Help Thread: ASM & Disassembly

[NewDenverCity]

I can't even tell what you are trying to do, but I'll do my best. It looks as though you are loading a ROM offset rather than an address. ROM is prefixed by 08/09, you have prefixed it with 00 (BIOS). In fact this address is invalid and will be ignored by VBA - the bios is only 16kb. Hardware will do weird things.

Next, you load two half words, add 5, then load the addresses again? Why? I think what you are trying to do is store to those addresses, but you'd need str, strh or strb to do that. If I'm right about these being ROM offsets, then you clearly don't understand the concept of ROM. You can't right to it. Ever. There are a few bytes of ROM address space reserved for GPIO for sensors, and this is the only exception.

Lastly, you're wasting stack space. Neither R0, R1 or LR need to be pushed.

I suggest you read some tutorials and look at existing code so you actually understand what you're doing, rather than fumbling around in the dark.

Ah well, had to start somewhere, even if it was 'get good scrub'.
Thank you for the information on the ROM offsets. I actually had no idea that it had to be 08. And I think I understand that more now, thanks.

 

[crehym]

Guys I need your help.

I inserted FBI's set party level routine in my rom and it worked perfectly.
Here's the routine:

Spoiler:

Set static party level

First of all, I need to mention that this routine works off percentage increases and decreases. So if you're planning to go from level 1 to 100 all in one go for 6 Pokemon it will take around 5 seconds to increment about 35 million experience points. The reason for the percentage increase is so that we don't go over. This was a pain to test, as in some occasions the percentage between levels 1-2 would be enough to set negative exp, and sometimes the levels 99 -100 would set exp over 100...it was just a huge pain. It now works off a lookup table and is quite spiffy now :3

How to insert:

Compile and insert into free space the following routine:

Spoiler:

.text
.align 2
.thumb
.thumb_func

main:
	push {r0-r7, lr}
	mov r7, #0x0

loop:
	ldr r6, =(0x2024029)
	ldrb r6, [r6]
	cmp r7, r6
	beq end
	ldr r0, =(0x2024284)
	mov r1, #0x64
	mul r1, r1, r7
	push {r7}
	add r0, r0, r1@addr
	mov r4, r0

set_level:
	mov r1, #0xB
	push {r4}
	ldr r3, = (0x803FBE8 +1) @get species
	bl linker
	pop {r4}
	mov r2, r0
	ldr r6, =(0x8253AE4)
	ldr r1, =(0x8254784)
	lsl r0, r2, #0x3
	sub r0, r0, r2
	lsl r0, r0, #0x2
	add r1, r1, r0
	ldrb r0, [r1, #0x13]
	mov r5, #0xCA
	lsl r5, r5, #0x1
	mul r0, r0, r5
	add r0, r0, r6
	ldr r1, .VAR
	ldrb r1, [r1]
	mov r3, #0x4
	mul r1, r1, r3
	add r1, r1, r0
	ldr r1, [r1]
	ldr r2, = (0x20370D0)
	str r1, [r2]
	mov r0, r4
	push {r4}
	mov r1, #0x19
	ldr r3, =(0x804037C +1)
	bl linker
	pop {r4}
	mov r0, r4
	ldr r3, =(0x803E47C +1)
	bl linker
		
next:
	pop {r7}
	add r7, r7, #0x1
	b loop	

end:
	pop {r0-r7, pc}
	
linker:
	bx r3
	

.align 2

.VAR:
	.word 0x020270B8 + (0x8000 *2)

Here is a compiled version:

FF B5 00 27 1A 4E 36 78 B7 42 2D D0 19 48 64 21 79 43 80 B4 40 18 04 1C 0B 21 10 B4 16 4B 00 F0 24 F8 10 BC 02 1C 15 4E 15 49 D0 00 80 1A 80 00 09 18 C8 7C CA 25 6D 00 68 43 80 19 0B 49 09 78 04 23 59 43 09 18 09 68 0E 4A 11 60 20 1C 10 B4 19 21 0D 4B 00 F0 09 F8 10 BC 20 1C 0B 4B 00 F0 04 F8 80 BC 01 37 CD E7 FF BD 18 47 B8 70 03 02 29 40 02 02 84 42 02 02 E9 FB 03 08 E4 3A 25 08 84 47 25 08 D0 70 03 02 7D 03 04 08 7D E4 03 08

Usage:
setvar 0x8000 0x[Level you want Pokemon to be set to (in hex)]
callasm 0x[this routine +1]

That's it. I should mention, you should apply this as often as possible to speed up the computation time for next time.

However, I would like to create a variation of this.
I would simply like to be able to set level of pokes individually.

I am re-learning asm, had it in college, and I do understand most of it, but still inexperienced to do a whole routine on my own.

The way to solve my prob is simply have 2 inputs
1 - the index of the poke to set the level
2 - the level it shall be set to

And, I can't follow FBI's routine since I don't know where the pointers point to.

And also, would it be possible to set by experience points?

Ex. Lv 5 Pikachu with 50 extra exp
-set to Lv 30 Pikachu (0 extra exp)
-set back to Lv 5 with the 50 extra exp
Idea is temporarily set the Poke to a certain level.

 

[Touched]

Guys I need your help.

I inserted FBI's set party level routine in my rom and it worked perfectly.
Here's the routine:

Spoiler:

However, I would like to create a variation of this.
I would simply like to be able to set level of pokes individually.

I am re-learning asm, had it in college, and I do understand most of it, but still inexperienced to do a whole routine on my own.

The way to solve my prob is simply have 2 inputs
1 - the index of the poke to set the level
2 - the level it shall be set to

And, I can't follow FBI's routine since I don't know where the pointers point to.

And also, would it be possible to set by experience points?

Ex. Lv 5 Pikachu with 50 extra exp
-set to Lv 30 Pikachu (0 extra exp)
-set back to Lv 5 with the 50 extra exp
Idea is temporarily set the Poke to a certain level.

Get yourself a copy of IDA and knizz's IDB for FireRed if you want to see what those addresses are. You can set Exp using the same function he uses there actually.

You just need to remove the loop in that code to do what you want.

FBI doesn't seem to label his addresses ever so it's understandable that you got stuck

0x2024029 - Number of pokemon in the party
0x2024284 - First party pokemon. This is an array of up to 6 entries long. Each entry is 100 (0x64) bytes

I assume the rest figures out the EXP needed to attain the target level and then recalculates the level based on EXP curves, but I haven't read it.

 

[crehym]

I modified FBI's routine to the one below and got it to work. However, I still would like to learn what the computation does, what does linker link to, etc, if anyone can elaborate. It doesn't feel comfortable running a program that works but you don't know how ~_~

Also, I'd like to have another input for the index of the pokemon to be changed (highlighted in bold)
What are the possible variables that can be used as input? aside from 0x8000 and what are their addresses?

Spoiler:

.text
.align 2
.thumb
.thumb_func

main:
push {r0-r7, lr}
mov r7, #0x1 @load index 0-5 from a variable

ldr r0, =(0x2024284)
mov r1, #0x64
mul r1, r1, r7
add r0, r0, r1@addr
mov r4, r0

set_level:
mov r1, #0xB
push {r4}
ldr r3, = (0x803FBE8 +1) @get species
bl linker
pop {r4}
mov r2, r0
ldr r6, =(0x8253AE4)
ldr r1, =(0x8254784)
lsl r0, r2, #0x3
sub r0, r0, r2
lsl r0, r0, #0x2
add r1, r1, r0
ldrb r0, [r1, #0x13]
mov r5, #0xCA
lsl r5, r5, #0x1
mul r0, r0, r5
add r0, r0, r6
ldr r1, .VAR
ldrb r1, [r1]
mov r3, #0x4
mul r1, r1, r3
add r1, r1, r0
ldr r1, [r1]
ldr r2, = (0x20370D0)
str r1, [r2]
mov r0, r4
push {r4}
mov r1, #0x19
ldr r3, =(0x804037C +1)
bl linker
pop {r4}
mov r0, r4
ldr r3, =(0x803E47C +1)
bl linker


end:
pop {r0-r7, pc}

linker:
bx r3


.align 2

.VAR:
.word 0x020270B8 + (0x8000 *2)

 

[Blah]

I modified FBI's routine to the one below and got it to work. However, I still would like to learn what the computation does, what does linker link to, etc, if anyone can elaborate. It doesn't feel comfortable running a program that works but you don't know how ~_~

Also, I'd like to have another input for the index of the pokemon to be changed (highlighted in bold)
What are the possible variables that can be used as input? aside from 0x8000 and what are their addresses?

Spoiler:

.text
.align 2
.thumb
.thumb_func

main:
push {r4-r7, lr}

@figure out slot address of Pokemon given slot number
@r7 contains slot number 0-5
mov r7, #0x1
ldr r0, =(0x2024284)
mov r1, #0x64
mul r1, r1, r7
add r0, r0, r1@address
mov r4, r0 @save address in r4

set_level:

@retrieve Pokemon's species, given address (calculated above)
mov r1, #0xB
ldr r3, = (0x803FBE8 +1) @get species
bl linker

@exp table and level curves tables
mov r2, r0
ldr r6, =(0x8253AE4)
ldr r1, =(0x8254784)

@calculations to get the species table index
lsl r0, r2, #0x3
sub r0, r0, r2
lsl r0, r0, #0x2
add r1, r1, r0
ldrb r0, [r1, #0x13]
mov r5, #0xCA
lsl r5, r5, #0x1
mul r0, r0, r5
add r0, r0, r6

@work backwards given a level to get exp required
ldr r1, .VAR
ldrb r1, [r1]
mov r3, #0x4
mul r1, r1, r3
add r1, r1, r0
ldr r1, [r1]
ldr r2, = (0x20370D0)
str r1, [r2]
mov r0, r4

@set exp
mov r1, #0x19
ldr r3, =(0x804037C +1)
bl linker

@recalculate stats
mov r0, r4
ldr r3, =(0x803E47C +1)
bl linker


end:
pop {r4-r7, pc}

linker:
bx r3


.align 2

.VAR:
.word 0x020270B8 + (0x8000 *2)

Commented, and removed stupid pushes/pops. For explanations of what bl linker is, read my ASM tutorial about function calling :)

 

[Touched]

Spoiler:

.text
.align 2
.thumb
.thumb_func

main:
push {r4-r7, lr}

@figure out slot address of Pokemon given slot number
@r7 contains slot number 0-5
mov r7, #0x1
ldr r0, =(0x2024284)
mov r1, #0x64
mul r1, r1, r7
add r0, r0, r1@address
mov r4, r0 @save address in r4

set_level:

@retrieve Pokemon's species, given address (calculated above)
mov r1, #0xB
ldr r3, = (0x803FBE8 +1) @get species
bl linker

@exp table and level curves tables
mov r2, r0
ldr r6, =(0x8253AE4)
ldr r1, =(0x8254784)

@calculations to get the species table index
lsl r0, r2, #0x3
sub r0, r0, r2
lsl r0, r0, #0x2
add r1, r1, r0
ldrb r0, [r1, #0x13]
mov r5, #0xCA
lsl r5, r5, #0x1
mul r0, r0, r5
add r0, r0, r6

@work backwards given a level to get exp required
ldr r1, .VAR
ldrb r1, [r1]
mov r3, #0x4
mul r1, r1, r3
add r1, r1, r0
ldr r1, [r1]
ldr r2, = (0x20370D0)
str r1, [r2]
mov r0, r4

@set exp
mov r1, #0x19
ldr r3, =(0x804037C +1)
bl linker

@recalculate stats
mov r0, r4
ldr r3, =(0x803E47C +1)
bl linker


end:
pop {r4-r7, pc}

linker:
bx r3


.align 2

.VAR:
.word 0x020270B8 + (0x8000 *2)

Commented, and removed stupid pushes/pops. For explanations of what bl linker is, read my ASM tutorial about function calling :)

Please. Please. Please. Never use MUL unless you really need to. Powers of two can be expressed as LSL, which is both shorter and faster.

@ BAD FBI
mov r3, #0x4
mul r1, r1, r3

@ Good
lsl r1, #2

I modified FBI's routine to the one below and got it to work. However, I still would like to learn what the computation does, what does linker link to, etc, if anyone can elaborate. It doesn't feel comfortable running a program that works but you don't know how ~_~

Also, I'd like to have another input for the index of the pokemon to be changed (highlighted in bold)
What are the possible variables that can be used as input? aside from 0x8000 and what are their addresses?

Spoiler:

.text
.align 2
.thumb
.thumb_func

main:
push {r0-r7, lr}
mov r7, #0x1 @load index 0-5 from a variable

ldr r0, =(0x2024284)
mov r1, #0x64
mul r1, r1, r7
add r0, r0, r1@addr
mov r4, r0

set_level:
mov r1, #0xB
push {r4}
ldr r3, = (0x803FBE8 +1) @get species
bl linker
pop {r4}
mov r2, r0
ldr r6, =(0x8253AE4)
ldr r1, =(0x8254784)
lsl r0, r2, #0x3
sub r0, r0, r2
lsl r0, r0, #0x2
add r1, r1, r0
ldrb r0, [r1, #0x13]
mov r5, #0xCA
lsl r5, r5, #0x1
mul r0, r0, r5
add r0, r0, r6
ldr r1, .VAR
ldrb r1, [r1]
mov r3, #0x4
mul r1, r1, r3
add r1, r1, r0
ldr r1, [r1]
ldr r2, = (0x20370D0)
str r1, [r2]
mov r0, r4
push {r4}
mov r1, #0x19
ldr r3, =(0x804037C +1)
bl linker
pop {r4}
mov r0, r4
ldr r3, =(0x803E47C +1)
bl linker


end:
pop {r0-r7, pc}

linker:
bx r3


.align 2

.VAR:
.word 0x020270B8 + (0x8000 *2)

The variables 0x8000 - 0x800F can be referenced by their memory address as expressed in the literal pool there (0x020270B8 + (0x8000 *2)). This can calculate the correct address for those variables. Other variables are DMA protected and thus it is recommended that you use the engine function to get their values. For simple script input, the 0x8000 series is better.

Again, look at the IDB - it will explain most of these questions about the locations of stuff.

 

[Blah]

Please. Please. Please. Never use MUL unless you really need to. Powers of two can be expressed as LSL, which is both shorter and faster.

@ BAD FBI
mov r3, #0x4
mul r1, r1, r3

@ Good
lsl r1, #2

The variables 0x8000 - 0x800F can be referenced by their memory address as expressed in the literal pool there (0x020270B8 + (0x8000 *2)). This can calculate the correct address for those variables. Other variables are DMA protected and thus it is recommended that you use the engine function to get their values. For simple script input, the 0x8000 series is better.

Again, look at the IDB - it will explain most of these questions about the locations of stuff.

Don't blame me, this routine was written back in my early days :P

 

[crehym]

Thanks FBI. ^^ ^^ ^^ ^^ ^^

Touched,
Ya, I've read that too in one of FBI's tutorial, about lsl/lsr being faster when multiplying by powers of two.
So I can just replace 0x8000 with any 0x8 series variable? Are all of them temporary ones? How about the addresses of 0x4011 onward variables, the safe ones?
Also I downloaded the IDB in your sig but I don't know how to use it -_- it opens in Visual Studio but displays hex values.

I want to know the other routines FBI's routine links to because I would like to make a variation of it that sets the exp not the level. And also the I want to know the addresses of tables such as the experience table. If it's in the IDB, how do you use it?

Again, thanks

 

[daniilS]

Download IDA.

 

[Touched]

Thanks FBI. ^^ ^^ ^^ ^^ ^^

Touched,
Ya, I've read that too in one of FBI's tutorial, about lsl/lsr being faster when multiplying by powers of two.
So I can just replace 0x8000 with any 0x8 series variable? Are all of them temporary ones? How about the addresses of 0x4011 onward variables, the safe ones?
Also I downloaded the IDB in your sig but I don't know how to use it -_- it opens in Visual Studio but displays hex values.

I want to know the other routines FBI's routine links to because I would like to make a variation of it that sets the exp not the level. And also the I want to know the addresses of tables such as the experience table. If it's in the IDB, how do you use it?

Again, thanks

The 0x8000 series are special, and seem to be designed to be accessed easily from code without the need for a function call. The other variables need this function call. It's the same function used by the code for setvar and other variable related script functions.

As daniilS said, you need to download IDA to open the IDB.

 

[Joexv]

So I'm having issues regarding a custom evolution routine I made. All it does is first checks the flag 0x4a1 to see if its not set. If it is it quits. Then it checks the Pokemon's capture location for 0xa1 or 161. Then if its anything but that it will quit. Then finally it will do the basic level check of a normal evolution. ATM it freezes the game upon leveling up to the proper level,

Spoiler:

main:
push {r0-r7}
add r0, r6, r7
lsl r0, r0, #0x3
add r0, r2, r0
add r3, r0, r3
ldrb r2, [r3, #0x2]
mov r0, r8
@Check flag 0x4a1
mov r0, #0xff
add r0, r0, #0x28
lsl r0, r0, #0x2
ldr r3, =(0x806E6D0 +1)
bl linker
cmp r0, #0x1
beq exit
@Check capture location
mov r1, #0x37
ldr r3, decryptpoke
bl linker
cmp r0, #0xa1
bne exit
ldr r0, levelcheckloc
bx r0
exit: pop {r0-r7}
ldr r0, noevo
bx r0
linker:
bx r3


.align
levelcheckloc: .word 0x0806D32F
noevo: .word 0x0806D333
decryptpoke: .word 0x0806A519

Emerald btw

 

[MisterJoJo]

Hi I need help with my own day night system. Everythings works fine and it works by writing a step number into RAM and after a certain amount of steps a script is executed which clears some flags like beery flags. The problem is that I want the light on the maps change depending on the current step number. So all I have to do is insert a light changing routine in my already working routine.
There is some information about setting brightness on this page: https://problemkaputt.de/gbatek.htm#lcdiocolorspecialeffects
Problem again is that I dont know how to use that information. I searched everywhere with google but I cant find a similar problem or someone using that feature.

 

[Touched]

So I'm having issues regarding a custom evolution routine I made. All it does is first checks the flag 0x4a1 to see if its not set. If it is it quits. Then it checks the Pokemon's capture location for 0xa1 or 161. Then if its anything but that it will quit. Then finally it will do the basic level check of a normal evolution. ATM it freezes the game upon leveling up to the proper level,

Spoiler:

main:
push {r0-r7}
add r0, r6, r7
lsl r0, r0, #0x3
add r0, r2, r0
add r3, r0, r3
ldrb r2, [r3, #0x2]
mov r0, r8
@Check flag 0x4a1
mov r0, #0xff
add r0, r0, #0x28
lsl r0, r0, #0x2
ldr r3, =(0x806E6D0 +1)
bl linker
cmp r0, #0x1
beq exit
@Check capture location
mov r1, #0x37
ldr r3, decryptpoke
bl linker
cmp r0, #0xa1
bne exit
ldr r0, levelcheckloc
bx r0
exit: pop {r0-r7}
ldr r0, noevo
bx r0
linker:
bx r3


.align
levelcheckloc: .word 0x0806D32F
noevo: .word 0x0806D333
decryptpoke: .word 0x0806A519

Emerald btw

ldr r0, levelcheckloc
bx r0
exit: pop {r0-r7}
ldr r0, noevo
bx r0
linker:
bx r3

You branch to levelcheckloc without doing pop {r0-r7} before that, causing stack corruption.

You should also specify an alignment for the routine and the literal pool, I don't think it defaults to 2. You should also use the .thumb directive.

Hi I need help with my own day night system. Everythings works fine and it works by writing a step number into RAM and after a certain amount of steps a script is executed which clears some flags like beery flags. The problem is that I want the light on the maps change depending on the current step number. So all I have to do is insert a light changing routine in my already working routine.
There is some information about setting brightness on this page: https://problemkaputt.de/gbatek.htm#lcdiocolorspecialeffects
Problem again is that I dont know how to use that information. I searched everywhere with google but I cant find a similar problem or someone using that feature.

Changing the IO registers is something which is pretty unpredictable within the context of the engine. They get constantly overwritten, so it's better to use the engine functions. Anyway, filtering palettes is probably a better way to go than using the blending features, as the former is more customisable. You should look at existing Day/Night systems if you have no idea how to do this.

 

[Joexv]

ldr r0, levelcheckloc
bx r0
exit: pop {r0-r7}
ldr r0, noevo
bx r0
linker:
bx r3

You branch to levelcheckloc without doing pop {r0-r7} before that, causing stack corruption.

You should also specify an alignment for the routine and the literal pool, I don't think it defaults to 2. You should also use the .thumb directive.

Spoiler:

.text
.align 2
.thumb
.thumb_func
main:
push {r0-r7}
add r0, r6, r7
lsl r0, r0, #0x3
add r0, r2, r0
add r3, r0, r3
ldrb r2, [r3, #0x2]
mov r0, r8
mov r10, r3
@Check flag 0x4a1
mov r0, #0xff
add r0, r0, #0x28
lsl r0, r0, #0x2
ldr r3, =(0x806E6D0 +1)
bl linker
cmp r0, #0x1
beq exit
@Check capture location
mov r1, #0x37
ldr r3, decryptpoke
bl linker
cmp r0, #0xa1
bge exit
pop {r0-r7}
mov r1, r10
ldr r0, levelcheckloc
bx r0
exit: 
pop {r0-r7}
ldr r0, noevo
bx r0
linker:
bx r3
.align 2

.align
levelcheckloc: .word 0x0806D32F
noevo: .word 0x0806D333
decryptpoke: .word 0x0806A519

Still freezing. I did what you said and I added a few things that other evolution methods seemed to have, but alas to no prevail.

 

[Touched]

Spoiler:

.text
.align 2
.thumb
.thumb_func
main:
push {r0-r7}
add r0, r6, r7
lsl r0, r0, #0x3
add r0, r2, r0
add r3, r0, r3
ldrb r2, [r3, #0x2]
mov r0, r8
mov r10, r3
@Check flag 0x4a1
mov r0, #0xff
add r0, r0, #0x28
lsl r0, r0, #0x2
ldr r3, =(0x806E6D0 +1)
bl linker
cmp r0, #0x1
beq exit
@Check capture location
mov r1, #0x37
ldr r3, decryptpoke
bl linker
cmp r0, #0xa1
bge exit
pop {r0-r7}
mov r1, r10
ldr r0, levelcheckloc
bx r0
exit: 
pop {r0-r7}
ldr r0, noevo
bx r0
linker:
bx r3
.align 2

.align
levelcheckloc: .word 0x0806D32F
noevo: .word 0x0806D333
decryptpoke: .word 0x0806A519

Still freezing. I did what you said and I added a few things that other evolution methods seemed to have, but alas to no prevail.

@Check capture location
mov r1, #0x37
ldr r3, decryptpoke

Two issues with this - first, there is no Pokemon data structure in r0. Second, #0x37 doesn't fetch the capture location - it's the status ailment. 0x23 is the capture location.

Right before you call the decrypter you call 806E6D0. Then you cmp r0 ... 806E6D0 doesn't have a return value so what are you trying to do?

 

[Joexv]

@Check capture location
mov r1, #0x37
ldr r3, decryptpoke

Two issues with this - first, there is no Pokemon data structure in r0. Second, #0x37 doesn't fetch the capture location - it's the status ailment. 0x23 is the capture location.

Right before you call the decrypter you call 806E6D0. Then you cmp r0 ... 806E6D0 doesn't have a return value so what are you trying to do?

Yea I fixed managed to fix everything but that 0x806E6D0 call. I read online that, that was the flagcheck routine for Emerald. Is it incorrect? Cause that would explain that.

 

[MisterJoJo]

Changing the IO registers is something which is pretty unpredictable within the context of the engine. They get constantly overwritten, so it's better to use the engine functions. Anyway, filtering palettes is probably a better way to go than using the blending features, as the former is more customisable. You should look at existing Day/Night systems if you have no idea how to do this.

Currently im trying to make it similar to the darkness of for example rain. I cant figure out though how the darkness there works and I thought it must work with the IO registers. I guess working with palettes is just like adding new darker pals and use them during night ?

 

[Touched]

Currently im trying to make it similar to the darkness of for example rain. I cant figure out though how the darkness there works and I thought it must work with the IO registers. I guess working with palettes is just like adding new darker pals and use them during night ?

Yeah, I could be wrong, but I think the rain and stuff works similarly to the sepia and greyscale functions - that is they manually blend the palettes. I think the only time those blend functions are used is in fade screens and stuff.

 

[MisterJoJo]

Maybe I can find the corresponding ASM code by debugging the fadescreen script. I'm coming again if I find something useful.
(Trying to debug the doweather script ended with crashs)

 

[daniilS]

Fade screen used a different method. Look at palette filters or at the cloudy weather, or use special effects. There's a function to modify IO regs, can't look up the address today though.