Search the Community

a/0/0/0 - contest UI graphics, ribbon sprites a/0/0/1 - 3*CGFX a/0/0/2 - “pokelist” party bclims in darcs a/0/0/3 - substitute battle stuff a/0/0/4 - battle graphics bclims a/0/0/5 - more battle graphics/UI a/0/0/6 - 0x4156 byte binary (unk) a/0/0/7 - 6 bin (scripting?) a/0/0/8 - pokemon models a/0/0/9 - fade background/map a/0/1/0 - skybox a/0/1/1 - menu app UI images a/0/1/2 - menu kawaigari (orange buttons) a/0/1/3 - ZOnedata pack, table, ENcounter pack a/0/1/4 - town models a/0/1/5 - config menu? a/0/1/6 - berry minigame a/0/1/7 - amie minigame yarn a/0/1/8 - pokepuff receiving stuff a/0/1/9 - name input UI a/0/2/0 - “alphabetical/phonetic sorting logic binaries?” a/0/2/1 - overworld models a/0/2/2 - 511*24byte bin a/0/2/3 - map models (failed to convert any tex?) a/0/2/4 - menu UI a/0/2/5 - pss emote icons a/0/2/6 - amie emotes a/0/2/7 - Super training UI a/0/2/8 - More Super Training UI a/0/2/9 - 48 * various (map scripting related?) a/0/3/0 - waza oboe plate Main UI a/0/3/1 - move effects a/0/3/2 - overworld effects (ambient) a/0/3/3 - battle fade intros a/0/3/4 - 976 SESD (battle animations; similar script format) a/0/3/5 - Amie emote cgfx a/0/3/6 - Trainer Info a/0/3/7 - 280 * 16 byte files (up from 178) a/0/3/8 - Trainer Pokemon a/0/3/9 - 31 GR models (map models? down from 1030) * 0 - movement permissions (u16 width, u16 height, u32[] perm) * 1 - BCH map model * 2 - collision boundary (map terrain) rigging * 3 - 0x80 (???) * 4 - 0x80 (???) * 5 - 0x80 (???) * 6 - KAGE (???) a/0/4/0 - 20 small MM (down from 227) a/0/4/1 - 430 small MM files a/0/4/2 - Amie face ui a/0/4/3 - Amie hand ui a/0/4/4 - pss enemy/self connection a/0/4/5 - pss - needs labeling a/0/4/6 - pss - needs labeling a/0/4/7 - pss - needs labeling a/0/4/8 - pss - needs labeling a/0/4/9 - pss - needs labeling a/0/5/0 - pss select effects a/0/5/1 - pss checklist a/0/5/2 - pss object select a/0/5/3 - pss lower window anim a/0/5/4 - pss menu sprites a/0/5/5 - pss config a/0/5/6 - pss selectmenu a/0/5/7 - pss battle lower a/0/5/8 - 0x108 byte binary, bunch of n*10 decimal a/0/5/9 - 6 * Floating point binaries (2.85KB) a/0/6/0 - Weather Effect CGFX a/0/6/1 - Bag Icons / UI a/0/6/2 - 7 CGFX (camera related) a/0/6/3 - 2 SHDR CGFX (~4KB) a/0/6/4 - overworld effects (trainer/map related) a/0/6/5 - pss colosseum a/0/6/6 - 1 binary (4 byte entries?) a/0/6/7 - town map UI crap (1) a/0/6/8 - town map UI crap (2) a/0/6/9 - Title Bar a/0/7/0 - report (last on / off) a/0/7/1 - jp-kana script a/0/7/2 - jp-kanji script a/0/7/3 - english script a/0/7/4 - french script a/0/7/5 - italian script a/0/7/6 - german script a/0/7/7 - spanish script a/0/7/8 - korean script a/0/7/9 - jp-kana text a/0/8/0 - jp-kanji text a/0/8/1 - english text a/0/8/2 - french text a/0/8/3 - italian text a/0/8/4 - german text a/0/8/5 - spanish text a/0/8/6 - korean text a/0/8/7 - file is 0 bytes (lol) a/0/8/8 - Trainer customization models a/0/8/9 - 1114 binaries a/0/9/0 - Apparel select UI a/0/9/1 - 971 box sprites a/0/9/2 - 631 item sprites a/0/9/3 - damage type sprites a/0/9/4 - messagebox UI a/0/9/5 - held item / expbar filler a/0/9/6 - pkmdata summary view sprites (pkrscure, penta, marks) a/0/9/7 - time_icon spinner a/0/9/8 - cursor (red arrow) a/0/9/9 - Pokeblock bclims a/1/0/0 - CSEQ/CWAR cries / sounds a/1/0/1 - 161*CGFX (Amie related) a/1/0/2 - 2*CGFX a/1/0/3 - Box name/wallpaper UI a/1/0/4 - Pokeball Models a/1/0/5 - Pokeball Textures a/1/0/6 - pokesel backgrounds a/1/0/7 - “shop” ui a/1/0/8 - PSS Spritebuilding a/1/0/9 - trainer case/badge images a/1/1/0 - Summary UI link interaction / searching ? gts sub-elements? a/1/1/1 - pasokon_menu_lower layout+ui a/1/1/2 - Trade ui a/1/1/3 - super training ui a/1/1/4 - more super training minigame stuff with 85 BCH, 1 CGFX a/1/1/5 - 47*0xc byte binaries a/1/1/6 - 36 * (header count @0x4, 0xC entry length) a/1/1/7 - 48 * 32 bytes a/1/1/8 - 80 * 236 bytes a/1/1/9 - 80 * 216 bytes a/1/2/0 - 500 * 36 bytes (end is unused) a/1/2/1 - 500 * 28 bytes (end is unused) a/1/2/2 - 63 * 120 “” a/1/2/3 - 50 * 120 “” a/1/2/4 - 80 * 20 a/1/2/5 - 100 * 244 a/1/2/6 - 58 * 244 a/1/2/7 - 80 * 64 a/1/2/8 - 80 * 80 a/1/2/9 - 109 CGFX (effects?) a/1/3/0 - little bit of data for each pokemon form a/1/3/1 - shinka demo / menu UI a/1/3/2 - 2 TM (national/regional dex + ???) a/1/3/3 - trainer battle models (may/orlando/steven) a/1/3/4 - pokelist menu a/1/3/5 - 2 u16 index binaries? a/1/3/6 - battle backgrounds a/1/3/7 - 7 small binaries (0/6 empty) a/1/3/8 - GTS Background & Windows a/1/3/9 - 44 * various a/1/4/0 - holo caster streetpass pokeball jpeg (with exif data!), debug camera a/1/4/1 - assist power UI related a/1/4/2 - box search UI a/1/4/3 - 4 * SESD a/1/4/4 - customize amie a/1/4/5 - amie bg 241 bclim (misc backgrounds/items) a/1/4/6 - pokepuff sprites a/1/4/7 - benri button UI a/1/4/8 - contest UI & effects a/1/4/9 - Pokeblock blending textures a/1/5/0 - finger pointing down icon a/1/5/1 - pokeride TM CGFX (riding rhydon) a/1/5/2 - title logo & while flying mini models a/1/5/3 - cursor list menu a/1/5/4 - thunder / chiri CGFX a/1/5/5 - online vs battle/wonder ui (fushigi) a/1/5/6 - 6 × CGFX a/1/5/7 - gamesync a/1/5/8 - 26 BCH a/1/5/9 - lower dialog button a/1/6/0 - trainer mugshots a/1/6/1 - battlematch UI a/1/6/2 - SESD 87 various (scripts?) (up from 66 in XY) a/1/6/3 - TM cut tree animation CGFX a/1/6/4 - TM rock smash(?) animation CGFX a/1/6/5 - TM rock strength(?) animation CGFX a/1/6/6 - TM dig animation (anahoru) CGFX a/1/6/7 - CFNT a/1/6/8 - Friend entry UI a/1/6/9 - 35 MM ~ shader related a/1/7/0 - 53 * 604 bytes Battle Video Info Markup Template a/1/7/1 - battle video save a/1/7/2 - “The the an An…” multilang text unicode? JP empty (okay) a/1/7/3 - traial UI/bg a/1/7/4 - 15 [u16 tables] a/1/7/5 - kujira cullingshader 2 BCH a/1/7/6 - 1 TM (0x54 entry file?) a/1/7/7 - communications wait a/1/7/8 - 22 TGA files (targa?) a/1/7/9 - friend safari UI a/1/8/0 - BCH CGFX shader matrix a/1/8/1 - 473 KB of zeroes. lol a/1/8/2 - Normal Maison pkm a/1/8/3 - Normal Maison choices a/1/8/4 - Super Maison pkm a/1/8/5 - Super Maison choices a/1/8/6 - Inverse(?) Maison pkm a/1/8/7 - Inverse(?) Maison choices a/1/8/8 - homenix (home button blocker) a/1/8/9 - move stats a/1/9/0 - egg moves a/1/9/1 - level-up moves a/1/9/2 - evolution data a/1/9/3 - mega "evolution" map a/1/9/4 - 8 * 404 bytes (101 entries) a/1/9/5 - pokemon stats (personal) a/1/9/6 - baby pokemon a/1/9/7 - item stats a/1/9/8 - 776 byte file a/2/0/1 - language selection plusle minun pikachu a/2/0/2 - number / text? input UI a/2/0/7 - battle vs UI time/containers a/2/1/0 - 9 TM models? a/2/1/2 - move summary sprites (contest/type sprites) a/2/1/3 - battle UI a/2/1/4 - elite four descriptor UI a/2/1/8 - SESD single 254 byte a/2/2/7 - Game Icon SMDH a/2/3/1 - stereo frame (useless) a/2/3/2 - game over a/2/3/3 - battle fade-outs a/2/3/5 - language icons a/2/3/6 - the end a/2/3/7 - ETC type backgrounds a/2/3/8 - fatal error a/2/3/9 - mode 1/2/4 a/2/4/0 - Hall of Fame Congratulations a/2/4/1 - str_fade_text_anime_on a/2/4/2 - 11 binary files a/2/4/3 - nav / pss UI a/2/4/4 - link UI a/2/4/5 - map news a/2/4/6 - casters and other sprites a/2/4/7 - Pokemon Multi Navi (pokenavi) header UI (minor) a/2/4/8 - pokenavi location screens & UI a/2/4/9 - pss UI buttons a/2/5/0 - contest UI a/2/5/1 - SCOL (sky collisions) skytrip BCH models (overworld) a/2/5/2 - SLAN skytrip landing coordinates? a/2/5/3 - skytrip CGFX / UV effects a/2/5/4 - skytrip models (lati@s + player) a/2/5/5 - skytrip map a/2/5/6 - ZG lz11 compressed pokedex UI a/2/5/7 - 173 TM files (Secret Base Decoration Models) a/2/5/8 - secret base UI a/2/5/9 - QR code UI a/2/6/0 - switch / denki_br BCH a/2/6/1 - c107gym_light c06gym_gc_li1 esper_gym_float a/2/6/2 - Binary File**** a/2/6/3 - 120x120 pokedex sprites a/2/6/4 - common heart emitter CGFX a/2/6/5 - contest photo taking a/2/6/6 - TM gym flight a/2/6/7 - wild grass a/2/6/8 - TM rigging a/2/6/9 - intro navi sprites (birch) and code cpp enum a/2/7/0 - TM Beautifly / Wingull BCH a/2/7/1 - TM Building interior related BCH a/2/7/2 - TM Hot springs a/2/7/3 - TM Ice Gym a/2/7/4 - TM Gost house / pure a/2/7/5 - TM Plrden Light a/2/7/6 - map navi buttons a/2/7/7 - Ruby Sapphire Sprites a/2/8/2 - extm glow effect BCH a/2/8/7 - TM wingull model a/2/8/8 - TM Luvdisc Corsola a/2/9/0 - TM Relicanth Chinchou Corsola DARK a/2/9/1 - flying a/2/9/2 - TM Bridge wooden BCH a/2/9/3 - TM c109_dai_07 meh a/2/9/4 - QR UI a/2/9/5 - TM sibuki kinagi misc BCH a/2/9/6 - TM fargake / sky BCH a/2/9/7 - TM extm UV BCH/CGFX a/2/9/8 - blend dummy Demo Only a/2/9/9 - ‘more adventures in the full game!’ demo only a/3/0/0 - ending Original link: http://pastebin.com/4bg3q6FL

PKM files have been ripped from saved and traded online for roughly the last 5 years or so by players [as of 2012]. Pulling them out of games is very easy and makes trading, legal checking specific bits of data, or giving out pokemon to friends a simple task. When GameFreak needs to get or set specific data from a pokemon file, they do it using a switch statement and a series of fields. They do it like so: (starting from 0, obviously) typedef enum PkmField { FIELD_PID, FIELD_PARTY_DECRYPT, FIELD_BOX_DECRYPT, FIELD_EGG_SPECIES, FIELD_SUM, FIELD_SPECIES, FIELD_ITEM, FIELD_ID, FIELD_EXP, FIELD_HAPPY, -and so forth- }; When they need to write data to the pkm file, they use this function: void setPkmStat(void* pPkm, PkmField field, int data) and when they need to retrieve data from a PKM file, they use this: u32 getPkmStat(void* pPkm, PkmField field, int data) (data is basically always 0 in the "get" function- unless they're retrieving a string, in which case it's a string buffer pointer) So to get a piece of data from a pokemon, say if the pokemon is an egg(0x4C), it would look something like this: getPkmStat(pkm_pointer, IS_EGG, 0); The switch statements for these functions are large. In B2W2 a pkm file has 180 fields. In BW pkm files had 176 fields. The following is a partial list of field values for these functions: (all are in hexadecimal) 0x0 pid 0x1 (sanity) pkm party data is decrypted 0x2 (sanity) pkm box data is decrypted 0x3 (sanity) is pkm species egg 0x4 checksum 0x5 species 0x6 item 0x7 sidtid 0x8 exp 0x9 happiness 0xA, 10 ability 0xB, 11 markings 0xC, 12 region 0xD, 13 hp ev 0xE, 14 atk ev 0xF, 15 def ev 0x10, 16 spe ev 0x11, 17 spa ev 0x12, 18 spd ev 0x13, 19 cool contest 0x14, 20 beauty contest 0x15, 21 cute contest 0x16, 22 smart contest 0x17, 23 tough contest 0x18, 24 sheen contest 0x19, 25 sinnoh champ ribbon 0x1A, 26 ability ribbon 0x1B, 27 great ability ribbon 0x1C, 28 double ability ribbon 0x1D, 29 multi ability ribbon 0x1E, 30 pair ability ribbon 0x1F, 31 world ability ribbon 0x20, 32 alert ribbon 0x21, 33 shock ribbon 0x22, 34 downcast ribbon 0x23, 35 careless ribbon 0x24, 36 relax ribbon 0x25, 37 snooze ribbon 0x26, 38 smile ribbon 0x27, 39 gorgeous ribbon 0x28, 40 royal ribbon 0x29, 41 gorgeous royal ribbon 0x2A, 42 footprint ribbon 0x2B, 43 record ribbon 0x2C, 44 history ribbon 0x2D, 45 legend ribbon 0x2E, 46 red ribbon 0x2F, 47 green ribbon 0x30, 48 blue ribbon 0x31, 49 festival ribbon 0x32, 50 carnival ribbon 0x33, 51 classic ribbon 0x34, 52 premier ribbon 0x35, 53 ribbon 0x36, 54 move1 0x37, 55 move2 0x38, 56 move3 0x39, 57 move4 0x3A, 58 move1 current pp 0x3B, 59 move2 current pp 0x3C, 60 move3 current pp 0x3D, 61 move4 current pp 0x3E, 62 move1 ppup count 0x3F, 63 move2 ppup count 0x40, 64 move3 ppup count 0x41, 65 move4 ppup count 0x42, 66 move1 max pp 0x43, 67 move2 max pp 0x44, 68 move3 max pp 0x45, 69 move4 max pp 0x46, 70 hp iv 0x47, 71 atk iv 0x48, 72 def iv 0x49, 73 spe iv 0x4A, 74 spa iv 0x4B, 75 spd iv 0x4C, 76 is egg 0x4D, 77 cool ribbon 0x4E, 78 cool ribbon super 0x4F, 79 cool ribbon hyper 0x50, 80 cool ribbon master 0x51, 81 beauty ribbon 0x52, 82 beauty ribbon super 0x53, 83 beauty ribbon hyper 0x54, 84 beauty ribbon master 0x55, 85 cute ribbon 0x56, 86 cute ribbon super 0x57, 87 cute ribbon hyper 0x58, 88 cute ribbon master 0x59, 89 smart ribbon 0x5A, 90 smart ribbon super 0x5B, 91 smart ribbon hyper 0x5C, 92 smart ribbon master 0x5D, 93 tough ribbon 0x5E, 94 tough ribbon super 0x5F, 95 tough ribbon hyper 0x60, 96 tough ribbon master 0x61, 97 champion ribbon 0x62, 98 winning ribbon 0x63, 99 victory ribbon 0x64, 100 artist ribbon 0x65, 101 effort ribbon 0x66, 102 marine ribbon 0x67, 103 land ribbon 0x68, 104 sky ribbon 0x69, 105 country ribbon 0x6A, 106 national ribbon 0x6B, 107 earth ribbon 0x6C, 108 world ribbon 0x6D, 109 fateful encounter 0x6E, 110 gender(0 male, 1 female) 0x6F, 111 form 0x70, 112 nature 0x71, 113 has dw abil 0x72, 114 0x73, 115 name 0x74, 116 nickname 0x75, 117 is nicknamed 0x76, 118 0x77, 119 game of origin 0x78, 120 0x79, 121 0x7A, 122 0x7B, 123 0x7C, 124 0x7D, 125 0x7E, 126 0x7F, 127 0x80, 128 0x81, 129 0x82, 130 0x83, 131 0x84, 132 0x85, 133 0x86, 134 0x87, 135 0x88, 136 0x89, 137 0x8A, 138 0x8B, 139 0x8C, 140 0x8D, 141 OT name in 0x8E, 142 OT name out 0x8F, 143 year egg received (0-99) 0x90, 144 month egg received(1-12) 0x91, 145 day egg received(1-end of month) 0x92, 146 year met/egg hatched(0-99) 0x93, 147 month met/egg hatched(1-12) 0x94, 148 day met/egg hatched(1-end of month) 0x95, 149 location met/egg received 0x96, 150 egg hatch location 0x97, 151 pokerus 0x98, 152 poke ball 0x99, 153 met at level 0x9A, 154 set if OT gender is female 0x9B, 155 0x9C, 156 0x9D, 157 0x9E, 158 level 0x9F, 159 capsule seal index 0xA0, 160 current hp 0xA1, 161 max hp 0xA2, 162 attack 0xA3, 163 defense 0xA4, 164 speed 0xA5, 165 spa 0xA6, 166 spd 0xA7, 167 mail 0xA8, 168 0xA9, 169 is slot filled 0xAA, 170 is egg(both sanity bits) 0xAB, 171 get species if filled slot is egg(ret 0 otherwise) 0xAC, 172 get IVs as u32, no is_egg or is_nicknamed included 0xAD, 173 is species NOT nido F/M 0xAE, 174 pkm type 0xAF, 175 pkm type 0xB0, 176 0xB1, 177 0xB2, 178 N's poke

The "/BALANCE/item_p.bin" file in Pokemon Mystery Dungeon Explorers of Sky/Time/Darkness contains data on every item in the game. Its a SIR0 wrapped file. Notes The item_p.bin file has a different structure in PMD:EoT/D than in PMD:EoS. Item entries in EoS are 16 bytes, while they're 24 bytes int EoT/D! In Explorers of Sky, there are 1,400 entries. In Explorers of Time/Darkness, there are 1,000 entries. File Structure (Explorers of Sky) Overview Offset Length Name Description 0x00 16 SIR0 Header A SIR0 header wrapping the item data. 0x10 (NbEntries * 16) Item Data A block containing entries for all items. After Item Data 3 SIR0 Pointer Offset List A list of encoded offsets to the pointers in the file. Since there are only the 2 pointers of the SIR0 header, those three bytes are always 0x04, 0x04, 0x00. After SIR0 Pointer Offset List 13 Padding Bytes Since all entries have a fixed size, and the SIR0 Pointer Offset List is 3 bytes long, 13 0xAA bytes are used as padding to align the end of the file on 16 bytes. Item Data The entries for each items are always 16 bytes long, and are organized this way: Item Entry (Total length 16 bytes) Offset Length Type Name Description 0x00 2 uint16 Buy Price Price to pay for the item when purchased from a shop. 0x02 2 uint16 Sell Price Price a shop will offer for the item. 0x04 1 uint8 Category Used for sorting items, and possibly to determine the way the item works. 0x05 1 uint8 SpriteID The sprite shown next to the item in the bag and on the ground. 0x06 2 uint16 ItemID The ID by which the game refers to this item ! 0x08 2 uint16 Item Parameter #1 See Item Parameter 0x0A 1 uint8 Item Parameter #2 Another parameter for items. Unknown role. 0x0B 1 uint8 Item Parameter #3 Another parameter for items. Unknown role. 0x0C 1 uint8 Unknown#1 Unknown. 0x0D 1 uint8 Unknown#2 Unknown. 0x0E 1 uint8 Unknown#3 Unknown. 0x0F 1 uint8 Unknown#4 Unknown, usually is 0. Category A list of the possible category value an item can have. This list is based on data compiled by nhahtdh into the item_p_sky.xlsx excel document, and then verified/confirmed on our end.(See links in the Credits section. ) ID Category 0x0 Projectile 0x1 Arc 0x2 Seed & Drink 0x3 Food & Gummi 0x4 Hold item 0x5 TM & HM 0x6 Poké 0x7 N/A 0x8 Evo. + Misc. 0x9 Orb 0xA Link Box 0xB Used TM 0xC Box 1 0xD Box 2 0xE Box 3 0xF Specific Items Item Parameter There are 3 parameters slots available for each items, their use depends on the item type. Parameter #1 (offset 0x08) If the item is an HM/TM, or an orb, this value is the move ID it refers to. Its also used the same way by some items, like orbs. Otherwise, with items of any other category, its role is unknown ! File Structure (Explorers of Time/Darkness) External Resources Wonder Mail S Tools, research notes. The "items_p_Sky.xlsx" excel sheet contains a comprehensive list of item names/types, pokemon names/types, moves names, etc, along with their associated index values in-game : [1] [Mirror] Credits The WMS project, for their notes. [2] OgreGunner and nhahtdh for that huge thread on GameFaqs filled with tidbits of information! [3]

The "/BALANCE/m_level.bin" file in Pokemon Mystery Dungeon: Explorers of Sky/Time/Darkness contains level-up data for all the Pokemon in the game. Its a pack file containing one entry per Pokemon. The index/order of the entry for each Pokemon is identical to the order of the entries in the monster.md file, and that's how they're assigned. However, in Explorers of Sky, the m_level.bin file's number of entries was cut in half, removing most redundant entries.(see monster.md for more details on why its redundant ) Notes Explorers of Sky: Contains 571 entries. Explorers of Time/Darkness: Contains 1,192 entries. The stats the Pokemon has on level 1 are contained within its entry inside the monster.md file! Not in m_level.bin! What is in m_level.bin is merely added to those stats as the Pokemon grows in level. File Structure See the pack file page, for details on how the container is organized. This page will focus on the particularities of the content, not the container. Content Structure Each individual entry/sub-file is a PKDPX compressed container. Once decompressed, the data is simply 100, 12 bytes entries one after the other. Each of those entries contains the total experience required to reach this level, and the stats growth after the level has been reached. Level-Up Data List Here's the structure of the entire thing: Total length 1200 bytes Offset Length Type Name Description 0x00 12 FirstLvlEntry Entry for the first level. Its always completely null, since there are no previous levels, and thus, no level-up requirements. .. Rest of the levels entries here.. 0x4A4 12 LastLvlEntry The entry for level 100 ! Level-Up Data Entry Here's how a single entry for a single level is structured. Everything is little endian. Total length 12 bytes Offset Length Type Name Description 0x0 4 int32 ExpReq The total amount of experience required to reach that level. The value is absolute, not relative to the last level! 0x4 2 uint16 HP Increase The amount of HPs the Pokemon will gain when reaching this level. 0x6 1 uint8 Attack Increase The amount the attack of the Pokemon will increase when reaching this level. 0x7 1 uint8 Special Attack Increase The amount the special attack of the Pokemon will increase when reaching this level. 0x8 1 uint8 Defense Increase The amount the defense of the Pokemon will increase when reaching this level. 0x9 1 uint8 Special Defense Increase The amount the special defense of the Pokemon will increase when reaching this level. 0xA 2 uint16 Null 2 bytes of zeroes.

General Information This page contains data on the Pokémon Mystery Dungeon: Explorers of Sky/Time/Darkness games. Explorers of Sky Data Specific to Explorers of Sky Here's a list of all known functions and data offsets within the game's binaries: Functions and Data Offset NDS9/ARM9 Overlays: A list of all the overlays, and what they're used for. Overlay #00: RAM Load address: 0x022BCA80 Length in RAM: 395,680 bytes Description: Possibly contains data and code related to wifi multiplayer, in addition to the root menu. It mentions several files from the BACK folder that are known backgrounds for the root menu. Overlay #01: RAM Load address: 0x02329520 Length in RAM: 77,088 bytes Description: Seems related to wifi rescue. It mentions several files from the GROUND and BACK folders: 0x11ab8 : "BACK/expback.bgp" 0x11b00 : "BACK/s07p02a.bgp" 0x11b38 : "BACK/expback.bgp" 0x11b70 : "BACK/expback.bgp" 0x11b84 : "GROUND/s18p01a4.wan" 0x11b98 : "GROUND/s18p01a2.wan" 0x11bac : "GROUND/s18p01a3.wan" 0x11be4 : "GROUND/s18p01a1.wan" 0x11bf8 : "BACK/s18p01a.bgp" Overlay #02: RAM Load address: 0x02329520 Length in RAM: 176,032 bytes Description: Most likely code for the Nintendo wifi setup. Overlay #03: RAM Load address: 0x0233CA80 Length in RAM: 41,312 bytes Description: Unknown so far. Contains a single mention of "TABLEDAT/item00.dat" at 0xA078. Overlay #04: RAM Load address: 0x0233CA80 Length in RAM: 11,232 bytes Description: Unknown so far. Contains a single mention of "TABLEDAT/item00.dat" at 0x2BA4. Overlay #05: RAM Load address: 0x0233CA80 Length in RAM: 12,864 bytes Description: Unknown so far. Contain a single line of dialog formated text "[CS:X][string:0][CR][CLUM_SET:88][rank:0]" at 0x31EC Overlay #06: RAM Load address: 0x0233CA80 Length in RAM: 9,312 bytes Description: Probably linked to WiFi rescue. Found those strings: 0x2354 : "Mysterious WiFi: Illegal Identifier" 0x237C : "Mysterious WiFi: Difference Version" 0x23A4 : "Mysterious WiFi: Difference Language" 0x23CC : "Mysterious WiFi: Difference Check Sum: 0x%08x 0x%08x" 0x2404 : "Mysterious WiFi: Illegal Data" Overlay #07: RAM Load address: 0x0233CA80 Length in RAM: 20,736 bytes Description: Unknown so far. Overlay #08: RAM Load address: 0x0233CA80 Length in RAM: 8,704 bytes Description: Seems related to WiFi communications, from the string search results. Overlay #09: RAM Load address: 0x0233CA80 Length in RAM: 11,648 bytes Description: Unknown this far. Has a single mention of "BACK/s18p02a.bgp" at 0x2D00 Overlay #10: RAM Load address: 0x022BCA80 Length in RAM: 128,928 bytes Description: Unknown this far. Some interesting strings: 0x1F58C : "Lv. %d" 0x1F594 : "[value:0:3]/[value:1:3]" 0x1F5AC : "Lv. %d [CLUM_SET:44][value:0:3]/[value:1:3]" 0x1F5D8 : "%s[CLUM_SET:70]%s" 0x1F5EC : "/DUNGEON/sub2.bgp" 0x1F600 : "/DUNGEON/sub.bgp" 0x1F614 : "MainGame enter dungeon mode %d %d" 0x1F638 : "dungeon fade out mode %d" 0x1F654 : "dungeon getout result %d" 0x1F694 : "rom0:BALANCE/mappa_gs.bin" 0x1F6B0 : "dungeon map index %3d floor %3d -> dg index %3d floor max %3d -> bg index %3d table index %3d" 0x1F710 : "rom0:BALANCE/fixed.bin" Overlay #11: RAM Load address: 0x022DC240 Length in RAM: 298,048 bytes Description: Most likely the script engine for the game ! Overlay #12: RAM Load address: 0x0238A140 Length in RAM: 32 bytes Description: Empty, 32 bytes of zeros. Overlay #13: RAM Load address: 0x0238A140 Length in RAM: 11,904 bytes Description: Controls the personality test, including the available partners and playable Pokémon. Personality test questions are stored in the MESSAGE folder. Overlay #14: RAM Load address: 0x0238A140 Length in RAM: 15,072 bytes Description: Probably what runs the gatekeeper mini-game(String search returned mention of footprints). Overlay #15: RAM Load address: 0x0238A140 Length in RAM: 4,192 bytes Description: Possibly has to do with Duskull's bank. Got this "Menu_Bank_Mode_Cancel" at 0xFB4. Overlay #16: RAM Load address: 0x0238A140 Length in RAM: 11,552 bytes Description: Possibly linked to the Chimecho's assembly menu. Got this string "menuMonsterPictureBook_IsBusy busy" at 0x2CC4. Overlay #17: RAM Load address: 0x0238A140 Length in RAM: 7,392 bytes Description: Unknown this far. Overlay #18: RAM Load address: 0x0238A140 Length in RAM: 13,568 bytes Description: Unknown this far. Overlay #19: RAM Load address: 0x0238A140 Length in RAM: 16,960 bytes Description: Possibly linked to Spinda's cafe. Overlay #20: RAM Load address: 0x0238A140 Length in RAM: 12,288 bytes Description: Unknown this far. Overlay #21: RAM Load address: 0x0238A140 Length in RAM: 11,808 bytes Description: Most likely for the swap shop menu. Overlay #22: RAM Load address: 0x0238A140 Length in RAM: 19,264 bytes Description: Most likely for the Keckleon shop menu. Overlay #23: RAM Load address: 0x0238A140 Length in RAM: 14,208 bytes Description: Most likely for the Kangashkan storage menu. Overlay #24: RAM Load address: 0x0238A140 Length in RAM: 9,440 bytes Description: Unknown this far. Overlay #25: RAM Load address: 0x0238A140 Length in RAM: 5,312 bytes Description: Unknown this far. Overlay #26: RAM Load address: 0x0238A140 Length in RAM: 3,648 bytes Description: Unknown this far. Overlay #27: RAM Load address: 0x0238A140 Length in RAM: 11,616 bytes Description: Most likely another menu for item handling storage.. Overlay #28: RAM Load address: 0x0238A140 Length in RAM: 3,168 bytes Description: Unknown this far. Overlay #29: RAM Load address: 0x022DC240 Length in RAM: 488,992 bytes Description: Possibly having to do with running the in-dungeon game. Spotted strings for the in-dungeon menu. Overlay #30: RAM Load address: 0x02382820 Length in RAM: 14,496 bytes Description: Unknown this far. Overlay #31: RAM Load address: 0x02382820 Length in RAM: 31,360 bytes Description: Possibly the tactics menu. Overlay #32: RAM Load address: 0x02382820 Length in RAM: 32 bytes Description: Empty, 32 bytes of zeros. Overlay #33: RAM Load address: 0x02382820 Length in RAM: 32 bytes Description: Empty, 32 bytes of zeros. Overlay #34: RAM Load address: 0x022DC240 Length in RAM: 3,680 bytes Description: Possibly having to do with launching the game. There are mention in the strings of the ERSB logo and the "n_logo" logo. Overlay #35: RAM Load address: 0x022BCA80 Length in RAM: 32 bytes Description: Empty, 32 bytes of zeros. Explorers of Time/Darkness Data Specific to Explorers of Time/Darkness. Those two games have some significant differences with Explorers of Sky in the way data is stored. NDS9/ARM9 Overlays: A list of all the overlays, and what they're used for. File Structure A detailed list of the file structure of the ROM's nitro-fs filesystem. The three games share a pretty similar file structure. The differences between the three file structures will be indicated as such. Note: A lot of files in the ROM have an identifier that correspond to which level/event/cutscene/etc, they're used in. Something like: "s17p01" for example. First/Second level directories: /BACK/ Contains large compressed BGP images. Some of those appear on the main menu, some later during the game. In Explorers of Sky, the backgrounds from Explorers of Time and Darkness are present but unused. /BALANCE/ Contain data about entities/Pokemon, moves, items, and dungeons data. /DUNGEON/ Contains what seems to be some dungeon tiles. /DWC/ Data for the standard NDS Wifi setup screen. /EFFECT/ Contains some of the effect sprites. /FONT/ Contains fonts, UI element resources, palettes, and the portraits for the talking pokemon during the game. /GROUND/ Contains various sprites, map props, cutscene elements, some effects, and more. /MAP_BG/ Contains what seems to be map tiles. /MESSAGE/ Contains the text strings for most of the game! /MONSTER/ Contains the pokemon sprites for battle and the "overworld". /RESCUE/ (Explorers of Sky only) Possibly linked to SOS code generation, and the interactive online rescues. /SCRIPT/ Contains the scripts for the whole game. Each directories has an identifier related to the context it takes place in. /SOUND/BGM/ Contains the main instrument sounds bank, "bgm.swd", and all the music in the game. With each tracks being a pair of a SMD and SWD file. Those files are used by the game's DSE sound driver. /SOUND/ME/ Contains the jingles that plays when obtaining items and etc.. /SOUND/SE/ Possibly sound effects. /SOUND/SWD/ A bunch of sound effects stored as SWDs /SOUND/SYSTEM/ Possibly menu related sound effects. /SYNTH/ (Explorers of Sky only) Possibly data for the swap cauldron. /SYSTEM/ Contains the demo roms for DS Download play, along with the icons and other resources related to that. /TABLEDAT/ (Explorers of Sky only) Possibly recycle shop data. /TOP/ Contains BGP files for the backgrounds used in Pokémon Mystery Dungeon: Blue Rescue Team. It can be deleted with no immediately apparent side effects, as the backgrounds are unused. File/Data Formats A list of all the file/data formats used in the game. Graphics Formats BGP WAN/WAT WBA W16 WTE and WTU CHR PAL BMA BPC BPL BPA SMD(image) SMA Audio Formats (The files the DSE sound driver uses) SWD SMD(Music Sequence) SED Data Formats BIN DAT MD TLK STR Script Engine Formats SSB SSA SSS SSE LSD Container Formats BIN(pack files) KAO SIR0 Compressed Container Formats AT4PX AT4PN PKDPX Font Data DAT (from in the /FONT/ directory) DIC Misc SRL Additionally, several files have a file extension that doesn't match their content. For example, "/SYSTEM/hsd_jap.dat" and "/SYSTEM/hsd_eng.dat" are AT4PX files, but their extension is ".dat". Files with Unique Formats A list of files that have their own unique format. /BALANCE/monster.md /BALANCE/monster.mnd (Explorers of Time/Darkness only) /BALANCE/item_p.bin /BALANCE/item_s_p.bin (Explorers of Sky only) /BALANCE/m_level.bin /BALANCE/waza_p.bin/waza_p2.bin /BALANCE/mappa_s.bin/mappa_t.bin/mappa_y.bin /BALANCE/mappa_gs.bin/mappa_gt.bin/mappa_gy.bin (Explorers of Sky only) /BALANCE/gwdparam.bin (Explorers of Sky only) /BALANCE/fixed.bin /BALANCE/st_i2n_j.bin /BALANCE/st_m2n_j.bin /BALANCE/st_n2m_j.bin /DUNGEON/dungeon.bin /FONT/kaomado.kao /MAP_BG/bg_list.dat /MESSAGE/tbl_talk.tlk /MESSAGE/text_*.str /RESCUE/rescue.bin (Explorers of Sky only) /SYNTH/synth.bin (Explorers of Sky only) /TABLEDAT/item00.dat to item15.dat (Explorers of Sky only) Internal Details Articles on the various inner working of specific aspects of the game. DSE sound driver: Explanation of the sound driver used in all 3 PMD2 games. Level System: Explanation on how the game picks a level to load and all the various sub-systems involved. External Resources Wonder Mail S Tools, research notes. The "items_p_Sky.xlsx" excel sheet contains a comprehensive list of item names/types, pokemon names/types, moves names, etc, along with their associated index values in-game : [1] Pokemon Explorers of Sky research thread on GameFaqs: [2] (lots of great info spread around all those pages)

General Information SWDL containers are used to contain sample and programs/presets information for any accompanying SEDL or SMDL files. They can be used in a few ways. To accompany a SMDL, and contain both the samples it uses and the data for the programs it uses. To accompany a SMDL, and contain only the program/preset data while referring to a main sample bank for the samples it uses. As a sample bank. When used in the second manner, it allows the game to only load the samples it actually uses from the main bank, and it keeps redundancy to a minimum. SWDLs also seems to override some of the data they contains. So, if a sample has its rootkey set to 60 in the main bank, and it was set to 80 in another SWDL referring to it, the rootkey actually used after loading that last SWDL would be 80. This works with a lot more parameters however. File Structure The file format is based around chunks, a bit like the RIFF file format. There doesn't seem to be a particular order to the chunks other than the header and the eod chunk. Overview[edit] Offset Length Name Description 0x0 80 SWDLHeader The container's header. - Varies wavi Chunk Contains details on all the samples contained, or referred to by the SWDL container. - Varies prgi Chunk The prgi chunk contains the programs/presets used by the SMDL files. (It may be omitted in SWDL purely for storing sample data.) - Varies kgrp Chunk The kgrp chunk contains information on every keygroups used in the SWDL by the programs/presets. (It may be omitted in SWDL purely for storing sample data.) - Varies pcmd Chunk The pcmd chunk contains the raw sample data for every samples contained in the file. (It may be omitted if the SWDL refers to a main bank for its sample data.) - 16 End of Data Chunk This empty chunk marks the end of the SWDL container. SWDL Header Total length 80 bytes Offset Length Type Name Description 0x00 4 char[4] magicn The 4 characters "swdl" {0x73, 0x77, 0x64, 0x6C} 0x04 4 - unk18 4 bytes of zeroes. 0x08 4 uint32 flen File length in bytes. 0x0C 2 uint16 version? Version number? ( 0x1504 ) 0x0E 1 uint8 unk1 Unknown. 0x0F 1 uint8 unk2 Unknown. 0x10 4 - unk3 4 bytes of zeroes. 0x14 4 - unk4 4 bytes of zeroes. 0x18 2 uint16 year Year the file was last modified. 0x1A 1 uint8 month Month the file was last modified. 0x1B 1 uint8 day Day the file was last modified. 0x1C 1 uint8 hour Hour the file was last modified. 0x1D 1 uint8 minute Minute the file was last modified. 0x1E 1 uint8 second Second the file was last modified. 0x1F 1 uint8 centisecond? Could possibly be the centisecond that the file was last modified. 0x20 16 char[16] fname Filename, ASCII null terminated string. Any extra space after the 0 on the total 16 bytes, is padded with 0xAA. 0x30 4 uint32 unk10 Always 0x00AA AAAA 0x34 4 uint32 unk11 4 bytes of zeroes. 0x38 4 uint32 unk12 4 bytes of zeroes. 0x3C 4 uint32 unk13 So far always 0x10 0x40 4 uint32 pcmdlen Length of "pcmd" chunk if there is one. If not, is null! If set to 0xAAAA0000 (The 0000 may contains something else), the file refers to samples inside an external "pcmd" chunk, inside another SWDL ! 0x44 4 uint32 unk14 4 bytes of zeroes. 0x46 2 uint16 nbwavislots Numbers of sample pointer slots, empty or not, in the "wavi" chunk's "WavTable". 0x48 2 uint16 nbprgislots Numbers of presets pointer slots , empty or not, in the "prgi" chunk's "TablA". 0x4A 2 uint16 unk17 Unknown 0x4C 4 uint32 wavilen Length of "wavi" chunk. wavi Chunk The wavi chunk contains information on all the samples. Its what links the prgi chunk to the sample data within the local or external pcmd chunk. Its made up of two main parts: A pointer table, with a slot for every samples used globally. A table of sample information. Each non-null pointers in the first table points to a single sample information entry in the second table. Null pointers indicate unused, or missing samples, depending on the context. Offset Length Type Name Description 0x00 4 char[4] label "wavi" {0x77, 0x61, 0x76, 0x69} 0x04 2 uint16 unk1 Always 0. 0x06 2 uint16 unk2 Always 0x1504. 0x08 4 uint32 chunkbeg Seems to always be 0x10, possibly the start of the chunk data. 0x0C 4 uint32 chunklen Length of the chunk data. Begins counting right after this field 0x10 Varies - WabTable Array containing 2 bytes offsets from the beginning offset of WavTable to an entry in the SampleInfoTbl table! It may be null. After WavTable 0-15 - Padding Bytes 0xAA padding bytes to align the next part on 16 bytes. After Padding varies - SampleInfoTbl This table contains details on each sample entries in the "WavTable". WavTable The table of pointers to the sample info. Each pointers is 16 bits, and may be null. The nb of entries is set in the SWDL header. SampleInfoTb The table made up of sample info entries. Each entries are 64 bytes, thus no padding is ever needed between entries. Here's the format of a sample info entry: Offset Length Type Name Description 0x00 2 uint16 unk1 Entry marker? Always 0x01AA. 0x02 2 uint16 ID Index number from WavTable. Empty/null entries in WavTable are counted! 0x04 1 int8 ftune The pitch fine tuning in cents(?). 0x05 1 int8 ctune Coarse tuning, possibly in semitones(?). Default is -7. 0x06 1 int8 rootkey The MIDI note associated to the sample. (The note that the instrument sampled is playing) It doesn't seems to have any effect in the game. 0x07 1 int8 ktps Key Transpose. Is basically the difference between rootkey and 60. 0x08 1 int8 volume The volume of the sample. (0-127) 0x09 1 int8 pan The pan of the sample. (0-64-127) 0x0A 1 uint8 unk5 Possibly Keygroup parameter for the sample. Always 0x00. 0x0B 1 uint8 unk58 Unknown. Always 0x02. 0x0C 2 uint16 unk6 Always 0x0000. 0x0E 2 - unk7 0xAA padding. 0x10 2 uint16 unk59 Always 0x1504. 0x12 2 uint16 smplfmt Sample format. 0x0000 : Possibly 8 bits PCM 0x0100 : 16 bits PCM 0x0200 : 4 bits ADPCM 0x0300 : Possibly PSG ? 0x14 1 uint8 unk9 Often 0x09 0x15 1 uint8 smplloop Flag indicating whether the sample should be looped or not ! (1 = looped, 0 = not looped) 0x16 2 uint16 unk10 Often 0x0108 0x18 2 uint16 unk11 Often 0004. 0x1A 2 uint16 unk12 Often 0x0101. 0x1C 4 - unk13 Often 0x0000 0000. 0x20 4 uint32 smplrate Sample rate in hertz. 0x24 4 uint32 smplpos The offset of the sound sample in the "pcmd" chunk when there is one. Otherwise, possibly offset of the exact sample among all the sample data loaded in memory? (The value usually doesn't match the main bank's) 0x28 4 uint32 loopbeg The position in bytes divided by 4, the loop begins at, from smplpos. ( multiply by 4 to get size in bytes ) Adding loopbeg + looplen gives the sample's length ! (For ADPCM samples, the 4 bytes preamble is counted in the loopbeg!) 0x2C 4 uint32 looplen The length of the loop in bytes, divided by 4. ( multiply by 4 to get size in bytes ) Adding loopbeg + looplen gives the sample's length ! 0x30 1 uint8 envon If not == 0, the volume envelope is processed. Otherwise its ignored. 0x31 1 uint8 envmult If not == 0, is used as multiplier for envelope paramters, and the 16bits lookup table is used for parameter durations. If 0, the 32bits duration lookup table is used instead. This value has no effects on volume parameters, like sustain, and atkvol. 0x32 1 uint8 unk19 Unknown. Usually 0x1 0x33 1 uint8 unk20 Unknown. Usually 0x3 0x34 2 uint16 unk21 Unknown. Usually 0x03FF ( Little endian -253) 0x36 2 uint16 unk22 Unknown. Usually 0xFFFF 0x38 1 int8 atkvol Sample volume envelope Attack Level.(0 to 127) Higher values towards 0x7F means the volume at which the attack phase begins at is louder. Doesn't shorten the attack time. 0x39 1 int8 attack Sample volume envelope Attack.(0 to 127) Higher values towards 0x7F means the attack phase takes longer to reach full volume! 126 is ~10 seconds. 0x3A 1 int8 decay Sample volume envelope Decay. (0 to 127) The duration the note has to be held until the volume is smoothly decreased to the value of "Sustain Volume". Higher values towards 0x7F means it takes longer before the held note's volume changes to "Sustain Volume". 0x3B 1 int8 sustain Sample volume envelope Sustain.(0 to 127) The volume at which the held note will stay at. (Default 0x7F) 0x3C 1 int8 hold Sample volume envelope Hold (0 to 127). Higher values towards 0x7F means the note is held at full volume longer after the attack phase. 126 is ~10 seconds. 0x7F, does the same as 0. 0x3D 1 int8 decay2 Sample volume envelope Decay2 (0 to 127). Higher values towards 0x7F means longer fade-out. 0x7F means never fade-out. (Default 0x7F) At 0x7E, it takes ~8 seconds for the volume to reach 0. 0x3E 1 int8 release Sample volume envelope Release parameter(0 to 127). Higher values towards 0x7F means longer release. Negative values mirror positive range. (Default is 0x28(40)) 0x3F 1 int8 unk57 Unknown. Usually 0xFF. prgi Chunk The prgi chunk contains programs/presets that the SMDL music sequences use as instrument presets in their tracks. Its made up of : A table of pointers to all the programs info entries. Some may be null. A table containing program info entries. The pointer table works in the exact same way as it does in the wavi chunk. 16 bits offsets from the beginning of the table to a program info entry. Offset Length Type Name Description 0x00 4 char[4] label "prgi" {0x70, 0x72, 0x67, 0x69} 0x04 2 uint16 unk1 Always 0. 0x06 2 uint16 unk2 Always 0x1504. 0x08 4 uint32 chunkbeg Seems to always be 0x10, possibly the start of the chunk data. 0x0C 4 uint32 chunklen Length of the chunk data. Begins counting right after this field 0x10 (nbprgislots * 2) + padding - ProgramPtrTbl A table of 16 bits pointers to entries in the ProgramInfoTbl. Some may be null. It usually has 128 slots. Like General Midi. If the nb of presets were to change, its possible there would be a need for padding bytes, seeing how the wavi chunk works. After ProgramPtrTbl Varies ProgramInfo[nbprgislots] ProgramInfoTbl A table containing information on all the presets available in the current SWDL. ProgramInfoTbl This table contains entries for every single presets available in the SWDL. Each entry is pointed to by a pointer in the ProgramPtrTbl. It contains ProgramInfo entries: ProgramInfo A ProgramInfo entry is minimum 144 bytes long. Its made of 3 parts: The program info header. The LFO table. The split table. The program info header contains details for identifying the preset, and the size of the LFO and split table. Offset Length Type Name Description 0x00 2 uint16 ID Index of the pointer in "TableA" that points to this entry. Also correspond to the program ID used in the corresponding SMDL file! 0x02 2 uint16 nbsplits Nb of samples mapped to this presets, in the split table. 0x04 1 int8 prgvol Volume of the entire program. 0x05 1 int8 prgpan Pan of the entire program. (0-127, 64 is middle, 127 is full right, 0 is full left ) 0x06 1 uint8 unk3 Most of the time 0x00. 0x07 1 uint8 thatFbyte Most of the time 0x0F. 0x08 2 uint16 unk4 Most of the time is 0x200. 0x0A 1 uint8 unk5 Most of the time is 0x00. 0x0B 1 uint8 nblfos Nb of entries in the LFO Table. 0x0C 1 uint8 PadByte Most of the time is 0xAA, or 0x0. The value here is used as the delimiter and padding ! 0x0D 1 uint8 unk7 Most of the time is 0x0. 0x0E 1 uint8 unk8 Most of the time is 0x0. 0x0F 1 uint8 unk9 Most of the time is 0x0. 0x10 (nblfos * 16) LFOEntry[nblfos] LFOTbl Table that contains details on how to use the 4 LFOs with this preset. After LFOTbl 16 - Delimiter 16 bytes of "PadByte" padding bytes, possibly to delimit the start of the section below. Uses the value of PadByte as padding value! After Delimiter (nbsplits * 48) SplitEntry[nbsplits] SplitsTbl Table of samples splits mapped to this program. LFOEntry These determine how to configure the 4 Low Frquency Oscillators (LFO) linked to this program. It allows to set the shape of the waveform/the function that generate the value. The output of the LFO, its frequency, depth, delay, fade-out. And possibly more. Here's the structure of an entry: Total Length 16 bytes Offset Length Type Name Description 0x00 1 uint8 unk34 Unknown, usually 0x00. It does seems to have an effect with a certain combination of other values in the other parameters. 0x01 1 uint8 unk52 Unknown, usually 0x00. Most of the time, this value is 1 when the LFO is in use. 0x02 1 uint8 dest The destination of the LFO's output. 0x0 : none/disabled 0x1 : pitch 0x2 : volume 0x3 : pan 0x4 : lowpass/cutoff filter? 0x03 1 uint8 wshape The shape/function of the waveform. (When the LFO is disabled, its always 1) Square Triangle? Sinus? ? Saw? Noise? Random 0x04 2 uint16 rate Rate at which the LFO "oscillate". May or may not be in Hertz. 0x06 2? uint16? unk29 Changing the value seems to induce feedback or resonance. (Or perhaps its because it ended up corrupting the sound engine state when messing with the parameter?) 0x08 2 uint16 depth The depth parameter of the LFO. 0x0A 2 uint16 delay Delay in milliseconds before the LFO effect is applied after the sample begins playing. 0x0C 2 uint16 unk32 Unknown, usually 0x0000. Possibly fade-out in milliseconds. 0x0E 2 uint16 unk33 Unknown, usually 0x0000. Possibly an extra parameter? Or a cutoff/lowpass filter's frequency cutoff? SplitEntry This represents a sample mapped to the preset. Those are played depending on certain conditions when a playnote event is received by the sequencer for that particular preset/program. Some samples may be played only for a certain range of keys or velocities for example. Offset Length Type Name Description 0x00 1 - unk10 A leading 0. 0x01 1 uint8 id The Index of the sample in the SplitsTbl! 0x02 1 uint8 unk11 Unknown. Is always the same value as offset 0x1A below ! (Possibly "bend range" according to assumptions made from the DSE screenshots) 0x03 1 uint8 unk25 Unknown. Possibly a boolean. 0x04 1 int8 lowkey Usually 0x00. Lowest MIDI Key this sample can play on. 0x05 1 int8 hikey Usually 0x7F. Highest MIDI Key this sample can play on. 0x06 1 int8 lowkey2 A copy of lowkey, for unknown purpose. 0x07 1 int8 hikey2 A copy of hikey, for unknown purpose. 0x08 1 int8 lovel Lowest note velocity the sample is played on.(0 - 127) 0x09 1 int8 hivel Highest note velocity the sample is played on.(0 - 127) 0x0A 1 int8 lovel2 A copy of lovel, for unknown purpose. Usually 0x00. 0x0B 1 int8 hivel2 A copy of hivel, for unknown purpose. Usually 0x7F. 0x0C 4 - unk16 Usually the same value as "PadByte", or 0. Possibly padding ? 0x10 2 - unk17 Usually the same value as "PadByte", or 0. Possibly padding ? 0x12 2 uint16 SmplID The ID/index of sample in the "wavi" chunk's lookup table. 0x14 1 int8 ftune Fine tune. The fine tune in cents. 0x15 1 int8 ctune Coarse tuning. Default is -7. 0x16 1 int8 rootkey Note at which the sample is sampled at ! 0x17 1 int8 ktps Key Transpose. Is basically the difference between rootkey and 60. 0x18 1 int8 smplvol Volume of the sample. 0x19 1 int8 smplpan Pan of the sample. 0x1A 1 uint8 kgrpid Keygroup ID of the keygroup this split belongs to! 0x1B 1 uint8 unk22 Unknown, possibly a flag. Usually 0x02. 0x1C 2 uint16 unk23 Unknown, usually 0000. 0x1E 2 - unk24 Usually the same value as "PadByte", or 0. Possibly padding ? Those last 16 bytes are for the volume envelope. They override the sample's original volume envelope! 0x20 1 uint8 envon If not == 0, the volume envelope is processed. Otherwise its ignored. 0x21 1 uint8 envmult If not == 0, is used as multiplier for envelope paramters, and the 16bits lookup table is used for parameter durations. If 0, the 32bits duration lookup table is used instead. This value has no effects on volume parameters, like sustain, and atkvol. 0x22 1 uint8 unk37 Unknown. 0x23 1 uint8 unk38 Unknown. 0x24 2 uint16 unk39 Unknown. 0x26 2 uint16 unk40 Unknown. 0x28 1 int8 atkvol Sample volume envelope Attack Level.(0 to 127) Higher values towards 0x7F means the volume at which the attack phase begins at is louder. Doesn't shorten the attack time. 0x29 1 int8 attack Sample volume envelope Attack.(0 to 127) Higher values towards 0x7F means the attack phase takes longer to reach full volume! 126 is ~10 seconds. 0x2A 1 int8 decay Sample volume envelope Decay. (0 to 127) The duration the note has to be held until the volume is smoothly decreased to the value of "Sustain Volume". Higher values towards 0x7F means it takes longer before the held note's volume changes to "Sustain Volume". 0x2B 1 int8 sustain Sample volume envelope Sustain.(0 to 127) The volume at which the held note will stay at. (Default 0x7F) 0x2C 1 int8 hold Sample volume envelope Hold (0 to 127). Higher values towards 0x7F means the note is held at full volume longer after the attack phase. 126 is ~10 seconds. 0x7F, does the same as 0. 0x2D 1 int8 decay2 Sample volume envelope Decay2 (0 to 127). Higher values towards 0x7F means longer fade-out. 0x7F means never fade-out. (Default 0x7F) At 0x7E, it takes ~10 seconds for the volume to reach 0. 0x2E 1 int8 release Sample volume envelope Release parameter(0 to 127). Higher values towards 0x7F means longer release. Negative values mirror positive range. (Default is 0x28(40)) 0x2F 1 int8 unk53 Usually 0xFF. kgrp Chunk The kgrp chunk contains a list of all the keygroups in use in this SWDL. Keygroups are used to allow finer control on how the audio engine allocates the limited amount of voices to the presets. They define a per group priority and a range of voice channel available to each, along with the maximum number of simultaneous voice channels each can used. Offset Length Type Name Description 0x00 4 char[4] label "kgrp" {0x6B, 0x67, 0x72, 0x70} 0x04 2 uint16 unk1 Always 0. 0x06 2 uint16 unk2 Always 0x1504. 0x08 4 uint32 chunkbeg Seems to always be 0x10, possibly the start of the chunk data. 0x0C 4 uint32 chunklen Length of the chunk data. Begins counting right after this field 0x10 Varies Keygroup[] Keygroups A table containing all the keygroups used in the SWDL. The first entry is usually the global Keygroup, of which most splits are part of. After Keygroups 0 or 8 - Padding? When there is an odd number of Keygroup entry, it appears there is some garbage(?) inserted here to make the next chunk start on an offset divisible by 16. Keygroup A single entry in the Keygroups table. This is meant to mitigate issues with the limited polyphony of the NDS. Basically, this is used to tell what sets of instruments gets to play notes over the others. (Wikipedia has an excellent article on synthesizer polyphony here: https://en.wikipedia.org/wiki/Polyphony_and_monophony_in_instruments ) The polyphony parameter allows to set how many simultaneous voices a member of the keygroup may use. The vc high and vc low parameters defines the range out of all the available voice channels that members of the group may use. The priority parameter is meant to tell which keygroups has priority over using a voice channel. For example, lets say that a split "splitA" is a member of a priority 1 keygroup, and another split "splitB" of a priority 15 keygroups, and there is no voice channel available to use as they're all being used. SplitB needs to play a note, but splitA is currently playing one. Then SplitA will be cut abruptly, and its voice channel will be reassigned to splitB so it can play its note! Keygroup 0 is the global keygroup everything uses by default, and its always there. Total Length 8 bytes Offset Length Type Name Description 0x00 2 uint16 ID Index/ID of the keygroup. 0x02 1 uint8 poly Polyphony. AKA max number of simultaneous notes played. 0 to 15. -1 means disabled. 0x03 1 uint8 priority Priority over the assignment of a voice channel for the members of this group. A value from 0 to possibly 99. Default is 8. Lower values means lower priority, while higher means higher priority. 0x04 1 uint8 vclow Lowest voice channel of the range this group may use. Usually between 0 to 15. 0x05 1 uint8 vchigh Highest voice channel this group may use. Usually between 0 to 15. 0x06 1 uint8 unk50 Unknown. 0x07 1 uint8 unk51 Unknown. pcmd Chunk The pcmd chunk contains the sample data for every samples. Each samples is stored one after the other, regardless of the sample type or sample rate, without headers or delimiters of any sort! Each samples is located by using the sample entries in the wavi chunk. Offset Length Type Name Description 0x00 4 char[4] label "pcmd" {0x70, 0x63, 0x6D, 0x64} 0x04 2 uint16 unk1 Always 0. 0x06 2 uint16 unk2 Always 0x1504. 0x08 4 uint32 chunkbeg Seems to always be 0x10, possibly the start of the chunk data. 0x0C 4 uint32 chunklen Length of the chunk data. Begins counting right after this field 0x10 Varies - SampleDataBlob Contains the sample data for all the samples used in the SWDL. The data can be stored in any of the compatible formats: The NDS's 4 bits IMA ADPCM encoding (Same as official IMA ADPCM. Even uses the same tables. only the way sample values are clamped when converting back to PCM16 differ a tiny bit, which might not even be noticeable.) raw PCM16 samples. raw PCM8 samples. Possibly PSG or something else ? Note About ADPCM: Each ADPCM sample begins with the initial value of the "predictor" on 16 bits. Then the "step index", also on 16 bits. Afterwards, comes the actual sample data. The ADPCM preamble is included in the value of the "loopbeg" parameter of the sample! Eod Chunk This chunk marks the the end of the SWDL container/file. There is nothing past the chunk header! Total Length 16 bytes Offset Length Type Name Description 0x00 4 char[4] label "eod\20" {0x65, 0x6F, 0x64, 0x20} 0x04 2 uint16 unk1 Always 0. 0x06 2 uint16 unk2 Always 0x1504. 0x08 4 uint32 chunkbeg Seems to always be 0x10, possibly the start of the chunk data. 0x0C 4 uint32 chunklen Length of the chunk data. Begins counting right after this field. Always 0 for eod chunk! Volume Envelopes Here is some more information on how volume envelopes are parsed. In PMD2 Explorers of Sky, the north american version, here are the routines at runtime in memory that handle parsing the envelopes: 0x02074E0C : Code that picks an envelope's starting phase. 0x02074F54 : Code that handles updating the envelope's state. 0x02074D58 : Code handling lerping the volume values for any of the envelope parameters indicating a duration. The parameters indicating a duration in the envelopes are used as indices in one of 2 lookup tables to get an actual duration. If the "envmult" parameter of the envelope is not 0, the 16 bits lookup table is used, while if its 0, the 32 bits lookup table is used. Here's a heavily commented and re-organized assembly snippet to demonstrate how the duration lookup tables are used, and how a single parameter is parsed: Fun_02074D58( R0(SplitEnvelopeAddress), R1(TargetVolume), R2(EnvelopeParam) ) { 02074D58 E92D4038 push r3-r5,r14 02074D5C E1A05000 mov r5,r0 02074D60 E1A04001 mov r4,r1 02074D64 E352007F cmp r2,7Fh //See if the envelope parameter is == 0x7F 02074D68 1A000004 bne 02074D80 if( EnvelopeParam != 0x7F ) { 02074D80 E5C5401D strb r4,[r5,1Dh] //Put the TargetVolume here 02074D84 E5D53001 ldrb r3,[r5,1h] //Load envmult 02074D88 E3530000 cmp r3,0h 02074D8C 1A000007 bne 02074DB0 if( envmult != 0 ) { 02074DB0 E59F0050 ldr r0,=20B0F50h //16 bits lookup table for durations 02074DB4 E1A01082 mov r1,r2,lsl 1h //R1 = EnvelopeParam << 1 (Basically, multiply by 2 the envelope param, so that we get a byte offset in a 16bits integer array) 02074DB8 E19020B1 ldrh r2,[r0,r1] //Get the duration from the table 02074DBC E59F1040 ldr r1,=22B7330h //That's the static address of DSE driver's memory 02074DC0 E3A00FFA mov r0,3E8h 02074DC4 E0020293 mul r2,r3,r2 //We multiply the duration with envmult (the envelope duration multiplier) 02074DC8 E0000092 mul r0,r2,r0 //We multiply our duration by 1000 02074DCC E1D112F8 ldrsh r1,[r1,28h] //This address always contains the value 10000 02074DD0 EB006C33 bl 0208FEA4 //(Division signed R0 = R0 / R1) //Continues to 02074DD4.. } else { 02074D90 E59F0068 ldr r0,=20B1050h //32 bits lookup table for durations 02074D94 E59F1068 ldr r1,=22B7330h //That's the static address of DSE driver's memory 02074D98 E7902102 ldr r2,[r0,r2,lsl 2h] //Multiply the EnvelopeParam by 4( EnvelopeParam << 2 ) to get the byte offset in a int32 array 02074D9C E3A00FFA mov r0,3E8h 02074DA0 E0000092 mul r0,r2,r0 //We multiply our duration by 1000 02074DA4 E1D112F8 ldrsh r1,[r1,28h] //This address always contains the value 10000 02074DA8 EB006CC0 bl 020900B0 //(Unsigned division R0 = R0 / R1) 02074DAC EA000008 b 02074DD4 //Continues to 02074DD4.. } 02074DD4 E5850018 str r0,[r5,18h] //Put EnvelopePhaseTimeLeft here 02074DD8 E5951018 ldr r1,[r5,18h] //Read it back into R1 02074DDC E3510000 cmp r1,0h if( EnvelopePhaseTimeLeft == 0 ) { 02074DE0 03A00000 moveq r0,0h 02074DE4 05850014 streq r0,[r5,14h] //Set VolumeIncrement to 0 02074DE8 08BD8038 popeq r3-r5,r15 //Return } 02074DEC E5950010 ldr r0,[r5,10h] //Load EnvPhaseCurrentVolume 02074DF0 E0600B84 rsb r0,r0,r4,lsl 17h // (TargetVolume << 0x17) - EnvPhaseCurrentVolume, or (2^23 * TargetVolume) - EnvPhaseCurrentVolume 02074DF4 EB006C2A bl 0208FEA4 //(Division signed R0 = R0 / R1) Divide volume difference between TargetVolume and EnvPhaseCurrentVolume by the EnvelopePhaseTimeLeft 02074DF8 E5850014 str r0,[r5,14h] //Set VolumeIncrement 02074DFC E8BD8038 pop r3-r5,r15 } else { //Envelope param disabled 02074D6C E3A00000 mov r0,0h 02074D70 E5850014 str r0,[r5,14h] //Set the VolumeIncrement to 0 02074D74 E2400106 sub r0,r0,80000001h //This basically puts 0x7FFFFFFF into R0 (Aka the maximum signed, positive value for a signed 16bits integer ) 02074D78 E5850018 str r0,[r5,18h] //Put 0x7FFFFFFF as EnvelopePhaseTimeLeft 02074D7C E8BD8038 pop r3-r5,r15 } } Duration Lookup Tables The durations in the tables are in milliseconds, conveniently! 16 bits table located at 0x020B0F50: const int16_t Lookup_Table_20B0F50 [128] = { 0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007, 0x0008, 0x0009, 0x000A, 0x000B, 0x000C, 0x000D, 0x000E, 0x000F, 0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017, 0x0018, 0x0019, 0x001A, 0x001B, 0x001C, 0x001D, 0x001E, 0x001F, 0x0020, 0x0023, 0x0028, 0x002D, 0x0033, 0x0039, 0x0040, 0x0048, 0x0050, 0x0058, 0x0062, 0x006D, 0x0078, 0x0083, 0x0090, 0x009E, 0x00AC, 0x00BC, 0x00CC, 0x00DE, 0x00F0, 0x0104, 0x0119, 0x012F, 0x0147, 0x0160, 0x017A, 0x0196, 0x01B3, 0x01D2, 0x01F2, 0x0214, 0x0238, 0x025E, 0x0285, 0x02AE, 0x02D9, 0x0307, 0x0336, 0x0367, 0x039B, 0x03D1, 0x0406, 0x0442, 0x047E, 0x04C4, 0x0500, 0x0546, 0x058C, 0x0622, 0x0672, 0x06CC, 0x071C, 0x0776, 0x07DA, 0x0834, 0x0898, 0x0906, 0x096A, 0x09D8, 0x0A50, 0x0ABE, 0x0B40, 0x0BB8, 0x0C3A, 0x0CBC, 0x0D48, 0x0DDE, 0x0E6A, 0x0F00, 0x0FA0, 0x1040, 0x10EA, 0x1194, 0x123E, 0x12F2, 0x13B0, 0x146E, 0x1536, 0x15FE, 0x16D0, 0x17A2, 0x187E, 0x195A, 0x1A40, 0x1B30, 0x1C20, 0x1D1A, 0x1E1E, 0x1F22, 0x2030, 0x2148, 0x2260, 0x2382, 0x2710, 0x7FFF }; 32 bits table located at 0x20B1050: const int32_t Lookup_Table_20B1050 [128] = { 0x00000000, 0x00000004, 0x00000007, 0x0000000A, 0x0000000F, 0x00000015, 0x0000001C, 0x00000024, 0x0000002E, 0x0000003A, 0x00000048, 0x00000057, 0x00000068, 0x0000007B, 0x00000091, 0x000000A8, 0x00000185, 0x000001BE, 0x000001FC, 0x0000023F, 0x00000288, 0x000002D6, 0x0000032A, 0x00000385, 0x000003E5, 0x0000044C, 0x000004BA, 0x0000052E, 0x000005A9, 0x0000062C, 0x000006B5, 0x00000746, 0x00000BCF, 0x00000CC0, 0x00000DBD, 0x00000EC6, 0x00000FDC, 0x000010FF, 0x0000122F, 0x0000136C, 0x000014B6, 0x0000160F, 0x00001775, 0x000018EA, 0x00001A6D, 0x00001BFF, 0x00001DA0, 0x00001F51, 0x00002C16, 0x00002E80, 0x00003100, 0x00003395, 0x00003641, 0x00003902, 0x00003BDB, 0x00003ECA, 0x000041D0, 0x000044EE, 0x00004824, 0x00004B73, 0x00004ED9, 0x00005259, 0x000055F2, 0x000059A4, 0x000074CC, 0x000079AB, 0x00007EAC, 0x000083CE, 0x00008911, 0x00008E77, 0x000093FF, 0x000099AA, 0x00009F78, 0x0000A56A, 0x0000AB80, 0x0000B1BB, 0x0000B81A, 0x0000BE9E, 0x0000C547, 0x0000CC17, 0x0000FD42, 0x000105CB, 0x00010E82, 0x00011768, 0x0001207E, 0x000129C4, 0x0001333B, 0x00013CE2, 0x000146BB, 0x000150C5, 0x00015B02, 0x00016572, 0x00017015, 0x00017AEB, 0x000185F5, 0x00019133, 0x0001E16D, 0x0001EF07, 0x0001FCE0, 0x00020AF7, 0x0002194F, 0x000227E6, 0x000236BE, 0x000245D7, 0x00025532, 0x000264CF, 0x000274AE, 0x000284D0, 0x00029536, 0x0002A5E0, 0x0002B6CE, 0x0002C802, 0x000341B0, 0x000355F8, 0x00036A90, 0x00037F79, 0x000394B4, 0x0003AA41, 0x0003C021, 0x0003D654, 0x0003ECDA, 0x000403B5, 0x00041AE5, 0x0004326A, 0x00044A45, 0x00046277, 0x00047B00, 0x7FFFFFFF };

The "/BALANCE/item_s_p.bin" file in the Pokemon Mystery Dungeon: Explorers of Sky game is used to store data for the "exclusive items". Its wrapped in a SIR0 container. File Structure Overview Offset Length Name Description 0x00 16 SIR0 Header A SIR0 header wrapping the item data. 0x10 (NbEntries * 4) Item Data A block containing entries for all exclusive items. After Item Data 3 SIR0 Pointer Offset List A list of encoded offsets to the pointers in the file. Since there are only the 2 pointers of the SIR0 header, those three bytes are always 0x04, 0x04, 0x00. After SIR0 Pointer Offset List 13 Padding Bytes Since all entries have a fixed size, and the SIR0 Pointer Offset List is 3 bytes long, 13 0xAA bytes are used as padding to align the end of the file on 16 bytes. Item Data Item Data Entry (Total length 4 bytes) Offset Length Type Name Description 0x0 2 uint16 Item Type A number that indicates several things on the item. 0x2 2 uint16 Item Parameter A parameter that depends on the item type. Item Type A list of the possible type values an "exclusive item" can have. This list is based on data compiled by nhahtdh into the item_p_sky.xlsx excel document, and then verified/confirmed on our end.(See links in the Credits section. ) The type can determine these things: The star rating of the item. (rarity) Whether its Pokemon-specific, or type-specific. If its a 1 star item, which of the 2 possible 1-star items is it. Whether its an item that a Pokemon can randomly get when hatching. And possibly, an additional unknown trait. Here are the possible item type values, and what they imply: Value Rarity Item "Slot" Exclusive To Extra Trait 0x0 - - - - 0x1 * 1 A Type - 0x2 * 2 A Type - 0x3 ** - A Type - 0x4 *** - A Type - 0x5 * 1 A Pokemon - 0x6 * 2 A Pokemon - 0x7 ** - A Pokemon - 0x8 *** - A Pokemon - 0x9 *** - A Pokemon The Pokemon may hatch holding the item. 0xA *** - A Pokemon ? (Only all the Eeveelutions, and the Tyrogue line have items with this type! ) Item Parameter The parameter's value changes meaning depending on the exclusive item type. Here are the two cases: If the item's type is set to "exclusive to a Pokemon", the parameter contains that Pokemon's National Pokedex number. If the item's type is set to "exclusive to a type", the parameter contains the ID of the type. (See monster.md's page for a list of values for each types.) External Resource Wonder Mail S Tools, research notes. The "items_p_Sky.xlsx" excel sheet contains a comprehensive list of item names/types, pokemon names/types, moves names, etc, along with their associated index values in-game : [1] Credits The WMS project, for their notes. [2] OgreGunner and nhahtdh for that huge thread on GameFaqs filled with tidbits of information! [3]

OR/AS Save files are comprised of 4 sections, the latter two storing the contents of the two savegames. The structure of the save is extremely similar to Pokemon X/Y's, with the majority of structural changes being the shifting of the positions of partitions. The game alternates between the two game saves similar to Generations 3 & 4 and X/Y. Save files are 0x100000 (1MB). The area between sections is either FF or 00, for Cartridges and Digital saves respectively. Single Partition Save File http://3dbrew.org/wiki/Savegames Image Header (0x00000-0x00460) Offset Length Hash Details Description 00000 0x10 0x0: Uses the AES Engine & KeyY AES MAC Header 00100 0x100 0x16C: (SHA256) 0x000-0x12C of active DIFI DISA 00200 0x12C 0x30C: (SHA256) 1st IVFC Hash copied to 0x200 zero array DIFI Blob 1 00330 0x12C 0x43C: (SHA256) 1st IVFC Hash copied to 0x200 zero array DIFI Blob 2 First Partition (0x01000-0x01107) Offset Description 01000 DPFS Partition Save File 1 (0x02000 - 0x75FFF) (420 KB) Offset Description 02000 IVFC Hash Region 03000 SAVE Header (0x3F0 medias, 0x200 length) = 0x7E000 total 03100 SAVE Data ID Start Length CHK Description 0000 5400 000002C8 75E1A 05400 - Pokepuff Inventory (Index * 100ct) 05464 - u32 Received Counter 0001 5800 00000B90 75E22 05800 - Items Pocket 05E40 - Key Items Pocket 05FC0 - TM Pocket 06170- Medicine Pocket 06270 - Berry Pocket 0002 6400 0000002C 75E2A Select Bound Items 0003 6600 00000038 75E32 ???? 0004 6800 00000150 75E3A Trainer Stat Tracking 0005 6A00 00000004 75E42 ???? 0006 6C00 00000008 75E4A u32 Time Played + u32 Adventure Started 0007 6E00 000001C0 75E52 Wardrobe (Bitflags) & Saved Outfits (Index #s) - Unused in ORAS 0008 7000 000000BE 75E5A u16/u8 storage 0009 7200 00000024 75E62 FFFFFFFF 000A 7400 00002100 75E6A Overworld Data 0x108 per Overworld Entity 000B 9600 00000130 75E72 Trainer Information ($) 000C 9800 00000440 75E7A Box Names [0x22] Box Name (* 31) [0x01] Box Background *31 [0x03] Background Unlock Flags 000D 9E00 00000574 75E82 Battle Box 000E A400 00004E28 75E8A PSS Data - Friends 000F F400 00004E28 75E92 PSS Data - Acquaintances 0010 14400 00004E28 75E9A PSS Data - Passerby 0011 19400 00000170 75EA2 Trainer Card (ID/SID/OT/Greeting) 0012 19600 0000061C 75EAA Party Members 0013 19E00 00000504 75EB2 Constant & Event Flags 19E78 - Ash Counter 0x1A0FC-0x1A27B - Event Bitflags (0x180 * 8) 0014 1A400 000011CC 75EBA Pokedex & Encounter Count 0x1A400 - Constant? 0x2F120F17 0x1A004 - u32 counter (?) 0x1A408 - 0x60 Region 1 - Owned 0x1A468 - 0x60 Region 2 - Encountered Male 0x1A4C8 - 0x60 Region 3 - Encountered Female 0x1A528 - 0x60 Region 4 - Encountered Male * 0x1A588 - 0x60 Region 5 - Encountered Female * 0x1A5E8 - 0x60 Region 6 - Displayed Male 0x1A648 - 0x60 Region 7 - Displayed Female 0x1A6A8 - 0x60 Region 8 - Displayed Male * 0x1A708 - 0x60 Region 9 - Displayed Female * 0x1A768 - 0x26 Form Bitflag Region 1 - Encountered form 0x1A78E - 0x26 Form Bitflag Region 2 - Encountered form * 0x1A7B4 - 0x26 Form Bitflag Region 3 - Displayed form 0x1A7DA - 0x26 Form Bitflag Region 4 - Displayed form* 0x1A800 - 0x27C 7bit/entry flags (Language) 0x1AA7C - u32 ??? 0? 0x1AA80 - Spinda Spot Pattern (First EC encountered) 0x1AA86 - Encounter Counts 0015 1B600 00000644 75EC2 Sorted Variables 0016 1BE00 00000104 75ECA Fused Zekrom/Reshiram Storage 0017 1C000 00000004 75ED2 ???? 0018 1C200 00000420 75EDA ???? 0019 1C800 00000064 75EE2 O-Power Flags 001A 1CA00 000003F0 75EEA ???? 001B 1CE00 0000070C 75EF2 User Metadata 001C 1D600 00000180 75EFA GTS Upload & Match Criteria 001D 1D800 00000004 75F02 87B1A23F const 001E 1DA00 0000000C 75F0A ???? 001F 1DC00 00000048 75F12 Repel Info, (Swarm?) and other overworld info 0020 1DE00 00000054 75F1A ???? 0021 1E000 00000644 75F22 WiFi Tournament Data 0022 1E800 000005C8 75F2A Live Tournament Data 0023 1EE00 000002F8 75F32 MAC Address & Network Connection Logging (0x98 per entry) 0024 1F200 00001B40 75F3A Hall of Fame Data (First Game Clear + 15 Latest) 0x48 per Pokemon Slot; capped with 4 bytes at end (total 0x1B4) 0x00 - Species 0x02 - Held Item 0x04 - Move 1 0x06 - Move 2 0x08 - Move 3 0x0A - Move 4 0x0C - Encryption Key 0x10 - TID 0x12 - SID 0x14 - [Nicknamed,1][Shiny,1][Level,7][Gender,2][Form,5] bits 0x16 - Unused 0x18 - Nickname (0x16) + 0x3F80 end 0x30 - Trainer Name (0x16) + 0x3F80 end Last 4 bytes: 0x00 - # of Hall of Fame Victory 0x01 - [Unk,1][Day of Month,5][Month,4][Year,8] bits 0025 20E00 000001F4 75F42 Maison Data 205C0 - u16 Current Singles Streak 205C2 - u16 Current Super Singles Streak 205C4 - u16 Best Singles Streak 205C6 - u16 Best Super Singles Streak 205C8 - u16 Current Doubles Streak 205CA - u16 Current Super Doubles Streak 205CC - u16 Best Doubles Streak 205CE - u16 Best Super Doubles Streak 205D0 - u16 Current Triples Streak 205D2 - u16 Current Super Triples Streak 205D4 - u16 Best Triples Streak 205D6 - u16 Best Super Triples Streak 205D8 - u16 Current Rotation Streak 205DA - u16 Current Super Rotation Streak 205DC - u16 Best Rotation Streak 205DE - u16 Best Super Multi Streak 205E0 - u16 Current Multi Streak 205E2 - u16 Current Super Multi Streak 205E4 - u16 Best Multi Streaks 205E6 - u16 Best Super Multi Streak 0026 21000 000003E0 75F4A Daycare Data (Larger than XY) u32 (Slot 1) Occupied Flag u32 (Slot 1) Steps Taken Since Depositing1 xE8 (Slot 1) Box EK6 1 u32 (Slot 2) Occupied Flag u32 (Slot 2) Steps Taken Since Depositing2 xE8 (Slot 2) Box EK6 2 u64 Flag (egg available) u64 RNG Seed 0027 21400 00000216 75F52 Index Number Related Data 0028 21800 00000640 75F5A Berry Field Data (0x10 per tree, 100 trees) 0029 22000 00001A90 75F62 Wondercard Data 0x100 bitflag-card received storage Wondercard slots (0x108 between) 002A 23C00 00000400 75F6A SUBE data (XY: Old Man) - purpose unknown. 002B 24000 00000618 75F72 Friend Safari Data 002C 24800 0000025C 75F7A PSS Data 24970 (0x20) - Pokemon Bank (application?) data 002D 24C00 00000834 75F82 PSS Friend Data [0x15]*100 entries 002E 25600 00000318 75F8A Super Training Data 24610 - Mission Best Times (seconds as 4 byte floats)*30 24788 - u32 Species That Scored Best Time*30 24908 - Bag Inventory (12 bags) 002F 25A00 000007D0 75F92 ???? 0030 26200 00000C48 75F9A Pokemon Link Gifts 0x25E44 - u16 checksum (ccitt16, 0xFFFF initial) of 0x25400-0x25E43 0031 27000 00000078 75FA2 Index Number Related Data 0032 27200 00000200 75FAA PGL Promotion Gifts 0033 27400 00000C84 75FB2 ???? 0034 28200 00000628 75FBA Data Block (Purpose Unknown) u64 Length byte[Length] data 0035 28A00 00000400 75FC2 Contest Data 0036 28E00 00007AD0 75FCA Secret Base (Favorites) 0037 30A00 000078B0 75FD2 Secret Base (Passerby) & Passerby Event Values 0038 38400 00034AD0 75FDA Box Data (31 Boxes, 30 Slots, 232 bytes each) 0039 6D000 0000E058 75FE2 Picture Data (JPEG Exif Ver 2.2) ---- 75E00 00000800 ----- Checksum Storage [0x14] Header: u64 savetime1 & u64 savetime2 (First five bytes Anti-Savegame Restore Secure Value), u16 BEEF magic [0x10] Checksum Entries: u32 len, u16 ID, u16 checksum (ccitt16, 0xFFFF initial) Save File 2 (0x81000 - 0xF1FFF) (420 KB) Same as Game Save 1's offsets; add 0x7F000. IVFC Hash Region SHA256 Hash over a 0x1000 large block (4096 bytes). Start End Hash Location 2020 203F 2000 - First Hash: Copied to 0x200 zero array. 2040 2FFF 2020 - Second Hash: Copied to 0x1000 zero array. 3000 3FFF 2040 4000 4FFF 2060 5000 5FFF 2080 6000 6FFF 20A0 7000 7FFF 20C0 8000 8FFF 20E0 9000 9FFF 2100 A000 AFFF 2120 B000 BFFF 2140 C000 CFFF 2160 D000 DFFF 2180 E000 EFFF 21A0 F000 FFFF 21C0 10000 10FFF 21E0 11000 11FFF 2200 12000 12FFF 2220 13000 13FFF 2240 14000 14FFF 2260 15000 15FFF 2280 16000 16FFF 22A0 17000 17FFF 22C0 18000 18FFF 22E0 19000 19FFF 2300 1A000 1AFFF 2320 1B000 1BFFF 2340 1C000 1CFFF 2360 1D000 1DFFF 2380 1E000 1EFFF 23A0 1F000 1FFFF 23C0 20000 20FFF 23E0 21000 21FFF 2400 22000 22FFF 2420 23000 23FFF 2440 24000 24FFF 2460 25000 25FFF 2480 26000 26FFF 24A0 27000 27FFF 24C0 28000 28FFF 24E0 29000 29FFF 2500 2A000 2AFFF 2520 2B000 2BFFF 2540 2C000 2CFFF 2560 2D000 2DFFF 2580 2E000 2EFFF 25A0 2F000 2FFFF 25C0 30000 30FFF 25E0 31000 31FFF 2600 32000 32FFF 2620 33000 33FFF 2640 34000 34FFF 2660 35000 35FFF 2680 36000 36FFF 26A0 37000 37FFF 26C0 38000 38FFF 26E0 39000 39FFF 2700 3A000 3AFFF 2720 3B000 3BFFF 2740 3C000 3CFFF 2760 3D000 3DFFF 2780 3E000 3EFFF 27A0 3F000 3FFFF 27C0 40000 40FFF 27E0 41000 41FFF 2800 42000 42FFF 2820 43000 43FFF 2840 44000 44FFF 2860 45000 45FFF 2880 46000 46FFF 28A0 47000 47FFF 28C0 48000 48FFF 28E0 49000 49FFF 2900 4A000 4AFFF 2920 4B000 4BFFF 2940 4C000 4CFFF 2960 4D000 4DFFF 2980 4E000 4EFFF 29A0 4F000 4FFFF 29C0 50000 50FFF 29E0 51000 51FFF 2A00 52000 52FFF 2A20 53000 53FFF 2A40 54000 54FFF 2A60 55000 55FFF 2A80 56000 56FFF 2AA0 57000 57FFF 2AC0 58000 58FFF 2AE0 59000 59FFF 2B00 5A000 5AFFF 2B20 5B000 5BFFF 2B40 5C000 5CFFF 2B60 5D000 5DFFF 2B80 5E000 5EFFF 2BA0 5F000 5FFFF 2BC0 60000 60FFF 2BE0 61000 61FFF 2C00 62000 62FFF 2C20 63000 63FFF 2C40 64000 64FFF 2C60 65000 65FFF 2C80 66000 66FFF 2CA0 67000 67FFF 2CC0 68000 68FFF 2CE0 69000 69FFF 2D00 6A000 6AFFF 2D20 6B000 6BFFF 2D40 6C000 6CFFF 2D60 6D000 6DFFF 2D80 6E000 6EFFF 2DA0 6F000 6FFFF 2DC0 70000 70FFF 2DE0 71000 71FFF 2E00 72000 72FFF 2E20 73000 73FFF 2E40 74000 74FFF 2E60 75000 75FFF 2E80 Pokepuff Index Numbers Index Name 00 Empty 01 Sweet Basic Pokepuff 02 Mint Basic Pokepuff 03 Citrus Basic Pokepuff 04 Mocha Basic Pokepuff 05 Spice Basic Pokepuff 06 Sweet Frosted Pokepuff 07 Mint Frosted Pokepuff 08 Citrus Frosted Pokepuff 09 Mocha Frosted Pokepuff 0A Spice Frosted Pokepuff 0B Sweet Fancy Pokepuff 0C Mint Fancy Pokepuff 0D Citrus Fancy Pokepuff 0E Mocha Fancy Pokepuff 0F Spice Fancy Pokepuff 10 Sweet Deluxe Pokepuff 11 Mint Deluxe Pokepuff 12 Citrus Deluxe Pokepuff 13 Mocha Deluxe Pokepuff 14 Spice Deluxe Pokepuff 15 Wish Supreme Pokepuff 16 Honor Supreme Pokepuff 17 Spring Supreme Pokepuff 18 Summer Supreme Pokepuff 19 Fall Supreme Pokepuff 1A Winter Supreme Pokepuff Super Training Bag Index Numbers Index Name 00 Empty 01 HP Bag S 02 HP Bag M 03 HP Bag L 04 ATK Bag S 05 ATK Bag M 06 ATK Bag L 07 Def Bag S 08 Def Bag M 09 Def Bag L 0A Sp.A Bag S 0B Sp.A Bag M 0C Sp.A Bag L 0D Sp.D Bag S 0E Sp.D Bag M 0F Sp.D Bag L 10 Speed Bag S 11 Speed Bag M 12 Speed Bag L 13 Strength Bag 14 Toughen Up Bag 15 Swiftness Bag 16 Big-Shot Bag 17 Double-Up Bag 18 Team Flare Bag 19 Reset Bag 1A Soothing Bag Form Dex Index Forms follow the same index as used in the pokémon data structure (i.e. first unown form is "A"...) Mega Pokémon have a flag for non-mega form (regardless of gender) and for mega form. Parenthesis indicates how many form flags there are. Unown (28) Deoxys (4) Shaymin (2) Giratina (2) Rotom (6) Shellos (2) Gastrodon (2) Burmy (3) Wormadan (3) Castform (4) Cherrim (2) Deerling (4) Sawsbuck (4) Meloetta (2) Darmanitan (2) Basculin (2) Kyurem (3) Keldeo (2) Thundurus (2) Tornadus (2) Landorus (2) Vivillion (20) Flabebé (5) Floette (6) Florges (5) Pumkaboo (4) Gourgeist (4) Aegislash (2) Xerneas (2) Venusaur (2) Charizard (3) Blastoise (2) Alakazam (2) Gengar (2) Kangaskhan (2) Pinsir (2) Gyarados (2) Aerodactyl (2) Mewtwo (3) Ampharos (2) Scizor (2) Heracross (2) Houndoom (2) Tyranitar (2) Blaziken (2) Gardevoir (2) Mawile (2) Aggron (2) Medicham (2) Manectric (2) Banette (2) Absol (2) Latias (2) Latios (2) Garchomp (2) Lucario (2) Abomasnow (2) Pikachu (1) 5 unused bits --> (unused cosplay pikachu formes probably?) Cosplay Pikachu (1) Hoopa (2) Beedrill (2) Pidgeot (2) Slowbro (2) Steelix (2) Sceptile (2) Swampert (2) Sableye (2) Sharpedo (2) Camerupt (2) Altaria (2) Glalie (2) Salamence (2) Metagross (2) Rayquaza (2) Lopunny (2) Gallade (2) Audino (2) Diancie (2) Kyogre (2) Groudon (2) Arceus (18) Genesect (5) Furfrow (10) Pokémon Bank (application?) data This region is written every time Pokemon Bank saves. It is a copy of first 0x20 bytes of Pokemon Bank savefile (turtle). Maybe this is used to store information of the last application used with the game, but currently no other application that interacts with ORAS savegame writes this data (Pokémon ORAS Special Demo does not write to this region). Offset Description 0x00-0x04 Pokemon Bank unique ID? (seems linked to nnid) 0x05-0x08 Unknown (0x00) 0x09-0x0F Unknown, only present in turtle file (0x00 on game's savegame) 0x10-0x14 Bank usage counter backup (previous counter) 0x15-0x18 Bank usage counter 0x19-0x1F Pokemon Bank signature? (always 48CA0A0002000000)

The PX compression format, for a lack of better name, is a custom format used notably by the Pokémon Mystery Dungeon : Explorers of Time/Darkness/Sky games. Most of the files using this compression method are contained within either PKDPX or AT4PX containers. Overview of the Format The format itself is nothing wildly complex. It revolve around using what we'll call a command byte. The command byte is what will tell the decompressor what to do with the data that comes after it. The command byte can hold information for up to 8 "operations" to do on the data that follows. Each operation is represented as a bit. And each operation may use one or more byte(s) of data after the command byte. If the highest bit is 1, we copy the first following byte as-is. If its 0, we compare the value of the high nybble of the following byte to the list of control flags. And depending on which flag match, or if none match, we'll know what to do next. Note that, those control flags are always "0n" where "n" is an hexadecimal value from 0 to F. Also, note that, these flags are computed on a file by file basis! They're "tailor-made" for each individual file. We discuss this more in details in the other sections below. Decompression To make explaining things easier, you could imagine that the bytes we're decompressing come from a FIFO queue. And also imagine that we put the decompressed bytes into a Double Ended Queue or deque for short. (Even if in practice those are probably too inefficient to use in this case!) To decode the command byte, we simply look at the value of all of its 8 BITS, one at a time. From the highest bit to the lowest. So lets say we're in a loop that isolate the value of a particular bit each turn. Something like: uint8 mask = 0x80 loop while( mask > 0 ) { uint8 bitval = mask & cmdbyte //Bitwise AND if( ! inqueue.isempty() ) //Make sure our input data is not empty, because its not guaranteed we { // won't reach the end of file while handling a command byte! ... // Handle the cases written below } else { break; //If we reach the end of file, stop the loop! } mask = mask >> 1 //Bitshift right by 1 } On each turn of that loop, we'll take the value of the current bit, and depending on its state, we'll decide what to do based on these criteria: If the Bit is 1 If the BIT we've isolated from the command byte is 1, then we pop the next BYTE from the input queue, and push it as-is at the back of the output deque! If the Bit is 0 Otherwise if the BIT we've isolated is 0, we'll pop the next BYTE from the input queue. Then, we'll try to find whether the high nybble of the BYTE we just read is the same value as one of our control flags. We also want to keep the value of the low nybble for later. We'll refer to the high nybble and low nybble we got here as "nbhigh" and "nblow" respectively. We got 2 possible cases : If one of our control flag match the high nybble "nbhigh" of the BYTE we just read, then it means we're inserting a pattern of 4 nybbles or 2 bytes into the output deque. Go to Inserting Byte Pattern. We'll refer to the index of the control flag we got as "ctrlflagindex". If none of our control flags match the high nybble "nbhigh" of the BYTE we just read, it means we're copying a sequence of bytes from our decompressed output so far. Go to Copying a Sequence. Inserting Byte Pattern Then its either one of these: byte1 = nblow << 4 BitwiseOR nblow byte2 = byte1 //Then we just push those two bytes, and we're done! If the index of the control flag "ctrlflagindex" is the first one in the control flag table, at index 0, we calculate the value of the 2 bytes we'll push at the back of the output deque this way: Otherwise, for any other "ctrlflagindex" flag index, we have a few other cases to take into account. They all have in common using the value of "nblow". Got to Inserting a Special Byte Pattern. We'll add a new variable called "basenybbleval" to make things easier to understand. And we'll put the value of "nblow" into it right away. Inserting a Special Byte Pattern First depending on the control flag index, do one of the following : basenybbleval = basenybbleval + 1 basenybbleval = basenybbleval - 1 If "ctrlflagindex" is 1. We increment the value of all 4 nybbles. Or in our example, the value we use to store the base value of all nybble "basenybbleval". Otherwise, if "ctrlflagindex" is 5. We decrement the value of all 4 nybbles. Or in our case, the value we use to store the base value of all nybble "basenybbleval". From here, lets put the value of "basenybbleval" into 4 separate variables, each holding the value of the individual 4 nybbles. Lets just name them, "nybble0", "nybble1", "nybble2", "nybble3", and put the current value of "basenybbleval" into all of them. (You should use an array or something, as they're only named like this for clarity's sake) Then, depending on the control flag index, do one of the following : If "ctrlflagindex" is between 1 and 4 inclusively. Then substract 1 from the nybble corresponding to the value of (ctrlflagindex - 1). For example, if (ctrlflagindex - 1) is 0, we subtract 1 from "nybble0". If its 3, we subtract 1 from "nybble3", and so on! Otherwise, we add 1 to the nybble corresponding with the value of (ctrlflagindex - 5). If (ctrlflagindex - 5) is 0 we add one to "nybble0" and so on! Now, all that is left to do is to assemble the 4 nybbles into 2 bytes, and push those 2 bytes to the back of the output deque! byte1 = nybble0 << 4 BitwiseOR nybble1 byte2 = nybble2 << 4 BitwiseOR nybble3 We just push those two to the back of the output stack, and we're done ! Copying a Sequence To figure out the offset from the end of our output deque where we begin reading the bytes sequence to copy, we'll need to pop the next byte from the input queue and do the following operations: int16 offset = (((-0x1000) + nblow) << 8) BitwiseOR inqueue.pop() "offset" will contain a negative integer value smaller than the current size of the output queue. Just go from the end of the output deque towards the beginning of it, by the absolute value of "offset". This will get you the beginning position of the sequence of bytes to append to the output later on. We'll call this position "seqbeg". Then, to get the amount of bytes to copy starting from "seqbeg", we take the value of "nbhigh" and add 3. Knowing this, we can now copy the sequence and push it into the back of the output deque. After Handling the Bit After going through those conditions, we know that the next BYTE we pop from the input queue will be a new command byte guaranteed! (Unless we reached the end of the file) So we just have to repeat this loop using this new command byte! However, keep in mind that, there are no guaranty that there are enough bytes in the input to decompress for each bits in a command byte! So its important to check if we reached the end of file each times we handle a new bit from the command byte ! This sums it pretty much! Compression Compression is a bit trickier. The byte patterns and the copy as-is operations are fairly easy to implement, but the string search and managing the control flags gets a little complicated! The tool that compressed the data originally used a sliding window algorithm, or something you could call a lookback buffer. This window/buffer is the range within which the compressor will look for matching strings. That ranges starts from the position of the byte the algorithm is currently handling, to either the beginning of the data, or at most 4096 bytes towards the beginning of the data. For the format of PX compression used in PMD2's files, the buffer's/window's range seems the fixed at 4096 bytes. A smaller buffer/window could be used, but not a bigger one, because of the way the data is stored in compressed file. The shortest matching string possible is 3 bytes, and the longest is 18 bytes. A word of warning about matching strings. Keep in mind that since the high nybble of the data byte is used both to possibly match a control flag or to indicate the length of the sequence to copy, you have a limited amount of possible lengths. You have to reserve 9 values out of the 15 possible for the control flags. Or else some sequence lengths will trigger a 4 bytes pattern replacement instead of a sequence copy, and the resulting decompressed data will be incorrect. So the decompressor/compressor can only use sequences/strings that have a length that matches one of 7 different lengths.. This means, you have to pick the most optimal values to indicate the possible lengths of sequences to copy, and only then pick the control flags from the remaining values ! It is suggested to at least keep 0x0 and 0xF reserved as sequence lengths, as in several cases they appear to be the most used/flexible. But this is in no way a rule. The algorithm used in this discussion will be a 2 pass algorithm. The first one builds a list of operations, then based on the results, the control flags are determined. After that, the operations are all encoded, and inserted into a PKDPX or AT4PX container. This makes it much easier to determine how to optimally use the limited value range to use for lengths of sequences to copy. 1st Pass First, its important to find a good way of storing all the required info for each operations, and preserve the order to process them in! This could be a simple vector/deque of little structures such as this one: /********************************************************************************* compOp Stores an operation to insert into the output buffer. *********************************************************************************/ struct compOp { ePXOperation type; //The operation to do uint8_t highnybble, //The value of the compressed high nybble if applicable lownybble, //The value of the compressed low nybble nextbytevalue; //value of the compressed next byte if applicable void reset() { type = ePXOperation::COPY_ASIS; highnybble = 0; lownybble = 0; nextbytevalue = 0; } }; Where the types of operations are represented using an enum such as this one: /********************************************************************************* All the possible operations that can be done to compress data! Entries 0 to 8 correspond to their respective ctrl flag indexes! *********************************************************************************/ static enum struct ePXOperation : int8_t { COPY_ASIS =-1, COPY_NYBBLE_4TIMES = 0, COPY_NYBBLE_4TIMES_EX_INCRALL_DECRNYBBLE0 = 1, COPY_NYBBLE_4TIMES_EX_DECRNYBBLE1 = 2, COPY_NYBBLE_4TIMES_EX_DECRNYBBLE2 = 3, COPY_NYBBLE_4TIMES_EX_DECRNYBBLE3 = 4, COPY_NYBBLE_4TIMES_EX_DECRALL_INCRNYBBLE0 = 5, COPY_NYBBLE_4TIMES_EX_INCRNYBBLE1 = 6, COPY_NYBBLE_4TIMES_EX_INCRNYBBLE2 = 7, COPY_NYBBLE_4TIMES_EX_INCRNYBBLE3 = 8, COPY_SEQUENCE = 9, }; Then, for the first pass, we simply iterate over each bytes. We'll refer to the byte we're currently iterating on as "curbyte" To determine the optimal operation to use, attempt to find which one out of the 3 methods of compression is the best in this case : Try finding a matching string of at least 3 bytes, starting from "curbyte", within the lookback buffer / sliding window. And from those matches, try to find those that match more than 3 bytes, up to the maximum of 18. Keep the first longest you find. And keep in mind you can only have sequences matching one out of the 7 different lengths you have. So pick those lengths wisely! Try finding if the 2 bytes starting from "curbyte" could be compressed by doing the opposite of one of these methods: Copy low nybble 4 times, increment the 4 nybbles by 1, subtract 1 from nybble#0, and make 2 bytes with those. Copy low nybble 4 times, subtract 1 from nybble#1, and make 2 bytes with those. Copy low nybble 4 times, subtract 1 from nybble#2, and make 2 bytes with those. Copy low nybble 4 times, subtract 1 from nybble#3, and make 2 bytes with those. Copy low nybble 4 times, decrement the 4 nybbles by 1, add 1 to nybble#0, and make 2 bytes with those. Copy low nybble 4 times, add 1 to nybble#1, and make 2 bytes with those. Copy low nybble 4 times, add 1 to nybble#2, and make 2 bytes with those. Copy low nybble 4 times, add 1 to nybble#3, and make 2 bytes with those. Try finding if the 2 bytes starting from "curbyte" contain the exact same nybble repeated 4 times. If all 3 tests fails, you should "copy as-is" the current byte. Do this for the whole file, and once it has been completely processed, look at the sequence lengths you've used, and pick the remaining values between 0x0 to 0xF for your control flags. For example, if you're using as your possible sequence lengths: 0x0, 0xF, 0x2, 0x3, 0x5, 0x7, 0xA Your control flags would be: 0x1, 0x4, 0x6, 0x8, 0x9, 0xB, 0xC, 0xD, 0xE We'll keep those in an array we'll refer to as "ctrlflags". 2nd Pass For this part, you want to handle operations by batches of 8. Look at your 8 operations, and make a command byte from those, setting each bit to 0, unless its a "Copy as-is" operation. Then encode the operation into one or two bytes, depending on the operation type. Finally just write the command byte followed by the encoded bytes in order! Extra Examples To make understanding the command byte, think of it as an array of boolean, where each index matches another array containing small arrays of bytes. This example might make things clearer: 0xFD, 0x53, 0x49, 0x52, 0x30, 0x24, 0x38, 0xE0, 0x30 //In this byte sequence, 0xFD is the command byte! 1111 1101 //Here's 0xFD's value in binary //Here are what bytes in the sequence each bit in the command byte correspond to: [1]111 1101 corresponds to 0x53 1111 110[1] corresponds to 0x30 1111 [1]101 corresponds to 0x24 Here's how this whole sequence is decoded(debug output from ppmd_unpx.exe ): -> Command Byte 0xfd Bit is 1 : Copy 0x53 as is! Bit is 1 : Copy 0x49 as is! Bit is 1 : Copy 0x52 as is! Bit is 1 : Copy 0x30 as is! Bit is 1 : Copy 0x24 as is! Bit is 1 : Copy 0x38 as is! Bit is 0 : appending 2 bytes.. 0 0 Bit is 1 : Copy 0x30 as is! Which results in : 53 49 52 30 24 38 00 00 30 Now take this one, which comes right after the one above: 0x0F, 0x0F, 0xFC, 0xE0, 0xE0, 0x1F, 0xFC, 0xEC, 0x01, 0xF4, 0x88, Which is decoded as such(debug output from ppmd_unpx.exe ): -> Command Byte 0xf Bit is 0 : appending sequence.. (highnybble: 0x0, lownybble: 0xf, calculatedoffset: 0xfffc( decimal -4 ) ) 38 00 00 Bit is 0 : appending 2 bytes.. 0 0 Bit is 0 : appending 2 bytes.. 0 0 Bit is 0 : appending sequence.. (highnybble: 0x1, lownybble: 0xf, calculatedoffset: 0xfffc( decimal -4 ) ) 00 00 00 00 Bit is 1 : Copy 0xec as is! Bit is 1 : Copy 0x1 as is! Bit is 1 : Copy 0xf4 as is! Bit is 1 : Copy 0x88 as is! And results in this : 38 00 00 00 00 00 00 00 00 00 00 EC 01 F4 88 Credits A big thanks to Zhorkenwho coined many of the terms used here, and figured out the header and the compression format!

This page contains RAM addresses to various interesting and useful processes of GBA and DS Pokemon games. Breakpoints can be set at these addresses. Inspiration This page is inspired by tsanth's thread with the same name on GameFAQs: [1] Pokemon DPP (U) DP RAM Address Pl RAM Address Description Discovered by 02000C54 02000C88 Main() Bond697 020064F0 02006AA4 Load from NARC (r1=archive_id, r2=file_id) Alpha 02000FB0 02001034 Begin Seed Calculation Routine mingot, arcee 02005FDC 02006590 Load Overlay (r0=overlay_id) Alpha 0201B9E0 0201D2DC Set PRNG seed mingot, arcee 0201B9EC 0201D2E8 PRNG loadingNOW, tsanth 0201BA10 0201D30C Alternate RNG used in some cases: Examples, PID generation for mystery gift pokemon, recalculating a PID after a failed shiny check, number which determines swarm pokemon and great marsh pokemon SCV 0201BA1C 0201D318 Set IRNG Seed mingot, arcee 02038B70 0203E778 Script Handler loadingNOW 0203E7D2 Loads address for a command then branches to that address SCV 02042FB4 0204BAFC ARNG call for PID of Wondercard pokemon SCV, arcee 02042FBA 0204BB02 Loads PID from wondercard to r0 SCV, arcee 02042FC8 0204BB10 First Shiny Check call during the generation of some wondercard pokemon SCV, arcee 02042FD0 0204BB18 Beginning of loop that makes sure you do not get a shiny wondercard pokemon (in some cases) SCV, arcee 0204305E 0204BBA6 PRNG call for first set of Wondercard pokemon IVs tsanth, arcee 0204309C 0204BBE4 PRNG call for second set of Wondercard pokemon IVs tsanth, arcee 02050958 Run item routines Mikelan98 020535E8 Use of Journal item entrypoint Mikelan98 02068884 Use of Bicycle item entrypoint Mikelan98 0205EABC Load player's X coord to r0 Mikelan98 0205EAC8 Load player's Y coord to r0 Mikelan98 0205DED4 Create chain set (not sure about address in tsanth's thread it said 205DED tsanth, loadingNOW 0205DF42 End of Create chain set routine tsanth, loadingNOW 02069820 Determines the 4 grassy patches that will move in Pokeradar and determines whether they are in a tall grass tile or not Mikelan98 02069A00 Use of Pokeradar item entrypoint Mikelan98 0205E40C 02069B00 Pokeradar Routine loadingNOW, tsanth, arcee 02068AAC 02075E38 Shiny Check, used to decide what sprite to show for a pokemon and to make sure dynamic PID mystery gift pokemon are not shiny as well as preventing manaphy from hatching shiny in some cases. SCV, arcee 02075C86 128 step RNG advancement arcee 0207760E Poketch check @ daycare screen arcee 0206A90C 02078780 Begin Calculation of Pokemon ID for alternate forms. SCV, arcee 0207CF48 Use item and load item data Mikelan98 020EBC80 020E1F6C Division routine; R0= R0 / R1, R1=R0%R1 tsanth, SCV 020F355C 020EAC58 Pointer to Begin Routine for Script Command 0000 SCV 020EB974 Pointer to Begin Routine for Script Command 0347 SCV 020F0CCA Item data slots Mikelan98 021C4D48 021BFB14 PRNG State Kazo 021C4D4C 021BFB18 Mersenne Twister Lookup Table Kazo 021F4DA8 Beginning of Honey Tree Routine SCV 021F4EE4 Determines a value from 0-3 to use to determine which list will be used and how the shake value is calculated. If 0, slathering fails and not pokemon will show up. SCV 021F4F44 Determines a number from 0-5 that represents which pokemon will be encountered in a honey tree. SCV 021F4F98 Determines which list will be used by (value determined by 021F4EE4) - 1 (its not done this way, but is equivalent) SCV 021F4FAC Determines a number from 0-3 that represents how much a Honey Tree will shake SCV 021F5138 021EFF4C Returns 1 if the current tree being slathered is a Munchlax Tree and 0 otherwise. SCV 02211E60 Set GRNG seed magical 02211E70 GRNG magical 0223BA10 Movement Handler Start tsanth 0223BA46 "Am I on grass?" check tsanth 0223BAD4 Wild Encounter Check tsanth 0223BB2E Pair-battle (NPC partner) check tsanth 0223BD1C Movement Handler END tsanth 0223C1EE 022377A2 Pokeball catching routine tsanth, arcee 0223C5B8 Start of Encounter Table Lookup Handler mingot 0223C66A Start of Water (Sweet Scent/Surfing) Encounter Table Lookup Handler mingot 0223C6A0 Start of Water (Fishing) Encounter Table Lookup Handler. There are 3 branches for each of the rods in this routine with different results for old and good/super. mingot 022417F4 Encounter- terrain check arcee 02241848 Encounter- motion mod arcee 022479E6 Call to get ID routine (result in r0) SCV 0224E920 Start of Frozen Handler SCV 0224190A - ESV calc 02241B28 - nature calc (probably) Pokémon HGSS (U) RAM Address Description Discovered by 02000CA4 Main() Bond697 02007508 Load from NARC (r0=offset, r1=archive_id, r2=file_id) Alpha 0201FD44 PRNG advancement routine Bond697 0201FD68 Alternate(simpler) PRNG Bond697 0203FE24 Script Handler - Read parameter of command (parameter saved in r0) Mikelan98 0204036C Script Handler - Read RAM offset of variable in r1 (offset saved in r0) Mikelan98 020403A4 Script Handler - Read value of variable in r1 (value saved in r0) Mikelan98 0204BFF0 Wondercard pokemon generation- full routine Bond697 02050544 Run item routines Mikelan98 02061E2A NPC movement arcee 0206C9D8 International shiny PID generation Bond697 02070068 Shiny check Bond697 020D34B0 Make wondercard PID Bond697 020D3A38 Disable slow IRQ Bond697 020D3A4C Enable slow IRQ Bond697 020F2998 Signed divmod() ? 020F2BA4 Unsigned divmod() ? 020F6BC8 Map headers table (Wild, Tileset, X-coord, Y-coord, Matrix, Scripts, Level scripts, Texts, Music 1, Music 2, Events, Name, Name style, Weather, Camera, ?, Allowed actions) Mikelan98 02100182 Item data slots Mikelan98 0210F6CC Mersenne Twister lookup table counter Bond697 021D15A8 PRNG State Kazo 021D15AC Mersenne Twister lookup table Kazo 021E19DC Upper half of wondercard PID Bond697 022074A2 Overworld Sprite Control Table Alpha 022440A0 Pickup / Honey Gather handler magical 02246B24 Start of Water (Fishing) Encounter Table Lookup Handler [2] mingot 02246FCC Fishing decision arcee 02247228 Pokéball catching routine magical 022475F2 Partial encounter calc- movement modifier arcee 0224767A Partial encounter calc- ability/item modifier arcee 02247698 Encounter slots arcee 02247720 Start of Water (Sweet Scent/Surfing) Encounter Table Lookup Handler [3] mingot 022477C0 Headbutt tree encounter slots (Post-National Dex) magical 022483C4 Partial encounter calc- roamer modifier arcee 02108514 Starter species in RAM(in the decompressed arm9 @ 108514) Bond697 0226CC7C Type Effectiveness Table (overlay 0012) Alpha Pokémon BW (U) RAM Address Description Discovered by 01FF8000 ITCM start Bond697 01FF80F0 ARM9 IRQ Handler Bond697 02005124 main() function- infinite main/busy loop that runs the game starts at 02005166 Bond697 0200520C VBlank handler function Bond697 020056D0 Set up both main RNGs for use Bond697 020056EC PRNG advancement routine 1 Bond697 02005728 PRNG advancement routine 2 Bond697 0200852C Store sidtid as uint Bond697 0201778C IV creation routine Bond697 02017EF4 Shiny check routine Bond697 02018746 PID type decision Bond697 02018788 Shiny prevention routine Bond697 02019A6C PKM + RAM encryption Bond697 02035F50 Input handler Bond697 0203EFE0 memcmp()- memory compare: 2 pointers and length of comparison(in bytes)) Bond697 0203F04C Set init MT seed (seed = init rng >> 32) Bond697 0203F078 ARNG(same as gen 4)- build initial MT seed table Bond697 0203F0C0 Mersenne Twister seed table handler Bond697 0203F270 Initial Seed Creation Routine OmegaDonut 0203F374 .sav encryption Bond697 020592E8 MD5 hashing routine for wifi Bond697 0207FD4C VRAM bank control handler Bond697 02082BE4 Takes 3 arguments: pointer to start of data write, length(in bytes) of data to write, uint to write multiple times- used constantly for clearing freed memory Bond697 02082D5C memcpy32()- accepts pointer to data start, pointer to copy start, and a length in bytes to copy Bond697 02085D54 DSi Detection Routine chiizu 02088A98 Date/time switch statement- used to grab pieces of the date and time and convert them to hex Bond697 02088E74 Convert BCD->hex, for RTC Bond697 020946AC Metrowerks ARM-provided lib rand- used for DS-to-DS handshake XFR,Bond697 0209C0C4 Signed divmod- r0/r1, result in r0; r0%r1, result in r1 Bond697 0209C2C8 Unsigned divmod- r0/r1, result in r0; r0%r1, result in r1 Bond697 020A1B50 Model/texture definitions/positioning data Bond697 020AA1C4 RNG state pointer Bond697 02146292 Pokemon to be encountered Bond697 02146974 Pointer to the struct for the current heap being used Bond697 02146A18 Mersenne Twister seed table pointer Bond697 02146A2C u32 date_time[8] (in hex) Bond697 02150920 SVC mode stack location for card reads/writes Bond697 02151260 SWI/SVC mode stack Bond697 02168844 rand(0xFFFFFFFF) / 0xFFFF Bond697 02168A52 ID generation for Battle Subway partner Bond697 021763DC Inside probability loop Bond697 021763F8 Probability routine- influences starting frame/seed Bond697 02176444 Outside probability loop Bond697 02176C6C Probability table Bond697 02193914 White Forest Trainer # Counter- returns # of trainers in White Forest Bond697 021A9370 Pre-battle setup(battle test, etc) Bond697 021A948C Double battle test Bond697 021A9DB2 0x80000000 OR PID decision routine Bond697 021A9DE8 ((rand() * 0xFFFF) >> 32) /0x290 -> function is called quite a bit for multiple calcs Bond697 021A9DF8 Fishing decision arcee 021AA41C Battle test/decision Bond697 021AA43A Battle test Bond697 021AA44C White Forest Battle Decision Routine- return 0 if no battle, 1 if there's a battle Bond697 021AA700 ((rand() * 0xFFFF) >> 32) /0x290 -> seems to only be used for battle tests Bond697 021BC4F8 Player setup on new game Bond697 021BC50A Make IDs Bond697 021C0A6C Battle routine(setup) Bond697 021C390C Complete breeding routine Bond697 021C4048 International breeding PID generation Bond697 021C6C18 Damage formula routine Bond697 021F6388 Battle PRNG State Kaphotics 02215374 Mersenne Twister Lookup Table Bond697 02215D34 Mersenne Twister Lookup Table Counter Bond697 02216244 PRNG State Bond697 0221BBD0 Start of save data in RAM(when saving, all relevant data is written here, then cart RAM, then .sav) Bond697 022394E0 Date/time in hex - uint array Bond697 0223C9D0 Daycare pokemon 1 Bond697 0223CAB4 Daycare pokemon 2 Bond697 0223D8CC BP Counter Bond697 0224120C Wifi RNG Bond697 02250030 Encounter slots in RAM Bond697 02257030 Step Counter Bond697 02257034 Shaking Patch Step Counter Bond697 0226DC5A Move Consecutive Use Counter (Wild Battle) Kaphotics 0226DC66 Protect Consecutive Turn Counter (Wild Battle) Kaphotics 0226E70E Move Consecutive Use Counter (Trainer Battle) Kaphotics 0226E71A Protect Consecutive Turn Counter (Trainer Battle) Kaphotics 02274302 Move Decision Dump (Wild Battle) Kaphotics 022BC734 Are there trainers in White Forest? (bool) Bond697 0233F004 Egg step counter ToastPlusOne 02FE0000 DTCM start Bond697 02FE0020 Interrupt handler lookup table Bond697 02FE3780 Main(user/system mode) stack start Bond697 02FE3F80 IRQ mode stack start Bond697 02FE3FC0 Supervisor mode stack start Bond697 02FFFC3C Vertical blank counter buffer OmegaDonut 02FFFDE8 RTC buffer(char rtc[8]) OmegaDonut 037FBCEC ARM7 IRQ Handler Bond697 02017638 Pokemon creation routine(makePKM) Bond697 02019AB8 PKM checksum generation Bond697 02019C54 PKM block shuffling Bond697 0203F3A0 Encrypt SAV, battle video, mystery gift Bond697, Codr, XFR 02150E6C Graphics bank assignment struct Bond697 0214EA70 Sound archive info struct Bond697 02006984 Play PKM cry- in battle and otherwise Bond697 02011298 Script handler Bond697 0224FED4 Expanded heap memory allocation struct Bond697 02169024 Runs everything that has to happen after midnight Bond697 0200D440 Swarm calculation and storage Bond697 02151350 Tick system Bond697 0272E9E8 DSi library overlay Bond697 021E6184 Moonlight modifier picker Bond697 Pokémon BW (J) RAM Address Description Discovered by 02005124 Main() Bond697 022151D4 Mersenne Twister Lookup Table OmegaDonut 02215B94 Mersenne Twister Lookup Table Counter Kaphotics 022160A8 PRNG State Kazo 02FFFC3C Delay OmegaDonut 02FFFDE8 Date OmegaDonut (All offsets are White offsets. Black offsets are White offset minus 0x20) Pokémon Emerald (J) RAM Address Description Discovered by 02024664 Frame Counter Kaphotics 03005AE0 PRNG State Kaphotics 08000248 IRQ setup Bond697 080003A4 Main loop Bond697 080005E4 Keypress handler Bond697 08000758 VBlank interrupt Bond697 0806F050 PRNG Advancement Routine Kaphotics 080B413A Feebas setup routine on finding a Feebas tile Bond697 08295E87 Signed division magical 08296518 Modulus routine- r0 % r1, return result in r0 Bond697 08297D6C memset magical Pokémon Emerald (U) RAM Address Description Discovered by 02020000 Timer1 storage on TID creation Bond697 020249C0 Main RNG Frame counter mingot 03000DC0 RTC array buffer(char rtc[8]) Bond697 03000E20 Directional movement counters(possibly per frame) Bond697 030022E0 Timer PRNG Initial State (Egg PIDs) Kaphotics 03002750 IRQ Handler (user mode) Bond697 03005D80 PRNG State mingot 03005D84 Timer RNG Current Seed (Egg PIDs) Kaphotics 08000248 IRQ setup Bond697 080003A4 Main loop Bond697 080005E4 Keypress handler Bond697 08000738 VBlank interrupt callback Bond697 08000988 Memblock header setup Bond697 08000B1C Malloc init Bond697 08000B38 Declare memblock(malloc()?) Bond697 080B49E2 Feebas setup routine on finding a Feebas tile Bond697 080B4AC8 Encounter Slot Bond697 080B4C74 Set level Bond697 080B4E2A Sync (bool) Bond697 080B4E4C Nature Setup/Decision (skip "if(sync())") Bond697 080B5144 Battle Test Bond697 08067BF8 Roamer creation start Bond697 08067E96 PKM Building Routine (test temp PIDs, make IVs on success) Bond697 0806D088 Get nature from tempPID(pass tempPID as an arg, return nature value) Bond697 0806F5CC PRNG Advancement Routine mingot 0817759E ARNG Bond697 082E7BE0 Modulus routine- r0 % r1, return result in r0 Bond697 082E7B68 Division routine- r0 / r1, return result in r0 Bond697 082E7540 Division routine- r0 / r1, return result in r0 Bond697 08070AC4 Make bred pokemon Bond697 080701E0 Make bred PID Bond697 020241F0 Damage storage- base dmg, etc Bond697 08070266 Inheritance- bugged to not prevent inheriting the same IV multiple times Bond697 08070218 Inheritance check- make sure the same IV isn't inherited multiple times- bugged due to the wrong argument being passed to it Bond697 0806AD9C Set PKM data field Bond697 0806A674 Read PKM data field Bond697 0806A518 Get PKM data field Bond697 0806ACAC Write PKM data field Bond697 0806DCB4 Pokerus handler Bond697 0806DEC4 Pokerus spread Bond697 03004134 IME store Bond697 Pokémon Ruby / Sapphire (U) RAM Address Description Discovered by 02024D1C Quick Claw Determination FractalFusion 020287E4 Egg Creation Step Counter Kaphotics 03004818 PRNG State Multiple 03000460 RTC Bond697 0800024C Main loop Bond697 080003E4 Initial seed creation Bond697 08000428 Keypress handler Bond697 0803AADC PID creation routine Bond697 08040048 Pokerus handler Bond697 08040EA4 Seed set routine, post creation Bond697 08040E84 rand() Bond697 08084AA6 Feebas decision Bond697 081E0770 Interrupts/SWIs Bond697 080421B0 Make bred PKM Bond697 080418F0 Build bred PID Bond697 081E0E20 Division r0/r1, result in r0 Bond697 081E0E98 Modulus r0%r1, result in r0 Bond697 08041960 Inheritance check- insure no duplicate IVs Bond697 Pokémon FireRed / LeafGreen (U) RAM Address Description Discovered by 02020000 Timer1 storage on initial seed creation flovv, Bond697 03005000 PRNG State Bond697 08000558 Turn on Timer1 @ TM1CNT_H = 0x80 Bond697 08000564 Grab and return the value of Timer1 for use in seeding Bond697 08000570 Turn off Timer1 @ TM1CNT_H = 0x0 and store the grabbed value to 0x02020000 Bond697 0803DA54 Make PKM Bond697 08044EC8 PRNG Advancement Routine Bond697 02023D50 Damage store Bond697 Pokémon Ruby Debug Version (G) RAM Address Description Discovered by 02024F54 P1 successive Protects 030043D3 Turns in battle 030046F0 CPU Active Sleep counter 030048F8 PRNG state Bond697 08045324 PRNG Advancement Routine(rand()) Bond697 08085CEC ARNG Advancement Routine Bond697 08220E5E Protect success rates Pokémon B2W2 (J) RAM Address Description Discovered by 02005124 TwlMain Bond697 02005748 RNG advancement routine 1 Bond697 02005784 RNG advancement routine 2 Bond697 020158E8 Script handler Bond697 02043BE8 Mersenne Twister setup Bond697 02043C38 Mersenne Twister handler Bond697 02043DA4 Seed building function Bond697 021A0E30 Create wild PID Bond697 021FE6E8 Mersenne Twister table Bond697 0276FA88 DSi Mersenne Twister table Bond697 021FF0A8 Mersenne Twister table counter Bond697 021FF5D8 RNG state Bond697 02770978 DSi RNG state Bond697 021707DC Probability table Bond697 0216FCE0 Probability loop Bond697 0216FCFC Inside probability loop Bond697 0223B188 Encounter slots in RAM Bond697 021DD22C Battle RNG state Bond697 0221D3A4 Item slots in RAM Bond697 022268D1 Repel counter Bond697 022260A4 Cash Bond697 022229A4 Total steps Bond697 0223AEB4 Current game(loaded save) step counter Bond697 0208D574 Unsigned divmod Bond697 0208D368 Signed divmod Bond697 0209D46C RNG pointer Bond697 021A0E9A 0x80000000 PID-OR decision Bond697 021A1994 Shaking patch generation Bond697 0219FAE4 Hardcoded trainer name length Bond697 0219CB1C Hardcoded wild pokemon name length Bond697 021D9DEC Data entry setup Bond697 021BF190 Hardcoded starter pokemon name length Bond697 02249BD0 Script info struct Bond697 020825B8 Abort on bad allocation Bond697 021BDA68 Breeding- normal/Shiny Charm/Masuda Method Bond697 021412C0 Mersenne Twister table pointer Bond697 02153100 Scripting system- memory allocation/setup Bond697 022581F4 Wild pokemon PID storage Bond697 02181E80 Hollow pokemon generation Bond697 02228B70 Hollow pokemon data array(u16 hollow[20]) Bond697 0200F84C Is hollow filled Bond697 021C8938 Hollow fill decisions Bond697 0214BE7C SVC stack Bond697 0200F8B4 Get hollow Bond697 0200F8BC Set hollow Bond697 02228B98 Current hollow number Bond697 0221DDAC Slot 1 PID Bond697 0221DE88 Slot 2 PID Bond697 0221DF64 Slot 3 PID Bond697 0221E040 Slot 4 PID Bond697 0221E11C Slot 5 PID Bond697 0221E1F8 Slot 6 PID Bond697 0207A998 DSi check Bond697 0214DC24 Mic status Bond697 0200F898 Set hollow gender Bond697 0200F830 Enable hollow Bond697 0200F818 Set subslot Bond697 0200F800 Set slot Bond697 0205780C Build seed - wifi Bond697 02241970 Wifi RNG state Bond697 021BCAC0 Battle rand Bond697 021A5318 Damage formula Bond697 021BCC58 Base damage Bond697 021BCC80 Damage type modifier Bond697 02005234 Vblank calback Bond697 0201C4E0 PKM creation Bond697 0201CDC0 Shiny check Bond697 0201D6E0 PID creation Bond697 0203D988 Input handler Bond697 021BD21C Breeding Bond697 02156410 Create scripted pokemon Bond697 02140B1E Current special pokemon being created Bond697 0201D644 Special PID creation Bond697 02026858 HM check Bond697 0223B3E4 Expanded heap memory allocation struct Bond697 02141324 G3D info struct Bond697 0214340C G3D global state Bond697 022263A4 Pokedex data in RAM Bond697 02162A14 Runs everything that has to happen after midnight Bond697 0200DD20 Swarm calculation and storage Bond697 02141440 VRAM transfer task array Bond697 0214BF70 Tick System Bond697 02258454 Decrypted battle video allocation Bond697 (All offsets are White offsets.) Pokémon B2W2 (U) RAM Address Description Discovered by 02005124 TwlMain Bond697 02005748 RNG advancement routine 1 Bond697 02005784 RNG advancement routine 2 Bond697 0201592C Script handler Bond697 020191D8 Read event flag Bond697 02019204 Update event flag Bond697 0201922C Set event flag Bond697 0201D688 Create special PID (N's pokemon, etc) Bond697 0201D724 Create wild PID Bond697 02026B44 Check for a hidden machine move Bond697 02043F08 Mersenne Twister setup Bond697 02043F58 Mersenne Twister handler Bond697 020440C4 Seed building function Bond697 0209DAC0 Current music Bond697 0214185C Game Freak's memory allocator Bond697 0214C5B0 Tick system Bond697 02153748 Scripting system- virtual machine pointer list and count Bond697 02153978 execute script Bond697 021A2428 EV handler Bond697 021BDA74 Breeding Bond697 021DD88C Battle RNG state Bond697 021FED68 Mersenne Twister table Bond697 021FF728 Mersenne Twister table counter Bond697 021FFC58 RNG state Bond697 02205244 Save data info Bond697 0220528C Save data block list (12 bytes per block: blknum, size, start) Bond697 02205624 Save data in RAM Bond697 02223024 Total steps Bond697 02225882 Const data storage in RAM Bond697 02225524 Event flag storage in RAM Bond697 02226328 Daycare poke 1 Bond697 0222640C Daycare poke 2 Bond697 022264F0 Egg seed Bond697 02226724 Money Bond697 022291F0 Hollow pokemon data array Bond697 0223B534 Current game step counter Bond697 02FE35C8 Egg data local array in RAM(u32 eggData[34]) Bond697 021FFB00 Overlays currently loaded list, 1 list each for EWRAM, ITCM, and DTCM Bond697 0203CED0 Overlay inspector Bond697 0203CE38 Overlay loader Bond697 021D01C0 N's pokemon Bond697 021D0230 Swarm pokemon Bond697 021D0190 Encounter slots Bond697 021D014C Item percentages Bond697 021D0B6C Move tutor Bond697 021D0310 Dust cloud rewards Bond697 021D0420 Field effect lookup Bond697 021C9F90 Fog table Bond697 021C9F34 Edge color table Bond697 021D21B0 Incense breeding lookup Bond697 0208F18C Save block action lookup Bond697 0208F948 Form lookup (u16 pkmFormSet[21][2]) Bond697 0208FA58 Key system keys Bond697 02090394 Rotom special moves Bond697 020903A0 Lookup table for adjusting stats for nature (u8 stat_nature_adjust[25][5]) Bond697 020904A0 Lookup table for pkm block shuffling (u8 pkm_blk_shuf[32][4]) Bond697 02091C42 State list Bond697 02091B58 Sweden county list Bond697 02090CB0 TM List(tm1-92, hm1-6, tm93-95) Bond697 02090B78 Berries Bond697 021BD100 Battle rand Bond697 021A5958 Damage formula Bond697 02141914 Main rtc date - year, month, day, week Bond697 02141924 Main rtc time - hour, minute, second Bond697 020492E8 Get resource and resource type: bva, bma, bca, btp, bmd, btx Bond697 020493B0 Load 3d gfx from narc(from already loaded narc) Bond697 02049370 Load 3d gfx from file(load narc then file from narc) Bond697 020493F0 Load 3d gfx from file path(from path to narc) Bond697 0223B484 Map number Bond697 0223B48A X pos Bond697 0223B48E Z pos Bond697 0223B492 Y pos Bond697 0223B49D Direction facing Bond697 02246830 Area data(zonedata) Bond697 0209DAA4 VRAM transfer manager counter for successful transfer Bond697 021D7540 Type-effectiveness chart(0- no effect, 2- .5x dmg, 4- 1x dmg, 8- 2x dmg) Bond697 021BD1A0 Determine type effectiveness for the current attack Bond697 020308EC Set up opposing trainers and their pokes for battle Bond697 0209D780 Start of .sbss Bond697 0214F540 End of .sbss Bond697 Pokémon X / Y (U) RAM Address Description Location Discovered by 00119C4C Mersenne Twister generate unsigned int ExeFS Bond697 0011E52C Seeding function for TinyMT ExeFS Bond697 0011E550 Generate seed for RNG ExeFS Bond697 0011E5C8 Seeding function for Mersenne Twister ExeFS Bond697 0015E958 Unsigned 32-bit divmod ExeFS magical 00163CC4 TinyMT PRNG ExeFS magical 00168660 Decrypt pokemon ExeFS Bond697 001685F0 Encrypt pokemon ExeFS Bond697 0016B358 Get pkm block 0 pointer after shuffle ExeFS Bond697 0016B3D4 Get pkm block 1 pointer after shuffle ExeFS Bond697 00176168 Get pkm block 2 pointer after shuffle ExeFS Bond697 001761E8 Get pkm block 3 pointer after shuffle ExeFS Bond697 0018FB50 powf ExeFS magical 002C67A0 LCRNG, generate random unsigned int ExeFS Bond697 003C71D8 Do pickup and honey gather ExeFS magical 004455A8 Pickup item table ExeFS magical 0002EFC0 Capture routine DllBattle.cro magical 000D12A8 Type effectiveness table DllBattle.cro Bond697 (All offsets are X offsets.) (CRO locations are offset, not address.) Pokémon Omega Ruby / Alpha Sapphire (U) RAM Address Description Location Discovered by 00168EC0 Decrypt pokemon ExeFS Bond697 00168E50 Encrypt pokemon ExeFS Bond697 0016BC84 Get block 0 pointer after shuffle ExeFS Bond697 0016BD00 Get block 1 pointer after shuffle ExeFS Bond697 00176EFC Get block 2 pointer after shuffle ExeFS Bond697 0016BD80 Get block 3 pointer after shuffle ExeFS Bond697 004872FC Pickup item table ExeFS Kaphotics 004960F8 Move Tutor List ExeFS Kaphotics 004A67EE TM/HM Move List ExeFS Kaphotics 000DB428 Type effectiveness table DllBattle.cro Bond697 (All offsets are Omega Ruby offsets.) (CRO locations are offset, not address.)

The "/FONT/kaomado.kao" file contains character portraits for the Pokémon Mystery Dungeon: Explorers games. It consists of a table of content, also used to look-up portraits available to each characters, and a data section filed with the actual portraits. By default it contains enough ToC entries for 1,154 pokemon. Out of those, only 652 are in use, and many are placeholders containing duplicate data. File Structure Overview Offset Length Endianness Type Name Description 0x00 160 Null Entry The first entry in the table of content is entirely filled with zeros. 0xA0 ToC End Offset - 160 Table of Content The table of content goes from here, to the offset of the first valid pointer in the ToC. More details below in the Table of Content section. After ToC Varies Portraits Data This is where all the portrait data is stored one after the other. More details in the Portraits Data section below. Table of Content Each block of 160 bytes represent all possible portrait slots for a single pokemon. There are 40 potraits slots per pokemon, however not a single pokemon uses its 40 slots. Each of these slots are 32 bits signed integers containing the offset of the portrait data it refers to. Most of those slots are filled with a null value. The null value is particular in that, its not just 0. Its actually calculated by taking the end offset of the data pointed to by the last valid pointer we've encountered starting from offset 0, and then changing the sign of the end offset to negative. For example, if our last valid pointer's value is 0x030058, and the end offset of the data pointed to by that pointer is 0x03034C. Then the value for any subsequent null entries, until the next non-null one would be: -( 0x0003034C ) => 0xFFFCFCB4 Anatomy of a single ToC entry. (Total size 160 bytes) Offset Length Endianness Type Name Description 0x0 4 little int32 Portrait Pointer 0 The Table of Content is made up of 40 pointers such as this one. Their value is signed! ... Rest of the pointers here ... 0x9C 4 little int32 Portrait Pointer 39 This is the last entry for this pokemon's block ! Portraits Data Each portraits is made up of 2 things. A 16 color palette, followed immediately by a AT4PX compressed container containing the actual image data for the portrait. The portraits do not carry any information about their formats. However, we do know that they're all 4 bits per pixels indexed images, and have a resolution of 40 x 40 pixels. The images are also tiled, which means they're made up of smaller "images" called tiles. Each tile is 8 x 8 pixels itself. Each tiles are filled linearly with the pixels contained in the decompressed file. The portraits are made of 5 tiles on their width, and 5 on their height for a total of 25 tiles. Anatomy of a single portrait block Offset Length Endianness Type Name Description 0x00 48 - - Color Palette The first part of a portrait block is a 16 colors RGB 24 bits palette, stored on 3 bytes per color. The first color is transparent. 0x30 Varies - - Compressed Image This contains the actual image data for the portrait. Its a compressed AT4PX container that contains the raw pixels of the image. The image itself, once decompressed, is stored as an indexed 4 bits per pixels, 40x40, tiled image. Once decompressed each images has a length of 800 bytes. More Details So far, it seems that some of those 40 slots for portraits are re-used between pokemon. For example, slot 0 is the "standard" default image shown when a pokemon talk, or the image that appears in Chimecho's assembly for a pokemon specie. It seems that odd numbered slots are a relic from Pokémon Mystery Dungeon : Blue Rescue Team. They contain mirrored portraits for some characters. However, the PMD:Explorers games all support mirroring the portraits at runtime. And so, it appears that most pokemon never use odd numbered slots. Even numbered slots on the other hand contain the portraits of the pokemon facing right. List of what each slots/pointers in a single pokemon's block are for. slot# Name Description 0 Standard Default pokemon portrait (Blue-Green BG) 1 - - 2 Grin Smiling pokemon portrait (Yellow-Orange BG) 3 - - 4 Pained Pained/Discouraged pokemon portrait (Blue-LightBlue BG) 5 - - 6 Angry Angry pokemon portrait (Read-Pink with sharp white line BG) 7 - - 8 Worried Worried pokemon portrait (blue-lightblue BG) 9 - - 10 Sad Sad/Disapointed pokemon portrait (blue-lightblue BG) 11 - - 12 Crying Crying pokemon portrait (blue-lightblue BG) 13 - - 14 Shouting Shouting pokemon portrait (Blue with light yellow "sunrays" BG) 15 - - 16 Teary Eye Teary eyed pokemon portrait (Light pink-darker pink BG) 17 - - 18 Determined Determined pokemon portrait (pink-red pink BG) 19 - - 20 Joyous Joyous/Very Happy/Ecstatic pokemon portrait (light yellow-yellow BG) 21 - - 22 Inspired Inspired/Admirative/Amazed pokemon portrait (light yellow-yellow BG) 23 - - 24 Surprised Surprised/Shocked pokemon portrait (blue-light blue BG) 25 - - 26 Dizzy Dizzy/(Spiral-Eyed) pokemon portrait (green to yellowish green BG) 27 - - 28 - - 29 - - 30 - - 31 - - 32 Sigh Sigh/Embarassed/Relieved pokemon portrait (light yellow to yellow BG) 33 - - 34 Stunned Stunned/Disheartened/Unnerved pokemon portrait (dark blue to light blue BG) 35 - - 36 - Wigglytuff YOM-TAH ! 37 - - 38 - - 39 - - Credits A big thanks to Zhorken, who figured out the compression format, the emotion name corresponding to each slots, and to what Pokémon each blocks of 160 bytes in the ToC was associated to!

Pack files are container containing a large amount of sub-files. They're fairly similar to the .sbin files found in Blue Rescue Team, except there are no filenames stored in the table of content(ToC). They usually share the ".bin" file extension with many other formats. The kind of files it contains can be pretty much anything. List of Known Pack Files Since all pack files end up the very common ".bin" file extension, it becomes hard to find which files are pack files, and which aren't. To help with this, here is a list of all the known files ending with a ".bin" file extension that happen to be pack files ! "/DUNGEON/dungeon.bin" "/EFFECT/effect.bin" "/MONSTER/m_attack.bin" "/MONSTER/m_ground.bin" "/MONSTER/monster.bin" "/BALANCE/m_level.bin" Those 6 files have been proven to be pack files. File Structure Overview A global overview of all the parts that make up a pack file. Offset Length Endianness Type Name Description 0x00 4 Null 4 bytes of zeros. 0x04 4 little uint32 NbFiles The number of sub-files / valid ToC entries. 0x08 ( NbFiles * 8 ) + 1 Table of Content This contains the offset of each sub-files, along with its length. After ToC Varies ToC Padding 0xFF bytes used as padding to align the sub-files data on 16 bytes. It should be noted that for some files there will be more padding bytes to align the beginning offset of the first sub-file to a precise address. More details in the Special Cases section! After ToC Padding Varies Sub-Files Data This block contains all the sub-files' data. Table of Content The Table of Content is fairly simple. It consists of a bunch of 8 bytes entries one after the other. Offset Length Endianness Type Name Description 0x00 8 ToC Entry 0 A single ToC entry. .. Rest of the ToC entries here .. Last ToC Slot 8 Last ToC Entry The last entry in the table of content is null, and filled with 8 bytes of zeros. ToC Entry A single entry in the table of content. Its made up of 2, 4 bytes integers. The first is a pointer to the offset of the sub-file data, the second is the length of the sub-file's data. Offset Length Endianness Type Name Description 0x00 4 little uint32 Pointer to Sub-File This value contains the offset of the sub-file within the Sub-Files Data block. 0x04 4 little uint32 Length of Sub-File This value contains the length in bytes of the sub-file pointed to by the "Pointer to Sub-File". Sub-Files Data This is where all the sub-files' data is piled one after the other, separated with padding when needed. Offset Length Endianness Type Name Description 0x00 Sub-File Length Sub-File Data The data for the sub-file. After Sub-File Data varies Sub-File Padding Some 0xFF bytes to align the next sub-file on 16 bytes. Special Cases The 3 pack files in the "/MONSTER/" folder are special. unlike the other pack files, the 3 of them must have their first sub-file stored at the very same address, 0x1300. A lot of padding is added after the ToC in all 3 files just to meet that requirement. If a single one of them isn't at the same address, the game will either black screen, or no sprites will be loaded, and the game will eventually freeze or crash.

The "/BALANCE/waza_p.bin" file and the "/BALANCE/waza_p2.bin" files contains both the data for every moves in the game, and the movesets for every Pokemon in the game. Its a SIR0 wrapped format. The "waza_p2.bin" file is found only in Explorers of Sky, and its purpose remains unknown. It contains mainly a perfect copy of all the move data in waza_p.bin. Only some Pokemon movesets differs between both files. Erasing the waza_p2.bin file from the game's files causes no immediate issues, as the game seems to use exclusively data from the waza_p.bin file inside and outside dungeons. The file is referred to in a string within the arm9.bin binary. Thus, it must be used eventually by the game in some way. "waza" is the Romaji equivalent of "わざ", which means technique/art.[1] File Structure Overview The format is pretty straightforward. Its made up of 3 major parts. The moveset data, the move data, and a table of pointers to regroup and access individual Pokemon moveset data. Offset Length Name Description 0x00 16 SIR0 Header A SIR0 header wrapping the item data. 0x10 varies Movesets Data A block containing the moveset data for most Pokemon. After Movesets Data 0-15 Padding Bytes Some 0xAA padding bytes to align the next block on 16 bytes. After Padding Bytes varies Moves Data A block containing the data for all moves in the game. After Moves Data 0-15 Padding Bytes Some 0xAA padding bytes to align the next section on 16 bytes. After Padding Bytes varies Moveset Data Pointers Table A table containing pointers stored in groups of 3 for every Pokemon's moveset stored in there. After Moveset Data Pointers Table 0-15 Padding Bytes Some 0xAA padding bytes to align the next section on 16 bytes. After Padding Bytes 8 Waza Header Two pointers, one to the Moves Data, the other to the Moveset Data Pointers Table. After Waza Header 0-15 Padding Bytes Some 0xAA padding bytes to align the next section on 16 bytes. After Padding Bytes 3 SIR0 Pointer Offset List A list of encoded offsets to the pointers in the file. Since there are only the 2 pointers of the SIR0 header, those three bytes are always 0x04, 0x04, 0x00. After SIR0 Pointer Offset List 13 Padding Bytes Since all entries have a fixed size, and the SIR0 Pointer Offset List is 3 bytes long, 13 0xAA bytes are used as padding to align the end of the file on 16 bytes. Waza Header Not really a header in the traditional sense, but more like the entry point to the data the file contains. Its made of two 4 bytes pointers, one to the beginning of the Moves Data block, and the other to the beginning of the Moveset Data Pointers Table. Waza Header (Total length 8 bytes) Offset Length Type Name Description 0x0 4 uint32 PtrMoveDataBlock Points to the beginning of the Moves Data block. 0x4 4 uint32 PtrPtrTable Points to the beginning of the Moveset Data Pointers Table. Moves Data This block is very simple. Its made up of 26 bytes entries containing data for all the moves used in the game. The first entry is always a dummy move. The order the moves appears in this block is the same order as the move names strings are stored inside the text*.strfile. The same goes for the moves' description strings. Move Data Entry (Total length 26 bytes) Offset Length Type Name Description 0x00 2 uint16 Base Power The base power of the move. 0x02 1 uint8 Type The type of the move. See the types list below, for the possible values. 0x03 1 uint8 Category What kind of move is it. 0x0 is Physical 0x1 is Special 0x2 is Status move 0x04 2 uint16 Bitfield#1 A bit field not fully understood yet. It does however changes what enemies are hit at close range. See Bitfield 1 for more details. 0x06 2 uint16 Bitfield#2 Another bit field that's not fully understood yet. This one seems to alter long-range attack. See Bitfield 2 for more details. 0x08 1 uint8 Base PPs The base amount of PP for the move. 0x09 1 uint8 Unk#6 Unknown. 0x0A 1 uint8 Unk#7 Unknown. 0x0B 1 uint8 Move Accuracy The percentage indicating the chances the move will succeed. 100 is perfect accuracy. Anything higher than 100 is a never-miss move. 0x0C 1 uint8 Unk#9 Unknown. 0x0D 1 uint8 Unk#10 Unknown. 0x0E 1 uint8 Unk#11 Unknown. 0x0F 1 uint8 Unk#12 Unknown. Possibly related to critical hits calculation? 0x10 1 uint8 Unk#13 Unknown. 0x11 1 uint8 Unk#14 Unknown. 0x12 1 uint8 Unk#15 Unknown. 0x13 1 uint8 Unk#16 Unknown. 0x14 1 uint8 Unk#17 Unknown. 0x15 1 uint8 Unk#18 Unknown. Possible bitfield. 0x16 2 uint16 Move ID The move's ID, possibly used by the game code for allocating resources and etc.. 0x18 1 uint8 Unk#19 Unknown. Types List Value Type 0x00 None 0x01 Normal 0x02 Fire 0x03 Water 0x04 Grass 0x05 Electric 0x06 Ice 0x07 Fighting 0x08 Poison 0x09 Ground 0x0A Flying 0x0B Psychic 0x0C Bug 0x0D Rock 0x0E Ghost 0x0F Dragon 0x10 Dark 0x11 Steel 0x12 Neutral Bitfield 1[edit] Not much is known about this field, except that setting some of its bits to 1 changes the way moves target entities. 0001 0000 (16)= Hit everything next to the user on 180 degrees forward 0010 0000(32) = Hit everything next to the user on 360 degrees 0011 0000(48) = Hit everything in the same room 0111 0011(115)= Hit user Bitfield 2 Not much either is known about this field. Changing some of its bits seems to alter ranged moves. 0101 0000(80) makes the move a long range straight line attack Moveset Data Pointers Table A table made of a series of groups of 3 pointers. Each groups of 3 pointers is assigned to a Pokemon that has the same index in monster.md as the group of pointer. Moveset Pointers Group (Total length 12 bytes) Offset Length Type Name Description 0x0 4 uint32 PtrLvlUpLst Points to this Pokemon's level-up moves list. Only null for the first dummy Pokemon. 0x4 4 uint32 PtrHmTmLst Points to this Pokemon's list of teachable HM/TM moves. Only null for the first dummy Pokemon. 0x8 4 uint32 PtrEggLst Points to this Pokemon's list of possible egg moves. Only null for the first dummy Pokemon. Movesets Data This block is made of null terminated lists of encoded integers. Each lists are pointed to by a pointer in the Moveset Data Pointers Table. The block always begin with 3 null bytes. Those are the lists for the dummy first Pokemon. Every 3 lists belongs to a specific Pokemon, and each have a specific content/purpose. An empty list is represented by a single null byte. Moveset Lists Group Offset Name Description 0x0 Level-Up Moves List This list of integer is particular. Its not just a list of moves, like the two others. Each move ID is followed with the level at which the Pokemon learns the move. So essentially, every 2 integer decoded from this list form a pair indicating the move ID and then the level. After Level-Up Moves List HM/TM Moves List A simple list of integer where each value correspond to a HM/TMs move ID the Pokemon can learn. After HM/TM Moves List Egg Moves List Another simple list of integer where each value correspond to a move ID of a move the Pokemon may get if it hatches from an egg. Encoding The encoding for the lists is the same used for the SIR0 format's encoded pointer list. However, each values decoded is not relative to the previous one, and you must keep in mind that there are several lists, not a single one, unlike the SIR0's encoded pointer offsets list. Also, the move IDs are 16 bits integers, not 32 bits integers like the pointer offsets are. Here's an example of decoding Bulbasaur's 3 lists. This only shows the raw bytes, then the decoded raw values, then the corresponding move to the move ID that was decoded: First List: 0x81 0x1A 0x01 => 0x9A, 1 => Tackle lvl 1 0x81 0x59 0x03 => 0xD9, 3 => Growl lvl 3 0x82 0x49 0x07 => 0x149, 7 => Leech Seed lvl 7 0x81 0x36 0x09 => 0xB6, 9 => Vine Whip lvl 9 0x81 0x47 0x0D => 0xC7, 13 => Poison Powder lvl 13 0x81 0x67 0x0D => 0xE7, 13 => Sleep Powder lvl 13 0x81 0x4B 0x0F => 0xCB, 15 => Take Down lvl 15 0x81 0x7B 0x13 => 0xFB, 19 => Razor Leaf lvl 19 0x0A 0x15 => 0x0A, 21 => Sweet Scent lvl 21 0x81 0x14 0x19 => 0x94, 25 => Growth lvl 25 0x81 0x0C 0x1B => 0x8C, 27 => Double-Edge lvl 27 0x83 0x78 0x1F => 0x1F8, 31 => Worry Seed lvl 31 0x5E 0x21 => 0x5E, 33 => Synthesis lvl 33 0x83 0x66 0x25 => 0x1E6, 37 => Seed Bomb lvl 37 0x00 Second List: 0x12 => 18 => Cut 0x18 => 24 => Swagger 0x1D => 29 => Rock Smash 0x30 => 48 => Return 0x32 => 50 => Strength 0x38 => 56 => Double Team 0x43 => 67 => Facade 0x4C => 76 => Giga-Drain 0x68 => 104 => Endure 0x81 0x17 => 151 => Solar Beam 0x81 0x23 => 163 => Bullet Seed 0x81 0x35 => 181 => Swords Dance 0x81 0x45 => 197 => Toxic 0x81 0x5F => 223 => Sunny Day 0x81 0x63 => 227 => Sleep Talk 0x81 0x68 => 232 => Rest 0x82 0x07 => 263 => Secret Power 0x82 0x11 => 273 => Flash 0x82 0x18 => 280 => Sludge Bomb 0x82 0x2D => 301 => Protect 0x82 0x30 => 304 => Substitute 0x82 0x44 => 324 => Hidden Power 0x82 0x46 => 326 => Attract 0x82 0x48 => 328 => Frustration 0x82 0x68 => 360 => Wide Slash 0x83 0x0A => 394 => Vacuum-Cut 0x83 0x3B => 443 => Energy Ball 0x83 0x4A => 458 => Grass Knot 0x83 0x57 => 471 => Natural Gift 0x84 0x16 => 534 => Captivate 0x00 Third List: 0x0B => 11 => Charm 0x54 => 84 => Grass Whistle 0x77 => 119 => Nature Power 0x81 0x06 => 134 => Safeguard 0x81 0x57 => 215 => Amnesia 0x81 0x69 => 233 => Ingrain 0x81 0x6D => 237 => Curse 0x81 0x7D => 253 => Petal Dance 0x82 0x03 => 259 => Light Screen 0x82 0x29 => 297 => Magical Leaf 0x82 0x5C => 348 => Skull Bash 0x84 0x19 => 537 => Leaf Storm 0x00 Credits The WMS project, for their notes. [2] OgreGunner and nhahtdh for that huge thread on GameFaqs filled with tidbits of information! [3] Kelvin Chung for the .grammar file containing much useful information on the PMD:RRT format, which share similarities with PMD2! [4]

X/Y Save files are comprised of 4 sections, the latter two storing the contents of the two savegames. The game alternates between the two game saves similar to Generations 3 & 4. Save files are 0x100000 (1MB). The area between sections is either FF or 00, for Cartridges and Digital saves respectively. Single Partition Save File http://3dbrew.org/wiki/Savegames Image Header (0x00000-0x00460) Offset Length Hash Details Description 00000 0x10 0x0: Uses the AES Engine & KeyY AES MAC Header 00100 0x100 0x16C: (SHA256) 0x000-0x12C of active DIFI DISA 00200 0x12C 0x30C: (SHA256) 1st IVFC Hash copied to 0x200 zero array DIFI Blob 1 00330 0x12C 0x43C: (SHA256) 1st IVFC Hash copied to 0x200 zero array DIFI Blob 2 First Partition (0x01000-0x01107) Offset Description 01000 DPFS Partition Save File 1 (0x02000 - 0x6AFFF) (420 KB) Offset Description 02000 IVFC Hash Region 03000 SAVE Header (0x3F0 medias, 0x200 length) = 0x7E000 total 03100 SAVE Data ID Start Length CHK Description 0000 05400 000002C8 6A81A 05400 - Pokepuff Inventory (Index * 100ct) 05464 - u32 Received Counter 0001 05800 00000B88 6A822 05800 - Items Pocket 05E40 - Key Items Pocket 05FC0 - TM Pocket 06168 - Medicine Pocket 06268 - Berry Pocket 0002 06400 0000002C 6A82A Select Bound Items 0003 06600 00000038 6A832 ???? 0004 06800 00000150 6A83A Trainer Stat Tracking 0x06802 - Map ID 0x06810 - X Coordinate (<>) 0x06814 - Y Coordinate (Height) 0x06818 - Z Coordinate (^v) 0x068F4 - Map ID 0x06904 - X Coordinate (<>) 0x06808 - Y Coordinate (Height) 0x0680C - Z Coordinate (^v) 0005 06A00 00000004 6A842 ???? 0006 06C00 00000008 6A84A u32 Time Played + u32 Adventure Started 0007 06E00 000001C0 6A852 Wardrobe (Bitflags) & Saved Outfits (Index #s) 0008 07000 000000BE 6A85A u16/u8 storage 0009 07200 00000024 6A862 FFFFFFFF 000A 07400 00002100 6A86A Overworld Data 0x108 per Overworld Entity 000B 09600 00000140 6A872 Trainer Information ($) 000C 09800 00000440 6A87A Box Names [0x22] Box Name (* 31) [0x01] Box Background *31 [0x03] Background Unlock Flags 000D 09E00 00000574 6A882 Battle Box 000E 0A400 00004E28 6A88A PSS Data - Friends 000F 0F400 00004E28 6A892 PSS Data - Acquaintances 0010 14400 00004E28 6A89A PSS Data - Passerby 0011 19400 00000170 6A8A2 Trainer Card (ID/SID/OT/Greeting) 0012 19600 0000061C 6A8AA Party Members 0013 19E00 00000504 6A8B2 Constant & Event Flags 0x1A0FC-0x1A27B - Event Bitflags (0x180 * 8) 0014 1A400 000006A0 6A8BA Pokedex 0x1A400 - Constant? 0x2F120F17 0x1A004 - u32 counter (?) 0x1A408 - 0x60 Region 1 - Owned Native 0x1A468 - 0x60 Region 2 - Encountered Male 0x1A4C8 - 0x60 Region 3 - Encountered Female 0x1A528 - 0x60 Region 4 - Encountered Male * 0x1A588 - 0x60 Region 5 - Encountered Female * 0x1A5E8 - 0x60 Region 6 - Displayed Male 0x1A648 - 0x60 Region 7 - Displayed Female 0x1A6A8 - 0x60 Region 8 - Displayed Male * 0x1A708 - 0x60 Region 9 - Displayed Female * 0x1A768 - 0x18 Form Bitflag Region 1 - Encountered form 0x1A780 - 0x18 Form Bitflag Region 2 - Encountered form * 0x1A798 - 0x18 Form Bitflag Region 3 - Displayed form 0x1A7B0 - 0x18 Form Bitflag Region 4 - Displayed form * 0x1A7C8 - 0x278 7bit/entry flags (Language) 0x1AA40 - u32 ??? 0? 0x1AA44 - Spinda Spot Pattern (First EC encountered) 0x1AA48 - u32 ??? 0x1AA4C - 0x54 Bitflags - Obtained specimen from Previous Console Era (pre Kalos Game Origin, 1-649) 0015 1AC00 00000644 6A8C2 Sorted Variables 0016 1B400 00000104 6A8CA Fused Zekrom/Reshiram Storage 0017 1B600 00000004 6A8D2 ???? 0018 1B800 00000420 6A8DA ???? 0019 1BE00 00000064 6A8E2 O-Power Flags 001A 1C000 000003F0 6A8EA ???? 001B 1C400 0000070C 6A8F2 User Metadata 1C538 - PSS Outfit 1C548 - Trainer Name 1C564 - Favorite Pokemon 1C567 - Pokemon's Gender 1C56C - Encryption Constant 1C57C - Pokemon's Nickname 001C 1CC00 00000180 6A8FA GTS Upload & Match Criteria 001D 1CE00 00000004 6A902 87B1A23F const 001E 1D000 0000000C 6A90A ???? 001F 1D200 00000048 6A912 Repel Info, (Swarm?) and other overworld info 0020 1D400 00000054 6A91A ???? 0021 1D600 00000644 6A922 WiFi Tournament Data 0022 1DE00 000005C8 6A92A Live Tournament Data 0023 1E400 000002F8 6A932 MAC Address & Network Connection Logging (0x98 per entry) 0024 1E800 00001B40 6A93A Hall of Fame Data (First Game Clear + 15 Latest) 0x48 per Pokemon Slot; capped with 4 bytes at end (total 0x1B4) 0x00 - Species 0x02 - Held Item 0x04 - Move 1 0x06 - Move 2 0x08 - Move 3 0x0A - Move 4 0x0C - Encryption Key 0x10 - TID 0x12 - SID 0x14 - [Nicknamed,1][Shiny,1][Level,7][Gender,2][Form,5] bits 0x16 - Unused 0x18 - Nickname (0x16) + 0x3F80 end 0x30 - Trainer Name (0x16) + 0x3F80 end Last 4 bytes: 0x00 - # of Hall of Fame Victory 0x01 - [Unk,1][Day of Month,5][Month,4][Year,8] bits 0025 20400 000001F4 6A942 Maison Data 205C0 - u16 Current Singles Streak 205C2 - u16 Current Super Singles Streak 205C4 - u16 Best Singles Streak 205C6 - u16 Best Super Singles Streak 205C8 - u16 Current Doubles Streak 205CA - u16 Current Super Doubles Streak 205CC - u16 Best Doubles Streak 205CE - u16 Best Super Doubles Streak 205D0 - u16 Current Triples Streak 205D2 - u16 Current Super Triples Streak 205D4 - u16 Best Triples Streak 205D6 - u16 Best Super Triples Streak 205D8 - u16 Current Rotation Streak 205DA - u16 Current Super Rotation Streak 205DC - u16 Best Rotation Streak 205DE - u16 Best Super Multi Streak 205E0 - u16 Current Multi Streak 205E2 - u16 Current Super Multi Streak 205E4 - u16 Best Multi Streaks 205E6 - u16 Best Super Multi Streak 0026 20600 000001F0 6A94A Daycare Data u32 (Slot 1) Occupied Flag u32 (Slot 1) Steps Taken Since Depositing xE8 (Slot 1) Box EK6 1 u32 (Slot 2) Occupied Flag u32 (Slot 2) Steps Taken Since Depositing2 xE8 (Slot 2) Box EK6 2 u64 Flag (egg available) u64 RNG Seed 0027 20800 00000216 6A952 Index Number Related Data 0028 20C00 00000390 6A95A Berry Field Data (0x18 per tree, 36 trees) 0029 21000 00001A90 6A962 Wondercard Data 0x100 bitflag-card received storage Wondercard slots (0x108 between) 002A 22C00 00000308 6A96A Old Man (Anistar) Pokemon Storage 002B 23000 00000618 6A972 Friend Safari Data 002C 23800 0000025C 6A97A PSS Data 23970 (0x20) - Pokémon Bank (application?) data 002D 23C00 00000834 6A982 PSS Friend Data [0x15]*100 entries 002E 24600 00000318 6A98A Super Training Data 24610 - Mission Best Times (seconds as 4 byte floats)*30 24788 - u32 Species That Scored Best Time*30 24908 - Bag Inventory (12 bags) 002F 24A00 000007D0 6A992 ???? 0030 25200 00000C48 6A99A Pokemon Link Gifts 0x25E44 - u16 checksum (ccitt16, 0xFFFF initial) of 0x25400-0x25E43 0031 26000 00000078 6A9A2 Index Number Related Data 0032 26200 00000200 6A9AA PGL Promotion Gifts 0033 26400 00000C84 6A9B2 ???? 0034 27200 00000628 6A9BA Data Block (Purpose Unknown) u64 Length byte[Length] data 0035 27A00 00034AD0 6A9C2 Box Data (31 Boxes, 30 Slots, 232 bytes each) 0036 5C600 0000E058 6A9CA Picture Data (JPEG Exif Ver 2.2) ~ 5C654 starts the JPEG (FF D8 marker) - Sent to PGL ---- 6A800 00000800 ----- Checksum Storage [0x14] Header: u64 savetime1 & u64 savetime2 (First five bytes Anti-Savegame Restore Secure Value),u16 BEEF magic [0x10] Checksum Entries: u32 len, u16 ID, u16 checksum (ccitt16, 0xFFFF initial) Save File 2 (0x81000 - 0xE9FFF) (420 KB) Same as Game Save 1's offsets; add 0x7F000. IVFC Hash Region SHA256 Hash over a 0x1000 large block (4096 bytes). Start End Hash Location 2020 203F 2000 - First Hash: Copied to 0x200 zero array. 2040 2FFF 2020 - Second Hash: Copied to 0x1000 zero array. 3000 3FFF 2040 4000 4FFF 2060 5000 5FFF 2080 6000 6FFF 20A0 7000 7FFF 20C0 8000 8FFF 20E0 9000 9FFF 2100 A000 AFFF 2120 B000 BFFF 2140 C000 CFFF 2160 D000 DFFF 2180 E000 EFFF 21A0 F000 FFFF 21C0 10000 10FFF 21E0 11000 11FFF 2200 12000 12FFF 2220 13000 13FFF 2240 14000 14FFF 2260 15000 15FFF 2280 16000 16FFF 22A0 17000 17FFF 22C0 18000 18FFF 22E0 19000 19FFF 2300 1A000 1AFFF 2320 1B000 1BFFF 2340 1C000 1CFFF 2360 1D000 1DFFF 2380 1E000 1EFFF 23A0 1F000 1FFFF 23C0 20000 20FFF 23E0 21000 21FFF 2400 22000 22FFF 2420 23000 23FFF 2440 24000 24FFF 2460 25000 25FFF 2480 26000 26FFF 24A0 27000 27FFF 24C0 28000 28FFF 24E0 29000 29FFF 2500 2A000 2AFFF 2520 2B000 2BFFF 2540 2C000 2CFFF 2560 2D000 2DFFF 2580 2E000 2EFFF 25A0 2F000 2FFFF 25C0 30000 30FFF 25E0 31000 31FFF 2600 32000 32FFF 2620 33000 33FFF 2640 34000 34FFF 2660 35000 35FFF 2680 36000 36FFF 26A0 37000 37FFF 26C0 38000 38FFF 26E0 39000 39FFF 2700 3A000 3AFFF 2720 3B000 3BFFF 2740 3C000 3CFFF 2760 3D000 3DFFF 2780 3E000 3EFFF 27A0 3F000 3FFFF 27C0 40000 40FFF 27E0 41000 41FFF 2800 42000 42FFF 2820 43000 43FFF 2840 44000 44FFF 2860 45000 45FFF 2880 46000 46FFF 28A0 47000 47FFF 28C0 48000 48FFF 28E0 49000 49FFF 2900 4A000 4AFFF 2920 4B000 4BFFF 2940 4C000 4CFFF 2960 4D000 4DFFF 2980 4E000 4EFFF 29A0 4F000 4FFFF 29C0 50000 50FFF 29E0 51000 51FFF 2A00 52000 52FFF 2A20 53000 53FFF 2A40 54000 54FFF 2A60 55000 55FFF 2A80 56000 56FFF 2AA0 57000 57FFF 2AC0 58000 58FFF 2AE0 59000 59FFF 2B00 5A000 5AFFF 2B20 5B000 5BFFF 2B40 5C000 5CFFF 2B60 5D000 5DFFF 2B80 5E000 5EFFF 2BA0 5F000 5FFFF 2BC0 60000 60FFF 2BE0 61000 61FFF 2C00 62000 62FFF 2C20 63000 63FFF 2C40 64000 64FFF 2C60 65000 65FFF 2C80 66000 66FFF 2CA0 67000 67FFF 2CC0 68000 68FFF 2CE0 69000 69FFF 2D00 6A000 6AFFF 2D20 Pokepuff Index Numbers Index Name 00 Empty 01 Sweet Basic Pokepuff 02 Mint Basic Pokepuff 03 Citrus Basic Pokepuff 04 Mocha Basic Pokepuff 05 Spice Basic Pokepuff 06 Sweet Frosted Pokepuff 07 Mint Frosted Pokepuff 08 Citrus Frosted Pokepuff 09 Mocha Frosted Pokepuff 0A Spice Frosted Pokepuff 0B Sweet Fancy Pokepuff 0C Mint Fancy Pokepuff 0D Citrus Fancy Pokepuff 0E Mocha Fancy Pokepuff 0F Spice Fancy Pokepuff 10 Sweet Deluxe Pokepuff 11 Mint Deluxe Pokepuff 12 Citrus Deluxe Pokepuff 13 Mocha Deluxe Pokepuff 14 Spice Deluxe Pokepuff 15 Wish Supreme Pokepuff 16 Honor Supreme Pokepuff 17 Spring Supreme Pokepuff 18 Summer Supreme Pokepuff 19 Fall Supreme Pokepuff 1A Winter Supreme Pokepuff Super Training Bag Index Numbers Index Name 00 Empty 01 HP Bag S 02 HP Bag M 03 HP Bag L 04 ATK Bag S 05 ATK Bag M 06 ATK Bag L 07 Def Bag S 08 Def Bag M 09 Def Bag L 0A Sp.A Bag S 0B Sp.A Bag M 0C Sp.A Bag L 0D Sp.D Bag S 0E Sp.D Bag M 0F Sp.D Bag L 10 Speed Bag S 11 Speed Bag M 12 Speed Bag L 13 Strength Bag 14 Toughen Up Bag 15 Swiftness Bag 16 Big-Shot Bag 17 Double-Up Bag 18 Team Flare Bag 19 Reset Bag 1A Soothing Bag Form Dex Index Forms follow the same index as used in the pokémon data structure (i.e. first unown form is "A"...) Mega Pokémon have a flag for non-mega form (regardless of gender) and for mega form. Parenthesis indicates how many form flags there are. Unown (28) Deoxys (4) Shaymin (2) Giratina (2) Rotom (6) Shellos (2) Gastrodon (2) Burmy (3) Wormadan (3) Castform (4) Cherrim (2) Deerling (4) Sawsbuck (4) Meloetta (2) Darmanitan (2) Basculin (2) Kyurem (3) Keldeo (2) Thundurus (2) Tornadus (2) Landorus (2) Vivillion (20) Flabebé (5) Floette (6) Florges (5) Pumkaboo (4) Gourgeist (4) Aegislash (2) Xerneas (2) Venusaur (2) Charizard (3) Blastoise (2) Alakazam (2) Gengar (2) Kangaskhan (2) Pinsir (2) Gyarados (2) Aerodactyl (2) Mewtwo (3) Ampharos (2) Scizor (2) Heracross (2) Houndoom (2) Tyranitar (2) Blaziken (2) Gardevoir (2) Mawile (2) Aggron (2) Medicham (2) Manectric (2) Banette (2) Absol (2) Latias (2) Latios (2) Garchomp (2) Lucario (2) Abomasnow (2) Pokémon Bank (application?) data This region is written every time Pokemon Bank saves. It is a copy of first 0x20 bytes of Pokemon Bank savefile (turtle). Maybe this is used to store information of the last application used with the game, but currently no other application that interacts with XY savegame is known. Offset Description 0x00-0x04 Pokemon Bank unique ID? (seems linked to nnid) 0x05-0x08 Unknown (0x00) 0x09-0x0F Unknown, only present in turtle file (0x00 on game's savegame) 0x10-0x14 Bank usage counter backup (previous counter) 0x15-0x18 Bank usage counter 0x19-0x1F Pokemon Bank signature? (always 48CA0A0002000000)