Guides:Wrong Pocket TM ACE setup (non-EN)
WARNING: This portion of the guide is outdated, the contents of this guide have been merged with the main setup articles. It is only kept for legacy purposes. You can find all up-to-date guides on the TimoVM's Gen 2 ACE setups article.
|
This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Wrong pocket TMs and HMs. |
This page serves as a repository for a Wrong Pocket TM ACE setup for the French, German, Italian and Spanish versions of Pokémon Gold & Silver. It is part of the TimoVM's Gen 2 ACE setups set of guides.
The preparation is best done during daytime in-game. If needed, you can change the in-game clock with the help of this tool.
Please make sure to fully read every step of the guide before executing them.
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.
Setting up initial ACE
In the generation 2 games, items are stored in their own dedicated compartiments. All TMs and HMs are stored in their own pocket, all key items are kept in their own pocket, etc..
By glitching an item into a pocket that it's not supposed to be, we can use the item to achieve various glitchy effects. In particular, using TMs from the wrong pocket will confuse the game, causing it to treat the TM as a "normal" item and execute invalid item effects, some of which can lead to arbitrary code execution.
TM25, in particular, executes code starting from $FA6A, a duplicate of address $DA6A. This region corresponds to party pokémon #2's stat experience. In this guide, we'll go through the process of obtaining TM25 outside the TM/HM pocket, along with how to obtain a pokémon that can redirect TM25's effect to the start of box names ($D8BF).
In practice, the initial ACE setup will be created using the following general process:
- Obtain the necessary items and pokémon for the setup.
- Obtain a bad clone.
- Use the bad clone to obtain two additional bicycles. then use duplicate key items glitch to place TM25 (an ACE item) in the ball pocket.
A note on the side effects of the method described below
The method described on this page requires fairly heavy abuse of glitches that will produce a small amount of side effects. All these side effects can be fixed with later applications of ACE and are never permanently harmful for the game:
- Obtaining duplicate key items requires obtaining a glitch pokémon that cannot be manually released.
- Duplicate key item swap glitch removes the CANCEL button from the key item pocket.
Later parts of the guide will offer methods to fix these side effects.
Requirements for this guide
When playing on original cartridge or on emulator, it is absolutely required to have used the Clear Save Data feature (press SELECT + UP + B on the title screen) or have replaced the battery at least once since owning the game.
- We'll require a pokémon that has exclusively defeated a set of specific encounters within Union Cave and route 33.
- Completing the setup requires having reached Goldenrod City, to access the Day Care and the GoldenRod Dept. Store.
- Due to technical reasons, please ensure that the following is true for your trainer ID:
- Your trainer ID must not be equal or higher than 65280.
- The remainder after dividing your trainer ID by 256 must not be equal to 255.
- If your trainer ID does not fulfill both requirements, one of the methods described in the guide will not work correctly. When starting from a new save, it is recommended to reset your game until you get a compatible trainer ID. If you do not wish to reset your save, a workaround is provided that requires you to not have traded the Machop in Goldenrod City yet.
Step 1: Preparing a pokémon that can be used with wrong pocket TM25
- Either in the Union Cave or on route 33, catch a pokémon that is (preferably) at least lvl 6 and not a Hoppip. Give it a specific nickname, such as "BOXCODES" to remember that it will be used as part of a Coin Case ACE setup that executes box name codes.
- Have it fight the following pokémon and defeat them solo (order doesn't matter, the pokémon must be the only pokémon to gain experience from the battle)
- Rattata - Union Cave, Route 33, higher spawn rate in Union Cave compared to route 33
- Hoppip - Route 33
- Hoppip - Route 33
- Have it fight the following pokémon with the help of exactly one other pokémon (the experience must be shared between exactly two party pokémon)
- Onix - Union Cave
- The "BOXCODES" nicknamed pokémon must never gain experience from any other battle from this point onward
Step 2: Obtaining a bad clone through resetting while saving
A bad clone is created when you reset the game at a very specific time frame where:
- The game has saved that additional pokémon were deposited in the active box.
- The game has not yet saved the actual data of the deposited pokémon.
In combination with the Day Care, we can turn this bad clone into a glitch pokémon that we'll be using to perform a variety of glitches.
Requirements
- A box that has never been completely full at any point in the past.
- Fill this box with 15 pokémon. You can use cloning glitch to obtain the required pokémon.
- An additional pokémon that you can deposit to the PC.
Obtaining the bad clone
- Deposit any party pokémon to the current active box.
- Go to "Move pokémon w/o mail", you will get a prompt to save the game.
- Reset the game shortly after the "saving...” text is fully printed.
- If successful, upon restarting the game you will find a level 0 female version of the deposited pokémon with a glitched name. Make sure you only withdraw this pokémon to your party using "Move pokémon w/o mail" to keep it at lvl 0.
Please note that the timing of this is very strict (around frame perfect).
- If nothing was saved, the reset was too early. Wait a little bit longer to reset.
- If the pokémon was successfully cloned, the reset was too late. reset a little bit earlier.
- If the box ever gets to 19 pokémon in total, release pokémon from the box until there are only 15 pokémon present. Make sure to save normally after releasing them.
Use these guidelines and keep retrying until you've obtained a bad clone.
Step 3: Obtaining additional bicycles and getting TM25 in the ball pocket
This works in any language version on any generation 2 game, the method is based on a translation of a [blogpost from 任意コード].
This method will only work if your trainer ID fulfills both of the following requirements:
- Your trainer ID must not be equal or higher than 65280.
- The remainder after dividing your trainer ID by 256 must not be equal to 255.
If your trainer ID does not fulfill both requirements and you do not wish to reset your save, please follow the following steps:
- On route 34, catch a Drowzee.
- On the 5th floor of the Goldenrod Dept. Store and trade Drowzee for a Machop.
- Buy a TM48 (Fire Punch) and teach it to Machop. Rearrange its moves so that Fire Punch is in the second move slot.
- Using the cloning glitch, get at least six copies of Machop (it is recommended to keep some spares just to be safe). We'll be using these Machop in the remainder of the setup.
Requirements
Have the following items in the ball pocket:
- Slot 2: Poké Ball x1
- Slot 2 and beyond: empty
Have the following items in the key item pocket:
- All key items you've obtained in your save thus far (withdraw all key items (if any) you previously stored from the PC)
- Bicycle at the bottom of the key item list
Have the following pokémon in the party:
| Compatible trainer ID | Incompatible trainer ID |
|---|---|
1. Bad clone 2. Drowzee with Fire Punch in second move slot 3. Drowzee with Fire Punch in second move slot 4. Unwanted pokémon 5. Unwanted pokémon 6. Unwanted pokémon |
1. Bad clone 2. Traded Machop with Fire Punch in second move slot 3. Traded Machop with Fire Punch in second move slot 4. Traded Machop 5. Traded Machop 6. Traded Machop |
You can buy the TM for Fire Punch at the Goldenrod Dept. Store. To save on time and money, catch one Drowzee (50% encounter odds all day on route 34) and teach it Fire Punch, then clone it using cloning glitch.
Have the following pokémon in the box:
| Compatible trainer ID | Incompatible trainer ID |
|---|---|
- 1 unwanted pokémon - 1 normal pokémon |
- 1 Additional traded Machop - 1 normal pokémon |
Keep in mind that we'll be corrupting both the Drowzees and the unwanted pokémon. Make sure to only use pokémon you do not wish to keep. The normal pokémon will not be corrupted at all during this process.
Obtaining duplicate bicycles
- Deposit the bad clone in the daycare and retrieve it. It will now have turned into a glitch pokémon. Arrange your party as follows:
- Glitch pokémon
- Drowzee/traded Machop with Fire Punch in second move slot
- Drowzee/traded Machop with Fire Punch in second move slot
- Unwanted pokémon/traded Machop
- Unwanted pokémon/traded Machop
- Unwanted pokémon/traded Machop
- Using "move pokémon w/o mail", add the stored unwanted pokémon/additional traded Machop to the top of your party. This will push the glitch pokémon down to the second slot.
- Switch the glitch pokémon in the second slot with the pokémon in the fifth slot.
- Select "Deposit pokémon" from the PC and deposit the top two pokémon in your party.
- Withdraw the normal pokémon from your box and add it to the party using "Withdraw pokémon".
The party will now contain two Drowzee/Machop that will both be holding a bicycle each. Take these held items to add them to the bottom of the Key Item list. It is now safe to save.
Obtaining TM25
- Go to the bottom of the key item list. The bottom of the list should consist of three separate bicycles.
- Press select on the second bicycle and swap it with the third bicycle. The number of bicycles will decrease, the "Cancel" button will change to a "Teru-Sama" item.
- Go to the ball pocket and toss 39 of the Master Ball that is now present in your inventory. The final quantity of the item should be a number ending in "6".
- Return to the Key Item pocket, press select on the upper bicycle and swap it with the bottommost item. This leaves you with a single bicycle, will turn the "Teru-Sama" into a "Paralyz Heal" and change the item of the Ball pocket into a TM25. It is now safe to save.
Do not worry about the glitch pokémon that's still in your party or the key item list that lacks a cancel button, we'll fix both at a later point in time.
Step 4: How to execute ACE using TM25
Now that we have obtained TM25 outside of the TM/HM pocket, we'll need to set up everything needed to actually safely use it. TM25's effect is to execute code starting from party pokémon #2's stat experience data. What we'd like to do is to redirect it such that box names get executed instead:
- Prepare the party to ensure that code gets safely redirected to box names.
- Prepare specific box names to run a simple test code.
Finishing the setup
- Arrange your party like the following:
- Any
- "BOXCODES" nicknamed Pokémon that has defeated a specific set of pokémon
- Any
- Any
- Any
- Glitch pokémon used in part 31
- Finally, give the "BOXCODES" nicknamed pokémon a flower mail with the following language-specific content:
| French | German | Italian | Spanish |
|---|---|---|---|
|
|
|
|
1 This last pokémon is not strictly needed for the setup, but is placed here in order to remove it from the party with a later box name code. If you do not wish to remove it, simply replace it with an unwanted pokémon.
Preparing a test box name code
Rename the first box name to the following language-specific name. This box name code will be replaced later and is solely intended to verify if the setup is working correctly. Their only function is to safely exit ACE and return the game to normal:
| French | German | Italian | Spanish |
|---|---|---|---|
|
|
|
|
Step 5: Using Wrong Pocket TM25 ACE
In order to use ACE, always perform the following steps:
- Ensure the "BOXCODES" nicknamed pokémon is in party slot #2.
- Read the mail that was given to the nicknamed pokémon.
- Use TM25 once. This will execute ACE.
Make sure to test the setup by going through this process once. With the current box name setups, you can ensure the setup working if you can are able to use TM25 without the game crashing.
If the test code still crashes, check the following:
- Did you correctly follow the previous steps?
- Is the box name code correctly entered?
- Is the content of the mail correct for the game's language?
- Did you ensure that the nicknamed pokémon only received experiences from the four specific encounters? Were both Hoppip and Rattata defeated using only the nicknamed pokémon? Was Onix defeated such that experience was shared between the nicknamed pokémon and only one other pokémon?
Anytime you wish to execute wrong pocket TM25 ACE, make sure the "BOXCODES" nicknamed pokémon is in party slot #2 and the held mail was read before using TM25.
Setting up an ACE environment
While we now have a way to execute box name codes using ACE, the current setup has a few drawbacks:
- Executing ACE requires reading a mail before every execution
- Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.
To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.
To do that, we're going to use a box name code to obtain 255 copies of all TMs, then sell them in specific quantities to write out a program. Alongside that, the box name code will also alter a party pokémon's data. This will allow us to use the Mail Writer with TM25, as long as this pokémon is kept in the second party slot.
The mail writer itself will be installed in the TM/HM pocket through the following two step process:
- Execute a box code using Coin Case ACE that sets the quantities of all 50 TMs to x255, as well as placing a TM25 in the main item pocket. On top of that, it will modify the data of party pokémon #3 so that TM25's effect gets redirected to the start of the TM/HM pocket, as long as it is kept in the second party slot.
- Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.
Step 6: Setting all TM quantities to x255
- Rename box names to form the following language dependent codes. Please mind the differences between uppercase X (
), lowercase x (
) and multiplication symbol (
).
| French | German | Italian | Spanish |
|---|---|---|---|
|
|
|
|
- Catch any pokémon and nickname it "MAILWRITER". Put it in the third party slot. We'll alter this pokémon's stat experience to redirect TM25 execution to the TM/HM pocket
- Ensure that you have everything set up for Wrong Pocket TM25 ACE:
- "BOXCODES" nicknamed pokémon holding mail in party slot #2
- Read the correct mail beforehand
- Use TM25 once. If the code was executed successfully, switch to the TM/HM pocket. It should now contain every TM at a quantity of x255.
NOTE: due to limitations, the German version of this box code can only be used once. If you need to use it again, make sure to redo box 7's name.
Step 7: Selling TMs to form a program in the TM/HM pocket
Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using. The following table displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.
| French | German | Italian | Spanish |
|---|---|---|---|
|
|
|
|
Language independent TMs
| TM | Final Quantity | Sell value |
|---|---|---|
| TM01 DYNAMICPUNCH | x17 | 357000 |
| TM02 HEADBUTT | x85 | 170000 |
| TM03 CURSE | x221 | 51000 |
| TM04 ROLLOUT | x213 | 42000 |
| TM05 ROAR | x213 | 21000 |
| TM06 TOXIC | x213 | 63000 |
| TM07 ZAP CANNON | x33 | 222000 |
| TM08 ROCK SMASH | SEE NEXT TABLE | |
| TM09 PSYCH UP | x98 | 78500 |
| TM10 HIDDEN POWER | x207 | 72000 |
| TM11 SUNNY DAY | x225 | 30000 |
| TM12 SWEET SCENT | x209 | 23000 |
| TM13 SNORE | x42 | 106500 |
| TM14 BLIZZARD | x254 | 1500 |
| TM15 HYPER BEAM | x80 | 262500 |
| TM16 ICY WIND | x56 | 298500 |
| TM17 PROTECT | x251 | 6000 |
| TM18 RAIN DANCE | x40 | 215000 |
| TM19 GIGA DRAIN | x10 | 367500 |
| TM20 ENDURE | x135 | 180000 |
| TM21 FRUSTRATION | x134 | 60500 |
| TM22 SOLARBEAM | x18 | 355500 |
| TM23 IRON TAIL | x19 | 354000 |
| TM24 DRAGONBREATH | x35 | 330000 |
| TM25 THUNDER | x129 | 126000 |
| TM26 EARTHQUAKE | x79 | 264000 |
| TM27 RETURN | x18 | 118500 |
| TM28 DIG | x24 | 231000 |
| TM29 PSYCHIC | x239 | 16000 |
| TM30 SHADOW BALL | x33 | 333000 |
| TM31 MUD-SLAP | x1 | 381000 |
| TM32 DOUBLE TEAM | x196 | 59000 |
| TM33 ICE PUNCH | x77 | 267000 |
| TM34 SWAGGER | x205 | 25000 |
| TM35 SLEEP TALK | SEE NEXT TABLE | |
| TM36 SLUDGE BOMB | x58 | 98500 |
| TM37 SANDSTORM | x27 | 228000 |
| TM38 FIRE BLAST | x205 | 50000 |
| TM39 SWIFT | SEE NEXT TABLE | |
| TM40 DEFENSE CURL | x55 | 100000 |
| TM41 THUNDERPUNCH | x189 | 99000 |
| TM42 DREAM EATER | x40 | 322500 |
| TM43 DETECT | x217 | 19000 |
| TM44 REST | x56 | 298500 |
| TM45 ATTRACT | x240 | 22500 |
| TM46 THIEF | x254 | 1500 |
| TM47 STEEL WING | x08 | 370500 |
| TM48 FIRE PUNCH | x200 | 82500 |
| TM49 FURY CUTTER | x24 | 346500 |
| TM50 NIGHTMARE | x242 | 13000 |
Language dependent TMs
| TM | French | German | Italian | Spanish | ||||
|---|---|---|---|---|---|---|---|---|
| Final amount | Amount sold for | Final amount | Amount sold for | Final amount | Amount sold for | Final amount | Amount sold for | |
| TM08 ROCK SMASH | x43 | 106000 | x34 | 110500 | x118 | 68500 | x153 | 51000 |
| TM35 SLEEP TALK | x144 | 55500 | x230 | 12500 | x222 | 16500 | x162 | 46500 |
| TM39 SWIFT | x59 | 196000 | x135 | 120000 | x127 | 128000 | x77 | 178000 |
Running the newly written program
- It is recommended to save before continuing.
- Put the pokémon that was nicknamed "MAILWRITER" into the 2nd party slot.
- Use TM25. If everything went correctly, this will start the mail writer and open a screen asking you to input text for a mail.
- From now on, you can repeat this process at any time to start the mail writer.
If the game crashes, first recheck if all TM quantities are correct. If all quantities are correct, you may need to redo the setup for the "MAILWRITER" pokémon. This can be done using the box codes included a bit further below.
A note on the nicknamed pokémon: when running the box name code, we altered "MAILWRITER"'s stat experience data to contain a redirect to the TM/HM pocket. You can safely deposit and withdraw it from the PC. Please note that this pokémon must never gain experience after this point, otherwise you'll need to reapply the setup.
Step 8: Using the mail writer
From now on, simply go through the necessary steps to use TM25 to start up the RAM writer.
The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.
This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.
Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh", then confirm and exit the RAM writer.
Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.
Controls
Between entering mail codes, the mail writer will ask for user input.
- Press SELECT to open a new mail and continue writing data.
- Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
- Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
 |
|
| Enter your mail code, then press "END". | It prints the checksum and waits for input. |
What to do with the Mail writer
The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:
- Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as fixing the side effects of the ACE setup, editing pokémon and items, etc..
- RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.
Addendum: repairing the "MAILWRITER" pokémon
In case something happens with the "MAILWRITER" nicknamed pokémon that causes it to no longer function, you can repair the pokémon without having to reset TM quantities using the following procedure:
- Arrange the party as follows:
- Any
- "BOXCODES" pokémon holding mail
- "MAILWRITER" pokémon
- Any
- Any
- Any
- Enter the following language-specific box name. Please mind the differences between uppercase X (), lowercase x () and multiplication symbol ().
| French | German | Italian | Spanish |
|---|---|---|---|
|
|
|
|
- Read the mail held by the "BOXCODES" pokémon
- Use TM25 to execute the code. If the game crashes, doublecheck the box name code and ensure you've performed every step of the process correctly
- If the code executes succesfully, the "MAILWRITER" nicknamed pokémon has now been repaired.
Appendix
Plain text transcripts of codes
| French | German |
|---|---|
A A A A A A A A A A A A A A A A A A p û ç 2 |
A A A A A A A A A A A A A A A A A A ë y é ß 2 ë 9 é Ä 2 ä Ä 2 |
| Italian | Spanish |
A A A A A A A A A A A A A A A A A A p ñ Á 2 |
A A A A A A A A A A A A A A A A A A p ñ Á 2 |
- Test box codes
| French | German |
|---|---|
n' |
A A A A 0 9 Ä |
| Italian | Spanish |
Í |
Í |
- Set all TM quantities to x255 and set up TM25 bootstrap
| French | German |
|---|---|
Box 1: A p é 3 2 u' 9 5 Box 2: é 1 2 u' c é 5 2 Box 3: H u' L é 6 2 ? b Box 4: é , 2 u' ♂ é 2 2 Box 5: u' t é ♀ 2 é ; 4 Box 6: p u' 5 é ) 4 ] 5 Box 7: ♀ ♀ ♀ ♀ ♀ 's Box 8: ? ♀ é [ 4 u' x 5 Box 9: é ( 4 H u' z 5 5 Box 10: é : 4 n' |
Box 1: Ä Ä , 2 ö ß 2 W Box 2: ö ß 2 W ö ß 2 o Box 3: ö ß 2 w G ö ß 2 Box 4: G ö ß 2 G ö ß 2 Box 5: G ö ß 2 g ö ß 2 Box 6: p 0 ( ö ß 2 0 9 Box 7: d J 5 T S v y b Box 8: 4 ? [space] ? ß ö ß 2 Box 9: ? E ö ß 2 p 0 Ü Box 10: ö ß 2 H E ö ß 2 Box 11: p 0 ♀ ä ß 2 |
| Italian | Spanish |
Box 1: A p é 3 2 ° 9 Box 2: é 1 2 ° 7 é ) 2 Box 3: ° G é ♀ 2 é ; 4 Box 4: È d é , 2 ° ♂ Box 5: é 2 2 È 9 é 6 2 Box 6: p ° P é 5 2 0 9 Box 7: A ♀ ♀ ♀ ♀ ó Box 8: p 0 ♀ é [ 4 ° x Box 9: é ( 4 È F é : 4 Box 10: ì |
Box 1: A p é 3 2 ° 9 Box 2: é 1 2 ° 7 é ) 2 Box 3: ° G é ♀ 2 é ; 4 Box 4: È d é , 2 ° ♂ Box 5: é 2 2 È 9 é 6 2 Box 6: p ° Q é 5 2 0 9 Box 7: A ♀ ♀ ♀ ♀ ó Box 8: p 0 ♀ é [ 4 ° x Box 9: é ( 4 È F é : 4 Box 10: ì |
- Repair bootstrap
| French | German |
|---|---|
Box 1: p u' 6 é ) 4 u' F Box 2: é ; 4 u' I é [ 4 Box 3: u' w é ( 4 H u' z Box 4: é : 4 n' |
Box 1: Ä Ä ( 4 p 0 ] H Box 2: ö ß 2 ? E ö ß 2 Box 3: p 0 Ü ö ß 2 H E Box 4: ö ß 2 p 0 ♀ 5 5 Box 5: ä ß 2 |
| Italian | Spanish |
Box 1: p ° 6 é ) 4 ° G Box 2: é ; 4 ° J é [ 4 Box 3: ° x é ( 4 H ° z Box 4: é : 4 Í |
Box 1: p ° 6 é ) 4 ° G Box 2: é ; 4 ° J é [ 4 Box 3: ° x é ( 4 H ° z Box 4: é : 4 Í |
In-depth explanation of the setup
Effect of party pokémon #3
Defeating the provided list of pokémon will result in the following values at the following addresses, assuming the pokémon is in party slot #2:
DA65 00 nop DA66 75 ld [hl], l DA67 00 nop DA68 94 sub a, h DA69 00 nop DA6A C3 DA6B 00 DA6C CF jp $CF00 DA6D 00 nop DA6E 6E ld l, [hl]
Using TM25 will cause execution to jump to $DA6A, after which execution will immediately jump to $CF00, which is in the middle of the last buffered mail.
Effect of the mail
The last read mail is buffered from $CEED onward. Converting the characters from the mail to assembly results in the following, ordered by language:
French 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 4E ld c, (hl) ; Newline control character. 80 add a, b 80 add a, b AF xor a ; Located at $CF00, all values before this address are filler and will not be executed. C8 BF F8 jp z, wBoxNames ; start of box code data
German 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 4E ld c, (hl) ; Newline control character. 80 add a, b 80 add a, b C6 B8 add $B8 ; Located at $CF00, all values before this address are filler and will not be executed. a = $22 EA BE F8 ld (F8BE), a ; One byte before the start of wBoxNames C6 FF add $FF ; a = $21 EA C0 F8 ld (F8C0), a ; One byte after the start of wBoxNames C3 C0 F8 jp F8C0 ; Jump to second character of box name #1
Italian & Spanish 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 80 add a, b 4E ld c, (hl) ; Newline control character. 80 add a, b 80 add a, b AF xor a ; Located at $CF00, all values before this address are filler and will not be executed. C8 BF F8 jp z, wBoxNames ; Start of box code data
Effect of the test box name
Box name data starts from $D8BF onward. Converting the provided mail code to assembly results in the following:
French C9 ret ; Safely return to normal game operation
German (starts from $D8BE onward, content overwritten by mail) 22 ldi (hl), a 80 add a, a 21 80 80 ld hl, $8080 F6 FF or $FF ; a = $FF, reset carry & zero flag C0 ret nz ; Safely return to normal game operation
Italian & Spanish C9 ret ; Safely return to normal game operation
Effect of the setup box name code
Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.
The code overwrites part of itself to call the byteFill function. This will fill the area between $D57E and $D5AF with $FF values, setting all 50 TM quantities to 255. Separately, this code overwrites the latter half of party pokémon #5's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
French
Box 1: $D8BF 80 add a, b AF xor a ; a = $00, carry flag reset EA F9 F8 ld ($F8F9), a DE FF sbc $FF ; a = $01, carry flag set FB ei 50 ld d, b Box 2: $D8C8 EA F7 F8 ld ($F8F7), a DE A2 sbc $A2 ; a = $5E, carry flag set EA FB F8 ld ($F8FB), a 50 ld d; b Box 3: $D8D1 87 add a ; a = $BC, carry flag reset DE 8B sbc $8B ; a = $31, carry flag reset EA FC F8 ld ($F8FC), a E6 A1 or $A1 ; a = $21, carry flag reset 50 ld d, b Box 4: $D8DA EA F4 F8 ld ($F8F4), a DE EF sbc $EF ; a = $32, carry flag set EA F8 F8 ld ($F8F8), a 50 ld d, b Box 5: $D8E3 DE B3 sbc $B3 ; a = $7E, carry flag set EA F5 F8 ld ($F8F5), a EA 9D FA ld ($FA9D), a 50 ld d, b Box 6: $D8EC AF xor a ; a = $00, carry flag reset DE FC sbc $FC ; a = $04, carry flag set EA 9B FA ld ($FA9B), a 9F sbc a ; a = $FF, carry flag set FB ei 21 Box 7: $D8F5 7E F5 ld hl, wTMsHMs 01 32 00 ld bc, $0032 DC 5E 31 call c, byteFill 50 ld d, b Box 8: $D907 E6 F5 and $F5 ; a = $F5, carry flag reset EA 9E FA ld ($FA9E), a DE B7 sub $B7 ; a = $3E, carry flag reset FB ei 50 ld d, b Box 9: $D910 EA 9A FA ld ($FA9A), a 87 add a ; a = $7C, carry flag reset DE B9 sbc $B9 ; a = $C3, carry flag set FB ei FB ei 50 ld d, b Box 10: $D919 EA 9C FA ld ($FA9C), a D9 ret c 50 ld d, b Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C3 7E F5 jp wTMsHMs
German
Lead-up to wBoxNames: $D8BE
22 ldi (hl), a
Box 1: $D8BF
C0
21 F4 F8 ld hl, $F8F4 ; Corresponds to terminator of box #9's name
C4 BE F8 call nz, $F8BE ; Due to mail, a = $21
96 sub (hl) ; a = $7E
50 ld d, b
Box 2: $D8C8
C4 BE F8 call nz, $F8BE
96 sub (hl) ; a = $F5
C4 BE F8 call nz, $F8BE
AE xor (hl) ; a = $0E
50 ld d; b
Box 3: $D8D1
C4 BE F8 call nz, $F8BE
B6 or (hl) ; a = $9F
86 add (hl) ; a = $32
C4 BE F8 call nz, $F8BE
50 ld d, b
Box 4: $D8DA
86 add (hl) ; a = $C3
C4 BE F8 call nz, $F8BE
86 add (hl) ; a = $79
C4 BE F8 call nz, $F8BE
50 ld d, b
Box 5: $D8E3
86 add (hl) ; a = $31
C4 BE F8 call nz, $F8BE
A6 and (hl) ; a = $21
C4 BE F8 call nz, $F8BE
50 ld d, b
Box 6: $D8EC
AF xor a ; a = $00
F6 9A or $9A ; a = $9A
C4 BE F8 call nz, $F8BE
F6 FF or $FF ; a = $FF
21
Box 7: $D8F5
7E F5 ld hl, wTMsHMs
0E 32 ld c, $32
C4 5E 31 call nz, byteFill
21 9A
Box 8: $D907
FA ld hl, $FA9A
E6 7F and $7F ; a = $7F
E6 BE and $BE ; a = $3E
C4 BE F8 call nz, $F8BE
50 ld d, b
Box 9: $D910
E6 84 and $84 ; a = $04
C4 BE F8 call nz, $F8BE
AF xor a ; a = $00
F6 C2 or C2 ; a = $C2
50 ld d, b
Box 10: $D919
C4 BE F8 call nz, $F8BE
87 add a ; a = $84
84 add a, h ; a = $7E
C4 BE F8 call nz, $F8BE
Box 11: $D922
AF xor a
F6 F5 or $F5 ; a = $F5
C3 BE F8 jp $F8BE
Party pokémon #3's stat experience, starting from $DA9A
3E 04 ld a, $04
C2 7E F5 jp nz, wTMsHMs ; Carry and zero flag are both reset when using TM25
Italian
Box 1: $D8BF 80 add a, b AF xor a ; a = $00 EA F9 F8 ld ($F8F9), a D6 FF sub $FF ; a = $01 FB ei 50 ld d, b Box 2: $D8C8 EA F7 F8 ld ($F8F7), a D6 FD sub $FD ; a = $04 EA 9B FA ld ($FA 9B), a 50 ld d; b Box 3: $D8D1 D6 86 sub $86 ; a = $7E EA F5 F8 ld ($F8F5), a EA 9D FA ld ($FA9D), a 50 ld d, b Box 4: $D8DA C6 A3 add $A3 ; a = $21 EA F4 F8 ld ($F8F4), a D6 EF sub $EF ; a = $32 FB ei 50 ld d, b Box 5: $D8E3 EA F8 F8 ld ($F8F8), a C6 FF add $FF ; a = $31 EA FC F8 ld ($F8FC), a 50 ld d, b Box 6: $D8EC AF xor a ; a = $00 D6 8F suc $8F ; a = $71 EA FB F8 ld ($F8FB), a F6 FF or $FF ; a = $FF 21 Box 7: $D8F5 7E F5 ld hl, wTMsHMs 01 32 00 ld bc, $0032 D4 71 31 call nc, byteFill 50 ld d, b Box 8: $D907 AF xor a ; a = $00 F6 F5 or $F5 ; a = $F5 EA 9E FA ld ($FA9E) D6 B7 sub $B7 ; a = $3E 50 ld d, b Box 9: $D910 EA 9A FA ld ($FA9A), a C6 85 add $85 ; a = $C3, reset carry flag EA 9A FA ld ($FA9C), a 50 ld d, b Box 10: $D919 D0 ret c 50 ld d, b Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C3 7E F5 jp wTMsHMs
Spanish
Box 1: $D8BF 80 add a, b AF xor a ; a = $00 EA F9 F8 ld ($F8F9), a D6 FF sub $FF ; a = $01 FB ei 50 ld d, b Box 2: $D8C8 EA F7 F8 ld ($F8F7), a D6 FD sub $FD ; a = $04 EA 9B FA ld ($FA9B), a 50 ld d; b Box 3: $D8D1 D6 86 sub $86 ; a = $7E EA F5 F8 ld ($F8F5), a EA 9D FA ld ($FA9D), a 50 ld d, b Box 4: $D8DA C6 A3 add $A3 ; a = $21 EA F4 F8 ld ($F8F4), a D6 EF sub $EF ; a = $32 FB ei 50 ld d, b Box 5: $D8E3 EA F8 F8 ld ($F8F8), a C6 FF add $FF ; a = $31 EA FC F8 ld ($F8FC), a 50 ld d, b Box 6: $D8EC AF xor a ; a = $00 D6 90 suc $90 ; a = $70 EA FB F8 ld ($F8FB), a F6 FF or $FF ; a = $FF 21 Box 7: $D8F5 7E F5 ld hl, wTMsHms 01 32 00 ld bc, $0032 D4 70 31 call nc, byteFill 50 ld d, b Box 8: $D907 AF xor a ; a = $00 F6 F5 or $F5 ; a = $F5 EA 9E FA ld ($FA9E) D6 B7 sub $B7 ; a = $3E 50 ld d, b Box 9: $D910 EA 9A FA ld ($FA9A), a C6 85 add $85 ; a = $C3, reset carry flag EA 9A FA ld ($FA9C), a 50 ld d, b Box 10: $D919 D0 ret c 50 ld d, b Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C3 7E F5 jp wTMsHMs
Effect of the TM code
Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.
French
11 55 DD ld de, $DD55 D5 push de D5 push de ; .nextMail D5 push de 21 2B 62 ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C4 ld hl, $C401 ; .screenLoop 4D ld c, l CD 90 3A call PrintBCDNumber.loop 1B dec de ; .goBack CD 3B 37 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
German
11 55 DD ld de, $DD55 D5 push de D5 push de ; .nextMail D5 push de 21 22 62 ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C4 ld hl, $C401 ; .screenLoop 4D ld c, l CD E6 3A call PrintBCDNumber.loop - 1 1B dec de ; .goBack CD 87 37 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
Italian
11 55 DD ld de, $DD55 D5 push de D5 push de ; .nextMail D5 push de 21 76 62 ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C4 ld hl, $C401 ; .screenLoop 4D ld c, l CD DE 3A call PrintBCDNumber.loop 1B dec de ; .goBack CD 7F 37 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
Spanish
11 55 DD ld de, $DD55 D5 push de D5 push de ; .nextMail D5 push de 21 99 62 ld hl, _ComposeMailMessage CF rst08h, FarCall a:hl E1 pop hl D1 pop de 2A ldi a, (hl) ; .continue FE 50 cp $50 38 FB jr c, .continue 28 0A jr z, .terminator 87 add a, a 86 add a, (hl) 12 ld (de), a 13 inc de 23 inc hl 81 add a, c 4F ld c, a 12 ld (de), a 18 EF jr .continue 21 01 C4 ld hl, $C401 ; .screenLoop 4D ld c, l CD A2 3A call PrintBCDNumber.loop - 1 1B dec de ; .goBack CD 4D 37 call JoyTextDelay_ForcehJoyDown BD cp a, l ; l = $04 28 D9 jr z, .nextMail 38 F0 jr c, .displayLoop FE 08 cp $08 C8 ret z 18 F2 jr .goBack
Effect of the reset box name code
Converting the characters from box names to assembly results in the following code. This code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.
French
Box 1: $D8BF AF xor a ; a = $00, reset carry flag DE FC sbc $FC ; a = $04, set carry flag EA 9B FA ld ($FA9B), a D6 85 sbc $85 ; a = $7E, set carry flag 50 ld d, b Box 2: $D8C8 EA 9D FA ld ($FA9B), a DE 88 sbc $88 ; a = $F5, set carry flag EA 9E FA ld ($FA9E), a 50 ld d; b Box 3: $D8D1 DE B6 sub $D6 ; a = $3E, reset carry flag EA 9A FA ld ($FA9A), a 87 add a, a ; a = $7C, reset carry flag DE B9 sbc $B9 ; a = $C3, set carry flag 50 ld d, b Box 4: $D8DA EA 9C FA ld ($FA9C), a D9 reti 50 ld d, b Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C3 7E F5 jp wTMsHMs
German
Lead-up to wBoxNames: $D8BE 22 ldi (hl), a Box 1: $D8BF C0 ret nz 21 9A FA hl hl, FA9A AF xor a ; a = $00 F6 9F or $9F ; a = $9F 87 add a ; a = $3E 50 ld d, b Box 2: $D8C8 C4 BE F8 call nz, $F8BE E6 84 or $84 ; a = $04 C4 BE F8 call nz, $F8BE 50 ld d, b Box 3: $D8D1 AF xor a ; a = $00 F6 C2 or $C2 ; a = $C2 C4 BE F8 call nz, $F8BE 87 add a ; a = $84 84 add a, h ; a = $7E 50 ld d, b Box 4: $D8DA C4 BE F8 call nz, $F8BE AF xor a ; a = $00 F6 F5 or $F5 ; a = $F5 FB ei FB ei 50 ld d, b Box 5: $D8E3 C3 BE F8 call nz, $F8BE Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C2 7E F5 jp wTMsHMs ; carry and zero flag are both reset when using TM25
Italian & Spanish
Box 1: $D8BF AF xor a ; a = $00 D6 FC sub $FC ; a = $04 EA 9B FA ld ($FA9B), a D6 86 sub $86 ; a = $7E 50 ld d, b Box 2: $D8C8 EA 9D FA ld ($FA9B), a D6 89 sub $89 ; a = $F5 EA 9E FA ld ($FA9E), a 50 ld d; b Box 3: $D8D1 D6 B7 sub $D7 ; a = $3E EA 9A FA ld ($FA9A), a 87 add a, a ; a = $7C D6 B9 sub $B9 ; a = $C3 50 ld d, b Box 4: $D8DA EA 9C FA ld ($FA9C), a C9 ret 50 ld d, b Party pokémon #3's stat experience, starting from $DA9A 3E 04 ld a, $04 C3 7E F5 jp wTMsHMs