[GEN 3] Mystery Event/Gift Research

[ajxpk]

A
Time to share everything we have learned from the research. 

Mystery Event Activation
RS: Section 2 - 0x03A9 - bit 6
RS: Section 2 - 0x05C0 - bit 2 (Flag for the NPC?)
E: Section 2 - 0x0405 - bit 6

Notes:
In Ruby & Sapphire Mystery Event can be activated by the NPC at the 1F of the Pokemon Centerin Petalburg City, right next to the PC.
The requirement for the activation is beating the Gym Leader Norman and getting the Balance Badge from the Petalburg Gym.
To activate it you have to tell him a specific phrase using the easy chat system. 

In Emerald Mystery Event can be activated by answer the questionnaire in the Pokemon Market. The only requirement is that you have received the PokeDex. 
The phrase that activates the Mystery Event feature is:

Japanese: ふしぎ できごと わくわく ドキドキ
English: MYSTERY EVENT IS EXCITING
French: EVENEMENT MYSTERE EST PASSIONNANT
German: GEHEIM GESCHEHEN IST JIPP!JIPP!
Spanish: EVENTO MISTERIOSO ES DEMASIADO
Italian: EVENTO SEGRETO È FANTASTICO

 

Mystery Gift Activation
FRLG: Section 2 - 0x0067 - bit 1
E: Section 2 - 0x040B - bit 4

In Mystery Gift can be activated by answer the questionnaire in the Pokemon Market. The only requirement is that you have received the PokeDex. 
The phrase that activates the Mystery Gift feature is:

Japanese: ともだち いっぱい ふしぎ つうしん
English: LINK TOGETHER WITH ALL
French: CONNEXION AVEC LES DRESSEUR
German:	LINK MIT ALLE ZUSAMMEN
Spanish: CONEXIÓN CON TODOS
Italian: INSIEME IN LINK !

 

Berry Data Structure
RS: Section 4 -  0x02E0

0x000 - 0x006	berry name + 0xFF string terminator
0x007		firmness
0x008 - 0x009	size (in mm)
0x00A		max yield
0x00B		min yield
0x00C - 0x00F	berry tag line 1 RAM offset
		0x02028D50 (US) / 0x02028AB0 (JP)
0x010 - 0x013	berry tag line 2 RAM offset
		0x02028D7D (US) / 0x02028ADD (JP)
0x014		growth time per stage (in hours)
0x015 - 0x019	flavor
0x01A		smoothness
0x01B		0
0x01C - 0x49B	berry sprite (4bpp) (48 x 48 px)
0x49C - 0x4BB	palette (16x2 Bytes / 5 bits per color)
0x4BC - 0x4E8	berry tag line 1
0x4E9 - 0x515	berry tag line 2
0x516 - 0x519	effect in bag
0x520 - 0x527	filled with 0
0x528 - 0x529	effect as held item
0x52A - 0x52B	filled with 0
0x52C - 0x52F	checksum


Effects as held item
0x00	no effect
0x04	cures poison
0x05	cures burn
0x06	cures freeze
0x08	cures confusion
0x17	restores a lowered stat
0x1C	cures infatuation

The size is ‭1328‬ bytes.

FRLG/E Berry Structure

FRLG: Section 4- 0x026C
E: Section 4 - 0x0378 

0x00 - 0x06	berry name + 0xFF string terminator
0x07		firmness
0x08 - 0x09	size (in mm)
0x0A		max yield
0x0B		min yield
0x0C - 0x0F	berry tag line 1 ROM offset
0x10 - 0x13	berry tag line 2 ROM offset
0x14		growth time per stage (in hours)
0x15 - 0x19	flavor
0x1A		smoothness
0x1B		0
0x1C - 0x1F	effect in bag
0x24 - 0x27 	unknown pointer
0x28 - 0x2B 	unknown pointer
0x2D - 0x2E 	unknown
0x2E - 0x2F	effect as held item
0x30 - 0x33	checksum

The size is 52‬ bytes.

Berry Checksum

unsigned long berryChecksum(char* berry)
{
	int x;
	unsigned long checksum = 0;
	for(x = 0;  x < 0x52C; x++)
		if(x < 0xC || x >= 0x14)
			checksum += (berry[x] & 0xFF);
	return checksum;
}

Moosdeep City/Seven Island/Sootopolis Trainer Data Structure
RS: Section 0 - 0x0498
FRLG: Section 0 - 0x04A0
E: Section 0 - 0x0BEC 

0x00	- Battle Tower Type
0x01	- Trainerclass		sprite indexes differ between the game versions
0x02	- Battle Tower Lv	0x00 => Lv 50; 0x01 => Lv 100
0x03	- 0x00
0x04	- Trainer Name		RS (US/EU): up to 7 Bytes + string terminator 0xFF
				RS (Jap), FRLG & E: up to 5 Bytes + string terminator 0xFF
0x0C	- Trainer ID		default: 0x0000
0x0E	- Trainer SID		default: 0x0000
0x10	- Intro quote     	6 x 2 Bytes
0x1C	- Win quote		6 x 2 Bytes
0x28	- Lose quote		6 x 2 Bytes
0x34	- 1st Pokemon		44 Bytes
0x60	- 2nd Pokemon		44 Bytes
0x8C	- 3rd Pokemon		44 Bytes
0xB8	- Checksum		4 Bytes (all 184 Bytes of the trainer
				data added together as words)

Pokemon structure (44 Bytes)
0x00	- Species		2 Bytes
0x02	- Item			2 Bytes
0x04	- 1st Move		2 Bytes
0x06	- 2nd Move		2 Bytes
0x08	- 3rd Move		2 Bytes
0x0A	- 4th Move		2 Bytes
0x0C	- Level
0x0D	- 0x00
0x0E	- HP EVs
0x0F	- Atk. EVs
0x10	- Def. EVs
0x11	- Init. EVs
0x12	- SP.Atk. EVs
0x13	- SP.Def. EVs
0x14	- ID			2 Bytes
0x16	- SID			2 Bytes
0x18	- IVs			4 Bytes
0x1C	- PID			4 Bytes
0x20	- Nickname		up to 9 Bytes + string terminator 0xFF
0x2A	- 0x00
0x2B	- 0xFF

The size is 188 bytes.

Mystery Gift Information

Serial Number for Pokémon JoySpot (Japan): 0x7f7f
Serial Number for Pokémon JoySpot (International): 0x7f7d


Base Offset
FRLG: Section 4 - 0x02A0
E: Section 4 - 0x03AC

Wonder News Data Structure

Japanese

Offset	Len	Description
0x00	u16	Checksum	/// for the data between offset 0x4 and 0xE4 (224 Bytes)
				/// Method: crc16
0x02	u16	Padding
0x04	u16	ID
0x06	u8	Resend Flag
		Resend Flag: 0 = OFF, 1 = ON
0x07	u8	Color
		Color: 1 = 0, 2 = 1, 3 = 2, 4 = 3, 5 = 4, 6 = 5, 7 = 6, 8 = 7
0x08	20	Title
0x1C	20	Contents Line
0x30	20	Contents Line
0x44	20	Contents Line
0x58	20	Contents Line
0x6C	20	Contents Line
0x80	20	Contents Line
0x94	20	Contents Line
0xA8	20	Contents Line
0xBC	20	Contents Line
0xD0	20	Contents Line

International

Offset	Len	Description
0x00	u16	Checksum	/// for the data between offset 0x4 and 0x1C0. (444 Bytes)
				/// Method: crc16
0x02	u16	Padding
0x04	u16	ID
0x06	u8	Resend Flag
		Resend Flag: 0 = OFF, 1 = ON
0x07	u8	Color
		Color: 1 = 0, 2 = 1, 3 = 2, 4 = 3, 5 = 4, 6 = 5, 7 = 6, 8 = 7
0x08	40	Title
0x30	40	Contents Line
0x58	40	Contents Line
0x80	40	Contents Line
0xA8	40	Contents Line
0xD0	40	Contents Line
0xF8	40	Contents Line
0x120	40	Contents Line
0x148	40	Contents Line
0x170	40	Contents Line
0x198	40	Contents Line

Wonder Card Data Structure

Japanese

FRLG: Section 4 - 0x0384
E: Section 4 - 0x0490

Offset	Len	Description
0x00	u16	Checksum	/// for the data between offset 0x4 - 0xA8 (164 Bytes)
				/// Method: crc16
0x02	u16	Padding
0x04	u16	Event ID
0x06	u16	Default Icon
0x08	u32	Count
0x0C	u8	Type/Color/Resend Flag
		Type: 0 = Event, 1 = Stamp, 2 = Counter
		Color: 1 = 0x00, 2 = 0x04, 3 = 0x08, 4 = 0x0C, 5 = 0x10, 6 = 0x14, 7 = 0x18, 8 = 0x1C
		Resend Flag: 0x40 = Sendable without Resend Flag, 0x80 = Sendable with Resend Flag
0x0D	u8	Stamp Max
0x0E	18	Title
0x20	13	Subtitle
0x2D	20	Contents Line
0x41    20	Contents Line
0x55	20	Contents Line
0x69	20	Contents Line
0x7D	20 	Warning Line
0x91	20	Warning Line

 

International

FRLG: Section 4 - 0x0460
E: Section 4 - 0x056C

Offset	Len	Description
0x00	u16	Checksum	/// for the data between offset 0x4 - 0x150 (336 Bytes)
0x02	u16	Padding
0x04	u16	Event ID
0x06	u16	Default Icon
0x08	u32	Count
0x0C	u8	Type/Color/Resend Flag
		Type: 0 = Event, 1 = Stamp, 2 = Counter
		Color: 1 = 0x00, 2 = 0x04, 3 = 0x08, 4 = 0x0C, 5 = 0x10, 6 = 0x14, 7 = 0x18, 8 = 0x1C
		Resend Flag: 0x40 = Sendable without Resend Flag, 0x80 = Sendable with Resend Flag
0x0D	u8	Stamp Max
0x0E	40	Title
0x36	40	Subtitle
0x5E	40	Contents Line
0x86    40	Contents Line
0xAE	40	Contents Line
0xD6	40	Contents Line
0xFE	40 	Warning Line
0x126	40	Warning Line

Event Script Data Structure
RS: Section 4 - 0x0810
FRLG: Section 4 - 0x079C
E: Section 4 - 0x08A8

Offset	Len	Content
0x0	u16	Checksum	/// Protects data between 0x4 - 0x3EB (1000 bytes)
				/// Method: checksum16 for RS, crc16 for FRLGE
0x2	u16	Padding
0x4	1000	Event Script

Eon Ticket (Emerald Version)
E: Section 2 - 0x049A - bit 6

Note: Unlike in Ruby & Sapphire the Eon Ticket Mystery Event is hardcoded and activated by a flag.
Officially this was only used in Japan but the flag exists in all localized versions as well.
When it's set the delivery guy appears at the 2F of the Pokemon Center, when you talk to him he will give you the Eon Ticket.

Record Mixing Item
RS: Section 4 - 0x0BFC
E: Section 4 - 0x0C94

Offset	Len	Content
0x0	u16	Checksum	/// Protects data between 0x4 - 0x8 (4 bytes)
				/// Method: checksum16
0x2	u16	Padding
0x4	u8	Max
0x5	u8	Count
0x6	u16	Item ID

Notes:
The item can be sent until the count reaches maximum. The count increments even if no item is sent.
Eon Tickets from official Events could be exchanged 151 times, while in case of the e-Card version 30 times.
If the sent item is an Eon Ticket the activation flag for the Event is automatically set by the receiving game.

CRC16

unsigned int __fastcall crc16(int a1, unsigned int a2)
{
    unsigned int v2; // r2
    unsigned int i; // r3

    v2 = 0x1121; // This is the seed
    for ( i = 0; i < a2; i = (i + 1) & 0xFFFF )
        v2 = *(unsigned __int16 *)((char *)crc16_ccitt_table + (2 * (v2 ^ *(unsigned __int8 *)(a1 + i)) & 0x1FF)) ^ (v2 >> 8);
    return ~v2 & 0xFFFF;
}

crc16_ccitt_table.bin

Extracted Mystery Gift Data from the ROMs (Includes Samples)
Mystery Gift Data.zip

 

 

 

-Links-

Pokémon.co.jp -  むげんのチケット
http://web.archive.org/web/20030201082646/http://www.pokemon.co.jp/event/mugen.html

http://www9.plala.or.jp/giw0011/game1.html

Information about JOYSPOT Events
Nintendo.co.jp - ポケモン ふしぎなニュース配信サービス
http://web.archive.org/web/20040901033951/http://www.nintendo.co.jp/n08/bprj/joyspot/news/index.html

Nintendo.co.jp - ☆ポケモン チャレンジバトル
https://www.nintendo.co.jp/nom/0404/pokemon/index.html

Pokémon.co.jp - 「ポケモンのタマゴ」プレゼント
http://web.archive.org/web/20040319200750/http://www.pokemon.co.jp/event/0324egg/index.html

Nintendo.co.jp - 「しんぴのチケット」プレゼント ２００４
http://web.archive.org/web/20040901035438/http://www.nintendo.co.jp/n08/bprj/joyspot/shinpi/index.html

Pokémon.co.jp - Pokémon Festa 2004 - Mystic Ticket Distribution 2004 (Japanese)
http://web.archive.org/web/20040615095104/http://www.pokemon.co.jp/event/festa2004/shinpi.html

Nintendo.co.jp - Pokémon Festa 2004 Resume
https://www.nintendo.co.jp/nom/0409/newinfo/index.html

Pokémon.co.jp - Pokémon Festa 2005 - Old Sea Map Distribution 2005 (Japanese)
http://web.archive.org/web/20060205094715/http://www.pokemon.co.jp/event/festa2005/game02.html#mew

Pokémon.co.jp - Pokémon Festa 2005 - Mystic Ticket Distribution 2005 (Japanese)
http://web.archive.org/web/20051018184055/http://www.pokemon.co.jp/event/festa2005/game021.html

Pokémon.co.jp - Official Ticket Site for the Distribution of 2006-2007 (Japanese)
http://web.archive.org/web/20070114111635/http://www.pokemon.co.jp/special/ticket/

Nintendo.co.jp - Nintendo Online Magazine - PokéPark Egg Present Page (Japanese)
http://www.nintendo.co.jp/nom/0504/1_2/

 たかさん links

Spoiler

The archived website of たかさん (Japanese)

http://web.archive.org/web/20080124205147/http://www.h6.dion.ne.jp/~taka.999/index.html

Japanese Injection Tools from たかさん:

TicketPRS (for Ruby & Sapphire)

http://web.archive.org/web/20080119194213/http://www.h6.dion.ne.jp/~taka.999/TicketPRS.exe

TicketP (for FireRed & LeafGreen)

http://web.archive.org/web/20080119194213/http://www.h6.dion.ne.jp/~taka.999/TicketP.exe

TicketPE - たかさん's Events Version (for Emerald)

http://web.archive.org/web/20080119194213/http://www.h6.dion.ne.jp/~taka.999/TicketPE.exe

TicketPEe - Real Distributed Events Version (for Emerald)

http://web.archive.org/web/20080119194213/http://www.h6.dion.ne.jp/~taka.999/TicketPEe.exe

PARPokeEE - PokéPark Egg Present Tool (Emerald Only I guess...)

http://web.archive.org/web/20080106083816/http://www.h6.dion.ne.jp/~taka.999/PARPokeEE.exe

 

Other related links
https://forums.glitchcity.info/index.php?topic=7114.0
 

 

Edited October 26, 2021 by ajxpk

[King Impoleon]

I've found this

http://web.archive.org/web/20080124205147/http://www.h6.dion.ne.jp/~taka.999/index.html

i DONT Know what it is but it looks very good

for every specific Game you can choose wich Ticket you want and input on you're game (i dont know if with or without Wondercard)...so i think it works...

[King Impoleon]

Oh! Only AR Codes also....boring but good

I thought that you have to enter a save file of the game and this program then write the events and wonderful cards on this save file.

[lostaddict]

Hi this is really interesting information...

Did you try the Morfeo's Codes? I have tried to use them with no luck. I'm not sure if the way I'm inserting them in VBALink is wrong or the version of the rom i have is not correct (Emerald US/Europe Rev A).

Anyway a tool to patch the save files or some already patched files with those wonder cards in them will be really nice to have...

PS: Here is a save file i found online containing a legit aurora ticket wonder card (that you cannot share).

Sauvegames Aurora.rar

[King Impoleon]

No, you're half-right. Sorry for the confusion.

It's right that the content of the Wonder Cards or at least the text and the script is not in the game. (As mentioned in my first post...)

But the Events are and they are triggered by having the respective Event Item in the Bag and the flag for the Event activated.

But at the end it's still code and way more complicated, because the offsets in the localized games are different.

That's why the Japanese codes wouldn't work for the other versions and vice versa.

We're quite lucky that Morfeo's Codes working for the English versions. I admit that I wouldn't be able to find this out by myself so I'm thankful because the work is already done.

Otherwise I wouldn't have opened this thread.

Btw. for everyone who's interested in the Japanese AR Codes for the Tickets they are located here:

http://web.archive.org/web/20080124020623/http://www.h6.dion.ne.jp/~taka.999/page013.html

And here are the Egg Codes:

http://web.archive.org/web/20080106083826/http://www.h6.dion.ne.jp/~taka.999/page036.html

At the end wether you use the Tools or insert the values manually via AR Codes, there is not much difference.

Because what you're actually doing is nothing more than editing the HEX values in the save file.

In the practical sense the tools are very easy and convience to use and this is were we want to be in the future.

Especially because the Wonder Card AR Codes are so huge. And you can't insert them all at once, you have to do it blockwise. (6 Blocks!)

But for my purpose right now AR codes are not a bad thing, because I can easily figure out the RAM addresses and work with it.

very nice!

but where to input the AR Codes?? after 12 years they sell no AR Devices more.... and japanese codes dont word on PAL or US devices...i try it

Morfeo dont List Japanese Codes (mastercode, etc)

[lostaddict]

Thanks for the clarifications ajxpkm.

The issue was that i was inserting the master code/RMA code only once at the beginning... After i watch the video i was able to enable the Aurora Ticket and Mystic Ticket wonder cards. I haven't test with the other ones...

Now any ideas on how to change the text that appears both on card and in-game once you use it?

[lostaddict]

It's nice to see some progress. :smile: Looking forward to see the final result...

By the way can you tell me what tools you are using? I'm totally newbie to this, but i'm interest to learn more...

I did some research in the rom code by the way. Here is the actual code of the specific event (i think it includes the flags and the checks that are made). It also includes the formal in-game text:

'---------------
#org 0x276B03
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x8276B23
goto 0x8276B19

'---------------
#org 0x276B23
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x8276B19
checkflag 0x8B3
if 0x1 goto 0x8276B19
msgbox 0x8273594 MSG_KEEPOPEN '"Thank you for using the MYSTERY\nE..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x82735F2 MSG_KEEPOPEN '"It appears to be for use at\nthe L..."
release
end

'---------------
#org 0x276B19
executeram
msgbox 0x8273178 MSG_FACE '"Thank you for accessing the\nMYSTE..."
end


'---------
' Strings
'---------
#org 0x273594
= Thank you for using the MYSTERY\nEVENT System.\pYou must be [player].\nThere is a ticket here for you.

#org 0x2735F2
= It appears to be for use at\nthe LILYCOVE CITY port.\pWhy not give it a try and see what\nit is about?

#org 0x273178
= Thank you for accessing the\nMYSTERY GIFT System.

[King Impoleon]

NEWSFLASH

I checked the save file you posted and I have good and bad news.

The BAD news first... the Ticket is already taken from the delivery guy in the Pokémon Center at the 2F.

Now I couldn't figure out where exactly the flag for this is, so I couldn't reverse the process in the short time.

And my thought was that it could be that the script gets deleted as soon as you receive the Ticket. This was at least the case with the Eon Ticket.

But now the GOOD news! After I checked the save file out more I found the script still intact. The script seems to be tied to the Wonder Card and it will be deleted as soon as you toss it. This also explains why the delivery guy is still there until you toss the Wonder Card. Lucky for us.

you need an Untouched Ticket?

in my Game collection i've found a LG savegame where i didn't pickup the Auroraticket on the 2F. (Legit Ticket pick up

in Real life event - Pokemon Day 2005 Germany)

:wink: so yoou're Right - Lucky for us.

That's amazing! Thank you so much. This is all I needed. I will check this save file out later.

I can't promise you anything right now, but with this I might have everything I need.

Yes, I tried Morfeo's codes before and they do work. I don't know why it didn't worked for you.

Please make sure to use the Master Code and Anti-DMA for the respective Game you're using.

I will list the Master Code in the top post for you.

And after every block of AR codes you have to save and reset.

You can watch Morfeo's Tutorial to see what I mean.

If you don't have an Action Replay the only option would be an Emulator like VBA.

You can insert them there as Gameshark Codes.

Yes, indeed, the japanese codes only work for the japanese versions. But this is no problem because we have Morfeo's codes. He didn't listed the japanese (m) codes, because his codes aren't compatible with the japanese version anyway.

so i've looking around the website and translate with google....

then i found the Japanese (M) Master codes here:

only FireRed and LeafGreen

http://web.archive.org/web/20080124020623/http://www.h6.dion.ne.jp/~taka.999/page013.html

上記のコードが入力できたら、

　�@「マスターコード」＋「ＲＡＭアドレス固定コード」＋「各チケット・ブロック１」でゲームを開始、すぐにレポート。

　　ＧＢＡの電源ＯＦＦ。

　�A�@のやり方で「各チケット・ブロック２〜６」をレポートする。

　�B通常のゲームを開始して、ＰＣの２Ｆに係員がいることを確認して下さい。

so it means:

Once the code above can be entered,

@ "Master code" + "RAM address fixed code" + start the game with "each ticket block 1", immediately report.

GBA of power OFF.

I want to report a "each ticket block 2-6" in the manner of A @.

Start the B normal game, make sure that there are attendant to 2F of the PC.

same procedere as Morfeo's

POKEMON_LEAF_BPGD00.sav

Edited August 24, 2015 by King Impoleon

[lostaddict]

OK some really good news:

I was manage to insert aurora ticket to another save file using just the hex editor... The good news is that once you insert it, the ticket is unclaimed. And once you receive it, everything is working as expected :tongue: All the text is in English as well... Here is the save file:

Now the bad news is that once you edit the sav file using hex editor, the sav file becomes corrupted. Most probably there is some kind of checksum validation during the loading... I was manage to overcome this issue by open the edited file in a .sav editor tool and save it again...

Next step is to figure out how to enable/disable the distribute functionality by checking Morfeo's sav file... Also i need to figure out how to bypass the checksum validation without using other tools...

PS: Regarding the tools i'm using, it's a HEX editor... The Script was extracted using the AdvanceMap tool.

Pokemon - Emerald Version (USA, Europe)CLEAN-MOD2.rar

[lostaddict]

I think we need to read those notes... It will save as some time

Some new findings:

Wonder Card is at 0x560 as you mentioned before. In my previous injection, i put it only on 0x560 and it worked perfectly. I didn't notice that there was a 2nd location until you mention it, so i investigate further... Once I received the aurora ticket and save, wonder card code was stored and in the 2nd location as well...

If you want to change the icon on the upper right of the Wonder Card here is the address:

0x6c6 - 0x6c7 : FF FF --> ? icon

9A 01 --> Deoxys icon

I have tried some random values and different pokemon appear... No luck with the colors though...

[BlackShark]

On location is current save the other is backup/previous save hence there are 2 of them.

The save has 2 main blocks with 57344 (0xE000) bytes each.

Each block is seperated into 14 sections with 4096 (0x1000) bytes.

In each section, 0xFF4 is the section ID, 0xFF6 - 0xFF7 is the checksum and 0xFFC - 0xFFF is the save counter.

Depending on the save counter you could determine the current save.

[BlackShark]

Take a look here http://projectpokemon.org/forums/showthread.php?29515-GBA-save-file-checksums&p=164767&viewfull=1#post164767

[ajxpk]

Thanks BlackShark.

I did a bit of research and figured out that the MYSTERY GIFT Script lostaddict found is on every Emerald Version.

Now I have the Scripts for all the European Versions.

'---------------
#org 0x28287F
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x828289F
goto 0x8282895

'---------------
#org 0x28289F
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x8282895
checkflag 0x8B3
if 0x1 goto 0x8282895
msgbox 0x827EE02 MSG_KEEPOPEN '"Danke, dass du das GEHEIM-\nGESCHE..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x827EE65 MSG_KEEPOPEN '"Du kannst es am Hafen von\nSEEGRAS..."
release
end

'---------------
#org 0x282895
executeram
msgbox 0x827E965 MSG_FACE '"Danke, dass du das GEHEIM-\nGESCHE..."
end


'---------
' Strings
'---------
#org 0x27EE02
= Danke, dass du das GEHEIM-\nGESCHEHEN benutzt hast.\pDu musst [player] sein.\nHier ist ein Ticket fur dich!

#org 0x27EE65
= Du kannst es am Hafen von\nSEEGRASULB CITY einsetzen.\pWarum probierst du es nicht\neinfach aus?

#org 0x27E965
= Danke, dass du das GEHEIM-\nGESCHEHEN-System benutzt hast.

'---------------
#org 0x27C0CB
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x827C0EB
goto 0x827C0E1

'---------------
#org 0x27C0EB
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x827C0E1
checkflag 0x8B3
if 0x1 goto 0x827C0E1
msgbox 0x82788E2 MSG_KEEPOPEN '"Merci d'utiliser le systeme\nEVENE..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x8278942 MSG_KEEPOPEN '"Il peut etre utilise au port de\nN..."
release
end

'---------------
#org 0x27C0E1
executeram
msgbox 0x8278461 MSG_FACE '"Merci d'utiliser le systeme\nCADEA..."
end


'---------
' Strings
'---------
#org 0x2788E2
= Merci d'utiliser le systeme\nEVENEMENTS MYSTERE.\pVous devez etre [player].\nIl y a un ticket pour vous.

#org 0x278942
= Il peut etre utilise au port de\nNENUCRIQUE.\pEssayez-le pour voir de quoi \nil s'agit.

#org 0x278461
= Merci d'utiliser le systeme\nCADEAU MYST.

'---------------
#org 0x27A995
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x827A9B5
goto 0x827A9AB

'---------------
#org 0x27A9B5
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x827A9AB
checkflag 0x8B3
if 0x1 goto 0x827A9AB
msgbox 0x827741B MSG_KEEPOPEN '"Gracias por usar el sistema\nde lo..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x8277489 MSG_KEEPOPEN '"Parece que puedes usarlo en el\nPU..."
release
end

'---------------
#org 0x27A9AB
executeram
msgbox 0x8277002 MSG_FACE '"Gracias por acceder al sistema\nde..."
end


'---------
' Strings
'---------
#org 0x27741B
= Gracias por usar el sistema\nde los EVENTOS MISTERIOSOS.\pDebes de ser [player], ?no?\pPues tenemos un ticket para ti.

#org 0x277489
= Parece que puedes usarlo en el\nPUERTO de CIUDAD CALAGUA.\p?Por que no curioseas un poco\npara ver de que se trata?

#org 0x277002
= Gracias por acceder al sistema\ndel REGALO MISTERIOSO.

'---------------
#org 0x2767EF
special2 LASTRESULT 0x1F8
compare LASTRESULT 0x1
if 0x1 goto 0x827680F
goto 0x8276805

'---------------
#org 0x27680F
checkitem 0x113 0x1
compare LASTRESULT 0x1
if 0x1 goto 0x8276805
checkflag 0x8B3
if 0x1 goto 0x8276805
msgbox 0x82731D8 MSG_KEEPOPEN '"Grazie per usare il Sistema\nEVENT..."
giveitem 0x113 0x1 MSG_OBTAIN
setflag 0x8B3
setvar 0x403F 0x0
msgbox 0x8273231 MSG_KEEPOPEN '"Dovrebbe servirti allo scalo di\nP..."
release
end

'---------------
#org 0x276805
executeram
msgbox 0x8272DD8 MSG_FACE '"Grazie per usufruire del Sistema\n..."
end


'---------
' Strings
'---------
#org 0x2731D8
= Grazie per usare il Sistema\nEVENTO SEGRETO.\pTu sei [player], vero? Ho qui\nun biglietto per te.

#org 0x273231
= Dovrebbe servirti allo scalo di\nPORTO ALGHEPOLI.\pTi conviene andare a vedere\ndi persona.

#org 0x272DD8
= Grazie per usufruire del Sistema\nDONO SEGRETO!

This is btw. what I found instead in Firered:

'---------------
#org 0x1BB1D2
special 0x187
compare LASTRESULT 0x2
if 0x1 goto 0x81A7AE0
special 0x188
executeram
msgbox 0x81A6393 MSG_FACE '"Thank you for accessing the\nMYSTE..."
end

'---------------
#org 0x1A7AE0
release
end


'---------
' Strings
'---------
#org 0x1A6393
= Thank you for accessing the\nMYSTERY GIFT System.

Edited August 24, 2015 by ajxpkm

[jm-plata]

Here a site with info about WCs in Gen III:

http://www.pokeyplay.com/comunidad/index.php?showtopic=37742

Note: Spanish Site

According to the site there are WCs that can be sended to obtain EGGs, Pokémon or News (i.e. CHANNEL Jirachi, Celebi Journey Across America 10th, etc.)

[lostaddict]

Some more info (most of them are speculations):

EVENT TYPE:

E8 03 FF FF --> AURORA TICKET

E9 03 FF FF --> MYSTIC TICKET

EA 03 FF FF --> OLD SEA MAP

This seems to be the identification of the wonder card event. (Not confirmed yet)

CARD COLOR:

08 --> RED

9C --> GREY

94 --> YELLOW

This seems to be the wonder card color. (Not confirmed yet)

POKEMON ICON:

01 00 --> Bulbasaur Icon

F9 00 --> Deoxys Icon

FF FF --> Questionmark Icon

This is the icon located on the upper right of the wonder card. Values are start from 01 to F9. (confirmed)

CHECKSUM:

This seems to be the checksum of the wonder card data. In order to be able to edit the text of the card we need to figure out how to compute this... Event type, Card color and Card text are part of the data that checksum is compute on... For some reason the Wonder Card Icon is not...

[jm-plata]

I still struggle to find out how the checksum is calculated.

I will use 32 bytes from the Wonder Card for this example.

According to Taka's Website it's calculated like this...

00000570   E8 03 FF FF 00 00 00 00 08 00 00 00 00 00 00 00   è.ÿÿ............
00000580   00 00 00 00 BB CF CC C9 CC BB CE C3 BD C5 BF CE   ....»ÏÌÉÌ»ÎýſÎ


We have to separate these 32 bytes into 4 bytes groups from left to right.
Then we have to add them together, but before we do this we have to swap the bytes from these groups. (From ABCD to DCBA)
As an example... E8 03 FF FF will become FF FF 03 E3.


0xFFFF03E3 + 0x00000000 + 0x00000008 + 0x00000000 + 
0x00000000 + 0xC9CCCFBB + 0xC3CEBBCC + 0xCEBFC5BD 
= 0x5C5A552F


Then we cut this sum in high and low bytes and sum them together as well.

0x5C5A + 0x552F = 0xB189

And this is the result, the checksum for these 32 bytes would be B189.
On the save file it would be 0x89 0xB1.

Missed a step, but the result is correct:

0xFFFF03E3 + 0x00000000 + 0x00000008 + 0x00000000 +

0x00000000 + 0xC9CCCFBB + 0xC3CEBBCC + 0xCEBFC5BD

= 0x5C5A552F AND 0xFFFFFFFF

= 0x5C5A552F

[lostaddict]

Really nice info!!!

There is a small mistake in you example: E8 03 FF FF will become FF FF 03 E8

I have write a quick script in java to compute this automatically... It reads the bytes from a file and computes the checksum. Here is the result when running it on you example:

FFFF03E8
00000000
00000008
00000000
00000000
C9CCCFBB
C3CEBBCC
CEBFC5BD
Sum: 5C5A5534
Final Checksum: B18E

The bad news is that when i use this algorithm to the actual wonder card data, the result does not match with the one in the .sav file...

Here are the results when running it on the actual wonder card data:

FFFF03E8
00000000
00000008
00000000
00000000
C9CCCFBB
C3CEBBCC
CEBFC5BD
00000000
00000000
00000000
00000000
00000000
00000000
00000000
DCD7ECBF
D9DBE2D5
E6D5BD00
000000D8
00000000
00000000
00000000
E3C10000
00E3E800
00D9DCE8
E3D7D9E7
DA00D8E2
E6E3E3E0
00DAE300
00D9DCE8
1BC5C9CA
00C8C9C7
BFBD0000
CCBFCEC8
D8E2D500
D9D9E100
DCE800E8
D9D800D9
D9EADDE0
E400EDE6
E3E7E6D9
E2DD00E2
E6DB0000
ADE2D9D9
D7D9CC00
D9EADDD9
D9DCE800
CCCFBB00
CEBBCCC9
BFC5BDC3
E2D500CE
000000D8
DCE80000
E700E2D9
00D9EAD5
00D9DCE8
D9E1D5DB
0000ABAB
00000000
00000000
00000000
00000000
E3BE0000
E8E3E200
E7E3E800
DCE800E7
BF00E7DD
D5DCD7EC
00D9DBE2
D8E6D5BD
00000000
00000000
D9D60000
D9E6E3DA
D7D9E600
DDEADDD9
E800DBE2
BB00D9DC
CCC9CCCF
BDC3CEBB
ABCEBFC5
000000AB
00000000
00000000
Sum: 5DFDA06E
Final Checksum: FE6B

It should give 85 FC instead....

Is there any information on Taka's website regarding the blocks we should use to calculate the checksum?

[lostaddict]

Damn.

I really messed up in my tutorial.

You're quick! I already thought about writing a script. Would be cool if you could give the java script to me.

Unfortunately my japanese is not good enough to understand everything what he wrote there.

But if you like you could use Google Translate to check it out. Maybe I missed something?

I've read it many times but it's still confusing.

https://translate.google.com/translate?sl=ja&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fweb.archive.org%2Fweb%2F20080106083812%2Fhttp%3A%2F%2Fwww.h6.dion.ne.jp%2F~taka.999%2Fpage002.html&edit-text=

I still don't know yet how the blocks are added together exactly.

There must be more steps to the actual checksum...

For anyone who is interesting here is the script:

The file contains the source code, a jar file that you can run from the command line and the legit Aurora Wonder Card. To run it open a command prompt and type:

java -jar ComputeChecksum.jar WonderCard.bin

You should see the results in the output :smile: Make sure you have java installed on your computer...

PS: Google Translate is not so good with the Japanese...

ComputeChecksum.rar

[BlackShark]

Checksum is calculated for the area from 0x56C to 0x6BB, so exactly 336 Bytes.

The bytes before and after that location won't corrupt the wc if you edit them.

Though there's a second part a few offsets after the first one which also belongs to the wondercard event.

That one also should have its own checksum.

The checksum should be included in the said area.

But somehow I believe it's computed different to what Taka is talking about. The algorithm he mentioned is exactly the same as the one used to validate each save section.

The are at least to other algorithms used for checksums ( one for pkm data the other for injected e-Reader trainer data). The one used to validate save data as well as the other two dont seem to match here.

If I didn't make a mistake I would guess the checksum is different in this case.

[lostaddict]

About Checksums, thanks to BlackShark's Thread I found this here on Bulbapedia:

http://bulbapedia.bulbagarden.net/wiki/Save_data_structure_in_Generation_III#Checksum

This is the exact same algorithm we have already implemented. If you run the algorithm on the block containing the wonder card data (using all block data) then it gives the correct checksum that you can add at the footer of the block.

This resolves the corrupted file issue when you inject the wonder card code in the .sav file. I have already tested it and works ok :biggrin:

NOW THE REALLY GOOD NEWS:

Morfeo has left behind actual instructions on how to compute this checksum... It's in a .rar file that it supposed to contain all the information needed to implement wonder card functionality and generate the AR Codes... I have this since yesterday and the algorithm is already implemented. :wink:

But while it works perfectly on his example, it does not work on the actual wonder card data... :rolleyes:

I will post more details on this later today...

[BlackShark]

You're right, there's a 2nd block for the Script a few offsets later with another checksum. But for now it's all about the Wonder Card itself.

The second block from 0x8B0 to 0xC93 (996 Bytes) has to be validated too. Otherwise the wondercard gets corrupted.

Probably there's a checksum for both together.

[lostaddict]

OK so here is what i have regarding the info and the algorithm Morfeo left behind:

1) General Information:

As we already know there are 2 relevant data blocks for each Wonder Card. At the beginning of each of those 2 blocks there is a key (checksum value) which is 4 Bytes

Wonder Card Data (332 bytes)

Green Man Script (1000 bytes)

2) Algorithm Information

The algorithm seems to use the same method that rom uses to encrypt things... Before proceed with the actual algorithm there are 2 things needs to be defined. What is "Seed" and what is "Tab"

"Seed" is a 2 byte value that is compute in each step of the algorithm and used as input to the next step. Initial value of "Seed" is always "8530"

"Tab" is an index value. This points to a 2 byte value that can be found in a file. This file is actually a lookup table. You look on a specific address and you retrieve the specific value to use it in the algorithm... According to Morfeo is really important to group the file data in "tabs". Each tab has 2 bytes.

More info on how the Tabs are created:

So if the tab file contains the following data

00 00 00 01 0F CF E0 17 30 01 0F 00 BO 19 30 2D

The tabs should be:

00 00 Tab 0

00 01 Tab 1

0F CF Tab 2

E0 17 Tab 3

30 01 Tab 4

0F 00 Tab 5

BO 19 Tab 6

30 2D Tab 7

The Tab file is provided by Morfeo (tab.bin). I did some search to find it's origin... The data in the file seems to be part of the actual rom (I found them both in Emerald and Green Leaf roms). That's why I'm assume that this is the same method of encryption the game itself uses...

3) The Algorithm

2 More definitions:

"upperSeed": The upper 2 bytes of the "Seed"

"reverseTab": The reverse value of the "Tab" (if Tab value is XXYY the reverse is YYXX)

For Each Byte:
     Tab Index = (Current Byte [b]XOR [/b]"Seed") [b]AND [/b]0xFF
     Tab Value = Value at position "Tab Index" in tab.bin file
     newSeed = reverseTab [b]XOR [/b]upperSeed
End For

Tab Values for the Example:

                Offset      Data  ##Tab

	00000000  00 00  00Tab
	00000002  00 01  01Tab
	00000004  0F CF  02Tab
	00000006  E0 17 "03Tab"<-- 1st Byte
	00000008  30 01  04Tab
	0000000A  0F 00  05Tab
		¡	¡
		¡	¡
		¡	¡
	00000130  10 06  98Tab
	00000132  00 10  99Tab
	00000134  01 ED "9ATab"<-- 2nd Byte
	00000136  10 1C  9BTab
	00000138  51 2F  9CTab
		¡	¡
		¡	¡
		¡	¡
	00000160  00 BB  B0Tab
	00000162  0B B0  B1Tab
	00000164  17 B0 "B2Tab"<-- 4th Byte
	00000166  EF 50  B3Tab
	00000168  17 D0  B4Tab
		¡	¡
		¡	¡
		¡	¡
	000001CE  20 BF  E7Tab
	000001D0  A0 2F  E8Tab
	000001D2  A0 30 "E9Tab"<-- 3rd Byte
	000001D4  17 20  EATab
	000001D6  1A F0  EBTab

Example: Input Data "33 FF FF FF"

Step 1: [b]"33"[/b] FF FF FF
     8530 ^ 33 =  8503 & 0xFF = 03
     Tab03 = E0 17
     17E0 ^ 85 = 1765
     newSeed = 1765

Step 2: 33 [b]"FF"[/b] FF FF
     1765 ^ FF =  179A & 0xFF = 9A
     Tab9A = 01 ED
     ED01 ^ 17 = ED16
     newSeed = ED16

Step 3: 33 FF [b]"FF"[/b] FF
    ED16 ^ FF = EDE9 & 0xFF = E9
    TabE9 = A0 30
    30A0 ^ ED = 304D
    newSeed = 304D

Step 4: 33 FF FF [b]"FF"[/b]
    304D ^ FF = 30B2 & 0xFF = B2
    TabB2 = 17 B0
    B017 ^ 30 = B027
    newSeed = B027

Once all the calculations for all the bytes are made we need to compute the final "Key" value which is the actual checksum. This is how this is done:

a. Get the Last Seed the algorithm compute.

b. Convert it to binary.

c. Replace "zeros" with "ones" and "ones" with "zeros"

d. Convert back to hex

Example:

B027 ---> 1011 0000 0010 0111

4FD8 ---> 0100 1111 1101 1000

"Key"= 4FD8

In sav file: D8 4F 00 00

4) Where this information is coming from?

Morfeo left behind this information for those who actually care enough to mess with his codes... If you check closely in a .sav file that contains a Morfeo Wonder Card, you should find some bytes that are translating to a URL... From that URL you can download a .rar file containing: A .txt file with the above instructions in spanish and the tab.bin file for the encryption...

Also you can find some other thoughts of Morfeo regarding why he is not sharing this information... :rolleyes:

5) Implementation of the algorithm

I have implemented this yesterday... I'm planning to provide it later.

As i have already explained while it works perfectly on the example, when it comes with the actual wonder card data, it fails to give the correct checksum... It can be either a code bug, wrong initial "Seed" value or missing data from the "tab.bin" file...

Hopefully is a code bug since we don't have more info on the other 2 factors (initial seed and tab.bin file) that may affect the result...

Enjoy :biggrin:

[lostaddict]

Ok I have check my code and I'm 99% sure that my implementation is correct. So at the moment I have reach a dead end... :confused:

I'm posting below the url to the original archive from Morfeo. You can take a look at it, maybe I'm missing something regarding the algorithm... Also here is how i find the archive with the algorithm info in the first place (it's part of a save file that contains Morfeo aurora ticket):

Here is the complete text in Spanish:

.NOTA 
No muestro a nadie el mé todo para crear Wonder Cards, por lo que no respondo a esas preguntas. 

Pero si tienes los conocimientos necesarios y sobre todo SENTIDO COMÚN, tal vez puedes merecer la última pieza para lograrlo en:

galeon.com/albumpokemon/llaveWC.rar

Also here are the results of my implementation running the Morfeo's example:

Step 1:
Input Byte: 33
Tab index: 3(0x3)
Tab value: E017
Tab value reverse: 17E0
New Seed: 1765
New Alta Seed: 17
----------------------------
Step 2:
Input Byte: FF
Tab index: 154(0x9A)
Tab value: 01ED
Tab value reverse: ED01
New Seed: ED16
New Alta Seed: ED
----------------------------
Step 3:
Input Byte: FF
Tab index: 233(0xE9)
Tab value: A030
Tab value reverse: 30A0
New Seed: 304D
New Alta Seed: 30
----------------------------
Step 4:
Input Byte: FF
Tab index: 178(0xB2)
Tab value: 17B0
Tab value reverse: B017
New Seed: B027
New Alta Seed: B0
----------------------------
Final Seed: B027
Binary Conversion:
0xB027 --> 1011000000100111
0x4FD8 <-- 0100111111011000

Save File Checksum: D8 4F

And the results when running it on the actual Wonder Card data (the last step):

New Seed: F018
New Alta Seed: F0
----------------------------
Step 332:
Input Byte: 00
Tab index: 24(0x18)
Tab value: 6130
Tab value reverse: 3061
New Seed: 3091
New Alta Seed: 30
----------------------------
Final Seed: 3091
Binary Conversion:
0x3091 --> 11000010010001
0x0F6E <-- 00111101101110

Save File Checksum: 6E 0F

[BlackShark]

Wow, I didn't expect they used something as complicated as this to validate the wondercard data.

I also tried calculating the checksum the way Morfeo described it. But I'm getting a false checksum as well, even though it's correct for the example.

I doubt the problem is the initial seed. I looped my function through all values from 0 to 0xFFFF (which could have been an initial seed) without getting a matching checksum.

I also don't think the tab.bin is incomplete. With the given algorithm you could only get values from 0 to 0xFF, the file contains 256 values.

In worst case both the initial seed and the algorithm are wrong...

[BlackShark]

About the e-card data.

It is different to the wondercards as far as I know.

The Eon Ticket e-card doesn't have a wondercard and no checksum.

Also it is saved to another location which is in section 3. I successfully changed that text without validation needed.

The e-Reader trainer data in section 0 is validated by a checksum which is very similar to the one that's used for the save. It is a 32 bit sum of the data summed up as half-words (2 bytes).

The e-Reader berries are in section 4, they should be validated as you can see in this thread http://projectpokemon.org/forums/showthread.php?31210-Index-numbers-of-the-eReader-berries&p=171472&viewfull=1#post171472

I haven't looked into it yet. So I don't know if it could help with wondercard checksums.

Edited August 28, 2015 by BlackShark