API tools faq
paste
Advertisement
luckytyphlosion

Pokémon Gold/Silver VC Bootstrap Guide.

luckytyphlosion
Dec 30th, 2017
1,665
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.38 KB | None | 0 0
raw download clone embed print report
  1. === Achieving Arbitrary ACE on Pokémon Gold/Silver VC ===
  2.  
  3. == What is Arbitrary ACE? ==
  4. Arbitrary ACE is a term created by myself and possibly ExtraTricky (I forget) which is a state where one can execute any possible combinations of bytes (within memory limitations) with ease. With Coin Case or TM17 ACE solely, this is not possible as you are limited to the set of Box Name characters or easily acquirable items.
  5.  
  6. This setup aims to create a bootstrapper which can store arbitrary bytes and execute them, while maintaining compatibility with Virtual Console versions which do not emulate certain functionality of original consoles or accurate emulators (namely execution in SRAM). The setup should take no more than an hour and does not have any complicated instructions (although they are monotonous and boring in the name of efficiency).
  7.  
  8. == Prerequisites ==
  9. - A Quagsire knowing Return as its first move holding TM02.
  10. - The Coin Case item.
  11. - A freshly acquired, low level Pokémon. There are a lot of edge cases which prevent certain Pokémon from working, so for the sake of simplicity you should only use Pokémon caught on Route 29.
  12. - Bellsprout seen in the Pokédex.
  13. - A useless item in the first slot of the Items Pocket of the bag.
  14.  
  15. == Acquiring the Prerequisites ==
  16. (Skip this section if you already have them).
  17. - Quagsire can be found surfing in Ruins of Alph, or by evolving Wooper.
  18. - TM02 can be obtained from an NPC in Ilex Forest, or by buying it at Goldenrod Department Store 5F if it has been acquired from Ilex Forest already.
  19. - TM27 Return can be acquired at Goldenrod Department Store 5F on Sunday if the first non-Egg party Pokémon has 150 or greater happiness. If you don't know what happiness is, just place a Pokémon which you've used a lot at the front of the party.
  20. - To change the day to Sunday, do the following:
  21. - Take note of your trainer name, trainer ID and current money, and use https://codepen.io/acarbonaro/full/EjqPQL/ to generate a password to reset the clock
  22. - On the title screen (with the legendary box Pokémon), press Down + B + Select, select Yes on the dialogue that appears, and enter the password.
  23. - The game will accept your password if done correctly. Upon hitting Continue on the main menu, the game will allow you to reset the clock. Change the date to Sunday to be able to obtain TM27 Return.
  24. - The Coin Case can be found in the Goldenrod Underground Tunnels.
  25. - The freshly acquired, low level Pokémon must follow these rules:
  26. - Simplified:
  27. - Cannot have a stat of 16
  28. - Special Defense stat cannot be 6, 8, or 14.
  29. - Indepth:
  30. - Internally, stats are ordered as such: Current HP, Max HP, Attack, Defense, Speed, Sp. Atk, Sp. Def
  31. - Cannot have a stat of 16 if done on real hardware or accurate emulators (3DS VC does not apply here), unless if the previous stat was 8. It is recommended to discard Pokémon with a stat of 16 in case of an update to the 3DS VC emulator.
  32. - Cannot have a Special Defense stat of 6, 8 or 14, unless if Special Attack is 8 and Speed is not 8.
  33. - Note that even if all these rules are followed there is still the chance of the Pokémon not working due to its internal DV values, which are randomized and hidden to the player. The steps for failure will be mentioned later.
  34.  
  35. == Getting TM17 + extras ==
  36. (Skip the technical explanation if you don't care)
  37. In Generation 2, if a TM is used in a non-TM pocket the game will read past the list of functions which designate what each item does, and in turn will jump to a nonsense place in the code. This can be abused for easier ACE than using the Coin Case; specifically we will use TM17 as it will execute code near the end of the first party Pokémon's data (which will fall through to the second party Pokémon's data, which will be Quagsire.)
  38.  
  39. The setup as follows:
  40. - Enter Goldenrod's Pokémon Center.
  41. - Walk to the Pokémon Center PC, and access the "Change Box" option from Bill's PC.
  42. - Name the boxes using "CoinCaseReference" at the bottom of the guide
  43. - Have the Quagsire with Return and TM02 in the fourth slot of the party, and the low level Pokémon in the third slot of the party.
  44. - Save the game.
  45. - From the Pokémon Center PC, walk one tile downwards and three tiles left (exact movement), then open the menu. If you mess the movement, you must walk back to the PC, open & close the Start Menu and try again.
  46. - Open the Start Menu, and play Bellsprout's cry via the Pokédex.
  47. - Go to the player's bag, and change pockets so that the "Pocket Switch SFX" plays.
  48. - Use the Coin Case. If done correctly, you should have a TM17 in the first slot of the Item Pocket (do not use it yet!), a TM01 & TM09 in the TM Pocket, and instant text if enabled. Safety save the game here.
  49. - If the game crashes or you do not get all items, reset the game and double check your box names. If they have been typed correctly, you will have to acquire another low level Pokémon.
  50.  
  51. == Preparation for the main bootstrap ==
  52. - Have Quagsire hold the TM01.
  53. - Move Quagsire to the second party slot, and the low level Pokémon to the first party slot.
  54. - Walk back to the PC, and name the boxes using "BoxNameBoostrap" at the bottom of the guide.
  55. - [Optional]: Go to the Daycare. The music is relaxing there for what you'll have to do next :P.
  56. - Save the game, and prepare for a lot of inputting.
  57.  
  58. == The opposite of fun (Main Bootstrap) ==
  59. - Use TM17 in the Items Pocket.
  60. - Input the mail codes using "MailBoostrap" at the bottom of the guide.
  61. - The mail input dialogues should stop generating once all messages have been entered. Save the game here.
  62.  
  63. == Verifying the bootstrap ==
  64. - Name the boxes using "BootstrapVerify1" at the bottom of the guide
  65. - Have Quagsire hold the TM09.
  66. - Save the game here.
  67. - Use TM17.
  68. - Input the mail codes using "BootstrapVerify2" at the bottom of the guide.
  69. - Rename Box 1 so that it is "EKEJIA".
  70. - Save the game here.
  71. - Use TM17. If the resulting textbox prints 29544, then the bootstrap has been inputted correctly (barring collisions, which can only occur if all character pairs have been entered in correctly but are not in the correct positions) and you are done!
  72. - If the resulting textbox does not print 29544, then you must redo from "Preparation for the main bootstrap" (although you will only need to rename boxes 1 to 2)
  73.  
  74. == Epilogue ==
  75. For 3DSVC users, "TIDGen" is located at the bottom of the guide as a sample program.
  76.  
  77. === Special Thanks ===
  78. - Everyone who worked on the pokecrystal disassembly, as well as PikalaxALT in particular for having a(n incomplete) pokegold which helped me track down some label addresses.
  79. - The people at GCLF for their work on Gen 2 ACE, specifically the Quagsire TM02 + Return method and documentation on TM17.
  80. - ISSOtm, for suggesting me to use RGBDS to compile the bootstrap (which saved me an immense amount of time).
  81.  
  82. === Input References ===
  83.  
  84. == CoinCaseReference ==
  85. - There are no spaces in any of the box names. Spaces are used as separators for each individual character.
  86. - Special characters will be noted below:
  87. - All characters are case-sensitive!
  88. - 'd, 'l, 'm, 'r, 's, 't, and 'v: Single letters with an apostrophe prefix
  89. - pk, mn, po, and ke: symbols which have the two letters in one tile
  90. - ♂ and ♀ are the male and female symbols respectively
  91. - é is the accent e character
  92. - × is the multiplication symbol. x is lowercase x.
  93. - All symbols exist on the current input menu. Press select or choose the (UPPER/lower) option to change character sets.
  94.  
  95. = With Instant Text (wears off upon reset) =
  96. Box 1: A 0 9 'v B é 'm 2
  97. Box 2: p 'v 9 é G 't . 9
  98. Box 3: é é 't 'v ♂ é × 2
  99. Box 4: P pk ♀ 4 Z 'l ? 'd
  100. Box 5: é Z 'l p p p 0 'd
  101. Box 6: é y 't 'm ♀ ♀
  102.  
  103. = Without Instant Text =
  104. Box 1: A 0 9 'v B é 'm 2
  105. Box 2: p 'v 9 é G 't . 9
  106. Box 3: é é 't 'v ♂ é . 2
  107. Box 4: P pk ♀ p p p 0 'd
  108. Box 5: é y 't 'm ♀ ♀
  109.  
  110. == BoxNameBoostrap ==
  111. Box 1: p 'v b 'v X ♀ 'v 3
  112. Box 2: é ? 2 'v p é ♂ 2
  113. Box 3: H 0 n é 5 2 0 9
  114. Box 4: 'v ; ♀ pk p p 'v 6
  115. Box 5: 'l x x x 't 4 5 2
  116. Box 6: 'v 9 x x - 0 . 'l
  117. Box 7: ♀ 'd
  118.  
  119. == MailBootstrap ==
  120. - Mail Messages 1 to 4 have characters separated by spaces, while Mail Messages 5 to 19 are not separated.
  121. - The numbers before each row for Mail Messages 1 to 4 represent the number of characters on each row. Each message is separated by an empty line.
  122. - Make sure you double check the messages before inputting them so you don't waste time!
  123.  
  124. = Mail Messages 1 to 4 =
  125. 16: p 'v 9 é A . é I . 'v 9 é [ . 'v 9
  126. 15: é ] . 'v ? é J . 'v 6 é po . 'v 3
  127.  
  128. 16: i i . é S . 'v 8 é P . é Y . 'v )
  129.  
  130. 16: / 'v H P 's O . 's 's 's q 'v 5 ♀ ♀ 8
  131. 15: 8 5 'v A ♀ 'l H H H H H s s s ×
  132.  
  133. 7: 'v 9 'd x 'm O .
  134.  
  135. NOTE: × after the "s s s" is a multiplication symbol, not lowercase X.
  136.  
  137. = Mail Messages 5 to 19 =
  138. NMJPGNDMBPADBCPL
  139. INKCHEHIIDIBFOBB
  140.  
  141. FNBMFNODEABCCECG
  142. PMBNKBLMPLCBHEBC
  143.  
  144. PLINNMOHBDBONMNB
  145. ENCGLGIHOPDOIDBA
  146.  
  147. JOGODALMAFICPANM
  148. BOADKCHEKCPEKCHF
  149.  
  150. KCPFFNDMKBBDLMIF
  151. FPFNBBFFHMBCBNIN
  152.  
  153. EMNBENFNFNBBFNBM
  154. ODEABCCECGPMBNFN
  155.  
  156. BCFNBMBAAAAAIBKA
  157. NMGCENCBDBBIPEAD
  158.  
  159. BAEANMPKHNOHOPAF
  160. ICEAOPHOACKOFPFN
  161.  
  162. BCKOPPJHCDAHEFNF
  163. BCFKDMBAFACMNMND
  164.  
  165. CDNMBEMBBNBMIDNL
  166. BOLMAEICHLBOLHFJ
  167.  
  168. PEKHMJHEBNBPNMBO
  169. ADKPEMINPBIDKALA
  170.  
  171. LAIHCBDBJHCBDBDA
  172. DADMKBBDOHOPOEAM
  173.  
  174. DCJMAANMGCENHFNM
  175. GCENPFJMFMNMHDEN
  176.  
  177. HIHIHIHIHENMHDEN
  178. GOPAALBMJMNMPKHN
  179.  
  180. KPPLINLMHGKCIMGM
  181. KAJM
  182.  
  183. = BootstrapVerify1 =
  184. Box 1: A K E J I A
  185. Box 2: a 'm / 'v
  186.  
  187. = BootstrapVerify2 =
  188. - The "checksum" line indicates if a mail code was inputted correctly (barring collisions). It is printed on the top of the screen after selecting "END" in the mail message menu. If the checksum is incorrect, select "NO" in the YES/NO dialogue to try again.
  189. - As there is checksum functionality, you do not need to be as careful when inputting mail codes.
  190.  
  191. MIAA
  192. checksum: 200
  193.  
  194. CBPDNGABMCAAMNCD
  195. MINFCBBNNEABCHAA
  196. checksum: 1652
  197.  
  198. MNCDMIGCGLNBBJHM
  199. OAOJHNOAOKCBDAMI
  200. checksum: 2324
  201.  
  202. MDFOAPPAJPPFDOAF
  203. NHMNOBFCPBOAJPMJ
  204. checksum: 2567
  205.  
  206. AJOJPPCFAGFA!
  207. checksum: 620
  208.  
  209. == TIDGen ==
  210. - This program will fill the current selected box with the Pokémon of your choice, and saves the game.
  211. - Each Pokémon will have a unique TID counting up from 00000.
  212. - Level and shininess are specifiable options.
  213. - Box 3's name is used to specify options, with the format as follows:
  214. - Char1&2: Internal ID of the Pokémon to get, in hex (reference: http://pastebin.com/raw/arPmsvYu )
  215. - Char3&4: Level of the Pokémon to get, in hex.
  216. - Char5: Number of Pokémon to generate, where "A" = 1, "B" = 2, "C" = 3 etc. Will stop generating if the box is full regardless
  217. - Char6: Flags
  218. - "A": Set initial TID to 00000 and disable shininess. Set to "B" after one use.
  219. - "B": Keep currently stored TID and disable shininess
  220. - "C": Set initial TID to 00000 and enable shininess. Set to "D" after one use.
  221. - "D": Keep currently stored TID and enable shininess
  222. - Note that if the number of Pokémon in the party is 6, the 6th Pokémon will be replaced by a "temporary" generated Pokémon!!!
  223. - Example input for 20 L100 shiny Suicunes, starting at TID 0: F564UC
  224.  
  225. = Input using Hex =
  226. - BootstrapHeader is what the first box's name should be when writing the mail codes
  227. - ExecuteHeader is what the first box's name should be when running the code
  228.  
  229. BootstrapHeader: QA4D2A
  230. ExecuteHeader: UA4D2A
  231.  
  232. C800
  233. checksum: 200
  234.  
  235. 2122DA7EFE062001
  236. 3521D1D8CD96C8EA
  237. checksum: 2004
  238.  
  239. 04D0CD96C8EA40D0
  240. 2AD6803CF57ECB4F
  241. checksum: 2370
  242.  
  243. F5CB47CBC7772006
  244. AF217DA52277AFEA
  245. checksum: 2138
  246.  
  247. 5FCE3E06CD492EFA
  248. 22DAFE0620F43DEA
  249. checksum: 2026
  250.  
  251. 05D03E01EA08D0F1
  252. 2807212FDB3EAA22
  253. checksum: 1579
  254.  
  255. 77C1C5CD80C83E08
  256. CD492EC138030520
  257. checksum: 1725
  258.  
  259. F1FABFD8E603CDE1
  260. 30217EA53520022B
  261. checksum: 2063
  262.  
  263. 35CDF1303E0521CC
  264. 4CCF112500C3243E
  265. checksum: 1481
  266.  
  267. AFCDE130217DA52A
  268. EA20DB7EEA21DB34
  269. checksum: 2167
  270.  
  271. C02B34C3F130C52A
  272. C60A87878787472A
  273. checksum: 1871
  274.  
  275. C60AE60FB0C1C9!
  276. checksum: 1023
  277.  
  278.  
  279. = Input using Base16 =
  280. BootstrapHeader: AKENCA
  281. ExecuteHeader: EKENCA
  282.  
  283. MIAA
  284. checksum: 200
  285.  
  286. CBCCNKHOPOAGCAAB
  287. DFCBNBNIMNJGMIOK
  288. checksum: 2004
  289.  
  290. AENAMNJGMIOKEANA
  291. CKNGIADMPFHOMLEP
  292. checksum: 2370
  293.  
  294. PFMLEHMLMHHHCAAG
  295. KPCBHNKFCCHHKPOK
  296. checksum: 2138
  297.  
  298. FPMODOAGMNEJCOPK
  299. CCNKPOAGCAPEDNOK
  300. checksum: 2026
  301.  
  302. AFNADOABOKAINAPB
  303. CIAHCBCPNLDOKKCC
  304. checksum: 1579
  305.  
  306. HHMBMFMNIAMIDOAI
  307. MNEJCOMBDIADAFCA
  308. checksum: 1725
  309.  
  310. PBPKLPNIOGADMNOB
  311. DACBHOKFDFCAACCL
  312. checksum: 2063
  313.  
  314. DFMNPBDADOAFCBMM
  315. EMMPBBCFAAMDCEDO
  316. checksum: 1481
  317.  
  318. KPMNOBDACBHNKFCK
  319. OKCANLHOOKCBNLDE
  320. checksum: 2167
  321.  
  322. MACLDEMDPBDAMFCK
  323. MGAKIHIHIHIHEHCK
  324. checksum: 1871
  325.  
  326. MGAKOGAPLAMBMJ!
  327. checksum: 1023
  328.  
  329.  
  330.  
  331. === Specification ===
  332. - The bootstrap has two modes: Bootstrap and Execute:
  333. - Bootstrap has three stages:
  334. - Input: Data is to be inputted here using the "Create Mail" menu. Each byte is comprised of two characters and the resulting byte is formed depending on the chosen format.
  335. - Checksum: After a mail message is inputted, the message is converted to byte format and then checksummed using an additive checksum, which is printed on the top of the screen for the player as a verification. A Yes/No box appears if the checksum is incorrect, for the player to decide. During this stage, the message is also checked for a "!" which signifies the terminator for the bootstrapper.
  336. - Copy: The resulting message is copied to the destination, specified by the flag options. The destination has a four byte header, followed by the data boostrapped. The four byte header is comprised of a two byte count which is automatically calculated, and the scratch destination to copy to for the Execute mode.
  337. - Execute:
  338. - The game will copy [count] bytes (specified in the header) from the designated source to the destination (specified in the header), and subsequently execute the copied data.
  339.  
  340. - The bootstrap is controlled by the flag options in Box 1:
  341. - Char 1: Flags 1
  342. - Bit 0-1: SRAM Bank to open for the duration of the bootstrap.
  343. - Bit 2: Select bootstrap mode. Unset corresponds to Bootstrap, while Set corresponds to Execute.
  344. - Bit 3: Allow specifying a custom location as the temporary buffer for the mail messages, where the buffer pointer is inputted starting at Box 3.
  345. - Bit 4: Selecting encoding choice. Unset corresponds to base16, while Set corresponds to Hex Encoding.
  346. - If the flag value is greater than 0xe3 ("-" char), execute the pointer directly. Bit 4 is specifiable by using either "-" or "/" respectively.
  347. - Char 2-5: Bootstrap pointer in encoded form. Is equivalent to the destination pointer for bootstrap mode, and the source pointer for execute mode.
  348. - Char 6: Flags 2
  349. - Bit 0: If set, don't include the header during the Copy stage
  350.  
  351. === SRAM labels ===
  352. ; use these to find free space
  353. SECTION "SRAM 0", SRAM, BANK[0]
  354. sScratch:: ds 7 * 7 * 8 ; a000
  355. sDecompressBuffer:: ds 7 * 7 * 16 ; a188
  356. ; a498 to a5ff free
  357.  
  358. ; a600
  359. sPartyMail::
  360. sPartyMon1Mail:: mailmsg sPartyMon1Mail
  361. sPartyMon2Mail:: mailmsg sPartyMon2Mail
  362. sPartyMon3Mail:: mailmsg sPartyMon3Mail
  363. sPartyMon4Mail:: mailmsg sPartyMon4Mail
  364. sPartyMon5Mail:: mailmsg sPartyMon5Mail
  365. sPartyMon6Mail:: mailmsg sPartyMon6Mail
  366.  
  367. ; a71a
  368. sPartyMailBackup::
  369. sPartyMon1MailBackup:: mailmsg sPartyMon1MailBackup
  370. sPartyMon2MailBackup:: mailmsg sPartyMon2MailBackup
  371. sPartyMon3MailBackup:: mailmsg sPartyMon3MailBackup
  372. sPartyMon4MailBackup:: mailmsg sPartyMon4MailBackup
  373. sPartyMon5MailBackup:: mailmsg sPartyMon5MailBackup
  374. sPartyMon6MailBackup:: mailmsg sPartyMon6MailBackup
  375.  
  376. ; a834
  377. sMailboxCount:: db
  378. sMailbox::
  379. sMailbox1:: mailmsg sMailbox1
  380. sMailbox2:: mailmsg sMailbox2
  381. sMailbox3:: mailmsg sMailbox3
  382. sMailbox4:: mailmsg sMailbox4
  383. sMailbox5:: mailmsg sMailbox5
  384. sMailbox6:: mailmsg sMailbox6
  385. sMailbox7:: mailmsg sMailbox7
  386. sMailbox8:: mailmsg sMailbox8
  387. sMailbox9:: mailmsg sMailbox9
  388. sMailbox10:: mailmsg sMailbox10
  389.  
  390. ; aa0b
  391. sMailboxCountBackup:: db
  392. sMailboxBackup::
  393. sMailbox1Backup:: mailmsg sMailbox1Backup
  394. sMailbox2Backup:: mailmsg sMailbox2Backup
  395. sMailbox3Backup:: mailmsg sMailbox3Backup
  396. sMailbox4Backup:: mailmsg sMailbox4Backup
  397. sMailbox5Backup:: mailmsg sMailbox5Backup
  398. sMailbox6Backup:: mailmsg sMailbox6Backup
  399. sMailbox7Backup:: mailmsg sMailbox7Backup
  400. sMailbox8Backup:: mailmsg sMailbox8Backup
  401. sMailbox9Backup:: mailmsg sMailbox9Backup
  402. sMailbox10Backup:: mailmsg sMailbox10Backup
  403. ; abe2
  404. ; most space is reserved here but labels unknown
  405. ds 134
  406.  
  407. sLuckyNumberDay:: ds 1 ; ac68
  408. sLuckyIDNumber:: ds 2 ; ac69
  409. sBackupStatusFlags:: ds $47d ; ac6b (wStatusFlags)
  410. sBackupPokemonData:: ds $4df ; b0e8 (wPartyCount)
  411. sBackupGameData:: ds $226 ; b5c7 (wGameData)
  412. sWindowStackEnd:: ; b7ec to sWindowStack at $bfff
  413.  
  414. SECTION "SRAM 1", SRAM, BANK[1]
  415.  
  416. sOptions:: ds 8 ; a000
  417. sValidCheck1:: ds 1 ; a008
  418. sGameData:: ds $84d ; a009
  419. sMapData:: ds $34; a856
  420. sPokemonData:: ds $4df ; a88a
  421. sChecksum:: ds 2 ; ad69
  422. sValidCheck2:: ds 1 ; ad6b
  423. sBox:: ds $44e ; ad6c
  424.  
  425. sLinkBattleStats::
  426. sLinkBattleWins:: ds 2 ; b1ba
  427. sLinkBattleLosses:: ds 2 ; b1bc
  428. sLinkBattleDraws:: ds 2 ; b1be
  429.  
  430. sLinkBattleRecords:: ds 90 ; b1c0, 6 records
  431. sHallOfFame:: ds $b7c ; b21a
  432. sHallOfFameEnd:: ; bd96
  433. sBackupObjectStructs:: ds $1aa ; bd96
  434. ; bf3f
  435.  
  436.  
  437. SECTION "Boxes 1-7", SRAM, BANK [2]
  438.  
  439. box sBox1 ; a000
  440. box sBox2 ; a450
  441. box sBox3 ; a8a0
  442. box sBox4 ; acf0
  443. box sBox5 ; b1f0
  444. box sBox6 ; b590
  445. box sBox7 ; b9e0
  446. ; be2e
  447.  
  448. SECTION "Boxes 8-14", SRAM, BANK [3]
  449.  
  450. box sBox8
  451. box sBox9
  452. box sBox10
  453. box sBox11
  454. box sBox12
  455. box sBox13
  456. box sBox14
  457. ; be2e
  458. ds 11 ; ???
  459.  
  460. sBackupValidCheck1:: ds 1 ; be38
  461. sBackupMapData:: ds $34 ; be39
  462. sBackupChecksum:: ds 2 ; be6d
  463. sBackupValidCheck2:: ds 1 ; be6f
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!