Guides:SRAM Glitch ACE Setups (EN): Difference between revisions
Line 115:
|}
By walking left or right, you can increment or decrement the item ID in slot #35. By walking up and down we can alternate between an item quantity of x0 and x1. We can safely swap the contents of item slot #35 with other item slots, as long as we use Fly/Teleport afterwards to restore the map back to normal. We can use this to collect all the items we need for the item code. slot #
For every item in the following table, head to the Thunderstone x0 spot, follow the instructions to obtain an item stack, then Fly back to Celadon and head back to the same spot to obtain the next item stack. '''It is heavily recommended to save after every time you fly back to the Celadon City Pokémon Center.'''
|
Revision as of 22:19, 8 February 2024
This page serves as a repository for methods to quickly set up advanced ACE setups, starting from a fresh save file. These methods can be used for the English releases of Red & Blue.
The methods described here were heavily inspired by previous SRAM glitch setups developed by Evie (Chickasaurus GL), as well existing setups intended to be used for the Japanese releases.
Please make sure to fully read every step of the guide before executing them.
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.
Setting up initial ACE
When you use UP + SELECT + B on the title screen, the game will delete the save by filling the entirety of SRAM with $FF values. When you then interrupt the very first save process with specific timing, you can create a glitched save file that has a party consisting of 255 ($FF) pokémon. This is known as "SRAM glitch".
Within this glitched state, we can abuse the expanded party to affect memory areas that are normally unrelated to the party, with a wide variety of possible effects. In this guide, we will be abusing this to set up an ACE environment through the following process:
- Set up SRAM glitch
- Using SRAM glitch, access Celadon City so that we can assemble an item code that will allow us to write code using boxed pokémon's nicknames.
- Using an exploit known as "Map Script ACE", set up a method to quickly pick up an unlimited amount of Eevees
- Write code by repeatedly picking up and nicknaming Eevees. This will be used to build a program that allows you to more easily write arbitrary code.
Step 1: Starting a new game and setting up SRAM glitch
First, we need to set up SRAM glitch.
- Clear all saved data by pressing UP + SELECT + B on the title screen and confirming that you want to erase all saved data. (This needs to be done even if no save data is present).
- Start up the game and go through the intro. Name your character and rival any name you want.
- Open the start menu, and select "Save".
- Select "Yes" in the "Yes/No" dialog box. At a very precise moment, power off or reset the console.
- Soft resetting (holding Start+Select+A+B) will not work, as the game prevents soft resets while it is saving.
- The timing to power off or reset is after the "Yes/No" dialog box has disappeared, but before the text changes to "Now saving..." (Red/Blue) or "Saving..." (Yellow).
- The time window between those two visual cues is around 20 frames (depending somewhat on the version and the circumstances), but the window to successfully perform this glitch is only 4 frames.
- Reload the game. If you can continue the game and can open the pokémon menu, you have successfully set up SRAM glitch and can continue with the guide. Otherwise, repeat the process from the start, erasing the save in the process.
A quick note on the effects of SRAM glitch
Thanks to clearing out the previous save using UP + SELECT + B, which fills saved data with $FF values, we will reload with a party consisting of 255 ($FF) pokémon. There are, however, quite a number of side effects due to this:
- Having 255 party pokémon makes us unable to enter battle without heavy side effects. Due to this, we will be avoiding battle completely.
- It is heavily recommended to not look at the summary of any of the party pokémon, since they are made up of glitched data.
- Thanks to having 255 party pokémon, we are able to swap pokémon beyond the 6th party slot.
- Every few steps, the game will act as if at least one party pokémon is poisoned. This effect can be freely ignored.
Throughout the guide, codes are provided that resolve these side effects and allow you to resume normal game progression.
A quick note regarding unterminated name items
Certain glitch items lack a proper string terminator. When you select them, either by pressing A or select when highlighting them in the bag, these items will crash the game. On the Virtual Console releases, this has a possibility of erasing your save. When you see any item with an unusually long glitched name, please make sure to not use either of these buttons to select them.
In certain maps, such as Celadon City, opening the item bag or scrolling the item bag to display an unterminated name item will cause the game to seemingly freeze. You can cause the game to safely resume by tapping b regularly until the game continues.
In the Celadon City map, unterminated name items can be made safe to handle as long as at least one tree is visible on the upper row of the map while the start screen is opened. Under these circumstances, unterminated name items can be safely selected with a or select. This will also ensure that you do not need to tap b multiple times in order to scroll through unterminated name items, but certain items may still require a single b press to scroll through.
During the guide, care is taken to ensure that we'll only stand on these safe spots when using the item bag.
Step 2: Reaching Celadon City
The main item code will be assembled in Celadon City. We will be abusing the extended party's properties to obtain an expanded item pack. The expanded item pack is a glitched state where the game thinks that we have 255 ($FF) items in the item pocket, even though the item pocket usually has a maximum size of only 20 items. This allows us to access areas of memory beyond the item pack and treat them as if they are items. We will be abusing this to warp directly to Celadon City.
Place to stand |
---|
- Go downstairs and exit your house to Pallet Town. This registers Pallet Town as a Fly location, preventing a possible crash at a later point in the guide.
- Go back inside your house and take a single step to the right, so you end up at the location indicated by the screenshot above.
- Open the party menu and swap the 2nd party pokémon with the 10th pokémon. This sets the amount of pokémon caught in the pokédex to 152, as well as setting the amount of items in the bag to 255.
- Open the item bag and scroll down to the 36th item slot. This will be a Master Ball with quantity x0 (see screenshots below). Toss a total of 250 items from it for a final quantity of 6. When tossing, you can press down to underflow the amount of items to be tossed from 0 to 255, then press down 5 more times.
- Exit your house. Thanks to changing the item quantity, you will exit to Celadon City.
Slot #36 |
---|
Step 3: Setting up a pokémon that can use Fly
In order to assemble the required item code, we need a pokémon that knows Fly and we need the necessary badge to be able to use it. We will be abusing the mechanics of the extended party and the extended inventory to add Fly to the 11th party pokémon.
Potion location |
---|
- From where you exited out to Celadon, Walk 6 steps right, 4 steps up,6 steps right and another 4 steps up so you end up at the spot indicated by the above screenshot on the left. At this spot, the item in the 35th item slot will have turned into a Potion x0, as indicated by the below screenshots. Using Select, swap this Potion x0 to the 29th item slot. This will give you the Thunderbadge and the Soulbadge, allowing you to use both Surf and Fly. Check your trainer card, you should now have the third and fifth badges.
- In the 39th item slot, you'll find a TM23 x64 stack. Toss 45 items from this stack until you get a TM23 x19 stack, then swap it to the 7th item slot. This will alter party pokemon #11's data and allow it to use Fly.
- Finally, open the party menu, select the 11th party pokémon and have it use fly. Fly directly to Celadon City. If it doesn't have fly, make sure that the TM23 x19 stack is located in item slot #7.
- (Optional) Only if you're playing on the virtual console releases, it is advised to enter the pokémon center and change the current active box any box other than box #2.
It is now safe to save the game.
Slot #35 |
---|
Step 4: Assembling an item code in Celadon City
While standing in front of the Celadon City Pokémon Center, take 3 steps right, 5 steps up, 11 steps left and finally 3 steps up to reach the following spot. Make sure to bring a pokémon with Fly/Teleport.
Place to stand |
---|
While standing on this spot, open your item bag and keep scrolling down until you find a Thunderstone x0 item stack, located at item slot #35 as indicated by the below screenshot. We will use this spot to orient ourselves for the next section.
Slot #35 |
---|
By walking left or right, you can increment or decrement the item ID in slot #35. By walking up and down we can alternate between an item quantity of x0 and x1. We can safely swap the contents of item slot #35 with other item slots, as long as we use Fly/Teleport afterwards to restore the map back to normal. We can use this to collect all the items we need for the item code. slot #33 will always contain a bicycle, you can safely use this to speed up the process.
For every item in the following table, head to the Thunderstone x0 spot, follow the instructions to obtain an item stack, then Fly back to Celadon and head back to the same spot to obtain the next item stack. It is heavily recommended to save after every time you fly back to the Celadon City Pokémon Center.
During the entire process, make sure to not swap two item stacks that have the same item. This will cause both item stacks to merge, resulting in glitches as side effects. When this happens, you can reset the game to restore the game back to normal.
After flying back to Celadon city, we will verify if all items have been successfully collected.
- Before opening the bag, walk 5 steps to the right from the entrance of the pokémon center. This will ensure that we can open the item bag without issues.
- Open the item bag and swap the TM21 x213 stack located in slot #17 to the item stack in slot #7. This will remove the ability to fly, but is required to complete the item code.
- Next, make sure your item bag looks as follows:
Item slot | Item ID | Item Quantity |
---|---|---|
Slot #6 | Max Potion | x42 |
Slot #7 | TM21 | x213 |
Slot #8 | Thunderstone | x06 |
Slot #9 | TM22 | x42 |
Slot #10 | Great Ball | x135 |
Slot #11 | Antidote | x48 |
Slot #12 | Poké Ball | x134 |
Slot #13 | Hyper Potion | x44 |
Slot #14 | Super Potion | x32 |
Slot #15 | TM44 | x201 |
Slot #16 | Rare Candy | x243 |
After this item code, head to the room where you can pick up the gift Eevee. Do not pick up this Eevee yet, make sure to save before continuing.
A small note regarding Eevee's room
Within this room, no safe spots exist that allow unterminated name items to be safely handled. Please make sure to not press a or select on unterminated items while in this room.
Step 5: Setting up an initial ACE environment using map script ACE
Now that we have an item code ready, we'll be using it to set up an ACE environment. The item code we just made looks at the nicknames of the pokémon in the currently stored box, then uses pairs of text characters to write a new program. After it finishes, it immediately jumps to execute the newly written program.
Having a party of 255 pokémon makes it impractical to safely enter battle. To circumvent this, we'll be picking up multiple Eevees, nicknaming them, then storing them in the current active box.
We'll be executing ACE by overwriting the contents of item slot #41. This item slot contains the map script pointer. By overwriting it with a pointer aimed for the 6th item slot, the item code we made will be executed on every individual frame the start menu isn't open.
We will be using this in three stages:
- First we will alter a value in memory so that we can continuously keep picking up Eevees while we remain on the same map.
- Next we will give ourselves a glitch item that, when used, will execute ACE starting from the sixth item slot. This allows us to execute ACE outside of the limits of Map Script ACE.
- Finally we will set up a short program that uses the nickname screen to quickly and easily write programs of arbitrary size, effectively giving us a flexible ACE environment.
It is recommended to not save the game until the Nickname Writer program is installed.
A note on using ACE
The first generation of pokémon games, especially the Virtual console releases, are vulnerable to certain crashes wiping the save file. As a protective measure, make sure to open the trainer card to display Red's sprite on screen right before using ACE of any kind. Loading any sprite switches the current active sram bank, offering a measure of safety against game crashes.
Setting up Infinite Eevee mode
First, we'll use Map Script ACE to make sure that we can pick up as many Eevee as we want.
Nickname |
---|
- Pick up an Eevee and nickname it so that its name matches the above screenshot on the left. It will be sent to the current active box.
- Open the item bag. Swap the Rare Candy x243 with the contents of item slot #41, which should contain Dire Hit x93. This will activate Map Script ACE.
- Close the start menu. If everything went all right, Eevee's poké ball will have reappeared.
- Open the item bag. Swap the Dire Hit x93 that was previously in item slot #41 with the Rare Candy x243. This will deactivate Map Script ACE.
Slot #41 |
---|
Setting up -g m to execute item codes
Next, we'll be entering a list of five nicknames that gives us -g m and the necessary bootstrap. This ensures that using -g m will activate the item code.
List of nicknames |
---|
- Pick up Eevees and enter the nicknames in the above screenshot one by one. The nicknames from this list needs to be entered in this exact order from the top to the bottom.
- Open the item bag. Swap the Rare Candy x243 with the contents of item slot #41, which should contain Dire Hit x93. This will activate Map Script ACE.
- Close the start menu. If everything went all right, the CANCEL buttons in the first three slots have been removed and the first item was replaced with a glitch item named "-g m"
- Open the item bag. Swap the Dire Hit x93 that was previously in item slot #41 with the Rare Candy x243. This will deactivate Map Script ACE.
- Finally, verify that -g m works by using it. If the game doesn't crash, -g m was set up correctly.
Slot #41 |
---|
Setting up the Nickname Writer
- Next, we'll be entering a list of fourteen nicknames. This will form a small program that, when activated using -g m, will allow us to easily write large amount of arbitrary code using the nickname screen.
List of nicknames |
---|
- Pick up Eevees and enter the nicknames in the above screenshot one by one. The nicknames from this list needs to be entered in this exact order from the top to the bottom.
- Exit the room and head to the pokémon center. We'll be testing out the Nickname writer.
- Once you're at the pokémon center, use -g m. This should open a screen in which you're asked to enter a pokémon's nickname
- For now, press START to end writing the nickname. This should display the main menu, a number should be written on screen.
- Press SELECT to exit the Nickname Writer safely.
Using the nickname writer
From this point onward, whenever you use the ACE item, you should be able to open the nickname writer. Please make sure to respect the following:
- The Nickname Writer only works when you have the Eevee-filled box set as the current active box. Attempting to use the Nickname Writer with any other boxes set as active will likely crash the game.
- Make sure to only use the Nickname Writer inside a pokémon center to ensure that the checksums are correctly displayed.
- As a side effect, the Nickname Writer will overwrite the nicknames of the first party pokémon.
The program works as follows:
- The program opens the nickname screen and asks you to input a nickname.
- This nickname then gets converted to a sequence of five bytes.
- All five bytes are written starting from the starting location
- The program displays a checksum (sum of all written byte values) to confirm that you correctly entered the code. If the printed checksum doesn't match the expected checksum, you made a mistake entering a code.
- Afterwards, it waits for the user to decide what to do.
During the input phase, the controls are as follows:
- Press A for the program to ask for a new nickname and convert that to the next five bytes to be written.
- Press B to go back one byte at a time. The checksum will automatically be overwritten by the value written at the current selected address, giving you a measure of how far back you're going. This function is only needed if you accidentally confirmed a nickname without writing all 10 characters.
- Press START to immediately start executing the newly written program. Only do this when you've finished writing everything.
- Press SELECT to safely quit the Nickname Writer, without executing the newly written code.
- Press any button on the D-pad to go back five bytes and ask for a new nickname to correct errors. Use this if the printed checksum does not match the predicted checksum and the last written nickname contained ten characters.
Write mode | Input mode |
---|---|
Press select to switch between uppercase/lowercase | Checksum is displayed right next to ITEM |
Step 6: Returning the game state to normal
At this point, there are certain side effects that have been introduced by the setup:
- Setting up SRAM glitch has given us a party of 255 pokémon.
- The item pack currently has 255 items.
- The item code is currently still required to run the Nickname Writer.
- We are currently located in the Celadon Pokémon center, while we need to return to Pallet Town to pick up the starter pokémon.
- Our pokédex currently has 152 pokémon species caught, preventing the story from continuing.
We will be removing all these side effect using the Nickname Writer. The nicknames we need to enter will be generated by the Nickname Converter webtool. Simply open the link, copy paste the entire code below into the converter, then press the "Run" button to display the list of nicknames. Please make sure that you use the Nickname Writer within a poké center, to ensure that the checksums are displayed properly.
When using the Nickname Writer, the generated nicknames need to be entered from top to bottom.
AF 01 26 00 21 F7 D2 22 0D 20 FC 2E B1 22 22 23 23 22 22 EA 63 D1 EA 1D D3 01 01 6A CD 2E 3E 21 4B DA 36 2A 23 36 DD C9 |
Once all 8 codes have been entered and verified, you can press START during input mode to execute the code.
This will reset all Pokédex flags, removes all party pokémon, resets the bag, gives the ACE item and alters the exit of the poké center to lead out to Pallet Town.
From this point onward, you can exit the Poké Center and continue the story as normal.
Addendum: Additional codes
The following codes can be used with the Nickname Writer:
Giving yourself a VC transferable Mew
Effects:
- Remove all pokémon from the party.
- Add a lvl 5 Mew. This Mew cannot be transferred to gen 7 without additional modifications.
- Add a second lvl 5 Mew. This Mew is transferable and will be shiny upon transfer.
Warning:
- This code is intended to be used right after setting up the Nickname Writer. Be mindful that it will remove the entirety of your party in the process.
- In order to be able to transfer, make sure to NOT give a nickname to the second Mew.
AF EA 63 D1 01 05 15 C5 CD 48 3E C1 CD 48 3E 21 A3 D1 3E 59 22 36 0C 2E B2 3E AA 22 22 21 7E D2 3E 86 22 3D 22 36 50 C9 |
PokeGiver script
Effects:
- Change second bag item to ACE item "4F".
- Set up everything so that 4F will activate the PokéGiver script (regardless of the current active box).
How to use the PokéGiver script:
- Please use a different box than the one that contains the Nickname Writer.
- Use 4F to activate the script. Once activated, the script will do the following:
- Give a pokémon.
- If the pokémon is deposited to the PC, the Pokémon will be made shiny. The default code will give female shiny pokémon (if the gender ratio allows it).
- Display two numbers (in hexadecimal) on screen. The left number indicates the species ID of the pokémon to be given, the right number indicated the level the pokémon is to be given at.
- The numbers can be altered by using the d-pad. Press A to confirm the values and give the next pokémon. Press Start to stop the script without giving any more pokémon.
- The script will stop automatically once the current active box is full.
Warnings:
- Species IDs do not match pokédex IDs in gen 1. Please use the Big Hex List article to determine which Species IDs give which pokémon.
- Be mindful of using this code to give yourself glitch pokémon, as the seen flags set by these glitch pokémon can alter the contents of the bag.
- The script is located in the area of memory that corresponds with enemy trainer party data. The script persists through saves, but will be destroyed when battling any trainer.
- Nickname writer codes with a length of up to 4 nicknames can be used without overwriting the PokéGiver script.
3E 59 EA 20 D3 21 AD D8 11 65 DA 01 03 00 C3 B5 00 C3 B1 D8 00 3E 01 E0 B7 01 01 01 CD 48 3E D0 21 B1 DA 36 2A 23 36 AA 21 B7 D8 11 91 C4 CD F1 D8 13 2B CD F1 D8 CD 31 38 F0 B5 FE 01 28 DA 07 38 10 07 38 0B 23 07 38 09 07 38 04 07 30 D9 D8 34 34 35 18 D3 CD F4 D8 CB 36 7E E6 0F C6 F6 F6 80 12 13 C9 |
Altering the PokéGiver script so that it is kept after battle
By executing the following two nickname codes, you can ensure that you can keep using the PokéGiver script even after engaging in trainer battles.
First, execute the following code:
21 02 0A 74 26 40 75 01 FF 00 11 53 BA 21 B1 D8 C3 B5 00 00 |
Using this code will store a copy of the PokéGiver script in an unused area of memory, located in sram bank 02 at $BA53 (right after box #5).
Next, execute the following code:
01 19 00 11 65 DA 21 A8 D8 C3 B5 00 11 B1 D8 D5 21 02 0A 74 26 40 E5 75 01 FF 00 21 53 BA CD B5 00 E1 36 00 C9 |
This code will alter the bootstrap of 4F such that, when it is used, it will look up the copy of the PokéGiver script and once more copy it over to $D8B1, in the middle of enemy trainer data, where it will immediately be executed.
Please make sure to not use 4F during trainer battles, as it will overwrite buffered trainer data leading to unintended side effects.
The bootstrap for 4F is located in daycare data. To preserve the bootstrap, you will unable to store or retrieve any pokémon from the Day-Care.
If the bootstrap fails to work, you can reapply the bootstrap by executing the second code again.
Changing the gender of pokémon given by the PokéGiver script
With the PokéGiver script installed, you can use the following codes to change the gender of the pokémon given by the script.
All Languages | |
---|---|
Female Shiny | Male Shiny |
3E 2A EA C0 D8 C9 00 00 00 00 |
3E FA EA C0 D8 C9 00 00 00 00 |
Changing a Mew to be VC transferable
This code changes the data of the 6th party pokémon to have an OT ID of 22796 and a nickname of "GF". By putting a Mew in the sixth party slot and executing the code, the Mew can be passed through poké transporter to gen 7.
It is small enough to not destroy the PokéGiver script.
All Languages |
---|
21 53 D2 3E 59 22 36 0C 21 AA D2 3E 86 22 3E 85 22 36 50 C9 |
Installing a RAM writer
A RAM writer is an installable program that allows you to view and change any value in memory using a graphical user interface. This allows you to easily change specific values, set up and run small payloads and verify specific values in memory.
3E 03 CD 92 D9 3E 59 EA 1E D3 01 45 00 11 53 BA 21 C3 D8 CD B5 00 11 30 D4 0E 78 CD B5 00 11 65 DA D5 0E 1B C3 B5 00 AF 3C E0 B6 E0 B7 21 00 DA CD 30 D4 E5 11 F8 FF 19 54 5D 01 0C 00 CD 75 DA 21 A9 C3 CD 99 D4 3E 7C 22 7A CD 99 D4 7B CD 99 D4 3E E3 22 1A CD 99 D4 36 7C 09 13 7D FE 13 20 E5 26 00 74 21 50 C4 36 ED E1 18 C4 CD 7A D4 CB 5F 20 39 CB 57 28 0A 0F 30 01 E9 F0 FE 83 E0 FE C9 0F 30 2A E5 CD 75 DA 4E CD 7A D4 0F 38 12 0F 30 01 4B 79 83 4F 21 50 C4 36 EC 23 CD 99 D4 18 E8 E1 71 E5 06 1C 21 CE 77 CD D6 35 E1 C9 0F 30 03 53 1E 00 19 C9 CD 31 38 F0 B5 76 11 00 00 F5 07 30 01 13 07 30 01 1B 07 30 03 11 F0 FF 07 30 02 1E 10 F1 C9 F5 CB 37 CD A0 D4 F1 E6 0F C6 F6 F6 80 22 C9 3E 03 CD 77 DA 11 E3 DE D5 21 53 BA 4D C3 B5 00 F0 FE E5 26 0A 74 26 40 77 E1 C9 |
Using the full RAM writer
Assuming the program was entered correctly, the game should open up one of the screens as seen in the below screenshots. The RAM writer will draw various values on the screen. The leftmost 4 columns describe the addresses that are currently in view. The rightmost two columns describe the values at each of these addresses. All values on screen are represented in hexadecimal format.
For example: DA01>05 means that the address $DA01 is currently holding the value of $05.
Make sure to save the game after you've confirmed that the RAM writer is fully functional.
The RAM writer can also be used during battle. Opening and closing the RAM writer in battle will pass your turn to the enemy and cause the battle to continue as usual.
Due to the location the RAM writer is buffered, upon closing the RAM writer in battle in Red/Blue, you will see a slight graphical corruption at the bottom of the screen that will immediately be overwritten by the battle text box. This corruption is purely cosmetic and temporary, meaning that it will not cause any harm to your game.
Full Writer Controls
The RAM writer uses two modes of operation. In Read mode you are able to navigate memory and view the values at specific addresses. in Write mode you'll lock in a single address and manipulate the value at that address. By default, the RAM writer will open in Read mode.
RAM writer in Read mode | RAM writer in Write mode. |
Read mode controls
up: address -1 down: address +1 left: address -10 right: address +10 B + up: address -1 B + down: address +1 B + left: address -10 B + right: address +10 start: exit program A: toggle write mode select + up: sram bank -1 select + down: sram bank +1 select + left: sram bank -10 select + right: sram bank +10 select + A: start executing code from current address onwards (use with caution!)
Write mode controls
up: value -1 down: value +1 left: value -10 right: value +10 B: set current value to 0 A: exit write mode and load final value into the address