Guides:Mail Writer C

From Glitch City Wiki
Jump to navigation Jump to search


WARNING: This portion of the guide is outdated, the contents of this guide have been merged with the main setup articles. It is only kept for legacy purposes. You can find all up-to-date guides on the TimoVM's Gen 2 ACE setups article.

This is a guide on how to execute and/or exploit a glitch. For a more technical overview of the glitch involved, see Mail writer.

The Mail writer is an arbitrary code execution program that allows the user to quickly and accurately write and execute arbitrary code payloads of up to a maximum size of 428 bytes. Payloads are written from wOtPartyCount onward, where enemy trainer's parties are usually buffered. It is part of the TimoVM's Gen 2 ACE setups set of guides.

This guide is applicable to the English, French , German, Italian and Spanish versions of Crystal only.

Using the Mail writer requires an ACE setup, like the one described here, that redirects execution to the start of box names.

If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.

How the mail writer works

Upon execution, the Mail writer will open the mail character entry screen where the player can write up to 32 different characters. After the player has confirmed the mail, the following actions take place:

  • The Mail writer will take pairs of characters and convert them into a single combined value. These values are then sequentially written, converting the 32 letter mail into a 16 byte long line of code.
  • Next, the Mail writer will display a checksum calculated from the combined value of all written bytes for the player to verify. Then the program enters a waiting state where they can either choose to write another mail, go back and correct previously written values or stop the mail writer and execute the newly written payload.
  • If the player has chosen to write a new mail, the Mail writer will open a new mail entry screen. The new mail is then also converted into a block of 16 bytes and placed right after the code written by the previous mail(s), allowing the player to write arbitrarily long payloads.

Installation

The mail writer itself will be installed in the TM/HM pocket through the following two step process:

  1. Execute a box code using 0x1500 control code ACE that sets the quantities of all 50 TMs to x255, as well as placing a TM15 in the main item pocket and installing a setup so that using this TM15 will redirect execution to the start of the TM/HM pocket.
  2. Sell TMs in specific quantities so that the amount of TMs in the TM/HM pocket spell out a small mail writer program.

Afterwards, simply use TM15 to start up the mail writer whenever necessary.

Step 1: setting all TM quantities to x255

  • Rename box names to form the following language dependent codes. Please mind the differences between uppercase X (), lowercase x () and multiplication symbol ().
English French German Italian Spanish
  • Then, execute 0x1500 control code ACE using the method described in the [guide here].
  • If the code was successfully executed, the TM/HM pocket should now be completely filled with 255 copies of every TM. Additionally, the first item in the main item pocket will have changed into a TM15. Using it will execute code in the TM/HM pocket. Make sure to save after verifying that the code worked.

NOTE: due to limitations, the German and French versions of the box name ode can only be used once. If you need to activate its effect again, reset all box names to their original values before executing ACE.

Step 2: Selling TMs to form a program in the TM/HM pocket

Now that we have obtained x255 of every TM, we'll be selling specific amounts of these in order to form a program. This program differs slightly depending on the specific language you're using. The following table displays how many TMs of each kind you need to end up with, along with the amount of money you gain by selling them.

Once you're done selling all TMs, simply use TM15 to activate the mail writer.

English French German Italian Spanish

Language independent TMs

TM Final Quantity Sell value
TM01 DYNAMICPUNCH x17 357000
TM02 HEADBUTT x128 127000
TM03 CURSE x210 67500
TM04 ROLLOUT x213 42000
TM05 ROAR x213 21000
TM06 TOXIC x213 63000
TM07 ZAP CANNON x33 222000
TM08 ROCK SMASH SEE NEXT TABLE
TM09 PSYCH UP x94 80500
TM10 HIDDEN POWER x207 72000
TM11 SUNNY DAY x225 30000
TM12 SWEET SCENT x209 23000
TM13 SNORE x42 106500
TM14 BLIZZARD x254 1500
TM15 HYPER BEAM x80 262500
TM16 ICY WIND x56 298500
TM17 PROTECT x251 6000
TM18 RAIN DANCE x40 215000
TM19 GIGA DRAIN x10 367500
TM20 ENDURE x135 180000
TM21 FRUSTRATION x134 60500
TM22 SOLARBEAM x18 355500
TM23 IRON TAIL x19 354000
TM24 DRAGONBREATH x35 330000
TM25 THUNDER x129 126000
TM26 EARTHQUAKE x79 264000
TM27 RETURN x18 118500
TM28 DIG x24 231000
TM29 PSYCHIC x239 16000
TM30 SHADOW BALL x33 333000
TM31 MUD-SLAP x1 381000
TM32 DOUBLE TEAM x197 58000
TM33 ICE PUNCH x77 267000
TM34 SWAGGER x205 25000
TM35 SLEEP TALK SEE NEXT TABLE
TM36 SLUDGE BOMB x56 99500
TM37 SANDSTORM x27 228000
TM38 FIRE BLAST x205 50000
TM39 SWIFT SEE NEXT TABLE
TM40 DEFENSE CURL x53 101000
TM41 THUNDERPUNCH x189 99000
TM42 DREAM EATER x40 322500
TM43 DETECT x217 19000
TM44 REST x56 298500
TM45 ATTRACT x240 22500
TM46 THIEF x254 1500
TM47 STEEL WING x08 370500
TM48 FIRE PUNCH x200 82500
TM49 FURY CUTTER x24 346500
TM50 NIGHTMARE x242 13000

Language dependent TMs

TM English French German Italian Spanish
Final amount Amount sold for Final amount Amount sold for Final amount Amount sold for Final amount Amount sold for Final amount Amount sold for
TM08 ROCK SMASH x117 69000 x122 66500 x99 78000 x197 29000 x232 11500
TM35 SLEEP TALK x204 25500 x175 40000 x182 36500 x186 34500 x172 41500
TM39 SWIFT x75 180000 x56 199000 x53 202000 x57 198000 x53 202000

Once this has been done, continue to the next step.

Using the mail writer

From now on, simply use the TM15 in the main item pocket to start up the Mail riter.

The Mail Writer will open a screen that asks you to write the contents of a mail. This is where you'll need to enter mail codes. Once done, use the "END" option to finish the mail.

This will cause the mail writer to convert the newly written code into assembly. It will also print a checksum (sum of all written values) on the screen just to the right of the lower row. This can be used to verify if a code was entered correctly.

Due to a lack of available memory in the TM/HM pocket, it is not possible to quit the RAM writer without executing the newly written code. If you ever accidentally activate the mail writer and would like to quit, simply write a mail containing "Rh" then confirm and exit the RAM writer.

Assembly can easily be converted to mail codes using TimoVM's MailConverter. Simply paste the assembly of the code you wish to enter here, press "run" and the converter will automatically generate mail codes requiring the least amount of button presses to write.

Controls

Between entering mail codes, the mail writer will ask for user input.

  • Press SELECT to open a new mail and continue writing data.
  • Press START to immediately jump to and start executing the newly written program. Only use this when you've finished every mail.
  • Press any other button to go back one byte at a time to correct errors. If the printed checksum doesn't match the expected checksum, press DOWN 16 times to retry the last mail. This will also overwrite the printed checksum with the value at the currently selected address, giving you a method to check how far back you're going.
Enter your mail code, then press "END". It prints the checksum and waits for input.

What to do with the Mail writer

The Mail writer allows you to easily write and execute arbitrary payloads. Aside from writing your own codes, we recommend the following:

  • Mail codes: this page contains a collection of assembly for mail codes that can be used for a variety of common purposes such as editing pokémon, obtaining items, etc..
  • RAM writer: (recommended for more experienced users) this page contains the assembly for a large one-size-fits all program that allows you to edit any value in RAM with a user-friendly GUI. It will also fix the side effects of the ACE setup when you first run it.

Addendum: repairing the TM15 bootstrap

In case something happens with the TM15 bootstrap that causes it to no longer function, you can repair bootstrap without having to reset TM quantities using the following procedure:

  • Enter the following language-specific box names. Please mind the differences between uppercase X (), lowercase x () and multiplication symbol ().
English French German Italian Spanish
  • Execute 0x1500 ACE using the usual steps.
  • If the code executes succesfully without crashing the game, the bootstrap has now been repaired.

Appendix: in-depth explanation of the setup

Effect of the setup box name code

Converting the characters from box names to assembly results in the following code. Please note that the box name code overwrites part of itself, the translated assembly assumes the code was already used once.

The code overwrites part of itself to call the byteFill function. This will fill the area between $D859 and $D88A with $FF values, setting all 50 TM quantities to 255. Separately, this code writes five bytes from $DA10 onward, the effect pointer of TM15, installing a TM15 bootstrap that redirects execution to the Mail Writer. Lastly, when combined with the mail code, it will convert the first item in the main item pocket to a TM15.

English

Box 1: $DB75
AF		xor a		; a = $00
D6 FF		sub $FF		; a = $01
EA D0 FB	ld ($FBD0), a
D6 F1		sub $F1		; a = $10
50		ld d; b

Box 2: $DB7E
EA 87 FB	ld ($FB87), a
D6 EF		sub $EF		; a = $21
EA 86 FB	ld ($FB87), a
21

Box 3: $DB87
   10 FA	ld hl, $FA10	; Execution pointer of wrong pocket TM15
EA AC FB	ld ($F8AC), a
D6 FF		sub $FF		; a = $22
FB		ei
50		ld d, b

Box 4: $DB90
EA AA FB	ld ($FBAA), a
85		add a, l	; a = $32
EA D1 FB	ld ($FBD1), a
85		add a, l	; a = $42
50		ld d, b

Box 5: $DB99
F6 81		or $81		; a = $C3, reset carry flag
D4 D6 FB	call nc, .setupBootStrap
B4		or a, h		; a = $FB
D6 A2		sub $A2		; a = $59, reset carry flag
50		ld d, b

Box 6: $DBA2
EA AD FB	ld ($FBAD), a
D4 AA FB	call nc, .writeBootstrap
D6 81		sub $81		; a = $D8, set carry flag
22		ldi (hl), a	; .writeBootstrap

Box 7: $DBAB
D0		ret nc
21 59 F8	ld hl, $F859	; $59 will later be overwritten to $41 to prevent crashing when viewing the newly written name
AF		xor a		; a = $00
EA D2 FB	ld ($FBD2), a
50		ld d, b

Box 8: $DBB4
D6 D0		sub $D0		; a = $30
EA D5 FB	ld ($FBD5), a
D6 EF		sub $EF		; a = $41
FB		ei
50		ld d, b

Box 9: $DBBD
EA D4 FB	ld ($FBD4), a
EA AD FB	ld ($FBAD), a	; Overwrites part of box #7 to prevent a crash
B5		or a, l		; a = $59
FB		ei
50		ld d, b

Box 10: $DBC6
D6 8B		sub $8B		; a = $CE
EA 93 F8	ld (wItems), a	; Main item pocket, item #1's ID
F6 FF		or $FF		; a = $FF, reset carry flag
FB		ei
50		ld d, b

Box 11: $DBCF
FB		ei
01 32 00	ld bc, 0032
D2 41 30	jp nc, byteFill
F5		push af		; .SetupBootStrap
50		ld d, b

Box 12: $DBD8
D6 85		sub $85		; a = 3E, reset carry flag
D4 AA FB	call nc, .writeBootstrap
85		add a, l	; a = $4F
E6 84		and $84		; a = $04, reset carry flag
50		ld d, b

Box 13: $DBE1
D4 AA FB	call nc, .writeBootstrap
F1		pop af		; a = $C3, reset carry flag
D2 AA FB	jp nc, .writeBootstrap
FB
50

Bootstrap: $DA10
3E 04		ld a, $04
C3 59 D8 	jp wTMsHMs

French

Box 1: $DB75
21 A4 FB	ld hl, $FBA4
CC B4 FB	call z, .subhl
FB		ei
FB		ei
50		ld d, b

Box 2: $DB7E
CC B1 FB	call z, .addhl
CC B4 FB	call z, .subhl
CC B1 DB	call z, .addhl

Box 3: $DB87
CC B6 FB	call z, .xorhl
AC		xor a, h	; a = $32
BF		cp a		; Set zero flag
CC B4 FB	call z, .subhl
50		sub d, b

Box 4: $DB90
AF		xor a		; a = $00
CC B7 FB	call z, .xorhl
CC B1 FB	call z, .addhl
FB		ei
50		ld d, b

Box 5: $DB99
CC B4 FB	call z, .subhl
CC B4 FB	call z, .subhl
F6 FF		or $FF		; a = $FF
50

Box 6: $DBA2
BF		cp a		; Set zero flag
BF		cp a
57		ld d, a		; Hides newly written box name from player, preventing crash due to $59 appearing
21 59 F8	ld hl, $F859
01 32 00	ld bc, $0032

Box 7: $DBAB
CC 2E 30	call z, byteFill
CA BA FB	jp z, .skip
86		add (hl)	; .addhl
86		add (hl)
50

Box 8: $DBB4
96		sub (hl)	; .subhl
AE		xor (hl)
AE		xor (hl)	; .xorhl
22		ldi (hl), a	; .hl
BF		cp a		; Set zero flag
C9		ret
E6 E2	and $E2			; a = $E2, .skip
50		ld d, b

Box 9: $DBBD
84		add a, h	; a = $DB, f = $10
F5		push af
E1		pop hl		; hl = $DA10
95		sub a, l	; a = $CB
87		add a, a	; a = $96
AC		xor a, h	; a = $4E
95		sub a, l	; a = $3E
BF		cp a		; Set zero flag
50		ld d, b

Box 10: $DBC6
CC B7 FB	call z, .hl
E6 84		and $84		; a = $04
BF		cp a		; Set zero flag
BF		cp a
BF		cp a
50		ld d, b

Box 11: $DBCF
CC B7 FB	call z, .hl
AF		xor a		; a = $00
F6 E2		or $E2		; a = $E2
A4		and a, h	; a = $C2
BF		cp a		; Set zero flag
50		ld d, b

Box 12: $DBD8
CC B7 FB	call z, .hl
FA A6 FB	ld ($FBA6), a	; a = $59, zero flag still set
FB		ei
FB		ei
50		ld d, b

Box 13: $DBE1
CC B7 FB	call z, .hl
FA A7 FB	ld ($FBA7), a	; a = $F8, zero flag still set
CA B7 DB	jp z, .hl

Bootstrap: $DA10
3E 04		ld a, $04
C3 59 F8 	jp wTMsHMs

German

Box 1: $DB75
21 B0 FB	ld hl, $FBB0
96		sub a, (hl)	; a = $5F
C4 A9 FB	call nz, .write
86		add a, (hl)	; a = $21
50		ld d, b

Box 2: $DB7E
C4 A9 FB	call nz, .write
87 		add a, a	; a = $42
96		sub a, (hl)	; a = $59
C4 A9 FB	call nz, .write
50		ld d, b

Box 3: $DB87
AF		xor a		; a = $00, zero flag set
F6 F8		or $F8		; a = $F8, reset zero flag
C4 A9 FB	call nz, .write
96		sub a, (hl)	; a = $75
96		sub a, (hl)	; a = $0E
50		ld d, b

Box 4: $DB90
C4 A9 FB	call nz, .write
86		add a, (hl)	; a = $A0
86		add a, (hl)	; a = $32
C4 A9 FB	call nz, .write
50		ld d, b

Box 5: $DB99
86		add a, (hl)	; a = $C4
C4 A9 FB	call nz, .write
AE		xor a, (hl)	; a = $2B
C4 A9 FB	call nz, .write
50		ld d, b

Box 6: $DBA2
96		sub a, (hl)	; a = $30
C4 A9 FB	call nz, .write
86		add a, (hl)	; a = $E2
F5		push hl
AF		xor a		; a = $00, set zero flag
22		ldi (hl), a	; .write
50		ld d, b

Box 7: $DBAB
C0		ret nz	
F5		push af
C1		pop bc		; bc = $0080
F6 FF		or $FF		; a = $FF, reset zero flag
5F		ld e, a
21 59 F8	ld hl, wTMsHMs

Box 8: $DBB4
0E 32	ld c, $32		; bc = $0032
C4 2B 30	call nz, byteFill
00		nop
F1		pop af		; a = $E2
84		add a, h	; af = $DA10
50		ld d, b

Box 9: $DBBD
F5		push af
E1		pop hl
95		sub a, l	; a = $CA
87		add a		; a = $94
AC		xor a, h	; a = $4E
95		sub a, l	; a = $3E, reset zero flag
FB		ei
FB		ei
50		ld d, b

Box 10: $DBC6
C4 A9 FB	call nz, .write
E6 84		and $84		; $04
C4 A9 FB	call nz, .write
50		ld d, b

Box 11: $DBCF
AF		xor a		; a = $00
F6 C3		or $C3		; a = $C3
C4 A9 FB	call nz, .write
FB		ei
FB		ei
50		ld d, b

Box 12: $DBD8
FA B2 FB	ld ($FBB2), a	; a = $59
C4 A9 FB	call nz, .write
AF		xor a		; a = $00
FB		ei
50		ld d, b

Box 13: $DBE1
F6 F8		or $F8
C3 A9 FB	jp .write 

Bootstrap: $DA10
3E 04		ld a, $04
C3 59 F8 	jp wTMsHMs

Italian

Box 1: $DB75
EA A3 FB	ld ($FBA3), a	; Due to mail, a = $00
D6 FF		sub $FF		; a = $01
EA A1 FB	ld ($FBA1), a
50		ld d, b

Box 2: $DB7E
D6 CF		sub $CF		; a = $32
EA A2 FB	ld ($FBA2), a
C6 EF		add $EF		; a = $21
FB		ei
50		ld d, b

Box 3: $DB87
EA 9E FB	ld ($FB9E), a
D6 C8		sub $C8		; a = $59
EA 9F FB	ld ($FB9F), a
50		ld d, b

Box 4: $DB90
C6 D6		add $D6		; a = $2F
EA A5 FB	ld ($FBA5), a
D6 FF		sub $FF		; a = $30
FB		ei
50		ld d, b

Box 5: $DB99
EA A6 FB	ld ($FBA6), a
F6 FF		or $FF
21 59 F8	ld hl, wTMsHMs	; $59 gets overwritten to $D8 to prevent a crash upon viewing the newly written box name
01

Box 6: $DBA2
   32 00	ld bc, $0032
CD 2F 30	call byteFill
AF		xor a		; a = $00
F6 E2		or $E2		; a = $E2
50		ld d, b

Box 7: $DBAB
84		add a, h	; af = $DA10
F5		push af
E1		pop hl
D6 9C		sub $9C		; a = $3E
CD C8 FB	call .write
50		ld d, b

Box 8: $DBB4
E6 84		and $84		; a = $04
CD C8 FB	call .write
C6 BF		add $BF		; a = $C3
BF		cp a
50		ld d, b

Box 9: $DBBD
CD C8 FB	call .write
C6 96		add $96		; a = $59
CD C8 FB	call .write
50		ld d, b

Box 10: $DBC6
D6 81		sub $81		; a = $D8
22		ldi (hl), a	; .write
C9		ret

Bootstrap: $DA10
3E 04		ld a, $04
C3 59 D8 	jp wTMsHMs

Spanish

Box 1: $DB75
EA A3 FB	ld ($FBA3), a	; Due to mail, a = $00
D6 FF		sub $FF		; a = $01
EA A1 FB	ld ($FBA1), a
50		ld d, b

Box 2: $DB7E
D6 CF		sub $CF		; a = $32
EA A2 FB	ld ($FBA2), a
C6 EF		add $EF		; a = $21
FB		ei
50		ld d, b

Box 3: $DB87
EA 9E FB	ld ($FB9E), a
D6 C8		sub $C8		; a = $59
EA 9F FB	ld ($FB9F), a
50		ld d, b

Box 4: $DB90
C6 D2		add $D2		; a = $2B
EA A5 FB	ld ($FBA5), a
D6 FB		sub $FF		; a = $30
FB		ei
50		ld d, b

Box 5: $DB99
EA A6 FB	ld ($FBA6), a
F6 FF		or $FF
21 59 F8	ld hl, wTMsHMs	; $59 gets overwritten to $D8 to prevent a crash upon viewing the newly written box name
01

Box 6: $DBA2
   32 00	ld bc, $0032
CD 2B 30	call byteFill
AF		xor a		; a = $00
F6 E2		or $E2		; a = $E2
50		ld d, b

Box 7: $DBAB
84		add a, h	; af = $DA10
F5		push af
E1		pop hl
D6 9C		sub $9C		; a = $3E
CD C8 FB	call .write
50		ld d, b

Box 8: $DBB4
E6 84		and $84		; a = $04
CD C8 FB	call .write
C6 BF		add $BF		; a = $C3
BF		cp a
50		ld d, b

Box 9: $DBBD
CD C8 FB	call .write
C6 96		add $96		; a = $59
CD C8 FB	call .write
50		ld d, b

Box 10: $DBC6
D6 81		sub $81		; a = $D8
22		ldi (hl), a	; .write
C9		ret

Bootstrap: $DA10
3E 04		ld a, $04
C3 59 D8 	jp wTMsHMs

Effect of the TM code

Converting the TM quantities to assembly results in the following code. Please note that this code requires a value of $04 in register a in order to properly work.

English

11 80 D2	ld de, $D280
D5		push de
D5		push de		; .nextMail
D5		push de
21 75 5E	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C5	ld hl, $C501	; .screenLoop
4D		ld c, l
CD CC 38	call PrintBCDNumber.loop - 1
1B		dec de		; .goBack
CD 4B 35	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

French

11 80 D2	ld de, $D280
D5		push de
D5		push de		; .nextMail
D5		push de
21 7A 5E	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C5	ld hl, $C501	; .screenLoop
4D		ld c, l
CD AF 38	call PrintBCDNumber.loop
1B		dec de		; .goBack
CD 38 35	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

German

11 80 D2	ld de, $D280
D5		push de
D5		push de		; .nextMail
D5		push de
21 63 5E	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C5	ld hl, $C501	; .screenLoop
4D		ld c, l
CD B6 38	call PrintBCDNumber.loop - 1
1B		dec de		; .goBack
CD 35 35	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Italian

11 80 D2	ld de, $D280
D5		push de
D5		push de		; .nextMail
D5		push de
21 C5 5E	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C5	ld hl, $C501	; .screenLoop
4D		ld c, l
CD BA 38	call PrintBCDNumber.loop
1B		dec de		; .goBack
CD 39 35	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Spanish

11 80 D2	ld de, $D280
D5		push de
D5		push de		; .nextMail
D5		push de
21 E8 5E	ld hl, _ComposeMailMessage
CF		rst08h, FarCall a:hl
E1		pop hl
D1		pop de
2A		ldi a, (hl)	; .continue
FE 50		cp $50
38 FB		jr c, .continue
28 0A		jr z, .terminator
87		add a, a
86		add a, (hl)
12		ld (de), a
13		inc de
23		inc hl
81		add a, c
4F		ld c, a
12		ld (de), a
18 EF		jr .continue
21 01 C5	ld hl, $C501	; .screenLoop
4D		ld c, l
CD AC 38	call PrintBCDNumber.loop - 1
1B		dec de		; .goBack
CD 35 35	call JoyTextDelay_ForcehJoyDown
BD		cp a, l		; l = $04
28 D9		jr z, .nextMail
38 F0		jr c, .displayLoop
FE 08		cp $08
C8		ret z
18 F2		jr .goBack

Effect of the reset box name code

Converting the characters from box names to assembly results in the following code. This code overwrites the latter half of party pokémon #3's stat experience data, allowing it to function as a TM25 bootstrap that redirects execution to the Mail Writer.

English

Box 1: $DB75
AF		xor a		; a = $00, reset carry flag
F6 E2		or $E2		; a = $E2
F5		push af
E1		pop hl
AF		xor a		; a = $00, reset carry flag
F6 F8		or $F8		; a = $F8
50		ld d, b

Box 2: $DB7E
84		add a, h	; af = $DA10
F5		push hl
E1		pop hl		; hl = $DA10
D6 B8		sub $B8		; a = $22
EA A8 FB	ld (.write), a
50		ld d, b

Box 3: $DB87
85		add a, l	; a = $33
D6 F4	sub $F4		; a = $3E
A7		and a		; Reset carry flag
D4 A8 FB	call nc, .write
AF		xor a		; a = $00
50		ld d, b

Box 4: $DB90
D6 FC		sub $FC		; a = $04
A7		and a		; Reset carry flag
D4 A8 FB	call nc, .write
AF		xor a		; a = $00
AF		xor a
50 		ld d, b

Box 5: $DB99
F6 D2		or $D2		; a = $D2
D4 A8 FB	call nc, .write
D6 8C		sub $8C		; a = $46
85		add a, l	; a = $59
50		ld d, b

Box 6: $D8A2
D4 A8 FB	call nc, .write
D6 81		sub $81		; a = $D8
A7		and a		; Reset carry flag
22		ldi (hl), a	; .write
D0		call nc

Party pokémon #3's stat experience, starting from $DA9A
3E 04		ld a, $04
D2 59 D8	jp nc, wTMsHMs

French

Box 1: $DB75
21 E2 F8	ld hl, $F8E2
AF		xor a		; a = $00
84		add a, h	; a = $F8
85		add a, l	; af = $DA10
F5		push af
E1		pop hl		; hl = $DA10
50		ld d, b

Box 2: $DB7E
95		sub a, l	; a = $CA
87		add a		; a = $94
AC		xor a, h	; a = $4E
95		sub a, l	; a = $3E
BF		cp a		; Set zero flag
BF		cp a
CC B7 DB	call z, .write

Box 3: $DB87
E6 84		and $84		; a = $04
BF		cp a		; Set zero flag
CC B7 FB	call z, .write
AF		xor a		; a = $00
AF		xor a
50		ld d, b

Box 4: $DB90
F6 E2		or $E2		; a = $E2
A4		and a, h	; a = $C2
BF		cp a		; Set zero flag
CC B7 FB	call z, .write
AF		xor a		; a = $00
50		ld d, b

Box 5: $DB99
F6 7F		or $7F		; a = $7F
95		sub a, l	; a = $6C
95		sub a, l	; a = $59
BF		cp a		; Set zero flag
CC B7 FB	call z, .write
50		ld d, b

Box 6: $DBA2
AF		xor a		; a = $00
F6 F8		or $F8		; a = $F8
BF		cp a		; Set zero flag
CA B7 FB	jp z, .write
FB		ei
50		ld d, b

Box 7: $DBAB
FB		ei
FB		ei
FB		ei
FB		ei
FB		ei
FB		ei
FB		ei
FB		ei
50		ld d, b

Box 8: $DBB4
BF		cp a
BF		cp a
BF		cp a
22		ldi (hl), a
BF		cp a		; Set zero flag
C9		ret

Party pokémon #3's stat experience, starting from $DA9A
3E 04		ld a, $04
C2 59 F8	jp nz, wTMsHMs

German

Box 1: $DB75
21 E2 F8	ld hl, $F8E2
AF		xor a		; a = $00
84		add a, h	; a = $F8
85		add a, l	; af = $DA10
F5		push af
E1		pop hl		; hl = $DA10
50		ld d, b

Box 2: $DB7E
95		sub a, l	; a = $CA
87		add a		; a = $94
AC		xor a, h	; a = $4E
95		sub a, l	; a = $3E
C4 A9 FB	call z, .write
FB		ei
50		ld d, b

Box 3: $DB87
E6 84		and $84		; a = $04
C4 A9 FB	call z, .write
AF		xor a		; a = $00
F6 C3		or $C3		; a = $C3
50		ld d, b

Box 4: $DB90
C4 A9 FB	call z, .write
AF		xor a		; a = $00
F6 7F		or $7F
95		sub a, l	; a = $6C
95		sub a, l	; a = $59
50		ld d, b

Box 5: $DB99
C4 A9 FB	call z, .write
AF		xor a		; a = $00
F6 F8		or $F8		; a = $F8
FB		ei
FB		ei
50		ld d, b

Box 6: $DBA2
C3 A9 FB	jp .write
FB		ei
FB		ei
FB		ei
FB		ei
22		ldi (hl), a
50		ld d, b

Box 7: $DBAB
C0		ret nz

Party pokémon #3's stat experience, starting from $DA9A
3E 04		ld a, $04
C3 59 F8	jp wTMsHMs

Italian & Spanish

Box 1: $DB75
AF		xor a		; a = $00
F6 E2		or $E2		; a = $E2
C6 F8		add $F8		; af = $DA10
F5		push af
E1		pop hl		; hl = $DA10
FB		ei
50		ld d, b

Box 2: $DB7E
D6 B8		sub $B8		; a = $22
EA 9F FB	ld (.write), a
85		add a, l		; a = $32
D6 F4		sub $F4		; a = $3E
50		ld d, b

Box 3: $DB87
CD 9F FB	call .write
C6 C6		add $C6		; a = $04
CD 9F FB	call .write
50		ld d, b

Box 4: $DB90
C6 BF		add $BF		; a = $C3
CD 9F FB	call .write
FB		ei
C6 96		add $96		; a = $59
50		ld d, b

Box 5: $DB99
CD 9F FB	call .write
C6 7F		add $7F		; a = $D8
7F		ld a, a
22		ldi (hl), a	; .write
C9		ret

Party pokémon #3's stat experience, starting from $DA9A
3E 04		ld a, $04
C3 59 D8	jp wTMsHMs

Plain text transcripts of codes

Language Box name content Language Box name content Language Box name content
English 
Box 1: p 'v 9 é 'd 5 'v *
Box 2: é H 5 'v ♂ é G 5
Box 3: A 4 é m 5 'v 9 5
Box 4: é k 5 F é 'l 5 F
Box 5: 0 B 's 'v 5 u 'v c
Box 6: é n 5 's k 5 'v B
Box 7: 'd 5 5 2 p é 'm 5
Box 8: 'v 'd é 't 5 'v ♂ 5
Box 9: é 's 5 é n 5 v 5
Box 10: 'v L é T 2 0 9 5
Box 11: 5 5 5 5 'm 5 5 ♀
Box 12: 'v F 's k 5 F ? E
Box 13: 's k 5 * 'm k 5 5
French 
Box 1: A e 5 î u 5 5 5
Box 2: î r 5 î u 5 î r
Box 3: î w 5 m ç î u 5
Box 4: p î x 5 î r 5 5
Box 5: î u 5 î u 5 0 9
Box 6: ç ç j û â ] 3 â
Box 7: î [ 8 û à 5 G G
Box 8: W 0 0 ç ç ô ? Mn
Box 9: E ♀ Pk V H m V ç
Box 10: î x 5 ? E ç ç ç
Box 11: î x 5 p 0 Mn e ç
Box 12: î x 5 4 g 5 5 5
Box 13: î x 5 4 h 5 û x
 German 
Box 1: A q 5 W ö j 5 G
Box 2: ö j 5 H W ö j 5
Box 3: p 0 2 ö j 5 W W
Box 4: ö j 5 G G ö j 5
Box 5: G ö j 5 o ö j 5
Box 6: W ö j 5 G ♀ p p
Box 7: Ä ♀ Ö 0 9 b Ü &
Box 8: ♀ S S ♂ 5 s * E
Box 9: ♀ Pk V H m V 5 5
Box 10: ö j 5 ? E ö j 5
Box 11: p 0 ä ö j 5 5 5
Box 12: 4 s 5 ö j 5 p 5
Box 13: 0 2 ä j 5
Italian 
Box 1: é d 5 ° 9 é b 5
Box 2: ° á é c 5 È ♂ 5
Box 3: é [ 5 ° Ì é ] 5
Box 4: È ° é f 5 ° 9 5
Box 5: é g 5 0 9 5 5 2
Box 6: 5 5 Ù 5 5 p 0 Mn
Box 7: E ♀ Pk ° : Ù Ì 5
Box 8: ? E Ù Ì 5 È Á Á
Box 9: Ù Ì 5 È W Ù Ì 5
Box 10: ° B Í Í
 Spanish 
Box 1: é d 5 ° 9 é b 5
Box 2: ° á é c 5 È ♂ 5
Box 3: é [ 5 ° Ì é ] 5
Box 4: È ñ é f 5 ° 5 5
Box 5: é g 5 0 9 5 5 2
Box 6: 5 5 Ù 5 5 p 0 Mn
Box 7: E ♀ Pk ° : Ù Ì 5
Box 8: ? E Ù Ì 5 È Á Á
Box 9: Ù Ì 5 È W Ù Ì 5
Box 10: ° B Í Í

Note: "..." refers to one ellipsis character, “pk” refers to the one pk character, "$" refers to the pokédollar sign, "*" refers to the multiplication symbol. Make sure to pay careful attention to upper/lowercase letters.

Retrieved from "https://glitchcity.wiki/wiki/Guides:Mail_Writer_C?oldid=43313"