Guides:Coin Case ACE: Difference between revisions

From Glitch City Wiki
Jump to navigation Jump to search
Content added Content deleted
VisualWikitext
 
(28 intermediate revisions by the same user not shown)
Line 21: Line 21:
==Step 1: Obtaining everything needed for the setup==
==Step 1: Obtaining everything needed for the setup==


# Catch any pokémon and nickname it "MAILWRITER".
# Go to Goldenrod City and obtain the Coin Case by picking it up in the Goldenrod Underground.
# Go to Goldenrod City and obtain the Coin Case by picking it up in the Goldenrod Underground.
# After obtaining the Coin Case, go to the Game Corner.
# After obtaining the Coin Case, go to the Game Corner.
Line 27: Line 26:
#* If you already have coins stored in the coin case, make sure that the first digit of the total number of held coins equals "1".
#* If you already have coins stored in the coin case, make sure that the first digit of the total number of held coins equals "1".
# In the Goldenrod Dept. Store, buy a Flower Mail.
# In the Goldenrod Dept. Store, buy a Flower Mail.
# For this guide, '''ensure that the first item in the main item pocket is an item you do not need''', as we'll be overwriting it to a different item.

==Step 2: How to execute ACE using the Coin Case==


Now that we have the Coin Case, we'll need to set up everything needed to actually safely use it. Using a specific setup, we can force the Coin Case to execute code starting from the second character of the last read mail. From here, we need to ensure that we have the proper setup to execute box name codes.
Now that we have the Coin Case, we'll need to set up everything needed to actually safely use it. Using a specific setup, we can force the Coin Case to execute code starting from the second character of the last read mail. From here, we need to ensure that we have the proper setup to execute box name codes.


* Prepare box names to execute a certain effect and return safely to normal game operations. For the purposes of this guide, we'll use the box name in the next section.
* Prepare a mail to ensure that a box name code can be executed
* Give any pokémon a flower mail with the following content:
* Prepare specific box names to run a simple test code.

===Finishing the setup===

#Arrange your party like the following:
## Any
## Any
## "MAILWRITER" nicknamed Pokémon, holding mail
## Any
## Any
## Any
# Finally, give the "MAILWRITER" nicknamed pokémon a flower mail with the following content:
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
|
Line 50: Line 37:
|}
|}


===Preparing a test box name code===
===Preparing the box name code===


Rename the first box name to the following name. This box name code will be replaced later and is solely intended to verify if the setup is working correctly. Their only function is to safely exit ACE and return the game to normal:
Rename the first 10 box names to the following names. This box name will do the following when executed as code:
* Set quantities for all 50 TMs to x255
* Alter the first item in the main item pocket to a TM33, which can be used to trigger ACE
* Set up code so that using TM33 will execute the data stored in TM quantities


{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
|
[[File:Coin Case ACE tester box name.png|frameless]]
[[File:Box English GS Setup.png]]
|}
|}


==Step 3: Using Coin Case ACE==
==Step 2: Using Coin Case ACE==


In order to use ACE, always perform the following steps:
In order to use Coin Case ACE, always perform the following steps:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:EN Coin Case ACE start.png]]
||
[[File:EN Coin Case ACE end.png]]
|}


* '''Make sure to set box 1 as the current active box.'''
* '''Make sure to set box 1 as the current active box.'''
Line 71: Line 68:
* Open the start menu, open the pokédex, then listen to the cry of Bellsprout.
* Open the start menu, open the pokédex, then listen to the cry of Bellsprout.
* Go to the Pokémon menu and read the previously mentioned mail.
* Go to the Pokémon menu and read the previously mentioned mail.
* Open the item bag, switch item pockets at least once, then use the Coin Case. This will execute ACE.
* Open the item bag, switch item pockets at least once, then use the Coin Case. ACE will be executed when the coin count displays on the screen.


Make sure to test the setup by going through this process once. With the current box name setups, you can verify that the setup is working by checking the TM/HM pocket. The quantity of TM03 should now be 255. You can now continue to the next guide.
With the current box name setups, you can verify that the setup is working by checking the TM/HM pocket. The first item in the main item pocket should be altered to a TM33, in the TM/HM pocket you can now find all TMs, each having a quantity of x255. '''Do not use this TM33 yet! This TM will allow us to execute the contents of the TM/HM pocket as code, but due to the specific quantities currently present it will be guaranteed to crash the game.'''


Anytime you wish to execute wrong pocket Coin Case ACE, you'll need to repeat the steps outlined at the beginning of this section. Always make sure the held mail was read before using the Coin Case and ensure that a valid box name code was prepared beforehand.
If the test code crashes, check the following:

===Troubleshooting===

If the code crashes, check the following:
* Did you correctly follow the previous steps?
* Did you correctly follow the previous steps?
* Is the current active box set to box 1?
* Is the current active box set to box 1?
Line 82: Line 83:
* Is the content of the mail correct?
* Is the content of the mail correct?


===A small note on the box names===
'''Anytime you wish to execute wrong pocket Coin Case ACE, you'll need to repeat the steps outlined at the beginning of this section. Always make sure the held mail was read before using the Coin Case and ensure that a valid box name code was prepared beforehand.'''

Due to the limited characterset, the box name code rewrites part of itself to be able to achieve its effect. This will cause the box names to appear glitched after executing Coin Case ACE once.

While this looks weird, this is completely intentional and harmless. The code can still be used again if needed, you can easily fix this issue by renaming the box names to a normal name.


=Setting up an ACE environment=
=Setting up an ACE environment=


While we now have a way to execute box name codes using ACE, the current setup has a few drawbacks:
While we have a way to execute box name codes using ACE, the current setup has a few drawbacks:
* Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.
* Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.
* Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.
* Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.
Line 92: Line 97:
To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.
To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.


When TMs are used outside of the TM/HM pocket, the game will incorrectly attempt to search its item effect in the list of normal item effects. This causes the game to interpret garbage data as item effect pointers, for some TMs this allows us to execute ACE. This is known as Wrong Pocket TM ACE. The advantage of TM33 is that it can be used without requiring specific party/item/box/mail setups.
To do that, we're going to use a box name code to obtain 255 copies of all TMs, then sell them in specific quantities to write out a program. Alongside that, the box name code will also add a TM25 to the main item pocket. Using this TM25, outside of the TM/HM pocket, will allow us to execute the Mail Writer at any time as long as a specific pokémon is kept in the second party slot.

We've already given ourselves 255 copies of every TM, along with a method to execute the contents of the TM/HM contents in the form of TM33. In this part, we'll sell TMs in specific quantities to write out a program. Once this has been done, we can simply use TM33 to start up the MailWriter.


The mail writer itself will be installed in the TM/HM pocket through the following two step process:
The mail writer itself will be installed through the following two step process:
# Execute a box code using Coin Case ACE that sets the quantities of all 50 TMs to x255, as well as placing a TM25 in the main item pocket. On top of that, it will modify the data of party pokémon #3 so that they allow TM25 to be safely used, as long as it is kept in the second party slot.
# Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
# Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
# Use TM33 to activate the mail writer program, allowing us to quickly write out and execute a variety of ACE effects.
# improve the setup by executing a small code to move the mail writer program to unused memory, freeing up the TM pocket for our own use.


==Step 4: Setting all TM quantities to x255==
==Step 3: Selling TMs to form a program in the TM/HM pocket==


Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program.
* Rename box names to form the following. '''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Setup box code GSEN.png]]
|}

* Catch any pokémon and nickname it "MAILWRITER". '''Put it in the fifth party slot'''. We'll alter this pokémon's stat experience to redirect TM25 execution to the TM/HM pocket.

* Ensure that you have everything set up for Coin Case ACE:
** "MAILWRITER" nicknamed pokémon holding mail in party slot #3
** Read the correct mail beforehand
** Perform all steps necessary to execute Coin Case ACE

* Use the Coin Case once. If the code was executed successfully, switch to the TM/HM pocket. '''It should now contain every TM at a quantity of x255. The code will also overwrite the first item in the main item pocket to be a TM25.'''

==Step 5: Selling TMs to form a program in the TM/HM pocket==

Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using.


The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
Line 202: Line 192:
|TM35 SLEEP TALK ||x239 ||8000
|TM35 SLEEP TALK ||x239 ||8000
|-
|-
|TM36 SLUDGE BOMB ||x58 ||98000
|TM36 SLUDGE BOMB ||x58 ||98500
|-
|-
|TM37 SANDSTORM ||x27 ||228000
|TM37 SANDSTORM ||x27 ||228000
Line 236: Line 226:


# It is recommended to save before continuing.
# It is recommended to save before continuing.
# Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
# Put the pokémon that was nicknamed "MAILWRITER" into the 2nd party slot.
# Use TM25. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
# From now on, you can repeat this process at any time to start the mail writer.
# From now on, you can repeat this process at any time to start the mail writer.


Since we aren't planning on using the Coin Case anymore, the mail that was previously give to a pokémon can be removed. It is no longer relevant for the remainder of the setup.
If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for the "MAILWRITER" pokémon. This can be done using the box codes included a bit further below.


===Troubleshooting & repairing TM33===
A note on the nicknamed pokémon: when running the box name code, we altered "MAILWRITER"'s stat experience data to contain a redirect to the TM/HM pocket. You can safely deposit and withdraw it from the PC. '''Please note that this pokémon must never gain experience after this point, otherwise you'll need to reapply the setup.'''


If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code:
==Step 6: Using the mail writer==


'''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''.
'''From now on, simply go through the necessary steps to use TM25 to start up the RAM writer.'''
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Reset box code GSEN.png]]
|}

To execute this box name code, repeat the process for Coin Case ACE:
* Read the mail previously given to a party pokémon.
* Go to the Goldenrod Radio Tower and follow the correct steps to finish the setup.
* Use the Coin Case to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly.
* If the code executes succesfully without crashing the game, TM33's functionality has now been repaired.

==Step 4: Using the mail writer==

'''From now on, simply use TM33 to start up the mail writer.'''


The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
Line 253: Line 256:


Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. '''If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.'''
Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. '''If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.'''

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
[[File:Mail_English_GS_Rh.png]]
|}


Assembly can easily be converted to mail codes using [https://timovm.github.io/MailConverter/ TimoVM's MailConverter]. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
Assembly can easily be converted to mail codes using [https://timovm.github.io/MailConverter/ TimoVM's MailConverter]. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
Line 269: Line 277:
|}
|}


==What to do with the Mail writer==
==Step 5: Improving the setup==


Since the mail writer is written using TM quantities, using or gaining TMs will break the mail writer. Because of this, we'll use the mail writer to execute a small code that achieves the following:
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
* Copies the mail writer to unused memory
* [[User:TimoVM/Mail Writer Codes|Mail codes]]: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..
* Overwrite the existing quantities in the TM/HM pocket to x1 for every TM
* [[User:TimoVM/RAM Writer|RAM writer]]: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.
* Alter TM33's underlying code to execute the mail writer in unused memory
You can use the mail code converter page as follows:
* Copy the code in the table below
* Follow the link at the top of the table to the mail code converter
* Paste the code in the text box on the code converter's page
* Select the correct language and version
* Click on the "Run" button to display the mails you need to enter


{| class="wikitable"
=Addendum: repairing the "MAILWRITER" pokémon=
|+ Codes to be used with [https://timovm.github.io/MailConverter/ TimoVM's MailConverter]
|-
! Language !! Gold & Silver
|-
! scope="row"| English
||
01 32 00 11 F2 D6 21 1B D4 73 23 72 3E 3E 12 13
3E 04 12 13 21 7E D5 E5 CD 1A 31 3E 01 0E 32 E1
C3 4C 31
|}


After executing this code, attempt to start up the mail writer. If you are able to open it and are able to successfully execute the following blank mail, the copy has finished successfully and you can save the game.
In case something happens with the "MAILWRITER" nicknamed pokémon that causes it to no longer function, you can repair the pokémon without having to reset TM quantities using the following procedure:

* Arrange the party as follows:
*# Any
*# Any
*# "BOXCODES" pokémon holding mail
*# Any
*# "MAILWRITER" pokémon
*# Any
* Enter the following language-specific box name. '''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''.


{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|
|
[[File:Reset box code GSEN.png]]
[[File:Mail_English_GS_Rh.png]]
|}
|}


==What to do with the Mail writer==
* Read the mail held by the "BOXCODES" pokémon

* Go to any pokémon center and follow the correct steps until you reach the correct location
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
* Use the Coin Case to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly
* [[User:TimoVM/Mail Writer Codes|Mail codes]]: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..
* If the code executes succesfully without crashing the game, the "MAILWRITER" nicknamed pokémon has now been repaired.
* [[User:TimoVM/RAM Writer|RAM writer]]: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it. WARNING: THE RAM WRITER SETUP FOR GOLD/SILVER IS CURRENTLY BEING REDESIGNED. PLEASE DO NOT INSTALL YET.


=Appendix=
=Appendix=
Line 307: Line 324:
! scope="row" | Mail
! scope="row" | Mail
||
||
<pre>A A A A A A A A A A A A A A A A
<pre>h h 's z 2 Pk 'l 0 9 ♀ . 9 Pk * ' ]
h 'd</pre>
A A p 'v 7 ' ] . 9 'l 'l 'l p 'm z 2</pre>
|-
! scope="row" | Test box name
||
<pre>0 9 é A ♀ h 'd [SPACE]</pre>
|-
|-
! scope="row" | Setup box name
! scope="row" | Setup box name
||
||
Box 1: A p é 3 2 'v 9 5
Box 1: p 'v . é 'l 2 'v 1
Box 2: é 1 2 'v 'd é 6 2
Box 2: é 'd 2 'v 9 é 'v 2
Box 3: ? b é , 2 'v ♂ 5
Box 3: , , 'v D H H 'd 5
Box 4: é 2 2 'v ? é 5 2
Box 4: ? E 's 'v 2 'v H 5
Box 5: ? E é 5 4 'v G 5
Box 5: 'v 9 é ♂ 2 ♀ 0 9
Box 6: é ♀ 2 é 7 4 0 9
Box 6: 5 5 é ♀ ♀ * 8 p
Box 7: ♀ ♀ ♀ ♀ ♀ 's ♀ ♀
Box 7: 'm 6 2 h 'm - 2 p
Box 8: ? 'm é 6 4 'v 4 5
Box 8: 0 'm 's 'v 2 'v T H
Box 9: é y ♀ 'v - é 8 4
Box 9: 's 'v 2 'v ; é y ♀
Box 10: 'v x é 4 4 'd
Box 10: 0 ♀ 'm 'v 2
|-
|-
! scope="row" | Reset box name
! scope="row" | Reset box name
||
||
Box 1: A p 'v 6 é ) 4 5
Box 1: p 'v . é 'l 2 'v 1
Box 2: 'v G é ; 4 'v J 5
Box 2: é 'd 2 'v 9 é 'v 2
Box 3: é [ 4 'v x é ( 4
Box 3: , , 'v D H H 'd 5
Box 4: H 'v z é : 4 h 'd
Box 4: ? E 's 'v 2 p 0 'm
Box 5: 's 'v 2 'v T 's 't 2
Box 6: p 0 ♀ 'm 'v 2
|}
|}


Line 339: Line 354:
===Effect of the Coin Case===
===Effect of the Coin Case===


Activating the Coin Case causes arbitrary code execution from $E112 onward, which is echo ram for $C112. This region corresponds with sound data and can be manipulated by buffering pokémon cries.
The effects of the Coin Case are described in more detail on the following [http://Coin%20Case%20glitches#cause wiki page]. Relevant to this setup is that the setup will redirect execution to address $FA98 (echo ram copy of $DA98), which is in the middle of party pokémon #3's stat experience data. During this redirection, the stack pointer gets incremented once and an address gets popped from the stack. The global effect is that the stack pointer is decremented once compared to when the Coin Case was used.


Playing Bellsprout or Machop's cry will buffer $33 at $C117. This opcode increments the stack pointer, desyncing the stack.
===Effect of party pokémon #3===


The sound that plays when swapping item pockets clears some bad data around the $C16x region. It also places a $C1 at $C16E, popping a value from the stack to registers bc.
Defeating the provided list of pokémon will result in the following values at the following addresses, assuming the pokémon is in party slot #3:

The sound that plays when confirming the use of the Coin Case places $80 A1 D0 at $C192. Due to prior opcodes setting the value of register bc to $0000, the condition for the return will always be true. Thanks to incrementing the stack pointer and popping the stack once, the next return address will redirect execution to $EB12, echo ram for $CB12.

From $CB12, the game will nopslide until $CC20 is reached. This region contains data on buffered tiles that are added when the player moves around . Due to our specific movement pattern within the Goldenrod Radio Tower, this results in the following data, starting from $CC20:


<pre>
<pre>
At start, hl = $B2B2 and sp : $DFBC
DA95 00 nop

DA96 75 ld [hl], l
39 add sp ; hl = $926E
DA97 00 nop
39 add sp ; hl = $722A
DA98 94 sub a, h
39 add sp ; hl = $51E6
DA99 00 nop
39 add sp ; hl = $31A2
DA9A C3
39 add sp ; hl = $115E
DA9B 00
39 add sp ; hl = $F11A
DA9C CF jp $CF00
39 add sp ; hl = $D0D6
DA9D 00 nop
DA9E 6E ld l, [hl]
39 add sp ; hl = $B092
39 add sp ; hl = $904E
39 add sp ; hl = $700A
39 add sp ; hl = $4FC6
39 add sp ; hl = $2F82, carry flag set
30 31 jr nc, $31 ; Ignore thanks to previous carry
1A ld a, (de)
1B dec de
1A ld a, (de)
1B dec de
0A ld a, (bc)
0B dec bc
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 39 39 ld bc, $3939
39 add sp ; hl = $0F3E
39 add sp ; hl = $EEFA, desired result in h, zero flag set
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
00 nop
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 01 01 ld bc, $0101
01 00 00 ld bc, $0000
00 nop
00 nop
84 add h
9B sbc e
A4 and h
9B scb e ; The result of these arithmatic opcodes aren't relevant, but they do reset the zero flag
C4 9B E4 call nz, $E49B ; Corresponds to lower parts of screen tile data
</pre>
</pre>


The main result of this region is to set h to $EE, followed by a call to screen tile data.
Executing Coin Case at the location described in the setup will cause execution to jump to $DA98. It will then harmlessly slide through the sub a, h and nop instructions, after which execution will jump to $CF00, which is in the middle of the last buffered mail.


Before ACE is triggered, the game will already print the amount of coins on screen. In particular, a number of coins whose first digit is equal to 1 will lead to $F7 (rst30h) being printed to $C4E1. The region between $C49B and $C4E1 is filled with harmless data consisting of blank tiles ($7F), textbox tiles ($7A-$7C) and arithmatic opcodes for the "Coins:" text ($82 AE A8 AD B2 9C). The end result is that a is set to be equal to $EE, the value stored in h, right before rst30h is activated.
===Effect of the mail===


rst30h is technically an unused reset vector, but accidentally contains the last three bytes of JumpTable function, usually accessed by rst28h:
The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following:


<pre>
<pre>
6F ld l, a ; hl = $EEEE
80 add a, b
D1 pop de ; Pops the return address to registers de
80 add a, b
E9 jp hl ; Jump to $EEEE, the second character of the last read mail
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
80 add a, b
4E ld c, (hl) ; Newline control character.
80 add a, b
80 add a, b
AF xor a ; Located at $CF00, all values before this address are filler and will not be executed.
D6 FD sub $FD ; Set a to $03.
E0 9F ld (hRomBank), a; Set current ROM bank to bank 3. This ROM bank contains item and pack data and ensures safe return.
E8 FF add sp, $FF ; $FF is interpreted as a singed integer, stack pointer gets decremented and the stack is now properly aligned again.
D1 pop de
D1 pop de
D1 pop de ; Pop text command related addresses so that returning from ACE execution will resume normal game operation.
AF xor a ; Set a to $00, set carry flag to 0.
D2 B9 F8 jp nc, $F8B9 ; Jump to echo ram copy of $D8B9, which lies a few bytes before box data.
</pre>
</pre>


This allows us to finally reach the last read mail, a region of memory that we have a good amount of control over.
===Effect of the test box name code===


===Effect of the mail===
Box name data starts from $D8BF onward. Converting the provided mail code to assembly results in the following:

The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following:


<pre>
<pre>
A7 and a ; Filler
F6 FF or $FF ; Set a to $FF, set carry flag to 0.
A7 and a ; Reset carry flag
EA 80 F5 ld (F580), a ; $F580 is an echo ram copy of $D580, which corresponds to TM03's quantity.
D4 B9 F8 call nc, $F8B9 ; Box names start at $D8BF/F8BF, setting the active box to box 1 will ensure we can safely slide through.
D0 ret nc ; Thanks to the preparatory work done by the mail, allow safe return to normal game operation.
E1 pop hl ; Additional pop to clear return address of call to screen data
D1 pop de ; Set de to $0075, which holds value $00. Ensures that print function will end immediately after resuming
E8 FF add sp, -1 ; Fix the effect of increasing the stack pointer
F1 pop af ; a = $03
E0 9F ld ($FF9F), a ; Ensures return to ROM bank 3 after resuming execution
A7 and a ; Reset carry flag. Not strictly necessary, but added for safety for now
D0 ret nc
</pre>
</pre>


Line 411: Line 466:
The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.
The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.


Separately, this code overwrites the latter half of party pokémon #5's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
Separately, this code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.


Lastly, the value of the first item ID in the main item pocket is overwritten so that it becomes a TM25.
Lastly, the value of the first item ID in the main item pocket is overwritten so that it becomes a TM25.
Line 417: Line 472:
<pre>
<pre>
Box 1: $D8BF
Box 1: $D8BF
80 add a, b
AF xor a ; a = $00
AF xor a ; a = $00
D6 E8 sub $FF ; a = $18
EA F9 F8 ld ($F8F9), a
EA D1 F8 ld ($F8D1), a
D6 FF sub $FF ; a = $01
D6 F7 sub $F7 ; a = $21
FB ei
50 ld d, b
50 ld d, b


Box 2: $D8C8
Box 2: $D8C8
EA F7 F8 ld ($F8F7), a
EA D0 F8 ld ($F8D0), a
D6 D0 sub $D0 ; a = $31
D6 FF sub $FF ; a = $22
EA FC F8 ld ($F8FC), a
EA D6 F8 ld ($F8D6), a
21
50 ld d; b


Box 3: $D8D1
Box 3: $D8D1
18 F4 ld hl, $F418
E6 A1 and $A1 ; a = $21
D6 83 sub $83 ; a = $9F
EA F4 F8 ld ($F8F4), a
D6 EF sub $EF ; a = $32
87 add a, a ; a = $3E, carry flag set
.write
22 ldi (hl), a
D0 ret nc ; Ignore on first pass, taken when .write called
FB ei
FB ei
50 ld d, b
50 ld d, b


Box 4: D8DA
Box 4: D8DA
E6 84 and $84 ; a = $04
EA F8 F8 ld ($F8F8), a
D4 D6 F8 call nc, .write
D6 E6 sub $E6 ; a = $4C
D6 87 sub $87 ; a = $7D
EA FB F8 ld ($F8FB), a
FB ei
50 ld d, b
50 ld d, b


Box 5: $D8E3
Box 5: $D8E3
.loop
E6 84 and $84 ; a = $04
D6 FF sub $FF ; Increments a on each pass
EA FB FA ld ($FAFB), a
EA EF F8 ld ($F8EF), a
D6 86 sub $86 ; a = $7E
F5 push af
FB ei
F6 FF or $FF ; a = $FF
50 ld d, b
50 ld d, b


Box 6: $D8EC
Box 6: $D8EC
FB ei
EA F5 F8 ld ($F8F5), a
FB ei
EA FD FA ld ($FAFD), a
F6 FF or $FF ; a = $FF, reset carry flag
EA xx F5 ld ($F5xx), a ; Ranges from $F57E to $F5AF, all 50 TMs
F1 pop af
21
FE AF cp $AF
50 ld d, b



Box 7: $D8F5
Box 7: $D8F5
7E F5 ld hl, wTMsHMs
D2 FC F8 jp nc, .continue
A7 and a, a ; Reset carry flag
01 32 00 ld bc, $0032
D4 4C 31 call nc, byteFill
D2 E3 F8 jp nc, .loop
.continue
AF xor a, a
50 ld d, b
50 ld d, b


Box 8: $D907
Box 8: $D8FE
E6 D2 and $D2 ; a = $D2
F6 D2 and $D2 ; a = $D2, reset carry flag
EA FC FA ld ($FAFC), a
D4 D6 F8 call nc, .write
D6 FA sub $FA ; a = $D8, TM25's item ID
D6 93 sub $93 ; a = $3F
87 add a, a ; a = $7E, reset carry flag
FB ei
50 ld d, b
50 ld d, b


Box 9: $D910
Box 9: $D907
D4 D6 F8 call nc, .write
D6 9D sub $9D ; a = $E1, TM33's item ID
EA B8 F5 ld (wItems), a ; Main item pocket, first item ID
EA B8 F5 ld (wItems), a ; Main item pocket, first item ID
D6 E3 sub $E3 ; a = $F5
EA FE FA ld ($FAFE), a
50 ld d, b
50 ld d, b


Box 10: $D919
Box 10: $D910
D6 B7 sub $B7 ; a = 3E, reset carry flag
F6 F5 or $F5 ; a = $F5
EA FA FA ld ($FAFA), a
D2 D6 F8 jp nc, .write
D0 ret nc
50 ld d, b
50 ld d, b


Party pokémon #5's stat experience, starting from $DAFA
TM33 bootstrap, starting from $D418
3E 04 ld a, $04
3E 04 ld a, $04
D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25
D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25
</pre>

====Raw Assembly====

<pre>
AF D6 E8 EA D1 F8 D6 F7 50
EA D0 F8 D6 FF EA D6 F8 50
F4 F4 D6 83 87 87 D0 FB 50
E6 84 D4 D6 F8 D6 87 FB 50
D6 FF EA EF F8 F5 F6 FF 50
FB FB EA F5 F5 F1 FE AF 50
D2 FC F8 A7 D2 E3 F8 AF 50
F6 D2 D4 D6 F8 D6 93 87 50
D4 D6 F8 D6 9D EA B8 F5 50
F6 F5 D2 D6 F8 50 50 50 50
</pre>
</pre>


Line 531: Line 609:
<pre>
<pre>
Box 1: $D8BF
Box 1: $D8BF
80 add a, b
AF xor a ; a = $00
AF xor a ; a = $00
D6 FC sub $FC ; a = $04
D6 E8 sub $FF ; a = $18
EA 9B FA ld ($FA9B), a
EA D1 F8 ld ($F8D1), a
D6 F7 sub $F7 ; a = $21
FB ei
50 ld d, b
50 ld d, b


Box 2: $D8C8
Box 2: $D8C8
EA D0 F8 ld ($F8D0), a
D6 86 sub $86 ; a = $7E
D6 FF sub $FF ; a = $22
EA 9D FA ld ($FA9B), a
D6 89 sub $89 ; a = $F5
EA D6 F8 ld ($F8D6), a
21
FB ei
50 ld d; b


Box 3: $D8D1
Box 3: $D8D1
EA 9E FA ld ($FA9E), a
18 F4 ld hl, $F418
D6 B7 sub $D7 ; a = $3E
D6 83 sub $83 ; a = $9F
.doubleAndWrite
EA 9A FA ld ($FA9A), a
87 add a, a ; a = $3E, carry flag set
.write
22 ldi (hl), a
D0 ret nc ; Ignore on first pass, taken when .write/.doubleAndWrite called
FB ei
50 ld d, b
50 ld d, b


Box 4: D8DA
Box 4: D8DA
E6 84 and $84 ; a = $04
87 add a, a
D4 D6 F8 call nc, .write
D6 B9 sub $B9 ; a = $C3
AF xor a ; a = $00
EA 9C FA ld ($FA9C), a
A7 and a ; Reset carry flag
F6 D2 or $D2 ; a = $D2
D0 ret nc
50 ld d, b
50 ld d, b


Box 5: $D8E3
Party pokémon #3's stat experience, starting from $DA9A
D4 D6 F8 call nc, .write
D6 93 sub $93 ; a = $3F
D4 D5 F8 call nc, .doubleAndWrite
50 ld d, b

Box 6: $D8EC
AF xor a ; a = $00
F6 F5 or $F5 ; a = $F5
D2 D6 F8 jp nc, .write
50 ld d, b

TM33 bootstrap, starting from $D418
3E 04 ld a, $04
3E 04 ld a, $04
C3 7E F5 jp wTMsHMs ; Carry and zero flag are both reset when using TM25
D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25
</pre>
</pre>

====Raw Assembly====

<pre>
AF D6 E8 EA D1 F8 D6 F7 50
EA D0 F8 D6 FF EA D6 F8 50
F4 F4 D6 83 87 87 D0 FB 50
E6 84 D4 D6 F8 AF F6 D2 50
D4 D6 F8 D6 93 D4 D5 F8 50
AF F6 E1 D2 D6 F8 50 50 50
</pre>

[[Category:Guides]]

Latest revision as of 22:38, 4 July 2024

This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Coin Case glitch.

This page serves as a repository for a Coin Case ACE setup for the English versions of Pokémon Gold & Silver. It is part of the TimoVM's Gen 2 ACE setups set of guides.

The preparation is best done during daytime in-game. If needed, you can change the in-game clock with the help of this tool.

Please make sure to fully read every step of the guide before executing them.

If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.

Setting up initial ACE

When using the Coin Case while a Bellsprout/Machop's cry and specific newly loaded tiles are buffered in memory, the game will execute code in various places before finally ending up in the $FA98-$FA9B range, which is echo ram containing the stat exp data of party pokémon #3.

Using specific movement patterns in the Goldenrod Radio Tower, we can form a jump to $EEEE, which is echo ram for the second character of the last read mail. This gives us enough space to call the start of box names, then fix the side effects of using the Coin Case and return to normal game operation.

In practice, the initial Coin Case ACE setup will be created using the following general process:

  1. Obtain the Coin Case
  2. Give any pokémon a mail with specific content and set up a box name code
  3. Set up a specific movement pattern in the Goldenrod Radio Tower to be able to execute ACE

Step 1: Obtaining everything needed for the setup

  1. Go to Goldenrod City and obtain the Coin Case by picking it up in the Goldenrod Underground.
  2. After obtaining the Coin Case, go to the Game Corner.
    • If you do not have any coins yet, simply buy 100 coins.
    • If you already have coins stored in the coin case, make sure that the first digit of the total number of held coins equals "1".
  3. In the Goldenrod Dept. Store, buy a Flower Mail.
  4. For this guide, ensure that the first item in the main item pocket is an item you do not need, as we'll be overwriting it to a different item.

Now that we have the Coin Case, we'll need to set up everything needed to actually safely use it. Using a specific setup, we can force the Coin Case to execute code starting from the second character of the last read mail. From here, we need to ensure that we have the proper setup to execute box name codes.

  • Prepare box names to execute a certain effect and return safely to normal game operations. For the purposes of this guide, we'll use the box name in the next section.
  • Give any pokémon a flower mail with the following content:

Preparing the box name code

Rename the first 10 box names to the following names. This box name will do the following when executed as code:

  • Set quantities for all 50 TMs to x255
  • Alter the first item in the main item pocket to a TM33, which can be used to trigger ACE
  • Set up code so that using TM33 will execute the data stored in TM quantities

Step 2: Using Coin Case ACE

In order to use Coin Case ACE, always perform the following steps:
  • Make sure to set box 1 as the current active box.
  • Go to the Goldenrod Radio Tower and take the stairs up to the second floor. Move to the spot indicated by the above screenshot on the left. Save the game while you're still standing on this spot and reset the game.
  • After reloading, take the following steps until you reach the spot indicated by the above screenshot on the left:
    1. 3 steps rightwards
    2. 2 steps upwards
    3. 1 step leftwards
  • Open the start menu, open the pokédex, then listen to the cry of Bellsprout.
  • Go to the Pokémon menu and read the previously mentioned mail.
  • Open the item bag, switch item pockets at least once, then use the Coin Case. ACE will be executed when the coin count displays on the screen.

With the current box name setups, you can verify that the setup is working by checking the TM/HM pocket. The first item in the main item pocket should be altered to a TM33, in the TM/HM pocket you can now find all TMs, each having a quantity of x255. Do not use this TM33 yet! This TM will allow us to execute the contents of the TM/HM pocket as code, but due to the specific quantities currently present it will be guaranteed to crash the game.

Anytime you wish to execute wrong pocket Coin Case ACE, you'll need to repeat the steps outlined at the beginning of this section. Always make sure the held mail was read before using the Coin Case and ensure that a valid box name code was prepared beforehand.

Troubleshooting

If the code crashes, check the following:

  • Did you correctly follow the previous steps?
  • Is the current active box set to box 1?
  • Make sure that the first digit of the total amount of coins is equal to "1". 100 is a good total for this setup.
  • Is the box name code correctly entered?
  • Is the content of the mail correct?

A small note on the box names

Due to the limited characterset, the box name code rewrites part of itself to be able to achieve its effect. This will cause the box names to appear glitched after executing Coin Case ACE once.

While this looks weird, this is completely intentional and harmless. The code can still be used again if needed, you can easily fix this issue by renaming the box names to a normal name.

Setting up an ACE environment

While we have a way to execute box name codes using ACE, the current setup has a few drawbacks:

  • Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.
  • Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.

To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.

When TMs are used outside of the TM/HM pocket, the game will incorrectly attempt to search its item effect in the list of normal item effects. This causes the game to interpret garbage data as item effect pointers, for some TMs this allows us to execute ACE. This is known as Wrong Pocket TM ACE. The advantage of TM33 is that it can be used without requiring specific party/item/box/mail setups.

We've already given ourselves 255 copies of every TM, along with a method to execute the contents of the TM/HM contents in the form of TM33. In this part, we'll sell TMs in specific quantities to write out a program. Once this has been done, we can simply use TM33 to start up the MailWriter.

The mail writer itself will be installed through the following two step process:

  1. Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
  2. Use TM33 to activate the mail writer program, allowing us to quickly write out and execute a variety of ACE effects.
  3. improve the setup by executing a small code to move the mail writer program to unused memory, freeing up the TM pocket for our own use.

Step 3: Selling TMs to form a program in the TM/HM pocket

Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program.

The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.

TM Quantities to sell

TM Final Quantity Sell value
TM01 DYNAMICPUNCH x17 357000
TM02 HEADBUTT x85 170000
TM03 CURSE x221 51000
TM04 ROLLOUT x213 42000
TM05 ROAR x213 21000
TM06 TOXIC x213 63000
TM07 ZAP CANNON x33 222000
TM08 ROCK SMASH x66 94500
TM09 PSYCH UP x98 78500
TM10 HIDDEN POWER x207 72000
TM11 SUNNY DAY x225 30000
TM12 SWEET SCENT x209 23000
TM13 SNORE x42 106500
TM14 BLIZZARD x254 1500
TM15 HYPER BEAM x80 262500
TM16 ICY WIND x56 298500
TM17 PROTECT x251 6000
TM18 RAIN DANCE x40 215000
TM19 GIGA DRAIN x10 367500
TM20 ENDURE x135 180000
TM21 FRUSTRATION x134 60500
TM22 SOLARBEAM x18 355500
TM23 IRON TAIL x19 354000
TM24 DRAGONBREATH x35 330000
TM25 THUNDER x129 126000
TM26 EARTHQUAKE x79 264000
TM27 RETURN x18 118500
TM28 DIG x24 231000
TM29 PSYCHIC x239 16000
TM30 SHADOW BALL x33 333000
TM31 MUD-SLAP x1 381000
TM32 DOUBLE TEAM x196 59000
TM33 ICE PUNCH x77 267000
TM34 SWAGGER x205 25000
TM35 SLEEP TALK x239 8000
TM36 SLUDGE BOMB x58 98500
TM37 SANDSTORM x27 228000
TM38 FIRE BLAST x205 50000
TM39 SWIFT x144 111000
TM40 DEFENSE CURL x55 100000
TM41 THUNDERPUNCH x189 99000
TM42 DREAM EATER x40 322500
TM43 DETECT x217 19000
TM44 REST x56 298500
TM45 ATTRACT x240 22500
TM46 THIEF x254 1500
TM47 STEEL WING x08 370500
TM48 FIRE PUNCH x200 82500
TM49 FURY CUTTER x24 346500
TM50 NIGHTMARE x242 13000

Running the newly written program

  1. It is recommended to save before continuing.
  2. Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
  3. From now on, you can repeat this process at any time to start the mail writer.

Since we aren't planning on using the Coin Case anymore, the mail that was previously give to a pokémon can be removed. It is no longer relevant for the remainder of the setup.

Troubleshooting & repairing TM33

If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code:

Please mind the differences between uppercase X (), lowercase x () and multiplication symbol ().

To execute this box name code, repeat the process for Coin Case ACE:

  • Read the mail previously given to a party pokémon.
  • Go to the Goldenrod Radio Tower and follow the correct steps to finish the setup.
  • Use the Coin Case to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly.
  • If the code executes succesfully without crashing the game, TM33's functionality has now been repaired.

Step 4: Using the mail writer

From now on, simply use TM33 to start up the mail writer.

The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.

This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.

Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.

Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.

Controls

Between entering mail codes, the mail writer will ask for user input.

  • Press SELECT to open a new mail and continue writing data.
  • Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
  • Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
Enter your mail code, then press "END". It prints the checksum and waits for input.

Step 5: Improving the setup

Since the mail writer is written using TM quantities, using or gaining TMs will break the mail writer. Because of this, we'll use the mail writer to execute a small code that achieves the following:

  • Copies the mail writer to unused memory
  • Overwrite the existing quantities in the TM/HM pocket to x1 for every TM
  • Alter TM33's underlying code to execute the mail writer in unused memory

You can use the mail code converter page as follows:

  • Copy the code in the table below
  • Follow the link at the top of the table to the mail code converter
  • Paste the code in the text box on the code converter's page
  • Select the correct language and version
  • Click on the "Run" button to display the mails you need to enter
Codes to be used with TimoVM's MailConverter
Language Gold & Silver
English 
01 32 00 11 F2 D6 21 1B D4 73 23 72 3E 3E 12 13
3E 04 12 13 21 7E D5 E5 CD 1A 31 3E 01 0E 32 E1
C3 4C 31

After executing this code, attempt to start up the mail writer. If you are able to open it and are able to successfully execute the following blank mail, the copy has finished successfully and you can save the game.

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

  • Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..
  • RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it. WARNING: THE RAM WRITER SETUP FOR GOLD/SILVER IS CURRENTLY BEING REDESIGNED. PLEASE DO NOT INSTALL YET.

Appendix

Plain text transcripts of codes

Language English
Mail 
h h 's z 2 Pk 'l 0 9 ♀ . 9 Pk * ' ] 
h 'd
Setup box name 
Box 1: p 'v . é 'l 2 'v 1
Box 2: é 'd 2 'v 9 é 'v 2
Box 3: , , 'v D H H 'd 5
Box 4: ? E 's 'v 2 'v H 5
Box 5: 'v 9 é ♂ 2 ♀ 0 9
Box 6: 5 5 é ♀ ♀ * 8 p
Box 7: 'm 6 2 h 'm - 2 p
Box 8: 0 'm 's 'v 2 'v T H
Box 9: 's 'v 2 'v ; é y ♀
Box 10: 0 ♀ 'm 'v 2
Reset box name 
Box 1: p 'v . é 'l 2 'v 1
Box 2: é 'd 2 'v 9 é 'v 2
Box 3: , , 'v D H H 'd 5
Box 4: ? E 's 'v 2 p 0 'm
Box 5: 's 'v 2 'v T 's 't 2
Box 6: p 0 ♀ 'm 'v 2

In-depth explanation of the setup

Effect of the Coin Case

Activating the Coin Case causes arbitrary code execution from $E112 onward, which is echo ram for $C112. This region corresponds with sound data and can be manipulated by buffering pokémon cries.

Playing Bellsprout or Machop's cry will buffer $33 at $C117. This opcode increments the stack pointer, desyncing the stack.

The sound that plays when swapping item pockets clears some bad data around the $C16x region. It also places a $C1 at $C16E, popping a value from the stack to registers bc.

The sound that plays when confirming the use of the Coin Case places $80 A1 D0 at $C192. Due to prior opcodes setting the value of register bc to $0000, the condition for the return will always be true. Thanks to incrementing the stack pointer and popping the stack once, the next return address will redirect execution to $EB12, echo ram for $CB12.

From $CB12, the game will nopslide until $CC20 is reached. This region contains data on buffered tiles that are added when the player moves around . Due to our specific movement pattern within the Goldenrod Radio Tower, this results in the following data, starting from $CC20: 

At start, hl = $B2B2 and sp : $DFBC

39		add sp		; hl = $926E
39		add sp		; hl = $722A
39		add sp		; hl = $51E6
39		add sp		; hl = $31A2
39		add sp		; hl = $115E
39		add sp		; hl = $F11A
39		add sp		; hl = $D0D6
39		add sp		; hl = $B092
39		add sp		; hl = $904E
39		add sp		; hl = $700A
39		add sp		; hl = $4FC6
39		add sp		; hl = $2F82, carry flag set
30 31		jr nc, $31	; Ignore thanks to previous carry
1A		ld a, (de)
1B		dec de
1A		ld a, (de)
1B		dec de
0A		ld a, (bc)
0B		dec bc
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 39 39	ld bc, $3939
39		add sp		; hl = $0F3E
39		add sp		; hl = $EEFA, desired result in h, zero flag set
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
00		nop
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 01 01	ld bc, $0101
01 00 00	ld bc, $0000
00		nop
00		nop
84		add h
9B		sbc e
A4		and h
9B		scb e		; The result of these arithmatic opcodes aren't relevant, but they do reset the zero flag
C4 9B E4	call nz, $E49B	; Corresponds to lower parts of screen tile data

The main result of this region is to set h to $EE, followed by a call to screen tile data.

Before ACE is triggered, the game will already print the amount of coins on screen. In particular, a number of coins whose first digit is equal to 1 will lead to $F7 (rst30h) being printed to $C4E1. The region between $C49B and $C4E1 is filled with harmless data consisting of blank tiles ($7F), textbox tiles ($7A-$7C) and arithmatic opcodes for the "Coins:" text ($82 AE A8 AD B2 9C). The end result is that a is set to be equal to $EE, the value stored in h, right before rst30h is activated.

rst30h is technically an unused reset vector, but accidentally contains the last three bytes of JumpTable function, usually accessed by rst28h: 

6F		ld l, a		; hl = $EEEE
D1		pop de		; Pops the return address to registers de
E9		jp hl		; Jump to $EEEE, the second character of the last read mail

This allows us to finally reach the last read mail, a region of memory that we have a good amount of control over.

Effect of the mail

The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following: 

A7		and a		; Filler
A7		and a		; Reset carry flag
D4 B9 F8	call nc, $F8B9	; Box names start at $D8BF/F8BF, setting the active box to box 1 will ensure we can safely slide through. 
E1		pop hl		; Additional pop to clear return address of call to screen data
D1		pop de		; Set de to $0075, which holds value $00. Ensures that print function will end immediately after resuming
E8 FF		add sp, -1	; Fix the effect of increasing the stack pointer
F1		pop af		; a = $03
E0 9F		ld ($FF9F), a	; Ensures return to ROM bank 3 after resuming execution
A7		and a		; Reset carry flag. Not strictly necessary, but added for safety for now
D0		ret nc

Effect of the setup box name code

Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.

The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.

Separately, this code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.

Lastly, the value of the first item ID in the main item pocket is overwritten so that it becomes a TM25. 

Box 1: $D8BF
AF		xor a		; a = $00
D6 E8		sub $FF		; a = $18
EA D1 F8	ld ($F8D1), a
D6 F7		sub $F7		; a = $21
50		ld d, b

Box 2: $D8C8
EA D0 F8	ld ($F8D0), a
D6 FF		sub $FF		; a = $22
EA D6 F8	ld ($F8D6), a
21

Box 3: $D8D1
   18 F4	ld hl, $F418
D6 83		sub $83		; a = $9F
87		add a, a	; a = $3E, carry flag set
.write
22		ldi (hl), a
D0		ret nc		; Ignore on first pass, taken when .write called
FB		ei
50		ld d, b

Box 4: D8DA
E6 84		and $84		; a = $04
D4 D6 F8	call nc, .write
D6 87		sub $87		; a = $7D
FB		ei
50		ld d, b

Box 5: $D8E3
.loop
D6 FF		sub $FF		; Increments a on each pass
EA EF F8	ld ($F8EF), a
F5		push af
F6 FF		or $FF		; a = $FF
50		ld d, b

Box 6: $D8EC
FB		ei
FB		ei
EA xx F5	ld ($F5xx), a	; Ranges from $F57E to $F5AF, all 50 TMs
F1		pop af
FE AF		cp $AF
50		ld d, b


Box 7: $D8F5
D2 FC F8	jp nc, .continue
A7		and a, a	; Reset carry flag
D2 E3 F8	jp nc, .loop
.continue
AF		xor a, a
50		ld d, b

Box 8: $D8FE
F6 D2		and $D2		; a = $D2, reset carry flag
D4 D6 F8	call nc, .write
D6 93		sub $93		; a = $3F
87		add a, a	; a = $7E, reset carry flag
50		ld d, b

Box 9: $D907
D4 D6 F8	call nc, .write
D6 9D		sub $9D		; a = $E1, TM33's item ID
EA B8 F5	ld (wItems), a	; Main item pocket, first item ID
50		ld d, b

Box 10: $D910
F6 F5		or $F5		; a = $F5
D2 D6 F8	jp nc, .write
50		ld d, b

TM33 bootstrap, starting from $D418
3E 04		ld a, $04
D2 7E F5	jp nc, wTMsHMS	; Carry and zero flag are both reset when using TM25

Raw Assembly

 AF D6 E8 EA D1 F8 D6 F7 50
 EA D0 F8 D6 FF EA D6 F8 50
 F4 F4 D6 83 87 87 D0 FB 50
 E6 84 D4 D6 F8 D6 87 FB 50
 D6 FF EA EF F8 F5 F6 FF 50
 FB FB EA F5 F5 F1 FE AF 50
 D2 FC F8 A7 D2 E3 F8 AF 50
 F6 D2 D4 D6 F8 D6 93 87 50
 D4 D6 F8 D6 9D EA B8 F5 50
 F6 F5 D2 D6 F8 50 50 50 50

Effect of the TM code

Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work. 

11 55 DD	ld de, $DD55
D5		push de
D5		push de		; .nextMail
D5		push de
21 42 62	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C4	ld hl, $C401	; .screenLoop
4D		ld c, l
CD EF 3A	call PrintBCDNumber.loop - 1
1B		dec de		; .goBack
CD 90 37	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Effect of the reset box name code

Converting the characters from box names to assembly results in the following code. This code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer. 

Box 1: $D8BF
AF		xor a		; a = $00
D6 E8		sub $FF		; a = $18
EA D1 F8	ld ($F8D1), a
D6 F7		sub $F7		; a = $21
50		ld d, b

Box 2: $D8C8
EA D0 F8	ld ($F8D0), a
D6 FF		sub $FF		; a = $22
EA D6 F8	ld ($F8D6), a
21 

Box 3: $D8D1
   18 F4	ld hl, $F418
D6 83		sub $83		; a = $9F
.doubleAndWrite
87		add a, a	; a = $3E, carry flag set
.write
22		ldi (hl), a
D0		ret nc		; Ignore on first pass, taken when .write/.doubleAndWrite called
FB		ei
50		ld d, b

Box 4: D8DA
E6 84		and $84		; a = $04
D4 D6 F8	call nc, .write
AF			xor a	; a = $00
F6 D2		or $D2		; a = $D2
50		ld d, b

Box 5: $D8E3
D4 D6 F8	call nc, .write
D6 93		sub $93		; a = $3F
D4 D5 F8	call nc, .doubleAndWrite
50		ld d, b

Box 6: $D8EC
AF			xor a	; a = $00
F6 F5		or $F5		; a = $F5
D2 D6 F8	jp nc, .write
50		ld d, b

TM33 bootstrap, starting from $D418
3E 04		ld a, $04
D2 7E F5	jp nc, wTMsHMS	; Carry and zero flag are both reset when using TM25

Raw Assembly

 AF D6 E8 EA D1 F8 D6 F7 50
 EA D0 F8 D6 FF EA D6 F8 50
 F4 F4 D6 83 87 87 D0 FB 50
 E6 84 D4 D6 F8 AF F6 D2 50
 D4 D6 F8 D6 93 D4 D5 F8 50
 AF F6 E1 D2 D6 F8 50 50 50
Retrieved from "https://glitchcity.wiki/wiki/Guides:Coin_Case_ACE?oldid=44421"