Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Pokémon Discussion

Debug menus in Japanese Crystal - Page 1

Debug menus in Japanese Crystal

Posted by: Háčky
Date: 2016-01-05 09:01:23
I came across what appears to be text for a few debug menus, which are only present in the Japanese version of Pokémon Crystal (not in the English version, and not in Gold and Silver). I havent started to work out how to load the menussomeone else might like to try!but it does look like theres some surviving code. Theyre in bank $12, which is the same bank as the main menu.

$4AE81:
へ



Palette Change may refer to this well-known feature. Reset, Debug Mode On, and Debug Mode Off are vague, but tempting. (A secret switch! Press it? Who wouldnt?)

$4AF2F:





























This appears to be a list of the trainers (plus /Buena) who can be registered on the Pokégears phone.

$4B030:
と

てつど
だ
ぶ

Radio Tower, Pokémon League, Railway, Team Rocket, All Off. Would probably set/clear flags of the major story events.

$4B0A1:


X and Y. Probably not a reference to the sixth-generation games :P

$4B13D:
で
で
き



Phone, Phone Flag, Radio Occupation, Buena Points, GS Ball (!), and Counter (of what?).

$4B1E0:

な


$4B1F2:
みな



All, Raikou, Entei, Suicune.

Re: Debug menus in Japanese Crystal

Posted by: camper
Date: 2016-01-05 10:08:42
I wonder if these are translated in Vietnamese Crystal…

Re: Debug menus in Japanese Crystal

Posted by: Háčky
Date: 2016-01-06 15:08:58
Apparently I hadnt even gotten to the good part, which is in bank $3F:

つ



その
ときの


Fight, Communication Method (based on the following text, this seems to be about selecting from the different Mobile Adapter cables), Field, Sound, Animation, Other, Clock Function, Graphics, Various.

と






ふく
つ



っ
つく

ま
きく


どぐ
と
づく
ま

べ



I dont know what the first one means, other than its something to do with TMs. After that, Game, Warp, Test 14, Recovery, Next , PC, Character, Tool Gear, Experiment, Make, Floor, Egg (written in hiragana), Record, Timer, Various, Item, Bug Catching, Child Making, Be Born, Egg (in katakana this time). The last four are developers names: Hisashi Sogabe, Keita Kagaya, Yoshinori Matsuda, and Tetsuji Oota.

Next there are some text strings that seem to line up with the translated debug strings found in the English version, such as those regarding breeding compatibility. Theres a menu related to clock adjustments, and a list of warp destinations (which looks to be every town except Indigo Plateau, plus Lake of Rage, Mt. Silver, and the Rock Tunnel entrance).

Then it gets even more interesting:


ぺ

Slot Machine, Poker Game, Pair Game, Picross. Were there supposed to be four Game Corner games? And could this have been the reason the GBC version of Pokémon Picross wasnt released?

A string (Test Fight) is followed by a preformatted table that looks eerily similar to something from the Ruby debug ROM:
なまべ
００００００
００００００
００００００
００００００
００００００
００００００


Finally, this looks suspiciously like a track listing for a sound test:


ど
ど
ど










ち
ち
つてく

て
でど


ち
ち
ち
ち






なみの


ま


ま
ち


ど







ち
ど
ど
そく
ね



ぼ




ふ
と
と
と
と
みち
みち
みち
ち
ち


ち

つてく
と





き
き
ぶ
ま

でぱ





とば








I wonder if these are translated in Vietnamese Crystal…

Funny you should ask thatI only found all this because I was in the process of putting together a TCRF article on Vietnamese Crystal ;D (Theres loads of duplicate translations, including some that were probably done by different people, plus a few unreferenced strings that I cant even identify, like SHIRK VERY HANDLY.) The answer is that they translated X, Y, IN, and NOT IN (but didnt use a valid pointer to IN, which set me off on this journey, so a big thank you to whoever made that mistake!). All the really juicy stuff was left untouched.

Re: Debug menus in Japanese Crystal

Posted by: pokechu22
Date: 2016-01-06 18:34:22



ぺ

Slot Machine, Poker Game, Pair Game, Picross. Were there supposed to be four Game Corner games? And could this have been the reason the GBC version of Pokémon Picross wasnt released?


I'm guessing that the "Pair game" reffers to the unused memory game?

Re: Debug menus in Japanese Crystal

Posted by: Háčky
Date: 2016-01-15 22:05:40
[img]http://i.imgur.com/Ew1O6I4.png[/img]
Forcing this menu to appear in place of the Option menu is fairly straightforward, but most of the menu options dont work and a couple of them crash the game.

For example, the (GS Ball) option calls this function:
DebugGSBall: ; 4B205
ld a, $05
call $2FDA
ld a, $0B
ld [$A000], a
call $2FEA
ret
This opens SRAM bank 5 with a call to $2FDA, then sets $A000 to $0B, then closes SRAM with a call to $2FEA.

Or, it would, except that the functions to open and close SRAM are at $2F9D and $2FAD, not $2FDA and $2FEA. Apparently this debug code was built for a different version of the ROM, and the calls to functions above around $2E00 in bank 0 are offset by exactly $3D bytes. Restoring the functionality of this menu is just a matter of correcting these several function calls; Ive attached an IPS patch which does this.

So, what does this menu do?

Phone (で)
[img]http://i.imgur.com/HvoPmKZ.png[/img]
Brings up this submenu in which a trainer can be selected. After you make a selection, and close the menu, you will receive a phone call from that trainer, regardless of whether theyre registered in your Pokégear.

Phone Flags (で)
[img]http://i.imgur.com/ayZTClP.png[/img]
Brings up this submenu, which allows certain event flags (having nothing to do with the phone?) to be set or cleared. と sets event flag $021, named [tt]EVENT_CLEARED_RADIO_TOWER[/tt] in pokecrystal. sets event flag $044, [tt]EVENT_BEAT_ELITE_FOUR[/tt]. てつど sets event flag $0CD, [tt]EVENT_RESTORED_POWER_TO_KANTO[/tt]. だ sets event flag $022, [tt]EVENT_CLEARED_ROCKET_HIDEOUT[/tt]. ぶ clears all four of these flags.

Radio Occupation (き)
Sets $D84A to $7F, which gives the player all Johto badges except the Rising Badge. Team Rockets occupation of the Radio Tower begins when the seventh badge is received.

Buena Points ()
Sets $DC11 to $1D. This puts 29 points on the Blue Card, one short of the maximum.

GS Ball ()
Sets offset $A000 of the save file to $0B. This has no apparent effect. Im guessing the Mobile Adapter needs to be connected before the GS Ball can be received at the PokéCom Center?

Counter ()
Calls function 41:6255. This is [tt]_MobilePrintNum[/tt] in pokecrystals misc/mobile_41.asm. Apparently this function is supposed to print a number on the screen, but the debug menu code doesnt set any parameters and it doesnt appear to do anything.


There doesnt seem to be any surviving code for the first debug menu with the Palette Change/Reset/Debug Mode On/Debug Mode Off options. There are a few functions related to the X and Y strings, but I havent figured what they do yet. Theres a lot of code associated with the Raikou/Entei/Suicune menu, suggesting that it must do something quite elaborate. I havent even started on bank $3F.

Re: Debug menus in Japanese Crystal

Posted by: Stackout
Date: 2016-01-16 10:20:32
Nice work. The thing with the SRAM functions, and that this debug stuff is not in any other gen2 game, makes me think that it's in there because of a linker fuckup.

Any chance of making Game Genie codes to get this working? (Game Genie on GB/C are for ROM patches, right?)

Re: Debug menus in Japanese Crystal

Posted by: Háčky
Date: 2016-01-18 00:19:23

Nice work. The thing with the SRAM functions, and that this debug stuff is not in any other gen2 game, makes me think that it's in there because of a linker fuckup.

It looks like the release build of bank $12 was written over the top of the debug build. The release code runs from $48000 to $4AE7C. The rest of the bank ought to be filled with $00, but instead the area from $4AE7D to $4B9E8 is code from the debug build. $4AE7E is the start of the Palette Change/Reset/Debug Mode menuthe code and header for that menu would likely have been in the region that was overwritten. Some of the leftover debug-build code is just normal gameplay functions that also appear in the release build of bank $12.

Im guessing the same thing happened in bank $3F, and probably any other bank that had debug code in it. But odds are that Game Freak wasnt nice enough to place all of their debug code near the end of a bank, so some leftovers could be perfectly mundane. I guess wed at least be able to tell how many bytes were removed.

Any chance of making Game Genie codes to get this working? (Game Genie on GB/C are for ROM patches, right?)

Yes, but it only accepts three codes at a time, and GBC-only cartridges like Pokémon Crystal wont even fit in the cartridge slot :P

But just in case youd like to enter the codes into an emulator rather than an actual Game Genie

Replace the Option menu with something more entertaining:
008-189-D5D
008-199-085
008-1A9-4C2
??8-1C9-E6E
??8-1E9-A27
??8-1F9-807
018-229-F72
The question marks are where the bank and address go. The phone/flags/etc. menu is at 12:70DE, so enter 12 DE 70.

Patch function calls for Phone option:
D7E-AA9-B3A
2FE-AB9-2AA
DCE-C39-80E
34E-C49-3BE

Patch function calls for Phone Flags option:
41F-EF9-193
41F-F79-193
41F-FF9-193
410-078-193
410-208-193

Patch function calls for GS Ball option:
9D2-088-801
AD2-108-4C1



Coordinates viewer
[img]http://i.imgur.com/WIlaJpB.png[/img]
Displays the player characters map coordinates in hexadecimal.

This function is at 12:7048, so enter 12 48 70 into the above code to replace the Option menu.
However, with this code, the game will freeze when exiting the coordinates window. Surely theres a way around that, but I havent bothered to find it.

Patch function calls for coordinates viewer:
8C0-498-C4D
CC0-5F8-C4E
310-608-2A2
B00-658-5DD
B00-6E8-5DD
A10-718-911


Rainbow Wing test
[img]http://i.imgur.com/V5B6EH8.png[/img] [img]http://i.imgur.com/ie0MGNi.png[/img] [img]http://i.imgur.com/KdtBQho.png[/img]
Selecting Raikou, Entei, or Suicune on this menu brings up a text box which will say if that Pokémon is present in either the party or PC with the players OT name and ID, or な if not. Selecting みな will check for all three beasts and display if all three are present, or な if at least one is absent. Catching all three legendary beasts and having them in the party or PC is the prerequisite for obtaining the Rainbow Wing. (I guess they didnt think someone would put them in the Day Care)

This function is at 12:7173, so enter 12 73 71 into the above code to replace the Option menu.

Patch function calls for Rainbow Wing test:
9D2-958-801
AD2-AA8-4C1
AD2-BA8-4C1
9D2-D08-801
AD2-F28-4C1
AD3-098-4C1


Other isolated debug functions
Function4aea5:
call Special_CelebiShrineEvent
ret

This plays the animation of Celebi descending into Ilex Forest.

[img]http://i.imgur.com/ysnU712.png[/img]

Function4b16c:
callba Function16d43b
ret

This ends up displaying a non-functional Mobile Trade screen:

[img]http://i.imgur.com/tuKeG0b.png[/img]

BOGUS_OFFSET EQU $3d

Function4b213:
ld a, $ff
call RandomRange + BOGUS_OFFSET ; $2f83 + $3d
ld [PlayerID], a ; $d48c
ld a, $ff
call RandomRange + BOGUS_OFFSET
ld [PlayerID + 1], a
ld a, $ff
call RandomRange + BOGUS_OFFSET
ld [wSecretID], a ; $d83d
ld a, $ff
call RandomRange + BOGUS_OFFSET
ld [wSecretID + 1], a
ret

This sets the trainer ID and secret ID to random values.

Function4b234:
callba $4b483
ret

This calls (using an unnecessary bank switch) the debug builds copy of the function which displays a menu used to select three Pokémon for mobile battles.

(Id initially thought that menu was something unused, because unlike in later generations, Crystals Battle Tower does not give you a menu to select your three Pokémon; the clerk just wont let you in unless you have exactly three in your party. If they created such a menu for mobile battles, why didnt they also use it for the Battle Tower?)


The remaining functions appear to be identical to whats in the release build, including the code that executes the Rainbow Wing search, the nearly-identical code that searches for a species irrespective of OT, and the aforementioned menu for selecting three Pokémon. These non-debug functions altogether take up 1966 bytes, which is likely the amount of other debug code in bank $12 that didnt make it into the ROM. :'(

Re: Debug menus in Japanese Crystal

Posted by: SatoMew
Date: 2016-01-18 09:39:34
These are amazing findings, Háčky! :)


GS Ball ()
Sets offset $A000 of the save file to $0B. This has no apparent effect. Im guessing the Mobile Adapter needs to be connected before the GS Ball can be received at the PokéCom Center?


Manually setting $A000 to $0B in BGB worked for me. Here's a video. (and, for the sake of comparison, the same event in Western Crystal)

Re: Debug menus in Japanese Crystal

Posted by: Háčky
Date: 2016-01-18 15:39:10
Manually setting $A000 to $0B in BGB worked for me. Here's a video. (and, for the sake of comparison, the same event in Western Crystal)


Oh. It didnt work for me becauseI was using a save file in which the GS Ball had already been obtained. *facepalm*



As I suspected, bank $3F went through exactly the same process as bank $12. The release build ends at $FD412. The debug build segment starts midway through the text [$D066]き[$D046]はっく！ (localized as How is that [$D086] I traded you doing? Your [$D050]s so cute!), which appears in the release build at $FD13C and would have started in the debug build at $FD407 (the first 12 bytes are cut off). This implies there would have been 715 bytes of debug code earlier in this bank.

The first 712 bytes of the debug leftovers ($FD413$FD6DA) are normal text and code related to in-game trades and Mom buying items with your money. (The three-byte discrepancy is because the release build ends with a [tt]nop[/tt] and two [tt]ret[/tt]s, which are likely artifacts of the debug code being cut from the release build.) This leaves us with a region from $FD6DB to $FF5D1 which ought to be 100% pure debugging goodness.

Its great that theres so much debug codebut not so great that all of it will need to be patched to work in the release build. That may take a while.

Re: Debug menus in Japanese Crystal

Posted by: Háčky
Date: 2016-02-28 18:02:53
Yeah, that took a while.

Since many of the debug functions in bank $3F make calls to various other banks, I ended up looking at the end of every bank in order to find all fragments of the debug build, and piece together a map of known correspondences between addresses in the debug build and the release build. As it turns out, all surviving fragments other than those in banks $12 and $3F simply duplicate the regular code/data at the end of the bank. However, these fragments are useful, because pointers or function calls can be compared with the equivalent code in the release build to find the corresponding addresses.

Its sort of like a giant Pokémon Picross puzzle, without the pesky microtransactions :P

Ive made the assumption that if two locations in a bank have the same offset between the two builds, then everything between those two locations will also have the same offset. This assumption would fail if a number of bytes was removed from the release build in one place and the exact same number of bytes was added in a different place, but that seems unlikely. In fact, it seems unlikely that anything would be added in the release build that wasnt in the debug buildbut that apparently did happen in bank $24, which is why the one offset in the table below is negative.

[table]
[tr][td]Bank[/td][td]Release[/td][td]Debug[/td][td]Offset[/td][/tr]
[tr][td]00[/td][td]000025E2[/td][td]000025E2[/td][td]0[/td][/tr]
[tr][td]00[/td][td]2AFB3F42[/td][td]2B383F7F[/td][td]3D[/td][/tr]
[tr][td]01[/td][td]7B587E1E[/td][td]7BBB7E81[/td][td]63[/td][/tr]
[tr][td]03[/td][td]7F227F26[/td][td]7F277F2B[/td][td]5[/td][/tr]
[tr][td]09[/td][td]501A7D85[/td][td]506B7DD6[/td][td]51[/td][/tr]
[tr][td]0B[/td][td]7E387E46[/td][td]7E3F7E4D[/td][td]7[/td][/tr]
[tr][td]0F[/td][td]68FA[/td][td]6991[/td][td]97[/td][/tr]
[tr][td]0F[/td][td]7D407E9D[/td][td]7DDF7F3C[/td][td]9F[/td][/tr]
[tr][td]12[/td][td]400066CF[/td][td]400066CF[/td][td]0[/td][/tr]
[tr][td]12[/td][td][/td][td]66D0723A[/td][td][/td][/tr]
[tr][td]12[/td][td]66D06E7C[/td][td]723B79E7[/td][td]B6B[/td][/tr]
[tr][td]13[/td][td]6F577358[/td][td]7359775A[/td][td]402[/td][/tr]
[tr][td]20[/td][td]53E65F01[/td][td]541D5F38[/td][td]37[/td][/tr]
[tr][td]24[/td][td]40004251[/td][td]40004251[/td][td]0[/td][/tr]
[tr][td]24[/td][td]64396C3A[/td][td]642C6C2D[/td][td]D[/td][/tr]
[tr][td]25[/td][td]7AC07C11[/td][td]7B027C53[/td][td]42[/td][/tr]
[tr][td]25[/td][td]7EEE7F3F[/td][td]7F407F91[/td][td]52[/td][/tr]
[tr][td]2E[/td][td]60DD620E[/td][td]620F6340[/td][td]132[/td][/tr]
[tr][td]34[/td][td]79C27C32[/td][td]7C337EA3[/td][td]271[/td][/tr]
[tr][td]3F[/td][td]5148540F[/td][td]541356DA[/td][td]2CB[/td][/tr]
[tr][td]3F[/td][td][/td][td]56DB75D1[/td][td][/td][/tr]
[tr][td]40[/td][td]46FD48A6[/td][td]49964B3F[/td][td]299[/td][/tr]
[tr][td]40[/td][td]76CA7AF9[/td][td]7AFA7F29[/td][td]430[/td][/tr]
[tr][td]41[/td][td]637D6397[/td][td]678B67A5[/td][td]40E[/td][/tr]
[tr][td]41[/td][td]67BA6E22[/td][td]6E23748B[/td][td]669[/td][/tr]
[tr][td]46[/td][td]7F997F9F[/td][td]7FA07FA6[/td][td]7[/td][/tr]
[tr][td]5C[/td][td]400040B0[/td][td]400040B0[/td][td]0[/td][/tr]
[tr][td]5C[/td][td]6B127354[/td][td]73557B97[/td][td]843[/td][/tr]
[tr][td]5E[/td][td]76077628[/td][td]7629764A[/td][td]22[/td][/tr]
[/table]

The attached IPS patch fixes (I think) all of the resolvable function calls in the debug code of banks $12 and $3F. This patch doesnt enable access to any debug menus, it just makes them work if you do access them. There are over 150 bytes changed in bank $3F, so it doesnt seem practical to list them all as Game Genie codes.

Ive also come up with a simpler Game Genie code for accessing debug menus, which relies on the Select button rather than the Option menu. This avoids issues with popping windows. It does cause some graphical issues with some menus, most of which can be solved by opening and closing the Start menu both before and after pressing Select.

??B-609-F7A
??B-619-3BF
??B-629-2A7

The first line is the bank number and the last two are the address in little-endian order. For example, to call 3F:5C3D when the Select button is pressed, enter the codes 3FB-609-F7A · 3DB-619-3BF · 5CB-629-2A7.

Most of the text scripts (as opposed to raw strings such as the menu options) within bank $3Fs debug code are translated in the English ROMs bank $6F. Ive put these official translations in quotation marks, whereas my own translations are in italics. Note that some of the official translations dont quite make sense in the context that theyre used.


[size=12pt]Debug menu (3F:56DB)[/size]
[img]http://i.imgur.com/cpwbc2Y.png[/img]

The text to the left says ROM Version. The displayed build date is stored in ASCII, presumably because it was automatically generated by the build system, and is converted at runtime to the games own character set.

This menu actually has nine programmed options, but is set to display only the first, second, third, fourth, ninth, fifth, eighth, and sixth, in that order. The missing seventh option is ときの Clock Function. Additionally, theres unreferenced code for a menu related to Mobile Adapter cables, plus one other function thats no longer functional, in the midst of the code for these menu options.

Fight ()
DebugFight: ; fd8b7
ld hl, wMonStatusFlags
set 0, [hl] ; Disable post-battle text.

predef $3a

ld hl, wMonStatusFlags
res 0, [hl] ; Re-enable post-battle text.
ret

This calls predef $3A.

What is predef $3A, you ask?

Itsjust a [tt]ret[/tt].

Specifically, its one of those two [tt]ret[/tt]s at the end of the release build of bank $3F. This implies that the intended function should exist somewhere in the debug build, but theres technically no way to know which function it is.

Lets take a wild guess and say that its 3F:657C, because that one has something to do with a fight.

[img]http://i.imgur.com/wikeAGE.png[/img][img]http://i.imgur.com/R3ztyBN.png[/img]

On the first screen, the players party may be chosen. The D-Pad moves the cursor, A increments the selected value, and B decrements it. The Pokédex number defaults to 000 (no Pokémon) and may be set to any value from 000 to 253 (glitch Egg). The level also defaults to 000which, if left at that value, also means that no Pokémon will be generatedbut can only be changed to a value from 001 to 100. The party Pokémon will be generated with their standard level-up moves for the chosen species and level. Pressing Start moves on to the second screen.

[img]http://i.imgur.com/h91Kp6f.png[/img][img]http://i.imgur.com/KOHF0ws.png[/img][img]http://i.imgur.com/dWEE5ns.png[/img][img]http://i.imgur.com/0qbzKAj.png[/img]

This screen is for setting up the opponent. The option at the top can be toggled between Wild Monster and Trainer.

For a wild Pokémon, the species and level may be set as on the previous screen, and the default level-up moves will be displayed. By scrolling down, the four moves can be changed to any value from 0 (no move) to 251 (Beat Up).

For a Trainer, the trainer class and level (actually the roster number, just like in the long-range trainer glitch in Generation I) can be set. The trainer class selection has a minor bug: pressing A cycles through values from 001 to 066 (Rocket Grunt ), while pressing B when the value is 000 or 001 resets it to 061 (Twins). Either way, its not possible to select trainer class 067 (Mysticalman), which was added in Crystal. The level can be set from 001 to 100, but defaults to 020, even though its initially displayed as 000. If the level is greater than the number of rosters assigned to that trainer class, then the roster is taken from a subsequent trainer class.

Pressing Start begins the battle. The game will return to the party selection screen after the battle, so another test fight can be set up. Pressing Select exits the test fight menu.

Side effects include:


The code for this menu is a sprawling mess and I havent analyzed it thoroughly, so it probably has other effects that Ive missed.

Communication Method (つ)
Calls 01:5BB9, which is in the middle of an instruction. It must have been calling something that was moved or excluded from the release build.

Field ()
DebugField: ; fd780
callba EraseBattleTowerStatus ; 05:4d09
callba ResetWRAM ; 01:5b96?
ret

The first function call sets offset $A800 of the save file to $00. Its known that this offset is checked upon entering the PokéCom Center and that the game may crash if its greater than $05. The corresponding function in the English version clears offset $3E45 instead, which is apparently used for the Battle Tower. This function is called when overwriting the old save file after starting a new game.

The second function clears game data from WRAM, as is done when starting a new game (without erasing the previous save file). However, 01:5B96 is very close to the 01:5BB9 thats called by the Communication Method option, so its likely that both of these were pointing to the 99 bytes of overwritten debug code in bank 1.

Sound ()
[img]http://i.imgur.com/DxuZpTy.png[/img]

Pressing Up and Down selects a music track (starting with track 0, Stopwhich is, of course, Lances and Reds encounter themeand ending with track 102, PokéCom), and pressing A plays it. Left and Right select a sound effect (ranging from 000 to 206), and Start plays it. Not mentioned in the on-screen instructions is that pressing B will stop the music. Theres no way to exit this screen, but why would you want to do that?

Various ()
Calls 41:68DD, which is likely part of the 603 bytes of overwritten debug code known to have been somewhere between 41:67A5 and 41:6E23.

Animation ()
Calls 34:4695, which is immediately after code related to Pokémon frontsprite animations, and was probably the location of the 625 bytes of overwritten debug code in that bank.

Graphics ()
[img]http://i.imgur.com/WlDaaIq.png[/img]

Brings up a submenu with options Pokémon and Trainer. Selecting either option sets $D002 accordingly and then calls 20:541D. This is clearly supposed to be calling the Pokémon/trainer palette test, which is at 20:53E6 in the release build.

Other (その)
DebugOther: ; fd8ce
callba $10ed51
call WaitPressAorB_BlinkCursor ; $0a76
callba $108d13
callba $108026
callba $10802a
callba $108000
callba $108016
callba $108012
ret

The first call is to a function thats unused in the final game, which displays the title screen. Pressing A twice will move on to the remaining code. Theres some sort of screen corruption/flickering that appears on the title screen and persists afterward; Im not quite sure what this is, or why it happens.

The rest of these functions are used to display a mobile trade between Game Freak, who trades a Venusaur with OT 08961 び (does this mean something?), and Creatures, who trades a Charizard with OT 22020 Matsumiya. (Those OT IDs are 23 01 and 56 04 in hexadecimal.)

Clock Function (ときの)
Calls 3F:40BE, which must have been part of the 715 bytes of debug code that was overwritten earlier in this bank.

Unreferenced Mobile Adapter menu (3F:579D)
[img]http://i.imgur.com/RVIFSzF.png[/img][img]http://i.imgur.com/00leFD8.png[/img]

This menu has the options な Nothing, Mobile, CDMA, DoCoMo PHS, DDI PHS, and Unlimited Mobile. Selecting an option will set offsets $E800 and $9000 of the save file (with the value at $9000 being the ones complement of the value at $E800) and display a corresponding message:

[table]
[tr][td]Option[/td][td]$E800[/td][td]$9000[/td][td]Message[/td][/tr]

[tr][td]な
Nothing[/td]
[td]$00[/td][td]$FF[/td]
[td]なにつなってな
There is nothing connected.[/td][/tr]

[tr][td]
Mobile[/td]
[td]$01[/td][td]$FE[/td]
[td]でのくに！
Check cell phone adapter.[/td][/tr]

[tr][td]
CDMA[/td]
[td]$02[/td][td]$FD[/td]
[td]のくに！
Check CDMA adapter.[/td][/tr]

[tr][td]
DoCoMo PHS[/td]
[td]$03[/td][td]$FC[/td]
[td]のくに！
Check DOCOMO PHS adapter.[/td][/tr]

[tr][td]
DDI PHS[/td]
[td]$04[/td][td]$FB[/td]
[td]のくに！
Check DDI PHS adapter.[/td][/tr]

[tr][td]
Unlimited Mobile[/td]
[td]$81[/td][td]$7E[/td]
[td]のくに！
Check unlimited battle mobile adapter.[/td][/tr]
[/table]

Does anyone have a clue as to what an unlimited battle mobile adapter is?

Setting these values (other than Nothing) causes the game to act as if the Mobile Adapter has been connected: the Mobile System GB logo is displayed before the copyright screen; the Mobile and Mobile Stadium options are added to the main menu; Pokémon Cable Club attendants ask whether Id like to make a mobile or cable connection; the PokéCom Centers Administration Office, Trade Corner, and News Machine and the Battle Tower are accessible, and both areas play their special music. Of course, any feature that actually requires sending data through the Mobile Adapter fails with error 10-000:

[img]http://i.imgur.com/kk3fZdA.png[/img]

Unreferenced function (3F:58FC)
Functionfd8fc:
callba WeedleShinyPalette ; 02:68f7
ret

Weedles shiny palette probably wasnt meant to be called as a function. Oddly, there are no other signs that the debug build had anything special in bank $02.


[size=12pt]Quick-start (3F:5983)[/size]
Function 3F:5983 seems to be intended as some sort of accelerated start for debugging purposes. It does a bewildering variety of peculiar things:




[size=12pt]Super-sized debug menu (3F:5C3D)[/size]
[img]http://i.imgur.com/jpnCnuX.png[/img][img]http://i.imgur.com/fwZi6TA.png[/img][img]http://i.imgur.com/eBRsNso.png[/img][img]http://i.imgur.com/XrPdx29.png[/img]

This menu has text for 26 options (not counting と Close and つ Next ), of which 25 have associated code and only 20 are displayed:

Page 1: Warp, づく Breed, つく Make, Tool Gear, PC
Page 2: どぐ Item, ふく Recovery, っ Experiment, Game, Various
Page 3: Test 1, Test 2, Test 3, Test 4, ま Hatch
Page 4: Tamada, Sogabe, Kagaya, Matsuda, Tetsuji

Unused options: Character, Timer, Floor, きく Record, と Bug Catching
Unreferenced text: ま Egg

To replace Tamada (which is useless, and can be quickly accessed by pressing Left to go to page 4) with one of the unused options, use the Game Genie code ??C-36A-B32. Insert the value 03 for Character, 0E for Timer, 10 for Floor, 11 for Record, or 13 for Bug Catching.

Warp ()
[img]http://i.imgur.com/49pKbkC.png[/img]

Brings up a map similar to the one for selecting a Fly destination. The first party Pokémon is used as the cursor. Unlike the Fly map, pressing Down or Right will advance the cursor to the next destination (e.g., from New Bark Town to Cherrygrove City), and pressing Up or Left will move the cursor back to the previous destination. Any Fly destination may be selected, in both Johto and Kanto (the map will switch between the two), regardless of whether the location has been visited. This includes Rock Tunnel, which is programmed as a Fly destination but cannot normally be flown to because the associated flag is never set.

After a destination is selected, the text ま！ Warping is displayed, and the player warps using a spinning animation.

Theres also partial code for a text-based warp menu, which presumably would have been used before the Fly map was created. That menu omits Indigo Plateau, but includes ぶのち My Home. It also calls Lake of Rage のみみ, with katakana , whereas its final name is spelled entirely in hiragana. This could be because Lake of Rage was originally a town.

Breed (づく)
Checks the compatibility of the two Pokémon deposited at the Day Care. If there arent two Pokémon deposited, displays なのでづくできま You need two POKéMON for breeding. If the two Pokémon are incompatible, displays づくできま Breeding is not possible. If they are compatible, displays [$D296]でづくま The compatibility is [$D265]. Should they breed? Saying Yes generates an Egg which can be obtained from the Day-Care Man.

Make (つく)
This menu generates a Pokémon and sends it to your PC. If your Box is full, it fails with the message っぱ！ The BOX is full!

[img]http://i.imgur.com/Ob206ou.png[/img]

At first, only the species is displayed. The species can be set to a value between 001 and 251 using the A and B buttons.

[img]http://i.imgur.com/e3BJF91.png[/img]

Pressing Down reveals five more lines. The second line is the level, which can be set between 001 and 100. The next four lines are the Pokémons moves, which are automatically set to the default level-up moves for the chosen species and level. The moves can be changed to any value between 001 and 251. (Its not possible to make an empty move slot, except when the Pokémon would know fewer than four moves at the chosen level.) If a move cannot be learned by the Pokémon or its pre-evolutions either by level-up, TM/HM, or as an Egg move, then it will be marked with .

[img]http://i.imgur.com/Q6jqsIb.png[/img][img]http://i.imgur.com/OWmfJaw.png[/img][img]http://i.imgur.com/2eo6V5e.png[/img]

Scrolling below the move list reveals three more values: the first is the Attack/Defense IV byte, the second is the Speed/Special IV byte, and the last represents the square root of the stat experience that will be assigned to every stat. (The square root of stat experience is functionally equivalent to EVs in later generations, except that theres no 510 EV cap.) Each of these values can be set between 000 and 255. When one of these values is selected, the Pokémons stats will be calculated and shown on the right of the screen.

Pressing Start closes the menu and sends the Pokémon to your PC.

Tool Gear ()
[img]http://i.imgur.com/s3UKrKH.png[/img]

This submenu seems to be related to the real-time clock, but none of the options have any discernible effect.

[table]
[tr][td]Option[/td][td]Effect[/td][/tr]

[tr][td]と
Clock[/td]
[td]Sets bit 0 of $D831 and clears bit 0 of $D835.[/td][/tr]

[tr][td]ひ
Coordinates[/td]
[td]Sets bit 0 of $D831 and sets bit 0 of $D835.[/td][/tr]

[tr][td]
Adjust[/td]
[td]Calls 3F:4000 _AnimateTileset, which freezes the game because its parameters arent set. Its probably supposed to call an overwritten debug function instead. After that, it calls functions related to refreshing the time-of-day palettes.[/td][/tr]

[tr][td]０び
60 Seconds[/td]
[td]Sets bit 7 of $D835, then jumps to the same code used by Adjust to refresh time-of-day palettes.[/td][/tr]

[tr][td]
24 Hours[/td]
[td]Clears bit 7 of $D835, then jumps to the same code used by Adjust to refresh time-of-day palettes.[/td][/tr]

[tr][td]
Erase or Turn Off[/td]
[td]Clears bit 0 of $D831.[/td][/tr]
[/table]

Bit 0 of $D831 and bits 0 and 7 of $D835 dont seem to be used anywhere. The equivalent addresses for the English version are $D83E and $D842.

PC ()
[img]http://i.imgur.com/dl5qtoZ.png[/img]

Does what it says on the tin.

Item (どぐ)
[img]http://i.imgur.com/yEFy63T.png[/img]

Allows an item in the range of 1 (Master Ball) to 251 (HM09!) to be selected with Up/Down, and a quantity from 1 to 99 to be selected with Left/Right. Pressing A gives you the item and displays [$D05B]にま The [$D073] was put in the PACK. If the corresponding pocket is full, it instead says どぐにま！ That item cant be put in the PACK.

Recovery (ふく)
Heals your Pokémon and displays のくふくま Your POKéMONs HP was healed.

Experiment (っ)
Tries to call a full-screen menu at 40:76B0, which is probably a debug function that was overwritten.

Game ()
[img]http://i.imgur.com/v3w0ZzH.png[/img]

Brings up this submenu with three options and a suspicious gap at the bottom. Selecting an option leads to the prompt [$D066]でそびま Will you play with [$D086]?, where the variable is filled with the name of the option you selected. Slot Machine does exactly what youd expect, Poker Game is Card Flip, and Pair Game is the unused memory game.

Theres unused text for a fourth option, Picross.

Various ()
Calls 41:68DD, the same function called by the other debug menus Various option.

Test 14 ()
Each of these displays the prompt [$D066]ま Test event [$D086]?, where the variable is the corresponding number from 1 to 4. Saying Yes launches an event script. In addition to the four scripts that can be called from this menu, there are nine unused scripts:

[table]
[tr][td]Script[/td][td]Effect[/td][/tr]

[tr][td]
Test 1
(3F:648C)[/td]
[td]Displays the text は！ Start!, fades to white, fades in, then displays ！ End! Is this Game Freaks version of Hello World?[/td][/tr]

[tr][td]
Test 2
(3F:64D1)[/td]
[td]If the player character is a girl, changes her into her Cable Club disguise and says とのに！ For a boy! If shes already wearing the disguise, changes her back to her normal appearance and says なのに！ For a girl!

If the player character is a boy, displays とのにはな！ This doesnt concern a boy![/td][/tr]

[tr][td]
Test 3
(3F:64B4)[/td]
[td]Gives an Egg containing a level 20 Abra. If the party is full, overwrites the sixth party Pokémon with the Egg.[/td][/tr]

[tr][td]
Test 4
(3F:6530)[/td]
[td]Warps the player directly in front of the Hall of Fame machine, and inducts the party into the Hall of Fame (without Lances assistance). As usual, the game rolls the credits, exits to the main menu, and the player is returned to New Bark Town.[/td][/tr]

[tr][td]Unused
(3F:64AE)[/td]
[td]Launches the Dudes tutorial on how to catch Pokémon.[/td][/tr]

[tr][td]Unused
(3F:64B8)[/td]
[td]Causes the Egg in the first party slot to hatch. If the first party member isnt an Egg, it just briefly displays a white screen.[/td][/tr]

[tr][td]Unused
(3F:64C1)[/td]
[td]Causes the player character to briefly run in place, then disappear, then fall back into place from the top of the screen.[/td][/tr]

[tr][td]Unused
(3F:652A)[/td]
[td]A wild level 10 Ditto appears.[/td][/tr]

[tr][td]Unused
(3F:6543)[/td]
[td]Initiates Team Rockets occupation of the Radio Tower.[/td][/tr]

[tr][td]Unused
(3F:654A)[/td]
[td]Rolls the credits as if Red was just defeated, placing the player outside Mt. Silver afterward.[/td][/tr]

[tr][td]Unused
(3F:654C)[/td]
[td]Overwrites the PC item storage with quantity 99 of the items numbered 1 (Master Ball) through 50 (Teru-sama).[/td][/tr]

[tr][td]Unused
(3F:6566)[/td]
[td]Calls function 41:68D6, which is very close to the Various function 41:68DD, and is probably an overwritten debug function.[/td][/tr]

[tr][td]Unused
(3F:656E)[/td]
[td]Displays the Mobile Adapter connection prompt with an incorrect palette. Maybe it would do more than that if a connection could be made.[/td][/tr]
[/table]

Hatch (ま)
If theres an Egg in the party, this makes it ready to hatch on the next step, and display the text ま！ Its going to hatch! (If theres more than one Egg, only the first one is affected.) If theres no Egg in the party, displays な！ There is no EGG.

Tamada ()
Earlier I misread this as . Its actually named after tool programmer Sousuke Tamada. Im guessing hes not an egg. :-[

This calls function 41:68DD, the same one called by the Various option of both this menu and the other one. The only difference is that Tamada passes a value of $01 in register [tt]c[/tt], whereas both instances of Various pass $00.

Sogabe ()
Named after programmer Hishahi Sogabe. Displays the prompt for selecting the level cap for a Battle Tower challenge. After selecting a level, attempts to make a Mobile Adapter connection.

Kagaya ()
Named after programmer Keita Kagaya. Deletes the contents of the Card Folder and removes its passcode.

Matsuda ()
Named after programmer Yoshinori Matsuda. Calls 12:66D0, which would have been the beginning of the debug code in bank $12.

Tetsuji ()
Named after game/script/map designer Tetsuji Oota.

[img]http://i.imgur.com/AzNv8ns.png[/img]

Hey, that looks familiar.

Character ()
DebugCharacter: ; fde86
ld a, $00
ret

Not only has this option been removed from the menu, but the function has been stubbed out. Oh well.

Timer ()
Blanks the screen and then calls 3F:40BE, the same function called by the other debug menus Clock Function.

Floor ()
[img]http://i.imgur.com/17UEH03.png[/img]

If youre standing in the elevator of the Celadon Department Store, displays this elevator menu which has the six floors in reverse order. The elevator will move to the selected floor without any sound or visual effects.

The menu can be viewed outside the elevator as long as the backup map ID is one of the floors of the Celadon Department Storethat is, if youve stepped into the Celadon Department Store elevator, and havent entered another special map since then, such as the Pokémon Center 2F or Goldenrod Department Stores elevatorbut selecting a floor has no effect outside of the elevator.

Record (きく)
Displays two pages of text:

[img]http://i.imgur.com/XyAlT8d.png[/img]
Number of times wild Pokémon were battled: 0
The number is a two-byte value taken from $DBD3, equivalent to $DC0D in the English version. This address is not used by the game and thus should always be 0. The text seems to suggest that functionality similar to Mauville Citys Storyteller was planned.

[img]http://i.imgur.com/1wbqbic.png[/img]
Timer status: 00000000
This number is the value at SRAM address 0:AC80 ([tt]sRTCStatusFlags[/tt]) displayed in binary.

Bug Catching (と)
[img]http://i.imgur.com/PWUG49a.png[/img]

Displays の Remaining Time, followed by the number of minutes and seconds remaining in the Bug-Catching Contest. It even counts down in real time!

Unreferenced dummy function (3F:5D0A)
This function displays the text のきのはつとできま That cant be used right now. Although the localized text doesnt say what that is, the original Japanese refers to a function or feature (きの), implying that this could have been a placeholder for something that wasnt finished.

Unreferenced OT ID editor (3F:610D)
[img]http://i.imgur.com/aGIvK5v.png[/img]

Displays the text へててくだ Which number should be changed? The five-digit number can be edited using Left/Right to move the cursor and Up/Down to change the value. Pressing A changes the OT ID of the first party Pokémon to the chosen value modulo 65536.


[size=12pt]Unreferenced lists[/size]

3F:6E6F
03 63 04 63 0B 63 10 63 11 63 12 63 13 63 14 63
FF

This list looks very much like an item inventory, with every second byte being a quantity of 99. That would mean:


BrightPowder and Ice Heal? Those are some odd choices. Hmmwhat if this was a Generation I item inventory?


That seems more likely.


3F:7261
07 09 0A 0E 10 14 16 1C 31 42 53 59 5B 63 64 67
68 69 72 7D 7E 8B 8E 95 98 9A 9B B2 B3 B4 BB BE
FF

This list is in the middle of the code that checks move legality on the Make submenu.

I think these values make the most sense if theyre read as Generation I Pokémon index numbers:


My best guess is that this is supposed to be a list of Pokémon that, in Red and Green (and international Red and Blue), could only be obtained through evolutioni.e., starter evolutions, trade evolutions, stone evolutions (except Raichu and Wigglytuff, which could be caught in Cerulean Cave), fossil evolutions, and other evolved Pokémon that couldnt be caught in the wild in those games. But Jigglypuff seems out of place (its the only unevolved Pokémon), and Persian, Poliwrath, Primeape, and Rapidash are missing.

Whats a list like that doing in the middle of Crystals debugging tools? Damned if I know.



As a bonus, heres some text from this bank that did get translated in Vietnamese Crystal:

[table]
[tr][td]Japanese[/td][td]Viet Crystal[/td][td]English[/td][/tr]

[tr]
[td]なにつなってな[/td]
[td]NOT SUCCEED[/td]
[td]There is nothing
connected.[/td]
[/tr]

[tr]
[td]での
くに！[/td]
[td]ENSURED THE
BROUGHT
TELLPHONES
ACCESSORIES[/td]
[td]Check cell phone
adapter.[/td]
[/tr]

[tr]
[td]の
くに！[/td]
[td]ENSURED THE CD MA
ACCESSORIES[/td]
[td]Check CDMA
adapter.[/td]
[/tr]

[tr]
[td]の
くに！[/td]
[td]TOCOMOS
ACCESSORIES
ENSURING[/td]
[td]Check DOCOMO PHS
adapter.[/td]
[/tr]

[tr]
[td]の
くに！[/td]
[td]DDIS ACCESSORIES
ENSURING[/td]
[td]Check DDI PHS
adapter.[/td]
[/tr]

[tr]
[td]の
くに！[/td]
[td]THE FIGHTING
ACCESSORIES
ENSURING IS
UNLIMITED[/td]
[td]Check unlimited
battle mobile
adapter.[/td]
[/tr]

[tr]
[td][/td]
[td]MEMORY[/td]
[td]ROM Version[/td]
[/tr]

[tr]
[td][$D05B]
にま[/td]
[td]PUT [$D05B]
IN BAG[/td]
[td]The [$D073]
was put in the
PACK.[/td]
[/tr]

[tr]
[td]づくできま[/td]
[td]DONT MAKE TOO
SMALL[/td]
[td]Breeding is not
possible.[/td]
[/tr]

[tr]
[td][$D296]で
づくま[/td]
[td]MAKE [$D296] SMALL?[/td]
[td]The compatibility
is [$D265].
Should they breed?[/td]
[/tr]

[tr]
[td]な！[/td]
[td]EGG![/td]
[td]There is no EGG.[/td]
[/tr]

[tr]
[td]ま！[/td]
[td]BORNED![/td]
[td]Its going to
hatch![/td]
[/tr]

[tr]
[td]！[/td]
[td]THE END[/td]
[td]End![/td]
[/tr]

[tr]
[td]なのに！[/td]
[td]IS WOMAN![/td]
[td]For a girl![/td]
[/tr]

[tr]
[td]とのには
な！[/td]
[td]NOT RELATE
TO MAN[/td]
[td]This doesnt
concern a boy![/td]
[/tr]

[tr]
[td][/td]
[td]EXAM[/td]
[td]Test Fight[/td]
[/tr]

[tr]
[td]なま[/td]
[td],LEVEL[/td]
[td].NameLevel[/td]
[/tr]

[tr]
[td][/td]
[td]GRACE ELF[/td]
[td]Wild Monster[/td]
[/tr]

[tr]
[td][/td]
[td]COACH[/td]
[td]Trainer[/td]
[/tr]

[tr]
[td]なまべ[/td]
[td]LEVELNUMBER[/td]
[td].NameLevel[/td]
[/tr]

[tr]
[td]き
き
ぼ
ば
とく
とくぼ[/td]
[td]VIGOR
DEFEN
SPEED
PREST[/td]
[td]HP
Attack
Defense
Speed
Spcl. Atk
Spcl. Def[/td]
[/tr]

[tr]
[td]く



[/td]
[td]MUSIC
UP-D
CAST COIN
START[/td]
[td]Music
Up/Down A

Sound Effect
Left/Right Start[/td]
[/tr]
[/table]

Re: Debug menus in Japanese Crystal

Posted by: Stackout
Date: 2016-02-28 21:03:24
Damn, that's some nice reversing writeup if ever I saw one, and I've read all of pocorgtfo.

That list at 3F:7261… I noticed it's in order of index number. I doubt that's a coincidence.

Re: Debug menus in Japanese Crystal

Posted by: SatoMew
Date: 2016-03-04 09:55:46
Wow, I'm flabbergasted by this. Apparently, it's been there for 15 years without anyone finding it :o This is awesome, Háčky, so thank you for actually taking the time to study and document it all :)

The debug ROM code is from the internal October 17, 2000 build. Crystal was released on December 14, 2000 so that it makes almost 2 months in between the two ROMs. It'd be nice if someone leaked debug ROMs of Crystal, hehe ;D

As a reminder, before Pokémon Crystal was officially announced, there was information circulating about an upcoming game tentatively titled Pocket Monsters X (Ｘ) with support for a Game Boy mobile phone adapter. X's initial release date of April 2000 was seemingly postponed until 2001 because of Nintendo's decision to delay the Game Boy Advance from August 2000 to 2001. The servers would be hosted by Kyocera.


For a Trainer, the trainer class and level (actually the roster number, just like in the long-range trainer glitch in Generation I) can be set. The trainer class selection has a minor bug: pressing A cycles through values from 001 to 066 (Rocket Grunt ), while pressing B when the value is 000 or 001 resets it to 061 (Twins). Either way, its not possible to select trainer class 067 (Mysticalman), which was added in Crystal. The level can be set from 001 to 100, but defaults to 020, even though its initially displayed as 000. If the level is greater than the number of rosters assigned to that trainer class, then the roster is taken from a subsequent trainer class.


I wasn't aware that ??? () and RIVAL () were different Trainer classes, or are they? "???" is 0x09, RIVAL is 0x2A. In the trainer palette test, 0x09 takes the previously loaded Trainer class as its own.

Fight seems to generate garbled party Pokémon data at random.


Pressing Up and Down selects a music track (starting with track 0, Stopwhich is, of course, Lances and Reds encounter themeand ending with track 102, PokéCom), and pressing A plays it. Left and Right select a sound effect (ranging from 000 to 206), and Start plays it. Not mentioned in the on-screen instructions is that pressing B will stop the music. Theres no way to exit this screen, but why would you want to do that?


Is it me or are a lot of the sound effects the exact same ones from Red, Green, Blue, and Yellow? They don't seem to be the similar ones from Gold, Silver, and Crystal but it could be a placebo effect. I also remembered the sound effect compilation included with Pokémon Techno (), a bonus track in the official soundtrack of Red, Green, and Blue which was released in Japan on November 1, 1997.

Some of the themes are mislabeled. Kikyo (Violet) plays the Azalea & Blackthorn theme, Hiwada (Azalea) plays the Ecruteak & Cianwood theme, and Yoshino (Cherrygrove) plays the Violet & Olivine theme. My Home is Pallet's theme, which would imply that the creator himself gave it that name (as Pallet is based on his hometown of Machida, Tokyo).

ふ Flute is the radio's Poké Flute channel but is sound 038 (0x26) the old Poké Flute? It can be played by using a restored Teru-sama 0x38 (in Korean Gold and Silver) but I'm not sure if they changed the theme.

Route 26's theme is called . relates to strength, so I guess they see it as the Harsh Road that precedes Victory Road ( Champion Road, called と in the sound test)?

でぱ Mysterious Radio Waves is obviously Team Rocket's evolution-inducing radio signal that plays at the Lake of Rage, and this is how it's called by the official soundtrack of HeartGold and SoulSilver. Printer is the well-known Game Boy Printer theme from Yellow, which was also rearranged for HeartGold and SoulSilver as the Pokéwalker theme. Shame that there is no classic-style version that plays the original :(

Input is the Mobile Center theme (in Stadium 2) while Mobile 1 is the Mobile Link theme. As to PokéCom, I guess we now know where the unused shortened English name for the Pokémon Communication Center, POKéCOM CENTER, comes from ;)

Suicune has the same title as its unused rearrangement 0x166 in the ROM of Ruby and Sapphire, SUIKUN. The official soundtrack of HeartGold and SoulSilver calls the classic-style version, then recycled for Omega Ruby and Alpha Sapphire, ！ Battle! Suicune.


The rest of these functions are used to display a mobile trade between Game Freak, who trades a Venusaur with OT 08961 び (does this mean something?), and Creatures, who trades a Charizard with OT 22020 Matsumiya. (Those OT IDs are 23 01 and 56 04 in hexadecimal.)


(び) is a flower vase so it makes sense, except that Venusaur is not nicknamed and び is the OT's name. is apparently manga slang for the depiction of shock and disappointment. び in katakana also refers to the name of a scrapped Capsule Monsters design that was some sort of special in-game encounter.


Unreferenced Mobile Adapter menu (3F:579D)
[img]http://i.imgur.com/RVIFSzF.png[/img][img]http://i.imgur.com/00leFD8.png[/img]

This menu has the options な Nothing, Mobile, CDMA, DoCoMo PHS, DDI PHS, and Unlimited Mobile. Selecting an option will set offsets $E800 and $9000 of the save file (with the value at $9000 being the ones complement of the value at $E800) and display a corresponding message:

[table]
[tr][td]Option[/td][td]$E800[/td][td]$9000[/td][td]Message[/td][/tr]

[tr][td]な
Nothing[/td]
[td]$00[/td][td]$FF[/td]
[td]なにつなってな
There is nothing connected.[/td][/tr]

[tr][td]
Mobile[/td]
[td]$01[/td][td]$FE[/td]
[td]でのくに！
Check cell phone adapter.[/td][/tr]

[tr][td]
CDMA[/td]
[td]$02[/td][td]$FD[/td]
[td]のくに！
Check CDMA adapter.[/td][/tr]

[tr][td]
DoCoMo PHS[/td]
[td]$03[/td][td]$FC[/td]
[td]のくに！
Check DOCOMO PHS adapter.[/td][/tr]

[tr][td]
DDI PHS[/td]
[td]$04[/td][td]$FB[/td]
[td]のくに！
Check DDI PHS adapter.[/td][/tr]

[tr][td]
Unlimited Mobile[/td]
[td]$81[/td][td]$7E[/td]
[td]のくに！
Check unlimited battle mobile adapter.[/td][/tr]
[/table]

Does anyone have a clue as to what an unlimited battle mobile adapter is?

Setting these values (other than Nothing) causes the game to act as if the Mobile Adapter has been connected: the Mobile System GB logo is displayed before the copyright screen; the Mobile and Mobile Stadium options are added to the main menu; Pokémon Cable Club attendants ask whether Id like to make a mobile or cable connection; the PokéCom Centers Administration Office, Trade Corner, and News Machine and the Battle Tower are accessible, and both areas play their special music. Of course, any feature that actually requires sending data through the Mobile Adapter fails with error 10-000:

[img]http://i.imgur.com/kk3fZdA.png[/img]


Aw yeah, finally a way to unlock the Pokémon Mobile System GB :D

As to the "unlimited battle mobile adapter", I've no idea. For the record, mobile battles could be held by paying the carrier service fees whereas the Battle Tower cost ¥10. (source 1, 2)

I noticed that Mobile Stadium is missing from the main menu. Does this mean that it is only displayed when connected to Stadium 2? Or is the debugging code related only to the Mobile Center and other Pokémon Mobile System GB features?

Another interesting thing is that while starting a new game, the Mobile Center takes the place of the regular screen that asks if you are a boy or a girl.

[img]https://i.imgur.com/m9L5bin.png[/img] [img]https://i.imgur.com/0wanL4U.png[/img]

Forcing Crystal to run in Game Boy mode shows that it skips the Mobile System GB screen loaded on Game Boy Color mode after the boot ROM.


Any Fly destination may be selected, in both Johto and Kanto (the map will switch between the two), regardless of whether the location has been visited.


This would be handy for regular gameplay. In the remakes, they sort of fixed this but you can only fly to either region from Indigo Plateau or Route 26.


Scrolling below the move list reveals three more values: the first is the Attack/Defense IV byte, the second is the Speed/Special IV byte, and the last represents the square root of the stat experience that will be assigned to every stat. (The square root of stat experience is functionally equivalent to EVs in later generations, except that theres no 510 EV cap.) Each of these values can be set between 000 and 255. When one of these values is selected, the Pokémons stats will be calculated and shown on the right of the screen.


Are there any references, used or unused, to まつきのつ innate strengths, which is apparently the Japanese name that Game Freak has always called individual strengths (IVs)? Japanese fans often use the expression "individual values" () though. I've found the kanji rendering of まつきのつ (まつきの強) in use alongside on an old Japanese fan site from 1999-2000 so it's safe to assume that the terminology is as old as Gold and Silver, if not older.


Brings up this submenu with three options and a suspicious gap at the bottom. Selecting an option leads to the prompt [$D066]でそびま Will you play with [$D086]?, where the variable is filled with the name of the option you selected. Slot Machine does exactly what youd expect, Poker Game is Card Flip, and Pair Game is the unused memory game.

Theres unused text for a fourth option, Picross.


Given how the original Pokémon Picross for the Game Boy and Game Boy Color appeared on magazines in early 1999, I suppose this may have been carried over from Gold and Silver.


[table][tr][td]
Test 2
(3F:64D1)[/td]
[td]If the player character is a girl, changes her into her Cable Club disguise and says とのに！ For a boy! If shes already wearing the disguise, changes her back to her normal appearance and says なのに！ For a girl!

If the player character is a boy, displays とのにはな！ This doesnt concern a boy![/td][/tr][/table]


Is this disguise code reused in normal gameplay or does the game use something else?

Re: Debug menus in Japanese Crystal

Posted by: Háčky
Date: 2016-03-04 22:24:33
I wasn't aware that ??? () and RIVAL () were different Trainer classes, or are they? "???" is 0x09, RIVAL is 0x2A. In the trainer palette test, 0x09 takes the previously loaded Trainer class as its own.


$09 is the rivals trainer class for the first five battles; $2A is for the sixth and seventh battles where he has a different sprite. Both of these classes are named RIVAL () internally, although this name isnt shown when you battle him. (I guess it would be a bit of a spoiler if the first battle said RIVAL ??? wants to fight!)

The Test Fight menu gets the trainer class name using the function [tt]GetTrainerClassName[/tt], which inexplicably treats trainer class $09 ([tt]RIVAL1[/tt] in pokecrystal) as a special case and returns the rivals given name (in your case ???; in my case its because I ran that silly quick-start function), but doesnt do the same for $2A. This function is only used in-game for phone calls, the Bug-Catching Contest, and the Places and People radio show (which cannot mention the rival, Prof. Oak, Cal, or Red), so that behavior is never seen.

Some of the themes are mislabeled. Kikyo (Violet) plays the Azalea & Blackthorn theme, Hiwada (Azalea) plays the Ecruteak & Cianwood theme, and Yoshino (Cherrygrove) plays the Violet & Olivine theme.


I hadnt noticed that. I wonder if these tracks got shuffled around as the Johto region was redesigned?

Looking over it again, another odd track name is ち Victory 4, which follows the three standard victory themes (Trainer Battle, Wild Pokémon, and Gym Leader). This track is used for Mt. Moon Square (confusingly called Mt. Moon on the HG/SS soundtrack, whereas the music played inside Mt. Moon is Rock Tunnel). If it was originally written as a victory theme, that would certainly explain why its so short.

Printer is the well-known Game Boy Printer theme from Yellow, which was also rearranged for HeartGold and SoulSilver as the Pokéwalker theme. Shame that there is no classic-style version that plays the original :(


Completely off-topic, but something I dont think Ive ever seen mentioned is that the looping part of the printer theme is channel 3 of Pikachus Beach played at a much slower tempo. The only unique section is the second measure of the intro (B E D C B A G F).

(び) is a flower vase so it makes sense, except that Venusaur is not nicknamed and び is the OT's name. is apparently manga slang for the depiction of shock and disappointment. び in katakana also refers to the name of a scrapped Capsule Monsters design that was some sort of special in-game encounter.


That last point strongly suggests to me that び is Kōji Nishinos nickname (from which was derived), which would make sense as a counterpart to Matsumiya.

I noticed that Mobile Stadium is missing from the main menu. Does this mean that it is only displayed when connected to Stadium 2? Or is the debugging code related only to the Mobile Center and other Pokémon Mobile System GB features?


The Mobile Stadium option appears if, in addition to those other two Mobile Adapter values being set, offset $E000 of the save file is not $00. This was already set in my save file; I think it was corrupted by a dodgy emulator in the past. It should be possible to use an N64 emulator with Transfer Pak support to see if Stadium GS sets this value.

Are there any references, used or unused, to まつきのつ innate strengths, which is apparently the Japanese name that Game Freak has always called individual strengths (IVs)? Japanese fans often use the expression "individual values" () though. I've found the kanji rendering of まつきのつ (まつきの強) in use alongside on an old Japanese fan site from 1999-2000 so it's safe to assume that the terminology is as old as Gold and Silver, if not older.


That term doesnt appear in the ROM.


[table][tr][td]
Test 2
(3F:64D1)[/td]
[td]If the player character is a girl, changes her into her Cable Club disguise and says とのに！ For a boy! If shes already wearing the disguise, changes her back to her normal appearance and says なのに！ For a girl!

If the player character is a boy, displays とのにはな！ This doesnt concern a boy![/td][/tr][/table]


Is this disguise code reused in normal gameplay or does the game use something else?


The Test 2 script sets/clears the flag [tt]ENGINE_KRIS_IN_CABLE_CLUB[/tt] and calls the special commands [tt]ReplaceKrisSprite[/tt] and [tt]Special_SetPlayerPalette[/tt], which are the same commands used by the Cable Club scripts. The real Cable Club scripts are slightly more elaborate in that they spin the player around and play a sound effect.

Re: Debug menus in Japanese Crystal

Posted by: SatoMew
Date: 2016-03-05 19:30:16

$09 is the rivals trainer class for the first five battles; $2A is for the sixth and seventh battles where he has a different sprite. Both of these classes are named RIVAL () internally, although this name isnt shown when you battle him. (I guess it would be a bit of a spoiler if the first battle said RIVAL ??? wants to fight!)


I see. If we somehow forced the game to display RIVAL, would that have any negative side effects?

Not surprisingly, $09 in Test Fight under a completely fresh save file returns the rival's name as "???" just like in his actual first battle.


I hadnt noticed that. I wonder if these tracks got shuffled around as the Johto region was redesigned?


You mean during the development of Gold and Silver? It's likely.


Looking over it again, another odd track name is ち Victory 4, which follows the three standard victory themes (Trainer Battle, Wild Pokémon, and Gym Leader). This track is used for Mt. Moon Square (confusingly called Mt. Moon on the HG/SS soundtrack, whereas the music played inside Mt. Moon is Rock Tunnel). If it was originally written as a victory theme, that would certainly explain why its so short.


HeartGold and SoulSilver differ from Gold, Silver, and Crystal in this regard.

In the originals, Mt. Moon uses the same theme as the Rock Tunnel and a separate theme for Mt. Moon Square. In the remakes, Mt. Moon plays つなのどくつ Union Cave (classic-style version) whereas Mt. Moon Square also plays つきみま Mt. Moon (classic-style version). The Rock Tunnel still plays the same theme so the official soundtrack labeled the track Rock Tunnel (classic-style version).

Mt. Moon Square in HeartGold and SoulSilver even plays Union Cave most of the time, except between Monday nights and Tuesday dawns, but it's been a while so I'll confirm this next Monday.


The Mobile Stadium option appears if, in addition to those other two Mobile Adapter values being set, offset $E000 of the save file is not $00. This was already set in my save file; I think it was corrupted by a dodgy emulator in the past. It should be possible to use an N64 emulator with Transfer Pak support to see if Stadium GS sets this value.


Which N64 emulator do you recommend?


The Test 2 script sets/clears the flag [tt]ENGINE_KRIS_IN_CABLE_CLUB[/tt] and calls the special commands [tt]ReplaceKrisSprite[/tt] and [tt]Special_SetPlayerPalette[/tt], which are the same commands used by the Cable Club scripts. The real Cable Club scripts are slightly more elaborate in that they spin the player around and play a sound effect.


Oh, thanks, as well as for the rest of the information I didn't quote :)

Re: Debug menus in Japanese Crystal

Posted by: SatoMew
Date: 2016-03-07 14:41:34

Mt. Moon Square in HeartGold and SoulSilver even plays Union Cave most of the time, except between Monday nights and Tuesday dawns, but it's been a while so I'll confirm this next Monday.


My memory was correct. In HeartGold and SoulSilver, Mt. Moon only plays during the weekly Clefairy event.