Guides:Goldenrod Glitch Pokédex Mode ACE setup (DE): Difference between revisions
Line 454: | Line 454: | ||
# Set all TM quantities to x1. |
# Set all TM quantities to x1. |
||
# Restore the previous PokéGear flags. |
# Restore the previous PokéGear flags. |
||
# Remove the last |
# Remove the last BICYCLE from the key item pocket and add a CANCEL button at the end of the key item list. |
||
# Set the amount of items in the ball pocket to 1. |
# Set the amount of items in the ball pocket to 1. |
||
# Remove the seen/caught flags of the hatched $00 species. |
# Remove the seen/caught flags of the hatched $00 species. |
Revision as of 20:48, 10 July 2024
This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Glitch Pokédex Mode ACE. |
This page serves as a repository for a Glitch Pokédex Mode ACE setup for the German version of Pokémon Gold & Silver. It is part of the TimoVM's Gen 2 ACE setups set of guides.
Please make sure to fully read every step of the guide before executing them.
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.
Setting up initial ACE
In the generation 2 games, the pokédex has three different modes that change the order of displayed pokémon within the pokédex. When selecting a certain mode, the game stores the value of the last selected mode in RAM, so that it will keep using this mode when you next use the pokédex. This valueis then used as part of a jump table, which returns the addresses of the functions used to determine the pokédex order.
By setting this value to an invalid pokédex mode value, the game will index this jumptable out of bounds. Some of these invalid values result in addresses that point to wram, resulting in arbitrary code execution. Since this value is in reach of the extended ball pocket, we can abuse an item swap to set such an invalid value.
By using the special properties of a $00 species pokémon, we are able to obtain duplicate key items which can then allow us to set up the extended ball pocket.
In practice, the initial ACE setup will be created using the following general process:
- Obtain the necessary items and pokémon for the setup.
- Obtain a bad clone.
- Convert the bad clone into a $00 species pokémon using the day-care
- Use the $00 species pokémon to obtain two additional bicycles, then use duplicate key items glitch to activate the extended ball pocket and set up glitch pokédex mode ACE.
Requirements for this guide
When playing on original cartridge or on emulator, it is absolutely required to have used the Clear Save Data feature (press SELECT + UP + B on the title screen) or have replaced the battery at least once since owning the game.
- Completing the setup requires having reached Goldenrod City, to access the Day Care and the GoldenRod Dept. Store.
- Due to technical reasons, please ensure that the following is true for your trainer ID:
- Your trainer ID must not be equal or higher than 65280.
- The remainder after dividing your trainer ID by 256 must not be equal to 255.
- If your trainer ID does not fulfill both requirements, one of the methods described in the guide will not work correctly. When starting from a new save, it is recommended to reset your game until you get a compatible trainer ID. If you do not wish to reset your save, a workaround is provided that requires you to not have traded the Machop in Goldenrod City yet.
A note on the side effects of the method described below
The method described on this page requires fairly heavy abuse of glitches that will produce a number of side effects. All these side effects can be fixed with later applications of ACE and are never permanently harmful for the game in any way:
- Obtaining duplicate key items requires obtaining a glitch pokémon that cannot be manually released.
- Duplicate key item swap glitch removes the CANCEL button from the key item pocket.
- Buying or obtaining additional poké balls causes issues when done with an extended ball pocket.
- Setting up glitch pokédex mode ACE disables the use of the PokéGear.
A code will be provided at the end of the guide that fixes all these issues in one execution and will allow you to choose a new player name.
Step 1: Collecting the requirements
Next, we'll gather the required items and pokémon for the setup.
- Do the following before reaching Goldenrod City:
- After clearing out Team Rocket from the Slowpoke Well, collect a Lure ball by talking to Kurt.
- Do the following after reaching Goldenrod City:
- Catch a Drowzee. After catching it, go to the Goldenrod Dept. Store and teach it TM48 (Fire Punch). Finally, move Fire Punch to the second move slot.
- Clear out the ball pocket and make sure you only have one Lure Ball and two poké ball left.
- (optional) Set the current pokédex mode to "OLD POKéDEX MODE". This adds a visual marker for a later item swap.
Step 2: Obtaining a $00 species pokémon
Using save corruption, we'll turn a pokémon into a $00 glitch pokémon.
Preparing the box
Before we can use save corruption with any degree of consistency, it is a good idea to fill up a box first. This will give us around 1 frame of leeway to perform save corruption.
- Using normal cloning, put 15 pokémon in a box that has never been completely full at any point in the past.
- Make sure you end up with at least 5 copies of Drowzee.
- For safety reasons, it is recommended you make additional clones of other party pokémon.
Performing the save corruption
Using save corruption, we're going to turn a pokémon into a bad clone using the following process:
- Deposit any pokémon to the current active box.
- Go to "Move pokémon w/o mail", you will get a prompt to save the game.
- Reset the game shortly after the "saving...” text is fully printed.
- If successful, upon restarting the game you will find a level 0 female version of the deposited pokémon with a blank name.
Please note that the timing of this is very strict (around 1 frame to obtain a bad clone).
- If nothing was saved, the reset was too early. Next time, wait a little bit longer to reset.
- If the pokémon was successfully cloned, the reset was too late. next time, reset a little bit earlier.
- If the box ever gets to 19 pokémon in total, release pokémon from the box until there are only 15 pokémon present. Make sure to save normally after releasing them.
Use these guidelines and keep retrying until you've obtained a bad clone.
After obaining the bad clone, you can continue with the next step.
Step 3: Obtaining duplicate key items and setting up glitch pokédex mode ACE
This works in any language version on any generation 2 game, the method is based on a translation of a [blogpost from 任意コード].
This method will only work if your trainer ID fulfills both of the following requirements:
- Your trainer ID must not be equal or higher than 65280.
- The remainder after dividing your trainer ID by 256 must not be equal to 255.
If your trainer ID does not fulfill both requirements and you do not wish to reset your save, please follow the following steps:
- On the 5th floor of the Goldenrod Dept. Store and trade Drowzee for a Machop.
- Buy a TM48 (Fire Punch) and teach it to Machop. Rearrange its moves so that Fire Punch is in the second move slot.
- Using the cloning glitch, get at least six copies of Machop (it is recommended to keep some spares just to be safe). We'll be using these Machop in the remainder of the setup.
Requirements
Have the following items in the ball pocket:
- Slot 1: Lure Ball x1
- Slot 2: Poké Ball x2
- Slot 3 and beyond: empty
Have the following items in the key item pocket:
- All key items you've obtained in your save thus far (withdraw all key items (if any) you previously stored from the PC)
- Bicycle at the top of the key item list
Have the following pokémon in the party:
Compatible trainer ID | Incompatible trainer ID |
---|---|
1. Bad clone 2. Drowzee with Fire Punch in second move slot 3. Drowzee with Fire Punch in second move slot 4. Unwanted pokémon 5. Unwanted pokémon 6. Unwanted pokémon |
1. Bad clone 2. Traded Machop with Fire Punch in second move slot 3. Traded Machop with Fire Punch in second move slot 4. Traded Machop 5. Traded Machop 6. Traded Machop |
Next, have the following pokémon in the box:
Compatible trainer ID | Incompatible trainer ID |
---|---|
- 1 unwanted pokémon - 1 normal pokémon |
- 1 Additional traded Machop - 1 normal pokémon |
Keep in mind that we'll be corrupting both the Drowzees and the unwanted pokémon. Make sure to only use pokémon you do not wish to keep. The normal pokémon will not be corrupted at all during this process.
Obtaining duplicate bicycles
- Deposit the bad clone in the daycare and retrieve it. It will now have turned into a glitch pokémon. Arrange your party as follows:
- Glitch pokémon
- Drowzee/traded Machop with Fire Punch in second move slot
- Drowzee/traded Machop with Fire Punch in second move slot
- Unwanted pokémon/traded Machop
- Unwanted pokémon/traded Machop
- Unwanted pokémon/traded Machop
- Using "move pokémon w/o mail", add the stored unwanted pokémon/additional traded Machop to the top of your party. This will push the glitch pokémon down to the second slot.
- Switch the glitch pokémon in the second slot with the pokémon in the fifth slot.
- Select "Deposit pokémon" from the PC and deposit the top two pokémon in your party.
- Withdraw the normal pokémon from your box and add it to the party using "Withdraw pokémon".
The party will now contain two Drowzee/Machop that will both be holding a bicycle each. Take these held items to add them to the bottom of the Key Item list. It is now safe to save.
Setting up glitch pokédex mode ACE
- Arrange the Ball pocket as follows:
- Slot 1: Lure Ball x1
- Slot 2: Poké Ball x2
- Go to the bottom of the KEY ITEM pocket. Swap the second BICYCLE with the third BICYCLE.
- Go to the BALL pocket, the LURE BALL has now changed into a MASTER BALL. The POKé BALL has now changed into an ULTRA BALL. The game now believes you have a total of 160 item slots in the ball pocket, allowing you to scroll past the CANCEL button.
- Toss 184 Ultra Balls until you have only 71 Ultra Balls remaining. Swap the Ultra Ball with the item in the 65th item slot (this item slot can be easily recognized due to having a quantity of 1 if you've previously set "OLD POKéDEX MODE" in the POKéDEX).
- Go back to the start menu. Check if the PokéGear option has disappeared from the start list. If it has disappeared, you can now save the game.
This swap removes the PokéGear from the start list and will activate Glitch Pokédex Mode ACE. From this point onward, using the pokédex will trigger ACE from $F8EA onward, an address that correspond to the 8th character of the 5th box name.
Do NOT open the pokédex yet. Opening the pokédex right now will likely crash the game. We first need to set up a way to properly execute ACE in a controlled manner.
Setting up an ACE environment
We have successfully set up Glitch Pokédex Mode ACE, what now?
Using Glitch Pokédex Mode ACE works great for an initial setup, but there are a few drawbacks:
- At this moment, we are not able to change the Pokédex Mode. This renders the Pokédex unusable for any other purpose than ACE.
- While $F8EA is a convenient entrance point, we still need to actually read a mail every time we want to execute ACE thanks to the limitations of the German characterset.
Due to this, we're going to focus on building the setup in three ways:
- Our aim is to switch from Glitch Pokédex Mode ACE to Wrong Pocket TM ACE. By putting a TM33 in a pocket other than the TM/HM pocket, we can simply use TM33 to execute ACE. TM33 will trigger ACE from address $D418 onward, which corresponds to unused data.
- We're going to install a program, written using TM quantities, that allows us to easily write and execute any code we want.
- We're going to make it so that using TM33 starts this program, without requiring a party or item setup.
In summary, we will proceed as follows:
- Prepare a mail and box name code
- Sell TMs in specific quantities in order to be able to run the Mail Writer
- Use Wrong Pocket TM33 to run the Mail Writer and clean up the side-effects of the setup.
Step 4: Setting up the Mail Writer
Give any party pokémon a mail with the following language-dependent content to hold:
German |
---|
|
We'll set up TM33 and obtain 255 copies of every TM using a single execution. Write the following box name codes:
German |
---|
|
Once this is done, make sure to save the game.
Step 5: Using Glitch Pokédex Mode ACE
Now that we have everything set up, we are going to use Glitch Pokédex Mode ACE to execute the box name code that we previously set up.
Executing the box name code
You can use Glitch Pokédex Mode ACE using the following process:
- Make sure you have an item you can afford to miss in the first slot of the main item pocket.
- Read the held mail that was previously given to a party pokémon.
- Open the start menu and open the pokédex. If the mail and box name codes were written correctly, this will immediately open and automatically close the pokédex.
The code that we used had the following effects.
- The first item of the main item pocket was overwritten to become a TM33.
- The TM/HM pocket has now been filled with 255 copies of every kind of TM.
- Code was added to ensure that using TM33 executes code in the TM/HM pocket.
Before continuing, make sure to verify that a TM33 is present in the Main Item pocket and that all TMs have a quantity of 255.
Do not use this TM33 yet! This TM will allow us to execute the contents of the TM/HM pocket as code, but due to the specific quantities currently present it will be guaranteed to crash the game.
Troubleshooting
If the code crashes, check the following:
- Are the box name codes (or mail) correct?
- In the 65th slot of the Ball pocket, is the item quantity equal to 71?
Step 6: Selling TMs to set up the Mail Writer
Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program.
The image belows displays the intended final quantities of all TMs, while the table in the next section displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
Graphical overview
|
TM sell values
TM | Final Quantity | Sell value |
---|---|---|
TM01 DYNAMICPUNCH | x17 | 357000 |
TM02 HEADBUTT | x85 | 170000 |
TM03 CURSE | x221 | 51000 |
TM04 ROLLOUT | x213 | 42000 |
TM05 ROAR | x213 | 21000 |
TM06 TOXIC | x213 | 63000 |
TM07 ZAP CANNON | x33 | 222000 |
TM08 ROCK SMASH | x34 | 110500 |
TM09 PSYCH UP | x98 | 78500 |
TM10 HIDDEN POWER | x207 | 72000 |
TM11 SUNNY DAY | x225 | 30000 |
TM12 SWEET SCENT | x209 | 23000 |
TM13 SNORE | x42 | 106500 |
TM14 BLIZZARD | x254 | 1500 |
TM15 HYPER BEAM | x80 | 262500 |
TM16 ICY WIND | x56 | 298500 |
TM17 PROTECT | x251 | 6000 |
TM18 RAIN DANCE | x40 | 215000 |
TM19 GIGA DRAIN | x10 | 367500 |
TM20 ENDURE | x135 | 180000 |
TM21 FRUSTRATION | x134 | 60500 |
TM22 SOLARBEAM | x18 | 355500 |
TM23 IRON TAIL | x19 | 354000 |
TM24 DRAGONBREATH | x35 | 330000 |
TM25 THUNDER | x129 | 126000 |
TM26 EARTHQUAKE | x79 | 264000 |
TM27 RETURN | x18 | 118500 |
TM28 DIG | x24 | 231000 |
TM29 PSYCHIC | x239 | 16000 |
TM30 SHADOW BALL | x33 | 333000 |
TM31 MUD-SLAP | x1 | 381000 |
TM32 DOUBLE TEAM | x196 | 59000 |
TM33 ICE PUNCH | x77 | 267000 |
TM34 SWAGGER | x205 | 25000 |
TM35 SLEEP TALK | x230 | 12500 |
TM36 SLUDGE BOMB | x58 | 98500 |
TM37 SANDSTORM | x27 | 228000 |
TM38 FIRE BLAST | x205 | 50000 |
TM39 SWIFT | x135 | 120000 |
TM40 DEFENSE CURL | x55 | 100000 |
TM41 THUNDERPUNCH | x189 | 99000 |
TM42 DREAM EATER | x40 | 322500 |
TM43 DETECT | x217 | 19000 |
TM44 REST | x56 | 298500 |
TM45 ATTRACT | x240 | 22500 |
TM46 THIEF | x254 | 1500 |
TM47 STEEL WING | x08 | 370500 |
TM48 FIRE PUNCH | x200 | 82500 |
TM49 FURY CUTTER | x24 | 346500 |
TM50 NIGHTMARE | x242 | 13000 |
Running the newly written program
- It is recommended to save before continuing.
- Use TM33. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
- Due to limitations, there is no in-built option to safely exit the mail writer. Instead, you can safely exit by typing the below mail, selecting END on the mail screen, then pressing START to execute the mail.
|
From now on, you can repeat this process at any time to start the mail writer.
The next section will elaborate on the usage of the Mail Writer. Please read these instructions carefully before proceeding.
Troubleshooting & repairing TM33
If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for TM33. This can be done using the following box code:
Please mind the differences between uppercase X (), lowercase x (
) and multiplication symbol (
).
German | |
---|---|
|
To execute this box name code, repeat the process for Glitch Pokédex Mode ACE:
- Read the mail previously given to a party pokémon.
- Open the pokédex. If the pokédex opens and immediately closes, the setup will have worked.
Step 7 : How the mail writer works
From now on, simply use TM33 to start up the mail writer.
The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.
Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.
|
Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
Controls
Between entering mail codes, the mail writer will ask for user input.
- Press SELECT to open a new mail and continue writing data.
- Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
- Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
![]() |
![]() |
Enter your mail code, then press "END". | It prints the checksum and waits for input. |
Step 8: Improving the setup
Since the mail writer is written using TM quantities, using or gaining TMs will break the mail writer. Because of this, we'll use the mail writer to execute a code that achieves the following:
- Copies the mail writer to unused memory
- Overwrite the existing quantities in the TM/HM pocket to x1 for every TM
- Alter TM33's underlying code to execute the mail writer in unused memory
- As a bonus, we'll also fix the side effects of the setup. Please note that, for safety reasons, this cleanup code will not disable Glitch Pokédex Mode ACE. A second code will be provided that allows you to alter the current Pokédex Mode directly.
You can use the mail code converter page as follows:
- Copy the code in the table below
- Follow the link at the top of the table to the mail code converter
- Paste the code in the text box on the code converter's page
- Select the correct language and version
- Click on the "Run" button to display the mails you need to enter
Simply copy the assembly code that is applicable for your setup, then click the link at the top of the table to go to the MailConverter tool. Make sure to select the current language and "Gold/Silver" as version.
Before executing this code, make sure to swap the glitch pokémon into the last party slot.
German |
---|
21 7A D6 2A 23 F6 84 22 AF 21 E1 D5 35 47 4E 09 23 36 FF 2E FC 36 01 21 03 DC CB BE 2E 23 CB BE 21 22 DA 4E 35 09 36 FF 01 32 00 11 F2 D6 21 1B D4 73 23 72 3E 3E 12 13 3E 04 12 13 21 7E D5 E5 CD 47 31 3E 01 0E 32 E1 C3 79 31 |
The cleanup code has the following effects:
- Move the mail writer program to unused memory.
- Adjust TM33's code so that using it now activates the mail writer at its new location.
- Set all TM quantities to x1.
- Restore the previous PokéGear flags.
- Remove the last BICYCLE from the key item pocket and add a CANCEL button at the end of the key item list.
- Set the amount of items in the ball pocket to 1.
- Remove the seen/caught flags of the hatched $00 species.
- Remove the glitch pokémon at the end of the party.
Optional: Altering the current Pokédex Mode
This code will alter the current active Pokédex Mode. By default, it sets the Pokédex Mode to zero, making it possible to use the Pokédex normally again. By changing the value marked in bold, you can change the value that the Pokédex Mode will be set to. You can reactivate Mode 71, the Mode that executes from $F8EA onward, by changing the value in bold to $47.
3E 00 EA 7E D6 C9 |
Conclusion: What to do with the Mail writer
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
- Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
- RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.
Appendix
Plain text transcripts of codes
- Glitch Pokédex mail
Language | |
---|---|
German |
ë 1 é y ♀ ë ; é , 2 ë e é ß 2 5 ë 9 é Ä 2 é / 2 ë 1 é Ö 2 Ü Ä 2 |
- Setup box name code
Language | Box names |
---|---|
German |
Box 1: Ä , , , 0 ] H ♀ Box 2: ö ß 2 ? E ö ß 2 Box 3: p 0 Ü ö ß 2 * 0 Box 4: ö ß 2 D u ö ß 2 Box 5: H d Ä Ä Ä Ä Ä p Box 6: ♀ Pk 0 g ♂ ♀ 5 ♀ Box 7: ♀ 0 9 ö ß 2 ? q Box 8: V Ü 0 2 Pk 0 - 1 |
- Reset box name code
Language | Box names |
---|---|
German |
Box 1: Ä , , , 0 ] H ♀ Box 2: ö ß 2 ? E ö ß 2 Box 3: p 0 Ü ö ß 2 * 0 Box 4: ö ß 2 D u ö ß 2 Box 5: H d ♀ Pk 0 - Ä p Box 6: ♀ Pk 0 g ♂ 1 1 1 |
In-depth explanation of the setup
Effect of the glitch pokédex mode
In the 2nd generation of Pokémon games, the Pokédex offers three different modes of sorting pokémon species (New, Old, A-Z). When the Pokédex is opened, the game checks which mode was last active, then launches a function to sort all species. Since the game needs to know which mode was last active, the last used Pokédex mode is stored in RAM at address $D67E.
By swapping an item stack using the extended Ball Pocket, we can directly overwrite the value for the last used mode. When the Pokédex is next opened, the game will read this value and attempt to launch an invalid sorting function depending on the value used, some of which will trigger ACE.
For the German versions of Gold & Silver, mode 71 ($47) will trigger ACE from $F8EA onward. This address is echo ram for $D8EA, which correspond to the 8th character of the 5th box name.
Effect of the mail
The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following, ordered by language:
German
Mail C6 F7 add $F7 ; a = $E1 EA B8 F5 ld ($wItems), a C6 9D add $9D ; a = $7E EA F4 F8 ld ($F8F4), a C6 A4 add $A4 ; a = $22 EA BE F8 ld ($F8BE), a FB ei 4E ld c, (hl) C6 FF add $FF ; a = $21 EA C0 F8 ld (F8C0), a EA F3 F8 ld (F8F3), a C6 F7 add $F7 ; a = $18 EA C1 F8 ld ($F8C1), a C3 C0 F8 jp wBoxNames + 1 h
Effect of the setup box name code
Converting the characters from box names to assembly results in the following code. The entrance point for glitch pokédex mode 71 ACE is located at $F8EA.
This code works in conjunction with the previous mail code to overwrite parts of itself. This enables it to fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.
Separately, this code targets $F418, TM33's execution pointer, and writes a 5-byte bootstreap allowing it to redirect execution to the Mail Writer.
German
Lead-up to wBoxNames: $D8BE .write 22 ldi (hl), a ; Due to mail, set hl to $D8F1 Box 1: $D8BF C0 ret nz 21 18 F4 ld hl, $F418 ; TM33 execution pointer F6 9F or $9F ; a = $9F 87 add a ; a = $3E F5 push af 50 ld d, b Box 2: $D8C8 C4 BE F8 call nz, .write E6 84 and $84 ; a = $04 C4 BE F8 call nz, .write 50 ld d; b Box 3: $D8D1 AF xor a ; a = $00 F6 C2 and $C2 ; a = $C2 C4 BE F8 call nz, .write F1 pop af ; a = $3E F6 50 or $50 ; a = 7E Box 4: $D8DA C4 BE F8 call nz, .write 83 add e ; e = $47; a = $C5 B4 or h ; h = $F4; a = $F5 C4 BE F8 call nz, .write 50 ld d, b Box 5: $D8E3 87 add a ; a = $EA A3 and e ; e = $47; a = $42 C0 ret nz C0 ret nz ; 4 bytes of filler C0 ret nz C0 ret nz C0 ret nz AF xor a ; a = $00, entry point for mode 71 50 ld d, b Box 6: $D8EC F5 push af E1 pop hl ; hl = $0080 F6 A6 or A6 ; a = $A6 EF rst28h JumpTable; Due to ROM header structure, call $CEEA, three bytes before the last read mail F5 push af FB ei ; Filler 21 7E Box 7: $D8F5 F5 ld hl, wTMsHMs .loop F6 FF or a, $FF ; a = $FF C4 BE F8 call nz, .write E6 B0 and $B0 ; a = $B0 50 ld d, b Box 8: $D8FE 95 sub l ; If l == $B0, set z flag and a = $00 C2 F6 F8 jp nz, .loop E1 pop hl ; h = $42 F6 E3 or $E3 ; a = $E3 F7 rst30h ; Jump to $42E3, immediately exit pokédex 50 ld d, b TM33 bootstrap, starting from $D418 3E 04 ld a, $04 C2 7E F5 jp nz, wTMsHMs ; Carry and zero flag are both reset when using TM33
Effect of the TM code
Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.
German
11 55 DD ld de, $DD55 D5 push de D5 push de ; .nextMail D5 push de 21 22 62 ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C4 ld hl, $C401 ; .screenLoop 4D ld c, l CD E6 3A call PrintBCDNumber.loop - 1 1B dec de ; .goBack CD 87 37 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
Effect of the reset box name code
Converting the characters from box names to assembly results in the following code. This code works in conjunction with the mail code to overwrite itself and target $D418, TM33's execution pointer, writing a 5-byte bootstrap that redirects TM33 execution to the Mail Writer.
German
Lead-up to wBoxNames: $D8BE .write 22 ldi (hl), a ; Due to mail, set hl to $D8F1 Box 1: $D8BF C0 ret nz 21 18 F4 ld hl, $F418 ; TM33 execution pointer F6 9F or $9F ; a = $9F 87 add a ; a = $3E F5 push af 50 ld d, b Box 2: $D8C8 C4 BE F8 call nz, .write E6 84 and $84 ; a = $04 C4 BE F8 call nz, .write 50 ld d; b Box 3: $D8D1 AF xor a ; a = $00 F6 C2 and $C2 ; a = $C2 C4 BE F8 call nz, .write F1 pop af ; a = $3E F6 50 or $50 ; a = 7E Box 4: $D8DA C4 BE F8 call nz, .write 83 add e ; e = $47; a = $C5 B4 or h ; h = $F4; a = $F5 C4 BE F8 call nz, .write 50 ld d, b Box 5: $D8E3 87 add a ; a = $EA A3 and e ; e = $47; a = $42 F5 push af E1 pop hl ; h = $42 F6 E3 or $E3 ; a = $E3 C0 ret nz AF xor a ; a = $00, entry point for mode 71 50 ld d, b Box 6: $D8EC F5 push af E1 pop hl ; hl = $0080 F6 A6 or A6 ; a = $A6 EF rst28h JumpTable; Due to ROM header structure, call $CEEA, three bytes before the last read mail F7 rst30h ; Jump to $42E3, immediately exit pokédex F7 rst30h ; Filler 21 7E ; Not executed during this code TM33 bootstrap, starting from $D418 3E 04 ld a, $04 C2 7E F5 jp nz, wTMsHMs ; Carry and zero flag are both reset when using TM33