Guides:Fast 0x1500 ACE (FR and DE)
|
This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see 0x1500 control code arbitrary code execution. |
This page serves as a repository on a 0x1500 ACE setup for the French and German versions of Pokémon Crystal. It is part of the TimoVM's Gen 2 ACE setups set of guides.
The preparation is best done during morning or midday in-game. If needed, you can change the in-game clock with the help of this tool.
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.
When playing on cartridge or emulator, it is required to have previously cleared an old save by pressing SELECT + UP + B simultaneously on the start screen at least once since obtaining the cart. Otherwise you will not be able to obtain a bad clone or an unterminated name pokémon.
Setting up initial ACE
Pokémon Crystal contains two important differences compared to its predecessors. Firstly, Crystal won't abort the text printing function when it encounters a $00 value, instead printing a '?' instead. Secondly, Crystal added new printing funtions related to the Mobile Game Boy Adapter, a Japanese exclusive peripheral that allowed internet connectivity through a mobile phone.
By obtaining a pokémon whose name does not contain the usual text terminator, we can force the game into printing much larger amounts of texts than would otherwise be possible. By abusing an illegal Mobile Adapter function and setting up memory in a specific way, we can escape the text printing function and trigger arbitrary code execution based on the data of the last viewed party pokémon.
In practice, the initial ACE setup will be created using the following general process:
- Obtain a Spearow
- Obtain an unterminated name pokémon.
- Set up the currently buffered memory in such a way that we can trigger 0x1500 ACE upon seeing the name of the unterminated name pokémon.
This guide can be performed right after obtaining poké balls for the first time, but can be performed regardless of game progression.
Regarding PKHex
At the moment, this guide is incompatible with saves exported from PKHex. Upon exporting a save, PKHex will fill all currently unused data for the OT name and nickname of all boxes with text terminators, making it impossible to obtain an unterminated name pokémon.
Step 1: Obtaining a Spearow
- Obtain a Spearow through one of the following methods:
- Catch a Spearow in the wild. It is recommended to catch a Spearow in the south part of route 46, which is accessible from the beginning of the game. (30% encounter odds, only during morning or midday)
- Talk to the gate guard between Goldenrod City and route 35 to obtain a Spearow.
- Head to the nearest pokémon center and continue with the next step.
Step 2: Preparing the bad clone and remaining items
- Use the bad clone glitch to obtain a pokémon with an unterminated name.
- For this, use a box that has never been full at any point in time. It’s recommended to start with an empty box.
- Deposit a single pokémon. Attempt to save the game using "Move Pokémon w/o mail" but reset the game a bit just after the game has fully printed "SAVING... DON'T TURN OFF THE POWER".
- After rebooting the game, use a potion up to where the game brings up the party screen. the potion doesn't have to actually be used, you can cancel from here), then check the newly deposited pokémon.
- If the newly deposited pokémon’s nickname was changed to a bunch of question marks, you can continue with the next step. If the pokémon wasn't saved, that means the reset too early. If the pokémon was cloned, this means the reset was too late.
- If the amount of pokémon in the box exceeds 15, release the cloned pokémon and save the game afterwards to set the amount of stored pokémon to 15 before repeating step 2.
- Now that you have an unterminated name pokémon, put it in box 14. Either release or move all other pokémon in the box so that the unterminated name pokémon is the only pokémon left in box 14.
- You now have everything needed for the setup, you can continue with the next step.
Step 3: Testing the setup and using ACE
Now that we have everything ready, we'll be verifying the setup by testing a code that will safely exit ACE without any additional side effects. Once we have verified the setup, we can replace the test box code with another box code to apply various effects.
In order to be able to test the setup, rename box 14 to the following names:
| French | German |
|---|---|
|
|
Using the ACE setup
Before executing ACE, arrange your party as follow:
- Slot 1 - Spearow
- Slots 2-6 aren't relevant for this setup.
Next, make sure you set up the following:
- Make box 14 the current active box, ensure that the bad clone is the only pokémon in box 14.
- Make sure that the box name code you wish to execute was correctly entered.
Finally, in order to execute ACE, do the following actions:
|
|
- Stand in front of the PC on the second floor of any pokémon center. Take one step down, take one step left until you end up at the location indicated by the above screenshot on the left. Save the game here and reset.
- After reloading the save, take one step to the right and take one step up. You should now be standing right in front of the PC. (these steps need to be taken in the correct order, otherwise the setup will not work)
- Open the start menu, select Spearow so that you get the option to look at its summary and switch its party position as indicated by the above screenshot on the right, then exit and close the start menu.
- Open the PC. Open the withdraw screen so that the unterminated name pokémon's name would be displayed. Displaying this name will trigger ACE. If the screen stays white, press "A" a couple of times until the box view reappears.
If the game doesn't crash, the setup was a success and you can continue to the next step.
Step 3.5: Obtaining a Flower Mail
Compared to other languages, the characterset of French/German boxes is unfortunately limited, resulting in difficulties when it comes to writing data.
In contrast, the characterset that is available in mails is more expansive, allowing us to fully use box data. For this reason, it is required to obtain any kind of mail. There are two possible approaches:
- If you've already reached Violet City or beyond, you can simply buy a Flower Mail or any other mail from the mail. After you have done so, you can simply skip this step and go to step 4.
- If you haven't reached Violet City yet, you can use ACE to give a Flower Mail to the second party pokémon.
Obtaining a Flower Mail through ACE
- Rename box names to the following names. Box names 1, 2 and 5 through 13 are not part of the setup and do not need to be renamed:
| French | German |
|---|---|
|
|
- Next, Make sure you have any pokémon in the second party pokémon slot. Please note that its held item will be overwritten by the setup.
- Then, execute 0x1500 control code ACE using the method described in section 1.4.1. If everything went well, the second party pokémon should now be holding a Flower Mail.
- Finally, take the Flower Mail from the second party pokémon and make sure to not send the Flower Mail to the PC. This will add the Flower Mail to the pack instead, allowing you to reuse it later.
Setting up an ACE environment
While we now have a way to execute box name codes using ACE, the current setup has a few drawbacks:
- Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.
- Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.
To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.
To do that, we're going to use a box name code to obtain 255 copies of all TMs, then sell them in specific quantities to write out a program. Alongside that, the box name code will also add a TM15 to the main item pocket. Using this TM15, outside of the TM/HM pocket, will allow us to execute the Mail Writer at any time without requiring additional setup.
The mail writer itself will be installed in the TM/HM pocket through the following two step process:
- Execute a box code using 0x1500 control code ACE that sets the quantities of all 50 TMs to x255, as well as placing a TM15 in the main item pocket and installing a setup so that using this TM15 will redirect execution to the start of the TM/HM pocket.
- Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
Step 4: Setting all TM quantities to x255
- Rename box names to form the following language dependent codes. Please mind the differences between uppercase X (
), lowercase x (
) and multiplication symbol (
).
| French | German |
|---|---|
|
|
- Next, give Spearow a mail to hold with the following content. Please mind the differences between uppercase X (), lowercase x () and multiplication symbol ().
| French | German |
|---|---|
|
|
Using the ACE setup with a mail
Before executing ACE, arrange your party as follow:
- Slot 1 - Spearow, holding mail
- Slots 2-6 aren't relevant for this setup.
Next, make sure you set up the following:
- Make box 14 the current active box, ensure that the bad clone is the only pokémon in box 14.
- Make sure that the box name code you wish to execute was correctly entered.
- Make sure that the mail you wish to execute was correctly entered.
Finally, in order to execute ACE, do the following actions:
|
|
- Stand in front of the PC on the second floor of any pokémon center. Take one step down, take one step left until you end up at the location indicated by the above screenshot on the left. Save the game here and reset.
- After reloading the save, take one step to the right and take one step up. You should now be standing right in front of the PC. (these steps need to be taken in the correct order, otherwise the setup will not work)
- Open the start menu, read Spearow's mail, then exit the menu.
- Open the PC. Open the withdraw screen so that the unterminated name pokémon's name would be displayed. Displaying this name will trigger ACE. If the screen stays white, press "A" a couple of times until the box view reappears.
- If the code was successfully executed, the TM/HM pocket should now be completely filled with 255 copies of every TM. Additionally, the first item in the main item pocket will have changed into a TM15. Using it will execute code in the TM/HM pocket. Make sure to save after verifying that the code worked.
Step 5: Selling TMs to form a program in the TM/HM pocket
Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using. The following table displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
Once you're done selling all TMs, simply use TM15 to activate the mail writer.
| French | German |
|---|---|
|
|
Language independent TMs
| TM | Final Quantity | Sell value |
|---|---|---|
| TM01 DYNAMICPUNCH | x17 | 357000 |
| TM02 HEADBUTT | x128 | 127000 |
| TM03 CURSE | x210 | 67500 |
| TM04 ROLLOUT | x213 | 42000 |
| TM05 ROAR | x213 | 21000 |
| TM06 TOXIC | x213 | 63000 |
| TM07 ZAP CANNON | x33 | 222000 |
| TM08 ROCK SMASH | SEE NEXT TABLE | |
| TM09 PSYCH UP | x94 | 80500 |
| TM10 HIDDEN POWER | x207 | 72000 |
| TM11 SUNNY DAY | x225 | 30000 |
| TM12 SWEET SCENT | x209 | 23000 |
| TM13 SNORE | x42 | 106500 |
| TM14 BLIZZARD | x254 | 1500 |
| TM15 HYPER BEAM | x80 | 262500 |
| TM16 ICY WIND | x56 | 298500 |
| TM17 PROTECT | x251 | 6000 |
| TM18 RAIN DANCE | x40 | 215000 |
| TM19 GIGA DRAIN | x10 | 367500 |
| TM20 ENDURE | x135 | 180000 |
| TM21 FRUSTRATION | x134 | 60500 |
| TM22 SOLARBEAM | x18 | 355500 |
| TM23 IRON TAIL | x19 | 354000 |
| TM24 DRAGONBREATH | x35 | 330000 |
| TM25 THUNDER | x129 | 126000 |
| TM26 EARTHQUAKE | x79 | 264000 |
| TM27 RETURN | x18 | 118500 |
| TM28 DIG | x24 | 231000 |
| TM29 PSYCHIC | x239 | 16000 |
| TM30 SHADOW BALL | x33 | 333000 |
| TM31 MUD-SLAP | x1 | 381000 |
| TM32 DOUBLE TEAM | x197 | 58000 |
| TM33 ICE PUNCH | x77 | 267000 |
| TM34 SWAGGER | x205 | 25000 |
| TM35 SLEEP TALK | SEE NEXT TABLE | |
| TM36 SLUDGE BOMB | x56 | 99500 |
| TM37 SANDSTORM | x27 | 228000 |
| TM38 FIRE BLAST | x205 | 50000 |
| TM39 SWIFT | SEE NEXT TABLE | |
| TM40 DEFENSE CURL | x53 | 101000 |
| TM41 THUNDERPUNCH | x189 | 99000 |
| TM42 DREAM EATER | x40 | 322500 |
| TM43 DETECT | x217 | 19000 |
| TM44 REST | x56 | 298500 |
| TM45 ATTRACT | x240 | 22500 |
| TM46 THIEF | x254 | 1500 |
| TM47 STEEL WING | x08 | 370500 |
| TM48 FIRE PUNCH | x200 | 82500 |
| TM49 FURY CUTTER | x24 | 346500 |
| TM50 NIGHTMARE | x242 | 13000 |
Language dependent TMs
| TM | French | German | ||
|---|---|---|---|---|
| Final amount | Amount sold for | Final amount | Amount sold for | |
| TM08 ROCK SMASH | x122 | 66500 | x99 | 78000 |
| TM35 SLEEP TALK | x175 | 40000 | x182 | 36500 |
| TM39 SWIFT | x56 | 199000 | x53 | 202000 |
Once this has been done, continue to the next step.
Step 6: Using the mail writer
From now on, simply use the TM15 in the main item pocket to start up the Mail riter.
The Mail Writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.
Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh" then confirm and exit the RAM writer.
Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
Controls
Between entering mail codes, the mail writer will ask for user input.
- Press SELECT to open a new mail and continue writing data.
- Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
- Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
 |
|
| Enter your mail code, then press "END". | It prints the checksum and waits for input. |
What to do with the Mail writer
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
- Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
- RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.
Addendum: repairing the TM15 bootstrap
In case something happens with the TM15 bootstrap that causes it to no longer function, you can repair bootstrap without having to reset TM quantities using the following procedure:
- Enter the following language-specific box names. Please mind the differences between uppercase X (), lowercase x () and multiplication symbol (). For French, boxes 9 through 13 are irrelevant for the setup and do not need to be renamed. For German, boxes 8 through 13 are irrelevant for the setup and do not need to be renamed.
| French | German |
|---|---|
|
|
- Then, execute 0x1500 control code ACE using the method described in section 2.2.1
- If the code executes succesfully without crashing the game, the bootstrap has now been repaired.
Appendix
Plain text transcripts of codes
Test box name
| Language | Box name content | Language | Box name content |
|---|---|---|---|
| French | Box 14: Pk Pk ô |
German | Box 14: Pk Pk 0 9 Ä |
Note: "..." refers to one ellipsis character, “pk” refers to the one pk character, "$" refers to the pokédollar sign, "*" refers to the multiplication symbol. Make sure to pay careful attention to upper/lowercase letters.
Setup box name
| Language | Box name content | Language | Box name content |
|---|---|---|---|
| French | Box 1: A e 5 î u 5 5 5 Box 2: î r 5 î u 5 î r Box 3: î w 5 m ç î u 5 Box 4: p î x 5 î r 5 5 Box 5: î u 5 î u 5 0 9 Box 6: ç ç j û â ] 3 â Box 7: î [ 8 û à 5 G G Box 8: W o o ç ç ô ? Mn Box 9: E ♀ Pk V H m V ç Box 10: î x 5 ? E ç ç ç Box 11: î x 5 p 0 Mn e ç Box 12: î x 5 4 g 5 5 5 Box 13: î x 5 4 h 5 û x Box 14: Pk ç û 9 ♂ |
German | Box 1: A q 5 W ö j 5 G Box 2: ö j 5 H W ö j 5 Box 3: p 0 2 ö j 5 W W Box 4: ö j 5 G G ö j 5 Box 5: G ö j 5 o ö j 5 Box 6: W ö j 5 G ♀ p p Box 7: Ä ♀ Ö 0 9 b Ü & Box 8: ♀ S S ♂ 5 s * E Box 9: ♀ Pk V H m V 5 5 Box 10: ö j 5 ? E ö j 5 Box 11: p 0 ä ö j 5 5 5 Box 12: 4 s 5 ö j 5 p 5 Box 13: 0 2 ä j 5 Box 14: Pk ä 9 ♂ |
Note: "..." refers to one ellipsis character, “pk” refers to the one pk character, "$" refers to the pokédollar sign, "*" refers to the multiplication symbol. Make sure to pay careful attention to upper/lowercase letters.
Reset box name
| Language | Box name content | Language | Box name content |
|---|---|---|---|
| French | Box 1: A Mn 2 p E F ♀ Pk Box 2: V H m V ç ç î x 5 Box 3: ? E ç î x 5 p p Box 4: 0 Mn e ç î x 5 p Box 5: 0 [SPACE] V V ç î x 5 Box 6: p 0 2 ç û x 5 5 Box 7: 5 5 5 5 5 5 5 5 Box 8: ç ç ç ç ç ô Box 14: Pk ç û 9 ♂ |
German | Box 1: A Mn 2 E F ♀ Pk Box 2: V H m V ö j 5 5 Box 3: ? E ö j 5 p 0 ä Box 4: ö j 5 p 0 [SPACE] V V Box 5: ö j 5 p 0 2 5 5 Box 6: ä j 5 5 5 5 5 5 Box 7: Ä Box 14: Pk ä 9 ♂ |
Note: "..." refers to one ellipsis character, “pk” refers to the one pk character, "$" refers to the pokédollar sign, "*" refers to the multiplication symbol. Make sure to pay careful attention to upper/lowercase letters.
In-depth explanation of the setup
Explanation on the 0x1500 ACE setup
This setup uses 0x1500 control code ACE. Since the page already contains an explanation on how it works, this page will focus on what the setup does to achieve its effect.
Relevant addresses for this explanation:
| Address | Function |
|---|---|
| $C4A0 | Starting address of wTilemap |
| $C4BE | Address of the tilemap where the name of the current active box will be printed when viewing the withdraw screen. |
| $CD70 | Starting address of wBGMapBufferPointers |
| $D073 | Address where the names of pokémon are buffered. |
| $D086 | Address where the names of used items are buffered. |
| $D108 | Address where the current selected party pokémon’s species is buffered. |
| $D109 | Address where the current selected party pokémon’s party slot is buffered. |
- The specific movement pattern used will buffer C2 9B C4 (jp nz $C49B) at $CD70.
- Selecting Spearow in the party screen will buffer 15 00 at $D108.
- Viewing the unterminated name pokémon in the withdraw screen will cause the game to attempt to print its name. Since the name doesn't contain a terminator, the game will continue printing text until it find and executes the $15 control character at $D108.
- The presence of the $00 at $D109 will erroneously cause the game to call $CD52. Due to the specific movement pattern and location used, the area between $CD52 and $CD70 is filled with $00 values, allowing safe passage.
- Thanks to the jump buffered at $CD70, the game will jump to $C49B. Since we're in the withdraw screen, the area between $C49B and $C4A0 is filled with $00 values, allowing safe passage. The jump will always pass, since both the carry and zero flags are reset when the game calls $CD52.
- Between $C4A0 and $C4BE are a bunch of screen tiles that are either blank ($7F) or edges of text boxes ($79, $7A, $7B and $7C). These opcodes are all harmless and simply load register values to other registers, allowing safe passage.
- $C4BE holds the text characters of the current active box, allowing us to form arbitrary jumps to other locations in memory.
Effect of the test box name
The current active box is printed on the tilemap starting from $C4BE onward. Converting the provided box name code to assembly results in the following:
French
E1 pop hl E1 pop hl ; Popping hl twice then returning will cause the game to continue printing from de to hl. The second pop ensures hl will point to the $7000 region, allowing safe exit. C9 ret ; Safely return to normal game operation
German
E1 pop hl E1 pop hl ; Popping hl twice then returning will cause the game to continue printing from de to hl. The second pop ensures hl will point to the $7000 region, allowing safe exit. F6 FF or $FF ; Set a to $FF, reset zero flag C0 ret ; Safely return to normal game operation
Effect of the mail box name
Box name data starts from $DB75 onward. Converting the provided box name code to assembly results in the following:
French
Box 3: $DB87 F6 FB or $FB ; a = $00 F5 push af E1 pop hl E6 90 and $90 ; a = $90 F7 rst30h ; hl = $FB90, de = $FB8E, jump to hl (box name #4's address) 9E 50 TEXT ; After return, $9E will be printed to $DD10, the second party pokémon's held item Box 4: $DB90 AF xor a ; a = $00 F6 E2 or $E2 ; a = $E2 84 add a, h ; a = $DD, set carry flag F5 push af E1 pop hl ; hl = $DD10 C9 ret Box 14: displayed as screen tiles at $C4BE E1 pop hl E1 pop hl ; After next return, print function will resume AF xor a ; a = $00 CA 87 FB jp z, $FB87 ; Box name #3's address
German
Box 3: $DB87 F6 FB or $FB ; a = $00 F5 push af E1 pop hl E6 90 and $90 ; a = $90 F7 rst30h ; hl = $FB90, de = $FB8E, jump to hl (box name #4's address) 9E 50 TEXT ; After return, $9E will be printed to $DD10, the second party pokémon's held item Box 4: $DB90 AF xor a ; a = $00 F6 E2 or $E2 ; a = $E2 84 add a, h ; a = $DD, set carry flag F5 push af E1 pop hl ; hl = $DD10 C0 ret nz Box 14: displayed as screen tiles at $C4BE E1 pop hl E1 pop hl ; After next return, print function will resume AF xor a ; a = $00 C3 87 FB jp $FB87 ; Box name #3's address
Effect of the mail
The last read mail is buffered from $D002 onward. Please note that viewing the bad clone in box #14 will write the value $01 to $D003 and $D004. Converting the characters from the mail to assembly results in the following, ordered by language:
French
FA 01 01 ld a, ($0101) ; a = $C3 D6 F5 sub $F5 ; a = $CE, TM15's item ID EA 93 F8 ld (wItems), a ; Main item pocket, first item ID D6 F3 sub $F3 ; a = $DB EA 86 FB ld ($FB86), a EA E9 FB ld ($FBE9), a 4E ld a, a D6 BA sub $BA ; a = $21 EA 75 FB ld (wBoxNames), a D6 FF sub $FF ; a = $22 EA B7 FB ld ($FBB7), a AF xor a ; a = $00, set zero flag CC 75 DB call z, wBoxNames E1 pop hl ; After returning from 0x1500 ACE, this prevents the print function from printing text in WRAM. D0 ret nc
German
FA 01 01 ld a, ($0101) ; a = $C3 87 add a, a ; a = $86 C6 9C add $9C ; a = $22 EA A9 FB ld ($FBA9), a C6 FF add $FF ; a = $21 EA 75 FB ld (wBoxNames), a AF xor a ; a = $00 F6 4E or $4E ; a = $4E F6 80 or $80 ; a : $CE EA 93 F8 ld (wItems), a ; Main item pocket, first item ID F0 F0 ld a, ($FFF0) ; a = 0, zero flag is NOT reset C4 75 FB call z, wBoxNames E1 pop hl ; After returning from 0x1500 ACE, this prevents the print function from printing text in WRAM. C0 ret nz
Effect of the setup box name code
Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.
The code overwrites part of itself to call the byteFill function. This will fill the area between $D859 and $D88A with $FF values, setting all 50 TM quantities to 255. Separately, this code writes five bytes from $DA10 onward, the effect pointer of TM15, installing a TM15 bootstrap that redirects execution to the Mail Writer. Lastly, when combined with the mail code, it will convert the first item in the main item pocket to a TM15.
French
Box 1: $DB75 21 A4 FB ld hl, $FBA4 CC B4 FB call z, .subhl FB ei FB ei 50 ld d, b Box 2: $DB7E CC B1 FB call z, .addhl CC B4 FB call z, .subhl CC B1 DB call z, .addhl Box 3: $DB87 CC B6 FB call z, .xorhl AC xor a, h ; a = $32 BF cp a ; Set zero flag CC B4 FB call z, .subhl 50 sub d, b Box 4: $DB90 AF xor a ; a = $00 CC B7 FB call z, .xorhl CC B1 FB call z, .addhl FB ei 50 ld d, b Box 5: $DB99 CC B4 FB call z, .subhl CC B4 FB call z, .subhl F6 FF or $FF ; a = $FF 50 Box 6: $DBA2 BF cp a ; Set zero flag BF cp a 57 ld d, a ; Hides newly written box name from player, preventing crash due to $59 appearing 21 59 F8 ld hl, $F859 01 32 00 ld bc, $0032 Box 7: $DBAB CC 2E 30 call z, byteFill CA BA FB jp z, .skip 86 add (hl) ; .addhl 86 add (hl) 50 Box 8: $DBB4 96 sub (hl) ; .subhl AE xor (hl) AE xor (hl) ; .xorhl 22 ldi (hl), a ; .hl BF cp a ; Set zero flag C9 ret E6 E2 and $E2 ; a = $E2, .skip 50 ld d, b Box 9: $DBBD 84 add a, h ; a = $DB, f = $10 F5 push af E1 pop hl ; hl = $DA10 95 sub a, l ; a = $CB 87 add a, a ; a = $96 AC xor a, h ; a = $4E 95 sub a, l ; a = $3E BF cp a ; Set zero flag 50 ld d, b Box 10: $DBC6 CC B7 FB call z, .hl E6 84 and $84 ; a = $04 BF cp a ; Set zero flag BF cp a BF cp a 50 ld d, b Box 11: $DBCF CC B7 FB call z, .hl AF xor a ; a = $00 F6 E2 or $E2 ; a = $E2 A4 and a, h ; a = $C2 BF cp a ; Set zero flag 50 ld d, b Box 12: $DBD8 CC B7 FB call z, .hl FA A6 FB ld ($FBA6), a ; a = $59, zero flag still set FB ei FB ei 50 ld d, b Box 13: $DBE1 CC B7 FB call z, .hl FA A7 FB ld ($FBA7), a ; a = $F8, zero flag still set CA B7 DB jp z, .hl Box 14: displayed as screen tiles at $C4BE E1 pop hl BF cp a ; Set zero flag CA FF EF jp z, $EFFF ; 3 bytes before last read mail Bootstrap: $DA10 3E 04 ld a, $04 C3 59 F8 jp wTMsHMs
German
Box 1: $DB75 21 B0 FB ld hl, $FBB0 96 sub a, (hl) ; a = $5F C4 A9 FB call nz, .write 86 add a, (hl) ; a = $21 50 ld d, b Box 2: $DB7E C4 A9 FB call nz, .write 87 add a, a ; a = $42 96 sub a, (hl) ; a = $59 C4 A9 FB call nz, .write 50 ld d, b Box 3: $DB87 AF xor a ; a = $00, zero flag set F6 F8 or $F8 ; a = $F8, reset zero flag C4 A9 FB call nz, .write 96 sub a, (hl) ; a = $03 96 sub a, (hl) ; a = $0E 50 ld d, b Box 4: $DB90 C4 A9 FB call nz, .write 86 add a, (hl) ; a = $A0 86 add a, (hl) ; a = $32 C4 A9 FB call nz, .write 50 ld d, b Box 5: $DB99 86 add a, (hl) ; a = $C4 C4 A9 FB call nz, .write AE xor a, (hl) ; a = $2B C4 A9 FB call nz, .write 50 ld d, b Box 6: $DBA2 96 sub a, (hl) ; a = $30 C4 A9 FB call nz, .write 86 add a, (hl) ; a = $E2 F5 push hl AF xor a ; a = $00, set zero flag 22 ldi (hl), a ; .write 50 ld d, b Box 7: $DBAB C0 ret nz F5 push af C1 pop bc ; bc = $0080 F6 FF or $FF ; a = $FF, reset zero flag 5F ld e, a 21 59 F8 ld hl, wTMsHMs Box 8: $DBB4 0E 32 ld c, $32 ; bc = $0032 C4 2B 30 call nz, byteFill 00 nop F1 pop af ; a = $E2 84 add a, h ; af = $DA10 50 ld d, b Box 9: $DBBD F5 push af E1 pop hl 95 sub a, l ; a = $CA 87 add a ; a = $94 AC xor a, h ; a = $4E 95 sub a, l ; a = $3E, reset zero flag FB ei FB ei 50 ld d, b Box 10: $DBC6 C4 A9 FB call nz, .write E6 84 and $84 ; $04 C4 A9 FB call nz, .write 50 ld d, b Box 11: $DBCF AF xor a ; a = $00 F6 C3 or $C3 ; a = $C3 C4 A9 FB call nz, .write FB ei FB ei 50 ld d, b Box 12: $DBD8 FA B2 FB ld a, ($FBB2) ; a = $59 C4 A9 FB call nz, .write AF xor a ; a = $00 FB ei 50 ld d, b Box 13: $DBE1 F6 F8 or $F8 C3 A9 FB jp .write Box 14: displayed as screen tiles at $C4BE E1 pop hl C3 FF EF jp $EFFF ; 3 bytes before last read mail Bootstrap: $DA10 3E 04 ld a, $04 C3 59 F8 jp wTMsHMs
Effect of the TM code
Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.
French
11 80 D2 ld de, $D280 D5 push de D5 push de ; .nextMail D5 push de 21 7A 5E ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C5 ld hl, $C501 ; .screenLoop 4D ld c, l CD AF 38 call PrintBCDNumber.loop 1B dec de ; .goBack CD 38 35 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
German
11 80 D2 ld de, $D280 D5 push de D5 push de ; .nextMail D5 push de 21 63 5E ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C5 ld hl, $C501 ; .screenLoop 4D ld c, l CD B6 38 call PrintBCDNumber.loop - 1 1B dec de ; .goBack CD 35 35 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
Effect of the reset box name code
Converting the characters from box names to assembly results in the following code. This code writes the required bootstrap to $DA10, the entrance point of Wrong Pocket TM15. This area of memory is unused but is preserved during saves.
French
Box 1: $DB75 21 E2 F8 ld hl, $F8E2 AF xor a ; a = $00 84 add a, h ; a = $F8 85 add a, l ; af = $DA10 F5 push af E1 pop hl ; hl = $DA10 50 ld d, b Box 2: $DB7E 95 sub a, l ; a = $CA 87 add a ; a = $94 AC xor a, h ; a = $4E 95 sub a, l ; a = $3E BF cp a ; Set zero flag BF cp a CC B7 DB call z, .write Box 3: $DB87 E6 84 and $84 ; a = $04 BF cp a ; Set zero flag CC B7 FB call z, .write AF xor a ; a = $00 AF xor a 50 ld d, b Box 4: $DB90 F6 E2 or $E2 ; a = $E2 A4 and a, h ; a = $C2 BF cp a ; Set zero flag CC B7 FB call z, .write AF xor a ; a = $00 50 ld d, b Box 5: $DB99 F6 7F or $7F ; a = $7F 95 sub a, l ; a = $6C 95 sub a, l ; a = $59 BF cp a ; Set zero flag CC B7 FB call z, .write 50 ld d, b Box 6: $DBA2 AF xor a ; a = $00 F6 F8 or $F8 ; a = $F8 BF cp a ; Set zero flag CA B7 FB jp z, .write FB ei 50 ld d, b Box 7: $DBAB FB ei FB ei FB ei FB ei FB ei FB ei FB ei FB ei 50 ld d, b Box 8: $DBB4 BF cp a BF cp a BF cp a 22 ldi (hl), a BF cp a ; Set zero flag C9 ret Box 14: displayed as screen tiles at $C4BE E1 pop hl BF cp a ; Set zero flag CA FF EF jp z, $EFFF ; 3 bytes before last read mail Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C2 59 F8 jp nz, wTMsHMs
German
Box 1: $DB75 21 E2 F8 ld hl, $F8E2 AF xor a ; a = $00 84 add a, h ; a = $F8 85 add a, l ; af = $DA10 F5 push af E1 pop hl ; hl = $DA10 50 ld d, b Box 2: $DB7E 95 sub a, l ; a = $CA 87 add a ; a = $94 AC xor a, h ; a = $4E 95 sub a, l ; a = $3E C4 A9 FB call z, .write FB ei 50 ld d, b Box 3: $DB87 E6 84 and $84 ; a = $04 C4 A9 FB call z, .write AF xor a ; a = $00 F6 C3 or $C3 ; a = $C3 50 ld d, b Box 4: $DB90 C4 A9 FB call z, .write AF xor a ; a = $00 F6 7F or $7F 95 sub a, l ; a = $6C 95 sub a, l ; a = $59 50 ld d, b Box 5: $DB99 C4 A9 FB call z, .write AF xor a ; a = $00 F6 F8 or $F8 ; a = $F8 FB ei FB ei 50 ld d, b Box 6: $DBA2 C3 A9 FB jp .write FB ei FB ei FB ei FB ei 22 ldi (hl), a 50 ld d, b Box 7: $DBAB C0 ret nz Box 14: displayed as screen tiles at $C4BE E1 pop hl C3 FF EF jp $EFFF ; 3 bytes before last read mail Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C3 59 F8 jp wTMsHMs