	This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Wrong pocket TMs and HMs.

This page serves as a repository for a Wrong Pocket TM ACE setup for the Japanese versions of Pokémon Gold & Silver. It is part of the TimoVM's Gen 2 ACE setups set of guides.

Please make sure to fully read every step of the guide before executing them.

If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.

Setting up initial ACE

In the generation 2 games, items are stored in their own dedicated compartiments. All TMs and HMs are stored in their own pocket, all key items are kept in their own pocket, etc..

By glitching an item into a pocket that it's not supposed to be, we can use the item to achieve various glitchy effects. In particular, using TMs from the wrong pocket will confuse the game, causing it to treat the TM as a "normal" item and execute invalid item effects, some of which can lead to arbitrary code execution.

TM17, in particular, executes code starting from $FA47, a duplicate of address $DA47. This region corresponds to party pokémon #2's data. In this guide, we'll go through the process of obtaining TM17 outside the TM/HM pocket, along with how to obtain pokémon that can redirect TM15's effect to the start of box names ($D8D2).

In practice, the initial ACE setup will be created using the following general process:

Obtain the necessary items and pokémon for the setup.
Obtain a bad clone.
Use the bad clone to obtain two additional bicycles. then use duplicate key items glitch to place TM17 (an ACE item) in the ball pocket.

When starting from a new game, it is recommended to NEVER have had a total 6 pokémon in the party. This allows you to use an easier and faster alternative method to obtain a bad clone.

A note on the side effects of the method described below

The method described on this page requires fairly heavy abuse of glitches that will produce a small amount of side effects. All these side effects can be fixed with later applications of ACE and are never permanently harmful for the game in any way:

Obtaining duplicate key items requires obtaining a glitch pokémon that cannot be manually released.
Duplicate key item swap glitch removes the CANCEL button from the key item pocket.

Later parts of the guide will offer methods to fix these side effects.

Step 1: Requirements for this guide

When playing on original cartridge or on emulator, it is absolutely required to have used the Clear Save Data feature (press SELECT + UP + B on the title screen) at least once since owning the game.

Catch a Drowzee. Can be found on route 34, 50% encounter odds at any time.
The guide requires having reached Goldenrod City, to access the Day Care and the GoldenRod Dept. Store.
Some required items need to be bought, this will take at least 6000¥.
Due to technical reasons, please ensure that the following is true for your trainer ID:
- Your trainer ID must not be equal or higher than 65280.
- The remainder after dividing your trainer ID by 256 must not be equal to 255.
If your trainer ID does not fulfill both requirements, one of the methods described in the guide will not work correctly. When starting from a new save, it is recommended to reset your game until you get a compatible trainer ID. If you do not wish to reset your save, a workaround is provided that requires you to not have traded the Machop in Goldenrod City yet.

Step 2a: Obtaining a bad clone through bug catching contest

Thanks to a JP Gold & Silver exclusive glitch, it is possible to exploit the bug catching contest to obtain a bad clone.

In combination with the Day Care, we can turn this bad clone into a glitch pokémon that we'll be using to perform a variety of glitches.

Requirements

This method is only possible if you've never had a full party at any point since starting the game. Follow step 2b if you don't fulfill this requirement.
Catch an Abra (10% spawn rate on route 34 all day). Save and reset to save on poké balls used.
In-game time needs to be tuesday/thursday/saturday to be able to participate with the bug catching contest.

Obtaining the bad clone

Have 5 pokémon in your party, with Abra as the first party pokémon.
Make sure to heal your pokémon at Goldenrod city to set it as the warp point for Teleport.
Go to the National Park and participate in the bug catching contest.
After starting the bug catching contest, turn around immediately and head back into the building. You'll be asked if you want to quit the contest. Select "No" and reenter National park.
TELEPORT to Goldenrod city. Deposit all pokémon except one. Return to the National Park.
You'll be asked if you want to quit the contest. This time, select "Yes".
After the results of the contest is announced, a lvl 0 pokémon will be added to your party that looks similar to the pokémon you previously had in the second party slot. This pokémon is the bad clone you need.
If you ever deposit this pokémon to the PC, make sure you only withdraw this pokémon to your party using "Move pokémon w/o mail" to keep it at lvl 0.

Now that you have the bad clone, continue to step 3.

Step 2b: Obtaining a bad clone through resetting while saving

A bad clone is created when you reset the game at a very specific time frame where:

The game has saved that additional pokémon were deposited in the active box.
The game has not yet saved the data of the deposited pokémon

In combination with the Day Care, we can turn this bad clone into a glitch pokémon that we'll be using to perform a variety of glitches.

Requirements

A box that has never been full at any point in the past.
Fill this box with 15 pokémon. You can use cloning glitch to obtain the required pokémon.
An additional pokémon that you can deposit to the PC.

Obtaining the bad clone

Deposit any party pokémon to the current active box.
Go to "Move pokémon w/o mail", you will get a prompt to save the game.
Reset the game shortly after the "saving...” text is fully printed.
If successful, upon restarting the game you will find a level 0 female version of the deposited pokémon with a glitched name. Make sure you only withdraw this pokémon to your party using "Move pokémon w/o mail" to keep it at lvl 0.

Please note that the timing of this is very strict (around frame perfect).

If nothing was saved, the reset was too early. Wait a little bit longer to reset.
If the pokémon was successfully cloned, the reset was too late. reset a little bit earlier.
If the box ever gets to 19 pokémon in total, release pokémon from the box until there are only 15 pokémon present. Make sure to save normally after releasing them.

Use these guidelines and keep retrying until you've obtained a bad clone.

After obtaining the bad clone, you can proceed to step 3.

Step 3: Obtaining additional bicycles and getting TM17 in the ball pocket

This works in any language version on any generation 2 game, the method is based on a translation of a [blogpost from 任意コード].

This method will only work if your trainer ID fulfills both of the following requirements:

Your trainer ID must not be equal or higher than 65280.
The remainder after dividing your trainer ID by 256 must not be equal to 255.

If your trainer ID does not fulfill both requirements and you do not wish to reset your save, please follow the following steps:

On route 34, catch a Drowzee.
On the 5th floor of the Goldenrod Dept. Store and trade Drowzee for a Machop.
Buy a TM48 (Fire Punch) and teach it to Machop. Rearrange its moves so that Fire Punch is in the second move slot.
Using the cloning glitch, get at least six copies of Machop (it is recommended to keep some spares just to be safe). We'll be using these Machop in the remainder of the setup.

Getting everything ready for the setup

If you haven't done so yet, make sure to catch a Drowzee. Can be found on route 34, 50% encounter odds at any time.
Catch any additional pokémon and nickname it "てていリ".
Go to the Goldenrod Dept. Store and buy one TM33 (FIRE PUNCH) and one TM41 (THUNDER PUNCH). TM33 (FIRE PUNCH) can be skipped if you are using the Machop method as an alternative
Teach Drowzee TM33 (FIRE PUNCH). Ensure that Fire Punch is in the 2nd move slot. This step can be skipped if you are using the Machop method as an alternative
Using Pokémon cloning, make at least the following clones:
1. Clone Drowzee twice, for a total of three Drowzee.
2. Clone the Bad Clone at least once, for a total of two Bad Clones. Ensure that the Bad Clone and all its clones are at lvl 0. You can keep it at lvl 0 by only withdrawing it using "Move pkmn w/o mail".

Collecting the items and the party needed

Have the following items in the ball pocket:

Slot 1: Poké Ball x1
Slot 2 and beyond: empty

Have the following items in the key item pocket:

All key items you've obtained in your save thus far (withdraw all key items (if any) you previously stored from the PC)
Bicycle at the bottom of the key item list

Have the following pokémon in the party:

Compatible trainer ID

Incompatible trainer ID

1. Unwanted pokémon
2. Drowzee with Fire Punch in second move slot
3. Drowzee with Fire Punch in second move slot
4. Unwanted pokémon
5. Unwanted pokémon
6. Bad clone

1. Traded Machop
2. Traded Machop with Fire Punch in second move slot
3. Traded Machop with Fire Punch in second move slot
4. Traded Machop
5. Traded Machop
6. Bad clone

Have the following pokémon in the box:

Compatible trainer ID	Incompatible trainer ID
- 1 unwanted pokémon - 1 normal pokémon	- 1 Additional traded Machop - 1 normal pokémon

Keep in mind that we'll be corrupting both the Drowzees and the unwanted pokémon. Make sure to only use pokémon you do not wish to keep. The normal pokémon will not be corrupted at all during this process.

Obtaining duplicate bicycles

Deposit the bad clone in the daycare and retrieve it. It will now have turned into a glitch pokémon. Arrange your party as follows:
1. Glitch pokémon
2. Drowzee/traded Machop with Fire Punch in second move slot
3. Drowzee/traded Machop with Fire Punch in second move slot
4. Unwanted pokémon/traded Machop
5. Unwanted pokémon/traded Machop
6. Unwanted pokémon/traded Machop
Using "move pokémon w/o mail", add the stored unwanted pokémon/additional traded Machop to the top of your party. This will push the glitch pokémon down to the second slot.
Switch the glitch pokémon in the second slot with the pokémon in the fifth slot.
Select "Deposit pokémon" from the PC and deposit the top two pokémon in your party.
Withdraw the normal pokémon from your box and add it to the party using "Withdraw pokémon".

The party will now contain two Drowzee that will both be holding a bicycle each. Take these held items to add them to the bottom of the Key Item list. It is now safe to save.

Obtaining TM17

Go to the bottom of the key item list. The bottom of the list should consist of three separate bicycles.
Press select on the second bicycle and swap it with the third bicycle. The number of bicycles will decrease, the "Cancel" button will change to a "Teru-Sama" item.
Go to the ball pocket and toss 47 of the first item. The final quantity of the first item is a number ending in "8".
Return to the Key Item pocket, press select on the upper bicycle and swap it with the bottommost item. This leaves you with a single bicycle, will turn the "Teru-Sama" into a "Paralyz Heal" and change the first item of the Ball pocket into a TM17. It is now safe to save.

Do not worry about the glitch pokémon that's still in your party or the key item list that lacks a cancel button, we'll fix both in the last step of the guide.

Step 4: How to execute ACE using TM17

Now that we have obtained TM17 outside of the TM/HM pocket, we'll need to set up everything needed to actually safely use it. TM17's effect is to execute code starting from $DA47, which is near the end of party pokémon #1's data. What we'd like to do is to redirect it such that box names get executed instead:

Prepare the party to ensure that code gets safely redirected to box names.
Prepare specific box names to run a simple test code.

Preparing the party

Arrange your party like this:
1. Any
2. Bad Clone (Needs to be lvl 0)
3. Drowzee holding a TM41
4. Pokémon nicknamed "てていリ"
5. Any
6. Glitch pokémon used in part 2¹

¹ This pokémon is not needed for the setup, but is placed here in order to remove it from the party at a later point using the RAM writer. If you do not wish to remove it, replace with an unwanted pokémon.

In order to safely use TM17, it's required to put a lvl 0 Bad Clone in the second party slot, Drowzee holding TM41 in the third party slot and a pokémon nicknamed "てていリ".

Testing the setup

Now that you have set up a party for TM17 ACE, we'll rename box names to form a specific bit of code which we'll execute when we use TM17.

Rename box code 1:

Use TM17 once. If executed successfully, it will add 255 copies of TM27 to the TM/HM pocket.

If the code crashes, check the following:

Is the Bad Clone in the second party slot, is Drowzee in the third party slot, is the nicknamed Pokémon in the fourth party slot?
Is the Bad Clone lvl 0?
Is Drowzee holding TM41?
Is the nickname "てていリ" correct?
Was the code correctly entered?

Setting up an ACE environment

Now that the ACE setup has been succesfully tested, we can start expanding the setup to more easily write arbitrary data. This will be done by installing the Mail writer, a small program installed using a set of box name codes.

Step 5: Installing the Mail Writer

For the Japanese versions of Gold & Silver, the mail writer can easily be installed as a set of box name codes. Write the following box codes:

After this is done, you can easily use the mail writer by going through the necessary steps and using TM17.

Step 6: Using the Mail writer

The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.

This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the lower left corner of the screen. This can be used to verify if a code was entered correctly.

Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.

Controls

Between entering mail codes, the mail writer will ask for user input.

Press A to open a new mail and continue writing data.
Press B to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.

Appendix

Plain text transcripts of codes

Testing box code name:

Box 1:　ョ　ベ　ゥ　シ　ゆ　の

Mail Writer:

Box 1:　ヅ　に　わ　ゆ　ゆ　ゾ　ュ　ぼ
Box 2:　ゆ　に　ヂ　ぺ　な　に　ヨ　プ
Box 3:　ゅ　ま　む　ゅ　ご　き　き　よ
Box 4:　ぐ　デ　だ　ガ　ご　き　き　よ
Box 5:　キ　デ　ド　ア　ぺ　デ　ご　？
Box 6:　だ　！　ズ　が　と　ぜ　ォ　ギ
Box 7:　ビ　ヘ　ば　で　が　ブ　ブ　ぜ
Box 8:　げ　ぜ　ォ　ま　き　ぐ　ァ　プ
Box 9:　ダ　れ　か　リ　ダ　リ　だ　ゥ

In-depth explanation of the setup

Effect of the Bad Clone

Using TM17 will trigger ACE from address $FA47 onward, an echo RAM copy of $DA47, at the start of the Bad Clone's stat values. A lvl 0 Bad Clone will be guaranteed to have a value of $05 (dec b) for each of its five stats. Since register b starts with a value of $00, decrementing b five times will result in a value of $FB in register b.

Effect of Drowzee

Translating the species ID and held item ID of Drowzee's data to assembly results in the following code:

60		ld h, b		; Since b = $FB due to the Bad Clone and hl = $FA47 due to using TM17, hl is set to $FB47.
E9		jp hl		; Jump to $FB47, corresponding to the 2nd character of party pokémon #4's nickname.

This causes a redirection of execution to a region right in front of wBoxNames. This region is mostly unused and consists of $00 values, with the exception of $D8AF which describes the current active box. After safely sliding through this region, the box name code is executed.

Effect of the nicknamed pokémon

Translating the characters of the nicknamed pokémon's name results in the following:

C3		filler
C3 B2 D8	jp wBoxNames

Effect of the test box name

Box name data starts from $D8B2 onward. Converting the provided mail code to assembly results in the following:

AF		xor a		; a = $00
3D		dec a		; a = $FF
EA 8B D5	ld ($D58B), a	; Address corresponds to TM27's quantity
C9		ret		; Return to normal game operation.

Effect of the Mail Writer

Box name data starts from $D8B2 onward. Converting the provided mail code to assembly results in the following:

Box 1: $D8B2
11 C6 DC	ld de, $DCC6
D5		push de
D5		push de		; .newMail
0E AE		ld c, $AE	; c = $AE
3E 50		ld a, $50	; a = $50

Box 2: $D8BB
D5		push de
C6 10		sub $A0		; a = $60
47		ld b, a		; bc = $60AE
C5		push bc
C6 A4		add a, $A4	; a = $04
42		ld b, d
50		ld d, b

Box 3: $D8C4
E1		pop hl		; hl = $60AE
CF		rst08H		; Farcall _ComposeMailMessage (a:hl = 04:60AE)
D1		pop de
E1		pop hl		; Set both hl and dc to the start of the newly written mail
2A		ldi a, (hl)	; .loop
B7		or a, a
B7		or a, a
D6 50		sub $50

Box 4: $D8CD
28 13		jr, .terminator
30 05		jr, .character
2A		ldi a, (hl)	; If terminator, escape loop. if newline, get new value for a and continue
B7		or a, a
B7		or a, a
D6 50		sub $50		; Ensures that new character will result in the same value when combined with the next

Box 5: $D8D6
86		add (hl)	; .character
12		ld (de), a
13		inc de
80		add a, b
47		ld b, a		; Responsible for generating checksum
12		ld (de), a
2A		ldi a, (hl)	; inc hl is not available, so this will have to do
E6 50		or $50		; Ensures that carry flag is not set

Box 6: $D8DF
30 E7		jr nc, .loop
0C		inc c		; .terminator, _ComposeMailMessage sets bc to 0000, so c = 01 after this part
26 C4		ld h, $C4
2E F4		ld l, $F4	; hl = $C4F4, bottom left screen tile
06 50		ld b, $50	; Ensures that b is consistent for the next call

Box 7: $D8E8
1A		ld a, (de)
CD 3A 33	call PrintBCDNumber.loop + 01h	; PrintBCDNumber.loop itself can't be reached, so we skip forward one byte.
26 1B		ld h, $1B	; .errorCorrection
1B		dec de		; Calling PrintBCDNumber.loop with c = 01 advances de by 1.
2E 50		ld l, $50	; hl = $1B50

Box 8: $D8F1
29		add hl, hl	; hl = $36A0
2E F4		ld l, $F4	; hl = $36F4 (address of JoyTextDelay_ForcehJoyDown)
CF		rst08H		; Farcall JoyTextDelay_ForcehJoyDown	set a = current button state
B7		or a, a		; Are any buttons pressed? if not, ask for new button states
28 E9		jr z, .terminator
42		ld b, d
50		ld d, b

Box 9: $D8FA
0F		rlca		; Is the a button pressed? If yes, start a new mail
DA B6 D8	jp c, .loop
0F		rlca		; Is the b button pressed? If yes, return and execute newly written program.
D8		ret c		; If not, another button was pressed, so decrement de to allow user to correct errors
30 EA		jr nc, .errorCorrection

Acknowledgements

Most of the setup of this page, with the exception of the final setup and the Mail Writer program, were all previously referenced in a blogpost written by flag3833753.

Guides:Wrong Pocket TM ACE setup (JP)

Contents

Setting up initial ACE

A note on the side effects of the method described below

Step 1: Requirements for this guide

Step 2a: Obtaining a bad clone through bug catching contest

Requirements

Obtaining the bad clone

Step 2b: Obtaining a bad clone through resetting while saving

Requirements

Obtaining the bad clone

Step 3: Obtaining additional bicycles and getting TM17 in the ball pocket

Getting everything ready for the setup

Collecting the items and the party needed

Obtaining duplicate bicycles

Obtaining TM17

Step 4: How to execute ACE using TM17

Preparing the party

Testing the setup

Setting up an ACE environment

Step 5: Installing the Mail Writer

Step 6: Using the Mail writer

Controls

What to do with the Mail writer

Appendix

Plain text transcripts of codes

In-depth explanation of the setup

Effect of the Bad Clone

Effect of Drowzee

Effect of the nicknamed pokémon

Effect of the test box name

Effect of the Mail Writer

Acknowledgements

Navigation menu

Guides:Wrong Pocket TM ACE setup (JP)

Setting up initial ACE

A note on the side effects of the method described below

Step 1: Requirements for this guide

Step 2a: Obtaining a bad clone through bug catching contest

Requirements

Obtaining the bad clone

Step 2b: Obtaining a bad clone through resetting while saving

Requirements

Obtaining the bad clone

Step 3: Obtaining additional bicycles and getting TM17 in the ball pocket

Getting everything ready for the setup

Collecting the items and the party needed

Obtaining duplicate bicycles

Obtaining TM17

Step 4: How to execute ACE using TM17

Preparing the party

Testing the setup

Setting up an ACE environment

Step 5: Installing the Mail Writer

Step 6: Using the Mail writer

Controls

What to do with the Mail writer

Appendix

Plain text transcripts of codes

In-depth explanation of the setup

Effect of the Bad Clone

Effect of Drowzee

Effect of the nicknamed pokémon

Effect of the test box name

Effect of the Mail Writer

Acknowledgements

Navigation menu

Search