C) and arithmatic opcodes for the "Coins:" text ($82 AE A8 AD B2 9C). The end result is that a is set to be equal to $EE, the value stored in h, right before rst30h is activated.

rst30h is technically an unused reset vector, but accidentally contains the last three bytes of JumpTable function, usually accessed by rst28h: 

6F		ld l, a		; hl = $EEEE
D1		pop de		; Pops the return address to registers de
E9		jp hl		; Jump to $EEEE, the second character of the last read mail

This allows us to finally reach the last read mail, a region of memory that we have a good amount of control over.

Effect of the mail

The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following: 

A7		and a		; Filler
A7		and a		; Reset carry flag
D4 B9 F8	call nc, $F8B9	; Box names start at $D8BF/F8BF, setting the active box to box 1 will ensure we can safely slide through. 
E1		pop hl		; Additional pop to clear return address of call to screen data
D1		pop de		; Set de to $0075, which holds value $00. Ensures that print function will end immediately after resuming
E8 FF		add sp, -1	; Fix the effect of increasing the stack pointer
F1		pop af		; a = $03
E0 9F		ld ($FF9F), a	; Ensures return to ROM bank 3 after resuming execution
A7		and a		; Reset carry flag. Not strictly necessary, but added for safety for now
D0		ret nc

Effect of the setup box name code

Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.

The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.

Separately, this code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.

Lastly, the value of the first item ID in the main item pocket is overwritten so that it becomes a TM25. 

Box 1: $D8BF
AF		xor a		; a = $00
D6 E8		sub $FF		; a = $18
EA D1 F8	ld ($F8D1), a
D6 F7		sub $F7		; a = $21
50		ld d, b

Box 2: $D8C8
EA D0 F8	ld ($F8D0), a
D6 FF		sub $FF		; a = $22
EA D6 F8	ld ($F8D6), a
21

Box 3: $D8D1
   18 F4	ld hl, $F418
D6 83		sub $83		; a = $9F
87		add a, a	; a = $3E, carry flag set
.write
22		ldi (hl), a
D0		ret nc		; Ignore on first pass, taken when .write called
FB		ei
50		ld d, b

Box 4: D8DA
E6 84		and $84		; a = $04
D4 D6 F8	call nc, .write
D6 87		sub $87		; a = $7D
FB		ei
50		ld d, b

Box 5: $D8E3
.loop
D6 FF		sub $FF		; Increments a on each pass
EA EF F8	ld ($F8EF), a
F5		push af
F6 FF		or $FF		; a = $FF
50		ld d, b

Box 6: $D8EC
FB		ei
FB		ei
EA xx F5	ld ($F5xx), a	; Ranges from $F57E to $F5AF, all 50 TMs
F1		pop af
FE AF		cp $AF
50		ld d, b


Box 7: $D8F5
D2 FC F8	jp nc, .continue
A7		and a, a	; Reset carry flag
D2 E3 F8	jp nc, .loop
.continue
AF		xor a, a
50		ld d, b

Box 8: $D8FE
F6 D2		and $D2		; a = $D2, reset carry flag
D4 D6 F8	call nc, .write
D6 93		sub $93		; a = $3F
87		add a, a	; a = $7E, reset carry flag
50		ld d, b

Box 9: $D907
D4 D6 F8	call nc, .write
D6 9D		sub $9D		; a = $E1, TM33's item ID
EA B8 F5	ld (wItems), a	; Main item pocket, first item ID
50		ld d, b

Box 10: $D910
F6 F5		or $F5		; a = $F5
D2 D6 F8	jp nc, .write
50		ld d, b

TM33 bootstrap, starting from $D418
3E 04		ld a, $04
D2 7E F5	jp nc, wTMsHMS	; Carry and zero flag are both reset when using TM25

Raw Assembly

 AF D6 E8 EA D1 F8 D6 F7 50
 EA D0 F8 D6 FF EA D6 F8 50
 F4 F4 D6 83 87 87 D0 FB 50
 E6 84 D4 D6 F8 D6 87 FB 50
 D6 FF EA EF F8 F5 F6 FF 50
 FB FB EA F5 F5 F1 FE AF 50
 D2 FC F8 A7 D2 E3 F8 AF 50
 F6 D2 D4 D6 F8 D6 93 87 50
 D4 D6 F8 D6 9D EA B8 F5 50
 F6 F5 D2 D6 F8 50 50 50 50

Effect of the TM code

Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work. 

11 55 DD	ld de, $DD55
D5		push de
D5		push de		; .nextMail
D5		push de
21 42 62	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C4	ld hl, $C401	; .screenLoop
4D		ld c, l
CD EF 3A	call PrintBCDNumber.loop - 1
1B		dec de		; .goBack
CD 90 37	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Effect of the reset box name code

Converting the characters from box names to assembly results in the following code. This code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer. 

Box 1: $D8BF
AF		xor a		; a = $00
D6 E8		sub $FF		; a = $18
EA D1 F8	ld ($F8D1), a
D6 F7		sub $F7		; a = $21
50		ld d, b

Box 2: $D8C8
EA D0 F8	ld ($F8D0), a
D6 FF		sub $FF		; a = $22
EA D6 F8	ld ($F8D6), a
21 

Box 3: $D8D1
   18 F4	ld hl, $F418
D6 83		sub $83		; a = $9F
.doubleAndWrite
87		add a, a	; a = $3E, carry flag set
.write
22		ldi (hl), a
D0		ret nc		; Ignore on first pass, taken when .write/.doubleAndWrite called
FB		ei
50		ld d, b

Box 4: D8DA
E6 84		and $84		; a = $04
D4 D6 F8	call nc, .write
AF			xor a	; a = $00
F6 D2		or $D2		; a = $D2
50		ld d, b

Box 5: $D8E3
D4 D6 F8	call nc, .write
D6 93		sub $93		; a = $3F
D4 D5 F8	call nc, .doubleAndWrite
50		ld d, b

Box 6: $D8EC
AF			xor a	; a = $00
F6 F5		or $F5		; a = $F5
D2 D6 F8	jp nc, .write
50		ld d, b

TM33 bootstrap, starting from $D418
3E 04		ld a, $04
D2 7E F5	jp nc, wTMsHMS	; Carry and zero flag are both reset when using TM25

Raw Assembly

 AF D6 E8 EA D1 F8 D6 F7 50
 EA D0 F8 D6 FF EA D6 F8 50
 F4 F4 D6 83 87 87 D0 FB 50
 E6 84 D4 D6 F8 AF F6 D2 50
 D4 D6 F8 D6 93 D4 D5 F8 50
 AF F6 E1 D2 D6 F8 50 50 50
Retrieved from "https://glitchcity.wiki/wiki/Guides:Coin_Case_ACE?oldid=44421"