	This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Glitch Pokédex Mode ACE.

This page serves as a repository for a Glitch Pokédex Mode ACE setup for the Japanese versions of Pokémon Gold & Silver. It is part of the TimoVM's Gen 2 ACE setups set of guides.

Please make sure to fully read every step of the guide before executing them.

If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.

Setting up initial ACE

In the generation 2 games, the pokédex has three different modes that change the order of displayed pokémon within the pokédex. When selecting a certain mode, the game stores the value of the last selected mode in RAM, so that it will keep using this mode when you next use the pokédex. This valueis then used as part of a jump table, which returns the addresses of the functions used to determine the pokédex order.

By setting this value to an invalid pokédex mode value, the game will index this jumptable out of bounds. Some of these invalid values result in addresses that point to wram, resulting in arbitrary code execution. Since this value is in reach of the extended ball pocket, we can abuse an item swap to set such an invalid value.

By using the special properties of a $00 species pokémon, we are able to obtain duplicate key items which can then allow us to set up the extended ball pocket. One of the major components of previous ACE setups was the requirement of having to use the day care in order to obtain a $00 species pokémon. This guide introduces a setup that does not require the day care and can be set up in Violet City, once the player obtains the Togepi Egg.

In practice, the initial ACE setup will be created using the following general process:

Obtain the necessary player name, items and pokémon for the setup.
Obtain a bad clone.
Increase the happiness of the bad clone by 1, then create a hybrid between the Togepi egg and the bad clone.
Hatch the bad clone egg to obtain a $00 species pokémon.
Use the $00 species pokémon to obtain two mystery eggs and one fast ball, then use duplicate key items glitch to activate the extended ball pocket and set up glitch pokédex mode ACE.

Things you should know prior to starting the guide

While not strictly required, it is faster and easier to use a very specific player name. Due to this, the guide is written from the perspective of a player starting a new game.
This guide allows players to set up ACE from Violet City onward, right after obtaining the Togepi Egg. As a drawback, the player needs to perform two separate save corruptions, both of which have between 1 and 1.5 frames of leeway. Alternative guides that are easier to perform are provided on the TimoVM's Gen 2 ACE setups page that can be executed once you reach Goldenrod City.

A note on the side effects of the method described below

The method described on this page requires fairly heavy abuse of glitches that will produce a number of side effects. All these side effects can be fixed with later applications of ACE and are never permanently harmful for the game in any way:

Obtaining duplicate key items requires obtaining a glitch pokémon that cannot be manually released.
Hatching a $00 species pokémon sets the seen/caught flags for an pokémon species that should not exist.
Duplicate key item swap glitch removes the CANCEL button from the key item pocket.
Buying or obtaining additional poké balls causes issues when done with an extended ball pocket.
Setting up glitch pokédex mode ACE disables the use of the PokéGear.

A code will be provided at the end of the guide that fixes all these issues in a single execution and will allow you to choose a new player name.

Step 1: Initial setup

When playing on original cartridge or on emulator, it is absolutely required to have used the Clear Save Data feature (press SELECT + UP + B on the title screen) at least once since owning the game.

Preparing the save

First, we're going to make sure to set up the save and collect all the requirements to perform the setup.

(optional) Hold SELECT + UP + B on the title screen to reset your save. After the save is cleared, start a new game.
(optional) Select 「ていリ」 as your player name¹:

Due to technical reasons, this guide can only be performed if the following are both true for your trainer ID:
- Your trainer ID must not be equal or higher than 65280.
- The remainder after dividing your trainer ID by 256 must not be equal to 255.
Any starter works, but Totodile is the fastest option.
Make sure to start the in-game clock during morning or midday.

¹「ていリ」 will redirect execution to box names. For full compability with Flag3's setups, you can either use 「てパま」to redirect to the end of the last read mail or use 「じがまァ」 (the last character is a small katakana ア) in combination with glitch pokédex mode 17 to redirect to the start of the last read mail.

Collecting the requirements

Next, we'll gather the required items and pokémon for the setup.

Do the following before reaching Violet City:
- Catch one Sentret (Route 29, 40% to encounter only during morning and midday)
- Catch one Bellsprout (route 31, 20% chance to encounter throughout the day)
Do the following after reaching Violet City:
- Defeat the gym leader and obtain TM31 (mud-slap)
- Obtain the Togepi egg
- Within the ball pocket, make sure you only have two poké ball left.
- (optional) Set the current pokédex mode to "OLD POKéDEX MODE"

Step 2: Obtaining a $00 species pokémon

Using two instances of save corruption, we'll turn the starter into a $00 glitch pokémon.

Preparing the box

Before we can use save corruption with any degree of consistency, it is a good idea to fill up a box first. This will give us around 1 to 1.5 frames of leeway to perform save corruption.

Using normal cloning, put 25 pokémon in a box that has never been completely full at any point in the past.
- Make sure you end up with at least 5 copies of Bellsprout.
- For safety reasons, it is recommended you make additional clones of the starter pokémon, the Togepi egg and the Sentret.

Performing the first save corruption

Using save corruption, we're going to turn the starter into a bad clone of the starter using the following process:

Deposit the starter to the current active box.
Go to "Move pokémon w/o mail", you will get a prompt to save the game.
Reset the game shortly after the "saving...” text is fully printed.
If successful, upon restarting the game you will find a level 0 female version of the deposited pokémon with a blank name.

Please note that the timing of this is very strict (around 1 to 1.5 frames to obtain a bad clone).

If nothing was saved, the reset was too early. Next time, wait a little bit longer to reset.
If the pokémon was successfully cloned, the reset was too late. next time, reset a little bit earlier.
If the box ever gets to 29 pokémon in total, release pokémon from the box until there are only 25 pokémon present. Make sure to save normally after releasing them.

Use these guidelines and keep retrying until you've obtained a bad clone.

Preparing the bad clone for the second save corruption

Our aim is to hatch a $00 species. The bad clone gets us halfway there, but we need to adjust its happiness value so that it can hatch as soon as possible after hybridizing it to a bad clone egg.

Withdraw the bad clone, use TM31 to teach it mud-slap. This will increase its happiness value by exactly 1.
Deposit the bad clone back into the active box.
Deposit enough pokémon to completely fill the box, ensure that the bad clone is at the last position inside the box.
Withdraw the Togepi egg to your party.
Withdraw/release pokémon other than the bad clone from the box until 25 pokémon are left in the box. Ensure that the bad clone is always in the last position.

Performing the second save corruption

Using save corruption, we're going to obtain a bad clone of the Togepi egg. Thanks to filling the box entirely and putting the bad clone in the last position within the box, all the empty slots are now filled with leftover data of the bad clone. This allows us to create an egg containing the data of the bad clone.

Deposit the Togepi Egg to the current active box.
Go to "Move pokémon w/o mail", you will get a prompt to save the game.
Reset the game shortly after the "saving...” text is fully printed.
If successful, upon restarting the game you will find an egg with a blank name. In the summary, it will report that it is making sounds and is close to hatching.
Withdraw the bad clone egg, then walk around until it hatches into a $00 species.

Please note that the timing of this is very strict (around 1 to 1.5 frames to obtain a bad clone).

If nothing was saved, the reset was too early. Next time, wait a little bit longer to reset.
If the pokémon was successfully cloned, the reset was too late. next time, reset a little bit earlier.
If the box ever gets to 30 pokémon in total, move the bad clone to the last slot, then release/move pokémon from the box (while keeping the bad clone in the last slot) until there are only 25 pokémon present. Make sure to save normally after releasing/moving them.

Step 3: Obtaining duplicate key items and setting up glitch pokédex mode ACE

Reminder: this method will only work if your trainer ID fulfills both of the following requirements:

Your trainer ID must not be equal or higher than 65280.
The remainder after dividing your trainer ID by 256 must not be equal to 255.

Collecting the required items and party

Have the following items in the ball pocket:

Slot 1: Poké Ball x2
Slot 2 and beyond: empty

Have the following items in the key item pocket:

All key items you've obtained in your save thus far (withdraw all key items, if any, that you previously stored from the PC)

Have the following pokémon in the party:

$00 Species that was hatched from the bad clone egg
Sentret
Starter pokémon
Bellsprout
Bellsprout
Bellsprout

Have the following pokémon in the box:

two Bellsprout
one Normal Pokémon.

Keep in mind that all these pokémon, with the exception of the normal pokémon, will be corrupted during this process. Please make sure to obtain copies of these pokémon using normal cloning if you wish to keep any of them.

Performing a party overload

Next, we're going to abuse the special properties of the $00 species pokémon to get over 6 pokémon simultaneously in the party.

Using "move pokémon w/o mail", add a Bellsprout to the first party slot. This will push the glitch pokémon down to the second slot.
Exit the PC, open the start menu and switch the glitch pokémon in the second slot with the Bellsprout in the fifth slot. Your party should be arranged as such:
1. Bellsprout
2. Bellsprout
3. Sentret
4. Starter pokémon
5. $00 Species that was hatched from the bad clone egg
6. Bellsprout
7. Bellsprout
Using "move pokémon w/o mail", add a second Bellsprout to last available party slot. This will result in a total of 8 party pokémon, both Bellsprouts and the Sentret now have a held item.
Exit the PC, open the start menu. Retrieve the Mystery Eggs from the Bellsprouts, retrieve the Fast Ball from the Sentret.
(optional) If you picked Totodile as a starter, it will now be holding a flower mail. Retrieve it and put it in the bag. Make sure to not move it to the PC but instead straight to the bag, otherwise you won’t be able to obtain the mail as a flower mail.
Select "Deposit pokémon" from the PC and release the top three pokémon in your party.
Withdraw the normal pokémon from your box using "Withdraw pokémon". This will restore the normal functionality of the party.

Setting up glitch pokédex mode ACE

Arrange the Ball pocket as follows:
1. Slot 1: Fast Ball x1
2. Slot 2: Poké Ball x2
Go to the KEY ITEM pocket. Swap the first MYSTERY EGG with the second MYSTERY EGG.
Go to the BALL pocket, the FAST BALL has now changed into a MASTER BALL. THE POKé BALL has now changed into an ULTRA BALL. The game now believes you have a total of 161 item slots in the ball pocket, allowing you to scroll past the CANCEL button.
Toss 238 Ultra Balls until you have only 17 Ultra Balls remaining. Swap the Ultra Ball with the item in the 65th item slot (this item slot can be easily recognized due to having a quantity of 1 if you've previously set "OLD POKéDEX MODE" in the POKéDEX).
Go back to the start menu. Check the PokéGear option has disappeared from the start list. If it has, you can now save the game.

This swap removes the PokéGear from the start list and will activate Glitch Pokédex Mode ACE. From this point onward, using the pokédex will trigger ACE from $FB20 onward, an address corresponding to the 5th character of the third party pokémon's trainer name.

Do NOT open the pokédex yet. Opening the pokédex right now will likely crash the game. We first need to set up a way to properly execute ACE in a controlled manner.

Step 4: Setting up the Mail Writer

Now that we have set up Glitch Pokédex Mode ACE, we are going to install the Mail Writer, a program written using box names that allows us to easily write and execute any code we want. To do this, we need to set up the following:

Prepare the party to ensure that code gets safely redirected to box names.
Prepare specific box names to run the Mail Writer.

Preparing the party

There are two possible party setups, depending on if you've used 「ていリ」,「てパま」or「じがまァ」as player name or not.

Preparing your party if you picked 「ていリ」,「てパま」or「じがまァ」as player name

Arrange your party like this:
1. Any
2. Any
3. Pokémon with your OT name
4. Pokémon with your OT name
5. Any
6. Glitch pokémon used in step 3

Only if you used 「てパま」or「じがまァ」 as player name, give any party pokémon the mail with the following content to hold:

Preparing your party if you picked any other player name

Catch any pokémon and nickname it 「ていリ」
Use the NPC trade in Violet City to trade a Bellsprout for an Onix. If this Onix is somehow unobtainable, replace it with a bad clone instead.
Use normal cloning to obtain 4 copies of the Onix/bad clone.
Arrange your party like this:
1. Pokémon nicknamed 「ていリ」
2. Glitch pokémon used in step 3
3. Onix/bad clone
4. Onix/bad clone
5. Onix/bad clone
6. Onix/bad clone

Setting up box names to install the Mail Writer

For the Japanese versions of Gold & Silver, the mail writer can easily be installed as a set of box name codes that do not need to be modified. Write the following box name codes:

Once this is done, make sure to save the game.

Step 5: Using the Mail Writer

Now that we have everything set up, all that remains is to use Glitch Pokédex Mode ACE to start up the Mail Writer and clean up the side effects.

Opening the Mail Writer

You can start the Mail Writer using the following process:

(only if you used 「てパま」 or 「じがまァ」 as player name) Read the held mail that was previously given to a party pokémon.
Open the start menu and open the pokédex. If the party is set up correctly, this will immediately open a screen asking to write a mail. For now, you can enter the characters「カナ」, confirm the end of the mail, then press B to exit the Mail Writer safely.

If the code crashes, check the following:

Is the party setup correct for your player name?
Are the box name codes (or mail) correct?
In the 65th slot of the Ball pocket, is the item quantity equal to 11?
Was the code correctly entered?

How the mail writer works

Upon execution, the Mail writer will open the mail character entry screen where the player can write up to 32 different characters. After the player has confirmed the mail, the following actions take place:

The Mail writer will take pairs of characters and convert them into a single combined value. These values are then sequentially written, converting the 32 letter mail into a 16 byte long line of code.
Next, the Mail writer will display a checksum calculated from the combined value of all written bytes for the player to verify. Then the program enters a waiting state where they can either choose to write another mail, go back and correct previously written values or stop the mail writer and execute the newly written payload.
If the player has chosen to write a new mail, the Mail writer will open a new mail entry screen. The new mail is then also converted into a 16 byte long line of code and placed right after the code written by the previous mail(s), allowing the player to write arbitrarily long payloads.
Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.

Mail Writer Controls

Between entering mail codes, the mail writer will ask for user input.

Press A to open a new mail and continue writing data.
Press B to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.

Using the Mail Writer to fix the side effects of the setup

Finally, we can both test the Mail Writer and fix the side effects of the setup. Codes are provided both for players who used 「ていリ」,「てパま」or「じがまァ」as player name and for players who used their own name.

As a more stable form of ACE, the Mystery Egg in the key item pocket will be replaced with a TM25. Both codes also modify a party pokémon that allows the player to use TM25 in order to start the Mail Writer. Please note that, due to safety reasons, neither codes will disable Glitch Pokédex Mode ACE. A second code will be provided that allows you to alter the current Pokédex Mode directly.

Simply copy the assembly code that is applicable for your setup, then click the link at the top of the table to go to the MailConverter tool. Make sure to select "Japanese" as language and "Gold/Silver" as version.

Codes to be used with TimoVM's MailConverter

「ていリ」,「てパま」or「じがまァ」as player name

Any player name

06 01 11 B5 D1 3E 04 21 3D 5A CF 21 6D D6 2A 23 
F6 84 22 AF 21 D4 D5 47 4E 09 36 D8 23 36 FF 2E 
EF 36 01 21 97 DB CB BE 2E B7 CB BE 21 E8 D9 35 
4E 09 23 36 FF 0E 03 21 15 DD 11 52 DA CD D6 30 
0E 02 1E 6D CD D6 30 0E 04 11 40 DB C3 D6 30 C3 
B2 D8 18 E3 A0 E3 A6 50

21 6D D6 2A 23 F6 84 22 23 AF 22 21 D4 D5 47 4E 
09 36 D8 23 36 FF 2E EF 36 01 21 97 DB CB BE 2E 
B7 CB BE 21 E8 D9 36 01 23 23 36 FF 0E 03 21 0D 
DD 11 F2 D9 CD D6 30 0E 02 11 0D DA CD D6 30 0E 
04 11 34 DB C3 D6 30 C3 B2 D8 18 E3 A0 E3 A6 50

The code intended for players with 「ていリ」,「てパま」or「じがまァ」as player name has the following effects:

Open a screen that asks the player to enter a new name.
Restore the previous PokéGear flags.
Replace Mystery Egg with TM25 and add a CANCEL button at the end of the key item list.
Set the amount of items in the ball pocket to 1.
Remove the seen/caught flags of the hatched $00 species.
Remove the last party pokémon. Due to the party setup, this removes the glitch pokémon from part 3.
Modify party pokémon #3 so that using TM25 will execute box names as long as the pokémon is in the third slot. Alter the pokémon's nickname to 「メール」.

The code intended for players with their own player name has the following effects:

Restore the previous PokéGear flags.
Replace Mystery Egg with TM25 and add a CANCEL button at the end of the key item list.
Set the amount of items in the ball pocket to 1.
Remove the seen/caught flags of the hatched $00 species.
Remove all party pokémon except one. Due to the party setup, this removes the glitch pokémon from part 3.
Modify party pokémon #1 so that using TM25 will execute box names as long as the pokémon is in the third slot. Alter the pokémon's nickname to 「メール」.

Using TM25 to start the Mail Writer

After executing the above code, arrange your party as follows:

Any
Any
「メール」nicknamed pokémon
Any
Any
Any

As long as the 「メール」 nicknamed pokémon is in the third party slot, you can simply use TM25 to start up the Mail Writer.

How the 「メール」 nicknamed pokémon works

Thanks to the above code, the 「メール」 nicknamed pokémon has two parts of its data structure modified:

Its encounter data (only used in Crystal) was modified to encode a jump to move data.
Its first three moves were modified to encode a jump to box data.

Due to this, you can safely deposit and withdraw the 「メール」 nicknamed pokémon. Be mindful that trading it to the first generation of pokémon games or deleting/overwriting its moves will destroy its functionality.

For safety, it's recommended to clone the 「メール」 nicknamed pokémon, as to have backups available.

Optional: Altering the current Pokédex Mode

This code will alter the current active Pokédex Mode. By default, it sets the Pokédex Mode to zero, making it possible to use the Pokédex normally again. By changing the value marked in bold, you can change the value that the Pokédex Mode will be set to. e.g. a value of $11 will set the current Pokédex Mode to mode 17.

Code to be used with TimoVM's MailConverter
3E 00 EA 71 D6 C9

Please note that it is not possible to use this code to change the current Pokédex Mode when the Mail Writer is started through the Pokédex. When exiting the pokédex, the current Pokédex Mode is saved, overwriting any alterations to the affected address. The above code is only usable when the Mail Writer was started through TM25.

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.

Appendix

Plain text transcripts of codes

Name

ていリ

Mail Writer

Box 1:　ヅ　に　わ　ゆ　ゆ　ゾ　ュ　ぼ
Box 2:　ゆ　に　ヂ　ぺ　な　に　ヨ　プ
Box 3:　ゅ　ま　む　ゅ　ご　き　き　よ
Box 4:　ぐ　デ　だ　ガ　ご　き　き　よ
Box 5:　キ　デ　ド　ア　ぺ　デ　ご　？
Box 6:　だ　！　ズ　が　と　ぜ　ォ　ギ
Box 7:　ビ　ヘ　ば　で　が　ブ　ブ　ぜ
Box 8:　げ　ぜ　ォ　ま　き　ぐ　ァ　プ
Box 9:　ダ　れ　か　リ　ダ　リ　だ　ゥ

In-depth explanation of the setup

Effect of the name

Converting the box name code to assembly results in the following code:

C3 B2 D8	jp wBoxNames
50		ld d, b
50		ld d, b
50		ld d, b

Effect of Glitch Pokédex ACE

In the 2nd generation of Pokémon games, the Pokédex offers three different modes of sorting pokémon species (New, Old, A-Z). When the Pokédex is opened, the game checks which mode was last active, then launches a function to sort all species. Since the game needs to know which mode was last active, the last used Pokédex mode is stored in RAM at address $D67E.

By swapping an item stack using the extended Ball Pocket, we can directly overwrite the value for the last used mode. When the Pokédex is next opened, the game will read this value and attempt to launch an invalid sorting function depending on the value used, some of which will trigger ACE.

For the japanese versions of Gold & Silver, mode 17 ($11) will trigger ACE from $FB20 onward. This address is echo ram for $DB20, an address corresponding to the 5th character of the third party pokémon's original trainer name.

We can redirect this effect through two possible ways:

We can use a specific player name. By putting pokémon with our own specific trainer player name in the third and fourth party slot, we're able to redirect the effect to somewhere else.
We can put clones of the bad clone in party slots 3 through 6. Bad clones have blank OT name values, allowing safe passage through this area of memory. The next area of data contains nickname data, so by putting a pokémon with a specific nickname in the first party slot, we can redirect the effect to somewhere else.

Effect of the mail

Converting the box name code to assembly results in the following code:

C3 B2 D8	jp wBoxNames	; Entry point of「じがまァ」player name
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
4E		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
D8		filler
30 DF		jr nc, -$21		; Jump to start of mail, entry point of 「てパま」player name
<pre>

===Effect of the box name code===

Converting the box name code to assembly results in the following code:

<pre>
Box 1: $D8B2
11 C6 DC	ld de, $DCC6
D5		push de
D5		push de		; .newMail
0E AE		ld c, $AE	; c = $AE
3E 50		ld a, $50	; a = $50

Box 2: $D8BB
D5		push de
C6 10		sub $A0		; a = $60
47		ld b, a		; bc = $60AE
C5		push bc
C6 A4		add a, $A4	; a = $04
42		ld b, d
50		ld d, b

Box 3: $D8C4
E1		pop hl		; hl = $60AE
CF		rst08H		; Farcall _ComposeMailMessage (a:hl = 04:60AE)
D1		pop de
E1		pop hl		; Set both hl and dc to the start of the newly written mail
2A		ldi a, (hl)	; .loop
B7		or a, a
B7		or a, a
D6 50		sub $50

Box 4: $D8CD
28 13		jr, .terminator
30 05		jr, .character
2A		ldi a, (hl)	; If terminator, escape loop. if newline, get new value for a and continue
B7		or a, a
B7		or a, a
D6 50		sub $50		; Ensures that new character will result in the same value when combined with the next

Box 5: $D8D6
86		add (hl)	; .character
12		ld (de), a
13		inc de
80		add a, b
47		ld b, a		; Responsible for generating checksum
12		ld (de), a
2A		ldi a, (hl)	; inc hl is not available, so this will have to do
E6 50		or $50		; Ensures that carry flag is not set

Box 6: $D8DF
30 E7		jr nc, .loop
0C		inc c		; .terminator, _ComposeMailMessage sets bc to 0000, so c = 01 after this part
26 C4		ld h, $C4
2E F4		ld l, $F4	; hl = $C4F4, bottom left screen tile
06 50		ld b, $50	; Ensures that b is consistent for the next call

Box 7: $D8E8
1A		ld a, (de)
CD 3A 33	call PrintBCDNumber.loop + 01h	; PrintBCDNumber.loop itself can't be reached, so we skip forward one byte.
26 1B		ld h, $1B	; .errorCorrection
1B		dec de		; Calling PrintBCDNumber.loop with c = 01 advances de by 1.
2E 50		ld l, $50	; hl = $1B50

Box 8: $D8F1
29		add hl, hl	; hl = $36A0
2E F4		ld l, $F4	; hl = $36F4 (address of JoyTextDelay_ForcehJoyDown)
CF		rst08H		; Farcall JoyTextDelay_ForcehJoyDown	set a = current button state
B7		or a, a		; Are any buttons pressed? if not, ask for new button states
28 E9		jr z, .terminator
42		ld b, d
50		ld d, b

Box 9: $D8FA
0F		rlca		; Is the a button pressed? If yes, start a new mail
DA B6 D8	jp c, .loop
0F		rlca		; Is the b button pressed? If yes, return and execute newly written program.
D8		ret c		; If not, another button was pressed, so decrement de to allow user to correct errors
30 EA		jr nc, .errorCorrection

Effect of the side effect-fixing code

Converting the box name code to assembly results in the following code:

「ていリ」,「てパま」or「じがまァ」as player name

Code

06 01	ld b, 
11 B5 D1	ld de, wPlayerName
3E 04		ld a, $04
21 3D 5A	ld hl, _NamingScreen
CF		rst08h FarCall	; call 04:5A3D
21 6D D6	ld hl, $D66D	; Address where the original pokégear flags have been displaced to
2A		ldi a, (hl)
23		inc hl
F6 84		or $84		; Ensures that minimal pokégears are restored if $D67A is empty
22		ldi (hl), a
AF		xor a		; a = $00
21 D4 D5	ld wNumKeyItems	; Current amount of key items in key item pocket
47		ld b, a		; b = $00
4E		ld c, (hl)	; Set c to amount of key items
09		add hl, bc
36 D8		ld (hl), $D8	; Change last key item to TM25
23 		inc hl
36 FF		ld (hl), $FF	; Restore cancel button to key item pocket
2E EF		ld l, $FC	; hl targets wNumBalls
36 01		ld (hl), $01	; Set current amount of balls in ball pocket to 1
21 97 DB	ld hl, $DB97	; Address containing $00's caught flag
CB BE		res 7, (hl)	; Remove $00's caught flag
2E 23		ld l, $23	; hl targets address containing $00's seen flag
CB BE		res 7, (hl)	; Remove $00's seen flag
21 22 DA	ld hl, wPartyCount
4E		ld a, (hl)
35		dec (hl)	; Remove last party pokémon
09		add hl, bc
36 FF		ld (hl), $FF	; Re-add proper terminator to party list
0E 03		ld c, $03
21 15 DD	ld hl, $DD15
11 52 DA	ld de, wPartyMon3Moves
CD D6 30	call CopyBytes	; copy bc values from hl to de
0E 02		ld c, $02
1E 6D		ld l, $6D		; hl = wPartyMon3Unused1
CD D6 30	call CopyBytes	; copy bc values from hl to de
0E 04		ld c, $04
11 40 DB	ld de, wPartyMon3Nickname
C3 D6 30	jp CopyBytes	; copy bc values from hl to de

Payload

C3 B2 D8	jp wBoxNames
18 E3		jr -1D
A0 E3 A6 50	unused	; forms 「メール」 when interpreted as text

Any other player name

Code

21 6D D6	ld hl, $D66D	; Address where the original pokégear flags have been displaced to
2A		ldi a, (hl)
23		inc hl
F6 84		or $84		; Ensures that minimal pokégears are restored if $D67A is empty
22		ldi (hl), a
AF		xor a		; a = $00
21 D4 D5	ld wNumKeyItems	; Current amount of key items in key item pocket
47		ld b, a		; b = $00
4E		ld c, (hl)	; Set c to amount of key items
09		add hl, bc
36 D8		ld (hl), $D8	; Change last key item to TM25
23 		inc hl
36 FF		ld (hl), $FF	; Restore cancel button to key item pocket
2E EF		ld l, $FC	; hl targets wNumBalls
36 01		ld (hl), $01	; Set current amount of balls in ball pocket to 1
21 97 DB	ld hl, $DB97	; Address containing $00's caught flag
CB BE		res 7, (hl)	; Remove $00's caught flag
2E 23		ld l, $23	; hl targets address containing $00's seen flag
CB BE		res 7, (hl)	; Remove $00's seen flag
21 22 DA	ld hl, wPartyCount
4E		ld a, (hl)
35		dec (hl)	; Remove last party pokémon
09		add hl, bc
36 FF		ld (hl), $FF	; Re-add proper terminator to party list
0E 03		ld c, $03
21 15 DD	ld hl, $DD15
11 52 DA	ld de, wPartyMon3Moves
CD D6 30	call CopyBytes	; copy bc values from hl to de
0E 02		ld c, $02
1E 6D		ld l, $6D		; hl = wPartyMon3Unused1
CD D6 30	call CopyBytes	; copy bc values from hl to de
0E 04		ld c, $04
11 40 DB	ld de, wPartyMon3Nickname
C3 D6 30	jp CopyBytes	; copy bc values from hl to de

Payload

C3 B2 D8	jp wBoxNames
18 E3		jr -1D
A0 E3 A6 50	unused	; forms 「メール」 when interpreted as text

Effect of 「メール」nicknamed pokémon

Assuming that the pokémon is put in the third party slot, converting the box name code to assembly results in the following code:

At $DA52

C3 B2 D8	jp wBoxNames

At $DA6D

18 E3		jr -1D		; Jump to $DA52, entry point of Wrong Pocket TM25

Effect of the pokédex mode-altering code

When using the Mail Writer, the assembly from this code is directly written and executed as follows:

3E XX		ld a, $XX
EA 7E D6	ld (wLastDexMode), a
C9		ret

Guides:Glitch Pokédex Mode ACE setup (JP)

Setting up initial ACE

Things you should know prior to starting the guide

A note on the side effects of the method described below

Step 1: Initial setup

Preparing the save

Collecting the requirements

Step 2: Obtaining a $00 species pokémon

Preparing the box

Performing the first save corruption

Preparing the bad clone for the second save corruption

Performing the second save corruption

Step 3: Obtaining duplicate key items and setting up glitch pokédex mode ACE

Collecting the required items and party

Performing a party overload

Setting up glitch pokédex mode ACE

Step 4: Setting up the Mail Writer

Preparing the party

Preparing your party if you picked 「ていリ」,「てパま」or「じがまァ」as player name

Preparing your party if you picked any other player name

Setting up box names to install the Mail Writer

Step 5: Using the Mail Writer

Opening the Mail Writer

How the mail writer works

Mail Writer Controls

Using the Mail Writer to fix the side effects of the setup

Using TM25 to start the Mail Writer

How the 「メール」 nicknamed pokémon works

Optional: Altering the current Pokédex Mode

What to do with the Mail writer

Appendix

Plain text transcripts of codes

Name

Mail Writer

In-depth explanation of the setup

Effect of the name

Effect of Glitch Pokédex ACE

Effect of the mail

Effect of the side effect-fixing code

「ていリ」,「てパま」or「じがまァ」as player name

Any other player name

Effect of 「メール」nicknamed pokémon

Effect of the pokédex mode-altering code

Navigation menu

Search