Guides:TMless 0x1500 ACE (JP): Difference between revisions

The guide is split up between guides applicable for players starting a new game or continuing from an old game. '''Please make sure to fully read every step of the guide before executing them.'''

The setup requires catching a Spearow during day time and fighting Spinarak during night time. It is recommended to set the in-game time at the start of the game somewhere between 5:00PM-5:30PM.

Pokémon Crystal contains two important differences compared to its predecessors. Firstly, Crystal won't abort the text printing function when it encounters a $00 value, instead printing a '?' instead. Secondly, Crystal added new printing funtions related to the Mobile Game Boy Adapter, a Japanese exclusive peripheral that allowed internet connectivity through a mobile phone.

By obtaining a pokémon whose name does not contain the usual text terminator, we can force the game into printing much larger amounts of texts than would otherwise be possible. By abusing an illegal Mobile Adapter function and setting up memory in a specific way, we can escape the text printing function and trigger arbitrary code execution based on the data of the last viewed party pokémon.

Within these pages, you'll be able to find four different methods. These are ordered based on how early you'll be able to setup ACE:

*Methods that should be used when starting from a new game

*# Rival Name method- can be performed from Cherrygrove City onward, after acquiring poké balls. '''Requires a specific rival name to work'''. By far the fastest method.

*# Onix method - can be performed from Violet City onwards. '''Requires not yet having performed the NPC trade in Violet City for Onix.'''

*# Sandshrew method - can be performed from Goldenrod City onwards. '''Intended to be started at the Union Cave''', serves as a backup method in case the Onix method fails.

*# Wooper/Quagsire method - requires having obtained both Surf and Strenght. Requires access to TM18 RAIN DANCE, either from Slowpoke Well or from Celadon Dept. Store, second fasted methods, but best performed using older saves.

=Rival Name method=

==Step 1: Preparing the Rival's name==

Start a new game, the starter you pick doesn't matter. '''Set the in-game clock either to morning or midday.'''

* Once you are giving the option to name your rival, give the rival the following name:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:Box Japanese C Rival.png]]

|}

* Once you acquire poké balls, catch a Spearow on route 46 (30% spawn odds, morning and midday).

# Now that you have an unterminated name pokémon, put it in box 1. Either release or move all other pokémon in the box so that the unterminated name pokémon is the only pokémon left in box 1.

===Setting up the Mail Writer===

Next, we're going to both finish the setup and use it install a Mail Writer program. The Mail Writer is a small program that is written using box name codes. This program will allow you to easily write arbitrary data in order to achieve numerous effects.

[[File:Box Japanese C V2 Initial.png]]

==Step 3: Using the ACE setup==

* Slot 1 - Spearow, no held item

[[File:JP Rival Name ACE location.png]]

# Stand in front of the PC on the second floor of any pokémon center. Take one step down, take seven steps to the right until you end up at the location indicated by the above screenshot. '''Save the game here and reset.'''

# After reloading the save, take seven steps to the left and take one step up. You should now be standing right in front of the PC.

# Open the start menu, then open the summary of Spearow and close it.

==Step 4: Finishing the Mail Writer==

Lastly, rename the names of boxes #1 through #4 so that all box names fit the following image. '''Make sure to not change the names of box #7 and box #9.'''

=Onix method=

==Step 1: Preparing the Onix==

Start playing the game as you normally would, the starter doesn't matter. '''It is recommended that you don’t fight the bug catcher on route 31.'''

# Once you acquire poké balls, catch a Spearow on route 46 (30% spawn odds, morning and midday).

# Once you reach route 31, catch a Bellsprout (20% spawn odds, all day).

# Proceed to Violet City. In the house to the left of the pokémon center, trade your Bellsprout for Rocky the Onix. '''In case you have already traded and used Onix prior to reading this guide, an alternative setup is provided further on in the page.'''

# With Onix, defeat the following Pokémon. It is imperative that Onix is the only pokémon that gains experience during these battles:

#* Spinarak (30% spawn odds on route 31, only during nighttime)

#* Spinarak (30% spawn odds on route 31, only during nighttime)

#* Spinarak (30% spawn odds on route 31, only during nighttime)

#* Caterpie (30% spawn odds on route 30, only during morning and midday. '''The trainer on route 31 has three Caterpie you can fight''')

#* Caterpie (30% spawn odds on route 30, only during morning and midday. '''The trainer on route 31 has three Caterpie you can fight''')

# Make sure Onix doesn’t hold any item, check that Tackle is set as its first move.

# Go to Violet City’s pokémon mart. Buy a flower mail.

==Step 2: Preparing the bad clone and remaining items==

# Use the bad clone glitch to obtain a pokémon with an unterminated name.

## For this, use a box that has never been full at any point in time. It’s recommended to start with an empty box.

## Deposit a single pokémon. Attempt to save the game using "Move Pokémon w/o mail" but reset the game a bit just after the game has fully printed "SAVING... DON'T TURN OFF THE POWER".

## After rebooting the game, '''open and close the item pack''', then check the newly deposited pokémon.

## If the newly deposited pokémon’s nickname was changed to a bunch of question marks, you can continue with the next step. If the pokémon wasn't saved, that means the reset too early. If the pokémon was cloned, this means the reset was too late.

## If the amount of pokémon in the box exceeds 15, release the cloned pokémon and save the game afterwards to set the amount of stored pokémon to 15 before repeating step 2.

# Now that you have an unterminated name pokémon, put it in box 1. Either release or move all other pokémon in the box so that the unterminated name pokémon is the only pokémon left in box 1.

# Finally, give Spearow a mail to hold with the following text:

|

[[File:Mail Japanese C.png]]

===Setting up the Mail Writer===

Next, we're going to both test the setup and install a Mail Writer program. The Mail Writer is a small program that is written using box name codes. This program will allow you to easily write arbitrary data in order to achieve numerous effects.

Rename all boxes to the following names:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:Box Japanese C Setup.png]]

|}

Upon using 0x1500 ACE, the mail code included in the setup will be executed and will replace the first item of the main item pocket with a TM15. Alongside that, it will install a setup so that using this TM15 will execute box name codes. Finally, it will write two values to the box name area that will allow the Mail Writer to properly function.

Once that is done, you can use TM15 at any time to run the Mail Writer. More details on the Mail Writer can be found in the next guide.

==Step 3: Using the ACE setup==

Before executing ACE, arrange your party as follow:

* Slot 1 - Spearow, holding mail

* Slot 2 - Onix, no held item

* Slots 3-6 aren't relevant for this setup.

In order to execute ACE, do the following actions:

# Stand in front of the PC on the second floor of any pokémon center. Save and reset the game.

# Take exactly one step down and open the start menu.

# Open the summary of Onix and close it.

# Take exactly one step up so you’re in front of the PC. Open the start menu again.

# Read the mail you've previously given to Spearow (the Spearow needs to be at the very top of your party list).

# Open the PC. Open the withdraw screen so that the unterminated name pokémon's name would be displayed. Displaying this name will trigger ACE.

If the game doesn't crash, you have completed the setup and have installed the Mail Writer.

Now that the ACE setup has been successfully tested and the Mail Writer program has been fully installed, we can use it to arbitrarily write data to achieve various effects. Instructions on how to activate and use the Mail Writer can be found in the following link: [[Guides:Mail Writer C (JP)|Mail writer C (JP)]]

=Sandshrew method=

==Step 1: Preparing the Sandshrew==

Continue playing the game as you normally would.

# Once you reach Union Cave, catch a Sandshrew (30% spawn odds, only during morning and midday). It is recommended to use TM31 to teach it Mud-slap (Obtained by beating Falkner).

# With Sandshrew, defeat the following Pokémon. It is imperative that Sandshrew is the only pokémon that gains experience during these battles:

#* Geodude (30% spawn odds in Union Cave, 20% spawn odds on route 33, entire day)

#* Geodude (30% spawn odds in Union Cave, 20% spawn odds on route 33, entire day)

#* Hoppip (15% spawn odds on route 33, only during morning and midday)

# Talk to the guard in the gate between Ilex Forest and route 34 to obtain Kenya the Spearow. If Kenya is not available, it can be substituted by any other wild Spearow.

# Once you reach Goldenrod City, go to the Goldenrod Dept. Buy one Flower Mail and one Lemonade (Lemonade can be bought from the vending machines at the top floor).

# Buy an additional Poké Ball and Great Ball. Ensure that the Poké Ball is at the bottom of the ball pocket item list.

# Give Sandshrew the Lemonade as a held item, ensure it has Scratch as its first move.

==Step 2: Preparing the bad clone and remaining items==

# Use the bad clone glitch to obtain a pokémon with an unterminated name.

## For this, use a box that has never been full at any point in time. It’s recommended to start with an empty box.

## Deposit a single pokémon. Attempt to save the game using "Move Pokémon w/o mail" but reset the game a bit just after the game has fully printed "SAVING... DON'T TURN OFF THE POWER".

## After rebooting the game, '''open and close the item pack''', then check the newly deposited pokémon.

## If the newly deposited pokémon’s nickname was changed to a bunch of question marks, you can continue with the next step. If the pokémon wasn't saved, that means the reset too early. If the pokémon was cloned, this means the reset was too late.

## If the amount of pokémon in the box exceeds 15, release the cloned pokémon and save the game afterwards to set the amount of stored pokémon to 15 before repeating step 2.

# Now that you have an unterminated name pokémon, put it in box 1. Either release or move all other pokémon in the box so that the unterminated name pokémon is the only pokémon left in box 1.

# Finally, give your '''Spearow''' (either Kenya or another Spearow) a mail to hold with the following text:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:Mail Japanese C.png]]

|}

===Setting up the Mail Writer===

Next, we're going to both test the setup and install a Mail Writer program. The Mail Writer is a small program that is written using box name codes. This program will allow you to easily write arbitrary data in order to achieve numerous effects.

Rename all boxes to the following names:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:Box Japanese C Setup.png]]

|}

Upon using 0x1500 ACE, the mail code included in the setup will be executed and will replace the first item of the main item pocket with a TM15. Alongside that, it will install a setup so that using this TM15 will execute box name codes. Finally, it will write two values to the box name area that will allow the Mail Writer to properly function.

Once that is done, you can use TM15 at any time to run the Mail Writer. More details on the Mail Writer can be found in the next guide.

==Step 3: Using the ACE setup==

Before executing ACE, arrange your party as follow:

* Slot 1 - Spearow, holding mail

* Slot 2 - Sandshrew, holding Lemonade

* Slots 3-6 aren't relevant for this setup.

In order to execute ACE, do the following actions:

# Stand in front of the PC on the second floor of any pokémon center. Save and reset the game.

# Take exactly one step down and open the start menu.

# Open the summary of Sandshrew and close it.

# Take exactly one step up so you’re in front of the PC. Open the start menu again.

# Read the mail you've previously given to Spearow (the Spearow needs to be at the very top of your party list).

# Open the PC. Open the withdraw screen so that the unterminated name pokémon's name would be displayed. Displaying this name will trigger ACE.

If the game doesn't crash, you have completed the setup and have installed the Mail Writer.

Now that the ACE setup has been successfully tested and the Mail Writer program has been fully installed, we can use it to arbitrarily write data to achieve various effects. Instructions on how to activate and use the Mail Writer can be found in the following link: [[Guides:Mail Writer C (JP)|Mail writer C (JP)]]

=Wooper/Quagsire method=

==Step 1: Preparing the Wooper/Quagsire==

This guide assumes you have at least access to Strength and Surf, having access to Fly is not required but will speed up the process.

# From Azalea Town, enter the Union cave. Surf on the nearest water and catch either a wild Quagsire or Wooper. (If you've previously already caught Wooper/Quagsire, you can use the old one instead)

# Obtain a TM18 RAIN DANCE using one of the following methods:

#* Go to Azalea Town's Slowpoke Well and pick up TM18. It can be found on B2F and requires the use of Surf and Strength to reach.

#* Go to the Celadon Dept. Store and buy a TM18

# Talk to the guard in the gate between Ilex Forest and route 34 to obtain Kenya the Spearow. If Kenya is not available, it can be substituted by any other wild Spearow.

# Use TM18 on Wooper/Quagsire. '''Ensure that Rain Dance is in Wooper/Quagsire's first move slot.''' Ensure that Wooper/Quagsire is not holding any item.

==Step 2: Preparing the bad clone and remaining items==

# Use the bad clone glitch to obtain a pokémon with an unterminated name.

## For this, use a box that has never been full at any point in time. It’s recommended to start with an empty box.

## Deposit a single pokémon. Attempt to save the game using "Move Pokémon w/o mail" but reset the game a bit just after the game has fully printed "SAVING... DON'T TURN OFF THE POWER".

## After rebooting the game, '''open and close the item pack''', then check the newly deposited pokémon.

## If the newly deposited pokémon’s nickname was changed to a bunch of question marks, you can continue with the next step. If the pokémon wasn't saved, that means the reset too early. If the pokémon was cloned, this means the reset was too late.

## If the amount of pokémon in the box exceeds 15, release the cloned pokémon and save the game afterwards to set the amount of stored pokémon to 15 before repeating step 2.

# Now that you have an unterminated name pokémon, put it in box 1. Either release or move all other pokémon in the box so that the unterminated name pokémon is the only pokémon left in box 1.

# Finally, give your '''Spearow''' (either Kenya or another Spearow) a mail to hold with the following text:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:Mail Japanese C.png]]

|}

===Setting up the Mail Writer===

Next, we're going to both test the setup and install a Mail Writer program. The Mail Writer is a small program that is written using box name codes. This program will allow you to easily write arbitrary data in order to achieve numerous effects.

Rename all boxes to the following names:

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"

|

[[File:Box Japanese C Setup.png]]

|}

Upon using 0x1500 ACE, the mail code included in the setup will be executed and will replace the first item of the main item pocket with a TM15. Alongside that, it will install a setup so that using this TM15 will execute box name codes. Finally, it will write two values to the box name area that will allow the Mail Writer to properly function.

Once that is done, you can use TM15 at any time to run the Mail Writer. More details on the Mail Writer can be found in the next guide.

==Step 3: Using the ACE setup==

Before executing ACE, arrange your party as follow:

* Slot 1 - Spearow, holding mail

* Slot 2 - Wooper/Quagsire

* Slots 3-6 aren't relevant for this setup.

In order to execute ACE, do the following actions:

# Stand in front of the PC on the second floor of any pokémon center. Save and reset the game.

# Take exactly one step down and open the start menu.

# Open the summary of Wooper/Quagsire and close it.

# Take exactly one step up so you’re in front of the PC. Open the start menu again.

# Read the mail you've previously given to Spearow (the Spearow needs to be at the very top of your party list).

# Open the PC. Open the withdraw screen so that the unterminated name pokémon's name would be displayed. Displaying this name will trigger ACE.

If the game doesn't crash, you have completed the setup and have installed the Mail Writer.

Now that the ACE setup has been successfully tested and the Mail Writer program has been fully installed, we can use it to arbitrarily write data to achieve various effects. Instructions on how to activate and use the Mail Writer can be found in the following link: [[Guides:Mail Writer C (JP)|Mail writer C (JP)]]

=Appendix: in-depth explanation of the setup=

===Effect of the Rival Name===

Moving with the specific movement pattern that is used in the Rival Name method will place the following data at $CD46:

D2 8B D4 jp nc, $D48B

This address corresponds to the second character of the Rival's name. The specific name that was used in the method will place the following data from $D48A onward:

<pre>

E1 filler

E1 pop hl ; Entry point of execution

C3 83 DB jp nc, $DB83

</pre>

This address corresponds with the 1st character of box #4's name. Once it arrives here, the first 4 box names will be executed as follows:

26 DA ld h, $DA ; .boxNameStart

32 ldd (hl), a

C6 3D add $3D ; a = $68

D6 8B sub $8B ; a = $38

EA B1 DB ld($DBB1), a

D6 D1 sub $D1 ; a = $67, Carry flag set

30 E3 jr nc, .boxNameStart

87 add a ; a = $CE

EA 86 D8 ld(wItems), a

50 ld d, b

</pre>

Box #5 through box #9 are not executed as part of 0x1500 ACE and are instead part of the standard Mail Writer program. These will be elaborated on in their own section.

===Effect of Onix===

Defeating the provided list of pokémon and viewing Onix's summary will result in the following values starting from the buffered species ID at $D10E, assuming the pokémon is in party slot #2:

<pre>

5F ld e, a

00 nop

21 67 00 ld hl, $0067 ; Determined by Onix's moves, Tackle and Screech

00 nop

BF cp a, a

1E 00 ld e, $00 ; $BF1E corresponds to Onix's OTID of 48926

01 XX 00 ld bc, $00XX ; $XX is determined by the exact level of the opponents fought

D2 00 F0 jp nc, $F000

</pre>

After the effect of 0x1500 ACE is triggered and execution is redirected to $D10E, execution slides harmlessly through move, OTID and experience data before jumping to $F000, which is echo RAM for $D000 and is located two bytes before the last buffered mail.

===Effect of Sandshrew===

Defeating the provided list of pokémon and viewing Sandshrew's summary will result in the following values starting from the buffered species ID at $D10E, assuming the pokémon is in party slot #2:

<pre>

1B dec de

30 0A jr .jump

XX XX XX XX XX XX XX XX XX 73 ; Move, OTID and experience is skipped over by the jr instruction

00 nop ; .jump

C3 00 F0 jp $F000

</pre>

After the effect of 0x1500 ACE is triggered and execution is redirected to $D10E, execution jumps over move, OTID and experience data, followed by another jump to $F000, which is echo RAM for $D000 and is located two bytes before the last buffered mail.

===Effect of Wooper/Quagsire===

Defeating the provided list of pokémon and viewing Sandshrew's summary will result in the following values starting from the buffered species ID at $D10E, assuming the pokémon is in party slot #2:

<pre>

C3 00 F0 jp $F000

</pre>

After the effect of 0x1500 ACE is triggered and execution is redirected to $D10E, execution immediately jumps to $F000, which is echo RAM for $D000 and is located two bytes before the last buffered mail.

===Effect of the mail===

The last read mail is buffered from $D002 onward. Please note that viewing the bad clone in box #1 will write the value $01 to $D003 and $D004. Converting the characters from the mail to assembly results in the following, ordered by language:

<pre>

3E 01 ld a, $01

01 8D A6 ld bc, $A68D

26 DA ld h, $DA

2E 12 ld l, 12

84 add a, h ; a = $DB

32 ldd (hl), a

81 add a, c ; a = $68

32 ldd (hl), a

90 sub a, b ; a = $C3

32 ldd (hl), a

F6 4E or $4E ; a = $CE

EA 86 D8 ld(wItems), a

D6 96 sub $96 ; a = $38

EA A1 DB ld($DBA1), a

EA B1 DB ld($DBB1), a

C9 ret

===Effect of the box name code===

Converting the box name code to assembly results in the following code: