Notices
For all updates, view the main page.

 Tools, Tutorials & Resources Various tools to help you develop your hacks can be found here.New threads in this forum are to be approved by a moderator before they are displayed.

#1
October 30th, 2010 (12:44 AM). Edited July 21st, 2012 by miksy91.
 miksy91 Dark Energy is back in action! ;) Join Date: Oct 2008 Location: A small country in the North Gender: Male Nature: Relaxed Posts: 1,432
Here is a tutorial of editing GB/C pointers.
I couldn't find any of these explaining things more than just briefly so I decided to make my own with more examples in it.

Updated pointer tutorial (21.7.2012)

Let's get started with the basics. Pointers are basically two-byte values and as you may be able to guess, they're used to pointing to different kinds of data. What you probably want to know is how to calculate them.

Calculating the offsets where pointers point to is easy. For example 2A 88 points to \$882A but this offset here is a memory address in RAM. Same way, 13 3A points to \$3A13 and 10 D0 to \$D010. The problem is, how to calculate pointers which are used for looking data inside ROM ?

GB/C RAM works like this:
\$0000-3FFF - ROM bank 0x0
\$4000-7FFF - Variable ROM bank
\$8000-9FFF - Video RAM
\$A000-BFFF - Save RAM
\$C000-CFFF - RAM
\$D000-DFFF - WRAM
\$E000-FEFF - Echo RAM
\$FF00-FF7F - I/O Registers
\$FF80-FFFF - HRAM

Basically, the RAM area between \$4000 and \$7FFF is the one you want to access with pointers pointing inside ROM (in case you're not calling some assembly code from ROM bank 0 for instance but you should know all this if you're even planning to do that). This RAM area between \$4000-7FFF is 0x4000 bytes long which is as large as each ROM bank inside a ROM file.

For example in Pokemon Gold (U) ROM, there is lots of blank data (data filled with 00 00 00...) starting at 0x109DCA. If we for example wanted to input some script data in there and make the script pointer of some random person look for the script data in this rom area, we'd have to find the right pointer to it. This rom bank we're in starts at:

0x109DCA / 0x4000 = 0x42 (if your Calculator shows some digits after a comma here, ignore them and just use the integer in the following calculation)
0x42 * 0x4000 = 0x108000

So our rom bank starts at 0x108000 and as rom banks are 0x4000 bytes long (as explained above), this rom bank ends at 0x10BFFF. Basically, when data is looked for in this rom bank, 0x4000 bytes starting at 0x108000 are copied to \$4000 in RAM (\$4000-7FFF).

Basically, we can use a calculation like this to find the pointer leading to 0x109DCA:
0x109DCA - 0x108000 + 0x4000 = 0x5DCA --> 5D CA

And as explained way above, we'll have to rotate the bytes around to find the pointer that leads to the wanted ram address and so we'll get: CA 5D.

So to look for script in 0x109DCA, you'll have to change the script pointer of this random person, I was talking about earlier, to CA 5D. This of course demands that the script pointer (along with his other event data which is no way related to this thread) is in the same rom bank (between 0x108000-10BFFF).

Because there are more rom banks than just rom banks 0x0 and 0x1, there has to be a way for moving on from rom bank to another. This is often done by calling a specific assembly routine by first loading register a with the byte of the rom bank and register pair hl with the 2-byte pointer to that rom address. You may not have understood a thing about that but it's okay, you won't need that info here :D

Anyway, in the explanation above, I explained how to define the 2-byte pointer pointing to a specific rom/ram address. This time, let's define where a specific "3-byte pointer" points to (we like calling them 3-byte pointers because they also consist of a byte of the accessed rom bank).

Let's pretend we had a pointer of this kind:
A7 48 3A in which A7 48 is the pointer to the accessed rom data and 3A the byte of the accessed rom bank. The offset where this pointer leads is then:

0x3A * 0x4000 + 0x48A7 - 0x4000 = 0xE88A7

Of course when this rom address is accessed, \$E8000-EBFFF is again copied into RAM (\$4000-7FFF), and we're currently pointing to ram address \$48A7.

Notice that all GB/C pointers are formed with two bytes! The rom bank byte itself is used in a specific assembly routine to define the accessed rom bank and doesn't have to be next to the two-byte pointer. Basically in rom you could also find a 3-byte pointer this way:
[2-byte pointer] [xx bytes data] [Rom bank]
__________________
My Rom Hack

CP of encountered pokemon in GO

Learn how to hack GB/C games:

Check my GameBoy/Color hacking videos in Youtube
-The video set uses Pokemon Silver (U) rom for demonstrations

#2
July 21st, 2012 (1:49 AM).
 miksy91 Dark Energy is back in action! ;) Join Date: Oct 2008 Location: A small country in the North Gender: Male Nature: Relaxed Posts: 1,432
This old, "buggy" tutorial has been completely redone!
Back in middle 2010, I didn't clearly understand enough of pointers to write a good documentation about them but now there is.

Some feedback from those who read this would be appreciated. Is it easy enough to keep up with?
__________________
My Rom Hack

CP of encountered pokemon in GO

Learn how to hack GB/C games:

Check my GameBoy/Color hacking videos in Youtube
-The video set uses Pokemon Silver (U) rom for demonstrations
#3
April 11th, 2014 (3:26 PM).
 com3tiin Soy chamber... Join Date: Jan 2013 Gender: Male Posts: 113
\$4000-7FFF - Variable ROM bank is the same that ROM, no?
__________________
#4
April 12th, 2014 (12:33 PM).
 adrift floating... floating... gone... ModeratorCS Join Date: Mar 2010 Age: 19 Nature: Quirky Posts: 3,392
I like this tutorial! Very easy to understand, I think, but that may just be me.

For those that don't get it, think of it this way:
Pointer = (Offset % 0x4000) + 0x4000
Bank = Offset / 0x4000

Offset = (Bank * 0x4000) + (Pointer % 0x4000)

NOTE: % is the modulo operator!
__________________

mod github pair
#5
April 13th, 2014 (6:20 AM).
 miksy91 Dark Energy is back in action! ;) Join Date: Oct 2008 Location: A small country in the North Gender: Male Nature: Relaxed Posts: 1,432
Quote:
 Originally Posted by com3tiin \$4000-7FFF - Variable ROM bank is the same that ROM, no?
One of the rom banks (apart from rom bank 0 which is at 0x0-0x3FFF in rom) is accessable at the time, and it can be pointed to with pointer values that are between 00 40 and FF 7F (because those pointers point to addresses \$4000-\$7FFF).

This is also why all the pointers are two bytes long. So when we have to point to an address that is in different rom bank, we'll have to change this variable rom bank to something else (doable with a routine that's in rom bank 0), and then we can point to the addresses of that rom bank with pointer values 00 40 to FF 7F.

Quote:
 Originally Posted by itari I like this tutorial! Very easy to understand, I think, but that may just be me. For those that don't get it, think of it this way: Pointer = (Offset % 0x4000) + 0x4000 Bank = Offset / 0x4000 Offset = (Bank * 0x4000) + (Pointer % 0x4000) NOTE: % is the modulo operator!
That's a pretty good way of summing it up
__________________
My Rom Hack

CP of encountered pokemon in GO

Learn how to hack GB/C games:

Check my GameBoy/Color hacking videos in Youtube
-The video set uses Pokemon Silver (U) rom for demonstrations