Guides:Mail Writer GS (non-EN)

This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Mail writer.

The Mail writer is an arbitrary code execution program that allows the user to quickly and accurately write and execute arbitrary code payloads of up to a maximum size of 428 bytes. Payloads are written from wOtPartyCount onward, where enemy trainer's parties are usually buffered.

This guide is applicable to the French, German, Italian and Spanish versions of Gold & Silver only.

Using the Mail writer requires an ACE setup that redirects execution to the start of box names. For this guide, it is assumed that you've previously set up Wrong Pocket TM25 ACE instead.

If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.

How the mail writer works

Upon execution, the Mail writer will open the mail character entry screen where the player can write up to 32 different characters. After the player has confirmed the mail, the following actions take place:

• The Mail writer will take pairs of characters and convert them into a single combined value. These values are then sequentially written, converting the 32 letter mail into a 16 byte long line of code.
• Next, the Mail writer will display a checksum calculated from the combined value of all written bytes for the player to verify. Then the program enters a waiting state where they can either choose to write another mail, go back and correct previously written values or stop the mail writer and execute the newly written payload.
• If the player has chosen to write a new mail, the Mail writer will open a new mail entry screen. The new mail is then also converted into a block of 16 bytes and placed right after the code written by the previous mail(s), allowing the player to write arbitrarily long payloads.

Installation

The mail writer itself will be installed in the TM/HM pocket through the following two step process:

1. Execute a box code using Wrong Pocket TM25 ACE that sets the quantities of all 50 TMs to x255 and adjusts party pokémon #3 to redirect execution to the TM/HM pocket.
2. Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program, then use Wrong Pocket TM25 ACE with the newly adjusted pokémon to use the mail writer.

Step 1: setting all TM quantities to x255

• Rename box names to form the following language dependent codes:

Language	Box names	Language	Box names
French	Box 1: A p é 3 2 u' 9 5 Box 2: é 1 2 u' c é 5 2 Box 3: H u' L é 6 2 ? b Box 4: é , 2 u' ♂ é 2 2 Box 5: u' t é ♀ 2 é ; 4 Box 6: p u' 5 é ) 4 ] 5 Box 7: ♀ ♀ ♀ ♀ ♀ 's Box 8: ? ♀ é [ 4 u' x 5 Box 9: é ( 4 H u' z 5 5 Box 10: é : 4 n'	German	Box 1: Ä Ä , 2 ö ß 2 W Box 2: ö ß 2 W ö ß 2 o Box 3: ö ß 2 w G ö ß 2 Box 4: G ö ß 2 G ö ß 2 Box 5: G ö ß 2 g ö ß 2 Box 6: p 0 ( ö ß 2 0 9 Box 7: d J 5 T S v y b Box 8: 4 ? [space] ? ß ö ß 2 Box 9: ? E ö ß 2 p 0 Ü Box 10: ö ß 2 H E ö ß 2 Box 11: p 0 ♀ ä ß 2
Italian	Box 1: A p é 3 2 ° 9 Box 2: é 1 2 ° 7 é ) 2 Box 3: ° G é ♀ 2 é ; 4 Box 4: È d é , 2 ° ♂ Box 5: é 2 2 È 9 é 6 2 Box 6: p ° P é 5 2 0 9 Box 7: A ♀ ♀ ♀ ♀ ó Box 8: p 0 ♀ é [ 4 ° x Box 9: é ( 4 È F é : 4 Box 10: ì	Spanish	Box 1: A p é 3 2 ° 9 Box 2: é 1 2 ° 7 é ) 2 Box 3: ° G é ♀ 2 é ; 4 Box 4: È d é , 2 ° ♂ Box 5: é 2 2 È 9 é 6 2 Box 6: p ° Q é 5 2 0 9 Box 7: A ♀ ♀ ♀ ♀ ó Box 8: p 0 ♀ é [ 4 ° x Box 9: é ( 4 È F é : 4 Box 10: ì

Note: "..." refers to one ellipsis character, “pk” refers to the one pk character, "$" refers to the pokédollar sign, "*" refers to the multiplication symbol. Make sure to pay careful attention to upper/lowercase letters.

• Catch any pokémon and nickname it "MAILWRITER". Put it in the third party slot. We'll alter this pokémon's stat experience to redirect TM25 execution to the TM/HM pocket

• Ensure that you have everything set up for Wrong Pocket TM25 ACE:
  • "BOXCODES" nicknamed pokémon holding mail in party slot #2
  • Read the correct mail beforehand

• Use TM25 once. If the code was executed successfully, switch to the TM/HM pocket. It should now contain every TM at a quantity of x255.

NOTE: due to limitations, the German version of this box code can only be used once. If you need to use it again, make sure to redo box 7's name.

Step 2: Selling TMs to form a program in the TM/HM pocket

Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using. The following table displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.

Language independent TMs

TM	Final Quantity	Sell value
TM01 DYNAMICPUNCH	x17	357000
TM02 HEADBUTT	x85	170000
TM03 CURSE	x221	51000
TM04 ROLLOUT	x213	42000
TM05 ROAR	x213	21000
TM06 TOXIC	x213	63000
TM07 ZAP CANNON	x33	222000
TM08 ROCK SMASH	SEE NEXT TABLE
TM09 PSYCH UP	x98	78500
TM10 HIDDEN POWER	x207	72000
TM11 SUNNY DAY	x225	30000
TM12 SWEET SCENT	x209	23000
TM13 SNORE	x42	106500
TM14 BLIZZARD	x254	1500
TM15 HYPER BEAM	x80	262500
TM16 ICY WIND	x56	298500
TM17 PROTECT	x251	6000
TM18 RAIN DANCE	x40	215000
TM19 GIGA DRAIN	x10	367500
TM20 ENDURE	x135	180000
TM21 FRUSTRATION	x134	60500
TM22 SOLARBEAM	x18	355500
TM23 IRON TAIL	x19	354000
TM24 DRAGONBREATH	x35	330000
TM25 THUNDER	x129	126000
TM26 EARTHQUAKE	x79	264000
TM27 RETURN	x18	118500
TM28 DIG	x24	231000
TM29 PSYCHIC	x239	16000
TM30 SHADOW BALL	x33	333000
TM31 MUD-SLAP	x1	381000
TM32 DOUBLE TEAM	x196	59000
TM33 ICE PUNCH	x77	267000
TM34 SWAGGER	x205	25000
TM35 SLEEP TALK	SEE NEXT TABLE
TM36 SLUDGE BOMB	x58	98000
TM37 SANDSTORM	x27	228000
TM38 FIRE BLAST	x205	50000
TM39 SWIFT	SEE NEXT TABLE
TM40 DEFENSE CURL	x55	100000
TM41 THUNDERPUNCH	x189	99000
TM42 DREAM EATER	x40	322500
TM43 DETECT	x217	19000
TM44 REST	x56	298500
TM45 ATTRACT	x240	22500
TM46 THIEF	x254	1500
TM47 STEEL WING	x08	370500
TM48 FIRE PUNCH	x200	82500
TM49 FURY CUTTER	x24	346500
TM50 NIGHTMARE	x242	13000

Language dependent TMs

TM	English		French		German		Italian		Spanish
	Final amount	Amount sold for	Final amount	Amount sold for	Final amount	Amount sold for	Final amount	Amount sold for	Final amount	Amount sold for
TM08 ROCK SMASH	x66	94500	x43	106000	x34	110500	x118	68500	x153	51000
TM35 SLEEP TALK	x239	8000	x144	55500	x231	12000	x222	16500	x162	46500
TM39 SWIFT	x144	111000	x59	196000	x135	120000	x127	128000	x77	178000

Running the newly written program

• It is recommended to save before continuing
• Put the pokémon that was nicknamed "MAILWRITER" into the 2nd party slot.
• Use TM25. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
• From now on, you can repeat this process at any time to start the mail writer.

If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for the "MAILWRITER" pokémon. This can be done using the box codes included a bit further below.

A note on the nicknamed pokémon: when running the box name code, we altered "MAILWRITER"'s stat experience data to contain a redirect to the TM/HM pocket. You can safely deposit and withdraw it from the PC. Please note that this pokémon must never gain experience after this point, otherwise you'll need to reapply the setup.

Using the mail writer

From now on, simply go through the necessary steps to use the Coin Case or TM17 to start up the RAM writer.

The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.

This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.

Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.

Controls

Between entering mail codes, the mail writer will ask for user input.

• Press SELECT to open a new mail and continue writing data.
• Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
• Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.

Enter your mail code, then press "END".	It prints the checksum and waits for input.

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

• Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
• RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.

Addendum: repairing the "MAILWRITER" pokémon

In case something happens with the "MAILWRITER" nicknamed pokémon that causes it to no longer function, you can repair the pokémon without having to reset TM quantities using the following procedure:

• Arrange the party as follows:
  1. Any
  2. "BOXCODES" pokémon holding mail
  3. "MAILWRITER" pokémon
  4. Any
  5. Any
  6. Any
• Enter the following language-specific box name:

Language	Box names	Language	Box names
French	Box 1: p u' 6 é ) 4 u' F Box 2: é ; 4 u' I é [ 4 Box 3: u' w é ( 4 H u' z Box 4: é : 4 n'	German	Box 1: Ä Ä ( 4 p 0 ] H Box 2: ö ß 2 ? E ö ß 2 Box 3: p 0 Ü ö ß 2 H E Box 4: ö ß 2 p 0 ♀ 5 5 Box 5: ä ß 2
Italian	Box 1: p ° 6 é ) 4 ° G Box 2: é ; 4 ° J é [ 4 Box 3: ° x é ( 4 H ° z Box 4: é : 4 Í	Spanish	Box 1: p ° 6 é ) 4 ° G Box 2: é ; 4 ° J é [ 4 Box 3: ° x é ( 4 H ° z Box 4: é : 4 Í

• Read the mail held by the "BOXCODES" pokémon
• Use TM25 to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly
• If the code executes succesfully, the "MAILWRITER" nicknamed pokémon has now been repaired.