Jump to content
ajxpk

[GEN 3] Mystery Event/Gift Research

Recommended Posts

Hey there!
Thank you for all the help from you guys especially @lostaddict@BlackShark, @suloku and everyone who contributed their Mystery Events and Mystery Gifts.
Now it's about time to share everything we have learned from the research. 


Mystery Event Activation
RS: Section 2 - 0x03A9 - bit 5
RS: Section 2 - 0x05C0 - bit 1 (Flag for the NPC?)
E: Section 2 - 0x0405 - bit 5

Notes:
In Ruby & Sapphire Mystery Event can be activated by the NPC at the 1F of the Pokemon Centerin Petalburg City, right next to the PC.
The requirement for the activation is beating the Gym Leader Norman and getting the Balance Badge from the Petalburg Gym.
To activate it you have to tell him a specific phrase using the easy chat system. 

In Emerald Mystery Event can be activated by answer the questionnaire in the Pokemon Market. The only requirement is that you have received the PokeDex. 
The phrase that activates the Mystery Event feature is:

Japanese: ふしぎ できごと わくわく ドキドキ
English: MYSTERY EVENT IS EXCITING
French: EVENEMENT MYSTERE EST PASSIONNANT
German: GEHEIM GESCHEHEN IST JIPP!JIPP!
Spanish: EVENTO MISTERIOSO ES DEMASIADO
Italian: EVENTO SEGRETO È FANTASTICO



e-Berry Data Structure
RS: Section 4 -  0x02E0
E: Section 4 - 0x0378?

0x000 - 0x006	berry name + 0xFF string terminator
0x007		firmness
0x008 - 0x009	size (in mm)
0x00A		max yield
0x00B		min yield
0x00C - 0x00F	berry tag line 1 RAM offset
		0x02028D50 (US) / 0x02028AB0 (JP)
0x010 - 0x013	berry tag line 2 RAM offset
		0x02028D7D (US) / 0x02028ADD (JP)
0x014		growth time per stage (in hours)
0x015 - 0x019	flavor
0x01A		smoothness
0x01B		0
0x01C - 0x49B	berry sprite (4bpp) (48 x 48 px)
0x49C - 0x4BB	palette (16x2 Bytes / 5 bits per color)
0x4BC - 0x4E8	berry tag line 1
0x4E9 - 0x515	berry tag line 2
0x516 - 0x519	effect in bag
0x520 - 0x527	filled with 0
0x528 - 0x529	effect as held item
0x52A - 0x52B	filled with 0
0x52C - 0x52F	checksum


Effects as held item
0x00	no effect
0x04	cures poison
0x05	cures burn
0x06	cures freeze
0x08	cures confusion
0x17	restores a lowered stat
0x1C	cures infatuation

The size is ‭1328‬ bytes.

Berry Checksum

unsigned long berryChecksum(char* berry)
{
	int x;
	unsigned long checksum = 0;
	for(x = 0;  x < 0x52C; x++)
		if(x < 0xC || x >= 0x14)
			checksum += (berry[x] & 0xFF);
	return checksum;
}





Mystery Event Data Structure
RS: Section 4 - 0x0810
E: Section 4 - 0x08A8

Offset     Content               Length
0x0        Checksum              word
0x2        Padding               word
0x4        Mystery Event Space   1000 bytes

Note:
Total size is 1004 bytes. The Checksum at Offset 0x0 protects the data between the Offsets 0x4 - 0x3EB. (1000 bytes)


Eon Ticket Event

Spoiler

//---------------
#org 0x2000061
setvirtualaddress 0x2000061
checkitem 0x113 0x1
compare LASTRESULT 0x1
virtualgotoif 0x1 0x20000BF
checkpcitem 0x113 0x1
compare LASTRESULT 0x1
virtualgotoif 0x1 0x20000BF
checkflag 0xCE
virtualgotoif 0x1 0x20000BF
lock
faceplayer
virtualmsgbox 0x20000C9 //"DAD["][player]! Good to see you!\n..."
waitmsg
waitkeypress
checkitemroom 0x113 0x1
compare LASTRESULT 0x0
virtualgotoif 0x1 0x20000C0
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x853
virtualmsgbox 0x2000104 //"DAD["]It appears to be a ferry TIC..."
waitmsg
waitkeypress
release
killscript

//---------------
#org 0xBF
killscript

//---------------
#org 0xC0
virtualmsgbox 0x2000183 //"DAD["][player]' the KEY ITEMS POCK..."
waitmsg
waitkeypress
release
end


//---------
// Strings
//---------
#org 0xC9
= DAD["][player]! Good to see you!\nThere's a letter here for you,[player].

#org 0x104
= DAD["]It appears to be a ferry TICKET.\nbut I've never seen one like it before.\lYou should visit LILYCOVE and ask\nabout it there.

#org 0x183
= DAD["][player]' the KEY ITEMS POCKET in\nyour BAG is full.\pMove some key items for safekeeping\nin your PC' then come see me.

 



E: Section 2 - 0x049A - bit 0

Note: Officially this was only used in Japan, the Mystery Event is hardcoded and activated by a flag.
When it's set to 1 the delivery guy appears at the 2F of the Pokemon Center, when you talk to him he will give you the Eon Ticket.
Spoiler

'---------------
#org 0x276B03
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x8276B23
goto 0x8276B19

'---------------
#org 0x276B23
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x8276B19
checkflag 0x8B3
if 0x1 goto 0x8276B19
msgbox 0x8273594 MSG_KEEPOPEN '"Thank you for using the MYSTERY\nE..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x82735F2 MSG_KEEPOPEN '"It appears to be for use at\nthe L..."
release
end

'---------------
#org 0x276B19
executeram
msgbox 0x8273178 MSG_FACE '"Thank you for accessing the\nMYSTE..."
end


'---------
' Strings
'---------
#org 0x273594
= Thank you for using the MYSTERY\nEVENT System.\pYou must be [player].\nThere is a ticket here for you.

#org 0x2735F2
= It appears to be for use at\nthe LILYCOVE CITY port.\pWhy not give it a try and see what\nit is about?

#org 0x273178
= Thank you for accessing the\nMYSTERY GIFT System.

 




Sending the Eon Ticket via Record Mixing
RS: Section 4 - 0x0BFC
E: Section 4 - 0x0C94

Offset     Content              Length
0x0        Checksum             word
0x2        Padding              word
0x4        Distribution Limit   word
0x5        How many times       word
0x6        Item Index Number    word

Notes:
Total size is 8 bytes. 0x0 appears to be the checksum.
The number at 0x4 is the Distribution limit, the number of times you can send the Ticket at 0x5 increases even if you don't send the item.
The number of times Eon Tickets could be exchanged that came from official events was always 151, but in case the e-Card version just 30 times.
When the sent item is an Eon Ticket the activation flag for the Event is set as well.

 

e-Trainer Data Structure
RS: Section 0 - 0x0498
FRLG: Section 0 - 0x04A0
E: Section 0 - 0x0BEC 

0x00	- Battle Tower Type
0x01	- Trainerclass		sprite indexes differ between the game versions
0x02	- Battle Tower Lv	0x00 => Lv 50; 0x01 => Lv 100
0x03	- 0x00
0x04	- Trainer Name		RS (US/EU): up to 7 Bytes + string terminator 0xFF
				RS (Jap), FRLG & E: up to 5 Bytes + string terminator 0xFF
0x0C	- Trainer ID		default: 0x0000
0x0E	- Trainer SID		default: 0x0000
0x10	- Intro quote     	6 x 2 Bytes
0x1C	- Win quote		6 x 2 Bytes
0x28	- Lose quote		6 x 2 Bytes
0x34	- 1st Pokemon		44 Bytes
0x60	- 2nd Pokemon		44 Bytes
0x8C	- 3rd Pokemon		44 Bytes
0xB8	- Checksum		4 Bytes (all 184 Bytes of the trainer
				data added together as words)

Pokemon structure (44 Bytes)
0x00	- Species		2 Bytes
0x02	- Item			2 Bytes
0x04	- 1st Move		2 Bytes
0x06	- 2nd Move		2 Bytes
0x08	- 3rd Move		2 Bytes
0x0A	- 4th Move		2 Bytes
0x0C	- Level
0x0D	- 0x00
0x0E	- HP EVs
0x0F	- Atk. EVs
0x10	- Def. EVs
0x11	- Init. EVs
0x12	- SP.Atk. EVs
0x13	- SP.Def. EVs
0x14	- ID			2 Bytes
0x16	- SID			2 Bytes
0x18	- IVs			4 Bytes
0x1C	- PID			4 Bytes
0x20	- Nickname		up to 9 Bytes + string terminator 0xFF
0x2A	- 0x00
0x2B	- 0xFF

The size is 188 bytes.



Mystery Gift Activation
FRLGSection 2 - 0x0067 - bit 1
E: Section 2 - 0x040B - bit 4

In Mystery Gift can be activated by answer the questionnaire in the Pokemon Market. The only requirement is that you have received the PokeDex. 
The phrase that activates the Mystery Gift feature is:

Japanese: ともだち いっぱい ふしぎ つうしん
English: LINK TOGETHER WITH ALL
French: CONNEXION AVEC LES DRESSEUR
German:	LINK MIT ALLE ZUSAMMEN
Spanish: CONEXIÓN CON TODOS
Italian: INSIEME IN LINK !



Mystery Gift Data Structure

Base Offset
FRLG: Section 4 - 0x02A0
E: Section 4 - 0x03AC

Wonder News Data Structure

Japanese

Offset     Content                Length

0x0        Checksum               word
0x2        Padding                word
0x4        Wonder News ID         word
0x6        Send Wonder News       byte
0x7        Wonder News Graphic    byte
0x8        Wonder News (Header)   20 bytes
0x1C       Wonder News (Line 1)   20 bytes
0x30       Wonder News (Line 2)   20 bytes
0x44       Wonder News (Line 3)   20 bytes
0x58       Wonder News (Line 4)   20 bytes
0x6C       Wonder News (Line 5)   20 bytes
0x80       Wonder News (Line 6)   20 bytes
0x94       Wonder News (Line 7)   20 bytes
0xA8       Wonder News (Line 8)   20 bytes
0xBC       Wonder News (Line 9)   20 bytes
0xD0       Wonder News (Line 10)  20 bytes

Notes:
Total size is 228 bytes. The Checksum at Offset 0x0 protects the data between the Offsets 0x4 and 0xE4. (224 Bytes)
We still don't know what Offset 0x4 is for but assume that it's the Wonder News ID and it's a 16bit Integer. 
To make the Wonder News sendable to other Players a bitflag at Offset 0x6 can be set. (0 = OFF, 1 = ON)
Offset 0x7 is for the Wonder News Graphic, there are 8 different designs for Wonder News in total.

1: 0x00
2: 0x01
3: 0x02
4: 0x03
5: 0x04
6: 0x05
7: 0x06
8: 0x07


International

Offset     Content                 Length

0x0        Checksum                word
0x2        Padding                 word
0x4        Wonder News ID          word
0x6        Distribution            byte
0x7        Wonder News Graphic     byte
0x8        Wonder News (Header)    40 bytes
0x30       Wonder News (Line 1)    40 bytes
0x58       Wonder News (Line 2)    40 bytes
0x80       Wonder News (Line 3)    40 bytes
0xA8       Wonder News (Line 4)    40 bytes
0xD0       Wonder News (Line 5)    40 bytes
0xF8       Wonder News (Line 6)    40 bytes
0x120      Wonder News (Line 7)    40 bytes
0x148      Wonder News (Line 8)    40 bytes
0x170      Wonder News (Line 9)    40 bytes
0x198      Wonder News (Line 10)   40 bytes

Notes:
Total size is 448 bytes. The Checksum at Offset 0x0 protects the data between the Offsets 0x4 and 0x1C0. (444 Bytes)
We still don't know what Offset 0x4 is for but assume that it's the Wonder News ID. It's 16bit. 
To make the Wonder News sendable to other Players a bitflag at Offset 0x6 can be set. (0 = OFF, 1 = ON)
Offset 0x7 is for the Wonder News Graphic, there are 8 different designs for Wonder News in total.

1: 0x00
2: 0x01
3: 0x02
4: 0x03
5: 0x04
6: 0x05
7: 0x06
8: 0x07

1.png.659e7faa9a5423736a96f0311ff33c54.png2.png.c6c9be6abf2cb1835fabef4b1d5987e6.png3.png.2e5b8fc18b08603ab90452839482e8e2.png4.png.6a995fdff89fc79db1203233aab28b41.png5.png.d302b890f7958e33e8f90a31a993680a.png6.png.4257adf0e51c0fd722b3ee6a96fed05f.png7.png.e8facfdfc12943786ad29cdd096c9188.png8.png.aad83bfb226a7590390cd7c868b4aaa8.png




Wonder Card Data Structure


Japanese

FRLG: Section 4 - 0x0384
E: Section 4 - 0x0490

Offset    Content                  Length

0x0       Checksum                 word
0x2       Padding                  word
0x4       Wonder Card ID           dword
0xC       Graphic + Distribution   byte
0xE       Wonder Card (Header 1)   18 bytes
0x20      Wonder Card (Header 2)   13 bytes
0x2D      Wonder Card (Center 1)   20 bytes
0x41      Wonder Card (Center 2)   20 bytes
0x55      Wonder Card (Center 3)   20 bytes
0x69      Wonder Card (Center 4)   20 bytes
0x7D      Wonder Card (Footer 1)   20 bytes
0x91      Wonder Card (Footer 2)   20 bytes
0xB2      Pokémon Icon             word

Notes:
Total size is 168 bytes. The Checksum at Offset 0x0 protects the data between the Offsets 0x4 and 0xA8. (164 Bytes)
Wonder Card ID is located at Offset 0x4, it's a 32 bit value that is separated into 2 16bit integers, similar to a Trainer ID.
Known official Wonder Card IDs are 01000-65535 from the Aurora Tickets, 01001-65535 from the Mystic Tickets and 01002-65535 from the Japanese Old Sea Map. 
The Wonder Card Graphic shares the same Offset 0xC with the send functionality of Wonder Cards. Just like Wonder News there are 8 different designs...
Although they are mapped in a different way with the help of bit flags.

1: 0x00
2: 0x04
3: 0x08
4: 0x0C
5: 0x10
6: 0x14
7: 0x18
8: 0x1C

Adding bit 6 (+0x40) makes Wonder Card sendable, the receiver will get the Wonder Card without this flag activated.  
Adding bit 7 (+0x80) makes Wonder Card sendable, the receiver will get the Wonder Card with this flag activated.  


 

International

FRLG: Section 4 - 0x0460
E: Section 4 - 0x056C

Offset      Content                   Length

0x0         Checksum                  word
0x2         Padding                   word
0x4         Wonder Card ID            dword
0xC         Graphic + Distribution    byte
0xE         Wonder Card (Header 1)    40 bytes
0x36        Wonder Card (Header 2)    40 bytes
0x5E        Wonder Card (Center 1)    40 bytes
0x86        Wonder Card (Center 2)    40 bytes
0xAE        Wonder Card (Center 3)    40 bytes
0xD6        Wonder Card (Center 4)    40 bytes
0xFE        Wonder Card (Footer 1)    40 bytes
0x126       Wonder Card (Footer 2)    40 bytes
0x15A       Pokémon Icon              word

Notes:
Total size is 336 bytes. The Checksum at Offset 0x0 protects the data between the Offsets 0x4 - 0x150. (332 Bytes)
Wonder Card ID is located at Offset 0x4, it's a 32 bit value that is separated into 2 16bit integers, similar to a Trainer ID.
Known official Wonder Card IDs are 01000-65535 from the Aurora Tickets, 01001-65535 from the Mystic Tickets and 01002-65535 from the Japanese Old Sea Map. 
The Wonder Card Graphic shares the same Offset 0xC with the send functionality of Wonder Cards. Just like Wonder News there are 8 different designs...
Although they are mapped in a different way with the help of bit flags.

1: 0x00
2: 0x04
3: 0x08
4: 0x0C
5: 0x10
6: 0x14
7: 0x18
8: 0x1C

Adding bit 6 (+0x40) makes Wonder Card sendable, the receiver will get the Wonder Card without this flag activated.  
Adding bit 7 (+0x80) makes Wonder Card sendable, the receiver will get the Wonder Card with this flag activated.  



1.png.1810d05d4162780490612577b6d3aa56.png2.png.0472dccba5adb3e476f7a4d64b58a0f1.png3.png.e41d703792b4f24b712ed00d57700061.png4.png.1cfbeb2ace9260461fd4e6e5b5fa1cf1.png5.png.d127c144ecac2c1f3055814a44806636.png6.png.5f7af2aef6f38fb8ac082e3c2128ca2c.png7.png.dc3ff72a0f63dc30207046968c497d78.png8.png.878c5265e1dc2df46ebca0a9320e62fd.png

 

Mystery Gift Data Structure

FRLG: Section 4 - 0x079C
E: Section 4 - 0x08A8

Offset     Content              Length
0x0        Checksum             word
0x2        Padding              word
0x4        Mystery Gift Space   1000 bytes

Notes:
Total size is 1004 bytes. This is the actual Mystery Gift, the structure is exactly the same like an Mystery Event.
The Checksum at Offset 0x0 protects the data between the Offsets 0x4 - 0x3EB. (1000 bytes)
The Mystery Gift Data Header at 0x04 is always 33 FF FF FF, the game is looking for these bytes to check if there's a Mystery Gift.





Mystery Event/Gift Checksum Algorithm

unsigned int __fastcall MysteryEventGiftChecksum(int a1, unsigned int a2)
{
    unsigned int v2; // r2
    unsigned int i; // r3

    v2 = 0x1121; // This is the seed
    for ( i = 0; i < a2; i = (i + 1) & 0xFFFF )
        v2 = *(unsigned __int16 *)((char *)crc16_ccitt_table + (2 * (v2 ^ *(unsigned __int8 *)(a1 + i)) & 0x1FF)) ^ (v2 >> 8);
    return ~v2 & 0xFFFF;
}

crc16_ccitt_table.bin



Mystery Gift Samples

Spoiler

STAMP CARD

FRLG - ENG - 1.0.

Spoiler


'---------------
#org 0x488E28
setvirtualaddress 0x8488E28
copyvarifnotzero 0x800D 0x1
special2 0x8008 0x186
copyvarifnotzero 0x800D 0x0
special2 0x8009 0x186
subvar 0x8008 0x8009
buffernumber 0x0 0x8008
lock
faceplayer
virtualmsgbox 0x8488E55 '"Thank you for using the STAMP CARD..."
waitmsg
waitkeypress
release
end


'---------
' Strings
'---------
#org 0x488E55
= Thank you for using the STAMP CARD\nSystem.\pYou have [buffer1] more to collect to\nfill your STAMP CARD.

 



POKEMON EGG

FRLG - ENG - 1.0.

Spoiler


'---------------
#org 0x488EB5
setvirtualaddress 0x8488EB5
checkflag 0x3D8
virtualgotoif 0x0 0x8488EC4
jumpram
special2 0x40B5 0x83
compare 0x40B5 0x6
virtualgotoif 0x1 0x8488EEB
setflag 0x3D8
virtualcall 0x8488EF6
lock
faceplayer
virtualmsgbox 0x8488F56 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
fanfare 0x102
waitfanfare
release
end

'---------------
#org 0x488EC4
special2 0x40B5 0x83
compare 0x40B5 0x6
virtualgotoif 0x1 0x8488EEB
setflag 0x3D8
virtualcall 0x8488EF6
lock
faceplayer
virtualmsgbox 0x8488F56 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
fanfare 0x102
waitfanfare
release
end

'---------------
#org 0x488EEB
lock
faceplayer
virtualmsgbox 0x8488FE3 '"Oh, your party appears to be full...."
waitmsg
waitkeypress
release
end

'---------------
#org 0x488EF6
giveegg 0xAC
setobedience 0x40B5
setcatchlocation 0x40B5 0xFF
compare 0x40B5 0x1
virtualgotoif 0x1 0x8488F38
compare 0x40B5 0x2
virtualgotoif 0x1 0x8488F3E
compare 0x40B5 0x3
virtualgotoif 0x1 0x8488F44
compare 0x40B5 0x4
virtualgotoif 0x1 0x8488F4A
compare 0x40B5 0x5
virtualgotoif 0x1 0x8488F50
return

'---------------
#org 0x488F38
setpkmnpp 0x1 0x2 0x39
return

'---------------
#org 0x488F3E
setpkmnpp 0x2 0x2 0x39
return

'---------------
#org 0x488F44
setpkmnpp 0x3 0x2 0x39
return

'---------------
#org 0x488F4A
setpkmnpp 0x4 0x2 0x39
return

'---------------
#org 0x488F50
setpkmnpp 0x5 0x2 0x39
return


'---------
' Strings
'---------
#org 0x488F56
= Thank you for using the MYSTERY\nGIFT System.\pFrom the POKéMON CENTER we\nhave a gift - a POKéMON EGG!\pPlease raise it with love and\nkindness.

#org 0x488FE3
= Oh, your party appears to be full.\pPlease come see me after storing\na POKéMON on a PC.

 



TRAINER

FRLG - ENG - 1.0.

Spoiler


'---------------
#org 0x48903A
setvirtualaddress 0x848903A
special 0xF6
compare 0x800D 0x0
virtualgotoif 0x1 0x8489058
lock
faceplayer
virtualmsgbox 0x8489063 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
release
end

'---------------
#org 0x489058
lock
faceplayer
virtualmsgbox 0x84891B0 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
release
end


'---------
' Strings
'---------
#org 0x489063
= Thank you for using the MYSTERY\nGIFT System.\pBy holding this WONDER CARD, you\nmay take part in a survey at a\lPOKéMON MART.\pUse these surveys to invite\nTRAINERS to the SEVII ISLANDS.\p[.]Let me give you a secret\npassword for a survey:\p["]GIVE ME\nAWESOME TRAINER"\pWrite that in on a survey and send\nit to the WIRELESS\lCOMMUNICATION SYSTEM.

#org 0x4891B0
= Thank you for using the MYSTERY\nGIFT System.\pA TRAINER has arrived in the SEVII\nISLANDS looking for you.\pWe hope you will enjoy\nbattling the visiting TRAINER.\pYou may invite other TRAINERS by\nentering other passwords.\pTry looking for other passwords\nthat may work.

 



BATTLE COUNT CARD

FRLG - ENG - 1.0.

Spoiler


'---------------
#org 0x4892B9
setvirtualaddress 0x84892B9
checkflag 0x3D8
virtualgotoif 0x1 0x84892F6
copyvarifnotzero 0x800D 0x2
special2 0x8008 0x186
compare 0x8008 0x3
virtualgotoif 0x0 0x84892F6
lock
faceplayer
virtualmsgbox 0x8489419 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
giveitem 0xD 0x1 0x0
release
setflag 0x3D8
end

'---------------
#org 0x4892F6
lock
faceplayer
virtualmsgbox 0x8489301 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
release
end


'---------
' Strings
'---------
#org 0x489419
= Thank you for using the MYSTERY\nGIFT System.\pCongratulations!\pYou have won a prize for winning\nthree battles!\pWe hope you will be inspired to\nbattle some more.

#org 0x489301
= Thank you for using the MYSTERY\nGIFT System.\pYour BATTLE COUNT CARD keeps\ntrack of your battle record against\lTRAINERS with the same CARD.\pLook for and battle TRAINERS who\nhave the same CARD as you.\pYou may check the overall rankings\nby reading the NEWS.\pPlease do give it a try!

 

 

AURORA TICKET

FRLG - ENG - 1.0.

Spoiler


'---------------
#org 0x4894B9
setvirtualaddress 0x84894B9
lock
faceplayer
checkflag 0x2A7
virtualgotoif 0x1 0x848951D
checkflag 0x2E4
virtualgotoif 0x1 0x848951D
checkitem 0x173 0x1
compare 0x800D 0x1
virtualgotoif 0x1 0x848951D
virtualmsgbox 0x8489526 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
checkitemroom 0x173 0x1
compare 0x800D 0x0
virtualgotoif 0x1 0x8489514
giveitem 0x173 0x1 0x0
setflag 0x84B
setflag 0x2A7
virtualmsgbox 0x8489583 '"It appears to be for use at the\nV..."
waitmsg
waitkeypress
release
end

'---------------
#org 0x48951D
virtualmsgbox 0x84895E8 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
release
end

'---------------
#org 0x489514
virtualmsgbox 0x8489615 '"Oh, I'm sorry, [player]. Your BAG'..."
waitmsg
waitkeypress
release
end


'---------
' Strings
'---------
#org 0x489526
= Thank you for using the MYSTERY\nGIFT System.\pYou must be [player].\nThere is a ticket here for you.

#org 0x489583
= It appears to be for use at the\nVERMILION CITY port.\pWhy not give it a try and see what\nit is about?

#org 0x4895E8
= Thank you for using the MYSTERY\nGIFT System.

#org 0x489615
= Oh, I'm sorry, [player]. Your BAG's\nKEY ITEMS POCKET is full.\pPlease store something on your PC,\nthen come back for this.

 



MYSTIC TICKET

FRLG - ENG - 1.0.

Spoiler


'---------------
#org 0x489689
setvirtualaddress 0x8489689
lock
faceplayer
checkflag 0x2A8
virtualgotoif 0x1 0x84896F6
checkflag 0x2F2
virtualgotoif 0x1 0x84896F6
checkflag 0x2F3
virtualgotoif 0x1 0x84896F6
checkitem 0x172 0x1
compare 0x800D 0x1
virtualgotoif 0x1 0x84896F6
virtualmsgbox 0x84896FF '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
checkitemroom 0x172 0x1
compare 0x800D 0x0
virtualgotoif 0x1 0x84896ED
giveitem 0x172 0x1 0x0
setflag 0x84A
setflag 0x2A8
virtualmsgbox 0x848975C '"It appears to be for use at the\nV..."
waitmsg
waitkeypress
release
end

'---------------
#org 0x4896F6
virtualmsgbox 0x84897C1 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
release
end

'---------------
#org 0x4896ED
virtualmsgbox 0x84897EE '"Oh, I'm sorry, [player]. Your BAG'..."
waitmsg
waitkeypress
release
end


'---------
' Strings
'---------
#org 0x4896FF
= Thank you for using the MYSTERY\nGIFT System.\pYou must be [player].\nThere is a ticket here for you.

#org 0x48975C
= It appears to be for use at the\nVERMILION CITY port.\pWhy not give it a try and see what\nit is about?

#org 0x4897C1
= Thank you for using the MYSTERY\nGIFT System.

#org 0x4897EE
= Oh, I'm sorry, [player]. Your BAG's\nKEY ITEMS POCKET is full.\pPlease store something on your PC,\nthen come back for this.

 


ALTERING CAVE

FRLG - ENG - 1.0.

Spoiler


'---------------
#org 0x489862
setvirtualaddress 0x8489862
addvar 0x4024 0x1
compare 0x4024 0xA
virtualgotoif 0x0 0x848987C
setvar 0x4024 0x0
lock
faceplayer
virtualmsgbox 0x8489887 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
release
end

'---------------
#org 0x48987C
lock
faceplayer
virtualmsgbox 0x8489887 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
release
end


'---------
' Strings
'---------
#org 0x489887
= Thank you for using the MYSTERY\nGIFT System.\pRecently, there have been rumors\nof rare POKéMON appearances.\pThe rumors are about ALTERING\nCAVE on OUTCAST ISLAND.\pWhy not visit there and check if\nthe rumors are indeed true?

 


OLD SEA MAP

E - ENG

Spoiler


'---------------
#org 0x6757F4
setvirtualaddress 0x86757F4
lock
faceplayer
checkflag 0x13C
virtualgotoif 0x1 0x8675858
checkflag 0x1CA
virtualgotoif 0x1 0x8675858
checkitem 0x178 0x1
compare 0x800D 0x1
virtualgotoif 0x1 0x8675858
virtualmsgbox 0x8675861 '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
checkitemroom 0x178 0x1
compare 0x800D 0x0
virtualgotoif 0x1 0x867584F
giveitem 0x178 0x1 0x0
setflag 0x8D6
setflag 0x13C
virtualmsgbox 0x86758D9 '"It appears to be for use at the\nL..."
waitmsg
waitkeypress
release
end

'---------------
#org 0x675858
virtualmsgbox 0x867593D '"Thank you for using the MYSTERY\nG..."
waitmsg
waitkeypress
release
end

'---------------
#org 0x67584F
virtualmsgbox 0x867596A '"Oh, I'm sorry, [player].\nYour BAG..."
waitmsg
waitkeypress
release
end


'---------
' Strings
'---------
#org 0x675861
= Thank you for using the MYSTERY\nGIFT System.\pLet me confirm--you are [player]?\pWe received this OLD SEA MAP\naddressed to you.

#org 0x6758D9
= It appears to be for use at the\nLILYCOVE CITY port.\pWhy not give it a try and see what\nit is about?

#org 0x67593D
= Thank you for using the MYSTERY\nGIFT System.

#org 0x67596A
= Oh, I'm sorry, [player].\nYour BAG's KEY ITEMS POCKET is full.\pPlease store something on your PC,\nthen come back for this.

 

 



Extracted Mystery Gift Data from the ROMs (Includes Samples)
Mystery Gift Data.zip

 

 

 

Other sources

Spoiler

Bulbapedia - Some informations about distributed 3rd Gen Wonder Cards

http://bulbapedia.bulbagarden.net/wiki/List_of_other_event_distributions_in_Generation_III

The archived website of たかさん (Japanese)

 

http://web.archive.org/web/20080124205147/http://www.h6.dion.ne.jp/~taka.999/index.html

Diary about dumping and injecting a Wonder Card (Japanese)

http://web.archive.org/web/20080106083812/http://www.h6.dion.ne.jp/~taka.999/page002.html

Pokémon.co.jp - Pokémon Center Egg Present 2004 (Japanese)

http://web.archive.org/web/20040319200750/http://www.pokemon.co.jp/event/0324egg/index.html

Nintendo.co.jp - Joyspot Information Site about the Mystic Ticket and Aurora Ticket 2004 Distributions (Japanese)

http://web.archive.org/web/20040901035438/http://www.nintendo.co.jp/n08/bprj/joyspot/shinpi/index.html

Pokémon.co.jp - Pokémon Festa 2004 - Mystic Ticket Distribution 2004 (Japanese)

http://web.archive.org/web/20040615095104/http://www.pokemon.co.jp/event/festa2004/shinpi.html

Pokémon.co.jp - Pokémon Festa 2005 - Old Sea Map Distribution 2005 (Japanese)

http://web.archive.org/web/20060205094715/http://www.pokemon.co.jp/event/festa2005/game02.html#mew

Pokémon.co.jp - Pokémon Festa 2005 - Mystic Ticket Distribution 2005 (Japanese)

http://web.archive.org/web/20051018184055/http://www.pokemon.co.jp/event/festa2005/game021.html

Pokémon.co.jp - Official Ticket Site for the Distribution of 2006-2007 (Japanese)

http://web.archive.org/web/20070114111635/http://www.pokemon.co.jp/special/ticket/

Nintendo.co.jp - Nintendo Online Magazine - PokéPark Egg Present Page (Japanese)

http://www.nintendo.co.jp/nom/0504/1_2/

Nintendo-Europe.com - Official European Deoxys Microsite

http://ms.nintendo-europe.com/deoxys/deDE/index.html

pokewiki.de - Aurora Ticket (German)

http://www.pokewiki.de/Auroraticket

pokewiki.de - Mystic Ticket (German)

http://www.pokewiki.de/Geheimticket

pokewiki.de - Old Sea Map (German)

http://www.pokewiki.de/Alte_Karte

-TOOLS-

 

 

Other Threads related to this Topic:

 



CURRENT RESEARCH STATUS:
I would like to analyze the functionalities of the Aurora Ticket Distribution ROM and it would be cool if someone experienced could help with this



Thanks for all the great support, effort and dedication to the project

Edited by ajxpk
  • Like 5

Share this post


Link to post
Share on other sites

I've found this

http://web.archive.org/web/20080124205147/http://www.h6.dion.ne.jp/~taka.999/index.html

i DONT Know what it is but it looks very good

for every specific Game you can choose wich Ticket you want and input on you're game (i dont know if with or without Wondercard)...so i think it works...

Share this post


Link to post
Share on other sites
I've found this

http://web.archive.org/web/20080124205147/http://www.h6.dion.ne.jp/~taka.999/index.html

i DONT Know what it is but it looks very good

for every specific Game you can choose wich Ticket you want and input on you're game (i dont know if with or without Wondercard)...so i think it works...

This is great! Thank you. I know this site.

They have nice informations, Tools and AR Codes.

Especially the tools are great. I can highly recommend them to everyone who plays the japanese versions.

It definitely has to be posted here.

I found the site once in the comments of this YouTube video

.

[video=youtube;mJ3688TCVK4]

The most interesting thing is that these seem to be 100% accurate replicas of the real events.

All the texts, flags, Wonder Cards, it's all there.

They even contain the PokéPark Egg Event, which would be impossible to reconstruct.

And as a sweet bonus there is also a custom Altering Cave Event. (There was never one officially distributed, but this is still interesting stuff.)

The only prob for us is that these tools are ONLY compatible with the japanese versions.

But at least we have something for the japanese versions now, which is great. :)

Small Update:

I've been a bit busy the past days and didn't made much progress.

At least I got the text for the Aurora Ticket Wonder Card:

http://bulbapedia.bulbagarden.net/wiki/List_of_other_event_distributions_in_Generation_III

Share this post


Link to post
Share on other sites
Oh! Only AR Codes also....boring but good

I thought that you have to enter a save file of the game and this program then write the events and wonderful cards on this save file.

No, you're half-right. :) Sorry for the confusion.

It's right that the content of the Wonder Cards or at least the text and the script is not in the game. (As mentioned in my first post...)

But the Events are and they are triggered by having the respective Event Item in the Bag and the flag for the Event activated.

But at the end it's still code and way more complicated, because the offsets in the localized games are different.

That's why the Japanese codes wouldn't work for the other versions and vice versa.

We're quite lucky that Morfeo's Codes working for the English versions. I admit that I wouldn't be able to find this out by myself so I'm thankful because the work is already done.

Otherwise I wouldn't have opened this thread.

Btw. for everyone who's interested in the Japanese AR Codes for the Tickets they are located here:

http://web.archive.org/web/20080124020623/http://www.h6.dion.ne.jp/~taka.999/page013.html

And here are the Egg Codes:

http://web.archive.org/web/20080106083826/http://www.h6.dion.ne.jp/~taka.999/page036.html

At the end wether you use the Tools or insert the values manually via AR Codes, there is not much difference.

Because what you're actually doing is nothing more than editing the HEX values in the save file.

In the practical sense the tools are very easy and convience to use and this is were we want to be in the future.

Especially because the Wonder Card AR Codes are so huge. And you can't insert them all at once, you have to do it blockwise. (6 Blocks!)

But for my purpose right now AR codes are not a bad thing, because I can easily figure out the RAM addresses and work with it.

Share this post


Link to post
Share on other sites

Hi this is really interesting information...

Did you try the Morfeo's Codes? I have tried to use them with no luck. I'm not sure if the way I'm inserting them in VBALink is wrong or the version of the rom i have is not correct (Emerald US/Europe Rev A).

Anyway a tool to patch the save files or some already patched files with those wonder cards in them will be really nice to have...

PS: Here is a save file i found online containing a legit aurora ticket wonder card (that you cannot share).

Sauvegames Aurora.rar

Sauvegames Aurora.rar

Share this post


Link to post
Share on other sites
No, you're half-right. :) Sorry for the confusion.

It's right that the content of the Wonder Cards or at least the text and the script is not in the game. (As mentioned in my first post...)

But the Events are and they are triggered by having the respective Event Item in the Bag and the flag for the Event activated.

But at the end it's still code and way more complicated, because the offsets in the localized games are different.

That's why the Japanese codes wouldn't work for the other versions and vice versa.

We're quite lucky that Morfeo's Codes working for the English versions. I admit that I wouldn't be able to find this out by myself so I'm thankful because the work is already done.

Otherwise I wouldn't have opened this thread.

Btw. for everyone who's interested in the Japanese AR Codes for the Tickets they are located here:

http://web.archive.org/web/20080124020623/http://www.h6.dion.ne.jp/~taka.999/page013.html

And here are the Egg Codes:

http://web.archive.org/web/20080106083826/http://www.h6.dion.ne.jp/~taka.999/page036.html

At the end wether you use the Tools or insert the values manually via AR Codes, there is not much difference.

Because what you're actually doing is nothing more than editing the HEX values in the save file.

In the practical sense the tools are very easy and convience to use and this is were we want to be in the future.

Especially because the Wonder Card AR Codes are so huge. And you can't insert them all at once, you have to do it blockwise. (6 Blocks!)

But for my purpose right now AR codes are not a bad thing, because I can easily figure out the RAM addresses and work with it.

very nice!

but where to input the AR Codes?? after 12 years they sell no AR Devices more.... and japanese codes dont word on PAL or US devices...i try it

Morfeo dont List Japanese Codes (mastercode, etc)

Share this post


Link to post
Share on other sites
Hi this is really interesting information...

Did you try the Morfeo's Codes? I have tried to use them with no luck. I'm not sure if the way I'm inserting them in VBALink is wrong or the version of the rom i have is not correct (Emerald US/Europe Rev A).

Anyway a tool to patch the save files or some already patched files with those wonder cards in them will be really nice to have...

PS: Here is a save file i found online containing a legit aurora ticket wonder card (that you cannot share).

[ATTACH]12502[/ATTACH]

That's amazing! Thank you so much. This is all I needed. I will check this save file out later. :D

I can't promise you anything right now, but with this I might have everything I need.

Yes, I tried Morfeo's codes before and they do work. I don't know why it didn't worked for you.

Please make sure to use the Master Code and Anti-DMA for the respective Game you're using.

I will list the Master Code in the top post for you.

And after every block of AR codes you have to save and reset.

You can watch Morfeo's Tutorial to see what I mean.

very nice!

but where to input the AR Codes?? after 12 years they sell no AR Devices more.... and japanese codes dont word on PAL or US devices...i try it

Morfeo dont List Japanese Codes (mastercode, etc)

If you don't have an Action Replay the only option would be an Emulator like VBA.

You can insert them there as Gameshark Codes.

Yes, indeed, the japanese codes only work for the japanese versions. But this is no problem because we have Morfeo's codes. He didn't listed the japanese (m) codes, because his codes aren't compatible with the japanese version anyway.

Share this post


Link to post
Share on other sites

Thanks for the clarifications ajxpkm.

The issue was that i was inserting the master code/RMA code only once at the beginning... After i watch the video i was able to enable the Aurora Ticket and Mystic Ticket wonder cards. I haven't test with the other ones...

Now any ideas on how to change the text that appears both on card and in-game once you use it?

Share this post


Link to post
Share on other sites

NEWSFLASH

I checked the save file you posted and I have good and bad news.

The BAD news first... the Ticket is already taken from the delivery guy in the Pokémon Center at the 2F.

Now I couldn't figure out where exactly the flag for this is, so I couldn't reverse the process in the short time.

And my thought was that it could be that the script gets deleted as soon as you receive the Ticket. This was at least the case with the Eon Ticket.

But now the GOOD news! After I checked the save file out more I found the script still intact. The script seems to be tied to the Wonder Card and it will be deleted as soon as you toss it. This also explains why the delivery guy is still there until you toss the Wonder Card. Lucky for us. :)

The weird things is that I found some french text there, too. I don't know why... but nevermind.

I will check more into this later.

Thanks for the clarifications ajxpkm.

The issue was that i was inserting the master code/RMA code only once at the beginning... After i watch the video i was able to enable the Aurora Ticket and Mystic Ticket wonder cards. I haven't test with the other ones...

Now any ideas on how to change the text that appears both on card and in-game once you use it?

Glad you got it to work.

Changing the text is actually not an too big issue. And now since I got the original text I think I will start to change the text for the Wonder Card and the script.

Share this post


Link to post
Share on other sites

It's nice to see some progress. :smile: Looking forward to see the final result...

By the way can you tell me what tools you are using? I'm totally newbie to this, but i'm interest to learn more...

I did some research in the rom code by the way. Here is the actual code of the specific event (i think it includes the flags and the checks that are made). It also includes the formal in-game text:

'---------------
#org 0x276B03
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x8276B23
goto 0x8276B19

'---------------
#org 0x276B23
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x8276B19
checkflag 0x8B3
if 0x1 goto 0x8276B19
msgbox 0x8273594 MSG_KEEPOPEN '"Thank you for using the MYSTERY\nE..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x82735F2 MSG_KEEPOPEN '"It appears to be for use at\nthe L..."
release
end

'---------------
#org 0x276B19
executeram
msgbox 0x8273178 MSG_FACE '"Thank you for accessing the\nMYSTE..."
end


'---------
' Strings
'---------
#org 0x273594
= Thank you for using the MYSTERY\nEVENT System.\pYou must be [player].\nThere is a ticket here for you.

#org 0x2735F2
= It appears to be for use at\nthe LILYCOVE CITY port.\pWhy not give it a try and see what\nit is about?

#org 0x273178
= Thank you for accessing the\nMYSTERY GIFT System.

Share this post


Link to post
Share on other sites
It's nice to see some progress. :smile: Looking forward to see the final result...

By the way can you tell me what tools you are using? I'm totally newbie to this, but i'm interest to learn more...

I did some research in the rom code by the way. Here is the actual code of the specific event (i think it includes the flags and the checks that are made). It also includes the formal in-game text:

'---------------
#org 0x276B03
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x8276B23
goto 0x8276B19

'---------------
#org 0x276B23
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x8276B19
checkflag 0x8B3
if 0x1 goto 0x8276B19
msgbox 0x8273594 MSG_KEEPOPEN '"Thank you for using the MYSTERY\nE..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x82735F2 MSG_KEEPOPEN '"It appears to be for use at\nthe L..."
release
end

'---------------
#org 0x276B19
executeram
msgbox 0x8273178 MSG_FACE '"Thank you for accessing the\nMYSTE..."
end


'---------
' Strings
'---------
#org 0x273594
= Thank you for using the MYSTERY\nEVENT System.\pYou must be [player].\nThere is a ticket here for you.

#org 0x2735F2
= It appears to be for use at\nthe LILYCOVE CITY port.\pWhy not give it a try and see what\nit is about?

#org 0x273178
= Thank you for accessing the\nMYSTERY GIFT System.

Wow, this is really in the ROM file? I didn't knew this.

The item you get from the script you found is 113 which is actually the Eon Ticket.

Usually you get this ticket from the father in Petalburg City, the text was different, too.

The text you found btw. appears to be the same like the one I found in the save file and seems to be used for all the Mystery Gift tickets. Maybe the Eon Ticket was planned to be distributed as a Mystery Gift Event?

Great find indeed.

I wonder if this script is on other localized versions (in their respective languages) as well.

If that's the case I could make Wonder Cards for other languages, too.

At least for the european versions it would be an easy thing to do.

Which tool did you use for this?

I always welcome recommendations.

I'm actually a beginner as well, especially when it comes to programing...

I was always fascinated, but never had enough time to go deeper into it.

For what I did today for example I just used some HEX editing tools like HxD.

And I use WinDiff to compare files.

If you want to know how I figured out the offset locations, I just tossed the Wonder Card and then I compared the save files to see what changed after I tossed it. It was very easy.

I will share the offset locations later if you're interested.

Edited by ajxpkm

Share this post


Link to post
Share on other sites
NEWSFLASH

I checked the save file you posted and I have good and bad news.

The BAD news first... the Ticket is already taken from the delivery guy in the Pokémon Center at the 2F.

Now I couldn't figure out where exactly the flag for this is, so I couldn't reverse the process in the short time.

And my thought was that it could be that the script gets deleted as soon as you receive the Ticket. This was at least the case with the Eon Ticket.

But now the GOOD news! After I checked the save file out more I found the script still intact. The script seems to be tied to the Wonder Card and it will be deleted as soon as you toss it. This also explains why the delivery guy is still there until you toss the Wonder Card. Lucky for us. :)

you need an Untouched Ticket?

in my Game collection i've found a LG savegame where i didn't pickup the Auroraticket on the 2F. (Legit Ticket pick up

in Real life event - Pokemon Day 2005 Germany)

:wink: so yoou're Right - Lucky for us.

POKEMON_LEAF_BPGD00.sav

That's amazing! Thank you so much. This is all I needed. I will check this save file out later. :D

I can't promise you anything right now, but with this I might have everything I need.

Yes, I tried Morfeo's codes before and they do work. I don't know why it didn't worked for you.

Please make sure to use the Master Code and Anti-DMA for the respective Game you're using.

I will list the Master Code in the top post for you.

And after every block of AR codes you have to save and reset.

You can watch Morfeo's Tutorial to see what I mean.

If you don't have an Action Replay the only option would be an Emulator like VBA.

You can insert them there as Gameshark Codes.

Yes, indeed, the japanese codes only work for the japanese versions. But this is no problem because we have Morfeo's codes. He didn't listed the japanese (m) codes, because his codes aren't compatible with the japanese version anyway.

so i've looking around the website and translate with google....

then i found the Japanese (M) Master codes here:

only FireRed and LeafGreen

http://web.archive.org/web/20080124020623/http://www.h6.dion.ne.jp/~taka.999/page013.html

上記のコードが入力できたら、

 �@「マスターコード」+「RAMアドレス固定コード」+「各チケット・ブロック1」でゲームを開始、すぐにレポート。

  GBAの電源OFF。

 �A�@のやり方で「各チケット・ブロック2〜6」をレポートする。

 �B通常のゲームを開始して、PCの2Fに係員がいることを確認して下さい。

so it means:

Once the code above can be entered,

@ "Master code" + "RAM address fixed code" + start the game with "each ticket block 1", immediately report.

GBA of power OFF.

I want to report a "each ticket block 2-6" in the manner of A @.

Start the B normal game, make sure that there are attendant to 2F of the PC.

same procedere as Morfeo's

POKEMON_LEAF_BPGD00.sav

Edited by King Impoleon

Share this post


Link to post
Share on other sites
you need an Untouched Ticket?

in my Gamecollection i've found a LG savegame where i didn't pickup the Auroraticket on the 2F. (Legit Ticket pick up on Real life event - Pokemon Day 2005 Germany)

:wink: so yoou're Right - Lucky for us.

[ATTACH]12503[/ATTACH]

Thank you very much!

With this I could make German versions of the Wonder Cards as well. :)

so i've looking around the website and translate with google....

then i found the Japanese (M) Master codes here:

only FireRed and LeafGreen

http://web.archive.org/web/200801240...9/page013.html

上記のコードが入力できたら、

 �@「マスターコード」+「RAMアドレス固定コード」+「各チケット・ブロック1」でゲームを開始、す ぐにレポート。

  GBAの電源OFF。

 �A�@のやり方で「各チケット・ブロック2〜6」をレポートする。

 �B通常のゲームを開始して、PCの2Fに係員がいることを確認して下さい。

so it means:

Once the code above can be entered,

@ "Master code" + "RAM address fixed code" + start the game with "each ticket block 1", immediately report.

GBA of power OFF.

I want to report a "each ticket block 2-6" in the manner of A @.

Start the B normal game, make sure that there are attendant to 2F of the PC.

same procedere as Morfeo's

Yes, they work the same.

The reason why they listed the Master and Anti DMA Codes is because FR and LG has 2 different versions. (1.0 and 1.1)

It's very important to use the right version of codes for the respective version.

I will list all the Master and Anti DMA Codes for the Japanese versions later in the first post of the Thread.

Share this post


Link to post
Share on other sites

OK some really good news:

I was manage to insert aurora ticket to another save file using just the hex editor... The good news is that once you insert it, the ticket is unclaimed. And once you receive it, everything is working as expected :tongue: All the text is in English as well... Here is the save file:

Pokemon - Emerald Version (USA, Europe)CLEAN-MOD2.rar

Now the bad news is that once you edit the sav file using hex editor, the sav file becomes corrupted. Most probably there is some kind of checksum validation during the loading... I was manage to overcome this issue by open the edited file in a .sav editor tool and save it again...

Next step is to figure out how to enable/disable the distribute functionality by checking Morfeo's sav file... Also i need to figure out how to bypass the checksum validation without using other tools...

PS: Regarding the tools i'm using, it's a HEX editor... The Script was extracted using the AdvanceMap tool.

Pokemon - Emerald Version (USA, Europe)CLEAN-MOD2.rar

Share this post


Link to post
Share on other sites
OK some really good news:

I was manage to insert aurora ticket to another save file using just the hex editor... The good news is that once you insert it, the ticket is unclaimed. And once you receive it, everything is working as expected :tongue: All the text is in English as well... Here is the save file:

[ATTACH]12504[/ATTACH]

Now the bad news is that once you edit the sav file using hex editor, the sav file becomes corrupted. Most probably there is some kind of checksum validation during the loading... I was manage to overcome this issue by open the edited file in a .sav editor tool and save it again...

Next step is to figure out how to enable/disable the distribute functionality by checking Morfeo's sav file... Also i need to figure out how to bypass the checksum validation without using other tools...

PS: Regarding the tools i'm using, it's a HEX editor... The Script was extracted using the AdvanceMap tool.

Good work!

About the checksum....

Yeah, I had exactly the same problem, it's normal that when you change the save file you also have to fix the checksum.

Can be fixed as you did with a tool or manually. If we create a tool we have to implement the checksum fix.

But personally I would prefer to have this in an all-in-one tool like KazoWAR's A-Save or another tool, I see not much reason for having a separate tool for this.

Currently I'm messing around with the Wonder Card to see how it works.

About which bytes are used to decide which of the card design is used ect.

But I didn't figured it out yet.

This could be useful if we want to make custom Wonder Cards.

There are 8 different card designs.

Btw. for everyone who's interested in it, the Wonder Card Offset on the save file is located at 0x560 and again at 0x1B560.

EDIT:

Well... I stuck right now.

Whenever I edit the Wonder Card the checksum gets invalid and when I fix it the Wonder Card is gone.

It's treated like I don't have a Wonder Card.

When I check with my HEX Editor it's still there, I need to find out why I can't access my Wonder Card in the game...

Maybe there's another checksum for this?

I remember that the Japanese Guy (Taka) from the site wrote a diary and I think he was mentioning this issue here:

http://web.archive.org/web/20080106083812/http://www.h6.dion.ne.jp/~taka.999/page002.html

Edited by ajxpkm

Share this post


Link to post
Share on other sites

I think we need to read those notes... It will save as some time :)

Some new findings:

Wonder Card is at 0x560 as you mentioned before. In my previous injection, i put it only on 0x560 and it worked perfectly. I didn't notice that there was a 2nd location until you mention it, so i investigate further... Once I received the aurora ticket and save, wonder card code was stored and in the 2nd location as well...

If you want to change the icon on the upper right of the Wonder Card here is the address:

0x6c6 - 0x6c7 : FF FF --> ? icon

9A 01 --> Deoxys icon

I have tried some random values and different pokemon appear... No luck with the colors though...

Share this post


Link to post
Share on other sites

On location is current save the other is backup/previous save hence there are 2 of them.

The save has 2 main blocks with 57344 (0xE000) bytes each.

Each block is seperated into 14 sections with 4096 (0x1000) bytes.

In each section, 0xFF4 is the section ID, 0xFF6 - 0xFF7 is the checksum and 0xFFC - 0xFFF is the save counter.

Depending on the save counter you could determine the current save.

Share this post


Link to post
Share on other sites
I think we need to read those notes... It will save as some time :)

Some new findings:

Wonder Card is at 0x560 as you mentioned before. In my previous injection, i put it only on 0x560 and it worked perfectly. I didn't notice that there was a 2nd location until you mention it, so i investigate further... Once I received the aurora ticket and save, wonder card code was stored and in the 2nd location as well...

If you want to change the icon on the upper right of the Wonder Card here is the address:

0x6c6 - 0x6c7 : FF FF --> ? icon

9A 01 --> Deoxys icon

I have tried some random values and different pokemon appear... No luck with the colors though...

How did you do that? Can you change the text as well?

Because whenever I change something about the Wonder Card it disappears until I change it back to was it was before...

But I'm glad at least you made some progress. :)

Too bad about the colors though...

On location is current save the other is backup/previous save hence there are 2 of them.

The save has 2 main blocks with 57344 (0xE000) bytes each.

Each block is seperated into 14 sections with 4096 (0x1000) bytes.

In each section, 0xFF4 is the section ID, 0xFF6 - 0xFF7 is the checksum and 0xFFC - 0xFFF is the save counter.

Depending on the save counter you could determine the current save.

Thank you for the clarification.

I already had a guess about this, because my changes to the save file only had an effect when I changed them in the other block, too.

Do you know anything about how the checksums are calculated? Maybe I should google about it...

Share this post


Link to post
Share on other sites

Thanks BlackShark.

I did a bit of research and figured out that the MYSTERY GIFT Script lostaddict found is on every Emerald Version.

Now I have the Scripts for all the European Versions.

'---------------
#org 0x28287F
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x828289F
goto 0x8282895

'---------------
#org 0x28289F
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x8282895
checkflag 0x8B3
if 0x1 goto 0x8282895
msgbox 0x827EE02 MSG_KEEPOPEN '"Danke, dass du das GEHEIM-\nGESCHE..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x827EE65 MSG_KEEPOPEN '"Du kannst es am Hafen von\nSEEGRAS..."
release
end

'---------------
#org 0x282895
executeram
msgbox 0x827E965 MSG_FACE '"Danke, dass du das GEHEIM-\nGESCHE..."
end


'---------
' Strings
'---------
#org 0x27EE02
= Danke, dass du das GEHEIM-\nGESCHEHEN benutzt hast.\pDu musst [player] sein.\nHier ist ein Ticket fur dich!

#org 0x27EE65
= Du kannst es am Hafen von\nSEEGRASULB CITY einsetzen.\pWarum probierst du es nicht\neinfach aus?

#org 0x27E965
= Danke, dass du das GEHEIM-\nGESCHEHEN-System benutzt hast.

'---------------
#org 0x27C0CB
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x827C0EB
goto 0x827C0E1

'---------------
#org 0x27C0EB
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x827C0E1
checkflag 0x8B3
if 0x1 goto 0x827C0E1
msgbox 0x82788E2 MSG_KEEPOPEN '"Merci d'utiliser le systeme\nEVENE..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x8278942 MSG_KEEPOPEN '"Il peut etre utilise au port de\nN..."
release
end

'---------------
#org 0x27C0E1
executeram
msgbox 0x8278461 MSG_FACE '"Merci d'utiliser le systeme\nCADEA..."
end


'---------
' Strings
'---------
#org 0x2788E2
= Merci d'utiliser le systeme\nEVENEMENTS MYSTERE.\pVous devez etre [player].\nIl y a un ticket pour vous.

#org 0x278942
= Il peut etre utilise au port de\nNENUCRIQUE.\pEssayez-le pour voir de quoi \nil s'agit.

#org 0x278461
= Merci d'utiliser le systeme\nCADEAU MYST.

'---------------
#org 0x27A995
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x827A9B5
goto 0x827A9AB

'---------------
#org 0x27A9B5
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x827A9AB
checkflag 0x8B3
if 0x1 goto 0x827A9AB
msgbox 0x827741B MSG_KEEPOPEN '"Gracias por usar el sistema\nde lo..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x8277489 MSG_KEEPOPEN '"Parece que puedes usarlo en el\nPU..."
release
end

'---------------
#org 0x27A9AB
executeram
msgbox 0x8277002 MSG_FACE '"Gracias por acceder al sistema\nde..."
end


'---------
' Strings
'---------
#org 0x27741B
= Gracias por usar el sistema\nde los EVENTOS MISTERIOSOS.\pDebes de ser [player], ?no?\pPues tenemos un ticket para ti.

#org 0x277489
= Parece que puedes usarlo en el\nPUERTO de CIUDAD CALAGUA.\p?Por que no curioseas un poco\npara ver de que se trata?

#org 0x277002
= Gracias por acceder al sistema\ndel REGALO MISTERIOSO.

'---------------
#org 0x2767EF
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x827680F
goto 0x8276805

'---------------
#org 0x27680F
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x8276805
checkflag 0x8B3
if 0x1 goto 0x8276805
msgbox 0x82731D8 MSG_KEEPOPEN '"Grazie per usare il Sistema\nEVENT..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x8273231 MSG_KEEPOPEN '"Dovrebbe servirti allo scalo di\nP..."
release
end

'---------------
#org 0x276805
executeram
msgbox 0x8272DD8 MSG_FACE '"Grazie per usufruire del Sistema\n..."
end


'---------
' Strings
'---------
#org 0x2731D8
= Grazie per usare il Sistema\nEVENTO SEGRETO.\pTu sei [player], vero? Ho qui\nun biglietto per te.

#org 0x273231
= Dovrebbe servirti allo scalo di\nPORTO ALGHEPOLI.\pTi conviene andare a vedere\ndi persona.

#org 0x272DD8
= Grazie per usufruire del Sistema\nDONO SEGRETO!

This is btw. what I found instead in Firered:

'---------------
#org 0x1BB1D2
special 0x187
compare LASTRESULT 0x2
if 0x1 goto 0x81A7AE0
special 0x188
executeram
msgbox 0x81A6393 MSG_FACE '"Thank you for accessing the\nMYSTE..."
end

'---------------
#org 0x1A7AE0
release
end


'---------
' Strings
'---------
#org 0x1A6393
= Thank you for accessing the\nMYSTERY GIFT System.

Edited by ajxpkm

Share this post


Link to post
Share on other sites

Some more info (most of them are speculations):

WCData.png

EVENT TYPE:

E8 03 FF FF --> AURORA TICKET

E9 03 FF FF --> MYSTIC TICKET

EA 03 FF FF --> OLD SEA MAP

This seems to be the identification of the wonder card event. (Not confirmed yet)

CARD COLOR:

08 --> RED

9C --> GREY

94 --> YELLOW

This seems to be the wonder card color. (Not confirmed yet)

POKEMON ICON:

01 00 --> Bulbasaur Icon

F9 00 --> Deoxys Icon

FF FF --> Questionmark Icon

This is the icon located on the upper right of the wonder card. Values are start from 01 to F9. (confirmed)

CHECKSUM:

This seems to be the checksum of the wonder card data. In order to be able to edit the text of the card we need to figure out how to compute this... Event type, Card color and Card text are part of the data that checksum is compute on... For some reason the Wonder Card Icon is not...

Share this post


Link to post
Share on other sites

I still struggle to find out how the checksum is calculated.

I will use 32 bytes from the Wonder Card for this example.

According to Taka's Website it's calculated like this...


00000570   E8 03 FF FF 00 00 00 00 08 00 00 00 00 00 00 00   è.ÿÿ............
00000580   00 00 00 00 BB CF CC C9 CC BB CE C3 BD C5 BF CE   ....»ÏÌÉÌ»ÎýſÎ


We have to separate these 32 bytes into 4 bytes groups from left to right.
Then we have to add them together, but before we do this we have to swap the bytes from these groups. (From ABCD to DCBA)
As an example... E8 03 FF FF will become FF FF 03 E8.


0xFFFF03E8 + 0x00000000 + 0x00000008 + 0x00000000 + 
0x00000000 + 0xC9CCCFBB + 0xC3CEBBCC + 0xCEBFC5BD 
= 0x5C5A5534 AND 0xFFFFFFFF
= 5C5A5534 

Then we cut this sum in high and low bytes and sum them together as well.

0x5C5A + 0x5534 = 0xB18E

And this is the result, the checksum for these 32 bytes would be B18E.
On the save file it would be 0x8E 0xB1.

Edited by ajxpkm
Errors fixed*

Share this post


Link to post
Share on other sites
I still struggle to find out how the checksum is calculated.

I will use 32 bytes from the Wonder Card for this example.

According to Taka's Website it's calculated like this...


00000570   E8 03 FF FF 00 00 00 00 08 00 00 00 00 00 00 00   è.ÿÿ............
00000580   00 00 00 00 BB CF CC C9 CC BB CE C3 BD C5 BF CE   ....»ÏÌÉÌ»ÎýſÎ


We have to separate these 32 bytes into 4 bytes groups from left to right.
Then we have to add them together, but before we do this we have to swap the bytes from these groups. (From ABCD to DCBA)
As an example... E8 03 FF FF will become FF FF 03 E3.


0xFFFF03E3 + 0x00000000 + 0x00000008 + 0x00000000 + 
0x00000000 + 0xC9CCCFBB + 0xC3CEBBCC + 0xCEBFC5BD 
= 0x5C5A552F


Then we cut this sum in high and low bytes and sum them together as well.

0x5C5A + 0x552F = 0xB189

And this is the result, the checksum for these 32 bytes would be B189.
On the save file it would be 0x89 0xB1.

Missed a step, but the result is correct:

0xFFFF03E3 + 0x00000000 + 0x00000008 + 0x00000000 +

0x00000000 + 0xC9CCCFBB + 0xC3CEBBCC + 0xCEBFC5BD

= 0x5C5A552F AND 0xFFFFFFFF

= 0x5C5A552F

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×