Guides:Wrong Pocket TM ACE setup (KOR)
|
This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Wrong pocket TMs and HMs. |
This page serves as a repository for a Wrong Pocket TM ACE setup for the Japanese versions of Pokémon Gold & Silver. It is part of the TimoVM's gen 2 ACE setups set of guides.
Please make sure to fully read every step of the guide before executing them.
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.
Setting up initial ACE
In the generation 2 games, items are stored in their own dedicated compartiments. All TMs and HMs are stored in their own pocket, all key items are kept in their own pocket, etc..
By glitching an item into a pocket that it's not supposed to be, we can use the item to achieve various glitchy effects. In particular, using TMs from the wrong pocket will confuse the game, causing it to treat the TM as a "normal" item and execute invalid item effects, some of which can lead to arbitrary code execution.
TM15, in particular, executes code starting from $FA0F, a duplicate of address $DA0F. This region corresponds to the second character of box #12's name. In this guide, we'll go through the process of obtaining TM15 outside the TM/HM pocket.
In practice, the initial ACE setup will be created using the following general process:
- Obtain a bad clone.
- Use the bad clone to obtain two additional bicycles. then use duplicate key items glitch to place TM15 (an ACE item) in the ball pocket.
As an alternative, if you already have another copy of Korean Gold/Silver that already has ACE, you can trade two pokémon holding bicycles to bypass the bad clone requirement and continue the guide from section 4.3. (Trade three pokémon holding bicycles if you don't have access to Goldenrod City yet.)
A note on the side effects of the method described below
The method described on this page requires fairly heavy abuse of glitches that will produce a small amount of side effects. All these side effects can be fixed with later applications of ACE and are never permanently harmful for the game in any way:
- Obtaining duplicate key items requires obtaining a glitch pokémon that cannot be manually released.
- Duplicate key item swap glitch removes the CANCEL button from the key item pocket.
Later parts of the guide will offer methods to fix these side effects.
Step 1: Requirements for this guide
NOTE: There seems to be an issue with the VC version of Korean Gold & Silver that renders you unable to get proper bad clones through resetting the game during a save. At the moment, the only viable alternative is Hall of Fame SRAM glitch which requires beating the game without saving after having cleared the previous save with UP + SELECT + B
When playing on original cartridge or on emulator, it is absolutely required to have used the Clear Save Data feature (press SELECT + UP + B on the title screen) at least once since owning the game.
- Completing the setup requires having reached Goldenrod City, to access the Day Care and the GoldenRod Dept. Store.
- Due to technical reasons, please ensure that the following is true for your trainer ID:
- Your trainer ID must not be equal or higher than 65280.
- The remainder of your trainer ID divided by 256 must not be equal to 255.
- If your trainer ID does not fulfill both requirements, one of the methods described in the guide will not work correctly. When starting from a new save, it is recommended to reset your game until you get a compatible trainer ID. If you do not wish to reset your save, a workaround is provided that requires you to not have traded the Machop in Goldenrod City yet.
Step 2: Obtaining a bad clone through resetting while saving
A bad clone is created when you reset the game at a very specific time frame where:
- The game has saved that additional pokémon were deposited in the active box.
- The game has not yet saved the data of the deposited pokémon
In combination with the Day Care, we can turn this bad clone into a glitch pokémon that we'll be using to perform a variety of glitches.
Method 1: Save corruption (not compatible with Korean VC)
Requirements
- A box that has never been full at any point in the past.
- Fill this box with 15 pokémon. You can use cloning glitch to obtain the required pokémon.
- An additional pokémon that you can deposit to the PC.
Execution
- Deposit any party pokémon to the current active box.
- Go to "Move pokémon w/o mail", you will get a prompt to save the game.
- Reset the game shortly after the "saving...” text is fully printed.
- If successful, upon restarting the game you will find a level 0 female version of the deposited pokémon with a glitched name. Make sure you only withdraw this pokémon to your party using "Move pokémon w/o mail" to keep it at lvl 0.
Please note that the timing of this is very strict (around frame perfect).
- If nothing was saved, the reset was too early. Wait a little bit longer to reset.
- If the pokémon was successfully cloned, the reset was too late. reset a little bit earlier.
- If the box ever gets to 19 pokémon in total, release pokémon from the box until there are only 15 pokémon present. Make sure to save normally after releasing them.
Use these guidelines and keep retrying until you've obtained a bad clone.
Method 2: Hall of Fame SRAM corruption (compatible with VC)
- Clear your previous save by holding UP + SELECT + B on the title screen.
- Start a new game and beat the Pokémon Leage without saving. The game will automatically save when your party gets registered in the Hall of Fame. After you entered the Hall of Fame, it is safe to save the game whenever you'd like.
- Use "Move PKMN w/o mail" to move an unwanted pokémon into the top slot of box 2.
- Use "Move PKMN w/o mail" again to move an additional unwanted pokémon into the top slot of box 2.
- This will corrupt the first unwanted pokémon, where it is now a hybrid between its original species and a glitch species $00. This makes it a bad clone, and you can now use it for the remainder of the guide.
Step 3: Obtaining additional bicycles and getting TM15 in the ball pocket
This works in any language version on any generation 2 game, the method is based on a translation of a [blogpost from 任意コード].
This method will only work if your trainer ID fulfills both of the following requirements:
- Your trainer ID must not be equal or higher than 65280.
- The remainder of your trainer ID divided by 256 must not be equal to 255.
If your trainer ID does not fulfill both requirements and you do not wish to reset your save, please follow the following steps:
- On route 34, catch a Drowzee.
- On the 5th floor of the Goldenrod Dept. Store and trade Drowzee for a Machop.
- Buy a TM48 (Fire Punch) and teach it to Machop. Rearrange its moves so that Fire Punch is in the second move slot.
- Using the cloning glitch, get at least six copies of Machop (it is recommended to keep some spares just to be safe). We'll be using these Machop in the remainder of the setup.
Requirements
Have the following items in the ball pocket:
- Slot 1: Poké Ball x1
- Slot 2 and beyond: empty
Have the following items in the key item pocket:
- All key items you've obtained in your save thus far (withdraw all key items (if any) you previously stored from the PC)
- Bicycle at the bottom of the key item list
| Compatible trainer ID | Incompatible trainer ID |
|---|---|
1. Bad clone 2. Drowzee with Fire Punch in second move slot 3. Drowzee with Fire Punch in second move slot 4. Unwanted pokémon 5. Unwanted pokémon 6. Unwanted pokémon |
1. Bad clone 2. Traded Machop with Fire Punch in second move slot 3. Traded Machop with Fire Punch in second move slot 4. Traded Machop 5. Traded Machop 6. Traded Machop |
(you can buy the TM for Fire Punch at the Goldenrod Dept. Store. To save on time and money, catch one Drowzee and teach it Fire Punch. Then clone it using cloning glitch)
Have the following pokémon in the box:
| Compatible trainer ID | Incompatible trainer ID |
|---|---|
- 1 unwanted pokémon - 1 normal pokémon |
- 1 Additional traded Machop - 1 normal pokémon |
Keep in mind that we'll be corrupting both the Drowzees and the unwanted pokémon. Make sure to only use pokémon you do not wish to keep. The normal pokémon will not be corrupted at all during this process.
Obtaining duplicate bicycles
- Deposit the bad clone in the daycare and retrieve it. It will now have turned into a glitch pokémon. Arrange your party as follows:
- Glitch pokémon
- Drowzee/traded Machop with Fire Punch in second move slot
- Drowzee/traded Machop with Fire Punch in second move slot
- Unwanted pokémon/traded Machop
- Unwanted pokémon/traded Machop
- Unwanted pokémon/traded Machop
- Using "move pokémon w/o mail", add the stored unwanted pokémon/additional traded Machop to the top of your party. This will push the glitch pokémon down to the second slot.
- Switch the glitch pokémon in the second slot with the pokémon in the fifth slot.
- Select "Deposit pokémon" from the PC and deposit the top two pokémon in your party.
- Withdraw the normal pokémon from your box and add it to the party using "Withdraw pokémon".
The party will now contain two Drowzee that will both be holding a bicycle each. Take these held items to add them to the bottom of the Key Item list. It is now safe to save.
Obtaining wrong pocket TM15
Have the following items in the ball pocket:
- Slot 1: Poké Ball x1
- Slot 2 and beyond: empty
- Go to the bottom of the key item list. The bottom of the list should consist of three separate bicycles.
- Press select on the second bicycle and swap it with the third bicycle. The number of bicycles will decrease, the "Cancel" button will change to a "?" item.
- Go to the ball pocket and toss 49 of the Master Ball item there. The final quantity should be a number ending in "6".
- Return to the Key Item pocket, press select on the upper bicycle and swap it with the bottommost item. This leaves you with a single bicycle, will turn the "?" item into a "Paralyz Heal" and change the first item of the Ball pocket into a TM15 x255.
Do not worry about the glitch pokémon that's still in your party or the key item list that lacks a cancel button, we'll fix both at a later point.
Setting up an ACE environment
Now that we have obtained TM15, we are able to execute box names as code. Korean box name codes unfortunately have limitations. Since all Korean text characters take up two bytes of memories, with the first byte being limited to $01 through $0B as values, it is often impractical to set up arbitrary effects.
To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.
To do that, we're going to use a box name code to obtain 255 copies of all TMs, then sell them in specific quantities to write out a program. Alongside that, the box name code will alter the code present within box name #11 that will allow us to execute the Mail Writer at any time whenever TM15 is used, on the condition that this box name is never altered.
The mail writer itself will be installed in the TM/HM pocket through the following two step process:
- Execute a box code using Coin Case ACE that sets the quantities of all 50 TMs to x255, as well as changing box #11's name to allow TM15 to be safely used.
- Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
Step 4: Setting all TM quantities to x255
- Rename box codes according to the image on the left. Box 9 and box 10 are not part of the setup and do not need to be overwritten. Then change box #11's name so that it matches the image on the right. Make sure to follow this exact order.
| Before | After |
|---|---|
|
|
Finally, go through the following process to execute ACE:
- Use TM15 once.
If the code was executed successfully, switch to the TM/HM pocket. It should now contain every TM at a quantity of x255.
A note on this box code
The above box code doesn't just set all TMs to x255, it also automatically alters the name of box 11 so that using TM15 will execute TM quantities from the TM/HM pocket instead. For this guide, we won't be needing to reset TM quantities to x255 after installing the mail writer.
If you do wish to reset all TM quantities, simply reset the name of box 11 in the following manner:
- Name box 11: (space) (space) (space) 꺽
- Overwrite box 11: (space) (space) 상
Step 5: Selling TMs to form a program in the TM/HM pocket
Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using. The following table displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
| Korean |
|---|
|
TM Quantities to sell
| TM | Final amount | Amount sold for |
|---|---|---|
| TM01 | 213 | 63000 |
| TM02 | 213 | 42000 |
| TM03 | 33 | 333000 |
| TM04 | 217 | 38000 |
| TM05 | 96 | 79500 |
| TM06 | 207 | 72000 |
| TM07 | 225 | 30000 |
| TM08 | 209 | 23000 |
| TM09 | 42 | 106500 |
| TM10 | 254 | 1500 |
| TM11 | 80 | 175000 |
| TM12 | 40 | 107500 |
| TM13 | 15 | 120000 |
| TM14 | 48 | 310500 |
| TM15 | 249 | 9000 |
| TM16 | 42 | 319500 |
| TM17 | 203 | 78000 |
| TM18 | 55 | 200000 |
| TM19 | 35 | 330000 |
| TM20 | 174 | 121500 |
| TM21 | 18 | 118500 |
| TM22 | 19 | 354000 |
| TM23 | 129 | 189000 |
| TM24 | 79 | 264000 |
| TM25 | 18 | 237000 |
| TM26 | 42 | 319500 |
| TM27 | 24 | 115500 |
| TM28 | 236 | 19000 |
| TM29 | 33 | 222000 |
| TM30 | 1 | 381000 |
| TM31 | 196 | 88500 |
| TM32 | 77 | 178000 |
| TM33 | 205 | 75000 |
| TM34 | 206 | 24500 |
| TM35 | 58 | 98500 |
| TM36 | 27 | 114000 |
| TM37 | 205 | 50000 |
| TM38 | 121 | 134000 |
| TM39 | 55 | 200000 |
| TM40 | 240 | 7500 |
| TM41 | 171 | 126000 |
| TM42 | 189 | 99000 |
| TM43 | 40 | 107500 |
| TM44 | 212 | 64500 |
| TM45 | 56 | 298500 |
| TM46 | 238 | 25500 |
| TM47 | 7 | 372000 |
| TM48 | 208 | 70500 |
| TM49 | 24 | 346500 |
| TM50 | 241 | 14000 |
- After selling TMs and verifying the amounts remaining are correct, make sure to save the game. Afterwards, use TM15 to start the mail writer.
Step 6: Using the mail writer
From now on, simply use TM15 to start up the RAM writer.
The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.
Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "ㅍㅊ" then confirm and exit the RAM writer.
Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
Controls
Between entering mail codes, the mail writer will ask for user input.
- Press SELECT to open a new mail and continue writing data.
- Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
- Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
 |
|
| Enter your mail code, then press "END". | It prints the checksum and waits for input. |
What to do with the Mail writer
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
- Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
- RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.
Addendum: Repairing box 11's name
In case something happens with box 11's name that causes it to no longer function, you can repair the name without having to reset TM quantities using the following procedure:
- Rename box codes according to the image on the left. Box 6 through box 10 are not part of the setup and do not need to be overwritten. Then change box #11's name so that it matches the image on the right. Make sure to follow this exact order.
| Before | After |
|---|---|
|
|
Finally, go through the following process to execute ACE:
- Use TM15 once.
- If the code executes succesfully, box 11's name has now been repaired.
Appendix
Plain text transcripts for codes
Setup box name code
- Rename box codes according to the following names (box 9 through 10 are not part of the setup and should be ignored):
Box 1: 뤠 쵭 묻 겉 근 둠 깝 근 Box 2: 둠 겜 근 둠 갠 근 둠 껭 Box 3: 묩 둠 같 근 둠 껍 근 둠 Box 4: 갑 근 둠 겊 껨 생 꺾 밞 Box 5: 긋 근 돠 괆 근 돠 겠 근 Box 6: 돠 갠 근 돠 겸 근 돠 굴 Box 7: 묩 돠 갓 근 돠 갤 근 돠 Box 8: 꼲 근 돠 껭 근 돠 샘 Box 9: 박 스 9 Box 10: 박 스 1 0 Box 11: [SPACE] [SPACE] [SPACE] 꺽 Box 12: [SPACE] 상 꺾
- Finally, overwrite box 11 to : (space) (space) 상
Reset box name code
- Rename box codes according to the following names (box 9 through 10 are not part of the setup and should be ignored):
Box 1: 뤠 꺾 묻 륜 긍 굽 돠 괆 Box 2: 묩 돠 겠 근 돠 갠 근 돠 Box 3: 겸 근 돠 굴 근 돠 갓 근 Box 4: 돠 갤 근 돠 꼲 근 돠 껭 Box 5: 묩 돠 샘 Box 6: 박 스 6 Box 7: 박 스 7 Box 8: 박 스 8 Box 9: 박 스 9 Box 10: 박 스 1 0 Box 11: [SPACE] [SPACE] [SPACE] 꺽 Box 12: [SPACE] 상 꺾
- Finally, overwrite box 11 to : (space) (space) 상
In-depth explanation of the setup
Effect of the setup box name code
Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.
The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255.
Separately, this code overwrites the latter half of party pokémon #5's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
Box 1: $D952 04 inc b 21 08 DA ld hl, DA08 ; Middle of box #11's name 04 inc b AF xor a ; a = $00 01 31 01 ld bc, $0131 A9 xor a, c ; a = $31 03 inc bc 32 ldd (hl), a 01 C5 01 ld bc, $01C5 A9 xor a, c ; a = $F4 50 inc d, b Box 2: $D963 03 inc bc 32 ldd (hl), a 01 37 01 ld bc, $0137 A9 xor a, c ; a = $C3 03 inc bc 32 ldd (hl), a 01 15 01 ld bc, $0115 A9 xor a, c ; a = $D6 03 inc bc 32 ldd (hl), a 01 E7 50 ld bc, $50E7 Box 3: $D974 04 inc b A9 xor a, c ; a = $31 03 inc bc 32 ldd (hl), a 01 10 01 ld bc, $0110 A9 xor a, c ; a = $21 03 inc bc 32 ldd (hl), a 01 DE 01 ld bc, $01DE A9 xor a, c ; a = $FF 03 inc bc 32 ldd (hl), a 50 inc d, b Box 4: $D985 01 09 01 ld bc, $0109 A9 xor a, c ; a = $F6 03 inc bc 32 ldd (hl), a 01 32 01 ld bc, $0132 E5 push hl 05 dec b CD 01 DA call .byteFill 04 inc b E1 pop hl ; continue writing to box #11's name 50 inc d, b Box 5: $D996 01 AF 01 ld bc, $01AF A9 xor a, c ; a = $50 03 inc bc 22 ldi (hl), a 01 6E 01 ld bc, $016E A9 xor a, c ; a = $3E 03 inc bc 22 ldi (hl), a 01 3A 01 ld bc, $013A A9 xor a, c ; a = $04 50 inc d, b Box 6: $D9A7 03 inc bc 22 ldi (hl), a 01 15 01 ld bc, $0115 A9 xor a, c ; a = $11 03 inc bc 22 ldi (hl), a 01 43 01 ld bc, $0143 A9 xor a, c ; a = $52 03 inc bc 22 ldi (hl), a 01 8C 50 ld bc, $508C Box 7: $D9B8 04 inc b A9 xor a, c ; a = $DE 03 inc bc 22 ldi (hl), a 01 0B 01 ld bc, $010B A9 xor a, c ; a = $D5 03 inc bc 22 ldi (hl), a 01 16 01 ld bc, $0116 A9 xor a, c ; a = $C3 03 inc bc 22 ldi (hl), a 50 inc d, b Box 8: $D9C9 01 F2 01 ld bc, $01F2 A9 xor a, c ; a = $31 03 inc bc 22 ldi (hl), a 01 E7 01 ld bc, $01E7 A9 xor a, c ; a = $D6 03 inc bc 22 ldi (hl), a 05 dec b C9 ret Box 11 before first execution: $D9FC 0B FF 0B FF 05 ; filler C3 50 D9 jp wBoxNames - 2; .entryPoint, renaming the box placed a $50 at $DA02 Box 11 during first execution: $D9FC 0B FF 0B FF 05 ; Filler F6 FF or $FF ; .byteFill, a = $FF 21 31 D6 ld hl, wTMsHMs C3 F4 31 jp byteFill ; Due to prior code, bc = $0032 Box 11 after first execution: $D9FC 0B FF 0B FF ; Filler 50 ld d, b ; Terminator $50 makes the rest of the box code invisible to the player 3E 04 ld a, $04 ; .entryPoint, a = $04 11 52 DE ld de, $DE52 ; Code written by the Mail Writer starts from here D5 push de ; When closing the Mail Writer, return to $DE52 to execute the newly written code C3 31 D6 jp wTmsHMs ; Execute mail writer Box 12: $DA0D 0B FF ; Filler 05 dec b ; Entrypoint of TM15, two preceding bytes are filler C3 01 DA
Effect of the TM code
Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a, a value of $DE52 in registers de and the value $DE52 pushed on the stack in order to properly work.
D5 push de ; .nextMail D5 push de 21 D9 60 ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 ; If terminator, break loop. if newline, skip and get new character. 28 0F jr z, .terminator 30 F9 jr nc, .continue 2A ldi a, (hl) ; Since Korean text takes up two bytes per character, get the second byte CB 37 swap a ; swap high and low nibbles of a 23 inc hl ; Skip first byte of second character AE xor a, (hl) 12 ld (de), a 13 inc de 81 add a, c ; Update checksum and store the result in c 4F ld c, a 12 ld (de), a 2A ldi a, (hl) 18 EC jr .continue 21 01 C4 ld hl, $C401 ; .screenLoop 4D ld c, l CD CE 3A call PrintBCDNumber.loop - 1 ; inc hl by 3, inc de, display byte at address de 1B dec de ; .goBack, compenstate inc de of PrintBCDNumber.loop CD 79 37 call JoyTextDelay_ForcehJoyDown ; Wait until end of frame, then store button state in hJoyLast F0 AB ld a, (hJoyLast) BD cp a, l ; l = $04 28 D4 jr z, .nextMail 38 EE jr c, .displayLoop 07 rlca D0 ret nc 18 F1 jr .goBack
Effect of the reset box name code
Converting the characters from box names to assembly results in the following code. This code overwrites box #11's name, allowing it to function as a TM15 bootstrap that redirects execution to the Mail Writer.
Box 1: $D952 04 inc b 21 01 DA ld hl, $DA01 04 inc b AF xor a ; a = $00 04 inc b 2B dec hl 01 B0 01 ld bc, $01B0 91 sub a, c ; a = $50 03 inc bc 22 ldi (hl), a 01 6E 50 ld bc, $506E Box 2: 04 inc b A9 xor a, c ; a = $3E 03 inc bc 22 ldi (hl), a 01 3A 01 ld bc, $013A A9 xor a, c ; a = $04 03 inc bc 22 ldi (hl), a 01 15 01 ld bc, $0115 A9 xor a, c ; a = $11 03 inc bc 22 ldi (hl), a 50 ld d, b Box 3: 01 43 01 A9 xor a, c ; a = $52 03 inc bc 22 ldi (hl), a 01 8C 01 ld bc, $018C A9 xor a, c ; a = $DE 03 inc bc 22 ldi (hl), a 01 0B 01 ld bc, $010B A9 xor a, c ; a = $D5 50 ld d, b Box 4: 03 inc bc 22 ldi (hl), a 01 16 01 ld bc, $0116 A9 xor a, c ; a = $C3 03 inc bc 22 ldi (hl), a 01 F2 01 ld bc, $01F2 A9 xor a, c ; a = $31 03 inc bc 22 ldi (hl), a 01 E7 50 ld bc, $50E7 Box 5: 04 inc b A9 xor a, c ; a = $D6 03 inc bc 22 ldi (hl), a 05 dec b C9 ret Box 11 before first execution: $D9FC 0B FF 0B FF 05 ; filler C3 50 D9 jp wBoxNames - 2; .entryPoint, renaming the box placed a $50 at $DA02 Box 11 after first execution: $D9FC 0B FF 0B FF ; Filler 50 ld d, b ; Terminator $50 makes the rest of the box code invisible to the player 3E 04 ld a, $04 ; .entryPoint, a = $04 11 52 DE ld de, $DE52 ; Code written by the Mail Writer starts from here D5 push de ; When closing the Mail Writer, return to $DE52 to execute the newly written code C3 31 D6 jp wTmsHMs ; Execute mail writer Box 12: $DA0D 0B FF ; Filler 05 dec b ; Entrypoint of TM15, two preceding bytes are filler C3 01 DA