Guides:SRAM Glitch ACE Setups (EN): Difference between revisions
m
no edit summary
mNo edit summary Tags: Mobile edit Mobile web edit |
|||
| (35 intermediate revisions by the same user not shown) | |||
Line 1:
This page serves as a repository for methods to quickly set up advanced ACE setups, starting from a fresh save file. These methods can be used for the English releases of Red & Blue. It is part of the [[Guides:TimoVM's_gen_1_ACE_setups|TimoVM's Gen 1 ACE setups]] set of guides.
The methods described here were heavily inspired by previous SRAM glitch setups developed by Evie (Chickasaurus GL), as well existing setups intended to be used for the Japanese releases.
Line 6:
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the [https://discord.gg/EA7jxJ6 Glitch City Research Institute Discord].
The contents of this guide are demonstrated in the following video:
{{youtube|jxu9VgwvkJw|TimoVM}}
=Setting up initial ACE=
Line 17 ⟶ 21:
# Using an exploit known as "Map Script ACE", set up a method to quickly pick up an unlimited amount of Eevees
# Write code by repeatedly picking up and nicknaming Eevees. This will be used to build a program that allows you to more easily write arbitrary code.
===Note: setting up ACE on an existing save===
While this guide is built with new saves in mind, the method itself is inherently compatible with existing saves that fulfill the following criteria:
* Must have reached Celadon City.
* Must be able to use Fly and have a party pokémon that has learned Fly.
* Must have set up the [[Expanded item pack]]. It is recommended to deposit all important items to the PC prior to setting up the expanded item pack.
* While setting up the expanded item pack, make sure to set it up in such a way that item slot #6 through #16 do not have any CANCEL buttons
Once you have all of these requirements, you can continue the guide from step 4 onward.
==Step 1: Starting a new game and setting up SRAM glitch==
Line 144 ⟶ 158:
| [[File:RareCandyLocation.png]] || Rare Candy|| x243 || At the Thunderstone spot, walk 7 steps to the right to get Rare Candy x0. Toss 13 from the stack, then swap to slot #16.
|-
| [[File:TM14Location.png]] || TM14 || x213 || At the Thunderstone spot, swap the Thunderstone with the TM23 x64 stack 4 slots below, then toss 63 TM23s. Walk 1 step up and 9 steps left to get
|}
Line 179 ⟶ 193:
|}
After assembling this item code, head to the room where you can pick up the gift Eevee. '''Do not pick up this Eevee yet''', make sure to save before continuing.
===Note: setting up ACE on an existing save===
Before heading to the room where you can pick up the Gift Eevee, make sure to do the following:
* Full up your party with 6 pokémon, to ensure that newly picked up Pokémon will be sent to the PC.
* Change the active box to an empty box.
* '''Only if you have already picked up the gift Eevee in the past''', catch any pokémon, nickname it so that it matches the name shown below, then send it to the currently empty box.
{| class="wikitable"
! Nickname
|-
![[File:InfiniteEeveeMode.png]]
|}
===Note: unterminated name items in Eevee's room===
Within this room, no safe spots exist that allow unterminated name items to be safely handled. Please make sure to not press a or select on unterminated items while in this room.
Line 214 ⟶ 241:
|}
* Pick up an Eevee and nickname it so that its name matches the above screenshot on the left. It will be sent to the current active box. '''Previously existing saves that have already picked up Eevee in the past must skip this step.'''
* Open the item bag. Swap the Rare Candy x243 with the contents of item slot #41, which should contain Dire Hit x93. This will activate Map Script ACE.
* Close the start menu. If everything went all right, Eevee's poké ball will have reappeared.
Line 227 ⟶ 254:
===Setting up 4F to execute item codes===
Next, we'll be entering a list of
{| class="wikitable"
Line 249 ⟶ 276:
===Setting up the Nickname Writer===
* Next, we'll be entering a list of
{| class="wikitable"
Line 258 ⟶ 285:
* Pick up Eevees and enter the nicknames in the above screenshot one by one. '''The nicknames from this list needs to be entered in this exact order from the top to the bottom.'''
* Once all nicknames have been entered, look at your trainer card, then use 4F. This should open a screen in which you're asked to enter a pokémon's nickname
* For now, press START to end writing the nickname. This should display the main menu, a number should be written on screen.
* Press SELECT to exit the Nickname Writer safely.
Line 267 ⟶ 293:
From this point onward, whenever you use the ACE item, you should be able to open the nickname writer. Please make sure to keep note of the following:
* Since the Nickname Writer works independently of the current active box, you can change the current active box however much you like.
* When writing data, the Nickname Writer will overwrite enemy party data. While this does not have any effect outside of battle, it is recommended to not use the Nickname Writer in battle.
The program works as follows:
Line 275 ⟶ 300:
* This nickname then gets converted to a sequence of five bytes.
* All five bytes are written starting from the starting location
* The program displays a glitched overworld view, along with a checksum (sum of all written byte values) towards the top right of the screen to confirm that you correctly entered the code. '''If the printed checksum doesn't match the expected checksum, you made a mistake entering a code.''' The glitched overworld view is temporary and will not affect your game.
* Afterwards, it waits for the user to decide what to do.
During the input phase, the controls are as follows:
* '''Press A''' for the program to ask for a new nickname and convert that to the next five bytes to be written.
* '''Press B''' to go back one byte at a time. The checksum will automatically be overwritten by the value written at the current selected address, giving you a measure of how far back you're going.
* '''Press START''' to immediately start executing the newly written program. '''Only do this when you've finished writing everything.'''
* '''Press SELECT''' to safely quit the Nickname Writer, without executing the newly written code.
{| class="wikitable"
! Write mode !! Input mode
|-
! [[File:RB Name writer write mode.png
! [[File:RB Name writer input mode.png]]
|-
|
|}
Line 296 ⟶ 321:
At this point, there are certain side effects that have been introduced by the setup:
* For all saves
**
** The current active box is filled with nicknamed Eevees
**
** The item
* For new saves only
** We currently have two badges set as obtained
** Our pokédex currently has 152 pokémon species caught, preventing the story from continuing
** Setting up SRAM glitch has given us a party of 255 pokémon
** We are currently located in the Celadon Pokémon center, while we need to return to Pallet Town to pick up the starter pokémon
We will be removing all these side effect using the Nickname Writer. The nicknames we need to enter will be generated by the [https://timovm.github.io/NicknameConverter/ Nickname Converter webtool]. Simply open the link, copy paste one of the
'''When using the Nickname Writer, the generated nicknames need to be entered from top to bottom.'''
Please ensure to pick the code that suits your type of save.
{| class="wikitable"
|+ Codes to be used with the [https://timovm.github.io/NicknameConverter/ Nickname Converter webtool]
! New Saves !! Older Saves
|-
| <pre>21 AE D5 CB AE
Line 323 ⟶ 353:
3E 21 66 DA 36
6A 23 36 D6 C9
</pre> || <pre>21 AE D5 CB AE
AF 21 80 DA 22
3D 22 AF EA 1D
D3 21 66 DA 36
6A 23 36 D6 01
01 59 C3 2E 3E
</pre>
|}
Once all
This will activate the following effects:
* For all saves:
** Reset the state of Eevee's poké ball, allowing it to be picked up again at a later point
** Empty the current active box
** Resets the bag, removing all items aside from 4F and removing the inventory underflow state
** Rewire 4F so that it can activate the Nickname Writer independently of the item code
* Only for new saves:
** Reset all badges
** Reset all Pokédex flags
** Removes all party pokémon
** Alters the exit of the poké center to lead out to Pallet Town
From this point onward, you can exit the
==
The Nickname Writer allows you to easily write and execute arbitrary payloads. You can either make and execute your own codes, or head to the [[Guides:Nickname Writer Codes|Nickname Writer codes]] page. This page contains a collection of assembly for nickname codes that can be used for a variety of common purposes such as editing pokémon and items, editing player stats, resetting legendaries etc..
[[Guides:Nickname Writer Codes|Nickname Writer Codes]]
=Addendum: raw text transcripts of nickname codes=
These are provided as an alternative in case images fail to load.
==Infinite Eevee Mode Nickname==
{| class="wikitable"
! Nickname
|-
|
C l l U ( ( : ; W ;
</pre>
|}
==4F Bootstrap Nicknames==
{| class="wikitable"
! List of nicknames
|-
|<pre>
g . y y ] , k Mn * Pk
* ( ; ! ? ) [ [ ] ,
w v v u U l k Mn Pk X
</pre>
|}
==Nickname Writer==
{| class="wikitable"
! List of nicknames
|-
|
a b v v ) l l C d d
j ? ) V t v v v l Mn
q p y y ] z y p g F
a * j ? t K K b c c
R j j m v w w P P p
l l M v V v v l : ♀
P x w v v W M m m w
A B r q x Pk z g g h
i z , [ o w o x w x
( ) ) ) ) , , ] ] .
j ! U ? ? u w v u -
v x w y y ♀ ♂ ♂ w w
r p P X [ : : ; : ;
</pre>
|}
=Addendum: technical explanation of the setup=
==Nickname Converter Item Code==
===Explanation===
The item code itself consists of two components. The first 10 items are used to write a program that takes text characters from the nicknames of characters currently within the active box, converts them, then writes the resulting values to unused memory starting from $D66A.
Pairs of text characters are converted to single values through a [(2a + b)%256] formula, where a is the value of the first character and b the value of the second. text terminators are skipped, the code will stop and execute the newly written code once it either reads a $00 value or if values are being read past $DEFF.
<pre>
11 6A D6 ld de, UNUSED_MEMORY ; Memory between $D66A and $D6EF goes unused
D5 push de
21 06 DE ld hl, wBoxNicks
.loop
2A ldi a, (hl)
03 inc bc ; Filler, no effect on flags
87 add a
0B dec bc ; Filler, compensates previous inc bc, no effect on flags
30 04 jp nc, .notChar ; Aside from space (should not be used), "add a" will only give nc if value read is not a text char
86 add a, (hl)
12 ld (de), a
2C inc l ; Affects z flag
13 inc de
.notChar
20 F4 jp nz, .loop ; loop unless l rolled over to $00 or value read was $00
C9 ret ; Due to previous push de, this ret will cause execution to resume from $D66A onward, immediately running the newly written code
</pre>
The last item, the Rare Candies, simply form a pointer to $F328. Due to echo RAM this address is equivalent to $D328, which correspond to item #6's item ID, the start of the item code. By replacing the map script pointer with this item, we can redirect the map script routine to execute the item code instead. This routine is executed on every frame, as long as the start menu isn't open.
===Raw Assembly===
<pre>
11 6A Max Potion x106
D6 D5 TM14 x213
21 06 Thunderstone x06
DA 2A TM22 x42
03 87 Great Ball x135
0B 30 Antidote x48
04 86 Poké Ball x134
12 2C Hyper Potion x44
13 20 Super Potion x32
F4 C9 TM44 x201
28 F3 Rare Candy x243
</pre>
==Infinite Eevee Nickname==
===Explanation===
The Infinite Eevee mode nickname writes $00 to the lower byte of wMissableObjectList, causing a misalignment in how the game applies NPC disappearance, causing Eevee's pokéball to stay permanently visible until the game is reset or the player leaves the Celadon Mansion penthouse.
<pre>
AF xor a ; a = $00
EA CE D5 ld (wMissableObjectList), a ; Misaligns which objects are made invisible
C9 ret
</pre>
===Raw Assembly===
<pre>
AF EA CE D5 C9
</pre>
==4F Boostrap Nicknames==
This set of nicknames, when converted, will modify item #1's ID to be 4F and writes a bootstrap so that using it will lead to execution of the item code from $D328 onward. It requires the presence of the Infinite Eevee Mode Nickname (see previous section) to properly return.
<pre>
21 1E D3 ld hl, wBagItems ; item #1's ID
36 59 ld (hl), $59 ; 4F's item ID
7C ld a, h ; a = $D3
21 67 DA ld hl, 4F_Execution_Pointer +2
32 ldd (hl), a
3E 28 ld a, $28
22 ldi (hl), a
36 C3 ld (hl), $C3
; The contents of the first nickname (see previous section) are written right after this, ensuring safe return.
</pre>
===Raw Assembly===
<pre>
21 1E D3 36 59
7C 21 67 DA 32
3E 28 32 36 C3
</pre>
===Explanation===
Using 4F, an invalid item, will cause the game to index the item effects table out of bounds, leading to an invalid execution pointer. For 4F, this causes the game to execute code from $FA65 onward. Due to echo RAM, this address is equivalent to $DA65. Thanks to the bootstrap that was applied earlier, this will then cause the game to jump to $D328, corresponding to the start of the item code.
<pre>
C3 28 D3 jp ITEM_6_ID
</pre>
===Raw Assembly===
<pre>C3 28 D3</pre>
==
===Explanation===
The Nickname Writer is a small program that, using nicknames as input, is able to write arbitrary amounts of custom code relatively quickly. It first request a nickname as input, then converts that data to custom code, then displays a checksum of the written data and finally asks the player to provide additional input.
The value of the checksum is calculated by [($80 + the sum of all written values)%256]. Custom code is buffered and executed within enemy party data. Due to how it calls DisplayNameRaterScreen, it will also nickname a party pokémon corresponding to the item slot that 4F currently occupies.
<pre>
11 B5 D8 ld de, $D8B5 ; location written to
D5 push de
.newMail
D5 push de
21 24 65 ld hl, AskName + 39h ; Prepares data and calls DisplayNamingScreen
CD 22 39 call $3922 ; sets b to 01, then jumps to Bankswitch, calling b:hl
0E 80 ld c, $80 ; Ensure checksum consistency
21 4B CF ld hl, wStringBuffer ; Address where new name gets written to
D1 pop de ; Continue writing from last saved de
.newChar
2A ld a, (hli)
87 add a
30 09 jp nc, .terminator ; If blank space as first character of pair, only terminator $50 will result in a nc result
86 add a, (hl)
12 ld (de), a
13 inc de
23 inc hl
81 add a, c ; Current checksum total is buffered in c
12 ld (de), a
4F ld c, a
18 F3 jp .newChar
.terminator
D5 push de
21 00 C4 ld hl, $C400 ; Corresponds to screen tile
0E 01 ld c, $01 ; How many bytes printed as numbers?
CD DF 15 call PrintBCDNumber.loop
.numLoop
2D dec l
CB FE set 7, (hl)
20 FB jp nz, .numLoop ; Repeat until hl == $C400
.inputLoop
CD 31 38 call JoypadLowSensitivity ; Halt execution until frame has passed, get joypad status and store result in hJoy5
F0 B5 ld a, (hJoy5)
E6 0F and $0F ; Set z flag if A, B, START, SELECT not pressed
28 F7 jp z, .inputLoop
1F rra ; Is A pressed? If yes, set c flag
D1 pop de
38 CB jr c, .newMail
1B dec de
1F rra ; Is B pressed? If yes, set c flag
38 E1 jr c, .terminator
1F rra ; Is SELECT pressed? If yes, set c flag
E1 pop hl ; pop starting address to hl
D8 ret c ; If SELECT pressed, simply return to normal operations
E9 jp hl ; If START pressed, jump to hl to execute newly written code
</pre>
===Raw Assembly===
<pre>
11 B5 D8 D5 D5
21 5C 65 CD 22
39 0E 80 21 4B
CF D1 2A 87 30
09 86 12 13 23
81 12 4F 18 F3
D5 21 01 C4 4D
CD DF 15 2D CB
FE 20 FB 75 CD
31 38 F0 B5 E6
0F 28 F7 1F D1
38 CB 1B 1F 38
E1 1F E1 D8 E9
</pre>
==
===Explanation===
This code cleans up every negative side effect brought on by the setup and allows the player to continue the story as intended, with the exception of 4F being added to the item bag, enabling use of the Nickname Writer.
The negative effects targeted are:
* By picking up Eevee, we have flagged its poké ball as "obtained"
* The current active box is filled with nicknamed Eevees
* The item pack currently has 255 items
* The item code is currently still required to run the Nickname Writer
* We currently have two badges set as obtained
* Our pokédex currently has 152 pokémon species caught, preventing the story from continuing
* Setting up SRAM glitch has given us a party of 255 pokémon
* We are currently located in the Celadon Pokémon center, while we need to return to Pallet Town to pick up the starter pokémon
<pre>
21 AE D5 ld hl, $D5AE ; Part of wMissableObjectFlags
CB AE res 5, (hl) ; Reenable Eevee's poké ball
AF xor a ; a = $00
EA 56 D3 ld (wObtainedBadges), a ; Reset badges
21 80 DA ld hl, wBoxCount
22 ldi (hl), a ; Set amount of pokémon in box to 0
3D dec a ; a = $FF
22 ldi (hl), a ; Add proper terminator to wBoxSpecies
AF xor a ; a = $00
01 26 00 ld bc, 0026
21 F7 D2 ld hl, wPokedexOwned
.loop
22 ldi (hl), a
0D dec c
20 FC jp nz, .loop ; Fully clear all Pokédex flags
2E B1 ld l, $B1 ; hl = $D3B1, within wWarpEntries
22 ldi (hl), a
22 ldi (hl), a
23 inc hl
23 inc hl
22 ldi (hl), a
22 ldi (hl), a ; Changes first two warp tiles to lead to Pallet Town instead
EA 63 D1 ld (wPartyCount), a ; Set amount of pokémon in party to 0
EA 1D D3 ld (wNumBagItems), a ; Set amount of items to 0
01 01 59 ld bc, $5901
CD 2E 3E call GiveItem ; Gives c amount of b item, giving 1 copy of 4F.
21 66 DA ld hl, $DA66 ; Part of 4F bootstrap
36 6A ld (hl), $6A
23 inc hl
36 D6 ld (hl), $D6 ; 4F now redirects directly to Nickname Writer
C9 ret
</pre>
===Raw Assembly===
<pre>
21 AE D5 CB AE
AF EA 56 D3 21
80 DA 22 3D 22
AF 01 26 00 21
F7 D2 22 0D 20
FC 2E B1 22 22
23 23 22 22 EA
63 D1 EA 1D D3
01 01 59 CD 2E
3E 21 66 DA 36
6A 23 36 D6 C9
</pre>
==Cleanup Code (existing save)==
===Explanation===
This code cleans up every negative side effect brought on by the setup and allows the player to continue the story as intended, with the exception of 4F being added to the item bag, enabling use of the Nickname Writer.
The negative effects targeted are:
* By picking up Eevee, we have flagged its poké ball as "obtained"
* The current active box is filled with nicknamed Eevees
* The item pack currently has 255 items
* The item code is currently still required to run the Nickname Writer
Since existing saves do not have to set up SRAM glitch, there are a lot less side effects that need to be addressed by the cleanup code.
<pre>
21 AE D5 ld hl, $D5AE ; Part of wMissableObjectFlags
CB AE res 5, (hl) ; Reenable Eevee's poké ball
AF xor a ; a = $00
21 80 DA ld hl, wBoxCount
22 ldi (hl), a ; Set amount of pokémon in box to 0
3D dec a ; a = $FF
22 ldi (hl), a ; Add proper terminator to wBoxSpecies
AF xor a ; a = $00
EA 1D D3 ld (wNumBagItems), a ; Set amount of items to 0
01 01 59 ld bc, $5900
CD 2E 3E call GiveItem ; Gives c amount of b item, giving 1 copy of 4F.
21 66 DA ld hl, $DA66 ; Part of 4F bootstrap
36 6A ld (hl), $6A
23 inc hl
36 D6 ld (hl), $D6 ; 4F now redirects directly to Nickname Writer
01 01 59 ld bc, $5901
C3 2E 3E jp GiveItem ; Gives c amount of b item, giving 1 copy of 4F.
</pre>
===Raw Assembly===
<pre>
21 AE D5 CB AE
AF 21 80 DA 22
3D 22 AF EA 1D
D3 21 66 DA 36
6A 23 36 D6 01
01 59 C3 2E 3E
</pre>
[[Category:Guides]]
| |||