Jump to content
  • GS ACE: TM17

    A tutorial for how to perform Arbitrary Code Execution on Pokémon Gold and Silver, using no external hardware.
    1. 1

      Introduction

      Introduction Many of you might have heard of the Coin Case Glitch, and our sites even hold a tutorial for a version that we've adapted for common usage. This version, however, is better than the existing version as: 1. It would not need a complicated list of items in the PC, meaning it can be done as soon as players get hold of the coin case (to set-up). 2. Does not rely on being at a certain location to execute. It is important to note, however, that the setup to this requires the Coin Case (even if it doesn't require the huge amount of items). Additionally, this only works for the English versions of Gold & Silver.   Before we go any further, I need to give my thanks to Crystal_, for coming up with a simpler method. If you're the type that thinks it's easier to learn and perform such a setup via videos, you can find Crystal_'s video here.   Set-up This set-up is required, as it involves finding a way to get TM17 outside of the TMHM slot of the player's bag. Alternatively, users with access to PKHeX can use Hax mode and hack in TM17 into the Items slot. Even so, there are some other steps that are necessary to use this. Once this set-up is complete, future sets are as easy as: 1. changing Box 1's Name 2. Using TM17 to activate. Here we go: A1. Set up your party:- "Slide Pokemon": Third slot is low level Pokemon with low attack IVs (glitch may fail if this is incorrect)- Fourth slot is Quagsire with Sleep Talk as First Move, holding Protein. - A Pokemon with Fly (if you're not in Cherrygrove)Example below is a typical set-up. Ignore statement about Red Gyarados > Egg for now.: Examples of a good "Slide Pokemon", and additional notes about it: A2. Have the first item in the bag be an unwanted item (it'll be replaced by TM17) A3. Fly to Cherrygrove (if you're not already there) A4. Have your PC Boxes renamed as such: A5. Save the game before leaving Pokemon CenterA6. Enter the mart, then leave the mart, then go 4 steps to the right. A7. Open Pokedex, and go to "Cry" to listen to Bellsprout's (or Machop's) Cry A8. Open Bag. Flip around pockets <- a must! Check Coin case.   A9. Check if first item in Items Pocket is TM17. If yes, proceed, if not, redo everything, double check boxes names.   A10. Shift the Slide Pokemon to the first slot, and Quagsire to the second slot. A11. Swap Quagsire's held item to TM09 (Psych Up), then save the game. A12. Lastly, rename Box 2 to Box 10 to these names, then save. (don't use TM17)   Congratulations! Your set-up is now complete! You're now ready to change whatever data you want with ease!  
    2. 2

      Custom Modifications (Standard)

      This page aims to educate users on how to change whatever values they want in their game. When you're modifying data during gameplay, you're actually modifying the data in your RAM. Hence, we'll be referring to Gold & Silver's RAM MAP, which is this page. Anything, ranging from Pokemon's DVs, to Shininess, to items, all that data can be found there. Box Name 1 data structure This is what it typically looks like: The address and value is converted from Hexadecimal to Box Name Encoding, via this table below (in the spoiler):   Example on data modificationStep 1: Find the new name needed for Box 1 This example is regarding changing the first ball in your bag's Ball Slot, to Master Balls. According to the ram map, this is the data address for the 1st Ball slot: $D5FD = Ball 1 $D5FE = Amount Now, the aim is to change 1st Ball Slot to Master Ball. Here's a look at what it is, before the change. Now, as per Data Structure, we need to change the address $D5FD (also commonly written as 0xD5FD) to the Box Name Encoding. First, we search for 0xD5 in the table. We will see that 0xD5 -> 'v9 Next, we will search for 0xFD on the table. We will see that 0xFD -> 89Lastly, we know that we are changing the Item to Master Ball. We will see that Master Ball -> AB So the new name we acquired for Box 1, is 'v989AB Step 2: Change Box 1's name Step 3: Use TM17 that is in Item Pocket Step 4: Check if change was made! Following our example, it became Master Balls! Once you want to make other changes, just run through Step 1 to 4 again. For example, if you want to change the amount, Restart from Step 1, with $D5FE as the focus this time.  
    3. 3

      Custom Modifications (Active till Shutdown)

      Before you read this page, it is paramount that users has read and understands the Standard Version of Custom Modifications. Effectively, this page will allow users to learn how to make codes that once activated, would remain activated until the game is shut down or SR'd. Such codes allows for changing of wild encounters, encounter shinies, walk through walls etc. This is done via redirecting the ram of the game to constantly read the certain stats of a Pokemon in party, to constantly read the Pokemon's data itself as cheat codes. This is also known as cheats from stats. Anyhow, you gotta make sure the Pokemon with Cheats in Stats is ready, before you perform Cheats from Stats. Data Structure of Redirecting to Party Slot (Cheats from Stats) To activate Cheats from Stats, players need to perform 3 Box 1 Names activations (via TM17, of course). Note that, the underscore (_) below represents a space on the box naming screen.Use Slot 5 (as seen here? Box 1 - Name 1: _A?e09 Box 1 - Name 2: _A?f!/ Box 1 - Name 3: _A?d's♂ The 3 addresses above, (0xFF8A -> _A?e ) (0xFF8B -> _A?f) (0xFF89 -> _A?d) are areas in the RAM, and the 3 values (0xF5 -> 09) (0xDA -> !/) (0xC3 -> 's♂), Where 0xDAF5 is actually the address of Slot 5's HP EV. This means the cheats from stats will load from Slot 5's HP EV. In this scenario, I want to load the cheats from my Slot 3's HP EV instead, and according to the ram_map, the Slot 3's HP EV is at 0xDA95. Because of this thing called "endianness", where some data structures flip the front and back of data addresses, it'll be represent as 0xBack then 0xFront, as seen below. So 0xFF8A and 0x95 -> _A?e?p 0xFF8B and 0xDA -> _A?f!/ 0xFF89 and 0xC3 - > _A?d's♂ (unchanged) Using EVs and IVs are preferred, because most of the time the Pokemon's data stays legal, meaning it can be boxed, and the Pokemon can be reused another day, without having to retype the whole thing.   Data Structure of custom cheat in stats (Pokemon with Cheats in Stats) First, we got to understand how the game will read the data. The code typically ends up being: "Write" "Value" "to" "Address (with endianness)" "Terminate (if necessary)" For example, let's look at the "Catch Any Pokemon" code on psypokes: First, the 01 in 01xxEDD0 can be abandoned/ignored. (this holds true for most GB era gameshark codes) Next, if we wanted to meet Celebi with this gameshark code, it would have been 01FBEDD0 (0xFB being hexadecimal for 251). What you probably didn't know, is that 0xD0ED (endianness resolved) is actually the address for Wild Pokemon Species ID! (if you don't believe me, check the ram_map) Now, if we wanted to write our own cheat code for stats, this is how is it normally expressed as: "Write" "251" "to" "0xD0ED" "terminate" So how would that look like? Using the Pokemon's structure as reference: So once you've did the 6 Box 1 names + TM17 activations, your Pokemon in the third slot will have those EVs! As long as your Pokemon doesn't gain EVs, when you use Slot 3 Cheat from stats (previous section), Celebi will continue to be every wild encounter, until you shut off your game. Don't believe me? watch this clip: ezgif.com-resize(1).mp4 You may have noticed, that I didn't use TM17 on my 3rd line of activation, until I entered the grass. The cheat activated upon all 3 lines being activated, and the Celebis appeared! (also, I think the Lv 40 was a Raikou I've yet to catch, lol)   Another Example Here's another example, which would instead require the cheat to be read starting from Slot 3's Pokemon Species ID. It's called Illegally Expanded, as the stats will likely become illegal, and may be changed when stored into the PC.Cheats from Stats (Slot 3) Illegally Expanded 0xFF8A and 0x8A -> _A?e?e 0xFF8B and 0xDA -> _A?f!/ 0xFF89 and 0xC3 - > _A?d's♂ Encounter Wild Lv 100 Shiny Celebi If you understood the previous table with the data structure, you'll likely understand what I just pasted above. Basically, the full Pokemon stats will be a cheat code, that changes various things until the game is reset. Additionally, you'll notice that the Item on the Third Pokemon, also would control the Wild Encounter's species. The video below will show how the encounters change, when activated. ezgif.com-resize(2).mp4 The most notable thing in the video above (besides the horrible rendering; trying to keep the video small in size), is that Item swapping changes the species encountered, as mentioned earlier. Also, I made it so that when the code is active, your character's clothes turn blue. To revert back to original red, reset the game (code inactive) and fly away. If you want to know what items can trigger what species encounter, refer to the table on this page. If the item can't be held (example, key items), you can simply use the box name 1 to change the held item.   So at this point, you've learnt how to read from EVs or Pokemon ID, and how to edit to EVs or Pokemon ID. Here's also an excel file, that can be used as a template for creating Pokemon with Cheat Stats (as seen above)GS ACE conversion table.xlsx
×
×
  • Create New...