Quick Research & Development Thread

HidoranBlaze · Nov 29, 2014

Lance32497 said:
how about if I want it 300 or 12C in hex...
What would I change?

cmp rX, #0xYY will only work if YY is a byte. You're limited to 255 Pokemon in that sense. If you want more, you'll have to modify the routine so that it loads a halfword and compares against that.

Danny0317 · Dec 7, 2014

So, I was messing around with spriteface2, which doesn't seem to be very documented (at least not in Spherical Ice's online thing), and I got this (tested in EM, btw):

Spriteface 2 documentation
0 - face down
1 - face down
2 - face up
3 - face left
4 - face right
5 - face down
6 - face down
7 - face up
8 - face up
9 - run nonstop facing down
10- run nonstop facing down
11- run nonstop facing up
12- run nonstop facing left
13- run nonstop facing right
14- run nonstop facing down
15- run nonstop facing down
16- run nonstop facing up
17- run nonstop facing up
18- run nonstop facing down faster
19- run nonstop facing down faster
20- run nonstop facing up faster
21- run nonstop facing left faster
22- run nonstop facing right faster
23- run nonstop facing down faster
28- run nonstop facing down very fast
29- run nonstop facing up very fast
30- run nonstop facing left very fast
30- run nonstop facing right very fast
46- (only works on creatsprite of player) runs in place facing down
47- (only works on creatsprite of player) runs in place facing up
48- (only works on creatsprite of player) runs in place facing left
49- (only works on creatsprite of player) runs in place facing right

To use it, first you must use createsprite then spriteface2.

DoesntKnowHowToPlay · Dec 10, 2014

In-game trades in FR are at 0x26CF8C. The scripts relating to them store very little information, and just index into this table. Each entry is 0x3C bytes, used as such:

0x0 - Nickname, limited to ten characters + 0xFF.
0xC - Half-word, ID of the NPC's pokemon.
0xE - IVs, stored in HP/Atk/Def/Speed/SAtk/SDef order. One byte each.
0x14 - An entire word dedicated to the ability bit.
0x18 - NPC's trainer ID. Only the low bits are visible on the status screen.
0x1C - Five bytes; four of them are 5 and one is 0x1E. Not sure what they do if anything.
0x24 - Personality value; influences nature, gender, etc; more info here: http://bulbapedia.bulbagarden.net/wiki/Personality_value
0x28 - Hold item.
0x2A - 0x00 if the mon carries mail (only ZYNX has mail in FR), 0xFF otherwise.
0x2B - Original trainer's name. Limited to seven characters + 0xFF.
0x36 - 0x00 if original trainer is male, 0x01 if original trainer is female. Only visible in RSE.
0x37 - Always 0xA. Not sure what it controls if anything.
0x38 - Half-word, ID of the species the NPC is looking for.
0x3A - Half-word, seems unused.

RichterSnipes · Dec 12, 2014

DoesntKnowHowToPlay said:
XY added a feature that gives experience points when you catch pokemon. To duplicate this in FR, do the following...

lsmash said:
I combined my work with the one from Doesnt. As a result, there are less bytes to write into freespace.
So, here's what to do to give exp points when you catch a pokemon...

I'm aware I'm kind of late to catch this, but I've caught a bug with this code. Everything works correctly, but if a Pokémon can learn a move on level up while it already knows four moves and you enter the move information screen, the captured Pokémon will reappear on screen after exiting the move information screen. It doesn't affect any functionality, but it is a notable occurrence.

Shiny Quagsire · Dec 13, 2014

Team Fail said:
Hate to basically draw this from the dead, but I've been looking at the routines for loading this, and I can't seem to find it. Has anyone been able to also adjust the trainer's name to small text as well as the rest of the menu? It's almost pointless to apply this if not all the text is uniform haha.

My guess with the trainer's name is that it uses one of the text attributes which changes the font, since the text renderer applies all those attributes/colors/etc regardless of where it is. I might edit this post if I happen to find it but that's probably the issue here.

Karjam · Dec 14, 2014

Someone on YouTube who goes under the username of "Pokechu22" had discovered a hidden debug function within Pokémon FireRed just by fiddling around with a glitch Pokémon.

When he shared his discovery on Bulbapedia, someone pointed out that the "backup save memory" mentioned within this hidden debug function was also mentioned in a couple of places within the leaked debug copy of the German version of Pokémon Ruby, leading me realize that this is indeed a function related to debugging the game.

Who knows? Perhaps there's more hidden debug features within the ROM that we don't know about.

Spherical Ice · Dec 20, 2014

Chaos Rush said:
Here are some offsets for the Pokedex HUD:
0x451F55 = X position of text list
0x451F56 = Y position of text list
0x451F5D = X position of Habitat picture
0x451F5E = Y position of Habitat picture
0x451F65 = X position of "Seen:__ Owned:__" box
0x451F66 = Y position of "Seen:__ Owned:__" box
0x451F61 = BG Palette number that habitat picture uses
0x4520C8 = # of list entries on main pokedex page (National Pokedex enabled only)

Mess around with the bytes at those offsets, allowing you to do stuff like this:

Expanding on from this, I've found out some more about this area of the ROM (again, for FireRed):

00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00451F50
00451F60

00 00 00 00 01 01 02 14 10 00 08 00 01 15 0B 08
06 01 48 01 01 15 02 09 09 00 78 01 FB 5E 41 08

The above controls the size and positioning of various aspects of the Pokédex page, regardless of whether the National Pokédex has been activated or not.

00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00451F60
00451F70
00451F80
00451F90
00451FA0
00451FB0
00451FC0
00451FD0
00451FE0
00451FF0
00452000
00452010

06 01 48 01 01 15 02 09 09 00 7B 01 [S-HIGHLIGHT]FB 5E 41 08
FD FF FF FF[/S-HIGHLIGHT] [S-HIGHLIGHT]95 5E 41 08 09 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]E0 5D 41 08
FD FF FF FF[/S-HIGHLIGHT] [S-HIGHLIGHT]F7 5D 41 08 00 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]09 5E 41 08
01 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]18 5E 41 08 02 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]2D 5E 41 08
03 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]39 5E 41 08 04 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]46 5E 41 08
05 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]57 5E 41 08 06 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]6D 5E 41 08
07 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]7B 5E 41 08 08 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]88 5E 41 08
FD FF FF FF[/S-HIGHLIGHT] [S-HIGHLIGHT]A4 5E 41 08 0A 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]D5 5E 41 08
0B 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]DF 5E 41 08 0C 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]ED 5E 41 08
0D 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]B0 5E 41 08 FD FF FF FF[/S-HIGHLIGHT] [S-HIGHLIGHT]C7 5E 41 08
FE FF FF FF[/S-HIGHLIGHT] 6C 1F 45 08 C1 2E 10 08 49 2F 10 08
13 00 09 00 00 00 0C 04 12 30 01 02 FB 5E 41 08

The above controls the Pokédex prior to the National Pokédex being activated.

00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00452010
00452020
00452030
00452040
00452050
00452060
00452070
00452080
00452090
004520A0
004520B0
004520C0
004520D0

13 00 09 00 00 00 0C 04 12 30 01 02 [S-HIGHLIGHT]FB 5E 41 08
FD FF FF FF[/S-HIGHLIGHT] [S-HIGHLIGHT]95 5E 41 08 09 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]24 5F 41 08
0E 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]E0 5D 41 08 FD FF FF FF[/S-HIGHLIGHT] [S-HIGHLIGHT]F7 5D 41 08
00 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]09 5E 41 08 01 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]18 5E 41 08
02 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]2D 5E 41 08 03 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]39 5E 41 08
04 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]46 5E 41 08 05 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]57 5E 41 08
06 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]6D 5E 41 08 07 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]7B 5E 41 08
08 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]88 5E 41 08 FD FF FF FF[/S-HIGHLIGHT] [S-HIGHLIGHT]A4 5E 41 08
0A 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]D5 5E 41 08 0B 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]DF 5E 41 08
0C 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]ED 5E 41 08 0D 00 00 00[/S-HIGHLIGHT] [S-HIGHLIGHT]B0 5E 41 08
FD FF FF FF[/S-HIGHLIGHT] [S-HIGHLIGHT]C7 5E 41 08 FE FF FF FF[/S-HIGHLIGHT] 1C 20 45 08
C1 2E 10 08 49 2F 10 08 14 00 09 00 00 00 0C 04
12 30 01 02 02 C8 13 03 C8 8D 00 00 0A 00 D0 07

The above controls the Pokédex after the National Pokédex is activated using special 0x16F.

Hover over all of the colored bytes to find out what they do. Co-ordinates are colored in red, while dimensions are in blue. List items are grouped together by yellow highlighting. Pointers are colored magenta, while the list item "functions" are colored in "royal blue". Unformatted bytes are currently unknown.

Note that Pokémon past 151 do not get loaded with the National Pokédex list "function" (0E 00 00 00) until the special is activated, and it otherwise functions like the Kanto Pokédex list "function" (09 00 00 00).

It's also worth noting that all of the headers (e.g. 'POKéMON LIST') are just regular strings. To recreate the orange text and dark-orange background in XSE, use this (and replace NAME with whatever you want, obviously):

Code:

[FONT="Courier New"]#org @string1
= [darknavyblue_fr]\c\h03ÓNAME[/FONT]

Telinc1 · Dec 22, 2014

Thanks to this post, I was able to find the part of the code that checks the badges for Surf and Waterfall. They're at 0x06D59C for Surf and at 0x06D5D0 for Waterfall. They're obviously stored as little endian. That's why the bytes at Surf's location are 24 08. Why is this important? Well, if we set those to flags that get set at the start of the game (0x33 = 33 00 is one, more in this thread), we can practically remove the badge checks for HMs with the following three steps:

Change the two bytes at 0x06D59C and 0x06D5D0 to the number of a flag that's set by the game start script - removes overworld badge checks for Surf and Waterfall (found using this post).
Write 01 20 00 00 00 00 00 00 00 00 00 to 0x124620 - removes HM checks from the menu (well known and found by karatekid552, source)
The overworld badge checks for Cut, Strength and Rock Smash in are in the scripts themselves. Just open up the script for any tree, boulder or rock and you'll see it.

I personally think this is a great discovery. Of course, I all I did was stare at some bytes in a Hex Editor to find the offsets for the badges themselves, so I take absolutely no credit for this.
Also, yes, I do realise it's a better idea to completely null out the call to the routine that checks flags, though I bet anybody who knows ASM could do it in seconds just by looking at the bytes.

Shiny Quagsire · Dec 24, 2014

If you want to stop the top help bar from showing up at all in the Town Map in Fire Red, just stub out the function at 080C4ED0 with a bx lr (70 47). This is useful if you maybe don't like the help menus or something, idk.

Also, if you want the Town Map to act like it would in a Pokemon Center (ie without the sliding animation), set 080A1CB0 and 080A1CDC to 1. Basically each offset calls the routine at 80BFF50 to set up the callbacks for the Town Map, thus also passing this argument handed down through r0. If it's set to 0, it does the sliding map animation. If it's set to 1, it acts like a wall map. Note that this map will not be able to view the additional regions like a normal map would.

Blah · Dec 28, 2014

Hiroshi Sotomura said:
I'm still seeking what controls the HM checks at all, so I can reallocate what badge works for what move.

And despite Black/White advancing the scene, X/Y goes back to the tried and true checks. :( (That's not why I want to keep using badge checks, mind you.) Maybe we should stop trying to follow the leader here, haha.

I've done some research on this some time ago :o

First of all, all HMs have secondary flag checks if used via the BRM.

The badge checks for Cut, Strength, Rocksmash are done via scripts. The badge checks for waterfall and surf are done in two places, once in their respective scripts, and another in the routines themselves (those checks would be at 0x806D570 and 0x806D5B2 respectively). Finally flag checks for moves being used via the bottom right menu are at 0x812461C (flash, fly and others you decide to use via BRM).

The same flag check is used for all HMs, and changing that requires your own little snipplet of ASM. Right now it's doing something like this:

Code:

ldr r0, =(0x820)
add r0, r0, r4
bl checkflag

Where r4, is the current HM selected from a table. So that leaves two possible ways, 1) edit the order of the table at 0x845A788, or 2) edit the routine to change the value of r4 depending on what you want. I should also mention that r4's value at this point is determined at 0x81245C0.

Overall just editing the badges should be rather simple :D

daniilS · Jan 4, 2015

Posted this in the Beginner's Lounge as a reply to a question, but figured it might as well go here:

Code:

.thumb

main:
	push {r4-r5, lr}
	sub sp, #8
	ldr r4, [sp, #0x14]
	str r4, [sp, #4]
	str r3, [sp]
	mvn r5, r2
	cmp r5, #0x1
	bne next
	mov r2, r3
	mov r3, r4
	b finish
next:
	mov r3, r2
	mov r2, r1
finish:	
	mov r1, r0
	ldr r0, warp1
	bl +0x080551DC-0x0805538C
	add sp, #8
	pop {r4-r5, pc}

.align 2
warp1:	.word 0x02031DBC

/*insert at 0x5538C*/
/*with this routine enabled, if the third argument of the warp command is 0xFE, it will instead read the last two arguments as the map and warp ID. the arguments may be vars.*/

Deokishisu · Jan 4, 2015

DoesntKnowHowToPlay said:
In-game trades in FR are at 0x26CF8C. The scripts relating to them store very little information, and just index into this table. Each entry is 0x3C bytes, used as such:

0x0 - Nickname, limited to ten characters + 0xFF.
0xC - Half-word, ID of the NPC's pokemon.
0xE - IVs, stored in HP/Atk/Def/Speed/SAtk/SDef order. One byte each.
0x14 - An entire word dedicated to the ability bit.
0x18 - NPC's trainer ID. Only the low bits are visible on the status screen.
0x1C - Five bytes; four of them are 5 and one is 0x1E. Not sure what they do if anything.
0x24 - Personality value; influences nature, gender, etc; more info here: http://bulbapedia.bulbagarden.net/wiki/Personality_value
0x28 - Hold item.
0x2A - 0x00 if the mon carries mail (only ZYNX has mail in FR), 0xFF otherwise.
0x2B - Original trainer's name. Limited to seven characters + 0xFF.
0x36 - 0x00 if original trainer is male, 0x01 if original trainer is female. Only visible in RSE.
0x37 - Always 0xA. Not sure what it controls if anything.
0x38 - Half-word, ID of the species the NPC is looking for.
0x3A - Half-word, seems unused.

I'm taking an educated guess without actually looking into it, but I believe that one of those unknowns are values for the received Pokemon's contest stats. In the third gen, all in game trades (even in FR/LG) give Pokemon with some contest stats built in. I'm going to guess that the bytes at 0x1C are it, as there are 5 contest stats. The byte at 0x37 may be sheen.

Again, just a guess.

EDIT: There has to be more to that mail byte too. Where is Zynx's mail message stored?

EDIT2: According to this Bulbapedia article, Pokemon given in ingame trades have contest stats all at 5, save for one that's set at 30. This all but confirms that the bytes at 0x1C are the Pokemon's contest stats. It also says that all ingame trade Pokemon have a sheen of ten. The byte at 0x37 is then probably sheen like I thought, since it's always set at 0xA.

redriders180 · Jan 5, 2015

I'm not sure if anybody's done any research on this in the past, but in BPRE, the branch for incenses in breeding starts at 0x08045FD2. At that point, R4 appears to contain an address to the Pokemon's species, and R6 and R2 contain the held items of the two Pokemon. More info in the spoiler.

Spoiler:

It would be fairly simple to put a hook in the table and point to more checks.

daniilS · Jan 10, 2015

E0 at 0806D7C3 will disable all of poison's effects in the overworld.

Percy · Jan 10, 2015

Chaos Rush said:
XY added a feature that gives experience points when you catch pokemon. To duplicate this in Emerald, do the following:

Repoint the battle script at x2dbd84 to point to this:

2A 00 08 42 02 02 05 00 92 BD 2D 08 60 0B 10 0B 01 F1 XX XX XX XX 2E 90 44 02 02 00 2E AC 40 02 02 00 2E AD 40 02 02 00 23 00 10 0F 01 3A 2E 32 43 02 02 00 F2 10 0D 01 3A 2E 32 43 02 02 00 F3 C2 BD 2D 08 F0 13 7A C9 5C 08 12 40 00 28 C3 BD 2D 08

where XX XX XX XX is a pointer to:

2E 90 44 02 02 00 2E AC 40 02 02 00 2E AD 40 02 02 00 23 00 10 0D 01 3A 2E 32 43 02 02 00 F3 C2 BD 2D 08 F0 13 7A C9 5C 08 12 40 00 28 C3 BD 2D 08

To let the player's mons evolve from this experience, replace the bytes at x3DE7C with B5 DE 03 08.

credit obviously goes to DoesntKnowHowToPlay for doing this first on FireRed lol

EDIT: So apparently, as discovered by Tlachtli, if you level up from experience while catching a Pokémon that hasn't yet been recorded to the Pokédex, then the Pokédex screen will have the text displayed in the wrong X-position offset. I'll look into it eventually

Chaos, is this safe to use? Is the bug squashed or something?

GoGoJJTech · Jan 12, 2015

In Fire Red, change the halfword at 21D94 (0x137) to a different song ID and it'll change the wild Pokemon defeated fanfare to another song. Example:

Changing 0x137 (Victory 2) to 0x12B (Battle 6) will allow you to hear the Champion's battle theme every time you defeat a Pokemon in the wild. Tickle yourself with this if you'd like.

Lance32497 · Jan 16, 2015

knizz said:
For FireRed:
If you want to skip the intro: [0x080EC5D0]=0x08078915.
~~If you want to skip the intro+titlescreen: [0x080EC5D0]=0x0800C301.~~
If you want to skip the tutorial+oak:

[0x0800C4C4]=0x08056645

[0x08054A68]=0x4C3C

[0x08054A6A]=0x6820

[0x08054A6C]=0x4900

[0x08054A6E]=0xE001

I want to clarify something, so in 0x800c4c4 I'll insert 08 05 66 45?
knizz said:
EDIT:
If you want to skip the intro+titlescreen:
- [0x080EC5D0]=0x08079255
- [0x080EC5C6]=0xB431
- [0x080EC5C8]=0x4700
Click to expand...
So when these codes are inserted, there will be no titlescreen permanently?
It continues to Continue/New Game/Option part?

Maverickp · Jan 20, 2015

Does someone know the location of the amorphous blob graphics on which the player surfs on in FireRed? It looks like some kind of blue pokémon.
I know there is the answer for Emerald in this thread (p.22), but I'm looking for the FireRed offsets.

Edit: found it, it's at 0x396B08.

knizz · Jan 24, 2015

Lance32497 said:
I want to clarify something, so in 0x800c4c4 I'll insert 08 05 66 45? So when these codes are inserted, there will be no titlescreen permanently? It continues to Continue/New Game/Option part?

The bytes are reversed. So that's 45 66 05 08 at 0x800c4c4 (offset 0xc4c4 in the gba file)
It will permanently disable the start game menu. You can't resume games anymore, after that. You'll have to use the emulators quick saves for that.

C me · Feb 2, 2015

So I was looking at disable's effect and was wondering where a number of things in the script were found.
These are:
- number of turns the effect lasts
- target of the effect (can it affect the user, maybe both targets in a double battle)
- why you can't disable more than one move (it has to store this information in the RAM, maybe there is one RAM offset and if it's taken the effect fails)

Here's the script in Emerald offset 0x2D9507

Spoiler:

The actual disablelastusedattack is one byte i think A3. It points to 0x2D9F1C.

Spoiler:

I don't think the rest of the script is relevant.

If you could change the things I mentioned above you could introduce cool new moves that would be so strong they would get disabled for a few turns. If you could make disable's effect not disappear when you switch out a Pokemon you could prevent a sweep from happening.

I hope there is a way to change these things and they're not hardcoded.

Quick Research & Development Thread

More options

HidoranBlaze

Danny0317

Fluorite's back, brah

DoesntKnowHowToPlay

Tiny Umbrella with Lots and Lots of Good

RichterSnipes

Not even a nibble...

Shiny Quagsire

I'm Still Alive, Elsewhere

Karjam

AKA KarjamP

Spherical Ice

Telinc1

Weirdo Extraordinaire

Shiny Quagsire

I'm Still Alive, Elsewhere

Blah

Free supporter

daniilS

busy trying to do stuff not done yet

Deokishisu

Mr. Magius

redriders180

Mastermind of Pokemon Glazed

daniilS

busy trying to do stuff not done yet

Percy

GoGoJJTech

(☞ﾟヮﾟ)☞ http://GoGoJJTech.com ☜(ﾟヮﾟ☜)

Lance32497

LanceKoijer of Pokemon_Addicts

Maverickp

knizz

C me

Creator of Pokemon League Of Legends