Guides:Coin Case ACE: Difference between revisions
(7 intermediate revisions by the same user not shown) | |||
Line 18: | Line 18: | ||
# Give any pokémon a mail with specific content and set up a box name code |
# Give any pokémon a mail with specific content and set up a box name code |
||
# Set up a specific movement pattern in the Goldenrod Radio Tower to be able to execute ACE |
# Set up a specific movement pattern in the Goldenrod Radio Tower to be able to execute ACE |
||
# Execute a code that gives us 255 of every TM, along with a different, more convenient ACE method. |
|||
==Step 1: Obtaining everything needed for the setup== |
==Step 1: Obtaining everything needed for the setup== |
||
Line 227: | Line 228: | ||
# It is recommended to save before continuing. |
# It is recommended to save before continuing. |
||
# Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail. |
# Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail. |
||
# Due to limitations, there is no in-built option to safely exit the mail writer. Instead, you can safely exit by typing the below mail, selecting END on the mail screen, then pressing START to execute the mail. |
|||
# From now on, you can repeat this process at any time to start the mail writer. |
|||
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;" |
|||
Since we aren't planning on using the Coin Case anymore, the mail that was previously give to a pokémon can be removed. It is no longer relevant for the remainder of the setup. |
|||
| |
|||
[[File:Mail_English_GS_Rh.png]] |
|||
|} |
|||
From now on, you can repeat this process at any time to start the mail writer. Since we aren't planning on using the Coin Case anymore, the mail that was previously give to a pokémon can be removed. It is no longer relevant for the remainder of the setup. |
|||
===Troubleshooting & repairing TM33=== |
|||
'''The next section will elaborate on the usage of the Mail Writer. Please read these instructions carefully before proceeding.''' |
|||
If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code: |
|||
= |
===Troubleshooting & repairing TM33=== |
||
If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code: |
|||
'''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''. |
'''Please mind the differences between uppercase X ([[File:Character UCX.png]]), lowercase x ([[File:Character lcx.png]]) and multiplication symbol ([[File:Character mul.png]])'''. |
||
Line 294: | Line 298: | ||
* Click on the "Run" button to display the mails you need to enter |
* Click on the "Run" button to display the mails you need to enter |
||
{| class="wikitable" |
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;" |
||
|+ Codes to be used with [https://timovm.github.io/MailConverter/ TimoVM's MailConverter] |
|+ Codes to be used with [https://timovm.github.io/MailConverter/ TimoVM's MailConverter] |
||
|- |
|- |
||
Line 301: | Line 305: | ||
! scope="row"| English |
! scope="row"| English |
||
|| |
|| |
||
11 F2 D6 21 1B D4 73 23 72 2E 18 2A 12 13 2A 12 |
|||
13 21 7E D5 E5 CD 23 12 3E 01 0E 32 E1 C3 4C 31 |
|||
|} |
|} |
||
Line 316: | Line 320: | ||
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following: |
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following: |
||
* [[User:TimoVM/Mail Writer Codes|Mail codes]]: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc.. |
* [[User:TimoVM/Mail Writer Codes|Mail codes]]: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc.. |
||
* [[User:TimoVM/RAM Writer|RAM writer]]: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI |
* [[User:TimoVM/RAM Writer|RAM writer]]: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. |
||
=Appendix= |
=Appendix= |
||
Line 475: | Line 479: | ||
<pre> |
<pre> |
||
Box 1: $D8BF |
Box 1: $D8BF |
||
80 add a, b |
|||
AF xor a ; a = $00 |
AF xor a ; a = $00 |
||
D6 E8 sub $FF ; a = $18 |
|||
EA F9 F8 ld ($F8F9), a |
|||
EA D1 F8 ld ($F8D1), a |
|||
D6 FF sub $FF ; a = $01 |
|||
D6 F7 sub $F7 ; a = $21 |
|||
FB ei |
|||
50 ld d, b |
50 ld d, b |
||
Box 2: $D8C8 |
Box 2: $D8C8 |
||
EA |
EA D0 F8 ld ($F8D0), a |
||
D6 |
D6 FF sub $FF ; a = $22 |
||
EA |
EA D6 F8 ld ($F8D6), a |
||
21 |
|||
50 ld d; b |
|||
Box 3: $D8D1 |
Box 3: $D8D1 |
||
18 F4 ld hl, $F418 |
|||
E6 A1 and $A1 ; a = $21 |
|||
D6 83 sub $83 ; a = $9F |
|||
EA F4 F8 ld ($F8F4), a |
|||
87 add a, a ; a = $3E, carry flag set |
|||
.write |
|||
22 ldi (hl), a |
|||
D0 ret nc ; Ignore on first pass, taken when .write called |
|||
FB ei |
FB ei |
||
50 ld d, b |
50 ld d, b |
||
Box 4: D8DA |
Box 4: D8DA |
||
E6 84 and $84 ; a = $04 |
|||
EA F8 F8 ld ($F8F8), a |
|||
D4 D6 F8 call nc, .write |
|||
D6 E6 sub $E6 ; a = $4C |
|||
D6 87 sub $87 ; a = $7D |
|||
EA FB F8 ld ($F8FB), a |
|||
FB ei |
|||
50 ld d, b |
50 ld d, b |
||
Box 5: $D8E3 |
Box 5: $D8E3 |
||
.loop |
|||
E6 84 and $84 ; a = $04 |
|||
D6 FF sub $FF ; Increments a on each pass |
|||
EA 9B FA ld ($FA9B), a |
|||
EA EF F8 ld ($F8EF), a |
|||
D6 86 sub $86 ; a = $7E |
|||
F5 push af |
|||
FB ei |
|||
F6 FF or $FF ; a = $FF |
|||
50 ld d, b |
50 ld d, b |
||
Box 6: $D8EC |
Box 6: $D8EC |
||
FB ei |
|||
EA F5 F8 ld ($F8F5), a |
|||
FB ei |
|||
EA 9D FA ld ($FA9D), a |
|||
EA xx F5 ld ($F5xx), a ; Ranges from $F57E to $F5AF, all 50 TMs |
|||
F1 pop af |
|||
21 |
|||
FE AF cp $AF |
|||
50 ld d, b |
|||
Box 7: $D8F5 |
Box 7: $D8F5 |
||
D2 FC F8 jp nc, .continue |
|||
A7 and a, a ; Reset carry flag |
|||
01 32 00 ld bc, $0032 |
|||
D2 E3 F8 jp nc, .loop |
|||
.continue |
|||
AF xor a, a |
|||
50 ld d, b |
50 ld d, b |
||
Box 8: $D8FE |
Box 8: $D8FE |
||
F6 D2 and $D2 ; a = $D2, reset carry flag |
|||
D4 D6 F8 call nc, .write |
|||
D6 |
D6 93 sub $93 ; a = $3F |
||
87 add a, a ; a = $7E, reset carry flag |
|||
FB ei |
|||
50 ld d, b |
50 ld d, b |
||
Box 9: $D907 |
Box 9: $D907 |
||
D4 D6 F8 call nc, .write |
|||
D6 9D sub $9D ; a = $E1, TM33's item ID |
|||
EA B8 F5 ld (wItems), a ; Main item pocket, first item ID |
EA B8 F5 ld (wItems), a ; Main item pocket, first item ID |
||
D6 E3 sub $E3 ; a = $F5 |
|||
EA 9E FA ld ($FA9E), a |
|||
50 ld d, b |
50 ld d, b |
||
Box 10: $D910 |
Box 10: $D910 |
||
F6 F5 or $F5 ; a = $F5 |
|||
D2 D6 F8 jp nc, .write |
|||
D0 ret nc |
|||
50 ld d, b |
50 ld d, b |
||
TM33 bootstrap, starting from $D418 |
|||
3E 04 ld a, $04 |
3E 04 ld a, $04 |
||
D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25 |
D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25 |
||
</pre> |
|||
====Raw Assembly==== |
|||
<pre> |
|||
AF D6 E8 EA D1 F8 D6 F7 50 |
|||
EA D0 F8 D6 FF EA D6 F8 50 |
|||
F4 F4 D6 83 87 87 D0 FB 50 |
|||
E6 84 D4 D6 F8 D6 87 FB 50 |
|||
D6 FF EA EF F8 F5 F6 FF 50 |
|||
FB FB EA F5 F5 F1 FE AF 50 |
|||
D2 FC F8 A7 D2 E3 F8 AF 50 |
|||
F6 D2 D4 D6 F8 D6 93 87 50 |
|||
D4 D6 F8 D6 9D EA B8 F5 50 |
|||
F6 F5 D2 D6 F8 50 50 50 50 |
|||
</pre> |
</pre> |
||
Line 589: | Line 616: | ||
<pre> |
<pre> |
||
Box 1: $D8BF |
Box 1: $D8BF |
||
80 add a, b |
|||
AF xor a ; a = $00 |
AF xor a ; a = $00 |
||
D6 |
D6 E8 sub $FF ; a = $18 |
||
EA |
EA D1 F8 ld ($F8D1), a |
||
D6 F7 sub $F7 ; a = $21 |
|||
FB ei |
|||
50 ld d, b |
50 ld d, b |
||
Box 2: $D8C8 |
Box 2: $D8C8 |
||
EA D0 F8 ld ($F8D0), a |
|||
D6 86 sub $86 ; a = $7E |
|||
D6 FF sub $FF ; a = $22 |
|||
EA 9D FA ld ($FA9B), a |
|||
D6 |
EA D6 F8 ld ($F8D6), a |
||
21 |
|||
FB ei |
|||
50 ld d; b |
|||
Box 3: $D8D1 |
Box 3: $D8D1 |
||
18 F4 ld hl, $F418 |
|||
D6 |
D6 83 sub $83 ; a = $9F |
||
.doubleAndWrite |
|||
EA 9A FA ld ($FA9A), a |
|||
87 add a, a ; a = $3E, carry flag set |
|||
.write |
|||
22 ldi (hl), a |
|||
D0 ret nc ; Ignore on first pass, taken when .write/.doubleAndWrite called |
|||
FB ei |
|||
50 ld d, b |
50 ld d, b |
||
Box 4: D8DA |
Box 4: D8DA |
||
E6 84 and $84 ; a = $04 |
|||
87 add a, a |
|||
D4 D6 F8 call nc, .write |
|||
D6 B9 sub $B9 ; a = $C3 |
|||
AF xor a ; a = $00 |
|||
EA 9C FA ld ($FA9C), a |
|||
F6 D2 or $D2 ; a = $D2 |
|||
D0 ret nc |
|||
50 ld d, b |
50 ld d, b |
||
Box 5: $D8E3 |
|||
Party pokémon #3's stat experience, starting from $DA9A |
|||
D4 D6 F8 call nc, .write |
|||
D6 93 sub $93 ; a = $3F |
|||
D4 D5 F8 call nc, .doubleAndWrite |
|||
50 ld d, b |
|||
Box 6: $D8EC |
|||
AF xor a ; a = $00 |
|||
F6 F5 or $F5 ; a = $F5 |
|||
D2 D6 F8 jp nc, .write |
|||
50 ld d, b |
|||
TM33 bootstrap, starting from $D418 |
|||
3E 04 ld a, $04 |
3E 04 ld a, $04 |
||
D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25 |
|||
</pre> |
</pre> |
||
====Raw Assembly==== |
|||
<pre> |
|||
AF D6 E8 EA D1 F8 D6 F7 50 |
|||
EA D0 F8 D6 FF EA D6 F8 50 |
|||
F4 F4 D6 83 87 87 D0 FB 50 |
|||
E6 84 D4 D6 F8 AF F6 D2 50 |
|||
D4 D6 F8 D6 93 D4 D5 F8 50 |
|||
AF F6 E1 D2 D6 F8 50 50 50 |
|||
</pre> |
|||
[[Category:Guides]] |
[[Category:Guides]] |
Latest revision as of 17:20, 22 July 2024
This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Coin Case glitch. |
This page serves as a repository for a Coin Case ACE setup for the English versions of Pokémon Gold & Silver. It is part of the TimoVM's Gen 2 ACE setups set of guides.
The preparation is best done during daytime in-game. If needed, you can change the in-game clock with the help of this tool.
Please make sure to fully read every step of the guide before executing them.
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.
Setting up initial ACE
When using the Coin Case while a Bellsprout/Machop's cry and specific newly loaded tiles are buffered in memory, the game will execute code in various places before finally ending up in the $FA98-$FA9B range, which is echo ram containing the stat exp data of party pokémon #3.
Using specific movement patterns in the Goldenrod Radio Tower, we can form a jump to $EEEE, which is echo ram for the second character of the last read mail. This gives us enough space to call the start of box names, then fix the side effects of using the Coin Case and return to normal game operation.
In practice, the initial Coin Case ACE setup will be created using the following general process:
- Obtain the Coin Case
- Give any pokémon a mail with specific content and set up a box name code
- Set up a specific movement pattern in the Goldenrod Radio Tower to be able to execute ACE
- Execute a code that gives us 255 of every TM, along with a different, more convenient ACE method.
Step 1: Obtaining everything needed for the setup
- Go to Goldenrod City and obtain the Coin Case by picking it up in the Goldenrod Underground.
- After obtaining the Coin Case, go to the Game Corner.
- If you do not have any coins yet, simply buy 100 coins.
- If you already have coins stored in the coin case, make sure that the first digit of the total number of held coins equals "1".
- In the Goldenrod Dept. Store, buy a Flower Mail.
- For this guide, ensure that the first item in the main item pocket is an item you do not need, as we'll be overwriting it to a different item.
Now that we have the Coin Case, we'll need to set up everything needed to actually safely use it. Using a specific setup, we can force the Coin Case to execute code starting from the second character of the last read mail. From here, we need to ensure that we have the proper setup to execute box name codes.
- Prepare box names to execute a certain effect and return safely to normal game operations. For the purposes of this guide, we'll use the box name in the next section.
- Give any pokémon a flower mail with the following content:
|
Preparing the box name code
Rename the first 10 box names to the following names. This box name will do the following when executed as code:
- Set quantities for all 50 TMs to x255
- Alter the first item in the main item pocket to a TM33, which can be used to trigger ACE
- Set up code so that using TM33 will execute the data stored in TM quantities
|
Step 2: Using Coin Case ACE
In order to use Coin Case ACE, always perform the following steps:
|
|
- Make sure to set box 1 as the current active box.
- Go to the Goldenrod Radio Tower and take the stairs up to the second floor. Move to the spot indicated by the above screenshot on the left. Save the game while you're still standing on this spot and reset the game.
- After reloading, take the following steps until you reach the spot indicated by the above screenshot on the left:
- 3 steps rightwards
- 2 steps upwards
- 1 step leftwards
- Open the start menu, open the pokédex, then listen to the cry of Bellsprout.
- Go to the Pokémon menu and read the previously mentioned mail.
- Open the item bag, switch item pockets at least once, then use the Coin Case. ACE will be executed when the coin count displays on the screen.
With the current box name setups, you can verify that the setup is working by checking the TM/HM pocket. The first item in the main item pocket should be altered to a TM33, in the TM/HM pocket you can now find all TMs, each having a quantity of x255. Do not use this TM33 yet! This TM will allow us to execute the contents of the TM/HM pocket as code, but due to the specific quantities currently present it will be guaranteed to crash the game.
Anytime you wish to execute wrong pocket Coin Case ACE, you'll need to repeat the steps outlined at the beginning of this section. Always make sure the held mail was read before using the Coin Case and ensure that a valid box name code was prepared beforehand.
Troubleshooting
If the code crashes, check the following:
- Did you correctly follow the previous steps?
- Is the current active box set to box 1?
- Make sure that the first digit of the total amount of coins is equal to "1". 100 is a good total for this setup.
- Is the box name code correctly entered?
- Is the content of the mail correct?
A small note on the box names
Due to the limited characterset, the box name code rewrites part of itself to be able to achieve its effect. This will cause the box names to appear glitched after executing Coin Case ACE once.
While this looks weird, this is completely intentional and harmless. The code can still be used again if needed, you can easily fix this issue by renaming the box names to a normal name.
Setting up an ACE environment
While we have a way to execute box name codes using ACE, the current setup has a few drawbacks:
- Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.
- Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.
To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.
When TMs are used outside of the TM/HM pocket, the game will incorrectly attempt to search its item effect in the list of normal item effects. This causes the game to interpret garbage data as item effect pointers, for some TMs this allows us to execute ACE. This is known as Wrong Pocket TM ACE. The advantage of TM33 is that it can be used without requiring specific party/item/box/mail setups.
We've already given ourselves 255 copies of every TM, along with a method to execute the contents of the TM/HM contents in the form of TM33. In this part, we'll sell TMs in specific quantities to write out a program. Once this has been done, we can simply use TM33 to start up the MailWriter.
The mail writer itself will be installed through the following two step process:
- Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
- Use TM33 to activate the mail writer program, allowing us to quickly write out and execute a variety of ACE effects.
- improve the setup by executing a small code to move the mail writer program to unused memory, freeing up the TM pocket for our own use.
Step 3: Selling TMs to form a program in the TM/HM pocket
Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program.
The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
|
TM Quantities to sell
TM | Final Quantity | Sell value |
---|---|---|
TM01 DYNAMICPUNCH | x17 | 357000 |
TM02 HEADBUTT | x85 | 170000 |
TM03 CURSE | x221 | 51000 |
TM04 ROLLOUT | x213 | 42000 |
TM05 ROAR | x213 | 21000 |
TM06 TOXIC | x213 | 63000 |
TM07 ZAP CANNON | x33 | 222000 |
TM08 ROCK SMASH | x66 | 94500 |
TM09 PSYCH UP | x98 | 78500 |
TM10 HIDDEN POWER | x207 | 72000 |
TM11 SUNNY DAY | x225 | 30000 |
TM12 SWEET SCENT | x209 | 23000 |
TM13 SNORE | x42 | 106500 |
TM14 BLIZZARD | x254 | 1500 |
TM15 HYPER BEAM | x80 | 262500 |
TM16 ICY WIND | x56 | 298500 |
TM17 PROTECT | x251 | 6000 |
TM18 RAIN DANCE | x40 | 215000 |
TM19 GIGA DRAIN | x10 | 367500 |
TM20 ENDURE | x135 | 180000 |
TM21 FRUSTRATION | x134 | 60500 |
TM22 SOLARBEAM | x18 | 355500 |
TM23 IRON TAIL | x19 | 354000 |
TM24 DRAGONBREATH | x35 | 330000 |
TM25 THUNDER | x129 | 126000 |
TM26 EARTHQUAKE | x79 | 264000 |
TM27 RETURN | x18 | 118500 |
TM28 DIG | x24 | 231000 |
TM29 PSYCHIC | x239 | 16000 |
TM30 SHADOW BALL | x33 | 333000 |
TM31 MUD-SLAP | x1 | 381000 |
TM32 DOUBLE TEAM | x196 | 59000 |
TM33 ICE PUNCH | x77 | 267000 |
TM34 SWAGGER | x205 | 25000 |
TM35 SLEEP TALK | x239 | 8000 |
TM36 SLUDGE BOMB | x58 | 98500 |
TM37 SANDSTORM | x27 | 228000 |
TM38 FIRE BLAST | x205 | 50000 |
TM39 SWIFT | x144 | 111000 |
TM40 DEFENSE CURL | x55 | 100000 |
TM41 THUNDERPUNCH | x189 | 99000 |
TM42 DREAM EATER | x40 | 322500 |
TM43 DETECT | x217 | 19000 |
TM44 REST | x56 | 298500 |
TM45 ATTRACT | x240 | 22500 |
TM46 THIEF | x254 | 1500 |
TM47 STEEL WING | x08 | 370500 |
TM48 FIRE PUNCH | x200 | 82500 |
TM49 FURY CUTTER | x24 | 346500 |
TM50 NIGHTMARE | x242 | 13000 |
Running the newly written program
- It is recommended to save before continuing.
- Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
- Due to limitations, there is no in-built option to safely exit the mail writer. Instead, you can safely exit by typing the below mail, selecting END on the mail screen, then pressing START to execute the mail.
|
From now on, you can repeat this process at any time to start the mail writer. Since we aren't planning on using the Coin Case anymore, the mail that was previously give to a pokémon can be removed. It is no longer relevant for the remainder of the setup.
The next section will elaborate on the usage of the Mail Writer. Please read these instructions carefully before proceeding.
Troubleshooting & repairing TM33
If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code:
Please mind the differences between uppercase X (), lowercase x (
) and multiplication symbol (
).
|
To execute this box name code, repeat the process for Coin Case ACE:
- Read the mail previously given to a party pokémon.
- Go to the Goldenrod Radio Tower and follow the correct steps to finish the setup.
- Use the Coin Case to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly.
- If the code executes succesfully without crashing the game, TM33's functionality has now been repaired.
Step 4: Using the mail writer
From now on, simply use TM33 to start up the mail writer.
The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.
Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.
|
Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
Controls
Between entering mail codes, the mail writer will ask for user input.
- Press SELECT to open a new mail and continue writing data.
- Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
- Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
![]() |
![]() |
Enter your mail code, then press "END". | It prints the checksum and waits for input. |
Step 5: Improving the setup
Since the mail writer is written using TM quantities, using or gaining TMs will break the mail writer. Because of this, we'll use the mail writer to execute a small code that achieves the following:
- Copies the mail writer to unused memory
- Overwrite the existing quantities in the TM/HM pocket to x1 for every TM
- Alter TM33's underlying code to execute the mail writer in unused memory
You can use the mail code converter page as follows:
- Copy the code in the table below
- Follow the link at the top of the table to the mail code converter
- Paste the code in the text box on the code converter's page
- Select the correct language and version
- Click on the "Run" button to display the mails you need to enter
Language | Gold & Silver |
---|---|
English |
11 F2 D6 21 1B D4 73 23 72 2E 18 2A 12 13 2A 12 13 21 7E D5 E5 CD 23 12 3E 01 0E 32 E1 C3 4C 31 |
After executing this code, attempt to start up the mail writer. If you are able to open it and are able to successfully execute the following blank mail, the copy has finished successfully and you can save the game.
|
What to do with the Mail writer
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
- Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..
- RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI.
Appendix
Plain text transcripts of codes
Language | English |
---|---|
h h 's z 2 Pk 'l 0 9 ♀ . 9 Pk * ' ] h 'd | |
Setup box name |
Box 1: p 'v . é 'l 2 'v 1 Box 2: é 'd 2 'v 9 é 'v 2 Box 3: , , 'v D H H 'd 5 Box 4: ? E 's 'v 2 'v H 5 Box 5: 'v 9 é ♂ 2 ♀ 0 9 Box 6: 5 5 é ♀ ♀ * 8 p Box 7: 'm 6 2 h 'm - 2 p Box 8: 0 'm 's 'v 2 'v T H Box 9: 's 'v 2 'v ; é y ♀ Box 10: 0 ♀ 'm 'v 2 |
Reset box name |
Box 1: p 'v . é 'l 2 'v 1 Box 2: é 'd 2 'v 9 é 'v 2 Box 3: , , 'v D H H 'd 5 Box 4: ? E 's 'v 2 p 0 'm Box 5: 's 'v 2 'v T 's 't 2 Box 6: p 0 ♀ 'm 'v 2 |
In-depth explanation of the setup
Effect of the Coin Case
Activating the Coin Case causes arbitrary code execution from $E112 onward, which is echo ram for $C112. This region corresponds with sound data and can be manipulated by buffering pokémon cries.
Playing Bellsprout or Machop's cry will buffer $33 at $C117. This opcode increments the stack pointer, desyncing the stack.
The sound that plays when swapping item pockets clears some bad data around the $C16x region. It also places a $C1 at $C16E, popping a value from the stack to registers bc.
The sound that plays when confirming the use of the Coin Case places $80 A1 D0 at $C192. Due to prior opcodes setting the value of register bc to $0000, the condition for the return will always be true. Thanks to incrementing the stack pointer and popping the stack once, the next return address will redirect execution to $EB12, echo ram for $CB12.
From $CB12, the game will nopslide until $CC20 is reached. This region contains data on buffered tiles that are added when the player moves around . Due to our specific movement pattern within the Goldenrod Radio Tower, this results in the following data, starting from $CC20:
At start, hl = $B2B2 and sp : $DFBC 39 add sp ; hl = $926E 39 add sp ; hl = $722A 39 add sp ; hl = $51E6 39 add sp ; hl = $31A2 39 add sp ; hl = $115E 39 add sp ; hl = $F11A 39 add sp ; hl = $D0D6 39 add sp ; hl = $B092 39 add sp ; hl = $904E 39 add sp ; hl = $700A 39 add sp ; hl = $4FC6 39 add sp ; hl = $2F82, carry flag set 30 31 jr nc, $31 ; Ignore thanks to previous carry 1A ld a, (de) 1B dec de 1A ld a, (de) 1B dec de 0A ld a, (bc) 0B dec bc 01 01 01 ld bc, $0101 01 01 01 ld bc, $0101 01 01 01 ld bc, $0101 01 01 01 ld bc, $0101 01 01 01 ld bc, $0101 01 39 39 ld bc, $3939 39 add sp ; hl = $0F3E 39 add sp ; hl = $EEFA, desired result in h, zero flag set 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 00 nop 01 01 01 ld bc, $0101 01 01 01 ld bc, $0101 01 01 01 ld bc, $0101 01 01 01 ld bc, $0101 01 01 01 ld bc, $0101 01 00 00 ld bc, $0000 00 nop 00 nop 84 add h 9B sbc e A4 and h 9B scb e ; The result of these arithmatic opcodes aren't relevant, but they do reset the zero flag C4 9B E4 call nz, $E49B ; Corresponds to lower parts of screen tile data
The main result of this region is to set h to $EE, followed by a call to screen tile data.
Before ACE is triggered, the game will already print the amount of coins on screen. In particular, a number of coins whose first digit is equal to 1 will lead to $F7 (rst30h) being printed to $C4E1. The region between $C49B and $C4E1 is filled with harmless data consisting of blank tiles ($7F), textbox tiles ($7A-$7C) and arithmatic opcodes for the "Coins:" text ($82 AE A8 AD B2 9C). The end result is that a is set to be equal to $EE, the value stored in h, right before rst30h is activated.
rst30h is technically an unused reset vector, but accidentally contains the last three bytes of JumpTable function, usually accessed by rst28h:
6F ld l, a ; hl = $EEEE D1 pop de ; Pops the return address to registers de E9 jp hl ; Jump to $EEEE, the second character of the last read mail
This allows us to finally reach the last read mail, a region of memory that we have a good amount of control over.
Effect of the mail
The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following:
A7 and a ; Filler A7 and a ; Reset carry flag D4 B9 F8 call nc, $F8B9 ; Box names start at $D8BF/F8BF, setting the active box to box 1 will ensure we can safely slide through. E1 pop hl ; Additional pop to clear return address of call to screen data D1 pop de ; Set de to $0075, which holds value $00. Ensures that print function will end immediately after resuming E8 FF add sp, -1 ; Fix the effect of increasing the stack pointer F1 pop af ; a = $03 E0 9F ld ($FF9F), a ; Ensures return to ROM bank 3 after resuming execution A7 and a ; Reset carry flag. Not strictly necessary, but added for safety for now D0 ret nc
Effect of the setup box name code
Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.
The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.
Separately, this code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
Lastly, the value of the first item ID in the main item pocket is overwritten so that it becomes a TM25.
Box 1: $D8BF AF xor a ; a = $00 D6 E8 sub $FF ; a = $18 EA D1 F8 ld ($F8D1), a D6 F7 sub $F7 ; a = $21 50 ld d, b Box 2: $D8C8 EA D0 F8 ld ($F8D0), a D6 FF sub $FF ; a = $22 EA D6 F8 ld ($F8D6), a 21 Box 3: $D8D1 18 F4 ld hl, $F418 D6 83 sub $83 ; a = $9F 87 add a, a ; a = $3E, carry flag set .write 22 ldi (hl), a D0 ret nc ; Ignore on first pass, taken when .write called FB ei 50 ld d, b Box 4: D8DA E6 84 and $84 ; a = $04 D4 D6 F8 call nc, .write D6 87 sub $87 ; a = $7D FB ei 50 ld d, b Box 5: $D8E3 .loop D6 FF sub $FF ; Increments a on each pass EA EF F8 ld ($F8EF), a F5 push af F6 FF or $FF ; a = $FF 50 ld d, b Box 6: $D8EC FB ei FB ei EA xx F5 ld ($F5xx), a ; Ranges from $F57E to $F5AF, all 50 TMs F1 pop af FE AF cp $AF 50 ld d, b Box 7: $D8F5 D2 FC F8 jp nc, .continue A7 and a, a ; Reset carry flag D2 E3 F8 jp nc, .loop .continue AF xor a, a 50 ld d, b Box 8: $D8FE F6 D2 and $D2 ; a = $D2, reset carry flag D4 D6 F8 call nc, .write D6 93 sub $93 ; a = $3F 87 add a, a ; a = $7E, reset carry flag 50 ld d, b Box 9: $D907 D4 D6 F8 call nc, .write D6 9D sub $9D ; a = $E1, TM33's item ID EA B8 F5 ld (wItems), a ; Main item pocket, first item ID 50 ld d, b Box 10: $D910 F6 F5 or $F5 ; a = $F5 D2 D6 F8 jp nc, .write 50 ld d, b TM33 bootstrap, starting from $D418 3E 04 ld a, $04 D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25
Raw Assembly
AF D6 E8 EA D1 F8 D6 F7 50 EA D0 F8 D6 FF EA D6 F8 50 F4 F4 D6 83 87 87 D0 FB 50 E6 84 D4 D6 F8 D6 87 FB 50 D6 FF EA EF F8 F5 F6 FF 50 FB FB EA F5 F5 F1 FE AF 50 D2 FC F8 A7 D2 E3 F8 AF 50 F6 D2 D4 D6 F8 D6 93 87 50 D4 D6 F8 D6 9D EA B8 F5 50 F6 F5 D2 D6 F8 50 50 50 50
Effect of the TM code
Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.
11 55 DD ld de, $DD55 D5 push de D5 push de ; .nextMail D5 push de 21 42 62 ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C4 ld hl, $C401 ; .screenLoop 4D ld c, l CD EF 3A call PrintBCDNumber.loop - 1 1B dec de ; .goBack CD 90 37 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
Effect of the reset box name code
Converting the characters from box names to assembly results in the following code. This code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
Box 1: $D8BF AF xor a ; a = $00 D6 E8 sub $FF ; a = $18 EA D1 F8 ld ($F8D1), a D6 F7 sub $F7 ; a = $21 50 ld d, b Box 2: $D8C8 EA D0 F8 ld ($F8D0), a D6 FF sub $FF ; a = $22 EA D6 F8 ld ($F8D6), a 21 Box 3: $D8D1 18 F4 ld hl, $F418 D6 83 sub $83 ; a = $9F .doubleAndWrite 87 add a, a ; a = $3E, carry flag set .write 22 ldi (hl), a D0 ret nc ; Ignore on first pass, taken when .write/.doubleAndWrite called FB ei 50 ld d, b Box 4: D8DA E6 84 and $84 ; a = $04 D4 D6 F8 call nc, .write AF xor a ; a = $00 F6 D2 or $D2 ; a = $D2 50 ld d, b Box 5: $D8E3 D4 D6 F8 call nc, .write D6 93 sub $93 ; a = $3F D4 D5 F8 call nc, .doubleAndWrite 50 ld d, b Box 6: $D8EC AF xor a ; a = $00 F6 F5 or $F5 ; a = $F5 D2 D6 F8 jp nc, .write 50 ld d, b TM33 bootstrap, starting from $D418 3E 04 ld a, $04 D2 7E F5 jp nc, wTMsHMS ; Carry and zero flag are both reset when using TM25
Raw Assembly
AF D6 E8 EA D1 F8 D6 F7 50 EA D0 F8 D6 FF EA D6 F8 50 F4 F4 D6 83 87 87 D0 FB 50 E6 84 D4 D6 F8 AF F6 D2 50 D4 D6 F8 D6 93 D4 D5 F8 50 AF F6 E1 D2 D6 F8 50 50 50