Search the Community

5th Generation Wonder Card Map Gift Data Offset Description 0x00-0x01 Trainer ID Number, Item Number, Power Type 0x02-0x03 Secret ID Number 0x04 Hometown 00 - Game Received In 01 - Hoenn(Sapphire) Values follow in standard order through 21 0x05-0x07 Unused 0x08-0x0B PID Unset = 00000000 0x0C Primary Ribbons Ribbon data available below. 0x0D Secondary Ribbons Ribbon data available below. 0x0E PokéBall 0x0F Unused 0x10-0x11 Held Item 0x12-0x13 Move ID #1 0x14-0x15 Move ID #2 0x16-0x17 Move ID #3 0x18-0x19 Move ID #4 0x1A-0x1B PokéDex Number 0x1C Unused 0x1D Language 00 for Game Received In 0x1E-0x33 Pokémon Nickname (0x32-0x33 FF FF terminated) If no nickname, all FF. 0x34 Nature FF - Unset 0x35 Pokémon Gender 00 - Male 01 - Female 02 - Random 0x36 Pokémon Ability 00 - Ability 1 01 - Ability 2 02 - Dream World Ability 03 - RND(Abil1, Abil2) 04 - RND(Abil1, Abil2, AbilDW) 0x37 Shiny Toggle 00 - Not Shiny 01 - Allow Shiny 02 - Generate Shiny PID Shows Shiny Pokemon on Card 0x38-0x39 Egg Met Location 0x3A-0x3B Met Location of Pokémon 0x3C Level - unused(?) 0x3D-0x42 Contest Stats Last byte is Sheen 0x43-0x48 IVs FFs for unset IVs 0x49 Unused 0x4A-0x59 OT Name 0x5A OT Gender 00 - Male 01 - Female 03 - Recipient's Gender 0x5B Level(random if set to 0) 0x5C Egg Flag 00 - Is Not Egg 01 - Is Egg 0x5D-0x5F Unused Card Data Offset Description 0x60-0xA9 Card Title 0xAA-0xAB Unknown 0xAC-0xAF Date Card Received 0xB0-0xB1 Card ID 0xB2 "Card From" Location 0xB3 Card Type 01 - Pokémon [Blue] 02 - (Key) Item [Pink] 03 - Power [Yellow] 0xB4 Gift Status: Used / Unused 00 - Repeatable gift 01 - Unused 03 - Used 0xB5-0xCB Unused Ribbon Sets These are the values for each ribbon byte: Flag Value 0x0C 0x0D 0x01 Country Ribbon Special Ribbon 0x02 National Ribbon Memorial Ribbon 0x04 Earth Ribbon Wish Ribbon 0x08 World Ribbon Battle Champ Ribbon 0x10 Classic Ribbon Regional Champ Ribbon 0x20 Premiere Ribbon National Champ Ribbon 0x40 Event Ribbon World Champ Ribbon 0x80 Birthday Ribbon No Ribbon(Empty) First Appearance in the Memory The Wonder Cards do appear in the active memory while the game is running, however there are certain things that are set in addition to the card data in addition to it being in two locations. The cards appear in the region of 0x0226BE30-0x0226C87F in Black, and 0x0226BE50-0x0226C89F for White. Card data is unencrypted when viewing, but encrypted at all other times. Each card is separated by 220 bytes of data. Memory Offsets of each Card when viewing, including the leading 4 bytes: Card # Offset (Black) Offset (White) 1 0x0226BE30 0x0226BE50 2 0x0226BF0C 0x0226BF2C 3 0x0226BFE8 0x0226C008 4 0x0226C0C8 0x0226C0E8 5 0x0226C1A4 0x0226C1C4 6 0x0226C280 0x0226C2A0 7 0x0226C35C 0x0226C37C 8 0x0226C438 0x0226C458 9 0x0226C514 0x0226C534 10 0x0226C5F0 0x0226C610 11 0x0226C6CC 0x0226C6EC 12 0x0226C7A8 0x0226C7C8 The card is preceded by 4 bytes, in which the first is 1 to indicate that there is a card present in that slot, being 0 when a card is not present. Meaning Data Card Present 0x00000001 No Card Present 0x00000000 The card data is then present, byte for byte for the entire 204 bytes. After the card data, there are 4 bytes (pointer?). Card # Trash Value (Black) Trash Value (White) 1 0x0226CAA4 0x0226CAC4 2 0x0226CD88 0x0226CDA8 3 0x0226D06C 0x0226D08C 4 0x0226D350 0x0226D370 5 0x0226D388 0x0226D3A8 6 0x0226D3C0 0x0226D3E0 7 0x0226D3F8 0x0226D418 8 0x0226D430 0x0226D450 9 0x0226D468 0x0226D488 10 0x0226D4A0 0x0226D4C0 11 0x0226D4D8 0x0226D4F8 12 0x02270248 0x02270268 There are then 8 unused bytes (all 00), leading up to the next card. Second Appearance in the Memory The second appearance of the unencrypted card data while viewing is varied based on the number of cards currently on the save. Since it has not been tested whether or not active/inactive gifts may change the locations, trash all used cards before using any memory codes. Cards and the surrounding data follow the first appearance's format. Kaphotics' Test Card 1 Memory Location of N Cards [Stop at (N) cards]: Black: 02277F20(1 card) +58C(2c) +590(3) +58C(4) +2E8(5) +2E4(6) +2E8(7) +2E4(8) [9-12 still testing] White: 02277F40(1 card) +58C(2c) +590(3) +58C(4) +2E8(5) +2E4(6) +2E8(7) +2E4(8) [9-12 still testing] Card 2 = Card 1 Memory + 420 Card n = Card 1 Memory + 5020 + (n-3)*4C34 || Number of cards: 13>n>2 For other DS's (with different MAC addresses) the 1st location is the same but the rest follow different additive constants between cards. The second appearances will appear in the block range of 0x02270000-0x022AFFFF.

Wild Pokémon and stationary legendaries without a shiny check have their PIDs created in the same way. It involves using the TID and SID to evaluate the seed being used for the PID and whether or not it should be OR-ed with 0x80000000 on creation. ---------------------------------------------------------------------------------------------------- standard 0x8 decision pid generation(btw, r6 is sidtid for basically this entire thing) 020056FC F096ECB6 blx #0209C06C //switch to ARM, to 0209C06C (umul64()) -return to 02005700 02005700 6922 ldr r2,[r4,#0x10] // load value at 2216254 into r2(00269EC3) 02005702 6963 ldr r3,[r4,#0x14] // load 02216258 into r3(aka, zero-out r3) 02005704 1810 add r0,r2,r0 // add together r0 and r2, finish l32 advancement 02005706 414B adc r3,r1 // new upper seed 02005708 6020 str r0,[r4] // store the lower half-rng back to the state offset 0200570A 6063 str r3,[r4,#0x4] // store the upper half-rng back to the state offset 0200570C 2D00 cmp r5, #0x0 // this is 0 for pid creation only 0200570E D101 bne #0x2005714 // false, no branch 02005714 6860 ldr r0,[r4,#0x4] // load the value of the upper half of the rng state into r0 02005716 2100 mov r1, #0x0 // set r1 to 00000000 02005718 2300 mov r3, #0x0 // set r3 to 00000000 0200571A 1C2A mov r2, r5 // move contents r5(0x0) to r2 0200571C F096ECA6 blx #0209C06C // no branch 02005720 1C08 mov r0,r1 //save that u32 02005722 BD38 pop {r3-r5,r15} //jump to 20186F8 020186F8 1C04 mov r4,r0 //save the seed to compare 020186FA E024 b #0x2018746 02018746 9807 ldr r0,[sp,#0x1C] // value @ 2FE3604(0x2) 02018748 2800 cmp r0,#0x0 0201874A D019 beq #0x2018780 0201874C 2801 cmp r0,#0x1 0201874E D002 beq #0x2018756 02018750 2802 cmp r0,#0x2 02018752 D01E beq #0x2018792 ;true 02018792 2001 mov r0,#0x1 02018794 9906 ldr r1,[sp,#0x18] 02018796 0400 lsl r0,r0,#0x10 //prepping for base 0x00010000 xor 02018798 1C22 mov r2,r4 0201879A 4002 and r2,r0 //not understanding why it ANDs u32 by 10000, but r2 now == 0 0201879C 0409 lsl r1,r1,#0x10 0201879E 428A cmp r2,r1 // same as with the legendaries, 10000 vs. 20000, not equal(this is ability-setting junk) 020187A0 D000 beq #0x20187A4 // false, no advancement 020187A2 4044 eor r4,r0 // base xor by 00010000 020187A4 1C20 mov r0,r4 // store this half-ready pid to r0 and save it... 020187A6 BDF8 pop {r3-r7,r15} 021A9DB2 79A1 ldrb r1,[r4,#0x6] //2FE36C4- pull a byte out of a local array- this byte determines the type of PID- HL, standard, gift, etc 021A9DB4 2902 cmp r1,#0x2 // r1 = 0 021A9DB6 D012 beq #0x21A9DDE // false, no branch 021A9DB8 6A2C ldr r4,[r5,#0x20] //load sidtid to r4 021A9DBA 0401 lsl r1,r0,#0x10 //set the lower half of the temp pid to r1(u16 of r1, need to fix) 021A9DBC 0C0B lsr r3,r1,#0x10 // move the lower half temp-pid to the lower half of r3 to prep 021A9DBE 0421 lsl r1,r4,#0x10 // separate tid and sid; this is tid 021A9DC0 0C22 lsr r2,r4,#0x10 // sid is ready 021A9DC2 0C09 lsr r1,r1,#0x10 // tid is ready 021A9DC4 4051 eor r1,r2 // tid ^ sid 021A9DC6 1C1A mov r2,r3 // move lower 16 of pid to r2, get ready for next step 021A9DC8 404A eor r2,r1 l16 pid ^ (tid ^ sid) 021A9DCA 2101 mov r1,#0x1 // r1 = 1 021A9DCC 4211 tst r1,r2 // (tid ^ sid ^ l16 pid) & 1 (= 0 in my case) 021A9DCE D004 beq #0x21A9DDA // resolve to 0, skip this 021A9DD0 2102 mov r1,#0x2 // set up 0x8 or 021A9DD2 0789 lsl r1,r1,#0x1E // r1 = 80000000 021A9DD4 B002 add sp,#0x8 021A9DD6 4308 orr r0,r1 // this is an OR, not XOR 021A9DD8 BD70 pop {r4-r6,r15} //return 021A9DDA 4902 ldr r1,=#0x7FFFFFFF // set up to finish the pid 021A9DDC 4008 and r0,r1 // unset the highest bit, though it's probably not set as it is 021A9DDE B002 add sp,#0x8 021A9DE0 BD70 pop {r4-r6,r15} // return

6th Generation Pokemon Link Map Overall structure Pokémon link data is stored at block ID 0x30 of the savegame, located at offset 0x1FE00 for X/Y and 0x20DFF for OR/AS (add 0x5400 if using the referenced offsets located at Pokémon X/Y Save Structure and ORAS Save Structure respectively). Offset Description 0x00-0x? Pokémon Transfer Flags? * 0x1FF-0xC45 Pokémon Link Data 0xC46-0xDFF Unused? * Pokémon Transfer flags: this value prevents receiving the same pokémon trough Pokémon Link Multiple times. If this value is cleared, the Pokémon can be received again. This has only been used for ORAS Demo Glalie/Steeliex, both of which set this value to 0x02. Pokémon Link Data Savegame Offsets Pokémon Link Data starts in the following offsets for decrypted savegame files and is 2631 bytes long: Pokémon X/Y: 0x1FFFF Pokémon OR/AS: 0x20FFF Modifying this data requires checksum #0x30 to be updated. Also, for ramsav users (ramsav method does not require to fix checksum): ramsav.bin offset Pokémon X/Y: 0x1CF9F ramsav.bin offset Pokémon OR/AS: 0x1E05B Pokémon Link Data Map Offset Description 0x00 Pokémon Link flag (0x00 disabled, 0x80 enabled) 0x01-0x6C Name of application that produce Pokémon Link Data 0x6D-0x6E NULL terminator? 0x6F-0x94 Unknown/Unused 0x95-0x98 Unknown/Unused (0x00000000) 0x99-0x9C Pokémon transfer flags?1 (see notes) 0x9D-0x13C Pokémon slot 1 (160 bytes 2 see notes) 0x13D-0x140 Unknown/Unused (0x00000000) 0x141-0x144 Pokémon transfer flags?1 (see notes) 0x145-0x1E4 Pokémon slot 2 (160 bytes 2 see notes) 0x1E5-0x1E8 Unknown/Unused (0x00000000) 0x1E9-0x1EC Pokémon transfer flags?1 (see notes) 0x1ED-0x28C Pokémon slot 3 (160 bytes 2 see notes) 0x28D-0x290 Unknown/Unused (0x00000000) 0x291-0x294 Pokémon transfer flags?1 (see notes) 0x295-0x334 Pokémon slot 4 (160 bytes 2 see notes) 0x335-0x338 Unknown/Unused (0x00000000) 0x339-0x33C Pokémon transfer flags?1 (see notes) 0x33D-0x3DC Pokémon slot 5 (160 bytes 2 see notes) 0x3DD-0x3E0 Unknown/Unused (0x00000000) 0x3E1-0x3E4 Pokémon transfer flags?1 (see notes) 0x3E5-0x484 Pokémon slot 6 (160 bytes 2 see notes) 0x485-0x488 Unknown/Unused (0x00000000) 0x489-0x48A Item 1 (3 see notes) 0x48B-0x48C Item 1 quantity 0x48D-0x48E Item 2 (3 see notes) 0x48F-0x490 Item 2 quantity 0x491-0x492 Item 3 (3 see notes) 0x493-0x494 Item 3 quantity 0x495-0x496 Item 4 (3 see notes) 0x497-0x498 Item 4 quantity 0x499-0x49A Item 5 (3 see notes) 0x49B-0x49C Item 5 quantity 0x49D-0x49E Item 6 (3 see notes) 0x49F-0x4A0 Item 6 quantity 0x4A1-0x4A2 Battle Points (max. value 9999) 0x4A3-0x4A4 Poké Miles 0x4A5-0xA44 Unknown/Unused (All 0x00) 0xA45-0xA46 CRC-16/CCITT checksum for 0x01-0xA44 data When no Pokémon Link Data is available, 0x01-0xA46 is set to 0x00. Pokémon slot structure Offset Description 0x00-0x01 TID 0x02-0x03 SID 0x04 Pokemon Origin Game (OT Game ID) 00 for Game Received in 0x05-0x07 Unknown/Unused (0x000000) 0x08-0x0B [Pokemon] Encryption Constant Unset = 00000000 0x0C Primary Ribbons Ribbon data available below. 0x0D Secondary Ribbons Ribbon data available below. 0x0E PokéBall 0x0F Unused/Unknown 0x10-0x11 Held Item 0x12-0x13 Move ID #1 0x14-0x15 Move ID #2 0x16-0x17 Move ID #3 0x18-0x19 Move ID #4 0x1A-0x1B PokéDex Number (4 see notes) 0x1C Form No. 0x1D Language 00 for Game Received In 0x1E-0x37 Pokémon Nickname Null terminator for last two bytes. If no nickname, all 00. 0x38 Nature FF - Unset 0x39 Pokémon Gender 00 - Male 01 - Female 02 - Genderless 03 - Random 0x3A Pokémon Ability 00 - Ability 1 01 - Ability 2 02 - Dream World Ability 03 - RND(Abil1, Abil2) 04 - RND(Abil1, Abil2, AbilDW) 0x3B PID Toggle 00 - Generate Specified PID (from 0x6C-0x6F) 01 - Generate Random PID (Can be shiny) 02 - Generate Shiny PID (Always shiny) 03 - Generate Random PID (Can't be shiny) 0x3C-0x3D Egg Met Location (5 see notes) 0x3E-0x3F Met Location of Pokémon (5 see notes) 0x40 Met Level 0x41-0x46 Contest Stats Last byte is Sheen 0x47-0x4C IVs FFs for unset IVs FE for priority 0x4D OT Gender 00 - Male 01 - Female 03 - Recipient's Gender 0x4E-0x67 OT Name Null terminator for last two bytes. If no set OT, all 00. 0x68 Current Level(random if set to 0) 0x69 Egg Flag 00 - Is Not Egg 01 - Is Egg 0x6A-0x6B 'Unknown' 0x6C-0x6F PID (used if PID toogle is 00) 0x70-0x71 Relearn Move 1 0x72-0x73 Relearn Move 2 0x74-0x75 Relearn Move 3 0x76-0x77 Relearn Move 4 0x78 OT Memory Intensity 0x79 OT Memory Line 0x7A-0x7B OT Memory TextVar 0x7C OT Memory Feeling 0x7D-0x9F Unknown/Unused/Reserved bytes Ribbon Set Flag Value 0x74 0x75 0x01 Battle Champ Ribbon World Champ Ribbon 0x02 Regional Champ Ribbon Birthday Ribbon 0x04 National Champ Ribbon Special Ribbon 0x08 Country Ribbon Souvenir Ribbon 0x10 National Ribbon Wishing Ribbon 0x20 Earth Ribbon Classic Ribbon 0x40 World Ribbon Premier Ribbon 0x80 Event Ribbon Empty Notes Pokémon transfer flags: for ORAS demo Glalie/Steelix this is set to 0x0001 0x0001; for Celebi and Johto starters 0x0000 0x0000. Somehow this sets a value in the XY/ORAS savegame that makes the game unable to receive the pokemon again, this is what makes Glalie/Steelix from ORAS Demo only be able to be received once per savegame. Removing that value from the savegame allows to import another Glalie/Steelix. Todo: add offset where that value is stored in XY and ORAS. The statement that pokemon data is 160 bytes long is made due to this data being essentially the same as in wondercard data, which is 160 bytes long from TID to end of file. If item is not valid, it won't be obtained. If pokemon species is not valid (i.e 0x0000), no pokemon will be generated. Pokemon link will set egg met location to "Pokemon Link" and met at location to "Pokemon Link" regardless of the value in the data.