	This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see 0x1500 control code arbitrary code execution.

This page serves as a repository on a 0x1500 ACE setup for the English, Italian and Spanish versions of Pokémon Crystal. It is part of the TimoVM's Gen 2 ACE setups set of guides.

The preparation is best done during morning or midday in-game. If needed, you can change the in-game clock with the help of this tool.

If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.

When playing on cartridge or emulator, it is required to have previously cleared an old save by pressing SELECT + UP + B simultaneously on the start screen at least once since obtaining the cart. Otherwise you will not be able to obtain a bad clone or an unterminated name pokémon.

Setting up initial ACE

Pokémon Crystal contains two important differences compared to its predecessors. Firstly, Crystal won't abort the text printing function when it encounters a $00 value, instead printing a '?' instead. Secondly, Crystal added new printing funtions related to the Mobile Game Boy Adapter, a Japanese exclusive peripheral that allowed internet connectivity through a mobile phone.

By obtaining a pokémon whose name does not contain the usual text terminator, we can force the game into printing much larger amounts of texts than would otherwise be possible. By abusing an illegal Mobile Adapter function and setting up memory in a specific way, we can escape the text printing function and trigger arbitrary code execution based on the data of the last viewed party pokémon.

In practice, the initial ACE setup will be created using the following general process:

Obtain a Spearow
Obtain an unterminated name pokémon.
Set up the currently buffered memory in such a way that we can trigger 0x1500 ACE upon seeing the name of the unterminated name pokémon.

This guide can be performed right after obtaining poké balls for the first time, but can be performed regardless of game progression.

Regarding PKHex

At the moment, this guide is incompatible with saves exported from PKHex. Upon exporting a save, PKHex will fill all currently unused data for the OT name and nickname of all boxes with text terminators, making it impossible to obtain an unterminated name pokémon.

Step 1: Obtaining a Spearow

Obtain a Spearow through one of the following methods:
- Catch a Spearow in the wild. It is recommended to catch a Spearow in the south part of route 46, which is accessible from the beginning of the game. (30% encounter odds, only during morning or midday)
- Talk to the gate guard between Goldenrod City and route 35 to obtain a Spearow.
Head to the nearest pokémon center and continue with the next step.

Step 2: Preparing the bad clone and remaining items

Use the bad clone glitch to obtain a pokémon with an unterminated name.
1. For this, use a box that has never been full at any point in time. It’s recommended to start with an empty box.
2. Deposit a single pokémon. Attempt to save the game using "Move Pokémon w/o mail" but reset the game a bit just after the game has fully printed "SAVING... DON'T TURN OFF THE POWER".
3. After rebooting the game, use a potion up to where the game brings up the party screen. the potion doesn't have to actually be used, you can cancel from here), then check the newly deposited pokémon.
4. If the newly deposited pokémon’s nickname was changed to a bunch of question marks, you can continue with the next step. If the pokémon wasn't saved, that means the reset too early. If the pokémon was cloned, this means the reset was too late.
5. If the amount of pokémon in the box exceeds 15, release the cloned pokémon and save the game afterwards to set the amount of stored pokémon to 15 before repeating step 2.
Now that you have an unterminated name pokémon, put it in box 14. Either release or move all other pokémon in the box so that the unterminated name pokémon is the only pokémon left in box 14.
You now have everything needed for the setup, you can continue with the next step.

Step 3: Testing the setup and using ACE

Now that we have everything ready, we'll be verifying the setup by testing a code that will safely exit ACE without any additional side effects. Once we have verified the setup, we can replace the test box code with another box code to apply various effects.

In order to be able to test the setup, rename box 14 to the following names:

English	Italian	Spanish

Using the ACE setup

Before executing ACE, arrange your party as follow:

Slot 1 - Spearow
Slots 2-6 aren't relevant for this setup.

Next, make sure you set up the following:

Make box 14 the current active box, ensure that the bad clone is the only pokémon in box 14.
Make sure that the box name code you wish to execute was correctly entered.

Finally, in order to execute ACE, do the following actions:

Stand in front of the PC on the second floor of any pokémon center. Take one step down, take one step left until you end up at the location indicated by the above screenshot on the left. Save the game here and reset.
After reloading the save, take one step to the right and take one step up. You should now be standing right in front of the PC. (these steps need to be taken in the correct order, otherwise the setup will not work)
Open the start menu, select Spearow so that you get the option to look at its summary and switch its party position as indicated by the above screenshot on the right, then exit and close the start menu.
Open the PC. Open the withdraw screen so that the unterminated name pokémon's name would be displayed. Displaying this name will trigger ACE. If the screen stays white, press "A" a couple of times until the box view reappears.

If the game doesn't crash, the setup was a success and you can continue to the next step.

Setting up an ACE environment

While we now have a way to execute box name codes using ACE, the current setup has a few drawbacks:

Executing ACE requires performing various specific steps, preventing us from using ACE whenever we want.
Box name codes have a limited characterset, effectively meaning that it's difficult to set up more complicated ACE effects.

To resolve this issue, we're going to install the Mail Writer. This is a 50 byte program, installed as a series of TM quantities, that will allow us to quickly and efficiently write and execute any arbitrary code we want.

To do that, we're going to use a box name code to obtain 255 copies of all TMs, then sell them in specific quantities to write out a program. Alongside that, the box name code will also add a TM15 to the main item pocket. Using this TM15, outside of the TM/HM pocket, will allow us to execute the Mail Writer at any time without requiring additional setup.

The mail writer itself will be installed in the TM/HM pocket through the following two step process:

Execute a box code using 0x1500 control code ACE that sets the quantities of all 50 TMs to x255, as well as placing a TM15 in the main item pocket and installing a setup so that using this TM15 will redirect execution to the start of the TM/HM pocket.
Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.

Step 4: Setting all TM quantities to x255

Rename box names to form the following language dependent codes. Please mind the differences between uppercase X (), lowercase x () and multiplication symbol ().


English	Italian	Spanish

Then, execute 0x1500 control code ACE using the method described in section 1.4.1

If the code was successfully executed, the TM/HM pocket should now be completely filled with 255 copies of every TM. Additionally, the first item in the main item pocket will have changed into a TM15. Using it will execute code in the TM/HM pocket. Make sure to save after verifying that the code worked.

Step 5: Selling TMs to form a program in the TM/HM pocket

Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using. The following table displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.

Once you're done selling all TMs, simply use TM15 to activate the mail writer.

English	Italian	Spanish

Language independent TMs

TM	Final Quantity	Sell value
TM01 DYNAMICPUNCH	x17	357000
TM02 HEADBUTT	x128	127000
TM03 CURSE	x210	67500
TM04 ROLLOUT	x213	42000
TM05 ROAR	x213	21000
TM06 TOXIC	x213	63000
TM07 ZAP CANNON	x33	222000
TM08 ROCK SMASH	SEE NEXT TABLE
TM09 PSYCH UP	x94	80500
TM10 HIDDEN POWER	x207	72000
TM11 SUNNY DAY	x225	30000
TM12 SWEET SCENT	x209	23000
TM13 SNORE	x42	106500
TM14 BLIZZARD	x254	1500
TM15 HYPER BEAM	x80	262500
TM16 ICY WIND	x56	298500
TM17 PROTECT	x251	6000
TM18 RAIN DANCE	x40	215000
TM19 GIGA DRAIN	x10	367500
TM20 ENDURE	x135	180000
TM21 FRUSTRATION	x134	60500
TM22 SOLARBEAM	x18	355500
TM23 IRON TAIL	x19	354000
TM24 DRAGONBREATH	x35	330000
TM25 THUNDER	x129	126000
TM26 EARTHQUAKE	x79	264000
TM27 RETURN	x18	118500
TM28 DIG	x24	231000
TM29 PSYCHIC	x239	16000
TM30 SHADOW BALL	x33	333000
TM31 MUD-SLAP	x1	381000
TM32 DOUBLE TEAM	x197	58000
TM33 ICE PUNCH	x77	267000
TM34 SWAGGER	x205	25000
TM35 SLEEP TALK	SEE NEXT TABLE
TM36 SLUDGE BOMB	x56	99500
TM37 SANDSTORM	x27	228000
TM38 FIRE BLAST	x205	50000
TM39 SWIFT	SEE NEXT TABLE
TM40 DEFENSE CURL	x53	101000
TM41 THUNDERPUNCH	x189	99000
TM42 DREAM EATER	x40	322500
TM43 DETECT	x217	19000
TM44 REST	x56	298500
TM45 ATTRACT	x240	22500
TM46 THIEF	x254	1500
TM47 STEEL WING	x08	370500
TM48 FIRE PUNCH	x200	82500
TM49 FURY CUTTER	x24	346500
TM50 NIGHTMARE	x242	13000

Language dependent TMs

TM	English		Italian		Spanish
TM	Final amount	Amount sold for	Final amount	Amount sold for	Final amount	Amount sold for
TM08 ROCK SMASH	x117	69000	x197	29000	x232	11500
TM35 SLEEP TALK	x204	25500	x186	34500	x172	41500
TM39 SWIFT	x75	180000	x57	198000	x53	202000

Once this has been done, continue to the next step.

Step 6: Using the mail writer

From now on, simply use the TM15 in the main item pocket to start up the Mail riter.

The Mail Writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.

This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.

Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh" then confirm and exit the RAM writer.

Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.

Controls

Between entering mail codes, the mail writer will ask for user input.

Press SELECT to open a new mail and continue writing data.
Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.


Enter your mail code, then press "END".	It prints the checksum and waits for input.

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.

Addendum: repairing the TM15 bootstrap

In case something happens with the TM15 bootstrap that causes it to no longer function, you can repair bootstrap without having to reset TM quantities using the following procedure:

Enter the following language-specific box names. Please mind the differences between uppercase X (), lowercase x () and multiplication symbol (). For English, boxes 8 through 13 are irrelevant for the setup and do not need to be renamed. For Italian & Spanish, boxes 7 through 13 are irrelevant for the setup and do not need to be renamed.

English	Italian	Spanish

Then, execute 0x1500 control code ACE using the method described in section 1.4.1
If the code executes succesfully without crashing the game, the bootstrap has now been repaired.

Appendix

Plain text transcripts of codes

Test box name

Language	Box name content	Language	Box name content	Language	Box name content
English	Box 14: Pk Pk h 'd	Italian	Box 14: Pk Pk Í	Spanish	Box 14: Pk Pk Í

Note: "..." refers to one ellipsis character, “pk” refers to the one pk character, "$" refers to the pokédollar sign, "*" refers to the multiplication symbol. Make sure to pay careful attention to upper/lowercase letters.

Setup box name

Language

Box name content

Language

Box name content

Language

Box name content

English

Box 1: 0 ♀ ♀ Pk ? ♂ E Pk
Box 2: ♀ Pk 'd 'v z é B 5
Box 3: 'v 9 é [SPACE] 5 'v , F
Box 4: 's [SPACE] 5 ? E 's [SPACE] 5
Box 5: 'v 's é J 5 'v 8 5
Box 6: é F 5 'v * é I 5
Box 7: 0 C 's [SPACE] 5 é H 5
Box 8: p é G 5 ♀ 'v h h
Box 9: 's [SPACE] 5 é C 5 'v B
Box 10: h 's [SPACE] 5 é D 5 *
Box 11: 'v 9 é E 5 Pk 0 9
Box 12: 's B 5 é C 5 Pk 'v
Box 13: 'v Pk é T 2 p F 1
Box 14: p 0 5 ♀ Pk 'v G 1

Italian

Box 1: 0 ♀ ♀ Pk ? ¡ E Pk
Box 2: ♀ Pk ì ° z é B 5
Box 3: ° 9 é [SPACE] 5 ° , F
Box 4: ó [SPACE] 5 ? E ó [SPACE] 5
Box 5: ° ú é I 5 ° 9 5
Box 6: é J 5 ° 8 é F 5
Box 7: È R ó [SPACE] 5 é H 5
Box 8: p é G 5 ♀ ° h h
Box 9: ó [SPACE] 5 é C 5 ° B
Box 10: h ó [SPACE] 5 é D 5 * 
Box 11: ° 9 é E 5 Pk 0 9
Box 12: ó B 5 é C 5 Pk °
Box 13: ° Pk é T 2 p F 1
Box 14: p 0 5 ♀ Pk ° G 1

Spanish

Box 1: 0 ♀ ♀ Pk ? ¡ E Pk
Box 2: ♀ Pk ì ° z é B 5
Box 3: ° 9 é [SPACE] 5 ° , F
Box 4: ó [SPACE] 5 ? E ó [SPACE] 5
Box 5: ° ó é J 5 È 5 5
Box 6: é I 5 ° 3 é F 5
Box 7: È R ó [SPACE] 5 é H 5
Box 8: p é G 5 ♀ ° h h
Box 9: ó [SPACE] 5 é C 5 ° B
Box 10: h ó [SPACE] 5 é D 5 * 
Box 11: ° 9 é E 5 Pk 0 9 
Box 12: ó B 5 é C 5 Pk ° 
Box 13: ° Pk é T 2 p F 1
Box 14: p 0 5 ♀ Pk ° G 1

Note: "..." refers to one ellipsis character, “pk” refers to the one pk character, "$" refers to the pokédollar sign, "*" refers to the multiplication symbol. Make sure to pay careful attention to upper/lowercase letters.

Reset box name

Language

Box name content

Language

Box name content

Language

Box name content

English

Box 1: p 0 Mn ♀ Pk p 0 2
Box 2: E ♀ Pk 'v y é h 5
Box 3: F 'v , h 's h 5 p
Box 4: 'v 6 h 's h 5 p p
Box 5: 0 'm 's h 5 'v M F
Box 6: 's h 5 'v B A 'd Pk
Box 7: Pk Pk p F 1

Box 14: p 0 5 ♀ Pk 'v G 1

Italian

Box 1: p 0 Mn È 2 ♀ Pk 5
Box 2: ° y é i 5 F ° ,
Box 3: Ù i 5 È È Ù i 5
Box 4: È Á Ù i 5 5 È W
Box 5: Ù i 5 È [SPACE] Ù i 5
Box 6: Pk Pk Pk p F 1 Í Í

Box 14: p 0 5 ♀ Pk ° G 1

Spanish

Box 1: p 0 Mn È 2 ♀ Pk 5
Box 2: ° y é i 5 F ° ,
Box 3: Ù i 5 È È Ù i 5
Box 4: È Á Ù i 5 5 È W
Box 5: Ù i 5 È [SPACE] Ù i 5
Box 6: Pk Pk Pk p F 1 Í Í

Box 14: p 0 5 ♀ Pk ° G 1

Note: "..." refers to one ellipsis character, “pk” refers to the one pk character, "$" refers to the pokédollar sign, "*" refers to the multiplication symbol. Make sure to pay careful attention to upper/lowercase letters.

In-depth explanation of the setup

Explanation on the 0x1500 ACE setup

This setup uses 0x1500 control code ACE. Since the page already contains an explanation on how it works, this page will focus on what the setup does to achieve its effect.

Relevant addresses for this explanation:

Address	Function
$C4A0	Starting address of wTilemap
$C4BE	Address of the tilemap where the name of the current active box will be printed when viewing the withdraw screen.
$CD70	Starting address of wBGMapBufferPointers
$D073	Address where the names of pokémon are buffered.
$D086	Address where the names of used items are buffered.
$D108	Address where the current selected party pokémon’s species is buffered.
$D109	Address where the current selected party pokémon’s party slot is buffered.

The specific movement pattern used will buffer C2 9B C4 (jp nz $C49B) at $CD70.
Selecting Spearow in the party screen will buffer 15 00 at $D108.
Viewing the unterminated name pokémon in the withdraw screen will cause the game to attempt to print its name. Since the name doesn't contain a terminator, the game will continue printing text until it find and executes the $15 control character at $D108.
The presence of the $00 at $D109 will erroneously cause the game to call $CD52. Due to the specific movement pattern and location used, the area between $CD52 and $CD70 is filled with $00 values, allowing safe passage.
Thanks to the jump buffered at $CD70, the game will jump to $C49B. Since we're in the withdraw screen, the area between $C49B and $C4A0 is filled with $00 values, allowing safe passage. The jump will always pass, since both the carry and zero flags are reset when the game calls $CD52.
Between $C4A0 and $C4BE are a bunch of screen tiles that are either blank ($7F) or edges of text boxes ($79, $7A, $7B and $7C). These opcodes are all harmless and simply load register values to other registers, allowing safe passage.
$C4BE holds the text characters of the current active box, allowing us to form arbitrary jumps to other locations in memory.

Effect of the test box name

The current active box is printed on the tilemap starting from $C4BE onward. Converting the provided box name code to assembly results in the following:

English

E1		pop hl
E1		pop hl		; popping hl twice then returning will cause the game to continue printing from de to hl. The second pop ensures hl will point to the $7000 region, allowing safe exit.
A7		and a		; reset carry flag
D0		ret nc		; Safely return to normal game operation

Italian & Spanish

E1		pop hl
E1		pop hl		; popping hl twice then returning will cause the game to continue printing from de to hl. The second pop ensures hl will point to the $7000 region, allowing safe exit.
C9		ret		; Safely return to normal game operation

Effect of the setup box name code

Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.

The code overwrites part of itself to call the byteFill function. This will fill the area between $D859 and $D88A with $FF values, setting all 50 TM quantities to 255. Separately, this code writes five bytes from $DA10 onward, the effect pointer of TM15, installing a TM15 bootstrap that redirects execution to the Mail Writer. Lastly, when combined with the mail code, it will convert the first item in the main item pocket to a TM15.

English

Box 1: $DB75
F6 F5		or $F5		; a = $F5
F5		push af
E1		pop hl		; hl = $F500
E6 EF		and $EF		; a = $E5
84		add a, h	; af = $DA10
E1		pop hl
50		ld d, b

Box 2: $DB7E
F5		push af
E1		pop hl		; hl = $DA10, overwritten to $22, ldi (hl), a
D0		ret nc		; On first pass, ignored. Taken whenever $DB7F is called
D6 B9		sub $B9		; a = $21
EA 81 FB	ld ($FB81), a
50		ld d, b

Box 3: $DB87
D6 FF		sub $FF		; a = $22
EA 7F FB	ld ($FB7F), a
D6 F4		sub $F4		; a = $2E
85		add a, l	; a = $3E, reset carry flag
50		ld d, b

Box 4: $DB90
D4 7F FB	call nc, $FB7F
E6 84		and $84		; a = $04
D4 7F FB	call nc, $FB7F
50		ld d, b

Box 5: $DB99
D6 D4		sub $D4		; a = $30
EA 89 FB	ld ($FB89), a		
D6 FE		sub $FE		; a = $32		
FB		ei
50		ld d, b

Box 6: $DBA2
EA 85 FB	ld ($FB85), a
D6 F1		sub $F1		; a = $41
EA 88 FB	ld ($FB88), a
50		ld d, b

Box 7: $DBAB
F6 82		or $82		; a = $C3, reset carry flag
D4 7F FB	call nc, $FB7F
EA 87 FB	ld ($FB87), a
50		ld d, b

Box 8: $DBB4
AF		xor a		; a = $00
EA 86 FB	ld ($FB86), a
F5		push af
D6 A7		sub $A7		; a = $59
A7		and a		; Reset carry flag
50		ld d, b

Box 9: $DBBD
D4 7F FB	call nc, $FB7F
EA 82 FB	ld ($FB82), a
D6 81		sub $81		; a = $D8
50		ld d, b

Box 10: $DBC6
A7		and a		; Reset carry flag
D4 7F FB	call nc, $FB7F
EA 83 FB	ld ($FB83), a
F1		pop af		; a = $00
50		ld d, b

Box 11: $DBCF
D6 FF		sub $FF		; a = $01
EA 84 FB	ld ($FB84), a
E1		pop hl
F6 FF		or $FF		; a = $FF
50		ld d, b

Box 12: $DBD8
D4 81 FB	call nc, $FB81	; $FB81 was rewritten to 21 59 D8 01 32 00 C3 41 30
EA 82 FB	ld ($FB82), a	; Replace $59 by $FF to prevent possible crash when viewing $59 as text 
E1		pop hl
D6 50		sub $50		; a = $AF

Box 13: $DBE1
D6 E1		sub $E1		; a = $CE
EA 93 F8	ld (wItems), a	; Replace first item in item pocket with TM15
AF		xor a		; a = $00
85		add a, l
F7		rst30h		; Resume text function, immediately hit terminator
50		ld d, b

Box 14: displayed as screen tiles at $C4BE
AF		xor a		; a = $00
F6 FB		or $FB		; a = $FB
F5		push af
E1		pop hl		; h = $FB
D6 86		sub $86		; a = $75
F7		rst30h		; hl = $FB75, de = $C4C5, jump to hl

Bootstrap: $DA10
3E 04		ld a, $04
C3 59 D8 	jp wTMsHMs

Italian

Box 1: $DB75
F6 F5		or $F5		; a = $F5
F5		push af
E1		pop hl		; hl = $F500
E6 E5		and $E5		; a = $E5
84		add a, h	; af = $DA10
E1		pop hl
50		ld d, b

Box 2: $DB7E
F5		push af
E1		pop hl		; hl = $DA10, overwritten to $22, ldi (hl), a
D0		ret nc		; On first pass, ignored. Taken whenever $DB7F is called
D6 B9		sub $B9		; a = $21
EA 81 FB	ld ($FB81), a
50		ld d, b

Box 3: $DB87
D6 FF		sub $FF		; a = $22
EA 7F FB	ld ($FB7F), a
D6 F4		sub $F4		; a = $2E
85		add a, l	; a = $3E, reset carry flag
50		ld d, b

Box 4: $DB90
D4 7F FB	call nc, $FB7F
E6 84		and $84		; a = $04
D4 7F FB	call nc, $FB7F
50		ld d, b

Box 5: $DB99
D6 D5		sub $D5		; a = $2F
EA 88 FB	ld ($FB88), a		
D6 FF		sub $FF		; a = $30		
FB		ei
50		ld d, b

Box 6: $DBA2
EA 89 FB	ld ($FB89), a
D6 FE		sub $FE		; a = $32
EA 85 FB	ld ($FB85), a
50		ld d, b

Box 7: $DBAB
C6 91		add $91		; a = $C3, reset carry flag
D4 7F FB	call nc, $FB7F
EA 87 FB	ld ($FB87), a
50		ld d, b

Box 8: $DBB4
AF		xor a		; a = $00
EA 86 FB	ld ($FB86), a
F5		push af
D6 A7		sub $A7		; a = $59
A7		and a		; Reset carry flag
50		ld d, b

Box 9: $DBBD
D4 7F FB	call nc, $FB7F
EA 82 FB	ld ($FB82), a
D6 81		sub $81		; a = $D8
50		ld d, b

Box 10: $DBC6
A7		and a		; Reset carry flag
D4 7F FB	call nc, $FB7F
EA 83 FB	ld ($FB83), a
F1		pop af		; a = $00
50		ld d, b

Box 11: $DBCF
D6 FF		sub $FF		; a = $01
EA 84 FB	ld ($FB84), a
E1		pop hl
F6 FF		or $FF		; a = $FF
50		ld d, b

Box 12: $DBD8
D4 81 FB	call nc, $FB81	; $FB81 was rewritten to 21 59 D8 01 32 00 C3 2F 30
EA 82 FB	ld ($FB82), a	; Replace $59 by $FF to prevent possible crash when viewing $59 as text 
E1		pop hl
D6 50		sub $50		; a = $AF

Box 13: $DBE1
D6 E1		sub $E1		; a = $CE
EA 93 F8	ld (wItems), a	; Replace first item in item pocket with TM15
AF		xor a		; a = $00
85		add a, l
F7		rst30h		; Resume text function, immediately hit terminator
50		ld d, b

Box 14: displayed as screen tiles at $C4BE
AF		xor a		; a = $00
F6 FB		or $FB		; a = $FB
F5		push af
E1		pop hl		; h = $FB
D6 86		sub $86		; a = $75
F7		rst30h		; hl = $FB75, de = $C4C5, jump to hl

Bootstrap: $DA10
3E 04		ld a, $04
C3 59 D8 	jp wTMsHMs

Spanish

Box 1: $DB75
F6 F5		or $F5		; a = $F5
F5		push af
E1		pop hl		; hl = $F500
E6 E5		and $E5		; a = $E5
84		add a, h	; af = $DA10
E1		pop hl
50		ld d, b

Box 2: $DB7E
F5		push af
E1		pop hl		; hl = $DA10, overwritten to $22, ldi (hl), a
D0		ret nc		; On first pass, ignored. Taken whenever $DB7F is called
D6 B9		sub $B9		; a = $21
EA 81 FB	ld ($FB81), a
50		ld d, b

Box 3: $DB87
D6 FF		sub $FF		; a = $22
EA 7F FB	ld ($FB7F), a
D6 F4		sub $F4		; a = $2E
85		add a, l	; a = $3E, reset carry flag
50		ld d, b

Box 4: $DB90
D4 7F FB	call nc, $FB7F
E6 84		and $84		; a = $04
D4 7F FB	call nc, $FB7F
50		ld d, b

Box 5: $DB99
D6 D4		sub $D4		; a = $30
EA 89 FB	ld ($FB89), a		
C6 FB		add $FB		; a = $2B		
FB		ei
50		ld d, b

Box 6: $DBA2
EA 88 FB	ld ($FB88), a
D6 F9		sub $F9		; a = $32
EA 85 FB	ld ($FB85), a
50		ld d, b

Box 7: $DBAB
C6 91		add $91		; a = $C3, reset carry flag
D4 7F FB	call nc, $FB7F
EA 87 FB	ld ($FB87), a
50		ld d, b

Box 8: $DBB4
AF		xor a		; a = $00
EA 86 FB	ld ($FB86), a
F5		push af
D6 A7		sub $A7		; a = $59
A7		and a		; Reset carry flag
50		ld d, b

Box 9: $DBBD
D4 7F FB	call nc, $FB7F
EA 82 FB	ld ($FB82), a
D6 81		sub $81		; a = $D8
50		ld d, b

Box 10: $DBC6
A7		and a		; Reset carry flag
D4 7F FB	call nc, $FB7F
EA 83 FB	ld ($FB83), a
F1		pop af		; a = $00
50		ld d, b

Box 11: $DBCF
D6 FF		sub $FF		; a = $01
EA 84 FB	ld ($FB84), a
E1		pop hl
F6 FF		or $FF		; a = $FF
50		ld d, b

Box 12: $DBD8
D4 81 FB	call nc, $FB81	; $FB81 was rewritten to 21 59 D8 01 32 00 C3 2B 30
EA 82 FB	ld ($FB82), a	; Replace $59 by $FF to prevent possible crash when viewing $59 as text 
E1		pop hl
D6 50		sub $50		; a = $AF

Box 13: $DBE1
D6 E1		sub $E1		; a = $CE
EA 93 F8	ld (wItems), a	; Replace first item in item pocket with TM15
AF		xor a		; a = $00
85		add a, l
F7		rst30h		; Resume text function, immediately hit terminator
50		ld d, b

Box 14: displayed as screen tiles at $C4BE
AF		xor a		; a = $00
F6 FB		or $FB		; a = $FB
F5		push af
E1		pop hl		; h = $FB
D6 86		sub $86		; a = $75
F7		rst30h		; hl = $FB75, de = $C4C5, jump to hl

Bootstrap: $DA10
3E 04		ld a, $04
C3 59 D8 	jp wTMsHMs

Effect of the TM code

Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.

English

11 80 D2	ld de, $D280
D5		push de
D5		push de		; .nextMail
D5		push de
21 75 5E	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C5	ld hl, $C501	; .screenLoop
4D		ld c, l
CD CC 38	call PrintBCDNumber.loop - 1
1B		dec de		; .goBack
CD 4B 35	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Italian

11 80 D2	ld de, $D280
D5		push de
D5		push de		; .nextMail
D5		push de
21 C5 5E	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C5	ld hl, $C501	; .screenLoop
4D		ld c, l
CD BA 38	call PrintBCDNumber.loop
1B		dec de		; .goBack
CD 39 35	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Spanish

11 80 D2	ld de, $D280
D5		push de
D5		push de		; .nextMail
D5		push de
21 E8 5E	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C5	ld hl, $C501	; .screenLoop
4D		ld c, l
CD AC 38	call PrintBCDNumber.loop - 1
1B		dec de		; .goBack
CD 35 35	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Effect of the reset box name code

Converting the characters from box names to assembly results in the following code. This code writes the required bootstrap to $DA10, the entrance point of Wrong Pocket TM15. This area of memory is unused but is preserved during saves.

English

Box 1: $DB75
AF		xor a		; a = $00, reset carry flag
F6 E2		or $E2		; a = $E2
F5		push af
E1		pop hl
AF		xor a		; a = $00, reset carry flag
F6 F8		or $F8		; a = $F8
50		ld d, b

Box 2: $DB7E
84		add a, h	; af = $DA10
F5		push hl
E1		pop hl		; hl = $DA10
D6 B8		sub $B8		; a = $22
EA A7 FB	ld (.write), a
50		ld d, b

Box 3: $DB87
85		add a, l	; a = $33
D6 F4		sub $F4		; a = $3E
A7		and a		; Reset carry flag
D4 A7 FB	call nc, .write
AF		xor a		; a = $00
50		ld d, b

Box 4: $DB90
D6 FC		sub $FC		; a = $04
A7		and a		; Reset carry flag
D4 A7 FB	call nc, .write
AF		xor a		; a = $00
AF		xor a
50 		ld d, b

Box 5: $DB99
F6 D2		or $D2		; a = $D2
D4 A7 FB	call nc, .write
D6 8C		sub $8C		; a = $46
85		add a, l	; a = $59
50		ld d, b

Box 6: $D8A2
D4 A7 FB	call nc, .write
D6 81		sub $81		; a = $D8, carry flag set
22		ldi (hl), a	; .write
D0		ret nc		; Skip on last pass
E1		pop hl
50		ld d, b

Box 7: $D8AC
E1		pop hl
E1		pop hl
AF		xor a		; a = $00
85		add a, l
F7		rst30h		; Resume text function, immediately hit terminator

Box 14: displayed as screen tiles at $C4BE
AF		xor a		; a = $00
F6 FB		or $FB		; a = $FB
F5		push af
E1		pop hl		; h = $FB
D6 86		sub $86		; a = $75
F7		rst30h		; hl = $FB75, de = $C4C5, jump to hl

Italian & Spanish

Box 1: $DB75
AF		xor a		; a = $00
F6 E2		or $E2		; a = $E2
C6 F8		add $F8		; af = $DA10
F5		push af
E1		pop hl		; hl = $DA10
FB		ei
50		ld d, b

Box 2: $DB7E
D6 B8		sub $B8		; a = $22
EA A8 FB	ld (.write), a
85		add a, l	; a = $32
D6 F4		sub $F4		; a = $3E
50		ld d, b

Box 3: $DB87
CD A8 FB	call .write
C6 C6		add $C6		; a = $04
CD A8 FB	call .write
50		ld d, b

Box 4: $DB90
C6 BF		add $BF		; a = $C3
CD A8 FB	call .write
FB		ei
C6 96		add $96		; a = $59
50		ld d, b

Box 5: $DB99
CD A8 FB	call .write
C6 7F		add $7F		; a = $D8
CD A8 FB	call .write
50		ld d, b

Box 6: $DBA2
E1		pop hl
E1		pop hl		; Prevent side effects when returning to text printer
E1		pop hl
AF		xor a		; a = $00
85		add a, l
F7		rst30h		; Resume text function, immediately hit terminator
22		ldi (hl), a	; .write
C9		ret

Box 14: displayed as screen tiles at $C4BE
AF		xor a		; a = $00
F6 FB		or $FB		; a = $FB
F5		push af
E1		pop hl		; h = $FB
D6 86		sub $86		; a = $75
F7		rst30h		; hl = $FB75, de = $C4C5, jump to hl

Guides:Fast 0x1500 ACE

Contents

Setting up initial ACE

Regarding PKHex

Step 1: Obtaining a Spearow

Step 2: Preparing the bad clone and remaining items

Step 3: Testing the setup and using ACE

Using the ACE setup

Setting up an ACE environment

Step 4: Setting all TM quantities to x255

Step 5: Selling TMs to form a program in the TM/HM pocket

Language independent TMs

Language dependent TMs

Step 6: Using the mail writer

Controls

What to do with the Mail writer

Addendum: repairing the TM15 bootstrap

Appendix

Plain text transcripts of codes

Test box name

Setup box name

Reset box name

In-depth explanation of the setup

Explanation on the 0x1500 ACE setup

Effect of the test box name

English

Italian & Spanish

Effect of the setup box name code

English

Italian

Spanish

Effect of the TM code

English

Italian

Spanish

Effect of the reset box name code

English

Italian & Spanish

Navigation menu

Guides:Fast 0x1500 ACE

Setting up initial ACE

Regarding PKHex

Step 1: Obtaining a Spearow

Step 2: Preparing the bad clone and remaining items

Step 3: Testing the setup and using ACE

Using the ACE setup

Setting up an ACE environment

Step 4: Setting all TM quantities to x255

Step 5: Selling TMs to form a program in the TM/HM pocket

Language independent TMs

Language dependent TMs

Step 6: Using the mail writer

Controls

What to do with the Mail writer

Addendum: repairing the TM15 bootstrap

Appendix

Plain text transcripts of codes

Test box name

Setup box name

Reset box name

In-depth explanation of the setup

Explanation on the 0x1500 ACE setup

Effect of the test box name

English

Italian & Spanish

Effect of the setup box name code

English

Italian

Spanish

Effect of the TM code

English

Italian

Spanish

Effect of the reset box name code

English

Italian & Spanish

Navigation menu

Search