The PokéCommunity Forums  

Go Back   The PokéCommunity Forums > ROM Hacking > Research & Development
Sign Up Rules/FAQ Live Battle Blogs Mark Forums Read

Notices

Research & Development Got a well-founded knack with ROM hacking? Love reverse-engineering the Pokémon games? Or perhaps you love your assembly language. This is the spot for polling and gathering your ideas, and then implementing them! Share your hypothesis, get ideas from others, and collaborate to create!
Research & Development programs in this forum are subject to moderator approval before they are displayed.

Reply
 
Thread Tools
  #1    
Old June 28th, 2009, 06:50 AM
JPAN
pokemon rom researcher
 
Join Date: Dec 2008
After a long break, I came back today with a large document. Might I add, this document is still incomplete, but is an honest attempt at cracking this game.

This document I bring you is a List of All Special commands for Fire Red\Leaf Green and a small study on the Special and Special2 commands in XSE.

All of you must have worked at least once with this versatile command, that allows you to execute a pre-rendered function other than those of the script.
These commands range from small pieces of work, such as healing your pokemon, to more complex ones such as checking hardware. I shall make a brief explanation on how they work.
Special <special number> (0xaabb)
Code:
0x25 0xbb 0xaa
Special2 <variable number> <Special number> (0xvvww 0xaabb)
Code:
0x26 0xww 0xvv 0xbb 0xaa
Although slightly different in their making, they are both identical in nature. Special (also refered here as Special1) recives only the special you wish to perform. Special2 recieves also a variable to store a returned value.
Special1 and Special2 are interchangeable, meaning that using Special1 calls only for the execution of that special function for its effects, while Special2 also receives a value from the execution and stores it at the given variable.
When in doubt, using special2 will allow you to know if the function is meant to return something or not.
When searching for Specials that work in FR\LG, I found an interesting reaction from the return addresses.
Special functions can be divided in three cathegories:
The ones that return 9f69 (40809):
Code:
These are meant to be used with Special1, for their effects are what matter. 
Generaly they either return by themselves a value to the 0x800y familly (most often 0x8004,0x8005 or 0x800D)
The ones that return ADC1(44481):
Code:
These are special ones, for they seem to have fallen out of use from R\S, mostly because of the lack of real-time events,secret-bases and contests.
I Studied some of them through decompiling the ASM code, and all those I saw jumped to the same function, So I ruled them out as useless.
The ones that return other values:
Code:
These are meant to be called with Special2, as the value is what is important. 
Generaly, it's about reading values, not editing them.
Underneath, all of them function the same in the begining and in the end:
Code:
1. Special\2 found by script executer;
2. loads address based on Special appearece(special table pointer);
2.5. (the executer loads variable address in the 2nd case);
3. special number is loaded;
4. multiplies the number by 4 (adress byte size), adds it to the address loaded;
5. checks if bigger than address + (1BB*4). If not, load data from address(function address), then run it.
What the function do is what this document is all about.
This list here has all the specials I could understand what they were doing in game.
Spoiler:
Special Description *other data*
000 Heals pokemon
001 clears the variable given in special2 or all the usual variables if in special 1

Warp Commands
002 door warp script (fade black until finished warping)
003 same screen effect as 02. Peculiar behaviour, warps to last used warp, or to center-map if last change was made by a screen transition, or trapped in Battle link if used after game start

Link Commands
020 battle trough link. Stored in the same location as all other battle data
021 link start (trading)
022 faster link start (overwrites other commands)
023 save game popup
027 updates a copy of your party at address stored at 03005008 +0x38. the number of pokemon in that party copy is stored 4 bytes before the start
028 replaces your party with the one stored with the code above. If you never used special 0x27, the party is that of the last time you loaded the game
029 although it lets you select three pokemon, it shows not where they are stored, being nowhere on the usual variables(8000-800f)
02A Nice crash sound…
032 checks the data for the Enigma Berry, stored at (03005008) + 0x30ec. if the old, not E-reader one, returns 1, else 0

Trainer Commands
034 prints a buffered message, buffered by the trainerBattle command.
035 prints a buffered message, buffered somewhere by a different command from 34. Dpad-Sensitive.
036 returns the number of times the buffered trainer was fought. If bigger than 0, usually is followed by na end signal
038 plays buffered trainer music
039 used vs-seeker. placed in given variable if it was fought before or not
03B activates battle with buffered trainer

03C activates pokestorage menu

Double battle commands
03d checks for a single viable pokemon, that is, pokemon capable to fight. returns 0x1 to given variable if only one pokemon capable of fight is present, 0 otherwise
045 checks for all viable pokemon. result stored in given variable

Profile commands
05D save game popup
05F edit profiles. Which depend on 0x8004 value *Key: 0x0 = profile 0x1 = battle quote 0x2 = uppon wining 0x3 = uppon losing quote 0x4 = nine word message 0x5 and up, nothing*
060 displays profile, same key as 5f

Pokemon Size "mini-game"
077 Buffers Heracross in buffer 0x0 and its recorded size in buffer 0x1
078 checks Heracross size. returns to given variable 0x1 if there was no heracross, 0x2 if it was smaller, 0x3 if bigger and 0x4 if the same size. Updates record automatically
079 Buffers Magicarp in buffer 0x0 and its recorded size in buffer 0x1
07A checks Magicarp size. returns to given variable 0x1 if there was no Magicarp, 0x2 if it was smaller, 0x3 if bigger and 0x4 if the same size. Updates record automatically

Name Rater commands
07B checks pokemon nickname, buffers it and put 01 in given variable if it was never nicknamed
07C buffers pokemon name indicated at 0x8004 (nickname)
07D obtained in a trade checker

080 flushes random words into buffer 2

083 counts the number of pokemon in your party and places it on a given variable
084 same as 83
085 gives the number to the last pokemon on your party, to the variable passed

Map Commands
08D displays last processed message
08e Forces map refresh, that is, puts into effect all changes made by setmaptile command
08f Returns the player map position, the X to 0x8004 and the y to 0x8005. Coordinates are the same as the ones for the map in AdvanceMap.

094 Buffers a word based on gender, big guy if boy, big girl if girl
095 Buffers other words based on gender, daughter if boy, son if girl. These two commands may be harmless leftovers from R/S

09D old man battle
Name rater commands 2

09E nickname pokemon in party indicated by 0x8004
09F chooses a pokemon for a purpose and stores its position at 0x8004. works even with eggs

Trainer House Commands
0A3 checks the Trainer Card achievements (color and stars). Place the achievement number from 0 to 7 in 0x8004, and returned in a given variable 1 if completed
0A4 Places how many achievements you have in a given variable
0a5 Buffers the rival achievement trainer name to the 0x0 buffer. Mostly, your rival name, but LT Surge, Koga and Lance also appear.

Special Battle commands
0AB makes a random battle based on the Tree wild values
0B4 after battle, ceratin variables are set. b4 reads them and places on a given variable the status at battle end. *key 0x1 = fainted, 0x7 = captured, 0x4 = escaped*

Breeding center commands
0B5 Buffers the Daycare Pokemon name to the buffers 0x0 and 0x1
0B6 daycare status *key: 0x1 = one egg, 0x2 = one pokemon, 0x3 = two pokemon*
0b7 Clear egg flag and reset timer for another egg
0b8 Creates and gives away egg
0b9 Corrects, in your party, the egg given by 0xb8, adding all learnable attacks, including egg moves
0BA seems to register a pokemon number after reading from the party(with other special) and puts it in a variable. Returns 277 for Treeko, so real, in game number.
0BB removes pokemon stored at 0x8004 from party. Places it on the daycare center address (dynamic)
0BC A selection screen for pokemon with store instead of select, identical in use to 9f
0BD two slot selection screen that allows you to choose one of two pokemon on the daycare center. If no pokemon is stored there, blank name, lv0 male will appear.
0BE checks number of levels they grew in daycare and places it on given variable as well as in buffer2.
0BF calculates price on pokemon growth and places it on buffer2
0C0 gets pokemon back from daycare center (taken with bb). If 0x8004 is different from the slot number the pokemon is in, a bad egg is formed.
0c1 a "silent hatch" code, hatches an egg in your party indicated by 0x8004, even if not an egg (reset level to 5, changes met location, clears EVs)
0C2 hatches a pokemon in the 0x8004 given position, even if not an egg
0C4 shows battle records and time scores. varies with value on ox8004 *key:0x0 = battle records, else = time board*
0C5 checks if you have enough money to pay for pokemon return. If true, return 1 to given variable
0C6 charges the money calculated bf

Whiteout command
0C8 whiteout screen and carried to a pokecenter. Variables are cleaned, money is partially lost

Safari mode command
0CD start safari game. Upon end, teleported back to default map, even though you never went near it
0CE ends safari game. This end, not being the default call to script, lets you remain where you are

Pokedex evaluation command
0D4 seems to place on 0x8005 the seen pokemon and on 0x8006 the caught ones. Also places on 0x800c a number that might be pokemon the pokedex doesn't detect but were caught. if 0x8004 = 0, print kanto's values, 0x8004 != 0x0, national dex values
0D5 prints the pokedex evaluation. Number of pokemon caught is stored on 0x8004

Pc animation commands
0D6 flashes a tile that is one tile above the script. Used in pc scripts
0D7 switches a tile above script. Another animation

move deleter\reminder commands
0DB selects a pokemon, but no variable is updated
0DC shows moves from pokemon in 0x8004 and allows you to choose one, position placed on 0x8005
0DD deletes move that was suposedly chosen with dc
0DF places on last-result the number of attacks on a pokemon defined by 0x8004
0E0 opens up a menu to teach previously known attacks to pokemon (move reminder) pokemon used is stored at 0x8004
0E6 returns the slot of the first available attack. If all occupied, returns 3 to given variable

Wierd Commands
0e9 prepares the message "previously on your quest", as well as others saved from last playthrough
0ea & eb continue the previous command, but have some glitches
0EC depending on 0x8004, may crash (0x0), have a wild battle with the buffered wild pokemon (0x1) or start an item-forbidden Trainer match (0x2), all other values crash.
0EF clears party, erasing all pokemon. And this definitely erases them, as the code clearly only fills the places with 0's
0F1 after clearing all waiting data, shuts down the system internally with the Stop Bios command. Also, disables all interuptions, killing the game right there.
0F5 asks to select three pokemon, and places them in the given order(removing the remaining) - pokemon tower. Choose cancel to get all your pokemon back.
0F6 appears to return if a pokemon is able to enter the event
0F8 really wierd command, deletes part of your party except for some of those you chose in f5

Item storage
0F9 pc item storage menu with pc animation (your room)
0FA same as f9 but without pc animation
0FB town map

Trade commands
0FC checks the trade in 0x8004 and buffers the name of the wanted pokemon(0x0) and the given pokemon(0x1)
0FD gets the pokemon to trade and places it in 0x0202402c. Is in it's party form, that is, fully decrypted, 100 bytes.
0FE activates trade, gets pokemon from previous memory address Incomplete pokemon(80 byte form) crash when seen. If deposited and withdrawn, it's fixed
0FF checks pokemon in 0x8004's number and places it in given variable

pc menu
106 opens pc menu, no animations, returns 01 to given variable and ff to lastresult

Finishing commands
107 shows hall of fame thens returns you to pc menu
108 shows diploma for finishing kanto dex. Finishes script.
10F this is the function that is called by f1 to do the shuting down thing. Therefore, this crashes everything
110 saves hall of fame and plays ending

camera control commands
111 elevator scene + small animation
113 freeze screen, but only on scripts, not on signposts or people. Call again to unfreeze
114 unfreeze screen\camera. Works on all surfaces
11F returns to a variable the facing you had when activating the event

Pokemon check commands
126 Check first pokemon added EV's. if over 510, returns 0x1
12b Checks party for a grass pokemon. returns 0x1 if there is one.
12e Checks party for your kanto starter. 0x1 if you have it
130 See if there is room for pokemon in a box. returns 0x1 if there is.

132 shows current floor
136 use strenght sound

Wild battle commands
137 starts wild battle on ice. Uses everything the normal wild battle use
138 starts wild battle on normal terrain. Uses everything the normal wild battle use.
139 same as 138

Cave commands
13D flashes screen.
13E warps to last used warp
13F falls to last used warp
143 perfectly normal wild battle

147 checks your pokemon in position referenced by 0x8004 and returns to the given variable its pokemon number. returns 0x19c if an egg.
14C fades sound until it turns off. Only some soundeffects remain. Loses effect after leaving map.
153 checks your party for pokemon equipped with e-card berries. 1 to variable if it happens
156 ghost battle. If you have a shilp scope, it becomes the lv 30, uncatchable marowak. If not, the ghost will have the cry of the pokemon that was buffered.
157 activates bicycle
158 opens several different multichoice boxes depending on 0x8004 *key: 0x0 = badge talk; 0x1 = silph-co elevator; 0x2 = rocket elevator; 0x3 = celadon department store elevator; 0x4 = link options; 0x5 = pharmacy options?; 0x6 other elevator; 0x7 and up - return 0x7f to lastresult*
15C crashes game after executing whole script
15d buffers to buffer 0x0 the name of the last pokemon you encountered
15e checks if values 0n 0x8004 and 0x8006 add up to more than 9999 decimal.
15f checks pokemon number in party and places the function for the correct pokecenter animation. returns to given variable that number.

161 activates surf sprite
162 places the number of the starter you chose in a given variable
163 sees pokemon number 0x8004 in the pokedex
166 lets you nickname the pokemon in the box in 0x800f, slot 0x8010. Gives it the buffered name.

Wireless link mini game commands
16A checks for wireless connector, 1 if there, 0 otherwise. Places value on given variable
16B tries to link for a game of pokemon jump the rope
16C tries to link for a game of dodrio berry-picking
16D linking for union room
16E wireless status

16F activates national dex
171 makes it impossible to step through scripts with the D-pad. only works on Scripts (green S on Advance Map)

Fame checker commands
173 activates the info at the slot 0x8005, for person 0x8004
174 sets the pesron picture status. 0x8004 = pesron number, 0x8005 = set value. 0x1 = only shadow. 0x2 = correct picture

(cerulean) Daycare commands
176 Remove pokemon from party and store it in daycare.
177 buffers daycare pokemon name in buffer 0x0 and the money owed for it in buffer 0x1
178 checks if a pokemon is at the daycare. returns 0x1 if there is.
179 returns the levels grown and buffers the same data as 0x177
17a returns the pokemon kept there to the trainer. returns to variable the pokemon number

17B travels in the boat for vermillion
17c checks for a pokemon species in the party. pokemon number wanted is stored in 0x8004, returns to given variable 0x1 if there is one.
183 checks if someone is playing through wireless and buffers that player name. if none, the empty string is buffered
187 places value on given variable. Seems to be a error checker of some kind, for every time it returns 0x2, a script is called to end.

Fossil commands
18B shows fossil picture. Only works if 0x8004 is 0x8d or 0x8e. Position is stored in 0x8005(x) and 0x8006(y)
18C unshows picture

Move tutor commands
18D Accesses move tutor data and teaches that move to an allowed pokemon. Tutor placed at 0x8005
18E a menu to choose pokemon for something

191 SS Anne departure scene. With no boat, your sprite will follow it and disappear, making you invisible.
192 checks if you have any of the needed pokemon to play Jump the Rope minigame
193 checks if the national pokedex is active.
194 if used without 0x8004, clears all warps and reproduces buffered video all over the map. Entering any menu will blank the video, crashing the game on exit
195 pokemon jump records
196 buffers attacks to 0x0 if 0x121< 0x8004 <0x15a. attacks buffered are stored in a table. returns 0x1 if it buffered anything

Berry powder commands
19b checks if you have the berry pouch and at least a berry. returns 0x1 if true to given variable and to 0x800d
19C shows powder counter
19D hides powder counter
19e checks if powder is more or equal to the amount asked for in 0x8004. returns 0x1 to given variable if its true.
19f decreases the amount in 0x8004 to the powder counter. returns 0x1 to given variable if it didn't go negative.
1A2 shows berry crushing records

Old lady tutor commands
1a3 buffers the ultimate attack for the starters and prepares the right tutor. return 0x0 if no pokemon in your party can learn it.
1a4 after teaching, checks the value of the tutor and sets the respective flag to the attack. if all three attacks were taught, returns 1 to given variable

1A5 plays credits
1A6 berry-picking records
1A7 multichoice for the islands, varies with what's on 0x8004
1AB sound effect for deoxys triangles
1AE checks for illegal pokemon for the union room and places one if found on a given variable
1B0 checks if pokedex (national) is complete. 0x1 if true, placed on a given variable
1B2 places a red arrow at the pixel coordinates indicated by 0x8004(X) and 0x8005(Y). 0x8006 = 0 means turn on, or create a new one, 0x8006 != 0 means shut last arrow down

1B5 creates a tile animaiton one block left two-four up the player
1b6 checks if you have a dodrio in your party.
1B7 creates a tile animation two-six blocks right from the top-left corner of the screen
1bb Create a full, party ready pokemon, at the trade slot. 0x8004 = pokemon number, 0x8005 = pokemon level, 0x8006 = item held

Here, I place those I know what they do, but don't know what the offsets, flags and variables used mean in-game
Spoiler:
(address) = content of that address
004 Updates the value in 02031dbc by analizing the data from the party copy at (03005008)+0x38
005 Places a pointer to a function for posterior execution to 03000e84. The wierd part is that that function only kills itself, erasing the content of 03000e84.
01c stores in 0x0202271A 0x2233 if 0x8004 is 1, 0x2244 if 2 and 0x2255 if 5.
01d,01e,05c Same thing, but have some extra steps.
033 loads to r0 the value at 0x020386AC, which is returned to given variable
096 adresses a variable\flag that number is stored in 8004, and makes some ands and ors(sets ang checks)
0A6 checks if the 8th bit in var 0x4038 is on, if so, copies the content of (0300500c)+1c to var 0x4039
0a7 the opposite of 0xa6. copies the content (0300500c)+1c to 0x4039
0a8 activates the 8th bit at 0x4038
0a9 same as A6 + store same value on variables 0x6c-0x6f
0aa returns to given variable one of seven values stored at 0x08456934. attribute those values to 0x4038 as well. it's 0x8004 dependant.
0c3 0x8004 dependant. Checks what is at position 0x70 of the pokemon in the daycare.
0d8 updates the value of 0x403a, vased on the value at (0300500c)+0x12
0e3 returns 2 to variable if the value in 0x2037078 ends in 6. 0x02037078 is the character speed control. bit0 = walking, bit1 = using bike, bit3 = ???
0e7 change value at var 0x4000 depending on the value of (300500c)+55e
11e updates and changes random seed, but other than that, seems to have no inherent use
125 sets flag 0x83b and executes special 0x124
142 sets var 0x4010 to 0x12. seems incomplete, as it loads values that never uses.
15b calculates values and uses 0x8004 and 0x8005 to save it. besides, 0x8004 is the result of the first function, and the 0x8005 is the result of the function that, in a table, is that number.
165 if flag 0x843 is set, returns 0, if not checks a byte in the Pokemon storage, and if different to the content of var 0x4037, set the flag and return 1.
167 changes a bunch of variables in the 4043 range. 4042 is a copy of 0x8004 at that time
168 places value on given variable. also changes values of several variables (417d o 0x8004 and 0x8006, ffff 0n 0x8005)
170 sets values on 0x020370a0 and 0x03000f9e, but don't stay until the end of the script
17d changes the value at 0203b0ec to the content of 0x8004. it seems to be related to the condition of the map (inside, outside, center, shop, forest, cave...)
17e reads the value at 03005ea0 and places it on 0203b0ec
17f reads the value at 0203b0ec and places it on 03005ea0
181 sets 2 flags at [0300500c]+a8 (5th and 6th)
182 sets the previous flags and places a function for further execution
188 usualy clears the values at 0203ae04 and ae08, but also may, if the values are right, change the value of 0203ae8c, which is a pointer to the RAM. is used before every legendary battle.
18f sets the flag 500+(020386ae)
197 a large list of comparisons to the target pokemon. Places 0 in 0x404e in any event
198 stores 0 in 0x3005ecc
199 if 0x0203adfa is smaller than 3, set the above to 1
19a sets a flag in (0300500c)+9 and sets flags 1,2,3 and 31 on (0300500c)+A8
1a9 compares values from 0x8004 and 0x8006 and returns specific values: returns 1 if either var is 8,7 if either var is 0, A if either var is 9, c if either is A, 2 if smaller than 2, 3 if smaller than 5, five if smaller than 7 and 6 if not any of the above
1aa returns the lower 4 bits of (02036e38 + (0203707d)+ 18)
1ad 1 if (03005008)+8 == 0x503 and (03005008)+ 0x503 > 17, 1 otherwise
1b1 check if [03005008]+8 is equal to 0x0a02
1b8 sets the value of 0x02039a0e depending on the value of itself and 0x02039a10
1b9 clears one of the flags A4-AC, depending on the values at [03005008]+1200 and [0300500c]+ f20.
1ba sets function 0x80cd1cc to be executed

There are the ones I have no idea what they do. If any of them sound familiar, post what it does so it might be added.
Spoiler:
02A
037: uses 03005090
03a
093: uses (3005008)+a
099
0c7: loads a function for later execution. sets a byte in 0x300ea8 (script related) to 1, which only happens when in wait for a result of a function.
0ed: accesses (300500c)+55e
0ee: similar to the one before in structure
0f0: accesses (300500c)+55e
0f2: access to the (300500c)+ 55c or (300500c)+ 0x570
0f3: access to the (300500c)+ 55c or (300500c)+ 0x570
0f4: access to the (300500c)+ 55c and party address
11d: copies 4 bytes off (300500c) + 4a4 to display
127
128
129: accesses var 4031, the var that keeps the starter pokemon chosen
134
135
13a: uses 0x3005074
148: checks something on party pokemon
14b
14f
150
152
159: store function for posterior use
15a: store function for posterior use
164
169
172: store function 0810c3b8, with 0x50 as an argument, for posterior use
175: checks a number of pokemon status, and then loads an encription key, applies it and buffers the result
180
184
185
186: apparently is a memory allocator, for a quantity defined by last_result, returns 0 is successful
190: related to PC script
1a0: makes some checks and recalculate some keys, but I can't grasp why it's needed
1a1:stores several functions for near use, and is dependant on flag 0x3 and [03005008]+8 (=or != 4f01)
1AC works with the value at 0x403e


Just for completion, or if anyone wants to test them out, these are the specials that return ADC1:
Spoiler:
006 --> 01b
024 --> 026
02B --> 031
03E --> 044
046 --> 05B
061 --> 076
07e,07f,081
086 --> 08c
090 --> 092
097,098
09a --> 09c
0A0 --> 0A2
0Ac --> 0B3
0C9 --> 0CC
0CF --> 0D3
0D9,0DA
0E1,0E2
0E4,0E5
0F7
100 --> 105
109 --> 10D
112
115 --> 11C
120 --> 123
12A
12C,12D
12F
131
133
13B,13C
140,141
144 --> 146
149,14A
14D,14E
151
154

That's it for now. I hope you find this document helpful. I may return to post some more in-detailed analysis of this code to the more practice-oriented.

thanks to liuyanghejerry for the use of Special 0x39

Last edited by JPAN; August 14th, 2009 at 12:31 PM. Reason: All specials analized
Reply With Quote
  #2    
Old June 28th, 2009, 09:21 AM
o0oBahamuto0o
Beginning Trainer
 
Join Date: Apr 2008
Gender:
Nature: Lonely
Send a message via Yahoo to o0oBahamuto0o
I bet you have a lot of exp from this . Thanks dude !
Reply With Quote
  #3    
Old June 28th, 2009, 05:06 PM
liuyanghejerry's Avatar
liuyanghejerry
Trainer
 
Join Date: Jan 2008
Location: China,Xi'an
Nature: Calm
Send a message via ICQ to liuyanghejerry Send a message via Windows Live Messenger to liuyanghejerry Send a message via Yahoo to liuyanghejerry
I love this thread,really.It brings new blood into scripting.
Keep going,my friends.
And I can do some test for you, if you need.
__________________
Zel,thethethethe,LU-HO,Darthatron,HackMew,ZodiacDaGreat,Juan,score_under,JPAN,Tamah-chan,I really appreciate your kindness and your help!:D


I did something that really bad.But made all Chinese can hack Pokemon, too.If you guys hate me, I totally understand,but cannot do anything but force to keep everything.
If there must be someone to undertake all spit and curse, it must be me.
Reply With Quote
  #4    
Old June 28th, 2009, 06:37 PM
.Seth's Avatar
.Seth
.explorer.
 
Join Date: Jun 2008
Location: A capacitor in a power supply board.
Gender: Male
Nature: Quiet
This is a very nice document. I might add this to my upcoming scripting tutorial, if it's alright with you, of course.

I'm just wondering, would it possible to use special2 to store a variable into something like LASTRESULT to use for things like yes/no scripts, and other things?
Reply With Quote
  #5    
Old June 29th, 2009, 02:00 AM
liuyanghejerry's Avatar
liuyanghejerry
Trainer
 
Join Date: Jan 2008
Location: China,Xi'an
Nature: Calm
Send a message via ICQ to liuyanghejerry Send a message via Windows Live Messenger to liuyanghejerry Send a message via Yahoo to liuyanghejerry
Quote:
Originally Posted by Raikou-san View Post
This is a very nice document. I might add this to my upcoming scripting tutorial, if it's alright with you, of course.

I'm just wondering, would it possible to use special2 to store a variable into something like LASTRESULT to use for things like yes/no scripts, and other things?

Yes, you can.LASTRESULT is a var too.But it will return not only 1,0,but also other hex numbers.
__________________
Zel,thethethethe,LU-HO,Darthatron,HackMew,ZodiacDaGreat,Juan,score_under,JPAN,Tamah-chan,I really appreciate your kindness and your help!:D


I did something that really bad.But made all Chinese can hack Pokemon, too.If you guys hate me, I totally understand,but cannot do anything but force to keep everything.
If there must be someone to undertake all spit and curse, it must be me.

Last edited by liuyanghejerry; June 29th, 2009 at 02:03 AM. Reason: add quote
Reply With Quote
  #6    
Old July 1st, 2009, 10:08 PM
liuyanghejerry's Avatar
liuyanghejerry
Trainer
 
Join Date: Jan 2008
Location: China,Xi'an
Nature: Calm
Send a message via ICQ to liuyanghejerry Send a message via Windows Live Messenger to liuyanghejerry Send a message via Yahoo to liuyanghejerry
Sorry for double reply,but I do have one thing to say.
I just found that in FR/LG,special2 0x39 is for about VS Seekers.
When returns 0x1,it means player has used VS Seekers in this place.
example:
Code:
'script from BPRE at 0x1A9CBF
#org @start
trainerbattle 0x0 0x103 0x0 @string1 @string2
special2 0x800D 0x39
compare 0x800D 0x1
if 0x1 goto @snippet1
msgbox @string3 0x6 '"You can't be a coward in the world..."
end

'---------------
#org @snippet1
trainerbattle 0x5 0x103 0x0 @string4 @string2
msgbox @string3 0x6 '"You can't be a coward in the world..."
end


'---------
' Strings
'---------
#org @string1
= Competition!\nI can't get enough!

#org @string2
= I had a chance!

#org @string3
= You can't be a coward in the world\nof POKéMON!

#org @string4
= Competing is the ultimate thrill.\nI still can't get enough!
__________________
Zel,thethethethe,LU-HO,Darthatron,HackMew,ZodiacDaGreat,Juan,score_under,JPAN,Tamah-chan,I really appreciate your kindness and your help!:D


I did something that really bad.But made all Chinese can hack Pokemon, too.If you guys hate me, I totally understand,but cannot do anything but force to keep everything.
If there must be someone to undertake all spit and curse, it must be me.

Last edited by liuyanghejerry; July 1st, 2009 at 10:08 PM. Reason: correct
Reply With Quote
  #7    
Old July 28th, 2009, 12:11 AM
0m3GA ARS3NAL's Avatar
0m3GA ARS3NAL
Im comin' home...
Community Supporter Tier 1
 
Join Date: Jan 2008
Location: Superjail Penitentiary
Age: 22
Gender: Male
Nature: Gentle
Ahh, JPAN, you never cease to amaze me.
I looked over this bit of info, and am impressed!
Maybe you could even fix your ASM stuff... (I'll send you a PM)
__________________
>Boot Jailbot
>Pass *****
.
.
Jailbot OS Ver 1.1.2
Greetings Warden
of Superjail Penitentiary
Awaiting user input...

>Display User_Info
╠══User Info══╣
Username:
0m3GA ARS3NAL
Age: 18
Sex: Male ♂
Race: Caucasian
Quote:
"What is this
I don't even..."

M/O: Often acts out to get attention, but recently has changed that. Has been studying up on hacking information and hopes to participate in more advanced hacking discussion.
╠══End of File══╣
Awaiting user input...

>
Reply With Quote
  #8    
Old January 15th, 2011, 04:30 AM
knizz's Avatar
knizz
 
Join Date: Aug 2007
Special 18F sets the trainer-flag of the last opponent. I haven't checked whether it's correct yet.
__________________
Firered IDA 6.1 DB: https://www.dropbox.com/s/hvvmxxoo1dkmdzc/firered.idb
VBA-M with lua scripting support (no longer in development)
Reply With Quote
  #9    
Old September 4th, 2011, 07:07 PM
DavidJCobb
RESIDENT RAAAAAAAAAAAAGEMASTER
 
Join Date: Jul 2010
Gender: Male
Nature: Lonely
I think I've identified a few more specials by looking at FireRed's default scripts. My findings:

D8
This special updates the value of script variable 0x403A, which seems to indicate the current floor. It is used by elevator scripts.

1B8
Called when an elevator script needs to know what floor should be the default in an upcoming multichoice2. It returns 0x0, 0x1, or 0x2 (going as high as there are floors?).

160
Called after the player selects a floor. It appears to generate a message box depending on the player's selection (though the messagebox is immediately hidden with releaseall if the player chose the floor they are already on). Does it accept 0x8006 as the floor the player has selected?

1A1
I don't know what it does, but I do know that it is called by level scripts in the chambers for each Elite Four member. It appears to take variable 0x8004 as input -- 0x8004's value seems to denote which Elite Four chamber you're in.

29
Specifically, this is used to select which 3 you'll use in a (EDIT) four-player link activity (four-way battle?).

83
Used in the Daycare Man egg-giving script. It appears to check how many Pokemon are in the player's party (between 0 and 6), returning that number to the supplied variable.

94
It's not from R/S, but it is a leftover. It's called in the script for Lostelle in Berry Forest, but the buffered strings aren't used. (Perhaps in other languages, they are used?)

A9
I don't know what it is, but it's called in the Hall of Fame registration room level scripts.

127
Called when talking to the woman in the Link Battle/Trade rooms -- just before she asks you to take your seat.

128
Called when talking to the woman in the Link Battle/Trade rooms -- just after she asks you to take your seat.

135
Part of Level Script 1 in ICEFALL CAVE (1.111). It appears to play a part in managing the breakable ice tiles.

165
Part of Pokemon-giving scripts when a Pokemon received via "givepokemon" is sent to the PC.

18A
Apparently returns the number of the currently-selected box in the PC. It is used by scripts when the player receives a Pokemon via "givepokemon" and the Pokemon was sent to a different PC box because the currently-selected one was full.

194
Unknown. Used in many TRAINER TOWER scripts. Before it is invoked, 0x8004 is set to some value (I've seen 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0xA, 0xB, 0xC, 0x10, 0x12, 0x13). It APPEARS to return a value in some cases (0x0, 0x1, or 0x2). It may also take 0x8005 and 0x8006 as input.

1BA
Used twice when stepping on the script tile that triggers the HO-OH encounter on NAVEL ROCK. Does it toggle camera movement without locking all OWs?

1BB
Sometimes used with 1BA.

EDIT:

AB
Triggering a Tree wild battle isn't the only thing this function does. It will actually decide at random whether or not to trigger the battle. If no battle is triggered, 0x0000 is written to script variable 0x800D (LASTRESULT). If a battle is triggered, 0x0001 is written (so that the script calling this special knows to use waitstate).

EDIT2:

196
I think it checks if var 0x8004 is the item ID of a TM, and if so, it buffers the attack that the item teaches. I think it's used upon picking up a TM (base script: 0x081A67B3).

15E
This is used in the internal script that the game calls when the player presses A on a hidden-item Signpost event. If the item found has index 0 (item: ????????), then it is treated as a Coins pickup, and this special is used to check if the player can carry the found coins.

17D
This is also used in PC scripts, and appears to use variable 0x8004 as an argument. 0x1B represents the PC and 0x1F represents the Hall of Fame display?

185
Unknown, but it's used in the Mystery Gift questionnaire script.

C7
Called from the internal script used when the player whites out (0x081A8DFD). It sets LASTRESULT; if LASTRESULT is set to 0x1, the calling script will attempt to take money from the player.

175
Called from the internal script used when the player whites out. It takes money from the player and buffers the amount taken to buffer 0.

5
Appears to terminate a link. Called by a script at 0x081BB9D4.

18F
Called after an endtrainerbattle2 command buried in some scripts I can't make sense of. According to the OP it sets flags above 0x500 -- trainer flags.
__________________

Last edited by DavidJCobb; September 8th, 2011 at 11:09 AM.
Reply With Quote
  #10    
Old September 23rd, 2011, 10:01 PM
DavidJCobb
RESIDENT RAAAAAAAAAAAAGEMASTER
 
Join Date: Jul 2010
Gender: Male
Nature: Lonely
Special 135 appears to be related to Icefall Cave. It's used in a level script, and some really complicated functionality that manages its breakable ice tiles (using cmda6) sets some flags... I think that special 135 either reads certain flags (to check which ice tiles have broken, and re-break them on map entry) or writes certain flags (to reset the ice tile flags, thereby unbreaking them on map entry).
__________________
Reply With Quote
  #11    
Old March 29th, 2012, 07:41 PM
YouListeningROMs's Avatar
YouListeningROMs
Beginning Trainer
 
Join Date: Mar 2012
Gender: Male
With the "special 0x163" command, does that return any values, saying if it is seen or caught, perhaps?
Reply With Quote
  #12    
Old March 30th, 2012, 02:23 PM
droomph's Avatar
droomph
mmm gurl that 90s
Community Supporter
 
Join Date: Sep 2011
Location: bar'jách
Age: 17
Gender: Male
Nature: Impish
No, it only returns a number depending on what happened, and you have to make it display the message depending on the number.
__________________
did u no there r 21 letters in the alphabet
o i forgot 5
uraqt


Reply With Quote
  #13    
Old March 30th, 2012, 04:13 PM
YouListeningROMs's Avatar
YouListeningROMs
Beginning Trainer
 
Join Date: Mar 2012
Gender: Male
Quote:
Originally Posted by droomph View Post
No, it only returns a number depending on what happened, and you have to make it display the message depending on the number.
Well, if you're saying what I think you're saying, then I was right. I didn't necessarily mean "saying" more than "indicating"? What values does it return and to where?
Reply With Quote
  #14    
Old March 30th, 2012, 04:49 PM
droomph's Avatar
droomph
mmm gurl that 90s
Community Supporter
 
Join Date: Sep 2011
Location: bar'jách
Age: 17
Gender: Male
Nature: Impish
Quote:
Originally Posted by YouListeningROMs View Post
Well, if you're saying what I think you're saying, then I was right. I didn't necessarily mean "saying" more than "indicating"? What values does it return and to where?
Well, you specify which variable, provided you're using special2. Then it returns value to it, and you do to it whatever you like, like maybe have a tea party with it.
__________________
did u no there r 21 letters in the alphabet
o i forgot 5
uraqt


Reply With Quote
  #15    
Old March 30th, 2012, 07:27 PM
YouListeningROMs's Avatar
YouListeningROMs
Beginning Trainer
 
Join Date: Mar 2012
Gender: Male
Quote:
Originally Posted by droomph View Post
Well, you specify which variable, provided you're using special2. Then it returns value to it, and you do to it whatever you like, like maybe have a tea party with it.
While you might enjoy the tea party scene, I was thinking of using it to implement a HG/SS style "Catch Legendaries you accidentally killed/didn't have the Balls to capture" system using this special on a map script to make the legendary reappear or to clear the flag of the script event. You know, practical stuff that doesn't involve tea.
Reply With Quote
  #16    
Old March 30th, 2012, 09:16 PM
droomph's Avatar
droomph
mmm gurl that 90s
Community Supporter
 
Join Date: Sep 2011
Location: bar'jách
Age: 17
Gender: Male
Nature: Impish
Quote:
Originally Posted by YouListeningROMs View Post
While you might enjoy the tea party scene, I was thinking of using it to implement a HG/SS style "Catch Legendaries you accidentally killed/didn't have the Balls to capture" system using this special on a map script to make the legendary reappear or to clear the flag of the script event. You know, practical stuff that doesn't involve tea.
Well, if you check the scripts for the legendary OWs, you will find that they have a system of specials that check, with much more ease, what you have done to the Pokémon.

I can't remember off the top of my head, but that's pretty much what you could do for that.
__________________
did u no there r 21 letters in the alphabet
o i forgot 5
uraqt


Reply With Quote
  #17    
Old April 23rd, 2012, 09:42 AM
Zilvereyes's Avatar
Zilvereyes
Beginning Trainer
 
Join Date: Mar 2012
Location: Denmark
Age: 34
Gender: Male
Send a message via Skype™ to Zilvereyes
Just adding a unknown special2:

14F = completed all 150 pokemon in pokedex.
(Pokemon - Fire Red 1.0)

Source inside spoiler
Person event person found in CELADON CITY (10,9)
Person event: 1
Person event no: 2
Spoiler:

#org 0x16C3F6
lock
faceplayer
special2 LASTRESULT 0x14F
compare LASTRESULT 0x1
if 0x1 goto 0x816C412
...

#org 0x16C412
goto 0x816C418

#org 0x16C418
preparemsg 0x81963CD '"Wow! Excellent!\nYou completed you..."
waitmsg
pause 0x3C
special 0x187
compare LASTRESULT 0x2
if 0x1 goto 0x81A7AE0
special 0x108
waitstate
release
end
__________________
Zilvereyes - Newbie
Hacking: Pokémon Fire Red

[Guides]:
Adding 0x0 - 0x57 Name Header to FireRed - Incomplete (Still working on it though [10-05-2012])
Reply With Quote
  #18    
Old May 25th, 2012, 02:29 PM
redriders180's Avatar
redriders180
Mastermind of Pokemon Glazed
 
Join Date: Jun 2010
Location: Path of Victory, Tunod
Gender: Male
Nature: Quirky
Send a message via AIM to redriders180 Send a message via Skype™ to redriders180
I really hope that I won't get penalized for posting here...

I think I have what the use of two other specials are.
Special 0x129 activates the roaming legends. It uses variable 0x4031 to determine which will roam. I tested this out by activating the special, and "faking" a battle with the legend using the wildbattle command. The icon then showed up on the World Map, indicating where it was.

I think Special 0x175 is used to calculate the amount of money dropped when you whiteout. In the whiteout script, Special 0x175 is called, and immediately following is the "player dropped $[buffer1]s" message. You mentioned how the Special 0x175 buffers a calculated value, so it seems like this is a likely reason for it. I could be wrong, though, since the amount of money lost is based on level of Pokemon and number of badges, not status.
__________________


Superfan of Pokemon Glazed? Click here to join the official Pokemon Glazed Facebook Page!

Thank you for hatching the eggs!
Please view these dragons! Just click them and you're done!
If you don't help them grow up, they'll die...


Reply With Quote
  #19    
Old April 18th, 2013, 02:04 PM
LocksmithArmy's Avatar
LocksmithArmy
Mew!
 
Join Date: Feb 2013
Age: 25
Gender: Male
I belive:

14F: Checks if KantoDex is Complete (Returns 1 if it is complete)

it is used by the "Game Designer" in Celadon Mansion
__________________
Reply With Quote
  #20    
Old August 10th, 2013, 02:03 PM
Spherical Ice's Avatar
Spherical Ice
 
Join Date: Nov 2007
Location: UK
Send a message via Skype™ to Spherical Ice
1ab actually controls most of the Birth Island puzzle.

Every time the player hits the Triangle from the right angle/amount of steps (not sure which) 0x8000 is set to 0x1. If the player gets it wrong/takes too long, it is set to 0x0. Once the puzzle is completed, it is set to 0x2. Every time after, it is set to 0x3.
__________________
Reply With Quote
Reply
Quick Reply

Sponsored Links
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Minimum Characters Per Post: 25



All times are UTC -8. The time now is 02:58 AM.


Style by Nymphadora, artwork by Sa-Dui.
Like our Facebook Page Follow us on Twitter © 2002 - 2014 The PokéCommunity™, pokecommunity.com.
Pokémon characters and images belong to The Pokémon Company International and Nintendo. This website is in no way affiliated with or endorsed by Nintendo, Creatures, GAMEFREAK, The Pokémon Company or The Pokémon Company International. We just love Pokémon.
All forum styles, their images (unless noted otherwise) and site designs are © 2002 - 2014 The PokéCommunity / PokéCommunity.com.
PokéCommunity™ is a trademark of The PokéCommunity. All rights reserved. Sponsor advertisements do not imply our endorsement of that product or service. User generated content remains the property of its creator.