Guides:Glitch Pokédex Mode ACE setup

This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Glitch Pokédex Mode ACE.

This page serves as a repository for a Glitch Pokédex Mode ACE setup for the English, Italian and Spanish versions of Pokémon Gold & Silver. It is part of the TimoVM's Gen 2 ACE setups set of guides.

Please make sure to fully read every step of the guide before executing them.

If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.

Setting up initial ACE

In the generation 2 games, the pokédex has three different modes that change the order of displayed pokémon within the pokédex. When selecting a certain mode, the game stores the value of the last selected mode in RAM, so that it will keep using this mode when you next use the pokédex. This valueis then used as part of a jump table, which returns the addresses of the functions used to determine the pokédex order.

By setting this value to an invalid pokédex mode value, the game will index this jumptable out of bounds. Some of these invalid values result in addresses that point to wram, resulting in arbitrary code execution. Since this value is in reach of the extended ball pocket, we can abuse an item swap to set such an invalid value.

By using the special properties of a $00 species pokémon, we are able to obtain duplicate key items which can then allow us to set up the extended ball pocket. One of the major components of previous ACE setups was the requirement of having to use the day care in order to obtain a $00 species pokémon. This guide introduces a setup that does not require the day care and can be set up in Violet City, once the player obtains the Togepi Egg.

In practice, the initial ACE setup will be created using the following general process:

1. Obtain the necessary items and pokémon for the setup.
2. Obtain a bad clone.
3. Increase the happiness of the bad clone by 1, then create a hybrid between the Togepi egg and the bad clone.
4. Hatch the bad clone egg to obtain a $00 species pokémon.
5. Use the $00 species pokémon to obtain two mystery eggs and one fast ball, then use duplicate key items glitch to activate the extended ball pocket and set up glitch pokédex mode ACE.

Things you should know prior to starting the guide

This guide allows players to set up ACE from Violet City onward, right after obtaining the Togepi Egg. As a drawback, the player needs to perform two separate save corruptions, both of which have around between 1 frame of leeway. Alternative guides that are easier to perform are provided on the TimoVM's Gen 2 ACE setups page that can be executed once you reach Goldenrod City.

Requirements for this guide

When playing on original cartridge or on emulator, it is absolutely required to have used the Clear Save Data feature (press SELECT + UP + B on the title screen) or have replaced the battery at least once since owning the game.

• Completing the setup requires having reached Violet City and obtaining the first gym badge.
• Due to technical reasons, please ensure that the following is true for your trainer ID:
  • Your trainer ID must not be equal or higher than 65280.
  • The remainder after dividing your trainer ID by 256 must not be equal to 255.
• If your trainer ID does not fulfill both requirements, you will not be able to finish this guide. If you do not wish to reset your save please use the alternative guide, provided on the TimoVM's Gen 2 ACE setup page, that can be executed once you reach Goldenrod City.

A note on the side effects of the method described below

The method described on this page requires fairly heavy abuse of glitches that will produce a number of side effects. All these side effects can be fixed with later applications of ACE and are never permanently harmful for the game in any way:

• Obtaining duplicate key items requires obtaining a glitch pokémon that cannot be manually released.
• Hatching a $00 species pokémon sets the seen/caught flags for an pokémon species that should not exist.
• Duplicate key item swap glitch removes the CANCEL button from the key item pocket.
• Buying or obtaining additional poké balls causes issues when done with an extended ball pocket.
• Setting up glitch pokédex mode ACE disables the use of the PokéGear.

A code will be provided at the end of the guide that fixes all these issues in a single execution.

Step 1: Initial setup

When playing on original cartridge or on emulator, it is absolutely required to have used the Clear Save Data feature (press SELECT + UP + B on the title screen) at least once since owning the game.

Preparing the save

First, we're going to make sure to set up the save and collect all the requirements to perform the setup.

• (optional) Hold SELECT + UP + B on the title screen to reset your save. After the save is cleared, start a new game.
• Due to technical reasons, this guide can only be performed if the following are both true for your trainer ID:
  • Your trainer ID must not be equal or higher than 65280.
  • The remainder after dividing your trainer ID by 256 must not be equal to 255.
• Any starter works, but Totodile is the fastest option and can be used to obtain a Flower Mail without needing a separate visit to the PokéMart.
• Make sure to start the in-game clock during morning or midday.

Collecting the requirements

Next, we'll gather the required items and pokémon for the setup.

• Do the following before reaching Violet City:
  • Catch one Sentret (Route 29, 40% to encounter only during morning and midday)
  • Catch one Bellsprout (route 31, 20% chance to encounter throughout the day)
• Do the following after reaching Violet City:
  • Defeat the gym leader and obtain TM31 (mud-slap)
  • Obtain the Togepi egg
  • Within the ball pocket, make sure you only have two poké ball left.
  • (optional) Set the current pokédex mode to "OLD POKéDEX MODE". This adds a visual marker for a later item swap.

Step 2: Obtaining a $00 species pokémon

Using two instances of save corruption, we'll turn the starter into a $00 glitch pokémon.

Preparing the box

Before we can use save corruption with any degree of consistency, it is a good idea to fill up a box first. This will give us around 1 frame of leeway to perform save corruption.

• Using normal cloning, put 15 pokémon in a box that has never been completely full at any point in the past.
  • Make sure you end up with at least 5 copies of Bellsprout.
  • For safety reasons, it is recommended you make additional clones of the starter pokémon, the Togepi egg and the Sentret.

Performing the first save corruption

Using save corruption, we're going to turn the starter into a bad clone of the starter using the following process:

1. Deposit the starter to the current active box.
2. Go to "Move pokémon w/o mail", you will get a prompt to save the game.
3. Reset the game shortly after the "saving...” text is fully printed.
4. If successful, upon restarting the game you will find a level 0 female version of the deposited pokémon with a blank name.

Please note that the timing of this is very strict (around 1 frame to obtain a bad clone).

• If nothing was saved, the reset was too early. Next time, wait a little bit longer to reset.
• If the pokémon was successfully cloned, the reset was too late. next time, reset a little bit earlier.
• If the box ever gets to 19 pokémon in total, release pokémon from the box until there are only 15 pokémon present. Make sure to save normally after releasing them.

Use these guidelines and keep retrying until you've obtained a bad clone.

Preparing the bad clone for the second save corruption

Our aim is to hatch a $00 species. The bad clone gets us halfway there, but we need to adjust its happiness value so that it can hatch as soon as possible after hybridizing it to a bad clone egg.

• Withdraw the bad clone, use TM31 to teach it mud-slap. This will increase its happiness value by exactly 1.
• Deposit the bad clone back into the active box.
• Deposit enough pokémon to completely fill the box, ensure that the bad clone is at the last position inside the box.
• Withdraw the Togepi egg to your party.
• Withdraw/release pokémon other than the bad clone from the box until 15 pokémon are left in the box. Ensure that the bad clone is always in the last position.

Performing the second save corruption

Using save corruption, we're going to obtain a bad clone of the Togepi egg. Thanks to filling the box entirely and putting the bad clone in the last position within the box, all the empty slots are now filled with leftover data of the bad clone. This allows us to create an egg containing the data of the bad clone.

1. Deposit the Togepi Egg to the current active box.
2. Go to "Move pokémon w/o mail", you will get a prompt to save the game.
3. Reset the game shortly after the "saving...” text is fully printed.
4. If successful, upon restarting the game you will find an egg with a blank name. In the summary, it will report that it is making sounds and is close to hatching.
5. Withdraw the bad clone egg, then walk around until it hatches into a $00 species.

Please note that the timing of this is very strict (around 1 frame to obtain a bad clone egg).

• If nothing was saved, the reset was too early. Next time, wait a little bit longer to reset.
• If the pokémon was successfully cloned, the reset was too late. next time, reset a little bit earlier.
• If the box ever gets to 20 pokémon in total, move the bad clone to the last slot, then release/move pokémon from the box (while keeping the bad clone in the last slot) until there are only 15 pokémon present. Make sure to save normally after releasing/moving them.

Step 3: Obtaining duplicate key items and setting up glitch pokédex mode ACE

Reminder: this method will only work if your trainer ID fulfills both of the following requirements:

• Your trainer ID must not be equal or higher than 65280.
• The remainder after dividing your trainer ID by 256 must not be equal to 255.

Collecting the required items and party

Have the following items in the ball pocket:

• Slot 1: Poké Ball x2
• Slot 2 and beyond: empty

Have the following items in the key item pocket:

• All key items you've obtained in your save thus far (withdraw all key items, if any, that you previously stored from the PC)

Have the following pokémon in the party:

1. $00 Species that was hatched from the bad clone egg
2. Sentret
3. Starter pokémon
4. Bellsprout
5. Bellsprout
6. Bellsprout

Have the following pokémon in the box:

1. Two Bellsprout
2. Ine normal Pokémon.

Keep in mind that all these pokémon, with the exception of the normal pokémon, will be corrupted during this process. Please make sure to obtain copies of these pokémon using normal cloning if you wish to keep any of them.

Performing a party overload

Next, we're going to abuse the special properties of the $00 species pokémon to get over 6 pokémon simultaneously in the party.

1. Using "move pokémon w/o mail", add a Bellsprout to the first party slot. This will push the glitch pokémon down to the second slot.
2. Exit the PC, open the start menu and switch the glitch pokémon in the second slot with the Bellsprout in the fifth slot. Your party should be arranged as such:
   1. Bellsprout
   2. Bellsprout
   3. Sentret
   4. Starter pokémon
   5. $00 Species that was hatched from the bad clone egg
   6. Bellsprout
   7. Bellsprout
3. Using "move pokémon w/o mail", add a second Bellsprout to last available party slot. This will result in a total of 8 party pokémon, both Bellsprouts and the Sentret now have a held item.
4. Exit the PC, open the start menu. Retrieve the Mystery Eggs from the Bellsprouts, retrieve the Fast Ball from the Sentret.
5. (optional) If you picked Totodile as a starter, it will now be holding a flower mail. Retrieve it and put it in the bag.
6. Select "Deposit pokémon" from the PC and release the top three pokémon in your party.
7. Withdraw the normal pokémon from your box using "Withdraw pokémon". This will restore the normal functionality of the party.

Setting up glitch pokédex mode ACE

1. Arrange the Ball pocket as follows:
   1. Slot 1: Fast Ball x1
   2. Slot 2: Poké Ball x2
2. Go to the KEY ITEM pocket. Swap the first MYSTERY EGG with the second MYSTERY EGG.
3. Go to the BALL pocket, the FAST BALL has now changed into a MASTER BALL. THE POKé BALL has now changed into an ULTRA BALL. The game now believes you have a total of 161 item slots in the ball pocket, allowing you to scroll past the CANCEL button.
4. Toss 96 Ultra Balls until you have only 159 Ultra Balls remaining. Swap the Ultra Ball with the item in the 65th item slot (this item slot can be easily recognized due to having a quantity of 1 if you've previously set "OLD POKéDEX MODE" in the POKéDEX).
5. Go back to the start menu. Check if the PokéGear option has disappeared from the start list. If it has, you can now save the game.

This swap removes the PokéGear from the start list and will activate Glitch Pokédex Mode ACE. From this point onward, using the pokédex will trigger ACE from $EEEB onward, an address that is located two bytes before the last read mail.

Do NOT open the pokédex yet. Opening the pokédex right now will likely crash the game. We first need to set up a way to properly execute ACE in a controlled manner.

Setting up an ACE environment

We have successfully set up Glitch Pokédex Mode ACE, what now?

Using Glitch Pokédex Mode ACE works great for an initial setup, but there are a few drawbacks:

• At this moment, we are not able to change the Pokédex Mode. This renders the Pokédex unusable for any other purpose than ACE.
• While $EEEB is a very convenient entrance point, we still need to actually read a mail every time we want to execute ACE.

Due to this, we're going to focus on building the setup in three ways:

• Our aim is to switch from Glitch Pokédex Mode ACE to Wrong Pocket TM ACE. By putting a TM33 in a pocket other than the TM/HM pocket, we can simply use TM33 to execute ACE. TM33 will trigger ACE from address $D418 onward, which corresponds to unused data.
• We're going to install a program, written using TM quantities, that allows us to easily write and execute any code we want.
• We're going to make it so that using TM33 starts this program, without requiring a party or item setup.

In summary, we will proceed as follows:

• Prepare a mail and box name code
• Sell TMs in specific quantities in order to be able to run the Mail Writer
• Use Wrong Pocket TM25 to run the Mail Writer and clean up the side-effects of the setup.

Step 4: Setting up the Mail Writer

• Make sure you have at least one item in the main item pocket. This item will be overwritten to become a TM33.
• Give any party pokémon a mail with the following language-dependent content to hold:

English	Italian & Spanish

• We'll set up TM33 and obtain 255 copies of every TM using a single execution. Write the following box name codes:

English	Italian	Spanish

Once this is done, make sure to save the game.

Step 5: Using Glitch Pokédex Mode ACE

Now that we have everything set up, we are going to use Glitch Pokédex Mode ACE to execute the box name code that we previously set up.

Executing the box name code

You can use Glitch Pokédex Mode ACE using the following process:

• In case you have more than one Key Item, make sure that the Mystery Egg is located at the top of the key item pocket.
• Read the held mail that was previously given to a party pokémon.
• Open the start menu and open the pokédex. If the mail and box name codes were written correctly, this will immediately open and automatically close the pokédex.

The code that we used had the following effects.

• The first item of the main item pocket was overwritten to become a TM33.
• The TM/HM pocket has now been filled with 255 copies of every kind of TM.
• Code was added to ensure that using TM33 executes code in the TM/HM pocket.

Before continuing, make sure to verify that a TM33 is present in the Main Item pocket and that all TMs have a quantity of 255.

Do not use this TM33 yet! This TM will allow us to execute the contents of the TM/HM pocket as code, but due to the specific quantities currently present it will be guaranteed to crash the game.

Troubleshooting

If the code crashes, check the following:

• Are the box name codes (or mail) correct?
• In the 65th slot of the Ball pocket, is the item quantity equal to 159?

Step 6: Selling TMs to set up the Mail Writer

Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using.

The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.

Graphical overview

English	Italian	Spanish

TM Sell List

TM	Final Quantity			Sell value
	English	Italian	Spanish	English	Italian	Spanish
TM01 DYNAMICPUNCH	x17			357000
TM02 HEADBUTT	x85			170000
TM03 CURSE	x221			51000
TM04 ROLLOUT	x213			42000
TM05 ROAR	x213			21000
TM06 TOXIC	x213			63000
TM07 ZAP CANNON	x33			222000
TM08 ROCK SMASH	x66	x118	x153	94500	68500	51000
TM09 PSYCH UP	x98			78500
TM10 HIDDEN POWER	x207			72000
TM11 SUNNY DAY	x225			30000
TM12 SWEET SCENT	x209			23000
TM13 SNORE	x42			106500
TM14 BLIZZARD	x254			1500
TM15 HYPER BEAM	x80			262500
TM16 ICY WIND	x56			298500
TM17 PROTECT	x251			6000
TM18 RAIN DANCE	x40			215000
TM19 GIGA DRAIN	x10			367500
TM20 ENDURE	x135			180000
TM21 FRUSTRATION	x134			60500
TM22 SOLARBEAM	x18			355500
TM23 IRON TAIL	x19			354000
TM24 DRAGONBREATH	x35			330000
TM25 THUNDER	x129			126000
TM26 EARTHQUAKE	x79			264000
TM27 RETURN	x18			118500
TM28 DIG	x24			231000
TM29 PSYCHIC	x239			16000
TM30 SHADOW BALL	x33			333000
TM31 MUD-SLAP	x1			381000
TM32 DOUBLE TEAM	x196			59000
TM33 ICE PUNCH	x77			267000
TM34 SWAGGER	x205			25000
TM35 SLEEP TALK	x239	x222	x162	8000	16500	46500
TM36 SLUDGE BOMB	x58			98500
TM37 SANDSTORM	x27			228000
TM38 FIRE BLAST	x205			50000
TM39 SWIFT	x144	x127	x77	111000	128000	178000
TM40 DEFENSE CURL	x55			100000
TM41 THUNDERPUNCH	x189			99000
TM42 DREAM EATER	x40			322500
TM43 DETECT	x217			19000
TM44 REST	x56			298500
TM45 ATTRACT	x240			22500
TM46 THIEF	x254			1500
TM47 STEEL WING	x08			370500
TM48 FIRE PUNCH	x200			82500
TM49 FURY CUTTER	x24			346500
TM50 NIGHTMARE	x242			13000

Running the newly written program

1. It is recommended to save before continuing.
2. Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
3. Due to limitations, there is no in-built option to safely exit the mail writer. Instead, you can safely exit by typing the below mail, selecting END on the mail screen, then pressing START to execute the mail.

From now on, you can repeat this process at any time to start the mail writer.

The next section will elaborate on the usage of the Mail Writer. Please read these instructions carefully before proceeding.

Troubleshooting & repairing TM33

If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code:

Please mind the differences between uppercase X (), lowercase x () and multiplication symbol ().

To execute this box name code, repeat the process for Glitch Pokédex Mode ACE:

• Read the mail previously given to a party pokémon.
• Open the pokédex. If the pokédex opens and immediately closes, the setup will have worked.

Step 7 : How the mail writer works

From now on, simply use TM33 to start up the mail writer.

The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.

This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.

Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.

Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.

Controls

Between entering mail codes, the mail writer will ask for user input.

• Press SELECT to open a new mail and continue writing data.
• Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
• Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.

Enter your mail code, then press "END".	It prints the checksum and waits for input.

Step 8: Improving the setup

Finally, we can both test the Mail Writer and fix the side effects of the setup. Please note that, for safety reasons, this cleanup code will not disable Glitch Pokédex Mode ACE. A second code will be provided that allows you to alter the current Pokédex Mode directly.

Since the mail writer is written using TM quantities, using or gaining TMs will break the mail writer. Because of this, we'll use the mail writer to execute a code that achieves the following:

• Copies the mail writer to unused memory
• Overwrite the existing quantities in the TM/HM pocket to x1 for every TM
• Alter TM33's underlying code to execute the mail writer in unused memory
• As a bonus, we'll also fix the side effects of the setup. Please note that, for safety reasons, this cleanup code will not disable Glitch Pokédex Mode ACE. A second code will be provided that allows you to alter the current Pokédex Mode directly.

You can use the mail code converter page as follows:

• Copy the code in the table below
• Follow the link at the top of the table to the mail code converter
• Paste the code in the text box on the code converter's page
• Select the correct language and version
• Click on the "Run" button to display the mails you need to enter

Simply copy the assembly code that is applicable for your setup, then click the link at the top of the table to go to the MailConverter tool. Make sure to select the current language and "Gold/Silver" as version.

Before executing this code, make sure to swap the glitch pokémon into the last party slot.

Codes to be used with TimoVM's MailConverter

All languages
21 7A D6 2A 23 F6 84 22 AF 21 E1 D5 35 47 4E 09 23 36 FF 2E FC 36 01 21 03 DC CB BE 2E 23 CB BE 21 22 DA 4E 35 09 36 FF 01 32 00 11 F2 D6 21 1B D4 73 23 72 3E 3E 12 13 3E 04 12 13 21 7E D5 E5 CD 1A 31 3E 01 0E 32 E1 C3 4C 31

The cleanup code has the following effects:

1. Move the mail writer program to unused memory.
2. Adjust TM33's code so that using it now activates the mail writer at its new location.
3. Set all TM quantities to x1.
4. Restore the previous PokéGear flags.
5. Remove the last MYSTERY EGG from the key item pocket and add a CANCEL button at the end of the key item list.
6. Set the amount of items in the ball pocket to 1.
7. Remove the seen/caught flags of the hatched $00 species.
8. Remove the glitch pokémon at the end of the party.

Optional: Altering the current Pokédex Mode

This code will alter the current active Pokédex Mode. By default, it sets the Pokédex Mode to zero, making it possible to use the Pokédex normally again. By changing the value marked in bold, you can change the value that the Pokédex Mode will be set to. You can reactivate Mode 159, the Mode that executes from $EEEB onward, by changing the value in bold to $9F.

Code to be used with TimoVM's MailConverter

3E 00 EA 7E D6 C9

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

• Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
• RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.

Appendix

Plain text transcripts of codes

• Glitch Pokédex mail

Language	Mail	Language	Mail
English	's z 2 p 0 b H ♀ Pk 0 - 1	Italian & Spanish	ó z 2 p 0 b H ♀ Pk 0 - 1

• Setup box name code

Language	Box names	Language	Box names
English	Box 1: p 'v . é 'l 2 'v 1 Box 2: é 'd 2 'v 9 é 'v 2 Box 3: , , 'v D H H 'd 5 Box 4: ? E 's 'v 2 'v H 5 Box 5: 'v 9 é ♂ 2 ♀ 0 9 Box 6: 5 5 é ♀ ♀ * 8 p Box 7: 'm 6 2 h 'm - 2 p Box 8: 0 'm 's 'v 2 'v T H Box 9: 's 'v 2 'v ; é y ♀ Box 10: 0 ♀ 'm 'v 2	Italian & Spanish	Box 1: p ° . é í 2 ° 1 Box 2: é ì 2 ° 9 é ° 2 Box 3: , , ° D H H ì 5 Box 4: ? E ó ° 2 ° H 5 Box 5: ° 9 é ♂ 2 ♀ 0 9 Box 6: 5 5 é ♀ ♀ * 8 p Box 7: ñ 6 2 h ñ - 2 p Box 8: 0 ñ ó ° 2 ° T H Box 9: ó ° 2 ° ; é y ♀ Box 10: 0 ♀ ñ ° 2

• Reset box name code

Language	Box names	Language	Box names
English	Box 1: p 'v . é 'l 2 'v 1 Box 2: é 'd 2 'v 9 é 'v 2 Box 3: , , 'v D H H 'd 5 Box 4: ? E 's 'v 2 p 0 'm Box 5: 's 'v 2 'v T 's 't 2 Box 6: p 0 ♀ 'm 'v 2	Italian & Spanish	Box 1: p ° . é í 2 ° 1 Box 2: é ì 2 ° 9 é ° 2 Box 3: , , ° D H H ì 5 Box 4: ? E ó ° 2 p 0 ñ Box 5: ó ° 2 ° T ó ú 2 Box 6: p 0 ♀ ñ ° 2

In-depth explanation of the setup

Effect of the glitch pokédex mode

In the 2nd generation of Pokémon games, the Pokédex offers three different modes of sorting pokémon species (New, Old, A-Z). When the Pokédex is opened, the game checks which mode was last active, then launches a function to sort all species. Since the game needs to know which mode was last active, the last used Pokédex mode is stored in RAM at address $D67E.

By swapping an item stack using the extended Ball Pocket, we can directly overwrite the value for the last used mode. When the Pokédex is next opened, the game will read this value and attempt to launch an invalid sorting function depending on the value used, some of which will trigger ACE.

For the English, Italian and Spanish versions of Gold & Silver, mode 159 ($9F) will trigger ACE from $EEEB onward. This address is echo ram for $CEEB and lies two bytes in front of the last read mail. While these two bytes do have some use, their values will start out as empty after resetting the game.

When species $00 is registered to the Pokédex, opening the Pokédex after safely returning from ACE can result in regions of data (including map data) being overwritten with $D1 values. To prevent this issue from occuring, the codes included will ensure that we will be immediately forced to exit the pokédex once the code is executed.

Effect of the mail

The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following:

Mail

D4 B9 F8	call nc, wBoxNames - 6h
AF		xor a			; a = $00
F6 A1		or $A1			; a = $A1
87		add a, a		; a = $42
F5		push af
E1		pop af			; h = $42
F6 A1		or $E3			; a = $E3
F7		rst30h			; Jump to $10:42E3, final bytes of Pokedex_ReinitDexEntryScreen. This will set $CE63 to $FF, causing immediate exit of Pokédex after return

Effect of the setup box name code

Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.

The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.

Separately, this code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.

Lastly, the value of the first item ID in the main item pocket is overwritten so that it becomes a TM25.

Box 1: $D8BF
AF		xor a		; a = $00
D6 E8		sub $FF		; a = $18
EA D1 F8	ld ($F8D1), a
D6 F7		sub $F7		; a = $21
50		ld d, b

Box 2: $D8C8
EA D0 F8	ld ($F8D0), a
D6 FF		sub $FF		; a = $22
EA D6 F8	ld ($F8D6), a
21

Box 3: $D8D1
   18 F4	ld hl, $F418
D6 83		sub $83		; a = $9F
87		add a, a	; a = $3E, carry flag set
.write
22		ldi (hl), a
D0		ret nc		; Ignore on first pass, taken when .write called
FB		ei
50		ld d, b

Box 4: D8DA
E6 84		and $84		; a = $04
D4 D6 F8	call nc, .write
D6 87		sub $87		; a = $7D
FB		ei
50		ld d, b

Box 5: $D8E3
.loop
D6 FF		sub $FF		; Increments a on each pass
EA EF F8	ld ($F8EF), a
F5		push af
F6 FF		or $FF		; a = $FF
50		ld d, b

Box 6: $D8EC
FB		ei
FB		ei
EA xx F5	ld ($F5xx), a	; Ranges from $F57E to $F5AF, all 50 TMs
F1		pop af
FE AF		cp $AF
50		ld d, b


Box 7: $D8F5
D2 FC F8	jp nc, .continue
A7		and a, a	; Reset carry flag
D2 E3 F8	jp nc, .loop
.continue
AF		xor a, a
50		ld d, b

Box 8: $D8FE
F6 D2		and $D2		; a = $D2, reset carry flag
D4 D6 F8	call nc, .write
D6 93		sub $93		; a = $3F
87		add a, a	; a = $7E, reset carry flag
50		ld d, b

Box 9: $D907
D4 D6 F8	call nc, .write
D6 9D		sub $9D		; a = $E1, TM33's item ID
EA B8 F5	ld (wItems), a	; Main item pocket, first item ID
50		ld d, b

Box 10: $D910
F6 F5		or $F5		; a = $F5
D2 D6 F8	jp nc, .write
50		ld d, b

TM33 bootstrap, starting from $D418
3E 04		ld a, $04
D2 7E F5	jp nc, wTMsHMS	; Carry and zero flag are both reset when using TM25

Raw Assembly

 AF D6 E8 EA D1 F8 D6 F7 50
 EA D0 F8 D6 FF EA D6 F8 50
 F4 F4 D6 83 87 87 D0 FB 50
 E6 84 D4 D6 F8 D6 87 FB 50
 D6 FF EA EF F8 F5 F6 FF 50
 FB FB EA F5 F5 F1 FE AF 50
 D2 FC F8 A7 D2 E3 F8 AF 50
 F6 D2 D4 D6 F8 D6 93 87 50
 D4 D6 F8 D6 9D EA B8 F5 50
 F6 F5 D2 D6 F8 50 50 50 50

Effect of the TM code

Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.

English

11 55 DD	ld de, $DD55
D5		push de
D5		push de		; .nextMail
D5		push de
21 42 62	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C4	ld hl, $C401	; .screenLoop
4D		ld c, l
CD EF 3A	call PrintBCDNumber.loop - 1
1B		dec de		; .goBack
CD 90 37	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Italian

11 55 DD	ld de, $DD55
D5		push de
D5		push de		; .nextMail
D5		push de
21 76 62	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C4	ld hl, $C401	; .screenLoop
4D		ld c, l
CD DE 3A	call PrintBCDNumber.loop
1B		dec de		; .goBack
CD 7F 37	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Spanish

11 55 DD	ld de, $DD55
D5		push de
D5		push de		; .nextMail
D5		push de
21 99 62	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C4	ld hl, $C401	; .screenLoop
4D		ld c, l
CD A2 3A	call PrintBCDNumber.loop - 1
1B		dec de		; .goBack
CD 4D 37	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Effect of the reset box name code

Converting the characters from box names to assembly results in the following code. This code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.

Box 1: $D8BF
AF		xor a		; a = $00
D6 E8		sub $FF		; a = $18
EA D1 F8	ld ($F8D1), a
D6 F7		sub $F7		; a = $21
50		ld d, b

Box 2: $D8C8
EA D0 F8	ld ($F8D0), a
D6 FF		sub $FF		; a = $22
EA D6 F8	ld ($F8D6), a
21 

Box 3: $D8D1
   18 F4	ld hl, $F418
D6 83		sub $83		; a = $9F
.doubleAndWrite
87		add a, a	; a = $3E, carry flag set
.write
22		ldi (hl), a
D0		ret nc		; Ignore on first pass, taken when .write/.doubleAndWrite called
FB		ei
50		ld d, b

Box 4: D8DA
E6 84		and $84		; a = $04
D4 D6 F8	call nc, .write
AF			xor a	; a = $00
F6 D2		or $D2		; a = $D2
50		ld d, b

Box 5: $D8E3
D4 D6 F8	call nc, .write
D6 93		sub $93		; a = $3F
D4 D5 F8	call nc, .doubleAndWrite
50		ld d, b

Box 6: $D8EC
AF			xor a	; a = $00
F6 F5		or $F5		; a = $F5
D2 D6 F8	jp nc, .write
50		ld d, b

TM33 bootstrap, starting from $D418
3E 04		ld a, $04
D2 7E F5	jp nc, wTMsHMS	; Carry and zero flag are both reset when using TM25

Raw Assembly

 AF D6 E8 EA D1 F8 D6 F7 50
 EA D0 F8 D6 FF EA D6 F8 50
 F4 F4 D6 83 87 87 D0 FB 50
 E6 84 D4 D6 F8 AF F6 D2 50
 D4 D6 F8 D6 93 D4 D5 F8 50
 AF F6 E1 D2 D6 F8 50 50 50