Guides:0x1500 ACE (JP Speedrun outlines)

From Glitch City Wiki
Jump to navigation Jump to search
This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see 0x1500 control code arbitrary code execution.

This page serves as a repository on fast 0x1500 ACE setups for the Japanese versions of Pokémon Crystal. These are rough sketches aimed at getting a RAM writer up and running as fast as possible. Due to this, these guides have strict requirements, such as starting from a new game and using specific parameters. These guides are not recommended for a casual audience.

Currently, there are two separate outlines available. The first outline uses a Mail Writer that offers both a checksum and an error correcting function, but requires more setup. The second version uses a gutted version of the Mail Writer that is faster to set up, but which has both the checksum and error correcting functions removed.

When playing on cartridge or emulator, it is recommended to have previously cleared an old save by pressing SELECT + UP + B simultaneously on the start screen at least once since obtaining the cart. Otherwise you will not be able to obtain a bad clone or an unterminated name pokémon.

Guide 1: Fully functioning Mail Writer

This guide uses the rival name jump method.

Step 1: Catching a spearow

  • Start a new game. Gender doesn't matter, set in-game clock to 10:00.
  • Choose「よゾゥモろ」as the player's name.
  • Choose Totodile as your starter, nickname it 「ぜケまゅの」.
  • Proceed through the game until you get the chance to nickname your rival. Name the rival 「ゅゅてひを」
  • After obtaining poké balls, go to route 46 and catch a Spearow (30% spawn odds, morning and midday). Nickname the Spearow 「ぼオがろ」.

Step 2: Preparing the unterminated name clone

  1. Use the bad clone glitch to obtain a pokémon with an unterminated name.
    1. For this, use a box that has never been full at any point in time.
    2. Deposit a single pokémon. Attempt to save the game using "Move Pokémon w/o mail" but reset the game a bit just after the game has fully printed "SAVING... DON'T TURN OFF THE POWER".
    3. After rebooting the game, open the item back, switch to the ball pocket and close the item pack, then check the newly deposited pokémon.
    4. If the newly deposited pokémon’s nickname was changed to a bunch of question marks, you can continue with the next step. If the pokémon wasn't saved, that means the reset too early. If the pokémon was cloned, this means the reset was too late.
    5. If the amount of pokémon in the box exceeds 25, release the cloned pokémon and save the game afterwards to set the amount of stored pokémon to 20 before repeating step 2.
  2. Now that you have an unterminated name pokémon, remove all other pokémon from the box. (untested option: should also work if unterminated name pokémon is just at the top of the pokémon list?)

Step 3: Setting up the Mail Writer

Rename all boxes to the following names:

Characters Assembly 
　Box 1:　ヘ　ぷ　パ　ヅ　あ　め　ゆ　ぜ
　Box 2:　ゆ　が　ぜ　げ　ぜ　ェ　ゆ　プ
　Box 3:　ぼ　オ　き　ま　む　ゅ　ご　よ
　Box 4:　ぐ　デ　だ　ガ　ご　だ　ん　よ
　Box 5:　キ　デ　ド　ア　ぺ　デ　ご　？
　Box 6:　だ　ァ　ズ　が　な　ぜ　ォ　ギ
　Box 7:　ビ　ヘ　チ　チ　が　ビ　ブ　ギ
　Box 8:　ぜ　セ　げ　ま　き　ぐ　ァ　よ
　Box 9:　め　ヤ　ろ　ダ　ダ　リ　だ　き

　Box 1: CD 46 40 11 B1 D2 D5 2E 50
　Box 2: D5 26 2E 29 2E EB D5 42 50
　Box 3: 3E 84 B7 CF D1 E1 2A D6 50
　Box 4: 28 12 30 05 2A 30 DE D6 50
　Box 5: 86 12 13 80 47 12 2A E6 50
　Box 6: 30 E9 CD 32 0A 3D C0 06 50
　Box 7: 1A CD 90 90 26 1A 1B 06 50
　Box 8: 2E 8D 29 CF B7 28 E9 D6 50
　Box 9: D2 A2 DB 0F 0F D8 30 B7 50

Step 4: Using the ACE setup

Before executing ACE, arrange your party as follow:

  • Slot 1 - Spearow nicknamed 「ぼオがろ」
  • Slot 2 - Totodile nicknamed「ぜケまゅの」
  • Slots 3-6 need to be empty

In order to execute ACE, do the following actions:
  1. Stand in front of the PC on the second floor of any pokémon center. Take one step down, take seven steps right until you end up at the location indicated by the above screenshot on the left. Save the game here and reset.
  2. After reloading the save, take seven steps to the left and take one step up. You should now be standing right in front of the PC. (these steps need to be taken in the correct order, otherwise the setup will not work)
  3. Open the start menu, select Spearow so that you get the option to look at its summary and switch its party position as indicated by the above screenshot on the right, then exit and close the start menu.
  4. Open the PC. Open the withdraw screen so that the unterminated name pokémon's name would be displayed. Displaying this name will trigger ACE and open the Mail Writer.

How the mail writer works

Upon execution, the Mail writer will open the mail character entry screen where the player can write up to 32 different characters. After the player has confirmed the mail, the following actions take place:

  • The Mail writer will take pairs of characters and convert them into a single combined value. These values are then sequentially written, converting the 32 letter mail into a 16 byte long line of code.
  • Next, the Mail writer will display a checksum calculated from the combined value of all written bytes for the player to verify. Then the program enters a waiting state where they can either choose to write another mail, go back and correct previously written values or stop the mail writer and execute the newly written payload.
  • If the player has chosen to write a new mail, the Mail writer will open a new mail entry screen. The new mail is then also converted into a 16 byte lond line of code and placed right after the code written by the previous mail(s), allowing the player to write arbitrarily long payloads.

Step 5: Using the Mail writer

The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.

This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the lower left corner of the screen. This can be used to verify if a code was entered correctly.

Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write. A list of ready-to-use codes will be provided at the end of the guide.

Controls

Between entering mail codes, the mail writer will ask for user input.

  • Press A to open a new mail and continue writing data.
  • Press DOWN button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
  • Press any other button to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.

Due to space limitations, it is not possible to exit the Mail Writer without executing the newly written code. If you accidentally start the Mail Writer, you can safely exit by writing a mail with the contents "セス" and execute it.

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

  • Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
  • RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly way.

Guide 2: Gutted Mail Writer

This guide uses the box name jump method.

Step 1: Catching a spearow

  • Start a new game. Gender doesn't matter, set in-game clock to 10:00.
  • Choose any name as the player's name.
  • Choose Totodile as your starter. Any nickname will do.
  • Proceed through the game until you get the chance to nickname your rival. Any name will do.
  • After obtaining poké balls, go to route 46 and catch a Spearow (30% spawn odds, morning and midday). Any nickname will do.

Step 2: Preparing the unterminated name clone

  1. Use the bad clone glitch to obtain a pokémon with an unterminated name.
    1. For this, use a box that has never been full at any point in time.
    2. Deposit a single pokémon. Attempt to save the game using "Move Pokémon w/o mail" but reset the game a bit just after the game has fully printed "SAVING... DON'T TURN OFF THE POWER".
    3. After rebooting the game, open the item back, switch to the ball pocket and close the item pack, then check the newly deposited pokémon.
    4. If the newly deposited pokémon’s nickname was changed to a bunch of question marks, you can continue with the next step. If the pokémon wasn't saved, that means the reset too early. If the pokémon was cloned, this means the reset was too late.
    5. If the amount of pokémon in the box exceeds 25, release the cloned pokémon and save the game afterwards to set the amount of stored pokémon to 20 before repeating step 2.
  2. Now that you have an unterminated name pokémon, remove all other pokémon from the box. (untested option: should also work if unterminated name pokémon is just at the top of the pokémon list?)

Step 3: Setting up the Mail Writer

Rename all boxes to the following names:

Characters Assembly 
　Box 1:　ゅ　よ　は　て　ン　ろ
　Box 2:　ヘ　ぷ　パ　ヅ　あ　め　ゆ　ぜ
　Box 3:　ゆ　が　ぜ　げ　ぜ　ェ　ゆ　プ
　Box 4:　ぼ　オ　き　ま　む　ゅ　ご　よ
　Box 5:　ぐ　デ　だ　ガ　ご　だ　ん　よ
　Box 6:　キ　デ　ド　き　き　き　ご　？
　Box 7:　だ　ァ　ヘ　づ　ザ　べ　た　ギ
　Box 8:　レ　だ　ほ　ほ　が　ろ　ぜ　ツ
　Box 9:　へ　マ　ぞ　ぼ　オ　ま　ゅ　の

　Box 1: E1 D6 CA C3 A2 AB 50 50 50
　Box 2: CD 46 40 11 B1 D2 D5 2E 50
　Box 3: D5 26 2E 29 2E EB D5 42 50
　Box 4: 3E 84 B7 CF D1 E1 2A D6 50
　Box 5: 28 12 30 05 2A 30 DE D6 50
　Box 6: 86 12 13 B7 B7 B7 2A E6 50
　Box 7: 30 E9 CD 32 0A 3D C0 06 50
　Box 8: A7 30 CE CE 26 DB 2E 91 50
　Box 9: CD 9D 2F 3E 84 CF E1 C9 50
  • Author's note: this version also has a built in function to open SRAM. When the box name gets executed as part of screen, a = $CD. By subtracting $CA (third character of the first box name), we are left with a = $03. Therefore, sram bank 03 will be opened. The destination address where bytes are written to is determined by the 6th and 7th character of the second box name.

Step 4: Using the ACE setup

Before executing ACE, arrange your party as follow:

  • Slot 1 - Spearow
  • Slots 2-6 are not relevant to the setup

In order to execute ACE, do the following actions:
  1. Stand in front of the PC on the second floor of any pokémon center. Take one step down, take one step left until you end up at the location indicated by the above screenshot on the left. Save the game here and reset.
  2. After reloading the save, take one step to the right and take one step up. You should now be standing right in front of the PC. (these steps need to be taken in the correct order, otherwise the setup will not work)
  3. Open the start menu, select Spearow so that you get the option to look at its summary and switch its party position as indicated by the above screenshot on the right, then exit and close the start menu.
  4. Open the PC. Open the withdraw screen so that the unterminated name pokémon's name would be displayed. Displaying this name will trigger ACE and open the Mail Writer.

How the mail writer works

Upon execution, the Mail writer will open the mail character entry screen where the player can write up to 32 different characters. After the player has confirmed the mail, the following actions take place:

  • The Mail writer will take pairs of characters and convert them into a single combined value. These values are then sequentially written, converting the 32 letter mail into a 16 byte long line of code.
  • Next, the program enters a waiting state where they can either choose to write another mail or stop the mail writer and execute the newly written payload.
  • If the player has chosen to write a new mail, the Mail writer will open a new mail entry screen. The new mail is then also converted into a 16 byte long line of code and placed right after the code written by the previous mail(s), allowing the player to write arbitrarily long payloads.

Step 5: Using the Mail writer

The mail writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail. This will cause the mail writer to convert the newly written code into assembly.

Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write. A list of ready-to-use codes will be provided at the end of the guide.

Controls

Between entering mail codes, the mail writer will ask for user input.

  • Press A to open a new mail and continue writing data.
  • Press B to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.

Due to space limitations, it is not possible to exit the Mail Writer without executing the newly written code. If you accidentally start the Mail Writer, you can safely exit by writing a mail with the contents "セス" and execute it.

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

  • Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
  • RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly way
Retrieved from "https://glitchcity.wiki/wiki/Guides:0x1500_ACE_(JP_Speedrun_outlines)?oldid=43432"