After applying MdDS 1.5a to a clean BPRE 1.0, themn I applied JPAN's FRHE using the Hack tool. I have found an bug in the specials introduced by FRHE to read pokemon data:
Special 0x06 correctly stores the pointers to decrypted pokemon data at Adress 0x0203f464 as expected. However, when trying to read them using special 0x7 (read EVs) to 0xE (read held item), the game crashes. mGBA gives an error, usually stating that the game is calling to BIOS. The change values specials (change IVs, species, etc) work correctly.
To rule out the posibility that there was some kind of error in the hack tool, I used it on a fresh BPRE 1.0 and there it works perfectly. In fact, I have checked that the tool does the same in both MrDS base and BPRE 1.0, for special 0x7 it writes a pointer at the offset 0x15fd7c (i supose that it is a pointer in the special table pointing to the routine), and then at that offset it writes 06 B5 05 4A 11 88 05 48 0B 29 03 DC 6C 30 00 68 40 18 00 78 06 BD 00 00 C2 70 03 02 00 F4 03 02 (I think that it is the routine).
Maybe JPANs routine my be incompatible with some of the changes MrDS made?
I'd appreciate help to understand what may be happening.