suloku

@Natasha http://mrnbayoh.github.io/basicsploit/

Reversing the entire IR protocol seems like a difficult and time demanding task. This hasn't been done even for generation 2, which I suppose is a far more simple protocol. A viable option, knowing the PID generation method and direct savegame editing is a far more plausible solution...but I agree the ideal would be to know how it works and emulate everything.

I agree, but that will be very complicated, as all gen 2 batteries are dead by now, so only two people will still have that Mew: - Those who transfered to gen 1/pokemon stadium 2. - Those with a backup device. I think there were little gen 2 distributions back in the day, in fact the only one I know of is the one from PNYC.

@j2k15 may you mind posting your Mew's OT and ID# (if you still got them of course)? Also, I've been lurking the old Azure Heights forum searching information about the mews, and yes, apparently all distributions had fixed DVs, but some exceptions arise. With all the gamesharked mews one can' really be sure about it though... i.e. Mewtosama posted: That NINTEN OT is also weird...I've read it might have been one of the original 151 by nintendo power, but that distro is not listed in bulbapedia? Someone said that the ad for that distro featured that OT. Also, White Cat posted: But even though I have found posts by the user Keibu that really make me think he did go to the event, I haven't found this post of him White Cat's is talking about. Also, there's no reference to the OT, which is a shame. It's a pitty I couldn't find any user that goes by the name "Keibu" at spanish forums, he even had a GBexchanger, so the chances he dumped his save with the spanish mew are high, but locating him would be almost impossible 16 years leater... same goes to trying to contact White Cat. Last but not leas, I can't find the thread right now, but an user posted that he had a lot of mews, all with the same stats, BUT he had one with ID# 0000001, and that mew had perfect DVs. Maybe it was a fake information, hacked or maybe nintendo really did make the very first distributed mew by the machines perfect. Last, here's a compilation of legit OTs and IDs found at azure heights, all these mews are said to have the following DVs: (HP - 5), Attack - 10, Defense - 1, Special - 5, Speed - 12. United States distributions OT: LINKE ID: 45013 OT: LINKE ID: 45104 OT: LUIGE ID: 005512 OT: LUIGE ID: 263103 Toy's R US (not sure if USA or Canada) OT: YOSHIRA IDno:55932 Toy's R US (USA for sure, this is the one we actually got a savegame for) OT: YOSHIRB ID: 55702 ------------------------- Sydney 2000 distribution Mew #1 OT: NAL ID: 00239 Mew #2 OT: NAL ID: 00450 Note: Australian PokeTour 1999 had AUS as OT. ------------------------- From Calgary (Canada), Alberta Stadium tour in March 2000: OT: YOSHIC ID: 30895 ------------------------- England OT: UK ID: 30091 note: I know that Bluewater Shopping Center in Kent, England on May 27, 2000 distribution had UK as OT name, but above's mew might not be from that event, as supposedly all England distributions had UK as OT. note 2: apparently in England no certificate was coupled with the Mew.

You can get a save with a legit USA Mew here: https://projectpokemon.org/forums/showthread.php?48299-GEN1-Legit-Mew-Save You can get PNYC celebies here: https://projectpokemon.org/forums/showthread.php?14531-Pokemon-Crystal-Version-(with-PCNY-event-Pokemon) You can get a Spanish FRANCO Celebi here: https://projectpokemon.org/forums/showthread.php?14531-Pokemon-Crystal-Version-(with-PCNY-event-Pokemon)&p=213150&viewfull=1#post213150 You will notice that the FRANCO celebi is a pkm file I made with Dr. Matt's data as he is certain the celebi is fully EV trained. I want to build a GB cart reader, and hopefully someday I'll be able to dump his save, but I don't know when I'll build it or where he lives, so I don't know when that might be. It's really pointless if the celebi is fully EV trained though, the file would be exactly the same I uploaded unless it wasn't fully EV trained (which again, Dr. Matt was pretty clear that it was fully EV trained). Also, about Mew distributions and IVs: I found this a while ago: http://www.pokexperto.net/foros/index.php?topic=27460.msg2528821#msg2528821 Here Pirk claims to have a legit Mew distributed in Spain (the only distribution made there). He also relates how the competition and the distribution happened, so it does seem pretty legit. Other users also seem to abide for the OT name "D-J" being the one for the legit spanish mew. Now, the problem is that the stats aren't possible with the fixed DV Mew distributed in USA, so either it has different fixed DVs or european distributions were random (which would make a shiny mew possible? or maybe they already knew they would make shinies and is shiny locked?) Assuming full EVs it would have the following data: OT: D-J ID: 60130 DV: (2 hp) / 6 atk / 4 def / 3 speed / 8 special Stats at level 100: 377/280/276/274/284 For reference, the fixed USA Mew DVs are: (5 hp) / 10 atk / 1 def / 12 speed / 5 special At level 100 and full EV: 383/288/270/292/278 As you might notice, the Special and defense DVs are necessarily different, it can't be a not EV trained USA fixed DV mew. Also, there's the PCNY mew distribution, which either had fixed DVs or was shiny locked with random DVs. That's the info I have. It's a petty all these mews and celebies are doomed to dissappear (specially celebies which probably already have). ps: and also, there's the perfect IV mew recently distributed in japan, but I guess that doesn't count

Well, forget about customfirmware without hardmod until a new kernel exploit is released. Also, cubic ninja and Ocarina of time have been updated to work under latest firmware (but they are secondary exploits). SmileBASIC is your best bet, as I said I'm pretty sure there's a way to keep playing online without updating trough homebrew, but you'll loose e-shop (or maybe that was also patched? Can't remember). Also, waiting in a firmware until something comes out is wise, but I think all the recent kernel exploits that allowed downgrading all worked in the latest available firmware, in fact the first downgrade exploit worked better in the latest available firmware (less brick probabilty) or so they said. Nintendo tends to fix exploits after the scene releases them. The best is to have a secondary exploit in physical, since those can't be patched by nintendo and are usually updated in a few days after a new firmware comes out. As I mentioned Pokémon ORAS or Super Mistery Dungeon might be of your interest, but you'll still need SmileBASIC (or someone) to install it.

The only way to be able to not worry about nintendo updates is to downgrade to 9.2 and use a custom firmware, either with or without arml9loaderhax. If correctly set up, you don't need Arm9LoaderHax to prevent updating your 9.2 system (which is a long process were you can brick your 3DS, the possibility is really low if you use opthelper, which makes sure everything is ok before any real attempt). Of course if a child is to use the console or the boot failures are a nuisanse arm9loaderhax is a better option. The dangerous process is still the downgrade (again, pretty low brick rate with the correct tools and making sure you have the correct files (and all of them) in the sd card). I think there are homebrew options to keep playing online while not being in the latest firmware. Given pokémon games haven't had an update for a very long time, your main concern should be e-shop and other game updates if nintendo updates firmware and you want to stay in 11.0 (unless they can't patch SmileBasic, but they have already gone the "update or you can't run the game" way brefore). Of course with a hardmod you don't have to worry about bricking as long as you have a working nand backup.

This a better info source: https://3dbrew.org/wiki/Homebrew_Exploits Any game listed as secondary exploit needs someone with a homebrew enabled 3ds to install the exploit, then you can use it in any 3ds. For 11.0 you should try to download SmileBASIC if you are USA region, don't know if it is freeware though, but it's gonna be a primary entrypoint (standalone) for 11.0. If you know someone with a 3ds in firmware 10.5 or lower you could use browserhax to get your save with his console or install a primary entrypoint (maybe you have super mistery dungeon or oras)

This caught my attention. Did the PID generation method for pokewalker get documented? Re-creating the whole IR protocol is definitely cool, but complicated. A less complicated way would be an android (or pc, but how would you walk?) app that "simulates" the pokewalker behavior by reading a HGSS savefile: you could get and modify courses and stepcount, as well as unlock more courses in the save and read the pc boxes to select a pokémon to carry to the course. Of course I talk about PID generation to actually create legit pokewalker pokémon that would just be injected to the savefile, alongside the "walking pokemon" with the experience maxed for the next level (or even actually allow to level up more than one level). Or just generating legit pokewalker pokémon would be great for those without the device (or that have lost/damaged it). ps: some interesting threads I've found in this forums: Offsets for watts, current course, walking pokemon...: https://projectpokemon.org/forums/showthread.php?7693-Pokewalker-Offsets A legit compilation of all US pokewalker pokemon: https://projectpokemon.org/forums/showthread.php?10291-US-complete-pokewalker-pokemon Some info about PID: https://projectpokemon.org/forums/showthread.php?8603-Pokewalker-PID-restrictions Some RNG threads at smogon might hold valuable information about PID. EDIT: Just read this at gamefaqs: "When you connect your Pokewalker to your save the first time it generates a PID it uses for all Pokemon caught from then on, only changing the first two characters. If one of the PIDs generates a Shiny Pokemon, then you'd have a 1/32 chance of getting it at any time. You can keep changing the PID by resetting your walker, but it will reset your Watts and Routes too." I don't think it's trustable as afaik pokewalker pokémon can't be shiny, but the part about assigning part of the PID the first time might actually be true? Maybe I'll make a compilation of ESP pokewalker pokémon, I already have some of the most difficult ones to encounter.

Spain still has to get the shiny Xerneas too, they only distributed Yvetal. Maybe they are waiting for "Saló del Manga" to be held at Barcelona in october 29th to november 1st, would make sense as Yvetal was distributed at "Saló del còmic" also in Barcelona.

I don't see the point in this kind of distribution if all the codes are the same... the qr just needs to be photographed to get the event. I'm not complaining at all, it makes it a lot more accessible, but makes it kind of pointless, unless their aim is to make events finally not time-dependent (the qr scanning will work forever, no need to hack wondercards in the save or get the distro devices...). And I do actually prefer distributions that enable in-game events, they should always make at least one of these distributions for the legendaries (even the other version's mascot at some point), it is far more enjoyable than just getting the pokémon given as gift.

I don't know anything about the vars, here's the most complete info about flags I could find: http://www.pokecommunity.com/showthread.php?t=330008 I'm actually surprised there's more than one flag for the gender check. Vars seem to be start at 0x4000 So, making a script that toogles var 0x4000 should allow to find var storage in the savegame. ("setvar 0x4000 0xABCD" should make it easy to find)

Here's littleroot's town house script: '--------------- #org 0x1525FB compare 0x4092 0x6 if 0x0 call 0x8152610 checkflag 0x112 if 0x1 call 0x8152623 end '--------------- #org 0x152610 setmaptile 0x5 0x4 0x270 0x1 setmaptile 0x5 0x2 0x268 0x1 return '--------------- #org 0x152623 checkgender compare LASTRESULT 0x0 if 0x1 goto 0x8152630 return '--------------- #org 0x152630 setmaptile 0x3 0x7 0x293 0x1 return About var 4092, this was found on smogon for emerald (script flags and vars are the same on emerald and RS, offsets change): 0x4092 0x1 - Get out from the truck script 0x3 - Vigoroths Fixing Your House script I guess the easiest would be to find out what the checkgender command exactly does via no$gba debugger, but I don't know how to do it. edit: not easiest, but most accurate way A0 checkgender Checks the player's gender. If male, then 0x0000 is stored in variable 0x800D (LASTRESULT). If female, then 0x0001 is stored in LASTRESULT. EDIT: also, flag 0x112 0x112 : Player has been given running shoes So before receiving running shoes and at the start of the game (vigoroths), the map is the same for male and female

To find the differences, a male save in the truck and a female save in the truck should be compared. I bet there will be a different flag at block #2 that is set for female. Alternatively, we could use advancemap to check the script that produces the odd behavior, it will teach us how the game determines different behavior for male/female (I bet on a checkflag command). Also in emerald: - badges flags are stored at 0x3fB section 2, badge 1 flag# is 0x867 and badge 8 flag# is 0x86E - Selected lati is stored at 0x5c6 section 2 (bit 0, or 0x01), the flag# is 0x16B0 Maybe the badge flag locations and the lati for emerald will be of some use, even if it is just for displaying purposes. I remember correctly, if flag 0x16B0 is set, Latios is roaming and latias at southern island (so player selected that he saw a blue pokemon on tv).

If nature and gender is fixed, pid most likely is too.

They are 0 even on japanesse? Those are some useless shadow pokemon... maybe I'll check the e-card data, but I think the feature is in colosseum, reading the card just enables it.

I checked the ones I catched on colosseum, purified and transfered to gen 3, and they do have IVs, so most likely IVs are generated when the pokémon is purified? Or are you referring to only those 3 e-reader shadow pokemon? This is in fact quite good in the sense that if there's no way to save without the gba connection to catch the shadow pokemon (besides savestates), it would mean that we don't really need that, just a save for each language edited to have some of the "instant purification item" (can't remember the name) in the inventory. Or maybe the purification gets the IVs from the PID and does not randomly generate them. Also, does the save have them in english or which language?

I've just re-checked the medal format as in this thread: https://projectpokemon.org/forums/showthread.php?44038-How-to-modify-the-date-of-medals 4 bytes: 1 byte: unused 1 byte: flags 2 bytes: date In my savefile and in one with 232 medals, the first byte is always 0, so it is most likely not used. About flag byte: Seems only the first 4 bits (bit 0, 1, 2 and 3) are used, never seen the top bits used on any medal on my savefile or the 232 medal one. But I've seen the other 4 flags used. The only medal where I've seen bit 0 (flag 1) used is in the Pokerus Discoverer medal, a medal I don't have. It also has flag 2 set. Flags 1 and 2 are also set on the unreceived "Good Souvenir Getter", Tycoon of Souvenirs, Avenue of Fame, The "give all medals" AR code sets flags 3 and 4 and medal date. Flag 3 is what tells the game "give this medal" making the medal guy appear, according to this post: https://projectpokemon.org/forums/showthread.php?32170-Regarding-the-Medal-Box-and-AR-codes-to-modify-it&p=172242&viewfull=1#post172242. So flag 4 should be what gets set once you collect the medal, and the date is set. Also, here's kaphotics medal AR code for reference (sets all medal's flag 3 except for those awarded by the game when certain # of medals are obtained): https://projectpokemon.org/forums/showthread.php?24541-B2-W2-AR-Codes/page33&p=164781#post164781 Also, I've noticed my code is buggy, so don't trust the flags that you see, as that might explain inconsistencies.

Should work with vba-m and dolphin. Since you are on it, might you keep a save before capturing each of the 3 shadow pokemon? Loading that save in each language of the game should give us the pokémon for each language. Since the savefile trainer can be edited, having those save files would be the easiest way to get those extra shadow pokémon, since if I correctly understood you can save after reading the e-card before the shadow pokémon battle. Also good for those who like soft-resetting for natures and such. Only the JAP ones would be really legit though, but accessible to everybody.

I don't know. Research needs to be done there. Setting a date is all it's needed to receive a medal (that's what the action replay code does). Each medal has 4 bytes, 3 are used for the date, 1 is unknown and the data is different for different medals. This byte is always 0x0X, so I assumed it is used for 4 flags, but I don't know what it is used for.

You are right, and neither musical or pwt (I really thought it did). You could use pockestock (, but I'm gonna add simple import/export options of PWT, Musical, Cgear and pokédex. I'll have to research BW1 offsets for cgear and pokedex skins (I'll just use pockestock to locate them ) EDIT: seems like all dlc has some extra data that has to be written to the save to the "mirror" section, but I don't know how that data is generated. I guess the forums hold that information (maybe), so I can't add anything wihout knowing where that is comming from.

Those features are already in pokegen.

Well, you could still add any of that functionality with some warning about using the GBA homebrew is a better option, given that resetting the clock is for real hardware use and requires a method to load saves onto gba carts. Of course there's people who may use a save backup/restore method that doesn't allow them to load the gba homebrew. Also, seems like the homebrew has not been ported to NDS and I don't think I'd be able to port it, unless it's a very easy process, but I don't have the time to learn to do that right now. Maybe someone has the knowledge to port it?

http://furlocks-forest.net/wiki/?page=Pokemon_Ruby%2FSapphire_New_Battery_Glitch It is actually a better option to set the cartridge's RTC to current date than modifying the one in the save. If you don't have a nds or gba flashcart, with a wiior gc you could send the gba homebrew trough the gba-gc cable (I can compile a program that sends the rtc modifier app to gba, I just need to change the gba file). I have not tested this, but should work fine. If you change the battery and want to test if the wii homebrew works tell me.

Never, actually I only use normal pokéballs for everything (except safari zone, since you can only use safari balls...). The roamers are such a pain to catch... thankfully critical capture on gen 6 makes it easier as I tend to go for legendaries after completing most of the pokedex.