API tools faq
paste
Advertisement
luckytyphlosion

Pokémon Gold/Silver VC Bootstrap Guide v2.

luckytyphlosion
Dec 7th, 2018
608
1
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.29 KB | None | 1 0
raw download clone embed print report
  1. === Achieving Arbitrary ACE on Pokémon Gold/Silver VC ===
  2.  
  3. == What is Arbitrary ACE? ==
  4. Arbitrary ACE is a term created by myself and possibly ExtraTricky (I forget) which is a state where one can execute any possible combinations of bytes (within memory limitations) with ease. With Coin Case or TM17 ACE solely, this is not possible as you are limited to the set of Box Name characters or easily acquirable items.
  5.  
  6. This setup aims to create a bootstrapper which can store arbitrary bytes and execute them, while maintaining compatibility with Virtual Console versions which do not emulate certain functionality of original consoles or accurate emulators (namely execution in SRAM). The setup should take no more than an hour and does not have any complicated instructions (although they are monotonous and boring in the name of efficiency).
  7.  
  8. == Prerequisites ==
  9. - A Quagsire knowing Return as its first move holding TM02.
  10. - The Coin Case item.
  11. - A freshly acquired, low level Pokémon. There are a lot of edge cases which prevent certain Pokémon from working, so for the sake of simplicity you should only use Pokémon caught on Route 29.
  12. - Bellsprout seen in the Pokédex.
  13. - A useless item in the first slot of the Items Pocket of the bag.
  14.  
  15. == Acquiring the Prerequisites ==
  16. (Skip this section if you already have them).
  17. - Quagsire can be found surfing in Ruins of Alph, or by evolving Wooper.
  18. - TM02 can be obtained from an NPC in Ilex Forest, or by buying it at Goldenrod Department Store 5F if it has been acquired from Ilex Forest already.
  19. - TM27 Return can be acquired at Goldenrod Department Store 5F on Sunday if the first non-Egg party Pokémon has 150 or greater happiness. If you don't know what happiness is, just place a Pokémon which you've used a lot at the front of the party.
  20. - To change the day to Sunday, do the following:
  21. - Take note of your trainer name, trainer ID and current money, and use https://codepen.io/acarbonaro/full/EjqPQL/ to generate a password to reset the clock
  22. - On the title screen (with the legendary box Pokémon), press Down + B + Select, select Yes on the dialogue that appears, and enter the password.
  23. - The game will accept your password if done correctly. Upon hitting Continue on the main menu, the game will allow you to reset the clock. Change the date to Sunday to be able to obtain TM27 Return.
  24. - The Coin Case can be found in the Goldenrod Underground Tunnels.
  25. - The freshly acquired, low level Pokémon must follow these rules:
  26. - Simplified:
  27. - Cannot have a stat of 16
  28. - Special Defense stat cannot be 6, 8, or 14.
  29. - Indepth:
  30. - Internally, stats are ordered as such: Current HP, Max HP, Attack, Defense, Speed, Sp. Atk, Sp. Def
  31. - Cannot have a stat of 16 if done on real hardware or accurate emulators (3DS VC does not apply here), unless if the previous stat was 8. It is recommended to discard Pokémon with a stat of 16 in case of an update to the 3DS VC emulator.
  32. - Cannot have a Special Defense stat of 6, 8 or 14, unless if Special Attack is 8 and Speed is not 8.
  33. - Note that even if all these rules are followed there is still the chance of the Pokémon not working due to its internal DV values, which are randomized and hidden to the player. The steps for failure will be mentioned later.
  34.  
  35. == Getting TM17 + extras ==
  36. (Skip the technical explanation if you don't care)
  37. In Generation 2, if a TM is used in a non-TM pocket the game will read past the list of functions which designate what each item does, and in turn will jump to a nonsense place in the code. This can be abused for easier ACE than using the Coin Case; specifically we will use TM17 as it will execute code near the end of the first party Pokémon's data (which will fall through to the second party Pokémon's data, which will be Quagsire.)
  38.  
  39. The setup as follows:
  40. - Enter Goldenrod's Pokémon Center.
  41. - Walk to the Pokémon Center PC, and access the "Change Box" option from Bill's PC.
  42. - Name the boxes using "CoinCaseReference" at the bottom of the guide
  43. - Have the Quagsire with Return and TM02 in the fourth slot of the party, and the low level Pokémon in the third slot of the party.
  44. - Save the game.
  45. - From the Pokémon Center PC, walk one tile downwards and three tiles left (exact movement), then open the menu. If you mess the movement, you must walk back to the PC, open & close the Start Menu and try again.
  46. - Open the Start Menu, and play Bellsprout's cry via the Pokédex.
  47. - Go to the player's bag, and change pockets so that the "Pocket Switch SFX" plays.
  48. - Use the Coin Case. If done correctly, you should have a TM17 in the first slot of the Item Pocket (do not use it yet!), a TM01 & TM09 in the TM Pocket, and instant text if enabled. Safety save the game here.
  49. - If the game crashes or you do not get all items, reset the game and double check your box names. If they have been typed correctly, you will have to acquire another low level Pokémon.
  50.  
  51. == Preparation for the main bootstrap ==
  52. - Have Quagsire hold the TM01.
  53. - Move Quagsire to the second party slot, and the low level Pokémon to the first party slot.
  54. - Walk back to the PC, and name the boxes using "BoxNameBoostrap" at the bottom of the guide.
  55. - [Optional]: Go to the Daycare. The music is relaxing there for what you'll have to do next :P.
  56. - Save the game, and prepare for a lot of inputting.
  57.  
  58. == The opposite of fun (Main Bootstrap) ==
  59. - Use TM17 in the Items Pocket.
  60. - Input the mail codes using "MailBoostrap" at the bottom of the guide.
  61. - The mail input dialogues should stop generating once all messages have been entered. Save the game here.
  62.  
  63. == Verifying the bootstrap ==
  64. - Name the boxes using "BootstrapVerify1" at the bottom of the guide
  65. - Have Quagsire hold the TM09.
  66. - Save the game here.
  67. - Use TM17.
  68. - Input the mail codes using "BootstrapVerify2" at the bottom of the guide.
  69. - Rename Box 1 so that it is "EKEJIA".
  70. - Save the game here.
  71. - Use TM17. If the resulting textbox prints 59346, then the bootstrap has been inputted correctly (barring collisions, which can only occur if all character pairs have been entered in correctly but are not in the correct positions) and you are done!
  72. - If the resulting textbox does not print 59346, then you must redo from "Preparation for the main bootstrap" (although you will only need to rename boxes 1 to 2)
  73.  
  74. == Epilogue ==
  75. For 3DSVC users, "TIDGen" is located at the bottom of the guide as a sample program.
  76.  
  77. === Special Thanks ===
  78. - Everyone who worked on the pokecrystal disassembly, as well as PikalaxALT in particular for having a(n incomplete) pokegold which helped me track down some label addresses.
  79. - The people at GCLF for their work on Gen 2 ACE, specifically the Quagsire TM02 + Return method and documentation on TM17.
  80. - ISSOtm, for suggesting me to use RGBDS to compile the bootstrap (which saved me an immense amount of time).
  81.  
  82. === Input References ===
  83.  
  84. == CoinCaseReference ==
  85. - There are no spaces in any of the box names. Spaces are used as separators for each individual character.
  86. - Special characters will be noted below:
  87. - All characters are case-sensitive!
  88. - 'd, 'l, 'm, 'r, 's, 't, and 'v: Single letters with an apostrophe prefix
  89. - pk, mn, po, and ke: symbols which have the two letters in one tile
  90. - ♂ and ♀ are the male and female symbols respectively
  91. - é is the accent e character
  92. - × is the multiplication symbol. x is lowercase x.
  93. - All symbols exist on the current input menu. Press select or choose the (UPPER/lower) option to change character sets.
  94.  
  95. = With Instant Text (wears off upon reset) =
  96. Box 1: A 0 9 'v B é 'm 2
  97. Box 2: p 'v 9 é G 't . 9
  98. Box 3: é é 't 'v ♂ é × 2
  99. Box 4: P pk ♀ 4 Z 'l ? 'd
  100. Box 5: é Z 'l p p p 0 'd
  101. Box 6: é y 't 'm ♀ ♀
  102.  
  103. = Without Instant Text =
  104. Box 1: A 0 9 'v B é 'm 2
  105. Box 2: p 'v 9 é G 't . 9
  106. Box 3: é é 't 'v ♂ é . 2
  107. Box 4: P pk ♀ p p p 0 'd
  108. Box 5: é y 't 'm ♀ ♀
  109.  
  110. == BoxNameBoostrap ==
  111. Box 1: p 'v b 'v X ♀ 'v 3
  112. Box 2: é ? 2 'v p é ♂ 2
  113. Box 3: H 0 n é 5 2 0 9
  114. Box 4: 'v ; ♀ pk p p 'v 6
  115. Box 5: 'l x x x 't 4 5 2
  116. Box 6: 'v 9 x x - 0 . 'l
  117. Box 7: ♀ 'd
  118.  
  119. == MailBootstrap ==
  120. - Mail Messages 1 to 4 have characters separated by spaces, while Mail Messages 5 to 19 are not separated.
  121. - The numbers before each row for Mail Messages 1 to 4 represent the number of characters on each row. Each message is separated by an empty line.
  122. - Make sure you double check the messages before inputting them so you don't waste time!
  123.  
  124. = Mail Messages 1 to 4 =
  125. 16: p 'v 9 é A . é I . 'v 9 é [ . 'v 9
  126. 15: é ] . 'v ? é J . 'v 6 é po . 'v 3
  127.  
  128. 16: i i . é S . 'v 8 é P . é Y . 'v )
  129.  
  130. 16: / 'v H P 's O . 's 's 's q 'v 5 ♀ ♀ 8
  131. 15: 8 5 'v A ♀ 'l H H H H H s s s ×
  132.  
  133. 7: 'v 9 'd x 'm O .
  134.  
  135. = Mail Messages 5 to 19 =
  136. NMJPGNDMBPADBCPL
  137. INKCHEHIIDIBFOBB
  138.  
  139. FNBMFNODEABCCECG
  140. PMBNKBLMPLCBHEBC
  141.  
  142. PLINNMOHBDBONMNB
  143. ENCGLGIHOPDOIDBA
  144.  
  145. JOGODALMAFICPANM
  146. BOADKCHEKCPEKCHF
  147.  
  148. KCPFFNDMKBBDLMIF
  149. FPFNBBFFHMBCBNIN
  150.  
  151. EMNBENFNFNBBFNBM
  152. ODEABCCECGPMBNFN
  153.  
  154. BCFNBMBAAAAAIBKA
  155. NMGCENCBDBBIPAPE
  156.  
  157. AAAANMPKHNOHOPAF
  158. ICEAOPHOACKOFPFN
  159.  
  160. BCKOPPJHCDAHEFNF
  161. BCFKDMBAFACMNMND
  162.  
  163. CDNMBEMBBNBMIDNL
  164. BOLMAEICHLBOLHFJ
  165.  
  166. PEKHMJHEBNBPNMBO
  167. ADKPEMINPBIDKALA
  168.  
  169. LAIHCBDBJHCBDBDA
  170. DADMKBBDOHOPOEAM
  171.  
  172. DCJMAANMGCENHFNM
  173. GCENPFJMFMNMHDEN
  174.  
  175. HIHIHIHIHENMHDEN
  176. GOPAALBMJMNMPKHN
  177.  
  178. KPPLINLMHGKCIMGM
  179. KAJM
  180.  
  181. = BootstrapVerify1 =
  182. Box 1: A K E J I A
  183. Box 2: a 'm / 'v
  184.  
  185. = BootstrapVerify2 =
  186. - The "checksum" line indicates if a mail code was inputted correctly (barring collisions). It is printed on the top of the screen after selecting "END" in the mail message menu. If the checksum is incorrect, select "NO" in the YES/NO dialogue to try again.
  187. - As there is checksum functionality, you do not need to be as careful when inputting mail codes.
  188.  
  189. MIAA
  190. checksum: 50
  191.  
  192. CBPDNGABMCAAMNCD
  193. MINFCBBNNEABCHAA
  194. checksum: 14
  195.  
  196. MNCDMIGCGLNBBJHM
  197. OAOJHNOAOKCBDJMI
  198. checksum: 241
  199.  
  200. MDFOAPBBAAAACKID
  201. FPDAABBEMLCDMLBC
  202. checksum: 0
  203.  
  204. DAABBMALHILBCAOO
  205. MJAJOJPPCFAGFA!
  206. checksum: 42
  207.  
  208.  
  209. == TIDGen ==
  210. - This program will fill the current selected box with the Pokémon of your choice, and saves the game.
  211. - Each Pokémon will have a unique TID counting up from 00000.
  212. - Level and shininess are specifiable options.
  213. - Box 3's name is used to specify options, with the format as follows:
  214. - Char1&2: Internal ID of the Pokémon to get, in hex (reference: http://pastebin.com/raw/arPmsvYu )
  215. - Char3&4: Level of the Pokémon to get, in hex.
  216. - Char5: Number of Pokémon to generate, where "A" = 1, "B" = 2, "C" = 3 etc. Will stop generating if the box is full regardless
  217. - Char6: Flags
  218. - "A": Set initial TID to 00000 and disable shininess. Set to "B" after one use.
  219. - "B": Keep currently stored TID and disable shininess
  220. - "C": Set initial TID to 00000 and enable shininess. Set to "D" after one use.
  221. - "D": Keep currently stored TID and enable shininess
  222. - Note that if the number of Pokémon in the party is 6, the 6th Pokémon will be replaced by a "temporary" generated Pokémon!!!
  223. - Example input for 20 L100 shiny Suicunes, starting at TID 0: F564UC
  224.  
  225. = Input using Hex =
  226. - BootstrapHeader is what the first box's name should be when writing the mail codes
  227. - ExecuteHeader is what the first box's name should be when running the code
  228.  
  229. BootstrapHeader: QA4D2A
  230. ExecuteHeader: UA4D2A
  231.  
  232. C800
  233. checksum: 50
  234.  
  235. 2122DA7EFE062001
  236. 3521D1D8CD96C8EA
  237. checksum: 228
  238.  
  239. 04D0CD96C8EA40D0
  240. 2AD6803CF57ECB4F
  241. checksum: 106
  242.  
  243. F5CB47CBC7772006
  244. AF217DA52277AFEA
  245. checksum: 27
  246.  
  247. 5FCE3E06CD492EFA
  248. 22DAFE0620F43DEA
  249. checksum: 101
  250.  
  251. 05D03E01EA08D0F1
  252. 2807212FDB3EAA22
  253. checksum: 22
  254.  
  255. 77C1C5CD80C83E08
  256. CD492EC138030520
  257. checksum: 24
  258.  
  259. F1FABFD8E603CDE1
  260. 30217EA53520022B
  261. checksum: 136
  262.  
  263. 35CDF1303E0521CC
  264. 4CCF112500C3243E
  265. checksum: 95
  266.  
  267. AFCDE130217DA52A
  268. EA20DB7EEA21DB34
  269. checksum: 23
  270.  
  271. C02B34C3F130C52A
  272. C60A87878787472A
  273. checksum: 177
  274.  
  275. C60AE60FB0C1C9!
  276. checksum: 160
  277.  
  278.  
  279.  
  280. = Input using Base16 =
  281. BootstrapHeader: AKENCA
  282. ExecuteHeader: EKENCA
  283.  
  284. MIAA
  285. checksum: 50
  286.  
  287. CBCCNKHOPOAGCAAB
  288. DFCBNBNIMNJGMIOK
  289. checksum: 228
  290.  
  291. AENAMNJGMIOKEANA
  292. CKNGIADMPFHOMLEP
  293. checksum: 106
  294.  
  295. PFMLEHMLMHHHCAAG
  296. KPCBHNKFCCHHKPOK
  297. checksum: 27
  298.  
  299. FPMODOAGMNEJCOPK
  300. CCNKPOAGCAPEDNOK
  301. checksum: 101
  302.  
  303. AFNADOABOKAINAPB
  304. CIAHCBCPNLDOKKCC
  305. checksum: 22
  306.  
  307. HHMBMFMNIAMIDOAI
  308. MNEJCOMBDIADAFCA
  309. checksum: 24
  310.  
  311. PBPKLPNIOGADMNOB
  312. DACBHOKFDFCAACCL
  313. checksum: 136
  314.  
  315. DFMNPBDADOAFCBMM
  316. EMMPBBCFAAMDCEDO
  317. checksum: 95
  318.  
  319. KPMNOBDACBHNKFCK
  320. OKCANLHOOKCBNLDE
  321. checksum: 23
  322.  
  323. MACLDEMDPBDAMFCK
  324. MGAKIHIHIHIHEHCK
  325. checksum: 177
  326.  
  327. MGAKOGAPLAMBMJ!
  328. checksum: 160
  329.  
  330.  
  331.  
  332. === Specification ===
  333. - The bootstrap has two modes: Bootstrap and Execute:
  334. - Bootstrap has three stages:
  335. - Input: Data is to be inputted here using the "Create Mail" menu. Each byte is comprised of two characters and the resulting byte is formed depending on the chosen format.
  336. - Checksum: After a mail message is inputted, the message is converted to byte format and then checksummed using an additive checksum, which is printed on the top of the screen for the player as a verification. A Yes/No box appears if the checksum is incorrect, for the player to decide. During this stage, the message is also checked for a "!" which signifies the terminator for the bootstrapper.
  337. - Copy: The resulting message is copied to the destination, specified by the flag options. The destination has a four byte header, followed by the data boostrapped. The four byte header is comprised of a two byte count which is automatically calculated, and the scratch destination to copy to for the Execute mode.
  338. - Execute:
  339. - The game will copy [count] bytes (specified in the header) from the designated source to the destination (specified in the header), and subsequently execute the copied data.
  340.  
  341. - The bootstrap is controlled by the flag options in Box 1:
  342. - Char 1: Flags 1
  343. - Bit 0-1: SRAM Bank to open for the duration of the bootstrap.
  344. - Bit 2: Select bootstrap mode. Unset corresponds to Bootstrap, while Set corresponds to Execute.
  345. - Bit 3: Allow specifying a custom location as the temporary buffer for the mail messages, where the buffer pointer is inputted starting at Box 3.
  346. - Bit 4: Selecting encoding choice. Unset corresponds to base16, while Set corresponds to Hex Encoding.
  347. - If the flag value is greater than 0xe3 ("-" char), execute the pointer directly. Bit 4 is specifiable by using either "-" or "/" respectively.
  348. - Char 2-5: Bootstrap pointer in encoded form. Is equivalent to the destination pointer for bootstrap mode, and the source pointer for execute mode.
  349. - Char 6: Flags 2
  350. - Bit 0: If set, don't include the header during the Copy stage
  351.  
  352. === SRAM labels ===
  353. ; use these to find free space
  354. SECTION "SRAM 0", SRAM, BANK[0]
  355. sScratch:: ds 7 * 7 * 8 ; a000
  356. sDecompressBuffer:: ds 7 * 7 * 16 ; a188
  357. ; a498 to a5ff free
  358.  
  359. ; a600
  360. sPartyMail::
  361. sPartyMon1Mail:: mailmsg sPartyMon1Mail
  362. sPartyMon2Mail:: mailmsg sPartyMon2Mail
  363. sPartyMon3Mail:: mailmsg sPartyMon3Mail
  364. sPartyMon4Mail:: mailmsg sPartyMon4Mail
  365. sPartyMon5Mail:: mailmsg sPartyMon5Mail
  366. sPartyMon6Mail:: mailmsg sPartyMon6Mail
  367.  
  368. ; a71a
  369. sPartyMailBackup::
  370. sPartyMon1MailBackup:: mailmsg sPartyMon1MailBackup
  371. sPartyMon2MailBackup:: mailmsg sPartyMon2MailBackup
  372. sPartyMon3MailBackup:: mailmsg sPartyMon3MailBackup
  373. sPartyMon4MailBackup:: mailmsg sPartyMon4MailBackup
  374. sPartyMon5MailBackup:: mailmsg sPartyMon5MailBackup
  375. sPartyMon6MailBackup:: mailmsg sPartyMon6MailBackup
  376.  
  377. ; a834
  378. sMailboxCount:: db
  379. sMailbox::
  380. sMailbox1:: mailmsg sMailbox1
  381. sMailbox2:: mailmsg sMailbox2
  382. sMailbox3:: mailmsg sMailbox3
  383. sMailbox4:: mailmsg sMailbox4
  384. sMailbox5:: mailmsg sMailbox5
  385. sMailbox6:: mailmsg sMailbox6
  386. sMailbox7:: mailmsg sMailbox7
  387. sMailbox8:: mailmsg sMailbox8
  388. sMailbox9:: mailmsg sMailbox9
  389. sMailbox10:: mailmsg sMailbox10
  390.  
  391. ; aa0b
  392. sMailboxCountBackup:: db
  393. sMailboxBackup::
  394. sMailbox1Backup:: mailmsg sMailbox1Backup
  395. sMailbox2Backup:: mailmsg sMailbox2Backup
  396. sMailbox3Backup:: mailmsg sMailbox3Backup
  397. sMailbox4Backup:: mailmsg sMailbox4Backup
  398. sMailbox5Backup:: mailmsg sMailbox5Backup
  399. sMailbox6Backup:: mailmsg sMailbox6Backup
  400. sMailbox7Backup:: mailmsg sMailbox7Backup
  401. sMailbox8Backup:: mailmsg sMailbox8Backup
  402. sMailbox9Backup:: mailmsg sMailbox9Backup
  403. sMailbox10Backup:: mailmsg sMailbox10Backup
  404. ; abe2
  405. ; most space is reserved here but labels unknown
  406. ds 134
  407.  
  408. sLuckyNumberDay:: ds 1 ; ac68
  409. sLuckyIDNumber:: ds 2 ; ac69
  410. sBackupStatusFlags:: ds $47d ; ac6b (wStatusFlags)
  411. sBackupPokemonData:: ds $4df ; b0e8 (wPartyCount)
  412. sBackupGameData:: ds $226 ; b5c7 (wGameData)
  413. sWindowStackEnd:: ; b7ec to sWindowStack at $bfff
  414.  
  415. SECTION "SRAM 1", SRAM, BANK[1]
  416.  
  417. sOptions:: ds 8 ; a000
  418. sValidCheck1:: ds 1 ; a008
  419. sGameData:: ds $84d ; a009
  420. sMapData:: ds $34; a856
  421. sPokemonData:: ds $4df ; a88a
  422. sChecksum:: ds 2 ; ad69
  423. sValidCheck2:: ds 1 ; ad6b
  424. sBox:: ds $44e ; ad6c
  425.  
  426. sLinkBattleStats::
  427. sLinkBattleWins:: ds 2 ; b1ba
  428. sLinkBattleLosses:: ds 2 ; b1bc
  429. sLinkBattleDraws:: ds 2 ; b1be
  430.  
  431. sLinkBattleRecords:: ds 90 ; b1c0, 6 records
  432. sHallOfFame:: ds $b7c ; b21a
  433. sHallOfFameEnd:: ; bd96
  434. sBackupObjectStructs:: ds $1aa ; bd96
  435. ; bf3f
  436.  
  437.  
  438. SECTION "Boxes 1-7", SRAM, BANK [2]
  439.  
  440. box sBox1 ; a000
  441. box sBox2 ; a450
  442. box sBox3 ; a8a0
  443. box sBox4 ; acf0
  444. box sBox5 ; b1f0
  445. box sBox6 ; b590
  446. box sBox7 ; b9e0
  447. ; be2e
  448.  
  449. SECTION "Boxes 8-14", SRAM, BANK [3]
  450.  
  451. box sBox8
  452. box sBox9
  453. box sBox10
  454. box sBox11
  455. box sBox12
  456. box sBox13
  457. box sBox14
  458. ; be2e
  459. ds 11 ; ???
  460.  
  461. sBackupValidCheck1:: ds 1 ; be38
  462. sBackupMapData:: ds $34 ; be39
  463. sBackupChecksum:: ds 2 ; be6d
  464. sBackupValidCheck2:: ds 1 ; be6f
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!