Guides:Mail Writer C
WARNING: This portion of the guide is outdated, the contents of this guide have been merged with the main setup articles. It is only kept for legacy purposes. You can find all up-to-date guides on the TimoVM's Gen 2 ACE setups article.
This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Mail writer. |
The Mail writer is an arbitrary code execution program that allows the user to quickly and accurately write and execute arbitrary code payloads of up to a maximum size of 428 bytes. Payloads are written from wOtPartyCount onward, where enemy trainer's parties are usually buffered. It is part of the TimoVM's Gen 2 ACE setups set of guides.
This guide is applicable to the English, French , German, Italian and Spanish versions of Crystal only.
Using the Mail writer requires an ACE setup, like the one described here, that redirects execution to the start of box names.
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.
How the mail writer works
Upon execution, the Mail writer will open the mail character entry screen where the player can write up to 32 different characters. After the player has confirmed the mail, the following actions take place:
- The Mail writer will take pairs of characters and convert them into a single combined value. These values are then sequentially written, converting the 32 letter mail into a 16 byte long line of code.
- Next, the Mail writer will display a checksum calculated from the combined value of all written bytes for the player to verify. Then the program enters a waiting state where they can either choose to write another mail, go back and correct previously written values or stop the mail writer and execute the newly written payload.
- If the player has chosen to write a new mail, the Mail writer will open a new mail entry screen. The new mail is then also converted into a block of 16 bytes and placed right after the code written by the previous mail(s), allowing the player to write arbitrarily long payloads.
Installation
The mail writer itself will be installed in the TM/HM pocket through the following two step process:
- Execute a box code using 0x1500 control code ACE that sets the quantities of all 50 TMs to x255, as well as placing a TM15 in the main item pocket and installing a setup so that using this TM15 will redirect execution to the start of the TM/HM pocket.
- Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
Afterwards, simply use TM15 to start up the mail writer whenever necessary.
Step 1: setting all TM quantities to x255
- Rename box names to form the following language dependent codes. Please mind the differences between uppercase X (), lowercase x () and multiplication symbol ().
English | French | German | Italian | Spanish |
---|---|---|---|---|
|
|
|
|
|
- Then, execute 0x1500 control code ACE using the method described in the [guide here].
- If the code was successfully executed, the TM/HM pocket should now be completely filled with 255 copies of every TM. Additionally, the first item in the main item pocket will have changed into a TM15. Using it will execute code in the TM/HM pocket. Make sure to save after verifying that the code worked.
NOTE: due to limitations, the German and French versions of the box name ode can only be used once. If you need to activate its effect again, reset all box names to their original values before executing ACE.
Step 2: Selling TMs to form a program in the TM/HM pocket
Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using. The following table displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
Once you're done selling all TMs, simply use TM15 to activate the mail writer.
English | French | German | Italian | Spanish |
---|---|---|---|---|
|
|
|
|
|
Language independent TMs
TM | Final Quantity | Sell value |
---|---|---|
TM01 DYNAMICPUNCH | x17 | 357000 |
TM02 HEADBUTT | x128 | 127000 |
TM03 CURSE | x210 | 67500 |
TM04 ROLLOUT | x213 | 42000 |
TM05 ROAR | x213 | 21000 |
TM06 TOXIC | x213 | 63000 |
TM07 ZAP CANNON | x33 | 222000 |
TM08 ROCK SMASH | SEE NEXT TABLE | |
TM09 PSYCH UP | x94 | 80500 |
TM10 HIDDEN POWER | x207 | 72000 |
TM11 SUNNY DAY | x225 | 30000 |
TM12 SWEET SCENT | x209 | 23000 |
TM13 SNORE | x42 | 106500 |
TM14 BLIZZARD | x254 | 1500 |
TM15 HYPER BEAM | x80 | 262500 |
TM16 ICY WIND | x56 | 298500 |
TM17 PROTECT | x251 | 6000 |
TM18 RAIN DANCE | x40 | 215000 |
TM19 GIGA DRAIN | x10 | 367500 |
TM20 ENDURE | x135 | 180000 |
TM21 FRUSTRATION | x134 | 60500 |
TM22 SOLARBEAM | x18 | 355500 |
TM23 IRON TAIL | x19 | 354000 |
TM24 DRAGONBREATH | x35 | 330000 |
TM25 THUNDER | x129 | 126000 |
TM26 EARTHQUAKE | x79 | 264000 |
TM27 RETURN | x18 | 118500 |
TM28 DIG | x24 | 231000 |
TM29 PSYCHIC | x239 | 16000 |
TM30 SHADOW BALL | x33 | 333000 |
TM31 MUD-SLAP | x1 | 381000 |
TM32 DOUBLE TEAM | x197 | 58000 |
TM33 ICE PUNCH | x77 | 267000 |
TM34 SWAGGER | x205 | 25000 |
TM35 SLEEP TALK | SEE NEXT TABLE | |
TM36 SLUDGE BOMB | x56 | 99500 |
TM37 SANDSTORM | x27 | 228000 |
TM38 FIRE BLAST | x205 | 50000 |
TM39 SWIFT | SEE NEXT TABLE | |
TM40 DEFENSE CURL | x53 | 101000 |
TM41 THUNDERPUNCH | x189 | 99000 |
TM42 DREAM EATER | x40 | 322500 |
TM43 DETECT | x217 | 19000 |
TM44 REST | x56 | 298500 |
TM45 ATTRACT | x240 | 22500 |
TM46 THIEF | x254 | 1500 |
TM47 STEEL WING | x08 | 370500 |
TM48 FIRE PUNCH | x200 | 82500 |
TM49 FURY CUTTER | x24 | 346500 |
TM50 NIGHTMARE | x242 | 13000 |
Language dependent TMs
TM | English | French | German | Italian | Spanish | |||||
---|---|---|---|---|---|---|---|---|---|---|
Final amount | Amount sold for | Final amount | Amount sold for | Final amount | Amount sold for | Final amount | Amount sold for | Final amount | Amount sold for | |
TM08 ROCK SMASH | x117 | 69000 | x122 | 66500 | x99 | 78000 | x197 | 29000 | x232 | 11500 |
TM35 SLEEP TALK | x204 | 25500 | x175 | 40000 | x182 | 36500 | x186 | 34500 | x172 | 41500 |
TM39 SWIFT | x75 | 180000 | x56 | 199000 | x53 | 202000 | x57 | 198000 | x53 | 202000 |
Once this has been done, continue to the next step.
Using the mail writer
From now on, simply use the TM15 in the main item pocket to start up the Mail riter.
The Mail Writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.
Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh" then confirm and exit the RAM writer.
Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
Controls
Between entering mail codes, the mail writer will ask for user input.
- Press SELECT to open a new mail and continue writing data.
- Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
- Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
Enter your mail code, then press "END". | It prints the checksum and waits for input. |
What to do with the Mail writer
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
- Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
- RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.
Addendum: repairing the TM15 bootstrap
In case something happens with the TM15 bootstrap that causes it to no longer function, you can repair bootstrap without having to reset TM quantities using the following procedure:
- Enter the following language-specific box names. Please mind the differences between uppercase X (), lowercase x () and multiplication symbol ().
English | French | German | Italian | Spanish |
---|---|---|---|---|
|
|
|
|
|
- Execute 0x1500 ACE using the usual steps.
- If the code executes succesfully without crashing the game, the bootstrap has now been repaired.
Appendix: in-depth explanation of the setup
Effect of the setup box name code
Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.
The code overwrites part of itself to call the byteFill function. This will fill the area between $D859 and $D88A with $FF values, setting all 50 TM quantities to 255. Separately, this code writes five bytes from $DA10 onward, the effect pointer of TM15, installing a TM15 bootstrap that redirects execution to the Mail Writer. Lastly, when combined with the mail code, it will convert the first item in the main item pocket to a TM15.
English
Box 1: $DB75 AF xor a ; a = $00 D6 FF sub $FF ; a = $01 EA D0 FB ld ($FBD0), a D6 F1 sub $F1 ; a = $10 50 ld d; b Box 2: $DB7E EA 87 FB ld ($FB87), a D6 EF sub $EF ; a = $21 EA 86 FB ld ($FB87), a 21 Box 3: $DB87 10 FA ld hl, $FA10 ; Execution pointer of wrong pocket TM15 EA AC FB ld ($F8AC), a D6 FF sub $FF ; a = $22 FB ei 50 ld d, b Box 4: $DB90 EA AA FB ld ($FBAA), a 85 add a, l ; a = $32 EA D1 FB ld ($FBD1), a 85 add a, l ; a = $42 50 ld d, b Box 5: $DB99 F6 81 or $81 ; a = $C3, reset carry flag D4 D6 FB call nc, .setupBootStrap B4 or a, h ; a = $FB D6 A2 sub $A2 ; a = $59, reset carry flag 50 ld d, b Box 6: $DBA2 EA AD FB ld ($FBAD), a D4 AA FB call nc, .writeBootstrap D6 81 sub $81 ; a = $D8, set carry flag 22 ldi (hl), a ; .writeBootstrap Box 7: $DBAB D0 ret nc 21 59 F8 ld hl, $F859 ; $59 will later be overwritten to $41 to prevent crashing when viewing the newly written name AF xor a ; a = $00 EA D2 FB ld ($FBD2), a 50 ld d, b Box 8: $DBB4 D6 D0 sub $D0 ; a = $30 EA D5 FB ld ($FBD5), a D6 EF sub $EF ; a = $41 FB ei 50 ld d, b Box 9: $DBBD EA D4 FB ld ($FBD4), a EA AD FB ld ($FBAD), a ; Overwrites part of box #7 to prevent a crash B5 or a, l ; a = $59 FB ei 50 ld d, b Box 10: $DBC6 D6 8B sub $8B ; a = $CE EA 93 F8 ld (wItems), a ; Main item pocket, item #1's ID F6 FF or $FF ; a = $FF, reset carry flag FB ei 50 ld d, b Box 11: $DBCF FB ei 01 32 00 ld bc, 0032 D2 41 30 jp nc, byteFill F5 push af ; .SetupBootStrap 50 ld d, b Box 12: $DBD8 D6 85 sub $85 ; a = 3E, reset carry flag D4 AA FB call nc, .writeBootstrap 85 add a, l ; a = $4F E6 84 and $84 ; a = $04, reset carry flag 50 ld d, b Box 13: $DBE1 D4 AA FB call nc, .writeBootstrap F1 pop af ; a = $C3, reset carry flag D2 AA FB jp nc, .writeBootstrap FB 50 Bootstrap: $DA10 3E 04 ld a, $04 C3 59 D8 jp wTMsHMs
French
Box 1: $DB75 21 A4 FB ld hl, $FBA4 CC B4 FB call z, .subhl FB ei FB ei 50 ld d, b Box 2: $DB7E CC B1 FB call z, .addhl CC B4 FB call z, .subhl CC B1 DB call z, .addhl Box 3: $DB87 CC B6 FB call z, .xorhl AC xor a, h ; a = $32 BF cp a ; Set zero flag CC B4 FB call z, .subhl 50 sub d, b Box 4: $DB90 AF xor a ; a = $00 CC B7 FB call z, .xorhl CC B1 FB call z, .addhl FB ei 50 ld d, b Box 5: $DB99 CC B4 FB call z, .subhl CC B4 FB call z, .subhl F6 FF or $FF ; a = $FF 50 Box 6: $DBA2 BF cp a ; Set zero flag BF cp a 57 ld d, a ; Hides newly written box name from player, preventing crash due to $59 appearing 21 59 F8 ld hl, $F859 01 32 00 ld bc, $0032 Box 7: $DBAB CC 2E 30 call z, byteFill CA BA FB jp z, .skip 86 add (hl) ; .addhl 86 add (hl) 50 Box 8: $DBB4 96 sub (hl) ; .subhl AE xor (hl) AE xor (hl) ; .xorhl 22 ldi (hl), a ; .hl BF cp a ; Set zero flag C9 ret E6 E2 and $E2 ; a = $E2, .skip 50 ld d, b Box 9: $DBBD 84 add a, h ; a = $DB, f = $10 F5 push af E1 pop hl ; hl = $DA10 95 sub a, l ; a = $CB 87 add a, a ; a = $96 AC xor a, h ; a = $4E 95 sub a, l ; a = $3E BF cp a ; Set zero flag 50 ld d, b Box 10: $DBC6 CC B7 FB call z, .hl E6 84 and $84 ; a = $04 BF cp a ; Set zero flag BF cp a BF cp a 50 ld d, b Box 11: $DBCF CC B7 FB call z, .hl AF xor a ; a = $00 F6 E2 or $E2 ; a = $E2 A4 and a, h ; a = $C2 BF cp a ; Set zero flag 50 ld d, b Box 12: $DBD8 CC B7 FB call z, .hl FA A6 FB ld ($FBA6), a ; a = $59, zero flag still set FB ei FB ei 50 ld d, b Box 13: $DBE1 CC B7 FB call z, .hl FA A7 FB ld ($FBA7), a ; a = $F8, zero flag still set CA B7 DB jp z, .hl Bootstrap: $DA10 3E 04 ld a, $04 C3 59 F8 jp wTMsHMs
German
Box 1: $DB75 21 B0 FB ld hl, $FBB0 96 sub a, (hl) ; a = $5F C4 A9 FB call nz, .write 86 add a, (hl) ; a = $21 50 ld d, b Box 2: $DB7E C4 A9 FB call nz, .write 87 add a, a ; a = $42 96 sub a, (hl) ; a = $59 C4 A9 FB call nz, .write 50 ld d, b Box 3: $DB87 AF xor a ; a = $00, zero flag set F6 F8 or $F8 ; a = $F8, reset zero flag C4 A9 FB call nz, .write 96 sub a, (hl) ; a = $75 96 sub a, (hl) ; a = $0E 50 ld d, b Box 4: $DB90 C4 A9 FB call nz, .write 86 add a, (hl) ; a = $A0 86 add a, (hl) ; a = $32 C4 A9 FB call nz, .write 50 ld d, b Box 5: $DB99 86 add a, (hl) ; a = $C4 C4 A9 FB call nz, .write AE xor a, (hl) ; a = $2B C4 A9 FB call nz, .write 50 ld d, b Box 6: $DBA2 96 sub a, (hl) ; a = $30 C4 A9 FB call nz, .write 86 add a, (hl) ; a = $E2 F5 push hl AF xor a ; a = $00, set zero flag 22 ldi (hl), a ; .write 50 ld d, b Box 7: $DBAB C0 ret nz F5 push af C1 pop bc ; bc = $0080 F6 FF or $FF ; a = $FF, reset zero flag 5F ld e, a 21 59 F8 ld hl, wTMsHMs Box 8: $DBB4 0E 32 ld c, $32 ; bc = $0032 C4 2B 30 call nz, byteFill 00 nop F1 pop af ; a = $E2 84 add a, h ; af = $DA10 50 ld d, b Box 9: $DBBD F5 push af E1 pop hl 95 sub a, l ; a = $CA 87 add a ; a = $94 AC xor a, h ; a = $4E 95 sub a, l ; a = $3E, reset zero flag FB ei FB ei 50 ld d, b Box 10: $DBC6 C4 A9 FB call nz, .write E6 84 and $84 ; $04 C4 A9 FB call nz, .write 50 ld d, b Box 11: $DBCF AF xor a ; a = $00 F6 C3 or $C3 ; a = $C3 C4 A9 FB call nz, .write FB ei FB ei 50 ld d, b Box 12: $DBD8 FA B2 FB ld ($FBB2), a ; a = $59 C4 A9 FB call nz, .write AF xor a ; a = $00 FB ei 50 ld d, b Box 13: $DBE1 F6 F8 or $F8 C3 A9 FB jp .write Bootstrap: $DA10 3E 04 ld a, $04 C3 59 F8 jp wTMsHMs
Italian
Box 1: $DB75 EA A3 FB ld ($FBA3), a ; Due to mail, a = $00 D6 FF sub $FF ; a = $01 EA A1 FB ld ($FBA1), a 50 ld d, b Box 2: $DB7E D6 CF sub $CF ; a = $32 EA A2 FB ld ($FBA2), a C6 EF add $EF ; a = $21 FB ei 50 ld d, b Box 3: $DB87 EA 9E FB ld ($FB9E), a D6 C8 sub $C8 ; a = $59 EA 9F FB ld ($FB9F), a 50 ld d, b Box 4: $DB90 C6 D6 add $D6 ; a = $2F EA A5 FB ld ($FBA5), a D6 FF sub $FF ; a = $30 FB ei 50 ld d, b Box 5: $DB99 EA A6 FB ld ($FBA6), a F6 FF or $FF 21 59 F8 ld hl, wTMsHMs ; $59 gets overwritten to $D8 to prevent a crash upon viewing the newly written box name 01 Box 6: $DBA2 32 00 ld bc, $0032 CD 2F 30 call byteFill AF xor a ; a = $00 F6 E2 or $E2 ; a = $E2 50 ld d, b Box 7: $DBAB 84 add a, h ; af = $DA10 F5 push af E1 pop hl D6 9C sub $9C ; a = $3E CD C8 FB call .write 50 ld d, b Box 8: $DBB4 E6 84 and $84 ; a = $04 CD C8 FB call .write C6 BF add $BF ; a = $C3 BF cp a 50 ld d, b Box 9: $DBBD CD C8 FB call .write C6 96 add $96 ; a = $59 CD C8 FB call .write 50 ld d, b Box 10: $DBC6 D6 81 sub $81 ; a = $D8 22 ldi (hl), a ; .write C9 ret Bootstrap: $DA10 3E 04 ld a, $04 C3 59 D8 jp wTMsHMs
Spanish
Box 1: $DB75 EA A3 FB ld ($FBA3), a ; Due to mail, a = $00 D6 FF sub $FF ; a = $01 EA A1 FB ld ($FBA1), a 50 ld d, b Box 2: $DB7E D6 CF sub $CF ; a = $32 EA A2 FB ld ($FBA2), a C6 EF add $EF ; a = $21 FB ei 50 ld d, b Box 3: $DB87 EA 9E FB ld ($FB9E), a D6 C8 sub $C8 ; a = $59 EA 9F FB ld ($FB9F), a 50 ld d, b Box 4: $DB90 C6 D2 add $D2 ; a = $2B EA A5 FB ld ($FBA5), a D6 FB sub $FF ; a = $30 FB ei 50 ld d, b Box 5: $DB99 EA A6 FB ld ($FBA6), a F6 FF or $FF 21 59 F8 ld hl, wTMsHMs ; $59 gets overwritten to $D8 to prevent a crash upon viewing the newly written box name 01 Box 6: $DBA2 32 00 ld bc, $0032 CD 2B 30 call byteFill AF xor a ; a = $00 F6 E2 or $E2 ; a = $E2 50 ld d, b Box 7: $DBAB 84 add a, h ; af = $DA10 F5 push af E1 pop hl D6 9C sub $9C ; a = $3E CD C8 FB call .write 50 ld d, b Box 8: $DBB4 E6 84 and $84 ; a = $04 CD C8 FB call .write C6 BF add $BF ; a = $C3 BF cp a 50 ld d, b Box 9: $DBBD CD C8 FB call .write C6 96 add $96 ; a = $59 CD C8 FB call .write 50 ld d, b Box 10: $DBC6 D6 81 sub $81 ; a = $D8 22 ldi (hl), a ; .write C9 ret Bootstrap: $DA10 3E 04 ld a, $04 C3 59 D8 jp wTMsHMs
Effect of the TM code
Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.
English
11 80 D2 ld de, $D280 D5 push de D5 push de ; .nextMail D5 push de 21 75 5E ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C5 ld hl, $C501 ; .screenLoop 4D ld c, l CD CC 38 call PrintBCDNumber.loop - 1 1B dec de ; .goBack CD 4B 35 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
French
11 80 D2 ld de, $D280 D5 push de D5 push de ; .nextMail D5 push de 21 7A 5E ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C5 ld hl, $C501 ; .screenLoop 4D ld c, l CD AF 38 call PrintBCDNumber.loop 1B dec de ; .goBack CD 38 35 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
German
11 80 D2 ld de, $D280 D5 push de D5 push de ; .nextMail D5 push de 21 63 5E ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C5 ld hl, $C501 ; .screenLoop 4D ld c, l CD B6 38 call PrintBCDNumber.loop - 1 1B dec de ; .goBack CD 35 35 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
Italian
11 80 D2 ld de, $D280 D5 push de D5 push de ; .nextMail D5 push de 21 C5 5E ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C5 ld hl, $C501 ; .screenLoop 4D ld c, l CD BA 38 call PrintBCDNumber.loop 1B dec de ; .goBack CD 39 35 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
Spanish
11 80 D2 ld de, $D280 D5 push de D5 push de ; .nextMail D5 push de 21 E8 5E ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C5 ld hl, $C501 ; .screenLoop 4D ld c, l CD AC 38 call PrintBCDNumber.loop - 1 1B dec de ; .goBack CD 35 35 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
Effect of the reset box name code
Converting the characters from box names to assembly results in the following code. This code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
English
Box 1: $DB75 AF xor a ; a = $00, reset carry flag F6 E2 or $E2 ; a = $E2 F5 push af E1 pop hl AF xor a ; a = $00, reset carry flag F6 F8 or $F8 ; a = $F8 50 ld d, b Box 2: $DB7E 84 add a, h ; af = $DA10 F5 push hl E1 pop hl ; hl = $DA10 D6 B8 sub $B8 ; a = $22 EA A8 FB ld (.write), a 50 ld d, b Box 3: $DB87 85 add a, l ; a = $33 D6 F4 sub $F4 ; a = $3E A7 and a ; Reset carry flag D4 A8 FB call nc, .write AF xor a ; a = $00 50 ld d, b Box 4: $DB90 D6 FC sub $FC ; a = $04 A7 and a ; Reset carry flag D4 A8 FB call nc, .write AF xor a ; a = $00 AF xor a 50 ld d, b Box 5: $DB99 F6 D2 or $D2 ; a = $D2 D4 A8 FB call nc, .write D6 8C sub $8C ; a = $46 85 add a, l ; a = $59 50 ld d, b Box 6: $D8A2 D4 A8 FB call nc, .write D6 81 sub $81 ; a = $D8 A7 and a ; Reset carry flag 22 ldi (hl), a ; .write D0 call nc Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 D2 59 D8 jp nc, wTMsHMs
French
Box 1: $DB75 21 E2 F8 ld hl, $F8E2 AF xor a ; a = $00 84 add a, h ; a = $F8 85 add a, l ; af = $DA10 F5 push af E1 pop hl ; hl = $DA10 50 ld d, b Box 2: $DB7E 95 sub a, l ; a = $CA 87 add a ; a = $94 AC xor a, h ; a = $4E 95 sub a, l ; a = $3E BF cp a ; Set zero flag BF cp a CC B7 DB call z, .write Box 3: $DB87 E6 84 and $84 ; a = $04 BF cp a ; Set zero flag CC B7 FB call z, .write AF xor a ; a = $00 AF xor a 50 ld d, b Box 4: $DB90 F6 E2 or $E2 ; a = $E2 A4 and a, h ; a = $C2 BF cp a ; Set zero flag CC B7 FB call z, .write AF xor a ; a = $00 50 ld d, b Box 5: $DB99 F6 7F or $7F ; a = $7F 95 sub a, l ; a = $6C 95 sub a, l ; a = $59 BF cp a ; Set zero flag CC B7 FB call z, .write 50 ld d, b Box 6: $DBA2 AF xor a ; a = $00 F6 F8 or $F8 ; a = $F8 BF cp a ; Set zero flag CA B7 FB jp z, .write FB ei 50 ld d, b Box 7: $DBAB FB ei FB ei FB ei FB ei FB ei FB ei FB ei FB ei 50 ld d, b Box 8: $DBB4 BF cp a BF cp a BF cp a 22 ldi (hl), a BF cp a ; Set zero flag C9 ret Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C2 59 F8 jp nz, wTMsHMs
German
Box 1: $DB75 21 E2 F8 ld hl, $F8E2 AF xor a ; a = $00 84 add a, h ; a = $F8 85 add a, l ; af = $DA10 F5 push af E1 pop hl ; hl = $DA10 50 ld d, b Box 2: $DB7E 95 sub a, l ; a = $CA 87 add a ; a = $94 AC xor a, h ; a = $4E 95 sub a, l ; a = $3E C4 A9 FB call z, .write FB ei 50 ld d, b Box 3: $DB87 E6 84 and $84 ; a = $04 C4 A9 FB call z, .write AF xor a ; a = $00 F6 C3 or $C3 ; a = $C3 50 ld d, b Box 4: $DB90 C4 A9 FB call z, .write AF xor a ; a = $00 F6 7F or $7F 95 sub a, l ; a = $6C 95 sub a, l ; a = $59 50 ld d, b Box 5: $DB99 C4 A9 FB call z, .write AF xor a ; a = $00 F6 F8 or $F8 ; a = $F8 FB ei FB ei 50 ld d, b Box 6: $DBA2 C3 A9 FB jp .write FB ei FB ei FB ei FB ei 22 ldi (hl), a 50 ld d, b Box 7: $DBAB C0 ret nz Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C3 59 F8 jp wTMsHMs
Italian & Spanish
Box 1: $DB75 AF xor a ; a = $00 F6 E2 or $E2 ; a = $E2 C6 F8 add $F8 ; af = $DA10 F5 push af E1 pop hl ; hl = $DA10 FB ei 50 ld d, b Box 2: $DB7E D6 B8 sub $B8 ; a = $22 EA 9F FB ld (.write), a 85 add a, l ; a = $32 D6 F4 sub $F4 ; a = $3E 50 ld d, b Box 3: $DB87 CD 9F FB call .write C6 C6 add $C6 ; a = $04 CD 9F FB call .write 50 ld d, b Box 4: $DB90 C6 BF add $BF ; a = $C3 CD 9F FB call .write FB ei C6 96 add $96 ; a = $59 50 ld d, b Box 5: $DB99 CD 9F FB call .write C6 7F add $7F ; a = $D8 7F ld a, a 22 ldi (hl), a ; .write C9 ret Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C3 59 D8 jp wTMsHMs
Plain text transcripts of codes
Language | Box name content | Language | Box name content | Language | Box name content |
---|---|---|---|---|---|
English | Box 1: p 'v 9 é 'd 5 'v * Box 2: é H 5 'v ♂ é G 5 Box 3: A 4 é m 5 'v 9 5 Box 4: é k 5 F é 'l 5 F Box 5: 0 B 's 'v 5 u 'v c Box 6: é n 5 's k 5 'v B Box 7: 'd 5 5 2 p é 'm 5 Box 8: 'v 'd é 't 5 'v ♂ 5 Box 9: é 's 5 é n 5 v 5 Box 10: 'v L é T 2 0 9 5 Box 11: 5 5 5 5 'm 5 5 ♀ Box 12: 'v F 's k 5 F ? E Box 13: 's k 5 * 'm k 5 5 |
French | Box 1: A e 5 î u 5 5 5 Box 2: î r 5 î u 5 î r Box 3: î w 5 m ç î u 5 Box 4: p î x 5 î r 5 5 Box 5: î u 5 î u 5 0 9 Box 6: ç ç j û â ] 3 â Box 7: î [ 8 û à 5 G G Box 8: W 0 0 ç ç ô ? Mn Box 9: E ♀ Pk V H m V ç Box 10: î x 5 ? E ç ç ç Box 11: î x 5 p 0 Mn e ç Box 12: î x 5 4 g 5 5 5 Box 13: î x 5 4 h 5 û x |
German | Box 1: A q 5 W ö j 5 G Box 2: ö j 5 H W ö j 5 Box 3: p 0 2 ö j 5 W W Box 4: ö j 5 G G ö j 5 Box 5: G ö j 5 o ö j 5 Box 6: W ö j 5 G ♀ p p Box 7: Ä ♀ Ö 0 9 b Ü & Box 8: ♀ S S ♂ 5 s * E Box 9: ♀ Pk V H m V 5 5 Box 10: ö j 5 ? E ö j 5 Box 11: p 0 ä ö j 5 5 5 Box 12: 4 s 5 ö j 5 p 5 Box 13: 0 2 ä j 5 |
Italian | Box 1: é d 5 ° 9 é b 5 Box 2: ° á é c 5 È ♂ 5 Box 3: é [ 5 ° Ì é ] 5 Box 4: È ° é f 5 ° 9 5 Box 5: é g 5 0 9 5 5 2 Box 6: 5 5 Ù 5 5 p 0 Mn Box 7: E ♀ Pk ° : Ù Ì 5 Box 8: ? E Ù Ì 5 È Á Á Box 9: Ù Ì 5 È W Ù Ì 5 Box 10: ° B Í Í |
Spanish | Box 1: é d 5 ° 9 é b 5 Box 2: ° á é c 5 È ♂ 5 Box 3: é [ 5 ° Ì é ] 5 Box 4: È ñ é f 5 ° 5 5 Box 5: é g 5 0 9 5 5 2 Box 6: 5 5 Ù 5 5 p 0 Mn Box 7: E ♀ Pk ° : Ù Ì 5 Box 8: ? E Ù Ì 5 È Á Á Box 9: Ù Ì 5 È W Ù Ì 5 Box 10: ° B Í Í |
Note: "..." refers to one ellipsis character, “pk” refers to the one pk character, "$" refers to the pokédollar sign, "*" refers to the multiplication symbol. Make sure to pay careful attention to upper/lowercase letters.