Brock Through Walls addendums
Posted by: Torchickens
Date: 2019-08-26 00:58:54
An answer to this can be found here:
https://github.com/pret/pokered/blob/6ba3765c5932996f5da6417ae703794ff10bb1cb/engine/overworld/pewter_guys.asm
Before the Pewter Gym guy (or Pewter Museum guy! hence the Yellow walk through walls glitch with him and TheZZAZZGlitch's recent finds) can walk their main paths, they must perform a smaller path based on the player's coordinates so that both the player and the NPC are guided correctly.
The actions in the scripts are based on a string of bytes terminated by 0xFF, such as:
.one
db D_LEFT, D_DOWN, D_DOWN, D_RIGHT, $ff
.two
db D_LEFT, D_DOWN, D_RIGHT, D_LEFT, $ff
.three
db D_LEFT, D_LEFT, D_LEFT, $00, $00, $00, $00, $00, $00, $00, $00, $ff
.four
db D_LEFT, D_LEFT, D_UP, D_LEFT, $ff
.five
db D_LEFT, D_DOWN, D_LEFT, $00, $00, $00, $00, $00, $00, $00, $00, $ff
The actions seem to occur in reverse order. Hence, preliminary path one (facing Gym guide from left) is actually Right>Down>Down>Left.
As for the main paths, they appear to be stored in a special format so that Game Freak didn't have to write the same direction multiple times;
An example from; https://github.com/pret/pokered/blob/725b86ebbec23bd1f53fd60bf0201c904fee951d/engine/overworld/npc_movement.asm
RLEList_PewterMuseumGuy:
db NPC_MOVEMENT_UP, $06
db NPC_MOVEMENT_LEFT, $0D
db NPC_MOVEMENT_UP, $03
db NPC_MOVEMENT_LEFT, $01
db $FF
; So the direction is defined, followed by a byte indicating how many times it must be taken.
When you follow the path, the directions are stored at a buffer from CCD3 (however directions are stored backwards; with the last at CCD3 or CCD4). It seems (??) this works with CD38 to determine which direction from the buffer to choose, which is decremented afterwards until CD38 is 0, and if you use a memory editor to change the CCD3 buffer while moving, you can temporarily create custom paths. However, it would seem because CD38 is one byte; paths can only be a maximum of one byte.
So it seems the Brock Through Walls paths (at least with the main non ACE method) are not a main glitch script pointer, but a glitch preliminary script pointer.
When the mass corruption occurs (including hold B for walk through walls), it is also because the CCD3 size is too large.
I tried creating an Oak Through Walls, but it appears he may work differently. I tried setting D5F0 (D5F1's Yellow equivalent) to 1 to enable the "Hey! Wait! Don't go out!" message (which is possible with expanded PC items) when entering Pallet Town, and I changed D35D (map) to 0x00 on Pewter City (which uses the same bank as Pallet Town so is safe even if you don't change D36D-E) on the same coordinates used for Brock Through Walls, then used 9F to load Pallet Town with those coordinates.
Surprisingly, after a while the Start menu opened like in Brock Through Walls. Sadly, possibly only the x-coordinate is checked here, and I couldn't find any walk through walls stuff. But x-coordinate 0x77 enabled me to fight a wild MissingNo. (like hooked Dragonite). It froze the game so I couldn't tell whether it was hooked or if you could fight it.
Additionally, in corrupting CD2D/CD2E with Brock Through Walls, we can get Pokémon normally unavailable with the Trainer escape glitch. https://forums.glitchcity.info/index.php?topic=8872.0