Guides:TMless 0x1500 ACE (JP): Difference between revisions

Jump to navigation Jump to search
Content added Content deleted
VisualWikitext
mNo edit summary
Line 1: Line 1:
{{Guides header|0x1500 control code arbitrary code execution}}
{{Guides header|0x1500 control code arbitrary code execution}}


This page serves as a repository on a 0x1500 ACE setup for the Japanese versions of Pokémon Crystal. It is part of the [[Guides:TimoVM's_gen_2_ACE_setups|TimoVM's gen 2 ACE setups]] set of guides.
This page serves as a repository on a 0x1500 ACE setup for the Japanese versions of Pokémon Crystal. It is part of the [[Guides:TimoVM's_gen_2_ACE_setups|TimoVM's Gen 2 ACE setups]] set of guides.


The guide is split up between guides applicable for players starting a new game or continuing from an old game. '''Please make sure to fully read every step of the guide before executing them.'''
The guide is split up between guides applicable for players starting a new game or continuing from an old game. '''Please make sure to fully read every step of the guide before executing them.'''
Line 7: Line 7:
The setup requires catching a Spearow during day time and fighting Spinarak during night time. It is recommended to set the in-game time at the start of the game somewhere between 5:00PM-5:30PM.
The setup requires catching a Spearow during day time and fighting Spinarak during night time. It is recommended to set the in-game time at the start of the game somewhere between 5:00PM-5:30PM.


If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the [https://discord.gg/EA7jxJ6 Glitch City Research Institute Discord].


'''When playing on cartridge or emulator, it is required to have previously cleared an old save by pressing SELECT + UP + B simultaneously on the start screen at least once since obtaining the cart. Otherwise you will not be able to obtain a bad clone or an unterminated name pokémon.'''
'''When playing on cartridge or emulator, it is required to have previously cleared an old save by pressing SELECT + UP + B simultaneously on the start screen at least once since obtaining the cart. Otherwise you will not be able to obtain a bad clone or an unterminated name pokémon.'''
Line 118: Line 118:
|}
|}


===Testing the setup===
===Setting up the Mail Writer===


Next, we're going to both test the setup and install a Mail Writer program. The Mail Writer is a small program that is written using box name codes. This program will allow you to easily write arbitrary data in order to achieve numerous effects.
In order to be able to test the setup, rename box 1 to the following names:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
Rename box 1 to the following names:
|
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
[[File:Box Japanese C Test.png]]
|
[[File:Box Japanese C Setup.png]]
|}
|}


This box name code will be used to test the setup. It has no effect outside of safely exiting ACE and returning the game's state back to normal. Alongside that, the mail code included in its setup will also replace the first item of the main item pocket with a TM15 and install a setup so that using this TM15 will execute box name codes. This effect is not relevant at the moment, but will be used to set up the mail writer.
This box name code will be used to test the setup and will safely exiting ACE and returning the game's state back to normal.

Alongside that, the mail code included in its setup will also replace the first item of the main item pocket with a TM15 and install a setup so that using this TM15 will execute box name codes. On top of that, it will write two values to the box name area that will allow the Mail Writer to properly function.


==Step 3: using the ACE setup==
==Step 3: using the ACE setup==
Line 149: Line 153:
= What to do with this ACE setup =
= What to do with this ACE setup =


Now that the ACE setup has been succesfully tested, we can start expanding the setup to more easily write arbitrary data and be more convenient to use. This will be done by installing the Mail writer, a small program installed using a set of box name codes.
Now that the ACE setup has been succesfully tested and the Mail Writer program has been fully installed, we can use it to arbitrarily write data to achieve various effects. Instructions on how to activate and use the Mail Writer can be found in the following link: [[User:TimoVM/Mail Writer C (JP)|Mail writer C (JP)]]

=Appendix: in-depth explanation of the setup=

===Effect of the mail===

The last read mail is buffered from $D002 onward. Please note that viewing the bad clone in box #1 will write the value $01 to $D003 and $D004. Converting the characters from the mail to assembly results in the following, ordered by language:

<pre>
3E 01 ld a, $01
01 8D A6 ld bc, $A68D
26 DA ld h, $DA
2E 12 ld l, 12
84 add a, h ; a = $DB
32 ldd (hl), a
81 add a, c ; a = $68
32 ldd (hl), a
90 sub a, b ; a = $C3
32 ldd (hl), a
F6 4E or $4E ; a = $CE
EA 86 D8 ld(wItems), a
D6 96 sub $96 ; a = $38
EA A1 DB ld($DBA1), a
EA B1 DB ld($DBB1), a
E1 pop hl
C9 ret
</pre>

===Effect of the box name code===

Converting the box name code to assembly results in the following code:

<pre>
Box 1: $DB68
11 B1 D2 ld de, $D2B1
D5 push de
D5 push de ; .newMail
26 2E ld h, $2E
2E 50 ld l, $50 ; hl = $2E50

Box 2: $DB71
D5 push de
29 add hl, hl ; hl = $5CA0
2E EB ld l, $EB ; hl = $5CEB
3E 05 ld a, $05
3D dec a ; a = $04
42 ld b, d
50 ld d, b

Box 3: $DB7A
B7 or a
CF rst08h ; farCall _ComposeMailMessage (a:hl = 04:5CEB)
D1 pop de
E1 pop hl ; Set both hl and de to the start of the newly written mail
2A ldi a, (hl)
B7 or a
B7 or a
D6 50 sub $50

Box 4: $DB83
28 12 jr, .terminator
30 05 jr, .character
2A ldi a, (hl) ; If terminator, escape loop. if newline, get new value for a and continue
B7 or a
B7 or a
D6 50 sub $50 ; Ensures that new character will result in the same value when combined with the next

Box 5: $DB8C
86 add (hl) ; .character
12 ld (de), a
13 inc de
80 add a, b
47 ld b, a ; Responsible for generating checksum
12 ld (de), a
2A ldi a, (hl) ; inc hl is not available, so this will have to do
E6 50 or $50 ; Ensures that carry flag is not set

Box 6: $DB95
30 E7 jr nc, .loop
0C inc c ; .terminator, _ComposeMailMessage sets bc to 0000, so c = 01 after this part
26 C5 ld h, $C5
2E F4 ld l, $F4 ; hl = $C4F4, bottom left screen tile
06 50 ld b, $50 ; Ensures that b is consistent for the next call

Box 7: $DB9E
1A ld a, (de)
CD 90 38 call PrintBCDNumber.loop + 01h ; PrintBCDNumber.loop itself can't be reached, so we skip forward one byte.
26 1A ld h, $1A ; .errorCorrection
1B dec de ; Calling PrintBCDNumber.loop with c = 01 advances de by 1.
06 50 ld b, $50

Box 8: $DBB0
2E 8D ld l, $F4 ; hl = $1A8D
29 add hl, hl ; hl = $351A (address of JoyTextDelay_ForcehJoyDown)
CF rst08H ; Farcall JoyTextDelay_ForcehJoyDown set a = current button state
B7 or a, a ; Are any buttons pressed? if not, ask for new button states
28 E9 jr z, .terminator
42 ld b, d
50 ld d, b


Box 9: $D8FA
Use the following link to continue to the next guide: [[User:TimoVM/Mail Writer C (JP)|Mail writer C (JP)]]
0F rlca ; Is the a button pressed? If yes, start a new mail
38 B9 jr c, .loop
40 ld b, b
0F rlca ; Is the b button pressed? If yes, return and execute newly written program.
D8 ret c ; If not, another button was pressed, so decrement de to allow user to correct errors
30 EA jr nc, .errorCorrection
</pre>


==Plain text transcripts of codes==
==Plain text transcripts of codes==
Retrieved from "https://glitchcity.wiki/wiki/Guides:TMless_0x1500_ACE_(JP)"