• Our software update is now concluded. You will need to reset your password to log in. In order to do this, you will have to click "Log in" in the top right corner and then "Forgot your password?".
  • Forum moderator applications are now open! Click here for details.
  • Welcome to PokéCommunity! Register now and join one of the best places on the 'net to talk Pokémon and more! Community members will not see the bottom screen advertisements.
  • Want to share your adventures playing Pokémon?
    Check out our new Travel Journals forum for sharing playthroughs of ROM Hacks, Fan Games, and other Pokémon content!
  • IMPORTANT: Following a takedown request, the following hacks have been delisted from PokéCommunity:

    • Pokémon Glazed
    • Pokémon: Giratina Strikes Back
    • Pokémon Flora Sky
    • Pokémon Stranded
    The downloads and discussion threads for these hacks will no longer be accessible, and staff will be unable to return questions regarding accessing this content.

Quick Research & Development Thread

5,256
Posts
16
Years
Special 0x167 is used by the printer in the Game Corner in vanilla FireRed to add the icons of your party to your Trainer Card.

Vars 0x4043 - 0x4048 correspond to the six Pokémon icons on the back of the Trainer Card. You can change them at x89a78, but note that special 0x167 assumes they will be consecutively stored (and it will take the starting variable as the one stored at xCC3C0. 0x4042 is also used by the special, but it just appears to be a clone of 0x8004, which determines what colour the icons should use.

0x4049 - 0x404B controls the three stickers on the back of the Trainer Card. You can change them at x89a6c. They're checked by the script of the sticker kid on Four Island, too, so just change them there like usual too.
 
Last edited:

Trainer 781

Guest
0
Posts
This post is a little extension to JPAN's document on Battle Structs for Fire Red (link here). The bolded ones are the new ones found during my research.

Spoiler:

I'll update this post after researching more locations.
 

GoGoJJTech

(☞゚ヮ゚)☞ http://GoGoJJTech.com ☜(゚ヮ゚☜)
2,475
Posts
11
Years
Code:
[10:59:13 PM] GoGoJJTech: [url]http://sphericalice.com/romhacking/documents/script/#c-D5[/url]
[10:59:20 PM] GoGoJJTech: pokemon emerald 0x26E331
[10:59:24 PM] GoGoJJTech: I think it's the trick house
[10:59:41 PM] GoGoJJTech: map 29.9
[10:59:45 PM] GoGoJJTech: script tiles
[10:59:50 PM] GoGoJJTech: essentially this happens:
[11:00:19 PM] GoGoJJTech: [url]http://hastebin.com/xuqoduhaho.hs[/url] (in xse)
[11:00:33 PM] GoGoJJTech: if we take into account that cmdd5 has no arguments, it'd appear as so:
[11:00:56 PM] GoGoJJTech: [url]http://hastebin.com/jakigedicu.hs[/url]
[11:01:02 PM] GoGoJJTech: however, d3 is braille2
[11:01:12 PM] GoGoJJTech: meaning that d3 can change its effect based on d5 before it
[11:01:16 PM] GoGoJJTech: but why?
[11:01:20 PM] GoGoJJTech: and d4 too
[11:01:24 PM] GoGoJJTech: which is usually bufferitems
[11:01:30 PM] GoGoJJTech: this is pretty funky

Yeah, so apparently this is a thing and this happens. It's probably useless to us hackers because it's so specific in its existence, but that's what researching is for right? (btw the only reason I came across this was because my script decompiler flopped here, meaning that most script editors might also flop on these scripts)

EDIT: In Emerald, Command 0xD5 actually uses a halfword as its argument (meaning XSE is correct) for Emerald
Also, XSE states that D4 (bufferitems) only exists in FRLG, meaning that for Emerald, it's probably only used in this strange context
 
Last edited:

Touched

Resident ASMAGICIAN
625
Posts
9
Years
  • Age 122
  • Seen Feb 1, 2018
Yeah, so apparently this is a thing and this happens. It's probably useless to us hackers because it's so specific in its existence, but that's what researching is for right? (btw the only reason I came across this was because my script decompiler flopped here, meaning that most script editors might also flop on these scripts)

EDIT: In Emerald, Command 0xD5 actually uses a halfword as its argument (meaning XSE is correct) for Emerald
Also, XSE states that D4 (bufferitems) only exists in FRLG, meaning that for Emerald, it's probably only used in this strange context

They seem to control those rotating obstacles as seen in the trickhouse 29.9 and mossdeep's gym.

cmdD3 does some nasty checking of the map tile ID. All those arrow panels are tile 0x298 and above. They're in groups of 8. Right, Down, Let, Up, Trigger, and then three blanks. D3 checks what group you're activating and rotates all the NPCs on those tiles in the correct directions. It uses movement scripts at 861269C, 86126A0, 86126A4 and 8612698 to accomplish this NPC movement. It also keeps track of their coordinates in the saveblock. I would guess this command also rotates the relevant tiles.

cmdD4 updates the facing of all relevant NPCs with applymovements and updates their behaviours so that they are facing the correct direction.

cmdD5 allocates memory for this whole process (if there is no memory already allocated). cmdD6 frees that memory, and updates the player's overworld sprite. It also waits for some task. For all these scripts, you'll see a cmdD5 first, then a cmdD6 at the end.

Summary:
cmdD3 - mossdeep gym trap rotate: takes a halfword (variable or number) of the trap type (panel colour)
cmdD4 - mossdeep gym trap update: no arguments
cmdD5 - mossdeep gym trap begin: takes a halfword (variable or number). true indicates trick house (panels start at 0x298), false indicates mossdeep gym (panels start at block id 0x250)
cmdD6 - mossdeep gym trap end: no arguments
 
Last edited:

Dr. Seuss

Will finish GS Chronicles, I swear!
522
Posts
10
Years
I've made a quick research about the background of the Oak's intro screen in Fire Red, to be accurate, this background
1636-PokemonFireRedUSquirrels_103.png


Tileset of Background: 0x460CA4
Tilemap:0x460CE8
Palletes: 0x460568
Tilemap size (In NTME): 30x20 (240x160)
Amount of colors: 16

I really don't understand why the Oak's intro uses 256 colors if a lot of colors aren't used.
 
218
Posts
10
Years
  • Seen Nov 12, 2021
For Emerald

Proper cry for limbo slots


This should theorically allow the limbo slots (between Celebi and Treecko) to have their proper cry, could be useful for forms etc, since the emerald expansion isn't finished yet :

Update : put C0 46 C0 46 C0 46 at 0x806D51C

A repoint might be needed, sadly I can't test on my PC as I don't have sound

Tbh the engine handles the cry weirdly, if someone has more information about how to repoint the tables correctly, please share. Thanks PurpleOrange :

EDIT: It should be noted with this method the repointed table must include the the national dex number of the first 251 pokemon in hex -1 followed by 25 lots of 00 00 (which can be changed for new cries), then followed by the index numbers of the hoenn pokemon (in their weird order)

The game displays the default sprite, icon and base stats for Deoxys



01 BC 00 47 at 0x8034C32 for the sprite.

C0 46 C0 46 C0 46 C0 46 at 0x8068A2C for the stats.

C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 at 0x80D3030 for the icon.
 
Last edited:

PurpleOrange

still don't know what I'm doing
367
Posts
10
Years
For Emerald

Proper cry for limbo slots


This should theorically allow the limbo slots (between Celebi and Treecko) to have their proper cry, could be useful for forms etc, since the emerald expansion isn't finished yet :

put C0 46 C0 46 at 0x80A359C

after that, you can fill 0x806D510-0x806D540 with FF bytes to create a bit of freespace

Though I don't have sound on my PC, so if someone could test I would appreciate

hey, there is another method for limbo cries that seems to work found in THIS POST.
write 00 00 00 00 00 00 00 00 00 00 (that's ten bytes) to x4330C and 00 00 00 00 (four) to x43318, then repoint the table at x4539D4 and expand it - it's now a table with one word for every ID
i found that the equivalent offsets for emerald are at 0x6D518, and 0x6D527
regardless, with your method, you'd still need to repoint and expand the cry table, no?

EDIT: It should be noted with this method the repointed table must include the the national dex number of the first 251 pokemon in hex -1 followed by 25 lots of 00 00 (which can be changed for new cries), then followed by the index numbers of the hoenn pokemon (in their weird order)
 
Last edited:
218
Posts
10
Years
  • Seen Nov 12, 2021
hey, there is another method for limbo cries that seems to work found in THIS POST.

i found that the equivalent offsets for emerald are at 0x6D518, and 0x6D527
regardless, with your method, you'd still need to repoint and expand the cry table, no?

No idea, as I said I can't test. I never even tried to expand or look at any sound-related table :s
I just negate the function that replaces limbos cries with unown cries
 

PurpleOrange

still don't know what I'm doing
367
Posts
10
Years
No idea, as I said I can't test. I never even tried to expand or look at any sound-related table :s
I just negate the function that replaces limbos cries with unown cries

well tested out your method, the first 251 pokemon have the correct cries, but the rest of the hoenn pokemon seem to be in a messed up order, and not an order that i recognize at all
 

Telinc1

Weirdo Extraordinaire
168
Posts
10
Years
I don't think this has been posted here, but if it has, sorry.
The step counter for the Safari Zone is at 02039996. It's completely unprotected by DMA and you can change it with cheat codes or ASM routines.
 

Telinc1

Weirdo Extraordinaire
168
Posts
10
Years
Sorry for the double post, but this is something completely different and has nothing to do with the Safari Zone. I'm okay with it being merged though.
I've found a couple of graphics offsets for FireRed's slot machines. Maybe I'll post the palette offsets too later.

Code:
0x084659D0 - The slot machine itself. Definitely uses multiple palettes.
0x0846653C - Some Poké Ball looking thing. Gets decompressed when the slot machine loads, but I don't know if it's used there.
0x08466620 - Combo images. Used for the little popup when you hit the right arrow. Width: 14, uses palette 8 from the background palettes
0x08464A14 - The actual 32x32 slot images. Get loaded in the OAM. Width: 4, uses palette 2 from the sprite palettes
0x0846506C - Clefairy down at the bottom. Width: 4, uses palette 5 from the sprite palettes
0x08465544 - Bubble-looking things that I can't identify. Similarly to 0x0846653C, they get decompressed when the slot machine loads. Don't think they're used.
By the way, this is everything that has do with LZ77 in the log file I extracted those offsets out of. Maybe it'll be useful to somebody.
Spoiler:
 

PurpleOrange

still don't know what I'm doing
367
Posts
10
Years
so I found this "table" in FireRed at 0x08466C58
Code:
13 14 27 29 FF FF FF 14 13 15 29 FF FF FF 15 14 16 FF FF FF FF 16 15 17 1B 2B
FF FF 17 16 18 19 1A 1B 2B 18 17 19 1A 1D FF FF 19 17 18 1A 22 FF FF 1A 17 18
19 1C 1E FF 1B 16 17 1C 2B FF FF 1C 1A 1B 1E FF FF FF 1D 18 1E FF FF FF FF 1E
1C 1D 1F FF FF FF 1F 1E 20 FF FF FF FF 20 1F 21 FF FF FF FF 21 20 24 25 FF FF
FF 22 19 23 FF FF FF FF 23 22 24 FF FF FF FF 24 21 23 25 FF FF FF 25 21 24 26
FF FF FF 26 25 27 FF FF FF FF 27 13 26 FF FF FF FF 29 13 14 2A FF FF FF 2A 29
14 FF FF FF FF 2B 16 17 1B FF FF FF 2C 2B 1B FF FF FF FF FF FF FF FF FF FF FF
each byte (other than the FF's) refer to the map number of the possible route the roaming pokemon can be found on. however I can't seem to find any sort of pattern for it, so expanding it doesn't seem to be easy. also, it doesn't seem to have a byte for the map bank (03), could that mean the map bank is calculated somewhere else?
 
Last edited:
1,653
Posts
8
Years
  • Age 23
  • Seen today
In PMD: Red Rescue, the tilemap that contains the letters and symbols in the game is located at 302088 and is 9E0 bytes long.
This is a dump of the first tile, a #, that fingerprints the sheet.
Code:
00 00 00 00 10 11 11 00 11 17 17 01 71 77 77 01 11 17 17 01 71 77 77 01 11 17 17 01 10 11 11 00
It appears to be formatted like this on a tile (Spaces separate pixels):
Code:
0 0 0 0 0 0 0 0
0 1 1 1 1 1 0 0
1 1 7 1 7 1 1 1
1 7 7 7 7 7 1 0
1 1 7 1 7 1 1 0
1 7 7 7 7 7 1 0
1 1 7 1 7 1 1 0
0 1 1 1 1 1 0 0

I have yet to find the palette.

EDIT: I suspect the Palette is controlled by ASM because I can't even find it saved in the rom.
There might be more tiles before and after but I'm not 100% sure about anything outside this range.

EDIT 2: I think I found the beginning of the tile map at 302048 which is just a one pixel column of black on the left and the rest is the transparent green.
Original:
Code:
03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00

Decompiled:
Code:
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0
3 0 0 0 0 0 0 0

There is this block-large section of 7s right after it which doesn't make sense.
Original:
Code:
77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77

Decompiled:
Code:
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7
7 7 7 7 7 7 7 7

There is also a 48 20 30 at 147E5, the only instance of it but it's immediately followed by a 05 so I don't know if it's a pointer to the tilemap. There was no pointer to the # though.

EDIT 3: Changed 48 20 30 to 48 20 40, there doesn't seem to be a visual effect. Conclusion: this is not a pointer (probably).
 
Last edited:

Telinc1

Weirdo Extraordinaire
168
Posts
10
Years
I'll just point out two things.
02036E58 contains the direction the player is facing. It's got the same key as 0x800C (1: down, 2: up, 3: left, 4: right), except that you can't change it (changing it will make it flip back to what it should be, so that makes me believe it's updated every frame) and it's also reliable. I haven't looked at it in a memory viewer, but 0x800C seems to behave funnily if you want to check the player's facing and not change it. Ergo, you should do something like comparefarbytetobyte 0x2036E58 0x2 instead of compare PLAYERFACING 0x2 in scripts.

The second I haven't looked into a lot, so I'm not sure if it's got truth in it, but type 0x7 level scripts seem to run only on menu close and not when the map is loaded (AdvanceMap 1.92 says they also run on map load). Maybe someone can confirm/reject this?
 

Blah

Free supporter
1,924
Posts
11
Years
I'll just point out two things.
02036E58 contains the direction the player is facing. It's got the same key as 0x800C (1: down, 2: up, 3: left, 4: right), except that you can't change it (changing it will make it flip back to what it should be, so that makes me believe it's updated every frame) and it's also reliable. I haven't looked at it in a memory viewer, but 0x800C seems to behave funnily if you want to check the player's facing and not change it. Ergo, you should do something like comparefarbytetobyte 0x2036E58 0x2 instead of compare PLAYERFACING 0x2 in scripts.

The second I haven't looked into a lot, so I'm not sure if it's got truth in it, but type 0x7 level scripts seem to run only on menu close and not when the map is loaded (AdvanceMap 1.92 says they also run on map load). Maybe someone can confirm/reject this?

That's the npc_states data structure. Basically, the first entry is always the player, and then the next entries are NPCs around the player (they include NPCs offscreen until a certain distance). The advantage to using this instead of "PLAYER_FACING" is that the temporary variable 0x800C (which is player_facing) is only updated when the "A" button is pressed. So if you wanted to use it with a green script tile, you'd a random result. Knizz has some more indepth research about the npc_states data struct in his IDB and he also made a thread about it some years ago, if you're interested.

For your inquiry about level script 0x7, I think they are all going to activate on map reload (just a guess). You can confirm by setting a break point at "08069940" with 0x7 as the only level script. See if it's breaking on the map reload/menu open-close :)

edit:
I thought I'd drop this here for archival purposes for anyone trying to do this:
http://www.pokecommunity.com/showpost.php?p=9028130&postcount=4
 
Last edited:

C me

Creator of Pokemon League Of Legends
681
Posts
10
Years
  • Age 27
  • Seen Apr 9, 2021
I'm going to post this here because I'm sick of working on it and it should be so simple.

I have been trying to find the location of the routine called when you use fly from the pokemon menu in Emerald. FBI found it at 0xC4EF8 in FireRed and a simple callasm script makes it work perfectly.

After spending hours looking for byte similarities between FireRed and Emerald I found nothing of value.
So then I moved on to making breakpoints for 'FLY', 'FLY to where?' and for cities names as well as breakpoints for the map tilesets and tilemaps, after hours the thing I keep getting is that it's around 0x124600.

KDS spent some time helping me out and he pointed out the routine at 0x124690.

Callasming 0x124691 produces a black screen, every other routine I've tried does nothing. Maybe something has to be set before the callasm?

That's all the information I have, I would really appreciate help. Thank You
 

Blah

Free supporter
1,924
Posts
11
Years
I'm going to post this here because I'm sick of working on it and it should be so simple.

I have been trying to find the location of the routine called when you use fly from the pokemon menu in Emerald. FBI found it at 0xC4EF8 in FireRed and a simple callasm script makes it work perfectly.

After spending hours looking for byte similarities between FireRed and Emerald I found nothing of value.
So then I moved on to making breakpoints for 'FLY', 'FLY to where?' and for cities names as well as breakpoints for the map tilesets and tilemaps, after hours the thing I keep getting is that it's around 0x124600.

KDS spent some time helping me out and he pointed out the routine at 0x124690.

Callasming 0x124691 produces a black screen, every other routine I've tried does nothing. Maybe something has to be set before the callasm?

That's all the information I have, I would really appreciate help. Thank You

I don't have an EM ROM so I can't confirm some of the ROM data, but have you tried calling it's parent 081B5470? The one you seemed to try callasm-ing is a task.
 

C me

Creator of Pokemon League Of Legends
681
Posts
10
Years
  • Age 27
  • Seen Apr 9, 2021
I don't have an EM ROM so I can't confirm some of the ROM data, but have you tried calling it's parent 081B5470? The one you seemed to try callasm-ing is a task.

It justs freezes the game, sadly that doesn't work.

Edit: Don't know why it never occured to me to find a pointer to the routine, there is a pointer for 0x124691 at 0x1B5620.
Oh that's where 081B5470 came from, didn't think the routine would be that big.

Edit2: If I set a breakpoint at 08124691, 081B5620 or 081B5470 the game doesn't break when I use fly. Am I doing it wrong or does that mean it's not there?
 
Last edited:
5,256
Posts
16
Years
The series of checks at x5613C check if the player is in a map with the name VICTORY ROAD (map name ID 0x84), ROUTE 23 (map name ID 0x7B) or INDIGO PLATEAU (map name ID 0x61). If they are, then the SURFing music will not play.

This becomes an issue, though, if you have maps on there that aren't supposed to be climactic or whatever; just change the map name IDs at that location to whichever map name you want to prevent SURFing music from playing on, or simply paste 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 to nop that entire series of checks out at x5613C.

This is for FireRed.
 
Last edited:
5,256
Posts
16
Years
Unsure if this has been done already, but whatever. If you want Pokémon to not show their Pokédex number as ??? on the summary screen before getting the National Pokédex, make the following changes:

0x6E272: 00 00 00 00
0x6E280: 00 00 00 00
0x1360F7: E0
EDIT: also this 0x43FA6: 00 00 04 E0

This is for FireRed.
 
Last edited:
Back
Top