# Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

## Arbitrary Code Execution Discussion

### ACE: Manipulate encounter - Page 1

Previous Page

- 1

Next Page

#### ACE: Manipulate encounter

Posted by: Dante
Date: 2016-06-10 12:55:42
So, I need to manipulate my next encounter. How can I do that with ACE? More importantly, I need to know Assembly in order to write by myself the code or there's some kind of converter from C or C# or anything else (like XSE for GBA games)?
I want to fight the professor OAK in EU Version of pokemon Red with his real team, not glitched.
Any suggestion?
PS: I'm specifically interested in this method, I know I can achieve that with ditto's glitch

#### Re: ACE: Manipulate encounter

Posted by: Torchickens
Date: 2016-06-10 16:58:20

> So, I need to manipulate my next encounter. How can I do that with ACE? More importantly, I need to know Assembly in order to write by myself the code or there's some kind of converter from C or C# or anything else (like XSE for GBA games)?
> I want to fight the professor OAK in EU Version of pokemon Red with his real team, not glitched.
> Any suggestion?
> PS: I'm specifically interested in this method, I know I can achieve that with ditto's glitch

Hi Dante. Modifying D059 (Pokémon/Trainer) and D05D (Roster) (or D058 and D05C in Yellow) will allow you to access every Pokémon with index numbers 1-199, and every real (and many glitch) Trainers in the game. The values for Professor Oak are 226 in D059 and 1 (Blastoise), 2 (Venusaur) or 3 (Charizard) in D05D.
The following code will enable you to access the Professor Oak roster of your choice.
`3E E2 EA 59 D0 04 3E xx EA 5D D0 C9`
Lemonade x226
TM34 x89 (x88 in Yellow)
TM08 x04
Lemonade x (roster)
TM34 x93 (x92 in Yellow)
TM08 x201
To look up the ASM interpretation of the code, refer to this page.
We can walk through the code I just wrote, below.
ld a, E2 - Register 'a' becomes E2; the value for Prof. Oak in the Big List
ld (D059),a - Load 'a' into D059 (instant encounter address)
inc b - Useless code, added for good item representation
ld a, xx - Register 'a' becomes the roster value (we want 1, 2 or 3)
ld (D05D),a - Load 'a' into D05D (Trainer roster)
ret - End code (actually return to the address in sp, which we have not changed)
Memory addresses can be found at Datacrystal and on the Pokémon Red disassembly.
There is a C-language to Game Boy game converter on this website that may be useful (although I've never tried this) if you want to make a game to execute such as Pong (first use 8F or ws m to store the code in free space such as boxed Pokémon, and then jump to it).
However, if you simply want to edit a memory address or call an existing ROM function, you're best off writing the raw code.
Hope that helps!

#### Re: ACE: Manipulate encounter

Posted by: Dante
Date: 2016-06-10 17:24:57
Thank you a lot ;D really good stuff

#### Re: ACE: Manipulate encounter

Posted by: Torchickens
Date: 2016-06-10 17:44:04

> Thank you a lot ;D really good stuff

You're welcome!

#### Re: ACE: Manipulate encounter

Posted by: Dante
Date: 2016-12-08 12:51:07
For future reference:
I had time to use this code only today: it didn't worked. I found out that the EU (Non english) version of the game have the addresses shifted: so you need 94 and 98 TM34 instead of 89 and 93.

#### Re: ACE: Manipulate encounter

Posted by: ISSOtm
Date: 2016-12-10 05:27:04
Actually, for all addresses starting at ~CE00 (can't exactly determine where) there is a 5-byte shift in RAM addresses. You need to add 5.

#### Re: ACE: Manipulate encounter

Posted by: Krys3000
Date: 2016-12-22 06:15:17
It's in WRAM, so $CF00 to $DFFF
Previous Page

- 1

Next Page