BIG EDIT: The limiting byte for the routine is located at 0x080C4D8A! The byte stored at this location is 0x6C. The sharper minded of us with have deduced that 0x6C = 0xC4 - 0x58. (Where 0xC4 is the highest allowed header in A-Map and 0x58 is the difference between Pallet Town's A-Map header, and it's "true" header in the FR rom.)
(Side note - All FR maps were created relative to the RSE maps, so as not to cause confusion between the games when traded Pokémon are viewed. The Relative map header number for Pallet Town is 0x58, but it is treated by the game as map header 0x0 - and as such, all maps are read following that order).
The actual routine itself is as follows (There's obviously much more to it than that, but it isn't relevant for this as far as I can tell):
Code:
cmp r5, #0x6C
bhi $080C4D40
This leaves us with a slight problem. Without a rewrite (OK, I could do it, but it'd take a while) there is no way to support more than 0xFE (254) map headers at any time. This means that we will NOT be able to have multi-region hacks.
My idea for having more than that is to use something similar to the following code to do the work for us:
Code:
push {r5}
cmp r5, #0xFF
bhi greater
pop {r5}
[Rest of Original Routine...]
greater: mov r0, #0x1
lsl r0, r0, #0x8
sub r5, r5, r0
lsl r0, r5, #0x2
cmp r5, #0xFE
bhi return
pop {r5}
[Rest of Original Routine...]
return: pop {r5}
[Return to Original Routine]
This would allow support for 0x1FE (510) map headers, which should be more than enough. Obviously, the cmp r5, #0xFE in the greater routine now contains the limiting byte, so it could still be limited to as few as you like.
This has NOT been tested, and I wouldn't suggest trying it yet without backing up your rom as I still need to do some serious research to see if it'll work.
However, this only takes into account the actual names, and not the positions on the map and such, so this still needs a LOT of research. There are at the very least 8 routines which will need modified to support extra maps.
Name Reading (2 versions of), Position Reading (Layer 1), Position Reading (Layer 2), Map Flags (Layer 1), Map Flags (Layer 2), "Map number on World Map" and "Head Moving on Map", which means there's a lot of work to go yet XD.
Theoretically, they should all be simple enough to actually track down, going backwards from the reading of a piece of data in the rom, but these are only the ones we ACTUALLY KNOW ABOUT! Who's to say there isn't more data which is read from somewhere that we can't find. All of the routines mentioned above can be found by looking at the World Map Editor on A-Map, and tracking the read of the data on A-Map back to the limiting byte.
On the plus side, they are designed exactly the same way as all other limited routines in FireRed, with a simple byte controlling how many we can have, so in theory, with some repointing and some rewriting, we can have as many map headers as we like (well, up to 0xFFFFFFFF - as if the rom has enough free space for that XD).
Incidentally, the layer 2 map flags are the problem behind the red text with white background on most hacks for secondary locations, as for some reason, that's how they're displayed unless they have a flag associated with them.
I'm really struggling to find the limiting bytes for the layer reading routines. Maybe I could contact Lu-Ho for some information, or read the A-Map inis?
The following bytes are only read while either accessing the world map or accessing the map names for display. Game Freak have consistently used R0 throughout here making compares with 0xC5 or 0xC4 (etc) relatively easy to find. For the first one, a "better" way to make it work is to change the bytes preceding the check to this:
At 0x080C4D84. This changes the map name reader into the same format as the rest of the routine, making it more compatible with the rest of the routine, and any extra map names we manage to add.
FOUND LIMITING BYTES:
Name Reader: 0x080C4D8A (0x6C)
Map Header on World Map (For Sevii Islands): 0x080C0080 (0xC5)
Map Header on World Map (For Sevii Islands): 0x080C00CC (0xC5)
Name on World Map: 0x080C0B32 (0xC5)
Name on World Map 2: 0x080C067A (0xC5)