Guides:Coin Case ACE: Difference between revisions

(32 intermediate revisions by the same user not shown)

Line 18:

# Give any pokémon a mail with specific content and set up a box name code

# Set up a specific movement pattern in the Goldenrod Radio Tower to be able to execute ACE

# Execute a code that gives us 255 of every TM, along with a different, more convenient ACE method.

==Step 1: Obtaining everything needed for the setup==

# Catch any pokémon and nickname it "MAILWRITER".

# Go to Goldenrod City and obtain the Coin Case by picking it up in the Goldenrod Underground.

# After obtaining the Coin Case, go to the Game Corner.

Line 27:

#* If you already have coins stored in the coin case, make sure that the first digit of the total number of held coins equals "1".

# In the Goldenrod Dept. Store, buy a Flower Mail.

# For this guide, '''ensure that the first item in the main item pocket is an item you do not need''', as we'll be overwriting it to a different item.

==Step 2: How to execute ACE using the Coin Case==

Now that we have the Coin Case, we'll need to set up everything needed to actually safely use it. Using a specific setup, we can force the Coin Case to execute code starting from the second character of the last read mail. From here, we need to ensure that we have the proper setup to execute box name codes.

* Prepare box names to execute a certain effect and return safely to normal game operations. For the purposes of this guide, we'll use the box name in the next section.

* Prepare a mail to ensure that a box name code can be executed

* Give any pokémon a flower mail with the following content:

* Prepare specific box names to run a simple test code.

===Finishing the setup===

#Arrange your party like the following:

## Any

## "MAILWRITER" nicknamed Pokémon

## Any

# Finally, give the "MAILWRITER" nicknamed pokémon a flower mail with the following content:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

Line 50:

Line 38:

|}

===Preparing the box name code===

Note: there is nothing unique about the MAILWRITER pokémon that requires it to be in the 3rd party slot. Later parts of the setup will, however, write data to the MAILWRITER pokémon, so it's convenient to keep it in the third party slot for now.

Rename the first 10 box names to the following names. This box name will do the following when executed as code:

===Preparing a test box name code===

* Set quantities for all 50 TMs to x255

* Alter the first item in the main item pocket to a TM33, which can be used to trigger ACE

Rename the first box name to the following name. This box name code will be replaced later and is solely intended to verify if the setup is working correctly. Their only function is to safely exit ACE and return the game to normal:

* Set up code so that using TM33 will execute the data stored in TM quantities

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:~~Coin~~ ~~Case~~ ~~ACE~~ ~~tester box name~~.png~~|frameless~~]]

[[File:Box English GS Setup.png]]

|}

==Step 3: Using Coin Case ACE==

==Step 2: Using Coin Case ACE==

In order to use ACE, always perform the following steps:

In order to use Coin Case ACE, always perform the following steps:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:EN Coin Case ACE start.png]]

||

[[File:EN Coin Case ACE end.png]]

|}

* '''Make sure to set box 1 as the current active box.'''

Line 73:

Line 69:

* Open the start menu, open the pokédex, then listen to the cry of Bellsprout.

* Go to the Pokémon menu and read the previously mentioned mail.

* Open the item bag, switch item pockets at least once, then use the Coin Case. ~~This~~ will ~~execute~~ ~~ACE~~.

* Open the item bag, switch item pockets at least once, then use the Coin Case. ACE will be executed when the coin count displays on the screen.

~~Make sure to test the setup by going through this process once.~~ With the current box name setups, you can verify that the setup is working by checking the TM/HM pocket. The ~~quantity~~ of ~~TM03~~ ~~should~~ ~~now~~ be ~~255.~~ ~~You~~ can now ~~continue~~ to the ~~next~~ ~~guide~~.

With the current box name setups, you can verify that the setup is working by checking the TM/HM pocket. The first item in the main item pocket should be altered to a TM33, in the TM/HM pocket you can now find all TMs, each having a quantity of x255. '''Do not use this TM33 yet! This TM will allow us to execute the contents of the TM/HM pocket as code, but due to the specific quantities currently present it will be guaranteed to crash the game.'''

Anytime you wish to execute wrong pocket Coin Case ACE, you'll need to repeat the steps outlined at the beginning of this section. Always make sure the held mail was read before using the Coin Case and ensure that a valid box name code was prepared beforehand.

If the test code crashes, check the following:

===Troubleshooting===

If the code crashes, check the following:

* Did you correctly follow the previous steps?

* Is the current active box set to box 1?

Line 84:

* Is the content of the mail correct?

===A small note on the box names===

'''Anytime you wish to execute wrong pocket Coin Case ACE, you'll need to repeat the steps outlined at the beginning of this section. Always make sure the held mail was read before using the Coin Case and ensure that a valid box name code was prepared beforehand.'''

Due to the limited characterset, the box name code rewrites part of itself to be able to achieve its effect. This will cause the box names to appear glitched after executing Coin Case ACE once.

While this looks weird, this is completely intentional and harmless. The code can still be used again if needed, you can easily fix this issue by renaming the box names to a normal name.

=Setting up an ACE environment=

While we ~~now~~ have a way to execute box name codes using ACE, the current setup has a few drawbacks:

While we have a way to execute box name codes using ACE, the current setup has a few drawbacks:

* Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.

* Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.

Line 94:

Line 98:

To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.

When TMs are used outside of the TM/HM pocket, the game will incorrectly attempt to search its item effect in the list of normal item effects. This causes the game to interpret garbage data as item effect pointers, for some TMs this allows us to execute ACE. This is known as Wrong Pocket TM ACE. The advantage of TM33 is that it can be used without requiring specific party/item/box/mail setups.

To do that, we're going to use a box name code to obtain 255 copies of all TMs, then sell them in specific quantities to write out a program. Alongside that, the box name code will also add a TM25 to the main item pocket. Using this TM25, outside of the TM/HM pocket, will allow us to execute the Mail Writer at any time as long as a specific pokémon is kept in the second party slot.

We've already given ourselves 255 copies of every TM, along with a method to execute the contents of the TM/HM contents in the form of TM33. In this part, we'll sell TMs in specific quantities to write out a program. Once this has been done, we can simply use TM33 to start up the MailWriter.

The mail writer itself will be installed ~~in the TM/HM pocket~~ through the following two step process:

The mail writer itself will be installed through the following two step process:

# Execute a box code using Coin Case ACE that sets the quantities of all 50 TMs to x255, as well as placing a TM25 in the main item pocket. On top of that, it will modify the data of party pokémon #3 so that they allow TM25 to be safely used, as long as it is kept in the second party slot.

# Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.

# Use TM33 to activate the mail writer program, allowing us to quickly write out and execute a variety of ACE effects.

# improve the setup by executing a small code to move the mail writer program to unused memory, freeing up the TM pocket for our own use.

==Step 4: ~~Setting~~ ~~all~~ TM ~~quantities~~ to ~~x255~~==

==Step 3: Selling TMs to form a program in the TM/HM pocket==

Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program.

* Rename box names to form the following. '''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:Setup box code GSEN.png]]

|}

* Catch any pokémon and nickname it "MAILWRITER". '''Put it in the fifth party slot'''. We'll alter this pokémon's stat experience to redirect TM25 execution to the TM/HM pocket.

* Ensure that you have everything set up for Coin Case ACE:

** "MAILWRITER" nicknamed pokémon holding mail in party slot #3

** Read the correct mail beforehand

** Perform all steps necessary to execute Coin Case ACE

* Use the Coin Case once. If the code was executed successfully, switch to the TM/HM pocket. '''It should now contain every TM at a quantity of x255. The code will also overwrite the first item in the main item pocket to be a TM25.'''

==Step 5: Selling TMs to form a program in the TM/HM pocket==

Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using.

The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.

Line 204:

Line 193:

|TM35 SLEEP TALK ||x239 ||8000

|-

|TM36 SLUDGE BOMB ||x58 ||~~98000~~

|TM36 SLUDGE BOMB ||x58 ||98500

|-

|TM37 SANDSTORM ||x27 ||228000

Line 238:

Line 227:

# It is recommended to save before continuing.

# Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.

# Put the pokémon that was nicknamed "MAILWRITER" into the 2nd party slot.

# Due to limitations, there is no in-built option to safely exit the mail writer. Instead, you can safely exit by typing the below mail, selecting END on the mail screen, then pressing START to execute the mail.

# Use TM25. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.

# From now on, you can repeat this process at any time to start the mail writer.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for the "MAILWRITER" pokémon. This can be done using the box codes included a bit further below.

|

[[File:Mail_English_GS_Rh.png]]

|}

From now on, you can repeat this process at any time to start the mail writer. Since we aren't planning on using the Coin Case anymore, the mail that was previously give to a pokémon can be removed. It is no longer relevant for the remainder of the setup.

A note on the nicknamed pokémon: when running the box name code, we altered "MAILWRITER"'s stat experience data to contain a redirect to the TM/HM pocket. You can safely deposit and withdraw it from the PC. '''Please note that this pokémon must never gain experience after this point, otherwise you'll need to reapply the setup.'''

'''The next section will elaborate on the usage of the Mail Writer. Please read these instructions carefully before proceeding.'''

==Step 6: Using the mail writer==

===Troubleshooting & repairing TM33===

'''From now on, simply go through the necessary steps to use TM25 to start up the RAM writer.'''

If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code:

'''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:Reset box code GSEN.png]]

|}

To execute this box name code, repeat the process for Coin Case ACE:

* Read the mail previously given to a party pokémon.

* Go to the Goldenrod Radio Tower and follow the correct steps to finish the setup.

* Use the Coin Case to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly.

* If the code executes succesfully without crashing the game, TM33's functionality has now been repaired.

==Step 4: Using the mail writer==

'''From now on, simply use TM33 to start up the mail writer.'''

The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.

Line 255:

Line 264:

Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. '''If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.'''

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:Mail_English_GS_Rh.png]]

|}

Assembly can easily be converted to mail codes using [https://timovm.github.io/MailConverter/ TimoVM's MailConverter]. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.

Line 271:

Line 285:

|}

==~~What~~ to ~~do with~~ the ~~Mail writer~~==

==Step 5: Improving the setup==

Since the mail writer is written using TM quantities, using or gaining TMs will break the mail writer. Because of this, we'll use the mail writer to execute a small code that achieves the following:

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

* Copies the mail writer to unused memory

* [[User:TimoVM/Mail Writer Codes|Mail codes]]: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..

* Overwrite the existing quantities in the TM/HM pocket to x1 for every TM

* [[User:TimoVM/RAM Writer|RAM writer]]: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.

* Alter TM33's underlying code to execute the mail writer in unused memory

You can use the mail code converter page as follows:

* Copy the code in the table below

* Follow the link at the top of the table to the mail code converter

* Paste the code in the text box on the code converter's page

* Select the correct language and version

* Click on the "Run" button to display the mails you need to enter

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

=Addendum: repairing the "MAILWRITER" pokémon=

|+ Codes to be used with [https://timovm.github.io/MailConverter/ TimoVM's MailConverter]

|-

! Language !! Gold & Silver

|-

! scope="row"| English

||

11 F2 D6 21 1B D4 73 23 72 2E 18 2A 12 13 2A 12

13 21 7E D5 E5 CD 23 12 3E 01 0E 32 E1 C3 4C 31

|}

After executing this code, attempt to start up the mail writer. If you are able to open it and are able to successfully execute the following blank mail, the copy has finished successfully and you can save the game.

In case something happens with the "MAILWRITER" nicknamed pokémon that causes it to no longer function, you can repair the pokémon without having to reset TM quantities using the following procedure:

* Arrange the party as follows:

*# Any

*# "BOXCODES" pokémon holding mail

*# Any

*# "MAILWRITER" pokémon

*# Any

* Enter the following language-specific box name. '''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:~~Reset box code GSEN~~.png]]

[[File:Mail_English_GS_Rh.png]]

|}

==What to do with the Mail writer==

* Read the mail held by the "BOXCODES" pokémon

* Go to any pokémon center and follow the correct steps until you reach the correct location

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

* Use the Coin Case to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly

* [[User:TimoVM/Mail Writer Codes|Mail codes]]: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..

* If the code executes succesfully without crashing the game, the "MAILWRITER" nicknamed pokémon has now been repaired.

* [[User:TimoVM/RAM Writer|RAM writer]]: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI.

=Appendix=

Line 309:

Line 331:

! scope="row" | Mail

||

<pre>A A A A A A A A A A A A A A A A

<pre>h h 's z 2 Pk 'l 0 9 ♀ . 9 Pk * ' ]

h 'd</pre>

A A p 'v 7 ' ] . 9 'l 'l 'l p 'm z 2</pre>

|-

! scope="row" | Test box name

||

<pre>0 9 é A ♀ h 'd [SPACE]</pre>

|-

! scope="row" | Setup box name

||

Box 1: A p é 3 2 'v ~~9 5~~

Box 1: p 'v . é 'l 2 'v 1

Box 2: é 1 2 'v 'd é 6 2

Box 2: é 'd 2 'v 9 é 'v 2

Box 3: ~~? b é~~ , 2 'v ♂ 5

Box 3: , , 'v D H H 'd 5

Box 4: é 2 2 'v ? é 5 2

Box 4: ? E 's 'v 2 'v H 5

Box 5: ? E é 5 4 'v G 5

Box 5: 'v 9 é ♂ 2 ♀ 0 9

Box 6: é ~~♀ 2~~ é 7 4 0 9

Box 6: 5 5 é ♀ ♀ * 8 p

Box 7: ♀ ♀ ♀ ~~♀ ♀~~ 's ♀ ♀

Box 7: 'm 6 2 h 'm - 2 p

Box 8: ? 'm é 6 4 'v 4 5

Box 8: 0 'm 's 'v 2 'v T H

Box 9: é y ♀ 'v - é 8 4

Box 9: 's 'v 2 'v ; é y ♀

Box 10: 'v x é 4 ~~4 'd~~

Box 10: 0 ♀ 'm 'v 2

|-

! scope="row" | Reset box name

||

Box 1: A p 'v 6 é ) 4 5

Box 1: p 'v . é 'l 2 'v 1

Box 2: 'v G é ~~; 4~~ 'v ~~J 5~~

Box 2: é 'd 2 'v 9 é 'v 2

Box 3: é ~~[ 4~~ 'v x é ( 4

Box 3: , , 'v D H H 'd 5

Box 4: H 'v ~~z é~~ : 4 h 'd

Box 4: ? E 's 'v 2 p 0 'm

Box 5: 's 'v 2 'v T 's 't 2

Box 6: p 0 ♀ 'm 'v 2

|}

Line 341:

Line 361:

===Effect of the Coin Case===

Activating the Coin Case causes arbitrary code execution from $E112 onward, which is echo ram for $C112. This region corresponds with sound data and can be manipulated by buffering pokémon cries.

The effects of the Coin Case are described in more detail on the following [http://Coin%20Case%20glitches#cause wiki page]. Relevant to this setup is that the setup will redirect execution to address $FA98 (echo ram copy of $DA98), which is in the middle of party pokémon #3's stat experience data. During this redirection, the stack pointer gets incremented once and an address gets popped from the stack. The global effect is that the stack pointer is decremented once compared to when the Coin Case was used.

Playing Bellsprout or Machop's cry will buffer $33 at $C117. This opcode increments the stack pointer, desyncing the stack.

===Effect of party pokémon #3===

The sound that plays when swapping item pockets clears some bad data around the $C16x region. It also places a $C1 at $C16E, popping a value from the stack to registers bc.

Defeating the provided list of pokémon will result in the following values at the following addresses, assuming the pokémon is in party slot #3:

The sound that plays when confirming the use of the Coin Case places $80 A1 D0 at $C192. Due to prior opcodes setting the value of register bc to $0000, the condition for the return will always be true. Thanks to incrementing the stack pointer and popping the stack once, the next return address will redirect execution to $EB12, echo ram for $CB12.

From $CB12, the game will nopslide until $CC20 is reached. This region contains data on buffered tiles that are added when the player moves around . Due to our specific movement pattern within the Goldenrod Radio Tower, this results in the following data, starting from $CC20:

<pre>

At start, hl = $B2B2 and sp : $DFBC

DA95 00 nop

DA96 75 ld [hl], l

39 add sp ; hl = $926E

DA97 00 nop

39 add sp ; hl = $722A

DA98 94 sub a, h

39 add sp ; hl = $51E6

DA99 00 nop

39 add sp ; hl = $31A2

DA9A C3

39 add sp ; hl = $115E

DA9B 00

39 add sp ; hl = $F11A

DA9C CF jp $CF00

39 add sp ; hl = $D0D6

DA9D 00 nop

~~DA9E~~ 6E ld l, [hl]

39 add sp ; hl = $B092

39 add sp ; hl = $904E

39 add sp ; hl = $700A

39 add sp ; hl = $4FC6

39 add sp ; hl = $2F82, carry flag set

30 31 jr nc, $31 ; Ignore thanks to previous carry

1A ld a, (de)

1B dec de

1A ld a, (de)

1B dec de

0A ld a, (bc)

0B dec bc

01 01 01 ld bc, $0101

01 39 39 ld bc, $3939

39 add sp ; hl = $0F3E

39 add sp ; hl = $EEFA, desired result in h, zero flag set

00 nop

01 01 01 ld bc, $0101

01 00 00 ld bc, $0000

00 nop

84 add h

9B sbc e

A4 and h

9B scb e ; The result of these arithmatic opcodes aren't relevant, but they do reset the zero flag

C4 9B E4 call nz, $E49B ; Corresponds to lower parts of screen tile data

</pre>

The main result of this region is to set h to $EE, followed by a call to screen tile data.

Executing Coin Case at the location described in the setup will cause execution to jump to $DA98. It will then harmlessly slide through the sub a, h and nop instructions, after which execution will jump to $CF00, which is in the middle of the last buffered mail.

Before ACE is triggered, the game will already print the amount of coins on screen. In particular, a number of coins whose first digit is equal to 1 will lead to $F7 (rst30h) being printed to $C4E1. The region between $C49B and $C4E1 is filled with harmless data consisting of blank tiles ($7F), textbox tiles ($7A-$7C) and arithmatic opcodes for the "Coins:" text ($82 AE A8 AD B2 9C). The end result is that a is set to be equal to $EE, the value stored in h, right before rst30h is activated.

===Effect of the mail===

rst30h is technically an unused reset vector, but accidentally contains the last three bytes of JumpTable function, usually accessed by rst28h:

The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following:

<pre>

6F ld l, a ; hl = $EEEE

80 add a, b

D1 pop de ; Pops the return address to registers de

80 add a, b

E9 jp hl ; Jump to $EEEE, the second character of the last read mail

80 add a, b

4E ld c, (hl) ; Newline control character.

80 add a, b

AF xor a ; Located at $CF00, all values before this address are filler and will not be executed.

D6 FD sub $FD ; Set a to $03.

E0 9F ld (hRomBank), a; Set current ROM bank to bank 3. This ROM bank contains item and pack data and ensures safe return.

E8 FF add sp, $FF ; $FF is interpreted as a singed integer, stack pointer gets decremented and the stack is now properly aligned again.

D1 pop de

D1 pop de ; Pop text command related addresses so that returning from ACE execution will resume normal game operation.

AF xor a ; Set a to $00, set carry flag to 0.

D2 B9 F8 jp nc, $F8B9 ; Jump to echo ram copy of $D8B9, which lies a few bytes before box data.

</pre>

This allows us to finally reach the last read mail, a region of memory that we have a good amount of control over.

===Effect of the test box name code===

===Effect of the mail===

Box name data starts from $D8BF onward. Converting the provided mail code to assembly results in the following:

The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following:

<pre>

A7 and a ; Filler

F6 FF or $FF ; Set a to $FF, set carry flag to 0.

A7 and a ; Reset carry flag

EA 80 F5 ld (F580), a ; $F580 is an echo ram copy of $D580, which corresponds to TM03's quantity.

D4 B9 F8 call nc, $F8B9 ; Box names start at $D8BF/F8BF, setting the active box to box 1 will ensure we can safely slide through.

D0 ret nc ; Thanks to the preparatory work done by the mail, allow safe return to normal game operation.

E1 pop hl ; Additional pop to clear return address of call to screen data

D1 pop de ; Set de to $0075, which holds value $00. Ensures that print function will end immediately after resuming

E8 FF add sp, -1 ; Fix the effect of increasing the stack pointer

F1 pop af ; a = $03

E0 9F ld ($FF9F), a ; Ensures return to ROM bank 3 after resuming execution

A7 and a ; Reset carry flag. Not strictly necessary, but added for safety for now

D0 ret nc

</pre>

Line 413:

Line 473:

The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.

Separately, this code overwrites the latter half of party pokémon #5's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.

Separately, this code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.

Lastly, the value of the first item ID in the main item pocket is overwritten so that it becomes a TM25.

Line 419:

Line 479:

<pre>

Box 1: $D8BF

80 add a, b

AF xor a ; a = $00

D6 E8 sub $FF ; a = $18

EA F9 F8 ld ($F8F9), a

EA D1 F8 ld ($F8D1), a

D6 FF sub $FF ; a = $01

D6 F7 sub $F7 ; a = $21

FB ei

50 ld d, b

Box 2: $D8C8

EA F7 F8 ld ($~~F8F7~~), a

EA D0 F8 ld ($F8D0), a

D6 D0 sub $D0 ; a = $31

D6 FF sub $FF ; a = $22

EA FC F8 ld ($~~F8FC~~), a

EA D6 F8 ld ($F8D6), a

21

50 ld d; b

Box 3: $D8D1

18 F4 ld hl, $F418

E6 A1 and $A1 ; a = $21

D6 83 sub $83 ; a = $9F

EA F4 F8 ld ($F8F4), a

~~D6 EF~~ ~~sub~~ ~~$EF~~ ; a = $32

87 add a, a ; a = $3E, carry flag set

.write

22 ldi (hl), a

D0 ret nc ; Ignore on first pass, taken when .write called

FB ei

50 ld d, b

Box 4: D8DA

E6 84 and $84 ; a = $04

EA F8 F8 ld ($F8F8), a

D4 D6 F8 call nc, .write

D6 E6 sub $E6 ; a = $4C

D6 87 sub $87 ; a = $7D

EA FB F8 ld ($F8FB), a

FB ei

50 ld d, b

Box 5: $D8E3

.loop

E6 84 and $84 ; a = $04

D6 FF sub $FF ; Increments a on each pass

EA FB FA ld ($FAFB), a

EA EF F8 ld ($F8EF), a

D6 86 sub $86 ; a = $7E

F5 push af

FB ei

F6 FF or $FF ; a = $FF

50 ld d, b

Box 6: $D8EC

FB ei

EA F5 F8 ld ($F8F5), a

FB ei

EA FD FA ld ($FAFD), a

F6 FF or $FF ; a = $FF, ~~reset~~ ~~carry~~ ~~flag~~

EA xx F5 ld ($F5xx), a ; Ranges from $F57E to $F5AF, all 50 TMs

F1 pop af

21

FE AF cp $AF

50 ld d, b

Box 7: $D8F5

~~7E F5~~ ld hl, ~~wTMsHMs~~

D2 FC F8 jp nc, .continue

A7 and a, a ; Reset carry flag

01 32 00 ld bc, $0032

D4 4C 31 ~~call~~ nc, ~~byteFill~~

D2 E3 F8 jp nc, .loop

.continue

AF xor a, a

50 ld d, b

Box 8: $~~D907~~

Box 8: $D8FE

E6 D2 and $D2 ; a = $D2

F6 D2 and $D2 ; a = $D2, reset carry flag

EA FC FA ld ~~($FAFC)~~, a

D4 D6 F8 call nc, .write

D6 FA sub $FA ; a = $~~D8, TM25's item ID~~

D6 93 sub $93 ; a = $3F

87 add a, a ; a = $7E, reset carry flag

FB ei

50 ld d, b

Box 9: $~~D910~~

Box 9: $D907

D4 D6 F8 call nc, .write

D6 9D sub $9D ; a = $E1, TM33's item ID

EA B8 F5 ld (wItems), a ; Main item pocket, first item ID

D6 E3 sub $E3 ; a = $F5

EA FE FA ld ($FAFE), a

50 ld d, b

Box 10: $~~D919~~

Box 10: $D910

D6 B7 ~~sub~~ $B7 ; a = ~~3E, reset carry flag~~

F6 F5 or $F5 ; a = $F5

EA FA FA ld ~~($FAFA)~~, a

D2 D6 F8 jp nc, .write

D0 ret nc

50 ld d, b

~~Party~~ ~~pokémon #5's stat experience~~, starting from $~~DAFA~~

TM33 bootstrap, starting from $D418

3E 04 ld a, $04

D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25

</pre>

====Raw Assembly====

<pre>

AF D6 E8 EA D1 F8 D6 F7 50

EA D0 F8 D6 FF EA D6 F8 50

F4 F4 D6 83 87 87 D0 FB 50

E6 84 D4 D6 F8 D6 87 FB 50

D6 FF EA EF F8 F5 F6 FF 50

FB FB EA F5 F5 F1 FE AF 50

D2 FC F8 A7 D2 E3 F8 AF 50

F6 D2 D4 D6 F8 D6 93 87 50

D4 D6 F8 D6 9D EA B8 F5 50

F6 F5 D2 D6 F8 50 50 50 50

</pre>

Line 533:

Line 616:

<pre>

Box 1: $D8BF

80 add a, b

AF xor a ; a = $00

D6 FC sub $FC ; a = $04

D6 E8 sub $FF ; a = $18

EA 9B FA ld ($~~FA9B~~), a

EA D1 F8 ld ($F8D1), a

D6 F7 sub $F7 ; a = $21

FB ei

50 ld d, b

Box 2: $D8C8

EA D0 F8 ld ($F8D0), a

D6 86 sub $86 ; a = $7E

D6 FF sub $FF ; a = $22

EA 9D FA ld ($FA9B), a

D6 89 ~~sub~~ $~~89 ;~~ a ~~= $F5~~

EA D6 F8 ld ($F8D6), a

21

FB ei

50 ld d; b

Box 3: $D8D1

EA 9E FA ld ~~($FA9E)~~, a

18 F4 ld hl, $F418

D6 B7 sub $D7 ; a = $3E

D6 83 sub $83 ; a = $9F

.doubleAndWrite

EA 9A FA ld ($FA9A), a

87 add a, a ; a = $3E, carry flag set

.write

22 ldi (hl), a

D0 ret nc ; Ignore on first pass, taken when .write/.doubleAndWrite called

FB ei

50 ld d, b

Box 4: D8DA

E6 84 and $84 ; a = $04

87 add a, a

D4 D6 F8 call nc, .write

D6 B9 sub $B9 ; a = $C3

AF xor a ; a = $00

EA 9C FA ld ($FA9C), a

A7 ~~and~~ a ; ~~Reset~~ ~~carry~~ ~~flag~~

F6 D2 or $D2 ; a = $D2

D0 ret nc

50 ld d, b

Box 5: $D8E3

Party pokémon #3's stat experience, starting from $DA9A

D4 D6 F8 call nc, .write

D6 93 sub $93 ; a = $3F

D4 D5 F8 call nc, .doubleAndWrite

50 ld d, b

Box 6: $D8EC

AF xor a ; a = $00

F6 F5 or $F5 ; a = $F5

D2 D6 F8 jp nc, .write

50 ld d, b

TM33 bootstrap, starting from $D418

3E 04 ld a, $04

C3 7E F5 jp ~~wTMsHMs~~ ; Carry and zero flag are both reset when using TM25

D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25

</pre>

====Raw Assembly====

<pre>

AF D6 E8 EA D1 F8 D6 F7 50

EA D0 F8 D6 FF EA D6 F8 50

F4 F4 D6 83 87 87 D0 FB 50

E6 84 D4 D6 F8 AF F6 D2 50

D4 D6 F8 D6 93 D4 D5 F8 50

AF F6 E1 D2 D6 F8 50 50 50

</pre>

[[Category:Guides]]